skysight-inc/HackerNews huggingface dataset:
The last Rails SQLI vulnerability was mitigated by the way ActionPack parsed request parameters, so lots of people dove into that code to see if the mitigation could be evaded with JSON or XML. That gave people incentive to review Rails XML parser wrapper class. The problem with that class is pretty obvious.
Diversity at it's shallowest?
From the rubyonrails-security list:

https://groups.google.com/forum/#!topic/rubyonrails-security...
Suggesting people he'd never interacted with in any way (who, mind you, ended up not being the responsible parties anyway) be fired wasn't a valid critique of much of anything.

And I don't think that registering that Dustin was "astounded" that the designer he received the email from had a good portfolio or only admitting to having been "partially wrong" with respect to the firing comment was particularly cordial or respectful, either.

I agree that the whole debacle reflects -much- more poorly on AA than on Curtis, but his conduct wasn't beyond fault by any means either.
I just realized that Svbtle is like TED or TEDx for blogging, and those have been very successful.
...and then the boy will be forced to live under a bridge:

https://en.wikipedia.org/wiki/Julia_Tuttle_Causeway_sex_offe...

Then again, this sort of treatment of children is not really a new practice:

https://en.wikipedia.org/wiki/Child_sacrifice
I don't think it's pedantic. Libraries are full of things that have yet to be digitized, and much of the digitized content they do provide access to requires a subscription and may not be indexed by search engines. I don't think most people realize how much information out there is not accessible online, so it's worthwhile to point out.
Awkward Family Photos
I'd guess multiple people working together, or multiple people who got hit by someone exploiting it in the wild.
https://github.com/clojure/clojure/blob/master/src/jvm/cloju...
I think people went looking for ways to exploit this vulnerability and ending up finding this vulnerability.
Funny, I was just thinking about this the other day in the context of why it's seldom mentioned when various parties heatedly discuss environmental issues. Seems like the earth literally being on fire would come up more often in rants about needless greenhouse gas pollution.
> why isn't there more of a focus on security here?

More compared to what, exactly? This vulnerability was responded to pretty damn quickly after it was reported, given that almost nobody is even paid to work on Rails. If you saw Aaron tweeting about "working over the weekend" a few days ago, well, now you know.

That said, you mention attr_accessible in your post: that's gone as of the next release of Rails. Basically everyone agrees that strong_parameters is a better approach, which is why a gem was released that works with 3.2: you can use that better approach now.

As was mentioned below, security is a process, not a result. Nobody wants these kinds of issues to happen, but they will happen, and do to every single framework that's used by lots of people.
I'm in a similar boat. I've just began with Rails in the last six months, and I've really been enjoying it. These vulnerabilities are unnerving but I am comforted by the visibility of the announcements. The community seems to get the message out very quickly when an exploit is found/patched.
My entire Twitter feed is filled with Rails developers telling others to upgrade immediately, and HN has multiple new posts about it.
I read about startups and the entrepreneur life a lot, but is it realistic?
I'm just your average guy in a Network Engineer role, 9-5 etc, but I'm becoming increasingly dissatisfied by the post-industrialist working world, and how it sits with me. I don't want to work for a giant company that pivots slowly and has masses of red tape, but it seems like it's impossible to find a job (especially in New Zealand) at a start up. Your only real option is to create a start up, but how does one do that without money? Whilst being in a tiny country?<p>It's motivating and discouraging seeing all these posts about companies raising funding and doing all this great stuff, when I'm stuck in a 9-5 job that feels like I'm doomed to be stuck in for the rest of my life to be "comfortable." It's depressing, I don't want to be comfortable, I'd rather do cool shit, but where does one start?<p>There are plenty of motivational posts from start up founders along the lines of "just do what you love" and "quit your job, follow your dream" but this doesn't really seem realistic or even explain anything useful.<p>HN, how do I break out of the comfortable life before it's too late?
Rails 3.2.11, 3.1.10, 3.0.19, and 2.3.15 have been released
batgaijin posted the article link http://www.telegraph.co.uk/travel/travelnews/6531610/America... in this comment http://news.ycombinator.com/item?id=5028019
This is a straw man.

These kinds of issues are open to all software.

I'm happy you work in the kind of place that audits all of its software, though. I'm sure you've all read through all of Hibernate, Spring and not to mention all the .NET framework code.
once Google decided to do Games, it needed to do them right

I don't see any support for this assertion. When was this decision taken? How many people were allocated to this "need" and for how long? Google has a vast services portfolio and a vast user base. Rather than spending cycles on a complicated area that is not a core competence, why not leverage the many services that people already use to drive interaction with G+? (Which is what Google has actually done, so far as I can tell from the outside.)
That also suggests that if Svbtle were to find its way into something good, Curtis may not be seen as essential to ongoing success, whatever that may be. It's founder as catalyst, rather than architect, making it more like Twitter, less like Apple.
"TDLR: if you want to fix a problem, expose people to the consequences of their acts."

I think you missed the past century:

https://en.wikipedia.org/wiki/Drug_prohibition
"Never, Ever Compromise on culture fit" works both ways. When I'm looking to join an organization, I see if exploitative crazy long hours are part of the company culture. If they are, we aren't a fit.

I've moved so far past thinking that long hours are a good thing that arguments for that kind of culture feel like arguments for the geocentric solar system. It would be cute if it weren't so sad.
Makes perfect sense. Thanks for pointing this out.
I don't think this is very responsible of you. You should post this, but you should really wait a week or so.
This is my favourite response: http://arstechnica.com/features/2012/10/can-you-fix-my-windo...

My personal best is 2 calls lasting just over 40 minutes. I was bored at the time and curious about their methodology. I was really impressed by their professionalism and technically competent scare tactics.
This battle is about sex, but make no mistake, the war is about bullying.

The people who are doing the "shaming" are almost certainly exploring their sexuality as well (and probably see nothing wrong with it), but that's not the point.

The point is that they are bullies and they will use anything they can to help them bully others. It is just convenient in this case to use society's taboos around sex as a tool to bully this particular person. The bullies are smart. They know what buttons to push. If we lived in a society where everyone was comfortable with sex, bullying would still be going on, but it would just look a little differently.
No, it was discovered by multiple teams independently, and not from exploitation in the wild.
I don't want to come across as rude, but I am fascinated how easy people are buying into these numbers. From my perspective the survey is in its current form far less informative than the original anecdote.

There is absolutely zero information on the data source he or Survate was using. The population seems to be selected based on the single factor age - meaning they might be getting the data from the easiest, cheapest accessible data sources available. In the end most of the responses could be coming from 30 y/o guys in India clicking on random answers to earn their 5c on mTurk.

In contrast to that, the original anecdotal evidence had the full story, provided the exact context on why and how the data was generated. But data without context is no data.
Please don't make comments like that here.
In the meantime, can you confirm that the disabling of XML and YAML inputs fully mitigates the RCE as well as the SQLi?
Not all of it, no, but some of it. (The whole point of concern trolling is that the two are indistinguishable, so you only notice something's amiss when you see odd patterns.)
Please do. Good writers like yourself can make a big difference right now. There's also the Clojure Doc project - http://clojure-doc.org/
In Lisp terms, however, a keyword is a self-evaluating symbol, a constant.

If it is a function, where it is defined and when?

That's why I'm arguing that this form is confusing, and that transformation is more correct notion, at least if people are insisting to call it Lisp.)
Interesting tool. This is something I normally do in a notebook (or a text file) so it wasn't like I was out looking for anything to replace that, but if this can add
value to that process I'm all for it.

One of the things I don't have in my home grown process but wish I did was a way to surface important but not urgent things periodically. Sort of along the memoize theme you need to keep the important things in your head even if you're not currently working on them, and having them surface periodically would assist that. I've had stuff get
pushed so far down in the stack that it basically submerges
until it becomes an urgent issue.
You are looking for answers on here that I don't think anyone can give you. You either want it so bad that you will do anything to make it happen or you don't.

For instance, I am at work 9 hours per day 5 days per work every week, I have a wife, two dogs and twin boys that are only two months old. I have a mortgage and car payments, student loans, yet I find the time to work on my startup every night.

Lots of people have told me that it's not a good idea, that I won't make any money with it and I just won't listen.

Hope that helps you.
Yeah, it seems odd that there are startups who know enough to do 4/1 vesting with a cliff, but also don't know enough to not abuse it this way.

The most unpleasant "founder disputes" I've ever seen have been in partnerships, not silicon valley style startups with vesting, and usually result from not having anything documented.

I'd be willing to say most "valley style" startups don't do this cliff-fighting options thing, which is why it's so astounding when it happens. Even what Zynga and Skype are said to have done wasn't outright "take stock away from someone right before a cliff since it has appreciated".
If you read the insinuator.net article posted elsewhere on this thread, you'll see that Java (Struts), PHP, and Python have all had their own remote-code-execution vulnerabilities over the years.
Please kill that red text on blue background, it's brutal on the eyes
Am I the only one that finds these deeply nested namespaces completely unusable?

https://github.com/symfony/symfony/blob/master/src/Symfony/B...

I thought the point of autoloading was to make things easier, not to replace require_once with something more verbose. Why should I have to import classes from within my own package?
>I was forced to download a torrent to hear the tracks.

"Forced", huh?

You don't have a right to hear the songs. Two perfectly valid options are to pay the going market rate on E-Bay, or to not listen to the songs. If Sony wants to produce a limited number of records such that it is prohibitively expensive for the audience to hear the songs, that is their right. You were in no way forced to illegally download their IP.
You could also deduce from the previous vulnerability disclosure or comments from rails developers who knew about the vulnerability that there was a way of generating symbols. This is how I found it. But there is still a big step from knowing about loading YAML to creating an exploit.
Delivering innovation vs delivering products
It would be nice if links you flagged would be removed from your view. It's sort of strange to have flagged something, come back the next day, and see an upvote arrow with the "Unflag" verb next to it.
I like the idea! One bit of knee-jerk feedback for you -- on Firefox (don't know about others), the "What our clients are saying" is moving really fast. Messages with longer text fly away before I'm done reading them!

If possible, I'd also like to see a simulated demo. "Watch users interact with your site" is very intriguing, but I'd like to see that in action, even before I commit to the first-is-free trial.

Edit: Expanding on that -- I signed up to see what the testing experience is like, and I see you guys have a stock website so you can confirm a tester account as legitimate. Why not take an example video from this process (one of yours, or maybe a tester's, with permission) and provide that as a demo so that people can see exactly what they'll be able to expect out of their site's review?

As an aside, out of curiosity, what's the point in having varied pricing plans if they all cost the same per unit? You have '5 for $50' or '10 for $100' or '15 for $150' -- why not just say "each test is $10" and let us choose the number of tests we want?
WH: We pick Cabinet based on qualification, not gender
The TV Business Getting Rich Off the Internet, Not Dying
I more than agree with your last paragraph.
I agree. I was really impressed with Dustin's blog where each post had a different design theme. I was hoping that svbtle would pull something more creative off. The network itself is fine but the quality doesn't seem to be better than my rss feeds. /me shrugs
No one seems to be mentioning the incredibly high usage of Tumblr in that survey. I have to say I'm really surprised.
This hits one my basic complaints about Rails: it activates too many features _by default_. Even if your app does not parse XML params, the parser is active. I know its convenient, but hey - is this worth the price of exposing _everyone_?
There are a lot of minimalist themes that aren't confusingly similar to Svbtle.
Please know that Rails is definitely very secure, and it has gone through many years of testing and review. However, no framework is immune. We should be grateful that the bug was found, patched, and notified, instead of being silently exploited by some black-hat who discovered it first.

The following is speculation, but keep in mind that this bug may have been found because the Rails team has been looking for security holes similar to the exploit that was found a few days ago.
The vectors for both are the same. The term "SQLI" here is very misleading.
turning rails up to 11..
Stop trying to find a system and just find a developer you like. Then send them an email. Try github to find some work you like??
Wow - that's commitment right there. I want 'it' pretty bad, but haven't found what that is just yet. Thanks for the feedback.
Oh yeah you mean women?
> As a simple solution, one could pass a signed auth-hash of the fields generated by form_for, and the server could re-hash the fields submitted to ensure the form data you asked for is what you get (this solves the primary issue with attr_accessible).

It does not solve the issue of javascript generated forms.
Motivation, Study Habits--Not IQ--Determine Growth in Math Achievement
Exactly.

ACH, wire transfers, etc. - it is amazing how much of our "modern" banking practice is still defined by the constraints of (literally) horses and buggies.

3pm cutoff times, overnight settlement, multi-day wire settlement ... what a clown show.
Analysis of Rails XML Parameter Parsing Vulnerability
True clojure assumes the existence of the JVM. However no other jvm language has gone with the language as library system which is a shame.

Also, I don't think anything would preclude non jvm hosted languages from doing something similar. I think it is a better solution than say virtualenv from python.
Just try to picture what the situation would be without it. And the sentences doesn't seem quite harsh.

OTOH, look at what Singapore did - it seems to have fixed their problem. The "mixed message" in the west about not prosecuting casual users in some place is certainly also not helping.

(and I'm saying that as someone who believe there is no point in restricting what someone may or may not inject in its own body, but if one was seriously against drugs, the current situation would seem like a feeble response to a real threat)
Ask PG: Are you still implementing/working on the "Feature Requests"?
In the footer of the main site pages is the "Feature Request" link [1]. I've submitted a few recently but I noticed today that the last comment that you seem to have replied to and said, "Done" (effectively) seems to be from about four years ago. I know you've implemented lots of features during the interim so I'm wondering if you could give us an idea about this page's usefulness to you.

Are you still using that list as a "wishlist" of sorts? If so, can you share any future plans from it?

Thanks!

[1] http://news.ycombinator.com/item?id=363
If you've recently started a new Rails project (or are thinking about it), you should use strong_parameters right off the bat!
I'm the author of the "Rails SQL injection vulnerability: here are the facts" blog post last week. This vulnerability is a different and unrelated one, and is very serious. Upgrade immediately.
Direct sync in 1Password 4 for iOS
As of October 2012, it's on EC2. http://status.fogcreek.com/2012/10/fogbugz-kiln-and-copilot-...

I don't know how many instances, or what size.
Lilliputian Nectar - USB 55000mWh fuel cell
Does this work with Savings accounts?
Well I account for respect on a personal level so the answer is me. Other readers may behave the same way, and they could also feel that respect is something which must be earned.

As for evidence, plenty of research has gone into respect and credibility, particularly as they relate to leadership.

http://scholar.google.com/scholar?q=leadership+credibility
Just ignore Myko guise. I've talked to him about his attitude. We're hiring a guy to replace him. Just ignore him for now. srsly. I know what I'm talking about. I ran a t-shirt company.
Using a raw repl at all is painful compared to just selectively evaluating expressions from a buffer (say, in Emacs, VimClojure, or the Eclipse and IntelliJ plugins).
Ask HN: Optometrist suggested wearing 'computer glasses'. Are they worth it?
The optometrist suggested getting a pair of 'computer glasses' with a slightly lower dosage than the prescription for the regular glasses.

If you wear them, have you found them to help reduce eye-strain and fatigue? Is there any medical research into the benefits of 'computer glasses'?

[1] http://www.pcworld.com/article/258302/gunnar_glasses_help_for_eyes_chained_to_a_monitor.html

[2] http://www.allaboutvision.com/cvs/computer_glasses.htm
Foursquare hackathon winners announced
That's fair, I suppose. Probably a good sign for you, though, as you mentioned re: controversy.
Sure, but as with all things, it could be turned off. The more I think about it, the more I like this idea. I may as well try it out and mock up a pull request.
At NextProof, we use BrainTree and ACH funds to our photographers. This looks cool but I'm trying to understand how it's different/better than what we do now.
if you have any production using rails version < 3.2.11 then upgrade to 3.2.11. You should not have to do anything else than upgrading.
Secret footsoldier targeting banks revealed
MUCHO LOVE, ALSO GORBY!
Upgrade instructions:

update your Gemfile and set the version you want. In my case:

gem 'rails', '3.2.10'

locally, run

'bundle update rails' which will update your Gemfile.lock

check-in and deploy your code. If you are using capistranso, the default 'deploy' task should handle everything for you. Otherwise, run 'bundle update rails' on your production server.
Instead of focusing on the tool we're using, the specific path we're following, look at the job for which you chose the tool, the destination toward which you're moving.

Introspection is a very useful way of analyzing the patterns our thoughts and actions take. Some people like to think while driving, others find ocean waves to clear their mind. For some it's their children, or a jazz song. Don't begrudge others for how they get there, just be happy you've both arrived.
The W3C Technical Architecture Group elections end today
The advisory also provides several workarounds that dont' require you to update Rails, all pretty simple ("drop a file into config/initializers and reload) which also work.
I've worked with other vendors. The rails security team is the best I've worked with. The major positives:

* Quick turn around. I have another vendor where it takes up to 3 months to get stuff fixed. :(

* They give you a patch to review before releasing publicly. This is very important and gives researchers a chance to fix any problems with the patch. With another vendor their fix missed a really obvious attack vector and anyone who diffed the code would have been given a free zero day vulnerability. :(
Excellent, I can give it to a friend who seems to use me (via Skype) as a proxy for StackOverflow.

He hasn't got the hint with lmgtfy links so I'll try a different tack...
got some good feedback from a few people on this for one of my sites. Wish there was a lower price point but was happy with the results
Getting continuous errors on deploy during the bundle stage like so:

/usr/lib/ruby/1.9.1/rubygems/remote_fetcher.rb:215:in `fetch_http': bad response Not Found 404 (http://bb-m.rubygems.org/quick/Marshal.4.8/activesupport-3.2.11.gemspec.rz)

Is this because rubygems.org is being nailed?
Presumably, they have some sort of funding system, where they can control/screen the intake and perform verification.
What is greed?

Every day startups and investors sit in a room asking "how can we make as much money as we can for as long as possible?" and they're celebrated on HN.

A big bad corporation asks the same question and is called greedy.

I don't get it.
"The government" doesn't mean that. My wife works for the DOI and their entire bureau uses Chrome and their government email and other services are managed through Google Apps, her cubical contains a typical locked-down Windows PC and a Red Hat workstation, the workstation runs Chrome and FF which are only as behind the curve as far as the stable releases are. I knew some guys who worked for NOAA as contractors who said they were pretty modernized as an agency too (running modern web servers on Python, vs the gigantic legacy J2EE apps I maintained during my stint as a government contractor).
Survata is a survey-wall -- meaning you have to answer a survey before you see a given article. They have about 20 publishers signed up, and they're all non-spammy content. Users are all US-based, which can be verified via geo-ip, and there's little reason for people to spoof that here.

I never claimed to have more anecdotal evidence -- the whole point is to try to validate the claims via some form of data collection. It was cheap and fast to do.
I've had an instagram since it started and have watched friends slowly adopt. It really seemed to be catching fire in the past 3 months.

So in my experience I've found that people follow me but because the tool doesn't very easily show if someone follows you back, without digging back and forth through your followers, it's very easy to just unfollow the friends who don't provide content I care about.

It's more similar to Twitters model of pub/sub vs facebooks 1 to 1 dynamic. If I 'defriend' on facebook it forces you to defriend both ways right? I think facebook has made attempts at fixing this with subscriptions but ...
Did you manage to generate some kind of EMP that affected the electronics, or did you manage to generate radio wave interference?
Aaron, thank you for all your hard work and making the Rails community fun to be a part of. ... upgrading now!