skysight-inc/HackerNews huggingface dataset:
Very similar vulnerabilities have definitely been discovered in other platforms.

This vulnerability is most similar to the object loader vulnerabilities found in Spring a few years back. It is the kind of vulnerability that is occasionally found in Java web stacks.

It is a simpler vulnerability. This is a double edged sword. On the one hand, it is easier to fix (and to be sure we've fixed) than the objectloader-type stuff. On the other hand, it's so easy to reason about and work with that the exploit is straightforward. It was very difficult to find ways to talk about the general pattern of weakness in this code without immediately disclosing the exploit.

The vulnerability is similar in spirit to Python's Pickle, which is also unsafe for untrusted data. A difference between Raila and Django, though: while specific Django apps have had Pickle exposures, I'm not sure Django itself ever did.

PHP has vulnerabilities that are similar in impact to this vulnerability. But there's a big difference between this flaw (and the Python issues) and PHP: PHP grappled for years and years with a publicly known bug class (remote file inclusion) that coughed up code execution. It's not impossible that more RCE flaws will be found in Rails, but it's unlikely to become a class of bug that every Rails developer will need to adopt best practices to stop.

No mainstream web platform has ever survived long deployment in popular applications without some horrible finding. Nobody's hands are clean. It is very difficult to get security right in every single component that a full-featured web framework needs to offer. It only takes one mistake.

You are dead right about deserializers in general.
We had a database spike in load. Nothing Rails-related.
Right, there's no fail in two replacement iPads being faulty or not replacing a product with something on hand of equivalent price. I've bought lots of Apple products but even I'm not that much of a fan boy to think that's business as usual for Apple.
So I actually need to read that book twice ?

I'm only half-joking here... It's a semi-serious question!
http://ak.quantcast.com/quantcast-top-million.zip
"[Deputy Dan Eggers] suggested that Henderson should "have a little respect" for people's privacy."

While this isn't yet SMBC-style irony, it will be soon:

http://minnesota.publicradio.org/display/web/2012/08/02/grou...
But looking at "the same schtick" given a new and original perspective is still worthwhile. You may notice aspects that weren't apparent earlier.
First come the programs which generate fingerprints from writing samples. Then comes the corpus of known author fingerprints which can take a submission of arbitrary content and turn it into a series of authors and confidence values.

Later, someone will figure they can profit by gaming this system and writing posts which appear to be someone else. All they have to do is try to clone an author's style and then feed their attempts to the analysis program to see how close they came. Then they can just fine-tune things until it's a strong enough match and push it out there as legitimate.

Yep, we might just have a "linguistic similarity analysis arms race" at some point. I concluded this in a post some months back. http://rachelbythebay.com/w/2012/08/29/info/
"In 2012 2,241,475 people
pledged a total of $319,786,629
and successfully funded 18,109 projects"

Kickstarter and Amazon Payments both took 5% of that, for a total of $15,989,331 apiece.

Not that I'm complaining; $5,928 (before KS/Amazon's cuts) of that $320k was for one of my own projects.
I love the comment down the page blaming Obamacare for HIPAA.

The police obviously acted out of line here, but it's pretty difficult to come up with a general principle of how to deal with public recordings.

Of police and other officers of the state? Totally should be allowed. What if they're interacting with some member of the public, though? That person may well desire not to have their face associated with a confrontation with the police, for professional reasons and otherwise. On the other hand, a bystander recording a confrontation can provide the key piece of evidence that lets someone being victimized by the police get justice.
It would be great if there was an tracking/advert blocking solution that let you block based on what is in their privacy policy, if anything, in which country they are based, and so on.
This could allow you to only permit advertisements/tracking that are have a privacy policy that you find tolerable and that is subject to FTC enforcement/auditing and penalties.

Your conscience can be clear, since you have the means to allow sites to fund themselves via advertising if they deal with ethical advertisers.
Google Nexus 4 Alert - Powered By Twilio
Tell HN: Everything's Abstracted and No One Knows What's Going On
What I mean exactly is, "We're so abstracted. Very few people know what's going on." But, that doesn't have quite the same ring to it. Now before you get upset with me, I am not saying that I know everything, or even much at all. I am merely making observations of what I see in the web developer / programmer mind-set at large.

Relatively speaking, there are a very few number of people who truly understand the underlying technologies, libraries, processes that are being run when they utilize abstracted interfaces. Those abstracted interfaces, by their very nature, remove functionality; or at least limit it. Abstraction targets the general purpose use; not every possible use or niche use.

Yes, abstractions are great at making complex tasks easy to implement reliably and quickly in most cases. But, I am not talking about most cases. I am talking about the need to innovate. To make truly innovative things, you must break those things down to their base components, and rearrange them at the core. You can't do that using high level abstractions.

Hacker News is filled with people whining about how innovative they would be if just given the chance. But, they just keep doing the same old, tired rehashes of the same things. Why? Maybe they aren't looking for the right problems to solve. Or, maybe they don't know what's really possible, limiting their ability to think of innovative solutions.

I guess the point I am getting at with all of this, is that perhaps we should all try a bit harder to try to understand what's really going on when we use those libraries and abstractions we have come to embrace so much.
There's a bit of a difference between offering a higher interest rate to someone who just ran their business into the ground (and needs a bailout to survive) and racism. Lenders take creditworthiness into account all the time. I'd have to image destroying your company, with your only other alternative being bankruptcy, as being a valid reason for having a higher than normal interest rate. There's certainly some risk there, and there isn't anyone who was going to come along and bail out the government if their bailout money was lost by AIG.

There was a greater than 0% chance that the government would end up with 0$ (losing everything they "invested"). In order for them to agree to take on that risk, they needed a suitable interest rate in return. At the time the deal was made, comparable "junk" bonds were at or above that interest rate. It's just the return that investors want for such a risky investment. It's not at all like racism.
I'd be curious if you have data on the risk of lane-changes. (Knowing how dangerous they are would probably cause me to do fewer of them.)
Composed Method.
Seriously, leave off the closing tags. They can only hurt you when you accidentally commit trailing whitespace.
How about just installing a video camera in the cellar?
who iz stoopid enuf 2 right in der normal stylz wen dey do bad tings?!
Ask HN:MMA fighters and boxers fight preparation?
If MMA fighters and boxers only knew the day of the fight who their opponent is, would this have altered the outcome of most fights in history?
Yup, when github barfs, you can still happily keep on hacking.

You're also not limited to one shared repo by any means, so even synchronization between multiple developers can continue when github is down. To avoid problems it's of course a good idea when one of the repos is a "master", and if using a secondary repo for synchronization when the master is down, you'll probably want to switch to unique temporary branches for the purpose.
> it's pretty difficult to come up with a general principle of how to deal with public recordings.

No, it's not. If you're in a public area, there is no expectation of privacy, period.
Heh, Morgan Stanley ran into this when the were trying to stay afloat after the 2008 crash:

> At this point, under any other circumstances, the $9 billion would be wired electronically from one bank to the other. But there were a few problems with wiring the money. First off, it was a holiday weekend and banks would be closed in both countries until Tuesday. Secondly, wiring any amount of money usually takes 2-3 days and Morgan Stanley may not have survived another 24 hours! Finally, Morgan Stanley was itching to make a formal announcement of the merger as soon as possible in order to stop their stock price from plummeting any further. ... A few hours later, the Mitsubishi bankers returned to Morgan Stanley’s headquarters with what will likely go down in history as the biggest check ever written.

http://www.celebritynetworth.com/articles/entertainment-arti...
> It's amazing to me how much expense comes out of fear.

If you are amazed by that, I suggest you spend a chunk of time outside America. The rest of the world is not run by fear.

I spent last week in America, and was amazed by how pervasive that culture is there.
Seriously, "accidentally commit?". See ~project/.git/git-hooks/pre-commit. Only a sloppy train of thought can hurt you when programming.
Maybe put it github. As a side note, the site does not look like high maintenance as is, maybe due some marketing around it using facebook targeting certain groups, get an adwords voucher for $75 add some keyword adds. This is just minimal stuff to test the waters "Explore-Exploite".
Advanced Vim Registers
I know, note what I said "...maybe just not enough. It would definitely be a welcome addition to the language"

People have proposed it and commented on it but it does not get enough support (votes) from senior devs to get included. Maybe with more requests it will get included finally.
They shouldn't be out in public.

The courts have routinely ruled that there is no expectation of privacy in public. This is why CCTV recordings are allowed.
So setup 1 small git server that mirrors your most critical repositories which devs can failover to in the event GitHub is down _exactly_ when you need to integrate changes.

I wouldn't call this "building around" GitHub. Git's nature promotes this kind of thing.
Wow, yeah, you could do that.

Or you could just leave off the closing tags that serve no purpose?
Well, you are right, the idea wasn't thought out very well. I was in a bit of a bad mood during patching up various rails deployments around here...

However, perhaps they could just promise to post a signed message, in a specified format, on a dedicated twitter account, if such a thing happens again. This would seem like a relatively low-tech approach, about adequate for such a rare event (just keep that secret key secret!).

The community can then roll their own gems to watch said twitter-account and act according to any user preference. Perhaps one of these gems would even make it into rails-core after sufficient review.

Obviously one can always argue whether such a rare case deserves dedicated infrastructure. But on the other hand we have yet to see how many rails deployments will be bitten by this incident in the long term. It's not uncommon to see years of exploitation for a vulnerability in a popular piece of server software.
>they had both invested cash and time

I have a question - when calculating % of shares for founders, do you calculate the time put in on top of cash, or only the cash being put in?

Say you have three founders, one who puts up a larger portion of cash but doesn't do any work, and two others who actually do consistent work and put in some cash. Should the ownership be divided by cash alone?
TIL all people in the US are complete idiots.
A fancy cheese grater sounds much more interesting than the insanely boring/tacky industrial design of the xbox and ps3...
Idempotence versus Referential Transparency
I think one issue is that if in these situations, the guy is high-fived, and the girl is shamed. Why can't they both be high-fived? Sex-negative culture SUCKS.
See below.

Why on earth are you, the guy preaching simplicity, advocating for including absolutely useless, unneeded code at the end of every file?

How does that reconcile?
What a waste of taxpayer money... if we add up the costs of all of this BS (time spent by both cops and defendant, courts, attorneys, misc. paperwork), I'm sure it will be in the 10s of thousands of dollars.
Hussein stole emla cream, that’s why he was hanged
Emla cream is primarily used for minor surgical procedures such as taking blood samples, vaccination, cleaning leg ulcers, skin grafting and inserting intravenous catheter. I is also use in procedures in minor superficial cosmetic procedures and procedures associated with genital skin. EMLA Cream is packaged in 5 gram tube and in 30 gram tube.
1. make a cool thing[1]
2. make a pitch video
3. launch kickstarter campaign
4. promote kickstarter
5. make and ship the final products and various higher-tier perks
6. profit![2]

[1] alternatively:

0. spend a decade or two building up a reputation
1. promise to make a cool thing

[2] assuming you don't end up eating all your profits and then some on manufacturing and shipping those perks.
This is the same advantage JRuby has in that Java developers don't have to convince someone in some chain of command about installing a new tool; it's just a jar file.

It's more of a plus if you already have a JVM in place.
Github Enterprise runs on your own servers. Not theirs.
I tried hiphop earlier this year, on a large WordPress installation, and it does not make the cut. It's unstable, crashes randomly. This on top of the pain of working around missing features, like eval or dynamic vars (think $$foo). It does show great promise, but until it gets heavy use outside of Facebook, it's not for me.
Of course, but not the right to be successful in doing so. Most sites where I have adblock enabled have too many ads to the point of making it difficult to navigate the content. OTOH, I don't block ads from google, since they are visually restrained and unobtrusive.
I say "promptly at X" when something is going to start at X, and I start it at X and finish it at X + appropriate time, prioritizing stuff I want more than them.

I don't say this for everything, but for many things.
Thinking aloud, do we need some kind of auto-update feature for rails apps? This kind of exploit suddenly exposes the multitude of Rails apps out there to remote code execution. I know it wouldn't be a trivial thing to make, but we already have yum auto update for linux and auto updates for Windows, OS X etc, it should definitely be feasible. Scope could be severely limited, so for example, a monkey patch for big vulnerabilities like this, while sending a notification email to the app maker.
Perhaps instead of treating "haters" as a pejorative term one should feel inclined to stand by it. I don't see what's so odious about wanting to see assholes fail. If there's any justice or karma in the world, I'd expect it.
On Falling Over
i think you're actually agreeing. what one of you is calling a key the other calls a no[u]nce.

the implicit (worse) alternative is that you encrypt or sign additional state in the url (and in this case, base64 was the "encryption").
Those are all personal, although your last one includes work information. My work has a separate identity from me, has a separate email address, and has confidential information that needs to be bounded by that work. Intermingling it with boards associated with my personal identity is wrong, and in violation of several work NDAs with partners.

It should also be the case that my work can disable/cancel my work account and be confident of no further work related access by me.
We're not systematically removing it. It's still there for other people. We are automating our own choice not to view it. What you do at the server side is your business.
So, basically, the suburbs are the problem?
For parties, yes. For Dinner? For Meeting for Sports? Nope. Not going to work.
I'm not sure that's the whole story. There are lots of reasons to live in Manhattan. Being able to walk or take a quick bus to work is one. Wanting to live in a modern building is another (although there are finally some coming up in Brooklyn). By far the overriding thing keeping Manhattan real estate prices high is housing regulation. Given the density of Manhattan, it should look like Hong Kong in terms of high rise construction. But instead, there are vast tracts of land below 96th street wasted on low-rise, pre-war apartments that have zero historical value (former tenement housing).

As for schooling, I think it's about fear but I think you're incorrect about the subject of the fear. These days, basically the only kids left in public schools are the kids whose parents can't afford to send them somewhere else. High-income city dwellers do not want their kids going to school with recent immigrants, poor minorities, etc. It's ugly tribalism, but when it comes to housing and schooling choices it's a driving force.
OK. I am basically a 15 year Linux user, web-stack focused code-wise, but never left the source-based Unix environment and unix-fu. Compiling kernels, configuring HA clusters, low level packet mangling, all good. These days I'm mostly interested in improving development process, emerging kernel features, and systems architecture. Working for a startup remotely right now, very hands on ... everything from speccing hardware and layout to purchase, physical network configuration, system setup & ongoing admin, design of full web stack .. writing all code through to JS .. even UI design. My strength, I would say, lies in breadth of experience and honesty. It took me 15 years to get a job this fantasic though, and that's constant work. When I meet office-dwellers, in a bar, I explain to them: that's longer than a BA, MA, PhD and a few years of work experience combined. And I had to office-dwell, too, once.
Not trying to undermine your skills, but if you can't get something done, it's not the tool's fault.
Just to be clear, Flash is being used to "detect" fonts on your computer.
Interesting note: There wasn't a single mention of the Pebble watch or Ouya game console, by far their two biggest financial successes. Kickstarter is not a store. http://www.kickstarter.com/blog/kickstarter-is-not-a-store
Ask HN: Why no mobile redirect for Hacker News?
I came across the mobile version while searching on the API. There's not even a link in the navigation?!
I still have over a dozen Radio-Electronics and Popular Electronics issues from the 80s and 90s that show how to make all kinds of neat high voltage toys :)
Public = Subject of whatever camera anyone wants to point at you.
One should never assume that he has a handle on everyone who knows the existence of a bug.

I think you underestimate your adversary. https://twitter.com/mikko/status/288766998228393984
It’s one of the biggest reasons I’ve heard young entrepreneurs prefer San Francisco over LA or New York: not a lot of girls to distract them.

Did Sarah Lacy really just say that?
Ask HN: News and Social on the lockscreen?
I was wondering:

Are Android users interested in receiving their news and social feeds on the lockscreen in a flipboard-style format?

Would you download an application that places an intuitive, beautifully designed news/social reader on your lockscreen?

Just new? Just social?

Is there some other tool you would like to see on the lockscreen?

Let me know what you think.
Full article on NY Daily News:

http://www.nydailynews.com/new-york/nypd-controversial-stop-...
I was hoping for a solution that can solve (or at least minimize) the problem between 6-9am and 4-7pm. I think there are a lot of short-lived local effects that can be avoided. For instance near my office is a government agency that quits work right at 5pm on the nose. If I leave one minute before 5pm it is smooth sailing, one minute after 5pm and traffic is snarled until 5:30pm or so. Also, as far as general commuting, the school start times are one major effect since these are local and hard set arrival times for the parents. A smart database could calculate these effects and other cross-interactions that really impact jams so a small change with x% of drivers can prevent avoid the log-jams or backups that take time to dissipate once they form. Perhaps the data could even be used to get schools with interfering traffic patterns to stagger their start time 30 minutes which could have a huge impact.
There is certainly a line that can be crossed when it comes to over thinking OO. However, Dependency Injection enables you to write much more testable code where in many cases people would use static methods therefore breaking the ability to properly unit test.

As for your argument against traits, using global functions clutters up the global namespace and doesn't lend very well to modular development. Next thing you know you have two libraries with "create_hash($string)" or something similar that do two different things.

*Edit: clarification
Extremely crtical Ruby on Rails bug threatens more than 200,000 sites
I cannot seem to find a major PHP framework that leaves it in so I will go ahead and officially call leaving off the closing tag a best practice by reason of: common sense, prevention is better than cure, type less--not more, etc.

Let's also hope that no noobs that were doing, or trying to do, the right thing (formal company coding practice aside) were negatively impacted in the process through performance reviews, perception, compensation, or otherwise. We understand that best practices are subjective to a degree, and that features of any language or platform will be abused. I also take this opportunity to encourage the PHP developers to add features that they believe solve real world problems and continue to make life easier for other developers.

slams gavel

Thank you for watching Coding Court lmao
Yup, Thorium is awesome. Energyfromthorium.com is a great resource if you want a further background. Also, if you want the actual technical papers that Kirk Sorensen painstakingly manually scanned in, please go here http://energyfromthorium.com/ornl-document-repository/

P.S. - if anyone has any use for a Chemical Engineer who really enjoys Thorium/Modeling, please contact me!
Great points. But: How do you make a living while combatting this?

I am torn on the question of universal medical coverage, for complex reasons that I imagine no one here wants to hear. I am wondering, though, if anyone has any ideas on how America could implement government funded, universal healthcare, what pitfalls we should look out for, etc.
"To make truly innovative things, you must break those things down to their base components, and rearrange them at the core. You can't do that using high level abstractions."

What the? How did you even reach that conclusion? That's a fallacy. It's all an abstraction, all the way down to machine code, like it or not.