skysight-inc/HackerNews huggingface dataset:
" this stunt will cost Github five to six figures."

The vulnerability already existed. There could have been github customers' accounts getting hacked without the customer knowing and leaking confidential information. There can be easily more than five to six figures, borne by Github's customers here.

Rails is insecure by default and the website would have required work==salary anyway to be secured. Instead of fixing it for cheap early they have to fix it for several times that cost now. Since we all know time is money and interest is paid on loans, paying a higher price now is only a natural consequence of not fixing it earlier.

Therefore, I don't believe it is the stunt that costed github five to six figures. The loss of wealth was already there from day 1 when Github developers did not read Rails documentation and/or when Rails decided to make attributes publicly accessible by default. Today it is merely a "correction" where instead of Github's customer losing confidential company information without knowing it is now Github bearing the costs upfront, as it should be.

In the "emperor has no clothes" story would you say it was the kid who pointed out the emperor had no clothes caused the emperor's embarrassment? The emperor never had any clothes, he should be embarrassed, but he wasn't. The kid pointing it out corrected this, and I believe the same has happened here with Github, Rails and Egor Homakov.
> (2) fixed the issue

They were notified of the issue 3 days ago. Today, he simply found another instance of the very same problem in a different place. The vulnerability is throughout their entire code-base.

They are not even close to resolving this.
> Actually, the world _does_ stop turning because it's Sunday.

Incorrect. In Islamic countries, which are a part of this world, like Saudi Arabia and Oman have Thu-Fri weekend.

http://en.wikipedia.org/wiki/Workweek_and_weekend#Islamic_co...
How does this happen (even in the source code)?
Also, it's not even that Rails is fundamentally better, it's that they are alike in so many ways that switching, except for a particular job, is usually not worth it.
Well the maker of the Zeppelin NT is the original Eckener entity that created the Zeppelins, so to the extent that a "Zeppelin" is an airship built by Luftschiffbau Zeppelin GmbH, the Zeppelin NT is a real Zeppelin.

But I think it's not accurate to think of the Zeppelin NT as a blimp with some rigid parts. The original Zeppelins had non-rigid fabric gas chambers as well, hung from a duralumin frame which also supported the airfoils and helped the fuselage maintain shape.

The gas chambers of a Zeppelin NT support their own shape through positive pressure, as in a blimp. But they don't have to also support the airfoils, etc. For that, the vessel has a rigid composite structure.

So I think it's more accurate to describe the Zeppelin NT as "a rigid airship with self-supporting gas chambers." And I see no reason why the design could not be scaled up to Graf Zeppelin or Hindenburg size if economics permitted it.
I'm in the process of self teaching myself to program (I'm a civil engineering student). I discovered one of pg's articles somehow and gradually worked my way through them and began to think that I should probably learn to program myself. I have ideas for things that I presume could be solved though programming but without learning to program it is impossible to know what is possible, this is the hardest gap to cross.

I bought Zelle's Python book, started JavaScript with Code Academy, got Graham's ANSI Common Lisp out the library and tried Rails for Zombies but none really got me interested enough to stick at it.

Dan Nguyen's Bastards Book of Ruby however has been the most successful. It's pretty much straight in, actively encourages copying and pasting code early on, with the immediate prospect of making real programs which interact with the wider world (HTML scraping) instead of feeling isolated on your own computer. I could immediately how HTML scraping could be useful for someone and how the first short programs might be extended.

There are some excellent motivating articles as well which were really key in sucking me in. He also calls his type of programming 'data programming' which to me, a non-programmer who hasn't had the chance to be brainwashed by programming theories, is the most obvious name in the world - all these problems I think could be solved with programming are just manipulating data.

btw: I don't find the prospect learning to program games motivating at all; there seems to be so little you can learn from most of them and a dangerous waste of time.
Hi, I'm one of the developers for MITx. We'd love to get your feedback on the system - bugs, features you'd like to see, what you like and don't like, etc. Thanks!
How to Extract AAC from MP4 Video Files on Mac OSX
Tune4mac MP4 Converter is all-in-one software that can convert mp4 to aac on Mac OSX including Lion. Also, it is powerful application that can remove DRM from m4v video files purchases or rents on iTunes Store.
Well, can't they make use of the information once they know who the connectors are? We can offer deals or special customer service to these users, but we can encourage others to!

One thing we could do is provide "invite code" that a company can put on their website to encourage their users to invite these people.
True, but if they have many years of reputation established, they may not want to throw that all away because of Google.
Totally avoidable via `Hash#slice`. Come on guys, this is common knowledge now.

def update
find_pk.update_attributes(params[:public_key].slice(...))
end
It's funny, I was talking with a friend about making something like this since I might be moving into a place with almost 10 people. I won't be able to use it for real for a few months, but it would be nice to test out the system without having to invite someone. The overall design looks very nice and clean though.

Edit: I can't see what my house name is when I'm logged in. Is this because I haven't invited anyone yet? I invited a friend and they entered my house name but it was not recognized.
I believe there to be a more concrete cause of US healthcare costs: collusion between insurance companies and healthcare providers. "Insurance" includes both health insurance and malpractice insurance, as well as "providers" being hospitals/doctors and manufacturers of equipment and drugs.
Somebody already came up with a system to replace man entirely. It was designed to use a tried-and-trusted document format, it added hyperlinks, interactive navigation, and a unified hierarchy for all documentation in the system.

It's called GNU TeXInfo, and it's terrible. Even with a third-party Info viewer like pinfo, it's still clunky and awkward and difficult to find things. The bash manpage may be a thousand pages long, but I can search for "BUILTIN" or "REDIRECTION" and pretty quickly find what I'm looking for, without much fuss.
6000K HID Xenon Headlight Kit - H1(9-32V)
It really amazes me how there are controversial topics where one side never presents any actual facts or figures to back up their stance. I would think that, in the absence of any hard evidence, the controversy would disappear. Yet it seems that anecdote and rhetoric alone are enough to sustain extreme controversy. Both health care and climate change in the US are excellent examples of this.

Edit: the statement about R&D costs is one excellent example of this. This thread is not the first place I've heard it, by any means. It's inevitably framed as the US subsidizing the rest of the world but without any quantitative analysis of it. The assertion evaporates when you actually look at the numbers, of course. Another excellent example was when my father claimed, no doubt prompted by right-wing talk radio, that the life expectancy gap was driven by the much higher murder rate in the US compared to European countries. Upon plugging in the numbers, I found that, assuming an absolute worst case (every murdered American is an infant, losing all ~80 years of life), dropping the US murder rate to zero would increase American life expectancy by six months.

I get how people can be wrong sometimes, but the way it spreads, the way people hear things and never check them or even apply a basic smell test, and the way these complete falsehoods manage to shape national debate is just crazy.
At least in Spanish pink "rosa" means something like light-red (red+white), not something between red and violet.
And in Spanish, "rosa" is in the same level of importance as sky-blue "celeste", that is something like light-blue (blue+white). So for me is very strange to see the spectrum charts in English that show the pink areas, but not the sky-blue areas.

Spectrum: http://www.ledlight.com/images/spectrum.jpg

Source: http://www.ledlight.com/LED-Information.aspx
Where do all the hackers go now?
HN has jumped the shark. The top five stories all relate to the fact that
some centralised source code hosting service got hacked. So what? Oh no
did your central git repo get deleted? Gosh if only git were distributed!

I swear, half the titles on this site sound as if they were taken from
Cosmo. I'll leave it as an exercise to determine which of these are real:

Finding a technical co-founder: You're doing it wrong.
(And You Could Be Packing On Pounds WITHOUT EVEN KNOWING!)

Be Successful First Thing in the Morning
(And Our Top Ten Tips For Slashing Technical Debt!)

Why you’ll always think your product is shit
(And Five Tips On How To Deal!)

Mashing Up On A Budget
(What You Need To Know About Apps, Maps, and Traps.)

I guess the brogrammers are already invading. So where do the hackers
go now? By hackers, I mean people who write C or Lisp code, not web 3.0
Rails crap; people who wouldn't touch hg with a ten-foot pole because they
understand that a database is a broken abstraction for storing source
code; people whose concept of distributed X doesn't include a massive,
single point of failure; people who get the magic of )))))))) and laugh
when they read that whatever has macros; people who can write proper,
non-sensationalised English.

Maybe I just missed the memo. If so, can someone please fill me in and
let me know where to go? Thanks.
Agreed. Once we got the SQL-Ledger codebase somewhat stabilized security-wise in LedgerSMB, we started removing it in favor of a secure-by-default framework. Our approach might not work well for other projects and it has its own security pitfalls (which we clearly document, and prevent by default), namely the fact that credential reuse is important and therefore you have to do something like HTTP-BASIC or HTTP-KRB5 auth (and hence for the former SSL really is required).

The way we do it is by not trusting the application. All authorization happens by levels further back, such as permissions granted to run stored procedures or on relations (permissions are granted to relations where there really is a clear, coterminous mapping between relational operations and procedural ones).

We then provide a framework for handling all of this. It means that as-yet-undiscovered flaws in our application are not as exploitable as they might be because the app is not trusted by the database.
He wasn't upfront about everything what he was doing, so we had to investigate.
And your data point is YOU because you don't use it?
Github Hacked: Things to Do on Monday
I actually wanted them to ban me for that, because then they'd have even more to explain about them allowing rape/abuse comics about me on their site:

https://github.com/nickmartini/dongml

Which has:

https://a248.e.akamai.net/assets.github.com/img/b0de87a4cf0c...

If I was a woman there'd be an international shit storm over that image, but I'm a dude, and one that TPW hates, so of course they won't do shit.

Then again I can usually handle myself so that's what I did.
On the topic, there was an article about using RPython to quickly implement PyPy-like JIT VMs. http://tratt.net/laurie/tech_articles/articles/fast_enough_v...
"Write programs that do one thing and do it well." --Doug McIlroy
> Beyond OS kernels , drivers and embedded systems is there any real use for this?

If you're parsing a binary format you'll probably use bit shifting.

Bit shifting is just bitwise arithmetic. Assuming you did CS or a related degree, it's more likely you forgot about being taught about it. In fact it'd pretty hard to come up with a CS syllabus that does not mention bitwise arithmetic.

These are some subjects where bitwise arithmetic is bound to appear: Intro to Programming, Data Structures, Operating Systems, Computer Architecture/Organization, Graphics, Cryptography, Implementation of Programming Languages.
Why I Wish I’d Read Bill Buxton Years Ago
Thanks, it's mostly Twitter bootstrap based. We definitely think that this application gets way more useful as a house has more roommates.

The problem with letting you browse around before inviting is that all of the tasks require some other user. I am very open to the idea of doing something so that people can somehow get use to stay dedicated so they don't forget about us while they wait for their roommates to join up.

Any ideas? Maybe a little preview video or something?
Pfft. Pro couriers don't even bother with FXP. A shell account on a fast European box and mget/mput are the weapons of choice.
It's an easy mistake to make, but arguably no easier than, for instance, not escaping input strings to guard against SQL injection. IMO it falls to the developer to set protected on vulnerable attributes. This is pretty basic Rails security practice.

EDIT: not 'escaping', but using hashes or formatted strings, etc., you get the idea.
I agree with your sentiment, there is no need to insult the guy on such a personal basis. Unfortunately all communities are full of people, some of whom will respond like this to situations. It is no excuse, and I don't condone the behavior. I do wonder tho, if it isn't because people are scared of their software being hacked. People frequently respond poorly to fear.

What is going on here? I think the fear people have is that this attack is laughably simple, but at the same time, was not noticed for a long time. It says something about complexity, all the interlocking parts may have simple problems that are hidden by the abstract models used. It reminds us that the law of unintended consequences are always in effect, and we need to really think out what we are doing, even if the tests all pass. It shows us that even good, well respected software is vulnerable. And it makes us wonder what we have done to open security holes and what is lurking in our code. No one wants to be responsible for such a thing, and it is not pleasant to think about potential consequences of them.
My point was that there is a large community that has gathered around the idea of sharing films. Large enough to make them want to issue standards. All I'm saying is with that size of community dedicated to sharing film, they should be producing more films. Especially if they dislike the current paradigm enough to remove themselves from its market.
If it happens without any client open, then it isn't really a problem is it?
Instead of considering all users' wants and needs, they're only thinking of their own interests.

There is a reason for that: it's hard enough to know your own domain's wants and needs, let alone all of your user's wants and needs.

Users are legion and diverse and unique.
I'm not a Rails/Ruby user but any decent database abstraction layer or ORM should be using bound parameters for all literal values. "Escaping" of SQL strings is best left to the database driver.
Oh, come on, it's like a brainstorming session in tweet format (140 characters and everything). The idea is to take very little time from the complainer, and let him/her just say what's most irritating about his/her day. Make it as easy as a tweet and nobody has a problem saying what's on the top of their minds. I think it's brilliant.
This reminds me of when laptop screens went glossy. Firstly everyone thought that they liked it. Then they realized that these screens were actually less ergonomic to use due to the increased mirror reflection. Now it is often necessary to pay more for the option of a non-glossy ('anti-glare') screen.
Well, it doesn't happen if the address doesn't exist (I tested it too), so it can still be used by spammers to check for that.
>hours

This is rarely true of most scene releases these days. They will hit private bittorrent trackers often within seconds of preing, and public ones not long after that.
I would argue that the dark ages of medicine were the dark ages. Yes, we might still be tilting at windmills in our battle with symptoms, but this is no dark ages, rife with misinformation, superstition and a complete lack of records.
In what way do they have to prevent him from ever accessing the site from any account ever again?

Who said they did?

The best they can do is suspend his account per policy while they are investigating.

Why? What's the point of suspending his account?
Git is not a fundamental commercial standard, I was winging about the state of industry in general.
Video preview would definitely be nice. A useful video would be something like "Hi I'm John, I live in a house with my three buddies and we manage our house chores/expenses/etc with GoodMate. I make sure my rent is paid using x feature. I check what chores I have to do here...", etc etc. I'm very curious as to how everything works so a video would be great.
It's a write that shouldn't be authorized but was. It's an access control vulnerability, and they happen all the time.
maybe "brogrammers" are just bros first, programmers second. i know plenty of guys who were "bros" that are now developers. why can't you people just let them be who they want to be and live their life?

i'm pretty sure the guy in the hot tub full of women is getting very upset with the trash people are talking about him on the internet. i'm sure he's taking time away from watching football and drinking natty lite to pen a witty response.

how about you all stop clinging to a false sense of identity , live, and let live?
fantastic idea. I'll work on something just like that!
This is the first thing in securing your rails app a developer learns, how to properly handle mass-assignment. I don't blame rails, I blame Github.
> we were never taught about bit shifting at university

This is surprising to me. I'm taking a computer architecture course now and it's the third class that bitwise operations have been mentioned and in the greatest detail (exactly how it's implemented in hardware). In fact, I think it was first mentioned in my intro to CS course, which used C++ (more like C with streams, but whatever).

Is it a CS program or something like CIS?
That's a bit harsh, it is at least a grey area.

Mass-assignment by-default, with disabling fields you want to protect

vs

Mass-assignment off by default, with enabling fields you want to mass-assign.

It's hardly just outright arrogance.
Knowing about networks and codecs isn't really the same as knowing how to write a screenplay etc.
Different strokes? Yeah, that doesn't mean what you think it means.

Regardless, it's great that you have a happy story to tell. It's mostly meaningless. The original point is, Canada's system isn't better. It's just another system, with it's own problems. I mean, do you really think your story will change the facts of mine? Does it matter? No.

And, to top this all off, you try to equate "not being impressed" with abuse? Really?
Relax, You Are Not Having a 'Nervous Breakdown'
Why is the current furthest mapping not in all directions? Is that because of the north and south poles?
NYC 2.0 - Rick Karr Reports on NYC's Startup Scene [6 episodes]
True, but they are rarely set up properly. Also, when they are set up they are often only used for things that are thought of as 'local tasks' such as a media store or printer server and not for replication of the online system that you have for some insane reason decided should be hosting your accounts or whatever.
> Banning clorine gas was a silly thing to do -- it didn't exactly stop the next war and only made the concept of war less terrifying.

This is such a silly statement I don't know where to begin. They knew there was going to be another war, did they? How did it make the concept of was less terrifying? WW1 was the "Great War" because it was the first time war was terrifying for everyone (except the stupid British generals, but don't get me started).

On this statement, one would disagree with the nuclear non-profileration treaty and think that WMDs are ok because war would be more terrifying.

My grandfather was gassed and it was horrific.
Oh, they've let you all down? Then stop using other people's web applications and just run your own git/hg server. With blackjack, and hookers.

You are vulnerable to someone else's fuck-ups as long as you insist on giving up control over your data and code in exchange for the convenience of someone else doing the "hard work" of development and administration for you.

Hell, restore the network to being peer-to-peer rather than hierarchical, and hosting your own whatever will no longer be such a damn problem.
(Ir)responsible disclosure always does more harm than good. Making these issues public is the only reasonable thing to do.
But this is slower than with multiplication, as Linus explains:

the simple shift+add version is all totally serialized
and nothing can be done before the previous operation
ends: as a result the three adds and three shifts will
inevitably take 6 cycles (the original P4 had that
double-pumped ALU, but not for shifts). That's already
slower than almost any multiply.

Edit: oops, I forgot your '(without multiplication)' qualifier. Yes, your way is likely the quickest without multiplication.
Bittorrent isn't used just on public sites; you can use the same technology to share between a very select group.
There are two ways to teach programming:

1. SICP
2. Everything else

If you think there is a method in (2) that is superior to the method in (1), then please reply to this comment.
You can get your code out, but what about all of the rest of your data? Wiki, issues, pull requests, etc.

Update: Apparently it's doable with some API magic, but you still have to handroll your exporter: http://www.lornajane.net/posts/2011/github-api-issues-list
4500 USD / month is great money for 18 year old in Russia.
It's 10 times usual wage.
Love the comment by dbounds: "Nice work. FULL DISCLOSURE"
> The law usually serves whomever has more money and power.

Not necessarily. Of course, when you need more money and power, that's why groups like the EFF exist. To fight for you.

> In the end, the masses are still powerless.

SOPA passed then, right? Please. This attitude of yours does more harm. Those with the "money and power" would love for you to think this way. Defeatism helps more than money.

As it stands, the law gives us amazing power.

That being said, GitHub has every right to dictate the conditions of their use. You, as a user, have a right to not use their service if you disagree. In fact, this allows competitors to provide their services to you (and their are competitors to GitHub).
Looks like a Thai character with stacked diacritics. (http://en.wikipedia.org/wiki/Thai_alphabet#Diacritics)
Obat Tradisional Keputihan
Obat Tradisional Keputihan

Kali ini kita akan membahas tentang cara mengatasi keputihan yang selama ini merupakan masalah bagi setiap kaum hawa yaitu dengan obat tradisional keputihan XAMthone Plus yang telah terpercaya mampu mengatasi dan mengobati masalah keputihan yang selama ini menjadi problem bagi para kaum hawa, secara aman dan tanpa menimbulkan efeksamping negatif bagi tubuh.

KEPUTIHAN ???!!
BASMI KEPUTIHAN DENGAN OBAT TRADISIONAL KEPUTIHAN XAMTHONE PLUS !!!
Konsultasi dan informasi lebih lengkap bisa menghubungi kami ke nomor 0877 2813 5144 atau 08521 9946 055.
Please add another type of login.
I was going to try it out, but the Facebook log-in deterred me. I know my roommates would not use it for that reason, so it's a no go.
Clearly the only secure and rational solution for all of us is to print out our source code every hour and store it in a shoebox under our beds.