skysight-inc/HackerNews huggingface dataset:
"It's obvious that the author of this article has never actually used systemd."

There's no need to start your article by being a douchebag. You could just make your point.

Also, I don't think you really got it right here. His point is that lots of functionality has moved from shell scripts to C. Yes, you have an ini-style configuration file. That's not the same as a shell script.

postfix took the simple-flat-config-file model whereas exim provides a much richer language. Some years ago I attempted to do something slightly odd for SQL auth in both, and found that postfix only let me use SASL, and SASL didn't have a driver for what I wanted, and therefore in order to make it do what I wanted I needed to write a C-based SASL driver to execute the SQL I wanted. In exim it was 3 or 4 lines of config.

Similarly, if I hit something systemd can't do I now have to write C to add a config file, rather than write a couple of lines of shell.

that is what the author means.

I could certainly see an advantage to providing an ini-based approach as well for people who regard current LSB conmpliant init scripts as "shell scripts that made no sense to me" - and for people like me who -do- love them, but would be quite happy with a simple way to configure simple things.

But please don't try and take that power away from me when I need it.
How else? By showing him how to securely disclose similar issues, for example.

Having the whole internet bashing him isn't good for anyone.

I'm for one very glad he kept pushing it out (but didn't do any real harm). This kind of vulnerability is just so common in Rails apps: I'd like to see safer defaults.
I can't help but be reminded of the various copy protection schemes they used with CD/DVD disks, such as SafeDisc. It feels like this is "nature's copy protection scheme", if you forgive the cliché.
The vulnerability was in github, allowing a public key to be added to any project.

The vulnerability was introduced to github by misusing a rails feature.
He'd already been ignored by the rails devs.

For a normal project, sure, whatever, but when the security hole is in a framework--especially one as widely deployed as rails--you eventually must cede that, yeah, the fastest way to get something serious fixed is to do a public exploit.

What if he'd submitted the fix to github and they'd quietly patched it and said nothing? What if they'd said something but nobody cared because hey, it's fixed now? What if they'd flat-out ignored it as the rails devs did (perhaps even citing that as their reason)?

No, security only reliably gets addressed when it hurts and hurts publicly.

The combination of hitting the exploit on perhaps the most visible site for the target audience and doing so in a way that didn't harm anything is impressive.
I've had this project in my head to build a graphing calculator thats a full Linux workstation for some time. It'd be really nice if the display and keyboard could be in the device to start with. Ya know, so I could walk around and use the thing.
> Whether or not rails' defaults are sane is a completely separate question. Egor acted out against GH when he was ignored by rails dev. Two entirely different parties.

100% agree here. The Rails devs may have ignored his issue, but GitHub are the victims here. Why not email GitHub and inform them, on the provision they communicate the fix they just made?

Doing this and saying "P.S. GH sorry, I was bored" is not acceptable.
How did Scirra get HTML5 audio so perfect in Construct 2?
Hmm, interesting site. Looks familiar ... almost too familiar ... waaaaaitaminute: http://phpispoetry.com/question_page/question/16 looks just like http://stackoverflow.com/questions/2283937/how-should-i-ethi... . Yup, an exact copy, right down to mentions of "bounty system" and "thanks to all the Stack users", and the only answer you have is likewise word-for-word identical to SO's highest voted answer. Is that both your question and your answer that you asked on SO, back there in 2010? If not, see this for proper CC-attribution guidelines - SO allows for republishing of user contributions, it just requires a few simple rules to be followed for it: http://blog.stackoverflow.com/2009/06/attribution-required/ Quote:

"If you republish this content, we require that you:
- Visually indicate that the content is from Stack Overflow, Meta Stack Overflow, Server Fault, or Super User in some way. It doesn’t have to be obnoxious; a discreet text blurb is fine.
- Hyperlink directly to the original question on the source site (e.g., http://stackoverflow.com/questions/12345)
- Show the author names for every question and answer
- Hyperlink each author name directly back to their user profile page on the source site (e.g., http://stackoverflow.com/users/12345/username)

Alas, you aren't doing any of these things on the site; worse, the texts seem to suggest that you and "peter" have written all of that yourself. http://phpispoetry.com/user/best That is an unfortunate issue that you've overlooked; people tend to get all possessive of the stuff they're written ;)

As for the site, it looks nice and clean, and feels very responsive. Perhaps making the tags interactive would be good - but I feel you're working on that even as I'm typing this :)
Did you do a clean install of windows? Mine ran like crap until I did that, plus I doubled the pre-installed RAM to 2GB.
> Suspending his account atleast stopped him for 5 minutes while they were working on it and prevented further immediate harm.

But it didn't stop anyone else - and Egor at least very clearly showed that he was not malicious.
RaspberryPi: Arch Linux ARM available for download
So randomness is an inherent guaranteed feature of life itself. Imagine if this applied universally to skin color too. What would our prejudices be then? Cue 1960s Star Trek episode where one guy is white on left side while the other is white on his right side...
We will never, ever suspend or ban accounts that follow responsible disclosure. Ever.
I'm challenging the idea that if you're just using an ORM for persisting objects you're probably doing it wrong.

For the vast set of programming problems having that user table that's relationally linked to a person table that's relationally linked to a company table that's relationally linked to, etc. gives you far more flexibility than having to start dealing with getting objects out of a key-value pair store and manually piecing together complex relationships just to add a simple page to the client's admin page to say how many people have setup their account properly (as a random real-world example where the admin emails their staff and they setup their own user details).

Once you get past the basic CRUD of a problem and start having to use the data for functionality, basically past anything more than a toy program, the relational model through an ORM is going to be much simpler than a NoSQL solution.

I just don't get how this statement makes sense:

ORM is great when a database is being used as a simple program data persistence layer, but if you limit yourself to that then you might as well use a NoSQL solution

I wouldn't because as soon as you start adding fairly simple functionality the NoSQL solution would rapidly become a nightmare. To me NoSQL would be the go to solution if I had a few very basic data structures that I had to do a lot of work on, not the opposite as dmethvin suggests, lots of different objects with simple operations.

In concrete examples, Google, NoSQL, Instagram, probably NoSQL, something like Freckle (Time Tracking), SQL, Salesforce, SQL all the way.

But as I said I've not had a project or personal project yet where I've gone 'Aha, now is the time! NoSQL here I come!' so push back if I'm doing it wrong!
Can you read the post without signing into a Google account? I click through via my iPhone, and get prompted for a Google account. Isn't this a post about getting tracked on the web?
Biteads.com is paying people to advertise their site
I've never heard that about Facebook, only the opposite: they hire awesome programmers, and then teach them PHP. Certainly, any Facebook developers I've met (online or in real life) have been pretty awesome, though my sample size is in the single digits.
"Hey customer, someone hacked your page thanks to a vulnerability in my service, but don't worry... I've added him as a contributor to my project and sent him a thank you email."

Like that?
Your probability calculations are invalid.

> Lets assume for simplicity, there is only one habitable planet in the entire Milkyway galaxy, Earth. And there are 'y' number of planets in Milkyway in total.

Okay...

> Then, the probability of finding a habitable planet (Earth) in such a galaxy is 1/y.

This does not follow. I'm going to quote Feynmann here:

"You know, the most amazing thing happened to me tonight. I was coming here, on the way to the lecture, and I came in through the parking lot. And you won’t believe what happened. I saw a car with the license plate ARW 357. Can you imagine? Of all the millions of license plates in the state, what was the chance that I would see that particular one tonight? Amazing!"
First he submitted a bug, and they closed it.

Then, he reopened the bug to prove it was a bug, and they closed it again.

Then, he submitted a new bug, 1001 years in the future, and they closed it, saying "Good one ;)"

Then, he committed a text document to master, and they got all upset about it and got Github staff involved.

How about this Ruby devs: actually consider what you're saying. Isn't the point of Ruby to make things simple? Yet, somehow, making rational default choices only applies to everything but this. I know that you love to feel better than everyone else (see: http://37signals.com/svn/posts/3124-give-it-five-minutes), but seriously, you shouldn't get all upset about it later when it turns out you're wrong.

This is why I refuse to learn Ruby. I don't want to be associated with that community. "Learn Ruby if you want to be associated with a bunch of people who call themselves Rockstar Programmers."
I'm curious if he reported it in any other way (www.github.org/security/). IMO, if you report something, and no action is taken, it's understandable if someone does an exploit like this, although not strictly ethical or right.

A global source code repository is one of the more terrifying targets on the Internet; imagine subtle compromise of various libraries...
I wonder if Microsoft will criticize them the same way the criticized Google for similar workarounds.
I don't get how many of you seem to take this issue lightly. Imagine what would've happened if this guy was a black hat. I use github for private code hosting and this a definite breach of trust and if I don't trust github how can I pay them? Sure they fixed the issue within an hour but still this could have ended far worse.
I think it is more likely they need to verify that he only did what is currently known about and nothing else (such as if he had granted himself access to some private repos, for instance). Much safer to suspend/terminate his account first just in case. They are likely combing access logs, etc. Maybe they will reinstate it later after a review. Who knows other than Github.

It could also be to reduce legal culpability. If they left his account enabled and he had granted himself access, and later did more damage, they might be liable for negligence? Not sure. IANAL, etc.
That's a matter of opinion. He intentionally reported it against rails because he thinks it is rails' fault for making it so easy to have this security problem. Given that the #1 rails app out there written by professionals suffers from it, and reportedly others do too, he has a point. You can disagree if you want but it's definitely not a "classic noob mistake".
You are on the mercy of the guy who found the vulnerability, if you like it or not. This person can have any personality and most of them don't care about your costs. They did your work and invested a lot of time. Most of then don't want money, they want appreciation for what they did. You can give it to them, or they take it and they have the perfect tool for that.
Well, if like in this case, he warned me and I told him to "fuck off", I kinda would be grateful, even more like "Should've seen that one coming...".
Mass assignment is one of the worst practices in typical rails apps. And their fix is to move everything to the models. All so they can have "skinny controllers" with one liners like @user.update_attributes(params[:user]).

Seems crazy to me. I've never used attr_protected, or attr_accessible because controllers should actually parse out the params and then explicitly define what's needed to update the models.

It's more glue code, but you're making rails controllers do what they're supposed to do... parse http form input and return results.
They also don't usually support softsubs or multiple audio tracks, which are completely standard in anime releases. As a result of that, the anime community pretty much gave up on device compatibility when they left XviD behind. People who really want mobile versions tend to transcode, resize and "harden" the subs, but that's a lot of work.

That said, I agree that "annoying" is the right word in this case. The Hi10p switch has caused a lot of problems even for people with PCs - software support took ages to reach acceptable levels, and it requires a lot more CPU power on the decoding side for a very minor quality increase. They could've waited 6-12 months before pushing for wider Hi10p adoption, and I think it would've gone much more smoothly.
Saw your full comment on github: https://github.com/blog/1068-public-key-security-vulnerabili...
Well put. I guess startups can act enterprisy too when money is involved. The irony is that had they been actually proactive, they would have avoided this kind of publicity and money (for 3rd party audits).
RAR is lame? Are you saying this from the viewpoint of a consumer or from the viewpoint of someone intimately involved in the scene?
In case you didn't see his bio, he's 18 years old. I'm not a fan of what he did, but frankly, his behavior is probably better than mine would've been at that age + circumstance.
Faster Unsigned Division by Constants
Hmm. Here's how I stepped through the logic:

Given a hacker who found a vulnerability, exploited it within his account, and publicised it we can conclude that (1) he is smart (or lucky), (2) he does not pose an immediate malicious threat, and (3) he has the potential to become a serious problem.

Engaging with him carries the benefit of understanding the vulnerability while opening a dialogue that mitigates the hacker mutating into a serious problem. It carries the cost of not being able to claim, as GH did, that it pro-actively identified the vulnerability and thus looking weak. It carries the risk of giving the hacker time to rummage through more of the system.

Suspending him carries the benefit of being able to look strong while mitigating the risk of the hacker causing further damage. It carries the cost of losing a lot of emotional lee-way and thus future conversational runway with the hacker. It thus increases the risk of him turning into a serious problem in the shadows. There is also the risk that future users who happen upon vulnerabilities will think twice about publishing their finding under their real name.

Given, as many here have pointed out, that he can create a new account and be equally damaging (the risk is a property of him, not his account), the suspension offers no tangible benefit long-run benefit above that of managing perceptions. I don't know how sensitive GH's user base is to the perception of security.

The unknown here is whether GH has evidence that he acted maliciously, i.e. modified repos in accounts whose owners didn't give him permission to modify.
IIRC this only works in IE. If someone sniffs their network traffic they could confirm what is going on.
The author has a point: many iPad buyers spend a lot of money to work around the limitations of the device. Is not a minority, else there wouldn't be so many keyboard cases for it.

I think the problem are all those pundits talking about the "post-PC era". Some are even reinforcing that point with Windows 8, but guess what? That OS is Windows7 with a touch UI layer on top. The only real novelty is the ARM version, in which case we're entering the post-WinTel era (at last!).

The iPad beats the crap of any PDA or PMP, but PCs and Macs? Sorry, is just not that versatile. The limitations it has have more to do with battery life and engineering constrains than actual ease-of-use.

And APPL patents are rarely made into actual products. Ironically that one from 2008 has far more in common with that slider tablet from ASUS than anything APPL is actually working on.
I have a rule that says that if someone sings the praises of PHP then they are ignorant of all the other languages available as alternatives. If it's your first language, and you praise it, that's not so bad.
Yeah. It was the same thing when bittorrent became big. It was the anime groups that were the first big adopters. Mainstream releases took a lot longer.
> If it's a concern, get a hold of the company and let them know.

Easier said than done. It's hard enough to find the right people to talk to when people are so paranoid about connecting devs with customers, and if by chance you wind up talking to a PM first, the first thing he does is engage legal, which means instead of fixing the problem and protecting their customers and data, you may now be threatened with lawsuits, have the incident reported to the FBI or someone for investigation (on the assumption that you are in fact trying to extort them or something).

In this world, I'm not sure you can 'win' at this situation at present. Until there are protections for white hats that are broadly recognized, I'm going to side with people like Egor, who find a big damn problem and don't use it for ill.
Well no. There may have been a language which was called Python but it seems to have been grown and added to over the years (OO, a faster JIT, more libraries) which suggest to me that the incarnation of Python which predates the web is not the incarnation that became popular.
Ask HN: What does "learning" a language mean?
Heavily inspired by sbov's comment [0] on this [1] HN thread about this [2] Ars Technica article discussing this [3] StackExchange question. (An aside -- there has to be something interesting to say about fragmented discussions and different value added by different communities!)

I don't want to make any suggestions as to what it means because I'd like to hear what you think.

[0] http://news.ycombinator.com/item?id=3664054
[1] http://news.ycombinator.com/item?id=3663727
[2] http://arstechnica.com/business/news/2012/03/ask-stack-should-i-learn-a-new-programming-language.ars
[3] http://programmers.stackexchange.com/questions/136133/why-should-i-learn-a-new-programming-language
This is bad advice.

Did github run over your dog or something?
Addiction or fad? Back in the 1980s, there were people addicted to the CB Simulator of CompuServe. Some spent over $1,000/month in connect-time fees. That didn't save CompuServe in the face of change. And I'm not sure those CB Simulator addicts transferred their addiction to AOL. And if they did, are they on Twitter today? I really doubt it.

"Addiction" is just the latest marketing hype (it seems marketeers have also dumped "Tipping Point" for "Inflection Point") for those looking for the tech world equivalent of The Secret. There really is no guaranteed road to success at all.
"threats of verbal abuse... of any GitHub customer...will result in immediate account termination."

So if you even threaten to verbally abuse me (a Github customer), your Github account will be immediately terminated. Sweet.

Seriously, this is why no one reads TOS.
I've used an iPad before and I am totally willing to admit that it is a sexy device. It felt fast and was able to do a lot of useful things.

What really convinced me to buy my netbook was the ability to not worry about my computing device.

Carrying around a $500 thin piece of hardware that is constantly in danger of breaking in half or getting stolen in an unfamiliar European city was just not appealing to me.
I first learned about bit-shifting when I took DIP / Computer Vision as an undergrad. All the assignments were done as plugins for ImageJ, which is apparently widely used in the scientific community (or so the course claimed). ImageJ stores the pixel values for images as bytes, ints, or longs (depending on the color-depth), so to get the individual component values from a 32-bit RGBA image (8 bits per channel), you would do something like this:

int pixel = image.get(x, y);

int alphaVal (pixel & 0xFF000000) >> 24;

int redVal = (pixel & 0x00FF0000) >> 16;

int greenVal = (pixel & 0x0000FF00) >> 8;

int blueVal = (pixel & 0x000000FF);

That's just one example w/ one piece of software, but I know similar approaches are often used within the world of imaging / graphics. Maybe networking? Seem like it would correlate well to IP address operations.
Doesn't gmail stop these attacks without needing to force plaintext only by simply disabling images by default?
The age range for my courses is 11 to 65 so far, but I haven't been able to get statistics on the median. It's a touchy subject to ask folks their age, but my guess is the median is about 30, or that it's bimodal with 20 being one hump, and 30 being another.

Another thing to keep in mind is that a computer is already interactive. The idea that you need "graphics" to get students interested is completely unfounded, and the only data comes from experiments from companies trying to sell graphical programming systems for education sales. Even then these studies were done in the 70's and 80's when many people just didn't have computers.

In my experience I've found just making simple text adventure games is entertaining enough. Think about it: It's a game that is approachable by anyone, they are fun, they involve writing, their "graphics" are immediate, they don't require any geometry, and the output looks a lot like the program itself. That's why I teach them. They're easy but still fun.

My experience says you don't need crazy amounts of sensory input to keep people interested, and in fact is just distracts them and frustrates them. Keep it simple, but make sure it has depth that they can discover.
Every couple of years, I consider LASIK and its variants. But I keep coming back to "How do I find a good doctor?"
Ask HN: What % of your users have JS disabled?
Always a consideration when deciding how much time to improving the none JS user experience, curious what the stat's are for sites run by HNers?
Especially if we are claiming that DHH is dressed well!
That may have been true at one point, but it is a totally obsolete practice due to Bittorrent.
Cool idea, but I'll stick with Github + Octopress.
whoa whoa whoa

Ruby is a really cool language with some fascinating features--don't limit yourself by assuming that you also have to learn the Rails stuff.

Seriously, give it a shot in one of its more palatable forms.
Please update your TOS to explicitly define what 'reasonable disclosure' is. I'm a paying customer and this comes off as arbitrary.
This is a technical site. If you write a blog post about HOW "forgetbox" works the people will be more interested.

For example: What is the tech stack? Problems with multiplatform support? Gmail integration? Internationalization/Localization? Does is work behind firewalls? What does "It works even without Internet" means? How do you handle folders? Links? Desktop.ini files?
Talking To Your Hangover
Programming Robotic Turtles in Minecraft