skysight-inc/HackerNews huggingface dataset:
Ask HN: Do you charge to fix a clients site when it gets hacked
Hi everyone

I'm a web developer. Two of my clients, that I made sites for, got hacked this week. I spent two days fixing the intrusion and doing support to the clients.

If this has happened to you in the past do you charge clients for this service?

The clients know this isn't my fault and are grateful to me fixing the problem but I could have been doing other work during this time but don't know whether to bill.
Recommended reading on this subject: http://www.spiderrobinson.com/melancholyelephants.html
Your Family is Also Your Startup
For years, some in the Java community (and programming community in general) have been claiming that Java is the new COBOL, so this is a refutation of that assertion. They are not fools, they just expect their audience is aware of the context.
Browsers don't prevent it because there are legitimate uses for cross-domain posts. Good frameworks do prevent it with CSRF tokens.
The vast majority of affirmative action has favored and continues to favor rich, connected white men. Famous example:

And the famous example is that... white men network. As do black lesbians, Papuan pearl divers, and for all I know the Turkish blue-ringed octopus (our only social octopus).

The leap from "vast majority" to "famous example" is great, too. I never cease to be fascinated by the bizarre pseudosequiturs that pass for logic in the orthodox mind. It's like tumor pathology - every case its own disease.

What's wonderful is how similar this general strain of disparate impact theory is to the classic logic of German anti-Semitism. Did you know that 80% of the lawyers in 1932 Berlin were Jews, even though only 1% of the population was Jewish? Ineluctable mathematical proof the Jews are conspiring against the Aryans - scratching each other's backs, while stabbing their good German competitors under the table.

Too bad Streicher and company never got a chance to read Cochran and Harpending 2005:

http://en.wikipedia.org/wiki/Ashkenazi_Jewish_intelligence

But to paraphrase Goethe, against stupidity even the Jews contend in vain...
If you haven't read them, how do you know they are critiques of a product he hasn't tried?
Switching from Perl to Python: Speed
I'm not following (but I'm a little buzzed). What do third-party cookies have to do with CSRF? CSRF is a flaw in the victim application.
That is a revocation of the license, not a violation of any terms of the agreement(s) with foursquare.
This attack vector requires:

1) previous authentication to a service.

2) service which supports destructive actions as guessable URLs.

3) "third-party cookie" support in the user agent. [1]

4) a visit to a page with a malicious resource construct (an image, script, iframe, external style sheet, or object). Note that this resource could be generated by JavaScript, although this is not necessary.

Sadly, the first three criteria are widely met. If we are to systematically remove this threat, then we have to look at removing each in turn:

1) Previous authentication to a service can be mitigated by simply logging out when you are done, but this is inconvenient and requires manual user intervention. However, there is an interesting possibility to limit "important" services to a separate process - a browser, an "incognito" window, etc.

2) Services should be built with an unguessable component that is provided just prior to calling by a known-good API, probably with additional referrer verification.

3) It is my belief that disabling third-party cookies is the right solution here: users rarely, if ever, get value from third-party cookies. Denying them would allow API authors to write simpler APIs that do not have a secret component, and would allow users to maintain the same behavior and login to all their services from the same browser.

4) While it seems that little can be done on this front apart from releasing some chemical agent into the atmosphere that made people trustworthy and good, actually it may be possible for browser makers to do some simple analysis of resource URLs to detect possible hanky-panky.

[1] https://en.wikipedia.org/wiki/HTTP_cookie#Privacy_and_third-...
Soybu Womens Lotus Yoga Capri
I don't want the legitimate uses prevented. The default behavior should be to prevent, and the legitimate uses should explicitly opt-in. That way, you only have to do security analysis for those explicit points.
It will soon be possible to design and build household animals to order
How would Google recognize they aren't a thin affiliate though?
Part of me thinks if you made "starting contests" free for customers, you'd get more traction. On the other hand the other part of me thinks that you've already tried this approach, or at least thought about it. So, which part of me is right?

Also two tiny notes about your front page:

1. I, personally, get really pissed when I'm informed about fees of a service in any step of the process other than the first one. So, I'd suggest show the fees somewhere above the fold.

2. This is more of a UX thing. In the "How it works" box, make the titles clickable.

I love the idea. Simple, yet has a lot of potential. Will be start my own contest someday soon.

Rock on.
Seams like you just made a crappy video about using notepad as a planner and then put oodles of ads on your site.
Because a lot of them are pure nonsense that can do more harm than good. There's a weird mish-mash of useful and garbage, and it's hard to tell which is which unless you already know about the field.

Some of them lack science. Worse, some of them are actively anti-science.

I agree that there some great books, with useful helpful life-changing advice.
Maybe because tracking down the address for a Jesse W. in SanFrancisco isn't that hard (you just need the right website), and after that... Somebody already pointed out that a "Burglar Me Please" app would be banal to write: you just walk along SF, and the app will tell you which owner is home and which is away, and how far s/he is; correlate with Facebook (is he married? is he so young he might be sharing his flat?) and you get a list of easy targets in the area.

It's not only about where you are, it's also about where you are not at any given time.
The Foursquare API explorer is the best demo of an API I have ever seen:
https://developer.foursquare.com/docs/explore
Pep: kinetic drag on touch and click devices
"SHA1 key handling"?

Anyways, you misread him. All he's saying is that the delay Egor Homakov experienced was with the Rails dev team, not Github. Github's response to Homakov's finding was very fast.
"We're over warning people about the dangers of data leakages;" ???

Isn't this an example that "we" are not over warning people?
I don't enjoy April Fools. At one point people would come up with well-thought out and entertaining tricks. Now it's 99% annoying stuff that's not funny and not creative.

Sorry to be a kill-joy but this plugin looks like it would be used by the 99%. An example of a good "fool" would be unixkcd.
Third party cookie support isn't necessary. You could just use a link instead of an image.
Top 5 Stanford CS Students You Should Know
From experience: had he simply told Github about it, they would have fixed it quickly, and there would have been no window of public exposure. That's the point being made here.
It's not that the referer header is not "enough". "Enough" implies that it falls somewhere on the scale of trustworthiness.

It's user input. Don't trust user input.
But there's existing code that would break.
Broadcasting your location also broadcasts where you aren't. I'm shocked there haven't been more news stories (or scare stories) about people being burglarized based on checkins.
Do companies really check our accounts?
Hi to all hacker news readers.

Do companies really look at into your github, hacker news, stack overflow, project euler, LinkedIn, etc. accounts to see your community involvement?

I only have a github account which I put all of my personal projects and a LinkedIn account. I think these two websites are the ones that companies may actually look into. Do you have any experiences of being asked for your account on community sites other than your github account?
CubeGrid - Build a 3D world using voxels in the browser, together
Why shouldn't you trust user-provided data to secure the same user's data? The potential attack is someone forging their own referer header in order to attack themself.
Yes, that's the active form of the attack. To me, the passive form is far more pernicious (you are taking destructive action passively). At least with the active form you know that you've done something unintentional.

But this does imply that the final onus is on the programmers of services to design services that do not have guessable, destructive one-step inputs.
You could use a redirect, too.
Brilliant! I'm rolling out PagerDuty as we speak.
It's possible to go overboard. You could mandate that all credit card data be treated like classified data, no sharing of systems or network domains, label everything, MAC everywhere, encrypt or hash everything at rest...

How do you strike a balance between that level of security and the current horrible (I think everyone realizes PCI is horrible) industry self-regulation?

a) PCI is lame.
b) Auditors audit according to lame PCI standards
c) The entire credit card payment scheme is insecure and broken
d) Larger companies (payment processors, Citi, or Sony PSN) make juicier targets

Doesn't that pretty much sum it up?
An app that sends kisses
Groupon seems to have a history of questionable bookkeeping. HN community saw this( http://news.ycombinator.com/item?id=3270165) way back when.

Edit: Added link to previous GRPN discussion
What are you using to send the faxes?
well there's not investment involved, nor equity taken. It's for the benefits of all involved. Instead of working in silos or at coworking spaces, YCx will provide a framework to develop more meaningful relationships than going to casual meetups or general assembly (NYC) events because you get to see the same 10 (or however many) startups repeatedly over a period of time, and presumably grow together.

I am based in NYC, so I can see that happening here. I am not sure where you are based but if your city has at least 50k to 100k people, you can probably get a few startups together.

And on dinner. Aren't we supposed to be just trying to get to ramen profitable ? :)
Thanks for the reply. I get your point that the initiative and aptitude are the starting point, but as you mentioned, looking for "proof" of ability is very tricky, particularly for people without much experience. Of course had I known I would be unemployed for 6+ months at the offset I could have planned a project that ticked lots of boxes (Django frontend, NumpPy, SQLAlchemy, PyMongo etc. etc.). I love the idea of Hacker School and wish I'd known about it at the time, I'm sure it would have helped me build a portfolio of work. While I did have some side projects I'd spend a lot of time learning to match a job spec or recruiters recommendations only to find the interviewer fixating on something else, other times I'd be strung along ("we'll be looking to hire in a month or so, why not brush up on X in the meantime?") and then the job would disappear (cash-flow issues, change in priorities, new CTO decides to scrap Python and rewrite in node.js ;)

Ultimately I'd rather be programming. My current job is OK and I'll stick at it for now, I owe my boss for taking a chance on me and they'd struggle if I left before the end of the year (we are a small team and in the middle of switching accounting systems and finalizing an acquisition). I do like the fact that I get exposed to a range of business issues, as my previous job in the insurance industry was a little more technical but very narrow in scope. Long-term it probably doesn't suit me (though it might be different at another company), I've automated some tasks in Access/VBA but there is a line between finance and IT (partially outsourced or contractors) and I'm expected to use systems rather than improve them. At least I can at least work on some longer-term programing projects in my free time, but it's frustrating to be left thinking "maybe next year", rather than living in the moment!
They now quote you saying that on the front page, btw. Linking to this comment.
Read through smacss.com, if you haven't already. It advocates a modular approach that should minimize the impact that components have on other components, thus a style change to one component won't blow up the rest of the site.

Third party tools can be hit and miss. Hopefully you're working with plugins/libraries that don't inject inline code and rely on namespaced classes to achieve the result you need. Then, you have control of the CSS to style as you wish.

(disclaimer: I wrote smacss (but didn't write the blog post))
Where's Racket?
"Much as there are tools like 1Password for passwords, I think there should be like tools for usernames/emails."

The way I read that is an aggregator for usernames. How would that help anything?

Or do you mean I change my username to a different sha1 string for each website? That seems like it would definitely hurt the social aspect of a lot of websites...

"2fd4e1c67a2d28fced849ee1bb76e7391b93eb12 just checked in at Alice and Bob's Bar"
Cara Membuat Status Kosong Di Facebook
Nah jika kalian ingin nyobain biar tidak penasaran ntar tidak bias tidur lagi hahahahha Ya Statusdah saya kasih nih kodenya tin
Why your tech CV sucks
I think you can escape the asterisk by indenting the line with two spaces:

text with * signs that doesn't get italicized *
Imagine you're looking to hire a top tier developer, or perhaps a "product person." After a strong interview, he or she is walking through the door, pauses, turns back, and says, "oh, one more thing." And hands you something like this.
Note: hiddenVideos has a number of mildly nsfw videos. Turn off your speakers before clicking!

The first one I got just kept repeating "surprise mother f*er".

The full list of YouTube ids for the curious:

videos = ['Prhzzqc0aFQ', 'UwB9m4FslO4', 'LH5ay10RTGY', 'DkQ83yLqpJE', 'T6j4f8cHBIM', 'kffacxfA7G4', 'RFzyYYZsxGc', 'v20jRHL492Y', 'Z8bpeeuHDOA', 'KHy7DGLTt8g', '_6-KspZegsE', 'l12Csc_lW0Q']
Creating fake profiles of customers using picture of dead people is not funny at all.
http://www.downtofax.com/users/8c51050c7abd11e1b11512313d186...
http://www.elizabethstricklandunterzuber.com/
She passed away in 2006.
I think anytime works for me, if I make sure, there are no distractions: email - off, messengers - off, phone - off.

Without distractions my preferred time would be during the day in a room/office with daylight. When I was working a regular dayjob, my most productive hacking hours moved to late night - primarily because of distractions.
CSRF isn't a browser vulnerability. It's a serverside application vulnerability.

To say otherwise is to say there there is some trivial policy, just an HTTP header away, that would allow IE, Firefox, and Webkit to coherently express cross-domain request policy for every conceivable application --- or to say that no FORM element on any website should be able to POST off-site (which, for the non-developers on HN, is an extremely common pattern).

There is a list (I am not particularly fond of it) managed by OWASP of the Top Ten vulnerabilities in application security. CSRF has been on it since at least 2007. For at least five years, the appsec community has been trying to educate application developers about CSRF.

Applications already have fine-grained controls for preventing CSRF. Homakov calls these controls "an ugly workaround". I can't argue about ugliness or elegance, but forgery tokens are fundamentally no less elegant than cryptographically secure cookies, which form the basis for virtually all application security on the entire Internet. The difference between browser-based CSRF protections (which don't exist) and token-based protections is the End to End Argument In System Design (also worth a Google). E2E suggests that when there are many options for implementing something, the best long-term solution is the one that pushes logic as far out to the edges as possible. Baking CSRF protection into the HTTP protocol is the opposite: it creates a "smart middleman" that will in the long term hamper security.

This blog post seems to suppose that most readers aren't even familiar with CSRF. From the comments on this thread, he may be right! But he's naive if he thinks Google wasn't aware of the logout CSRF, since it's been discussed ad nauseam on the Internet since at least 2008 (as the top of the first search result for [Google logout CSRF] would tell you). Presumably, the reason this hasn't been addressed is that Google is willing to accept the extremely low impact of users having to re-enter their passwords to get to Google.

Incidentally, I am, like Egor, a fan of Rails. But to suggest that Rails is the most advanced framework with respect to CSRF is to betray a lack of attention to every other popular framework in the field. ASP.NET has protected against CSRF for as long as there's been a MAC'd VIEWSTATE. Struts has a token. The Zend PHP framework provides a form authentication system; check out Stefan Esser's secure PHP development deck on their site. Django, of course, provides CSRF protection as a middleware module.
Kevin Smith On Why You Don't Have To Be Kevin Smith To Try Innovative New Things
Ok so I have two more ideas to mitigate this vector:

1) Rename "Third-party cookies" to "Evil Cookies" and lobby all browser vendors to disable them in all circumstances. They are enabled by default(!) in the major browsers presumably to placate advertising networks.

2) Introduce a new HTTP verb, SECURE, which browsers will not send to a third-party website under any circumstance, including navigation events. That would make requirement number four impossible to satisfy (even for links and redirects).
Some of my best bosses have done this in different ways and it's super inspiring. I know it's a ridiculous amount of work in and of itself but it's something that becomes absolutely priceless to those who were involved.

For those who are managing software teams, check out http://code.google.com/p/gource/ It does a stunning job visualizing your codebase being built based on git changelogs. Record it with fraps, add some background music and you have a music video you can watch of each major release. :)
I love this idea guys - v. cool
Sorry, but I think you're out of touch with Americans. Most of us want great transit. It's difficult to do in a country as large as the USA. It's a problem of scale, something difficult to appreciate for people living in smaller countries.
The 2012 Wired 100: Who should we include?
Cheap Mens True Religion Skinny Jeans Sale, True Religion Cargo Pants
Why Path Will Survive Its Privacy Scandal: Great Design
> The color of the envelope does not change the message it contains.

I would consider this half-true. As Marshall McLuhan said: "the medium is the message". What is communicated is defined by the complete sum of the experience of the receiver, which includes subtle nuances of how that message is packaged.

That said, I agree with your core point.
The Top 5 Stanford CS Students You Should Know
Sec Companies and Governments conspire to discover and hide exploits
Or leverage a template cache on (insert any framework here) and get 2,000+ hits a second on a Linode, or 172,800,000 hits day.
We should meet up.
Oh man, change it to "sqrt(​x * ​x + ​y * ​y * ​y)", and it looks like either boobs or ass, I'm not sure which!
Isn't that Morningside Heights? The southern boundary depends on who you talk to... can go down to 110th or so. I grew up on 119th and Riverside. LOVE that area, even thirty-odd years ago. Harlem doesn't start until 125th on the west side.

Anyway, the west side of Harlem, the other side of Morningside Park, has gentrified significantly in the last 20 years and is also by all accounts a pretty nice place to live nowadays.

Washington Heights is also "up-and-coming", up north of there.
Hi Hamid, (full disc: we've worked alongside Hamid, awesome coder).

1. Good point about knowing about the fees upfront. Will update in our next release. Somehow went missing after experimenting with pricing too often.

2. They are clickable. Aren't they? Uh, oh... What OS/browser? Opens Vbox

Would love to iterate faster with more engineers. Any chance we can poach you from setkick.com?

Thanks again.
Ignoring? Not at all. I'm just pointing out that the notion of racial differences is so taboo in contemporary academic culture that it's impossible to honestly discuss the question. To honestly address the question, you have to be open to the possibility of any answer, which frankly we aren't. If certain racial differences don't exist, that's fine, but if they did exist, no one would say so anyway. So we can't take the claim that racial differences don't exist at face value, because that's the only palatable conclusion open on the question.

The taboo is a completely understandable and largely inevitable reaction against the open and largely fallacious racist claims of academics in the recent past, but it's still a taboo that inhibits honest inquiry. Perhaps in another 50-100 years.
If you haven't discussed it up front with them, you're going to have to tread carefully.

We offer, as part of the handover when we deliver a site, a "support contract" which includes a few hours of phone support per month as well as software security updates. It's made clear in this offer that if your not on our support contract, any time doing that is chargeable at our regular rates.

What you need to do is make sure you and your clients are both aware of all the different responsibilities in keeping a website up (from the network connectivity and hosting hardware, through the OS, OS applications, web app dependancies to the web application software), in many cases the "web developer" has no control over some of those responsibilities (particularly if the customer is organizing the web hosting), and everybody needs to be aware of who to call, and who's responsible for fixing problems at each layer, and how the cost of that responsibility is going to be borne. In my experience, everything between the OS install and the web app software (Wordpress/Drupal/custom written app) is often overlooked - who's responsible for keeping apache/MySQL/nginx/memcached/sendmail/named up to date? Customers in general don't even know they're using those things. Race-to-the-bottom-price hosting companies aren't going to be proactive about protecting your $4.95/month hosting account. Unless you've raised these issues with your clients beforehand, your relying purely on their goodwill towards you to get paid for any time you spend fixing problems you never knew you signed up to accept responsibility for…
> Also, you pay less in taxes (income and sales tax) since you're in NJ.

If you live in NJ but work in NY don't you pay NY taxes? And even if you want to get around that somehow, won't any normal employer payroll withhold for NY before you even see it?
I will build your mobile mvp/prototype for $99
Have some more nightmare fuel: http://ha.ckers.org/xss.html

You can inject the things above into somebody else's data, or hide them in your own page from the beginning, I suppose.

As a site developer, you can mitigate some mischief a bit by having any destructive update be a two step process: first get a form (or an "are you sure" page, if no real input is required), and add a nonce to the form, which is submitted back with the "request for destruction and subversion". Of course, the attacker can still request the form, harvest the nonce, and send it back with the attacking request, but now his attack has to be 2 steps instead of just 1. Also, if the nonce has a variable name, he has to know to grab everything off of the setup form, and not just resubmit a hard-coded name. Obviously, this won't stop everybody, but it does force them to try a little harder.