skysight-inc/HackerNews huggingface dataset:
The Rails Guides may discuss it, but this does not excuse the fact that for years the Rails core team knowingly shipped code (and generators that created) insecure by default code.

No, this isn't a "Rails vulnerability" in the traditional sense, but the level of immaturity and groupthink in the response to these issues being reported is staggering and somewhat shameful.
I wonder how many Rails apps there are out there that is still vulnerable to this sort of flaw. Both GitHub and Posterous has fixed it, but there's probably thousands of smaller less known Rails sites/apps that still haven't been patched.
Nope. It has about 300HP at the wheels. It's super fun.
Scientists Say People Aren't Smart Enough For Democracy To Flourish
Do Startups Need Hockey Stick Growth to Raise VC? - Mark Evans Tech
A really interesting concept! Unfortunately it's only really applicable for Americans though. It'd be nice if there was support for other legal systems, but I guess that'll come with time.
Cool. :)

Btw., I assume you know LOEVE? https://love2d.org/
Is is very similar, though the target audience is not kids. :)

Personally, I think time would be well spent making a kids-friendly version of LOEVE (and ofc, porting LOEVE to Android/iOs, finally).
What makes 3 more enjoyable/productive?
ex-pHASE courier here. You must be referring to 0day couriering. We use a custom pftp w/ rel server to chain our FXP routes.
I've also looked into licensing live sports data from Stats, Inc. and it is prohibitively expensive (i.e. tens of thousands of dollars to get started). It seems like the timing is right for a crowdsourced solution for live sports data that is developer friendly.
Can a $35 computer teach kids to code?
nope, the canvaspixelarray is no arraybuffer, doesn't work yet. i check for changes in that regard with every google chrome canary release.
Yes. pftp is the tool of choice for couriers still.. albeit they hardly resemble the original source.
I downvoted you for trying to make a big deal about opening a closed issue. That's one of the weakest arguments I've ever seen.
Six Circles – An experience design framework (PDF version)
No one uses drftpd except for rented sites. They all use glftpd, still.. sigh.
It's all perspective, I guess. I was pissed when I joined a shop that wouldn't give me a phone. I had been cell phone free for 5 years and didn't want my own. Instead, I get a per-paycheck stipend to cover work-induced costs.

The up-side, however, is that I felt free to unplug my desk phone and totally ignore it. For some reason, that really reduced my stress.
and hence, like hn did with google+ subdomain, every link should include subdomain if its not www.
Good job ESPN. I was excited about this until I registered and realized I could only use headline data. This thing is completely useless without giving everyone access to at least two more data streams. (No scores?!) FAIL.

Nice try though.
And link: http://www.shareaholic.com/careers/
Love it. Will a rating system be added? Would love to know which documents are better than others in a particular category.
Yeah, this is really unfortunate. I run a game thread generator for the NBA subreddit (essentially just builds a nice pre-game data table for a user to create a thread), I guess it's going to stick with insane scraping for now: https://github.com/alex/nba-gamethread
FYI, a breadpig is already taken.
IMO, the unmade decision is a symptom.

In my personal experience, I start deferring things when there's something else going on that I don't want to deal with. Usually the something else is that I haven't accepted that I "don't know" something.
Looks like the deeper cuts, in his division and more broadly, are confirmed: http://allthingsd.com/20120305/yahoos-new-ceo-preps-major-re...
Nokia Ovi Share to be discontinued
I posted a link to the relevant part of it (http://news.ycombinator.com/item?id=3665429) on another thread regarding this exploit already, but the official Rails Security Guide covers this and other common security pitfalls really well. It is worth reading over thoughtfully if you are building a Rails app:

http://guides.rubyonrails.org/security.html
You sure? Facts can't be copyrighted, I think sports scores are considered facts.
Let's not forget about hardware donors. Donate a hard drive? Get an account and some credits! Sites such as LSD and LOOP did this.. and many more still do.
Maybe I'm being unnecessarily harsh here, but this seems to have about the same level of substance as a low-level JS tutorial you'd find on Nettuts or something.
I'm a Python/Django developer and don't really know much Ruby or Ruby on Rails. Does anyone have an outsiders/non-rubyist explaination of how this hack was carried out? Did he modify HTTP headers? POST parameters?
If you like this, you'll love MOAI: http://getmoai.com/

(For when those kids grow up a little more, perhaps..)
Reading their Terms of Service... Section 3...

"Branding. All Apps must include an approved ESPN trademark, logo or other intellectual property (each, an "ESPN Mark").
Advertising. No advertising or sponsorship of any kind may appear on or be associated with any App (unless included in the Content made available by ESPN).
No Charge. All Apps must be offered free of charge to download or otherwise access and may not contain any in-App purchase features."

Correct me if I'm wrong - but they've made it impossible to monetize my effort, correct? I don't see how this will go anywhere if that is the case. It seems like they just want developers to build extra ESPN apps for them, and then give them all away for free. Ugh.
For me, unicode everywhere is cool. (Yes a PITA to work with, but it should be a PITA if you only assume ASCII)
IDC Analyst Firm Predicts: Cloud Computing to Create 14 Million New Jobs by 2015
IDC Analyst Firm Predicts: Cloud Computing to Create 14 Million New Jobs by 2015
I hope those who ripped into Homakov initially are feeling more mellow towards him. They certainly were justified in thinking him being rash, but his action raised far more awareness about this issue than the typical proper channel.

Rails devs (some, not all of them) had dismissed his complaint because "Every Rails developer hears about attr_accessible." Well, I'll be the first to say that I can't remember the last time that this update_attributes vulnerability had been pointed out to me. I certainly can remember all the times that Rails docs reminds me to use their sanitizing helpers when making ActiveRecord queries.

To be fair, I haven't developed apps that required the use of user-facing access to update_attributes, and maybe when I got around to using that, I would've wisely consulted the dev guides to make sure I was following best practice. But knowing me, I probably would've likely thought, "Well, that seems simple enough, here goes."

It's not that the logic behind this vulnerability is hard to understand...in retrospect, it's as clear and blatant as the processes that lead to SQL injection.

But surgical patients die because elite surgeons sometimes forget to wash their hands (Google "Atul Gawande checklist"). It's not an impossibility that a skilled dev team would overlook the update_attributes issue.

The Rails team was right in arguing that this wasn't a security risk given a half-competent dev. But they were looking at the problem from the wrong perspective and assumed that everyone is as familiar with Rails best practices as they were. So how else could Homakov convince them otherwise other than pricking a high-profile dev group?

What if Homakov managed to alert the Github team, and they managed to fix it quietly? Github would be safe but thousands of Rails sites would still be operating in ignorance. It truly stinks for the Github group that they had to respond to a five-alarm emergency on a Sunday...on the other hand, I think there are going to be a lot of Rails devs who are thankful that they (involuntarily) took one for the team. Thanks to Homakov, it was a small hit.
Star Wars does Yoga by Rob Osborne
CIOs Must Fit The Cloud Into IT Strategy - All VoIP News
CIOs Must Fit The Cloud Into IT Strategy - All VoIP News
That's amazing! I would have loved something like this when I was growing up. If you can do that simple games would be no problem, and who doesn't dream of making their own games.

Also, try 'z' and 'p'.
MethodProfiler: Find slow methods in your Ruby code
Microsoft: Cloud Computing to Create Millions of Jobs
Microsoft: Cloud Computing to Create Millions of Jobs
> But for guys like me who never use mass assignment, our
> applications are not vulnerable by default, correct?

Yes, if you never ever call `update_attributes` you're not vulnerable. This is, however, the most common way to perform model updates.

> And likewise, for people who RTFM before using mass
> assignment, their applications are not vulnerable,
> correct?

No! Absolutely not! The Github exploit is a prime example of this. Solid developers, who have obviously ReadTFM, can easily fall victim to this because the default is to be insecure!

The fact is that Rails ships code generators that give you insecure code and put the onus on you to do something about it.

I'm not absolving any developer of their responsibility to not shoot themselves in the foot. Ultimately, if this Github exploit had been used to do serious damage, Github, not the Rails core team, would have been responsible. It is the developer's responsibility to ensure that their code is as free of vulnerabilities as they can make it.
It's sad that this same bug was resolved in CakePhp 7years* ago:
http://groups.google.com/group/cake-php/browse_thread/thread...
I was going to read this until I saw (techcrunch.com) :(
The Enterprise IT Industrial Complex In The Era of Agile IT
The Enterprise IT Industrial Complex In The Era of Agile IT
I agree completely, which is why I have carefully curated my collection of computers over the years, to keep them functioning until the day my sons are ready to code. I've still got my Oric-1 (and now, an Atmos) with all accessories, in fully working order, ready to roll! :)
Most significant libraries and tools work with 3.x by this point. SQLAlchemy, numpy, scipy, cherrypy, WebOb, pymongo (as pymongo3), virtualenv, pip, pygments, jinja2, tox, nose, ...

It's too bad that django, zope and werkzeug (flask) aren't there yet. I understand that a lot of people on this site use django and so these discussions are always dominated by people complaining that they can't use Python 3 because their dependencies (django) aren't available.

But the Python community is much bigger than django and today most of the rest of the ecosystem is ready and working fine. The parts that aren't, are getting there rapidly.
It's confusing too. The API suggest 4 tiers but then in the FAQ it mentions 3 tiers. The top tier is for ESPN itself?

ESPN: "Hey guys we are cool, right? We opened up our API so that anyone at ESPN can use. Let's tell the world!!"
They explain how to contact them if you'd like to sell an app. The idea is that they do not want you earning money from their data without them getting a cut. Similar to how Apple does not allow you to use their distribution channel without taking a cut.
Works great on my Beagleboard already! 10 points to you for using SDL and making it build so cleanly ..

EDIT: just wanted to add, it works fabulously on my Open Pandora console as well!
Good flag - I've made the warning even clearer in the Gist
You would modify the hidden form values (or add parameters that didn't exist) depending on the situation. These new/modified parameters would appear in Rails' params hash which would then be passed to the update function which, by default, will update any fields you hand it.
I agree that the default for Rails should be more secure, but this was a really basic mistake by the GitHub team. Yes, mistakes do happen, but there's a very simple way to avoid the exploit that is postulated in this article.

The 'schematic' of what the public key update looks like from the original post:

class PublicKeyController < ApplicationController
before_filter :authorize_user
...
def update
@current_key = PublicKey.find_by_id params[:key]['id']
@current_key.update_attributes(params[:key])
end
end

The correct way to code this is as follows:

class PublicKeyController < ApplicationController
before_filter :authorize_user
...
def update
@current_key = current_user.public_keys.find params[:key]['id']
@current_key.update_attributes(params[:key])
end
end

This has two updates to it that protect against this exploit:

1. Rather than calling "find_by_id" on the PublicKey model, which searches all public keys, you call it on the current user's list of public keys. This scopes the search down to the public keys that they own. Thus, if you pass in the id of a key they do not own, it will not be found, leading us to:

2. Using "find" instead of "find_by_id" will trigger an ActiveRecord::RecordNotFound error (404) if the resource is not found. Of course, find_by_id will just return nil in this instance, so the update_attributes part would still fail, but triggering a 404 is an easier, cleaner way of dealing with this, I think.

It's really very simple: you don't let people access stuff they don't own.

Now, this does not protect you against faked timestamps, or against privilege escalation by passing in a faked "role" parameter, and so on. You still need to use attr_accessible to protect yourself from that stuff, but scoping resources down to the user who owns them is a simple technique that should be standard practice for applications with authentication.
Video Marketing Doesn't Have to Be Complicated
From what I can tell, the 'rails way' of dealing with form data is something akin to user.__dict__.update(request.POST). So you can just add some additional parameters to your POST data and set arbitrary fields on the model.
TSA to start searching ground transportation
Post something cool you've been working on to HN:

Have everyone shit on it because something similar exists.

Down with competition! Down with creating!
Since this vulnerability has been known about for years and experienced crackers have presumably checked for it before, is there any reason to be concerned about more malicious corruption of other repositories on github?
Why won't sports leagues take fans' mobile money?
Addendum: your app is pretty cool and I like it. Keep making cool stuff.
Isn't it just wasted effort though? If you're using hosted jQuery from Google or similar, it is likely it is already in the client cache... You may in fact find its faster to use jQuery than just Sizzle (which I imagine fewer have cached)
A single tweet page is 2.0 MB
It still means you'll run out of power on a typical workday (or a trans-Atlantic flight). With such battery life I still found myself having to decide whether to do something now on the device, or save battery for later.

On the days when I'm carrying only my Transformer Prime I charge the device at night and never take the charger with me to work.
Xml-motor v0.1.1 ~ cleaned up pre_processed_content usage via XMLMotor
You aren't kidding: http://developer.espn.com/branding
Apple's solution is much more clear, however. Before you ever develop an app, you know to expect a 70/30 cut. If ESPN provided those details upfront, I'd be much happier. As it stands, seems like quite a risk to take.
Tutorial: Sending intelligent push notifications without a server
Windows 8 and Metro show true multiplatform OS promise
ASK HN: FTP or HTTP for download or upload small/large files?
Informative 𝘢𝘯𝘥 how!
I've used fanfeedr as well in the past, worked well.
The author should put his talent to work on something that _won't_ get him sued. :(

Wondering how long till that domain renders an ICE homepage.
Why doesn't the Maximize button maximize across all monitors?
Apple’s Job Creation Data Spurs an Economic Debate
High-functioning 'short sleepers' make good entrepreneurs
Too bad ESPN half-assed this. The pro sports industry is so perfect for doing awesome data-based products. All that data that drives all the on-screen stats/replays/camera angles during a TV broadcast... you could just build awesome interfaces around that. Stuff that would greatly enhance entertainment for sports nuts and casual fans.

The data is there. The tech is here. It's the lawyers holding this back. And the CEOs who think they'll still be able to rake in huge profits from selling TV rights 5 years from now.

ESPN, you know cableTV is what made you, you should be smart enough to realize that cableTV has started its decline.

Would love to see ESPN/Disney/ABC partner with Apple to build a real interactive TV platform.
http://mothereff.in/js-properties#%F0%9D%98%A2%F0%9D%98%AF%F... :(
It is probably against the TOS and if you get caught I can see your google account getting locked.

Take a look at twilio (http://www.twilio.com/pricing) if you haven't already.
Idle.js - library to tell activity of user in browser (away, idle, etc)
The Horror: iPhone/Android/w/e intercepts your touches on your phone's touchscreen!!!!!11
US lagging behind in IPv6 adoption, others accelerate
If Java itself were included in the poll, then a logarithmic scale would be required :-)

Personally, I really enjoy Clojure development, but Java is still the elephant in the room. Also, even though JRuby doesn't rate as high as the "big three," JRuby is incredible useful for merging work done in Ruby and Java, and for taking Ruby web apps and deploying them on the JVM.
If she left on good terms, have her try and get her old job back working remotely.
One thing that you might want to keep in mind is that I seem to recall IE 6/7 being funny with quoting here compared to other browsers. Firefox and Chrome behaved like this but earlier IE's I always ran into problems with if I didn't quote everything.
Save The Environment By Recycling Cartridges
Printers are widely used today, in offices, homes, schools, factories and universities. This obviously means that the amount of toner cartridges being consumed every year is increasing than the previous year.
That is a heck of an idea. Live data is definitely out of my price and would love to help if someone decided to crowdsource live stats. :)
Love it!

As a lawyer (UK based if you're thinking of expansion!), I think it's a great idea. I've been mulling over something similar for in-house teams but based on precedent clauses rather than entire documents.
The sorry state of Python OAuth providers
New Facebook page timeline: the 7 essential things you need to know
I'm honestly not sure about what is free to use and what is not. If you guys are looking for a free stats solution for MLB, head over to http://erikberg.com/mlb/ .

Perhaps an expert can say whether it is legal to make money via advertisements if you use this data.
So you can't charge for an app and you can't place any ads either (except the ones that come from the API).

But it'll look great in your portfolio!
The code may be something you could find on Nettuts but I think the point is to challenge the belief that we should all "just use jQuery". Not to show you how, but rather to explain why.

"How's" are easily Googleable, "why's" are a little harder and therefore more valuable, IMO.
But is that legal to scrape data?
5 Tech Things Star Trek Got Right
CBSSports.com http://developer.cbssports.com/ launched a similar product a few months back - it seems to be going well and offers more data than ESPN does, including fantasy data. My initial reaction is that ESPN hastily cooked this up as a response to what CBS did.

Disclaimer, I work for CBS Interactive, the parent company of CBS Sports.
Agreed with the paid upgrade. Businesses are ready to pay for such things, especially when they bought a $500 iPad just for the purpose... what's $15 on a card reader? As was suggested, a cheap and free reader as well as a paid upgrade would work well I think.

Overall great product, and demo video!
Very cool Alex. I was actually seriously considering advertising in the /r/NBA reddit. It seems like it has a loyal following of well informed fans. Just what I love! :)

The only problem is that I'm not sure how many play fantasy basketball.
A Compact Mechanical Crossbow With the Precision of a Laser
you want the word ubiquitous

https://www.google.com/search?ix=sea&sourceid=chrome&...
Risks
Complications are relatively rare and can in most cases be dealt with during follow-up treatments. Very rarely, the quality of vision may deteriorate. Complications may include:
- Temporary increase of eye pressure. This, however, is only a temporary phenomenon which can usually be adjusted with drugs.
- Infections/inflammations. Early detection allows these to be treated easily.
- Lens replacement (if the power is incorrect) or lens reinsertion (if the lenses are not in a sufficiently central position).

http://www.ophtec.com/consumer/en/artisan-artiflex/faq
and
http://www.ophtec.com/consumer/en/artisan-artiflex/safety-an...
I don't think I had more fun and felt more control than when I was professionally programming in assembly language. The more I use high level languages the more I just want to step back and learn x86-64 assembler and put scoping and default allocation and language lawyers behind me. Of course there's nothing stopping me except myself really...
I don't think this is the best way to describe this. It is not the "Rails Way" to NOT validate form input. The Github team used a method that allows quick and easy assignment of bulk values. This method is used often in non-public-facing tasks but when it is used in connection with a public facing POST request, then validation logic should be implemented.

It was not, in Github's case. It seems like a glaring error in retrospect but it's easy to see how this code (or the pattern) would move over from the private to public-facing interface and not trigger any errors or notice.
Fedora? That would be pretty weird for a distribution mostly shipping with cutting-edge software.

As far as I can see, they're shipping both 2.7.2 and 3.2.2: http://pkgs.fedoraproject.org/gitweb/?p=python.git
Grouped & Creative Mischief
http://fedoraproject.org/wiki/SIGs/Python

Fedora 16 (the latest) ships with Python 2.7. Python3 is available in the yum repositories.

Distros aren't holding Python3 adoption back, it's apps and libraries.
Interesting idea. There are some extra challenges when the scanning is not done live.

Does Etsy accept url shorteners? Including some that allow editing? Is it feasible to rewrite the content to have the redirected URLs?
I don't play fantasy basketball myself, but from reading the comments a lot of the other commenters do.
The ECMAScript spec states that engines are free to choose which Unicode version they support, and that Unicode 3.0 is considered to be the lowest common denominator.

Old IEs use an outdated Unicode version (I’d guess Unicode 3.0) to determine whether a given string is a valid identifier name. When using the Unicode 6.1.0 database, much more identifier names are allowed. (More on that here: http://mathiasbynens.be/notes/javascript-identifiers & http://mothereff.in/js-variables.)

Could that be what you’re referring to? Can you give a concrete example of a property name that should be allowed, but fails to work in old IE?
Definitely, I think that striving to be somewhere else or just the idea of not having everything done for something that you are dedicated to can be a source of stress. A clear plan for when and how you are going to handle your Todo's can help relieve some of this stress.
Alan Turing: 10 ideas beyond Enigma
Congratulations, that's excellent! I'll have to show this to my daughter. She wants to make her own Hello Kitty game since she's been watching her older brother (8) making games on Scratch :) Its an excellent platform for learning the basics of programming. I was worried that my son wouldn't have the patience to work with Scratch since he sees what's on Wii and XBox and that has set his expectation level. But fortunately he's become very excited by Scratch and can build games with very little or no guidance from me now, w00t!