skysight-inc/HackerNews huggingface dataset:
Really? I was also one of the initial licensees and I feel like it's the most value over the years I've received for $100 ever. Even though I've never released a game with it, having a "real" game engine (warts and all) to play around in and try out ideas in code, and learning how to get stuff from a DCC tool into a real engine was hugely valuable. Also the fantastic support and community around the engine is unmatched (at the time, I don't know what it's like these days).

It's certainly not a "make game for dummies", it's hard work to get something built with any engine, but unlike a lot of "easy to use" engines, Torque ships games.
How Greg Yaitanes used technology to make HBO's Banshee
Rails Remote Code Execution Vulnerability
This is something that clojure got right before any other language I'm familiar with did.

You do not "install" clojure. You depend on clojure just like you might log4j or joda-time
Says exactly who, and with what evidence?
Multiple vulnerabilities in parameter parsing in Action Pack
IANAL but that would make it even worse, and likely lead to a lawsuit. Hostile work environment, or discrimination based on medical condition would be actionable.
One of the approaches my statistics books take is to include the numerical answers in the back of the book but have a separate guide for sale if you want to know why specific approaches were taken. By being an extra book, students who need the extra help pay extra for the time to compile all the extra solutions. This also keeps the cost low for people who only need a reference.
Patch right now.
"Posted Last Monday by Michael"[1]

1. http://codular.com/implementing-pagination
To emphasize:

> Due to the critical nature of this vulnerability, and the fact that portions
> of it have been disclosed publicly, all users running an affected release
> should either upgrade or use one of the work arounds *immediately*.
Note: the vulnerability in the OP refers to ActiveRecord and affects only 3.x. However, there is another vulnerability just announced for ActionPack:

https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...

This affects all versions, including 2.x
"1) Try to give everybody in the world free internet"

Because, of all the areas that is just crying out for free or subsidized internet, Chelsea, Manhattan, with a median income of $81,000 and less than 4% below the poverty line, is just at the head of the line.
I think most people separate Svbtle from Dustin, although I don't think Dustin necessary is advocating for this separation himself. You can see this in the comments. When people are being critical, it generally leans towards Dustin and not the product. When people are boasting Svtble, they rarely mention Dustin. There's a reason for that.

It was clear to most that Dustin was expecting adoration and when that didn't happen, the conversation changed.

I don't know how many tweets, posts and "thoughts" I read where Dustin was "abandoning HN" or laying claim to "the downfall of HN"[2], only to end up back here posting some other ego-laden[3] dribble.

"You're welcome", I believe is what used to be on the footer of Svtble. Really gets me thinking about how modest he is.

[1] http://news.ycombinator.com/item?id=3749035

[2] https://twitter.com/dcurtis/status/182986897444966402

[3] https://twitter.com/dcurtis/status/183394426914217984
New Rails Parameter Vulnerabilities: 3.2.11 released
Haiku coming to ARM
Ha! that is true. In my experience 'culture' means 'drinks microbrews and knows _all the memes_ '
from the article: "Because Sony has been considering some tracks on “The 50th Anniversary Collection” for its Bootleg Series, a program of archival releases that now encompasses nine multidisc sets, the company decided to throw a few dozen tracks onto the market, however tenuously, to ensure their ownership. "
So instead of one teenager who is embarrassed and emotionally disturbed, you'll have dozens who will go through life as registered sex offenders, constantly harassed by idiots who think they are child molesters, cut off from certain jobs, barred from living in certain neighborhoods, marked with the scarlet letter for something stupid they did when they were kids.

Did the police help solve our drug problems? No, in fact, they made society worse than it had been when drugs were legal; now we have teams of soldiers serving search and arrest warrants, all in the name of prosecuting drug offenses. Do you really want to bring that sort of chaos and mayhem into our nation's middle and high schools? Schools already have many of the characteristics of prisons; let's not make that any worse.
actually, lack of those buttons is a feature
This is bad, bad, bad, bad! SQL injections, remote code execution, DoS. Pretty much everything is possible with this exploit. You don't even need the secret key which was required in the previous vulnerability.

Upgrade NOW.
Zappos is a great example of doing this kind of thing. From anecdotes, it sounds like if you call Zappos to order something that they don't have in stock, they'll help you find a competitor that has it. There's some insurance companies that do this too. They'll help get you quotes from competitors. Amazon does this a bit too with their outbound advertising links. (Of course for Amazon there's still a direct monetary incentive)

Sometimes it's a great hook to help potential customers feel more comfortable doing business by giving them a good reason to trust you. You're doing what's right for them as a customer, not necessarily what's right for you as a business.
You're line of work sounds very interesting. I'd love to hear more about it!
True, they may not disappear completely, but they definitely get filtered out over time. And imagine you're 25 years old and someone wants to bring up old, explicit photos of you at age 15...they would immediately open themselves up to some very serious criminal charges. So I would agree that these are likely to more or less fade away into the recesses of the internet.
It is a contradiction for which no proof is offered (no, a reference to a quora post doesn't count, sorry). It is not consistent.

I welcome any proof on any direction (diversity of personal origins is good, divergence of company values is bad / diversity of personal origins is good, divergence of company values is good / diversity of personal origins is bad, divergence of company values is bad / diversity of personal origins is bad, divergence of company values is good)

Here, I just don't see any (except repeating politically correct clichés)

Facts are usually stronger than a doctrine, however sweet or morally "better" it may pretend to be.

If there are no facts, it's not even a theory but an hypothesis or worse- someone wishing the word to be a certain way while it's not (and getting burned in the process, and getting other people burnt too if they believe such claims)

I don't "want to believe" in anything - not on HN. I just want to see facts, i.e. anyone is free to advocate diversity, racism, sexism, whatever- but that person would better have some solid facts to back such claims.
An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced.

Here is the commit where it was introduced. https://github.com/rails/rails/commit/27ba5edef1c4264a8d1c0e...
This is bad, bad, bad, bad! SQL injections, remote code execution, DoS. Pretty much everything is possible with this exploit.

Upgrade NOW.
Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155)
Cohesive, insular cultures are more likely to suffer from group-think and to tolerate bad behavior.

This article seems like bad advice because when everyone thinks alike it's more difficult to spot and correct mistakes.
A 5$ one-time fee is way too low. Advertisers will probably outspend anything that isn't a proper monthly subscription.
Nope, these apply to the design of any building with a sink or a toilet in it. That's just the standards for the drainage pipe sizing, layout and design of pipe bedding and cover. To be fair, for a very simple building you can probably get enough information from a manufacturers website to get by, but then you don't know how much of what they are telling you is sales patter designed to make their product seem like the only solution to the problem. For example, there are more than 320 standards referenced in the domestic version of the Scottish Building Standards and while you don't need access to all of them there are plenty that are very useful to have access to.
2001:0db8:85a3:0042:1000:8a2e:0370:7334

That's the internet of things.

|2001:0db8|
|85a3:0042|
|1000:8a2e|
|0370:7334|

Or that, if you like squares.
You are a bank note.
> The reason that you won’t find yourself running `clj` often is that the REPL built into bare Clojure is pretty much garbage....

This is what rlwrap is for. Call `rlwrap clj` instead of `clj`, and you get all that and more (C-r, for reverse incremental search, etc). Works with every other REPL that doesn't bother to re-implement read-line.
Add to that family members, and you have pretty much the problem with Facebook currently (imo): focus.

Unfortunately, it's also the only thing Facebook pretty much seeks to avoid, in favor of making the most connections between users as possible.
It's has to orient itself in 3d space somehow. Wikipedia says the best you can get with dead reckoning drifts by .6nm/hr. I'm guessing that can be useful in some cases, but it probably limits a lot.
I agree that when it comes to anti-harassment policies in the digital age, schools have it tough. As you say, a lot of this is happening in spaces that are outside of the school's control and, sometimes, understanding about technology.

When it comes down to talking about sexual harassment, bullying, and how that interacts with someone's daily life, information about sex and culture are hugely important and relevant to young folks. Issues about consent, how you treat current and former partners, slut shaming, perceptions and stereotypes about gender with regards to sexuality, and about sexual agency are all a part of bullying via spreading of explicit pictures/video. These issues are tremendously important because many people do not have any basic information about any of these subjects and these issues shape the way they experience the world. The popularity of sites like Scarleteen show that there is a very real demand for this kind of information and sex education should include this information at a minimum.

I agree that what I mentioned isn't enough and that the situation is more complicated. We need to give people information and tools that empower them to control their lives and not let others control it, and issues of bullying and harassment are big issues in US culture today.
Oh you are soooo close.. And I'm not offended at all.

I like puzzles but I like this have some sort of relationship to real life if possible.. :)
Before anyone wonders if they're having deja vu, this is different than the SQL injection vulnerability that was discussed 5 days ago:

http://news.ycombinator.com/item?id=4999406
Valve unveils 'Steam Box' with Xi3, codenamed 'Piston'
New year, new look, new limits
True enough, but it's still not the place for stupid pun threads.
Systemic traffic jams caused by small groups of drivers, study says
trivia - PHPStorm's code-inspectior reports closing php-tag at end of file as code smell.
I was rather hoping for some more independent statistics, those links are all to posts on your blogs with your numbers but anyway let's take Tesco for example.

Tesco is huge in the UK but let's be very conservative and estimate that they have 10 million customers a month (in reality I expect they have more customers than that in a day) apparently 6000 of those are engaged enough with QR codes to use them which is 0.06%. That's not a very impressive statistic from where I'm sitting.
Thank you, that was my point. I admit that I wasn't thinking about the potential for the photos to live forever but also feel that 1) in all probability they won't live forever, at least not on the public, searchable internet given that they're illegal 2) If the article's purpose was to highlight that aspect then it did a poor job.

My reaction to this article is that it comes across as a continuation of a lazy, facile media narrative about technology and culture and kids that began with Geraldo Rivera, BBSes and Dungeons and Dragons.
This isn't a SQL injection vulnerability at all.
Every now and then someone will complain about it, usually after fat fingering on an iPhone.
At least people are getting practice at following security bulletins.
I have a 254 column terminal :-)

That said you will want to use code to analyze it.. You're very close..
An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with a new rails application without any controllers.

Here is the commit where it was introduced:
https://github.com/rails/rails/commit/27ba5edef1c4264a8d1c0e...
So if I understand the product correctly, I have to give you the money first, wait 3-5 days, and then I can pay people?

That's why there is no way to specify the source account?
My problem is that I delete many people, but I still have divides in groups: family, friends, co-workers, distant connections.

Separate accounts seems to really be the only option aside from trudging through heaps of menus to make lists. I had a list relegated to family/distant connections, however I can't for the life of me find out how to configure it again, or find it for that matter.
Not as serious as http://news.ycombinator.com/item?id=5028218 but still important to note.
This isn't really anything interesting unless you're a Dylan collector.

No boundaries of copyright are being pushed, no new faces of record label greed are being shown, there's nothing to even talk about really. It's just a major label releasing some work to opt into the 20 year extension on copyright in the UK. With out the words Bob and Dylan this is just normal, lame, day to day record label business.
This is awesome! So happy for these guys! GREAT solution. 1 million is just the tip of the iceberg. I'm sure they will have millions more.
Good god man! between the anglers (http://i.imgur.com/zTHuT.jpg), and the goblin sharks (http://i.imgur.com/40WP8.jpg) ... stuff of nightmares!
I can confirm most of what Ben says directly. What I can't confirm, I can't confirm only because Ben is smarter than me about this stuff.
I'm impressed Trello has managed to succeed in what many had written off as overcrowded space. I think the key to its success is the insight that Joel Spolsky explains in his post here: http://www.joelonsoftware.com/items/2012/01/06.html - that successful apps often provide a new kind of data structure, that makes them suitable for many purposes. (For Trello, that's a "list of lists".)

Fog Creek Employees: can anyone comment on who had this original insight? Was it Joel himself or another employee?
Correct me if I'm wrong, but looks like this should only be a vulnerability if your app uses XML parameters?
No, it's a vulnerability if your app SUPPORTS XML parameters, which all modern Rails apps do.

This vulnerability is exploitable even if you don't have any exposed controllers.
MD5/ SHA is designed to be slow. so it makes sense that one that is optimized to be chaotic, low collision probability and even distribution could be faster.
> The article doesn't even talk about the real lesson here: be careful who you trust. If you can't trust someone not to secretly record you having sex and then posting the video on Facebook, then you shouldn't be having sex with them. The lesson has always been the same, and there have always been people who don't learn it until it's too late.

The issue here is that trust is impossible to judge in this context. Sexual violence and intimidation is has deep cultural roots in the US, changing that culture is key to reducing incidents of that violence and bullying. Most sexual assault is committed by someone the victim already knew and 1 in 4 women will experience domestic violence in their lifetime, so trust is not enough.
Man, I really really want to see Gittip go big. It would be great. The recent credit card fraud issue was certainly unfortunate.

I don't instinctively think that the $1 minimum was a problem. When Gittip was first mentioned, I asked to be able to give tips without signing in first with Twitter or Github; I have accounts with neither service. For example, you say, "...the number of givers on Gittip is really, really small (279) compared to the number of people who, e.g., are on the Internet (2,450,000,000 [source])...", but you aren't making your service available to everyone on the Internet.

Maybe with the recent fraud problem you'll be forced to stick with requiring Github accounts for tippers (though I don't see how a Twitter account would meaningfully alter the metrics for fraud), but I really wish there were some way for me to just hook my business credit card into your service, point it at some guy on Gittip, and send him money each week, without having to create an account on another service first that I don't need.
I don't have a problem with curation; Sturgeon's Law goes double for blogs, and I'd be happy to have someone else filter the crap. It's not like it won't find somewhere else to get published or self-hosted. Honestly, the way some people are reacting to this you'd think the government just passed a law that meant if you didn't use Svtble you got the orange overall treatment :)
Are you referring to the OP? The OP states:

> There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application. This vulnerability has been assigned the CVE identifier CVE-2013-0156.
How about a podcast (tour, presentations, you name it) and commercial activities within that podcast?
No, there is no syntactic transformation.

The keyword is a function i.e. (in Java terms) it implements the IFn interface.

The effect of that function is the same as calling the get function on a map using the keyword as the argument.
I'm stating direct knowledge of the vulnerability. It's worse than SQL injection.
Would be more helpful if the fonts on the left sidebar were displayed in their native font (a la Photoshop).
To Make Clients Happy - Show & Tell
Off topic perhaps, but is Rich Hickey's wisdom only summarized in talks, or has he written some of this down? I see a number of glowing reviews of videos like this. While I don't want to miss out, I would personally much rather consume this info in writing.

The one I did bite the bullet on and watch in full was his talk on “hammock-driven development”. I liked it, but couldn't help feeling it would have made a very nice blog post that I could've read in 5 to 10 minutes as opposed to watching a 30 minute video.
That may be a bit low. Facebook makes approximately $5/year off of each user.

Another problem with a $5 one-time fees is that people expect to use your service in perpetuity. That price point probably isn't sustainable over a more than a few year period.
As a newcomer to the Rails ecosystem all these posts of vunlerabilities and open doors leaves a bad taste in my mouth.

God know I love programming in Ruby now, but is Rails really that insecure?
Ford's Adds BeCouply App To Help Couples Find Date Ideas While Driving
I don't speak Ruby. Can you or someone else be more precise about where that introduces the vulnerability? (Surely it isn't that YAML::load(content) can run arbitrary shell code?)
I also missed that it was under the MIT license as well but it has been quite a while since i've used it.

Will have to check it out and see what's new in it.
That's really sad man.
All programming languages have their share of terrible tutorials, but of all languages I have used PHP has the by far worst tutorials.

The PHP core community might not write such tutorials but there are loads of people who do.
I'm just commenting here so that people can have a central thread for love / hatred. ;-)

But seriously. This is extremely critical, please upgrade!
Another option: do what someone else is already doing. For instance, bug tracking and project management apps have proven demand. Sometimes you can steal enough market share by doing things better or by making subtle variations.
People begin with that qualification because otherwise, someone will say it's not data and derail the conversation.
Whats the best way to market to developers (B2D)?
Hi,

We know developers are hardened from the vagaries of Internet marketing, so whats the best way to reach the developer community to market products to them? The obvious choices would be online forums, PPC for keywords, online banners, etc. But as heavy Internet users, developers would have developed a thick skin to these tactics.

Interestingly, trade shows don't seem to be the answer since may developers are introverted/shy. We actually had better results leaving information about our products and walking away then having someone stand at a booth.

So, what say you, o' hacker news?
You still need to install the JVM. Python/perl/ruby require installers because you need some platform-specific stuff for each. Running everything inside the JVM means you only need to ship what any arbitrary JVM library requires. In this case, its as simple as a .jar.
Risk I/O Founder Wants to Improve Vulnerability Intelligence
Risk I/O CEO, Ed Bellis, discusses how he's improving vulnerability intelligence through Risk I/O, his vulnerability intelligence platform.
Calling YAML::load on attacker-controlled content in a Ruby app of any complexity is very bad news. As Ben and 'judofyr said: this is remote code execution.
Congratulations to Svtble for their funding.

I am curious as to what their business plan is, especially for a blog network that strives to minimalism, having an ad presence would seem anathema.

And to that end, I am curious why anyone would fund them -- what is it that they offer in terms of being able to generate income that makes them more viable than say, any old "webring" that uses the same CSS?

Or makes them different from various other focused blogging sites: science 2.0, freethoughtblogs, pjmedia, etc., none of which seem to be doing especially well as far as I know.

My problem with svbtle is that unlike Salon/The Atlantic/ArsTechnica/JUST ABOUT EVERYONE ELSE/ since there is no masthead, or links from one svtble writer to another, so at this moment, I don't see a real difference between svbtle the company, and svtble the CSS design sheet. So I don't see how they build up brand, or how they build on top of network effects since they don't link from one author to another. (And should ads be added and mastheads and footers added well will social toolbars and unother unsubtle widgets be far behind?)

And while I read svbtle when I come across it, I find their content not much better, not much worse than anyone elses.

(I will say, I am much less put off by svtble writers once I had adblock plus block their 0-click kudos.)
But you can use this to trigger the earlier SQL injection vulnerabilities, right?