skysight-inc/HackerNews huggingface dataset:
I want an iPad with high resolution input. I want Wacom-tablet quality input. Steve Jobs' paint-by-numbers level of quality is a pile of suck. I have tried every beautiful stylus and drawing app out there, they all suck compared to a Wacom tablet. Which is a shame. Because not putting the pen on the drawing is soul-crushing. I have several 0.3 mm Pentel pencils that remain my mainstay for drawing and math. I will not name the model, as they occasionally come up on eBay and last time I tipped my hand on another work-a-day model, the eBay prices shot up 400% and have stayed there for a year.

I want a MacBook with 4G. I would change carriers in a heartbeat to get that. In fact, our contracts are up, we're month to month, primed, waiting, for exactly that.
HDTV indicates source, not release quality. It's the same with bluray. The naming standards (and everything else for that matter) are highly regulated which is an impressive example of order by consensus since no one can give out orders.

RARs are an artefact of FTP transfers during which files would get corrupted, and not-so-fast connections of the past which made re-downloading the whole release somewhat inconvenient and wasteful.
That was the author's assumption, but it's not correct. iMessage requires both the sender and the recipient to have compatible devices with iMessage enabled.

Even putting your iPhone in Airplane Mode will cause you to receive all your text messages via SMS rather than iMessage.
His behavior should not be rewarded.
WebSockets - How To Use Cookies?
Came here to say the same thing. I love TortoiseHG but it does lack polish, and TortoiseGIT is clunky as hell.
I'd agree with it being "not the most responsible" way if you were talking about him publicly posting an exploit instead of privately talking to github. But the vulnerability was already known, he didn't disclose anything new, so I don't see the lack of responsibility.
> To playback an mp4 file you need to have it wholly (please correct me if I am wrong)

You are. By default, many tools put the meta data of mp4 files at the end of the file which means you have to have the whole file before playing. However, such mp4 files can be "fixed" using tools like this:

https://github.com/danielgtaylor/qtfaststart
> To playback an mp4 file you need to have it wholly

720p or better videos on youtube are all MP4 now. You just have to move some atoms around within the video file to prepare them for "streaming" playback. There's open source software to do this.

Then again, the ability to play an incomplete file is not really useful if you're fetching a movie via torrent, which is what I would assume most of these guys are using.
Did they figure out how to make one without putting a half a million dollars worth of platinum in it yet?
Should I use a local database or an XML file?
If the MP4 is "fast start" the index is at the beginning so you can "stream" it.

I suspect scene standardization on MKV would probably encourage Apple and Sony to deliberately not support MKV (instead of not supporting it out of laziness, as they currently are).
From my experience 12.04 is quite stable, you are going to see a few app crashed reports but apart from that everything should work.

And I agree, Ubuntu (as well as other Linux distros) has come a long way. 4 years ago there was no way I could get my graphics card to work, today it works both on open source and propriety drivers. Amazing!
> [...] automated lighting systems actually have a negative effect on break-in protection [...]

Do you have a source for this? I've always been under the commonly held impression that this has a preventative effect, and it would be very interesting if the opposite really is true.
He's not a killjoy. It only works in the video. If you saw it on the street, at another place except directly in line, it would just look silly.
This sort of behavior shouldn't be rewarded, though. He publicly exploited a 0-day vulnerability. He should've responsibly disclosed it to GitHub, and instead he revealed it to the public.
You don't need the whole file. That would just be silly and it's used for streaming all the time. Also even though I would prefer to see an open standard succeed, the mp4 container does have a lot more support while mkv doesn't have any advantages for this type of use.
Machine Learning Summer School
This is a great question, and the answer is that universities serve their own institutional needs, not those of business, or of society, or even of students. I remember the shock when I was in college trying to learn Japanese and I asked why, after the first couple of years of language, all the Japanese classes switched to literature or obscure linguistics. I told them that I wanted classes in advanced language that would teach me how to live and work at a professional level in Japan: present in a business meeting, read a contract, etc. I claimed that going from basic language to advanced, modern, professional Japanese was a lot higher priority than a switch to archaic, literary Japanese or obscure linguistic analysis. They reacted with outrage, claiming that if they were to do what I was suggesting, they "wouldn't have any academic credibility at all!"

Ah, that's what it's about. Not my needs but theirs: not real-world skill but academic credibility.

Of course it would be what I needed if, and only if, I intended to become an academic in the field myself, but that is what universities are---farm leagues for finding and developing future professors.

Since professors are only a small portion of the work force, most people weren't even supposed to attend universities. Most people were supposed to enroll in other educational programs (tech schools, art/cooking/etc. academies, apprenticeships, and so on) if they intended to work for a living.

But these days, no employer wants you without a university degree, so universities can go on serving themselves and you'll pay for it anyway, because the end for non-professors is a general purpose "degree" credential that employers use as a proxy for generic employment qualification.

I'm not saying that computer science isn't important, just that it is a higher priority for academia than for business, and academia serves academia.
I thought that rar was used so that the capper could split the archive across multiple files and begin uploading the content before the show was over.
I was going to say the same thing.

The Security guide does describe the issue, and even describes attr_accessible as a "Countermeasure".
http://guides.rubyonrails.org/security.html#mass-assignment

Without any precautions Model.new(params[:model]) allows attackers to set any database column’s value.

Unbelieveable! PHP showed long ago that allowing a web request to auto-populate arbitrary members in app objects is just a spectacularly bad idea.

Even the canonical "Hello Rails" example code neglects to specify attr_accessible.
http://guides.rubyonrails.org/getting_started.html#hello-rai...

The general attitude of Rails developers towards security here is really shocking. I don't think I could recommend anyone use Rails.
Why? He didn't cause any harm, disclosed quickly, and only acted after being ignored by the framework community (multiple times, it would seem).

It's not even being "rewarded"--it's being "not punished".

Wouldn't you like to have people spot vulnerabilities on your site and report them promptly without also breaking things? Seems a little ungrateful, yeah?

If we are all going to migrate to the cloud and assume our services (no longer under our control) are handled competently, we must place a higher premium on vetting that competency.
Are You Solving Problems or Just Building Products?
What makes it beneficial for ripping/distribution groups to coordinate like this? I've previously seen them agree on a common standard for the number and size of rar files a release is to be broken up into, and other things i can't remember the specifics of. Why do they do it?

PS: About time with dropping xvid for h264.
that's the source, not the quality
I do not like to use ad-blockers but ads have made internet really impossible to use. Some sites have few layer of ads before you can actually access the content. I feel content providers don't respect their customer by putting hundreds of ads on their website. You do not always appreciate intrusive ads like music or video or resource intensive flash. If content providers can be considerate of the number of ads they put on their website, I will not have to use ad-blocker at all.

Read-It-Later is the only solution on Android, so, I go with it.
This is a pretty huge security issue with wide-reaching implications. People everywhere pull and compile from master branches on Github without second thoughts. It's a big hole. But everybody's running defense for GitHub.

Contrast this with the enormous hue and cry against FB, MS, et al. when they have comparatively minor holes in their systems.

I'm not saying that we need to tar and feather GH, but we should at least be equal-opportunity in our condemnations and realize that everybody is capable of mistakes. So, if you're OUTRAGED about Apple making a minor boo-boo, you should be equally outraged about this.
This sounds like a "register_globals" feature. Are people still that obtuse to basic security?
Breaking some poor dude's window probably causes a whole bunch more economic damage than a spurious commit into a github repos.
I'd love to see a detactable touchscreen product where tablet part is a standalone device, but the keyboard part contains additional battery and hard-drive and maybe even additional memory, GPU and CPU. That way the low powered tablet screen could be taken off when I want to only read or watch video, but the full power of the device is available when it's docked, with tablet or desktop interface available for each mode.

(Yeah, I get that plug-and-play chips & memory are unlikely to happen, so perhaps the keyboard part would contain a separate host OS and they'd communicate over a more hot-swappable interface...)
IMO this attitude of GitHub is the best motivation to sell 0day exploits in private instead of ever trying to get dev's attention.

No, I mean really, "malicious attack". I can't help but laugh, he committed 3 lines of text grand total, this is what you call malicious? Seriously, WTF.

The guy is a proper white-hat hacker, even if somewhat childish, Y U ban him.
We included a spec in our rails app that inspects all AR models and errors if any don't specify any attr_accessible (with a whitelist of models to ignore). This catches anything included by plugins too, which can be helpful.

https://github.com/instructure/canvas-lms/blob/9b52a51b6a37e...
http://phpsadness.com/

http://www.reddit.com/r/lolphp/

Among others...
Firstly, thanks for posting this (very old) post of mine to hacker news. I didn't even register the traffic initially because it is one of my more popular posts (referenced by various people).

The point of the article wasn't to say that good programmers work at night, or in the morning. It was more about drawing the distinction between those programmers that are driven and invest time in themselves and their career.

Glad that you align more closely with the Night Programmer mindset - good for you!
Not sure that's the call I would have made, but hacking into other users' accounts does seem like a pretty valid reason for account termination.
I don't see how you can ever replace a laptop. iPads are cool and have appeal as being easier to grab & go- kind of like a larger version of our iPhones. Tablets as an accessory, yes. However, as a replacement for our laptops, no way! Those of use who daily use and rely upon our laptops know better.
I wonder how this would work for 4 categories instead of 3? When looking at something like backpackit.com, I really like how their packages feel like there are more options to get in at different price points.
That looks kinda cool, that it's mountable as a Redcarpet renderer

One feature I would love to see in RubyGems is man pages for gems, because man pages are underused and I can't go and look Github documentation up quickly as I have to break out of my dev box and go and open Chrome and look it up there

I would still use https://github.com/rtomayko/ronn, simply for the pretty HTML pages though
He clearly violated their Terms Of Service:

5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express written permission by GitHub.

You do something dumb like this, you should live with the consequences. In legal terms, if they don't enforce their TOS, it can be a legal issue later.

I love how he punts on the terms with "but lets get real".

Analogy: You break into a house and get caught. "Oh yeah, laws. But lets get real, I was pointing out they didn't lock their door."
We must realize that Ed Hardy under button up shirts two sizes too large is considered fashionable by some people. I've never met them, but I'm sure they exist.
I would expect the guy who found an issue with GitHub to report it to them. Yes, the rails people could have, should have.. But they explicitly asked "him" to report and there is no word on whether he did it or not.
Hi there,

Not really. I wrote this post when I was doing a lot of consulting around software development. I was working with lots of different companies and was comparing some of the individuals involved and how easily they could grasp some new concepts.

The defining characteristic was some/all of those attributes that I ascribed to Night Programmers. That isn't to say that I think Day Programmers are worthless - that isn't the case, but I personally would rather work with Night Programmers. Makes life more interesting.

Since that post was written, others have observed that Night Programmers might be difficult to work with which may well be the case given that their passion might lead them to odd work behaviours and extreme points of view.
Anon reveals Canadian gov surveillance proponent appointed mistress to gov job
What I would like to know is if this is permanent or just till github completes their security audit. It doesn't seem like homakov intended or caused any real harm, although it was a bit immature to draw attention to the vulnerability that way.
Like this? https://github.com/blog/1068-public-key-security-vulnerabili...
I believe it's for non-torrent sharing methods such as NNTP (since you can't, I guess, upload hundreds of megabytes of data to a newsgroup in a single post).
He didn't exploit anything, technically--that's all in the service API. (thanks Rails!)

More seriously, just because he violated the ToS doesn't mean that they have to be dicks.
A harmless, spurious commit is hardly comparable to the insane property damage of destroying someone's house, likely to bankrupt a private person.
Part of it can come from who you've grown up around. To draw from my own experience, I think I've had one technically inclined IRL friend ever. Everyone else has been a non-developer/designer, non-programmer, or barely computer literate. What happened to me was at age 10 we got a computer and I've been absolutely obsessed with creation ever since.

This led to mannerisms, interests, and an external appearance adapted from my peers, but also to a quiet (though dominant) side of me that spends 20 of 24 hours each day pounding away at my keyboard. If I ever came across another programmer in the wild I'm not sure how I would be received.

It's weird to not fit in anywhere. But these guys just sound like douchebags.

Truth be told this 'us vs. them' is a relic of the Revenge of the Nerds days. Saying things like "no you're a bro you can't be one of us" or yelling "neeerrrrrrds" is exactly the same thing. As time wears on, the techs will seem to get less awkward and the bros will seems to get less "bro-y." It's the convergence that occurs once the social stigma of the 80s has worn off.

It should be noted though that tech conversation and "testosterversation" are really difficult to mix. If you're in one mode you don't want to keep switching back to the other.
Hackers Steal Michael Jackson's Unreleased Tracks
Thanks for the news. Now I have a reason not to work until 2013. =)
If I was in their shoes, I would have made the same call: he hacked into users accounts and threatened to do more damage, quick, bust out the bargepole

I would be very concerned about this backfiring, but, I would hack Rails a little to report when anybody attempts to use this glitch and wire that into Hubot(TM), so if he does attempt to use this same hole again, the devs are warned instantly
If the best you can do is close to a year stale and doesn't apply to the latest version, I'd say PHP is doing a fine job.

Also, reddit? Really?
Isn't bgsound IE only? That's what a quick search lead me to believe...
Egor, keep up with the good work. Not your fault Rails guys are overly self-confident.
It seems problematic to set up and could cause nukes for incomplete releases with the slightest mistake or network failure on the capper's part (with the accompanying displeasure of sites' admins). And he would have to do everything on his own -- the capping, the encoding, the packaging. Also, I don't know how hard the tv groups are pushing for early release but usually the content is uploaded to the group's server and only then pushed to affiliated top sites at the same time.

Obviously, it's all hearsay so you may be right.
IMHO, tablety paddy things are all just expensive toys unless they let you use some form of accurate stylus as well as your fingers.

Fingers have some major usability issues if used as your only drawing instrument, when it comes to any form of detailed technical drawing, and in engineering environments are often covered in various interesting varieties of minging filth.

Also, we can see down to a much finer point than the tip of a finger and even if I have paid out serious money for something that calls itself a 'retina display' I would still like to be able to try and see which pixel it is I am selecting.
Case study in community relations and why the GitHub hack happened
http://news.ycombinator.com/item?id=3663816
OT: Hey you're back! Welcome...
Others have made the comparison to PHP's `register_globals`.

Yes, Github had vulnerable code. It's also true that Rails apparently defaults to leaving that bit of code vulnerable. A saner default seems in order, if even highly competent Rails devs can be caught by this.
This is a shocking portrayal of the actual occurrences.

They/He make it sound like they were proactive about all of this, always one step ahead of the attacker/@homokov

> As soon as we detected the attack we expunged the unauthorized key and suspended the user.

They didn't detect anything. They were informed. It also wasn't an attack. If it was an attack, you wouldn't have seen it coming, or in the very least more damage would have been done.

As far as attacks go, this was probably the "whitest" of white that has ever gone down. Not only did the "attacker" not do any actual damage, but he was continually ignored.

This is a shameful handling of the actual events.
The title is a little misleading. This is a new standard for SD content.

http://scenerules.irc.gs/t.html?id=2011_X264.2.nfo
Even better, IMO, would be a layered API, with a lower layer of 'atom' (atomic would be a good name, if it wasn't taken for something else already) calls tht do one thing, and a clearly separate layer of 'molecule' calls that help you perform common operations. For example, reading a text file into a string would be a 'molecule' call. That call would not need to be as flexible as a hand-coded open-read-convert bytes to characters- close chain. For example, it could assume a UTF-8 encoding.
Particularly funny is (https://github.com/rails/rails/issues/5228#issuecomment-4290...).

I'm sure that that is great solace to the GitHub customers, staff, and any other sites affected by this vulnerability.

Developers: we need to do better.
I'll give it a shot and get back to you. Should be doable.
Can't say it is a douche move from GH since they are protecting their users' best interests. The facts are: Egor has a way to cause damage to GH. I don't think GH would sit there wondering whether he would do the ethical thing.

_If_ something had happened then the reaction would have been totally different. "Why didn't GH ban him when they could have before the damage was done?"
Right, refactoring an existing project to enforce attr_accessible nil by default can be a hassle.

From my experience, the main (though easily side-stepped) annoyance is when creating or updating records that have belongs_to associations (for example, user_id and repository_id for a commit ;)) programmatically.

For security purposes, you would not set those 2 attributes to be attr_accessible. To create a new record, you then would have to build the record and then set the user_id and repository_id on the record.

Or, you can set user and repository to be accessible (attr_accessible :user, :repository). This is fine because the associated methods expect ActiveRecord objects.
Suspending his account doesn't make any sense. He could easily sign up with another email account. Set up a new set of keys on another computer and he's back at it. GH should be working with him instead... he obviously knows what he's doing.
From the same author, http://oscarbonilla.com/2009/05/the-monty-hall-problem/
Not according to - http://blogs.discovermagazine.com/badastronomy/2012/03/04/no...
Is this open source? I'd love to implement some of the changes mentioned above.
I'm pretty sure it's already deliberate.
A non-geeky guide to understanding performance measurement terms
Thats why I say tabs are for consumers. If you want to just sit down and look at things on the web, then they are ideal. The second you want to participate, say, reply to some one on a forum, then it begins, IMHO, to get difficult. If you want to type out something or work, then its near impossible.

OK, there is, or should be, more to it than browsing the web, but my point I think, is more about input. Maybe be its me, but I am yet to find anything better than a keyboard and mouse. Even track pads are a pain to me. What I think is a problem is that these tablets actually limit what one can efficiently do with a computer, which kinda goes against the whole point.

I also think that "we" techie types are very different users to the majority of people who buy these things. We expect a "computer" to be versatile and do everything. Where as the average punter only wants limited set of things to work well. And these tabs do that really well. And, of course, there is more of them than us!!!!!!
I am learning webmaster skills and have marked this to study in detail later. I am scratching today after having my site ranked #3 on google for my keyword to today not being found in the search results at all. I went to bing and did not have this problem. The changes Google made with the new search format last year has a lot to be desired in my book.
I mostly agree with you in principle, but sometimes you push the big red button and sort out the pieces later, like when it's not a Sunday.
I like how Python is considered a 'next new thing'. It merely predates the web.
A Coder's Nightmare