skysight-inc/HackerNews huggingface dataset:
There are two things that needs to be defined here (Well three if you include how media never portrays the story as it was interviewed, media always searches for the dramatical pitch [1])

The first is that of the Brogramming meme. The definition at Urban Dictionary is a joke in itself. It's a joke accept it, don't accept it. No developer in their right mind goes around proclaiming that they are a brogrammer and if they are saying that they are serious (like some say in the case of Facebook and Zynga) you are being deceived [2].

There is a second definition which that I think everyone clumps with this meme and that is of the asshole/douchebag/sexist employee. He is everywhere. Not just in software development. These individuals are the ones making the majority of sexist comments, makes sexist jokes while a female employee is in a cubicle nearby, trying to hit on female coworkers during work hours and going to bars every night. They have existed long before any reference to Brogramming.

Now, I will say this. It was not smart of this individual to try advertise the meme to the SfGate readership. Just based on the prefix "bro" alone will bring about perception of sexism even if the original intent was not to be.

[1]: http://www.facebook.com/ariadoss/posts/305742279480205
[2]: http://www.facebook.com/getwiththebrogram/posts/373108606051...
Jeff Bezos's Brain scan: Taking the long view
He clearly violated their Terms Of Service. If you like and enjoy a service, exploiting it to prove a point is not the way to do it. It takes no time to spot the clause about exploiting the service.

Legally, it wouldn't be good to have a TOS and then not enforce it. You never how that could bite you later on if you get dragged into a dispute.

All this "they should give it back when they're done" is pointless. You can't reward stupid behavior.
The problem with this attitude is that such caveats are not mentioned where it would be most prudent to do so. Which means you have scaffolding and documentation that shows you can use mass assignment, but totally fails to mention what you also need to do if you're going to put that code into production. Instead, it's hidden in a totally separate section in the guides.

The approach this encourages is to code insecure (because you don't know any better), without any awareness of it being insecure, then remember to go back and secure it when you've found out what all the vulnerabilities are. Inevitably, you will waste time, and probably miss things out.
He didn't hack into any others' accounts, he simply (mis)used the service from his own. Suspending him is useless for security as he could set up another account in minutes.
For the longest time, xvid was the standard for these guys. They still have standards requiring that all releases be packaged into multipart RAR files, "in 15, 20, or multiples of 50 MB". In other words, they are kind of inflexible and hidebound.

Anime fansubbing groups, in contrast, have no common standards except for -- to paraphrase the IETF motto -- rough consensus and regular releases. If some group wants to encode with Hi10P to get the same video quality at 2/3 the file size, they don't have to ask permission from anyone. Competition between groups gradually pushes forward the rough consensus, which is how they switched from xvid to x264, from container formats like AVI to the more flexible MKV, from SD to HD, and so on. The freedom to not live up to a community standard of quality gave them the ability to exceed it.

There's probably a broader lesson in all this.
The Wild Dogs of Istanbul
Yesware also does something similar as well...
Except if you're using ksplice on Linux to start a new kernel, you won't be waiting for RAID to initialise, which means those seconds do matter. (Or fast reboot on Solaris.)

In many SLAs, the amount of time the system is unavailable can count against the company providing the server. Minimising the amount of downtime is a win for everyone.
When tech stops being as lucrative, the brogrammers will scatter like cockroaches.
I'm not sure if I agree with you.

I think a lot of people are repulsed by the idea of spending a career surrounded by the "programmer" stereotype (i.e. monomaniacal, male, introverts). Part of me wonders whether advertising a more traditionally social work environment might not attract a lot of talent that doesn't fit the "programmer" mold (including women!).
PHP Q&A website
They should be hiring him.
I don't think he can be blamed too much though. As per the bug filed here - https://github.com/rails/rails/issues/5228, the bug was being closed by others after being given a cursory look, and was being reopened again for consideration. Maybe a little immature, but there was a mild provocation.
You appear to be arguing that one anecdotal query "says nothing" but one anecdotal user experience says something. What is it about your anecdote that makes it meaningful in a discussion about services with hundreds of millions of users?
Suspending him only shows that if a vulnerability exists (and they always do) in the future people won't go about it so openly because what they'll get for their troubles will be an account suspension. The guy could have done real harm if he kept silent and used it maliciously, chose not to, and got suspended. Github should pay him for finding the vulnerability instead!
I never suggested it was off topic, I usually enjoy reading the low level programming threads on HN.

I just wondered why it seems to considered something every CS grad/programmer should understand.
I think it's perfectly fine to not "give him a break." How else is he going to learn manners?
Some people are jealous of success.
Having just graduated high school a few years ago, I'd say graphic calculators are sort of needed. Most of the time a simpler calculator would do the job and having a $100 Texas Instruments is just a luxury because they're better laid out and show a history of operations like a terminal. Even when graphing and matrices were part of the curriculum, those things can all be done by hand if you really have a lot of time, but it would be harder to learn that stuff without a reference to compare yourself to.

TBH I think books, calculators, computers, and basically every other tool kids use in school will soon be replaced by the iPad, or a similar device. If someone can make a cheaper alternative with R-Pi that catches on (very doable), well great.
Relic or not, that's the way things are in many businesses and governments.
Presenting PostHub
My problem with this question always is: what do they mean by "learning" a language?

Does it mean you just learn the syntax? Does it mean you can write a simple program that works? Does it mean you can write a simple program that works and exhibits the idioms of the language? Does it mean you can write a medium length program without having to refer to api docs? Does it mean you can write a complicated, robust, production quality system in the language? Does it mean all your friends who have a perplexing problem in the language shoot you an email because you know it inside and out?

All of these take differing amounts of time to accomplish, and all can fall under learning a language. I think I've learned erlang at least 3 times now. When you say you learned a language in a week or two, what does that mean?
Of course there is distrust, and it is unlikely that hiring based on social behavior is going to make a successful company. I'm merely pointing out that some misguided people are trying to change the business environment to their advantage. I didn't say they are or will be successful. If we describe the status quo, it will be the same as it always been, engineering requires strong, real skills for success. Companies that have unskilled management or people who "bro'd" their way into a high level position are going to have a hard time finding success, but we have to acknowledge there are real companies out there that are taking brogramming seriously.
Where have they been dicks? Please elaborate.

From all appearances, GH is taking it quite seriously. Because it is a serious matter. Egor on the other hand wasn't taking it seriously.
See here:
https://github.com/rails/rails/issues/5228#issuecomment-4290...

This isn't a 0-day vulnerability--this is an issue known to the rails devs, and one which they decided wrongly on. Sometimes you've got to take things to the next level of visibility.
Sunday Spinach Homemade Ricotta Fresh Plum tomatoes Stuffed S... on Twitpic
If 'bigger screen' rather than 'desired screen' is the required spec, then surely a 17" laptop handily beats out the MBA? It'll have a bigger hard drive, and more RAM as well.
But which version do they sell? I'm talking about the old version with the yellow brick computer. The new version is bad.
Think this was meant as a short term move. They got a patch out in an hour. Suspending his account atleast stopped him for 5 minutes while they were working on it and prevented further immediate harm. Sure, anything over an hour it wouldn't stop him, but it sent a signal.
Personally, I find it fascinating that this band of merry pirates is so organized, so rules-based. Out of a purely anarchic environment, they've managed to accept this kind of self-discipline. If only web-standards committees had that sort of power...
Well, this is not exactly what I expected to find in the ToS:

GitHub, in its sole discretion, has the right to suspend
or terminate your account and refuse any and all current or
future use of the Service, or any other GitHub service, for
any reason at any time. Such termination of the Service will
result in the deactivation or deletion of your Account or
your access to your Account, and the forfeiture and
relinquishment of all Content in your Account. GitHub
reserves the right to refuse service to anyone for any
reason at any time

That means my company's code can be wiped out by GH at any time, for any reason. Please don't hurt me :(
While not mitigating most of the issues you listed, I thought I would mention the awesome https://github.com/ctran/annotate_models plugin in case you did not know about it. I personally could not work on Rails without it.

AR was born with a set of very opinionated decisions. I believe those that prefer a more declarative approach (and built-in identity map) can use DataMapper.
Funny enough, almost every programmer I've ever met that I would identify as "punk" was seriously into coding craftsmanship. Nothing punk about their code.
This is really childish attitude. Egor grow up.
Yes, I think it is, but don't forget that IE has quite a share on the browser market.
What's to prevent Egor from setting up a new account and using it to exploit the vulnerability he's found?
Git is a distributed SCM, you know. I would highly recommend that you push your code to other remotes in any case.
Many desktop e-mail clients have their own rendering engines. Outlook, I believe, uses Word's HTML engine, for example.
First--I know the author of this post personally, and he's a good kid. Young, but ambitious, talented and smart, and he's got his head on straight.

Second--how important is a CS degree in the Valley? I lived there for 10 years, was extremely successful there by almost anyone's definition, and built, bootstrapped, and ran a tech company for 6 of those 10 years. Yet I don't have any college degree.

I think the OP sees people like me in his daily life (we work out of the same building, and chat a lot) and thinks a degree is probably not as worthwhile as society thinks it is.

There is a value in a CS degree, but there's also a lot of value in being forced to make a business work or you don't eat this week. That's where I was when I first started in business. Both paths have merit, but many CEOs and successful people don't have, or need, a degree to get there.
Read marks are an option for the receiver, and is turned off by default.
What do you mean by "load scenario"? The only thing that should affect the plan is the characteristics of the underlying data (e.g. do we expect to return so many rows that we should full-scan anyway, or can we use an index).
Uinvest review Earn Money by Investment
Plaintext e-mail is awesome, not just because it's readable, but because it's not vulnerable to these sorts of attacks.

Incidentally, it's unfortunate that Sparrow doesn't have a 'force plain text' option. Even though I've checked 'prefer plain text', all Facebook e-mails are delivered in HTML. This might be a reason to switch back to Mail.app.
I would say that homakov's angry and not very mature reaction to his warning being ignored just did a very big favor to a lot of rails developers, that reading about his exploit on HN (and other places) will rush to check their websites and will fix a LOT of serious vulnerabilities they didn't have any idea they had. But which somobody could have already been secretly exploiting.

Understandably, Github would have liked much more to be one of those companies that will be able to quietly fix this vulnerability without anybody knowing, but now that the damage to their image is done I really hope they'll not add to that damage by persisting in their banning of a 18 year old that acted irresponsibly yes, but maliciously - definitely not.

From a PR perspective, I guess that having titles like "Silicon Valley company rewards Russian teenager who helps them eliminating a security risk" could even spin the episode in their favor.
Russia Vote Ballot 2012?
I would be happy to provide one to you. Where do I submit a pull request?

By the way, one of the main reasons I bought an iPad stems from the fact that HN comments were so hard to read on my iPod Touch. And I'm a student who doesn't have a lot of money to buy every latest Apple gadget. So it is pretty important to me. ;-)
To provide better search results?
You're stating the obvious. Egor Homakov should have done a lot of things differently. But there is little that can be done about the behavior of bad actors in the rails community. With people on the team, it's different. Practices can be audited, mistakes can be pointed out, and the fine people in the Rails team can respond to criticism and improve their performance.
A lot of devices don't support High Profile, let alone Hi10P. Frankly, getting video in Hi10P sounds more annoying than 'innovative'.
Good question. It was a long time ago, and I'm having trouble googling for it, because all I get in search results are articles and how-tos by motion-sensor companies selling their products. I'll search though and update if I find it.

UPDATE: Hey, awesome, turns out we blogged about it back in the day: http://blog.ratemystudentrental.com/2008/03/05/a-safe-home-i...

Here is the original article: http://www.schneier.com/blog/archives/2007/09/light_and_crim...

Much so-called security lighting is designed with little thought for how eyes -- or criminals -- operate. Marcus Felson, a professor at the School of Criminal Justice at Rutgers University, has concluded that lighting is effective in preventing crime mainly if it enables people to notice criminal activity as it's taking place, and if it doesn't help criminals to see what they're doing. Bright, unshielded floodlights -- one of the most common types of outdoor security lighting in the country -- often fail on both counts, as do all-night lights installed on isolated structures or on parts of buildings that can't be observed by passersby (such as back doors). A burglar who is forced to use a flashlight, or whose movement triggers a security light controlled by an infrared motion sensor, is much more likely to be spotted than one whose presence is masked by the blinding glare of a poorly placed metal halide "wall pack." In the early seventies, the public-school system in San Antonio, Texas, began leaving many of its school buildings, parking lots, and other property dark at night and found that the no-lights policy not only reduced energy costs but also dramatically cut vandalism.

I remembered it incorrectly, as apparently motion-activated lighting helps, but on-all-night floodlighting makes the situation worse.
Zeppelin is just a brand (at this point, anyway). While the Zeppelin NT isn't a blimp, it's not a rigid airship either, but rather a hybrid of the two with an internal frame. Better than a blimp at high speeds and in bad weather, but I doubt the design would scale to the size of the 1930s behemoths.
I believe Github has patched this specific vulnerability.
You're good by me. There are so many ways that you could've gone in a truly evil direction with this exploit, and you chose not to.
Ask HN: Anyone had LASIK and, while successful, still doesn't see "well"?
I wore glasses since I was a kid, for 15 years. Then a couple of years ago I had LASIK performed, and after a second touch up procedure I ended up with a "perfect" lens on my eye (according to three different doctors). So the LASIK was a success, I see as well without glasses now than with glasses before.

BUT, I never saw too great with my glasses before to begin with. I can totally have a normal life, but I need to be a lot closer (than people with a normal vision) to text to be able to read it. This affects me greatly on my day to day as I'm a developer, and I need to be staring at text on my screen all the time. I can work just fine (larger font, screen closer to me, etc) but the biggest problem of all is, I tend to get my head closer to the screen a lot to see smaller text, consciously or not, and I have ridiculous neck and back pain as a result. I've been suffering this already for a few years. I've been to several eye doctors and all say wearing glasses or more LASIK wouldn't make a difference since "my eye is OK", and of course I've gone to every kind of back expert on Earth. All agree it's a posture issue (doh!) and while a good massage is a relief, the relief doesn't last more than a few hours, so that's not helpful.

Has anyone gone/is going through the same? Any ideas what could I do to improve my vision?

I know all about "stop working every X time and do this and that exercise to relax your back", and would appreciate any "amazing and not-well-known exercises", but I'm mostly interested in improving my vision, if that's at all possible.

Thanks a lot.
Since when did learning a language stop being a big investment? Beyond syntax there are idioms, idiosyncrasies, standard libraries, advanced features, upstream features, and toolchains.

How many people do you know have full understanding of C++ or Haskell? Or even Ruby or Python?
It's important if you want to get a job. Not so much if you want to start your own business (see my other comment in this thread for more details on that.)
Yes, mass assignment with Model.new(params) and model.attributes=params is a best practice for professional production Rails websites. Business and security rules for field updates are coded in the model (attr_accessible/attr_protected/validates).

That's how it's been since Rails 1. Which is cool. But it's error-prone for newbies, especially when Rails's model and controller generators make all attrs writeable by default, with nary a generated comment about how or why to lock things down. In a culture of convention over configuration, attrs should be locked down by default: "config.active_record.whitelist_attributes=true" for new apps, and throw a helpful message when I mass assign to a model that has no accessible attrs configured yet.
So if you had a vulnerable product and this gentleman altered one of your customer's pages without permission you would be grateful? That is strange to me.
This is pretty standard practice really... many e-mails will have a "tracking pixel" or similar. Facebook has this in their e-mails too: <img src="https://www.facebook.com/email_open_log_pic.php?mid=
=blah" style="border:0;width:1px;height:1px;" />
There was a post about doing the pragmatic thing versus the right thing on HN a little while ago. I can't think of a better scenario to illustrate that than this.

By pushing him out you create moral hazard for future users who discover vulnerabilities. You also, in the near term, risk pissing off the guy who found the vulnerability which could result in very real blowback.

I'm basing this on the assumption that he didn't do anything malicious, i.e. outside his own account. If he did then his near-term risk profile changes dramatically and the move would have been rational.
Integrating PR Into Your Product
Boo: https://twitter.com/#!/avibryant/status/176155999151996928
The Rails team essentially argued that it isn't on them to secure sites built with Rails.

I'm getting a good laugh seeing this card played to defend terrible practice as the norm for what sells itself as an opinionated framework that champions convention over configuration.
Because of distraction-free-single-tasking-writing.
Fake it till you make it. That is pretty much the advice given to people in unfamiliar social situations. It doesn't work in technical areas (where it is rightfully laughed at as cargo cult coding) but it does work in social situations.
They claim to have fixed it. http://news.ycombinator.com/item?id=3663313

If they were thorough enough to fix it everywhere in their code is a different matter, though.
This other part is fun too:

Verbal, physical, written or other abuse (including threats of abuse or retribution) of any GitHub customer, employee, member, or officer will result in immediate account termination.

What if a GitHub employee cuts me in traffic and I shout f--- you!? My account could be lawfully terminated if the guy finds my twitter handle.

God, I hate law. I'm sure github folks have good intentions and operate on good will, but reading this stuff gives me shivers.
Torties are great, loyal cats--they can have a bit of an attitude though. :) Here's my little tortie girl: http://i.imgur.com/ilSqNl.jpg
In the future, if folks find vulnerabilities in GitHub, please report them via an Email to security@github.com or support@github.com.
So, the vulnerability was public for at least days in homakov's bug report, and probably for years to anyone who wanted a crack at github badly enough to do a little research. Is it paranoid to worry about malicious commits in other important github repositories?
My take on this is that it is fairly common to use some type of analytics to know if your targets are opening the mail that they get from you or not. This is a fact of which I am familiar with from my knowledge of email marketing. In reading this, I am not so sure this is a direct attempt to invade privacy. I just think Facebook is following practices is already common with email marketing. From a privacy or trust concern, I feel much safer with Facebook services than I do with Google.
Ronn's HTML output is indeed pretty, but I cannot say the same of its input. In particular, I find md2man's syntax for tagged paragraphs (all lines indented by +2 spaces except the first line) to be less intrusive and easier to maintain than Ronn's (list items that begin with boldface and end with a colon, followed by +2 space indented lines).
The odd thing is, I've never met a guy in a fraternity like this.
Here's an article explaining the trick:

http://ridiculousfish.com/blog/posts/labor-of-division-episo...

And a library from the same guy for generating code at runtime to do fast division by constants:

http://libdivide.com/
Big Data and the Perception of Privacy
Thanks very much for the answer pg.
That's why you use yenc. Personally, I believe it's to do with now bypassed limitations of parity programs.
It may have changed since you posted, but right now it says first Zeppelin. He does go on to seemingly conflate the terms though.
Naveen Selvadurai, Foursquare co-founder is leaving
This analogy is just wrong, on the web exists perfect anonymity. Very often you also can hide your traces and nobody will ever find out what you did.

You have to assume every exploit will be abused.
The most stupid thing you can do is attack the white hats, because the next hacker will shove your stupidity down your throat. On a lulz way or on a black hat way.

I would never let my data near a company which doesn't respect white hats, for security and moral reasons. I would remind you that we are on Hacker News, that doesn't exclude the popular meaning of the word.