skysight-inc/HackerNews huggingface dataset:
Now I know why I lost thousands of dollars in orders last summer as a marketplace seller. The great part is that Amazon denied it and refused to take negative feedback off of my account when I got multiple orders for items that were no longer listed and I had to cancel my orders.

Even better is the fact that they have absolutely no support for marketplace sellers. If you get your account banned by their automated system, the only thing you can do is email their tech support and get automated responses back.

They take a 16% cut of most orders. I made them thousands of dollars last year as a result of my sales and they couldn't even give me the common courtesy of being able to talk to a support rep when they banned my account. To this day, I still don't know why my account was banned. I've been selling for years on other venues with no issues.

I always have positive feedback and answer customer issues quickly.

Even worse is that when you're on Amazon, you pretty much have no control over your business.

You can't communicate with your customers outside of Amazon and if a customer makes any sort of claim (through their A-Z claim system), they win 99% of the time. As in, they didn't like the item for whatever reason, make a claim, and get a refund without you getting your item back.

I seriously doubt if you ordered an iPad on Amazon and wanted to return it that they would give you a refund before you actually returned it.

Oh and one more great thing I wanted to add: Although Amazon has a 30-day return policy, they will force you to give refunds even a year after a person ordered something from you. This happened to me and I know it's happened to other people.

I'm thoroughly disgusted with Amazon's business practices.
> stuff like Hadoop for big data or Groovy for DSLs were built upon the existing JVM

Hadoop become popular for handling big data, but I'm not sure if many are using Groovy for DSL's. The 2 big uses for Groovy in industry seem to be (1) scripting on Grails, and (2) quick standalone scripts for testing or booting Java code. For these it rocks but the stuff added after Groovy 1.0, such as DSL's, isn't really being used much.
DeNA & Disney Team Up To Launch Mobile Games Worldwide
Is it a persistent XSS vuln or does it depend on malicious input being passed via the URL or POST?

It's persistent if it can be saved in a comment or on a profile, etc, and is much more dangerous if so. Non-persistent XSS realistically isn't too big a deal, most sites are vulnerable and it's usually only a problem if you're a big website and therefore vulnerable to phishing attacks.
I've been black in the past, now I'm completely white hat.
Starbucks comes into Energy Drink market: Refreshers
I think you can get around #3 if you just tell people to be upfront with you. Half way through your pitch, stop, and ask if they're interested.
Same deal for me, usually after work is when I don't interruptions but there are days that work is slow and I can get a couple hours of hacking in. Yeah, having a day job sucks in some ways, my sleep schedule is pretty average right now though.
I have adblock plus and FB disconnect, still logged me out
People that do stuff like that need to find another industry. IT is not for them. We're nice people, generally. Maybe try finance or real estate or lobbying or health care or defence work.
Incredible.

As a fellow creative, the amount of care and consideration that's displayed here is not at all surprising. The product really speaks for its self.

This type of journey that a product takes is so often lost forever.

I wish more people documented their creative journeys. At the time, small anecdotes may not be that interesting, but the sum can offer incredible insight into how something came into fruition.

It's valuable both as a display of how much unseen work goes into great products, and as a way to help others learn from your mistakes.

I'm as guilty of this as anyone else.

http://www.folklore.org is a great example of how enthralling these stories can be.
Cross site request forgery is separate from cross site scripting. He is not clamming to have done any cross site scripting. Secure sites generally require a token to perform any state changing effects, it's just odd that Google doesn't require it for logging out.

Facebook uses http://facebook.com/logout.php to log you out, but clicking that link won't do it.
SW:TOR, which you can compare to WoW, has been estimated to have cost $500 million(sic) to produce[0].

[0] http://massively.joystiq.com/2012/01/17/analyst-believes-sta...
Definitely interested in your story - be sure to post if you start a blog. Best of luck with relaunch!
You seem to know what you're talking about, so can I ask a very simple question: Why do people use consoles? I don't get it. Computers are better in every way [1], plus you don't have corporations limiting access.

[1] The ways:

1. Mice/Keyboard vs. Clumsy controllers.
2. Superior hardware.
3. You already have one, so no new purchases needed.
4. A vastly greater array of games to choose from.
5. Almost always cheaper games.
If only it wasn't a TOS violation of Foursquare and/or Facebook's API, then maybe people might actually care about their privacy.
Google allows a logout from a GET request, on Chrome of all browsers? Is there a way to run browser tabs completely sandboxed regarding cookies/auth? (private browsing mode and running different browsers is a bit too clunky)
The game's up when people like you start commenting on this board. Don't you have a SCRUM of SCRUM meetings to attend? That VB.NET isn't going to write itself.
Gmail has had more serious CSRF vulnerabilities in the past - you could use it to download the entire address book of anyone who visited your site.
I've noticed some other really oddities (and the pricing is way off for me, unfortunately -- if only I could get a policy for what they're saying!).

For example, if I list my occupation as "Consultant", Leaky says Geico will give me a $150 discount. Bizarre.

Edit: Clarifying that Leaky says Geico will give me a discount, not that Geico actually does.
Ask HN: questions from a tech/start-up newb
Good afternoon everyone,

I'm new to the game (I will not call myself a hacker), but my interest and self teachings have been giving me a lot of insight into the hacking world.

With that being said, I sprung this idea 6 months ago and have been working at it since. My efforts towards this project have been very time consuming and I feel like I've hit a few barriers. Being a full time student I have zero capital, and what I need done requires advanced programming (php).

I am hoping the following questions can be answered.

How do I find a good partner/co founder?

Should my programmer/designer be local?

Is crowdfunding a good source for raising capital?

Any advice will help as I am the only person working on this at the moment. Thanks all.

Dave
Works on Android Dolphin
OpenCL/CUDA are GPGPU programming languages - that's something we're getting to soon :) We previously exposed OpenCL as an extension, but took it out because it's a nightmare to support. We're looking at it again at the moment - it's pretty challenging to write GPU code, so it's hard to see how much benefit developers will get from it until we can target nicely from KL. One for the longer term :)

The rationale for creating KL was that we had some specific goals, and we couldn't find an existing language that did everything we wanted - the requirement of being high-performance _and_ easy to use was critical. We also had security concerns (we started out as a browser plug-in), so it also had to be pointerless. Given that we have a fairly narrow scope (writing high-performance operator code), we decided the best path was a DSL. If we didn't have the security concern, we would have stuck with C++ - but that wouldn't have had the lower bar to entry that KL has.

My co-founder who wrote KL still thinks we were crazy to do it - 'the world does not need another language' :)
(I am the author of the post) - I think you are right if you are self aware; however, when you are all amped up about your idea it is tough to stop and imagine that someone might think it sucks.
Check out the wiki page for python blogging systems: http://wiki.python.org/moin/PythonBlogSoftware

Blaag and Hyde generate static html, which is about as scalable as you can get, w.r.t. speed.
That doesn't solve it because the attacker can just create a <form> and auto submit it with js (or make a translucent submit button that is the size of the entire page if you have JS disabled).
And my original point was that FTP is inherently insecure. It's transmitting username and password in the clear, for starters.

(To be clear, I'm talking about plain vanilla RFC-959 FTP. Yes, you can add additional security layers on top. Sadly, at least the places I've seen still use FTP are the places that still use it in vanilla config. I have no idea what your experiences are - this is a comment on the general state of FTP users.)
Placing verbs in your Resftul apis resources is wrong, but it just feels so right....
This is a problem with app developers, not browser makers. Applications should follow the HTTP spec and not do any persistent changes via GET.

The "I can log you out of Facebook/etc" trick is one of those techniques that script-kiddies love using on forums.
Here's Google's reply to this particular "vulnerability": http://www.google.com/about/company/rewardprogram.html#logou...
I agree the world would be better if it were just nice people being nice, but IT security has become defense, and is an increasing part of defense. Governments are buying.

I don't see a huge moral difference between smart hacker with $0 (publishing 0-day for the lulz) and smart hacker with $250k (selling vuln to a defense contractor).
Am I correct in interpreting that the proposed fix would the be the same as the functionality provided by RequestPolicy (which he mentions in the post)? I've used it for quite a while now, and although it works well for me as a power-user (who is concerned about security), I can't imagine the confusion and pain a user will feel despite the message suggested.

Blocking resources loaded over separate domains breaks a lot of sites today. Few popular sites keep everything under the same domain (CDN´s, commentsystems, captchas and Facebook/Google/Twitter-resources, for example). http://www.memebase.com is probably the worst "offender" I've come across. Hacker News isn't one of them, which I'm happy to see.

Although if this was implemented I could see a lot of sites moving quickly to remedy this, reducing the alerts. It'd still be a pretty hard transition-period, though.

Want to see how much would break today (and if the fix would work for the average user)? Try: https://www.requestpolicy.com
A bit of a note regarding REST:

RESTful services are as vulnerable to CSRF as anything else. See [1] for more information (and I'm really sad that there's no second post, like mentioned). However, since RESTful services imply no state on the server (i.e. no token), the question is, how do you prevent CSRF attacks?

One really simple method is to deny all requests (on the server) with the application/x-www-form-urlencoded content type, and deny all multipart/form-data requests that include non-file parameters, which are the only two content types that can be sent from an HTML form. For your application, XMLHttpRequest can change the content type, and isn't affected by CSRF.

EDIT: Also, sort-of-related: I recommend you set the X-Frame-Options header too, in order to prevent clickjacking. Info at [2].

[1]: http://blogs.msdn.com/b/bryansul/archive/2008/08/15/rest-and...
[2]: https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_respons...
I am not familair with Django's CSRF tools, but you could write your own that didn't depend on cookies. Init a js var with a random token in the html somewhere, then require that the browser includes it with any state changing actions.
Edison was my hero when I was a kid. I used to believe of Edison as one of the greatest inventors of all time. As I admired him, I started digging about him. Slowly I realized Edison was one of the greediest, heartless, criminal of all time. He not only bought and stole inventions of others, he cashed on killing of people. Most people know how he screwed Tesla. What many people don't know about Edison is that his employees created electric chair which is considered as device of cruel punishment. So, he made money by selling this device of painful death. He even took opportunity to film the electrocution and killing of Topsy (elephant) to demonstrate superiority of his DC system over Tesla's AC.

Edison is an example of what one should never become in life.
>"Money is good -- it can be exchanged for valuable goods and services."

Money is not "good". Money is "necessary" in our society because people are greedy bullies.
What's the right way to do this?
Chrome allows you to set up multiple user profiles; each one is isolated from the others. Like Incognito mode, it's per-window, not per-tab. I have one for GMail, one for Facebook, and one for everything else.
Wow. That's incredible...what a combination of intelligence, passion, and hard work. I don't even have a car, but this makes me want to use Leaky.
Also on the plus side, a much lower chance of dying in a horrible earthquake.
It has a screen lock and a device password. It has an entire physical button to unlock the device, in an awkward-to-reach-one-handed place, and all that does is let me type in a password. It's a bothersome redundant thing every time I go to use it.

It doesn't remember open websites for more than 10 minutes after the browser is closed, and after using Mobile Safari, it's like using a device with alzheimers.

The default menu/home screen is just dreadful, filled with pointless sliding panels going up and down, left and right, by default with lots of redundant icons, but not adding anything useful, just triggering often and accidentally.

There is an extremely fine distinction between pressing the back button (which does one thing), and pressing and holding it (which does another thing). It's way too easy to accidentally press for too long.

The much vaunted messaging abilities are a mess - email is empty because I have no POP accounts, messages doesn't contain my messages, Text Messages does, and my email is in "Desktop". I set it up this way to stop it being even worse and pushing all kinds of mixed message types into one list (who wants that?!), and that (by default) puts the top item in the list as the message I've just sent. On a screen which shows 5 things, the least important is the one I've just finished dealing with.

The web browser is poor compared to mobile safari. I always have to fight what I want (click on a link) with what it wants (needlessly zoom in more and more and more). Resizing with gestures is finnicky - it will often resize as I want, then undo to suit itself.

The trackpad replacement to the thumb-ball is horrible. It is awfully sensitive in one sense (jumping long distances when I'm not meaning to touch it) and awfully insensitive in another sense (often have to move my thumb over it several times before it registers at all).

The 'convenience' key is in such an inconvenient place I've had to disable it because I kept pressing it by accident.

It often says things like "this charging source cannot charge your blackberry" when it definitely can because I have before, or it's the proper adapter and cable.

The menu system is a nested mess - the difference between 'device setup' and 'options', the reliance on the Blackberry button to bring up a long scrollable list of 10-20 things.

This one has a touchscreen, but the icons don't have text under them and touching to select them doesn't change the "what you've selected text" so it is mystery meat navigation for the less commonly used ones.

It took five hours to install an updgrade. And that's normal.

Nothing about it is as bad as a phone from 10 years ago, but many, many things about it grate as unpolished, clunky, as if designed-to-annoy.
I like to come to work early morning, when the sorroundings are quite, mind is quiter. I get most done!
and what would he find?
We Are All Liars Because We Don't Really Have A Choice
>are a bit weak
don't be too polite )
I reported holes that definitely should be reported.
For example:

<body onload="javascript:document.evil.submit()">
<form name="evil" method="POST" action="https://mail.google.com/mail/u/0/?logout">
</form>
</body>

The massive button is left as an exercise to the reader ;-)
I can link someone to a page and it can associate them with something they can then never disassociate themselves with. For example I could create an account, post illegal content (child pornography etc.) on the site then get people to click a link and forcibly associate their account with that content, which they are then tied to until a site administrator realises and fixes it. (edit: without them ever knowing)

Imagine if I could make you the author of this comment, it's like that.
This was an amazing letter. Great lesson for me on so many levels.
Attack on WikiLeaks mounts as cables are withheld
Adding a extra token for protection against CSRF attacks will only work if is changed on each request. Some of the biggest sites out there do not do this. I know of one site in particular (I won't name it, but its HUGE) that generates a unique token every time a user logs in. The token doesn't change until the user logs out even if the user closes the browser and doesn't go back to the site for a week, the token will be the same. So it does its job, until somebody like me pokes around and finds a hole that will parse out that token, and generate a form that can make any request on behalf of that user in a iframe without that user knowing a thing. Evil yes, but I found this months ago, and it still works..and I haven't used it in anyway, besides a proof of concept.
I'm having a bit of trouble parsing the post. Did he just discover CSRF and is trying to raise awareness? Or did he discover a new variant of CSRF that makes previous counter-measures ineffective?

For completeness, Rails guide covers these security holes
http://guides.rubyonrails.org/security.html#cross-site-reque...
Speaking as both an avid gamer and an (ex) game dev:

Because consoles are _easy_. You plop them into your entertainment center, and you're done. No need to maintain the latest security patches, find just the right combo of drivers to make it work, etc. Not to mention the wonderful "buy yet another graphics card, please - your previous one you bought 6 months ago is too slow".

They also take less space than PCs. "Clumsy controllers" are easy to set up. Keyboard and mouse really require some dedicated space. (Yes, you could pull them out when you need them. It's annoying as heck)

From the developers point of view: The game looks and feels the same for every single player out there. I don't need to worry about dozens of graphics fallback paths depending on what hardware you use.

So, for everybody involved in the game development cycle, they're more convenient. All your points still hold, but they don't matter in the face of convenience. Not for the average person, at least.
10pm-2am, by far. There are so few distractions, and the entire internet goes quite. I don't get 10 new RSS items per minute anymore, people aren't @ messaging me on Twitter, tagging me on Facebook, emailing me about things, knocking on the door of my office to ask a quick question, asking me to come out for dinner, texting me a question, etc etc etc....
it took me a long time to understand the point behind CSR (cross-site requests) and CRSF fully enough to find them EXTREMELY malicious.

I think this is a very important line. The sense I get around most of my colleagues is that CSRF exploits are only something "bad programmers" get wrong. Of course, they're all rockstars who've never been exploited (yet/AFATK) so it's not like they need to spend a weekend or five paging through droll security papers. A little modesty would do us all well.

90% of developers just don't care and don't spend time on that.

Indeed. It takes time to learn, time to code, and unless you're working at a big shop, there's little pressure (or even acknowledgement of the need) to get this stuff right.

Keep up the good work OP.
You shouldn't be able to get the token from another domain, regardless of how long it lasts. How are you able to?
Auto insurers will definitely give you a discount for certain fields of employment. "Engineer" drops it $100 or so every time I've tried. My business cards sometimes say "Software Engineer", but I dropped out of a math program, so it's pretty bogus.
I just want passable functions, or even better, first class functions in module namespace.

I still find it hilarious how even Swing shows how crippled the language is without that feature, where adding event listeners is complicated like new EventListener(Event e) { @override onEvent... etc. When just overriding some declared event handler method would be so much clearer.
The Cloud Will Cure Cancer
do some friendly hacking to annoy the admins (but only them), and watch them fix the issue in real-time
I agree that web security needs to be rethunk from the ground up, but I don't think it's fair to blame browsers for things that are fundamentally HTTP protocol and server app problems.
Consoles are much cheaper.

They are also a lot easier to use. No need to install an anti-virus, worry about having the latest drivers, or having background programs eat up all the resources and thus receive a bad gaming experience.

Also, the time it takes to boot up a console and start playing takes seconds. Booting up an old windows install on a HDD takes forever.

Superior hardware on the PC, sure. But it's locked behind a mountain of drivers. On the console, you can get much more direct access. This means that some stuff is actually faster on XBox360 than a brand new 7000 series radeon.
The answers seem pretty skewed to night-time ... a few months ago I wrote a post with some thoughts as to why this might be happening: http://swizec.com/blog/why-programmers-work-at-night/swizec/...

It's gotten quite a bit of traffic (14.4k tweets), but maybe someone still hasn't seen it :)
> but I feel like if I don't do anything someone malicious will discover the issue and cause harm to users of the website.

They certainly will. Usually responsible disclosure is defined as some form of contacting the party involved, working out some window of time that you both agree on during which they can fix the bug (~30 days say), then disclosing details of the vulnerability. This is like a very polite and necessary threat.

If you care I would contact them again and let them know you plan to make the vulnerability public, and ask how much time they need to fix it.
Thanks. I guess when I read that the processor was compromised I guess I assumed it was at Ring0 (couldn't resist). It never occured to me that it was within a client's account at the processor.
Homakov, by doing what you are doing.

A lot of people are watching you from your blog posts and some of these watchers would pay you good money to do a security audit.

I don't know the breadth of your expertise but I would reach out to some well respected security consulting firm and use your blog to demonstrate your interest/passion for web security. This might be a great way to broaden your expertise.

If you contacted 10 security firms, I'm sure at least one would hire you and cover VISA issues if you plan on leaving the country.
What's Ofly? Is there a spec for it?

Edit: found it. Surprised this page makes no mention of OAuth. http://www.shutterfly.com/documentation/OflyCallSignature.sf...
I think you may be confusing being "selective" with being "elitist."

Also, don't forget that TED offers the ability to use its name and platform via TEDx for free. [http://www.ted.com/tedx]
Productivity Posts Are Bullshit.