skysight-inc/HackerNews huggingface dataset:
I spent two years operating, promoting, and working to monetize a city-specific site for Chicago called Windy Citizen.

We got the site up to 50k unique visitors/month within Chicago, and local advertising was still a very tough sell.

Eyeballs don't mean a lot for local. You have to build a brand and, more importantly, a community with a strong identity.

The three things you need are:

Events.
Email.
Web site.

Events are your main focus. If you can organize a quarterly event that brings out 300+ people at $25/head, maybe a debate about some local issue, you could build from there.

E-mail is how you keep in touch with people. You want to build a list of at least 20k people in Baltimore who might get a great local video in their inbox each day. That's a starting point.

The web site is where folks find you to join your e-mail list, learn about events, and browse some content.

You're not going to sell ads on your web site. It will never get big enough to create meaningful value in and of itself.

What you're going to do is sell sponrships that get a business featured at your next event, included in your e-mails, AND featured on your web site. You're going to offer them a ton of access to your audience. This is much more appealing to a local business than just web ads alone.

Check out http://Technori.com to see a great example of this. Seth started a site with some great content, spun off evnets that have gotten super popular, and has a great e-mail list that everyone gets.

He's building a brand, and eventually that will attract more and better sponsors.
I possess a device in my pocket that is capable of accessing the entirety of information known to man.

This is probably pedantic, but: I've been doing ancestry research lately and while it's extraordinary how much has been digitized and transcribed, there still clearly a lot of information known to man that remains outside the digital sphere, and sadly is often never written down in the first place.
Indeed. Laravel (especially the upcoming version 4) is the best thing that happened to the PHP community in a while!
Nikola Tesla: World Marks 70th Anniversary Of Death Of World’s Greatest Inventor
Also, it's not really an In-depth review if they don't talk about the privacy policy.
I think the poster is from Brazil, which had a very long and very interesting Master System history, which lasted well into the 16-bit era.

But you are correct, the SMS and the Famicom/NES were from the previous generation, which btw also has the same 2 ecosystem feature I've been talking about above. The Atari 7800 came in a distant 3rd to a distant 2nd dominated by the 1st place player.
This vulnerability is also present in other other Ruby libraries. I would advise anyone to do bundle install --deployment in there development environment then 'grep -r "YAML::load"' and 'grep -r "YAML.load"' in the vendor/bundle directory. If you have YAML::load(user_controlled_value) or YAML.load(user_controlled_value) then you might be vulnerable to remote code execution. There are some other ruby libraries that are vulnerable to this attack but I don't want to post about them until their authors have fixed them.
This is great advice. If you want to keep it exclusive and selective, you could ask customers to apply to be covered, part of which could include paying a fee after you vet them to your level of criteria.

Other angles you might want to go down is tying some special offers only to your site for the customer and seeing if you can do some (type of) lead gen for them where they might pay for access to that.
I think we're all saying the same thing. But this particular vulnerability described in the OP allows SQL injection via a different means than the one I had linked to (from 5 days ago). But yes, it's all SQL injection (and more, in this case).
They can claim copyright on the code, but its license ensures that it can still be forked, no matter who owns it.
I really suggest biting the bullet on "are we there yet" - it changed the way I think about state and identity (in that it got me to start thinking about them at all). I haven't found anything by him in written form aside from interviews, though, but I'm still really new here.
I think it's better to not discuss this openly for a few days. The exploit isn't obviously (as you've noticed) so hopefully users will be able to upgrade before the script kiddies discovers this.
Really? Wondering how to monetize a blogazine is concern trolling driven by hating Dustin Curtis?

I worry that moderating this community has jaded you. (That's concern trolling.) It's a valid question, and one I'd ask of any blogazine that received funding; do you stick ads on it? Charge a subscription fee? Sell user data?
All web frameworks have vulnerabilities - the key is how quickly the team responds. For that, I love Rails (and @tenderlove)
You've really sold me on this. Just letting you know. This is something that I would have liked to see or bite on for a while now. Didn't know something like this existed already. I haven't heard exactly good things on developing with Marmalade or PhoneGap from friends or HN. This sounds like a much better alternative to both.
I wasn't angry and didn't mean to come off that way. Text man, emotions just don't come through... unless you use emoticons... which I never do.

But anyway I think we might just view tutorials differently. To me, what's posted above is an outdated, insecure way to put data into a database but it definitely answers the question "how do I put stuff in a databse" simply and right to the point. And that's what I like about PHP tutorials. I'd rather put the onus on the programmer to learn how to put "way to do X' and "way to do Y" together on their own rather than muddy the waters with "here's how to do X but this is important too so let's show you how to do this other thing at the same time".
I agree with you about a culture of slut shaming in the US, but I don't agree with the idea of protecting young folks for their own sexuality. The issue here isn't that young people have or enjoy sex, but rather about a culture that promotes harassment against women for being sexual and uses that as a way to keep those women invisible.
love++
Show HN: CloudClip - Cross-platform Clipboard Synchronization
JavaScript: Modern Event Handling
3 links on HN frontpage for this same vulnerability proves the love of the community to warn each other tenderly.
But the NYTimes et al. are exclusive because they've earned respect and have a genuine history of excellence, not the other way around. I'm sure "svbtle could be that" for something, as long as that something is inherently vapid and mediocre.
Tell me how you enter a QR code on a touch screen. At least the url you can enter, QR code fails, as your argument 'entering them on a touch screen is harder'.

That problem is pertinent to both, so QR codes are still worse than urls.

Your argument is invalid.

Now, if you mean reading the QR code or URL on any device, let me tell you that QR codes are dots, if you misread a dot you fuck up the meaning. So OCR engines can EASILY read a URL and the same rule applies, if they miss a dot, they may confuse an I for an L or a 1, but still easier than a QR code, because 26 letters an 10 numbers are easier to configure in an OCR engine than irregular dots on a square.

URLs win.

I rest my case, your honor.
Understood, and question withdrawn. Thanks for the answer. I look forward to your future public disclosure. (I mean that sincerely, not as a poke.)
<3++
love += 1
"if there are any photos on the internet that will go away it's these, if for no other reason, because they're illegal."

I doubt it; the existence of an FBI database of known child abuse photos suggests that long after these images are identified, they continue to be shared online. Given how many amateur porn websites there are, and how older teenagers can easily pass for adults (thus reducing the likelihood that whatever moderators such websites have will reject the photos), it is almost certain that such photos will continue to be available online long after the girls/boys are adults and have forgotten the whole episode.

I think this argument is a red herring, though. The problem as I see it is not what happens when the photos are out there, the problem is that our notion of sex ed still comes out of the 1950s. We teach children about sex when they are old enough that there is a non-trivial probability they already started having sex. We limit sex ed to information about STIs and a reminder to use a condom (but in New York City, we were not actually shown how to apply one).

We need to update our approach to sex ed to reflect the realities of this century. First of all, children should start receiving some amount of sex ed long before they start having sex; clearly it will need to be explained in a way that is age-appropriate, but we cannot continue to put it off. Second, we must include a discussion about modern technology as it relates to sex -- that includes cameras, computers, and the Internet; if we know that teenagers are doing this, we need to explain to them how to be responsible (in the same way that we say, "use a condom because some STIs last forever," we should be saying, "don't let photos or videos be taken, because they last on the Internet forever"). We need to be frank with kids about these issues, or else they are just going to run wild and "learn" from their friends (who will almost always give them bad advice, betray them, or otherwise "do it wrong").

Yes, technology changes things. That is not a surprise. That is not shocking. If we fail to adapt to those changes, we'll just wind up in the same position as the RIAA and MPAA: crying, whining, and pushing for destructive laws.
I used Trello for a little while, I thought the software was good, but didn't really match my taste. Just didn't like the cards =/
Thanks for your awesome work and continued vigilance Aaron!
This is a duplicate of http://news.ycombinator.com/item?id=5028218

We were probably both hovering on submit new link waiting for disclosure :)
Its a viral for pacific rim!!!!
BetaPunch - User Testing For Startups
The keyword syntax is transformed into a keyword instance by the reader, and keyword instances implement IFn as objects on the JVM, hence can be used as functions under clojure's evaluation rules.

As I understand it, the roles which things like lists and functions play in a traditional lisp are replaced in Clojure by abstract datatypes corresponding to Java interfaces. Which on one hand is kinda neat because the core lisp datatypes aren't tied to specific concrete implementations and other datatypes (including user-defined ones) can participate in the same abstractions.

On the other hand it means the semantics become quite tied up in underlying JVM-related details and don't seem as clean/elegant as (say) Scheme.
These are the commits that need to be pulled in, right?

https://github.com/rails/rails/commit/d5cd97baa44fa66dc68104...

https://github.com/rails/rails/commit/43109ecb986470ef023a7e...

Are there others?
I strongly hope we can come up with better solutions than that. The fear and threat approach strikes me as merely reinforcing the root problem.
ruby on cracks
All kinds of love.
The Torque code base is really awful. One of the most broken pieces of code I've ever seen.
I wish people would at least attempt contributing to official documentation instead of spreading stuff across random blogs.
<quote>
[Inexperienced people] Work long hours. Inexperienced people make up for inexperience with enthusiasm, and often don't have much of a life. This does not necessarily make them more productive then experienced people, but the enthusiasm and energy is often infectious and helps shape the company culture.
</quote>

If I'm reading this right, this is awful. Just awful. You want to hire inexperienced people to "infect" the culture with a habit of working long hours. I have a seriously bad reaction to this because I was that guy. I came into a company, was super excited to work there, worked long hours like everyone else, and all of a sudden I had no life outside of work. I don't plan to do that again.
consciously posing in a photo next to a penis for posterity (which is, after all, what a photo is) has consequences that extend _far_ beyond your sexuality. This isn't about getting sheepish about teen sex, it's about long-term destructive decisions that aren't even necessary for pleasure.
There's actually two vulnerability announcements:
https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...

This one deals with problematic JSON parsing and affects only 3.x. It is dealt with in the release that fixes the other vulnerability
Underground coal fire still burning after 50 years
The timings for hash() are meaningless, since Python's str object caches the hash after the first call [1]. FNV is one of the fastest hash functions, it should be at least suspicious that hash() is 500 times faster than FNV.

[1] http://hg.python.org/releasing/2.7.3/file/7bb96963d067/Objec...
Can anyone with a more intimate knowledge of the inner workings of Ruby on Rails speak to how detrimental this exploit is in practice? I seem to recall a fair number of people feeling the SQL injection exploit from a few days ago was being blown out of proportion and I was wondering how this particular exploit stacks up against it.
Yeah, but

1) there's no down-kudo, and
2) kudos are mysterious, what's a kudo, and then SURPRISE, it's a 0-click rollover vote.

I find kudos deceptive for both those reasons. That's not what subtle should mean.
I'm aware of what the current state of the law is. I'm suggesting a change to it.
Security is a process; what matters is how people respond to new vulnerabilities. I'm naturally biased pro-Rails, but so far I don't feel uncomfortable with how it has been handled.

I can't comment on how on-the-ball the Rails security team is, but I can say it's really easy to update your apps.

It's also relative to your alternatives. It's way safer than not using a framework. Is it safer than Django? That's kind of unknowable; maybe, maybe not.
But if it was released under an OSS license, anyone who wants can fork, rename if necessary due to trademark, preserve a little (c) vmware in the source files and do whatever they want, right?

Basically, can vmware retroactively revoke that open source license?
Fair point, mea culpa :) I'll carve out some time this weekend, figure out how to make this advice generic across platforms, and figure out how to contribute it to dev.clojure.org.
Just wanted to show off the little 4-day project I have been working on.

I use a combination of OSX and Windows, mainly for coding and cross-platform CSS/HTML work and always wanted an easy way to copy something on one machine and have it immediately available on another.

There are a few different options out there, but many limit the clipboard sharing to an internal network or are feature-overkill.

This is my take on something small and simple that stays out of the way.

Feedback much appreciated.
LOVE FOR TENDERLOVE! <3 Thanks for the prompt action.
Looking Back at 2012's Best Branding
This one is not blown out of proportion. Lots of people have working proof-of-concept exploits for this. The vulnerability has no app dependencies. You don't need a session secret. You don't need a login. There are vectors for the vulnerability that will work against applications that don't even have exposed controllers.
Super excited about this. I have a couple ideas I've been rattling around that would be much easier to pull with boards that already have wifi/mesh over trying to get a bunch of xbees/arduino parts.
Vint Cerf: Internet competition has “evaporated” since dial-up
I really don't understand the last part "This vulnerability was reported to us by numerous people, many thanks to [...]".

Considering it affects all versions, what are the odds of multiple people pointing this out at the same time?

Rails has a very good track record regarding these things, but I'm just curious.
In the news piece, the journalist flags a photo twice as inappropriate. Both times, Facebook responded that the photo was within guidelines.

This is a photo that was drawing hundreds of likes and "shaming" comments.

Looking at the link you provide, the journalist took the Facebook suggested course of action, and Facebook actively failed to stop the abuse.
For those of you interested in more details about this bug: I've posted a first analysis at http://www.insinuator.net/2013/01/rails-yaml/
Ask HN: Is anyone else on Hacker News using Windows Azure?
I am using SQL Azure, blob storage, 2 web roles and 1 worker role. I have Accelerator for websites set up to allow ease of deployment for multiple websites on the same shared instances :)
Firefox 18 Launches With New Ion Monkey JavaScript Engine, Retina Support
As there have been many exploits / issues recently realized in parameters parsing, why isn't there more of a focus on security here? Specifically, this is where users/hackers can put ANY DARN THING THEY WANT and your server has to deal with it.

As a simple solution, one could pass a signed auth-hash of the fields generated by form_for, and the server could re-hash the fields submitted to ensure the form data you asked for is what you get (this solves the primary issue with attr_accessible). I feel getting this right is crucial to Rails' future.
"Facebook needs to get involved in policing this sort of thing"

I am guessing you were an angel when you were in school. Well, I was not an angel, so I can tell you what effect Facebook policing this would have: it would move somewhere else, where it will not be policed. Even if every website on the Internet were policing this, there are enough hackers and geeks at every high school that you would see teenagers setting up their own bulletin boards, email systems, etc. -- and don't think for a moment that a geeky kid would turn down the popularity points they would gain by running such a thing. If you took the Internet and the cell phones away, then teenagers would pass thumb drives around.

Basically, you would need to erase computers entirely to prevent this from happening. Good luck with that one.
My problem with the word hater, seeing how it's used at other sites, is that it stops any dialogue and dismisses even valid argument with a permanent label.

So earlier, I posted how I would like to know more about their business plan, because well, it seems hard to understand how they plan to make money. Now I have to worry my comments will be seen as critical and I will be lumped in as a "hater".

Because that's the behavior at other sites. "Hater" allows and encourages polarization.

(Also, I am not sure if on the spectrum hater is related to fan so much as it is related to fanboy.)
Nexus 4 has one major flaw -- you can't tell people to buy a phone that is not on the market. :) I can wait until my n900 breaks down (which won't happen any time soon, that thing is built like a rock), but N4 would be so much better if it was, you know, there.
This is a very interesting report. It was based on anonymized tracking of cars with cell phone GPS signals to better understand the whole traffic network of the Bay Area. Identifying choke points for traffic led to a policy proposal.

"John Goodwin, a spokesman for the Metropolitan Transportation Commission, the region's transportation planning agency, says the best way to spread out traffic coming from these neighborhoods is to install metering lights at their freeway onramps, which spaces out the traffic to help both those drivers and everyone else get to their destinations quicker. Though many important Bay Area freeways already have metering lights, such as Interstate 280 in the South Bay and Interstate 680 in the East Bay, others don't."

The Twin Cities metropolitan area, where I live, was the first place in the United States to gain special federal permission to put on-ramp metered signal lights on federal Interstate Highways used heavily by commuters. They empirically help a lot in smoothing traffic. One reason we know that is that for a while a doofus state legislator shut down the freeway metered ramp program, until traffic here became so unbearable that the meters were put back in use. I have heard from friends who travel here from other parts of the country that the ramp meters (implemented as red-yellow-green traffic signals just before a car gets onto the freeway) are confusing to people who usually drive where on-ramps are just unimpeded paths onto the freeway. But they definitely speed up traffic.

The Twin Cities has one federal highway, Interstate 394, with a pair of reversible lanes, usually eastbound (into Minneapolis from the suburbs where I live) in the morning, and westbound (out of the city into the suburbs) in the evenings. That helps with rush hour commuter traffic, except that a lot of cars are eastbound for evening appointments even as commuters are leaving the city, so the reversal of lanes still leaves the regular, nonreversible lanes badly congested each evening. I wonder if a traffic study like the one reported in the interesting article submitted here could identify how to smooth out the traffic problems we still have here.
As I understand Balanced Payments, it's for the other side of the transaction: Stripe is about people giving you money, but Balanced Payments is for sending others money (where you do a straight ACH deposit). (As opposed to paying them via Stripe, or PayPal, etc)
I really look forward to a time where "the government" doesn't mean IE8 only. I've been bit by this myself, at the state level.
Who still uses this crap?
Former PayPal, eBay hacks strap a rocket onto MongoDB
Insider Seeding
All software has bugs, and the subset of bugs which turn out to be security vulnerabilities is borderline asymptotic.

That's not to say all frameworks are created equally secure, but the differences have more to do with the culture around the project than any technical decisions (minus some very specific language-related issues).

Rails is a big, public project; with many years now of being used by a sizable number of people. There will be more security vulnerabilities discovered, hopefully they'll be addressed quickly and communicated well (which this one seems to be).

That's a long-winded way of saying to be cautious with picking some other framework because it has less security vulnerabilities reported, that almost certainly has no bearing on it being more secure.
Which is why I have been telling people it's a "better Python".
> Considering it affects all versions, what are the odds of multiple people pointing this out at the same time?

My understanding is that while investigating the SQL issue a week or so back, it gave several people ideas on how to make this exploit happen, and they all reported it.
Who'd have thought it? Hugely dynamic language turns out to be difficult to audit or analyse for security issues.

It was never about Java(C, C++) vs. Ruby despite what fanboys on either side made out. It was about conservative vs. devil-may-care. All that "convenience" and "it's so clean" came at the price of a whole load of code executed behind the scenes. You didn't write it, and the Gods of TDD preached that you don't need to test it because that's Someone Else's Problem. Auditing it is nearly impossible not least because it's a moving target, so you either get stuck in a backwater of obsolete versions that once got audited and approved or you live on the bleeding edge constantly (and DevOps hate you forever).

FWIW we (large satnav company) prototyped the last major service in Rails (actually a one-man hack proof of concept) then implemented it in production in Scala (and that was a bridge too far for a lot of people) because no-one wanted to run Rails in production.
Rails noob here... with this and the other vulnerability from a few days ago, do all you need to do is update your rails gem to become safe?

Current version at time of my post is 3.2.11, if I'm using that am I safe or do I need to perform additional steps?
gTar, the iPhone guitar launched on Kickstarter, is now on sale