skysight-inc/HackerNews huggingface dataset:
Well, the fact that the Air can't be used as a tablet and does not have a touchscreen can be considered a compromise as well :).
There is absolutely no reason why a dockable mobile device would not deliver a full desktop experience.

Have you seen the Android/Ubuntu demo? They ran Ubuntu on a cellphone in a dock. Very impressive.
'Bout time someone took the Rails "rockstar ninjas" down a peg or two.
Regardless of the 'hacker's motives/personality, I think this is yet another testimony to the power of open source.

When you have this many eyeballs looking at your code, the odds of a good-intentioned (however playful/immature) coder to discover a vulnerability is much greater than those of a real ill-intentioned hacker simply due to the sheer number of the former. The issue will quickly get fixed by the community, the kid will get the attention he wants, and life will go on.
Looks like he's in Russia. Good luck. It wasn't that long ago where it was mass belief that this stunt is what got you white-hat jobs. It still seems the sensible option is to rescue someone into the legal security analysis field before one of the person's targets overreacts to a financially harmless taunt by destroying someone's life.
Olympus PEN E-PL1 Review
http://help.duckduckgo.com/customer/portal/articles/216399-s...
Why is this being downvoted? Because it allows for the possibility that a Microsoft product could satisfy the needs of someone when an Apple product doesn't?

If you disagree, say why. A downvote isn't a substitute for substantiating your opinion.
Against what law? Remember that Internet does not necessarily equal USA.
I imagine it'd be pretty hard to get law enforcement interested in this. It's hard enough getting them to care about a single stolen credit card number - imagine reporting "someone added a harmless comment to prove a vulnerability" to the cops.
My thoughts on the latest Ubuntu Beta
Probably some of the "top 1% person in the US [that] gets $384k/year" do not get it only because of being highly qualified and hard working...
This just reminds me of PHP years ago where making it 'easy to develop for' took precedence over making sure that the defaults were safe (security-wise). The issue with this line of thinking is that by making it easier, you attract more less-experienced devs to your platform. Devs that don't know how to read all of the documentation and configure settings in a safe way. So what you're essentially doing is giving the inexperienced more rope to hang themselves with. Just because not everyone will be burned by a lack of security doesn't mean that the 'benefits outweigh the downsides.'
Canada has a public health insurance program. Medical services are privately provided except for hospitals which usually are partially government subsidized on top of the health fees due to the high capital costs of building them.
> Although it dovetails with the well worn narrative on HN, this comparison fails due to the level of care.

The context is purely the model of provision; level of care isn't addressed.

> Second, some of the development of MRI technology happened in Britain. Most was performed in the U.S. Who is paying for the cost of development of this and other new technology and drugs? It's often not the people in places like Canada and France, where government controls hold down prices. Most of the cost of research and development is paid for by Americans. We pay perhaps five times more in the U.S. for some procedures than people in France pay, but the technology might not exist in the first place if we didn't pay this disproportionate share.

This is an interesting point, in that much of the technology is actually developed outside the US, but the very high prices which Americans pay may be funding some of the development. That said, drug companies, for instance, only spend in the region of 12% on research, less than they spend on marketing. This marketing spend is disproportionately targeted at the US, as it's one of the few countries which permits heavy marketing of prescription drugs directly to normal people.
Exactly. For the comparison to be valid (I'm typing this on a Transformer BTW) you'd have to compare to the Air plus an iPad. You'd also have to compare prices, and there the Air loses badly even without including the iPad.
> Hey masklinn, I'm totally receptive to constructive criticism like this, so can you make it even more constructive? :)

Sure, just ask, I'll answer if I can.

> I've seen many "RESTful" APIs with this structure:

Yes, and that API is not even remotely RESTful according to Fielding (whom you may or may not agree with, but he's the guy who thought up REST and coined the acronym). It can be a fine API, but not RESTful: it's not hypertext-driven, instead it's a (hierarchically organized) set of function calls mapped onto HTTP.
Time from exploit to fix in production: < 1h. On a Sunday morning.

I'd buy Github stock if I could.
Form and Fortune: Steve Jobs’s pursuit of perfection—and the consequences.
Here's my proposal for improving the situation: https://gist.github.com/1974187

Merb's approach was to have mass assignment protection in the controller, and I personally think it's self-evident that it belongs there. Moving it into the controller will also make it easier to solve the tension between reducing the friction of getting up and running quickly and having good security defaults.

In general, Rails' convention over configuration make a stock Rails app more secure by default (CSRF protections, XSS protection, timing attacks, session fixation, etc.). This is a case where there's a real tension, but I think that we can solve it by applying some brainpower to the question.
Being alone together. And retouching our lives.
Weather Sentiment Prediction/Analysis
Good work. Please could you write a post explaining what you did, so others using Rails can do the same?
Before I moved internationally for school, I was concerned I would need a secondary computing device that would have a lot of functionality, a lot of portability, and be cheap enough not to worry about if it, say, dropped out of my backpack while riding my bike across town.

I looked at all kinds of tablets, but then I realized I could get more functionality, roughly equal portability and battery life, for a much cheaper price.

My ASUS netbook was the best money I've ever spent.

For $250, I got:

-A 10.1 inch screen

-9-10 honest hours of battery life if you're conservative

-A 1.5GHz dual core processor fast enough to watch 360p videos while running Visual Studio and Eclipse

-2GB of DDR3 RAM

-A 250GB HD

-3 USB 2.0 ports

-Ability to dual boot Win7 Pro and Linux

-A keyboard

-A webcam

-All in a device that weighs less than 3 pounds and fits easily in any small bag.

It blows my mind that people would want to spend $300+ on a device with slightly more portability and far, far less functionality.
One is not obligated to support all features of a standard in order to support some, a reality Microsoft has consistently availed itself of during its existence.
Hmm? The vulnerability is in github's code (not open source) and not in rails.
> "You know sir, with insurances we have all those additional costs...".

Two possible issues here. First, it _does_ cost more to reclaim payment from an insurance company than to get it from the consumer. There are the forms to be considered, and also the fact that insurers often pay substantially in arrears. Also, did you end up paying cash? Some providers of services like this will prefer a cash deal, as they do not necessarily plan to declare it.
Given the guy's English, I doubt he lives in the US and I don't think this is a serious enough case to start an international procedure. I surely hope not, that would just be a huge waste of money and resources, the guy doesn't look like a rich man anyway.
Very enlightening article, thank you!
why isn't software engineering taught as a discipline that can let you implement and create?

It is. But not in school, or at least not in most schools. Many working web programmers appear to have gotten their start by picking up PHP, HTML, CSS, and snippets of jQuery via online tutorials and a lot of tinkering.

But this process has little or nothing to do with either CS or OO. My impression is that when teachers say "introductory programming" they usually mean either "introductory computer science" or "introduction to OO in Java". I'm a much bigger fan of the former than the latter, but Java is an overdesigned and slow-to-learn path to actually implementing anything fun, and CS is not really about the pragmatics of implementation, just as mathematics is not really about accountancy or computer graphics.
It doesn't hurt that the vulnerability was already discussed in a bug report by the 'attacker.' I'd imagine it would have taken a longer time had they needed to track down how exactly this happened, though I guess I'm making an assumption on what their logging/auditing/reporting is like.
Switching from shell to C is a problem from DoD users - you aren't allowed to have a compiler installed on a production machine, so to edit your init process (I guess they aren't scripts anymore!), you'd have to have a separate machine to do the compiling.
In fact, bit shifting is always faster than anything. At the hardware level, it's just wiring; there is no logic involved in shifting the bits, so there is no propagation delay involved, unlike even the single logic gate operations like &, |, ~, etc.

It's so much faster, that many compilers, for integer multiplication, will optimize these multiplications by converting them to shifts and adds. Integer division, however, usually just involves a lookup table.
People need to stop telling other people what they want.
I agree the message is the most important part of this despite the immature way he exposed this GitHub security issue.

Rails can certainly adopt an 'opinion' regarding this issue, but if I think if we were to take a look around at heavy web frameworks today, we would see a very similar approach of "let the developer decide" when dealing with Model security and serialization of fields.

These framework devs have no idea how people are going to use their models, so forcing them to whitelist everything by default may cause unnecessary headaches. Instead, they provide tools to prevent this exploit from happening should devs expose the model.
Villa à Illigh | REF:780
It's a matter of sanity, not difficulty. VLAs are not well-loved by many of the same people who write the compilers.
It's common in tutorials and quickstart guides, usually with a note saying that you really should be protecting things and not using mass-assignment. It just makes the blog in 5 minutes videos cleaner.
As a matter of fact, the vehicle itself is "zero-emissions" and "invisible to the environment".

I see your point, but first of all, it would be a very big step ahead if all the vehicles in cities wouldn't have toxic emissions.

And second, shifting the "dirty" part from the vehicles to big factories possibly makes the process more optimizable.

I agree that other form of energy should be researched, but any step in this direction is better than nothing.
While an ASUS Transformer Prime is still limited in certain ways like the iPad, surely that's already a step in the right direction (as far as this post is concerned)?
I have never used a 11" Air, but they get quite warm; don't they?

In contrast, the iPad 2 has never in my experience got even noticeably warmer than its surroundings, and I tend to believe that the Transformer line will also have that (very welcome, IMO) property.
I have anecdotal evidence to back up these claims: my mother is in internal medicine and my father is a surgeon. both have practiced defensive medicine and my father has complained about how common an occurrence it is on a regular basis.

Many tests, drugs and treatments have been applied in the name of defensive medicine.
Older, more experienced people are not so easily used.

Meh. You can manipulate anyone - it just takes different triggers to manipulate an older more cynical person.
Huh, I had thought the "brogrammer" thing was a parody, not a serious self-description. I usually run across variants of the descriptor "bro-ish" as derogatory, not something people actually want to call themselves; for example, "brostep" is a derogatory term for a subgenre of dubstep that dubstep purists don't like, not something people proudly call their own music. But I'm admittedly totally out of this particular loop.
This has been discussed since the early days of Rails, and they have chosen to leave their defaults as such and encourage developers to implement model security as needed. Github (seemingly) did not implement model security. This is a vulnerability that is different from application to application, and if the team was following best practices, is not there.
مسلسل اكون او لا الحلقة 3 
مسلسل اكون او لا الحلقة 3
مسلسل اكون او لا
Proposal for Improving Mass Assignment in Rails
Whoa bro. Take it out at the gym
From Urban Dictionary:

brogrammer, n.: A programmer who breaks the usual expectations of quiet nerdiness and opts instead for the usual trappings of a frat-boy: popped collars, bad beer, and calling everybody "bro". Despised by everyone, especially other programmers.

Ex: Oh my god, John is talking about football and chicks again. That guy is such a brogrammer.

See also: programmer, frat boy, bro, douchebag, developer

This is not a good stereotype to conjure up, even in some ironic-parody-hipster sense.

It isn't a joke, either; I've definitely seen programmers where I've worked who really do act like that -- and they are like toxin for introverted programmers. Most other programmers probably don't appreciate a "bro" constantly talking about his sexual conquests instead of interesting technical topics or hobbies.
Actually, I bundled the update url with the manifest, so Chrome will auto-check my website for updates from time to time.
Google Apps Federated Auth for Flask
Can we please not equate Google to Gandhi? Google is a corporation every bit as large, and every bit as purely self-interested, as Microsoft.
I've got to say this article was fairly disappointing. So the author finds more value in a laptop than an iPad; that means that everyone else must also arrive at the same conclusion? That's a load of crap. Different people have different needs, and for some, an iPad may satisfy them better.

For me, I've realized that a laptop is sub-optimal, and a desktop and soon an iPad 3 makes much more sense. You see, I only do productivity work for extended periods in a single location. I don't need to haul a computer back and forth to work, and I don't need to do extended work out of coffee shops or hotel rooms. A proper ergonomic desktop workstation is therefore the most valuable and economical solution for productivity in my case.

For mobile use, I just want something to browse the web on the couch or in bed, control my entertainment center, maybe play the occasional game or watch the occasional movie or TV show, respond to an email once in a while, and have the batteries last all day doing it. I seriously couldn't care less about a built-in keyboard, and laptop keyboards are all terrible for productivity in any case. And though the Author thinks the iPad is a, "limited device... in terms of what websites [he] can watch", I think I've had problems with a website all of one time, when it rendered some form fields above a submit button and I couldn't complete a purchase on a small e-commerce site.

I've got a MacBook Pro that is currently being so under-used, that I will hardly notice its absence after I replace it with the upcoming iPad. This whole piece seems like a useless rant to me, certainly not up to my lofty standards for HN-worthiness.
This justification seems especially odd to me since Rails did so much in the first place to popularize the idea that the default behavior should be the one most likely to be "right". Don't they (or didn't they at one time) have a mantra "convention over configuration"?

I guess that doesn't apply to security.
You are so funny.
I'd imagine because at the moment there isn't a tablet market, there's an iPad market. Windows 8 isn't even out yet.
> In the past 30 years have you heard of any medical innovation or drugs coming from anywhere other than the US?

Er, yes, _many_. See some of the recent work in HIV and cancer drugs, for instance, along with many more conventional drugs. It _is_ true that pharmaceutical companies (most of which are, these days, highly multinational) derive a lot of their profit from the US market, but they spend a lot there too; the industry spends more on marketing than research, and this is disproportionately targeted at the US, as it's one of the few countries where one may advertise prescription drugs directly at the general public.

> Of course the MRI machine was itself invented in the US

Hmm? Very arguable, that one. While its medical application seems to have been the product of an American academic (note, academic, not medical device company employee), NMR imaging (renamed MRI for medical purposes, presumably due to the unpopular word 'nuclear' in the original), was previously made feasible through work at the University of Nottingham, in the UK.

Like many inventions which came as a series of parts, it's rather hard to point and say 'Mr X invented this'; there are at least two American contenders, one British, and one Soviet.
In some cases, this really isn't possible. Many companies will not spring for the storage (hundreds of terabytes+) or computing power to test with an adquete data set. In some cases, using a copy of the production database, is prohibited due to privacy concerns.

I know of one company that was running IBM DB2 EEE that had a 40 node production environment with almost a petabyte of data. I also hear that the USPS database is rather big.
Shouldn't rails by default protect belongs_to associations. There is probably a minute number of cases where someone wants mass assignment changes to include the parent's id of that record.
If I send a reply, it comes from a different address (which is not published and is unaffected by the procmail recipe)
This is nothing new, back in ~2004 when I was at university for CS there were plenty of students who were desperate to shed the "nerdy" image and would compensate taking up macho hobbies like bodybuilding , playing metal music, martial arts or motorcycling or by drinking large amounts and getting high every weekend.

The whole brogrammer meme reminds me a lot of DHH. Whenever you see him speak he is always dressed and groomed well and fashionably , likes to swear a lot and has a keen interest in fast cars.

It also reminds me of the sorts of people who are into PUA manuals.
Surely tablets are for consumers, and laptops are for workers and creators. I mean, I can't imagine developing anything on a tablet, iPad or otherwise, but grazing the web should be a breeze on a tablet.

What does my head in is that nowadays, it seems computer = internet, and that is almost the only use people know of.
SpeechJammer: Artificial Speech Disturbance with Delayed Auditory Feedback
I totally agree with this. I thought it was a joke. I didn't think frat guys were actually learning to code and calling themselves programmers or something...

The point of this blog post is basically that it doesn't matter if you program or what, if you're a douche, you are a douche.
Surely tablets are for consumers, and laptops are for workers and creators. I mean, I can't imagine developing anything on a tablet, iPad or otherwise, but grazing the web should be a breeze on a tablet.
The fact that this is even a discussion is sufficient for me to consider it a bug. It's irresponsible of the Rails team to leave this default the way it is given that it's long been a known risk.

That they like to consider it a "feature" doesn't make it any better - it just makes them look like idiots
PULSA
Here is a pic of the guy who said the line about the girls in the hot tub.

http://danilo.ariadoss.com/about/

Pretty much exactly what I expected.
As a Canadian, the stuff that I see other people telling _me_ about my healthcare system makes me upset.

As others have said, it's not illegal to be private in Canada.

Everyone who seeks medical attention at a hospital is sent through triage, you are right. If you don't have a life threatening problem you won't be treated first, but saying "sometimes people wait a years for treatment" is just hilariously misleading.
Although I am not trying to argue against your overall position, my experience with a Core-Duo Macbook and an iPad 2 leads me to the firm conclusion that an iPad is going to feel a lot faster than the above set-up until you add an SDD.
Four Hackathons at SXSW 2012
Do you plan on notifying customers whose repos he accessed? This looks like more than just a minor breach if he was able to give himself admin rights and had read/write access to any repo.
Funnily, the first Diaspora release had the same issue and the devs were ridiculed and called noobs by a big part of the HN community and security "experts" wrote big posts about it. The different reaction here is interesting to say the least.
It actually looks like the vulnerability is on Rails itself, which Github is built on...
Everyone might as well take this opportunity to add attr_accessible to your models.

Models: find app/models -type f -name \*.rb | wc -l

Models with attr_accessible: grep -r -m1 "attr_accessible" app/models | wc -l

If those numbers aren't the same, and the missing model files inherit from ActiveRecord::Base, then look into adding attr_accessible.
This isn't high school; there's nothing productive or rational about assigning labels to yourself or others. Judge someone by the quality of their work and the output of their lives, not how they dress or the culture they associate themselves with.
This is very true. It was actually the argument that convinced me that a public provided healthcare system (at least for preventative treatment) is an awesome idea.
Styles of Thinking
Renegotiation is fixed in all major browsers and servers with the implementation of RFC 5746. http://tools.ietf.org/html/rfc5746

Unless you're a year or so out of date on your patches, renegotiation works better than ever.
I have an older Samsung netbook and haven't looked at the market lately. Does your netbook do 1024x768 natively?

The Samsung I have will do it, but it is weird ... like bitmapped, which makes it unusable.

If yours does, can you share the model you bought? Thanks!
and this cut-the-rope ad has been around for a long time... at least 2 months I think
> Merb's approach was to have mass assignment protection in the controller, and I personally think it's self-evident that it belongs there.

But wasn't Merb merged into Rails? :) Sigh...
If you've read SICP:
http://www.cafepress.com/+white_tshirt,386853836
I'll answer for myself, as I have no idea about the author.

For me Windows is disqualified from the start because it's not Unix or Plan 9. The nature of my work requires a Unix environment, and even if it weren't the case, I'd still prefer a Unix/Plan 9 environment.

The various Unix emulation layers available in Windows like Cygwin, SFU/SUA/Interix, UWIN, MKS don't satisfy me the slightest, and even if they did, they'd restrict me to the Unix side of things while on Linux or Mac OS X I most often use plan9port.
Nobody who's published an RPG based on Harry Potter can refer to himself as "bro".
Can't decide whether to love or hate this guy. For his young age, he seems to have an impressive skill set, but you can totally tell the douche growing inside
Tuning In to Dropping Out - Which educations to subsidize
Its hacker news. What do you expect? Not many Windows users here.
This seems to be one of the fundamental misunderstandings people have about capitalism; they like to think of it as a form of virtuous economic freedom. A market system, however, only works with reasonable information. In this case, it is apparently of benefit to the providers to treat them as trade secrets, but the system will operate more efficiently if they are forced not to do so (as they are in most places).