HNHacker News
TopNewBestAskShowJobs

5vforest

700 karma · joined November 8, 2011

submissionscomments
5vforest··on Newark cops, with reform, didn't fire a single shot in 2020
Your cited source literally says the opposite:

> While Trenton and Paterson saw spikes this year, other cities like Newark and Jersey City haven’t seen much of a change.

5vforest··on CSS mix-blend-mode is bad for your browsing history
The `href` attribute of the visible mole could pass the data back to the server.
5vforest··on Show HN: Spotbot, a Slack bot that monitors your website for visual bugs
We use Percy.io for this and can't recommend it enough. It integrates with your CI workflow, which makes a whole lot more sense to me than waiting until production. (Or to be fair, staging.)
5vforest··on “Huge” number of Mac apps vulnerable to hijacking, and a fix is elusive
Good info! I really have no clue what I'm doing. Just trying to help coworkers figure out if they need to uninstall any apps, really :)
5vforest··on “Huge” number of Mac apps vulnerable to hijacking, and a fix is elusive
Augmented it with a bit of Ruby in order to find the "SUFeedURL", which if using the `http` protocol, means that an application is vulnerable.

https://gist.github.com/ajb/876107d0edc0f2c11779

5vforest··on Ask HN: Who is hiring? (April 2015)
## The Department of Better Technology - http://www.dobt.co/ - REMOTE

Our one-sentence tagline: We are dedicated to making great software that helps governments and non-profits better serve their communities.

If you've ready some of the recent posts about US Digital Service or 18F, we're doing similar stuff, but from the outside-in, with mostly SaaS products. (Our flagship product, Screendoor: http://www.dobt.co/screendoor)

We're bootstrapped, profitable, and we'd love to find folks who are passionate about this kind of work. Stack is Rails / Postgres / JS -- nothing too fancy, but we're serious about the quality of our code. We're big on open-source, too: github.com/dobtco/

If you're interested in hearing more, email me at adam (at) dobt (dot) co

5vforest··on The No CAPTCHA problem
Half of the post is about how the new technique is vulnerable to clickjacking.
5vforest··on Ask HN: Who is hiring? (September 2014)
Ruby Developer to Fix America Department of Better Technology Headquarters: USA http://www.dobt.co

About us

We’re the Department of Better Technology, a Knight Foundation-funded startup that’s digging into the guts of government and trying to fix it with technology.

Job Details

We're hiring a web developer to help us revolutionize the world of government IT. We started this company after being embedded inside government and seeing first-hand the horrors of the technology that these folks have to use everyday. We worked on a project called RFP-EZ that made it super simple to view and bid on government contracts. It wasn't anything amazing -- just a simple Bootstrap site, but just by making this process easier to understand for web firms who don't specialize in government contracting, we were able to save the federal government an average of 30%.

We've been in business for a just under a year, and have already created dozens of success stories - governments who are using our software to save staff time, save money, and provide better experiences for citizens. We're looking to grow our team and help us scale this success to governments across the country.

Experience

We're looking to bring on a developer who fits the following:

You are experienced in Ruby and ideally, Rails You have strong knowledge of SQL/Postgres You have a passion for good user experience and are excited about frontend development, too You are comfortable working with a 100% distributed team And last, but perhaps most important, you are as passionate as we are about our mission to revolutionize government IT

Our Culture

For many people in the technology industry, DOBT is a different kind of place to work, and a different set of people work here. Usually, they’re people who value time more than they value money. While from time to time, circumstances may call for it, you aren’t going to see a lot of 80 hour weeks, and depending on your time zone you might see some people who clock out at around 6.

You’re probably not going to be in a work environment that has a foosball table, catered lunches, and its own mass transportation either. That’s because we’re a fully remote firm. While some people may opt to work together in the same space, we want people to work from wherever they feel like it. So if you’ve always wanted to live in Japan, now’s your chance.

Diversity

DOBT is an equal opportunity employer. We will not discriminate and will take measures to ensure against discrimination in employment, recruitment, advertisements for employment, compensation, termination, upgrading, promotions, and other conditions of employment against any employee or job applicant on the bases of race, creed, color, national origin, or sex. We are committed in all areas to providing a work environment that is free from harassment.

How to apply

Fill out the form on Screendoor: https://screendoor.dobt.co/dobt/developer-hiring/ (yay for dogfooding!) Alternatively, send a note to sdp-response-hclhimz1@in.dobt.co. USA/Canada only, sorry. Recruiters and agencies will be marked as spam.

5vforest··on Testing at Airbnb
Wow. I'm surprised at how big they were able to scale, while still pushing most commits directly to master and having a test suite that took 1hr to run.
5vforest··on GoDaddy ends support for Ruby as of 23/01/2014
> Rails version 1.1.6 is supported in the default directory

So yes, I doubt anyone is still using GoDaddy for Rails hosting.

5vforest··on Ask HN: Where are the interesting jobs?
We're trying to make sure that Healthcare.gov never happens again.

dobt.co

5vforest··on Passenger date header was incorrectly formatted as week-based year
> Passenger sometimes gets the date wrong when appending the http Date header to responses. This happens when the week-based year differs from the calendar year. It happens because it uses %G to print the year when it should be using %Y (see this commit: 15ed1d4).

Took me a few hours to track this down -- and it's probably affecting a large majority of the Rails apps that are using a Passenger server.

Hopefully getting the word out can save some folks a few hours of banging their heads on their desks.

5vforest··on My Favorite jQuery Plugin Template
Neat. I also like this one (Coffeescript): https://gist.github.com/rjz/3610858
5vforest··on Inside Nick Denton's phony, hypocritical class war against tech workers
Valleywag is the TMZ of Silicon Valley. Remind yourself of that when reading it, and you'll be fine.
5vforest··on What I have learned running a software consultancy over the past two years
On one hand: it's cool to read something so "unfiltered".

On the other, If I was a potential client of Dockyard's and saw this, I would run for the hills. This is not the kind of stuff that belongs on a company blog. Or any blog, for that matter.

5vforest··on The Silicon Valley-ization of San Francisco
Wow, right as I clicked reply to say "kudos for admitting this", the original post was deleted. What's up?
5vforest··on Server-generated JavaScript responses
sync is amazing. just wanted to say thank you :)
5vforest··on RJS leaking vulnerability in multiple Rails applications
Seems to me like this solution, or checking for `request.xhr?` are the best suggestions so far.
5vforest··on RJS leaking vulnerability in multiple Rails applications
You're right, will update now.
5vforest··on RJS leaking vulnerability in multiple Rails applications
Here's a quick summary:

There's a Rails design pattern where you send an AJAX request to your controller, and it returns a bunch of Javascript that gets eval'd by the page you're on. This is used for say, infinite scroll. You'll click the 'load more' button, the server will render a partial containing your new records, and return something like:

    $('#itemsList').append('<li>My new item</li><li>another new item</li>')
So guess what? This is susceptible to XSS-ish attacks.

Let's imagine that instead of a simple list item, this request was returning some sensitive information or a CSRF token. (Egor points to various examples of this.) Normally, executing a GET request from an unauthorized domain will not be allowed because of CORS. This is what prevents me from instructing the users of my website to make an AJAX request to gmail.com, allowing me to see all of their emails.

But "wait", you say, "the content type of this request is application/javascript."

So open developer tools and type this: (using jQuery for conciseness)

    $.ajax({
      url: 'https://basecamp.com/[BASECAMP_PROJECT_ID]/progress.js', 
      dataType: 'jsonp'
    })
And boom, you have a bunch of sensitive information about your Basecamp project, accessible via JSONP request from any domain.
5vforest··on 'git commit' your favorite coffee place to work in
I kinda like http://jlord.github.io/hack-spots/ more. (Although I'm biased based on geographical location.)

Powered by a Google Spreadsheet, so instead of `git commit`, it's "Add a row to this public spreadsheet!"

5vforest··on Rails 3.2 Performance: Another Step Slower
For what it's worth, apparently the Basecamp team was hitting ~50ms request times with their new (well, now it's not that new) design: http://37signals.com/svn/posts/3112-how-basecamp-next-got-to...

All technology has its trade-offs. Rails can be plenty fast, it just all depends on how you're using it.

5vforest··on Show HN: Watson – inline issue manager with GitHub support
Agree with the general preface of not interrupting your flow with issue tracking. I've been using ghi (command line GitHub Issues)[1] and couldn't be happier.

[1] https://github.com/stephencelis/ghi

5vforest··on Show HN: A gem to stop progressively building ActiveRecord queries
Ah, that's neat. I usually just build these forms without the Rails helpers, using something like:

    <form>
      <input type='text' name='email' value='<%= params[:email] %>' />
    </form>
Which works out nicely, since the method defaults to 'GET' and the action defaults to the current path.
5vforest··on Show HN: A gem to stop progressively building ActiveRecord queries
Author here. Probably a matter of preference, to be honest. has_scope never really made much sense to me.

If we're checking boxes, two features that Filterer has and has_scope doesn't are:

- results ordering

- pagination (although most folks will already be using kaminari or will_paginate)

5vforest··on The Coach Who Never Punts
Related: the basketball coach who always did a full-court press: http://www.newyorker.com/reporting/2009/05/11/090511fa_fact_...
5vforest··on Show HN: Take Control of Mac OS X Notifications with Hush
I'm cringing right now, because it seems like the authors weren't aware that this feature is already part of OS X.

http://cl.ly/image/1u0S0H330v1D

5vforest··on OS X: About Mail Update for Mavericks
upvoted, because until I read your comment I was wondering "WHAT THE GOD DAMN HELL IS GOING ON WITH MY COMPUTER?!"
5vforest··on Healthcare.gov failed despite agile practices
Seems like as good of a time as any to bring up Zed Shaw's "Programming, Motherfucker": http://programming-motherfucker.com/

  We are a community of motherfucking programmers who have been humiliated by software development methodologies for years.

  We are tired of XP, Scrum, Kanban, Waterfall, Software Craftsmanship (aka XP-Lite) and anything else getting in the way of...Programming, Motherfucker.

  We are tired of being told we're autistic idiots who need to be manipulated to work in a Forced Pair Programming chain gang without any time to be creative because none of the 10 managers on the project can do... Programming, Motherfucker.

  We must destroy these methodologies that get in the way of...Programming, Motherfucker.
5vforest··on Twitter Bootstrap or Zurb Foundation for RailsApps?
Bootstrap 3 introduces some pretty weird markup IMO. Foundation is a bit better, but I'm going to suggest something unpopular, which is to use a lighter-weight framework like http://purecss.io/ or http://cardinalcss.com/ instead.
Page 1 of 4Next →