skysight-inc/HackerNews huggingface dataset:
number_to_currency is used in three of three Rails apps which I know well enough to grep without grepping, though not in the form which is vulnerable here. I have an imperfect understanding of the development practices in the wider community, but my guess is that, if your app touches money, it probably uses it.
QPX Express API (flight search)
Rinspeed XchangE concept video presentation
I am fond of the controls in my car. Pretty much everything is done through a simple knob with a label above it.

On the far left, a knob for lights. Pull out one click to turn on parking lights, all the way out for headlights. Twist left and right to adjust dashboard brightness.

Next to that, fan control. One click out for slow, all the way for fast.

Just to the left of the steering wheel is the heater control. Pull it out for low->high heat on a sliding scale, rotate it to control the defrost.

Immediately to the right of the steering wheel is the cigarette lighter.

To the right of that is the wiper control. One click for slow, all the way out for fast.

Center of the dash is the radio. One knob to turn it on and control volume, one to tune.

You might have guessed that this isn't a modern car. It's a 1962 Studebaker. The controls are simple, clearly labeled, and do everything you need. You don't even have to look down to find the right control, you can just count the knobs from one side to find the right one. You can easily tell the state of the heater or lights because you can see and feel the state of the control. You don't really even need fine motor control except for tuning the radio, and that's pretty forgiving too. Were I designing a car interface, I'd consider the lessons presented there.
Yes, I thought the whole issue was myth.

Which does lead into, why are we trying to learn about stack overflows and critical system issues about imaginary subjects.

And even if it's not myth, as above there's no proof that a stackover flow was the supposed issue.
Aaaaand, it's gone.
Why Taxpayers Will Bail Out the Rich When the Next Storm Hits
Plus, if the one on Mars kills anyone, we all know how that movie goes. One does not simply walk away from killing an extraterrestrial.

I'm going to lick someone with a very bad cold now, just in case.
So a tautology broke Hacker News?
This App Trains You to See Farther
Reek.ly?
When I've tried to read the article I got 404 response, so just in case that happens again:

http://webcache.googleusercontent.com/search?q=cache:http://...
Not here. I am way more scared of the "best" candidates than I am of the normal ones.
I have a hard enough time getting multi-finger gestures to actually work on my iPad and that's while it is right in front of me with my full attention. I can't imagine this all happening while trying to drive the car too.

I think we have too much shit distracting us in the car as it is. I am more than happy with physical dials and sliders for A/C, dials and buttons for the audio, and hopefully someone will come up with a descent Siri-like voice command input for messages/voice and GPS.

Asking me to interact with a blank screen and having to look at it to make sure it's doing what I want is asking for trouble. Just the other day a cop was walking the line-up at the traffic lights and booking anyone who was fiddling with their phone.
Unless your online storage method of choice is encrypting your files on the client side before its transmitted, you should assume it's visible to the operators and anyone they grant access to.

And it's not just Dropbox that can see those files but also Amazon as Dropbox is doing the encoding of the videos on AWS.
Looking for a spring break accessory that is sure to impress?
http://www.connectionpin.com/2014/02/looking-unique-funny-spring-break-accessory-sure-impress-friends-dates/
Prescription eyewear that displays app notifications
Ok, time to call most of you out. Why's this company different? When nameless corporations lay everyone off I usually here how broken capitalism is and how huge companies are evil, etc., but in this case I see more people trying to rationalize it.
I really doubt that it's possible to be a top exploit developer and yet be unable to implement BFS/DFS in under fifteen minutes. Some things really are just the absolute basics. If it never goes further, then that's a problem, but there are enough people out there who can't write ten lines of code that you have to weed them out.

My cousin's employer has started using Javascript Under Pressure [1] as the first round of technical interviews - it lightens the mood, and fully half of the people applying for a front-end development position at his company can't finish the first one, which is literally to write a function that returns the argument multiplied by two.

[1]http://games.usvsth3m.com/javascript-under-pressure/
The video is over-produced and phony, but it's an entertaining conceptualization of a self-driving vehicle experience.

(That is, assuming you wear thick turtlenecks and suave watches.)
Neat and I feel like this could be easily learned by a driver. Minor feedback: the audio level selection seems to move on linear scale, but volume is a logarithmic scale. The perceived difference between 16db and 8db is the same as the perceived difference between 4db and 2db. If the audio is on a linear scale, then the sensitivity of the screen will be much more on one side than the other.
http://www.trueproperty.ph/A-139144383731

I don't know what the laws regarding kicking out tenants in the Phillipines are, but I'd hate to be the landlord locked into this lease if the price of bitcoin drops significantly.
I think "associate professor" is the untenured position, regardless they seem to be all 100k +... even in Canadia:

https://uwaterloo.ca/about/what-we-stand/accountability/sala...
I'm curious whether anyone has done any recent, and hopefully unbiased and comprehensive, Mongo comparisons with other DBMS with a large dataset. It's been a while since I've seen any new information.
>>> SWAT 4

Oh man I miss this game so badly. I just loved every piece of it. I tried to buy it now, but unfortunately it's out of stock everywhere. Apparently because the publisher has closed. And there's not much on eBay :(
If you want good work out of oDesk/Elance, please treat the freelancers with respect and be ready to pay up.
gallium arsenide costs a fortune, way more than twice of silicon
Even post 4.0 it isn't super reliable. Basic playback of HLS works, but we have had issue seeking, pausing for long periods of time and resuming, etc. I wouldn't be surprised if things like WebVTT(Subtitles), ID3 tags and other advances features also don't work well.

4.4 is supposed to be much better but I don't work on Android anymore, so I am not really sure.
Wikipedia has a brief section on this[1], but essentially it means "buys on release". It's the people who follow reviewers and industry news, spread word-of-mouth, play for dozens of hours, but don't demand features that would drive other customers away.

[1] http://en.wikipedia.org/wiki/Gamer#Core_gamer
Justin Biever-Draw My Dysfunctional Life (Hilarious)
Does he have any books published? I'd buy it.
What it's like to be a professional poker player
Gold didn't back currency, it was currency.
It's an admirable initiative, but I'm pretty sure that at this point sta.li has been in the "design phase" for years. It's vaporware. I'd love to be proven wrong, though.
That person made some good points about Bioshock, but their self-important ramblings about video game reviewers got old really quick.
> And despite the infinite number of Irrational Games studies opening and closing, for some reason they only ever make two games... a strange limitation on 'infinity'.

Let's call those two games, "pi" and "e" while we are at it.
You're substantially right with who isn't affected, but I would recommend prioritizing this as Immediate Remediation Required if any part of your app is affected.

You should treat "attacker gets to modify columns of their choosing" as being epsilon away from "remote code execution." There exist multiple plausible paths to getting it which are widely implemented in Rails projects.

Two of many:

1) The attacker writes arbitrarily serialized objects into your queuing system, such as Delayed::Job. They either execute attacker-chosen instructions or the deserialization of them executes attacker-chosen instructions, in a fashion similar to the January of Fun YAML issues.

2) The attacker uses this vulnerability to compromise the admin users (and/or make their user into an admin user), thereby gaining access to your admin dashboard, and either a) causes business damage via malicious use of admin-only commands, b) achieves privilege escalation from the dashboard to e.g. an admin's email account (game over almost always), or c) they attack your app's vulnerable underbelly since who worries about a company employee exploiting appsec bugs.

It is possible that your app is resilient to these and other bugs, but until you know you are, treat this CVE as a gun pointed at your face. It may not be loaded and the trigger might not eventually be pressed, but it's still a gun pointed at your face, so prudence suggests removing the gun pointing at your face ASAP.
Is this company named in honor of our favorite blind starship engineer?
If those projects have prospered enough that rewriting in a high-performance language has become a necessity, then I would say Rails fulfilled its function brilliantly.

Rails is a good, probably the best, general purpose web framework, and no-one claims otherwise.
$100k is low for a HW designer unless you have no experience building anything (home/school projects don't count). $135k-140k is about right for an experienced Staff-Level HW designer.

In my view not getting paid market rate and taking equity is for founders. Under no circumstances would I take 50% stock and 50% salary as an employee. Generally founders carve out 15% equity for the employee pool. So you might get what 1%? Not worth it.

Also, there's a perk premium that you are giving up when you join a startup. Established companies have ESPP, profit sharing, 401k matching, RSU's, bonuses, etc... This can easily be 30% over your regular salary.

Joe Sixpack HW engineer at Average BottleCap Co, is probably earning $135k base + ~$40k or $175k-$180k in total compensation.

So even at market rate salary, you are below market in terms of total compensation.
King.com, Maker of Candy Crush, files for IPO
Ask yourself this: why can't the founders afford to pay market salaries if they have successful businesses already, and had previous success with fundraising?

It's likely not that they can't pay you market wages, but rather that they don't want to for some reason. By that I mean they presumably could either pay out of pocket (if their other businesses have been financially successful), or they can sell the equity they are offering you to an investor, and then use the money they receive in return to pay you (that's the whole point of fundraising, after all!)

I would have an upfront conversation with them to find out the answers to these questions - maybe they strongly believe the equity is going to be worth a lot in the near future, and want you to share in that upside for your contributions. Or maybe they are trying to take advantage of you - only talking to them and reflecting on their responses will get you your answers.
You'll have to forgive me for the awful presentation format and pacing, but here's a fun trick for bypassing the auth system on the Asus WL-700gE circa 2007:

http://www.toaster-of-doom.com/~brandon/no_crawl/router/

Spoiler alert: it makes the WRT120N look like Fort Knox. These companies have come a long way over the years.
> I remember trying to recruit good analog IC design engineers at my previous startup ... There were maybe 100-200 worldwide who fit the bill

You have atrociously high standards for "good" if that is the size of your pool.
ugh, written too quickly. s/irrational games/stories/

Infinite finishes with an Everstory, with infinite branches... yet in all of those branches, there is only one of two possible outcomes for the main character in each of them.

I really need to proofread my comments more.
Actually it looks like Java 8 will improve on Joda-Time, its far from perfect.
I spent entirely too much time trying to parse 'outagelet'.
I love the way this API is presented on the page. It's awesome. It exposes itself in such an obvious way that it leaves no question about its capabilities and usage. Makes me want to jump right in.
Very telling that you felt the need to create a new account to make these idiotic comments - you're obviously unwilling to have your real account associated with them.

So even you know you're talking shit. Knock it off, why don't you?
They were not sent to prison for a peace protest. They were sent to prison for breaking into a nuclear facility by cutting through three fences, bypassing armed guards, and ignoring signs about the restrictions.
"The reason why dynamic linking has been invented was not to decrease the general executable sizes or to save memory consumption, or to speed up the exec() -- but to allow changing code during runtime -- and that's the real purpose of dynamic linking, we shouldn't forget that."

Not sure about "changing code during runtime", but one of the great benefits
of dynamic-link libraries are for writing plugins. And I don't think it would take much time for an app to look up its own plugin folder.
Rails does suffer disproportionately from security issues. The framework code has become increasingly bloated and serious security vulnerabilities are being continuously discovered (see http://www.cvedetails.com/vulnerability-list/vendor_id-12043...) both on the low and high level code (the seriousness of this specific vulnerability depends on application). While I like Rails, I would not choose it as a server-side framework for my product anymore: painful to maintain (backwards-compatibility is not a priority) and slow (compared to say, Go, anyway).

Rails is nowadays easily replaced. Most of the fancy server-side bits are not really that useful, and on the front-end the zeitgeist are JavaScript frameworks, where the server acts as an API but serves static HTML/JS/CSS files.
Thank you for brightening a miserable afternoon.
I totally agree, things like opening the AQ gates in WoW are like old battle stories
Absolutely INCREDIBLE cover of "Let it Go" from Disney's Frozen
This is the best cover I've ever heard of "Let it Go." I am absolutely in love with this girls voice and think everyone should send her some love
Programming Laws and Reality: Do We Know What We Think We Know?
Then use a shared neutral host or VM that you both ssh into.
It would be interesting to see an analysis of the number and severity of Rails security issues as compared to similar frameworks with similarly sized user-bases. I would be happy to be convinced by _actual and relevant data_ that Rails has an unusual problem with security.

But until then, to me, the people complaining about Rails security sound a lot like the people that complain about Windows security. When you have a product that's used by a whole lot of people, then there's going to be a lot of incentive to find security holes and a whole lot of people using the product in sometimes hard to predict ways. This does not necessarily mean that the product is inherently less secure than alternatives, it just means it's popular.
I don't think Dropbox has ever claimed that they can't see your files on a technical basis. I'm sure that there are policies and auditing, but it's not secure storage. This is why I've told medical profession clients that they should absolutely NOT be using Dropbox.

If you want security, encrypt on your own or decide if you trust SpiderOak.
This is like learning vim!
Maybe they've restarted the server. Before it was just timing out and later returned 404, that's why I've posted the link to the google cache.
I think cars should just come with slots where we could put in our phones and bam!, powerful computing that you could carry along.
What makes ambition/creativity/drive/perspective/attitude/inspiration any more intrinsic than intelligence/knowledge?
Immigration Department data lapse reveals asylum seekers' personal details
The direct link
http://www.forbes.com/sites/lewisdvorkin/2014/02/18/inside-f...
Total self-sufficiency is nearly impossible or at least extremely difficult. If you allow external trade it might be doable, although then you have to actually produce something of value, and trade it without bringing the government down on you.

Although I wonder, what kinds of technologies would you need to achieve complete self-sufficiency? It's a practical question too because that's what we would need them to settle mars and the moon, not to mention other solar systems.

Perhaps you could get a lot done with robots, it depends on the task.
I guess "outagelet" is a replacement for "downtime".
Free Book- Iraq: A Soldier's Perspective on War
It's satire, even the name of the CEO is incorrect:

"We are proud to introduce Uber Rickshaw, Uber Bike, and Uber Piggyback.” stated the CEO, Travis Parker Monday morning.
Probably used "while" instead of "for each" when matching.
Maybe this term "outagelet" should be added to list of terms to automatically replace in article titles.
Harvard's swarm-like robotic construction crew needs no foreman
Textbook Search Engine and Marketplace (MIT)
This is why I've backed 9 Kickstarter games already. It may not be perfect, but I'm not a part of the problem anymore. Traditional publishers put the carriage before the horse. They use money earned by Game 11 to fuel Game 12. When you're buying a game you like, you're NOT paying for its production costs. You're paying for its sequel production costs.

Kickstarter success is reputation/prototype based. You need either a great reputation or a great prototype. It's essentially a form of grant. Many of the games which succeed will ultimately fail in the "fun" sense. Yet I'm convinced that, as broken as AAA publishers are, throwing dice gives me a better chance.

Check out board games. There's big innovation and it's entirely game mechanic based.
You'd be paying with post-tax dollars rather than pre-tax dollars, and you have to be an accredited investor [1] for it to be legal.

If somebody really had said, "I want to bet my whole salary on the company," I'm sure we would have be happy to accommodate them with a deal that was fair. There'd still be a vesting period, of course, for the same reason you don't get your annual salary up front on the first day. The tricky question would be the cliff, but I'm sure something could be worked out.

[1] http://en.wikipedia.org/wiki/Accredited_investor#U.S._criter...
Honestly I didn't really get this article. It seems to make ad hoc distinctions for traits based on some possible future reality, that may occur after we are dead. And none of it relates to why people get intimidated.
Blonk – a Tinder for Jobs iOS/Android app
Can't help you with that, latest download is from 2009: http://dl.suckless.org/stali/
Before you wonder about stack overflows, as yourself why the occupants never applied the brakes.
Man having worked on a few router firmware sources I'm surprised there's not an exploit for every router out there, except maybe for the OpenWRT ones.

There was one router that had a built in backdoor, lets say you hit the router on a hidden page /sysctrl.html, which gives you essentially a poor-man's console with an input to send any command as root and it writes the output into a textarea. I mean it's as simple as launching telnet and then you're on the router as root.
The article specifically mentions how this special HTTP header was implemented client side using a browser extension and how it's handled server side
© 2006-2013 for something still not released certainly isn't promising. Glancing at the git logs (http://git.suckless.org/?s=idle) there is some ongoing work, so the project isn't totally dead at least.
Presumably a hit on any of the "before" keys triggers not just a replacement with the corresponding "after", but another pass through either a subset of the replacement list starting from the key that matched, or the entire replacement list from the top down; otherwise an identical pair wouldn't have a chance to be pathological.
How the Feds Can Take Even Legally Earned Bitcoins
I think the idea would be that those are more complex traits that will be harder to change through new neural technology (compared to simply learning new information) and thus less likely to change in the medium term.
But carefully.
> That was my first thought on reading the article - they do connect via ssl/tls to a daemon and get 64 bytes of entropy. But how much good entropy would you need to complete a secure tls handshake?

It certainly doesn't mitigate the attack completely, but it does reduce it to a narrower window of time, so I think that's a step in the right direction.

Before - given 1000 machines in EC2, running the same AMI, it seems like you have a better-than-expected chance of predicting the SSH host keys (or other sensitive "random" data that was generated on first boot) of a fair number of those machines.

With this - given those same 1000 machines in EC2, you would have to eavesdrop on the network traffic of each one, at the time of its first boot, to have a reasonable chance of guessing the state of the internal entropy pool.
Movie Pass for Movie Lovers
However, I am quite certain I save considerably more than $9K each year by not living in SF, so I'd still be better off with the $90K income.
I was dreaming of it, and knew that no matter how much it was itching I could never scratch it. Thanks
I believe there was a group on reddit that tried to do this.
And people still wonder why climate change faces such fierce opposition. At this point I'd expect large amounts of people to refuse to budge with childish arguments. And the people who pull this crap deserve it.

Sadly typical for UK governments though. Clearing out anyone working for them with an incorrect ideology (or party card. Technically illegal. Technically even against human rights. Sadly very common). Sometimes they're even demanding government suppliers do the same.

I realize the people calling for this are not the same people that do climate research but still. At this point I'd really expect to hear arguments along the lines of "if you were right, why is this necessary ?".
Is he trying to violate the laws of thermodynamics?

The front has to let sunlight in, but then keep photons from
escaping. ..... This takes photons from a broad area and
funnels them into the PV chip. The other end of the U acts
like a reflective cap, making it very hard for a photon to
escape from the chip without being reflected back into it.

So basically a funnel with a wide part and a narrow part? And since it's narrow it's less likely for a photon to enter?

That actually doesn't work - the intensity at the narrow end is higher, and the total number of photons going in each direction is exactly the same.

One way mirrors do not, and can not, exist.

(One thing that does work is having slanted walls and lots of reflections giving many opportunities for the photon to be absorbed. But if it doesn't it will inevitably escape again.)
Is it really illegal to use your phone while stopped at a stoplight?
By "cues," I mean visual affordances that persist, not instructions that are shown before using it. It's a violation of one of the fundamental rules of usability, "Recognition Rather than Recall."

Look at a traditional dashboard. The air conditioning knob is a different shape and size from the stereo's volume knob, and located in a different place (ideally). Those things make it easy for the the driver to distinguish one from the other, and find them while keeping their eyes on the road.

There are other cues that usually exist to help as well, such as a blue-to-red graphic around the temperature control, the volume control being next to other audio features like the radio display, etc.

In an environment where the user has to keep a 3,500 lb steel machine safely controlled while traveling 100 feet per second, the rules of usability become incredibly important.