skysight-inc/HackerNews huggingface dataset:
Do you read all the privacy statements of sites that you give personal information to? Every site gets at least your IP address, which has been used in courts to identify people (albeit in a flawed and usually incorrect way). There is a vast amount of information that each of us gives away every time they are on the internet. What we read, what we buy, what interests us, who we talk to, what we say, where we are and much more can be gathered by websites. What sites and companies do with this information varies. Legal contexts vary state to state, nation to nation (some are completely laissez-faire to very protective of users).

The article makes an accurate point about privacy being almost incomprehensible and near impossible to fully understand because of the depth and volume of privacy statements. The article's point is backed up with numbers. How can it be reasonable when the quantity of reading required to have a basic understanding of what sites say they won't do with your information is "too much"?
Video comparison of IPad with Windows8
Ask HN: How Much Karma Do You Have and...
How Much Karma Do You Have and Do You Have Any Special Abilities That You Got From Your Karma?

At the time of this post I have 26 karma points.
The search results strongly suggest that they have a reputation as the site of a disaster.
sorry, was my mistake, fixed! :)
Yes it is. But even ignoring that, Rails 3.2 added a feature to do something similar: roles. You can do things like this in the model:

attr_accessible :user_id, :on => :admin

And in controllers (or anywhere, really):

@something.update_attributes(params[:something], :as => :admin)

It's naive and it's not exactly an ACL or anything but it's a way to indicate the context at a basic level.

Sadly, people seem to be running around like headless chickens trying to scotch tape trash bags over a broken window instead of learning how to replace the glass.
If you have a high myopia, Bates is useless. But it really helps when you have a little nearsightedness.
What about co-writers, other musicians, producers and so on that create the work who live on after one of their cohort dies?

I've always felt that ten years was suitable for copyright fee recovery and then let it be in the public domain.
+1 for using F.lux (http://stereopsis.com/flux/) — started using this months ago and couldn't imagine going back ... the different is startling!
Perhaps I am misunderstanding the situation. Am I correct that the so-called “vulnerability” is that if you do a mass assignment from an untrusted source—form parameters—to a model without whitelisting attributes via attr_accessible, an attacker can write values to arbitrary attributes?

If so, this isn’t a security vulnerability in Rails. A new Rails application isn’t vulnerable by default. It’s a security vulnerability in apps written using a certain style, or perhaps a vulnerability by default in apps written using the generators and scaffolding baked into rails.

But for guys like me who never use mass assignment, our applications are not vulnerable by default, correct? And likewise, for people who RTFM before using mass assignment, their applications are not vulnerable, correct?

If I understand this, it is very different from something like the routes vulnerability a while back, where EVERY Rails app was vulnerable whether you liked it or not. Saying Rails has a security vulnerability here is like saying that ActiveRecord has a SQL Injection vulnerability because by default, find_by_sql allows you to compose queries out of strings, and if you don’t choose to use the correct form, you will be attacked by little bobby tables.

(EDIT) To be clear, I like what the article says, I’m just not sure that the phrase “Rails has a security vulnerability” applies in this case, or that it is technically true that Rails is insecure by default.
It would be nice to have some buttons. One to report a comment if it does not meet a certain level of discourse- lol I don't know why they down voted you- and the other to collapse threads.
As an integral convention of Rails, it does not (to my best knowledge). As something you could add yourself or package up into a plugin, sure. It just wouldn't be the conventional approach (which, as we're discovering, is stupidly insecure and patching things over while targeting the wrong problem).
Thank you for insight on how scene works. But my main question - where is profit? I.e. what drives this scene and what these groups compete for?
Could you link to the fix/bug report? My mozilla-ppa(deb) Thunderbird 10.0.2 leaks like the Titanic after the iceberg.

Gmail does much much better - a counter-intuitive result.
That was a post that included some kind of character that doesn't render properly for some reason. I saw it there towards post #5, then later it was up past post #200, and with the misbehaving character removed. Looks like someone edited it who had admin magic or something.
Most sane thing ever said about the iPad.
Panty by Post founder Natalie answers my questions
Limitation of terms to a sane time-frame is important as well but it seems like a different fight.

I just think its a shame that Jackson is going to get Mickey Moused for an entire human lifespan before having a chance at public domain. Buy it now before it goes back in the Neverland vault for good! (We mean it this time...)
you should provide a way for people to contact you privately ;)
The problem I see with this blog post is something I haven't seen mentioned in the comments. It's not GitHub's place to set policy on what kind of disclosure is or isn't "responsible". Egor Homakov's responsibility is not to GitHub; his responsibility is to other users. His moral duty upon finding a security vulnerability is to act in such a way that other users will be minimally hurt. It appears that he has fulfilled that responsibility spectacularly in this case.

GitHub has no business demanding his, or your, agreement to a legal contract that prohibits you from exercising your best judgment in such a case.

Furthermore, "responsible disclosure" is a propaganda euphemism for "allowing irresponsible vendors to cover their asses, possibly at the expense of their users". Terms like "responsible disclosure" have no place in a serious discussion. Please see the blog post by the Google security team at http://googleonlinesecurity.blogspot.com/2010/07/rebooting-r... for further details.
So, I'm walking this edge right now with a few middle schoolers.

At the beginning of the (school) year, we started doing a programming class using scratch. The operative theory was to be able to explore, get the cause/effect thing going, some debugging, and be able to build something that they could distribute and have other people play. It was a success for a while, within a class or two, pretty much everyone had something that was more than just basic behavior. There was some animation, some 'cat chases mouse', and other basic games. But they quickly hit the wall where scratch is just painful to program. There's no abstraction, and if you want to do space invaders, you wind up copy and pasting a hell of a lot of code blocks. And woe to you if you then need to change something. Dragging and dropping is attractive till you need to build equations of motion.

So, beginning this semester, we're working through LPTHW. The class is smaller, some were definitely scared away by the "hard way" and my warning that they'd have to work. But the ones that are there are soaking it up. I think we're at ~ 5 lessons a week, based on one class time when they can do stuff + homework.

They're getting it. They can find bugs. They have seen where we can go (because of scratch) but they've also seen that there's got to be a better way than drag and drop. My goal is LPTHW should take a quarter, then we'll pull in pygame and some networking stuff, and do a basic networked game. My goal is to be able to translate one of their scratch games roughly block to line, then kick it up a notch. Seeing what I have, I should have abandoned scratch after a quarter, rather than a semester. It would have still given them the view of where we can go, but had them miss the more frustrating parts of the scratch environment.

I've now got some home school experience teaching kids from pre-k to middle school. Heavily scripted stuff is awesome, _provided_ the kids see where it's all going at the end. Far better than random or directed exploration. (I've seen this in learning to read, elementary math, programming, and an art class).
Here's the relevant section of the Rails manual describing this exploit, along with some ways to prevent it.

http://guides.rubyonrails.org/security.html#mass-assignment
Ask HN: Any good open-source user management libs for web apps?
I'm building a web site, and want to authenticate/authorize users, do password resets, and possibly link accounts to facebook/twitter.

Anyone make a nice library or web service that does this? My gut feeling is that everyone just rolls their own since it's pretty easy to implement this stuff. But was curious if anyone has implemented such a thing in Java, Ruby, Perl, or Python, or as a web service.
When I first started learning C++ (back in the bad old days)

Siiiigh. Here we go again, the C++ hate bandwagon. Let's see why he thinks this.

I was convinced that any 1st year student could design a better programming language.

That's normal for someone who doesn't yet have any idea what he's talking about.

One which behaved in a sane fashion without a lot of legacy cruft.

Okay, that's kind of vague...

In many ways, PHP is that programming language.

Nope. No, it isn't. Not at all. PHP is a mishmash of C-ish APIs that get things randomly backwards along with some handy built-in constructs. Also, it has some of the most appalling documentation of any mainstream language.

works without having to know lots of esoteric computer science.

I would love to know what "esoteric computer science" necessary to use C++, or any language for that matter. But that's not contained in this link-bait-y post.
> What makes you think they are saints?

What makes you think I think that?
And just in case the OP is unaware: the "email" field in your profile is not publicly visible. You must put anything you want people to see in the "about" field.
Splitwise (http://splitwise.com) also has a roommate bill-tracking tool, of which I'm the co-founder. We have Android and iPhone apps that sync with the cloud, and you don't need to connect with Facebook to sign up. Doesn't do chores or to-dos though, if that's something you want in your roommate site.

Let me know if you'd like to meet sometime @rschmulker, I'm based in Cambridge MA and Providence RI. You can reach me at hello@splitwise.com.
I generally try to utilize address "tags" for this sort of tracking, for example username+tag@example.com
(http://en.wikipedia.org/wiki/Email_address#Address_tags).

Unfortunately many websites seem to think that '+' is not a valid character in an email address. Very annoying.
"before it goes back in the Neverland vault for good!"

I sincerely wish that was an option I could choose!!
I think Google's full disclosure policy, which "involves making full details of a vulnerability available to everybody simultaneously, giving no preferential treatment to any single party" is far classier.

http://googleonlinesecurity.blogspot.com/2010/07/rebooting-r...
That's definitely not what the numbers say. Foursquare is one of the strongest start-ups with good competitive advantages and a solid team. The Foursquare brand is very strong, they've successfully competed against Facebook and Google and (at least judging by their performance over last year) they only do better and better. See some traffic data for reference: http://www.quantcast.com/foursquare.com

Nobody knows what the future will bring, but I'm very inclined to say that Foursquare has given no signs of stagnation. How can this company become less relevant after the introduction of NFC, faster smartphones and more precise GPS systems?
Bitcomet has actually beein doing this for ages.
My point is that Rails does not take the high road of providing better, sane, secure defaults for people to build their applications.

While the proposed solutions in the issues I linked to were denied, it doesn't mean there shouldn't be some solution added to Rails. This is definitely a case of convenience favored over security.
Sure. But I feel like it's the job of a framework to hide away complexities to help the developer write code faster. I don't use Ruby/Rails but from my experience with ASP.NET MVC it seems that these helper functions exist for a reason. So why provide a tool that's inherently insecure? Caveat emptor?
Early PHP is exactly what came to mind when I read the description.

Nothing new under the sun.
Fun With Population Density
Ruby community is quite reasonable. I usually avoid discussions in framework communities. At the other hand, programming language communities tend to be more reasonable and nerdy. I feel bad that you missed the chance to know ruby language due to anti rails.
Or, I do not know how popular gore/ghost are over there, change the theme. Take your marketing in an entirely different direction. This of course could backfire.
It'd be great if one could toggle the quality of the videos, the default is 480 but I noticed you guys offer 720.
Many systems do. In the US, people advocating for mandatory sentencing say the same thing about the justice system, and the RIAA and the MPAA say the same thing about the DMCA safe harbor and takedown notice provisions.

Outside of getting google to enforce sanctions against whatever "black hat SEO" methods were used, asking Google to act in that case would appear to be asking Google to settle on a single notion of the limits of free speech and defamation when entire countries of people clearly cannot. I'm not sure putting Google in charge of that is a good idea.

(With this sort of thing you start to see why country-specific censorship occurs and may be the best of a set of terrible solutions. See also "the right to forget" vs US court decisions on free speech that is only going to come up more and more)
Write up a list of 10 advertising companies in the Bay Area smaller than Google, figure out who inside needs to say "Yes" for her to get hired, then get a warm intro to that person. Possible avenues would be convincing any of the 432 startups in that space to take a coffee date with you, then asking for an intro after demonstrating credibility. Given that most of them have nothing but time that shouldn't be a terrible imposition. An offer of Real World Experience Selling This should strike most as attractive.

Sending resumes into the firewall may bear superficial resemblance to productive work but does not make forward progress enough to justify doing it. If that's the best idea for a day, that day goes into the No Work Done On Job Search column. That is OK, but you don't want to accumulate lots of them.
OP didn't know. OP is now informed and updated. Thank you!
ha-ha

or, for full effect;

http://www.youtube.com/watch?v=yq5ZSBa_PFk
I was on Egor's end of a similar incident back in my more impulsive years. I wasn't treated quite as well as he was but even so I eventually came around to the realization that being overly confrontational is never the right way to gain attention for security issues (even though it did result in the issue being fixed rather quickly).
Drink driving facts
The drink driving law is complicated and given the severity of any potential punishment, expert assistance from a qualified solicitor should always be obtained. Many road users are confused by drink drive limits and alcohol levels.
Have these been tested in court?

I am waiting for a site that puts clauses like "10% of your income belongs to us" in their clickthrough one day.
"If that's the best idea for a day, that day goes into the No Work Done On Job Search column."

+ 1 - wonderfully put. Thank you.
I don't think anything will happen to Github or even Rails users. There user base will not likely decrease.It will increase infact.

More importantly people reading this forum are very scanty in the larger picture of people writing software around the world. Software and tools get used in 99% of cases for average programmers because of jobs,popularity and usability reasons.

I bet of all the Rails programmers, and Git hub users very few would have heard the news. And of those few who have heard it very few would understand the seriousness of the issue.

The only benefit that has come out of this, is a serious problem has been averted. If this vulnerability had been discovered by some body who makes his bread and butter cracking systems. He could have done a great deal of damage to a lot of systems.

Lets hope that Rails finds and fixes these sort of vulnerabilities. To avoid bigger problems in the future.
You suggested bitbucket as an alternative to the github the thread starter had lost trust in.
Is that because they do not have any tiny computers in their eyes or anything?
Sure abstraction is good and speeds up workflow, but in this case, it was rolled into main without a lot of noise and essentially opened up developers to the situation without giving fair warning that this type of thing COULD happen. I'm not saying the blame lies solely with the Rails team - but the issue here is more with full disclosure and due diligence in communicating to the community.
"4. If you don't have functional English, learn it.

"As an American and native English-speaker myself, I have previously been reluctant to suggest this, lest it be taken as a sort of cultural imperialism. But several native speakers of other languages have urged me to point out that English is the working language of the hacker culture and the Internet, and that you will need to know it to function in the hacker community.

"Back around 1991 I learned that many hackers who have English as a second language use it in technical discussions even when they share a birth tongue; it was reported to me at the time that English has a richer technical vocabulary than any other language and is therefore simply a better tool for the job. For similar reasons, translations of technical books written in English are often unsatisfactory (when they get done at all).

"Linus Torvalds, a Finn, comments his code in English (it apparently never occurred to him to do otherwise). His fluency in English has been an important factor in his ability to recruit a worldwide community of developers for Linux. It's an example worth following.

"Being a native English-speaker does not guarantee that you have language skills good enough to function as a hacker. If your writing is semi-literate, ungrammatical, and riddled with misspellings, many hackers (including myself) will tend to ignore you. While sloppy writing does not invariably mean sloppy thinking, we've generally found the correlation to be strong--and we have no use for sloppy thinkers. If you can't yet write competently, learn to."

--Eric S. Raymond, How To Become A Hacker http://www.catb.org/~esr/faqs/hacker-howto.html

Not that being a "Rails Rockstar" necessarily implies being a Hacker--what I like about your quote is that it shows the phenomenon is everywhere. One nice thing for programmers though is that with online text communications you can hide a thick accent that would otherwise be held against you even if what you speak is grammatically perfect.
Best Homepage Ever.
MacHG looks very nice, too bad it doesn't support Git (or Github doesn't support HG)
"this isn’t a security vulnerability in Rails. A new Rails application isn’t vulnerable by default. It’s a security vulnerability in apps written using a certain style, or perhaps a vulnerability by default in apps written using the generators and scaffolding baked into rails."

Well, gee...so maybe some novice developers write an app using the generators and scaffolding baked into Rails, and as a result they get a security vulnerability that a more experienced developer might have avoided by doing extra work, and you say that's not a security problem in Rails?

Maybe it isn't a "vulnerability", per se, but it sure seems like a poor design choice. A "hardened" framework is going to make parameter whitelisting the default behavior, even if it's a little less convenient. If the github developers (who are presumably experienced) can make this mistake, then anyone can make this mistake.
I think it’s like .find_by_sql and .where and everywhere else Rails provides a way to write SQL fragments. You can compose strings and open yourself to SQL Injection, or you can have ActiveRecord insert sanitized parameters for you.

There’s no “vulnerability by default” in ActiveRecord’s handling of SQL snippets. There’s a right way and a wrong way. Likewise with mass assignment. There’s a right way to use it and a wrong way to use it. FWIW, I don’t use mass assignment, ever, because the “right” way offends my sensibilities by making me load up a model with authorization logic.

Rails is not vulnerable by default because Rails apps do not include mass assignment by default. It’s not like there’s a controller method called ‘update’ created if you don’t write one that uses mass assignment. You have to generate or write an update method, and if you do and you include a sql query, you have to get the sql fragments right. Likewise if you use mass assignment, you have to do attr_accessible right.

All that being said, I don’t like attr_accessible, I think it might have been brilliant at the time but a few years later I think we can revisit this problem with fresh eyes and a lot of experience as a community and do even better. Which by extension means that I don’t like mass assignment.

SO:

We probably agree that this feature should be taken out and shot, but are quibbling over which charge should be read off the indictment before giving the order to fire ;-)
I noticed this today on Usenet. I've switched to downloading all my TV from torrent sites to Usenet because it's much more reliable. Everything old is new again. It's nice to see that the animated shows I enjoy like Family Guy are available in HD resolutions at roughly the same download size as their previously available SD counterparts. I assume animation is really efficiently encoded with h264. Anyway, smaller files and higher quality = happy me.
What exactly would you require to have happened to demonstrate that github was taking the problem "seriously" enough?

Should they have shut down github.com entirely. Tweeted in all caps every 15 minutes until they fixed the problem? Called a televised press conference? What?
Not disagreeing with you, but, as a point of reference, I took 6.002 in person and I didn't take advantage of any of those opportunities for that class. You could argue that it's my loss, and you'd be right, but in practice you can replicate many MIT students' 6.002 (or any other class) experience with just videos and a looming final exam.
Mobile Advertising Platform Round-Up
Yahoo Labs head Prabhakar Raghavan leaves (and joins Google)
Interesting timing, my friend's son was recently hospitalized (in the ICU) with a severe asthma attack. Very scary, and a week later he's still in the hospital -- but improving and out of the ICU.

His treatment? O2 and a nebulizer of some sort.

I can't help but think that with how common asthma is, that we'd be further along in treating it than a 5 or 6 day stay in a hospital for a bad flare up.
Calculating the time it would take to actually read privacy policies
They should have burned the midnight oil and made sure the same problem wasn't prevalent in other parts of the code.

I understand that's the feeling here, but it's unrealistic. I've reported dozens of bugs to shops that ranged in size from 1 to borg. You simply never see a whole set of bugs fixed and pushed live over a weekend. Not even close. Exactly what company have you seen set this standard for professional? The smallest amount of time between notification and public disclosure I've seen get called responsible disclosure is a month. Many, many, many enterprises take six months or longer to push fixes (which is far too long but that's another whole discussion)
Unique Functions that identify efficiency of electronic Camera