skysight-inc/HackerNews huggingface dataset:
Each time the loaded train crossed the border the cargo earned its owner a certain amount of Renewable Identification Numbers (RINs), which were awarded by the US EPA to “promote and track production and importation of renewable fuels such as ethanol and biodiesel.” The RINs were supposed to be retired each time the shipment passed the border, but due to a glitch not all of them were. This enabled Bioversal to accumulate over 12 million RINs

edit:

The "glich" sounds to be with the EPA system. Its not clear if the problem is technical (like an ATM giving 40 for 20 requested withdrawl) or if the system did not differentiate between "crossing" and "production and importation", by design or specification. In any event, there's not much in the article that supports any forgery or false claim about the shipment's paperwork, etc. It was more that the EPA had no or poor controls. This latter case is a grey area between willful negligence (poor design of credit-issuance-proceedures) and potential fraud (unethical re-submission).
Monte Carlo simulation is the most oft-cited example. This tends to be most relevant to quickly American pricing options, or anything that isn't easily done in closed-form.
RIAA is involved in copyright protection, not patents.
Simple: use parametric prepared statements instead of composing a SQL string with the user-provided data (escaped or otherwise).

This has been available in numerous database APIs for like, ever.

For example [1], [2], [3]. Any actual web developer will have read something along the lines of [4].

A lot people seem confused by my original post, which was in response to a Django user's question about how this sort of thing happens. I provided a general response which seems to have offended some people.

Yes, Rails does appear to use parameterized statements. However, when it is building those parameterized statements it's still using user provided data to build the SQL. If that weren't the case, then this wouldn't be a bug at all, would it? Of course not, so obviously it is using user-provided data in some way, otherwise an HTTP cookie's value wouldn't be getting passed to the database, would it? The prepared statement string shouldn't be composed with anything user provided.

[1] http://php.net/manual/en/mysqli-stmt.bind-param.php

[2] http://bit.ly/WlPEFR

[3] http://rubydoc.info/gems/mysql/2.9.0/Mysql/Stmt

[4] https://www.owasp.org/index.php/Top_10_2010-A1
Giving statistics on n = 6 is not very useful.

It's a sufficiently small sample that a table would be a better way to present the data.
> "The network is the computer."

With the network this bad (cost and performance wise) in US (due to legal and monopolistic reasons, not necessarily technical), that makes a pretty shitty computer. So I would rather have a computer that can be divorced from the network if need be.
You know, escrow sounds like a great idea if it can reduce applications by the same amount it increases prior art submissions. It would make it harder for individuals, though.
Does the FBI normally notify the potential victim of an assassination plot? I could totally believe it's standard procedure to just try to handle it themselves. If the target panics, the perpetrators might bolt and never get caught, or something like that.
Try it out. Was it better or worse than you expected? :-)
Probably PHP heh.
And?

If you're dealing with people who have potentially compromised immune systems on a daily basis, you should be taking every vaccine possible.
Ob. SMBC

http://www.smbc-comics.com/index.php?db=comics&id=2761#c...
Surely there's been prior art.
So "exploit" == legal way to keep MY money. Interesting.
Just need to set up caching. No reason not to.

Edit: Static caching.

Edit2: Wow, well, :(. Glad I'm out of that world now though.
Flagged. I want to see intel and analysis, not hysterical fear mongering.
CORN SUGAR by aresant
This report contains a lot of information, so for those looking for the executive summary of one of the more interesting and controversial findings (in the "Conclusions and Relevance") section:

"Relative to normal weight... Grade 1 obesity overall was not associated with higher mortality, and overweight was associated with significantly lower all-cause mortality."
What is the gigantic mistake here? Per the story: The RINs were supposed to be retired each time the shipment passed the border, but due to a glitch not all of them were. Really, we have no idea whether this glitch was legislative, administrative, or database-related.

Update from the CBC story linked downthread: Once "imported" to a company capable of generating RINs, ownership of the biodiesel was transferred to Bioversel's American partner company, Verdeo, and then exported back to Canada. RINs must be "retired" once the fuel is exported from the U.S., but Bioversel says Verdeo retired ethanol RINs, worth pennies, instead of the more valuable biodiesel RINs. Bioversel claims this was all perfectly legal.

So basically Verdeo was lying to the EPA by claiming it was exporting ethanol rather than biodiesel. I would not like to be the person trying to explain to a court why that should be considered legal.
Both screen and keyboard are nothing but external accessories. You computer case from 1998 didn't come with an integrated keyboard and display, those were separate. This if (funny enough) a similar situation. You get your phone and then buy a larger case for it that has a flexible OLED display and a bluetooth keyboard. Don't need the large screen and keyboard? Fine just leave those home and take only the phone with you.

Tablets are cool but they can't conveniently become phones, but phones can become tablets/desktop/TVs/ebook reader with appropriate accessories.
This is a typical case of how incentives have a tendency to go wrong. I recommend you to listen to this Freakonomics Radio podcast which tells a series of stories about incentive failure, for example an indian town which started farming cobras when a ruler started giving out money for each cobra head after an infestation.

http://www.freakonomics.com/2012/10/11/the-cobra-effect-a-ne...
But I did :(

Edit: Even using Boost
Have you checked out firebase? What do you think about Firebase+Angular?
I had a laptop stand I was using for a couple weeks.. I found that it helped my productivity when multitasking, but when it came time to churn out code, it was harder to focus. Even then, I was only standing for a few hours at a time.
Get Over Your Fears, For They Are Just Imaginary
it's far simpler than that - social news sites like reddit and hn have 'fads' - surges of interest in a topic that involve lots of people posting about it, a bunch of debate, and then a dying off of attention as people move to the next fad. it's not even anything new; the same thing happened on Usenet back in the day, and probably on bbses before that, and in newspaper letter pages even earlier.
Al Jazeera Acquiring Current TV
I'm not entirely against long-term copyrights, but I'm not for them either. If a company/individual still rakes an exorbitant cashflow from a given copyrighted work, why not let them keep it? Let's make the law smarter. Initial copyright is free (14 yrs); first renewal is free (+4 yrs); subsequent renewals (every four years) increase in cost exponentionally (e.g., $2^n where n is the number of renewals): if a work is still profitable after 20 years, why not extend it another four? However, for a work to be profitable under these extension guidelines after sixty or eighty years it would have to be a monumental work indeed. This also allows less profitable works to fall into the public domain more quickly.

The other issue with our current copyright law is lost works: works where the rightsholder can no longer be found or even identified. This should be changed vis a vis copyright registration - register a work and after the copyright expires it is published freely online in a digital fashion.
Why thieves just stole $1.3 million in iPhones and iPads
Let's see. Phrack Volume Three, Issue 25 says "In March of 1982, the 5ESS switch first went into operation."

Esquire published "Secrets of the Little Blue Box" in the October 1971 issue of Esquire, based on the phone system MF design from the 1950s/1960s. That means blue boxing started at least 15 years before 5ESS, as tptacek pointed out.

The 1987 Phreakers Manual (http://fringe.davesource.com/Fringe/Hacking/Phreaking/Phreak... ) says "Blue boxing becomes harder as all Bell switching and transmission facilities go under to CCIS. Then to further complicate things, digital microwave, fiber optic, and satellite transmission are all coming to be digital and do not recognize 2600hz for the hang up signal. I predict that around 1990, blue boxes will be obsolete from all major cities."

The 2600 FAQ, Section C-07, says (the earliest date I found for this was August 9, 1993): "Because of ESS Blue boxing is impossible". This is incorrect. ... While the advent of ESS (and other electronic switches) has made the blue boxers task a bit more difficult, ESS is not the reason most of you are unable to blue box. The main culprit is the "forward audio mute" feature of CCIS (out of band signalling). ... So for the clever amongst you, you must somehow get yourself to the 1000's of trunks out there that still utilize MF signalling but bypass/disable the CCIS audio mute problem.

I don't know the switch models enough to say if it was exactly 5ESS, but everything suggests that that is the case.
The overreaction on this page is ridiculous. Has anyone actually read the steps required to exploit this vulnerability?

You do know that to be able to exploit it you have to know the application's secret key, so you can create your own malicious encrypted session cookie that includes hashes instead of strings for the auth token lookup?

You do know that if someone has your app's secret key they can just write whatever they want into the session cookie, instantly compromising a large number of apps anyway? That's the whole point of the secret key!

This is an obscure issue which can be used to get around one layer of defense in rails security. It could never get around all of them. It requires intimate in-depth knowledge of the app to even attempt the exploit. Sure, it's a bug, and it's not to be taken lightly, but the howls of derision here are totally out of proportion.
Sorta. The joy of PhantomJS (and of Chimera) is that they use a real browser to run the JS/CSS/HTML/whatever. No simulated DOM; no simulated cookies; etc. Just a real [headless] WebKit browser with all of its quirks and tricks. You can even take screenshots of a real, rendered webpage (which is great for debugging).
Can someone please shed some more light on this? I have Roku and Google has not allowed them to build a Youtube channel. (http://www.engadget.com/topics/hd/2011/04/21/google-puts-the...)
Backbone.js compared with Ember.js
why is this submission dead? :(
Well, there were a TON of Kinect units sold, and its initial incarnation in the game console space could lead to some innovate interfaces for computers in general (or whatever else) one day.

I'll be interested to see if there has been much improvement in the technology when the next Xbox launches this fall.
Freelance guidence
I am looking for helpful advice and/or links, particularly about self employment and dealing with your own taxes. I am going to try to live off of my own skills this year while I go to school.
Would it make sense to inform people that they're being targeted for assassination? I mean, a dedicated hostile entity could just wait for the next event unless the authorities can arrest them with solid evidence.
You want to see intel and analysis? The submitted link has a 112 page FBI intelligence report (complete with an FBI customer satisfaction survey on page 6). What more do you want?

Seems like the hysteria and fearmongering (treating OWS as terrorists) was coming from the Bureau.
Heh. I'm old school; I think it all belongs on SO and P.SE should be merged back into the mother site.

As far as I can tell, the only practical consequences of having them as two separate sites are that you have to set up different user accounts to use them, and the SE.com is less discoverable because search results depend on what subsite you search on. Not exactly a great win for usability.

Having separate sites for completely separate topics (like most the others on SE) makes all the sense in the world. But sticking a Berlin wall between the categories of "programming questions" and "other programming questions" is just goofy.

To my mind, the original once-sentence statement of how P.SE is different from SO (Paraphrased, "SO is for when you're sitting at the keyboard, P.SE is for when you're standing at the whiteboard.") makes it clear that the idea was fuzzily-conceived from the get-go. And it only got more muddled when the maintainers of the site, which had originally been specifically envisioned as a place for subjective discussion as per the very first sentence of the (original) site FAQ,* came out with a decision that it was absolutely not a place for subjective discussion, no how no way.

*Those with long memories will catch me out by pointing out that the very next paragraph of the original FAQ started by making a sudden one hundred eighty degree turn and specifically admonishing people to not ask subjective questions. I must concede that this is absolutely true. But I would counter by saying this fact doesn't make P.SE look any more well-conceived.
Just because you fail to lock your door does not authorize a burglar to come into your house and help himself to your stuff. You don't get to beg off responsibility by claiming the injured party made it too easy for you to help yourself.
> I read it and wasn't sure why you had used "they".

I actually used 'they' because I generally don't try to gender someone unless I know what pronoun they wish me to use. It's just default speech for me. You'll note that I replaced it with 'someone with schizophrenia' and tend to use "Terry" rather than 'he' even; "Terry" can certainly be a woman's name.

That said, something about the above sentence tripped my othering-detector, so I had a moment of 'ugh,' but as I said, it went away. I don't think it was incorrect/wrong usage, I was just sharing a strange moment that happened in my own head. I don't know why my brain parsed it as "those people can't have a normal conversation" instead of my usual genderless usage.
Thanks for the info - I was signing up with Perfect Audience (currently an adroll customer) and chatted with their olark chat. After getting pretty technical with the guy on the other end, he said "Sorry, I'm not 100% sure on this - I am the CEO not the lead dev. I like to chat to get to know the customers!"

#rad.
Presumably the sample size is the aggregated number of companies these VCs invested in. Sure, the numbers are averaged together but I find it interesting that the variance is relatively low. I think these numbers are still pretty useful for entrepreneurs. If nothing else, they give you an idea of what to put on the projections you send to VCs. :)
Everything Wrong With Prometheus in 4 Minutes
Your laptop can serve as that OCR service and it can cost a few - even several - times less than that estimate. Case in point: I write this reply on a $250 Woot.com netbook, which already saw me through a few novel drafts.

Please watch your costs here. My writing still hasn't covered the costs of the netbook I bought for my first novel, drafted back in 2008, and I paid only $500 for that one. A hundred sales counts as serious success for a brand-new author, and that likely won't bring in a grand on even self-published eBook royalties (70%).

Editorial and other services (layout, etc.) shouldn't cost you anything close to that first estimate, either. Dean Wesley Smith (http://deanwesleysmith.com), a 30-year industry veteran, has more to say on these points.
Please provide a source for your claims.

From looking at it, it seems that ANY HTTP parameter (e.g. POST or GET - which are completely user-controlled) can be manipulated if you know how it's going to be used in the code, e.g. an obvious object ID.

EDIT: tenderlove sets it straight below
Or how cryptographers use threat models (from what I've seen).
Funny, I had a similar idea recently. I'd be happy to share some of my ideas on increasing value for users. If you're interested, shoot me an email at xmas_project@<my username>.org
Phooey, Facebook is at this point just a big Lebron James charging down the court and intimidating everybody in it's way. People will leave as soon as it's convenient because they viscerally hate it.

The Onion told me so: http://www.theonion.com/articles/number-of-users-who-actuall...
You're going to need a lot of perseverance to get a project like this done, so if nothing else this project will teach you a lot of patience with people who don't believe in your idea.

You can get a prototype really easy: get an Arduino platform and some sensors and then work on your back-end. With about $100 in parts you can prove out a lot of your overall idea. Visit https://www.adafruit.com/ - you don't need to have any hardware experience to get something functional in just a few hours or days; this stuff is easy to learn.

If you have the ability to objectively analyze results, you'll quickly realize your project is a) recreating wheels that already exist, b) utterly pointless.

Anyone intent on doing evil will be able to destroy or suppress any sensor added or built-into a gun. Mass-murders are not done on a whim - they plan and have plenty of time to figure out ways around obstacles.

Yes, some obstacles will undoubtedly deter some people, but with everything there is a cost / benefit analysis that must be done. You will find in this debate that people, on both sides of the issue, will use every statistically correlation as a causation to support their point. Factual, proven data is very hard to come by without a bias: I'm pretty sure I could statistically prove that mass murders are directly related to the availability of avocados.

Weapon-smithing and ammunition production is easy with modern tools and is just getting easier. Even casings for ammunition is easy with simple machine tools. As others have mentioned, with 3D printing technology advancing printing guns from scratch is effectively here today and will only get better.
honest question - does the united states not have barratry laws? why do they not cover cases like this?
Sure, you can see it that way, but that also means that you consider all taxes to be taking your money - i.e. taxes are illegitimate. Otherwise, if you think taxes have their purpose, then everyone should play by the same rules, and not try to "cheat the system".
Yes! I love this. If we can reduce the cost of defending these we would eliminate them without needing anything else.
Why do major C++ libraries and frameworks never use smart pointers?
Exploit because it's based on a loophole. Lots of things are legally excusable because they are worded poorly or too vaguely, but it's usually easy to see the /intention/ of such wording. Taking advantage of the difference between the intention and the defined is most certainly an exploit by definition.
That would be appreciated! Don't hesitate to share with our fellow HN:ers too :-)
I've been hearing about the "paperless office" since the mid-80's. What is needed is not something to replace paper, but something better. For example, the paper memo was replaced by email.

Paper is just another technology, and a very good one at that.
The Electrowetting Display (video)
Great project. The biggest question for me when I'm using phantomjs is why phantomjs is trying to replicate nodejs infrastructure. For example, phantomjs has an HTTP server feature for processing incoming requests. This doesn't make sense to me because a browser shouldn't be a server. If you need to get information out of the worker, you should POST it somewhere. The proclivity of phantomjs users to prefer stdout is astounding. It's definitely the #1 question or issue that I get fielded in #phantomjs on freenode.

For example, for POSTing and reading from redis/resque I wrote this (proof of concept, not what's in production):

https://gist.github.com/000037f472b72d9490a6

A few thoughts..

> There are similar "glues" like phantomjs-node that integrate phantomjs by
> spawning a process, and processing the stdout stream, but it is limited by
> what can be done via the command line of phantomjs. If you really want direct
> api access to the browser, the best way is via direct integration.

This seems like a lot of overhead on top of a phantomjs (or even just a generic webkit) worker. Substack's approach was to just put a proxy in front of a browser that injects a <script> tag into the page to boss the browser around:

https://github.com/substack/schoolbus

Supposedly the actual browser client shouldn't matter, as long as your fleet of workers are up and running. I bet chimera's approach will end up with more access to npm modules in the long run compared to phantomjs.

Also, the link wasn't in the article: https://github.com/deanmao/node-chimera

For the python equivalent of this project, there's https://github.com/kanzure/pyphantomjs
Did we really reach the point where demonstration code can be presented in coffeescript without an equivalent javascript demo?
They've removed the blurred-text overlay and now are returning pseudo-blurred-text images, so afaict there's no way to get the remaining answers without logging in. I can't seem to find actual confirmation of it, but a lot of people were skeptical of whether Quora's previous approach (returning text but rendering it non-user-readable) was consistent with Google's rules against search-engine cloaking, so maybe they changed it to avoid angering Google.
Ooo, checking that out now. Parse alternative? http://www.quora.com/Firebase/How-does-Firebase-differ-from-...
One could lament that the real issue is the (maybe not so) accidental complexity (and hidden deep down complexity lies insecurity) that results when you're using utter non-sense like an ORM.

The very concept of an ORM is broken. I know most devs don't know SQL well enough to do more code directly from SQL and I know most devs don't know anything else than SQL... But it's a bit sad to see all these "frameworks" tailored to the masses.

dev: "I want objects. I don't really understand set theory but I still want SQL because it's all I know."

chef: OK, here's a framework doing nearly everything from you.

Seriously guys. Mixing orthogonal concepts and posting provocatively titled blog entries like "OO and SQL aren't orthogonal concepts, there's no mismatch impedance" ain't going to help.

The only thing this creates is a lot of needless complexity and, of course, there shall always be major SNAFU like this one.

Maybe, just maybe, that we could realize that if the reader is set to "from now on do not eval anymore" code shall not be eval'ed? And maybe, just maybe, that we could realize that if you're not using SQL you're not subject to these monthly SQL injections issues?

How far does the SNAFU need to go for you to consider that OO + SQL is actually a very, very poor mix?
I don't disagree at all with what you say, but it assumes that I'm doing it to make money. I see it as a hobby that I'm willing to throw money against; the likelihood of me seeing a dime is incredibly slim, and not at all the goal. Thanks though -- it's always good to have more info!
If anything, it speaks to the danger of hidden incentives in otherwise innocent-looking regulations.

Yep. Writing regulations is like writing code. In anything nontrivial, there are a lot of nonobvious edge cases that never occur to the writer until they bite him in the rear. And just like code, some of these sneak through even rigorous review and testing.
That's a good point. If it was merely a mistake, then I'm sure the company would not mind the EPA adjusting the credit balance. After all, they did not intend benefit from the error.. they just wanted to ship their goods back and forth for some other reason.
Sure. Here is the exploit: https://github.com/binarylogic/authlogic/pull/341