skysight-inc/HackerNews huggingface dataset:
This is not a hack it's basic Javascript.

If a malicious hacker can insert some script in a trusted page, security is pretty much completly broken and you have other worries. The fact that you can make links in this page point to other malicious pages seems like a small problems as most people won't even check the domain before clicking the link.

I would think that some users are most likely to check the address bar after clicking the link. But my dad would probably woudn't see anything.
What if their database is empty?
Thanks for the feedback! I'm looking into the delay issue, hopefully will push a fix soon.
Side project, use sounds to track your sleep, give it a try.
What could possibly go wrong?

Oh I know, like the last time government pumped massive amounts of money into biofuels and there was a massive food crisis in the 3rd world due to rocketing food prices which was caused by the government buying up massive amounts of corn for ethanol fuel.
You mean like the "stimulus" spend that shot wind power from ~1% of the power grid to ~6%, approximately 8 years ahead of when most forecasters head predicated this would occur?[1] You mean the "stimulus" that caused renewables to be 55% of new power that went online in 2012? (Which is really significant when you consider demand is flat?[2])

[1]http://www.bloomberg.com/news/2013-01-18/u-s-wind-power-acco...

[2]http://en.wikipedia.org/wiki/Energy_in_the_United_States#Con...
I believe that by definition a patsy is always quite willing.

The OP might be a little off in this case, but I fail to see how this is inane. A publication that is run by someone who has a conflict of interest released a large media blitz that undoubtedly painted Mailbox in a very positive light, leading to an arguably overpriced acquisition.

I honestly don't know enough to make a judgment, but following the money has never lead me wrong before.
It was purely gathering thoughts to what I consider a flaw. Sure, it's not the only way to do it -- but this is it in it's simplest form.

False redirections is the principle. I'm not sure how to fully eradicate it in that sense, but I think to bring attention to the possibility is somewhat beneficial rather than sensationalist.
If you are unhappy with your taxes being too low you can always write a check to the IRS for whatever sum you believe you are underpaying.
Let's try to think through why they might not want to make it completely automatic without several steps. Hmmm. What downside could there possibly be. Let's think. Let's think....

Nope, I can't think of any. Oh wait aren't we're actually responding to a post about a vulnerability in the update mechanism, when you say, "not only is it vulnerable, but it should essentially be automatic!" :)
New! A simple yet powerful tool to mine and visualize data. Need feedback!
Sometimes the obvious problems are really hard to put a finger on. The new design for example tries too hard to look good, almost de-emphasizing the message.

The fact that they are even previewing the website with dummy content tells me that they are focusing on the wrong things.
The only reason that I don't like it isn't for attacks, but for undisclosed affiliate schemes. Even if I'm watching my address bar once I get there I may have been 301'd before I could notice the bar changing.

Not that bad, but still kinda sucky.
Extending your poorly thought out analogy: in the real world, a person who uses "free" services is equivalent to a homeless person - you get almost everything for free, in exchange for other people getting to see what you're doing. If you care about privacy, you'll pay for a proper home.
Replace it with a try-python style interactive shell!
The good thing about google voice is that when it is finally axed, the US laws require them to give a way to port numbers. That's the only reason why I was comfortable using their service
The danger of this, is not (IMO) people inserting personal data or financial data on the end page (which would be avoided by paying attention to the URL bar), but in targeted attacks where the page serves up a IE/Flash/Java exploit compromising the users machine. At this point it doesn't matter what the end result is, as the damage is done. Also, an attacker can simply redirect to to the orig page/target after exploitation in such a way that the majority of casual users wouldn't notice, as there is no user interaction at the end.

Example a link to an article or PDF report of interest is Hijacked via this method (where the hover is correct but actual target is malicious) the user quickly hits the exploit site and is compromised/malware dropped while the exploit site displays a splash page of some sort briefly, it then forwards to the orig. destination.

I don't see the majority of non paranoid users detecting this, even if they are in the right mindset, as they end up at the proper site with nothing more than quick, and now ubiquitous, splash/ad page in between.

EDIT: I'm not necessarily advocating any change, this behavior can be tracked and blocked in a properly secured infrastructure, but this is where I see the potential for harm.
Show HN: Cibarsi.com - Create a website for your restaurant
Essentially it’s a site that allows small restaurant owners to build their own site, without any technical skills. Think of it as about.me for restaurants. The issue is that if you own a restaurant and you want to communicate and interact with your online users, you need a website.

But the whole “building a website” scenario sucks. You’re stuck with having to contact professionals to build it, and you end up spending thousands of euros in the process. You end up with something that you basically have no control of, and every time you want to make specific changes to your menu or anything else, you have to waste time and energy to contact your “webmaster”.

Cibarsi gets rid of all this extra boilerplate and puts you in charge of everything. With a very basic interface you can edit your menu, change the color schema, add new images, etc. And in the end you get this very basic webpage where you can show off your restaurant and make it visible to your online clients.
Completely unrelated, but I love the "certain pink rock" phrase.
i do not believe that i am confused.
let me recap for you just in case

whao: who cares whether he paid, he contributed value

8gig8: i concede that he has contributed value, but maintain that the package author has violated the license

me: i disagree with your assertion that the author has violated the license, and place the burden of responsibility on you to substantiate your claims

8gig8: i will vaguely avoid substantiating my claim

me: at this point i will express the reasons why i disagreed with your claim and ask you whether you agree with them or not

8gig8: (crickets)
If your only goal is to send the user to a malicious page with a payload then you don't need any user action.

Just do: document.location.href = "http://malware.com;

And you are done.
When is it ok to bash a founder
Google Reader: A Product vs. A Symbol
>> I certainly support research, but isn't there a sequester looming

Looming? No. It has already taken affect.

>> I would be happier if Obama took steps to raise taxes.

Do tell, what steps would you have him take? The Republicans have sworn to not raise taxes at all. They control the house and have unleashed a record smashing set of filibusters (and no, not the Rand Paul style) in the senate. Thanks to gerrymandering, they can (and must) hold stedfast to ideologues. There's also the corporate interests to look after.

>> At the place I work we lost an employee due to grant shortages.

Classic. You want taxes to be raised so your employment can be safeguarded. Meanwhile the grants, and jobs in turn, are a waste of time and energy.
Yup. It's not like they paid cash. I would be shocked if that price tag was not mostly stock, and tied to future performance. Details matter here, and everyone getting in a huff over something they really don't know about is just wasted emotion.
Plus: I'm relatively comfortable distributing my GV number widely, since I know I can selectively block calls to it in a way that I can't with my iPhone (cell number).

Minus: My GV calls have noticeably lower voice quality.
With relative ease, you can build websites with a cheap $10 SSL that can impose to be a PayPal page. JavaScript can provide phishing and accessing cookies, but beyond that, I'm not really sure what else it can offer.

It may be simple code, but I think the title of the post explained that.
Constructive criticism:

The shadow on the logo is too dark and looks wierd. Also, I'd put a call to action, like "Download" or "Learn" in a more visible format (maybe on a button) in a larger font, above all the "blocks", along with the content of the Statistics block.

The PSF block at the bottom looks out of place. (I really love the way you show additional information when I hover on the links in the second navbar. I'm not sure how that extends to touch based devices, but you could probably present the PSF block in a similar way.)

The "Socialize" link looks out of place too and should probably be on the upper navbar. (The other "actions" in that block are related to the site itself - search and text size)

I agree with the others that that code sample should actually be an editor with the ability to actually execute code.
Thanks for sharing, great hack!
BeOS and Plan 9 have such different concepts of OO that they're hard to compare. In BeOS, there's a C++ interface your applications have to conform to, and it's somewhat machine-centric. Your objects are live processes in memory.

Plan 9 guys tend not to like the design of HTTP ( http://http02.cat-v.org/ ) so don't tell anyone I used this illustration, but Plan 9 is OO similar to the way REST is.

In Plan 9 (and Inferno) your objects can be files on disk, structs in memory, devices, etc. Anything that can conform to the interface. The interface in this case is files. Your objects expose a filesystem, and you interact with them by means of the usual tools for file manipulation. The Acme editor exposes a filesystem, the clipboard ("snarf buffer") is a file, and the network is, instead of a group of special syscalls, a filesystem. So you could write a shell script that reads a URL from the snarf buffer, downloads the page it points to, and puts the content into a new window in Acme, in three or four lines, without using anything more complex than cat and echo.
I am going to take you at your word that you aren't baiting me. Yes, you can (and people have) predicted where a roulette ball will land while it is in motion, particularly if you have the aid of cameras. This is more useful in European Roulette and American Roulette - but it can work.

What you can't do, is come up with a positive expected value through any kind of betting pattern.
expelled!
Your article's great! I'm an IT guy in Vietnam and I really appreciate your help with IT teaching for Vietnamese students.

However, there're some points which I don't agree with you:

1. This school seems to be a good one in a great city in Vietnam. No way they're lack of money to hire enough CS teachers to teach their students. No offense, your help's great. But I just don't agree with the reason they (the school) told you.

2. Broadband Internet connection is cheap and popular in cities nowadays. A lot of Vietnamese students have ADSL or Fibre connection at home, so I don't think the school "can't afford a reliable internet connection". There're even educational service plans with much cheaper price.

3. The CS program you mentioned in your article is the advanced one.

Again, I love your work. Thank you ;)
The point remains that this kind of thing is entirely possible via "legitimate" methods, too.

If the bad guys can inject Javascript into your page, it's game over, period. The attack vector is meaningless; there are tons of them. If I can inject my Javascript into your page to hijack your clicks, why would I bother with that rather than just putting an invisible iframe into the page that delivers the payload without any user interaction required? It's going to get me far better results, doesn't rely on undocumented behavior, and isn't contingent on a user failing to notice a splash screen.
I originally used google voice as a really quick way to get a phone number while setting up a business, but later moved the number to a dedicated cell phone.

I still use it in that capacity, given that they don't give more than 1 year clarity (every year they only extend their assurance by 1 year)
I'm not sure why you're being downvoted, your point is legitimate.
Ha. I'm very much aware of preventDefault(), but to add that in my article won't make any difference to my point.
TechStars reality show
I am working on something similar with the prospect of getting CannonJS physics to work so that one can walk the city (in my case procedurally generated): https://twitter.com/dirkk/status/309024330115842049

I also tried a multi-device approach for visualisation: http://www.youtube.com/watch?v=-TiZzovx5YE

Any chance of collaboration?

From this thread I reckon there are quite a few people working on something similar. I guess it would be extremely cool if we could join forces.
I'm not sure I buy this argument.

First, while people may be increasingly equal in material goods I think a fair argument could be made that they are increasingly unequal in political rights. The Koch brothers have much more political power than the average American,for example, and most of that is down to money equalling speech.

Second, there's the question of whether skill is actually rewarded perfectly, or whether there are social factors at work, making someone's race and class an arbitrary handicap.

Third, it's entirely possible that people contribute far more than those at the top think. Sure, you might not swap your superstar basketball player for a guy off the street, but how far would you get without a good team doctor, or accountant, or the police officer who stopped them being mugged, or the midwife who kept them alive in childbirth? I think the argument for only some people being 'wealth creators' ignores the fact we all rely on other people most of the time.

Fourth, there seems to be a large excluded middle. For example, the argument that:

> If you suppress variations in income, whether by stealing private fortunes, as feudal rulers used to do, or by taxing them away, as some modern governments have done, the result always seems to be the same. Society as a whole ends up poorer.

... suggests a choice between two extremes.

What's wrong with a system which allows some variation but also keeps it from getting extreme?
Irksome it may be. If you were Michael Arrington though, would you do anything to further your competitors' position at the cost of your own? I dislike his arrogance, but have to wonder what I'd do in his shoes...
Good post. Henry Ford also understood this concept, he raised wages for all his employees in an attempt to drive up wages so more people could afford to buy his cars and it worked. What was true then is still true.
Uh, extortion.
No Google Reader? No Problem: Startup Spundge Gains 10,000 new RSS Feeds
> JavaScript can provide phishing and accessing cookies, but beyond that, I'm not really sure what else it can offer

if you had success putting your JS payload on target website you can do anything. Period. From from stealing user's passwords (http://homakov.blogspot.com/2012/11/xss-save-your-password-p...) to executing any authorized request POST /send_money. The last thing attacker will do is to "phish" you.
All I can say is Bravo.
The problem with python's website was never that it wasnt "Sexy" enough to attract newcomers. Its that the documentation was never as well written or well organized as other languages/libraries like ruby and jQuery.
It sounds like they can't get the votes to approve it, which makes sense. It's gotta be political suicide. Either way the banks are going to be destroyed.
That would be fantastic, and pretty doable, I would think.
A quaint but very worthwhile read (we know, Comic Sans isn't cool). Lots of fun stories, and it helps control those impulses to just start hacking at the weeds.

http://www.debuggingrules.com/
These banks were paying 9+ percent interest on some accounts. If it sounds too good to be true, it probably is.
Well, then charging $10 to view it would clearly match the definition of fraud.
some classes depend on a sort of "co-learning", e.g. writing classes and some programming classes on coursera have bits were the homework you do gets peer evaluated (and you're of course expected to evaluate your peers in turn), which works on a fixed schedule basis, but doesn't in a free form thing.

But, as others said, you can usually go back to the classes on your own time, which means you just missed the "timed" bits.
It can be used to lead you to a page that exploits the browser, before you realize you're not on the expected site.

There are, most of the time, undisclosed zero day attacks in the wild, for most browsers and plugins.

I should add that I check the URL bar when I enter information, but not always when I browse casually. I always check the target of links, though, and this could trick me.

I wouldn't be surprised if some users never read the URL bar... people who can't tell a browser from a search engine, for example.
Well, I certainly agree that atleast prompting to update is worthwhile, but there are several steps afterwards -- the equivalent of installing a new application -- every time an update comes out.
> It's also kind of upsetting that this post is at the top of HN and getting a kind of froth-at-the-mouth reaction that it is.

It should be upsetting, because after enough posts like this, hopefully something will be done. When it comes to ethics -- be it in politics, corporations or journalism -- behavior must not only be clean and honest, it must also be seen as clean and honest. Sometimes the people involved know that they have acted completely ethically, but they don't see how the public may perceive the situation to be different. And since public perception can hardly be changed (and it hardly should as long as unethical behavior is not uncommon), it's the people that are in the public eye who must watch their behavior rather than assume (incorrectly) that the public grant them the benefit of the doubt. They should not only make sure to behave ethically, but must make sure their behavior appears ethical (in fact, if they don't want this kind of reaction, they could act unethically as long as they appear clean :))

Now, in this case, the problem is TC. As long as TC's ethics seem "controversial" as you've put it, everything they do will be tainted. They could practice the apotheosis of ethical journalism, but as long as the conflicts of interests are not visibly resolved to the public's satisfaction, they're going to elicit such reactions. It might not be fair, but that's the way it is.

Because this is the "TechCrunch situation", any company that receives an investment from funds directly or indirectly associated with TC should -- if they want to avoid this possibly unfair though perfectly to be expected response -- distance itself from TC by requesting not to be covered by them. Or, it might not care about the reaction, in which case it may choose to do nothing about it. Hopefully, companies in this position will care, and if enough of them do maybe this will have an effect on TC or other tech publications. It's unhealthy for an industry that so much of its media coverage has a cloud of suspect ethics over it.
as a Cypriot who will lose part of his money I believe voting for this measure is the best of the two options even though both are bad for us.
Be Happier: Things to Stop Doing Right Now
bjornsing's blog post is a good read, and gets it right imho.
http://conscienceofanentrepreneur.blogspot.se/2013/03/whats-...
I'm a Rubyist but I find that curious because the more common public complaint seems to be that Ruby's documentation isn't as good as Python's. (And its official site is rather tired, to say the least.)
There is an old add-on from Firefox called Brief. It takes your Live Bookmarks (RSS feeds) and wraps a nice GUI around it so you can use your Live Bookmarks effectively like how other RSS readers behave.

Firefox syncs all of your bookmarks which would include your Live Bookmarks/RSS feeds. Assuming (I have not tested it yet) that this sync process retains the state of your read/un-read items, this could potentially be a hybrid solution where you are using a locally installed feed reader, while at the same time you can sync your data without loosing its attributes.

Does this make any sense? I'm not a developer, just a reader.
part of the loss was due to Greece's bail out last year. Cyprus had huge investments in Greece and when Greek debts were written off Cyprus debt automatically went up overnight. add to that bad management from the government and banksters and you have an unmanageable debt.
I really liked Python's documentation. I read the tutorial and it got me up and running really quickly, and whenever I had a problem or needed details of the arguments it was an invaluable reference.

Clearly, not everyone thought so. What did you not like about the docs?
Indeed. The premise is flawed to begin with. From the link:

> "If a complete stranger holds a camera to your face you know what he is doing and you have a legitimate reason to tell him to stop doing it, most of you will probably object to it."

As a street photographer, that last part is entirely false. The vast majority of people have no objections to being photographed in public - almost all reactions I've ever gotten have ranged between "huh? meh" and "oh cool!".

The reactions he got in the video was because he was behaving like Lord Regent of the Universe, not because he was recording someone. My unscientific estimate is that >95% of the people I've ever taken pictures of (all strangers, almost all without seeking permission beforehand), are either ambivalent or downright approving.

Which goes towards the point: Google Glass is the vehicle for the problem, not the problem itself. The problem, as it has always been, is with assholes.
I've updated it. Sorry about that.
Maybe so, but there are a handful of overriding reasons I can think offhand for why you don't make updating more automatic

1) The customer didn't ask. It's their PC, not yours.

2) "Backwards compatibility." See: https://xkcd.com/1172/

Basically, if you don't leave your program bit-for-bit the same as it was, maybe you break someone's shitty workflow that you could not possibly have predicted and which has no grounding in anything sane.

3) BIG ONE!!! You might have made a mistake. The old version worked fine, for millions of your customers. But you just pushed a version that causes a fairly common setup to have all sorts of problems.

How do you protect against this? Well, for one thing, you can make the update process a bit more involved. Track it better. Keep logs. Nip it in the bud. (Meaning when the first few complaints from early adopters - who jump through the hurdles - trickle in. Not millions at once.) That way you won't accidentally screw your whole entire installed base for NO reason (what they had was working fine) and cause literally millions of dollars of damage (lost productivity as people, some of whom have no access to any IT, simply cannot see their screens anymore).

4) Maybe your installer is not doing what you think it will do. i.e. vulnerability or error in installer. When you mess remotely on a user's PC, this is not to be taken lightly. At all.

This is actually squarely the territory we're in with this article.

So, I find it kind of funny that in an article on an update vulnerability, someone quips that not only that, but it should be WAY more automatic! :)
Cool name :) What's the story behind it?
Yes, but it's hard to prove. And they could stuff it with a few fake numbers so it's not technically empty.
Yeah. They have a litte bit more information on their own blog about it: http://www.artisopensource.net/2013/03/17/incautious-porn-a-...