skysight-inc/HackerNews huggingface dataset:
The straight up ban is a great short term solution, but in the long run being easy to work with on security issues and not alienating your users is a better road. As they stated, this user wasn't malicious so banning him only causes grief and could turn him from an ally into an enemy.

There was a great post a couple of days back that in effect said: It's not a matter of _if_ your security will be compromised but _when_. By being open to your users disclosing this information you're helping to keep your product secure. IMHO 37signals does a good job of this by linking and giving credit to those that have discovered security flaws in their apps (http://37signals.com/security-response).
Undesrscores how powerful Google is. To many people internet is what Google shows to them. Though its a slippery slope, If the peson who is requesting for changes is liable for those then Google should comply. DMCA also has similar provision.
This isn't about websites, it's about email. Ethical operators do not insert tracking bugs into email, and they definitely don't do it in a way that tries to deliberately get around long-standing restrictions in virtually all email clients explicitly designed to impede this.
Haha, yeah - and make it good, too! ;)

It just wasn't clear from your description if you're "just" providing the information, or actually enabling the businesses to make use of the information.
Actually, the world _does_ stop turning because it's Sunday. Anything happening on the weekend is emergency management, which takes time to scramble. I work in network/information security, and if we had a security incident on a Sunday, it would go to our backup team (of one). If they (he) deemed it critical, they would notify the security director, who would notify my boss, who would notify the rest of the team. This would take 3-5 hours, plus the amount of time it took us to get to the office and actually investigate the emergency. While we were investigating, we would likely shut down everything (including user accounts that were involved).

Weekends are time away from the office. I don't understand how you could expect the same amount of service on a weekend opposed to a week day. Do they deserve to be commended just because it was a weekend? Internally maybe, yes, externally maybe not. Fact remains that the weekend is when they are most likely to be short-staffed.
Sure. First and most important thing for understanding Real World costs: one engineer is $20k per month in fully loaded costs (salary, benefits, taxes, overhead). One engineer-day costs you $1k. These go up for emergency response because a) on-call b) experts are even more expensive than generic engineers.

Github's first response to this would be pushing a Big Red Button that would get 4+ engineers to devote their Sunday to this. That's $4,000, cash money. The predictable second step after the bleeding stops is to do a line-by-line audit of their entire code base. My guesstimate for Github is that that would cost north of 50 man days ($50k).

But wait, there's more! As a result of this compromise, Github is likely going to hire external security firms to pentest them and make process recommendations. The caliber of firm they would consider employing will cost, bare minimum, five figures. Cost goes up pretty rapidly.

But wait there's more! Github will, as a result of this incident, have a number of people close accounts today (totally measurable) and an unknown number avoid creating accounts in the future. LTV for SaaS customers very quickly becomes motivational numbers. A single company moving its repo from Github to an internal system because Github Let Anyone See Any Repo (+) could easily cost $5k+ in LTV, and that scales horizontally across their entire client base. Scaring your customers' PHBs is never fun. This issue will be held against Github in a thousand internal conversations.

But wait there's more! Highly visible security problems will bring Fortune 500 lawyers out to play. "You just caused a security audit for us. It cost $250,000. Where should we send the invoice? Oh, you think that your Terms of Use says you don't owe us? Cool, let's run that by Legal: they're free this week."

Long story short: getting hacked is Very Bad News.

+ This is the key takeaway from the hack, not "Someone did a one-line defacement of an OSS project."
Yes, we're familiar with that work. One technical bit of interest is that we don't use the C stack at all (we have heap-allocated continuation records), so we're curious how that will play out with the calling convention even beyond the issue with registers.

That said, we're still hopeful that we can make things work, though we're not optimistic that it will come about without some significant tweaking.
No dude, I want an Ipad
Meanings of Error
I just wanted to say that. The web needs a clear privacy policies scheme similar to f.ex. CC with clear guidelines, and even maybe fancy logos like the CC ones. You take a glance at the image, click to see the text version for details and your done.
I've used bit shifting a lot when dealing with any sort of audio/video applications. Specifically, when muxing audio and video into a container (i.e. MPEG transport streams) you need to set up a bunch of bit flags that are packed very tightly and also need to frequently need to write data into non-byte boundaries. The result is a couple hundred lines of code of all pointer arithmetic and bit shifts to convert between verbose data structures and the format in question.
99.9% of the time, tools which work for communicating over the internet work very well for communicating locally. It's not worthwhile for most people to devote the time to building, maintaining, or learning a second tool for the LAN side for that 0.1% of the time when your internet connection is down.
Dell xps m1530 battery
7200mAh Dell xps m1530 battery is specifically designed for Dell xps m1530 laptop. We offer a complete line of replacement Dell batteries and compatible replacements for almost all laptop models. All of our replacement Dell xps m1530 laptop batteries are made with high quality safe parts and are guaranteed to meet or even exceed the original manufacturers specifications.
Speaking as someone who isn't a Rails developer (but does use GitHub Enterprise for work projects), when this first broke I was on the side of github and thought homakov was acting irresponsibly.

Now that more background is coming out, I think he probably did the Rails community at large a huge favor here. Had this just been fixed quietly on GitHub, that would certainly be better for GitHub's PR but the wider community might never have realized the lurking horror that the Rails team appears to have been unlikely to do anything about other than point people to the existing docs.

This situation shows that pointing people to those docs was clearly an inadequate solution. If GitHub (arguably the poster child for Rails apps outside of 37signal's own apps) could fuck this up, anyone using Rails could. All of this exposure to the problem is net positive for everyone using Rails other than GitHub and the core Rails team, IMO.
This feature already exists in Rails.

https://github.com/lest/rails/commit/f2fa4837a8a888ee86997be...
How To Define Site Theme Using Target Audience Profiles?
It is important to gather accurate site visitor profile and other target audience information. As a skilled web designer, you should be able to convert any information into a meaningful visual theme.
These issues need to be nipped very early on before they get too big to handle. Microsoft was stuck in this situation for many years because they had decided to favour compatibility over security. Rails now has a wide footprint on the web, and it all makes it even more important to enable it to be properly locked down.

I hope this marks a turning point in the way the Rails team think about security.

ps At least Rails no longer allows web crawlers to delete resources by issuing GET requests.
By this logic, no company in any industry should attempt to reduce costs in an easily replicable way. Since the world doesn't behave that way, there must be something wrong with your logic.
Apparently he did. However, GH only fixed that specific exploit he provided. The general vulnerability was apparently spread throughout their entire code-base. After realizing this, he filed a report with the framework GH uses (which would fix the problem for everyone - not just GH). They told him to fuck off (politely). So he proved his point.

Childish? Yes. But then again, he is a child. The kid is a teenager. That's how they're supposed to behave.

Also, I have a strange feeling things will actually be fixed now? So the kid gets results.
Very little about film making has to do with x264 encoders and torrents. Anyone can do those things... Louis CK figured it out, anyway.
Capture Space Photo Contest
Michael Jackson back catalogue allegedly stolen by hackers
If what you're implying here is that they should be offering a bounty for discovery of bugs, I'm not necessarily disagreeing with you, but to expect them to get a policy about that and to allocate funding for those bounties on a Sunday, within 24 hours of a major, public breach seems a little unreasonable.
If the vulnerability is that serious should they have not taken the site down instead?
To be honest, mass assignment sounds like Rails' own "register_globals". The default should be conservative and disallow setting any fields, instead of allowing anything to be changed.
Coincidentally, the incident with Zed was also fueled by the ruby guys being dicks. He just happens to be a higher-profile personality.
Only for relatively new versions of Rails. The oldest version of Rails including this patch was released January 20, 2012.
Three years. Every time you see a post like this it's three years. What changes at that time?
We do. Our tools use it to help customers in India upload multi gigabyte movies to our storage in the US.

But nobody uses RAR without PAR2, and I was responding to the bewilderment at those using RAR.
Wow! I personally find it fantastic! Where is this data coming from? How do you get industry people to complain there?
See below. 99% of the total cost isn't accrued yet.
I see this whole story as "Irresponsible kid accidentally teaches the whole town a lesson"
Change the name of the resort. Seriously, fastest and easiest way to beat a computer/algorithm.
As someone who's never driven a Ford (or, indeed, a car), I would not dream of driving one off a cliff, nor would the Github team. It's entirely possible that I would forget to use attr_protected. Github certainly did.
"No matter how trustworthy, reliable, and secure they try to be, every one makes mistakes." Which can include you. I get that it'd be pretty hard for anyone else to access code that is just on your own laptop plus encrypted off-site backup storage, but once you get to the point where you need to collaborate with other people and need some sort of a service available on the web, I'd put more trust in the security chops of a trustworthy third party than I would in myself.
Not to downplay the exploit at all, but for everyone raging that this occurred and are worrying about the integrity of their codebase, we are talking about an SCM for god sakes aren't we? Git is distributed and all most users would need to do who are freaking out right now about evil commits is to go back and audit your git commit history no?
It is possible but why would he disclose it then if he was trading it on the black market? Kind would shot himself in the foot then since the vulnerability would be fixed and the price of it would go down to 0.

Actually, that was my original point. If he is already treated as a criminal and a hacker, might as well profit from it. Instead of trying to disclose it publicly and get treated as a criminal, might as well sell it on the black market, don't tell anyone about it and at least profit from all this work.
Well this is interesting.

That's a question I submitted while in the process of researching my final paper for Alfred Aho's advanced compilers course at Columbia University. In the paper, I discuss why compiling Python to C is difficult, and present some of the process that PyPy uses to make the translation happen for RPython.

Here's the link:

http://www.scribd.com/thejfasi/d/83851011-COMS-6998-Final-Pa...

EDIT: The title of this post is slightly misleading. It doesn't discuss how PyPy works, just how the translation framework happens.
I'm not so much glossing it over as emphasizing it. The Indian healthcare system is like the US healthcare system, except people are not insulated from the price. As a result, people shop around.

I.e., Nitramp is wrong, people are capable of shopping around, all they need is incentive to do so.
MITx 6.002x course website is live
:)
How could anyone be certain that there hadn't been a 0-day inserted in their code, even if the method of disclosure had been different?
> he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly

If he was, he wouldn't have really made his point, would he? There are a lot of other Ruby sites which have this sort of bug.

I actually do understand suspending his account, and I even kind of get the intentionally misleading communications (you have to keep the corporate customers happy, right?), but the new "white hat" policy thing is kind of silly, because that's clearly not what this was about.
Maybe 3 year vesting - although 4 year is more common. But 75% vested of a big company is fine.
TaylorMade RocketBallZ
I am not at all a doctor, just a personal anecdote about acid reflux while sleeping. Start jogging. I know this could be very hard with asthma, but it completely cured my night time acid reflux.
Yeah I expected this as many github-ers are also HNers and it looks like this PR battle is not theirs to win this time (there is some backlash happening). This is good, they listen to developers and I think that is a good decision. As ultimately developers are their customers (either indepent ones or the ones working for large companies).
MITx First Course "6.002x Circuits and Electronics" is Live
I agree with you up to a point; those certainly should be their priorities. However, suspending his account didn't help them accomplish any of those goals.

I think we can all agree that it certainly didn't help them fix the vulnerability or communicate with users, right? (Actually, it arguably did the reverse...) But it also did absolutely nothing to stop him from breaking into the service; the exploit works for any user, and Github allows anyone to create an account instantly and for free. Until the exploit was fixed, anyone including him could have created an account and exploited their service.

A better defence of Github would be that they couldn't have been expected to know that, and so they shouldn't be slammed for doing something unproductive and pointless that distracted them from the three core priorities you list above. And I agree! If something looks fishy, banning everyone involved, and sorting it out later is actually a pretty decent idea...even if (as here) it proves to be a complete waste of time in retrospect.
I prefer to pay someone to host the private repos.

Yeah, and people payed GitHub to host their private repos --how did that go?
CHAUSSURES RUNNING NIKE AIR MAX + 2011 Femme
Chaussures Running Nike Air Max 2011 Femme, Neuf Running Nike Air Max 2011, Basket Air Max 2011 Rose/Blanc/Noir,	Nike Air Femmes running shoes France!
How insurance companies incentivize doctors to keep patients sick
md2man's input is already Markdown and its Roff output already supports hyperlinks: https://github.com/sunaku/md2man/blob/master/test/md2man/rof...
Irresponsible, perhaps, but somehow I doubt it was accidental :)
i agree that Foresquare may be on the wane.

i am starting to see that some of these social websites might just have a normal lifespan like the run of a TV show. Signing up to something like Foresquare might be like starting to watch "Seinfeld" or "Friends", it's exciting at first, you get to know the characters and you get engaged, and then after a normal involvement arc you move on to new things.

nothing wrong with it,,,, unless of course you staff up 100 engineers thinking that this will be a new permanent part of the landscape ;)

sell to FB when it's public and grab your loot!
14 points but nobody giving feedback? Here's some. It's not really apparent for first time users what is being shown here:

- Is it a stack of peoples input or a hierarchical list?

- Can items go up/down?

- Can you vote?

- Why are the buttons green?

- There's a number on them is that how many votes the item has?

Maybe a quick into paragraph explaining it's use? Maybe a series of mouse-over hints to tell users the mechanics.
As a hacker, sure, I'd rather not have this potentially spam my wall with posts. But as a college student living with other college students, it's the perfect choice. This could prove to be really useful, I'm looking forward to trying it.
Big "Data"
VHS to S3 (w/ HTML5)
Ah okay. I thought you were referring to Rails, my mistake.
After years of being annoyed by these kinds of unfriendly unsubscribe policies, I now use disposable e-mail addresses to sign up for most web-based services. These have two advantages: (1) If they refuse to unsubscribe you, you can disable the address and never hear from them again; (2) If your e-mail address gets leaked to spammers, you know who did it, since you provide a unique address to every service. (I still use my real e-mail address with critical services such as on-line banking.)

I've been very happy with the disposable e-mail provided by http://spamgourmet.com; it's free, reliable, and you can create a new disposable address without visiting their web site. (It's not a pretty-looking web site, but it does the job.)
Of course, all of the countries with good health care have more regulation, not less.

All you've identified is that rich nations have good health care regardless of how much regulation they have. This is hardly surprising - the evidence suggests that once health care exceeds a certain minimum level, it has little effect on health outcomes.

Incidentally, the Indian health care system is excellent and less regulated than the US one. I'm very lucky that I blew out my back in over here rather than in the US. I didn't come over here as a medical tourist (my startup is in Pune), but I strongly recommend that more people consider it.

Granted, the vast majority of people here are too poor to use the health care system effectively, but that's not the fault of the system.
There aren't any. The parent to this thread doesn't know what they're talking about. :)

It's just a way that the media/government gets people to accept their poor health care situation: it's better! and you couldn't get it anywhere else! The high costs? That's just the way things are, never mind these examples in every other developed country in the world.

All of this is bullshit.
> The predictable second step after the bleeding stops is to do a line-by-line audit of their entire code base.

And this would be unnecessary if a vulnerability was discovered internally rather than demonstrated to exist by a well-meaning outsider? (Never-mind a malicious third-party).

A bank that left the back door open wouldn't need to conduct an audit if the breeze was noticed a few years later by a teller, rather than if it was pointed out by a customer throwing notes on paper aeroplanes through the open door?

(Ditto all your other points).

You cannot and should not assume that a "0 day" (questionable terminology in this case) has not already been discovered and exploited.
We never post to your wall :) We should make that clear though, thanks for the tip!
A similar problem (in Perl) lead us to fork LedgerSMB from SQL-Ledger in part because the author of SQL-Ledger had trouble fixing it....

The thing is that this really belongs to a class of vulnerabilities where authentication information is inadequately tied together on the server. This allows any user with valid credentials to fabricate credentials for any other user. In SL it was worse because all you needed was the timestamp and not, say, a valid password, but the same applies.

One thing I will say is that this sort of vulnerability IME suggests inadequate thinking relative to security (and probably other things) on the part of the application designer and therefore raises questions in my mind as to what else may be lurking there.
Third option is that he was credited 1 year for work done prior to the investment. That happens sometimes.
I never understood why people use the same exact email address to sign up for multiple sites. Any decent MTA will give you a wildcard extension on your username, so signing up for service Foo means telling them something like user-foo@example.com. An unsubscribe is as simple as forwarding that specific address to bounce, /dev/null, or their whois contact information (although I generally reserve that last one for articles that pop up a subscribe box when viewing). This also gives you the advantage of seeing who has sold your email address.
I'm not sure if everyone noticed the last comment on this article: http://screencast.com/t/Nobted7zv5z

Posted "almost 8 years ago" ie. posterous would appear to have the same vulnerability.
This implies that the only use of LinkedIn is to be courted by recruiters.
I wonder if they pay their security firms for code audits, vs. just system configuration level stuff. It's reasonable to think they're about as expert on their codebase and its security as anyone else would be, so just having different people within the same company look at it would probably be effective, and could be done more frequently than an external audit. (I generally advise AGAINST external code audit for a lot of early stage companies, since it can be a lot of wasted money when the codebase is changing; it's better to have some guiding principles internally and then try to reduce the scope of security critical code as much as possible, and eventually audit that. Stick to securing the infrastructure, which is pretty standard across companies and thus cheap, and can be handled through outsourcing to gmail/heroku/etc., at least in the beginning.)

Looks like they have two companies for audit/pentest (nGenuity and Matasano Security), plus a consultant. Somehow I doubt tptacek is going to comment on any of this.
What about the bgsound attack?
Gotta love the level of idiocy in this entire thread. Americans are being really (and irrationally) delusional here, without any data to back up anything being said.
First impression from someone a bit tired on a Sunday night (sorry!), I don't quite understand what this is.

Second impression: How much will "Dealing with people" help anyone? I don't mean to sound like a cynic, and this could be valuable if you get the right "culture" on here, but I think you need more.
He didn't WANT to tell github, he wanted Rails Core to pay attention to him, and github was the sacrificial lamb.

He doesn't deserve props from github, he just exploited their app to make a point (to rails core) he never disclosed anything to github, from what I can tell.
I agree with you, I imagine your parent's reply was could have been sarcastic that got lost in text.

It's really an authorisation issue as to who/what can update which parts of a model - generally this is handled in the controller.