skysight-inc/HackerNews huggingface dataset:
Is this YAML vulnerability something that can be patched in relatively short order without Rails itself having to be completely rewritten?

Or should I basically just not run Rails on any machine ever anymore, get a different web server, and start implementing my own request routing and ORM without any sort of YAML-parsing magic?

>One of my friends who is an actual security researcher has deleted all of his accounts on Internet services which he knows to use Ruby on Rails. That’s not an insane measure.

So anyone who uses Twitter, for example, could have their passwords and other data stolen through this exploit?
> You also might want to learn what the word "xenophobia" means since at no point in this article does it discuss foreign actors or organizations

"Two out of the three publishers are foreign publishing giants"

"funding some foreign publishers"

"supporting foreign publishers"
Do they hammer the webserver for this? Is the JSON pushed somehwere? I'm in Europe, so numbers are probably too high, but httping results for the file suggest this is not how it's done:

% httping http://ir.eia.gov/ngs/wngsr.json
PING ir.eia.gov:80 (http://ir.eia.gov/ngs/wngsr.json):
connected to 205.254.135.25:80 (286 bytes), seq=0 time=459.92 ms
connected to 205.254.135.25:80 (286 bytes), seq=1 time=230.15 ms
connected to 205.254.135.25:80 (286 bytes), seq=2 time=232.81 ms
connected to 205.254.135.25:80 (286 bytes), seq=3 time=235.23 ms

I would love to have some background information about how this trading works. Are there any technical details available how this works?
I'm eager to take RethinkDB for a spin, as soon as secondary and compound indexes are fully implemented.

[1] https://github.com/rethinkdb/rethinkdb/issues/88

[2] https://github.com/rethinkdb/rethinkdb/tree/jd_secondary_ind...
> Someone implemented a YAML parser that executed code. This should have been obviously wrong to them, but it wasn't.

Someone implemented a YAML parser that could serialize and de-serialize arbitrary objects referenced by class name.

It was not obvious that this meant it 'executed code', let alone that this meant it could execute _arbitrary_ code, so long as there was a predictable class in the load path with certain characteristics, which there was in Rails.

In retrospect it is obvious, but I think you over-estimate the obviousness without hindsight. It's always easy to say everyone should have known what nobody actually did but which everyone now does.

As others have pointed out, an almost identical problem existed in Spring too (de-serializing arbitrary objects leads to arbitrary code execution). It wasn't obvious to them either. Maybe it _should_ have been obvious _after_ that happened -- but that vulnerability didn't get much publicity. Now that the YAML one has, maybe it hopefully WILL be obvious next time!

Anyhow, that lack of obviousness applies to at least your first two points if not first three. It was not in fact obvious to most people that you could execute (arbitrary) code with YAML. If it was obvious to you, I wish you had spent more time trying to 'paul revere' it.

> The issue was reported to RubyGems multiple times and they did nothing.

Now, THAT part, yeah, that's a problem. I think 'multiple times' is 'two' (yeah, that is technically 'multiple'), and only over a week -- but that still indicates irresponsibility on rubygems.org maintainers part. A piece of infrastructure that, if compromised, can lead to compromise to almost all or rubydom -- that is scary, that needs a lot more responsibilty than it got. We're lucky the exploit was in fact publisizied rather than kept secret and exploited to inject an attack into the code of any ruby gem an attacker wanted -- except of course, we can't know for sure if it was or not.
Not mentioned: RethinkDB doesn't yet support secondary and compound indexes, which is a dealbreaker for a lot of setups

Definitely looks interesting though, and I look forward to playing around with it at some point.
W3C to add Cross-Origin Resource Sharing (CORS)
The bits that need high security such as production databases have extra layers of access and tracking. But most devs can push changes to the retail website.
Best Movies directed by Ridley Scott
E-Inkey Keyboard with keytops that shift to context
I really hate that I can't find articles when I need to. However, I have read that investment companies build datacenters as close to internet hubs as possible, to take advantage of the extra milliseconds gained.

If I recall correctly, this is notable in Manhattan.
The Ultimate Guide to Attracting Tons of Traffic to Your Website
> Seriously who buys gift cards for a shop that sells drinks?

I had to re-read that several times, trying to decide if your 'Seriously' was seriously serious or not...

http://www.statisticbrain.com/starbucks-company-statistics/

> Starbucks Company Statistics
> Year Value of Gift Card Activations
> 2011 $820,500,000
The other point to bear in mind is that a bad startup does not mean any particular individual was responsible.

I agree 125%. Everyone who understands business knows that it's a risky world in which good people can make mistakes, or even do everything right and still fail.

My point is that this "we accept failure" attitude in VC-istan is paper-thin. If you're a 35-year-old with a 32-year-old's resume, you're judged to be a permanent loser, and you're competing with people who haven't made mistakes yet.

When VCs say "we invest in people, not ideas" they're full of shit. They invest in resumes. Oh, and if you want to become fundable, you should spend your 20s in finance, not tech, so as to exploit the VCs' "just like me" bias. Dirty secret: most founders are ex-bankers and traders. There's a reason for that.
What's your strategy? SEO is an ongoing process. How can you get everything done that you need to in that amount of time? I've worked in the industry, and that seems like too little time to make an impact.
Its not a chart for your life. Everyone's chart is going to be a little different, but that is besides the point.
this is marketing cloaked in a developer portal. I think it's great that rethinkdb is trying to distinguish themselves from Mongo, but what's the real marginal utility of a rethinkdb over Mongo?

Mongo has been around for years, and it still has problems.

Rethinkdb is just launching a new product that essentially does the same thing as Mongo, but is maybe just a little easier to use.

I think the Yet Another Database (YAD) question still hasn't been answered by this post.
Seeking affirmation of your product idea can be dangerous
It's common knowledge in Australia that you don't pitch your tent under a tree, alive or dead. I imagine that's because Eucalyptus trees have a habit of dropping large limbs without warning (it's an adaptation to survive droughts).
Where are you located. I know a company that is great for that type of thing. They work with clients all over the US, but they're based in the DC area.
I've always been a huge fan of the visa gift cards for exactly this reason.

It satisfies a person's general aversion towards gifting cash in an envelope and still gets me a usable currency. Plus, my name isn't tied to it as well!
AWS was actually UP all this time, so perhaps that's not a bad suggestion.
A Change The Apple App Store Needs ASAP
The VC's are just one manifestation of the stress problem. I'm bootstrapped and have followed the same work patterns as many startups, trying to get the company off the ground. Building a successful company often requires extremes.

I'm also not one that values balance. I'm more concerned about failing and being left without a paddle than working 24/7 and missing a personal life.
I care very deeply for my mental health and part of that is balance. My parents always taught me to maintain balance, and it's turning out to be the most important (and hardest) pursuit of my life right now, as I do a startup of my own.

Get up early, go home at a reasonable hour (5 or 6pm) and leave your computer at work. Read a book, go out with friends, have a social life when you have the energy.

Do not sacrifice your health for extended periods of time -- it's not worth your mental, physical, and social health to get a bunch of money.
Amazon and other companies should not interview on white board.
What do you think?
Tablet shipments now more than half that of the PC
We did some testing and it should be great, especially once https://github.com/rethinkdb/rethinkdb/issues/97 makes it in.
Doesn't matter whether this happens elsewhere. It's still bad. Here's a near-Godwin-like example. If I say that gun violence is a problem in the USA, you could say "Hey! You're up in Canada, what happened with that guy who gunned down 14 women in Québec? Gun violence happens everywhere!"

It does happen everywhere. It should be stopped everywhere. But it happens more frequently in some places. There are special conditions that permit it to happen in some places.And if it is a serious concern of yours, knowing where it is and isn't most likely likely to happen again is important.
This has nothing to do with the main subject matter of the article but those graphs are almost unintelligible. I didn't even try to decode what they were trying to communicate.
Almost any implementation masks off the bit(s) before using the value as pointer (when they are not defined as zero for pointers as in this case :)) and stores the objects aligned in memory.

As for performance penalty, unaligned memory accesses are (at least potentially) slower than aligned on almost any architecture. On some architectures they are simple not implemented in hardware and cause an exception (which includes SPARC and essentially anything purporting to be any kind of RISC)

As for SPARC: SPARC actually even has hardware support for similar tagging mechanism: TADDcc and related instructions. Idea is that integers are taged by having two LSB's set to 00. These additional instructions do arithmetic as normal, but also set overflow flag (and optionally cause exception) when any of the operands have tag different from 00. Thus code can do the common case of fixnum arithmetic in one instruction (and possibly OF check) and only when overflow is detected fallback to slower codepath that handles fixnum->bignum overflows and non-fixnum datatypes.
Net 30 is very common, even if you are not Amazon.
About that. A Surface Pro with the Type Cover should be both thinner and lighter than the smallest MacBook Air. Exactly how many hundredths of a pound lighter isn't yet known since no review units were sent out and the Surface Pro website says "under 2 pounds" for the device.
The US government has a variety of ways to stomp on such countries, hard.
It looks like it's JTools: http://www.nanex.net/CodingNxCore/JTools/JTools.html

However, I don't know what JTools uses internally to generate the graphs.
The blessed languages of Amazon are C++, Java, and Perl.
I meant measures beyond remembering really hard. Writing software to brute force it with the bits I already know. Believe me I'm pretty unhappy about the situation.

Provisioning EC2 GPU instances and the like and writing the grammars.
Fascist? How so?
Angband(the roguelike) is an excellent teacher of the point made in the article.

The game is quite long and if you die you have to start over from the beginning. You can also be killed in one turn if you are unlucky and not careful. The only way to win is to lower the risk to die at each turn sufficiently that you can play through the 100 000 turns or so that it takes to win.

Playing it has really given me perspective on risks in a similar way to the author of the article. In real life you end up doing some things a lot of times and then the risk has to be damn low.
What The Cost Of Renting An Apartment In Boston Looks Like
Given the severity, it'd almost be a public service to hit every public Rails server and exploit it to patch it with the security fix(es)...
Surely, surely the experience bonus of having a startup under your belt (even a failed one) outweighs being two years older, to any rational VC?

If not, I think my opinion of SV just went down yet another notch...
"When someone gives me cash, it suggests to me that they haven't put in any effort."

Why would you assume someone has to make more than the effort of working for a pay check, and then giving you some of that hard earned cash to do with as you please?

But then you go on to say; "unless someone is going to give me a life-changing amount of money, they might as well not bother." .. what the hell, dude?
It's amazing what you can do with WebGL.

Reminds me of the mercury thing that the Gas Powered Games guy.
Ever tried to install a semi-decent framework from cabal or maven?
There are in fact places where the exchange processes trades once per hour. They are called "Call markets". Their disadvantage is trades only take place once per hour.

http://www.investopedia.com/exam-guide/cfa-level-1/securitie...
I used to work for Amazon. Unless this was willful I doubt anyone is going to get fired for it. After all, you'd be firing the guy who's least likely to make such a mistake ever again.
The spaghetti structure is one of PHP's biggest strengths and weaknesses.

A novice can just pick up PHP and run with it. She can start blindly with unstructured code, then move to methods, then finally to OO.

The downside, of course: http://www.flickr.com/photos/raindrift/sets/7215762949290803...
Bernie Madoff Investors list
Title is somewhat false, since you still rely on rubygems for deployment. It's just that you cache bundled gems and don't have to hit rubygems unless really needed.

Also noteworthy: described bundler usage is the default behavior of capistrano bundler recipe.
Want to create one for your city? Here is the source: https://github.com/jeffkaufman/apartment_prices
It would be interesting to compare PHP's growth with Ruby and Python.

For a starting developer, does it still make more sense to learn PHP?
Google donates $5,000 USD to Haiku
I haven't programmed in PHP for a long time and I could have forgotten, but I don't think there are many (if at all?) web specific language constructs. There are many things in standard library tuned for use in a web environment, that's true, but they are not a part of the language. The only thing I can think of as a web specific in a language itself is a '@' thing used for silencing errors.

On the other hand there are languages like Opa and Ur/Web or Racket instaweb dialect which do include language construct specific for web, for example static typing for forms, send/suspend or statically typed xml expressions.

I may be wrong on this and I would welcome a correction from someone better informed on the matter.
I wouldn't necessarily blame the YAML library devs, assuming they documented that it could instantiate arbitrary classes.

I do more Perl but I can tell you that "this deserializer can create new arbitrary objects" would give screaming alarm bells. And that is because there is a long history of trying (and failing) to safely do stuff like this (e.g. note the lack of warrant for the Safe CPAN module: http://search.cpan.org/~jhi/perl-5.8.0/ext/Opcode/Safe.pm )

Python has the same well-known and well-documented issue with their pickle module.

In general using /any/ deserializer that can create arbitrary objects of arbitrary classes has been known to be a bad idea for some time, and as far as I can tell Ruby YAML documents that it supports doing exactly this: http://www.yaml.org/YAML_for_ruby.html#objects

So if we were talking about a security vuln from something like JSON where we expect benign data to be the only possible output I think I'd agree completely.

Using a deserializer even more powerful than that is at the very least a bad smell from the POV of security, especially post-Spring (fixed in 2011, even if it was re-iterated 2013), so I wouldn't be so quick to claim this could only have been predicted in hindsight.

I get that it's still hard work to move from "I made an object of my choosing" to "framework pwned" but you pretty much have to assume that the former implies the latter nowadays. It was more than 5 years ago now that tptacek was gushing over Dowd's "Inhuman Flash Exploit" and I somehow don't think that pen testers and security experts have gotten any dumber since then. ;)
I think most people who knew Aaron (even briefly, like me) sensed that he had some kind of emotional problem before any of this ever happened. I knew him in the Infogami days, pre-Reddit, and I ceased our friendship because of his negativity. He wasn't mean, but my main impression of him was "Smart… but negative." Cory Doctorow wrote about the harsh experience of Aaron's mentors, who were on the receiving end of his disappointment.

Yes, the whole prosecutorial situation was adverse. Yes, it was ridiculous. Yes, he could have accepted a 6 month plea bargain… he did things which are if not outright illegal, clearly were not really aboveboard, either.

Yes, I believe that a lot of what people call 'depression' has to do with circumstances[1] -- and you'd have to have been a lot closer to Aaron than me to know if there were circumstances making him miserable back then, or if it was an organic issue, or simply who he was, personality-wise.

Many people in worse situations don't kill themselves. Many people in lesser situations do.

None of that matters. The fact that Aaron took his own life is tragic. I was truly sorry to hear it, but… I wasn't very surprised.

It's simply a fact that things are more complex than they appear from the outside. People are more complex than they appear from the outside. And when you spend a lot of time with someone, sometimes you say "Oh, they're depressed," when really they have a lot of shitty people in their lives; and sometimes it's because they make choices that make their lives miserable; and sometimes it's because they have a real organic issue that has nothing to do with their daily lives or friends/family/job or personal choices.

You can't know, though, from the outside. Only they can know.

That's the fact of the matter.

None of this downplays the need for empathy. I think it increases it. But there's no point in saying "depression is chemical" or "depression is because of shitty circumstances" or "depression is a fault of choices." Unless it's you -- and probably even if it IS you -- you can't ever know which it is.

[1] NOT saying this is to do with Aaron, but just based on my experience of a lot of different people and reading a lot of research -- "circumstances" can include all the obvious external things we think of as circumstances, and also personal, inner circumstance, such as viewing one's self as someone who has to become a world savior or the next Bill Gates, presenting a false face to everyone (result? feeling completely isolated and unknown), the choice to embrace a victim mindset, self-pity, and sometimes "too high standards" which is masking a lack of empathy for fellow people as individuals.
I've worked for 3 startups funded by firms like Sequoia, Matrix, General Atlantic and Greylock and the VCs were very hands off. In my experience, tech founders tend to push themselves to the extremes, rather than have it forced upon them.
During my time as an engineer working on Amazon.com, we occasionally experienced outages of various lengths. One of the surprising details about these outages is that they really didn't result in any revenue loss. That is, it appeared that customers would simply wait until the website was available again to make their purchase. I would be surprised if that effect doesn't still happen today especially with the availability of Amazon on a variety of platforms (i.e. customers are comfortable ordering from their phones when they couldn't get to the website from their desktop computers).
> "I am not sure how much all the safety requirements have actually changed things"

Well, absent digging into details that neither of us have, that's going to come down to a philosophical position: do you think that trends will continue indefinitely in the absence of any additional efforts to sustain them?

> "You must be watching some other debate, I consider new legislation being introduced "what to do"."

I'm watching the debate where practical political reality says every legislative proposal, other than "study the problem", is trivially DOA due the lobbying power of the NRA and Congress' makeup and existing obstructionist strategy.
Thanks for this post Steve. We're not too far from deployment and the recent issues have us slightly wigged out.

On the plus side, we can make the security revs before going live.
That is simply not true. Here's an example linked upthread for Struts, for example: http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote...
Steve, could you maybe expand a little bit on your reasons for not wanting to have the gems cached in your repo? Have you run into practical issues (deployment speed, etc.) or is it more of a philosophical thing?
Check it out at https://github.com/twitter/flight
You'd turn error reporting off completely for prod anyway.

Please don't use @
I can totally see the desire for multi-vendor gift cards, but I'd almost rather see a company like Simple handle that, not a brand synonymous with shady practices and the rest of my personal data as-is.
Cousera course Algorithms Part I, starts in 4 days
Any time. Everyone's a bit testy right now. I can barely stand about half of my Twitter feed.
11 Worst Server Outages of 2012
I think you have really, really missed the point of the OP.

First of all, what family and friends want is not the sole factor in what should be publicly discussed. If I die because I am drunk behind the wheel tomorrow, I bet none of my loved ones would want to focus on that aspect of my passing, and yet I think a case could be made that it is a legitimate topic of public concern.

Of course what Jody did was a private decision...and yet that is the problem the OP is alluding to. From all reports, Jody was a wonderful engaging person with a lot to live for. And yet he killed himself? If there is something about the tech world that causes such wonderful people to be untreated and lost, then is is a topic that should be considered publicly, and not hushed on the grounds of "bad taste"
Is this YAML vulnerability something that can be patched in relatively short order without Rails itself having to be completely rewritten?

Long story short: There's a variety of things that can be done to mitigate this vulnerability and an active conversation on which is the best option. My go-to suggestion would be having Rails ship with either a non-stdlib YAML serialization/deserialization parser or have it modify the stdlib one, with the major point of departure being "Raise an exception immediately if the YAML encodes any object not on a configurable whitelist, and default that whitelist to ~5 core classes generally considered to be safe."

Or should I basically just not run Rails on any machine ever anymore, get a different web server, and start implementing my own request routing and ORM without any sort of YAML-parsing magic?

That is astonishingly unlikely to be a net-win for your security.

So anyone who uses Twitter, for example, could have their passwords and other data stolen through this exploit?

I'd expect that Twitter (in particular) has a better handle on it than your average startup, but successful exploitation of this means the attacker owns the server, if the attacker owns the server they probably get all the servers, and they will tend to gain control of any information on all of the servers. That can include, but is certainly not upper-bounded by, passwords/hashes stored in the database. It is absolutely possible, and indeed likely, that many people will be adversely affected by this vulnerability without themselves running Rails or even, for that matter, knowing what Rails is.