skysight-inc/HackerNews huggingface dataset:
Ask HN: good looking "nerdy" t-shirts?
Hey HN, soon it'll be summer again and I'd love to stock up on shirts. Are there any places on the web for "well designed" nerdy shirts? I'd love to show a bit of geek pride and look decent at the same time. A bit of good typography/design never hurt anyone :)

I'm looking for the usual software engineering / science / ... theme and if possible a bit more on the minimalistic side rather than full prints.

In my case, the price for shipping to Germany is a relatively big factor, but no need to let your suggestion influence that.

As an example: New Relic's "data nerd" shirts seemed to look pretty decent, but I think they don't ship them anymore.
That's true of the UK system too. People get public treatment, but can go private if they wish. There are some restrictions on novel cancer medications if those are shown to be both expensive and minimally effective. I don't know if it's a good thing that dying people are protected from high pressure selling of pharmaceutical companies or whether the government should just allow people to spend tens of thousands of pounds on medication that may not extend their life and may not improve (and may decrease) their quality of life for the remaining weeks they have.
I was going to get an iPad a while back. Basically, unless you're doing basic Web browsing or just playing games, you need a keyboard to do any real work on a tablet. Also, they're light, but still not much different than a MacBook Air - and they're not much cheaper. Tablets still just seem like a novelty to me - toys for gaming and watching movies.

If you want a serious tablet though, check out the Modbooks. They're regular Mac notebooks hacked to use touchscreens. They're good if you do art on your notebook, since you can basically draw on the screen, you get all the features of a full-fledged notebook, and they were around long before the iPad.
>out dated in a few months

This is actually the problem, I don't mind it getting "out shined" I'm not buying it to look/feel cool/for bragging rights - but I expect new software/OS to work on my "old" hardware, at least for some amortization period that's proportional to the price of the device.
This is Windows 8's primary use case. We'll soon see how many people agree with OP
Call yourself a 'brogrammer'? Then get the hell away from me.
That's exactly correct.

If you're working with a pure key-value store, the only query you have is get(), plus maybe a scan over all keys. Stores like Cassandra give a little more structure to the data (column families, supercolumns, etc.) and you can use that to make certain types of queries simpler, but there's still nothing like the algebra that comes with relational DBs. Anything other than the most primitive logic is going to have to be written in client-side code, which is why you see things like MapReduce used to filter down large data sets or other complex client-side transformations.

The advantage of writing on the client is that you get to use whatever the hell programming paradigm you like: pretty much any language that can deal with a hashmap can deal with NoSQL. (That's true of relational DBs, of course, since you don't have to write complex queries; but if you're not taking advantage of the relational structure, NoSQL tends to be easier / faster.)
> [..] there are some problems that have a strong need for erotically background [..]

DYAC? I'm sure you meant "theoretical" background there :)
At the risk of sounding cliche: to me making software is like a toy that delivers what the author described. Sure, I sometimes get disappointed (hours spent hunting a dumb bug) but in the end it is as close to magic as the real world allows. And it has real effects on the real world. I hope this never wears off.
Sounds like a Touchpad or an Android tablet in a case with a chroot to boot Ubuntu. This is what I do with my Touchpad, and it works just like an ultraportable laptop with 10 hours of battery life.
I'm confused. Is this a generic Github vulnerability or is this a vulnerability in tools outside of Github used by Rails? The 'hacker' seems to suggest it's the former ("Github pwned"), which would be pretty serious stuff.
I guess I look at the iPad/iphone/ipod touches more like consoles than computers, where I look at android more as computers.

When you have a console, you want that eco system and hardware to last longer than it takes to develop the next gnu or cpu. Android updates on every single new advancement in mobile tech, which I find completely overwhelming.

It's very obvious that the carriers get overwhelmed because they have significant trouble updating their devices that are over a year old.
Real time Tetris with microscopic optical 'tractor beams'.
Bye Bye American Pie: The Challenge of the Productivity Revolution
Of course, all of the countries with good health care have more regulation, not less. (Yes, even in Switzerland.) Do you know of any countries with minimal health care regulations and good outcomes? I suspect they don't exist, because the preconditions of a functioning free market do not exist for health care consumption (rational consumers, symmetry of information, consumer choice, etc.)
I think it's a mass assignment vulnerability:

https://github.com/rails/rails/issues/5228
GitHub uses Rails. Depending on who you ask, either Rails is at fault for having unsafe defaults or GitHub is at fault for not reading the documentation. It just so happens that he demonstrated his point on the Rails repo because he thinks it's a failing of Rails, but it could have been any repo.
Same thing -- I got a 13" MBA and now basically only use my iPad for Instapaper, as a backlit Kindle, and in the bathroom or on very tiny aircraft. I'll still probably get an iPad with retina display, though. Part of my problem with the iPad is that I really love the keyboard as an input device, part is the screen resolution of the MBA13, and part is tabbed browsing that actually works/doesn't crash.

Some people really like the iPad, though -- my girlfriend also has an MBA 13 (2010) and an iPad, and uses the iPad almost to the exclusion of all other computers, for basically all tasks. Not sure why.
Here's the guy's blog post about the hack: http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.htm...

"Today I can pull/commit/push in any repository on github. Jack pot."
Ringtone | apps mobile
As Github is a Rails 2 app, I'm pretty sure it's a Rails (and therefore also Github) vulnerability.
It can all be tracked back to the well-known "Mass assignment/attr_accessible vulnerability" in Rails. Demonstrating that even Github - full of very smart engineers - is vulnerable is just an attempt to raise (even more) exposure to the problem.
"Egor, stop hacking Github"
If this is a GitHub exploit, and I were GitHub, I would be talking to law enforcement. This is not how adults disclose software vulnerabilities.
FaceTime is of limited use for me because both sides have to be on wifi. I can never just reach for it first and expect them to answer, it's usually a phone call that migrates to FaceTime. It's still a bit annoying

However, I really appreciate how easy it works across the Apple ecosystem now that I have a toddler and live very far away from family. The grandparents love it (setting up Skype would be something they'd never do on their own).

As for video calling non-family? It's never even come up as a possibility.
Sounds like the "keyboard" would then have to have special hardware (pricey/not efficient) or the pad would have to have multicore/scalable hardware that draws more power when connected to the "keyboard" and the keyboard could have extra hardware like more storage and IO ports and a PSU/high capacity battery. It would be cool to merge this concept with something like padphone - sort of a Russian doll concept :) And the ARM manufacturers seem to be going that route for performance anyway - adding cores/disabling them for power saving. I assume the same concept could be applied to memory and GPU.
He registered a commit using his own account - so he either got the password of a rails admin or he must've found a way to add his keys to the rails github account directly.

The comments on the commit mention he just raised an issue that few people protect the attributes on their models from mass assignment, which… is one way this could happen.

Kind of a dick move, though. Responsible disclosure, doing it on a Sunday morning, etc, etc.
Yeah America makes the whole medical R&D, right.
Seriously.
One of the first comments is a link to where he tried, but the issue was repeatedly closed.
BiteAds: Advertising by social media. Tweet buttons that pay you.
Asus Transformer

- Android
- 10" screen at 1280x800
- 2.9 pounds (with the dock)
- 16GB HD + 1GB ram
- 15hr battery

11" Air

- OSX
- 11.6" screen at 1344x756
- 2.3 pounds
- 64GB HD + 2GB ram
- 5hr battery

The only thing that Transformer has going for it is the battery life, everything else is a compromise.
It could be far less nefarious than getting passwords or adding SSH keys. If, e.g. the `repo_id` attribute is not protected (and there are no further authorization checks), he could just send a POST and set the repo_id to the Rails project instead of his own repo and his commit could be pushed to master.
Relevant:

What I want you to see in that thread I mentioned is the
way the core team perceives this. You are not discovering
anything unknown, we already know this stuff and we like
attr protection to work the way it is.

Looks like this guy got really frustrated with the Rails devs basically saying that he didn't know what he was talking about. This reminds me of all of the unsafe defaults that PHP used to have. Same justification too, "it's a config setting, so it's up to the developer/sysadmin to read the docs and set them right."
Dwarf Fortress is about ten years old. Battle for Wesnoth is in development for 9 years. BZFlag is in development since 1992. Freeciv is in development since 1996.

The only game that in that particular list that is still in major continuous development is Dwarf Fortress. Everybody else is a completed game that is still improvement.

Duke doesn't really count, since their development is not really cumulative.

Commercial development tend to develop really intensely for several months to a short few years and make all their money in a few months. The're short term motivated and they will never develop their game beyond that. Yet, they took the equivalent of several decade of development time and never seems to goes beyond 40 hours gameplay.
He submitted it to… the rails bug tracker. Three days ago. That's not disclosing the issue to GitHub at all.
I've been using DDG ever since I submitted a bug and got a response from yegg a few hours later. That lets me know someone on the other side really cares and I'm not just firing emails off into the dark.
He did: http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.htm...
I don't think adults react to harmless (if public) disclosure by tattling to law enforcement either, though.
This guy brought up the vulnerability and the maintainers didn't seem to take it seriously since he wasn't articulate enough or was not approaching them with enough respect maybe for their liking? I wish they would have kissed his ass a little to get the low-down on the vulnerability so I didn't have to worry about my company's private github repos. He deserves props for bring it up for discussion.
It's a vulnerability in Rails, which is what GitHub is built on.

The vulnerability was demonstrated by adding a commit to the Rails project on GitHub, indicating that GitHub suffers from the vulnerability.

Here's the relevant issue. It might clarify things a bit better: https://github.com/rails/rails/issues/5228
Right, this is actually what I was getting at, without even being conscious of it when I asked that. Part of the appeal of NoSQL is that programmers don't need to learn a different paradigm of thinking other than the usual imperative model.

I'm not sure if I like that rationale for using NoSQL. Strikes me as being lazy up front. Or maybe you don't really need ad-hoc queries.
It's unfortunate that the guy stumbling upon this apparently noteworthy vulnerability happens to be so utterly immature. [EDIT: Unsurprisingly, the dude's 18. See http://homakov.blogspot.com/p/about-me.html for reference.]
This makes a lot of sense. I played around with Windows 8 this week and thought this hybrid felt a bit awkward on my desktop pc. But installed on a laptop which converts to a tablet would be very practical and useful.
One situation: if they believe that their competitors will follow suit. Unless an insurance company concocts a way to lower costs that isn't easily replicable, they have little incentive to do so. Otherwise, they're just triggering a race to the bottom.
> Responsible disclosure

If you look at the bug report, the core Rails Dev Team basically said that they like the defaults the way that they are. They have/had no intention of changing the defaults, and are trying to push responsibility on to the developers using Rails to use sane config settings.

Looks like the guy did report it and the response was: "Not our problem" / "Not an issue." He got frustrated and decided to make a very public example of how this is bad.
How to contribute to html5rocks.com
On the other hand, this makes for a hilarious perusal of his blog.
Unofficial Path Client for OSx
If we're discussing how adults act, then I definitely would not refer to reporting a crime as "tattling" (I might expect that from a child in Elementary school, though). Zero-day attacks are extremely irresponsible, and this is probably against the law.
He's being an asshole. On the other hand, if the defaults in Rails lead even strong Rails developers into making mistakes, perhaps it is time for Rails to develop an "opinion" about this.

I hope the asshole messenger doesn't obscure the importance of the message because people often push back harder against a message when it is delivered in an obnoxious manner by an obnoxious person.
Hurt pride is the best reason to contact police.
Well… strictly speaking it's not a vulnerability in that you aren't inherently unsafe just because you use rails.

It is a bug in that it's a usability issue; maybe it should be turned on by default, much like the auto escaping to prevent XSS that came in rails 3.
>"Ideally, what I would like (and I think most people would like) is something of the form factor of a MacBook Air (thin and light), that has a detachable touch-screen that can run apps written for iOS or Android, and when the screen is connected to the main body, acts like a fully-functioning laptop."

>I think some devices like this are beginning to appear, but so far none of them are compelling. It might take Apple to show them how it's done, again.

Really? Not even a mention of Windows 8, if it is just to say why it doesn't suit his needs? Has the author taken a look at upcoming Windows 8 devices like the Samsung Slate ?

Or is the discussion artificially limited to Apple devices when Apple has specially noted that they don't envision a fusion device/OS (atleast in the short-medium term) because it won't be a good consumer experience.

The tradeoff of the Slate is lower battery life and things like a fan, but it has a Core i5 and can run all Windows apps.

http://www.youtube.com/watch?v=8K1ZbY03nTQ

Or check out the IdeaPad Yoga, a 13" Macbook-Air like laptop that can double as a Windows 8 tablet.

http://www.youtube.com/watch?v=5SHKFYngqOM

http://cnettv.cnet.com/hands-lenovo-ideapad-yoga/9742-1_53-5...

There will be Windows 8 ARM tablets that will be fanless and have great battery life, but they can run only Metro apps and touch optimized versions of Office.

These are just the tip of the iceberg and there will be lots of Transformer like devices in the coming months running Windows 8. These may or may not fit the author's needs, but excluding them from the discussion doesn't seem like a good move to me.
> but due to her age, she was not eligible in France

I call bullshit on that. Due to general condition maybe, but if you are in great shape except on one risky point and the risk of treatment seems acceptable you are not going to be refused treatment because you are too old.
since we are on the "space" subject and I dont feel its worth new HN thread, but same time would love to pick up your brain; what do we see here? dust on a lenses???

http://www.youtube.com/watch?v=yjjftMK2HHM

appreciate your comments
Apple is Worth More Than Poland? No, it isn't.
Ok, that might be what the author wants and needs, but why does he claim to be able to tell everyone else what they want? That seems kinda self-important to me. Your own experience is not necessarily that of everyone else.
Hah..I was thinking of something even simpler - Lets assume for simplicity, there is only one habitable planet in the entire Milkyway galaxy, Earth. And there are 'y' number of planets in Milkyway in total. Then, the probability of finding a habitable planet (Earth) in such a galaxy is 1/y. We know that the Milkyway isn't the only galaxy. Let there be totally 'z' no. of galaxies in this universe. Let the percentage of them being a galaxy like Milkyway (where there is a probability of finding a habitable planet) be 'x'. So there exists'x' percent of 'Z' number of Galaxies that may have 1 habitable planet each. Mathematically, thats (x/100)z. Honestly, analyzing (1/y) for each galaxy in (x/100)z should lead you to believe that there exist intelligent life forms apart from just earth. That's such a large number to ignore and it would not be appropriate to say that there exists only one planet, Earth with intelligent life form. I'm not saying this is correct, I'm just justifying what my logic tells me - There's a large chance that there are intelligent life forms elsewhere in the Universe. Why? Because, we are a living example part of the same Universe, so there's no reason why there couldn't be others like us.
If it's a simple mass-assignment vulnerability, the Rails team has nothing to do with it given that mass-assignment is a feature and the vulnerability is well documented:

http://edgeguides.rubyonrails.org/security.html#mass-assignm...

Heck, I even learned this way back when I was learning Rails:

http://railscasts.com/episodes/26-hackers-love-mass-assignme...
I think this is related to an issue he opened on Rails[1] which would suggest that GitHub isn't protecting against malicious mass assignment.

By default, if you have an new, create or update_attributes (and more, I imagine) call which changes various attributes based on a hash from parameters (eg params[:post], where you have params[:post][:title], params[:post][:body] etc) Rails allows mass assignment of every attribute on that model, since attr_accessible is not called.

There is a method you can call in the model called attr_accessible that restricts the columns that can be updated through mass assignment, while still allowing for manual assignment of other columns.

An example of this might be a post's user_id, which you would usually want to set to the current user while not allowing mass assignment. Without specifying attr_accessible it would mean that if a malicious user added params[:post][:user_id] to their POST/PUT, the Rails application would update the user_id as per the params value. If attr_accessible had been called, defining the columns that the developer wanted to be mass assigned (say post and title), it would mean that the user_id would not be mass assigned and Rails would log that this was the case.

attr_accessible therefore acts as a whitelist for columns that can be mass assigned. It just so happens that the Rails default is to have no whitelist and allow all columns to be mass assigned, despite the fact that the sensible option is to always have a call to attr_accessible in your models.

[1]: https://github.com/rails/rails/issues/5228
> My personal threshold is around 100 people

That is probably highly correlated with Dunbar's number

http://en.wikipedia.org/wiki/Dunbars_number
Also, although the question is tagged for "c", the top answer has some Java specific examples.
Rails bugtracker != notifying the people at github that they forgot to add a mass-assign protection.
The Rails team essentially argued that it isn't on them to secure sites built with Rails. Rails provides tools to avoid this, and GitHub chose to not use them, so this is a vulnerability in GitHub. They should be using attr_accessible, and they're not.
Ok, thanks. I wondered if the etiquette was different in situations where the first VC was trying to put together a consortium.
It is good to have highly paid nurses if it correlates with other good factors, else it is good for nurses but pointless for the general public, or even bad if it means the latter is being ripped off and the costs are absurdly high compared to other countries.
Nobody likes a rat. You become a rat, even your friends don't respect you anymore.
The Dangers of "Tech Neck." How your lifestyle might be affecting your health.
Air also has a 1.6 GHz Core i5 processor.
Ah, great, thanks!
Any chance to have this in the chrome webstore for automatic updates?
We've patched and fixed this on GitHub.
New Microsoft mobile head Terry Myerson says that Apple's habit of releasing software updates for current iPhones is really just a way to sell more hardware. Myerson was speaking to financial analysts at the Mobile World Congress on Wednesday. A questioner noted that Apple releases software updates for current phones, and was asking if Microsoft would do the same thing.

So, releasing updates is ..."just a way to sell more hardware" !!!!

Is this idiot for real?

1) If Apple didn't release updates, people would feel MORE forced to buy the latest iPhone, because they wouldn't just be getting the new hardware --it would also be the only way to get the new OS.

2) New OS releases have little to do with people upgrading or not, at least in the US. People mostly upgrade when their bloody contract expires. Even new devices releases are not that important, for people still bounded with a contract for many months.

3) Apple sells hardware, so can afford to give frequent iOS updates for free. Apple also wants a homogenous iOS installed base, that App Store apps can target, so prefers it's customers to have the latest iOS version possible. Microsoft sells software, so of course wants to NOT give you each new update of Windows for mobile for free --it's better if you buy a new phone with it, so that the phone care pays MS their commission.

Anecdotal: I have a 3GS and it runs iOS 4 just fine.
> The US has these entities too - they are called "insurance companies".

As mentioned in the article, American insurance companies appear not to be very good at negotiating prices, partly because the providers are permitted to negotiate different prices with different companies, and to treat these negotiated prices as trade secrets. This is a highly unusual state of affairs.
Well...

> Why I do this? Since guys in rails issues ingored me

But I guess I agree.
The issue seems to be a result of an entire hash of the parameters passed in the request being sent to the new method for models.

Is this really common practice in Rails code? Sure you can specify in the model that certain attributes can't be changed. But shouldn't this stuff be checked when validating form input? Normally I'd have a hash of filters, with the field/column name mapped to the appropriate set of rules for that field. Anything that's not specified in the filters doesn't go to the model's new method.

In this case, it's like the equivalent of PHP code where you santizie the data in $_POST and just send that whole variable to the database.

Choosing which fields are accepted shouldn't just be a model security issue, it's a form validation issue. This makes choosing whether an admin can change a field or not trivial as well. If a request is made as an admin, (maybe through a form that's only accessible by someone with an admin role) then you just apply the validation rules for an admin. Otherwise you apply the rules for a user.
For All that was lost
logging in to upvote parent. to me, tc has lost its journalistic credibility a while ago.