skysight-inc/HackerNews huggingface dataset:
The company missed a valuable window of opportunity to gain a lot of traction when there was strong anti-bank sentiment. People anxiously waited for invites that took too long to come, and when they finally did, there were problems.

Meanwhile the economy has improved, and let's face it, when there's sufficient fund sloshing around in our checking account to make those pesky fees non-issues, the big banks are not that bad.

In addition, many banks have cleaned up their act under pressure from regulators and customers, so now you have much smaller pool of people who are still willing to switch their banks out of spite.

In the end, this was a business that could've taken off and sustained for awhile had their timing and execution been better. After all, once people switch banks, they stick with them.
I'm saying that complex systems in and of themselves don't have "objectives".

Deliberately designed systems can absolutely have purposes and objectives.

If you want to be nitpicky there's a frothing sea of philosophers smashing endlessly against the little rowboat we're in here. Feel free to dive off and swim around, I'll stay here.
ohh i mistakenly upvoted it , shit :(
You misinterpreted my comment. I agree, the language is largely inconsequential. Its the culture around the language that is the problem. Ruby's is particularly bad. All I'm saying is the "1000 ways todo the same thing" nature of Ruby, has the unfortunate consequence of attracting newbs, and making 'best practices' hard to nail down.

Other languages tend to have more support in corporate/educational areas, tend to have more money backing them, tend to have more 'best practices', tend to have more rigorous testing and review. Ruby is the hipster hacker's language.... and the quality of code shows this. (in the core of the language, and by the individuals who use it)

Other languages absolutely have these problems too, but it has been my experience that Ruby is particularly bad. You are welcome to disagree with that part.

But IMO it makes sense. The quick and dirty 'million ways todo the same thing' nature of Ruby breads this kind of culture. I certainly didnt mean to single out interpreted languages tho, or imply other languages dont have security problems, or unique issues with their cultures.

PHP is probably about just as bad. I'd put Ruby and PHP high up on the 'fun to program in' list, and low on the 'secure, quality languages' list.
A Dash Of Olive Oil May Preserve Decaying British Cathedral
Is a passive-aggressive comment really the solution? It could backfire and make them feel defensive as easily as it could make them feel guilt. They're late all the time will become because your pedantry pisses them off and they don't want to spend time around you.

Habitual lateness could be engaged with positive reinforcement too couldn't it? This could be achieved by calling the latecomers before meetings or escorting them there early a few times until the habit changes.
Try reading this. It concisely gets at some of the main ideas of his talks regarding values, identity, and perception. http://clojure.org/state
It's not a touchy subject. I'm just sick of everybody trying to turn every conversation into some kind of fact-war, especially when opinions are explicitly asked for. What do you think you're going to win?
Wiki.python.org compromised
Get kids trained early. Next put them into all adult ID cards and make it illegal to walk around outside without one. Police can just drive through a neighborhood and see who everyone is and their drones can just tag you and watch you move through your day. Don't have a chip on? Then get a forced iris scan like the US military does in Iraq and Afghanistan.

The future freaking terrifies me, especially how people just roll over and accept it.
It seems a shame about TCL. It has some cool ideas, including at least some degree of homoiconicity. I don't suppose a new replacement with the design warts removed would get much traction, either.
That's an interesting suggestion but it has nothing to do with the problem at hand.

The problem here was a feature somewhat haphazardly added to Rails for ActiveResource was turned on-by-default and enabled features that should only be active for interactions with trusted clients (i.e. authenticated services running in your own infrastructure)

Your suggestion is not without merit, but this is a case of having to learn to walk before you learn to run. There are clearly much more egregious parameter parsing vulnerabilities which need to be solved before the things you're describing would ever make it into rails-core.
The short version, my Kindle died. This happened before...
I feel like banking is a bad problem for the modern startup that relies on speed of implementation over security concerns.

I'll be happy to see them win, but I'd rather not be a Guinea pig.
Wow, I really want to ad hom here because you obviously didn't read the article or listen to the original (and excellent) WNYC Radio Rookie piece, but I'll resist.

This isn't about a girl or a case. It's about many girls (and boys) and how public "slut shaming" in the modern age affects their lives. Yes, Hester was forced to wear a scarlet "A" as her public shaming. But in today's world the scarlet letter is a digital record that follows you, potentially for the rest of your life because of a bad choice as a teenager.

Can you now understand Temitayo Fagbenle's allusion?
Lol, forgot to bundle update that gemfile!
I personally wouldn't plan a business model around technology laggards.
There's a good chance that a Perl interpreter is installed on any Linux system, but this is really an incredibly trivial reason to prefer a language. If you can't use (say) a ruby installer you are going to have even bigger problems building almost any kind of software.
common sense tells me, even if they did hack it, it most likely is a honeypot.
Why you shouldn't work less
People don't want a classless society because it removes the ability to attain the one thing that all people want: distinguishment. People usually want money not for its utility, but as an arbitrary measure of merit and a way to distinguish oneself. This is why the American Dream is so pervasive: the concept of economic mobility appeals to people. If anything, we've seen a regression from equality and an exacerbation of class segregation throughout the century.

People (at least in this country) don't want to be happy and healthy. They want to be richer than everyone else because that is what success is.
I heard through the grapevine that YC affiliated companies were tipped off to this exploit/patch before it was made public (really; a YC affiliate asked me today about the vuln before it was disclosed). Could anyone comment on that?
Replacing one RCE with another :)
I'm In Need Of Part-Time Work To Pay For Move To SF
I will be moving to San Francisco on May 1st and I am starting to worry that I won't have enough money to cover my moving and living expenses. I was hoping that someone here on HN had some extra Ruby/Rails work that they needed doing and are willing to pay to have done.

If you find yourself in such a situation, please email me at james@breweronrails.com. Moving to San Francisco has been a goal for a while now and I've found myself faced with a good opportunity to do so. Hopefully HN will support this goal.

Edit: Bed time. I'll answer any replies in the morning.
Why does a religious objection make it okay?

If a start the church of antirfidism why should I get a free pass if the tech is so important?
I am typically very lenient guy, but in this case I would say this is complete fail. What Simple is trying to do is extrapolate the problems people have with bank - e.g. overdraft fees, evil sequencing of transactions etc and market service based on it - whereas they have their own list of shortcomings and (as of now) lack of ability to be a real alternative to be a Bank.
Class is both very real and very touchy in the United States. But people use the term in a really broken way, typically trying to map arbitrary income groups with classes. Which is convenient for everyone: Democratic-aligned classes can try to maintain their privileged position using class rhetoric to bludgeon Republican-aligned classes, and Republican-aligned classes can deny class altogether and take advantage of real but ignored class rifts within the Democratic coalition.

Of course, the classes at the bottom of the respective coalitions get screwed in the process. Which isn't to say that there's any grand lower-class coalition waiting to be made: disempowered classes align themselves in the partisan coalitions out of genuine self-interest, not out of false consciousness. They're just getting a disproportionately small serving of the winnings.
Apple doesn't 'force' upgrades anything like what every Android vendor does. The iPhone 4 is now 2.5 years old and still happily runs iOS6 - I can't find anyone with a 2.5 year old android phone that's running current software that hasn't modded it.
In firefox I just did a print preview which got rid of it. Also annoying but slightly easier.
I'm just saying Ruby is good at enabling DWIM and Rails has taken it and run with it to the point of magical thinking.

It's very hard for an app developer to test for vulnerabilities such as this one which seem to involve a combination of contributory factors. When magical stuff is constantly willing to help the app developer out in the background, it's very difficult to get a handle on what our true attack surface is.
Why you are not likely to see many Big Data success stories
Yeah what the fuck? Since when can the government qualify the religousness of my beliefs?
This is really interesting. Before now, I'd always viewed DX as this monolithic thing from Microsoft, and reading about the people behind it, especially in a moment of weakness, really helps humanize such a faceless piece of software.
That's odd, that seems a little inaccurate to me. Clojure's agents are useful for encapsulating I/O-related resources, and are integrated with the STM system. Per http://clojure.org/agents -

Agents are integrated with the STM - any dispatches made in a transaction
are held until it commits, and are discarded if it is retried or aborted.
MSN/Windows Live Messenger to close down on March 15th 2013
What is the implication of touch screen only world?
That was poorly phrased. I meant, it's not about pre-paying for a product, it's about funding something you believe will be awesome if it's created, and if it is created, getting access to it in some way.
> It would be much more digestible as a single page of data that didn't screw up your back button.

In other words, no design? How engaging.
I am not in US, so I cannot open an account here. But Prima Facie, this seems like another Bank to me. Ofcourse, they are trying to simplifying a few things. But they do not have the kind of scale larger banks do, say Citibank etc.
So I'm guessing once they reach a level where they have a lot of customers, their system will be forced to become more convoluted due to operational overhead.
I have never done any Ruby / Rails development, but this exploit doesn't look like it requires any proof-of-concept.

My understanding is that as long as there is a JSON endpoint accepting parameters, and the parameters are used for query generation without going through a proper validation layer [1], then the app is vulnerable.

[1] In python, this would be things like FormEncode, WTForms, Colander, etc.
I'm surprised there are people who don't open their links in new tabs on HN.
The font was Source Code Pro (monospace). That header image was somewhat old, so I just changed it now. :)

The high-contrast style of minimalism is what I prefer: I hate the low-contrast style that many blogs seem to love. Although I might tweak with it more.

The Read More bug appears to be from the original theme. urg.
If you're talking about in person, I did a Pragmatic Studios course and it was great. Highly recommend if you can afford it and do the travel.

Otherwise, Ray Wenderlich online and the Big Nerd Ranch book are my favorites.
So it's an analytics front-end for an account with Bancorp? (http://www.thebancorp.com/about/)
A great guide to unexpected San Francisco. Thanks.
Less magic.

The more magic, unexpected behavior you have when parsing untrusted input, the more likely you are to have security holes.

Instead of building up some complex object based on untrusted input, the author of the application should specify the values and types expected, and the parser should parse those and nothing more. This would lead to much simpler code paths, as the user never has an object that has unexpected keys, values, behaviors, etc. Don't parse the object using complex, general purpose code, then hand the user an object that they have to treat specially; if their form only expects 5 values of given types, then parse only those values and those types.

The problem is, all of this kind of magic is at the very heart of what Rails is. I don't know if you could eliminate it all and still have Rails be Rails.
Europe wasn't a unified entity in 1913.
I guess I've been living under a filtered bubble...I've used Google as my go-to example as the only big company not using patents offensively (http://cultofmac.cultofmaccom.netdna-cdn.com/wp-content/uplo...)
What terrifies you in this scenario? That the technology would be used by people other than the police, or that the police require identification?
Would this work as a way of hiding? Write plainly. Put it into the Google translator to be converted to the language of your choice and then this is again translated back to English. Correct the individual words mistranslated but leave the awkward phrasing intact.
Q1: MBA - I guess no :). But it will be good to have very strong hold on how financial system in your country works.
Q2: Scaling a Bank is not easy (but ofcourse possible). Reason is Regulations of each country is different. That is true with any Financial Service. People say PayPal is global, yes they are but they have to adhere to local rules.
I'm amazed that the author of this piece managed to write all those words analogizing 2013 to 1913 without ever mentioning the huge, obvious difference between the two eras: the existence of nuclear weapons. Those weapons create pressures against direct state-on-state confrontation that simply did not exist in 1913.
One thing I don't see addressed here (or in other articles linked to in this thread): corporate governance. Abusing the standard corporate governance model, where shareholders delegate to a Board of Directors, is one of the key ways that rich people game the system.
Someone else posted this another thread and I agree: any methodology that determines that JavaScript is "treading water" is suspect. Even if you ignore JS on the server side, I would be very surprised if its importance and use was not increasing pretty rapidly.
You are correct. But if that is the standard you hold critics to, as opposed to making statements based on all information available at a given time, then no critics would exist, because it is always possible for any group to enter unknown territory.
Can't speak for adsense but Android developer support is none existent, so that probably extends to other arms of the company as well.
Justice Department and Patent Office Issue Policy Statement on Patents
> I want to use any ATM I see on the street with no fee.

Mechanics Bank in the SF bay area will pay you back for the fees you accrue using others' ATMs. It's only up to $15/mo (I think) but that's more than enough for me.
Ok, s/girl/girls/ and s/case/cases/ in my post. How does that change the point? AFAIK, all of the girls involved did not cheat on anyone. Hester Prynne did. My point is that the "scarlet letter" analogy is unfair to the girls, because it implies that they have done something worse than just make a bad choice of who to trust.
I'm responding to your philosophical ideas about emergence, I don't intend on making any philosophical points here, only responding to the ones that you made. You disagreed with the idea that society can have objectives based on philosophical grounds.

>>Emergent phenomena don't have "objectives", mate.

Society may or may not have some emergent qualities, but it definitely has "deliberately designed" qualities, so therefore according to you: society "can absolutely have purposes and objectives".

Examples of deliberately designed qualities: banking system, fiat currency, stock market, credit card infrastructure, etc. All engineered to streamline economic activities and to allow those who control them to wield power(among other purposes).

>>>The production of wealth, as measured by GDP, or by the stock markets, or consumer spending, is our yardstick of success.

What is success other than the ability to succeed at wielding power, control over your environment etc?
Why does capitalism have to lift anyone out of poverty? The opportunity to own assets and control your own production sometimes provides the means to do so. Just because enough impoverished people are not becoming rich per year does not mean capitalism is not working as intended.
IT Pro Impact: iPad vs. Nexus vs. Surface Tablet Shootout
Government policies are what created gargantuan financial firms who were in a position to overleverage themselves because they didn't think there was any risk in it. And low and behold governments bailed their asses out. In a more diversified market the companies that had overleveraged themselves would simply have gone under. More so, in a situation where the government had not put pressure on lenders to give loans to "sub-prime" borrowers, the whole mess would have never gotten so out of hand. Defaults would not have been so high, and real estate valuations would not have been so inflationary.

Additionally, we've pretty much gotten over that problem. The problem now is a sovereign debt crisis, especially in Europe, and that has little to do with the market.
What you are describing is Roulette.
It seems to me that the system enables more accurate reporting on daily attendance of ID badges.
>> "Student Suspended for Refusing to Wear RFID Tracker Loses Lawsuit"

Student Suspended for Refusing to Wear Any Identification Badge Loses Lawsuit
You make it sound like a community college education and 90's Honda are bad things to have. They might not be as nice as your neighbor but it's certainly nicer than 100 years ago, no?
I think the title is misleading...

"The girl’s father, Steven, wrote the school district explaining why removing the chip wasn’t good enough"

The title should read "Student Suspended for Refusing to Wear ID Loses Lawsuit"

This case had little to do with RFID. It had more to do with religion.
Europe in 1913 was a collection of feuding empires rather than a semi-unified entity like it is today. Britain, France, Germany, Italy and Russia all had commercial and geopolitical interests that conflicted with each other, and a long history of fighting major wars in pursuit of those interests.

Additionally, the United States at the time was coming out of a long period of isolation and beginning to flex her muscles in Latin America and the Pacific. The American victory over Spain in the Spanish-American War (http://en.wikipedia.org/wiki/Spanish%E2%80%93American_War) demonstrated that the US was willing to fight established European powers, and could win. Similarly, Japan was relatively small economically, but by 1913 she had inflicted a major defeat on Russia in the 1904-05 Russo-Japanese War (http://en.wikipedia.org/wiki/Russo-Japanese_War), making her another rising power.
Rails has definitely started to get complex, which is why many have chosen to go towards the simplicity of Sinatra, Rack etc.. Any time a framework get's complex this happens.

Look at big data and AI. There are loads of permutations. How do you prevent stuff from just happening? How do you make sure that things are correct etc.? Trust me I would love to do TDD on an AI / big data analysis project. But the reality is that no-one has figured out how to reliably test things....so TDD is not the right tool at this point. But there is also the potential to introduce vulnerabilities. That doesn't mean I am not going to use AI or do big data.

It's always a balance between tighter security/less complexity, or more complexity and less security etc...obviously there are other factors as well, but my point is to choose the right tool for the job.....sometimes it is Rails, and sometimes not......

And beyond that give the Rails team kudos for a taking care of things like this when they do find them.
Incorrect:

https://github.com/blog/493-github-is-moving-to-rackspace
2:13 if you count from the first message about high exceptions to the all clear "everything is working normally."
If enough people say they are done with 40+ hour work weeks and only will do 35 companies will adapt. So far there has not been enough people willing to do so.
even the 3gs runs ios6 and it's from 2009!
Several things:
1) Mass scale surveillance becomes trivial and you'll end up in a database of suspects even if you've never broken the law
2) Your identity can be checked without your knowledge regardless of probable cause
3) The technology might not be safe, but this is much less of an issue than #1 and #2
EPIC Provides Newly Released Details on NSA’s “Perfect Citizen” | NoVA Infosec
I'm tired of the logical fallacy that consists in always saying: "Every software suffers from security issues".

It is just plain wrong to reason like this.

So let me ask something to the ones using the above fallacy: are all programs (say webservers) equals in the face of security?

It's an easy question right? And the answer is: "no, they're not all equal".

So stop saying: "But Java had several DoS bugs affecting Tomcat in 2011 too, so we're not doing anything wrong here".

And start coding (and documenting) to higher standards.
Ditto... Huge Ditto. I know I will be moving to a cabin in the woods when that happens.
India’s ‘Missed Call’ Economy: An Untapped Goldmine
A couple of years ago they actually started a one year COBOL education program here in Stockholm. Mostly backed by banks and insurance companies and from what I have heard most graduates have gotten relevant jobs. I doubt that the demand will be larger than the supply for much longer but it is quite fascinating nonetheless.
See "Did Affordable Housing Legislation Contribute to the
Subprime Securities Boom?" at http://research.stlouisfed.org/wp/2012/2012-005.pdf

Abstract: No.
We are making progress. It used to be your class was determined by how much money your great great great grandfather had. Now it's determined by how much you have. Soon it will be determined by how much we think you will have based on your profession ("oohh a doctor"), health ("oohh she's skinny and eats right), habits (non-smokers). Eventually that bubble will pop or cancers/diabetes and other ridiculous ravagers of our species will be eliminated. Class has a real shot of being eliminated then.
I seriously don't understand your position, at all.

Education is rarely "fun" - there is a huge amount of dry information out there that is impossible to colour in a "fun" way, I had an excellent teacher explaining to me the interesting intricacies of the Krebs cycle but I still had to learn that terrible thing by heart.

If you just want to learn the things that are "fun" you have become the ultimate consumer, the guy (or girl) who just picks the easy things in life. Other people will be better trained, will make more money than you, will be your bosses because they are willing to do what it takes, even if it's "boring".

I remember during my Biology BSc I had a couple of lectures that were extremely uninteresting, for these I just didn't show up and learned for the exam with the lecturer's PDFs or the required books, that went perfectly fine.

If you want advice on what to do now, re-enroll and buckle up. Judging from your posts I don't think that right now you have what it takes to be a self-motivated freelancer or leader in this economy.