michh

I don't think using Python is significantly more ridiculous than the current practice of either using shell scripts or your own C code to parse form-data and generate HTML. In fact, it's probably a lot less ridiculous.

I wonder if 3 vulnerabilities in 3 days means this device has exceptionally bad firmware compared to other similar devices or is just suddenly getting a lot of attention from skilled hackers.

Guessing by how frail software on these types of devices (routers, access points, home automation stuff, DSL modems, cable boxes, consumer NAS enclosures, etc etc) often feels, I fear it's the latter.

Because you're used to it from years of using Linux? Or have software from other unix-like platforms which expects a case-sensitive filesystem?

A good example would be MySQL. The case sensitivity of table names is determined by the file system on which MySQL is running.

It's terrible, I know, but if you're developing a webapp which is going to run on a Linux-server you might want to have a case sensitive database locally as well or you could end up with queries that run without a hitch on your dev machine but give a "No such table" error in production. That sucks.

Of course, nowadays, you could just use a Vagrant VM or something similar, but still.

With Google you're lucky to get any reaction at all. Security issues are one of the few things where you can actually still get a response from a human being.

My guess would be driving around with a relatively short-range jammer actually increases the odds of being hit by a distracted driver. Rather than people driving near you being distracted by conversations on their phones, they're going to be even more distracted because their call just got dropped, prompting them to look at the display waiting for the bars to come back so they can re-dial.

For the average article in a newspaper: yes. But that includes a lot of the stuff already out there for free. It'd be silly to pay even a cent for a copy-pasted press release or a 100-word article reporting on how firemen rescued a kitty from a tree the other day.

For stuff like in-depth analysis and backgrounds, imo the only area in which newspapers still add value nowadays, I think $0.10 is perfectly reasonable.

I especially hate having to be so defensive.

E.g. in phrasing my question, specifically having to mention a whole bunch of things that obviously aren't the problem but people are going to insist on anyway unless I've already mentioned them myself.

Or the whole "Well, you shouldn't be doing this in the first place so I'm not going to help you with your actual problem".

It can be incredibly helpful to point this out. But often I'm doing things in a certain way for a reason (constraints that aren't relevant for the question, like "yeah but our entire codebase").

So when I say I'm doing it this way for a reason and looking for a way to make it work, either trust my judgment or decide I don't deserve to be helped and stop commenting. But it often ends up being a massive distracting derail preventing others from trying to answer the question I was actually asking in the first place. Most annoyingly, this behaviour is often rewarded with upvotes.

For example:

> "I can't connect to my database due to error 110, I have no idea what that means"

"Why aren't you using an ORM?"

> "I have good reason not to, besides, I'm just looking to fix error 110 now"

"But a good ORM handles these types of errors for you, it'd be stupid not to use it"

> "You're probably right, but that'd require a lot of rewriting and refactoring and that's simply not an option right now"

"Ok, get back to me when you're actually using an ORM and still having trouble with your database"

when all I'm looking for is "That's a connection timeout, tried checking your firewall configuration?"

What's the legal side of this?

I can imagine tunnelling your traffic through DNS to avoid a captive portal (i.e. actually paying for it) counts as circumventing a security measure, which is illegal in a lot of places including the country where I live in.

Add a yellow light for when there are stalls available but all free stalls have recently been used for more than 2 minutes.

So basically, yellow would mean "You could, but unless you really need to, you probably don't want to" ;)

Yeah, disappointing. It's just a "list of things I hate and you'll just have to trust me I have good reason to". It's a bit childish, actually.

Some of the things have links to rants explaining why they apparently suck, but that's just more adolescent ranting mixed with quotes.

I like a good rant occasionally, but those are well-written, make a point worth making and actually show some effort to convince the reader. This is just not it.

Sadly, I couldn't right now but I bet there's someone out there that'd be willing to give it a go. Maybe an "Ask HN"-post?

I'm guessing there might be someone willing to take over the project for free (if he's abandoning it anyway) and invest the time in actually getting the word out and improving it? Who knows.

Ask for a small percentage of profits or something. The author can't lose more than he already is by completely abandoning it and letting the domain expire. If only because when someone else is keeping it running, he could still use it himself.

Exactly. Except they could have used Springloader or something as a shorthand for it (rather than Spring) and it wouldn't have been as much of an issue.

It reminds me of when Wordpress gave one of their milestone releases the code-name Django. They actually changed it to "Rheinhardt" after the initial release because of the confusion it was causing.

In this case it's even worse. Giving a component of a web framework the same name as a different, in a sense competing, framework is just plain silly.

Something that compiles to C? Or can compile to C at a slight performance penalty for unsupported platforms?

An Ubuntu update would be nice right about now. Outside of disabling everything that uses openssl or compiling a new one manually, there's not much I can do to secure my servers at this moment. Meanwhile, I'm guessing a lot of not so nice people are racing to scan IP ranges for this bug.

That's going to come in useful, bookmarked, thanks!

AFAIK it's a legacy thing. SOCKS4 didn't support it, SOCKS5 did but using that functionality changes behaviour depending on which SOCKS version the remote end happens to use.

> Every commit has a single parent, making a previous button trivial.

Until, of course, you hit a merge commit. Which most projects have a lot of regardless of whether that's a good thing. I suppose you could always pick the parent which is on the same branch, but still.

That's the whole point: they seem to be using deep packet inspection to mess with all DNS traffic regardless of the DNS server being used.

Previous/Next is a bit complicated if one of the key features of the versioning system you're using is that it's a graph.

Of course, that graph could easily be flattened (e.g. simply sort by date) but that'd cause you to jump all over the graph. It would make for a terrible and confusing user experience as the next commit is suddenly based on a state of the code you saw 20 steps ago.

As it would only work properly for projects with a completely linear history (which most projects don't have) I can understand Github not adding this feature. I'd say this is something a third party app using the Github API could do very well for projects specifically set up for learning through their history (like this one).

By default using a SOCKS proxy (which, using ssh -D is probably the easiest and most common way to do this) in most browsers doesn't solve this problem as DNS resolving is still done locally.

As they're messing with DNS, you'll still be connecting to their evil version of YouTube through your SSH tunnel. In Firefox this behaviour can be changed by toggling network.proxy.socks_remote_dns in about:config.

Of course, setting up an actual tunnel (i.e. on a lower network layer) would be better but that's a bit more complicated to do.

Still wishing they'll completely open up the data and end the 9292 monopoly. Recently a lot of Dutch public transport data has been opened up but you kinda need it all to make an effective 9292-alternative.

Tumblr isn't representative of feminism or humankind for that matter. And a collage of Tumblr posts cherry-picked for their awfulness isn't even representative of Tumblr itself.

Not to me, but my perspective is far from the definition of normal ;)

I wish that worked. I'm in an open plan office where I constantly need the headphone to drown out the noise all the other things happening (people talking to each other, marketing people making phone calls, people walking about, etc) so that'd mean I'd be constantly unapproachable. I'd actually like that, but I'm pretty sure my co-workers and employer wouldn't.

A friend works in an office where headphones are even banned because they create too much of a barrier to talk to a co-worker. I'd go absolutely crazy there in less than a week.

Why should I be using OpenSSL other than this bug?

except, expressing the fact that you're gay in public is seen as promoting it to minors. So for all intents and purposes: being gay without pretending to be straight is illegal.

Classic forgetting the full WHERE-part of a manual UPDATE-query on a production system. The worst part is you know you fucked up the nanosecond you hit enter, but it's already too late. Lesson learned? Avoid doing things manually even if a non-technical co-worker insists something needs to be changed right away. And if you do: wrap it in a transaction so you can rollback, leave in a syntax error that you'll only remove when you're done typing the query.

The risk with saying "Yes, if.." is that a lot of managers (or clients or whatever) stop listening after the word "Yes".

With "No, unless ...", it's a different story. Then success is dependant on the conditions mentioned and they're much more likely to do their part in making sure those conditions are met. If you said "Yes, if" they'll often just remember you promised you could do it and leave it at that.

What's a legitimate site? Plenty of sites most people would call "legitimate" like high profile blogs or ecommerce sites engage in activity that's frowned upon by Google. The fact that some unwanted behaviour was no longer rewarded isn't exactly a penalty.

What RapGenius (also a legitimate site in the sense that they're not scammers and providing an useful service) did wasn't just unwanted behaviour but specifically forbidden. And yes, they're far from alone in what they did. Which is exactly why Google is making an example out of them.

I know, it sucks, all your competitors doing similar things forces you to choose between taking this risk and never making it in the first place. But that's exactly why it's a good thing Google is making a stand and setting an example.

It's a move towards a level playing field where nobody is making the internet a worse place by engaging in tricks like link farming rather than a level playing field where everyone is doing it and the end user suffers the consequences.