skysight-inc/HackerNews huggingface dataset:
After one-click unsubscribe web site may email the user last notification that unsubscribe was successful, and if the user wants to subscribe again - he can do so by clicking on that re-subscribe link (which can also be one-click).

Update: I just noticed that this goes against Amanda Peyton's last request (Do not send an unsubscribe confirmation email.).
But I guess she's wrong on that (because unsubscribe could be unintentional or malicious based on forwarded email).
Everybody wants heavy ass weights lifted, but don't nobody wanna have to be a bodybuilder to lift them.
I would rather say, a 45- 60 secs max, video with a screenplay, would be just awesome. If you can tell the pain of whiteboarding the tasks, or roomies arguing over the tasks, and then the advantage of using GoodMate.
This is a pretty simple idea, but a damn needy one.

Cheers!!
Why is zzz90210's post dead? Everyone knows about tracking via images. I never considered something like bgsound, probably a lot of other people did not as well.

And it's the whole point of the article.
Indeed. Our ignorance will invariably overshadow our knowledge, the universe is too vast and too complex for it to be otherwise. But we shouldn't let perfection be the enemy of good.
Wow, Gerald Sussman (SICP) is one of the professors, another one is the director of CSAIL. If you are not in the US, or if you are not in a top university, why would you study in your university instead of studying from top material like this?
That's a good strategy for advanced email users. But only small minority of email users belong to that camp.

What would you do with the information about who sold your email address?

The best defense against spam is spam flag button. It can be successfully used on your single gmail account.
Allow me to rephrase that:

"Well, it's a beginner-level PHP mistake; it is not precisely an obscure issue. Googling 'SQL Injection/register_globals/get_magic_quotes/etc' will show you discussion going back years, and it has been actively exploited before. I'm shocked that the mistake was made in ..., though."

Ten+ years of register_globals, get_magic_quotes and SQL injection attacks (etc etc etc) in PHP show that even well-known issues still bite people everyday. IMO, it's up to the framework developers to make it easy to do the right thing and damn hard to do the wrong thing.
Btw, If someone wants to drop out from the course. How can he/she do so ?
It is a valuable app for people looking for startup ideas. It even validates a point that PG makes on one of his essays when he talks about how the current CRM is nothing more than a fancy to do list (not his exact words).

Thanks for sharing, I've bookmarked it.
I like the emails because they keep me engaged when the service is just fledgling. I also like them because they're a permanent record for when friends delete their posts or what not. Also, in two clicks they can be auto-relegated a labeled folder that I never have to see and can be easily purged.
I wouldn't say 'great' but decent and ok.
Another option is to have the model take more a DDD approach. Part of the input params could be a user object. That same user object would know its current privileges and that could be done within the large model that is actually trying to do something.

What I don't know is if RoR allows for this sort of modeling. I have no experience with the framework. It might want something that is similar to getters/setters in Java. If this is the case, such a modeling is problem not going to work since the multiple params will break the spec.
overflow: hidden?
I was meaning HTML + scripting, which admittedly is much less of an issue these days. I just remember having to rescue lots of people using outlook.
ha ha dotben :). I had the same opinion, but I refrained myself thinking that these might be some students who are pretty excited with their school project or something. Ofcourse I second you, but if this was a way to test twitter bootstrap, or just checkout their own capabilities with web development, then great.
As far as market is concerned, I have never felt a need myself, because I never stayed with roomies.
I recall them saying you don't have to do anything. Just stop participating and they will know whether you are active or something like that
Tiffany Outlet,Tiffany and Co Outlet
All that guy needs is to spend his money on some serious Reputation Management instead of lawyers. For a fraction of the cost he can get other content pushed ahead of it, no one is building new links to that content, so it is stale. It's a little harder to do with images but it can still be done with 6 months to a year of progressive work. On multiple occasions I've buried a story that was the top result, to the second page. Instead of regular SEO where you bring one result to the top, this involved bringing 15 other results ahead of it.
Puzzle & Run: Fireboy & Watergirl 2: The Light Temple - Free Online Games
The outrage over this seems rediculous to me.

How many people complaining about email open tracking are also Sendgrid customers? Use email newsletter service? Your emails may have open tracking (including who opened it) without you even knowing.
One of the first things I noticed was the video sizing. The default size seemed too small but the larger size was not view able without scrolling down past so all of the top nav controls where out of the way. Making video like a click to resize type thing would be pretty cool.

(just resizing the browser content also seems to be a suitable solution too however)
Labs, office hours, networking, research opportunities, independent study, structural constraints, etc.

I love the whole movement of making lecture recordings available online for free. Ready and open access to learning has long been an ideal of academia. But it's not likely to topple the ivory tower any time soon, there's just too much that it can't do.

There's also plenty that it can do but isn't yet, leaving many areas to target if you want to do an EDU startup. "Video lectures plus computer-administered homework" is not the endpoint.
Jesus, HN goes from zero to lynch mob faster than reddit these days.

Guy drops a zero day on a major service provider, guy gets his account suspended (temporarily, it turns out). In what possible world is disabling an account that has recently exploited your live product in a very visible way not ok? Remember, you don't have a chance to call a meeting with the C level guys and your community manager - you're one or two guys responding on a weekend.

The rest of the "oh my god the sky is falling" drivel about how terrible a bug it could have been and how they should never have had such a vulnerable bug in the first place is even worse. Security bugs are fuckups by nature - nobody sat and said well shit I was going to code this wrong but since it might allow a lot of access I won't. In terms of OH SHIT bugs this is actually rather small - I'm sure github's live infrastructure has been open to lower level remote execution vulnerabilities over the years - newsflash: we all have been. Getting user or superuser or db admin is going to almost certainly be a lot worse than an application authentication level vulnerability.

You say none of that matters because it's such an obvious bug and people have known not to do that kind of thing for years? Say hello to our old friends "buffer overflow" & "use after free" - still grabbing msft aapl & goog after all these years.

TL;DR - stop acting like children.
Is Social Media Actually Making Us Less Connected?
A system that is designed to rely on human diligence is inherently flawed. It's a mercy that drills and other dangerous tools aren't designed in the same way that a lot of software is.
It won't help.
After @pk.update_attr(params[:pk]) you drop mailicious pub key to user params[:pk][:user_id]
no way
This is why I am taking a year off before transferring into a 4 year college from community :)
What If You Could Use NFC to Make a Giant Display Out of Two iPads?
You are right, that and any ability for scripting.
I'm not sure if this is a product that will become profitable soon.
I am quite sure that you did learn from building it (and you did a good job!), so that may be worth more in the long-run than what this may end up being worth.

It takes guts to launch, more to show them on HN, and even more to keep launching until you strike gold (but you still keep on launching...)

The best of luck!

=)
People do not learn from the past. People will keep reinventing these kinds of bad designs, and we will have security holes in web apps until it stops.
I can identify with this. Our family got an iPad, and while the kids like using it, I much prefer my MBP for basically everything: reading HN, blogs, news, watching videos. The larger screen, better viewing angles, and keyboard just makes it superior. I'm not sad we got it, but I don't personally find it that useful. The biggest thing it made me realize is that it'd be really nice to have a laptop with a good touchscreen. I've been thinking about the Transformer, but I do wish that docked it'd behave more like a laptop-ish machine and less of a mobile-ish one.
Static code analyzer for Clojure, core.logic unifier search control structures
If you decide to have a fixed position (hovering) div for share links, make sure it doesn't cover the text of the article you want people to share!

On my phone (Android 2.3), it makes the text unreadable.
A very minor issue – I was looking through the Terms of Service and noticed that under the DMCA section, DMCA is misspelled as DCMA in both the email and mailing addresses.
Yeah, I thought it was going to be an actual bug in Google. Turns out someone just posted some funny unicode in a Youtube comment? Rather disappointed that this is on the front page.
But most Real programmers don't understand Haskell either. Every time someone succeeds in understanding Haskell, an alarm rings by SPJ's bed, signaling him to publish another semantic and type-system extension to GHC.
just wonder why you all discuss that kind of shit: 'who's in charge', 'who should be punished', 'funny bug' etc in other topics.
This topic is better because it is about reality. protect your attrs blah blah
Thanks for the comment Vivtek. Why do think this is brilliant? What would be useful from these tweet-like brainstorms?
Their claim that his exploiting the vulnerability (in a completely benevolent fashion) was not "responsible disclosure" is bogus.

They need to stop trying to cover their ass and just apologize for suspending the guy.
The problem itself may be small but the number of potential users is fairly large. The majority of Americans live with other people. This would probably be more useful for people living with friends rather than for families, but that's still quite a large number of people.

Utility = Size of problem solved * Users

Do you have a good plan for how to get users other than counting on TC and virality?
Even with good knowledge of a system people forget things. The blame for this incident falls 100% on rails and its awful design. It's like blaming the driver for crashing your car whose brakes can silently and unpredictably fail unless you press some button when you first get into the car. Critical failure points should be isolated aggressively. Many software "engineers" have not yet grasped this.
Font Editor 
Hi! I'm looking for a great font editor software. I found "FontForge" so far, which open source and looking more list. Hope you can suggest one or two. Thanks in advance. :)
You're correct and Rails does do this (handle parameters in such a way as to prevent SQL injection attacks), however it is always possible to circumvent these protections and code things up in such a way (concatenate your own raw SQL string and push it through) as to shoot yourself in the foot.
Correct me if I'm wrong but this wasn't a "zero day". This issue was brought up four days ago https://github.com/rails/rails/issues/5228
Nice work. I like the logo and its a great idea. This space seems to be getting crowded, I feel like I've seen a few apps in this vein recently, most notably RentShare (http://rentshare.com), which a few of my friends in NYC use.

My biggest question to you (and anyone else here): What's your strategy for differentiating yourself from others in the market?
Shut the fuck up.

How many companies get hacked regularly like this but keep it under the rug? You think FaceBook's never been exploited? TurboTax? Mint? Stripe? PayPal? Shopify? Tumblr? Pick your app that "so so so so many businesses" use regularly, and I guarantee something like this has happened with all of them.

But were they open about it?

GitHub's been open the whole time.

Your post is like saying "All criminals are stupid". This is ridiculous, as the only sample you know of and can work with are the criminals who have been caught. You don't know how many other criminals are out there getting away with their crimes, because...they haven't been caught yet.

Who knows how many other companies have had hacks like this in the past two months alone, for example? I don't, and neither do you.

But GitHub, as an open, honest company that so so so many of use regularly (which means we know right away when there's a problem, especially with a hugely popular repo like Rails/rails) has been in the spotlight since the second this happened.

GitHub, in my opinion, has acted really cool about this. They addressed the issue, explained what the issue is, patched the hole, and even reinstated the hacker's account. DHH addressed the issue in twitter, other people in the community have admitted they fucked up, and now we as a community can work on fixing this.

That doesn't sound like "Letting us all down".

Someone who expects everything to work perfectly all the time and have no vulnerabilities is someone will be let down by anything, a pessimist, and stupid. And certainly not worthy of the front page of Hacker News.
For me they looked through everything once I got (worked) there, and harassed me by playing it all back. It was very annoying. Your mileage may vary, as I may have been singled out.
Github Is Classy
I don't think those kids would enjoy programming a game even with a good kit. They want to play games, not code them, and thus why I said no amount of graphics will get them to.

Also, what you describe is why I wrote:

http://learnpythonthehardway.org/book/advice.html
The disappearing virtual library
UK’s $35 Raspberry Pi Model B Sold Out On Launch Within Minutes
It's easier for me to setup a quick filter once than to navigate the ever-changing Facebook UI and privacy settings.
It's a spectrum. I'm a complete stereotypical "geek" who aspires to enter academic research, and yet the #1 thing I want to do this week is go to a punk rock concert. The thing that kept me going through a period of depression this fall was attending Occupy Boston.

Nobody is just one thing. I don't understand why America as a whole has such a trouble with this concept, in school and then in the working world too (look at "professionalism" and "dedication" from the eyes of someone who has more than one personal facet than their job).
"Pi" now available on netflix instant
Ask PG/HN: What is the spiral thingy on the frontpage?
I just noticed this on the frontpage today:
http://imgur.com/apSQv
It appears on Chrome 19 as well as Firefox 13 on Windows 7. What is this? Easter egg of some kind?
Yelp Review of Yelp Stock
At least, after this, there should be a few people picking through github with a pin to look for other vulnerabilities.
The question I'm left with after reading this: Why? The comments suggest it's because he got paid. Why not stay on and work on cool stuff, if the company is actually valuable?
Yeah, not everyone opens the mail, so the recipient shouldn't have to deal with the larger download (and the sender doesn't have to send a larger mail), and also, the opens are more distributed over time (for the most part, depending on when you send and to whom), so you can send the smaller mails faster but have a more even distribution of bandwidth as the opens occur across a longer period.
Who watches SD anymore anyway?

Although I can just imagine all the pirates whining about "h.264 (or mkv as they call it) doesn't play on my dvd player, bring avi (as they call xvid) back".

I can't believe pirates are still burning crappy SD rips to DVD.

Someone I know stopped doing that when he wanted to watch a movie for the second time and realized it was quicker to leech a 1080p bluray rip than search through his mountains of VCD and SVCD discs for the one he downloaded just a couple of years back.

This pirate friend of mine welcomes the change, for the maybe 1 SD show he watches.

Although he personally wishes people paid more attention to sound codecs, nothing worse than downloading something broadcast in 5.1 and finding out the file only has a stereo downmix.
Note that that commit is only a comment -- the addition of "whitelist_attributes" presumably is older.
And just like that it's disappeared.
This kind of sums up the point of contention.

Rails, by default, does things like escaping input and output strings, CSRF protection, masking password fields in the logs, etc. So why doesn't it do the same with attribute assignment?
The title contains, an unfortunate comma splice.
The Best Cheap NFL Jerseys On Sale for wholesale
Welcome to online NFL jerseys-wholesale Shop. Wide selection of cheap nfl jerseys. Include new, women, kids, youth, replica, authentic, customized and throwback nfl jerseys. Only 3-8 shipping days, wholesale price for jerseys.
I thought it was more of a moral label than anything else. One who find vulnerabilities but doesn't exploit them or doesn't do it with a malicious purpose vs. the ones that do it with malice, Of course you can't read someone's mind, but you can see the actions and go from there. It looks extremely unlikely that this is a case of hacking for profit or to cause harm.
I am glad you fixed this in your post btw, but I still think the initial thought of using escaping to solve issues like SQL injection shows the way we think about security is flawed.

In general we tend to see security flaws as programming flaws. In other words, the programmer makes a mistake and therefore there is a security hole. The problem with this approach is that programmers make mistakes all the time.

Certainly it is impossible to take all the weight off the programmer's shoulders. Mistakes will always allow a program to be misused, misdirected, and so forth. However, most security issues are best solved as architecture problems, not as developer problems.

For example input sanitation is generally a bad idea* beyond certain things we should never see in inputs. It's far better to find ways of making the input safe to the database and to the web interface that doesn't depend on it being sanitized on input.

* This is because you can only sanitize based on how you want things to go on output, whether you are outputting from your program to the db or to a user interface of some sort. If you sanitize for HTML, you can't use the same info reasonably well for LaTeX, etc.....

So I am of the considered opinion that data should be checked for basic sanity on input (no termination sequences in the middle of input strings, etc), and escaped on use or output. If you have a framework to do this, then you centralize that logic so you don't have to think about it every time. This drastically cuts down on things like XSS, SQL Injection, and the like.

This sort of thing again strikes me as something the framework should prevent. That's not necessarily a flaw of Rails if you use Rails as a toolkit for your own application frameworks. However, it is an architectural flaw, not a programming mistake.
OCR, duh.
Yes, here is an example of an address that doesn't exist:

https://grepular.com/email_privacy_tester/lookup?code=gapz72...

If the address exists in Gmail, you get a response on "DNS Prefetch - Anchor", so it could be used to determine whether to send an email or not. I'm not a mail administrator but I can imagine how it might be useful to a spammer, e.g to stop mass bounce replies.
BBC: Ted Nelson interview on TeleDildonics
Well-produced video, but I don't really see the point of these "concept" videos that rely on technology that doesn't exist, like holograms floating in midair projected from nothing in particular. What if the iPhone 5 could make you a sandwich?
Right, but I think you are confusing causation with correlation. You say, "Nobody wants to learn the boring stuff and they just want to make games." But, they will learn the boring stuff if you teach it right. The concepts aren't what's putting people off, they're just correlated with bad styles of teaching it.

For example, explaining programming to total beginners doesn't work. Like you say, paragraph on paragraph about boolean logic is pointless if they can't even type:

print "hello world"

A beginner can't understand this because they don't have the cognitive tools to comprehend your explanation. But, if you make them do it a bunch, in tiny bites, and build their understanding as you go, then it works. This doesn't work for experts, but it works great for people with no prior knowledge.

So, you are confusing the concept with the delivery. The concept does not cause boredom, it's the delivery that does.
And, I also don't mean you have to deliver it wearing a clown costume, I mean breaking it down in a way that builds the concepts from nothing.
There are a lot of shady players in SEO. Any recommendations for good ones?
I'm not sure if I buy that.

If a product or service solves a small problem, what would make users transition from what they're currently using to solve that problem to this new product? There has to be some sort of incentive because inherently, we're all lazy and don't want to go through the entire process of switching existing systems.

Honestly, a simple group messaging app (or even email) + using Billmonk solves most/all of these problems. That's what my three roommates and I are using and there haven't been any complaints. As well, the more roommates, the bigger the need has to be in order to convince everyone to use this new system. The smaller the number of roommates, the even less necessary it is to have a new platform to manage all these affairs.

I think this is a cool weekend project, but would I call this a startup? I don't think so (at least, not by the definition Eric Ries uses in The Lean Startup).
That argument would hold a lot more water if searching for "accidente" with the camp name didn't remove all the pictures of the accident. The pictures of charred human remains only appear when you search for the name itself.
Real-time Game Development: Present and Future
I thought there were two different issues, though not being a rails jockey I could easily be mistaken. Even if it was disclosed four days before it was exploited I stand by my take if not my terminology.
I think these location based applications are like a wave.. People ride it,enjoy it and then get onto another wave...
https://twitter.com/#!/vkhosla/status/59390622209015808
It seems so. I freelance, so have to jump into various different offices. And on the whole, a hell of a lot of small companies that shouldn't need to be that net-dependent seem crippled these days if their net connection is being flaky.