skysight-inc/HackerNews huggingface dataset:
So to be clear:

1) The attacker must be on the same network as you, or at least be able to detect how large the compressed and encrypted replies are.

If you are on the same network it seems to be there are far more MITM and whatnot attacks that are more likely to succeed, if you do not use HSTS (or secure DNS if that helps).

2) The attacker must be able to get your browser to rapidly generate many (how many?) requests from your browser to the site. It takes "30 seconds" they claim, but is that at a rate 100 requests per second?

3) Each request must carry something that will be reflected by the body of that particular page when it's rendered. I suppose it could be an error message or search string that's echoed.

It seems to me that unless you generate a CSRF token unconditionally on every page, the subset of pages that both reflect something with no protection (e.g. search results) and have a protected form (e.g. change my email address to XYZ) might be small.

4) The secret that can be extracted is what's in the reply body and not the headers -- headers are not compressed, since the TLS compression is now universally disabled post-CRIME.

Personally I use Referer header checking as well. IME all the browsers of my users do send them. So if you extract the CSRF token, it's useless by itself unless you also can make the browser send the right Referer header (and AFAIK, all the holes such as Flash have been plugged).

Other than that -- it seems that if you are normally generating e.g. a 32 byte CSRF key, you could interleave it with 32 bytes of good randomness per request?
I'm not sure it's much more than him wanting to get on the forefront of the coming changes in the way print media works.

I wouldn't be surprised to see some sort of news integration with Kindles in the near future.
America is a Business and not a country. Profit motive will always rule; good for managing a business in most cases, bad for managing a society in all cases.
...And what happens when we no longer need cows? It's not going to be happy fun time for the species, because as soon as there's not a reason to breed them then we'll have a few cows kicking around in zoos and that's it.

Good for the environment, possibly, but bad for the species.
Google Glass demonstrated by visually impaired users
Mh or ruby and rails (but 40h are not enough for both) or probably GO
The community page (where all the mailing lists and contact addresses are listed) say:

>Report potential security issues in Django via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers mailing list
I am aware of the connotation that you sited. But my point is that he is being tried in the media, and perception matters. So, no, I don't think it's OK to label him as a traitor.
"The basic principle behind asset forfeiture is appealing."

No, no it's not. It's flawed and messed up intrinsically. The fact that even a story covering this would say something to the effect of it's OK just abused... sigh.
What's the BOM or cost of materials on this thing?
State-of-the-art security and crypto.
I too write documentation. Not exclusively, but in my day job I often write manuals and other documents for our software, and I've done documentation work as a volunteer for Project GNU.

It's no more strange that someone would enjoy writing documentation that it is that someone would enjoy writing software, though just as non-developers don't understand the joy of programming, I imagine that non-writers don't understand the joy of documenting.
There was an article on Rails, but no official announcement.

https://news.ycombinator.com/item?id=6150535
> Yes, but by your reasoning, surely obfuscating passwords when inputted into websites is also pointless, yet you do do this in Chrome, which is inconsistent with your reasoning.

Passwords are normally masked to prevent shoulder surfing, but the presumption is that the correct person is still at the keyboard. When you explicitly chose to show a password, the presumption is that you attempt to be aware of who is around you. If the bad guy is at the keyboard for your unlocked account, the fact is you've already lost.

> Yes, locking the account is the user's responsibility, but it wouldn't hurt to help them out, by not making it possible to view all a user's passwords in their chrome preferences.

This isn't about pushing responsibility off on the user. It's about not tricking users into believing they're safer than they actually are.

> Again, I'm aware that you could simply hop into keychain and check "show password", but this prompts for the user account password. At the very least, you should be doing the same.

If I'm an attacker, why would I use the keychain app to get Safari passwords? Just navigate to the site and change the auto-filled password field to text, or use an extension, or one of the many system-level approaches you have at your disposal. Many of these things are even available as tools that any novice can trivially acquire and use.
This would cause a big problem for us. we mobile web service serves around 3-4k concurrent requests on average. without compression our API would take 300% - 900% increase in the delay.

is there any alternatives ? would like to know what Cloud Flare would do as their CDN is based on compressed nginx responses.
I was surprised that Windows was the target OS -- I had figured that most Tor users were using Tails at this point. I'm sure that whoever targeted the user group they meant to capture, though, had a good idea of their general usage patterns.

Wouldn't disabling JavaScript have also prevented this exploit? I don't know if FireFox still runs JavaScript through an interpreter if the user has disabled it; I'd assume not, but it wouldn't come as a shock to me if it did.
It seems like this is all for solving the wrong problem. Why isn't there a shift away from the perceived need for more meat.
It's caused by the sun's rotation, mostly. There are some complex magnetics that go on inside the sun, but the gist of it is that there is a differential in rotation rates between the poles and the equator of the sun. This causes field lines to be dragged along the equator, which then get knotted up and form coronal holes and other phenomena. Eventually, along an 11-year cycle, the field flips orientation.

Source: I work in a solar research lab at the University of New Hampshire
This is one of the best articles I've read on HN.

How to stay hungry, in other words. Or, why opulence can crush you.

I wonder how these lessons apply to us personally and as a society. Does getting rich make us fat and lazy? Or decadent?
>Other than that -- it seems that if you are normally generating e.g. a 32 byte CSRF key, you could interleave it with 32 bytes of good randomness per request?

Which would be pretty easily averaged out with a few more requests. It makes the attack a little harder, but not substantially so.
The History and Psychology of Clowns Being Scary
I don't think he'd be against moving into a new generic office space. He's against letting the new building define who the company is, and take away time and energy. Just moving to another strip mall might not cause that problem! :)
Absolutely, I'm just saying that your statement that it's the only must have is factually incorrect. I could include some sort of secret on every page, but since my blog doesn't reflect user input, it would be fine. I could also have a 'search' function that would reflect input, but without the secret in the body, the secret would be fine.

All three parts are a must-have, even if they are incredibly common. Saying otherwise is misleading.
He hasn't been accused of treason, either.
Using government equipment to conduct personal "business" is considered unethical.

If someone in the Senate wants to edit Wikipedia articles, they're free to do so on their own time, using their own equipment.
I agree in a broad sense, but:

> Have you seen mfg goods get cheaper as a result of automation? No.

Actually, they've not only become cheaper but more durable and functional as well.
node or basic sysadmin or django
in this case, the page at DjangoProject needs some updates.
disabling gzip/ssl is not the only option here. (it's not even practical in most cases)
>People can get upset by words for a variety of reasons. Should they make an effort to handle their emotions better? Absolutely. But that doesn't mean you shouldn't also make an effort avoid language which might upset people.

Well, I'll take any effort needed to avoid language that might upset people -- except the kind of people that are upset by language.

Those I'll take any effort needed to upset them.

I mean, I would not use words that might hurt a regular person or somebody who is actually sensitive to them because of their state/past/gender/color/etc.

But I would very much use all the words that annoy the kind of people who get annoyed by words all the time, ie. the PC crowd. I'm with this Carlin and Lenny Bruce guy on this one.
> This WORKS.

Quoth the person who is apparently oblivious to the media shit-storm occurring right now.
And he's dead, so he's not making any more.
That's usually acceptable. Annoying, no doubt, but those 45 minutes a month don't usually happen in 45-min blocks monthly. It's more like a few seconds every day, and a sparratic issue once or twice a year causing a few minutes.

SLA's commonly agree to 99.9% (and I've dealt with some picky clients), though 99.99% would be better, it's an acceptable amount. Servers break, people need to deal with it when they do, and we aren't all robots.
Happy Birthday, Curiosity
#3 is being crowd sourced already for many for profit companies and open source projects via wikis, blogs, forums, videos, podcasts, and Q&A sites populated primarily by volunteers. Particularly with games, documentation is sometimes intentionally not included to allow "explorer" players debate, theorycraft, and publish knowledge about the game for fun, notoriety, and sometimes profit.

We've also seen further pushes to higher level languages, automated testing, improved version control systems, better and more accessible bug and feature tracking products that begin to take the place of official documentation or at least let it be automatically generated.

I also don't think we've reached the end of innovation in this area of self documenting code plus incentivized crowdsourced documentation. Slow incremental changes are eventually going to make that current help link at the top of your software app extinct, or at least look like a dinosaur compared to the elegant evolution that takes its place.
Well, especially the "such", whereas I considered that "trivial cases" is the important one.
The real cool thing is that they are making great advertising to stem cells, by doing something that has a very positive ethical connotation (which is the typical argument against using stem cell in medicine).
Retroshare is currently the best example of Zawinski's Law[1] one could ask for; We needed a p2p/f2f daemon we could run voip/chat/messaging/file sharing on top of. Instead, we're given this bloated hunk of 1998's software design policies that tries to do everything for us, but do all of it poorly.

[1] http://catb.org/jargon/html/Z/Zawinskis-Law.html
You have to believe some things you are told. Not believing anything you're told isn't really virtuous like some people make it sound. I'm not saying you're like this, but often times I hear people say things like "people just believe whatever they're told" and "the real truth is..." and similar phrases that just sound so empty. Whenever I hear it I think of a person who wants to feel superior because they somehow have learned "the secrets" and have special knowledge about how this world works. Truth and justice are things that are relative. Its often the case that these same people will buy into full-blown or quasi-conspiracy theories not because any critical thinking was done about them but because its just not what the mainstream says. It becomes this weird "us vs. them" mentality where you end up distrusting one set of facts to your own detriment and believe an entirely opposite set of facts, again, to your detriment while leaving out everything in the middle where the truth these people seek really is.

Like I said, I don't know you - I'm not saying you're one of those people I mentioned here but what you said reminds me of things I've heard them say.
sayonara <blink> tag. you won't be missed.
Not wrong, and what I view as an intermediate step of the evolution of a project.

But the crux of your argument, also invalidates it :) as a hacker you should be able to hack around github being dead.
The #4 is not that difficult without compromising the user's browser -- as long as the user can visit the site under your command or see some HTML under your commend you can make the browser do a HTTPS request to anywhere at all.

Maybe you buy some targetted ads served in an iframe. Maybe you send the user an email where his email server either always shows images, or you trick the user in clicking 'display images' with promise of kittens.

You won't be able to see the results directly, but if you can observe how long the encrypted responses will be, you'll know whether your reflected input could make use of the compression dictionary (meaning your reflected input matches the secret) or not.

I wonder if there is any way to even do this without the passive network snooping -- like some kind of internal browser stats API call that tells you # of HTTPS bytes transferred. It could be innocent enough so it's not protected.
Amazon can already trivially batch up payments, as most of their customers won't just buy a single $0.50 thing (and if they do, the loss is miniscule) and never make another purchase.
Its not any newspaper. Its the one with most political influence. $250M is a small price to influence all policy makers.
and yes, they clearly state it was made as a solution to cookie forcing:

>Your site is on a subdomain with other sites that are not under your control, so cookies could come from anywhere.

it should be default, for sure.
"i am not sure how it works in Django"

Perhaps you should do a little research before proclaiming things insecure?
for the most part, art is a system that society affords itself to observe itself.
Regarding #1 and the other attacks that are more likely to succeed, are you referring to the propensity of users to bypass certificate warnings, or is there something else in play there?
For those who upgraded and still see the old scrollbar: despite what Beta Release Note said, Lion-style scrollbar is not in this release due to regression. It will be available in Firefox 24 instead[1]:

>The new scrollbars has been disabled on Beta for Firefox 23 due to a serious regression. It is now scheduled to be released in Firefox 24 as long as there are no serious regressions.

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=636564
> We still have due process.

Allegedly. Who knows what interpretations of the law the government makes in secret. That's the thing, it's secret, so you don't know. http://en.wikipedia.org/wiki/Abdulrahman_al-Awlaki#Abdulrahm...
We don't need hundreds of millions of cows, do we? I think they contribute a lot to Earth's pollution, too.
Aha! So, this is memristor arrays?
I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.
Do you think they are having fun now?
They are bred to be eaten, if we don't need them we'll stop breeding them.
This one is pretty neat: http://www.selbyfleetwoodgallery.com/artwork/raptor/5

A bronze casting of an origami bird.
This was a terrible piece. Why/who think Stallman is a crackpot? And what is up with this snide editorializing?:

'“Almost everyone in the world using proprietary software is also using propriety malware,” said Stallman, who looks every inch the part of a hactivist with his long mane of graying hair.'

I actually bust out laughing when I read that. Journalistic standards, please.
If it makes you feel any better, many (most?) Senate interns are unpaid.
1) I know the difference between sessions and logging in. I didn't say anything about logging in; I said that our CSRF protection protects users without sessions. Not all sites use sessions (some for performance reasons, others for privacy reasons); must those sites be vulnerable to CSRF?

2) First, you should report this to Bitbucket: https://www.atlassian.com/security. And c'mon, disclosing a possible CSRF vulnerability on a public board is kinda irresponsible. Is responsible disclosure not something you practice?

SecondI don't know what Bitbucket is running, exactly, and exrapolating from Bitbucket to Django is pretty lazy. Frameworks != sites. Once again, we've spent quite of bit of time validating the design and implementation of Django's CSRF protection, and we believe it works. If you find proof otherwise, can you please send it to security@djangoproject.com, and not post it to Hacker News?
Can the proper admin update OrgName? Should read:

OrgName: United States Traitors
Humans are not emotionless robots who can interpret the intention of a sentence without being influenced by the way in which it is constructed. If you use a word with negative connotations, people will react more negatively to your sentence than if you don't, regardless of your intent. It might be "pointless" but it is a simple reality of human behaviour, and it is even more pointless to complain about people being human.
really? I'd call editing a wikipedia article a public good, not a bad use of public resources then, eh?
Anyone can edit wikipedia - that is what makes it great. I don't think it is accurate to describe Snowden as either a "traitor" or a "hero" (or similar words as used in other comments) and dissident was pretty accurate but I hardly see how an edit coming from the senate is such a big deal, or indeed any bigger deal than anyone else editing wikipedia.
Yeah, I totally would have missed the desktop app had I not happened to see this comment. I was about to give up since a desktop app is critical for me.
I'm really looking forward to the overhaul on the road map that moves more things off the main UI thread.

I keep switching from Chrome to Firefox for reasons of principle ... and keep switching back to Chrome for reasons of performance. I hate myself, but can't help it. Firefox will briefly freeze scrolling a long page. Firefox will beach ball for 15 seconds after resuming laptop from sleep. And so on. None of it is crash/burn awful, but it adds up to be just irritating enough that it makes me mental. I tolerate it until I can't (for a couple weeks), then switch back to Chrome. Just did so yesterday, which is why I'm ranting in response to this headline.

This on OS X. Couple years ago when I was using Windows 7 all the time, Firefox was great. IME the fit/finish on OS X is not the same.

tl;dr: Firefox, I want to love you and be exclusive. Please change.
I think you're debating semantics here. What if the person looks at it as doing the world a service by correcting wrong information? Then that would probably fit into the job somehow.

In any case though, I don't think the ethics of editing a word on Wikipedia during work hours is what we're supposed to be getting up in arms about. I'm really not sure still why we're supposed to be upset.
>Personally I use Referer header checking as well. IME all the browsers of my users do send them. So if you extract the CSRF token, it's useless by itself unless you also can make the browser send the right Referer header (and AFAIK, all the holes such as Flash have been plugged).

do-not-use-referrer-as-csrf-protection.com
I am okay with anyone labeling him anything that they want. Some say he is a hero and some say he is a traitor...what does it matter?
The biggy for me is <input type="range"/> support. I’ve already ripped jQuery UI out of an internal project today; it was only there because of that omission.
The timing on this is amusing:

Jeff Bezos buys a newspaper for $250,000.

Sergey Brin buys a burger for €250,000.

Each smart in its own way.
I'm all for marrying who you want, but if you live in the US your tax comment doesn't make sense.

http://en.wikipedia.org/wiki/Marriage_penalty
Never Be a Customer's Doormat
Quartz: The First Experiment - Annotations
Different category--bootstrapped maker.
Firefox will beach ball for 15 seconds after resuming laptop from sleep.

That really doesn’t sound like normal behaviour? Have you tried the ‘Reset Firefox’ button on about:support? More info at https://support.mozilla.org/en-US/kb/reset-preferences-fix-p...
Nice way to sell your brand patio11.
The very large banner at the top of the page seems to indicate that this is a beta release, so shouldn't that be indicated in the submission title? I was excited about a new release of Firefox (namely to see if performance improved), but if this is beta then I won't be touching it.
I did. What is the theory?
Because it's interesting, and there are a lot of possibilities about what may have caused his change in thinking - I highly doubt Bezos would have spent $250m (even if that is small time money to him) if he still believed what he said last year.

Of course, there may not have been a complete change in his thinking, and he feels he can still do something with a major news paper that sits within those lines.

Either way, Bezos is currently finding print news a worthwhile thing to invest in, and if your business intersects with either of his (or you're just curious), it might be interesting to read a post on HN in which he expresses a very different opinion a very short time ago simply in order to have a historical perspective on the evolution of his views.
Agreed that that's the basic idea behind government-run anything -- its ostensible adherence to the benefit of society. But that's the naivete I was referring to: in the end there is no "government" per se, just a bunch of self-interested individuals. They all stand to benefit from overemphasizing a need for their department, bigger budgets, better benefits, tenure, and the political clout to influence those things.

There will always be undesirable incentives. Say we reverse things and pay the company more for reformed prisoners who make parole earlier. Now the incentive is to err on the side of leniency and potentially release more dangerous criminals earlier. You might then counteract it by penalizing the company even more if one of their parolees ends up back in the tank within X period of time; that might help, but depending on the parameters it could make them so gun-shy that we're back where we started -- holding people for longer -- but with a more complex system with more opportunity for schemes and loopholes.

It's not an easy problem by any means. As I said, I want to find some studies; I'm open to what the results show, but I'm very wary of trusting government simply because their purported goal is social benefit.
Could you elaborate? I don't understand what you mean by perceived need for more meat - to me this seems like a project geared at creating more ethical, future proof meat products.
There is a lot of this sort of routine business communication the review of which can be automated. I'm thinking of invoices, etc, of all sorts. I wonder about their privacy story: if I'm CC-ing my bills to SimpleLegal, how are they protecting that data? Are they aggregating between customers, etc? Sensitive information about legal strategy can appear in bills, so it's important to have a good story for potential customers of this service.

Also, there might be a business opportunity on the flip side. One of the things law firms worry about is collection rate: the percentage of bills that are paid. Industry-wide, the rate hovers in the mid 80% range. Could this technology be used to get clients and firms on the same page and boost collection rates (even if it resulted in discounts elsewhere)?