skysight-inc/HackerNews huggingface dataset:
Ensuring input is properly validated is always the developer's concern. A framework can make that easier for you, but especially in cases like this, which are basic user authentication concerns, it is ABSOLUTELY the developer's responsibility to be 100% sure how all of those abstractions work and ensure there are no leaks anywhere.

You can't punt on security. Abstractions may make it easier, but you better be damn certain how they work.
Why would you think that population density would be the limiting factor when NYC, SF, and other dense urban areas in the US don't have internet access that's as fast and cheap as is available in Japan and Europe?

Note: I'm not talking about access to the vast majority of unpopulated area that is the rural US; I'm talking about the well-established high-density urban areas.
Really splitting hairs here. He committed a change to a repository that wasn't his. He altered files that belong to other users, albeit benignly.
I'm usually a nice guy, but I'm an absolute jerk when it comes to my inbox:

- If a service's registration has the "send notification" button checked by default, and I don't see it when I register.. well each time I get an email from the service, I flag it as spam. Damn, these things really should be opt-in, not opt-out.

- If the unsubscribing takes more than exactly one step. I flag.

It's a bit harsh, but I don't like feeling trapped. The OP's right: unsubscribing should be as simple as clicking on a button.
I wondered why I was suddenly seeing x264 instead of AVI for TV files. I thought it had to do with the lockers going down.

Well, in a way this will make things even worse for the CopyNazis. No longer will people have to convert from AVI to watch on their tablets and phones.
I think it's interesting how sometimes the "immature" course of action is what brings the greatest good.
the post at https://github.com/blog/1068-public-key-security-vulnerabili... says "Database and log analysis have shown that the user compromised three accounts (rails and two others that appear to have been proofs of concept)."

do you have any evidence for your assertion? (and why the downvote? i'm just reporting the facts....)
The LinkedIn throwdown
The blog title is a significant misnomer, IMO. The vulnerability has nothing to do with public keys, but with the incorrect configuration/use of a Rails feature. This vulnerability was then exploited to add a public key to the rails/rails repo, but apparently could have been used for other purposes [1] that are unrelated to pushing to a repo.

This seems like an omission that may have people worrying about the wrong things or drawing the wrong conclusions if they don't take the time to understand what actually happened.

[1] http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.htm...
Fun tends to be best enjoyed in small groups.

The auto industry is far from a joyless place, engineers at AMG or BMW design products with the aim of fun, great design for the sake of it over economy is the only reason they exist.

I'd wager that the person administering databases at Citibank tends to have less fun during the day than somebody making a living developing apps for their own company, in much the same way that designing transmissions for a formula one team is more fun than designing transmissions at GM.

That the bigger an organisation gets the less fun it is, is the most important force driving start-up creation and there is still a far greater untapped frontier available to us than any other industry to date.

The future is so fun its blinding ;)
I'm not saying he is a douche for breaking into github. its more like how he acts and what he says:

"Then, I could make a post pretending i am DHH. That was funny too."

"GH sorry, I was bored."

Im sure everyone has different definitions, for me its just someone that I wouldn't wanna hangout with on a personal level, that's all.
I think the biggest fallacy these days is that "programming is easy". I bet pilots think flying is easy, and surgeons will repeatedly tell you cutting someone open and removing this vestigial part of the cecum is routine, but if you did that the patient will bleed to death from the first incision.

My point is that coding might be easy for you, easy for me, and it must be easy for most people here, but the rest of the world?

I'm going to sound like Spock here but most individuals out there aren't logical. People out there don't thing in terms of ¬P->Q, so for them even the basics of programming are very hard, if not impossible to understand.

And even if you work around your limitations and learn how to program there's a long way between "hello world" and the engineering behind the kind of stuff that motivates most people to learn how to code, like building the next Google.
It says they've cleared out homakov's modification, but I gather this vulnerability has been around for a long time. Is it paranoid to worry about malicious commits to other github repositories? (By other more surreptitious parties?)
You still have it and all of its history on your own machine. Git is distributed, a central web-based repository like GitHub is useful but not needed. At all.
Exactly. The guy might not have the best English or highest level of maturity, but it's not like he found a flaw and ran around saying, "Haha, look what I can do!" with no justification.

He submitted a security flaw to the Rails issue tracker. It was shut down by committers saying, "This isn't a real flaw, it's everyone's responsibility to secure their own apps."

At that point, a reasonable response is, "Yes it is, you dummies. Watch as I use it to pwn multiple high-profile production rails sites."
Gezondheid: hoe stress voorkomen?
Well, of course. You think they should be contractually obligated to provide service to all customers no matter what forever?

It seems only fair that if I'm allowed to cancel my account with no notice and no reason that they at least have the ability to do the same.
I would have found the article much better if there was more discussion of the "highly efficient indexOf function". It sidesteps the whole discussion of algorithms to appeal to some magic black box with no explanation of how it works - in this case it seems like the speed advantage might very well be because that's implemented in C rather than his KMP implementation which is all in Python. That's still a valid reason to use the approach instead if it means the result is faster, but I'd have preferred to see some more discussion of what was going on behind the scenes.
Not sure why so many are getting worked up about the suspension.

Would you not at least temporarily suspend a user account that had compromised your stack for audit and temporary prevention of further new developments?

If they meant to remove the account or target that specific human user, would they not have made a statement to the fact and done something a lot more irrevocable and unambiguous? ...
That's the purpose of sending attempted uses of this exploit straight to the highest place possible: so if he does, they know

Working with him to do what? He pissed about a little with WebInspector, it doesn't make him a security consultant

He threatened to do more damage to your site, why wouldn't you suspend someone like that?
As an embedded developer/EE, I feel the same way, but from the other side. There is too much breadth for any single person to be proficient at all 7 layers, but from time to time, you still see job descriptions that ask for assembly, C, C++, Java, PHP, HTML, Python, CSS, Flash, Haskell, PCB Layout, VHDL, 7 yrs iOS...
Actually now that they've suspended him, I kind of wish did some real damage. The whole 'get hung for a lamb' saying.

That is why I don't really believe in 'white hat hacker' label. Organization when humiliated by their vulnerability strike back and treat the white hacker as a criminal. Or I guess since he actually modified a file or to instead of just publicly commented about the theoretical vulnerability, he is now a gray hat hacker ... ? But if he just blogged about the vulnerability without proving it, he wouldn't have been taken seriously and less people would have believed him (did you know about this guy before this happened? I didn't).

That is why I think, as an individual, if you hack, always be a black hat hacker. Organizations do not have mercy and will not treat you with respect if you just break in to point out a problem to try to help them. So might as well do some real damage, hide and or profit from it, by selling it on a black market.

(Note, not saying that I condone, or personally agree with such activities, just proposing a better course of actions for those who do).
A relational database is a big spreadsheet that several people can update simultaneously

As someone who works on a "big spreadsheet that several people can update simultaneously", I can't resist making an off-topic comment.

The analogy between spreadsheets and relational databases is seductive because both appear to use tables (actually, spreadsheets use a grid addressing system which only looks like a table). But really the two are from different planets: their data models as well as their computational models are incompatible. For example, compare how databases relate data (foreign keys) to how spreadsheets do it (cell references). What do these have in common? Basically nothing.

The point may seem esoteric, but there have been lots of attempts to combine spreadsheets and databases and they all run aground on this mismatch. Crude integration a la import/export works ok, but the perennial dream of having a true spreadsheet on top of a relational database is out of the question unless you sacrifice efficiency, which you can't. I do wonder sometimes how far you could get implementing SQL on top of spreadsheet data.

As an aside, it's interesting that the research literature on databases is vast and rich while the literature on spreadsheets (alas!) approximates nil.
How To Manufacture Desire
"The idea of having a laptop with a detachable screen is good, but for now it's probably still not possible to stick the capabilities of a normal laptop into something that would pass as a handy tablet."

This use case is clearly part of the reason behind Microsoft's Windows 8 ARM strategy.

Within a year I will almost certainly own an x86-64 laptop with a detachable screen that happens to be an ARM based tablet that can run independently of the main system, so long as you're just using the Metro apps.

Apple could do the same with OS X/iOS, of course, though if they don't have an announcement for this on March 7th I wouldn't hold my breath for a while after that.
It was a 0-day in github allowing malicious code being committed to any project. Egor never (seemingly) took the appropriate steps to inform anyone of this vulnerability in github.

Whether or not rails' defaults are sane is a completely separate question. Egor acted out against GH when he was ignored by rails dev. Two entirely different parties.
I've been trying out a bit of a different setup and finding some interesting results so far.

I switched from an iPhone to a Samsung Galaxy Note to try and achieve a few things:

- I liked owning an iPad but didn't like carrying it with me in addition to my laptop.

- I liked consuming information on my iPad. I wanted to continue consuming information on a device.

- I liked trying to make my iPad my sole device for communication (Facebook, twitter, email, IM, Skype.) If I could do it on my iPad I could block out those distractions on my laptop. I live not running any notification stuff on my laptop when coding. I really like being able to come to my communication device and find that there.

- the iPhone seemed to small to use as an information consumption device, iPad too big to carry to do the same. If I wanted a physical keyboard on my iPad I could get a MacBook air (which I did and its working great for that purpose)

- my iPad became strangely redundant in my use case after getting an Air because I wanted a light device to carry around. Ended up selling it.

- The Note fits in my pocket. It's thinner and lighter than an iPhone from everyone who's compared the weight

- The Galaxy Note seems huge as a phone but small as a serviceable tablet. The high screen res makes it very usable. I've been varying just the note and my air and its almost starring to feel like I'm where I should be.

So, maybe you're looking for an Ultrabook and a 'Phablet'.

I'm going to ride this out until the iPhone 5 is available to re-evaluate then.
Provided that the he did so and made the change public, and the modification was not malicious?

Yes. I'd even send him a thank-you email, and add him to our list of contributors.

I'd then of course contact the customer (probably over phone, as quickly as possible), explain the vulnerability, explain what happened, and explain how we were fixing it. Then I'd write a post about it, and put it on the front of the site.

That's how you do business.
CreateJS, a suite of creative Javascript libraries and tools
Funny, I thought you were going to argue that the other way. That the "right" thing to do is start a dialogue with him, but the pragmatic thing is to ban his account at least until you sort things out on your end. Guess that just shows how tricky these issues are.
If he used a known vulnerability to break into github, then he didn't break in, he walked in.

Admittedly he did then do the online equivalent of pissing on the wall, so minus several million points for artistic endeavor.
Yes, but about 100% of email clients now don't load images -- whether webbugs or actual content -- because of that. This BGSOUND tactic certainly isn't standard practice, despite being an extension of a prior technique, extended specifically to get around the existing filter.
Well, it's a beginner-level Rails mistake; it is not precisely an obscure issue. Googling 'attr_accessible' will show you discussion going back years, and it has been actively exploited before. I'm shocked that the mistake was made in Github, though.
Personally, the tablet form factor is great for consumption. For example, watching movies or casual web browsing.

For me, I don't have much use for a tablet on the creation side but suspect it might be of use for specific requirements, people DJ'ing etc.

But my mindset has always been: right tool for the job. Trying to use a tablet as a laptop probably will be very frustrating in short order.
I read more negativity into your comment than I should have. Apologies.
The fact that anyone is talking about any of this speaks volumes about how skewed some people's priorities are. The author of this article comes across as a whiny bitch, and the author of the article in question comes across as a douche-bag. Can we get back to discussing meaningful topics?
To me, it seems like a poorly designed posterous/tumblr clone. I'll pass.
This is not a rails bug, but a github bug. The discoverer reported it in the wrong place, the rails people (correctly) told him to report it to github, he ignored them, and this hilarity ensued.

While this is a legit bug on github, and Egor deserves credit for finding it, he also deserves a scolding for the classic noob mistake of not reporting it to the right place.
Or if you want to keep your account, don't tell GitHub, but sell the vulnerability on black market and make some profit off of it.
That said, when your tools generate an insecure scaffold by default with no easy path to discovery on how to fix it, your tools do have a security flaw as well.

You can't expect all of the developers in the world to be literate in security, especially the ones who choose batteries-included web frameworks as their go-to.
It's because there's a huge amount of competition in the "scene" to get first and best copies of a show. In order to declare a "winner" in the competitions, there have to be rules.
It's hardly irrational to distrust someone clueless enough to go into a job interview with a popped collar. This isn't really limited to the tech world.
Unless you have a particular project in mind, I don't think you can just "learn a new programming language". There has to be some context for it.

Perhaps better advice is to seek out a new project in an area you're not familiar with and use the opportunity to seek out the best tool to solve that problem regardless of the technologies you already know. If you need to build a server process, maybe that would be a good time to look into node.js. If you need or want to design a web application look into Ruby.
I agree security vulnerabilities should be addressed by the company as much as they can. But there's no such thing as a perfectly secure system, so there will always be some amount of vulnerability. My only point is that there are ways to communicate with companies and help them fix things without committing a crime and breaking them.

I wouldn't throw a brick at a store window to make sure they have an alarm installed. Likewise, I wouldn't screw with someone else's production system to make sure they have X or Y security vulnerabilities patched. If you're worried about your own data, then try the exploits on your own account, or repository as the case may be. If it's a concern, get a hold of the company and let them know.
Anime groups can afford to be much more aggressive about technology because they have special requirements that older tech doesn't allow (styled softsubs, multiple audio/sub tracks, ordered chapters), and because their audience is overwhelming using high-performance PCs because nothing else commonly supports those technologies. In fact, modern anime releases are basically targeted towards one platform (Windows PC with MPC-HC and CCCP[1] without DXVA) with coincidental support for Mplayer on Linux because it uses the same basic open source codecs and splitters. Hi10p is even more aggressive - when they started releasing Hi10p releases, the only decoder that supported it was ffdshow alphas, and even now software support for it is very sparse. Hardware support is non-existent, and will continue to be so unless a mainstream content provider like Apple decides to start releasing Hi10p video content.

On the other hand, people who watch non-anime scene releases are much more likely to use mobile devices, set-top boxes and other A/V equipment that relies on hardware decoding support. One of the major reasons that scene releases are standardized is so that they'll play on a wide variety of hardware, and this results in a much more conservative approach than anime groups. The main reason they're moving forward with this change is because H.264 has acceptable support in hardware (primarily in the MP4 container, MKV support is awful) and XviD is really showing its age compared to modern H.264 encoders like x264.

[1] - Media Player Classic - Home Cinema (http://mpc-hc.sourceforge.net) and the Combined Community Codec Pack (http://www.cccp-project.net)
Kill Your Introduction
That is why this just seems like petty bureaucratic revenge. It looks good for PR purposes and placates other users ("look we got rid of the problem, the hacker has been eliminated").
I think something more fun for kids would be (apart from the obvious game platform) some kind of communication device. Something like walkie-talkies.. but maybe communicating via IR LEDs with morse code rather than voice. Another idea is using the R-Pi as a counter for a LaserTag-like game.
I remember reading years ago (possibly on Wikipedia's Scene article) that the multipart RAR thing was for faster distribution among the network of servers: Other servers can start downloading parts before the current server has finished fetching everything.

There's many layers of hierarchy (from the release groups themselves down to the hoopleheads at the bottom) so it speeds up releases significantly.
Respectfully I think I am right:

"I don't know how hard the tv groups are pushing for early release"

Why do you think they are called racers? "Early release" as you call it is the reason for the season...

"He would have to do everything on his own -- the capping, the encoding, the packaging."

This does not make any sense to me. Who would have to X?
Legendary Star Wars concept artist Ralph McQuarrie passes away at 82
It's a beginner-level Rails mistake but it's very widely seen in codebases: it's a real, common threat.
Actually this is awesome. I now know exactly who not to hire. Please, brogrammers unite! You have nothing to lose... except working with me! :)
What filter is this getting around at actually? Since the article / post says it only works for email clients that have "show images" enabled, I'm wondering what the added value of using this technique is?
To be clear: we all had (past tense, as I'm assuming GitHub effectively fixed it) that "way to cause damage to GH"; it isn't a bug that Egor was hoarding, or that only he was in a position to exploit. You can argue all you want that he deserved to have his account banned (I might even agree with you, although I haven't come to a conclusion on that yet), but to claim that it was some kind of required protection that people would legitimately be able to complain about had they not done it is silly: he can still do the damage from a new account, and someone else can do that damage even if he didn't want to.
Is always good to have more MRI scanners.

I just want one of them. Is that ok?

[ I want to scan beez :) ]
> I only ask because we were never taught about bit shifting at university

At CMU, three of the first four intro programming classes discuss bit shifting in depth.
This reminds me of the Spartan project and all the money FB is burning to get around APPL policies. I think in the medium and long term this overly restrictive appstore strategy and the limitations of mobile webapps are going to backfire, similarly to how Nintendo's 3rd party policies of the '80s backfired soon after the NES. Initially it made a ton of money, but then it lost the market to the likes of Sega, Sony and MSFT.
Perhaps add some screenshots, or tell us a little more about the app on your site? There's not much to go by as-is...
Since the article / post says it only works for email clients that have "show images" enabled?

It does? Someone mentions that they had loaded the image bug, leading to someone else making the show image comment. BGSOUND would not be filtered by that.
Here’s the gist:

- The degree to which a company can utilize habit-forming technologies will increasingly decide which products and services succeed or fail.

- Addictive technology creates “internal triggers” which cue users without the need for marketing, messaging or any other external stimuli. It becomes a user’s own intrinsic desire.

- Creating internal triggers comes from mastering the “desire engine” and its four components: trigger, action, variable reward, and commitment.

- Consumers must understand how addictive technology works to prevent being manipulated while still enjoying the benefits of these innovations.
Work 3.0: How The Employment Model Needs to Change
Remind me to never play Prisoner's Dilemma with you.
It's an ASUS eeePC 1015PEM. Unfortunately I don't think they sell them anymore. They've since upgraded the processor to an 1.66GHz N550 which performs better on youtube, but I've heard it gets 25% less battery life.

Display is 1024 x 600 non-glossy.
> God, I hate law.

Sure, but how do you feel about the alternative?