alinajaf

> But imagine, America coming in to NK, in the name of liberalizing the people, and causing more death, famine, and stuff in the process, which is not avoidable.

Ugh, this dichotomy of America as world police vs. cultures it doesn't really understand is juvenile at best.

The US drone strikes on Pakistani civillians are horrible, but if you want a lesson in brutality towards non-combatants, look no further than Pakistan during partition or the Bangladeshi independence war. The U.S. dropped nukes on Japan, but the atrocities carried out by the Japanese military at Nanking and Unit 731 are about the most terrible you'll read about outside of the Third Reich.

Morality, especially in terms of the actions of nations over time is complex and nuanced. Pointing out that the North Korean regime is fucking insane does not imply that you think the U.S. should roll in guns blazing.

> Organizations like RedCross, UNESCO, and others have to be pressed upon.

Pressed upon to do what exactly? Provide even more aid to the North Korean regime who will distribute it to citizens it deems fit to eat?

I applaud the sentiment here, but this belies either naivete about the complexities and long-term effects of supplying aid to developing countries (especially dictatorships) or a complete lack of knowledge about the North Korean track record.

The grim western consensus on the North Korean problem has always been to sit-tight and let the country implode and hopefully unify with the South, though whether this is likely to happen soon is anyones guess.

I'm not quite sure how that answers DLays points. Care to elaborate?

He/she was pointing out that people the children, and childrens children of people who are deemed enemies of the state are not free to live how they want.

For a minute there I thought you were talking about Kim Jong-un, but it turns out he's 28.

If only 10% of one of the accounts of the concentration camp escapees is true, then NK is in the same cluster as Syria and Congo in terms of treatment of its people.

Its reasonable to assume that the right to not have your malnourished six year old daughter beaten to death for stealing a few corn kernels is one that homo sapiens everywhere find worth fighting for.

FYI it looks like you've fixed the update controller (as per the gist), but I can still:

* See other peoples rewards (just go to /rewards/whatever-id), not that big a deal, unless you want to keep them private.

* Go to the edit form of any reward (just go to /rewards/whatever-id/edit), big-deal factor is same as above.

* Delete other peoples rewards (inspect the delete link of any reward in chrome, modify the id in the href, then click it), this is somewhat of a big deal. Sorry to whoever had reward with id 4!

PITA I know, security doesn't get easier I'm afraid :)

EDIT: updated gist to be a little more useful, though you probably worked the required code out for yourself.

Seconded! Using current_user.rewards.find(...) is a good stopgap if you're not keen on going as far as using cancan.

This won't take care of the parameter whitelisting for you though.

Hi Jason,

Great work! The website has a great feel to it and it seems like a good first project to get out in the open. Definitely looks/works a gazillion times better than my first website!

There's an issue I'd like to point out that I've seen come up over and over again with people like yourself who've taught themselves to code via treehouse, codecademy or some of the other webdev-education based startups. I've met developers with 10+ years of experience who make the same error though, so I wouldn't beat yourself up too much about it.

This may have been deliberate, but it appears as though you can view all the rewards on the site (including other users) simply by modifying the URL. It also seems like you can modify or delete any of the rewards on the site too (try changing the form action/fields using chrome web inspector and submit the form). Since this is your first rails app and I'm assuming you're not hoping it's going to hold any sensitive data, this isn't that big a deal.

Do keep in mind though that in its current state, it's trivial to create a script that deletes all the rewards on the website or worse, fills all the reward info with spam data.

For the last person I pointed this out to, I put together a gist of what the before => after of the code should look like for fixing this https://gist.github.com/Najaf/5431024 (tl&dr, you need to whitelist those params and implement authorization).

If you'd like any further help with this, feel free to ping me via email.

Best of luck!

Pertinent Bruce Schneier quote:

Anyone can invent a security system that he himself cannot break. I've said this so often that Cory Doctorow has named it "Schneier's Law": When someone hands you a security system and says, "I believe this is secure," the first thing you have to ask is, "Who the hell are you?" Show me what you've broken to demonstrate that your assertion of the system's security means something.

http://www.schneier.com/blog/archives/2011/04/schneiers_law....

> Your employer (reasonably) has an expectation that you will give them 100% during at least 9-5 hours and also be available for overtime periods on occasion.

If you're consulting you can set expectations on how much time you give to clients daily.

If I give clients a focused (no HN, twitter, coffee breaks etc, pure heads-down work) five hours of effort then they will likely be happy with the results. This gives me time to work on product, do chores, play with the baby and do whatever else is important to me.

This is obviously not feasible if you're a full time employee, where the usual expectation is that you're there in person whether you're productive or not.

Microconf was indeed a tour de force. If you're serious about making the transition to products for your primary income, go.

Probably a good a place as any to start:

http://www.matasano.com/articles/crypto-challenges/

I'd fall under your definition of 'anti-theistic' and I'm still not entirely sure what happens after death. I'm perfectly happy not knowing though.

I think you'll find that after attending one or two sessions of BJJ its not as crazy or sexually charged as you're assuming it is.

If you liked this, you will love Greg Egans Diaspora.

With kids, client work and generally having a life, I'm getting about one or two hours a week tops to work through them.

If I were working on them full time I'm confident I could get as far as I am now (mostly finished the third set) in about a week.

And fish.

Does anyone know of a good reason not to use TLS with client-side certificates (and you as the CA) for API authentication?

My pick-me-up checklist for when I'm procrastinating too much for comfort:

* Get plenty of sleep. If you're sleepy, take a nap. Go to bed early, wake up early.

* Drink plenty of water.

* Eat well, whatever that means for you (for me its cutting back on sugary things and processed foods).

* Do some exercise.

If you take care of these basics, for me at least, the rest seems to fall into place.

Have you tried having a read of The Non-designers Design Book?

While it won't make you a master designer, it will give you some basics. Notably CRAP (Contrast, Repetition, Alignment, Proximity) and the basics of colour theory and typography.

I found it to be an extremely easy read with good exercises for people like me who are somewhat aesthetically challenged.

> Not every piece of writing is a philosophical treaty

I think you might mean treatise.

The language we're talking about makes a big difference here. I have (very) occasionally been mistaken for a native Japanese speaker over the phone, but I have the reading level of a 12 year old at best.

My hope is that one day some of you guys over in SV realize what you just did and start contracting more work to us across the pond. Programming talent in the UK is cheap.

If you have a portfolio site and testimonials from past clients, £20k isn't that great. I worked with a guy at a small(ish, <100 employees) company who started at £34k with a similar background to that.

Yes, London. I was at £45k after two years, and permie salaries are in general higher now than than they were three years ago.

You're getting screwed at £15k, I've never been paid that little for developing web.

For reference, my salary history over my 6+ year career is as follows:

£20k->£26k->£45k->£450-£600/day

Note that I am a totally average developer, nowhere near as smart or knowledgable as a lot of the guys here on HN. I have a CS degree, barely (I got a 3rd), so that helped at the beginning, but most of my luck has been thanks to an extremely welcoming market.

If you have three years experience, you should be clearing £42k, if not £45k. I don't know much about speech impediments and how easy/hard they are to fix, but in this market, trust me, you can achieve £42k+ for fizzbuzz and a pulse.

EDIT: Modified figures in last paragraph on account of OP having three years of experience.

The guy is 18. Who cares?

> Talking about node.js or NoSQL or puppet or ansible or other "new technology" and be greeted by ignorance.

You'd be greeted by a great big meh from me and I make considerably more than $100/hour.

Your definition of 'basic stuff' is not inspiring. My definition would include processes and threads, I/O and networking, conversations around which also happen to often be greeted with ignorance.

+1 I'm working through these now and they're the most fun thing I've done with a computer for a long time.

2 points:

> This comment is ridiculous.

Yes. However, I would point out that eventually this productivity thing matters i.e. more productive developers will be able to effect more change in the world faster than less productive developers.

While I'm all for sharing knowledge, if my competition is putting creative effort into hobbling themselves, then I say leave them to it.

> I use vim because it's the fastest thing I've ever used by a very wide margin.

I used to think this, but then I paired with someone who was eye-wateringly fast with TextMate (that person has since converted to using vim full-time). Rather than speed, for me at least, its always been about fluency (how little cognitive load is there between thinking and the code appearing). I happen to be a lot faster than most IDE clowns I happen to be working with, but I believe that's a happy side-effect.

> but Japan also has institutionalized politeness.

Careful. They also have an institutionalized social hierarchy, baked into the language and pretty much everywhere. It's expected that when you start at a new school or a new company that you will be treated like dirt by your 'superiors' on an ongoing basis.

There's a much higher tolerance for hazing and bullying in general. This leaves me skeptical that Japanese culture fosters an environment where people are nicer to each other than anywhere else.

Foreigners tend to get a free pass by being 'out of the system', unless their Japanese(ness) passes a certain threshold of fluency.

Or you know, you could just spend a few hours learning about how a tool you're probably going to be using for over a decade works.