skysight-inc/HackerNews huggingface dataset:
Pretty much every tutorial I can find on using controllers in Rails uses mass assignment, and the majority of them (including the beginners guide on guides.rubyonrails.org) don't mention attr_accessible or the security risk in allowing unrestricted mass assignment.

We're telling people to RTFM, but the FM doesn't say a thing about how this is dangerous.

If it was considered standard to avoid use of your brakes at all costs, and accelerate at maximum speed at all times, and this was reflected in the owner's manual - sure, I would think cars were unsafe.
>Remember we are based in Singapore. There are quite a few government funds for entrepreneurs to tap into and most importantly they don’t take any equity at all.

The more I learn about Singapore the more I like it.

Also, given the quality and humor of your article it's probably best that you didn't outsource that press release. You write better than a lot of writers out there.
Lawn Collection for Girls & Women 2012
Lawn Collection for Girls & Women 2012
There's an old debate over what constitutes "gray hat" hacking, and whether it's moral.

I haven't looked at Egor's actions too closely, but he seems fairly close to a "white hat". He's been a bit immature, and so has Github, but there's been no real lasting damage.

Anyone who's written a web app knows that mistakes can happen, and they take time to fix. I'm sure Github will handle the PR crisis with an informative and unbiased mea culpa (even if they secretly think Egor was a bit brash). People will keep using them, because their interface rocks.

This will stay on the front page for about 24 hours, then there will be a few link bait articles that also cash in on it, but that's about it.
I wholeheartedly agree. I had some code that had to parse several different .ply files and creat the respective 3D models, and without web workers, the process was unbearably long.
If someone made a mitre saw that didn't have a guard over the blade, and people were getting their fingers cut off, I'd absolutely blame the tool.
I agree that a lot of small companies have really unrealistic expectations about these kinds of things, and I cringe whenever I hear about a 3-man shop who drops $10k so they can get a booth and attend a trade show or something. I just don't see that investment ever being repaid.

However, 7.5 "man days" really isn't that much in the whole scheme of things. Most small teams lose that much in a weekend. Plus, if the Singapore government is paying the entire bill then you're not spending your own money. To me it sounds like a (somewhat crappy) paid vacation. There are worse things to do with your time.

One final note: I think setting target goals for blog posts, customers, and investors is an excellent idea. It helps to turn very vague "networking" into a goal-oriented task. I have used the same technique in the past to help gauge the value of spending my time and resources at various events.
Little Rose (2010) | zee4fun.com
You can make a dummy device that works exactly the same way but has a large physical footprint can't you? Yes, it has a higher cost, but POS systems are very costly too.
"The guy reported the issue on Friday, they fixed that specific instance of the issue ... and it remained a problem in other places."

If I have correctly understood the issue, Igor at first informed Rails, and this was the right thing to do. He was ignored by Rails and then he wanted to proof his view point by applying it to GitHub. How could GitHub inform other places? By contacting Rails, but they already downplayed the issue...
The data science debate: domain expertise or machine learning?
Ask HN: Can anyone recommend a timer?
Lookin' for a timer so I can keep track of how long I've been coding for. I need the timer to run when I start it, stop when I stop it, carry on from the previous time when I start it again and/or keep a record of sessions/total time.

Any ideas?

Cheers! :)
This is why open source works. People can make matches and fix up the original content.

If only all content like this was open source.
This is going to be more of a pain in the ass than Vista's Security popup or whatever it's called. It'll be the #1 way to make users hate using your application, I assure you.

Badges need to enhance the application not interrupt it. I have never seen a badge application pause the application to award you with the badge. The entire concept is pretty nuts. It's a good idea, such a shame about the implementation.

Mozilla can easily provide an interface to delete badges you don't want, or ban applications that spam you from the badge system. The whole threat model idea is just self-sabotage.
Résidence Alicia - Défiscalisation Scellier Dom & Girardin 2012
From user point of view using flash as GUI is a better idea.
http://code.google.com/p/lua-alchemy/

example:
http://lua-alchemy.googlecode.com/svn/trunk/demo/index.html
Pigeons outperform humans at the Monty Hall Dilemma
Or for example an oil company that wanted to remove images from searches like "piper alpha" or "Bophal" I am sure Dow would love to have those images removed.
Mark Zuckerberg Seen Not Rich Enough for Global Daily Billionaires Ranking
> Beside the non-commercial clause, when applied to source code, it is roughly equivalent to a BSD/MIT license.

More like the GPL, SA is CC's copyleft.
(I didn't downvote you)

> Does exactly what you'd expect it to do.

Given the existence of attr_accessible, attr_protected, a global on/off switch for the default behavior and nested attributes, you cannot tell what that line does without knowing the contents of at least two files.

And Rails 3.1 does have the concept of roles (not necessarily of users), baked into the same mass assignment logic into the model via the :on argument.

I'm not saying that this is all bad or a bug even, but I don't see how this is trivial to the reader either.
The 5-9 Startup: Launching a company while working full time
That's a good question. I'm not sure if there's any list of issuers. However, it is an open project and therefore any entity could become an issuer. They list a few possible sources on the FAQ. I think many of the code education startups, such as Code School, Treehouse and Codecademy would be an excellent fit.

[1] http://openbadges.org/en-US/faq.html

[2] http://codeschool.com

[3] http://teamtreehouse.com

[4] http://codecademy.com
The cynic in me thinks that the site was cheap to buy because of the tradedgy - and Hes trying to pull a fast one.
One that I quite like but have not tried yet is: "What is the reason this role is available"

This provides insight into if the role has come out of an expanding workload/new projects or replacing an employee.

If it is to replace an employee you could follow up with "how long were they with you". What you are trying to do is get hints of if there is high staff turnover. You could also add in some more questions about staff retention but this could lead to some uncomfortable situations and might not go down well with the employer, as Stonk has mentioned already.

The other side of this is if they have new projects or increased workloads. This will lead you into discussion about the projects/work and hopefully let you get a better idea on where the role will fit into the company.
How is that so very different from, say, kidnapping someone's children and holding them hostage until they fix whatever you want fixed?

The problem here is that when you violate someone's trust you change the landscape. People get scared, they question your motives, they go into a fight or flight response. Yes, this sometimes results in the problem being fixed faster because they are very much more motivated now, but the same is true if you kidnap their family, right?

If you think someone is letting down their customers by not responding fast enough, then you go public. But violating trust is a quick way to end a professional relationship.
I'm in Austin, but I moved here just recently so I wasn't around for the last SXSW. As far as active HN community, there was a thread about it ages ago, but nothing ever happened (http://news.ycombinator.com/item?id=3221674). It stands to reason that we might be able to arrange something with the greater HN community with SXSW.

I'm not going to SXSW as it's not in the job description. If anyone is going to be here [http://lanfest.intel.com/?page=event&eventid=1874] on Friday around ~3pm I can probably meet up with you.
اجمل مسجات عيد الام 2012
AT&T Clarifies Data Limitations on "Unlimited" Data Plans
> Let this be a reminder to you all. Build the hell out of your network.

Not that this is bad advice, by all means, but I think there is a more concrete lesson here:

> I went so far as to convince her to quit a great gig back in Chicago (knowing she could work remotely)

In most cases - including this one if I understand correctly - you don't need to quit your old job and then find a new one. You can and should do it the other way around.

Best of luck on the search.
Was always tempted to do the same. Heading there next week.

How'd you sort out the visa? Extending each month, or doing a visa run every 30 days?
Yes and ironically the First NT Ship was built in the UK at Cardington - I rember seeing it and its predecessors from airship industrys flying over bedfordshire.

Quite a shock to see one of the Airship Industry Airships parked at Cranfield when I got to work one morning
Whilst possible, this is a) more unsubtle and b) still limited to a single device - but good point.
Same here (your first sentence).
Something like that? http://www.xul.fr/javascript/regular-expression-tester.php
The language here is lua, a structured language, rather than a thin instruction layer over hardware. If it more of an API behind it (e.g. ability to work with sound at a low level) then the result could be better.
Gutter repair Manchester
Gutter repair Manchester are the best providers of Gutter repairs and building. They provide Gutter repair and Wooden Guttering services in Oldham, Manchester & Stockport
That would just be ruled unconscionable by a court anyway, but I agree in principle that the whole practice of "by using our website you agree to these umpteen pages of small print" is silly. Browsing a website shouldn't require any terms of service (obviously submitting data is a bit different).
That's cool - a reference would be good as well. I've always used RegExr[1] which combines such documentation really neatly.

1. http://gskinner.com/RegExr/
Hydroponic Grow Equipment Store
The Perfect Harvest sells all your Hydroponics Grow Equipment and has all growing needs covered
Making a First Impression
No, it would still be an emergency, but the response time (unless guaranteed by a SLA) would likely vary. Does GitHub have a SLA?
I'm not intimate with the Ruby community, but the quality / quantity / culture of the community surrounding a programming language seems like a reasonable consideration to me.
British Airways and Iberia IT consolidation aids £112m savings
Zuckerberg Doesn’t Rank on Billionaire Index
Beautiful Cars
You should propose a workable solution before making statements like "Google seems to favor the troll". How would you solve this problem given that manually removing the results are probably out the question for legal reasons?
Transloading Services
CDS’ transload division specializes in container processing for import and export. Our experienced crew of full-time employees will coordinate freight between port and warehouse ensuring the timely processing of your product.
I would venture to say a majority of American 20-somethings use a card as much as possible. My bank PNC has a decent toolset that allows you to do a lot of things automatically and includes a basic budgeting tool. It's pretty cool.
#Startup accelerator LaunchpadLA shares insight for entrepreneurs - SamTeller
How to Declare and Assign a Variable in SQL Server
Somtime we need to access a user define variable inside the SQL script. The variable is the name of the memory location that stores some specific value. and also another property of variable is that its value can be vary or we can say that its value can be changed multiple time during the execution of the program.
Site freshness only matters for certain categories/topics. For other topics you could say the older the static content the better. Some of my best ranking/money making pages have not changed in 8 years and rank better every year, without doing anything.

Regarding ranking algos, you did not mention the Trust Rank (there is a patent G filed some years ago). A low Trust Rank is equally bad as a low Page Rank. I don't really know much about it, but afaik it has to do with the trust that G has collected on your site, while Page Rank is based on individual pages. If you link to "bad neigborhoods" (another important term, think casino sites, v*agra, etc.) your TR will go down for example, and its hard to get it back up. If National Geographic links to one of your pages, your site's TR goes way up.

And then there is the number of pages on your site. Google will only crwal a limited amount of pages from your site, depending on your Page Rank and distribution of incoming links. So try to keep the number of crawlable pages focused to the relevant pages (ie the ones you'd like to see in G's index).

After some time and if you have tons of links, you will see a "deep crawl" with a bunch of Gbots hammerings you server and downloading many more pages a day than usual.
OLPC and Microsoft
I'm worried I won't be able to explain to my kid this part:

as3.class.mx.controls.Label.new()
But I wonder I all that Metro does can't be made throught Node.js too. I started some experiments about that.
Reinventing Smalltalk? Nice job.
It's open source, but not free software.
I was actually surprised it came out, they had some teasers on Reddit a few days ago and I thought Nintendo laywers would have showed up by now. Copying game mechanics is not a big deal, but reusing trademarked and copyrighted sprites (of the main franchise from one of the richest companies on the planet!) is a bit too much.
Totally agree. The problem is the idiom of using mass assignment, which IMO should almost never be used.

This is not a bug or a security hole in Rails, but an issue with programmers not paying attention.

If Rails had no attr_accessible feature, it would be standard practice to always filter attributes in the controller, and no one would call this a rails issue - they would put the blame where it belongs: Github.

Instead, because attr_accessible exists, people are flaming that it should be enabled by default.
Mozilla’s Boot 2 Gecko and why it could change the world
I've always wanted to know about the 'international version' of Eftpos. A lot of internationals get confused at our Cheque/Savings/Credit.

Also, the large majority of banks offer Mastercard/Visa debit cards where even though you press 'Credit', its your money from your Savings account. You get the benefit of more consumer protection via Mastercard/Visa, as well as contactless payment and sometimes not having to sign or enter PIN
Does it use Smart HTTP Transport? http://progit.org/2010/03/04/smart-http.html
On the other hand, you made it to page 1 on HN due to your going to the conference and blogging about it. That should be better than the 3 blog posts you aimed at :-).
There's also Bananajour if you want to share on the local network: https://github.com/toolmantim/bananajour
I've coded in Rails since forever (0.5) and I honestly don't see how that dongml thing is funny. I'm not even able to understand how it is supposed to be funny, is it the dicks?

For sure I think that a language shouldn't be avoided for something different than technical reasons, and nothing else.
New computers respond to students' emotions, boredom
хех :) молодец
What I learned when building Leavetrack
From what I understand In-app purchases (where Apple gets a 30% cut) are only required when the item is only for use from within the app (virtual currency, level packs, digital subscription etc). Purchasing a physical items does not require transaction to use Apple's IAP API. In fact, it is expressly forbidden.
Browser of choice? I don't think so.
When it comes pre-loaded with the os
its no longer a choice. Especially since
a lot of phone users have no idea there are other browsers.
I'm curios, the difinition of open source implies (demands) more than making the source code available?

Just in case I'm not talking in a broad sense, I'm asking whether just being able to see the code is enough to consider a piece of software open source.

Thabks
Name 2 please, so I don't have to build my own.
Awesome iPhone app ideas
Emerson Ecologics : Nutritional Supplements, Vitamins & Natural Health Products
That looks pretty neat. Is it just a bonjour enabled web interface, or does it do other stuff? If it's mostly a web UI, you may be able to expose that using PageKite too, for sharing over the Internets:

pagekite.py localhost:9331 bananajour-youraccount.pagekite.me
http://www.getharvest.com/

I ude this service. It's mit free but I think it's worth it. You can create clients/projects and set Tour pricing individually. There's an iPhone app to manage it also
, I don't know if there's an Android app aswell..
F# and ASP.NET Web API
Year 2012 is a Leap Year
This isn't breaking into someone's house and leaving a note.

This is breaking into a huge commercial factory with thousands of clients, where you could cause colossal damage, and only leaving a note.
My iPhone corrected some words for me, so excuse the spelli g.. :)
I dont think we're discussing real solutions to the mobile computing problem here - just stop gaps.

The issue with doing real work on a tab or smartphone is that touch is not a fast or accurate input medium - mice and keyboards are much better suited for it.

However, it would be foolish to think this will always be the case. Some combination of our devices recognizing new gestures (grasp, cup, etc.), advances in interface design and voice recognition will eventually disrupt the keyboard and mouse. Since our data can basically be stored in a number of device agnostic ways already via cloud computing, user interfaces for interacting with that data are only going to iterate faster and faster.

I think the problem of creating content on the go is going to be solved in the software too soon to warrant a whole product line that merges keyboards and trackpads into our tabets.
Sorry for being off topic, but I thought the correct word would be "applies" in this sentence. Could anyone educate me, please?

Sinc., a swede
SiriCorrectInfinity tweak helps you to change Siri query infinite time
I think idea today is 0% it's development process that matters.
I'm sorry, but you (as ZeroGravitas has already pointed out) have only convinced me that you don't know what anarchism is. :)

https://en.wikipedia.org/wiki/Anarcho-communism

https://en.wikipedia.org/wiki/Anarchism

https://en.wikipedia.org/wiki/Council_communism
Warren Buffett: Crony Capitalist
It's hard to know how much value you'll get out of different kinds of marketing.

The $10k or so cost of having a conference booth helps me put other kinds of marketing in perspective, in particular, it helps justify spending $5k on something else that that I think would pay off better.

Note that there's psychology at work even for more established companies. I used to work for a company that, for years, rented a booth at a large conference in Las Vegas -- the president of the company told me that he thought going to the conference was not cost effective, but that if he stopped going, people would have thought we'd gone out of business.

Funny, I talked with a guy who sells newspaper ads who finds that he brings this one up every time a local business questions the value of newspaper advertising.
Android apps cost more than iOS apps
I agree there are a number of complex issues here, however that line of code still obviously takes ALL content from the outside world and directly updates a model with it. Any developer who does not spot that as a security issue is probably creating many others as well. Rails can not protect against developers not understanding that form submissions can contain any content and should not be trusted or applied directly to models without understanding what's happening. A cautious developer would slice up the submission to update the model with only the expected or allowed fields.

I just learned of the new role feature for attr_accessible because of this controversy. This seems to solve one of the major issues with attr_accessible - that different controllers and users need to update different attributes, so any somewhat complex app would end up widening it's attr_accessible attributes beyond what they should be.

These are still blunt tools though - what if only superadmin users can update a role column to superadmin, but admins can update it to admin or guest. This requires more extensive logic in the controller than simple attribute filtering, demonstrating why this filtering really belongs outside the model. Despite that, I think the new "role" based attr_accessible probably covers most cases and seems quite useful.

For all we know, GitHub may have been using attr_accessible but have expanded it to include columns updatable by admins.

Thank you for the thoughtful comment - perhaps there is hope that HN hasn't been entirely taken over by people talking out of their asses.
Why You Should Leave Microsoft, Too
The subject in this sentence, "two sources of stress," is third person plural. Verbs are only conjugated with -s for third person singular in English.

One source of stress applies

Two sources of stress apply
If there was only one source of stress, it would indeed be "A source of stress that (probably) applies to you". But because it's two sources, apply is correct.
You might want to follow Avinash Kaushik (hopefully I wrote it right), his blog is quite popular and for very good reasons: http://www.kaushik.net/avinash/
His book, Web Analytics 2.0, is an eye opener in terms of defining your own goals and processes, highly suggested.
I agree, I want to add low level things like POKE to write to the screen memory. Sound would also be awesome.
I get that these terms do have specific meanings, but it bothers me that those meanings are so restrictive as to be unintuitive to someone not steeped in the dogma of the community.

These people made the source openly available and, by the CC license applied, can't it be modified and redistributed? That feels like "openness" to me. Thus, this feels like "open source", but technically the open source proprietors haven't opened the term "open source", so it's not.

Or have I misunderstood the license in this case? I admit, I am posting before looking, because the time it would take to look could make my post irrelevant.

Correction: I just went and looked. The license acts as I expected and has a digestible compact form for easy consumption.

Now I've gone and looked at the OSI site, and the CC license is not one they have approved. Yet they provide the material on the OSI site as CC licensed.

This distinction suddenly just seems dumb. Can someone elucidate it, or its use, please?
The vulnerability was public, known for years, and no doubt already exploited. Making a splash about it on GitHub, popular as it is with rails hackers, is the best thing that could happen to the security of the rails ecosystem.
I'm mostly interested in whether you would hold it against the CEO for asking your opinion on the matter. It sounds like you might be implying that the CEO shouldn't even be considering the decision, whereas I would assume a CEO working with you would want to feel like he can be open with you about his/her dilemmas.

Of course I might be really misreading here.
In his master commit he commented that next tattoo would be real :-D
I think this can be simplified down to a single word - uncertainty. Thats the cause of stress.
Right, but in this instance the 'terminal' to confirm your pin and POS application are one and the same, and ultimately just replaceable software on an iOS device.