skysight-inc/HackerNews huggingface dataset:
Tell that to STM. Sure most new programming languages are amalgamations of existing concepts, but new stuff does turn up from time to time.
I fail to see what GitHub did wrong here. They were attacked, they suspended the account doing the hacking, and they fixed the problem. Then, they blogged about it, explaining in detail what happened. Apparently they weren't quite reverent enough for the person who wrote this article.
Agreed. He used an account trivially tied to himself, and posted publicly with his full name and picture on his blog explaining what he did, after having complained about the existence of this problem in public in the past (though apparently not specifically about Github).

He might have been stupid to do this, and a bit childish in his approach, but he did not go about it in a way that's reasonably interpreted as malice.

As a Github user, it angers me that they've responded in this way.
Yep you are right. Almost no-one does any drawing or drafting. Apart from every moody teenager in the world as far as I can tell. Plus the whole creative industry.

Oh, and artists.
Please note: if you use SourceTree as a Subversion client and you store your local repo in git format, empty directories will not be tracked or versioned.
They 'bought' this client.
> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable.

I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked.

BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you must trust all of your data with the one provider, who might go belly up at any point and take it with them.

Yes, GitHub provides some fantastic social features and helps with community involvement through these features, but if you are dependant on a "single service" and you're using a DSCM/DVCS, you should probably look at a few alternatives to reduce that dependancy.
Its a blog article. I think he is just expressing himself. If Apple and iPad happen to be highly valued keywords, then so be it.
Apparently wikipedia's format is a pain to parse. I think jgm posts here as fiddlosopher he is the best source for the gory details...

But there is definitely sufficient motivation just google "convert wikipedia to" for some examples. I think that the arcane syntax is a big lockin factor with large wikipedia based sites...

There is a ticket for it: https://github.com/jgm/pandoc/issues/388
Windows 8: Microsoft Gambles on a Tablet-centric Future
Erk.

webOS email client leaks data all over the place.
So if I got this right, this is the order of how things happened.

1. Egor finds a vulnerability and reports it. https://github.com/rails/rails/issues/5228

2. It gets ignored and he is being called a troll.

3. He proves that he was right by doing a harmless commit to to the rails master repo.

4. The vulnerability gets fixed quickly as it got the focus of the community.

5. His account gets suspended

Not sure I agree with the suspension.
The quotes around holman's name in his post seemed to indicate otherwise.
True. And CS is still one of the more practical degrees. But in the end faculty are weighted on their research, and producing Phds who cite their research, so post-undergrad employment isn't a big concern.
A company I worked for was started by someone doing this kind of work in biology. In particular trying to find matches in the ACTG strings and when there is a huge volume of data.

The startup was doing network compression - put an appliance either side of a WAN link and transparently compress the data inbetween. The core loop of that is examining IP and TCP traffic and determining if you have seen something like that before and how much of a match you have. If there is a match then you can just send the match details to the other side rather than the actual data. Typical compression ratios were 20:1 / 95% - ie you could stuff 20 times as much data through the link.

The standard zip algorithm has a window of 32kb (ie it looks roughly 32kb behind to see if data has been repeated). bzip2 uses 900kb. That is usually less than a second or two on standard WAN links! The founder's algorithm worked over hundreds of megabytes.

(The company name was Peribit Networks - you'll find Wikipedia rather unhelpful.)
> Beyond any shadow of a doubt, a shit storm of epic proportions has just gone down.

Breathe.
I have been using PHP for 4 years, and Ruby and RoR for a month or so.

And I have noticed this pattern:

In PHP frameworks, creating an object with raw $_POST is as common as in Rails (params), because it's faster for the developer. Of course, it's a known bad practice, and is discouraged.

The difference is that when a php developer makes this mistake, people say it's because php developers are all noobs and php is crap.

Now, when a Rails developer makes the very same mistake, it gets fancy names like 'mass assignment vulnerability', and by what I read in the comments on github, they are fully convinced that no other framework has this 'vulnerability', because no other framework has this feature of 'mass asignment'.
"Go looking for serious security holes in Rails? Change defaults so Rails users don't unsuspectingly open themselves up to attack? Fuck that! Let's add CoffeeScript instead. That's how I roll" - DHH*

* Not actually DHH.
You don't list a source, but I'll propose a different stat. A survey in 2010 implied that only 33% of folks kept images on... but that's a wide jump from 100%.

http://www.clickz.com/clickz/column/1716214/disabled-images-...

Your point is right, that emailers are trying to get around the image blocking... But it's not that everyone turns off their images; some folks still keep them on. The question then becomes: what's the best way to block tracking pixels while still allowing consumers to experience attractive emails if they wish?
The point of his hack was to _make_ him a contributor to rails.
This is correct. People who don't understand what a mass-assignment bug is are running with this story. It's like when we witness a DDoS and have to tollerate people who think it means that the targeted party was infiltrated.

This bug allowed one to add their public key to another user's account, and make changes to comments and issues.
AFFECT, grrr. Not effect. To effect every coder would be to bring them all into existence, which is clearly not what happened here.
I meant that people upload pictures to Pinterest and they upload pictures to Imgur, but no one would ever worry about the images they uploaded to Imgur, because it's so anonymous.

I think Pinterest has managed to attract a different crowd from Reddit/4chan. For Pinterest users, it isn't so important to know that at any moment you can retreat behind a cloak of anonymity, whereas Redditors and 4chan users regard it as a fundamental human right.

I'm glad you commented though, I agree with what you're saying and I had no idea about flicker users having a history of people pulling their stuff. That definitely changes the game.
AFAIK he did warn them about it, and they did nothing. His actions are a bit childish but he did no harm. Plus he brought shitload of attention to them which isn't a bad thing. It's totally understandable they suspended his account but if they want their reputation restored, they better contact him and sort this out together.
People use services like GitHub because they provide security, reliability, uptime, protection against hw failure, centralized issues and patches, and so on. If we have to worry about each of these on our pwn, what's the point?
Give me an F'in break. I understand security is not something to take lightly, but no system is infallible. There was an oversight, plain and simple. It is debatable whether the Github/Rails Core Team was too lax, but I for one am tired of hearing developers whine and make a witch trial out of groups of developers that have moved the development community forward several huge steps just to make themselves sound smart or feel fulfilled. If you're such a hero, why didn't you discover this loophole? Please stop writing provocative statements and behaving as if the sky is falling on top of your head and the very fiber of our being is at stake. An open source language and a website written in that language were shown to have a flaw. Which has since been fixed. I hate developers who like to sound smart at the expense of somebody else. Get over yourself.

I also don't see how you can blast Github for its oversight of this issue but then defend the "hundreds of thousands" of sites that use Rails. Aren't they as culpable? Oh, I suppose Github is held to a higher standard than the rest of the dependent apps. If this is Github's fault, then it is also every other developer's fault who doesn't by default disable mass-assignment of attributes.
I can see how the standard "first class is scheme second class is discrete math" scares some away. How big of a population actually gets lured unto programmingblater in life?
Of course: anything said about the future is "speculation"; stating as much is pointless, as it is impossible to say otherwise. ;P We can only speak of the trajectory of things we can observe, such as market behaviors or patent filings.

To comment on "OS X apps on [] iDevices", that is still a notion that comes from the (I argue flawed) way of thinking that extrapolates a few isolated variables from today without taking into consideration how they will affect each other.

In this case, the performance and battery tradeoffs of multi-tasking are already changing in hardware: I do not feel like my 11" Air (again: nearly the same dimensions as the original iPad) is drastically worse for supporting multitasking.

Meanwhile, OS X /is/ moving in a direction of more restricted applications: it would not be surprising to see most normal software start being suspended when in the background, in exactly the same manner with the same exceptions as on iOS.

As for the "post-PC world", I fail to see how any of this is a "pivot": in fact, it seems to be exactly where they are going based on both their behavior (looking at the changes they are making to their product lines) and their patent filings.

Apple is explicitly bringing iOS features to OS X, where they are actively dropping Mac branding. Meanwhile, the performance of the iOS devices is increasing and they are bringing an ever more complete programming experience to it.

During all of this, they are actively evaluating hardware that combines the benefits of both of the platforms (specifically: keyboard and touch). Seriously: if I had a touchscreen on the MacBook Air, I'd question the entire point of having an iPad.

Given all of this, it would be shocking if they were not intending to unify the two platforms, and that is why this is relevant to this article: the author is stating that he doesn't want to have an iPad+keyboard, and it seems highly likely that Apple agrees.

(Finally, I fail to see why it is relevant to say that "two years is a long time in tech", and then bring up competition; it is certainly and obviously true that everyone is seeing this same vision, but the article was about people and their iPads.)
Ironic then that is the commentator (not quite antagonist) in the "Example" who exclaims "OMG"!
How to Multiply Numbers that are Close to base 100 in just one line
Nothing in the article would lead one to believe he didn't understand the distributed nature of git repositories, but a lot in the article would lead one to believe he was specifically referring to the data loss issues on GitHub if someone wiped out a project.
It's poor design in Rails, but not a security hole as such. The security hole was on GitHub's side.
I've yet to see any of the people conflating the Rails repository with the Github team reply to any of the (many) people in this thread pointing out that creating a ticket in the Rails repository is in no way the same as warning the Github team, so I'm really curious - is there general confusion about where the lines are between Github and Rails, or are you just being obstinate?
You did it under your own full name. For me that's enough to consider your intentions to be good, even though it might've been smarter to try a bit harder to bring attention to the issue in other ways first.
Noam Chomsky - media manipulation strategies
I am Lucky: Influencing Lady Luck
Given that this is a community of entrepreneurs, I'm surprised how unsympathetic a lot of people here are to this technique. Operating a business online, analytics are a very important part of understanding how your users interact with with your service and improving the quality of your correspondence. Facebook is just trying to identify which emails people respond to (i.e. open) most.
I don't think anyone is dreadfully concerned about service availability - although that is certainly a concern.

The problem is that source code is incredibly valuable and often represents many man-years of effort. A competitor could use this to bypass a lot of the early architectural fumbling around that we all do. Also, source code often contains passwords and shared secrets like Facebook secret keys. Disclosure wouldn't be the end of the world, but it could certainly be disastrous for a lot of companies.
> If we have to worry about each of these on our pwn, what's the point?

You should always have to worry about these things, regardless of who's hosting things. It just so happens that Github, to date, has been checking the boxes in these areas and has established a reputation for doing so.

But, if GitHub losing your repo/having it trashed beyond repair will kill your project (or severely hamper it), the cost of setting up a second Git server and a couple of hooks to mirror your push is very low, in both dollars and man-hours.
I agree with your sentiments. What Homokov did was childish, but he made his point in a non-malicious way that got the message out better than silently writing a letter to the admins. It is evident from the events that occurred that this is an issue in Rails that needs to be fixed. What does it say about a feature of your framework when, by default, one of the largest code repository hosting sites in the world is vulnerable? The phrase "meaningful defaults" has never been more relevant.
Except he also opened a closed issue, compromised 2 other accounts and impersonated another user, something he admits to in his blog.
I have yet to work out why anyone should wish to turn on html in emails ever and I always thought that was the start of email being broken. Protocols existed before machines and should serve us as well as them.
It's not a flaw, because the flaw in this case was a feature! That's what we call "insecure by design". Its PHPs register_globals all over again.
I lost a tremendous amount of respect for Github when I heard they'd suspended his account.

I have more of an issue with the Rails team for not accepting that this "feature" is a massive bug that they should've changed ages ago, though.
I think this all depends on the user. If you are a person who is largely a consumer of data (reading Twitter, checking email, etc.), the form factor and weight of a tablet is great. If you produce more data (constantly writing emails, code, working with spreadsheets, etc.), you definitely need a laptop.
You're conflating two issues here. He's arguing that the Rails team was ignoring an important issue by noting it was an easy end-user fix, and GitHub overreacted by suspending him after he tried several times to bring it to their attention, and then grossly mislead their user base as to the extent of the issue (which sounds like a really fundamental security issue that any professional Rails developer should know how to avoid) and how they discovered it (i.e. they didn't discover it, they had to be shown it). You're responding as if GitHub was simply being attacked for not fixing the issue.
Why? I would expect any company to suspend the account of someone hacking them.
It also reminds me of the sorts of people who are into PUA manuals.

Care to elaborate? You say it like it's obvious to everyone that being into those manuals is a heinous crime, or at least prima facie evidence of humongous douchebagdom in a person.
Ask PG: Thought's on Google's "Don't Be Evil" Mantra
I came across your Startup School talk from 2008(http://www.youtube.com/watch?v=q7K0vRUKXKc).

In the talk, you mention how companies that always (appear to) work for the net benefit of the customer do well, the two main examples being Google and the early stages of Microsoft.

In the recent turn of events with Google's new unified search policy (and their quest to make more money with ad-targeting that is not only accurate(read more expensive), but also very creepy), do you believe that Google's elixir of youth has now run dry and they are in the process of becoming like Microsoft and IBM? Will their bullying continue?

The same could be said for Facebook. In the beginning it appeared that Facebook was providing a social network with a clean UI, in addition to being a safer alternative to the sex-offender-infested MySpace. Facebook has adopted the "bullying" mantra with every new product feature, e.g. News Feed, Ticker, and Timeline. Moreover, many feel very insecure with all of their information being in Zuckerberg's control. Though, to be fair, they voluntarily gave that information up by signing the TOS.

Do you feel that Google and Facebook are now "over the hill", have matured, and in the coming years will no longer be as relevant? These giants may stand, but have their actions sown the seeds for new startups to takeover this space?
That's an oversimplification. We have a big virtual stick, which we use to make some guys to register what we want on paper and give other guys real big sticks so that they will tell us to do what we actually wanted. At least, that's how it's supposed to work, I guess. (And it's also oversimplification.)
Anarchist are more open than content providers. On the other hand, content providers and publishers only act in wake of revenue loss.
> Beyond any shadow of a doubt, a shit storm of epic proportions has just gone down...

> ...this episode has been handled is a face-palm fail of epic proportions.

I'm all for, like, the evolution of language, but can we please all, like, agree that 'fail' isn't, like, a noun, and 'epic' is, like, totally overused.
You could say the same for any website. What's different?
it would be awkward to expect to see two views of the app, one mouse-driven and the other keyboard-driven, being flipped between via an MVC paradigm.

I'd expect that both views would be fairly similar, like the two different views on an iPad vs. iPhone app, or when rotating 90 degrees. The OSX view would be tailored just for it; larger screen size, multiple displays, different input, etc... Apple is already unifying the look-and-feel of OSX and iOS apps, getting ready for some sort of merge (iCal/Calendar, Pages, Reminders in 10.8).

We're probably going to see five major input devices in all computers a few years from now. Keyboard, mouse/touchpad, touchscreen, voice, and physical gesture (e.g. Kinect, eye tracking). No piece of software has to use all of them, just as many as necessary. So I wouldn't expect "every" app to have an OSX and iOS mode.

In the future, a sixth input device will probably read our thoughts directly. :)
attacks? Run for your life, is mute-sound-email-tracking attack!
Isn't the multi-part thing for distribution on newsgroups?
you seem confused on the distinction between the scene and P2P. pretimes have nothing to do with this. the torrent sites aren't the ones doing the capping, encoding, or releasing.

when you see on your torrent site that a show has a pre-time of three minutes, that's the time it took to grab the show from a scene FTP topsite, download it, make a torrent, and upload the .torrent file to whatever site you are using. when a torrent 'pres' is when the scene releases it. before the pretime, the torrent is encoded, rar'd and FTPd to a scene FTP dump.

the reason that split rar files are used is so that the scene uploader only has to upload the first chunk before they can claim credit and other groups can begin to download. if the release was uploaded all in one piece, it would have to be uploaded completely before anybody could start to download it. with split rars, other groups can have the file almost completely downloaded by the time it is completely uploaded.
First MITx course launched today
Sign up and log in using the "log in" button in the top-right corner to experience your first taste of MITx goodness. So far, the online learning platform is looking excellent. MIT is giving this a serious effort!
Were his other actions (impersonating another user, compromising other accounts) also to demonstrate vulnerabilities or just unnecessary semi-malicious actions on his part?
Google deals Yahoo major blow, poaches head of strategy and Labs
I can, yes. And I do...

EDIT: Oh, are you talking about tracking someone on your website, or tracking people across websites?

EDIT2: When people visit a website, they expect that website to be able to see their IP address and track their movements across it. What people don't expect is that websites (without their permission) can track their movements across other websites.
How github was hacked
Thank you, @homakov
I agree wholeheartedly. I always facepalm when people aren't able to work because the internet is down (read: no github access). Just start an SSH server, netcat some keys around (or use an USB stick), and get back to work again :)

Transmitting files via Google's email servers from two computers on the same network in the same office in the same room, especially if you're in europe (ridicilously far away from GMail's servers) instead of directly between the computers on the local network is one of my main pet peeves..
Fair enough. Ignoring the issue and not fixing it after it was brought to their attention to me is where they screwed up.

As for the account suspension, I'm not sure I agree that the account should not have been suspended. Github is a code repository first, and I don't think they have an obligation to keep people around who are exposing security flaws by notifying the entire community. As the author of the post points out, hundreds of thousands of apps rely on Github, so to an extent it is their responsibility to block people who may jeopardize their users. Let's say that they left his account active, and then two months from now he exposed a larger security flaw by greatly damaging a users' app or business. I'll bet there would be more posts like this one blasting Github for not suspending his account. Personally, I think they should offer him a job.
"If you are one of those strange coders that don't use GitHub".

Never used and never will. What's strange with that?
Hey Steve! Good to see another Kettering grad on here :)
Naveen is Leaving Foursquare
What is complicated about it? Someone finally called the Rails team out seriously on a long-standing well known security problem.

This is the type of ridiculous stuff we used to expect from PHP years ago.
Plato and Diogenes
All of my public comments on this topic agree that this is a problem that we should fix. Are you conflating me with other people? Am I not part of "the Rails team"?
Akin's law #2: To design a spacecraft right takes an infinite amount of effort. This is why it's a good idea to design them to operate when some things are wrong.

I think there's some truth to that :)

Source: http://spacecraft.ssl.umd.edu/akins_laws.html
Samsung Galaxy S3 – Ponsel Pintar 3 Dimensi
Samsung Galaxy S3 – Ponsel Pintar 3 Dimensi tanpa harus memakai kacamata 3D, keren bener dah pokoknya.