skysight-inc/HackerNews huggingface dataset:
Knowing that all user-data is required to have a user-credential, use this fact when issuing the urls to the browser that instantiate this request, make these urls specific to the user and cryptographically bound to their authenticated state.

session_id = '5f5513f8822fdbe5145af33b64d8d970dcf95c6e'
ajax_endpoint_secret = 'this is a super secret!'

token = hmac.new(
ajax_endpoint_secret,
session_id,
hashlib.sha1
).hexdigest()

- or -

token = '3815c118a9e3e663215adba5e0ca626e8bdd5125'

then when your server emits the html page, your AJAX link looks like:
https://example.com/ajax_api/3815c118a9e3e663215adba5e0ca626...

Here, we have cryptographically bound the AJAX url to the user's cookies, so the <script> trick won't work any longer as they don't have access to the token.

Second, you can have your server endpoint checking for the 'X-Requested-With: XmlHttpRequest' if you anticipate this to only be accessed via XHR. This is a pretty effective thwart of the <script> attack as well.

Lastly, ensure that your JSON response always is wrapped in curly braces {}. Never respond with [] From my experiments, all browsers interpret this as a code block and breaks processing when <script src=> runs.
Knowing that all user-data is required to have a user-credential, use this fact when issuing the urls to the browser that instantiate this request, make these urls specific to the user and cryptographically bound to their authenticated state.

session_id = '5f5513f8822fdbe5145af33b64d8d970dcf95c6e' <-- whatever your auth cookies look like
ajax_endpoint_secret = 'this is a super secret!'

token = hmac.new(
ajax_endpoint_secret,
session_id,
hashlib.sha1
).hexdigest()

- or -

token = '3815c118a9e3e663215adba5e0ca626e8bdd5125'

then when your server emits the html page, your AJAX link looks like:
https://example.com/ajax_api/3815c118a9e3e663215adba5e0ca626...

Here, we have cryptographically bound the AJAX url to the user's cookies, so the <script> trick won't work any longer as they don't have access to the token.

Second, you can have your server endpoint checking for the 'X-Requested-With: XmlHttpRequest' if you anticipate this to only be accessed via XHR. This is a pretty effective thwart of the <script> attack as well.

Lastly, ensure that your JSON response always is wrapped in curly braces {}. Never respond with [] From my experiments, all browsers interpret this as a code block and breaks processing when <script src=> runs.
What do you mean by "linux kernel without the usual userspace tools"? Openstack runs on a complete system with all the tools you want to install, not some bare kernel machine.
http://xkcd.com/705/
Isn't 19 too old to be considered a "wunderkind," per the article title? It's hard to consider someone to be a child prodigy when they're legally an adult.

EDIT: Not criticizing the article, I'm just confused with the language.
I've been prepending with ], which as far as I know is enough to make any JSON data into a syntax error... is there a reason why these companies use longer things?
Can someone please show the java guys the <Number>.TryParse(String s) from C#?

I'm convinced everytime I have to manually write the try catch clause for parse a kitten dies somewhere!
I agree that it's alarming to think of cyber-warfare escalating to a war, but I don't think it's unrealistic or uncalled-for. I'm concerned that a cyberattack could be misinterpreted (not really an attack, or originating from another body) but that's an education and sophistication problem, not an error in the legal premise.
Welp, hope some people enjoyed it! I see it got flagged. Not surprising I guess, but I'm not really sure what harm it was doing.
Streaks are motivational and demotivational
Glasshole
> See poorly configured DNS servers and ISP's failing to configure their networks properly - so traffic with a source address which is not part of your allocated IP block is not allowed to leave your network. It is not that hard!

It may not be that hard to set things up this way, but very few ISPs configure their network with this restriction.
Really? I can't find anything one way or another on the Cedar stack, but on the old Bamboo stack they used Thin.
Why? So you unambiguously know that all your transactions are reported and data mined? sigh.
This reminds me of the days when I was learning, even before I got into college. Fortunately, we as an industry have more resources than any other field for beginners, but as lelandbatey said, "...we really should do a better job of explaining things to people,..." - +100
Yep, that was the original source, it didn't gain any traction or comments.

It's pretty interesting, I hadn't heard of OpenStack before, and the company I work for is migrating TO VmWare.
The point made by Legere (T-Mob CEO) a few months ago was that we need to start seeing handsets for the sophisticated, lasting, pieces of technology that they are. He argued that handset subsidies have pushed us into a mindset where we see our phone as disposable, destined for upgrade every 2 years. When we take this perspective there is no shortage of available phones, we should just be comfortable with upgrading our handsets much less often than we are currently accustomed to.

Also, T-Mobile still allow you to pay off the cost of your phone over the length of the contract, so people will still be able to get state-of-the-art phones for a low upfront cost.
The common example people pull off the hat with C++ is the use of << operator for streams and some UI toolkits.

Which I personally never had a problem with.
New Type of Solar Structure Cools Buildings in Full Sunlight
> But, not all young entrepreneurs are like Nick D’Aloisio and Andrew Hsu. Some of these whipper snappers are the REAL deal.

This sounds very insulting to Nick and Andrew. I don't see any evidence that they're anything but earnest entrepreneurs. In the case of Nick, he succeeded (the reason is debatable), and as for Andrew, he simply hasn't succeeded (yet), but it's no reason to say he isn't genuinely trying. Older investors may be trying to take advantage of their youth, but it's not a discredit to these young people.
Isn't "detect features, not browsers" the current js mantra? How can they do this without browser sniffing?
"Still, Firefox OS could have a big impact on the Web even if it never gains significant market share. By pushing the Web forward, Mozilla is helping to ensure that mobile websites will continue to be relevant even as developers create hundreds of thousands of proprietary apps. Firefox could lose the battle for the smartphone OS market but still win the war for open standards."

I think this is the big point. Mozilla doesn't have to win. We're all winning from it's push. It's like when you compare a startup to an open source project. If the startup fails, it's a complete failure. If an open source project doesn't succeed in becoming popular, we still have it's legacy bare open on which to build on. The majority of startups failing don't contribute anything to humanity. The majority of open code does, in their small, incremental ways.
MongoDB manual has some good recommendations on operations here: http://docs.mongodb.org/manual/administration/security/#oper...

It certainly helps limit the damage. However, unless it is chroot-ed, it will still pose a very serious risk. And even with chroot, the damage is not totally eliminated. The attacker can start leveraging local vulnerabilities.
Apple fans: Microsoft is no longer the enemy
Indeed, the ecosystem of actively deved numerical libs is the only upside to R over other tools. It's a pretty large cliff for any other tool chain to climb over.

--someone who's writing numeric/ data analysis tools in Haskell.
Firing your customers
Don't forget http://hackerjobs.co.uk for UK roles
Viable scenario: a state-organized effort perpetrated solely thru data networks shuts down a nation's entire power grid (electric, gas, etc.), and in a manner where re-activation thereof will be slow & expensive (transformers blown, gas pipes ruptured, etc.) with extensive major civilian consequences (dominating digital economy offline, health/rescue services disrupted/overwhelmed, traffic congestion skyrockets, etc.). Think Stuxnet for the electric company. The perpetrator is identified.

Variation: this is detected beforehand, but very little time remains (hours/minutes) before "detonation". Polite diplomatic channels are in no way fast enough. The cyber-attack is traced to 10,000 malware-hijacked PCs in a handful of concentrated residential neighborhoods.

Discuss.
Nintendo announces Web Framework
just to clarify - robohash is a image made up from discrete robot parts (ears, nose, etc) and assembled according to say every 8 bytes in a SHA1 hash?

So its essentially SSH-fingerprint-art, but waaaaay cooler.

Do not monetize it - the world will come back around and reward you one day.
Is a man sitting in a bomber a combatant? If so, then how is a drone pilot not a combatant?

How does international law protect civilians in a war, except by the actions of a party interested in protecting those civilians?
Cloudflare has unfortunately been shockingly bad in the UK over the last few days (yesterday in particular).

I assume it was related to this attack.
ISTR that Eliot Spitzer was pushing for more aggressive treatment of structuring, and that's exactly how he got caught. No one ever accused politicians of being consistent, though
It's unfortunate that they are handing these out to the press at a time when developers still cannot get a device.
"But we're up - they haven't been able to knock us down. Our engineers are doing an immense job in keeping it up - this sort of attack would take down pretty much anything else." --Steve Linford from the BBC article.

If Spamhaus' Linford is quoted accurately, he's kind of full of it. The NYT article gives more detail about CloudFlare's involvement.
If you use the twitter site from Firefox OS browser, links will just open in a new tab as you expect. What they where using is the twitter app. In this situation, external links are openened as _target=blank and we redirect these page loads to the browser app.
How Netflix Is Ruining Cloud Computing - yeah right
You don't. On the 1st of every month, that account posts a Who's Hiring thread. You comment in that thread with the details of your vacancy and how to apply.
From what I understand of the case, the cash was smuggled from the US to Mexico and deposited into accounts with HSBC based in Mexico. Consumer goods were then purchased in Mexico and shipped to Colombia and elsewhere (but not the US). While there should have been a lot more local oversight for money laundering, why should US government agencies have access to bank accounts in Mexico to determine if there has been money laundering activities?

This is a local matter, as it is in other jurisdictions, and the US can formally complain through the established channels, treaties, and agencies which allow for sanctions to be placed on banks and jurisdictions where there is excessive money laundering activities and low oversight.
Well, it makes sense... OpenStack is getting better and better with each release and whilst VMWare do add some cool new features every now and then, the price simply sky rockets and you don't really need the new features.

For the customers who do not need much more than basics (e.g. just virtualisation, storage server etc.), it is just so hard to justify the price now.

Just the other day I had a client who wanted basic fault tolerance and by changing versions, the quote goes from 6k to 47k! It is crazy pricing... :(
This is what Cesar Alierta (Telefonica's CEO) dared say aloud... "Spanish customers need an education".

Like he was our father, man.
I'm using Aptana, a PHP centric variation of Eclipse.

It's great at matching parenthesis, braces and brckets, provides popup tips on commands and functions (including defined) as you code, can customize syntax highlighting, does some proactive error checking and the file manager is good. Doesn't do upload well.

Used to use Quanta Plus - what I miss from that was the better speed, drag and drop tags (drop an image from your tree into your source - instant img tag.) Better PHP example popups, easier color tag editing, nice preview/WYSIWYG editor pane and decent printout (aptana printing is formatted lousy, and sublime is literally non-existent) And better file transport (pre KDE 4)
I think that claim could also support that they "mustn't" be brought down.
If it was so easy to define war, then when did the US Civil War begin?

We are already in an era after the atomic bomb, after "total war". Now we are disturbed that in the future, civilians might be killed along with the countries they support in war? How about this happening constantly in war all the way back to city-states?
XSS restrictions generally apply to things such as making XmlHttpRequests from other sites. Loading scripts from other sites generally isn't restricted, since it's used for a variety of legitimate things such as loading jQuery from a CDN.
Do You Fit the Profile of Tech Industry's Most Obnoxious Tweeters?
We only have a limited number of devices, and won't sell any ourselves. For sure we would be happier if geeksphones were available for all to use...
That's not JSON though, it's executable Javascript. This whole issue is (was) about Arrays accidentally becoming executable Javascript. To elaborate:

Let's say I have a data API http://bank/sensitiveData which returns JSON:

["bmjs", "sensitive", "data"]

.. if your browser has a valid session. Now, if an attacker lures you onto his http://malicioussite, he may try to do:

ajax.get("http://bank/sensitiveData).then(sendReceivedDataToMaliciousDatabase)

This will throw an exception, because the browser doesn't allow the cross domain requests to http://bank .

However, he _can_ insert a <script> tag that loads it (this is how JSONP works):

<script src="http://bank/sensitiveData"></script>

This will load your sensitive data (assuming you have a session open). If, before this, the attacker has overridden the Array constructor in his site's Javascript, whatever code he has in that constructor will receive your sensitive data (and may send it to his malicious database).

Now, if my bank data API actually served your sensitive data as executable Javascript, that is:

var bmjsSensitiveData = new Array("bmjs", "sensitive", "data");

Then you need to cancel your account and find a new bank immediately :) This would be loadable with the <script> tag on a malicious site as shown earlier, and subsequently make the variable bmjsSensitiveData available to the attacker's Javascript (overriding the Array constructor wouldn't even be necessary).
As a daytime Scala developer who seldom uses Java anymore these changes are nice, but a far cry from what I get in Scala.
I realize it's a news headline but I feel obligated to point out that this doesn't rank as the 'biggest attack in history' except maybe for Spamhaus. It doesn't appear to come close to what the SQL Slammer, Blaster, or Sasser worms did. Slammer in particular increased latency globally and the impact was easily visible to anyone browsing the web.
iOS doesn't need a file system to have files
True, he's not exactly a wunderkind (though he started "starting-up" in his early teens). But his backstory is more "bootstrappy" than some of the others. . .working-class family from Bosnia...started his successful company in Bosnia and returned to US. The wunderkind points he loses for being 19 are offset by the points for his more humble roots, I think.
It's worth noting that Digitimes is a notoriously unreliable source, one that has been wrong many times in the past about the Amazon smartphone in particular.
The Secret to Safe Continuous Deployment (video & slides)
I know fabrice, this isn't your fault, but I consider it a PR mistake to give these to the press when developers cannot pay for them. Sends the message that press is more important than developers (which may be true, but not the message you want).

If this had been a blog post from Twitter about how they integrated Web Activities into their mobile web app, that would have been really awesome.
Ahh, no wonder I didn't see it, nor did I see any of this listed first glance on the page you linked to. I wonder if they need to get a real marketing team working for them.
Fired SendGrid Developer Evangelist Adria Richards Speaks Out
Here is a (claimed) account of the dispute from the attackers: http://stophaus.com/entry.php?5-The-Real-story-on-the-New-Yo... .

I got there from the comments on the CloudFlare blog posts, where a user named "STOPhaus" posted taunting CloudFlare, with a link to the stophaus.com website. Apparently it's a meeting place for anti-Spamhaus sentiment and includes such classy stuff as personal information on Spamhaus employees.

Wild stuff, and thanks to CloudFlare for their writeup.
Apple has plenty of potential for harm via its iPhone and iPad ranges, both of which are locked down.... However, neither has a monopoly maket share.
Climbing the Ladder as a Developer
Quite a few languages allow the use of operators, or special characters if you prefer, as names.

Without any restriction, except for a few basic ones.
If someone is at war with your whole state or society or culture, then they aren't going to make a lot of fine distinctions about whether you were working on military software.

Since when did we start to believe that civilians are safe in wars? Is this not one of the worst and most ancient aspects of war, that it consistently kills civilians?
One of the less literal definitions is "one who succeeds in a competitive or highly difficult field or profession at an early age"[0]

[0] http://www.merriam-webster.com/dictionary/wunderkind
Please do! If you want to add widgets with functionality similar to existing ones, please add details of the difference s to the description (e.g. 'Uses OAuth' for Twitter').
Does the phone have to be on the same WiFi network to connect to the http://piui/? More specifically, if the pi is running at my house and is connected to my home WiFi, can I run the UI from my phone while at my office over a different WiFi or over 4G?
As a developer that uses MongoDB in production I am shocked! Shocked, I tell you.
Exploring open source software developed for European libraries
Probably not that accurate indeed: several Amazon reviewers noted his descriptions of "vicious" recoil from M16 rifles (!!!). If he got something so widely, if not infamously, well known so wrong, why would we expect anything else to be correct?

On the other hand, an early strike at both ends of the tunnel is very different from eroding it over some period of time (has to be some separation to avoid fratricide); if the construction was done well enough, the latter might have provided more time for NORAD to transmit additional data about the attack in progress.
Not when he's going to re-therm. Also, from the post I linked above:

A rib-eye was salted, seared, placed in a vacuum bag,
and cooked at 55 C for 1.5 hours, chilled, stored for
two days, rethermed at 52C for one hour, seared, and
served
> In the US, two administrations have asserted that a "terrorist" is anyone the executive branch claims is a terrorist due no particular evidential requirement and subject to no legislative restriction or judicial review.

That's not actually true, but don't let the facts get in the way of your narrative.
Gradle 1.5 Released
Which illustrates that, despite what you might think, it's possible to be Linux user and stupid.
Here's an NPR story about Fort Hunt and the care packages they made for POWs http://www.npr.org/templates/story/story.php?storyId=9364035...
The problem is that here the "generic" tools like "apply" are not really generic. Hence you can not use your intelligence and creativity to deduce a working program using a small toolset that you know fully.

Instead you must use a huge number of special tools that do only a few things. The code is hard to read, hard to write, slow, the compiled version is big. It is also error prone since you must use a large number of different paradigms. Some might have their arguments slightly differently. It's produced by googling for everything (or if there's a decent builtin help system, using that).

It seems strange that such concepts, like generic data types, operators and functions are not more widely spread. For example if you can calculate "max(a-b)" even if "a" is a matrix and "b" is a scalar, that's already quite nice. This can increase productivity a lot.

Since such design models are so fundamental, they are rarely found in "matlab-like" extensions for other programming languages: instead you must constantly do type conversions and transformations by hand and use awkward middle man functions to access data types. Most of your code is housekeeping and little actual progress.

See for example the problems with Julia where column and row vectors are totally different types: http://2pif.info/op/julia.html
Why Werewolf Matters at TechStars Cloud
This year was my first PyCon ever. Being a student, I did not have the funds to pay for a 4 night hotel and a 600$ flight. I really wanted to go, so I just decided to put what ever it would cost on my almost full student line of credit. Thanks for the this financial aid, I was able to reimburse everything, and my final cost for attending PyCon was near zero.

While being at PyCon, I also decided to help the best I could. I was a session runner for 4 different tracks. This led me to meeting amazing people (Doug, Dave, etc) and having a few minutes private talk with the speakers as we rushed down the stairs to their room.

Overall, what really amazed me during the weekend is the community itself. I still can't put words on how incredible the outreach that the community is trying to accomplish is (Financial Aid, PyLadies, The Yound Coder, Poster session, etc). This is what makes PyCon and the Python community so unique.
This is a problem of collecting evidence about who is responsible. It doesn't address the underlying nature of the responsibility. In your hypothetical, you are the one who is responsible both for the hacking of the military network (in the context of this discussion, presumably to do physical work like killing people) and for fingering someone else. This is indeed not very different from physically committing a murder and planting evidence pointing to someone else. Yet that does not cause us to challenge the notion of responsibility for murder.
I guess this is only a real problem if you're exposing your MongoDB instance to the internet.
What part of "killing by electronic means is just as bad as other killing" don't you understand?
Running a Startup 2
I just listened to Looking Back (http://heymarseilles.com/media/) - Just curious - does anyone know if there's actually a name for that kind of vocal styling and where/when it came from?

I don't think I ever hear people talking like that - it seems to be a specific affectation only for singing. I think the first time I heard it was Michael Stipe in REM? But it's spread since then - the Decemberists, Alanis Morissette, and a bunch of indies since then. It's like a specific sort of dipthong.

Has anyone written about it?
Can you provide links?
I, too, do not think it is unrealistic or uncalled-for. My sense of 'alarming' is anchored a bit in a historical position--i.e., we've now reached the point in history where an action taken on a computer in a room in some corner of the world can be the trigger for formal war declarations, and is officially recognized as such.

We thought blitzkrieg was a challenge about 75 years ago. This is a huge shift.
Also, an abstract class can have a constructor (and instance initializers, and initialization expressions for its fields), which an interface can't. That means an abstract class can do work when it is created.

Although it's probably a good idea not to do too much work - a factory method would be better for that.