pak

It is categorically false. Police have radios, backup units, plainclothes units, dogs, helicopters, and some level of support from just about every citizen on the street. Where this happened, you are smack in the center of Cambridge in broad daylight with hundreds of witnesses and nearby patrol units. You can't outrun every witness on the street, or the officers summoned to the block ahead of you. It is absolutely ludicrous.

But for the sake of argument, let's assume he is the next Jason Bourne and manages to elude all of Cambridge, Boston, and MIT police on bicycle. What then? They clearly identified him on the street, so he knows they have his face. They also have his prints from the laptop, and the FBI probably has those filed from the PACER incident, so pulling his complete identity is only a matter of time. Staying at his job and place of residence is therefore out of the question. Does he pull a Whitey Bulger and go into hiding in some remote corner of the US? Give up contact with everybody that ever knew him and change his identity? Even Whitey got caught after 17 years, how long do you give a mild-mannered 24 year old with no ties to the criminal underworld? "Running faster" is only putting off the inevitable and adding charges to the docket.

There's nothing wrong with police skepticism or discussing libertarianism. Calling cops dumb and fat and saying you can avoid arrest by running faster... ehmm... what the hell passes for intelligent discussion on here now?

I see the anti-cop contingent from reddit has finally arrived. Seriously, for your sake, I hope you are just trolling.

Your reactions here are completely emotional. This is understandable, since the story is about a potentially emotional topic, but your response to it is not helpful for making a rational business decision.

Try to divorce yourself from the topic and read your reply again, realizing that you've set up an impossible standard and blanket-judged a complicated balance of liabilities as "pretty simple."

This guy is a professor I would have loved to have for one of my English classes. His positive attitude and willingness to adapt and work hard for his students is just remarkable and rarely seen in a college classroom.

By the way, this is a great solution to the much-discussed (http://news.ycombinator.com/item?id=2774254) problem of effectively dealing with plagiarism: imagine if it were expected, as part of your class, that you engaged your professor via email while writing assignments. There would be no way to plagiarize, because the professor would have direct insight into each part of your writing process as he saw bits of your essay fall into place. Imagine all the students that could be guided to correctly cite and re-use sources if their professor had just headed it off at the pass instead of running it through TurnItIn and groaning at the fallout. I couldn't agree more with the benefits of this dynamic, more interactive teaching method for writing.

It also makes me wonder if he would be interested in having students share their works-in-progress via Google Docs--he would be able to essentially peer over their shoulder as they type and comment. Or would that be going too far?

In my experience, maybe 2% of software engineers are incentivized more strongly by positive social change than by money or fame. These are the idealists, like Richard Stallman and former members of OLPC, who are often ridiculed by the rest of the community. Until the academic and governmental infrastructure is able to put anywhere near as much money into CS research as private industry, the majority of technologists will (have to) be driven by the desire to make money.

For all the talk of how doctors make a lot of money, the reason they do is that so few are both qualified and willing to take the long, grinding road through 8 years of medical school and residency, $200k in debt, and 80 hour work weeks, with fierce competition at every step of the way. According to the med students I know, if you aren't inspired by some higher calling it's almost not worth it because you won't make it through.

Egh, pgAdmin doesn't feel native at all. I wish there were a Sequel Pro (http://www.sequelpro.com/) for postgres, with a proper Cocoa UI. Once you use Sequel Pro going back to anything less friendly is a real grind.

How do you understand the charge of attempted murder then?

A man brings a gun to a political demonstration where a VIP with whom he violently disagrees will be arriving. He reaches the front of the crowd and as the VIP draws near, the gun slips from his pocket and he is arrested. Are you meaning to tell me he shouldn't be charged with attempted murder just because he hasn't yet pulled the gun out and engaged the trigger?

Just so you know, people have already been convicted under these circumstances, so the case law is already pretty clear.

How did this guy ever organize his buddy list when he used AIM or whatever? It's painful for a day, but it's not like people move between groups very often, and unless you are a celebrity it's an infrequent task after the initial setup. Plus, they've made the UI for it slippery smooth (kudos to Google+ for the effort there).

eh? I don't see that as one little omission. It's kind of straightforward that you would need to be the owner of the actual URL to be deleted, so checking the siteUrl is not sufficient. I can understand if they only intended to allow relative paths from the siteUrl, and if there was some kind of bug in special characters or parameter parsing. But no, this is as bad as that bug in Citibank's site where you could just change the account number in the address bar [1]. Color me disillusioned with Google's security practices.

[1] http://consumerist.com/2011/06/how-hackers-stole-200000-citi...

'Business' does not just happen within the database! You will have to perform logic based on events that occur elsewhere, e.g. on the network or within outside data sources! And to say that something should be done in SQL just because it can is patently absurd--do you know how much performance suffers as soon as you start roping in subqueries and calculated values? Half of the things I listed would require stepping outside of indexed columns in awkward ways--that was kind of my point. Good luck keeping that performant past a few million rows.

In fact, I would love to see you design a query that branches on the condition that the item is out of stock and automatically returns the top 3 equivalent parts for each brand using a junction table containing equivalencies, ordered by a column in the junction table containing the closeness of fit. Go ahead, humor me. Then try to pretend that that query will ever stand up under scale.

Most academic journal repositories grant institutional access based on IP address blocks. Some institutions keep this narrow and force you to use an HTTP proxy, which gives them the ability to put additional institutional-level authentication in place. The upside is that you can access the journals from off-network, the downside is using the proxy can be a major pain. Other networks, e.g. MIT, are permissive with the IP restriction and don't mandate the use of one centralized proxy as long as you are on-network. I suppose that may change after this case.

Yeah, I think it's a bad argument to personify network protocols or imbue them with intent. Legally speaking, what is more important is the intent of the person using them.

>I take issue with the notion that someone who is accessing a service through a public interface is criminally responsible for downtime if too high an access rate causes service degradation or an outage

Ah... well surely you've heard of people being prosecuted for denial of service attacks? Most recently, members of anon getting raided because they used LOIC? If you use a network in a way that is intended to degrade others' quality of service, even if you are just accessing things via normal protocols at a really high rate, you are breaking the law. In this case, it does not look like they are alleging that he intended to cause a service disruption, but they claim that he repeatedly circumvented measures that JSTOR put in place to halt his unauthorized activities, which caused service disruptions for other legitimate users and therefore denial of service.

>At that point, it's equally easy to install a stack like haproxy + varnish + nginx + a bunch of CPAN modules as it is to rsync over a bunch of .php files

Ahem. I get what you are trying to say, but I think you're gonna have a hard time saying that Ruby is as easy to deploy "right" as PHP. Rsyncing a bunch of PHP files is a single shell command. Writing puppet or bcfg2 specs to deploy your six-tier web stack for your RoR app is a bit harder, it is most certainly not a button click out of the box, and neither process is necessarily more "right". It certainly helped the PHP ecosystem that deploying a LAMP stack is as easy as running three package installs and copying over some PHP files. The fact that a simple-to-understand, well-established process will scale you up to decent load before you need to get fancy will continue to make it an attractive platform.

Hmm. Not to nitpick, but what if:

- you're running a promotion

- the price changed in between the time the person added it to their shopping cart and checkout

- two people are processed for a payment on the last item in inventory at the same time

- there are different options on the item, e.g. color, that change the price

- other people bought the last item in inventory already, but there's an equivalent product at the same price

- the person bought the product using a combination of real money and gift card money, which the payment processor does not handle

- the person bought other things in the same transaction, e.g. a gift card, that do not have an inventory ID

Those are just a few cases off the top of my head, but the short end of it is that expressing all of this with a combination of SQL and client-side logic is just madness. If you're saying that we don't need to write business logic in PHP any more, I think you just don't work with the same constraints that most businesses do.

If only they could get the docs back up to par! Things were sort of OK for 2.x, even if you needed some background in CodeIgniter to really understand everything, but half of the wiki for 3.x is empty pages with TODO's.

I still recommend that people new to Kohana start with 2.x because a framework is worth a lot less without quality documentation, when you have to go read the code all the time. Not that you shouldn't do that eventually, there's a lot of good code in there to learn from!

>That is exactly the message that the unemployed and the rest of the country need to hear and take to heart.

I bet they and the lady at Rite-Aid regularly read Forbes magazine, right? Don't kid yourself--this article is meant for the echo-chamber. And that's why I think it's a waste of space.

grellas, you're the man when it comes to assiduous comments on legal topics, but why this article? It's just a bunch of hard-nosed Valley boardroom hot air that namedrops from the NASDAQ-100 and tells middle america to suck it up. The only salient point was that the government has no easy way of producing more jobs, but there's no solution offered and it's buried in a sea of other BS. "Hey poor and struggling unemployed Americans, you need to find new skills?" Seriously, Forbes needed to run a whole article dedicated to this?

A much better take would be an examination of why our education system churns out so many college grads with few marketable skills. Or something that balances it with their viewpoint: http://opinionator.blogs.nytimes.com/2011/07/16/growing-up-t... This submission is just a pile of inflammatory linkbait that offers nothing new to the people that would agree with it, and enrages those who disagree by using such caustic language.

How about taking a harder line then? Make your warning at the start of the semester, and to everybody: any reasonable suspicion of cheating results in an immediate referral to the honor board, no protesting or second chances. The first assignment rolls around, a few people are caught cheating, and you spend X hours submitting their cases to the honor board. Let the honor board handle the adjucation of the matter, which is where it belongs, and wastes less of your time. It also lets the department know that they have a problem, since some of them are probably involved with the honor board.

Students hear that peers are getting sent straight to the honor board, and they fall in line. The next assignment that rolls around, almost surely less students will attempt to cheat. If you have to spend Y hours sending more students to the honor board, hopefully Y is less than X. But it sends a loud-and-clear, unmistakable message to the students that cheating is unacceptable. With any luck the students that actually take the class seriously will appreciate your candor on the matter.

I agree that allowing students to actually come in and argue their case to you is a waste of your time. You're right, that's not your job. Send it to the honor board and waste the time of the deans and the department heads, since that's their job. If you let students waste your time by giving them an extra strike before they're out, you can't be surprised when they try to take advantage of it. One strike and you're out tells students that it doesn't matter if ex post facto you think your best friend's grandma's death drove you to do it: cheating is never acceptable.

Facebook will ban this app from FB Connect in 3.. 2.. 1..

The thing is, I don't see any effort by Twitter to try to separate the inband metadata, except for what they did with in_reply_to (which continues to have problems). They should have done exactly the same for hashtags, URLs, and pictures a long time ago. As a result, URL shorteners have spread across the web like a disease and tweets are #goddamn #liketotally #nearunreadable http://bit.ly/mjSZ1G now, unless you have a client that gets rid of the junk for you. I don't see the top-down, platform-level vision from Twitter about how they'll innovate and make the UX better, instead I just see them sucking up all the startups that built products around their service.

You can make a better UX for a broadcasting service than by having people squeeze more characters in by switching to a tinier URL shortener and using sillier hashtags. I'm hoping to see some movement that actually indicates they know what a problem this is.

I think people need to be educated that SQLI bugs (errors in escaping) lead to usability issues as well as security issues. I can't count the number of times I've searched for something on a clearly handmade site and watched in amusement as my search query grows backslashes while paging through the results. Also, single quotes show up in more places than people realize: I've seen them in proper names, street addresses, uploaded filenames... if those things break your app or damage data, that should be a tangible concern.

Perhaps; to avoid any verbosity for any real code I wrap PDO in something like IdiORM and Paris (http://j4mie.github.com/idiormandparis/) or my fork called Dakota (https://github.com/powerpak/dakota). My point was that you can write a PHP + MySQL toy example with PDO that is just as simple as the mysql_query() garbage but is a million times safer in the long run.

Yes, yes, yes a million times yes. Every person starting PHP should be taught PDO with parameterized queries from the get go. The internet (and many respectable CS courses) are littered with examples using mysql_query() and string concatenation, half of which train people to create SQLI bugs or don't explain why escaping is needed; it's too late to undo the damage already done but at least people new to PHP will hopefully be told now that there is a better way.

If we had trained people to simply do

    $sth = $dbh->("INSERT INTO folks (name, addr, city) values (?, ?, ?);");
    $sth->execute(array($name, $addr, $city));

in 2005, when PDO first came out, uncountable SQLI bugs would have been avoided, and maybe lulzsec wouldn't be having such a field day in 2011...

Why not just order regular boards, cut the USB headers off with wire cutters and fill the ports with epoxy? That should prevent any casual thumbdrive usage.

The only hangup I see with that is that most boards don't have PS/2 anymore and you might need to connect a keyboard/mouse. To solve that you might need to epoxy a wireless transmitter into one of the ports and pair it with mice/keyboards as needed. But for situations where wireless devices are not allowable, I can't see any cheap solution short of soldering the USB wires to the motherboard. Damn USB for being so... universal.

Beisdes analyzing properties of the commit graph, which doesn't seem to be a common task, what about them is so useful that they need to be stored in commit headers now? For instance, what day-to-day operations do they actually make faster? At first, it sounded like it might be for easier navigability (e.g. expanding git-rev-parse) but I don't see that in this description.

Which would be a success of Google's new algorithm, as far as Google's users are concerned: force the website owner to separate out his own garbage, and only the good stuff makes it to the search results.

Although I wonder: if a website spreads enough of its "garbage" around multiple domains (not subdomains), it might be able to still avoid the new blacklist threshold while polluting entire pages of Google results. It's not hard to trivially reskin your site and pump it through hundreds of domains--certain sites in, ahem, seedier parts of the web have done it for years.

It was an interesting read, and thanks for coming here to talk about it! There were a few questions that came to mind...

- In what ways does Facebook prioritize social science over technology? By all accounts it's just as engineer-driven as Google.

- Also, you seem to have pivoted away from research upon your arrival. Does Google not allow researchers to transition into product development? Would that have been a desirable path for you?

- Finally, did you leave Google before or after you knew about the Google+ launch, and is there any part of you that wishes that you retained some input into the product? It is quite evident that it was built centrally around the results of your research, and I wonder what it must feel like to be working for a competitor when the product of your vision finally goes live and reaches 10 million users.

Whoa, didn't realize WebGL used canvas. Cool.