skysight-inc/HackerNews huggingface dataset:
I agree. But we're talking about software as a service here, and that kinda makes it a different ballgame. Folks are paying money (in some cases) to use your software living on your servers (or, at least servers that you manage). I would certainly hope that someone who can deal with outages or penetrations is actually working on the weekend (perhaps that person doesn't work Monday and Tuesday?).

Would you say "eh, but it was the weekend" if an attacker purged your paid enterprise repo on a Sunday morning?
Another in the long line of Silicon Valley companies screwing up and then getting kudos from the community for handling the screw up. It's getting tiresome to see people get accolades for basically doing their job, after failing to do their job.
Disclosure does mean making things public...
Mac Mercurial users should also check out (ha ha) MacHG. For me, it feels a lot better than SourceTree and just hit 1.0 beta.

http://jasonfharris.com/machg/
A New Development Philosophy: Build, Deploy, and Grow
Isn't that Twitter?
Looks much spiffier than I expected. Very well organized and presented.

I did manage to get the scrolling text out of synch with the video. I think it was because I put the first video on 1.25 speed. The next video then reverted to 1.0 speed by itself, but I think the text stayed on 1.25. When I explicitly reset the video to 1.0, the text re-synched and stayed synched.
It's not like this is a little known pitfall with Rails. Anyone who has read Hartl's Rails tutorial knows about it[1]. It's very commonly mentioned in basics for Rails security.

And I say all this someone who has never professionally developed for Rails. My experience with Rails consists of a couple half-done toy projects. I find it pretty surprising that Github makes this mistake. But I don't think they should be burned at the stake for this. The bigger problem was how they were initially handling the issue, which they're trying to rectify now.

[1] However, Hartl recommends using attr_accessible at the model level and DHH says this preventative measure should be implemented in the controller, ie:

class PostsController < ActionController::Base
def create
Post.create(post_params)
end

def update
Post.find(params[:id]).update_attributes!(post_params)
end

private
def post_params
params[:post].slice(:title, :content)
end
end
There's a very good reason not to do that. I'm a Wikipedia admin, and we have a policy on blocking and banning that sort of makes sense. A block is done to "prevent damage or disruption". That might be short term or indefinitely, but not permanently. You put in a block when there's an issue. But a ban is a formal statement that you are no longer allowed in. You only do that after some thought and consultation.

Github is actually pretty similar given that the commercial side of Github is fuelled by the free, open-source side. There is a feeling of community ownership. Going straight for the ban without some thought and soul-searching is confusing fixing an issue with making a more detailed judgment about whether the user ought to be on the site at all.

IMHO, Github played it about right.
Given all the things the Google Chrome User-Agent does keep in sync across different User-Agent instances, I'd imagine keeping a host of origin-bound certs in sync wouldn't pose too great a challenge. I'd love to see BrowserAuth take off!
That's what PHP programmers were saying for years regarding magic_quotes (which didn't actually make things less secure). That this is apparently the default behaviour of Rails... yeah, it's a security issue.
http://www-biba.inrialpes.fr/Jaynes/cc02m.pdf

Jaynes argues here (pg 221) that examples were Venn diagrams apply are special cases. According to Jaynes, Bayes theorem is more general than that.
There's no specific provision disallowing immigration of doctors. For obvious reasons it's an occupation that requires licensing/certification, which is more cumbersome than many are willing to consider, and reasonable English, which is usually not a priority in medical schools around the world.
I'm somewhat of two minds about this one.

1) The model could be used everywhere so it may be best to negate the issue by locking down the attributes at one source.

2) As you pointed out, the model is in different contexts depending on the privilege of the current user session. It's almost as if I want a thin layer between my model and controller that takes into account session info and informs the model about what can and can't be done.
I'm in a similar situation (quit my job, building a startup), but I choose Taiwan.
Unicode combining diacritics. There's no real limit to the combining and it makes some text layout engines make funny characters.

Perfect example of GIGO.
Keep in mind that "on the Internet, nobody knows you're a dog." In other words, some commentators on any website may be children or teenagers.
There is so much bombastic talk in this post. This has to be a troll.
What are the odds that there's a similar bug which allows changes to user accounts? If that's the case, then altering the password or email address is trivial.
No they didn't. It's @homakov. With an "A".
For the first 8 paragraphs I was thinking "What an idiot!" but then the last two might suggest a great idea: have the iPad switch to MacOS when it is inserted into a keyboard stand.
That could be, but it could also be biased. For example, people looking for the camping site for a vacation might see those pictures and then click on then, not because they were looking for those pictures, but because OMG what is that in those pictures?! As a result, though, it would appear that people are searching for the pictures in the first place.

I'm sure it's much more complicated than that. But we can't tell if the pictures are shown for good reason or not.
I think the key to the OP's idea is that it runs iOS in "tablet mode" and MacOS when in its keyboard stand.
I wish I could take a screenshot on my Windows Phone news reader to show you what happened :-)
How does suspending his account ensure he doesn't continue breaking into your service?
"give other guys real big sticks so that they will tell us to do what we actually wanted"

I think you mean so that they will tell other people to do what we wanted. Also, that doesn't change the fact that those with lesser power will be in a worse position to enact change. They will usually be on the losing end of "the stick".
Ha! Alright he probably should quit doing that before he gets KimDotcom'd.
Very cool! And if you paste it an ASCII only text editor (notepad) and you'll see a huge blob at the end. You can actually left arrow through the entire stack of diacritics.
As Zed Shaw pointed out, someone appearing to be Homakov has posted a comment dating back eight years. Is Posterous vulnerable as well? If so, that may not be Homakov, of course, but his twitter comments are consistent with him posting it.

https://twitter.com/zedshaw/status/176497720817762304
Wow. MITx is very well done. Great UI that feels really coherent and custom-made. Really love the textbook feature.
Interesting. By far, the biggest problems seem to be "people".

I wonder if it follows that the best thing one could do to alleviate workplace suffering is to create an AI capable of running the economy and then entomb all people in the Matrix.
If an address doesn't exist the message will simply bounce. Or am I missing something?
Tracking email opens is surely helpful to their businesses, but is it really fundamental?
On the other hand if you have a reputation, the search results don't matter that much. People already know that it's a nice resort and not a disaster.
"In class - in my English class - you will have to master and write in Standard Written English, which we might just as well call "Standard White English" because it was developed by white people and is used by white people, especially educated, powerful white people. [RESPONSES at this point vary too widely to standardize.] I'm respecting you enough here to give you what I believe is the straight truth. In this country, SWE is perceived as the dialect of education and intelligence and power and prestige, and anybody of any race, ethnicity, religion, or gender who wants to succeed in American culture has got to be able to use SWE. This is just How It Is. You can be glad about it or sad about it or deeply pissed off. You can believe it's racist and unfair and decide right here and now to spend every waking minute of your adult life arguing against it, and maybe you should, but I'll tell you something - if you ever want those arguments to get listened to and taken seriously, you're going to have to communicate them in SWE, because SWE is the dialect our nation uses to talk to itself... And [STUDENT'S NAME], you're going to learn to use it... because I am going to make you."

- David Foster Wallace, Authority and American Usage
S̢͎̳̞̲͈̪̳̻ͮͩt̟̳̏ͬ̔͒̈́ͦ͠a̞̤̝̟ͫ̽̂̈́ͪ͐͘n͕͐͑ͪ͐ͦ͋ͮ̅d͚̗̙̎ͫ̌â̗̬͓͍͍̳̥͆̕͠r̢̘ͣ̀d̢̢̢̘̲̺͙̂̈́̊ͬ ͎͎̫͚̣̺̤̖͊̏̀ͬ͞u̧͆ͩ́͒҉͔̠̪̖̹̠̰͎ṇ̸̛͚̟̫͎̟̣̜͋̈́ͧͯi̲̲̺͑̐ͣ͗̿̕͘͝c̦͈͇̦͈ͦ̆ͨ͝o̟̭̫̥͎̹͆́ͥ͊ͬ̏͝d̪͔̯̥̩͙̝ͩ̏͒̈́ͩ̿́̕͜ͅe͍͓̻̊͛ͅ ̸̧̻̺̤̠͙ͪ̋̽l̛̥̥ͬ͂̈́ͤ̓̀̓̚͘ͅͅͅǒ̮͓̼ͭ̂̆̇̕͘ͅl̯̯̟̗͔̳͉̰ͫ̒ͧͦͩͦ̓̓͢ͅs̝͎͚̗̮̟̒̔͛̈̊͋͒ͩͅ
While the author continues to scratch his head because he's attempting to fit a square into a circle, I'll continue to use my Macbook Air for actual work, my iPad for couch/bedside/casual consuming, and my iPhone for communicating on the go.

You know, what all of the devices are meant to do.

Can anyone here actually see Apple releasing a product that has a detachable part? That stands for everything Apple is against when they design products.
i love bear bonging.
Try to be serious. What are you gonna do, type your source back in by hand? Punch cards, paper tape, cassette recorder, pick one.
An iPad ... but thicker, heavier, with a fan and a docking port/hinge connecter on one edge. And an MBA with the USB/audio ports on the screen which is screen-heavy and keeps falling over backwards.
Zalgo generator: http://www.eeemo.net/
Maybe adding some screenshots of the app could help people sign up.
What makes you think they are saints? About a year ago I discovered that they didn't protect attachments to tickets in private repositories (since fixed). Anyone who could guess the URL could access the content. (It looked like the cause was keeping the attachments in S3 without front-ending them.)

On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the URL. The values you had to guess in the URL were a ticket number (they start from 1), a repository name, a date (YMD) and a filename. Sure there is some variety in there but it is not in the billions of possibilities, just hundreds and that won't make any computer break into a sweat and in my words at the time "easy". To make matters worse you can't delete the attachments to tickets.

This may not affect you. It certainly affected me. For example we had some keyfiles in one ticket. Coredumps in others.

Two weeks later the issue still hadn't been fixed and I don't know when it was. I've never seen disclosure of the issue. There wasn't even any way of knowing if attachments had been accessed in an unauthorized way since there was no checking in the first place.
On a traditional PC, let metro apps run windowed
Good idea. Will add something to the home page.
This is immensely useful. i do something similar when I need an idea. I just search twitter for "wish app for", or "<NAME OF WEBSITE> sucks because".
Mobile User Privacy Bill of Rights lays down guidelines for app developers
Drop some of those diacritic stacks into Twitter and check out the mayhem.
It can if you want. It's not that hard to make documents which are valid before and after scripts run. This enables many more tools to work with them.
would be nice to see a syllabus on the home page
Make the decisions you take the ones that actually count
Versioning Rails 3 based RESTful APIs
You can turn his argument around. Why should the needs of a business search be more important than historical search or journalism search? Maybe, on average, users more often want to learn about the historical accident than the resort. Or maybe Bing and Google are providing a better information service by showing those images.

I'm not sure this is necessarily the case, but the normative standards are much less clear than is depicted in this article.
hmm I have been downvoted but I deserve it. So to rephrase what I do the problem is a you say not losing data that is going to be inserted but performing operations with the wrong type of data which mean errors.

Let's say I have 3 pieces of data required by a function to compute the outcome of a certain operation (withdraw 10 billion dollars): A B C. We change the data in that fashion:
A -> A'
B -> B'
C -> C' -> C"

When I query, because of eventual consistency the f(A,B,C) may very well be:

f(A,B,C), f(A,B',C), f(A,B,C'), f(A,B,C"), ... so on. It is simple when you have 3 sources, but when you have 50, and then when the operation use 50 or those f, depending on 50 other pieces of data ?

Anyway, again sorry for my poor explanation of the issue!
GitHub's and its computers are governed by US laws, and many countries have extradition treaties. Many countries also have equivalent computer abuse laws.

My comment was to discourage such spectacular glory-seeking behavior by other people that claim to be trying to help. It's a serious crime, and the FBI does not care that your intentions were good.
HP Pavilion dv4-1160tx Battery
Great UI, having had to use the blackboard system for 4 years of undergrad I'm really impressed with how much cleaner/intuitive this feels.
Everything, Everywhere, All the Time
The problem with texinfo has nothing to do with it's document format, hyperlinks, interactive navigation, or a unified hierarchy. It does however have everything to do with the info reader being totally unusable. From the texinfo documentation (Read through the info reader.):

" This all probably seems insultingly simple so far, but _please don't_ start skimming. Things will get complicated soon enough! Also, please do not try a new command until you are told it is time to. You could make Info skip past an important warning that was coming up."

It's a bloody text reader. It shouldn't ever get "complicated". For that matter, it has the most obnoxious scrolling ever. It's hard to tell where one page starts and the other ends. (Contrast with: Less.) I shouldn't have to memorize keyboard shortcuts to navigate. (At least not in a system that wants to be used and supported by anyone who isn't the most hardcore of users.)

On top of that, part of the reason I can't use the texinfo reader is because it very often doesn't have the "info" I want. And just takes me to the top node or whatever. So let me go ahead and append to "As for backwards compatibility". The system should also be able to take and render man pages as though you were using man, because expecting 30 years of projects to all move to any new system is ridiculous. And supporting man page format really shouldn't be that hard.

The closest thing to what I'm thinking of is something like the links web browser. Which still falls short. And with all that in mind, it's not like I expect anyone else to do it. Thats probably like the first rule of project ideas. Unless you do it, it won't be done the way you want it to be.
I came across the "Bates Method" in a very old book which I found in a second hand bookshop. Now there is a web site for the method: http://www.seeing.org/intro/index.htm

It has helped me preserve good mid-range vision and I can comfortably use computers all day long without strain or discomfort.
Instead make it really easy for one roommate to create everyone's accounts, then you reduce the conversion requirement to just 1 person (though you do slightly increase the friction on that one person you radically decrease it on the others).
Integration Tests for Stripe with Cucumber
I used to be a professional auto mechanic (still work on cars for fun, though). Here is my take on your question(s).

Mini Coopers are cheap "premium" cars, in a sense that they are indirectly marketed as if they were mini BMWs (they are made by BMW), but they are just the equivalent of a volkswagen in terms of quality (which is pretty bad from professional experience). They are built using cheap parts, that are even too flimsy to even use (it is not an exageration, but actual experience).

Porsche is a brand that is driven by engineering, but engineering != reliability. Even though they have improved a lot in the last 5-6 years, they are not sold for their reliability, but for their performance. The Boxster is a specially good example of how not to build a cheap sports car when all you do is build premium sports cars. The best example of those shoddy quality of the Boxster (first generation) is the engine that self-destructed due to an improperly machined engine part (the case). Sadly, some 911 owners also got a bad engine with the 1999 model carrera equipped with the 3.4 engine (ddg it). The engine goes for about 12k when sourced from Porsche, not including installation.

Honda does not make cars that don't break. They have problems too. The Accord suffered from a defect in the engine block cylinders that cause it to warp the deck surface and thus make the car overheat (it required you to buy a new engine, because this was not serviceable).
The S2000 has a transmission made out of glass (not really, but you get my point(it is prone to failure on the first, second and third gear grear set)).

Mercedes does have the ussual electronic gremlic (just like most European cars), because they have extremely short development cycles, and you just can't test so much stuff at once (they ship a lot of buggy hardware, if you will). One of my favorites is the C240 Kompressor, which had a supercharged engine that blew up if you used a fuel that did not meet the octane requirements. Why didn't Mercedes just let the computer retard the ignition timing to compensate for the lack of octane? Wait, they did! They just didn't do enough of it (they did not test it throughly, and they also used parts that could not withstand a simple engine backfire ( a backfire is more lethal on cars that use supercharger or turbochargers, as it sends an explosion through the intake manifold (where the supercharger/turbocharger intake is)))(this comment looks like LISP code).

tl;dr: cheap parts, cheap engineering and cheap testing that derive from extreme cost-cutting measures make most brands out there a russian roullette. Good for mechanics, but bad for owners. Though with European cars, its as if you were playing Russian roullette with two bullets instead of one.

PS.If you do get the S2000, install a transmission oil cooler to extend the life of the tramsission components. The later years with the 2.4 engine had stronger transmissions, but a lower readline (and less peaky powerband (something people loved about the first generation (because it felt like a motorcycle/F1 engine))).

=)
The golf-ball analogy implies a fast-track to anxiety for many people.
Is it stock?
No matter the reason, reading the entire book is a fair endorsement of prominent twilight placement in the bookstore. It doesn't matter if you hate it, you wanted to read it. But picking it up, looking at the description in the back jacket, and putting it back down is most definitely not.

Going to a site for 10 seconds is not an endorsement.
All valid points.

- a stack of inputs ordered based on number of points

- items can go up and down (again based on number of points)

- anyone can vote (although technically the people with the pain point should vote)

- using twitter bootstrap (because I can't design) and one of the buttons you can use is green

- yes the number on the green buttons is votes

I apologize for any confusion in features. I wanted to keep this as minimalist as possible so the industry professionals don't think they are overwhelmed with information. I can see how this can be confusing. I tried putting some of the information in the uservoice widget, but that's probably not the best place to do so. Any suggestions on how I can inform users what's going on without cluttering the page (pop-overs sounds like a good idea)?
Is there any good way to support Unicode and user-submitted content, but prevent people from drawing "outside the lines," so that for example what happened to the HN front page because of this post doesn't happen?

I guess in any case when you have user-submitted content you have to have some way to deal with inappropriate content, but something like this just makes the site's interface appear broken.
For emacs, there is magit.
In an age when prospective employers often want to see your social-network profile, LinkedIn makes an excellent honeypot.
He was being snarky.
It is rails guys, not ruby guys. I am still wondering why people can't distinguish two different communities. You don't mistake python and django or php and kohana or java and strut, right?
A combination of reaching out to professionals on twitter and cold-emailing.

We were doing this for market research anyway, so we decided to throw our information in web app form.

I am worried about scaling though.
Leveraging RESTful SOA for Enterprise IT System Communication
I find it really surprising that Rails is taking heat for this. "Protect your attributes" is something you learn really early on, and most of my models will have a spec along the lines of "as a user, I can't steal another user's _____"

On top of that, public facing code should be written like

def update
@pk = current_user.public_keys.find(params[:id])
# do the update if you find the key
end

Simple stuff.
Awesome. MITx platform is superior than any other online learning platform i have ever seen. Very well done. Congrats.
The funny thing is that we buy what comes in new, and don't really know the purpose or use of it. iPad to me makes sense if you are an avid browser, and a reader, or type in few short emails a day.
First came iPhone, and then came various keyboards which can be blue toothed to the phone.
Dude!! the iPhone has a touch keypad, and its not for typing in long emails. Use the gadget for what it is meant for.
"reasonably priced device that boots instantly"

Ehm, the iPad isn't reasonably priced or boots instantly.
Elements in packaging design
I guess I'm going to sound like a Debbie Downer* but this feels like a great example of when talented software engineers have too small a universe of personally experienced problems, and end up building solutions for things that don't really need to be solved.

Dealing with roommates is no doubt a venerable problem to solve, but is there really a 'market' here that people will pay to address? There are so many lucrative and important issues out there, solving roommate management seems way down the list in terms of building a viable business. I base that last bit on the fact the OP describes this as a "startup" not a project.

I would emplor the OP to get out into the world more and find better problems to solve.

* = I use the term "debbie downer" after the recent HN post about searching for the weird terms people use in their comments. Debbie Downer was one of them.
Excellent. That is a really well done CMS, and Im not being nice. The textbook specially is a nice touch. Love the course progress.

Small request - Given that most of your users are going to be college students whose emails are cut off after graduating, I think you should allow emails to be changeable in the profile. (I used my school email hoping to change it later on. I couldve signed up for another accont but your policy prohibits that not to mention I lose my username.)
First of all no "pro courier" is going to be on HN bragging about his "weapons of choice." Second of all FXP was the protocol of choice back in the day(the time period the parent post was referring to). Thirdly, I remember when telix and minicom where "the weapons of choice."
Rails attr_accessible vulnerability pre-commit check