skysight-inc/HackerNews huggingface dataset:
Havij is a similar tool thats gaining in popularity due to its point and click interface. check out: http://blog.imperva.com/2012/04/dissecting-the-sql-injection...
I think you're downplaying this. The illegitimate use of the address book is being masked by a legitimate use - even if permission is asked for it will likely be granted. What is essentially impossible to control except through manual app verification processes (and very hard even then) is what is done with the data once the app has access to them.

As a total aside, if you are an AT&T customer you can just forward SMS spam to 7726 (SPAM) and they take care of it - I'm not affiliated with AT&T (just a customer) and I wish they would publicize this stuff more.
If that is the case, I can't wait for a Wikileaks leak blowing Wikileaks cover.
I've had a few cases of hesitation when I'd like to report a post item but not the posing user. (User is ignorant or compromised.)

Not caring to keep up on every changing detail of FB's self-management, the dropdown options left me uncertain of the effect(s) my reporting (e.g. as "spam") would have.

IMO, FB could put in some work to make the reporting options clearer in terms of effect. (E.g. reporting a spam "post" will or will not ding the post's owner -- your friend.)

Just a suggestion. Use clear communication and information to make it easy for the user to help you (reporting spam).

Of course, I tend to "overthink" these things. Perhapss/likely, most users just ignore or "report" without thinking about the implications of doing so.
Software patents: the good, the bad and the ugly.
Showing the world some 2-years old tech doesn't turn a dinosaur into a cheetah.
Dear god what buzz-word laden soup. Switch out the brands and this article could just as well be about Nokia or GM or whatever BigCo.
Sergey Brin: Batman, Iron Man or Dr Doom?
He is still right on on being completely locked in one network with dumb phones.
Scientific community is not "mainstream" either because it projects "nerdiness" and "geekiness", both of which are associated with negative connotations and don't fit into the anti-intellectual narrative that is broadly perpetuated by the media.
Even some MSFT divisions openly admit to using Linux in-house. So, I'm pretty sure s/most/all/.
I just wish Google had named their "mobile operating system" as Linux/Android instead of just Android, and have a "Powered by Linux" on their homepage, this way many more people would realize that they use Linux more often than they think. The problem is that then we would have purists that would call for a GNU/Linux/Android and others would ask for Powered by libc, engineers, your utility company, lunch from the Burger Joint Inc, pigeons, etc ;)
Saying something like stack ranking is partly responsible for ruining Microsoft completely discredits this article. It makes every word suspect in the whole thing.

1. Microsoft has almost always stack ranked.
2. Companies like Google who has done nothing but grow in the past decade also has almost always stack ranked.

Try not to put things in your article that seem so baseless.
It makes you look like a hater.
Google Nexus Q Streaming Media Player
An organization's ability to respond to incidents must include tools like this!
For most people, at least.

http://en.wikipedia.org/wiki/Body_integrity_identity_disorde...
I'd contend that manpower is the bottleneck, and time spent writing and debugging software is time taken away from designing and performing experiments. How much time, exactly, depends on the precise software.

I'm not saying it's on the scale of years, but that's what I'm opening up for discussion. It's certainly plausible, given the sheer scale of work that's gone into the development of Linux, that there may be features that researchers would have had to recreate at great effort and expense had Linux not existed.
I really like objective-c. I think my perfect language should be something between C++ and objective-c.
Someone needs to develop an algorithm or mechanism that allows someone to record their own voice without recording anyone else's speech. Most video recording doesn't run afoul of the law, unless there is a soundtrack. However, recording yourself is okay in most jurisdictions.
It's working much better for me in IE9.

http://screencast.com/t/BI0Q97W5FpL

Still not quite perfect, but not totally broken.
Completely agree with this. If you look at some of the CERN infrastructure pages, you see they use both open source and commercial apps wherever they make sense. For example when I checked out the DB infrastructure a while ago, they seemed to use a lot of Oracle[1] (with some MySQL in there as well), Scientific Linux for some stuff and RHEL where needed ( presumably for support reasons).

[1] https://openlab-mu-internal.web.cern.ch/openlab-mu-internal/...
I've read books, papers, articles, and various other things on ipads, kindles, palm IIIs, two android phones, and a Transformer prime, (I think I'm being exhaustive enough). And I completely agree with you. I tore through lots of books on my old palm III, but it was often constraining and some types of material worked much better than others.

As a more recent example. In a book club I'm in, we were reading "The Theory of the Leisure Class" (man, oh man is Veblen cantankerous, but "conspicuous consumption" is a bit of genius). Anyway, many of us passed around the ebook copy we had, and at least five people tried to read it on their phones... to unanimous, vehement agreement that the late 1800's style of long-winded rhetoric was too much for reading on small screens. Headaches, lots of paging back to find the point of things again, no one made it through more than a quarter of the book that way. Just another example of the medium shaping the possible messages.
For no reason at all, Opera users told to use Chrome on Blogger
> How much longer would it have taken if they'd had to use BSD?

Macs (BSD-based) are popular at CERN as well:

Smashing Research at CERN
http://www.apple.com/science/profiles/briancox/index2.html
The reverse-corporation
Analyzing distribution channels for startups
I feel like this is missing the forest for the trees. What is the value of a curated app ecosystem like Apple's to the consumer if they cannot prevent malware from winding up on consumers' devices?
Recent iOS, Mac app crashes linked to botched FairPlay DRM
Corrupt App Store Binaries Crashing on Launch
I've been using and writing KIF extension categories for the http://artsy.net gallery iPad app now on and off for a few months and have it to almost that kind of simplicity/readability.

To be honest though, I'd drop all my KIF tests and happily re-write in ruby motion if I can have these tests ran on the project instead of writing longer KIF steps. Does anyone know if this is possible? Taking an existing codebase and running the ruby motion test frameworks?
What if, instead of legs, he had electric wheels capable of going 30 miles per hour? That would be a clear advantage.
Trojan Horse Found in the iOS App Store
How to get over idea block?
I've been reading HN for a few years now, seeing everyone talk about their ideas, their weekend projects, and their startups. I'm pretty capable with a background in programming and electronics, but for some reason, any time I want to sit down and create or invent something, I just draw a blank. I'm sure there are other people here who have struggled with the same thing... How did you get past it? Thanks!
I agree -- more people need to be aware of the Mobile spam reporting, it's actually quite cool.
Personally not sure I would try an OS until Clojure has a compile to target like C, unless you'd try writing an OS in Java.
> would you go with Clojure as one of the core languages, specifically the one that developer-created apps are written in?

Only after detaching it from the JVM. Forcing all apps to run on JVM would obviously be too limiting.

> And could Clojure be fast enough to power the actual OS itself too?

It is definitely possible to get C-grade control over machine code with a Lisp, as evidenced by GOAL/GOOL. Not sure though if it is worth it.
You can vote before you can comment (15 and 50 rep generally speaking).

Once you get over 200 rep anywhere in the network, you'll automatically get a +100 rep bonus on other sites you join so you don't have to "grind it out" for the basic privileges.

The low rep hurdles (anything < 100) are basically "know how everything works" bars (the number of people who mistake "answer" for "forum-style reply" and "community close votes" as "moderators" backs up the need for such hurdles), the high ones (down vote, edit, close, etc.) are the "strong community" ones.
Without dynamic sql, it is tough to do arbitrary (user-selected) columns, sorting, and server-side paging simultaneously (limiting the result set in the query instead of skipping through results in the app). SQL does not allow use of parameters in all the necessary locations in the query (result column list, order by list, etc.), and some databases are more limited than others.

There are options available as one or more of the above 3 requirements is dropped: http://stackoverflow.com/questions/149380/dynamic-sorting-wi...
I guess I don't understand. How does one go about writing an open API for someone else's platform? Won't that require support by that someone else who created the platform?

Otherwise, aren't we stuck with having to recreate Facebook, Twitter, etc. in order to write an open API for it? And therefore stuck requiring the adoption for the new platform that someone else's platform already has? Therefore "rolling your own" entirely in the first place?
Ben Venuto's Burn The Fat Feed The Muscle
Ben Venuto's Burn The Fat Feed The Muscle - Obesity may be a physical state that describes extreme excess fat. likelihood is you have experienced the worries of dieting no less than as soon as in your life, if you've got problems along with your weight. close to One hundred million People in america conserve a weight loss diet in almost any given 12 months and up in order to ninety-five Percent of them regain the responsibility they shed among 5 years.
Yes, but if i recall correctly, apple's patent claim is quite specific about dragging an on-screen picture across a visually represented path -- isn't that how google got around it in android? The neonode, on the other hand, doesn't look to have any visual indicator at all; it just uses a corner-to-corner swipe with nothing extra on the screen.

Also, it was the judge who said the neonode made it obvious, which seems wrong to me given the lack of mainstream implementations.

But none of this changes the fact that this patent is ludicrously trivial -- even if not obvious -- and should never have seen the light of day.
That's because world history in America is much the same as the world series - fully encompassing of the whole world, with countries as far afield as.... Canada :)

I should have mentioned I grew up and went to school in England, and learning the ins and outs of luminaries like Sir Issac Newton was part of history class.

To be fair, we only touched on American history, and obviously seen from the other side of the coin. We kicked out the religious pilgrims so we could get back to partying and starting the industrial revolution.
Well, it's hosted on the JVM, so, no, it probably would not be a good language to write an operating system in.

That said, Clojure is quite fast compared to Python, Ruby et al, but this is primarily a side effect of running on the JVM. FWIW, Java is even faster.
The size of the population from which the top race horses are drawn is orders of magnitude smaller than the size of the set of human track athletes. Thus in the Olympics, you're looking at specimens a few standard deviations above the mean, instead of only 1 or 2 in horse races, which means the very top ones are going to be significantly better than the rest of the competition.
Exactly. Companies are legally required to go public if they have >500 shareholders, which Facebook has had for a while due to investors + stock options.
They use RHEL too: http://linux.web.cern.ch/linux/rhel/

For offical usage in the context of Oracle production databases and eventually other applications requiring commercial support there is a limited number of Red Hat Enterprise Linux 6 Server, Red Hat Enterprise Linux 5 Server licenses available at CERN. For all other tasks standard CERN Linux distribution: Scientific Linux CERN shall be used.
Show HN: Hosted Graphite service (with statsd integration)
Can anyone comment on what sort of software they use for collecting and analyzing this kind of data? Python+numpy? Matlab? Gnuplot? In a past life I was a neuroscientist, and although you could theoretically do experimental neuroscience entirely using open source tools, almost no one does in practice.
100 Riffs (A Brief History of Rock N' Roll)
Sharing data links in networks of cars
I disagree with you. You start ignoring the refresh flash and it is not distracting at all once you get used to it. Really the fancy page turn animation does not add any value to my reading experience. I would care less. What I care about is I can read my book outdoors in bright sunlight and go without charging for a month. And, my eyes don't get tired after long hours of reading.
That is an important point. The law varies across states. Some states are two-party consent states for audio, and some are single party. Courts seem to be allowing exceptions for recording where there is no anticipation of privacy but, if I remember correctly, stealth recording can tip back towards illegality in some places.
And steroid after steroid has gone through similar processes; there is a reason there are still world records from the 80s East Germany and the Soviet Union. In less obvious advantages we have dietary supplements, training at altitude or in altitude chambers, biomechanical analysis and direct muscle stimulation. Every athletic competition is a balance between what technology gets through and which doesn't. Most olympic athletes are already genetic outliers; I'm sure sooner or later gene therapy will become a major issue.

The idea that athletics is purely a competition of body is a convenient fiction, nothing more. It seems a shame to me to exclude people simply because they challenge that fiction.
The Trouble with Khan Academy
good point. it'd be nice if more features were options, and not necessarily requirements. it would probably simplify things, at least.
Public defenders usually produce better outcomes than private lawyers, the exception being private lawyers who were once district attorneys or public defenders.

Public defenders get a bad rap because most of their clients are--get this--actually guilty of the crimes they are charged with. The vast majority of defendants accept their guilt and are unwilling to pay thousands for a private lawyer who will not produce a better outcome. For these defendants, the public defenders are merely there to make sure that their rights are protected (at this point, usually procedural rights, i.e., due process).

A lot of the remaining clients go to trial simply because they can without having to pay for it (i.e., go down fighting). These clients have no chance of winning (multiple eyewitnesses, caught on video, caught with the goods/drugs/weapons, DNA/fingerprints, unsolicited confessions, etc.), but the public defender goes to trial anyway because that is what the client has demanded. (Private attorneys would simply inform them that their rates for trial are usually double their standard rates; at this point most clients either switch to public defenders or plead out.)
Anyone doing a startup in embedded systems?
As I understand this site is mostly visited by webdevs and most of the projects sponsored by YCombinator are web startups.

I am more into embedded systems and wondering if anyone is doing a startup in embedded systems? If so, what are you doing and what has the process been like(how did you get the idea, how did you proceed, finances etc)?
Not "we looked at the video", but "here, take a look at this video". Don't trust the police to self-determine if they're at fault.
Money can't buy me performance
Correct me if I am wrong, but I believe if your application was designed to operate across multiple 'regions' your app would have indeed been safe from this failure.
I think entrepreneurs are drawn to the US simply because it is the biggest economy. The corruption overhead is just a cost of doing business, you don't pay, your customers do, you just have to account for it when you create the pricing structure.

I think Google is an exception, because it is a technology company. I would say the amount of corruption depends on the age of the industry and the vested interests, technology is so new it just isn't there yet. On the other hand, you have the financial industry and the big New York banks. The SEC is bought and paid for, they will never prosecute one of the big banks, and a judge will never rule against them either.

One of the most interesting stories is Martin Armstrong (perhaps the only person in the world who actually understands how the global economy works imo) who was held in contempt of court in jail without trial for like 7 years because the government wanted to silence him.

In the US you won't really see the corruption at the lower levels, but the higher up you go, the more corruption you will find. The corruption is hidden and more sophisticated. The real corruption occurs at the highest levels, behind the curtain. Governments are simply tools used by those who are really in power. It's more profitable to make your competitor (unknowingly) become your economic slave than it is to put them in jail.
The whole notion of preventing unfair technical advantages in the Olympics is outdated and stems from the fundamental attribution error [1]. The competition is no longer primarily about the athlete but about the level of training they have access to and the size of a country's pool of healthy candidates to select from. Industrialized nations win the majority of medals [2] since they have a large healthy population to select from and they can afford to train those athletes and provide high quality equipment. Discriminating against Pistorius would be as bad as discriminating against an Olympian because they were rich enough to afford expensive coaches and equipment or banning Michael Phelps because he won the genetic lottery which gave him his body structure.

It makes sense to ban certain performance enhancing methods such as illegal steroids because they have severely negative side effects, but the Olympics would be more fun if the rules were much looser. Let all the athletes have the best training and equipment their sponsors can afford. There is little difference between technology that reduces disadvantages such as lighter bikes or shoes and technology that enhances advantages like low drag swimsuits or cybernetic legs. Unless we want to genetically screen all our athletes to make sure they were not born with any advantage and force them to use the same training program and equipment, we should stop trying to compensates for advantages and disadvantages and just do whatever results in the best entertainment.

[1] http://en.wikipedia.org/wiki/Fundamental_attribution_error
[2] http://en.wikipedia.org/wiki/All-time_Olympic_Games_medal_ta...
Honestly, all malware "isn't really that bad" by the metrics you're using. Maybe it sends spam. Maybe it hogs your CPU. A few will crash your machine or break it in some obvious way. This one happened to steal your personal data (and attempt to steal that of your contacts').

You're right though, that it's basically exposing a hole in the OS security metaphor. Two really: the address book was unprotected and the application review process didn't work.
Has this been something you have found in practice? Or just theory/fear you've developed? I would think tools like sqlmap are helpful in building that initial recon/inventory of items to explore. You should still be doing the due diligence of manual exploration. I suppose if one were to get lazy and stop doing the manual exploration, and just let the mapper tell them where to look, it is most definitely true. However, people can get lazy without automated tools, and fall into the same trap.
It would be a controversial step to write an OS without a type system.
By "university events" I'm assuming you are a student.

Even if that is the case you should reveal more publicly who you are (fn,ln). You are selling a personal service and people will want to know who they are dealing with. You are selling yourself. Even if "yourself" is just starting out.

(Separately you should also get pitchrejig.com and if at all possible remove the whois privacy on your domains some of us check things like that..)
The story neatly illustrates how the patent system doesn't really benefit inventors and instead benefits well established corporations.

And Carmack was against patents before that even, and what is more, even after that he refused to patent any of his work, not even for "defensive" purposes, just out of principle.
GradientFinder - Convert An Image To CSS Gradient
Would you consider it a perfectly good procedure to run some automated tests against the web app and glance at the results? It's only a problem if you use those results as the focus of your investigation, right?

What it seems like you're saying is that you have found that scanners are almost always a distraction at best, misleading at worst, and that they offer zero useful information about the app or about the MO of the app developer.

You (matasano) are good enough that any information those scanners could reveal about the app or the developer, you'd probably turn up independently. Not everyone has those skills, and the results of a scan might include something that a lesser practitioner wouldn't have noticed any other way.
Sounds like a good business idea, IMO.
With so many apps some may slip through the review process, but they can be remote wiped, unlike side loaded apps.
Very true, but that actually validates my point- how many amputees actively strive to participate in the paralympics? I would estimate that pool is smaller than all the horses being raced, meaning his accomplishment of beating other racers is even less significant.
> Many inputs to query construction can't be parameterized.

I do not allow the client direct access to the database. They access the database through objects, which have methods that only permit parameterized input.

The client cannot specify the database, table, or columns. That is hard-coded. They can only specify values. Values that are always entered through a prepared statement.

In that scenario, isn't injection impossible?
I disagree. The way I see it the 7" form factor is big enough to be a pain in the ass to carry yet small enough to be useless for most tablet stuff I'd actually want to do anyway.

In my opinion, a mobile device should have a keyboard big enough for me to type using ten fingers, or it should fit in my pocket. Using something in between baffles me.