skysight-inc/HackerNews huggingface dataset:
I don't think kmfrk is saying that the warnings are unjustified, more that they're just not getting through due to oversaturation. People hear about privacy issues all the time, but rarely see or experience actual negative repercussions, so they begin to tune out the warnings. Apps like this are excellent demonstrations of the hazards of tossing out personal information willy-nilly, and are thus more likely to actually get the message across to people.
Steam and Adobe are the only reasons I don't use Linux. I would love to make the switch otherwise.
Er, Third Party Cookies have absolutely no influence over CSRF.

And I am kind of at a loss where the cross-domain part of what you are saying is part of cross-domain tracking.

Kindly enlighten.
pleaserobme.com has existed for while (looks like they have changed it to be more of a data leakage awareness site but originally it just spit out a stream of people who weren't home).
Patent Troll Sues Amazon, Mobile Industry Over Battery Charger
As someone who is not afraid of Makefiles (and has used them by default in past JavaScript-based projects), I welcome tools like Grunt to my projects. It fits in well with the types of "build" tasks I'm typically invoking in my JavaScript projects — and done so in a much simpler and abstracted syntax I prefer to work with.

Also, based on your comments, I think you and I have different definitions of "simple". :)
Now I'm afraid of asking for a reference for anything. God forbid I'd like evidence so if I share a claim with others I have as solid foundation.

You are providing your own chilling effect by demanding others adhere to your personal standards.
This to me is a server side issue- but that doesn't necessarily mean it's on the app developer. The behavior you're talking about can be set most servers directly, by adding the "X-Frame-Options" header into every request by default. Then exceptions would have to be made explicitly, by either the server admin or application developer. If anyone should change the default behavior (which I am not convinced is the case) it should be the server developers, not the browsers.
You should change the title to be of "Ask HN:" format.

My $0.02 is that if you charge your clients as part of an overall hosting solution, then you either have a rate card or a monthly rate that covers issues such as this.

Else, it's outside of your usual work, then it would be reasonable to bill for your time.
Thanks for the heads up. This account has been deleted. Unfortunately some people aren't taking this as seriously as we hoped. There are over 20mm Americans (mostly in rural areas) who have access to a fax machine but don't have the internet.

We have a feature to flag inappropriate profiles.
I'm thinking you should quickly rename it to Tripfox, TripBounty, or something else. It seems like the real value here is replacing travel agents more comprehensively than something like Kayak does.

Good luck!
Republican Philosophy
Though people on WP doing admin, if you have 6 people, are unlikely to be doing things every second - most of it is writing stuff, looking at things, so even if they were doing a click every second that's still 6 requests per second that for even completely non-cached dynamic stuff is completely irrelevant.
Austin is the only place I can imagine living in Texas. But it's still Texas, after all.
Definitely agree with #2, I spent a little too long trying to click the titles. The "Next Step" button should also be a color other than white so it stands out more.

I think this is an awesome idea, though! Will definitely use it in the future.
X-Frame-Options only prevents the page from being displayed in a frame. It doesn't prevent a page on another domain from submitting a POST request.
well, that's certainly disappointing.
What's a practical next step we can actually do to make this happen?

I feel like we see a lot of blog posts about this, but are there any tangible action steps people can do beyond blogging, commenting and signing petitions?
Invest Your Time, Don't Spend It
6. Walled gardens
It's clear that developers need a simple way to specify that a piece of API should not be accesible from third-party sites.

I propose a new set of HTTP verbs, "SECPOST", "SECGET", etc that comes with the implication that it is never intended to be called by third-party sites or even navigated to from third-party sites. It is a resource that can only be called from the same origin. Application developers (and framework authors) could make sure to implement their destructive/sensitive APIs behind those verbs, and browser vendors could make sure to prevent any and all CSRF on that verb (including links and redirects).
Navy: We're 4 Years Away From Laser Guns on Ships
Fair enough, here's another piece of advice: Surround yourself with people who are better than you, especially the types of people you'd like to become more like. Conversely, avoid people who are averse to the change you're experiencing and drag you down from becoming the person you want to be.

You spoke of male friends who are failures—those are the people you want to avoid. Start hanging out a lot more with your successful female friends, find mentors who will help guide you to improvement, get a job where you feel like the stupidest person in the room.

This goes back to setting high expectations for yourself. You're not the only variable.
Study: Amazon Trouncing Google in Android App Revenue
I was thinking more along the lines of having unique emails per site. While usernames have a higher probability of being the same person across different sites, it's not guaranteed. twitter.com/ed may not be facebook.com/ed but foo@bar.com is definitely unique.

The goal would be to make email one less piece of PII to aggregate you across sites as well as helping narrow down who is selling your info. I am well aware of the <username>+foo convention of gmail but it is trival to strip off the +foo part.

This way, you still get mail that you want without having to give out your "real" email address.

Maybe it's wasted effort but personally, I think there is some value there (for the people that care).
Screen Rage is the New Temper-Tantrum [Ipad]
Um... "You can write RESTful SOAP, I don't think the two ideas are perpendicular." (emphasis mine)

He's saying they aren't perpendicular and also saying they are independent.
The internet must be a very dark place for you.
Ha. Craig would probably do this, and then say "Hold on" while he plunks down his book on Tokyo Art Galleries: http://craigmod.com/journal/kickstartup/

What can I say? The man is prolific.
Conflict Over How Open ‘Do Not Track’ Talks Will Be
Anecdotal evidence is anecdotal and I'm a major skeptic of all things, but I'm amazed at hour accurate Leaky was for me.

My wife and I pay $119 per month for car insurance and Leaky's magic was within $3 bucks. Wow.

EDIT: Might I suggested some kind of accuracy checking feature? For example, my Leaky estimate vs. actual was really close and it would be cool if you collected data on this. Like if I selected "I use company X and my rate is $Y", then you could compare accuracy.
How do you find a good cofounder?

Asked and answered many times, but I like this answer the best:

http://www.humbledmba.com/please-please-please-stop-asking-h...

Should your programmer/designer be local?

I think your programmer should be you, to begin with. Don't know PHP? I think you can learn it in the next six months at minimal expense. You may groan and discover you hate PHP, and end up moving to another medium because there's a reason you hate it. If you're going to try and get a technical cofounder, presumably with equity only, you'll significantly expand your available talent pool if you can get the talent to take you seriously. That can be done by either having money to throw at the project (ruled out already), or being able to at least carry on a conversation on how to get things done in the medium you've chosen.

You can often find programmers in far-flung regions of the world that work for cheap, but probably not many work for equity. That leaves your immediate surroundings or whoever you can travel to get an audience with.

Is crowdfunding a good source for raising capital?
Yes. That's why it's illegal.

Other than end-runs around the system (crowdfunding a loan you're personally liable for like with prosper or lendingclub, or crowdfunding a project through direct sales of finished product like kickstarter), you're stuck with friends, family, and fools.
Groupon: 'material weakness' in financial controls, restates earnings
Two things.

First, every mainstream web framework already comes with a simple-to-use way to block forged requests. Even if we adopted new HTTP verbs to give them a common name in the protocol, by the time developers are making decisions they're not working with the ALL-CAPS-NAMES-OF-HTTP-VERBS anyways.

Second, there isn't anything inherently "cross-site" about CSRF, so denying off-site POSTs isn't a complete solution to the problem either. Every site that accepts any form of user-generated content must deal with intra-site request forgery as well.

So no, I don't think that's a great idea.

The things that are insecure here are serverside web applications. Changes to the HTTP protocol or to browsers are a red herring. There's no way around it: web developers have to figure out how to write secure code.
It is possible to steal IP though. If you assert ownership of an intellectual property, then your next step can be to stop the original artist from claiming royalties. An example would be the companies claiming ownership of public domain films and then getting youtube to yank the public domain versions.

So if NBC was claiming they owned the Apple artwork, its stealing because that ownership (if uncontested) allows them to collect royalties, etc.
I'm using Rich Hickey's definition: http://www.infoq.com/presentations/Simple-Made-Easy

You might be using it to mean what he's defined as "easy".
Yes I should have included what happens when a site is compromised in the terms. As the developer, not host this just didn't occur to me. I provide a 90 warranty but generally this only requires a small amount of hours as major problems are usually picked up in testing.

tyvm - great comments
I wholeheartedly disagree. Only major in CS if you genuinely love it. I am a cold logic machine about nearly everything, but when it comes to your career and your life's work, you gotta follow your heart--not your head! Plus learning is easy when you find the subject matter fascinating.
Love the idea of a life style brand for those who make things! I've got your biggest sized poster, looks beautiful right above my desk.
What this argument does is look at a profound failure of regulation (payment processors are overseen by PCI QSAs, who in this case signed off on a site that experienced a monumental breach), and then points to a site at random that has not yet experienced a breach to argue that less regulation is needed.
Is the following accurate:

If a form is served from domain A (via GET) in to an iframe on a page that was served from domain B, then the JS on the page from domain B is prevented from reading or writing data on the page from domain A (unless an x-domain policy is in place) though it may be able to post it.
Thank you for your quick reaction. Good luck.
I'm not the host. Just the developer. The host is shrugging it off as 'just one of those things', which it may well be and have billed for restoring dbs etc..

I think you're right - I not sure how to broach the subject with the client though. tyvm for your $0.02 :)
I think by "RESTful thinking" he means "cargo-culting the Rails RESTful scaffolding".
The inescapable ’80s: 8-bit, SimCity, and Wing Commander all make a comeback
Probably closer to 20,000 hits per second with Nginx configured correctly and if the framework doesn't impose too much overhead. Alternatively, use ESI with Varnish and the HTTP Cache spec and get 10,000+ hits per second on a relatively dynamic website (read: micro-caching).
There's actually nothing stopping you from using your own verbs, actually; it's allowed. Lloeki gives a good reason not to, though: I don't know how PAY will be handled without consulting documentation.
The referer header can easily be forged. The whole point of a CSRF attack is to turn a user's credentials against him.
How do you forge the referer header as a third-party site?
I have this catch-all ABE (Application Boundaries Enforcer) rule (in NoScript config, advanced tab, abe subtab, USER rules). The blog didn't log me out of google.

Site ALL
Accept INCLUSION(XHR, SUBDOC) from SELF++
Anon INCLUSION

http://noscript.net/abe/
It does, maybe you checked the "Remember this computer for 30 days" box last time you were logging in?
This is an excellent question. At the end of the day, the TSA exists as it does because the population is fearful of dying in an airplane explosion (even though these tactics don't much help prevent that), and there's no political cover whatsoever for a politician that endorses scaling back security theater. So whatever the practical next step is, it needs to start by solving that problem. We need a public declaration by the population that we're willing to take the risk and won't punish politicians for changing the TSA.
Traffic isn't as bad as everyone thinks. The sprawl is desirable if you want to live in a big city but still be able to afford a place with a yard and driveway.
Down, and no Google cache.
Have you considered allowing people to optimize for something other than cost? I'd be very interested in paying people to find me mileage runs - that is, itineraries that minimize the cost per mile.

http://en.wikipedia.org/wiki/Frequent-flyer_program#Mileage_...
Thank you for pointing me to X-Frame-Origin!

So, in the context of this discussion, why don't the browsers make X-Frame-Origin: DENY the default behavior?????
He provided instructions to your browser to include an image.

If that is considered 'without your consent', then so is every site that is embedding external plugins, images, and videos.

How are you supposed to 'give your consent'? Must you be given a list of all the content on the website before the browser will be allowed to display it?

When you requested the page, you gave your consent to load whatever was on that page. If you don't want that, then you should use wget instead of a browser.
Why are fantasy world accents British?
Maxis developing new SimCity for 2013 release [includes trailer]
Don't you know that? Terrorists did a great job in 2001! Since then, every one in United States are in terror, especially the US government. They did everything they believed to fight it, spend every penny they have, and torture every citizen of them whenever they are flying. If I were the terrorist I would be much glad: I don't need to do anything anymore but the whole US is in terror, forever!
I agree that nobody should focus solely on getting better at, say, Agile. I also agree we should work hard at getting better at programming.

However, I don't think that focusing on programming alone is sufficient. A lot of projects fail for reasons other than bad coding, and almost no project exists where programming is the end purpose. You can do all kinds of great programming, but if you make the wrong thing, you're screwed. Ditto if you have a bunch of individuals doing great programming that doesn't add up to a functioning project.

I also think you're creating a bit of a false dichotomy. When I first tried XP, it wasn't for the sake of doing XP. It was because I wanted to improve how we made things for our users. So exploring XP wasn't tangential to better programming; for me it was closely related, in that programming was a big part of making.
Personally, I would be happy to eliminate any possibility of inter-site forgeries. It's unlikely that my bank will be putting user-generated content in front of me any time soon (and if they do I presume that they'll sanitize it well enough to not be a problem).

It troubles me deeply to have CSRF declared a purely server-side application problem. The browser is quite literally my agent in all of my interaction with the web. It is an extension of me, and when it does things that pretend that they are me, that feels very wrong. That is why I propose new HTTP verbs: my browser should know (and verify) that when it sends out a SEC* request, that my eyeballs are on that data and my finger physically clicked that button, and it can do this if those requests are, essentially, tagged as particularly sensitive.

To place the onus soley on the server-side is for me to abrogate my responsibility to fully control my browser-as-agent. Frankly, even if the server successfully rejects forged attacks, it is not acceptable that my browser, acting as my trusted agent, attempted that attack in the first place.
Or followed with a space. * this * vs. this
Yes, absolutely. You could do that know, but we need to build our expert base a little larger before we target this market specifically. Also, we need to find a way to add these options without confusing the average person. We're pretty obsessed with analytics and we've seen that even just minor details confuse people and reduce conversions. Maybe a separate menu/link/section/subdomain is needed.
Good point. I wonder, though-- could you make /order/42/payment the only payment resource related to /order/42, so the ID isn't needed? (PUT /order/42/payment)

If the payment doesn't cover the bill, you could have the PUT respond with a link to /order/42/payment/remaining/1, then (if needed) continue with /remaining/2, and so on.

That would avoid the danger of a gap between your id GET and the payment PUT.
This is very nice; one addition that would make it even better is support for implicitly defined functions and relationships. If we could graph things like x^2+(y-x^(2/3))^2=1 directly, that'd be awesome.
I know it's not made for anyone outside of the company, but why not? Trade secrets? It would be an interesting read to other people too, and they might also have the experiences of reading "The Umbrella" on software craftsmanship...
Using SIMD for hardware acceleration
Thanks! We do a lot of internal testing, but I'm always really excited when I hear that we were close for an actual person!

Thanks for the feedback too, it sounds like something that we're working on to allow users to fold their information into our routine accuracy testing - which should be helpful for them and us.
If you think of the damage that can be done by a logout CSRF, it is not going to harm very much. Really a low-level issue.
I am not so sure human is something one ought to aspire to be. There is a certain comfort in dealing with people who, when they criticise your ideas, you can be confident that they are doing so purely from a rational position.

I believe it is worthwhile to pursue and encourage this mindset, if I am wrong about something, I want to know about it, not be encouraged to pursue a path of questionable value purely because it might be perceived as mean to educate me.

I want to be treated this way and I want to treat others this way. It is not at all innately vicious or an excess of negative emotion, if anything its precisely the opposite, the complete absence of emotion.
Non creepy version? http://itunes.apple.com/us/app/where-the-ladies-at/id4156024...
Many thanks. You're spot on. And it's so obvious in hindsight, but alas.

We've already had a contest asking for accomm recommendations and it worked surprisingly well. That person paid a $200 finder's fee and it was great to see experts who'd been to the same places recounting their experiences in detail and giving highly practical advice. Of course you can get this for free elsewhere, but the whole package is worth paying for. This person saved a fortune on the flights alone.
> They are clickable. Aren't they?

Nope.

> Uh, oh... What OS/browser?

Windows 7: Chrome 17, Firefox 10, Firefox 11, IE9
I don't understand this argument. If I buy a box of cereal, and open it to find it contains a live rattlesnake, have I consented to be bitten by the snake because I knowingly purchased the box?

Of course I don't know everything that's in cereal -- I trust the manufacturers to provide me with the product I paid for, whatever that involves. But I know for sure that that doesn't involve snakes, and had I had reason to believe that there might be a snake in there, I wouldn't have bought it. And the rational response to this is definitely not "If you didn't want snakes, you should have x-rayed the cereal before you bought it."

Arguing that my ignorance of something which I wouldn't have wanted had I been aware of it constitutes consent is severely shaky.

(Again, I'm not saying that logging me out of Google is like getting bit by a snake, and I do think it was a decently harmless demonstration of the issue with CSRF for anyone who was unaware. I'm just speaking hypothetically here.)
Cool! I am working on automated mileage run finding at mileagebrain.com - hoping this will turn out to be complementary :)
checkout enthought traits
Now, a year from now, five years from now, I'd like someone to explain to me why Google, when confronted with Facebook and Twitter chose to make Google+ a mostly walled garden (can't link to comments, no api) when the "obvious disruptive, jujitsu" move would've been to be the massive and open player for others to build on.

But yeah, walled gardens are a huge problem.
Twitter Takes Tweetdeck Offline due to Vulnerability
Update -- now downloads all lecture materials on the videos page (pptx, pdf, etc).
Specialized Turbo e-bike is too fast and furious for the western world
The titles such as "Award a Winner" are not clickable for me either on Windows 7 Chrome 17.
The best most productive schedule I've ever been on usually came about around finals time in college.

I would wake up around 8AM, then fall asleep at 4PM, wake up again at 8PM and fall asleep again at 4AM. I was awake during all the necessary "business hours" to go to school, but I also had 8 uninterrupted hours in the middle of the night to study or read or whatever.

The best part was, whenever 4 came around I would get tired and fall asleep very rapidly, and snap awake fully energized at 8. Since I was never awake more than 8 hours at a stretch I was always refreshed right up to the time I would fall asleep. Meanwhile, unlike the hoax uberman or other sleep schedules, I was getting a full 8 hours of quality sleep per day, so I was never tired.
So if a user enters the following search query:
Sqrt(xx+yy)+3cos(sqrt(xx+y*y))+5 from -20 to 20

And gets a graph of the equation as the top result, are you claiming that this is a poor search experience? Are you claiming that this is a bad result?

If not, how is this feature not an improvement to search? How is this not "sticking to search"?

Note - I was not involved in any way with this feature, or with search quality in general
Nice. My friend did his PhD on gecko adhesives too[1]. He later built[2] a "six-legged" robot like Boston Dynamics' RHex 'bot[3].

[1] http://northdesignlabs.com/?page_id=12
[2] http://northdesignlabs.com/?p=38
[3] http://www.youtube.com/watch?v=ISznqY3kESI
Foursquare revokes location API for 'Girls Around Me' app