skysight-inc/HackerNews huggingface dataset:
Because I have a lot of web properties, I look at Google Analytics almost every day. So I'm not a noob to the idea of analytics by any means.

I keep reading these Google Analytics articles and they all just kind of wash over me. So many thousands of pieces of data. It just never all seems to come together into some kind of useful whole. It just never seems to add up to much.

I look at total traffic and how the traffic is getting there. Then I look at time on site and page views, which show me how engaged they are. Finally I glance at new vs. returning visitors. That's about it. I know I must be missing out on something -- writers keep telling me this -- but somehow I'm just not easily able to move from "here's a zillion pieces of data" to "here is something I can do today for my content to make it better for folks"

On on the positive side, I like the new interface and features. I've been geeking out on watching traffic arrive at the site realtime. But then again, just like all the other stuff, it's cool glossy data, but not a lot of actionable useful stuff.
When you've tried to inform the vendor and have been rebuffed, a demonstration of the vulnerability helps convey the gravity of the issue.
SVAngel Buying Up Foursquare Stock. Dennis Crowley Emerges As Big-Company CEO
Did he notify github directly, or did he notify the rails team in a github-issue in the rails project?

If he didn't actually contact github directly and just assumed they would see the rails issue on a weekend, then I wouldn't exactly call it 'notice'.

If he did submit it to github via the proper channels before taking action, and nothing was done within a reasonable timeframe (eg. not just an hour or two on a sunday), then what he did would make a bit more sense.
LANs are broken. Why is it that we have usable tools for connecting halfway round the world, but find it massively hard to coordinate ourselves across a small office when the internet is down. It is total madness.
He did it under his own name, in a way dad not damage anything, using a problem that has been well known for ages, after attempting to draw attention to the issue several times and being ignored.

It is pretty obvious that he did not have any malicious intent, nor intended to do damage (if he wanted to, he could've done massive damage from an anonymous account in ways that wouldn't draw attention to it).

The only thing suspending his account accomplished is to punish someone who has helped draw attention to a very serious problem.

It just comes across as an incredibly childish and petty response given the circumstances.
I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another).

I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the future. I had a similar response with my (non-paid) DropBox account. I guess I didn't rationally evaluate cloud resources, and have trusted far too many people.
I've used an iPad 2 extensively and (like most people reading this) I've owned a clamshell-format device, and although I do not hold myself out as an expert on such things, I would have guessed that the iPad is the more durable device because there are fewer moving parts and no moving parts as complex or as prone to getting gummed up as the clamshell's hinge or a trackpad. Do not get me wrong: I am perfectly willing to believe that a netbook is better for you than a tablet; I am just finding it a little hard to believe that durability concerns tip the balance in favor of the netbook.

P.S. The iPad's back and sides are machined from a single piece of aluminum; do iPad's really break in half?
Apparently, some pirates are upset even threatened to boycott(!?)

https://torrentfreak.com/bittorrent-pirates-go-nuts-after-tv...
The issue is that it needed to go this far before someone actually paid attention to it. It indicates a cultural problem that is not going to get addressed by fixing a single technical issue.
I love the delicious irony when all sorts of rails dev argue for status quo only to find their master hacked because the source control system has the same vulnerability.
I had the same issue this blogger describes regarding "No URL Selected". The solution is given in the comments. I did not review the whole post, but I think the post addresses some other issues as well that you might be interested in reviewing.

http://coderscentral.blogspot.com/2011/07/how-to-have-fanati...

I also believe that installation on Linux could be more polished, but that is based on my experience from over six months ago, so I'm not sure if the process has been improved.

These are the first two things that come to mind since you asked. Overall, I find the program polished, and when I use it on Windows I find the shell integration convenient.
And don't get me started on "should of", used twice in this article...
tl;dr; - Learn about: attr_protected[1]

[1] http://guides.rubyonrails.org/security.html#mass-assignment
Right. As if this guy who reported it was the only one at the time who could have pwned Github with it.

For all we know, this bug has been abused for a long time to commit backdoors to other projects (perhaps those too big and active to notice).
Sure, that was my knee jerk reaction too. Of course they should suspend the account! But I think that was the wrong choice.

Shutting down the one account will do nothing. He can create a second account in a matter of seconds. They fixed the code that permitted the exploit, right? So the fix alone should be plenty to prevent any more malicious attacks.

And now, because of the suspension, they have a wave of bad PR (justified or not). This guy is clearly infatuated with Github. He got a tattoo of the Octocat for crying out loud. Why would you punish this guy for loving your service and caring enough about it to warn you of a security vulnerability?

Seems like there are only minuses to suspending the account, not a lot of pluses.
While GitHub's uptime has improved immensely, it was a serious problem. It's not as simple as pushing your repo someplace else when you use submodules. If anyone has a fix for that I'd love to hear it. I've ceased using submodules in most cases precisely because GitHub used to go down so frequently, but now I have the same problem with anything that's a :git entry in my Gemfile.
This is a bit unrelated but anyone know which font is used in the website logo?
The point is he did them no harm when he could have done a lot of it.
Probably because most entrepreneurs have morals/ethics. Just because you can do something, or just because you want something, doesn't mean you should. And doubly so when you know that the victim would most likely not agree to being tracked.
Seems like a very hard fight and a slippery slope. This time it's personal and seemingly one sided. What happens when it's competing commercial interests that sue for a change?
I guess it's just about familiarity. We do have the tools (mdns/avahi/bonjour, tcp/netcat, ...). But the internet is usually up, so we don't need to learn how to set up our own local servers, and there's no punishment for transmitting a file across the atlantic when it could have been transferred to another room in the same building and back again.
Apparently heck of a lot. Over 30%. But that's a lot of HN/reddit traffic, and I might still be missing some bots masquerading as humans, but it's certainly not negligible.

[1] http://www.reddit.com/r/programming/comments/qev5u/native_an...
The reason for exploiting github was to get the rails issue noticed, not to notify github of a vuln. If he quietly notifies github then there are still thousands of github sites out there that remain vulnerable. By exploiting GitHub and getting this huge response he allows the news of the vulnerability to get tons more coverage than it would have otherwise.
I did put them on several times a day after the procedure, as told. It's been two years since I had LASIK, now I only use them sparingly when my eyes get dry.
A/B Testing, Hill Climbing and Simulated Annealing
It's sort of a sticky situation. My take on it wasn't that this was so much to screw with GitHub as it was to show the Rails team the true severity of an issue they downplayed. It gets a bit circuitous because Rails is hosted on GitHub and GitHub is a Rails app. Had he reported it to GitHub and they patched it, which is arguably the proper thing to have done, nothing would have happened on the Rails side of the equation. All told, I think he did the right thing.
Hehe. Seems like I just wrote that comment. I'm in my twenties, constantly CMD+'+' to increase text size, use F.lux all the way to tungsten at night, use a 13" macbook pro (although have a 24" inch monitor).

The thing is, sometimes some text can't get bigger, so I tend to get closer to the screen, and my neck & back suffers.
Presumably Github is currently auditing their db for keys added to organizations by users who are not admins of those organizations.
One workaround for submodules would be local DNS entries, i.e. edit /etc/hosts to make github.com the temporary local github.com. Also, I generally mirror submodule repos and use those. But neither of these "solutions" fixes the actual issue of course. Not using submodules sounds like the best solution to me :)
I would expect any company to do far more than suspend the account, especially knowing exactly who did it.

I would think having a suspended GitHub account would be the least of worries with a company who has presumably access to a good lawyer or two and boatloads of cash...
Egor is a human whose motivations were totally obvious and whose actions were transparently harmless (and, in fact, net helpful.) The Github team are behaving foolishly if they can't or won't distinguish that from an "attack."

Organizations should be expected to make decisions using reasoning that amounts to more than word association, e.g. he "attacked" us, so we'll "suspend" him.
This is basic security, folks: never drive your application from stuff that comes over the wire (or any untrusted channel). Passing a params array directly to update_attributes is a fundamentally flawed approach for this reason. Instead, inspect incoming data for exactly what you expect to be there. By doing this, malformed input will either fail or be ignored without exposing a security vulnerability.

It should be obvious that you can't anticipate every potential attack vector at design time. Therefore, a well-designed system is one for which, when expected or normal conditions are not met, the resulting action is nothing or error, not an unexpected action.

This principle is also known as fail-safe:
http://en.wikipedia.org/wiki/Fail-safe
I've had tests done twice, and both with same results: glasses wouldn't improve my vision. I wish I could wear glasses, even just for work, and improve my vision, but they don't seem to help.
That comment jumped out at me as well. I use Perforce at work and run my own at home. Both with local and offsite redundancy. I guess that makes me strange.
While that's true, VLC has had a history of problems with H.264 (quite ironic), ASS/SSA and ordered chapters that makes them shunned in the anime community. Apparently, libass still has problems with skewed and rotated subtitles. CCCP is much more preferred on Windows.
How many of their users do you think know they're being tracked like that? I mean actually know and understand, not "were notified in the fine print on page 27".

Tracking users in ways they don't actually know about and understand, well, the usual terms normal people apply to that sort of behavior are "underhanded", "antisocial", "betraying trust", etc.
but if you get repeated waves of fools it does not matter

in that sense, fishermen, advertisers and dealers of crack are in more or less the same market
Menlo Park / Bay Area, CA

We are Badgeville a fast growing exciting startup that is about allowing websites to better engage with their users through among other things gamification! We use rails on the backend and have both a javascript and REST API.

See an article in NYTimes about us and one of our partners samsung http://www.nytimes.com/2012/02/05/business/employers-and-bra... and a recent tech crunch article on us http://techcrunch.com/2012/01/10/badgeville-proves-gamificat...

We are looking for a number of jobs you can see the list: http://badgeville.jobscore.com/list

In particular we are looking for
Technical Support Engineers - Act in a customer facing role, helping to assist clients integrate Badgeville's javascript and REST APIs with their websites. Programming experience in at least one language is required with knowledge of javascript a big plus.

and

Technical Account Managers - You will own a client's technical implementation of the Badgeville platform, architecting an appropriate solution. You will be in charge of both educating the client, developing relationships with the customer development teams and working with our producers to build the most successful possible implementation of our product.

See the full job description for Technical Account Managers at http://badgeville.jobscore.com/jobs/badgeville/technical-acc...

Feel free to email me at justin@badgeville.com if you have any questions about what we do, any of the jobs listed or what color you should dye your hair.
Are you saying that because it exists in a particular community there will be more apologists?
After so many years and such a high success rate in LASIK procedures, I don't think it's a problem at all to find a good doctor. Mine came very recommended, and as examined by several doctors afterwards, "my eye is perfect". Apparently the problem isn't from any distortion or issue with anything (visible) with my eye.
Also checked using Chrome/Firefox on Ubuntu, with the same result. iOS Mail App didn't grab anything with remote images turned off.

Considering it's an IE specific tag, I tried with IE and gmail, I couldn't get it to download anything, even when allowing remote images. IE was too bugged out trying to render gmail (not hating, stating).
"If you are one of those strange coders that don't use GitHub and think you are in the clear because you use SVN/Mercurial"

I can't believe he actually put SVN and Mercurial on the same side, or that he implies that not using GitHub must mean that you don't use Git at all. This sentence is wrong on so many levels. Sigh..

I'm strange, for my actual work I use Mercurial hosted on BitBucket.
People turn on HTML in email because there is no other widely accepted alternative for rich text email.

As for why plain text only is not good enough, here's a simple thought experiment. Imagine that we did not have any kind of email. We invented computers, and computer networks, but somehow, incredibly, overlooked inventing email.

In this hypothetical world, people still communicate by writing letters, and sending them through the post office. Of course they write the letters on computers in word processors, and then print them, and it is the print outs that they mail.

Now, imagine in this hypothetical world that someone finally comes up with the idea of email, and pitches it as an electronic equivalent of regular mail that is faster and more convenient. Is he going to make it plain text only? Of course not. It will need to be as capable as physical mail, which means it needs to support sending anything that people can print on paper. That means some kind of rich format that can handle different typefaces and fonts, colors, inline images, and attached documents.

Email started off plain text only simply because when it was invented the technology wasn't up to the challenge of handling the presentation features of real mail. The technology has improved, and rich email is the natural, inevitable outcome.
Reading the Privacy Policies You Encounter in a Year Would Take 76 Work Days
^ this, I just moved my prive repo to bitbucket hoping that Atlassian would have handled this issue better. At least they seem to have more experience looking at their long history in software. I will also look into setting up my own git(orious) server.
The Greatest Brandversations by Stefan Asafti
I have to agree that suspending the account was dumb as if he wanted to be malicious, he'd have created dummy accounts and would have committed malicious code to popular projects.

But then, going so far to say losing all trust in github.. there was a bug, it's fixed and they suspended the "attacker". I wonder what will happen in the following days with script kiddies trying to "hack" all rails website. In fact, isn't the overloading of parameters something as old as the earth that security experts would check first as a vulnerability?
I agree that analytics is important, but users are still entitled to their privacy, at least until they say otherwise.

I'd say a nice way to go about it would be to use Read Receipts (http://en.wikipedia.org/wiki/Email_tracking#Read-receipts). I know they're kind of annoying, I have not used them in a while and I don't even know if gmail supports it but it would be the correct way to track opened emails.
This is a perfect summary and exactly the sentiments that I couldn't express in the article. I've quoted you with attribution if you are okay with that?
When applying for a job at Google?
A bizarre thought entered in my mind.

When you apply for a job at Google they have the ability to find out in depth about my habits online and offline in perhaps more detail then the government or police. I certainly would be horrified if someone could see my search history.

Do they every go through candidates search history or other information? (With permission of course.)
The fact that there is not persistent caching of mission dependent code and data as a fundamental commercial standard shows how badly we as a species in general can judge risk, even when the stakes are really high.
They should've at least thanked the guy.
I don't think hacking sites to do security activism is a good idea, at all. However, many people over a period of years said that this change needed to be made, in all of the friendly, ethical, polite OSS-approved ways. Tickets, blog posts, emails to security, etc etc. I got to the issue a few years late, saw the WillNotFix tickets, and wrote up - I kid you not - an on-dead-tree journal article which said:

[W]rite access to sensitive data should be limited to the maximum extent practical. A suitable first step would be to disable mass assignment, which should always be turned off in a public-facing Rails app. The Rails team presumably keeps mass assignment on by default because it saves many lines of code and makes the 15-minute blog demo nicer, but it is a security hole in virtually all applications.

http://queue.acm.org/detail.cfm?id=1964843

This doesn't justify the Bad Guys abusing third-party sites with this, but the Good Guys did everything right and did not achieve a fix as a result of doing so.
Yep, this bothers me too. attr_accesible is to Rail's what magic_quotes_gpc was to PHP: a terribly misconceived 'helper' feature that is almost designed to trip up beginners in the worst way.

Of course, that GitHub should get caught by it is alarming.
I am getting: " Error establishing a database connection "
There's a long extract from the book here: http://www.guardian.co.uk/books/2011/aug/19/genius-downstair...
I agree, Benzes are a bit bland. They don't give you as much physical feedback as a BMW, they're not as low and stiff as a Porsche, they're not as light and agile as an 86 Corolla, they're not as quick as a Subaru.

But when you think about the fact that most people only drive a few cars in their lifetimes, and the first couple cars are something like a Honda Civic or a Mazda Protege, the first experience with a fine German automobile is going to be anything but bland.

Most people get new vehicles every five or ten years - I get a new car or bike every couple of months (I'm not rich, I just buy cheap and flip them for various reasons) and I worked at a dealership, so I'm just as familiar with the flaws of Benzes as the strong points. You must have a similar experience. We're just spoiled, is all.
Wow, I hope that subscribing to this mindset is not the status quo among entrepreneurs. Another "very important" thing for most online businesses is money. Doesn't mean that we should accept it when they get it through underhanded means.
Yes, but funsubbers hate VLC since it used to mangle subtitles.
Content:

three years ago this week, when dennis and i were putting the finishing touches on the vision for this company, we had a hundred or so beta testers who helped us reach the finish line. we went down to sxsw to tell the world about foursquare.

it’s hard to believe that now, three years later, instead of one hundred beta testers, the company has over a hundred incredibly talented employees helping us realize that vision. and they’re building amazing things.

in that time, i’ve worn a ton of hats: from product to engineering, from funding rounds to roadshows, from recruiting to evangelizing. but, after three years, i feel i’ve done all i can do and i’m moving on. dennis and i have been discussing timing for a while, and we decided that now, on this anniversary, it feels right to begin the transition. so this will be my last month working at foursquare. over the course of the next few weeks, i’m going to be taking a step back as my final projects near their release.

i’ve always been here for the company and i always will be. i look quietly around the office every once in a while as the team works (not. creepy. at. all.) and i can’t tell you how proud i am of everyone. we’ve brought together an incredibly special group – one that’s going to go down in history – and they’re going to keep making us all proud.

going forward, i’m going to continue to be connected to the company: i’m on the board, i’ll still be advising, and i’m obviously going to be the single most vocal user. but the spring is time for things that are new, and i realize that i have a desire to do something new as well. i’m not sure about my exact next steps, but i’ll probably get back to what i love most – being an entrepreneur, learning and building new things.

three years ago, we took an idea and threw it into the world. i’m going to miss the crazy intensity that is foursquare, but am excited to see where it all goes from here.
+1

push to bitbucket! Its also free!
I actually had "Thanks to Homakov" inside the title of this post but I guess I wasn't allowed to have that in the title and someone changed it.
I'm just going to latch on to this comment to make mention of a GitHub alternative for private repositories: http://repositoryhosting.com/

I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan.

My open source code is on GH, but it's all also pushed to RH, along with all my private code.
So did I, it picked up a Google IP address. Anyone know how to close this? I have images turned off.
Interesting. In many ways we are still in the dark ages of medicine (treating symptoms). In the future we will know the causes of asthma, and directly fix them.
Irrespective of Naveen's departure, Foursquare seems like one of those companies that had its time, but it's clear now it won't have a place in the future.
I refer to compressed artifacts in general, here. I do not consume "scene" artifacts. I am merely positing that there is no technical reason for the choice in this era. But having lived through the last one, I can understand why it became common then.