skysight-inc/HackerNews huggingface dataset:
The vulnerability doesn't get triggered normally. As the grandparent said, request parameters are stored in an object of class HashWithIndifferentAccess, which stores all keys as strings. For the vulnerability to be triggered, the keys must be symbols. You cannot trigger this vulnerability unless your have written code in your app which converts the HashWithIndifferentAccess to a normal hash.

This patch does not fix a wide vulnerability. It just fixes a corner case, a just-in-case-somebody-might-write-vulnerable-code fix.

It just so appears that Authlogic does this. They pass a cookie value into a dynamic finder, so you can tamper the cookie to inject SQL.
Or just use Github's.
I suspect bicycles are one of those things that really seem obvious in retrospect but for some reason were invented well after the time when they were first feasible.

If you gave someone a bunch of gold, the ability to speak fluent Latin, and kicked them back into ancient Rome, I am sure they could commission the creation of a bicycle. It wouldn't be very good (no rubber for the wheels for starters, maybe replace that with several layers of leather? You might be able to make a leather belt-drive too.), but the general idea should have worked.

Another example is the phonograph. You can make a rudimentary phonograph with some very very basic clockwork, some wax, a needle, and a sheet of something taught and thin (I bet parchment would work fine.) The biggest issue would probably be figuring out how to present it without being burnt as a witch. But nobody did it until the late 19th century.
I suspect some of these examples also come down to making much hay of the lack of decimalization in Imperial units, combined with the way a name has been assigned to just about every possible subdivision of each unit. 250mL isn't really any harder than a cup, nor is 500mL harder than a pint. And we could make them sound just as cuddly by assigning them special names.

But I think a lot is lost in that, by way of usability. Here's a quiz: You're planning a party. How many pint servings of beer can you get out of a 15 gallon keg? Now let's do it in Metric. How many half-liter servings of beer can you get out of a 50 liter keg?

I think most anyone will instantly recognize that in the latter case you just need to multiply 50 by 2 to get the answer. But most people will probably have to stop and think through a couple layers of unit conversion (four quarts in a gallon, two pints in a quart) before realizing that you can multiply 15*8 to get the first figure. Heck, I suspect that even among people who grew up with Imperial units a lot might get stuck without a hint.
How do you work on verbal communicaton?
This is also a problem with e-books: There's no way to just scribble something on the pages. I hope there will be a solution for this soon.
The TSA wants to be everywhere in 2013 - here's why we shouldn't let it
Man Locked Up After Claiming “Digg.com Still Exists.”
I have been extremely positively impressed by r/programming (as opposed to SO).

I would agree that there's a niche for a high-quality discussion forum that is currently not filled. Reddit has, well, "redditors", and has entirely too much NSFW style content. A more buttoned-down site would be nice.
This looks really great. I would love to see a bit more of an in-depth example in a follow-up post!

Is more documentation to come?
Ask HN: Can you really listen to tech podcasts while working?
It just doesn't work out so I always ended up unsubscribing from most of the podcasts I once liked. What are the time slots you allocate to listen to podcasts?
>If anything, it speaks to the danger of hidden incentives in otherwise innocent-looking regulations.

That's like saying, there should be no lower tax brackets than 39% because I can lie and say I made less money than I actually did... speaks to the danger of hidden incentives in the tax code.
If Facebook removed all privacy controls, people would leave the social network in droves, and FB would be forced change their policy. Consumers are fickle, and FB is not an unstoppable juggernaut; I'm not sure why people have this idea.
xentronium: i agree on cutting slack. my comment was mostly meant to be fun and to only poke a bit :-)
Encameo is hiring a front end + iOS/Android mobile app developer. We are looking for someone who has published apps on app store(s). We work on second screen solutions for Hollywood. We target both movies and TVs. We are three co founders (One serial entrepreneur/one software engineer/one executive producer in hollywood). We are currently in talks with TV networks and studios.

We are looking for part time employees...location is not a constraint but Bay area is preferred. At this point, we only offer equity as compensation(All of us are currently working for equity)

Craigslist ad...

http://sfbay.craigslist.org/sby/cpg/3511943284.html

If you are interested, send me an email (Address in my profile).
Well, maybe. Uncle Sam tends to look the other way when it's not him being fleeced. But when it is him, holy crap watch out. He'll break you up and sell you for pieces.
They claimed to be importing fuel into the US that was actually produced in the US.
"there are no chefs that don't cut fugu wrong from time to time"

This doesn't seem to be the case: fugu preparation is licensed and regulated, and deaths are very rare indeed. I can't find exact numbers offhand, but according to a paper cited on Japanese Wikipedia, there were 315 fugu poisoning incidents in Japan in the 10 years from 1996 to 2005. Of those, 31 were fatal, and of those, the majority were due to preparation by unqualified individuals (presumably those who had caught fugu themselves).

Given the quantity of fugu consumed nationwide, it seems reasonable to say that, in fact, most chefs never cut fugu wrong - or at least that most chefs never serve wrongly cut fugu.

https://ja.wikipedia.org/wiki/%E3%83%95%E3%82%B0#.E3.83.95.E...
They do, but what we're talking about here is an ORM, so there will always be machine generated SQL somewhere. Or do you believe that GP is suggesting that developers use parameterised SQL queries instead of an ORM?
Just wait until you find someone named Robert'); DROP TABLE STUDENTS; --
i like Google+
It is clearly an abuse of monopoly. I am already using GMail, Free google apps, search, android apps review and many other things. If now I have to do the same thing, I am forced to either sign up for Google plus, which also force me to give my complete name along with other personal details, If not I can not use all these services.
What a strange, is it not a abuse of monopoly? I dont want to give my personal details, is it not my right?
Why google is forcing me to do so?
Why I cant keep using android review withoug using Google plus?
The phone looks like Win8 Metro, and the presenter is trying to be Steve Jobs. With the cpu's in phones already being phenomenally fast I see little to no value in removing the java layer. Currently this is vaporware, but should it appear on a phone sometime soon, I just don't see it gaining any marketshare beyond some of the hardcore OSS fans. Real people like an app ecosystem with their latest Angry Birds games and don't much care about any of the technical details.

The "lock screen" is just weird, and the hyperbole spouted by the presenter was downright embarrassing.

It all comes down to the apps. If Google Maps/Gmail/Chrome/Youtube etc all run on it then it might stand a chance, but I don't see further phone market fragmentation as being in anyone's interest.

I do, however, use Ubuntu as my main desktop (2.6.38)
Do you have entrepreneurs guilt?
Hey there -- if the `bundle install` command isn't working when you are in the repo, you probably need the bundler gem installed, which is kind of like a package manager for ruby project deps. Just do `gem install bundler` and you should be able to run commands with it afterwards. Feel free to email me if you need any help!
Early Facebook did die, though. Facebook today is utterly different from the quasi-private social space for college kids that it used to be. They pivoted from an exciting fad to a boring but pervasive network that wants to handle all your communication.
Not just tech podcasts, using my service podcastomatic.com (text-RSS-to-podcast) I convert all tech blogs into podcasts.

I listen on the commute and while coding. I assume no employer would object to their employees listening to tech podcasts as long as they are still doing their work.
> This will only work if tinydns supports zone transfers (AXFR/IXFR), which as far as I can tell, it doesn't.

http://cr.yp.to/djbdns/axfrdns.html

It does. I'm doing this currently, I host primary DNS myself with tinydns, and the makefile sends a notify to the registrar-hosted slave DNS, which gets data via this daemon (with tcp server configured to only allow that IP).
> I'm not a big fan of the Dalvik virtual machine layer on Android.

It provides a processor independent application format. It is obvious now that ARM has won, but not so several years ago. There are many technical benefits to an abstract format including bytecode verification, and the consequent ability to run multiple applications in the same address space because you can't create pointers. JIT/hotspot style execution can also provide better performance than C.

In any event providing a CPU neutral application format isn't a bad decision - others have done it too.

> It does drain device resources, especially RAM.

That claim needs to be substantiated. Is native code significantly denser than bytecode? The mobile vendors have all gone with GC. Mark and sweep style GC has more RAM in play by design than something like reference counting, but there is no requirement that mark/sweep is used - Dalvik could use reference counting. Again there are tradeoffs but calling them a drain seems a large stretch.
No, it's a bit more elaborate than that. If what you said were strictly true you could DoS any Rails app as symbols are never garbage collected - you could just continue sending new param keys to the app until it runs out of memory.
That sentence referred to original post, read it as "there are no programmers that never make bugs". I didn't mean the real chefs!
Please define "entrepreneurs guilt".
Google+ is an information-gathering service for Google's ad networks, disguised as a social network; that's why it's being integrated everywhere. Eyeballs are kinda secondary...
Er, why can't the ORM use paramaterised queries?
They made a gigantic mistake and we shouldn't blame them? I disagree completely. They should be blamed for this asinine regulation yes. Because it really is their fault. Good intentions don't cut it when it comes to fiscal accountability.
There are different risk dynamics between someone that is studying medicine and someone studying computer science. The major one being that if you drop out while studying CS you could still likely get a job as developer if you are able to prove you are capable.
Zynga Tries Its Hand at Online Gambling
Android License SDK 1.0 to Protect and License Android Software
Use the Android License SDK to protect and license any Android application. A developer on a Mac or Windows computer uses QuickLicense to configure the license and generate a Ticket file. The Ticket file and two Java code files are added to an Android development project. The Android application is distributed with the royalty-free LicenseManager to handle the licensing process.
Or we could take the money those pills cost, give it directly to researchers, and open source the results. Lower costs, same results, money left over for plenty of other things. I mean you do know the US has the worst cost/lifespan ratio of the western world, right?
To anyone that sees this email validation regex, DO NOT USE IT. Hope that was clear, if not obvious.

Use something like `^([^\s]＊)@([^\s]＊\.[^\s]＊)$` which will do most of the work for you, then check second group for common domain typos, and what have you.
plus.google.com is blocked at my employer.
Strict legality and validity are irrelevant -- proving the legality and validity would be an expensive and time-consuming process for the targets of these claims and most lawyers would agree that settlement is always preferable.

9/10 someone may win the suit against a patent troll but the cost of proof ($$$$) is extremely bitter to taste.
cool, but you could have stayed in the g namespace just by adding http:// to the beginning.
This is my holiday project, so please let me know what I can improve. Is the copy clear enough? Does the service provide value? Can I increase the value for the user in any way?

Feel free to criticize :)
I would put writing right up there too. It forces you to think creatively and/or analytically and you become a better communicator. Communication can not be underrated as a key to successful relationships.
Is there more documentation(or source) available somewhere?
The hilarious thing is that upon this they will require that the fuel be loaded/unloaded at which point they will pay someone to unload it into a common pool and then reload 'different' biofuel from that common pool.
Actually, this is a horrible idea, because it's easier to run a software company outside the US, since you don't have to deal with the IRS.

Once you gain a physical presence, you're now liable for both federal and state taxes (depending on where your location is). This is much worse than your 5% revenue share or equity fee.

Add to that any legal and accounting fees you've just added for the company in the US, and you're essentially giving up 5% for a whole heap of pain.

Keep in mind that most law firms already provide this service. And they don't ask for 5%.

Your "pain points" are also over-exaggerated. The only reason for a company to consider a US presence is dealing with VCs or if they want to use something like Stripe or Braintree. Both of those are expanding (or have already expanded) globally.
You can get Rails to construct symbols out of a params hash in some cases.
I wonder which of Derby or Meteor was used to build that site which has been down all day. :-P
So cool, makes me wanna work there..
In what way is a bicycle an improvement over a horse as long as the infrastructure for maintaining a horse already exists? I am sure it could have been built but why bother? A phonograph provides a service that would have been unknown at the time and is a much better plan to send back with your time traveller.
I would rather have that than shitty 100ms+ audio latency that Android OS has and still hasn't practically fixed (they did theoretically in 4.1+)

http://code.google.com/p/android/issues/detail?id=3434

Not that I am a bitter Android VOIP developer or anything ;-)
Pill (Ivermectin) Could Join Arsenal Against Bedbugs
>Where's the controller?

The MV* family of patterns seems to be okay without the notion of a controller.
I'm sorry to hear that. :(

> (distinguishing between "IRL" and virtual interaction is a convenient way many people justify being assholes online).

Yes x 1000000.
I don't think that's the right thing to be looking at. That's the district court, which wouldn't be binding anyway, and if I remember correctly the appellate court had some pretty harsh things to say about the district court's opinion in that case. (As in, start over and try again, although the trying again never actually happened because at that point Microsoft decided to settle.)
I believe that statement is being actually tested right now in the US courts.

Also it looks like in EU it is officially a monopoly and in Brazil it isn't.

Also I owe @aresant an apology for rejecting his idea outright. It looked so obvious to me with bing owning about 30% of search market share!
> Python could use Qt too.

Can. Pyside is very mature for GUI building now. My concern is that the Ubuntu phone OS might not be beefy enough to run a bunch of python interpreters for apps, or that it might not come with one stock.
I think that's the point :P
I love their R&D department. If only they could mutate Ballmer into a human being using bio-engineering..
Whether it's grounded in fact has never been relevant because the in-court legal costs will far outweigh settlement -- that is the business model of patent trolling.
I find it deeply amusing that tech people are always so forgiving of bugs in software, but seem to go out of their way to blame the government for bugs in regulation just because it's the government. Newsflash: everything is imperfect, and the operation of this whole complex world we live in requires a certain amount of good faith on the part of everyone.

I agree the regulation is asinine, but for reasons completely unrelated to the incident. From the article: "Each time the loaded train crossed the border the cargo earned its owner a certain amount of Renewable Identification Numbers (RINs), which were awarded by the US EPA to “promote and track production and importation of renewable fuels such as ethanol and biodiesel.” The RINs were supposed to be retired each time the shipment passed the border, but due to a glitch not all of them were."

The mechanism in question was reasonable, and it looks like there was a bug in the implementation. While that's definitely a mistake, I don't think it rises to the level of "asinine" and I don't think that gets the importer off the hook any more than it gets a cracker off the hook when he exploits an OS bug to steal credit card numbers.
Might need to donate more - for every $1 you got paid, the evil company received more than $1 of benefit. ;)
This is not always the "standard" which wins. You may have also de-facto standards like MS-DOS in 1980' which was an "shell to rule them all" and which has made Microsoft a multi-billionar company and has been more used than UNIX which was better and open!

Either is the standard, either it the the most adapted product/company (not necesseraly technologically) which wins the pot. This is technology AND business model, user community, strategic partnerships which will make an API to rule them all a defacto standard which will lead the programmable web.
But you're right that IETF standards for APIs may be so long that I consider it is not possible untill decades !(or a leader which will open and free its winning standart to all only)
It is sci-fi in the sense that it involves speculation as to future interefence in various scientific endeavors on a industry-wide scale (i.e., soft sci-fi) by extending numerous historical examples of such practices. Also...it takes place in the future.
CDC: Overweight BMI associated with lower mortality
Don't be. I lived. (I have a diagnosis with "certain death" attached. Long story and not terribly relevant to this discussion.)

Have a good evening.
I would heartily recommend "The Mezzanine" by Nicholson Baker. It is an excellent written account of an unnamed mid-level corporate employee riding the escalator to his office after getting some lunch. The large majority of the novel is set inside his thoughts as his ruminates over the minutiae of everyday life.

What makes the book so brilliant is that Baker has an incredibly inquisitive mind. Ordinary things like straws or shoelaces become the subject of several pages worth of digression on manufacturing processes, design decisions, economics, human relationships, and so on and so forth. He is really able to look at devices that we take for granted and explore the history behind them and what makes them so interesting yet so forgettable despite being ubiquitous.

It is a beautiful book and splendidly written. I read it in one sitting I was so captivated by it.
Well, bringing the same fuel load across the border over and over again but claiming a credit for it each time as if it were a different load would be misrepresentation.

Update from the CBC story: Once "imported" to a company capable of generating RINs, ownership of the biodiesel was transferred to Bioversel's American partner company, Verdeo, and then exported back to Canada. RINs must be "retired" once the fuel is exported from the U.S., but Bioversel says Verdeo retired ethanol RINs, worth pennies, instead of the more valuable biodiesel RINs. Bioversel claims this was all perfectly legal.

So basically Verdeo was lying to the EPA by claiming it was exporting ethanol rather than biodiesel. I would not like to be the person trying to explain to a court why that should be considered legal.
You say 8000 APIs, but for example on http://apihub.com , you have more than 13000 APIs registered.
And OpenAPIs are only the emerged part of the iceberg.
Soooooooo many services ran by private APIs in big companies...more than you expect.
Assuming you could teach furniture carpenters to build bicycles from wood, the advantage bicycles could provide over horses would be cost. You don't have to feed it, and it would be cheaper initially too I am sure, at least after it gets to the point that you don't have to specially commission them. Horses used to be very expensive.

Over cheaper modes of animal transportation (donkey and cow?), the bike would probably have a speed advantage.

The real downside in both cases is cargo capacity and manual effort, but I think it could have made sense as a poor-mans transport. Barring that though, it could just be a toy for the rich.
Swiping from the edge of the screen is not always easy with a protective case on your phone, as it impedes your ability to do so. Pretty annoying problem that I haven't seen that considered in many places.
A multi tasking OS with a powerful CPU and wireless video streaming should provide those at least in theory. There is actually Miracast http://en.wikipedia.org/wiki/Miracast so in theory the bits and pieces are here already they just have to work as a package.
That would be Drupal. Nail on the coffin. I'll be switching to Jekyll + Github Pages sooner than later.
I haven't actually used it so I may be mistaken but I assume the finished podcast has one of those robotic like text to speech voices. At least for me, I can't imagine listening to any longish podcast in that voice.
similar: http://txt2re.com/
The company is "importing" and re-"exporting" the same fuel over and over again, collecting a credit each time.

The credit is only intended for fuel that is imported into the US. Under international laws, import has a very specific meaning which the company does not appear to even come close to meeting (if the fuel never left the train). Thus, the fraud is that the company is repeatedly claiming the import credit for fuel it has never actually imported.
"I don't understand what you are saying "

The assumption that this is a legal loophole is mistaken.

"It reads to me like the government is either creating perverse incentives, failing to implement correctly or failing to monitor"

Because someone committed fraud and they're now being investigated for fraud by the government?

"If it is the first, we'd be better off without the interference"

If only we were omniscient and knew which incentives were perverse.

"If it is the second, what is wrong with the government that it can't implement it's policies correctly (perhaps too complex)?"

If only the government could always put it's policies into effect perfectly like the free market. Wait, what?

"If it is the last, then why is the government not policing the policies better?"

Because justice isn't instant? Because 30+ years of one party pushing deregulation takes it's toll? It sounds like your solution to the latter is more deregulation.

"And finally, do RIN credits provide better incentives than no credits? That is the real question that should be asked with regard to the government being involved."

If only there were some way for the public to comment on future government rules.

"The government's track-record isn't great."

The track record for successful modern societies without pesky governments is stunningly less great.
Thanks for sharing this. I had a marginal experience with PA and your post is making me take a second look.

As an aside, it would be great to see more posts on HN about "why I chose X over Y"