skysight-inc/HackerNews huggingface dataset:
If you are going to go that simple, then why even pass
function formatCurrency on the main page, you can pass the whole function back with the document.body.appendChild method.

Then instead of 628 bytes, you'll have just 100 or so. Then make the script loader a re-usable function for other data on the page.
It would still be no good. If you drop one, it's dead. If you drop a Barclays PDQ, you pick it up and continue the transaction.
Doesn't the line:

@current_key.update_attributes(params[:key])

still mean that an attacker can pass in arbitrary fields to be updated in the public key table? If that's the case then doesn't it open room for an attacker to change a field that is assumed not accessible from the outside? For example, would it be possible to change an _id field that references another table?
Please have an espn3 api, please have an espn3 api, please have an espn3 api...

well darn!
Of course, now it doesn't hit the front page ;(
Here you go: http://labs.yahoo.com/publications

Yahoo Labs people regularly win "best paper" awards at top conferences.
I find your claims are unsubstantiated and would require some evidence to be convincing.

For example, the performance of Python 3.0 was slow on I/O operations. The reason was because the I/O modules were written in pure-python in order to get the ball rolling. This wasn't a bug. However, the code was eventually ported to C in 3.1 and unsurprisingly the performance improved: http://www.gtsystem.eu/blog/2009/08/improved-performance-of-...

And that's an old post from 2009! The performance is much better today.

Features they're releasing in this new version include zero-copy in os.copyfile() which is totally sweet. No user-space buffers involved in transferring bytes from a file to a socket. This should speed up such operations well past what any version of python 2.x is capable of.

There isn't a feature in Python 3 that is not substantially better than 2.x -- they're fixing all the fiddly bits and producing a much better language. There is no feature they can create which will open the dam to a flood of porting projects. The reason is that the problem is a social one.

An honest-to-goodness effort to port the large libraries requires a plan to support the existing 2.x versions alongside the 3.x versions so that the people who are still running applications built on the old versions will still work. This requires extra effort that is difficult to acquire in open source projects let alone commercial ones.

Even if the Python 3 devs added a feature that materialized ponies out of thin air there would still be projects running the 2.x code.
I don't see him asking for money anywhere, so at most he'll get a cease and desist. Of course if he doesn't comply then things would get worse.

Plus from what I understand Nintendo has been pretty lax with these sort of projects lately and I don't think Valve would do anything either.
Scaffolding is part of rails, so fixing the bug does involve patching rails.

"Windows has no security vulnerabilities itself, since you can edit the exe of any malfunctioning app. A security conscious app developer is responsible for auditing Windows and making necessary changes. Heck, most vulnerabilities have already been documented, and sometimes the workaround doesn't even involve coding. " See how silly that is?
Castors
This is a General Duty Grey Rubber Castor with Brakes. This Grey Rubber Castor has 10mm bolt hole. It is an every day use grey rubber castor wheel.
Join 4000+ entrepreneurs and developers and start a business together
I know I immediately panicked because I know this was not one of the many issues that I had thought to be aware of. Luckily, I remembered that I've just out of habit/circumstance not used update_attributes...so I avoided the bullet out of dumb luck.

I imagine there are many, many sites that are vulnerable to this. I hope the high profile hack (at least on HN) quickly spreads the kind of panic that gets other devs to check their repos today.
Maybe so, but how much of that 1.65MB of Javascript is cached by the browser?
Alternatively, this is something that the Application Cache would be ideal for. One-time download, cached forever. (Well, until they clear their cache.)
As New iPad Debut Nears, Some See Decline of PCs
SEEKING FREELANCER - Toronto, ON - Can work REMOTELY.

Hi Guys,
I'm a web designer located in Toronto, ON and i'm looking to partner with a web dev. I really enjoy working with wordpress because it's easy enough for clients to use when I hand over their sites. I work with small local businesses and restaurants to give them a web presence. I'm looking to partner with a RELIABLE developer to bring my designs to life. Check out my site www.nicklenko.ca and fill out the contact form if you're interested.
LoseThos started 100% TASM. Then, as I improved my compiler, I converted it to C.

I have many years of professional asm experience. The main reason it's bad is when you want to modify a routine to add something, suddenly you have to change all the registers.

You know how Mexicans have machizmo? Asm is generally considered manly... like guns and weapons. The most retarded thing are OSes that are all asm, unless it's because they have a native assembler and not compiler.

MikeOS and BareMetal? All asm is just silly.

Here's LoseThos when it was all TASM.

http://web.archive.org/web/20040606212724/http://www.simstru...

It's a slow link.

Fixation on asm is childish -- you need to do it to your hearts content, then you will not be emotional.

Actually, my niche is supposed to be recreational programming. ASM is popular and it's sure not because it warranted -- it's highly entertaining.
That is a great point - and I definitely wasn't encouraging buying links. I updated the post with your advice.
That wouldn't fix it.

I own the key. I set the owner of the key to you. You now own the key that I have on my machine. I commit to your repo.

I'm sure the github team has authorization at a model level, preventing access to other user's resources. This wasn't an instance of accessing another user's resources via rails, it was assigning your own resources to another user, then abusing that fact via git.
His rant doesn't seem too informed: "aggressive anti-performance and apparent contempt for the web by Twitter’s designers"

According to his charts most of Twitter's page is JS/CSS and presumably set to heavily cache. Very little is data. Once you've done the first page load Twitter's pages will load quite fast and efficiently. While quite a lot of JS, this is good design, not bad.
What I'd really like is something that fixes browser quirks and provides a consistent API that's identical to the ecmascript standard, instead of something entirely new.

Then have a jQuery-like API when it's useful or improves clarity.
How To Build A Brand
Simplistic.
A part of that is because the charter of Labs is (was?) to generate papers and provide exposure to the company. It helps to attract talent if you're presenting at large conferences about the interesting problems you're working on.
Unfortunately, some people think facts can be copyrighted: see http://www.premierleague.com/en-gb/news/news/football-dataco...
File this under "annoying to developers and no-one else".

Twitter obviously caches 99% of this stuff. I absolutely agree that 2.2MB on one page seems absolutely insane, but that doesn't match up with the experience every time you load the page. And I imagine it's pre-caching code that runs on other pages as well, so you most likely only ever take that download hit once.

Yes, they should bring that amount down. No, it probably isn't going to be a priority.
Here's the Rails Guide on the Mass-Assignment "Issue"
This is documented behavior, right?

If someone did not read your documentation, and submitted an issue about known behavior, would you be inclined to change your application because of it? Or, would you be inclined to close the issue and ask them to read the documentation?

If a high-profile website also did not read or implement your documentation, does this mean there is a vulnerability in your application because your users did not secure their websites as a consequence?
In Django (and Python in general) you have a form abstraction that validates the user input and filters out unwanted fields, preventing problems like this. On Rails (and Ruby in general) they don't use such abstraction (I do myself, using an implementation of forms abstractions[1] very similar to what Django provides).

Instead they send the params dictionary (which contains url captures, POST and GET values) directly to the model instance, and expect the model to deal with it. The problem with this approach is that it gives too much responsability to the model. Other than forms not necessarily mapping directly to models, making this more complicated, it is also prone to security issues, like the one Github suffered. ActiveRecord (Rails ORM) allows you to whitelist and blacklist fields at the model level (which IMO is the wrong way to do this, Django got it right), but a lot of people don't do it.

[1] https://github.com/tizoc/bureaucrat
This is documented behavior, right?

If someone did not read your documentation, and submitted an issue about known behavior, would you be inclined to change your application because of it? Or, would you be inclined to close the issue and ask them to read the documentation?

If a high-profile website also did not read or implement your documentation, does this mean there is a vulnerability in your application because your users did not secure their websites as a consequence?
PyPy has folks actively working on getting Py3k support. Check out their status updates on py3k and consider donating to the PyPy project to make this happen.

http://morepypy.blogspot.com/2012/03/py3k-status-update-2.ht...

http://pypy.org/py3donate.html
Personal Goals for your Students (and self) Should Be Kept Private
No wonder it takes long for Twitter pages to load. Such things show up only when you're on slower speeds.
Exactly right! If we don't 'live in the moment,' focusing on whatever we are doing, that is stressful and increases unhappiness. Pardon a cliche, but it is so very correct: people who live in the past tend to be depressed, people who live in the future tend to be anxious, and people are generally happy when they are absorbed in their current activity.
Cool URIs don't change - Tim Berners-Lee [1998]
They might be using it because of the study about font legibility and learning retention that was all over the news last year:

http://seedmagazine.com/content/article/the_revenge_of_comic...

http://slog.thestranger.com/slog/archives/2011/01/13/new-stu...

Kathy Sierra and Burt Bates also used these types of fonts in their "Head First" series for O'reilly. I have never gotten into those books, but many people love them.
Nokia Lumia 710 Price India - Nokia Mango OS Windows Smartphone
Nokia Lumia 710 Windows Phone with 3.7 inches WVGA Capacitive Touchscreen and built in social networking features. Nokia Lumia 710 a smartphone coupled with integrated apps, Internet explorer 9 with entertainment features. Nokia Lumia 710 comes with Windows 7.5 Mango OS and is powered by MSM8255 chipset with a 1.4 GHz single core processor that givers high definition gaming experience. Its 5 MP camera lets you have quality pictures record HD videos and with 32 GB extended memory (with SD) you can store and play your music collections any time. The Nokia Lumia 710 mobile phone supports Wi-Fi, WAP, Bluetooth, GPRS and USB data connectivity. Fully customizable home screen, easy and fast internet browsing, free GPS navigation and downloading of apps from Nokia OVI store are some of its special features. Nokia ClearBlack display makes it ideal for watching videos and gaming. Its super AMOLED WVGA TFT display saves power and ensures better battery backup and standby time.
Yes, jQuery does utilize things like querySelectorAll (among other things) when available.
The privacy risk for GSB in general is that you are sharing URLs with a (trusted) third party. That's most acute with the REST API, but most implementations (including gsb4ugc) cache a local copy of the lookup tables and so don't actually send URLs to Google. There is still a very occasional need to send a link to Google for validation, but in the server-side case the only context Google has for the request is the IP address of the server, which minimizes privacy risks as much as possible.
Entrepreneurship reaches Middle Earth
Square Register for iPad is here, makes all other registers cry
Really this means a form of Chrome will become the mobile browser, right? Since, at least as I understand it, Chrome is going to be taking over the role of the stock Android Browser? (The beta has worked amazingly well for me on ICS)
I'm not a Ruby or Rails guy, so I can't comment on how likely a typical (or atypically good) Rails dev might be to code this sort of bug into their app.

But as a security guy, given the power of Public Key assignment in the context of a system for managing access to Git repositories, I can't help but be a little surprised that model objects that touch Public Keys weren't more thoroughly reviewed.

If nothing else, folks everywhere will be thinking a little harder about authorization logic this week.
I like the choice of Lua and SDL, not only as a modern LOGO/BASIC alternative. I think it can go much further.

I guess as a minimum you want the editor to function to the level of notepad/pico/nano, and then perhaps have helpers with regards to indenting, and after that error marking similar to that of QBASIC, and after that syntax highlighting.
GitHub really needs to clearify if access to private repos was compromised, for how long and if such access would be traceable.
"Homakov PUT an update to his own existing public key which included a new user_id. The user_id he used was that of a member of the Rails repository members."

But wouldn't that mean, that the commit would display the username of the user with the `user_id' that he used?
My five biggest blogging mistakes
It wasn't an oversight. It was a design choice.

"we already know this stuff and we like attr protection to work the way it is."
https://github.com/rails/rails/issues/5228#issuecomment-4292...
Parameter Type Casting in PHP
The problems with update_attributes have been known, and messing with things like timestamps probably has been done before, but Rails itself didn't violate any acls. All users still can only access their own resources via Rails.

This attack was a combination of Rails and git/ssh keys. There's a bit of a clever aspect to it, one that isn't implied merely by understanding the vulnerabilities of update_attributes. While I think it is likely someone else has thought of it before, it is a little more exotic than something your average cracker is going to try.
Because convenience is deemed more important than safety.

Same reason that "enum" and "int" are pretty much interchangeable in C, that arithmetic conversions and truncations are implicit -- it's not very safe, but it is more convenient.
I'll try again tomorrow morning. Hit it up when you see it ;-)
The rhetoric that tends to be thrown around is that CC licenses aren't specifically designed for code, and that there are other licenses that accomplish the same thing but cover your bases better.
Thoughts on upcoming programming languages
A more accurate title might be "The Twitter web client is 2.0 MB."
Yes, if there is anything else in the public key table that you don't want to be updated via form fields, then you should be protecting yourself against it. However, every developer - or at minimum, every experienced developer - should know the basic maxim "never trust the data from your users".

But this method does protect resources from being arbitrarily assigned to other users.

In any controller where the user should be authenticated, I would suggest the following two guidelines (let's assume the model is PublicKey, as before):

1. In the index action, where you get a list of resources, use:

@keys = current_user.public_keys

2. In all of the actions (such as show, edit, update, etc.) where the method starts with:

@key = PublicKey.find(params[:id])

Remove that method and instead create a private method in your controller:

def get_key
@key = current_user.public_keys.find(params[:id]) if params[:id]
end

And at the top of your controller:

before_filter :get_key

This should just be a habit. With these two modifications, you've just scoped the resource down to the user everywhere that it is used. Additionally, you've DRYed out your single resource-specific actions (show, edit, etc.) because the code to find the resource only exists in one place.

Of course, you still need to think about attr_accessible. But even this is not a panacea. Consider the case where a user has a role_id field that specifies whether they are an admin, manager, or regular user. In this three role scenario, managers are allowed to create managers or regular users, but not admins. Admins can create users of all three roles.

This means that you may want to allow the role_id to be updated by mass assignment. You just have to ensure that users cannot update the role_id if the role they have picked is more privileged than their current role. You could just add a validator to the user model that does exactly that.

Alternatively, you could keep role_id as a blacklisted attribute, but in your controller you could check for the new role in the params, and then only assign it if the user should be able to assign it. Both approaches have merit. The bottom-line is that you still have to THINK.
Can ARPA-E Solve Energy Problems?
Does anyone know how to get those graphs to show up in the current version of WebKit? They seem to have disappeared or are hidden.
>the compromise of an account not held by him puts him clearly into the "black-hat" category.

That's not what "black-hat" means.
If you're basing downtime avoidance on 'how fast I can boot', you're doing it wrong.
Show HN: My startup's redesign and new approach at tips and advice
Cool site! It's like github for legal documents. Perfect.

Now if there was a way to encourage democratic gov'ts to draft their bills using something similar...
Is it just me, or doesn't this sound very similar to SQL injection, only as applied to an ORM instead?

That is, if my understanding is correct, they're taking user posted data and trivially turning it into a command to update data.

This doesn't sound like a problem with Rails, in the same way that if I turn data I receive from the user straight into an SQL statement, the fact that people can abuse it isn't a problem with SQL.
Actually, that's true. I stand corrected. I think I was distracted by the rather obvious issue in the example code that the OP posted, which did not include this basic protection.
It's absolutely brilliant for kids - and it seems to be avaialble on Linux, so should be runnable on Raspberry Pi - which could be great for the classroom. It's so easy to add new little bits of functionality and see them in action that she never got bored whilst I was showing her the basics - in fact it seems to be her new favourite app at the moment. I can't recommend it highly enough as a first step programming educational tool (the reason I was first looking at it was because my wife's a teacher and was looking at a good app to teach programming to 10 year olds).

It's certainly possible to write very simple games. The tutorial I gave my daughter was a (very clunky) Space Invaders clone, and I'm going to have a go at something a little more advanced tonight - I've got to make sure she doesn't start overtaking me...

The one place it seems to fall down a little is managing multiple identical sprites - I looked at a rather more professional-looking Space Invaders that someone else had written and it looks like they needed a separate sprite with full code behind it for every single alien, although it looks like BYOB may address some of this.
How long did it take you to put this together and how much of that time was coding vs researching?
Thanks, I missed that somehow. Although, I did say DoD clients, so odds are they're out of date still.

Neat to get the update from the guy I watched keynote about the problem in the first place though!
Boston, MA - 1 year paid internship for programmers to learn to hack biology

Ginkgo BioWorks is a small, fast paced MIT startup that genetically engineers organisms that make the world better. Come learn how to re-program DNA to create fuel producing bugs! Help us use state of the art technologies to create a production pipeline for organism engineering!

Relevant skills: Creativity, Drive, Commitment, and some programming skills.

What you will learn: synthetic biology, metabolic engineering, computer aided manufacturing of modified genomes, modeling of cells, bioinformatics, robotics automation, software engineering, UI/UX, Ruby/Rails, database, and more.

For more, see: http://ginkgobioworks.com/careers.html

Apply here: https://ginkgo.resumetracker.com/public/job_detail/83
It might also be possible to have a "debug mode" that scans the stack while copying it to the lthread_compute_begin() thread, and warns you if any of it looks like pointers that point into the copied stack. It will probably be negligible compared to a long-running thread (compare 60 pointers against a lower and upper bound), and it might have false positives occasionally -- but could save a lot of debugging time...
How far back does your score data go?
Apart from a couple of short consulting jobs, it's been 17 years since I last worked on a machine that wasn't web visible...

I couldn't imagine not being able to ssh in to screen session with my exact current state of work and/or access work in progress websites directly...
Ah, but how big is the (downloaded) size of the next page on each of those sites?
The idea is really solid. And the execution is good for a MVP. I agree with the previous posts, it needs some more explanation. I'm not sure you need to add anything, just edit whats there already.

I would try some other tag lines besides "why does your day suck" . I understand that your going for but I think its too abstract to get good solid ideas. I would try something like "what would make your life easier". That way the site is yielding useful info with every query.

Great start though! Excited to see where it goes.
You're telling us to read a 4 year old book on technology that changes on a monthly basis?

Lots of SEO involves guess work. Google changes its algorithm constantly.

That's the reason nobody reads books on SEO. It's the same for web development.
How does this work, is he reporting compressed or uncompressed sizes of data? text/css/js compresses really well for transmission, images do not.

User-defined image backgrounds can also be up to 800k-ish for twitter too right?
In light of all the hilarious 'best practices' talk after the github/rails incident, the best practice in this situation is to hire a graphic designer to do even this early stage mascot research.

Why you ask? Much like API design, a logo/mascot/etc, once you commit to it, is very hard to change. People talk about software that scales, but keep in mind, identities need to scale too. The standard logo/identity course in any design program goes into this and forces you to think about identity not only as a mascot, but as a system.

This isn't to say that any of the submissions proffered wouldn't be valuable, they might be! But the whole thing that happens when you pick up a designer is that you also are implicitly asking them to research how your brand/logo appears on a shirt, on a business card, in press clippings, on sponsorship banners, and so forth.

These are all things that are incredibly easy to ignore because, unless you've done this before, it's really hard to get an identity right the first time.

Also, why's it gotta be an animal? What ever happened to those insanely geometric but disturbingly sinister-looking corporate logos from back in the day? ;)