skysight-inc/HackerNews huggingface dataset:
Some interesting discussion on the TIPM, complete with pictures, is here:
http://www.jeepforum.com/forum/f96/oem-tipm-study-1200238/

I wonder how much Chrysler saved by putting so much functionality into one "god object", compared to what it costs them to replace all the failing ones. Also would like to know the exact causes of these failures; the thread linked above suggests bad solid-state relays, which would probably fail regardless of whether they were all put into one TIPM or scattered in separate modules throughout the vehicle.

Edit: in that thread someone experienced the wiper switch behaving like an inverted ignition switch, and another user had a fire related to headlight wiring that apparently is not fused(!) on these models.
> sigh another angry gamer with no patience for theory.

What meaning of the word theory do you use here?
Why the assumption that if it works it must violate a conservation law? That's the last thing I would suggest after exhausting every other possibility, even weird ones like space time distortion thst would still operate within known conservation laws.
Daniel Kahneman's and Gary Klein's (two of the experts usually seen on opposing sides of the conversation) article "A Failure to Disagree" is worth a read [1]:

"This article reports on an effort to explore the differences
between two approaches to intuition and expertise that are
often viewed as conflicting: heuristics and biases (HB) and
naturalistic decision making (NDM). Starting from the
obvious fact that professional intuition is sometimes marvelous
and sometimes flawed, the authors attempt to map
the boundary conditions that separate true intuitive skill
from overconfident and biased impressions. They conclude
that evaluating the likely quality of an intuitive judgment
requires an assessment of the predictability of the environment
in which the judgment is made and of the individual’s
opportunity to learn the regularities of that environment.
Subjective experience is not a reliable indicator of judgment
accuracy."

They agree on almost every point, they disagree on the usefulness of checklists on low-validity environments and on "whether there’s more to be gained by listening to intuitions or by stifling them until you have a chance to get all the information." [2]

[1] 2009, Conditions for intuitive expertise: a failure to disagree., Kahneman, Klein. http://www.fiddlemath.net/stuff/conditions-for-intuitive-exp...
[2] Strategic decisions: When can you trust your gut? http://www.mckinsey.com/insights/strategy/strategic_decision...
just throwing in my experience here. I've seen a few sites that actually had the password reset request send them a url that was formatted as:

example.com/password_reset?username=<username>

You could basically type that in and replace <username> with any username you wished and reset their password.

The sad part was how obscenely long it took them to close those holes (couple of weeks).
In this case different tests have occurred at different power levels. Has anyone normalized the results? Of course with only a couple replications its early for a meta study.
Seriously, it isn't that expensive to get a shot on a possibly blowing up test rocket that is going into orbit, launch something and fly it out to mars and back. We'll believe you then.
No not really. It highlights how incompetent Valve is at security.

If you cannot trust the webserver or whatever is being served to you, JS crypto isn't going to do anything. They could just send you a login script that sends your unencrypted password elsewhere.
SV's biggest lie is that you need to be in SV and you need SV money to build a successful company.

I don't think anyone in the valley is saying that. I think what they actually do say is that if you want to build a $BN company, the best place to do that is in the valley - which I think is probably true.

Look. Something like 80% of the world's Venture Capital money is in the valley. It has the highest number of exits and the most concentrated group of developers. So if you want to maximize your chances of massive success that's where you go.

Just like if you want to be an actor, you go to LA, or if you want to be an Ibanker you go to NY.
Whoah, that's frightening.
You generally don't know if you've reached a suitable maxima, which is why it is good to run a nondeterministic optimizer a few times (if computation power allows) and see if there are any reliable parameters form there.

There are also somewhat better-than-random strategies such as Bayesian optimization and particle swarm optimization that can help you to search more efficiently.
> multi-billion dollar company

checked with what? Valve is not a public company nobody actually knows how MUCH they earn. you can only estimate it.

> not some small-scale startup

They are very small scale in terms of employees numbers. Check your facts.

> They could easily build out a quality support infrastructure but choose not to.

For that statement, I agree with you.
Another way around the rewrite is to simply proxy_pass with the $uri: https://gist.github.com/sansmischevia/cf425d5ffe09f824cb27
That's true. In my observation it tends to be that their tracing alerts employees to a problem, which they then proactively fix without the end user having to contact support. When it requires human intervention and isn't caught by their own systems, it's another matter entirely.

I'm pretty sure I was hit by a bug during the recent sales event and submitted a ticket, but to this day never heard back. Their human-based support is Google-level bad.
Mankind's natural resting state is peace, not violence. The extreme majority of all humans throughout history have been peaceful, not violent 'savages.' Violence by any given individual person against another is the extreme outlier, not the common.

Historically death from war is the result of a very small percentage of the global population acting violently. It is not the result of a majority of people acting violently.

Simple proof: what percentage of the world population belonged to the side of the aggressors in WW1 or WW2?

You can apply the same premise to any historical scenario. What percentage of Cambodians were involved in the massacres committed by Pol Pot's regime? What percentage of North Koreans are involved in violently repressing their fellow North Koreans? The general answer is obvious: most North Koreans are peaceful, most Cambodians were peaceful, rather than savages.

Yes, the world is getting drastically better.

Living standards are much higher and continue to climb. Child / infant mortality is drastically lower. Our ability to treat, cure, or wipe out diseases is far beyond anything from 50 years ago. Large scale starvation is becoming extremely rare.

War between leading nations hasn't occurred in 70 years, a record likely unmatched in recorded history.
Yep, that's what I think you should do.
And you are correct. Bug fixes from Valve are few and far inbetween with many bugs being unpatched for years.

https://github.com/ValveSoftware/Source-1-Games/issues/assig...
It can be defeated. In fact multiple incomplete ASLR implementations were and are defeated everyday. Even the grsec's implementation has been defeated under certain conditions i believe.

They just limit attacker's possibilities of getting what he wants. There is no absolute security. Maybe in some kernels like sel4 but they are so small compared to something like linux that it's incomparable.
Here's Pike's implementation:https://github.com/robpike/filter
The single biggest mistake I made when I was an independent software developer was making my flagship product available for free.

Of course when I first released the application I had no idea it would become a significant part of many people's lives and would come to occupy all of mine. I also had a job at the time, and like you I felt conflicted about charging for my work.

The application was Journler, an information management application for the Mac desktop circa 2006-2010, and I eked out a living on a "donationware" model for some time.

Eventually the scope of the project became so large that I needed extra help, but I didn't have the income to hire help. I needed to start charging to be able to hire help, but in order to release a new version of the software with a paid model while continuing to manage customer support, I needed to hire help. I fell into a vicious circle, and the project collapsed. I open sourced it, apologized to the user community, and moved on to contract work.

You cannot anticipate what will happen with the software projects you release into the wild. But as developers often underestimate how long it takes to complete a project, I'd speculate we also underestimate how much of ourselves we'll have to commit to a project that becomes even modestly successful.

Charge from the beginning and put yourself into a position where you can hire help if it should come to that.
Yep. Try this one: https://www.google.com/search?q=intitle:%22Index+of+%2F.git%...
Plenty of places with deeply hierarchical systems have had major security bugs.
What was your title in the company before today?
I agree with brudgers' response. There doesn't seem to be anything to gain from changing it right now.
This is the broad academic use of the word. Specifically Sarkeesian builds upon feminist film theory.
You could be liable when disclosing bugs responsibly too, as some researchers have learned when investigating voting machine security.
There are no proper limits. If someone doesn't like a speech, they can just down-mod it. Eventually an algorithm will cull the speech if some obscure amount of down-mods occur.

Those who wish to censor, can on HN discussions.
The revenge of former employees can close the business
That's got to be the first one I've ever heard of that can do that. I don't imagine it'll make much difference in most cooking but for things like softening butter that you only do for 10-15 seconds I could see it making a big difference.
Why isn't it okay to start a company and just want to build it consistently and be profitable from the start?

It is "ok" and done all the time, all over the world. It's just not exciting or newsworthy. Just look at dry cleaners - they are everywhere, and usually family owned small businesses that do well enough to put kids through college. In some cases they are even using exciting new technologies to make the process more efficient. It's not exciting though Maybe you don't need that, which is also ok, but there is no sense in vilifying that.

The people doing startups are self selecting as people who want to be involved in something that impacts a lot of people, very quickly. The Valley is full of people who want to do moonshot exciting stuff - even if it doesn't seem exciting to a lot of people outside of it.
So... the point of this article is?

I see the long winding whinging about how a white cis male is being persecuted and is trying to gain sympathy, or something. OK, so you had threatening comments supposedly aimed at you at one point. You hid from it, you didn't challenge it - and you are complaining that women, who get that shit EVERY DAY, are challenging it. This is one of your arguments? You are seriously trying to convince me that these women who have literally risked their life to speak out against the violence and persecution they face are some how doing something wrong? Good god man...

The ONLY point of value in this entire rant that I can see is the comment about the damage to the industry reputation for recruiting women. Is this valid? Is there evidence? I don't care who this guy is or if he stays anonymous (manufactured drama...), data backs arguments up. Until there is data, this is a pointless, emotional dump based on nothing but hatred and hurt.
With ads or just paid apps? Any idea how to sell apps from unsupported countries? Thanks.
Again: the issue is not Grexit and return of the drachma. That's a realistic, if incredibly painful, option. The issue is doing it abruptly, by fiat, at the behest of a faction of Syriza.

If they had gone ahead with this plan, Syriza would be isolated from everyone --- the Greek people, who would instantly lose the majority of their assets in the euro/drachma haircut, and every lender in the world that might help soften the landing.

That's why the Left Platform leadership had to talk about arresting their own central banker. They'd have been executing a financial coup and rewriting the rules of their economy without consultation with anyone else inside Greece. They'd have been deciding by themselves not just to exit the Eurozone, but to do so abruptly and without the cooperation or assistance of the ECB.

This isn't just about Greece severing ties with the Eurozone; it's about how they would have done it.

Edit

Here's a Greek expat trying to lay out what an orderly transition from Eurozone membership to a drachma economy would look like:

http://pavlos.geekhost.org/2015/07/05/what-grexit-looks-like...
OK, you meant the bullshit use of the word, I didn't miss out on anything. Bullshit is a technical term here.

As opposed to the notion of a theory used as something to predict phenomena. Especially prediction we can check, and falsify.
See appendix A.
Validating email addresses is non-trivial too.
Relability: When it comes to Jeeps their super reliable phase was pretty much pre-2007. Mechanical was reliable because it was all old proven technology.(Thus, very outdated too.) Electrical was very good 1997 through around 2004. AMC based electrical before 1997 was just okay. The AMC electrical had numerous fundamental design issues with the wiring harnesses that made them prone to killing systems if a ground wire was disrupted.

The Gas Tank Thing: The Cherokee (XJ) was designed in the 1980's and the Grand Cherokee (ZJ/WJ) was based on the Cherokee (XJ) even though it debuted in 1993. Locating the gas tank behind the axle in the rear was fairly standard back then. I really can not blame Chrysler when they get defensive about it since that was how vehicles were being built in that time period. They had even switched to double walled plastic tanks by early 1990's which are much less prone to being ruptured. Adding a tow hitch can help, but only other practical solution is to toss on a skid plate.

Even the Wrangler had behind the axle mounted gas tanks through 2006. Both the Wrangler (TJ) and Cherokee (XJ) are not part of the gas tank recall even though they both could be similarly affected.
I store dummy values in VC, then edit the real data on the production server. (And I obviously never check anything in from production, if you can set the production VC user to read only.) This has a nice side effect that if I edit the configuration file the new stuff gets merged in without causing a mess.

Another way is a second file that overrides settings as needed. Although I have found that to be less maintainable if the configuration file changes. That file should be somewhere entirely out of the VC tree.

Either way, the file must be placed in a directory that is not served by the web server.

/include

and

/public

are traditional. Only /public is exposed by the web server.
It highlights how incompetent Valve is at security.

Adding one feature shows they are incompetent at security? Great real.

Without more information about the scheme there's nothing to know. Whether useful or not it is still neat and can be used for benefit, but not for something TLS like.
Why are people serving web traffic to a folder with a .git folder anyways? I thought it was basic deployment practice to export your code OUT of the VCS before deploying... every shop I've worked at had this in place.

Other solutions just seem hackish to me, but every project is different I suppose.
Cloudbric: Candy, Vitamin, Painkiller, or Vaccine?
I worked on a big name project that had this same problem, which we found because users had begun exploiting it. The problem was caused when a user would intentionally prevent the recovery_code from submitting with the rest of the form, which resulted in recovery_code being nil, which resulted in "SELECT something FROM users WHERE recovery_code IS NULL AND email = targeted_email" hitting the database. This wouldn't work if you'd requested a password reset code and not yet used it, but everyone else was vulnerable. Sounds like something similar happened here.

EDIT: Updated explanation of problem because I originally explained it wrong (required omission of the value on submission, not just a blank value).
I have been writing ToDoList (http://www.codeproject.com/Articles/5371/ToDoList-An-effecti...) as freeware for nearly 12 years and never regretted a minute. I have a day job and write ToDoList purely for fun/joy. A Thriving community has grown up around it, it has provoked a number of people to develop related tools and has kept the passion alive when my day job (also programming) sometimes sucked.
If you have to validate, you're doing something wrong (but this is a something wrong people do sometimes do). You should send email only to the string you saved in the database record for the user.
I had the same interpretation.

I noted that he still (understandably) doesn't forgive the Japanese, but that could be entirely separate from the decision to use atomic weapons against civilians.
I'm angry! Brggh! Controversy!
HN should have killed this post immediately, right? It's a serious threat to many people's mental well being!

What a misogynistic website. There's, like, 15 people among the thousands that view this website which up-voted this article. HN should probably just remove itself from the internet now. People might see these opinions!

it unfortunately may be necessary to confirm this is sarcasm

EDIT: well it's killed now, no more comments, can't even click the original link... will I risk the heresy of linking to the un-allowable text here? why not: https://stateofthegaming.wordpress.com/2015/07/26/the-oppres...
Snapchat. Thought it was a pretty dumb idea till recently. I'm now an active user. To be fair though, I still think the messaging feature of it is fun only as the occasional gimmick. The value tapers off as soon as you pass a certain age (at least that's what I feel). But when they introduced stories, and "live stories" in particular, their value just skyrocketed. It suddenly became genius. Being able to follow a full day of Red Bull's highlights, experiencing a country or city from multiple viewpoints in the span of a couple of minutes was amazing. Watching UFC from the front, back stage, way at the back of the ring, seeing the reactions of people in a curated-ish form that lasted 5 minutes was incredible. Snapchat suddenly became a whole lot more valuable for me.

One other idea. Yo. I don't think anyone's really using it to its potential. Apart from the "Yo" feature, the idea of it as a notification broker is fantastic. I still carry bets that it won't hit "critical mass/momentum" in its current form. Way too clunky.
Sure, that's also what I cover in the post. The latter part about rewriting is only relevant when you want to have the service behind an ELB to be located at something else than "/".
Invariably such refutations fixate on the specific examples chosen by Sarkeesian and go on to make flawed arguments like e.g. (paraphrasing):

> Violence against women in XYZ is not problem because XYZ also features violence against men!

Which is completely besides the point and ignores the societal context into which these games are released. Other common "critiques" leveled against Sarkeesian, that I've seen anyway, are straight up strawmen. These include gems like she's in favour of censorship or that she argues games have the ability to directly manipulate people into violence or sexism.

Innuendo Studios recently posted a great analysis of this phenomenon in their "Why Are You So Angry?" video series. It's really well done and worth checking out:
https://www.youtube.com/watch?v=6y8XgGhXkTQ&list=PLJA_jUddXv...

The OP reads just like an Angry Jack.
> The "Scala is slow to compile" meme needs to die in a fire.

Well said.

Additionally, I think people often forget that the same JVM tuning parameters available for production deployments are available for Scala compilations. These can make a huge difference in build times, especially since the default JVM parameters are understandably conservative.
I completely agree, every time I do a new deployment script for git, I miss the old svn export command, I hate the idea of cloning on the deployment machine, having to git sync in the script etc. Whereas 'svn export' feels stateless, and is clean by construction.
Thanks! I've made it dark when not painting.

It's also slightly transparent now.
Switching user database on a running system
There is absolutely a mess of little oversights like this in every non-trivial software project (I just fixed one not 30 minutes ago). The effects are sometimes very serious, as in this case. Cyber-warfare is scary precisely because of this. There is nothing we can do about it IMO, though things like SELinux/AppArmor and even good filesystem-level permissions help a little bit.
> This is solved by simply deleting the tokens after reset, correct?

They should also time out after a day or two and either invalidate or delete.
Montasano has been vocal in the past about denouncing client side crypto implemented in javascript [1], but I think that their use cases fail to consider a system in which the server has no need to access the decrypted user data.

I helped implement a system for Stellar that does something very similar to what this article describes [2]. User data is encrypted into blobs using a key generated from credentials. The blob is fetched from the server using a hash of those credentials. Neither the server nor a MITM have sufficient information to decrypt your blob, so the security is deferred to each user's computer.

If you want a server to be able to access your data, you must acknowledge that there is a non-zero probability that it will become public. If you want truly private data you must encrypt it locally and take the appropriate measures to keep your local system secure.

[1] https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

[2] https://www.stellar.org/blog/wallet-server-version-two-the-e...
This is called either a Local File Inclusion or a Directory Traversal Vulnerability. The name depends on the details. It's really really common, and definitely something I see a lot of.

The OWASP Top 10 is deadly.
It wasn't a YCombinator startup, was it?
The author sets up so many strawman arguments, I wonder whether he has bothered to engage with the Sarkeesian et al. in the way he's imploring journalists to engage with GamerGaters.

For example, that journalists/society make all women out to be paragons of virtue:

> I’ve seen how women can treat each other, and can put my hand on my heart and say I’ve generally seen IRL women being much nastier to other women than I’ve EVER seen a man being to a woman. Let’s not paint women as some saintly figures incapable of doing any wrong. This is the root of all our problems here.

Or when he accuses some of those same figures of wanting to keep vile comments coming:

> ...another example was a photo of them laughing at dumb trolls tweets on their phones in a bar, not an opportunity was spared to say ‘fuck you’ and rattle the bear cage to keep the abuse train running. This is not what someone who wants the abuse to stop does.
No, mainly because there is no such thing as "irresponsibly".