skysight-inc/HackerNews huggingface dataset:
The point is that large OAuth2 providers have open redirects themselves at the authorization endpoint, by not requiring all clients to register their redirection URIs. This directly violates the spec, as per section 3.1.2.2, and is further warned against in section 10.15.

In combination with the implicit flow, this means that an attacker can create ask the provider to authorize any client to access their data, but actually send the access token to the attacker's URL.

The interesting thing is... if providers actually followed all MUSTs and SHOULDs, this would not be a problem. The providers explicitly decided to allow this variety of problem to happen.
When sued the appropriate action is to immediately higher a qualified lawyer with expertise in the specific area. Then follow his advice. Until you do that... do not do ANYTHING.
While it may have been in isolation the "What does a STOP sign mean?" question is a question that I actually had on my written test.

I think it was phrased a bit differently, but that was the essential question. The multiple choice answers were also extremely leading with one being even more obviously correct than you would expect.

In California you're also able to take the test 3 times in a row if you fail it every time, you can then take it another three times immediately if you pay $20. Since there aren't many questions it's basically impossible to fail.
Exactly - this is 24 separate 2 dimensional Games of Life overlaid on each other for visual effect.

To be 24 dimensional, the rules would have to be quite different: at each turn of the game, instead of just considering each cell's 8 neighboring cells on a 2d grid, there'd be 11 additional 2d grids (perhaps represented by different colors), and you'd evaluate the 8 neighboring cells on each of the 11 other 2d grids, iteratively, once for each of the 12 grids. Likely this would not run particularly quickly in a browser (or anything else) for any interestingly large field.
It would be ...gasp... Following its own and iteration law.
As a matter of order, people should only stand trial if the government legitimately believes them guilty and the government believes it can prove this to a jury.

Trials aren't for finding out facts or uncovering the truth. They are the formal processes that a government must do after deciding that a citizen deserves punishment to actually effect their decision.

minor edits
I got a lot of strange looks from white people in cars while walking through Capetown, SA. I could not imagine to live in a place where I were afraid to just walk where and whenever I want!

Until now, I never had any negative experiences, anywhere in the world because of walking. I'm male, though, I guess that's quite significant in many places.
Philadelphia,Pennsylvania, Remote work only,Full-time,Part-time,Contract

Stack: PHP,Mysql,CSS3,HTML5,Javascript,jQuery,Python,Django

Resume: Email me for resume.

Junior web dev here looking for new opportunities and eager to learn new things. I've been playing with Go lately and have also been getting my feet wet with iOS dev.

Contact: dave.jdough [at] gmail [dot] com
Needs moar detail and/or a proof-of-concept. Is this issue about sites not doing section 3.1.2.2 of RFC6749 correctly?

http://tools.ietf.org/html/rfc6749#section-3.1.2.2
London, UK, Remote, Contract

Stack: J2EE/Java (10 years), Android (4 years)

Resume: http://uk.linkedin.com/in/rbateman

Contact: ryan@darkindustries.co

Overview: I currently develop Android applications and run a small team of freelance/contract developers and designers. We specialise in the development of Android applications for iOS-based startups but have produced apps for everything from large media clients such as NBCSports to individuals with a neat idea.
Ontario Canada, Remote, Contract

I'm a very talented and innovative software/UX/UI designer and project manager with 20+ years experience. I've designed from scatch and managed very large and complex projects, most recently a new type of analytics SaaS, a server-to-server software installer, and a 2nd screen real-time fantasy sports game. I'm also a copywriter and sales page/funnel designer with an eye to conversions.

http://johnreel.com/resume
http://linkedin.com/in/johnreel
http://tracker.ly

Currently looking for contract work to:
- Define the specs for software
- Design software
- Write Sales Copy

I also can write you the kind of online dating profile that will find you the love of your life. :-)
Any member of Congress that starts putting Administration personnel in jail will be committing political suicide.
It's someone who has been involved in the business of technology for a long time, so I'd give his opinion substantially more weight than the average HN comment. It's also bog-standard legal advice, so I'd say it doesn't need a lot of footnoting.
Supermarkets are using science to turn ordinary shopping habit into
Yes, his comment is just a winded way of saying ends justifies means.
Well, despite its imperfections, how does DNSSEC worsen security compared to regular DNS? Besides, it's not like the use of DNSSEC prevent you from continuing to also rely on additional measures; such as good old fashions CAs, or something better.
Just keep in mind that the expensive and well regarded headphones aren't always the best for you. There's no best really, as far as subjective listening experience goes.

I have the Sennheiser HD650s and AKG K701s. Used to have the HD595 also. I tend to prefer the latter for most music, as well as speech. The Senns I find more preferrable for movies and classical music.

I also have an ancient pair of Grado SR-80s (or SR-60s?), which are by no means an expensive high-end headphone. But I still like their sound on some things.

Other people prefer considerably bassier headphones and I can see how that is a valid preference, especially considering how some electronic music is mixed.. in fact, I wouldn't mind having such a pair for myself.
Wow, feels like it's the 90s again with PGP and 40bit export browsers!
Cool, I tried a few searches for links I've saved off and it works quite well
Oregon; Remote, Relocate Anywhere; Full-Time

Stack: Java(Android, Salesforce, Junit, Selenium) Python, C, C++, HTML/CSS, Git

Resume: https://www.dropbox.com/s/smz2xoeofhdekx6/resume.pdf

Contact: vanrysss@onid.oregonstate.edu

Ex .mil graduating with a degree in Economics. One year's development experience dealing mainly with Java. I'd prefer to do something mobile or web front-end related. Currently picking up Objective-C, and JS. Fluent in Dutch/Flemish.

I have an Android project in "the second 90%" that you can check out here, excuse the mess while I refactor some stuff. https://github.com/Brabon/MACSv1.0
Java needs feature opt-in, import future.sane.Generics; and so on. (Scala has these.)

Python learned it the hard way. The value of backward compatibility got a bit underestimated there, with Java it's going the other way (the value of progressing, giving better tools to developers is overlooked). The JVM is a big bag of crazy code already (HotSpot with C1 and C2 JIT compilers, the many garbage collector algorithms/implementations and the other stuff that is currently deemed the JVM's responsibility), so there's plenty of space for new opt-in features.
Not just a decent implementation; an implementation which meets the spec. This is not a problem with OAuth2, which explicitly requires registration of URIs where the implicit grant type is used, and covers other cases well in the Security Considerations section.
Probably not, I tend to only click on links on domains that I have heard of, though.
> So what you are saying is you are ok with 10000+ deaths year over year for many many decades to counteract an extremely remote chance of US federal government behaving like Saddam or Assad

The violent crime rate has been trending down in the US for decades, and continues to do so. You seem to be making the assertion that banning firearms would result in fewer deaths due to violent crime - an assertion that is not borne out by reality. Further, the number of people killed by government action in "peacetime" exceeds this number by many orders of magnitude.

> We all know where the state govt will land if it comes down to killing their citizens.

We do? I seem to recall several instances of states acting in exactly that manner. I'm originally from Arkansas... are you familiar with the "Little Rock Nine"? The governor called up the Arkansas National Guard to prevent desegregation in Little Rock's Central High School.

I have no idea why you would believe that the state government would protect unarmed citizens if the feds came calling.

> And even if they did taking on the US army by militias with their puny machine guns is laughable.

That's fantasy. No one is proposing this. Any action that brought the US military to bear against the American people would be met with a great deal of resistance from all corners of society - including from within the military itself.
Because he lied during testimony in front of Congress without any consequences?

There were ways to answer the question without jeopardizing a classified program. It has been done before and will be done again.
Automated 0-day attack: fair point.

Though direct remote code execution is probably much, much more likely than authentication bypass.
CSS. visibility: visible undoes visibility: hidden
I love it! By far the most important thing about Privacy Badger is that it's backed and controlled by the EFF, instead of some individual or business that might be tempted in the future to betray users for profits.[1]

--

[1] For example, consider what happened with Adblock Plus. For years, it blocked all ads, but then in 2011 its developer announced it would allow "acceptable ads" by advertisers who had partnered with Adblock Plus. (For the details, see http://en.wikipedia.org/wiki/Adblock_Plus#Controversy_over_a... ) The EFF is extremely unlikely ever to do something like that.
Um, the first one doesn't seem to have any code in it ... or documentation ... or anything ...

https://github.com/nasa/Kodiak
Show HN : Hasty PopCorn, daily dev builds for PopCorn Time
Location: Atlanta, Local or Remote, Full Time

Stack: JS (esp. Leaflet and D3), R, Gephi, HTML, CSS, a little Python and Django

Portfolio: http://mollietaylor.com/portfolio.html

Resume: http://mollietaylor.com/resume/

Contact: mollie.taylor@gmail.com

Overview: Data scientist. Love making interactive visualizations and maps. Also enjoy data analysis and front-end development.
Anywhere, Remote, Open to Relocation, Full Time

Stack: Ruby/Rails, PHP (have used CakePHP and Kohana), C#/ASP.NET MVC, Java/JavaEE, love learning new stacks

Resume: http://www.cmadams.org

Contact: chris@cmadams.org

I'm trying to figure out where to relocate to for full-time work and I'm not really sure where I want to go (so feel free to contact me no matter where you are). You can learn about me through my resume at http://www.cmadams.org but I'm a recent-ish university CS grad, I've worked as part of a distributed team for Microsoft, interned at a YCombinator startup (WePay) in Palo Alto, have done web development remotely for three different clients, tried to build a startup at an incubator (didn't work out but learned a lot), and http://www.istorical.com is my baby/time-sink (it's where I've learned Ruby/Rails).
For all the size of both houses of US Congress, they are essentially run by a handful of people.
This is an awesome article. I would love to see the tests packaged in such a way that we could port them to other DB's easily and perhaps do something like the web framework shootout, but with database consistency.
Didn't really like the font on the resume, found it a bit boring and became uninterested very quickly
Be careful if you use the GitHub "Web Flow" (edit button on files on GitHub) and this Extension. Saw one commit where someone was editing a readme to make some small correction. Well, the extension went ahead and replaced all the instances of "the cloud" with "my butt" along side his changes.

He didn't notice, and it was amazing.
Great post! Gonna give this type of email a try!
So, can one submit a FOIA request for all Obama, Clapper, Alexander emails older than 180 days?
Right, but does that mean I'll have to write the boxed and unboxed representation? If not, how do you distinguish between boxed and not?

edit: And yes, I see it says they will be auto generated. It is the "how to distinguish" question that is non-obvious to me.
The risk is exactly that you can't tell it was hacked. Then the manufacturer might end up being liable.
Trials and Tribulations of the New Uncover
All OpenBSD developers work on -current and commonly on multiple platforms. Snapshots are rolled continuously for most platforms and made available to anyone who wants to run the latest code without having to build it themselves. The entire ports tree is compiled regularly on -current too. The compiled packages are then made available.

Check out the 'snapshots' folder of any mirror. More info here: http://www.openbsd.org/ftp.html
Hello danvayn,

Can you please email your information to careers@threadmeup.com

Thank you.
>No one went to jail for the Wall Street fiasco.

Minor correction: One person did to go jail[1].

[1]http://www.propublica.org/article/the-rise-of-corporate-impu...
They aren't. They wouldn't even be controversial at the EFF.

The controversy stems from cost/benefit judgements on individual spy programs AND from the fact that Clapper perjured himself in front of congress and the american people. The latter is a far more clearcut issue than the former, and it's what we were talking about before the lawyer came in and changed the subject.
Watch the Earth From Space with ISS's New High Definition Earth Viewer
Sure, but it's a tradeoff. The Preston-Werners have made legally threatening noises. Julie Ann Horvath's public comments have made an impressive difference in the court of public opinion, but if she gets sued in the court of actual court, they provide a lot of attack surface to a plaintiff's attorney.

I think it's great when people speak up about bad conditions: it's a big way that exploitative and oppressive behavior gets remedied. It seemed like Horvath knew the risks she was running, and I admire her bravery. But I wouldn't want people speaking up to be heedless about the risk they're taking.
So more reason to go to the bottom of this.
Personal experience tells me that carrying a firearm means that you are far more likely to attempt to avoid even relatively minor confrontation.
Actually a generic addon that let you swap any 2 parses.

Because I really want something that replaces, "Full Stack Engineer" with "Knows python AND java-script". Because every time I hear that parse I cringe, 75% of the Linux Stack is C, how is a full stack engineer skating by without knowing it?!
I agree the entanglement is a good thing, but our dependence
on them might have been contributory to their boldness on
Ukraine, deterrence is still needed.
Cooperation and interdependence prevents these events.
Chicago, Remote | Full Time

Stack: Ruby on Rails, Ruby, MVC, rspec, HTML, CSS, Node.js

Resume: https://www.dropbox.com/s/betp1wkg2g4ezg4/RichardHamiltonRes...

Contact: richardgregoryhamilton@gmail.com
Good point, the text has been updated.
Oh, I miss understood and thought this was just about the memory layout problem. Oops. :)
You could probably use a combination of Github (since you can see all the source, hopefully with comments) and Stackoverflow for any questions you would have.
NYT Recreates Wacky Deposition Over Definition Of A Photocopier
How typography affects conversions.
Location: South Africa, Remote, Full Time | Contract | Part-time

Stack: Ruby, ROR, Python, Django, Flask, HTML, CSS, Redis, MongoDB, PosgreSQL, Oracle, JS

Work:

http://www.codiez.co.za

http://github.com/ismaild

Contact: myHNuser @ codiez domain

Looking for interesting challenges, companies that value quality. I have previous startup experience and have done everything from product development, lean startup, marketing to dev, and knocking on doors.
Yes, but it's easier to teach admins to never use "PermitRootLogin yes" "because it's bad for security" than to teach them to never use weak passwords.
Amsterdam (The Netherlands) · Local | Remote · Contract | Freelance

Stack: JavaScript (Node.js/Express, AngularJS, BackboneJS), Perl (Dancer), Python (Flask), Ruby (Sinatra)

Resume: http://about.peterdevos.com

Contact: peter at sitecorporation.com

Looking for remote contract or freelance work, to build your MVP or build something big with a small distributed team. As product owner or tech lead I can bring your idea to market. Full-stack dev, 20 years experience, always eager to learn.
Deepface, Google X, and the Militarization of Consumer Technology
> How does the other process inspect the memory at the right time?

There must be some side effect of the optimisation, otherwise there wouldn't be a problem. Detect that side effect (e.g. write a buffer of memory to disk, check timing of some code, ptrace-attach to the other process and inspect it, trigger a core dump and pick over the bones, code up an exploit which would work if the explicit_bzero() wasn't present)

> How do you know all the scenarios where some compiler would optimize things out?

You only really need to know one case where the compiler will, if the prevent-optimisation compiler magic isn't sprinkled on it.

> Tests might not hurt, but I am not sure trying to cater for braindead porters is a good idea. They might get the idea they're doing it right once they get the tests to pass one way or another...

At least they'd get an idea that something was up. I guess you might get away with:

#ifndef OPENBSD
#error "You can't just call bcopy() for explicit_bcopy() - see http://good-description-here why not"
#endif
That's right look for Programming languages polls here in HN and you'll find a lot of C sharpers
Are athletes really getting faster, better, stronger – or is technology at play?
I beg to differ, not that Go doesn't have its place, but I think they can't even be compared.
You should check your history. The US kept the Philippines until they revolted hard enough to stick. It keeps Puerto Rico to this day.
Oklahoma City, Remote or OKC, Full Time

Stack: JavaScript, Node.js, PHP, HTML, CSS (SASS|LESS), Database (MySQL\Maria), Deployment (Git|Nginx|Apache), Design (Illustrator|Photoshop)

Resume: http://snelling.io/resume

Contact: sam@snelling.io

Looking for:
- A cross-functional position where I can help a business in several different areas.
- A scrappy company looking to try new ideas, technologies and services.

Me - Somewhat full stack. Love ML, NLP, and big(ger) data. Love connecting the dots between data. Self taught, willing (and still hungry) to learn new technologies.
Bret Victor: References
Or D.
A Vision of the Future From Those Likely to Invent It
This is just a link to the search box that's at the bottom of every page - does this really deserve a submission?

Really?
Is your SaaS business a Flytrap or a Lion?
So normally, I agree that there is a difference between projects in the same language.

However, http.sys is kernel mode in windows, and should have advantages that other programs don't have.
I'll say it again:

If java was brainf&%k and we still got the JVM out of it, it would all be worth it. And I think there's a good chance that Java's successor runs on it.
Nice article, although I was expecting something a bit more quantitative than qualitative
Thanks for the clarification.

On my system, especially considering the EOL of XP,
the main issue is just backing up a 'boot partition',
that is, a hard disk partition that is bootable, that
has the usual XP directory tree, and that otherwise has
as little as possible. For everything other than
a boot partition, I have a workable system based on
WinZip and DVDs. A 3TB external hard disk with some
suitable software, maybe just XCOPY, would be better.

Since I have two XP bootable partitions, I could boot one
of the two and get a backup of the other, bit for bit,
if I could find or write a utility such as the one you
mentioned for Unix.

But, then, much of this backup interest is recovering
after a hard drive failure, and if I replace a hard
drive then the new one will no doubt have to be larger
than the old one in which case I wonder if the bit for bit, or record for record, copy I have would boot if copied to the new drive.

That NTBACKUP will backup a live system is convenient but not essential. What is important about NTBACKUP for me
is that, finally, I got it to work, all the way, from
backup to restore.

I also have a copy of Acronis which likely I should
unwrap, study, work with, and use.
The legitimate response in such a situation is to officially dodge the question. It doesn't even have to be public since they're given the questions in advance and have veto power. But Clapper went before Congress explicitly allowing them to ask him about this program and knowingly lied about it.

What's unfortunate is that it's not controversial. It seems Clapper has the backing of a pretty big group in Congress.
SoCal, Flexible, Full Time / Contract / Part Time

Stack: C/C++, Python, VST, Pure Data, Max/MSP.

Resume: https://www.dropbox.com/s/dry2ld5pds8lmcy/greg-surges-cv.pdf

Contact: surgesg (gmail)

Looking for work as an audio programmer. Skilled in music, audio, and DSP programming.
I learned about this study through Daniel Solis's blog[1]. He's a game designer.

His article discusses the fact that American and European boardgames reflect the cultural differences they were designed in. If you know the terms "Ameritrash" and "Euro game" you know what I'm talking about.

As a board game hobbyist, I'm glad that people are looking at and talking about this research. I'm curious to see if there's a brave soul who can design an awesome, fun game that provides players with a distinctly different set of difficult choices that's neither Euro nor Ameritrash.

[1] http://danielsolisblog.blogspot.ca/2014/04/game-design-outsi...
Minneapolis, wishing to move to San Francisco, Remote or Relocation, Full Time

Stack: Ruby/Rails, Ember.js, Docker, PostgreSQL

Resume: https://docs.google.com/document/d/1eId4toQ3xVwyQF7zhV8awtQr...

Contact: jake.m.mays [at] gmail.com

Currently I'm in Minneapolis looking to get over to San Francisco- but what I'm looking for most is interesting work. I'm looking for the kind of work I can throw myself into. I love what I do, and I love learning even more, so talk to me that's more than just a 9-5 to collect a paycheck.
how does that work??

edit: just found http://www.getchef.com/solutions/windows/
That'll help.
Eich's public behavior was absolutely material to his work. You can't work to break apart gay families and undermine gay people's constitutional rights and then expect gay people to be be perfectly comfortable working for you. And Mozilla's board reasonably felt that material to him being the CEO of a company. Well, that or his demonstrated inability to handle a corporate crisis with a big press element.
Let me add a few others:

1) Every nation should protect their citizens against intelligence gathering from outsiders. 2) Intelligence-gathering must be subject of the rule of law. 3) Military forces must be under democratic control.

Surely, neither of those are controversial either?
maybe he is using youtube as a hardrive backup.
Hey guys, this is a great thread but if you find yourself looking for work or freelancers more then at the beginning of the month, I started a newsletter / community called Workshop where you can receive all the best leads each day or reach out to hundreds of freelancers almost instantly. Check it out: http://letsworkshop.com I send out the good stuff from this thread each month too :)
I am a man and I write code
OpenBSD ASLR versus Linux ASLR
I don't think Go is a replacement for Java.