skysight-inc/HackerNews huggingface dataset:
He never said it did. He said that they can use Android kernel and drivers. That doesn't mean it's using Android's java environment, just the kernel and drivers beneath it.
This misses the point. The problem is not that unsafe SQL is produced it is that the method signature is not always what is expected by the user.

This isn't actually an SQL injection flaw.
That's a leap. Yehuda and I knew about the mass-assignment vulnerability during DataMapper v0.3, way back in the Merb days, before Rails3.

Yet it didn't get addressed until a few months ago.

PS: It's still broken IMO. It needed a rethinking of strategy and purpose. Instead it got a quick hack. If you want to see mass-assignment done right, look to Play Framework's First Class Forms support.
Sounds like the people in this discussion need to do some exercise, have more sex and laugh a bit more.
That's discounting first-mover network effects before Facebook became as international as it is today (VKontakte in Russia) and the big case where Facebook is outright banned (China). For the rest, you have a point.
I don't think you 'get it' at all.

Apple has merely provided SSO. All of its services have always been private (unless you explicitly share) and will always be. Google has taken what were private services e.g. YouTube and content and exposing that through a social network.

And for most people it is that blurring of the boundary between private and public that makes what Google is doing a bit concerning.
If you have an invalid id coming in, wouldn't you generally want an Exception? What is the use case where the app would send an id that does not exist, but you would not want to fail?
It seems to me that most of these kicks are better suited for a different sport.
Look at http://webshell.io I know they are hiring! ;-)
This is huge. I've been waiting for you guys to release this; thank you for listening!
Sustainism: A Designer's Cultural Revolution
>The manufacturer doesn't install things on my phone, I do.

And you expect for the operating system you install to have working drivers. Which are written by the hardware manufacturer, unless you want to wait for the open source community to reverse engineer them (which takes many months or years).

Nobody is saying that you can't hack whatever OS you want onto whatever device you own. But playing nice with the people who are in the best position to make it easy for you to do that is clearly something that Canonical has an interest in doing, and I don't think we should fault them with that.
TL;DR: export fraud.
Will Canonical be in the firing line of Microsoft's lawyers in the same way as some manufacturers selling android phones are? Microsoft make $10 for every android phone. How will this be different?
You don't need two computers.
Here's a more concrete example of how efficient communication would improve your dining experience. (Disclaimer: The startup I founded, Cloud Dine Systems, does this, so take this with a bit of salt since I'm a bit biased.)

You want a refill of your coffee during the breakfast rush. You can either try to flag down one of the wait staff or send a text to the restaurant with "#Table12 can you refill my coffee?" The wait staff gets the text and delivers you a coffee refill. Notice, you sent off the asynchronous message and then continue talking with your friends instead of pausing the conversation to flag down staff. It translates to better service and a better dining experience because the timing matches your needs. Similar examples follow for anything you would flag a waiter down for.

IMHO, one of the more pressing problems is efficient communication within the restaurant. Here's where the gains from better communication are the greatest. But that's a whole different conversation.
They have the indicator lights now also ;-)

But, I understand your point!
I say this all the time but I'll say it again: Xubuntu, the flavor with Xfce as its desktop environment, has IMHO been an excellent choice for several years now. There's no tablet version but it works well, does what you expect and isn't being messed with constantly like other Linux desktops.
Oh. I always figured it was bad coding, but I normally use the workaround anyway. Post.find_by_id(params[:id].to_s)

Regardless, I think I have some patching to do tonight.
Minus the ability to select an answer, voting on best answers doesn't seem ill-suited for these types of questions at all.

It seems to me that removing answer selection would be all that's necessary to create a place for discussion.
You're not far off at all. Think about how you use the web. Right now I personally have 9 tabs open in my browser and I'm flitting from task to task. Lots and lots of people browse that way.

Imagine you have an online store or a web service. You are working hard to drive traffic to your site, but only 5-6% might be "converting" in the desired way.

There's many reasons for this including outright lack of interest.

But for many, conversion doesn't happen because the time just wasn't right, or they got distracted, or life intervened. And seeing a reminder about that service a day or two later can be enough to bringing someone back to convert, when they're ready and clear-headed.

All that said, at end of day, it comes down to ROI. And with retargeting, folks are able to spend $1 and get $8-12 in sales back from that dollar. It works, and can work really, really well.

Happy to answer any other questions you might have!
"The network is the computer." Who uses a computer without the internet?

I suppose the same thing is possible using local wifi synching, like how Dropbox shares content over a LAN when it can vs. downloading it from the cloud.
To me this reads like pretty standard fraud, along the lines of carousel fraud[1] which was very common a few years ago.

If nobody is arrested or punished for it, then that's more like weak enforcement than clever use of the system.

http://en.wikipedia.org/wiki/Missing_trader_fraud#Carousel_f...
It's also being used for branding. You see an ad for a service or product everywhere, and you'll think they're big.
I use free WordPress (dotcom, not the self-host software). I used to embed a lot from YouTube. But found it affected loading times. When possible, I would put the video after the -More- break. Don't know if that helps at all.

EDIT: For clarification.
can you give an example of how this is really a problem? I have an iPad that can display PDFs. When I scan documents PDFs get created.
MSR does in fact file quite a few patent applications. At least in the past, Microsoft employees got little tchotchkes for each patent application filed, and it's not uncommon for MSR researchers to have small mounds of these patent 'cubes' on their bookshelves.
Maybe if you have an iPhone. My phone is definitely the computing device that gets the most use from me.
Is it just me or is there a recent surge of G+ stuff here? Almost seems systematic. Some free books post with the G+ book, some Facebook "bashing" posted on G+ now this.

Maybe I'm just paranoid but it smells like a targeted campaign :P
reminds me of tonx. good luck guys!
Full Show 12/28/12: The 2012 Year End Rumble
You can dock your smartphone and have a complete desktop environment - no half-assed stuff - a full on desktop environment with all your desktop grade apps. That's even better than WP8 can do.

That alone is huge.
Does anyone else find 37signals competitor comparison dishonest/disingenuous?

For example, when 37signals compares Breeze to Google Group [1], Google Group steps #3-6 are all the same "step" but 37signals breaks it out to multiple artificial steps to give the illusion there's more work in the sign-up process for Google Groups (when there's not).

What 37signals did was make each form field on the same sign-up page into multiple "steps".

If this same logic was applied to 37signals Breeze sign-up process, then their process would in fact be nearly 10 steps as well since a "step" is required to input your List Name, another "step" for credit card info, etc.

This seems a bit shady ... just saying.

[1] http://basecamp.com/breeze/compare#google
Google+ is a social network. The only person who thinks otherwise is you:

http://plus.google.com

And the reason Google+ is being integrated everywhere is because it is the only way they see themselves gaining traction against Facebook. Which right now is their primary online competitor for the almighty advertising dollar.
Actually many of these requirements were created so the cost of creating new drugs is sufficiently high to keep out new companies. The FDA is big pharmas moat.
It won't be successful if the company pays more in fines than it earned in profit.
I absolutely HATE the fact that google forces me to have a profile on Google+, but Google Hangout is so compelling that I've done it anyways.

I am hoping that Google bumps up security and visibility preferences for Google+ profiles in 2013.
Aisle50 (YC S11) seeks dev - Chicago
About us:

+ We sell grocery deals online and load 'em to loyalty cards

+ We are growing quickly. 2013 is our year.

+ We’re in Chicago and so is the job

+ VC funded

+ We have sales relationships with more than ten companies with revs of $1B+ (Kellogg's, Unilever, etc.)

+ We offer competitive salary, equity awards and full benefits

+ Free lunch everyday with team of 11 in Chicago

About you:
Agile generalist
+ Entrepreneurial
+ Ruby experience preferred

To apply, email your resume and a few sentences. Github profiles and personal webapps – or examples of anything you’ve built – also appreciated.

Email: corbetscouloir@aisle50.com
There's more than one way to skin a cat. Besides mixins, You don't even have to use SimpleDelegator to do delegation in Ruby. For example, here is a demonstration of another approach to DCI in Ruby (http://github.com/rubyworks/dci).
This isn't something that only happens in your industry -- you'll see it in most sufficiently large enterprises. Effective software reuse, while certainly a noble goal, is very hard to accomplish.
That's not really a skew so much as a reflection of the realities of the time, though. If you were lucky enough to want to go somewhere along a canal route, you traveled fast; otherwise you traveled slow. (Which meant most trips were slow.)

Attention to goods and other point pairings probably matter a lot when you get to 1857. I expect internal communications, of goods, in the South reflected high proximity to the nearest port, and that NY was essentially on the other side of the moon. Whereas the North was probably much more homogenous in its travel times (proportionately more railroad, less river) -- but largely isolated from the South.

You might be surprised. Antebellum New York actually had strong commercial ties to the South, primarily from acting as a distribution center for Southern cotton to the rest of the North. These ties were so strong that Fernando Wood, the mayor of New York City during the secession crisis, actually led a short-lived movement to take New York out of the Union and establish it as a neutral "free city" so that it could continue in the cotton trade. (See http://opinionator.blogs.nytimes.com/2011/01/06/first-south-... for a good account of this period.) There was actually a fair bit of support in the city for Wood's plan until the Confederates fired on Fort Sumter, setting off a wave of pro-Union support in the North that swamped it.
Watching the animation it is interesting that Iran flipped from facebook being to dominant in June 2009 to Cloob being dominant in June 2010. Wonder if this was due to government action or something else?

EDIT: Read the actual story. It says due to state censorship.
Did you watch the video? You dock your phone and you've got the full desktop. This ubuntu phone is literally the FULL ubuntu desktop with a new UI on top. The only thing docking does is switch you to your desktop environment.
Obvious comparison but interesting how close this feels to the DOJ hitting MSFT over the head for bundling:

"The issue central to the case was whether Microsoft was allowed to bundle its flagship Internet Explorer (IE) web browser software with its Microsoft Windows operating system . . . Underlying these disputes were questions over whether Microsoft altered or manipulated its application programming interfaces (APIs) to favor Internet Explorer over third party web browsers." (1)

When does leveraging a platform flip from good business to unfair competition?

(1) http://en.wikipedia.org/wiki/United_States_v._Microsoft
Good point, and IANAL etc, but since we as humans can more or less clearly see the difference between patent trolls and such institutions, there has to be a way to encode those nuances in legalese.

But I guess the real problem isn't whether the patents usually involved will hold up in court, but the costs involved in setting up a defense and disproving the accusations.
Canonical is always trying to make itself more relevant by chasing the new hotness. First it was copying Windows. Then it was copying the Mac. Then tablets. Now smartphones. Unfortunately, the open source nature of their efforts means that they can never supply a meaningful value-add, even if they had as much money as their competitors.
Those specs edge out the Microsoft Surface RT, which does run Windows 8.
This is a really nice guide. I've been up to my eyes in python dicts over the last few days so already had most of these figured out.

setdefault is new to me, which is cool. Unfortunately I can only see one place to use it in my code and it would be inefficient [0]. Best stash it away for later use :)

[0] r = re_subs.setdefault(s, re.compile(s))
Derby and Meteor
Rocking it out! Awesome! Getting down! Make it happen!
I'm aware they don't use SQL, but someone on HN once told me there was some kind of JavaScript injection you could do in theory. Was wondering how mongoid would handle this technique.
Microsoft Acquires Startup R2 Studios
Um... have you read the linked posting?

>Carefully crafted requests can use the scope to inject
>arbitrary SQL.

It's also titled "SQL Injection Vulnerability". Are we all missing something?
Yes, clearly, because Rails has introduced absolutely no other kind of default protection.

Is this an argument for hand rolling your own code, or for using some other framework that is apparently immune (or, to be charitable, has a stronger security track record)?
I got some basic n900 apps up and running pretty easily with vala and the maemo touch widgets. porting an existing ui might be hard, but building one around a set of touch widgets is relatively straightforward.
I did assume as much. I'm curious, since so many in J-orgs are trying to change the status quo, if there are success stories that are worth paying attention to.
Thank you for bursting the comment cherry!

We are a little different from tonx but the idea is the same :)

They source and roast beans while we work hand in hand with already established local roasters.
One thing I never see mentioned is the awkwardness of the metric names. The older measurements are all one syllable, while their metric replacements are often three or four.

mile -> kilometer
inch -> centimeter
pound -> kilogram

The only one that comes out even is ounce -> gram.

Obviously it's not a huge impediment since many other countries got past it, but I'm sure it just adds to the discomfort people have with it.
ooh ooh ooh. Disclaimer: Plug for my app called "tonepush" coming up.

I wrote an app that allows you to change the ringtone on someone else's phone (think xmas tunes, valentine songs etc etc). Anyway, one of my users had this issue where his wife is expecting a kid and he always has his phone on silent at work, so I've extended the app so that if he enables a web password, she can log in, turn his phone off silent and then ring him.

Before you say it, no it's not for iPhone but for Android. It's called TonePush Beta. All feedback gratefully received.
The backend is indeed the same (same API), only the UI is different. You can access the old UI at https://picasaweb.google.com/home
Most of our newfound forms of travel depend on engines, which haven't been around long. That's the reason travel was fairly stagnant for so long, IMO.

Bicycles on the other hand have been around for a while. Why didn't they see more prolific use in Europe between 200 and 1800? I speculate lack of good enough roads. An oxcart road would not be the most pleasant place to ride an old-fashioned bicycle.
Hmm. I'm not sure I agree that the web is missing a "social content protocol". What would such a protocol actually do?

REST+HTTP are not without their issues, but I'd argue they've been successful in allowing numerous heterogeneous applications to speak with each other, in a reliable and standard fashion for many years.

Compared to more complicated protocols such as SOAP, COBRA, DCOM, etc...REST+HTTP is as reliable and ubiquitous today because of its simplicity and generic nature. Adding features and utilities for a particular aspect (i.e. "social") would serve to weaken the protocol, not make it better.

The argument that the HTML+JS+CSS side of things has turned HTTP into an application environment is a bad thing is puzzling. Besides, what is the point of a content transport protocol if not to provide valuable services and use cases on top of it? We have TCP and UDP to push bits around...
> The RINs were supposed to be retired each time the shipment passed the border, but due to a glitch not all of them were.

Inside job? Sounds like the type of "glitch" that was in Office Space.

But probably not (Hanlon)
No it isn't an app. It is actually the full Ubuntu OS running on your android device. The point wasn't for it to be a touch screen, the point was that you could dock your device and suddenly be using a full desktop OS with all your desktop grade applications.
Targeted by who? The coverage of G+ seems to be almost consistently negative.
Ruboto 0.10.1 release doc · ruboto/ruboto Wiki · GitHub
Hackers, Disconnect From Your Computer and Go For a Walk
Nice! Contributor or employee?
I strongly disagree. Google made their strategy very clear on day one with their choice of name for this new endeavor: Google+. The "augmented" version of Google as a whole.

The discrete social network is definitely only a small cog in a much bigger machine, but debating whether it is a side effect or an intentional strategy is missing the point.
>The fact that this keeps happening on Rails is the #1 reason I haven't bothered to take the time to do anything real with it. I don't have the time to read the code for the framework and I don't trust that it's written with security in mind.

What frameworks do you use? Have you performed your own audit?
>The only one that comes out even is ounce -> gram.

Gallon -> liter?

And most of the extra syllables are because SI uses prefixes, instead of inventing completely different units. I think the verbosity is justified by enhanced understandability.
You guys are all thinking in terms of forming a business and having income from it. Our tax system doesn't encourage that. Our system heavily incentivizes people to seek capital gains through (for example) stock market and real estate speculation.
I would love to understand how any message queue can offer "one-time" delivery. At best it seems like a misleadingly under-qualified description, e.g. "one-time-if-the-consumer-successfully-acks-the-message".

Ultimately dequeueing a message, doing work, and acking the message, involve multiple systems in a logical distributed transaction.

Regardless of any guarantees the queue makes, you will need to deal with the fact that the consumer can potentially perform an operation based on the message, and then the ack can fail due to any kind of communication failure between queue and consumer. Or the worker can die (permanently) immediately after performing the work but before performing the ack. Etc. The message will be redelivered and the operation will occur again. As a result, you likely need to ensure that the operation in question is idempotent.

Given that you need to ensure this idempotency regardless of the queue's delivery semantics, I don't see what benefit it is for the queue to make any claims about one-time delivery.

What am I missing?
You're just reciting the standard line which I already acknowledged in my comment. My point was that some of the most promising avenues of research are ignored because of the lack of patentability. How do you address that point?
"There's SOAP, but nobody really cares or wants to use it anymore."

Do you know why? What makes you think we won't end up at

"There's OneAPItoRuleThemAll, but nobody really cares or wants to use it anymore."

or even at

"There's OneAPItoRuleThemAll, but nobody really cares or wants to use it."

If you cannot answer that, I wouldn't bother working on something like this.

Also, who do you think will be interested in having a common protocol? I think the answer will be "those with little data of their own". Big players do not want you to build tools that work together with 'their' data (clear example: Twitter: open while small, but now closing down its API)
Significantly more expensive airfare, and the beef still costs $100!
The Boeing 747 was introduced in 1970, and we're still traveling at around Mach 0.85. In the past four decades, we haven't made any significant improvements to travel time.

The market largely seems to have decided that supersonic flights aren't worth the cost or the hassle; the push has been toward slightly smaller, more fuel-efficient twin-engine craft on the long-haul routes. Which pays technological dividends of a different, but less flashy sort. Hence publicity stunts like flying a 747 on one 777 engine (it works, and think what a 1970s-era person seeing a 747 for the first time would think about hearing that).
Have you actually ever competed in online competitions like Topcoder or algorithm competitions like ACM ICPC?

For solving these kind of problems knowing a bunch of known algorithms won't take you too far. They will only be useful in the beginner stages, but as you progress you need to invent new algorithms, make modifications to the existing algorithms (so they test that you really understand the idea behind them), combine different algorithm design techniques, etcetera.

They are often a good proxy to test how creative in problem solving you can be, not just mere rote memorization of algorithms and how good are you at remembering known algorithms.
QuickLogin WordPress Plugin
AIUI in some areas if the business claims for part of the main residence as a home office over a prolonged period then Capital Gains Tax can be due on that same fraction if there's a profit when the house is sold. IOW, it's not a free lunch.
That didn't help in the RIAA situation, they could have continued suing grammas and kids if they had wanted to with no legislative remedy in sight.
i moved on from ubuntu a while back but, watching the promo video, i couldn't help but thinking mark shuttleworth is, pardon the cliche, something like the new steve jobs. he's got charisma, big ideas, and he's savvy enough to market them.

my other major thought, while watching this: where is the keyboard? (ie, will it run emacs?)
Asking Steve Jobs a question is going to require a very impressive in-band signaling hack on a system that appears to have no such vulnerability.
What is the use of "running Windows 8" per se? ... operating systems are a means to [an] end

That's the use. If it runs Windows 8 without complaint, you can generally do the things that running Windows 8 allows you to do.
Good point, I removed the nested CONCATs for clarity. Thanks!
I use Perfect Audience for Stackify (http://stackify.com) and it works really well. I also used AdRoll before. PA's UI is much better for sure. Their support has been amazing and I highly recommend them.
Extending this idea, a regex (code)coverage tool would be great...
Terse Words: Install Stackless Python on Ubuntu