skysight-inc/HackerNews huggingface dataset:
Simple patent sending paper-based communication that is enveloped in a paper casing.
You can pass a hash (dictionary) to represent kwargs in Python.

This seems like bad engineering fundamentals in the design of ActiveRecord for it to be perpetually subject to this sort of thing.
"You should be doing that anyway."

A huge selling point of Rails, other web frameworks, and ORMs in general, is that you don't have to be doing these checks. You can push the query through without concern of SQL injection, and handle the failure case there. This is convenient because you often have to handle that failure case anyway.

Rails' own "Getting Started" guide uses this technique because it's assumed to be secure:
http://guides.rubyonrails.org/getting_started.html#showing-a...

We know you can "break" the application by tampering with IDs, but you shouldn't be able to pose a security threat.

Validating type and data ranges is common with things like dropdowns, where you need to ensure an actual option was selected. This is a very common security flaw, and it's definitely good practice to be checking (especially when it leads to adding/updating database rows).
I've been using a Lumia 710 as my primary phone and like it quite a bit. I still haven't decided to upgrade to Win Phone 8 though, as I like the smaller size of the 710 quite a bit, and the apps that I have are working well for me.
Does anyone know of a patched version of rails 2.3 series on rubygems?
SQL injection is the web-equivalent of having a stack allocated buffer overflow. We have built and use (expensive) abstractions that supposedly eliminate these whole class of issues.

With Rails, you get the expensive abstraction and apparently none of the security.
GreyCoder: How To Be Anonymous and Private Online
Well, then there is an opening for a site that allows you to see the discussion index without creating an account.
Which one? Twitter/Rails or Facebook/PHP and why not?
Should I care? If I am designing a system that requires only a full legal name...then it depends on the law of the target region. If it's for almost anything else...I'm not going to waste my time unless there are more than a few complaints.

My entire point here is that if it's really important to the system being designed, that the correct answer will occur to you naturally. Honestly, if we design a system that requires full legal names and we don't look into the laws of the target region, then we're probably not too bright.
Update the version in your project's Gemfile, and run "bundle update rails".
Measuring metric adoption by counting countries with official adoption is common. Less common is measuring by aggregate PPP-GDP and actual adoption by the public. To approximate actual adoption, I give the US, UK, Canada and Jamaica completely to traditional units and the rest of the world completely to metric.* Using 2011 data from the IMF, I then conclude that traditional units command 31% of usage worldwide.

* These are the countries in red on this table
http://en.wikipedia.org/wiki/Metrication#Chronology_and_stat...
But a review of the UK article shows that the language "partially complete" is pretty fanciful in describing the current situation in the UK. The story in China is more complex...
This won't work. The old version won't be purged, and it'll still be referenced in the Gemfile.
Surely, though it's worth noting that education campaigns and research are financed with both tax dollars and cigarette company settlement money (from a large lawsuit many years back).
Love the recruitment video!
This is us :) http://perfectaudience.com

Really terrific to see folks appreciating the time we spent slaving over the billing system and trying to make it not completely suck.

If anyone on HN is curious about retargeting, especially on Facebook, where low CPMs are plentiful, drop on by!
Yeah, very impressed with their API documentation and example building tools. As an API publisher, it's an excellent product.
Facebook is the top social network in 127 out of 137 countries
Wow. Hahahaha. The author of this Forbes article must be a web developer to have such an amazingly low opinion of Microsoft.
Or he lives RIGHT on the edge of a timezone ;)
This won't work if your Gemfile declares a version of Rails (Rails 3.2.9 did this). You have to update the Gemfile and then bundle update.
I think both WP8 and Windows 8's problems are that they are mostly beautiful "skin-deep", and that it mesmerizes you a little with all its different colors and animations. But once you start using them for a while you get frustrated with the lack of OS functionality, lack of apps, or even the OS interface itself, which wastes a lot of space for stuff, and doesn't make stuff as clear as on other platforms. Sometimes it's difficult to even realize what you're looking at or what you have to do, because the symbols and identifiers are so simplistic.
Fun playing background patterns. Can change color, size and rotate.
LG finally selling first large-screen OLED HDTV — for $10,000
eat more goji berries </sarcasm>
500 Startups Launching New York Co-Working Space
Nice! Some good information here. Good for beginners, good for intermediates, some expert will probably say it's good for them too.
I've got a Lumia 920 and I'm a bit disappointed with it. I don't know if this is a programming fault or something wrong with the OS itself but the best apps I could find for reddit and HN cut off text for story titles. This is a serious issue for me because these apps constitute 90% of my phone usage throughout the day. I also have problems with web pages not rendering at all (probably the web site's fault but still). Also, the phone is really heavy and not comfortable to hold, with the buttons on the side always getting pressed by accident, especially while reading. The only thing I like is the eReader I have, but it's not quite as good as Aldiko was on my Droid Incredible. I'm going to stick it out because I'd like to try my hand at developing for it.
Square’s Senior Product Designer returns to Black Pixel
ConTeXt is probably even better if you're doing lots of layouts and inline figures, sidebars, etc.
You mentioned it a bit, but I want to make it clear that, even if you don't use 2.7, you can still count by doing:

from collections import defaultdict
counter = defaultdict(int)

There is a difference though, because you have to count manually, i.e:

for i in 'supercalifragilisticexpialidocius':
counter[i] += 1

Also, because defaultdict accepts any callable, you can have a dict of counters by doing:

counters = defaultdict(lambda: defaultdict(int))
for word in ['apple', 'berry', 'grape']:
for letter in word:
counters[word][letter] += 1

This is not very obvious, so I don't use it a lot, but sometimes it's the most elegant solution.
> This is what makes them great Q&A sites, but also makes them relatively ill-suited as discussion sites.

Are they actually ill-suited to this sort of discussion though? Most of the closed discussions like this that I have seen have actually been very good. It seems like they are closing these discussions because the site wasn't designed for it, but not because the site is bad for it.
I bet you have fun with the TSA.
The getting started guide does not use that technique. It uses `Post.find(parms[:id])` The vulnerability is in `Post.find_by_id(params[:id])` and any other `find_by_*` dynamic finders.
No serious company wants the responsibility of bricking someone's smartphone.

Where it would get interesting is if they introduced this as a UML guest Android app.
Yes, the article does mention session secrets. However, this exploit does not require session secrets. The person who wrote the blog post wrote about essentially two vulnerabilities: session forging and SQL injection.
I’ve often pondered on why capitalism doesn’t work the way it’s supposed to when it comes to reallocating resources. ... A no-longer useful business should release its capital back into the marketplace. But institutions formed during their useful phase never seem to go away voluntarily.

This is a shallow and misleading characterization of capitalism and Microsoft's current place in the economy. To pretend that Microsoft is no longer relevant just because their mobile phone and Windows 8 haven't been successful is just lazy journalism. Look at how much software still runs on Windows machines. Microsoft software runs the modern corporate desktop and that will not change for a long time.

Does Microsoft have challenges? Of course. But to pretend like they should be wiped away because of a few bad years is the argument child makes, not a journalist.
Blue boxing predates 5ESS switches; 5ESS was notoriously the switch you couldn't blue-box.
I really believe that expressing gratitude every day has a positive effect, so much so that I made a clojure-based site, http://gratefulplace.com/ (and wrote about the code at http://www.flyingmachinestudios.com/programming/dissecting-g...).

For the past year I've spent a few minutes every morning thinking about what I'm grateful for and it's had a big positive influence on my life. I'm definitely happier.
Holiday 2012 Delivers Historical Worldwide App Downloads
> You can pass a hash (dictionary) to represent kwargs in Python.

Eh, sure but you need to explicitly pass the dict as a kwarg with a double-asterisk, or else it's just a normal positional parameter.

In Ruby prior to 2.0, there is no formal concept of kwargs, so there is no distinction between passing a Hash as the last positional parameter and passing kwargs. This is the root problem, and I look forward to it going away when everyone moves to 2.0.
Fast as in did so two years ago?
Odd, navigating to that URL simply returned the word false as the page content.
you have to have a more nuanced approach to intellectual property than 'Burn down the House'

(Shrug) The house will either burn down, or it will fall apart due to shoddy construction. Better to get it over with sooner than later, so the land it stands on can be put to better use.
I'm sorry but this is braindead. I'm sure there are valid use cases but optimize for the most common one: find_by_id accepts a single argument, the ID of the object you want to find.

That is why Python has kwargs. Those two stars stand out like a sore thumb and when you are passing positional arguments in the form of a hash it is pretty apparent.
You are going to have problems with this whenever you are composing SQL statement with any type of user-provided data as part of the raw SQL string passed to the server.

This generally happens in one of two says:

1) (most common) You have a SQL statement that takes a user-provided parameter and you compose your SQL statement as a string, including that parameter (eg., sql = "SELECT * FROM person where id = " + form.id, or similar). This is typically solved by using parametric, prepared statements. Basically, you prepare a SQL statement that contains "?" for the parameter values and then bind values to the statement.

2) (Common in ORM frameworks) A user provided string is used to compose some other (non-parameter) piece of the SQL statement, such as a column or table name. This is usually caused by laziness. Rather than combining the string provided by the user (form values, URL components, etc.) you should instead look up the string to use from some internal data source, such as a list of domain classes, etc., and use that instead. In that way, the data that is user provided is kept entirely separate from data that will be executed.

You'll hear a lot of people talk about "why isn't this being escaped". And, frankly, it's a good question. But the real question is "why are you trusting data that could come from anywhere on earth?". Don't take it for granted that only your users will be sending queries to your application.

The code you write for Django (Post.objects.get(pk=request.GET['id']) is only secure from 1 and 2 if the framework is written in an appropriate manner to avoid trusting user provided data.

The fact that this keeps happening on Rails is the #1 reason I haven't bothered to take the time to do anything real with it. I don't have the time to read the code for the framework and I don't trust that it's written with security in mind.

ps. This type of problem applies to any kind of "data that is executable", be it strings passed to an "eval" function or strings passed to a web browser. SQL is just a giant eval() function.
the ORM escapes the parameter but it lets you specify bits of SQL by hand (think "select foo, myfunc(bar) as BAZ, joineds.quux as quux").

In theory when you do that you have already given up on letting the framework handle it for you, and you must take care of not feeding raw user input as the select code, for example.

The issue here is that the option to do this is exposed in a functionality where people do not expect it (dynamic finders) and thus people may be passing risky input there.
Very fascinating find. Having just finished reading Empire of the Summer Moon, I would not have wanted to be anywhere near the Southern Plains areas in 1857.
Strongly argued but wheres the credibility for forbes when they have another article from a few days earlier that takes the exact opposite view:
http://www.forbes.com/sites/edzitron/2012/12/28/windows8/
Microsoft: Top 5 Security Threat Predictions for 2013
The param keys remain strings underneath.
Haw Haw!
I don't fly much. When I have, it's a brief conversation with the TSA supervisor, followed by the miracle of flight.
This pull request is probably what caused the alarm:
https://github.com/binarylogic/authlogic/pull/341

With 3395 stars it seems to be a quite popular.
Am I the only one who almost literally vomits when I hear the phrase, "gratitude journal"?

Maybe it is just me, and I'm some kind of happiness hating troll (I really don't think so, though!) but there's a certain point at which I feel like a person keeping gratitude journal is trying to stave off a deeper and more problematic depression that ought to honestly be addressed with more serious activities besides writing down what you're grateful for every day.
Interesting to see such an amazingly positive article on the front page at the same time as the scathing Forbes piece. I wonder if that's really a coincidence.

http://www.forbes.com/sites/rogerkay/2013/01/02/microsoft-is...

Since most of these revolutionary systems aren't available as actual products, I have to assume that Microsoft buys people and ideas mainly to keep them from interfering with their monopolies.
The problem for a newcomer to an established market is that you cannot be just "something new", you have to be 10x as good or compete on price.
I hate to be that guy but what about dictionary comprehensions?
You, sir, have raised pedantry to a level I've never seen before on HN. But I'm not afraid to be servicy, so let me retroactively preface my remarks with the qualification that they apply only to members of the living, and not members of the dead and / or other residents of any spirit world currently known, or waiting to be discovered in this universe or any other.

Separately, I don't know why you're interpreting remarks about people around the world who are buying tools that improve their lots in life with "manifest destiny" which was a religious justification for the genocide of Native Americans in the 19th Century. For a guy so concerned about the meanings of precision and accuracy, this interpretation is hilariously devoid of either.

But please, feel free to elaborate.
Ruby does not yet have kwargs, but the upcoming Ruby 2.0 has a form of them.
Anant Agarwal: What it’s like to teach 155,000 students online
There's no avoiding Google+
All highly commendable projects.

There's no exit strategy, though, so VC aren't interested.
It's exhausting just reading this.

Obviously since you're here wasting time typing out long comments you don't take your own advice.
Yea I'm not seeing it either. Maybe if someone explicitly called `params.symbolize_keys!`? If that's the only time its vulnerable it seems like less of a big deal, though still obviously something that should be patched ASAP.

edit: Above sandstrom posts the link to https://github.com/binarylogic/authlogic/pull/341 so I guess maybe you can use the session to do this, though you would need access to the secret_token.
Well, if the product's manufacturer has licensed the patent, then the "exhaustion doctrine" generally keeps the patent holder from taking a second whack from people who bought it. That's what ordinarily shields end-users of consumer products from this kind of nonsense.

If the manufacturer hasn't licensed the product, though, the users may well be fair game, in the eyes of the law.
Why Did A Train Carrying Biofuel Cross The Border 24 Times And Never Unload?
You know a guide is good when it makes you want to go back and refactor old code. Great information, thanks :)
> That's assuming you have a method to unlock it, you can't always necessarily count on that.

For a long time, we couldn't count on video cards or sound cards being compatible with Linux either. The Linux community just shared information about which computers were most compatible, with the most open hardware, and we bought those devices.

The same thing could happen with phones. Even without being installable on EVERY device, surely some of the manufacturers will stick to fairly standard hardware and the Ubuntu community will see to it that the drivers and unlocking tools are there. Not everyone will be able to get Ubuntu on their phone, but the community can still thrive.
I believe this could all be done with a single CONCAT. Looks like author is unaware that you can CONCAT(param1, param2, param3, ..., paramN)
Every magazine should have a strictly enforced editorial line and quash all diversity of opinion.
http://redis.io/topics/virtual-memory

It used to exist but has since then be deprecated. You can read Salvatore's thoughts on this exact topic here: https://groups.google.com/forum/#!msg/redis-db/IiJU0COilYc/Q...
Patch is quite small, here are the tests:

+ def test_find_by_id_with_hash
+ assert_raises(ActiveRecord::StatementInvalid) do
+ Post.find_by_id(:limit => 1)
+ end
+ end
+
+ def test_find_by_title_and_id_with_hash
+ assert_raises(ActiveRecord::StatementInvalid) do
+ Post.find_by_title_and_id('foo', :limit => 1)
+ end
+ end
+

I can't understand how it happens with real params, though (they are converted to hash with indifferent access internally).

Example (real rails app):

1.9.3p327 :017 > Forum::Thread.find_by_id_and_forum_id(1, {:limit => 10}.with_indifferent_access)
ArgumentError: Unknown key: limit
[backtrace skipped]

NOTE: I originally posted (and quickly deleted) wrong answer because I looked up another CVE. I apologize if it confused anyone.
This seems like a great excuse to pimp my startup! http://Beeminder.com is a goal-tracking tool where you have to keep all your datapoints on a "yellow brick road" to your goal or we charge you (actual money). It's less perverse than it sounds though -- you can think of it as a fee for a service that happens to be waived if you never actually needed its kick in the pants.

It's perfect for things you want to commit to doing daily. In fact, it's all about that, as opposed to StickK which is not so data-oriented and just has weekly reports.

Our litmus test for whether you should beemind things like in TFA is:

1. How certain are you that you *want* to do this?
2. How certain are you that you *can* do this?
3. How certain are you that you *will* do this?

If your answers are "absolutely", "definitely", and "given historical evidence, not entirely" then you'll probably think Beeminder is super great.
I'm waiting a few years. I think eventually they'll get it right. With every update, they're slowly fixing and improving things.

I'm using OS X, and I love it. But I think Apple is going to fuck it up eventually, somehow. And hopefully, by then, Ubuntu will be a good choice.
I don't understand the diversity of their products, it seems like a lack of focus, and driven by a fear of missing out on the Next Big Thing.

I think they should focus on 2 products:

1. Office software: have clients on ALL popular operating systems including iOS and Android, and move as many customers as possible to Office 365 and Outlook.com (and move that to Windows Azure).

2 Windows operating system(s): that would be desktop, tablet and server including Windows Azure, not sure if Windows Phone makes sense.

Spin off Xbox (and related Kinect products) as a separate company. It's a strong enough 'living room' brand, and I doubt if customers really care that it's a Microsoft product.

Make technology from devdiv as open and easily accessible as possible. E.g. give the drugs away for free as in beer, and also free as in freedom where it makes sense. Ultimately, this should drive adoption of products 1 and 2 listed above, and that's where Microsoft should be making money.

Not sure what to do about Bing. Google needs competition, but I'm not sure if Microsoft is the right company to be doing this (search engine, maps, pushing ads). Is it profitable? If it's not by now, then when are they going to take their losses and quit that game?
My point is that London is the south east, by bringing the erostar round to north London it is easer for the whole country to use. There is probably an argument that they should have a station in South London but the Erostar is there to cater to the whole country, not just london.
To continue the metaphor, it seems that in their mission to make the meal taste better for the customer they neglected to clear the poison.

Lets not pretend that Ruby/Rails doesn't make major architectural decisions in favour of ease of use for the user.

e.g. if HTTP params weren't automatically marshalled into non-string data structures this bug wouldn't exist.
So tell me, is two names United States, or any US state's law, or is it just a common assumption?

Do programmers routinely look up the law for common assumptions? I'm guessing no.

And by the way, the tone of your responses in this thread is the first time in my years of HN participation (under various user names) that I've wished for a plonk file. Everything you've said has the core of a relevant argument, wrapped in condescension.
Personally, I believe part of the problem is the artificial barriers to platform adoption that Microsoft continues to insist upon. For example, Windows Phone 8 is basically a good platform. But there's no support for OpenGL -- the graphics interface of choice in the mobile world today. If they wanted more "apps" (games) for the platform, then choosing to support OpenGL would have been a sign they actually care about that.

There's also a bit of "not invented here" going on. They could have embraced and contributed to webkit, and made the web better for everyone, instead they wasted millions of dollars recreating what someone else had already done in IE10 and then limited IE10 to the newest of platforms. While I'm not suggesting that they slavishly follow what everyone else does with webkit, they could have at least used it as a base and contributed meaningful changes back.

And finally, yes, as a Windows 8 user myself, I can tell you that while the underlying OS is clearly loads better, the Modern UI is a mishmash of UI ideas with razor-sharp usability edges.
The biggest favor Apple could do their users is simply to provide a silent ringtone option, so that users can leave their ringer turned off while 'whitelisting' the appropriate contacts.

It's simply staggering that this has apparently never occurred to anyone at Apple. The cheapest feature phone in a bubble package at Radio Shack supports silent ringtones -- or at least it did a few years ago -- but with the iPhone, the user has to record or purchase a track with several seconds of silence and create one manually.