Hacker News Reader

techpeaceon Medical Care in the U.S is Bad, But Insurance Sucks Too

Except, of course, for all of the evidence he provided as to his experience in the US versus his experience in another country.

techpeaceon Rails 3.2.13, 3.1.12, and 2.3.18 have been released

Anybody else unable to to upgrade via bundler? I can report also seeing the following behavior: https://twitter.com/jamesgolick/status/313751280210288641

Not sure if this is a rails, bundler, or rubygems issue, at this point.

techpeaceon White House Response to “Make Unlocking Cell Phones Legal”

The entire reason this was controversial was specifically because we consider telecommunications working hand-in-hand with intelligence agencies to be a violation of our basic freedoms. Had this been set up in a foreign country by KBR, it would fit within the concept of the "military industrial complex."

techpeaceon White House Response to “Make Unlocking Cell Phones Legal”

https://en.wikipedia.org/wiki/Military-industrial_complex

The phrase does not apply to any industry, it refers specifically to the defense industry, of which telecoms are not a part. Otherwise, we could plausibly say that any sufficiently large business in the US is part of the "military-industrial complex," which is not the case.

So it has little, if anything, to do with the military-industrial complex.

techpeaceon Why was my email leaked?

They aren't letting me post to the forums, but I can also report receiving spam, but only on an address I formerly used with this account, not my latest address.

techpeaceon Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3

No, it points to a project with a larger user base and much greater degree of scrutiny. No web framework is entirely secure - some have just had more of their insecurities made public.

techpeaceon Is Tokaido (rails.app) Dead?

This will make future Rails Girls events a breeze. :) Thanks for all your hard work on this and everything else.

techpeaceon Metasploit Rails 3 Remote Code Execution Hours Away

Very true. There were no widespread reports of incidents based on this vulnerability in the wild, though, or it would have been discovered already. Thankfully, the folks that found this exploit (and the others they are sitting on for the moment) were wearing white hats. Also thankfully, the core team responded quickly to rectify and publicize the issue.

techpeaceon Metasploit Rails 3 Remote Code Execution Hours Away

When the execution path looks like this, yes: http://blog.codeclimate.com/blog/2013/01/10/rails-remote-cod...

An exploit that's simple to use does not mean that it was simple to discover. In fact, the opposite is often the case.

techpeaceon Metasploit Rails 3 Remote Code Execution Hours Away

That's exactly what it's intended for, actually. It was built by pentesters to perform their work. I'd rather my security tools be open sourced and available for all the world to see and contribute to. Doing so also compels lazy vendors to patch awful vulnerabilities.

techpeaceon Metasploit Rails 3 Remote Code Execution Hours Away

It wasn't a simple code review, it was a vulnerability that existed in code unnoticed for a number of years. It required skilled security researchers to unearth it. Vulnerabilities exist unnoticed in a number of foundational OS projects like this, and it's only when a CVE is released that people realize it had been there for quite some time.

techpeaceon Metasploit Rails 3 Remote Code Execution Hours Away

Metasploit releases significant exploits pretty frequently. HD (the author of the blog post) is featured for one of his more interesting exploits in this NYTimes article from last year: http://www.nytimes.com/2012/01/23/technology/flaws-in-videoc...

techpeaceon Nathan Myhrvold's Cunning Plan to Prevent 3-D Printer Piracy

http://cunningplan.com/

techpeaceon Show HN: LearnStreet - The Best Place to Learn How to Code

That Heroku video you link to on the Dev Tools page is about 4 years old, and is demoing a version of the product that no longer exists (their attempt at an online IDE of sorts).

Looks like a great product, though! Keep it up.

techpeaceon CourseTalk: Reviews for Udacity, Coursera, and edX

Twitter deprecated an oauth endpoint yesterday, so I'd check the URLs that you're attempting to hit. We ran into this yesterday, as well.

techpeaceon The Magazine

I can't seem to get the "start your free trial" link to function from the "Introduction" article.

techpeaceon A Letter from Tim Cook on Maps

Gizmodo claims to know why Google Maps were dropped: http://news.ycombinator.com/item?id=4577866

According to their sources, Google was keeping Apple from adding turn-by-turn directions without complying to some conditions that were too onerous for Apple.

techpeaceon Huffshell: You probably type too much.

For improving your git-command-related efficiency, you could always use the excellent git-sh by Ryan Tomayko (CTO of GitHub): https://github.com/rtomayko/git-sh

techpeaceon Open-sourcing Stylo

Awesome stuff, Alex. Thanks for open-sourcing the code!

techpeaceon Spotify now requires a Facebook account to sign up.

I believe he was referring to an unlimited sync-to-mobile, since he references unlimited storage in that sentence, as well. He's probably referring to a model like Rdio's.

techpeaceon A set of useful mixins for LESS CSS

https://github.com/thoughtbot/bourbon

techpeaceon Tim Ferriss on tolerable mediocrity, and the advice he gives startups

The problem is using a physician's name to lend authority to a physical regimen that might be harmful without that physician's approval. He's clearly attempting to mislead his readers.

techpeaceon Tim Ferriss on tolerable mediocrity, and the advice he gives startups

I think there's a difference between getting "supporting data" (or your own medical test results) and using a physician (and a university's name) without their express permission to both:

1. promote a commercial work, and 2. espouse an exercise regime that may be harmful.

Tim has responded to my comment on that original post:

"Matt,

To be clear: - Dr. Plato took most of the measurements in one chapter titled “Geek to Freak” - As she noted, I’ve contacted her several times (phone and email) in the desire to confirm data and even repeat tests. My last email to her was in March of 2009 and read:

“Dear Dr. Plato,

It has been some time since we last spoke, and I hope this finds you well! We did a number of hydrostatic weighings and circumference measurements back in 2005/2006, when I was gaining a lot of muscular weight as an experiment.

Are you still working at the Human Performance Laboratory? I will be writing a new book about physical optimization and will need to track things well. Do you have any availability for a visit from me and one other person anytime soon?”

If I wanted to falsify data, I wouldn’t include a specific person’s name. Too much headache for everyone. I hoped to actually work with Dr. Plato to present things, but she didn’t respond to my email/phone.

That is. Nothing sinister about it.

All the best,

Tim Ferriss"

techpeaceon Tim Ferriss on tolerable mediocrity, and the advice he gives startups

"I don’t know anything about Tim Ferris’s exercise regime. He came through our Sport and Fitness Evaluation Program for some testing a number of years ago. He did not provide any information about his purpose. In fact, I only found out that he put my name on his website after receiving an inquiry from someone who had seen the website and asked if I could confirm his results. I cannot — he signed a consent form that states that individual results will not be disclosed. Although he contacted me about being retested, I am not willing to do that because he is apparently using my name and San Jose State University for his commercial purposes, without asking for permission or notifying me of this."

The above quotation is allegedly from the doctor that Ferriss sites at the beginning of The 4 Hour Body. I have not verified that the quotation is legitimate, but I found it within this review of the book: http://forums.somethingawful.com/showthread.php?threadid=337...

I found the review when I was researching some of the claims he makes within the book, claims which, to me, seemed to be obviously fraudulent. Assuming it's true, I have a hard time understanding why anyone should seek him out for advice on any matter.

techpeaceon _why is no more

Maybe the title of one of his RailsConf sessions gives us some clue: "A Starry Afternoon, a Sinking Symphony, and the Polo Champ Who Gave It All Up for No Reason Whatsoever."

techpeaceon Ask HN: Which tools do you use to optimize your webapps?

Google Page Speed is also worth a look. It will point out problem areas and recommend best practices to speed them up.

techpeaceon Amazon EC2 gets statistics, auto scaling and elastic load balancing

You can already use publicly-available AMIs that contain a wide variety of application stacks.