skysight-inc/HackerNews huggingface dataset:
Well, for savvy users:

In the location bar type about:config

Search for javascript.enabled

You can turn it off there by simply double-clicking the entry.
Do you understand how CSRF works? Just think of it in terms of CSRF. Since the attacker is trying to infer page content, they don't care that the server rejects all the probing requests, so CSRF protection doesn't help you as the attacker carries out the BREACH/CRIME stuff. If the result of the attack is an inferred CSRF token, they then cap the whole exploit off with a (now working) actual CSRF attack.
Reminds me of early web when Microsoft's websites always worked a lot better in IE than other browsers. And maybe they still do.
Emma instrumenting classes incorrectly
Slim your wallet. Slide your favorite card. The MostRad Minimalist Wallet
If you view the page with Firefox version <= 22, that paragraph is blinking, very easy to notice :-) (annoyingly easy!)
save it for the judge.
The idea is so appealing to some because it means any host serving that web application can handle your request, rather than being forced to use "sticky sessions". Otherwise you have to move the session data into the database, which can be unappealing as well.
ORMs can't work for a simple reason.

But they do. They work every freaking day, in millions of applications, all over the world.

I think it would be more correct to say "ORM's can't work perfectly for every conceivable scenario involving an RDBMS". But they certainly can, and do, work for many, many use cases.

They are trying to map from the world of sets into the world of graphs. Sets are more expressive, so there is always a good chance that there will be a lossy transformation.

But if you started with a graph, transform it to the more expressive set world, then transform it back to a graph, why would you lose anything? And in my experience that's usually the way ORM's are used... to persist an object-graph and then query/retrieve parts of that graph.

Now if you're taking an existing schema, developed for different usage patterns, and trying to layer on top of it with an ORM, then, yes, you should expect problems.

We need relational programming languages.

That's an interesting idea. What would such a language look like?
They fired a load of iron filings at the sun.
One method is to use LaunchRock, never tried it myself though. But they have some nice-looking designs: http://launchrock.co/
For startups. Not in general. It helps to have read Blank's other work about the phases companies go through; startups to him are companies still working on optimizing their product/market fit.
>>Truth and justice are things that are relative.

There is such a thing as objective truth. The only thing that's relative and subjective is its interpretation.
Just because it's short doesn't mean it's simple to understand. Also, the recommendations aren't about how to fix things in Django, but instead a way to prevent this attack from happening. Hardly a long-term solution, especially because it basically asks you to avoid using GZIP for compression, which many people and organizations rely on in order to process timely responses.
You might find this story quite interesting: http://qntm.org/responsibility
I'm sorry, but I really do understand your argument. You're claiming that the same novice who can't install a simple application or or follow three steps to reveal a password on the page will be capable of drilling down through the Chrome settings menus and displaying passwords. The corollary to your claim is that the threat of this novice outweighs the damage of encouraging people to leave their computers unlocked in a potentially hostile environment.

Drawing equivalence to sites that email your password is also misguided. The issue with those sites is that, contrary to a password manager, they have no reason to ever retain the cleartext password. And more fundamentally, there's no excuse to ever transmit credentials in the clear over a network. Whereas in this case, we're talking about showing the user passwords that must be retained in a recoverable form, displaying only on user request, and within a security context that can trivially access them anyway.

At this point I think I've repeatedly conveyed the reasons for Chrome's design decisions on this front. Since there's no new information, and the discussion seems to be going around in circles, I don't really see a value in continuing this thread.
I doubt this is a priority. 802.11n can happily stream 1080p video, which is the most bandwidth-intensive thing this thing can handle (it can't drive a 4k display so far as I know). A 5GHz radio, on the other hand, would be pretty great; in my neighborhood, at least, the 2.4GHz band is pretty shot.
Just to be clear, there's no proposed US law anywhere that would enable that attack.
Really? I switched from Chrome to Firefox because the Firefox is way faster on my MacBook. Do you have any heavy mods installed?
You're from Lund! I've been studying in Lund!

By the way, can you show some statistics and performance metrics with respect to nginx, Apache and such?

To put it another way: why did you choose to write your own webserver instead of using, say, nginx?
> Perhaps set limits for granularities of /32, /28, /24 and /20?

Our last case of T-Online abuse originated from 79.192.0.0/10 (e.g. 79.241.205.250, 79.241.223.141, 79.241.207.37 in rapid succession) and there's not much we could do about it (we blocked the changing IPs for 15 minutes each time and hoped we didn't lose too many legitimate users who happened to get one of the blocked IPs).

> Are there really enough reliable cost-free options out there to make that a massive problem?

Apparently there are hundreds of free/open proxies out there. They don't seem to change often and there are some lists of such IP adresses circulating the web, so it's possible to keep up with those. But it's a hassle...

> While you can't block them (EC2)

Actually with obvious server/VPS addresses, blocking is feasible for web sites (not APIs!) because the chances that legitimate website visitors will be affected, are slim.

> IPv6

Indeed, but at least the problem of rapidly changing IPv4 addresses will probably disappear there (you block the offender's /64 and he's not likely to get another quickly).
The problem is you're taking that energy from one area and shifting it elsewhere. Acres of untouched natural fields suddenly covered with solar panels wicking away the bulk of light & heat will wreck the local ecosystem. Sure it's not aggregating an undue accumulation of additional heat, but shifting it around in large scales does impact. Make those solar farms big enough, and you'll start seeing atmospheric effects akin to the "heat bubble" effect cities suffer.
Why wouldn't they have fun? They get a comfortable life up until the horrible end. Most cattle is not kept inside huge industrial buildings like chickens or pigs.
In the journalese about Bezos's latest buy and wondering why, I have yet to see a mention of why Bezos quit managing hedge funds to start up Amazon. He noticed that there was a tax benefit to selling across state lines, i.e. no state sales tax had to be paid. Hence he setup in favourable Washington state rather than anywhere else, to keep things a lot more tax efficient than his competitors. At the time those competitors did not notice what he was doing.

With where we are now there is the real possibility that Bezos has outwitted everyone again with some loophole/tax perk that you would have to be an investment banker to really appreciate.
Nice story. I generally agree the message, particularly the concept and phrase of an "internal champion". As demonstrated that one person can make or break you.

I've witnessed similar situations play out more than once, but to the negative with bad service aimed at seemingly insignificant people killing six and seven figure orders.

That said, I think you're missing something if the potential windfall is your impetus for quality service.

"You can easily judge the character of a man by how he treats those who can do nothing for him." —Malcolm S. Forbes [0]

0: http://quoteinvestigator.com/2011/10/28/judge-character/
Did you see the material? It's cast aluminum.

Here's one that seems perfect for the study of some aerospace engineer:

http://www.amazon.com/Paper-Planes/dp/B00E67R8MQ/ref=art_owf...
If it's stem cells from a cow, then it's okay because it's delicious.

If it's stem cells from the human species it's controversial even if the purpose is to save lives.

Unless both are controversial?
I doubt the market for "real" meat will ever die completely.
I think you think this is more clever than it actually is, because the music industry has been torpedoed over the last dozen or so years.
Backbone Belay helps manage multiple pending HTTP requests for your apps
I've tried Xubuntu but XFce doesn't seem to work that well with Hebrew keyboard layouts, at least without more tinkering than I was willing to put into it.

Dislike Kubuntu/KDE (I've used Ubuntu/gnome2 for long enough that I can no longer bear the look and feel of KDE).

Maybe I should try Lubuntu... I've lost faith in the Ubuntu project though, I don't think they're capable of making the right decisions.
The cow is already extinct in the wild. It's not an animal that gets along well outside of human care. An argument could be made that the kindest thing to do is let the species, twisted and distorted by humanity into a ghoulish parody of a once-mighty beast, regain its dignity in extinction.

I have a feeling though that however easy faux-beef gets, there will always be people who won't eat it- just look at the "pink slime" controversy, or the anti-GMO movement.
COC: A new metric for thinking about cancellations in SaaS business models
Actually just what I was after. Thanks for your efforts on this :)
There's a sample configuration at https://raw.github.com/timothyej/Shortfin/master/config/shor...
Amazon per se may not be interested in WaPo per se under current conditions, but repackaged into a suitable form it may be. Bezos could make a tidy sum selling an Internet-future-ready news service to Amazon.
Because not enough people are wonderful.
If I didn't know any better, I might think there is some sort of correlation between moving fast and breaking APIs (or "things" as Facebook likes to call them.
How I compute
I agree that history should not be destroyed and in sites that have old pages with the blink tag it won't be. But I think its fine for the browser makers to remove old cruft. Especially in this case where the behavior can easily be replicated in Javascript.
I'm intrigued. What's it weigh though? I'd want to use it for backpacking / disaster-style work rather than sitting at some table or desk.
From the archvies: web economy bullshit generator
Non-standard element.

http://en.wikipedia.org/wiki/Blink_element
I didn't find the reference to unrelated spending by Grameen in the linked article.
That's another way to put it :D
A prison is a place where people are deprived of liberties. A society can justify depriving people of liberties. A private interest should not have the right to do so.

Yes, it's not the private interest who condemns the prisoner, but they run these facilities at a profit, turning what should be a rehabilitating environment into an environment that is designed to promote full prisons to enrich an individual.

A good prison should work at a financial loss because there should be a societal benefit to rehabilitating inmates. If a higher prison population turns into a financial incentive, there is no incentive to help inmates or even reduce recidivism.

This is especially true when you consider how many minor offenses can send people to jail in the US. It is also interesting to consider that when slavery was abolished, many plantations turned into for-profit prisons; or that the incarceration rate of the US is the highest in the world.
Sublime Text - Expand Selection By Paragraph
how hard is it to run a second, smaller server for "learning" that doesn't get rate limited but also doesn't have full access? Maybe it even only has access to a fake data set, no real data.
What you're looking at is the die of an LED. Almost made the same mistake myself.
I don't think that saying if someone has access to your computer then you're screwed anyway is really an excuse.

You talk about lulling users into a false sense of security but do you have any idea how many Chrome users assume that their saved passwords can't just be viewed in plain text with a couple of clicks? I had no idea until I read Elliott's article and I immediately turned the feature off and deleted all my saved passwords.
The only thing that bothers me about the wallets I got, they break over too much change.
I'm sad that doesn't appear to exist.
justin: other applications offer an added layer of security through a master password, which chrome does not, are you saying that this has 0 affect of the level of security surrounding the stored passwords?

Or are you saying chrome(ium?) uses the same technique but hidden to the user?
Introducing Appidemia
I agree. I don't think there should be a value description there at all. He hasn't been formally accused of treason, so I think this is abuse. That account should be flagged.
Extracting passwords from Chrome
This long comment boils down to "so this is an attack that negates the protection that TLS gives you in defending against CSRF attacks". Yes, in the CSRF case, that's what the attack is.
Elliottkmember is right here. Chrome's approach to this is absurd. What if you simply don't want friends, coworkers, significant others browsing your passwords? At least tell users that if they choose to save passwords in Chrome, that everyone who uses their computer, even pretty non-technical people, will be able to access those passwords. Tell them that storing their passwords in Chrome is unsafe.

Justin, can you tell us the real reason Chrome does it this way? Because the reasons you list so far don't make sense.
It's the same with every other browser, for instance...

https://support.mozilla.org/en-US/kb/password-manager-rememb...
> In any case that you can edit the CSRF token you already can execute a much stronger attack (MITM, XSS, etc).

MITM is not a problem for HTTPS, but it can force cookies.
Subdomain can do same thing. These preconditions are common
Psychology Study Notes for Hackers
I tried going back to Debian as well.

I'm having serious slowness issues in my windowing environment (hardware acceleration is enabled). e.g: Opening large windows takes almost a full second.

Ubuntu was snappier on the same machine, but I couldn't bear Unity :-(
If you've got something that I can do with a wife, a 6-year-old, and that won't make me lose my job or blow through my savings, I'm interested. Otherwise, I'd just be reading fantasy.
I understand how the attack works, the question was about how a practical exploit would actually be carried out. I've figured out how one would issue GET requests from the right environment, but I don't know if the same is possible for POST.
Just patched some apps, and there have been other changes from 1.2.5 to 1.2.6 - not cool! In page templates,

.formatCurrency('GBP')

no longer works
Actually, the land/people ratio now is vert low, there is research named "original affluent societies" that show that stone age people were rich and lived better, because low population means they almost did not had to work, with plenty of food, including hunted meat available.
If you want stability above all else, sure; tricycles exist and are more stable than bicycles, and you can go up to 4 wheels, too. They have other downsides, however. More friction, more width needed to both travel and park, and actually worse stability when cornering at speed (they can't lean, so are at risk of flipping in a turn).

Cargo bikes often have more than two wheels, but people who don't need to carry significant weight in a basket tend to prefer bicycles as the more practical option. Parents in Copenhagen do often choose the tricycle-with-basket at a moderate speed, as a safer option than putting a kid on the back of a bicycle. But that only works when you have wide bicycle lanes.
>Yup, even if you're totally innocent you can be held in jail for 3 days if a cop decides they don't like you.

Yup. Happened to an acquaintance who was in town for a charity event. He was arrested in Fort Worth, and when we tried to post bond for him, the jailers "couldn't find" him. Went on for 3 days. The ironic part was that the guy was a prosecutor (from Mass.)

See also: http://gritsforbreakfast.blogspot.com/2005/12/tarrant-county...
For long overdue accounts, here is a short sample email that I came across a while ago:

"A quick note to say that I am really disappointed that you have still not paid me the [..] that I'm owed for the work I did for you. In the grand scheme of things, it's not a lot of money, but actually I think that this is more a matter of respect.

I have always been there at the drop of a hat to sort out any problems you might have. I love working with you and have always taken our relationship as more than just client/supplier. But if I can't rely on you paying promptly or it takes several attempts and reminders to get my money, that's not good business.

I'm not saying that I don't want to work with you, I do. But if I don't receive what I am owed within the next couple of days, I will have to think twice about helping you in the future."

Never hesitate to ask what's rightfully yours.
Javascript error preventing the site from working in Chrome and Firefox:

TypeError: $ is not a function

$(window).keydown(_.bind(function(event) {

Stage.js line 249
The article in the submission mentions the bank's involvement in unrelated areas: "The dispute is driven in part by the rapid growth of Grameen Bank, which is at the center of a sprawling empire that includes 48 companies including the nation's biggest mobile-phone operator and a yogurt maker."

I removed the comment about the use of capital, because it's an allegation not a confirmed fact.
Show HN: URX Turnpike enables deeplinking for iOS apps
That's a pretty good final ultimatum email. There's also the threat of a law suit. That seems to work for professional services types, at least.
Looking at the wiki, I don't think it does handle them. I reckon that if jehna when to the trouble of making this, he knows of at least one use case, even if it's his own. I appreciate that he's shared his work. That said, from my own experience, by the time a regular expression becomes difficult for me to parse, there are subexpressions, negative lookbehinds, and other less comprehensible regex features that this library doesn't seem to support.
> Is a somewhat brief existence worse than no existence at all?

This would apply to local farms perhaps, but from what I read industrial livestock production is causing suffering to many animals to lower the costs.

Disclaimer: I am not a vegan.
This just motivated me to get a Wiki account and help contribute.
That's how locals used to be treated. I see less and less of it as time passes.
Why do people always confuse logic to mean we ignore all sociological concerns? Just because they are harder to reason about doesn't mean they don't matter.

It's not logical to pretend that they don't matter.
It's obviously deliberate. Are you not familiar with OS level profiles? in the case of OSX:
http://support.apple.com/kb/PH11468
there is your master password.

Also the post you mention was already submitted and discussed: https://news.ycombinator.com/item?id=6165708
Who says the computation has to run inside of time?

Consider our spacetime as a four-dimensional space, the pixels of which are set by a computation running in a different dimension of "time." The number of steps required to generate the final output is arbitrary and unrelated to anything we observe, and there's no contradiction in supposing that, say, information in our future could be an input to an iterated algorithm that determines our present.
Lean UX Teams
I'd love to see RubyMotion for Android soon.
> The problem arising from growing meat consumption include, pollution, maldistribution of food, animal suffering, wasting of land and resources, wasting of water, etc.

That's the whole point of growing meat in a lab. It isn't economical to do it now, but it also wasn't economical to have a personal computer 30 years ago, or to get your DNA sequenced 10 years ago.
Neither of those are criminalized; this is an example of the kind of confusion the WaPo article has created by being absurdly imprecise about "streaming".
They should have just renamed it "Break almost every web site" instead.
I think SimpleLegal is my favorite startup out of the batch; I'm an absolute sucker for ideas that boil down to "apply common sense and technology to verticals that are usually ignored by those things."

Really excited to see how things evolve for them.
Does anyone have any direct insight into how "real" this is?

I ask because I hate playing the role of dismissive guy on HN but this seems waaaaay too good to be true at anywhere near the estimated price. Even ignoring the solar power challenges a fully rugged design at $350 seems like a huge reach as does submersible at $400.
He might be a genius but not all genius can make a profitable business. I doubt that will be the case for Amazon eventually (I may well be one of the suckers heh) but let's remember that they just LOST money on the last quarter and consistently earn little to no profits.
No, every does not run a business feeding unauthorized streaming copies of movies or songs to customers.
Good to see that correction.

Under what legal theory is the government taking over the bank?
Where to buy the New Nexus 7 (UK)
cool!! ^.^
Does anyone have any ideas how much this thing weighs? I couldn't seem to find it anywhere...
>That's we use existing crypto libraries.

That's how we implement flaws in the process, around crypto libraries. The price of session-cache lookups is the price paid not to worry there is a serious undiscovered security flaw waiting for you around the corner.

Its a price you have to decide if its worth paying.
If you hover that button with your mouse pointer you can read the following explanation:

Send three "heap-minimize" notifications in a row. Each notification triggers a global garbage collection followed by a cycle collection, and causes the process to reduce memory usage in other ways, e.g. by flushing various caches.
I've got $300 for this if the solar panel is detachable with a few feet of cord, and the keys aren't flat. I don't want to type on flat keys or in the sun.
It doesn't matter how good the man pages are, I can't give emacs and latex to my mother and expect her to produce a document. In general, FLOSS really sucks at supporting nontechnical, mainstream users.
I've just woken up and I haven't tested it, but off the cuff I believe HSTS will prevent the browser from trusting a plaintext HTTP response at all. So you cannot force a cookie if I understand the blog post correctly. You'd have to create a cookie inside of a verifiable HTTPS connection, which if you can do you've already executed a much worse attack.
I don't get it. You create a server to solve C10K problem, and then host its own website with nginx? Why?

Having HN crowd coming and testing your server would be a great test, no?
If a technical person with a bit of knowledge and a few minutes has access to your computer then yes, you're a bit screwed.

If the broadband engineer comes round to investigate your connectivity issues and you (sensibly) watch over their shoulder while they fiddle with your browser settings, looking away for 10 seconds shouldn't result in them having ALL your passwords.

It's about ease & simplicity of breaching the "security" for non-technical people as well as techies.
Is there any country in which the relationship between the finance sector and politics is not ultra-seedy and ridden with dirty laundry and media-swipes?

Regardless of what winds up happening, best of luck to the Bangladeshi people.
Looks tight! Good luck guys!