skysight-inc/HackerNews huggingface dataset:
Does any GET or POST URI endpoint in your application accept parameters? Do none of those parameters impact the output of the application? That set of circumstances is extraordinarily common.
Oh, OK then. Good to know. Thanks.
Looks nice, but do you think there's a business model for something this simple/light?

Unless you were dealing with a project that had dozens or hundreds of users/clients interested in tracking the status, it seems like sending an email would be a lot lower friction.
This is in the works. While it won't be three pedals to start, I realized the simplicity of wiring the Teensy to a digital piano foot pedal (like this: http://www.amazon.com/M-Audio-Sustain-Pedal-Action-Keyboards...) to build a relatively cheap, durable foot pedal for computing. I'll be posting about that sub-project soon on my blog.

One thought, since the Teensy can detect button press and button release events, is to code a vim mode where holding the pedal puts you in insert mode and releasing the pedal hits ESC to leave insert mode. We'll see how that works out in practice.

For 3 pedals, you could go with a DIY guitar pedal solution of project boxes and 3 momentary stomp switches (http://www.mammothelectronics.com/ is a good supplier of these parts) but I am unsure about the ergonomics of using one of these pedals constantly. (Guitarists simply stomp them on and off from a standing position. They're generally not pressing and holding the switches for 8 hours from a chair. So it might just cause foot/ankle problems due to the height of the front of the enclosure. More experimentation is needed on my part in this area.) Such a pedal would be way cheaper than the commercial versions from Kinesis and other manufacturers, however, and should be far more configurable / useful on Linux & Mac.
Pretty much in line with comments from WaPo regulars, why am I not surprised. Some people greatly depend on the status quo for their way of life and will believe whatever they are told.
Its an ebook. An extra page doesn't cost you much. The first thing I thought of when I saw the title was:

https://en.wikipedia.org/wiki/Colossal_Cave_Adventure

And aside from the text adventure aspect, its based (in part) on a real cave system, one you can crawl inside. As you can see in:

http://www.getlamp.com
I try to learn as much as I can about cryptography, but I know how much I am still missing. So a question to more knowledgeable part of the crowd - is the crypto suite this article suggests is best pick, or is there anything better?
Similar.

You intentionally underexpose the film when you shoot, pretending that it has a higher ASA rating than it actually does.

You then increase the time and/or the temperature when developing the film, to compensate for the underexposure. You end up with a correctly-exposed image, but at the cost of extra grain, extra contrast, etc.
>And i was trying to report it, but didn't find a contact/email.

How hard did you try? Django uses the industry standard security@ address for reporting security issues.

A quick googling results in this page pretty easily:
https://docs.djangoproject.com/en/1.5/internals/security/

EDIT: I described the link as 'first' in the Google results, but that was because Google was being helpful and promoting a page I've visited a lot before... In reality, it's a few links down.
>The experiments where performed on a 2.7Ghz quad core MacBook Pro with both client and server running locally

No no no. Assuming your production code runs on Linux THAT is where you need to do this test. It is extremely naive to assume that either the JVM or the Go runtime will perform system interfacing tasks even remotely similar between OSX and Linux. Linux is what you will use in production. Linux is almost always faster (more effort from devs both on the kernel TCP/IP side and the runtime/userspace side).

Write your Scala, Java, Go wherever you want, but please, benchmark it in a clone of your production environment!

P.S. In production I assume your client and server will not be local... don't do this, kernels do awesome/dirty optimizations over loop-back interfaces, sometimes even bypassing large parts of the TCP/IP stack, parts you want included in any meaningful benchmark.
Is OpenFL the solution to cross-platform development?
P.S. i am not into django, but if you have a clue how to contact authors... please tell them to put CSRF token into session cookie. It must be fixed in the first place, BREACH is 100 times harder and longer, while cookie forcing is completely viable attack with active MITM. Or perhaps it was fixed? I checked it on bitbucket the last time..
Why Your Cell Phone's Location Isn't Protected by the Fourth Amendment
You mean something like:
http://www.ninjito.com
http://sleepycity.net etc?
> In Germany, they can also use cheap DSL where they can switch to new IP addresses almost instantaneously

That one is easy to reduce the effect of: as well as a per-IP limit have a per-/24 limit that is much lower then 256 times the single address limit. To avoid seeming to be too unfair to other people on the same ISP who happen to be at an address next to a heavy-but-not-abusive user make this limit's bucket refill more often (i.e. if you limit to 100 requests/day per IP, try 100 requests/hour per 256 address block).

You might consider different granularities instead of or as well as /32 and /24. It is not uncommon for a small organisation to have a /29 or /28 allocated (heck, I have a /29 on my line at home as I host a couple of services from it that need their own address). Perhaps set limits for granularities of /32, /28, /24 and /20? Of course this requires development effort, implementing an efficient method of enforcing these limits, but not lots.

> They will try Tor, then various anonymizer proxies (forcing you to block all of them or give up)

Are there really enough reliable cost-free options out there to make that a massive problem? A few determined people will use more resource than you wont by these methods, but the majority will either put up with the rate limit, pay what-ever you are asking for a less limited option, or do somewhere else (the third option being something you'd prefer didn't happen, of course, but you'll always lose some users by refusing to give them the moon on a stick).

> Amazon EC2 instances or other VPS, or large public proxies / ISP proxies that you cannot block

While you can't block them, you can apply rate limits at multiple granularities as mentioned above to limit their effect. To reduce the effect of ISP proxies on HTTP APIs force the use of HTTPS (less HTTPS traffic goes via a proxy than does HTTP traffic - ISPs that use transparent proxies for HTTP caching don't do the same for HTTPS as there would be no point).

THE THING NO ONE HAS MENTIONED YET

Of course this all changes a little once you consider IPv6. A per address limit is meaningless when everyone has a /64 or wider to play with so you are going to have to implement ranged limits (perhaps with gradiated limits like above for /64, /56, /48, ...) if you are limiting by address, and you are going to limit by ISP when trying to limit by individual more often than you will filtering IPv4 addresses this way (some VPS providers hand out small numbers of v6 addresses to each VM so they presumably use one /64 for everyone, where-as I have a /64 allocated to my home line.
Yes, but by your reasoning, surely obfuscating passwords when inputted into websites is also pointless, yet you do do this in Chrome, which is inconsistent with your reasoning.

I know, and you know, that locking one's account is the Thing To Do when not at one's terminal, but Joe User is still learning this, and in practice, most people do not lock their terminals when AFK, leaving them open to others in the household/dorm/school/office/whatever.

Yes, locking the account is the user's responsibility, but it wouldn't hurt to help them out, by not making it possible to view all a user's passwords in their chrome preferences.

Again, I'm aware that you could simply hop into keychain and check "show password", but this prompts for the user account password. At the very least, you should be doing the same.
1) open https://www.djangoproject.com/
2) find /contact/, /email/, user group
Yeah turning off compression completely is kind of crude but it works without having to go into app-specifics, I'm sure the Django folks are on it ;). When it comes to things like CSRF tokens, probably secret masking (4) is the easiest to implement? so something like

import uuid
csrf = '42be455e20e64d7294eee8d1806d14a9'
p = uuid.uuid4().hex # random response-specific pad
xord = "%2x" % (int(csrf, 16) ^ int(p,16))
request_token = "%s%s" % (p, xord)
print "<input type='hidden' name='token' value='%s'>" % request_token
v_unxord = "%2x" % (int(request_token[len(request_token)/2:], 16) ^ int(request_token[:len(request_token)/2], 16))
if ( v_unxord == csrf ): print "yay, valid CSRF" # constant_time_cmp
The Bot Wars: or why you can never buy concert tickets online
I have found the Cherry MX switches to be fairly good and reasonably priced.

I did some research to see if anyone had open sourced a design for a 3D printer to print a Spiffchorder, but I didn't find anything. Maybe that's the next step? 3D printing these iteratively, to see what fits and what needs to change, seems like a huge win for developing a wearable chording keyboard that is comfortable and durable.
To your second point, security@djangoproject.com. It's documented in a bunch of places; where'd you look for it? I'll add it there, too :)

To the first point, we believe that Django's CSRF protection is as strong as session-linked CSRF protection, and adds CSRF protection to anonymous users (users without a session as well). In other words, it's a design decision, one that we believe doesn't compromise CSRF protection. If you believe otherwise, please get in touch (see above).
I just do not understand why we keep persisting in putting session data into cookies.

Its between hard and impossible to build to systems perfectly that do this, whereas a server based lookup has a limited number of attacks that do not involve owning my boxes.

I have even written my own session handling wsgi middleware just because I don't understand encryption and cannot find a framework that doesn't try that.
Hijacking the porcelain throne:Toilet hackers bust into bathrooms via Bluetooth
Md5 changed for older ruby versions (on ruby-lang.org)
> * Be served from a server that uses HTTP-level compression

this is the only must-have. Last 2 exist almost in every website (everyone needs a CSRF token, everyone reflects something somewhere)
Too bad it's those anarchists/traitors/dissidents/hippies/[label] trying to make their socialist/anrarchist/communist/[derogatory adjective] opinions into facts.

See what I did there?

A Senator or anyone within the Senate has just as much of a right to their opinions as any of us do and they also have the same permission to edit Wikipedia entries as we do.

So what is the point in pointing out that someone presumably within the US Senate has changed a word in the Wikipedia article about Snowden? To point out that they're wrong? What if we're the ones who are wrong?

This act doesn't infringe on anyone else's rights in any way. Its an attempt to persuade possibly but we can't blame them for that. They have just as much a right to try and persuade people to seeing things their way as we do.

I'm just wondering what kind of discussion is this supposed to spark? I've seen a fair number of posts on HN lately that are little more than attempts to preach to the converted and turn the comments into a back-slapping fest. Is it weird that I consider the opposing viewpoint any time I make an argument or consider an issue? I don't necessarily agree with changing dissident to traitor but I don't see anything wrong with someone believing that either.
Both Angular and Ember so I can at last make my own mind up on which is better!
Is Microsoft Challenging Google on HTTP 2.0 with WebSocket?
Back in 2009, Google began an industry discussion about a prospective upgrade to HTTP protocol - the application that enables the Web over the Internet. The concept is called SPDY, and to date, conventional wisdom held that while some are skeptical of Google's motives, as a concept, SPDY was running unopposed. Maybe not any more. This week…
Outside legal spheres, the word "traitor" may also be used to describe a person who betrays (or is accused of betraying) their own political party, nation, family, friends, ethnic group, team, religion, social class, or other group to which they may belong. Often, such accusations are controversial and disputed, as the person may not identify with the group of which they are a member, or may otherwise disagree with the group members making the charge.

http://en.wikipedia.org/wiki/Treason
Yes, that's correct, in theory BREACH can be used to target any sort of secret embedded in the body of an HTTP response. CSRF tokens are the most common type of secret in that category, but there are others. However, we can't speak authoritatively to The Web or All Web Frameworks or anything, but we can advise our users on how they can protect themselves.
This is great! Bookmarked!
Interesting, but you should probably add an example on your landing page.
what current skills do you have? I would pick a skill to compliment my current skills.
I do not think the unions are the only ones to blame. If so why are the unions a problem in California (a state with private prisons) while not close to as much of a problem in places with government prisons?

My theory is that the owners and the unions work together towards the same goal. The owners get a very powerful lobby group in the unions.
That was actually one of the key points of SOPA -- it extended DMCA-style service provider protection to payment providers and ad networks. As for the "streaming" provision, that was (inartfully) meant to penalize the day 0 crowd, especially for unreleased media. It was not intended to penalize people downloading, watching, or what people who read this site consider "streaming."

The language could and should have been cleaned up then; it all got lost amidst the SOPA screaming. Penalties for "streaming" are covered by the DMCA inside the US. It's how YouTube and UStream can exist. And I think we've seen precisely how many felonies and how much jail time resulted from cover songs and Justin Bieber lip dubs since that law passed 15 years ago.

But right now someone outside the USA can take another party's shady (or well-intentioned stream) of a pay per view, wrap ads from an ad network around it, and accept PayPal in order to see the "unrestricted stream" (scam). And there's no legal framework to deal with it.

That's obvious scammy theft regardless of where you stand on copyright. And all the "good guys" (ad networks, payment providers) remain liable whether they respond to takedown requests or not. SOPA let people take down the ads and PayPal links if they couldn't get the site down. It gave PayPal and Google the same kind of process and liability protection for payments and ads that YouTube already enjoys for video.

This needs to get fixed and techdirt, boingboing and others need to hire someone with minimal legal expertise (optimally Congressional litigation support experience) if they're going to keep hammering this for pageviews and anti-copyright cred.
Washington Post, Newsweek, Boston Globe Sell: We’ve Been Here Before
No, man. You just don't get it! He's a master of the game. He's thinking 12 cards ahead and is going to uno your bishop with his Washington Post before you can even bingo your king of spades! It's so crazy it might just work!

I don't like the article. Full of sensationalist filler with little real content. What's his point? That stock price reflects the perceived expected value of the company now and in the future? He never really connects Amazon's investment into its infrastructure with Bezos' purchase of a newspaper. He talks about corporate profits as if they are a bad thing (and uses Apple as his sole example) - what about the second largest company in the world? Exxon Mobil hasn't had the same pattern as Apple at all. I'm sure there are plenty of other examples as well. So how does one data point prove his point that withholding profits is a good idea (and I'm not saying it isn't, I'm just confused by his argument)?

Anyways, yes Bezos is trying a strategy of targeting long-term growth. He makes that abundantly clear. Will it work out? Is he really a genius? Honestly, it's too early to really say definitively, isn't it? But that's boring, so no one would write an article saying that.

<\rant>
It was not meant as an attack at all. It just seems to be a very under-appreciated skill. I've yet to see a firm whose documentation is current more than 6 months after a major release. If you're able to keep up, you're more in the minority than your realize. :-)
Almost certainly a summer intern.
World's First Lab-Grown Burger Unveiled and Eaten in London
Again, we believe that sessions and CSRF protection can be orthangonal (and that there are benefits to doing so). If you can prove otherwise, let us know!

There's also https://github.com/mozilla/django-session-csrf, an alternate CSRF implementation by Mozilla that does use session-linked CSRF tokens. So if you insist on "tokens must be session-linked", you can use that instead.
No, you're missing that the original GET requests can be performed in some cases over HTTP, either by forgery or by surreptitiously spoofing the user's own browser into doing it. No need to have compromised the SSL/TLS.
I love how simple this is. Thanks!
For some reason I thought that this was about Google Play and Android devices...

(crawling back under my rock now...)
The thought process came to me many years ago when Microsoft was an example of a startup that built itself from scratch and was very current.

I've come around to broader thinking since then. And Microsoft has changed some too. But it has gotten harder to create companies from scratch due to restrictions on developer freedom. (Patents) There are other reasons that have made it easier, but those are tangential to RMS's topics.
1) session and logged in/out user are two different things. Session is the way you store information about current user, no matter he is anonymouse or logged in.

2) I checked again for instance https://bitbucket.org/ - edit csrftoken cookie to any, 123123 for example. Reload the page and if site keeps working - Cookie Forcing with MITM will do the same thing using http: injector Set-Cookie

not only MITM, subdomains can do precisely same thing. Either bitbucked uses old django or django is vulnerable to it (which is, well, a severe vulnerability imo)
Fantastic app.
My blog does not have CSRF tokens, and does not reflect user input.

Many web _apps_ have these things, but many web sites do not.
Our experiences hacking for growth
Graphic design.
Bangladesh government to seize control of Grameen Bank
Currently running Freenet/Tor/I2P on a VM (KVM) with 1.5GB RAM allocated it. according to htop, java (Freenet and I2P) is using 985MB. Tor is using approximately 40MB.

The day someone takes up a rewrite of Freenet in C/C++ is the day I send money to the project.
Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild.

My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords.

It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration.
sorry, I think in terms of Rails, in rails a session is a _site_sess cookie... i am not sure how it works in Django but what here is a post about it http://homakov.blogspot.com/2013/06/cookie-forcing-protectio...

https://github.com/mozilla/django-session-csrf seems ok, should be default
fat is good for you. more fat please
Google’s Flagrant Violation of the CAN SPAM Act
I've never really looked at Django's site before, picked 'community' on the upper right, and it says

> Report potential security issues in Django via private email to
> security@djangoproject.com, and not via Django's Trac instance or the
> django-developers mailing list
Considering the aftermath of what he has released, quite a lot of power.
I believe the whole purpose of putting session data into cookies is to prevent the other issues that arise when storing session data on the server's database. The main issue is that when you're load balancing, each request could be load balanced to a different server, so you need the session to be stored on the client side to prevent the hassle of trying to scale your back-end to use your solution.
Previous discussion: https://news.ycombinator.com/item?id=6150773
Could somebody help me understand how this attack would be viable?

It seems like the attack has the following requirements:

1. You want a secret that appears in the response body, like a
CSRF token.

2. The web server always responds with the exact same response
for a request.

3. The response body contains data that you send to the server,
e.g. url params.

4. The attacker has access to an environment where he can send requests
under your browser session (otherwise, the user would be
unauthenticated and there would be no secrets to steal).

Given (4.), how is this a real concern? If I, an attacker, am able to make 3000+ requests while logged in under your session and modify the request character by character pre-encryption, doesn't it logically follow that I have your cookies anyway?
The Core Feature Set To Build A Successful Retail Mobile App
> Crime prevention? Does our government police prevent crime, or just punish criminals?

Both.

> I can argue that without any state-established law criminals would be punished, in some way or another.

Without any state-established law there would be no criminals, just the much broader category of people that other people don't like. Quite arguably, the whole purpose of state-established law is to limit the scope and severity of punishment compared to what happens in the absence of central authority, and to provide clear rules. This aids in deterrence, since, to the extent that antisocial behavior is rational and deterrable, there needs not merely be an expectation of punishment if you do 'wrong', but a clear idea of what 'wrong' is in the context, and a clear expectation that punishment will not be imposed if you do not do 'wrong'.

Certainly, one can argue that modern states are less than ideal in each aspect of this, but that's very different than arguing that they are worse than the absence of a state would be.

> Medical services? I think that some people really enjoy being doctors and nurses, and they would associate even without state-mandated organization.

The problem here isn't that there would be no medical practitioners apart from a mandate to provide them (after all, most states that provide medical services don't compel people to become doctors and nurses), but that medical services lack features that make it the kind of service modeled well by econ 101 rational choice assumptions, with (among other things) a very high and uncorrectable cost of bad (or even merely incompetent) suppliers.

> But we're (slowly) solving scarsity through science and technology.

We may be reducing the resource costs of some goods and services, but that doesn't solve scarcity (it reduces the opportunity cost of some while increasing the opportunity cost of others, since it is unequal progress, and opportunity cost is what else you could have gotten for the resources you put into getting what you chose.)

Suggesting that we are "solving scarcity" demonstrates a lack of understanding of what "scarcity" means.
since it's attack on secrets then we don't even consider blogs and read only media as targets :)