skysight-inc/HackerNews huggingface dataset:
You are right. The thing is, django doesn't have an image problem so it is fine to announce the attack that way.
Paris commuters rebel against Gov. law to give taxis leverage over Uber
FounderDating Success Story: Refresh
OFF Pocket - prevent your mobile phone from being tracked
Slate Roofing Repair: Cost-Effective Alternatives to Replacement
Note that a fix is available -- patched versions of Play are available all major releases. So it might mean a redeploy of code but it's not a big deal.
I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.

Consider the case of someone malicious getting access to your account. Said bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software. My point is that once the bad guy got access to your account the game was lost, because there are just too many vectors for him to get what he wants.

We've also been repeatedly asked why we don't just support a master password or something similar, even if we don't believe it works. We've debated it over and over again, but the conclusion we always come to is that we don't want to provide users with a false sense of security, and encourage risky behavior. We want to be very clear that when you grant someone access to your OS user account, that they can get at everything. Because in effect, that's really what they get.
...times various JS interpreters, times various browsers, and keeping all those in sync? Sounds like a support nightmare combined with several attack vectors ("sure, the precompiled version is the same as the original, and doesn't try any funny stuff with pointers, either").
I believe you are referring to ethanol based biofuels, which have significantly reduced energy density and require engine modification.

This technology is a plant oil based technology, and requires no engine modification. It's just fuel that comes from plants, and you can put it in your vehicle right now and drive.
I'm sure everyone is going to come up with workarounds that re-enable compression, but they'll be context-dependent and will involve code; in the meantime, the attack is straightforward and viable. Think of disabling compression as a stopgap.
Targeted Advertising Considered Harmful
redpen.io doesn't require sign-in or login or email etc
I'm not sure i buy into the whole idea that they are spending so much money on infrastructure and then they will "turn on a switch" to be profitable. Google is building, but they are still profitable. Here's an interesting dissection of amazon's earnings (complete opposite perspective from the article): http://market-ticker.org/akcs-www?singlepost=3190940.
StartUp Mentorship: Signal vs. Noise
I found it extremely beautiful, especially with the context you provided. Some large framed prints with the text in little gallery placards would make an interesting exhibit.
>There are no other more sympathetic people to do news stories for?

Here you go. https://en.wikipedia.org/wiki/Donald_P._Scott

See also: http://www.fee.org/the_freeman/detail/the-governments-war-on...

and: http://www.volokh.com/2010/04/06/institute-for-justice-repor...
US venture capital courts India tech
FWIW here is the relevant WHOIS lookup for the IP that this edit originated from:

NetRange: 156.33.0.0 - 156.33.255.255
CIDR: 156.33.0.0/16
OriginAS: AS3495
NetName: USSAA
NetHandle: NET-156-33-0-0-1
Parent: NET-156-0-0-0-0
NetType: Direct Assignment
RegDate: 1991-12-03
Updated: 2007-04-05
Ref: http://whois.arin.net/rest/net/NET-156-33-0-0-1

OrgName: United States Senate
OrgId: USSAA
Address: 2 MASSACHUSETTS AVENUE, N.E. 6TH FLOOR
City: WASHINGTON DC
StateProv: DC
PostalCode: 20510
Country: US
RegDate: 1991-12-03
Updated: 2011-09-24
Ref: http://whois.arin.net/rest/org/USSAA
A few days ago, Meldium's announcement of a Ruby gem that provides an inexpensive partial protection (i.e. not disabling gzip) made it to the HN front page:

http://blog.meldium.com/home/2013/8/2/running-rails-defend-y...

The two protective measures are masking the Rails CSRF token and appending a HTML comment to every HTML doc to slow down plaintext recovery. How easy is this to include in a Django plugin?
More details on Google+: https://plus.google.com/109344265064351301756/posts/bZwduor7...
Open source is ostensibly about altruism isn't it?

No. Free Software (Open Source misses the point[1]) is about giving users their four freedoms. There's nothing in the philosophy that implies that you shouldn't charge for it.

Personally, my salary - and of the other developers at the company I work for - is paid for writing Free Software, some of which is publicly available, some of which isn't.

"Since free software is not a matter of price, a low price doesn't make the software free, or even closer to free. So if you are redistributing copies of free software, you might as well charge a substantial fee and make some money. Redistributing free software is a good and legitimate activity; if you do it, you might as well make a profit from it."

http://www.gnu.org/philosophy/selling.en.html

[1] http://www.gnu.org/philosophy/open-source-misses-the-point.e...
Ten Rules Of Internet
50 Websites You Can Use Skills To Make Side Cash On
Thanks Sharlin, that was not only instructive on the terms, but a great read as well. Now I understand precisely why my uncle can always ride is raked Harley with no hands far longer than I can on my stock bike.
I'm pretty sure the pipe could and would be considered 'drug paraphernalia', and therefore possession is a misdemeanor in Texas.

Of course, pretty much everyone has 'drug paraphernalia' lying around somewhere. My coffee grinder, my wife's kitchen scales, our snack-sized sandwich bags, the spoons in our cutlery drawer...
High Frame Rate Video Output for Google Glass
My previous ADB method got a lot of mentions on places like Google Plus. So here's an updated write up with another popular method of outputting the display!
Too bad it's the people in power trying to make their life-threatening opinions into facts.
Two zeros is the end of a list. You must put a space-and-zero for a null.

God says...
had some
advantage over their already dominant parents, as well as over other
species; and again spreading, varying, and producing new forms. The old
forms which are beaten and which yield their places to the new and
victorious forms, will generally be allied in groups, from inheriting some
inferiority in common; and, therefore, as new and improved groups spread
throughout the world, old groups disappear from the world; and the
succession of forms everywhere tends to correspond both in their first
Metascala - A JVM written in Scala
Send Me To Heaven sport game for Android
TL;DR: Senate IP address (156.33.241.5) changed single word on Edward Snowden's Wikipedia page from "dissident" to "traitor".
How is data injection possible if the session is signed?
It's cast directly from the paper. It sounds complicated.

http://www.nesculpture.com/html/specialty.htm
What type of company?
> Crime prevention? Does our government police prevent crime, or just punish criminals? I can argue that without any state-established law criminals would be punished, in some way or another.

Sure, criminals would be punished, but in a much more arbitrary manner. Do you really think that would be an improvement?

> Medical services? I think that some people really enjoy being doctors and nurses, and they would associate even without state-mandated organization.

Yes they would, but as people get richer they start to want there to be standards, at which point you need some kind of group to codify and enforce those standards. Over time, these thousands of different groups that are setting rules for their own little domains end up being grouped together, for a range of reasons, and then you have a dreaded 'government'.

Formality offers protection. In all the cases I can think of, weaker government corresponds to an increase in either the arbitrariness or the corruption of justice. This applies both to criminal justice and to the wider sense of an equitable (not equal) distribution of resources.
The operation of airfoils is non-intuitive and many (event most pilots) hold misconceptions about how they work. That does not mean that the physics is not well understood by those who design them.

There maybe a few gaps (particularly for supersonic flight) still being explored, but in general it's inaccurate to claim that we don't know how airplanes work.
What if you don't stream the copywritten work, and instead download it for later viewing/listening?
i think i would be ok with being called a traitor to the US government, as long as it specified that i was a hero to the country.
Is this due to our Sun's rotation or because it revolves around the center of the Galaxy?
I understand why people don't like ORMs. But I don't understand people who like iBatis: it is boilerplate like the hell. Imaging you have to separately update mappings for SQL select, insert, update and delete query (and these mappings are very long) for your entities.

For example, prepared statement for update looks like this:

PreparedStatement ps = ...;
ps.setLong(1, author.getUserId());
ps.setLong(2, author.getStreamId());
ps.setString(3, author.getNetwork());
ps.setString(4, author.getIdInNetwork());
ps.setString(5, author.getNote());
ps.setString(6, author.getSocialId());

....

And manually counting questions is a normal practice when you add a field:

static final String UPDATE = "UPDATE Table1 SET Domains = ?, TemplateId = ?, InternalJson = ? WHERE StreamID = ?";
static final String INSERT = "INSERT INTO Config1 (UserID, StreamID, Domains, TemplateId, InternalJson) VALUES (?, ?, ?, ?, ?)";
Is it people in power? How many interns and aides do you think work in Congress?
But it is a false sense of security.

Joe User doesn't know a thing about how this magical box of tricks called a computer works. He just assumes that his data is safe on it, and won't get into the wrong hands, and that his passwords will always be protected by asterisks or what-not.

Sure, you may encrypt them using keychain, which is good, and yes, if someone has physical access to their machine and user account then it's compromised, fundamentally - but you're missing the far more likely scenario that this could be used, by, say, an unscrupulous employer, or a mistrustful spouse, or a child to get at daddy's porn passwords. People re-use passwords. Yes, it's bad behaviour, but what do you expect from a shaved ape? By making it possible to view these, you could grant the keys to the kingdom to any would-be eavesdropper.

It's not good. I understand your reasoning, but it's not connected to how people actually use their computers in reality.
But the GP's mention of the 'correlation is not causation' is completely warranted in this case. He doesn't think 'geopolitical happenstance is affected by solar magnetism' either. And that's exactly what is said. Though there seems to be a correlation, politics is not actually affected by the phenomenon.
I received a reply on Twitter from Bill Buxton, who worked at Xerox/PARC and other cool places, pointing me at this chapter out of his book:

http://www.billbuxton.com/input06.ChordKeyboards.pdf

The section "The NLS System: Engelbart and English" contains the most detailed explanation of Engelbart's chording keyboard that I've found, and the rest of the chapter is an interesting read.
Alonzo Harris: This shit's chess, it ain't checkers
A lot of them. http://www.ij.org/images/pdf_folder/other_pubs/assetforfeitu...
There is also the GKOS project: http://gkos.com/gkos/index-gkos-com.html
That [title] is a weird thing to take as main message from that advisory. The Firefox exploit that was used would have worked on Linux just as well; it was simply only targeted at Windows this time.

I agree that switching away from Windows is generally a good idea, but only a hardware-based router, or a software based VM isolation solution like Whonix or Qubes OS would have defended the user in this case. Even Tails, the Tor live USB distribution could have gotten owned by this exploit, had the NSA/FBI/hackers chosen to target them.
The attacker has to be able to issue requests on behalf of the user with injected "canary" strings. I fail to see a practical exploit where one can do this and wouldn't have access to the secret in the response anyway. What am I missing?
Art is a racket. Not art as the human endeavor of expression, or art as the appreciation of beauty. Art as a business is ABSOLUTELY a racket in the same way that dutch tulips were a racket once upon a time. Nothing wrong with that at all in my book.
Did you read the article? The theory seems clear to me...
You've described how cops in small towns in Texas treat locals, while the article describes how cops in small towns in Texas treat outsiders.

The sheriff is elected by the locals, after all.
On your /steps page you have invalid markup.

You are not closing the div (class .btn.btn-danger) so you have an open element when you try and close the list tags.

I noticed it because I viewed the source (always interested to see what people are using to build front-end stuff).

edited: for clarity.
Except we know exactly how gravity works. If you google it all the exact equations are there.

As you say exactly why is still a unknown but then so is everything if you keep reducing the problem.
Edit wars are quite unlikely on this article. There'll be a bit of back and forth, but there'll be plenty of administrative eyes on this page looking for abuse.
Lower pressure = air can move faster ...
How to Gamify your life without Apps
I'm a fan of society6 -- sure it's not expensive art, but you can buy some pretty cool stretched canvasses for $85-$150 depending on the size you want. Of course you're also getting printed somewhat mass-manufactured stuff instead of one-of-a-kind pieces.
I think if the ultimate goal was to integrate the WaPo with Prime, he may have made the purchase as Amazon, instead of as a personal purchase.

There's something else going on here.
Pylint 1.0 released
Of course it's not a monopole, but the dipole idea is also too simplistic, as is the idea of "poles". Presumably, the dipole moment of the Sun has become very small but there are still higher orders at work. Thus, the field of the Sun will look very much more complex than the simple dipole field [0].

A possible configuration would be that both geographicals poles of the same sign, but the field around the equator is of a different sign, like a quadrupole perhaps.

Disclaimer: I'm a physicist but not an astrophysicist.

0: http://upload.wikimedia.org/wikipedia/commons/1/17/Earths_Ma...
I'm really looking forward to getting a Leap Motion device! I think there's a lot of possibility there for programmers that are interested in building a new input method.

My thinking is that a Leap Motion could be used with a standing desk (my current preferred desk setup), in combination with existing keyboard and mouse, to replace key combos to the OS like switching windows/tabs, window management (maximize, minimize, expand to left half of screen, etc.) as well as macros for common commands we type all day (`git push` or running the tests, for example.)
Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.
"I'm not sure why you would feel better if defendants went through a kangaroo court where justice is dispensed within days and the convicted are forgotten just as quickly, but I certainly don't see how that would lead to any decrease in wrongful convictions."

What the hell? Where did I express a preference for anything like this?
Wow, that's a hard sell. Quite impressed by the sheer intensity of it.
No. He has not been convicted of treason. We still have due process.
NuoDB Matures NewSQL Solution with Further Features and Performance Enhancements
Find your local art college and attend their graduation show.
I'm in the same boat - if the attacker could inject strings into requests pre-compression, then wouldn't the client already be compromised?
If the issue can be caused by inserting null bytes into the session, then it sounds like the signed cookie verification might have stopped at the first null byte, allowing the attacker to place other data after the null byte which the application would continue to read and use.
How is it that random data would only slow it down? If I add a random field to my response of variable length, say, from 0 to 50, with completely random characters, it should completely throw off this attack. The length of the output will change from request to request.

I suppose, given infinite time, you could send the same request over & over and map the variance of content lengths, and get an idea of what the actual content length was before random padding? But the compression seems to throw that off even more AFAIK - because the data we pad with is random, it could very well accidentally compress well because of the rest of the data in the response, further throwing off any guesses.

Edit: From the pdf on breachattack.com:

While this measure does make the attack take longer, it does so only slightly.
The countermeasure requires the attacker to issue more requests, and measure the
sizes of more responses, but not enough to make the attack infeasible. By repeating
requests and averaging the sizes of the corresponding responses, the attacker can
quickly learn the true length of the cipher text. This essentially boils down to the
fact that the standard error of the mean in this case is inversely proportional to p
N, where N is the number of repeat requests the attacker makes for each guess.
Interns seems likely. I've seen a fair few politicians-attempting-to-surreptitiously-edit-Wikipedia scandals, and mostly they are just incompetent or joking around.
"LLVM backend for the Scala compiler". There ya go, no ambiguity.
Economist : Troll Attack
What kind of power did Snowden have?
Why the throwaway account to ask that?
That one is not to scale, either. That one is: http://mishkahenner.com/filter/works/Astronomical
SimpleLegal (YC S13) Reduces Legal Bills With Machine Learning
I am in Nashville, TN.
It wasn't. The whole post is tongue-in-cheek.
> People getting upset by mere words (not even uttered against them) are hardly worth a hackers time.

Rape is a trigger word unlike most other words.

I for one don't sensor myself around my friends, I tend to cross the line, all the time. My friends see me in context smiling or laughing, I know most of their life stories. It's safe to push the limits of hyperbole.

Here we have little/no context. Someone sees the word and they think of something horrible, the place, the person, the smells. All the things that are blocked out on and every day basis.

So why not avoid the word? Just to be kind to a stranger.
> Support for new scrollbar style in Mac OS X 10.7 and newer

Finally. That one took quite a long time for them. It looks simple in the change log, but I suspect that it was actually quite a big change under the hood.

EDIT: Woops, it seems that this is an error on release page, since they've hit a regression [1] and they've pulled the feature, it's due to come back in v24. And is seems I was right that this was actually a pretty big change under the hood [2].

EDIT 2: And they now removed the error about new scrollbar from the article.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=636564#c244

[2] https://bug636564.bugzilla.mozilla.org/attachment.cgi?id=744...
/facepalm. He's not playing poker though, he's playing chess!
http://deviantart.com
http://etsy.com
http://yourlocalcoffeeshop.irl
A delay on the API key generation or approval?
I'm sure a lot of the price is supply and demand. There is only one of an original work available.
im a rabbit
How to pronounce 49
I'm British, where our Internet connections aren't quite as restricted as America's, but certainly aren't anywhere near parts of Europe.
GM cuts 13 percent off price of Volt electric car
Rails is not vulnerable to cookie forcing btw. But your authentication can be (Devise bug http://blog.plataformatec.com.br/2013/08/csrf-token-fixation... )
It's not a scam. I read through the book, it's very interesting. It does actually show a side of javascript I never thought of before.
I wouldn't agree that a negative cash cycle is outdated. However I would disagree with the author's inference that a low profit business with negative working capital is as good a high profit business.

As evidence, I'd point to a great negative working capital businesses. Dell. No one's arguing that Dell is a super business thanks to the cash it generates because of its negative working capital cycle.

Bezos is obviously brilliant. It's possible that he made the decision to stick to low margin businesses because he knows that won't attract competition. That would be counter-intuitive and pretty brilliant if you're certain you can out-execute your competitors in the low margin space.
... or that it's hard to be a major contributor without getting paid for it.
If you read the actual paper referenced, we know some of how it works, but not all.

Two of the proposed theories (that it has to do with gyroscopic effects, and that it has to do with trail), have been disproven by creating a self-stable bike with no gyroscopic effects and (slightly) negative trail. The paper introduces one additional factor, the difference in center of mass between the steering assembly and the rigid body of the bike; the steering assembly having a lower center of mass causes it to fall faster, providing the necessary corrective steering to achieve self-stability.

So, there are several factors we know about, which can increase stability. We know how to locally optimize stability for certain designs. But we don't yet have a full set of necessary and sufficient conditions for a bike to be self-stable. We haven't even proven, analytically, the intuitive notion that a bicycle must lean toward a fall, though given our intuition it is believed to be true.

Here are the two necessary conditions that the paper provides:

> To hold a self-stable bicycle in a right steady turn requires a left torque on the handlebars. Equivalently, if the hands are suddenly released from holding a self-stable bicycle in a steady turn to the right, the immediate first motion of the handlebars will be a turn further to the right. This is a rigorous version of the more general, as-yet-unproved claim that a stable bicycle must turn toward a fall.

> Another simple necessary condition for self-stability is that at least one factor coupling lean to steer must be present [at least one of Mδϕ, Cδϕ, or Kδϕ must be nonzero (SOM text S3)]. These coupling terms arise from combinations of trail, spin momentum, steer axis tilt, and center of mass locations and products of inertia of the front and rear assemblies.

That's what is meant when people say "we don't know how bicycles work." We do know some of how they work; we know that the designs that we create steer into a fall, and do so in such a way that damps the wobbles and eventually goes straight again. And we do know some necessary conditions for a self-stable bicycle, like a requirement that something that couples lean and steering must be present; but we don't know if the steering into the fall is absolutely necessary, or if you could build a bike that managed to achieve self-stability without it.

So, I would say that a more accurate summary is "we know how current bicycle designs work, but we don't know exactly what aspects of them are necessary, or how to completely characterize the sets of designs that work or don't work." But that's a bit more of a mouthful than "we don't know how bicycles work", so that's what gets repeated.
Fastclick - Polyfill to remove click delays on browsers with touch UIs