TomasSedovic

This is the Ruby on Rails Security mailing list:

https://groups.google.com/forum/#!forum/rubyonrails-security

you can view it in the browser but unlike with a vanilla website, you can also receive notifications via an email.

Thanks so much for the LDT link, it's exactly what I was looking for (and thought impossible).

I can't speak for the GP, but my problem with ACE et al. is that they replace the textarea with their own HTML structure (e.g. a div for every line). I understand the reason why, but it means they have to reimplement all the textbox behaviour and they never get it completely right.

For example: when I double-click on a word in the textbox I'm writing this in, and then middle-click somewhere else, the word gets pasted there.

In ACE, it pastes a different text in a different location.

ACE is brilliant if you want to a full-fledged text editor. But it's an overkill if all you need is a normal textarea with some colours.

It would and they should do it. But the whole thing would still be fundamentally insecure. Read the link submitted by raphinou:

http://www.matasano.com/articles/javascript-cryptography/

They seem to be using TLS, but yeah the users have to trust Google (which hosts their jQuery js), Mozilla (which hosts their Persona js) and of course the admins of yithlibrary.herokuapp.com itself.

If any of these gets compromised, the crackers would be able to retrieve the master password of any user entering it afterwards.

According to the docs, Quintus does support mouse and touch input.

On my PC, the demo is controlled by keyboard only. Presumably, they wanted to make the code as small as possible so they didn't put touch controls in.

http://html5quintus.com/quintus/docs/quintus_input.html

If I recall correctly, they have some sort of cookie-related bug (feature?) in G+ and Google Groups.

If you clear your cookies or open the link in incognito mode, you should be able to see it without having to log in.

I think this really depends on the point of view.

It is a back door because the user (even a sophisticated one) has no visibility into what's being installed (all the information the user sees is being controlled by Microsoft and the user has no way to verify it because of the closed nature of the system).

This means that fundamentally, the user has to trust Microsoft every time time an update is being rolled out. And as any other large corporation, Microsoft doesn't always do things that are in the best interest of their users.

Mind you, this is the back door that we know about. I don't want to go get into the conspiracy territory, but one of Stallman's points is that the user really can't know whether there's a hidden back door or not. And even if there isn't one now, they can use the Windows update to put it there.

Richard Stallman feels very strongly about this. Others may not. Depending on which side you're on, you may either make this a big deal or say that Microsoft (or anyone breaking and hijacking the system) is trustworthy so this is nothing to worry about.

How you talk about the facts is retorics. But at least on this subject he's not saying anything that isn't true (he may be bending the truth on other issues -- I haven't read the article so I can't honestly say).

I think that yes, he means the software update. I'm afraid you're mistaken on where the defaults lie, though.

An out-of-the-box Windows will download and install the software and then automatically reboot the PC. You have to explicitly change the settings to avoid that.

On Fedora, Ubuntu, Arch and Mint (the desktop distros I've used at one point or another) you will be notified that the updates are available but you have to explicitly say that you want them installed. If they require special privileges, you will be asked for a sudo password. If they require a restart, you have to approve it explicitly as well.

Except for Rust which takes you directly to rust-lang.org. I actually like the idea though. No language is perfect and people do seem to be a bit too sensitive of their favourite languages.

The submission's title is very misleading.

According to the article (titled "UK begins three-parent IVF debate") they are starting a debate on the issue and seeking comments from the people.

They plan to send a report to the UK government in early 2013, which could then possibly lead to legalising the procedure.

Which happens to be the point of this article.

Sadly, the post provide little content besides showing the favicons Google used in the past.

The icon itself's not even new -- the post mentions it's the same icon they've been using on the mobile devices already.

Really, all the post is saying is: "Lookie, we're using our mobile icon everywhere for the sake of consistency."

Does that really "gratifies one's intellectual curiosity"?

http://ycombinator.com/newsguidelines.html

I don't mind paying for the software. If it ends up being as cool as it looks, I'll happily part with the cash.

But I would love the promise of open source and not open core. Especially since the current description is so vague.

"some of the plugins may remained [sic] closed source"

What kinds of plugins? Every supported language is a plugin -- will Python or Ruby end up closed? Or the inline HTML rendering?

If Chris promised a true commitment to keeping this open, I'd promise to pay up. With Kickstarter, I could even prove it.

How about a KS reward that would give me the access to all everything Light Table related that the team builds?

Also note that even GPL allows you to sell the software and sell the code separately. Ditto for other licenses. I'd pay for the code. Not sure how viable that actually is, but it's something to consider.

Lastly, how's the development going to look like? Are the open source parts going to be done in the open (as most successful open source projects do) or will it be Android-like code dump on the release date?

Regardless of Zed Shaw (the author of Lear Python The Hard Way) says, I think that Dive Into Python is a great book and one definitely worth reading.

I love Mark Pilgrim's writing and I've found the book quite helpful when I started.

http://www.diveintopython.net

That said, LPTHW seems like a great book, too though I haven't read it the whole thing.

Ruby, Python, Go, JavaScript, Bash, even Clojure -- kinda.

https://gist.github.com/1815639

Of course, unless you're the sole writer and reader of the code, it's generally good to follow the common practices that evolved around the particular language.

That's been my experience at least. But remember that this is very subjective and different people will have different habits.

It's quite possible that there are shortcuts that get crippled by the Dvorak layout -- I'm just not aware of them.

Also, muscle memory is a strong thing. Expect at least the first few days to be slow and painful. And as such, it's quite possible that all my positive experience now is due to cognitive dissonance.

Yeah. Adjusting to typing in Dvorak took me considerably more time and effort that getting used to the new shortcuts.

Luckily, Dvorak isn't that bad for this. For instance, 'j' (down arrow) and 'k' (up arrow) are still next to each other, in the same order.

'h' (left arrow) and 'l' (right arrow) are not, but when you have your right hand in the starting position, their location and distance is very similar to where they are on QWERTY.

As a side note, it's much harder to type QWERTY on Dvorak.

Now, the arrow keys no longer in the same place -- up/down is on the left side of the keyboard whilst left/right is on the right side.

But that's not as big a problem as you may think -- provided you keep both your hands on the keyboard. Interestingly, the Kinesis Contoured keyboards [1] have the arrows similarly separated.

And there are no "gotchas" where the keys' position would go against the spatial intent.

You could imagine a layout that would for instance have ctrl-f (page down) located below ctrl-b (page up) or 'h' (left arrow) on the right side of 'l' (left arrow). But that's not the case in Dvorak neither for vim nor for the emacs keybindings that I'm familiar with (c-b, c-f, c-a, c-e). Sheer dumb luck, methinks.

Both under vim and under Gnome in general, I've found that all the shortcuts I'm using aren't that much worse off. Some are actually better. It seems to pretty much balance out.

[1]: http://www.kinesis-ergo.com/advantage.htm

Pleasure to meet you. Not sure how much passion you require. I'm not exactly head-over-heels with vim, but I have been using it for about 7 years and dvorak for about 3.

Anything in particular you want to ask?

Take a look at the second line in the `apply` definition[1]:

    self.eval @env[fn][2], Hash[*(@env[fn][1].zip args).flatten(1)]

It's triggered when the `fn` is not callable, i.e. when we pass in lambda:

    [:lambda, [:x], [:car, [:cdr, :x]]]

The code ignores the `:lambda` symbol (that would be `@env[fn][0]`).

It evals the third element of the list (the lambda body) in a new context that combines `@env` and the binding of lambda's args to the symbols in the lambda's definition -- that's what the `Hash` mumbo jumbo creates.

[1]: https://github.com/fogus/ulithp/blob/b02d5806ce3b2d3766311c2...

Heh, the reason I used Bandcamp instead of iTunes is that it runs on Linux and that they actually want my money :-).

At least in some countries (mine included) you can't in fact buy music or video from iTunes. They won't accept your paypal or credit card.

There is a workaround -- buying and redeeming gift codes. But honestly, I can't be arsed to that.

I didn't know Bandcamp but a few days ago I wanted to buy the Bastion soundtrack. The Bandcamp link was the first hit on Google and it was linked from the game's official page so I went there.

I could listen to all the songs without restriction, pick from a variety of reasonable formats (including ogg) and download the same album to my computer at work the next day without any trouble.

This is how you do it. They treated me like a customer not a criminal and it was actually easier than using BitTorrent. I was happy to give these folks my money.

There's some serious spinning going on in that article.

The asthma study showed that (in that particular case) the placebo treatment did not work at all. The patients reported feeling as good as with using the real treatment, but it did nothing to alleviate the actual symptoms.

The last paragraph tries to claim that placebo (sham acupuncture) may be as effective as the real treatment (real acupuncture). That's not what the study shows. The result of the study is: the "real acupuncture" doesn't work either.

Placebo is the null hypothesis. It's something that all treatments show regardless of their actual effect. It's the level that you have to beat before you can say that your treatment has any benefits.

If something is no different than a placebo, that means that it has no effect other than the placebo effect. Therefore, the original treatment does not work. Period.

Placebo effect is a psychological hack. You get it regardless of the active component in the treatments. It's about the feelings and expectations of the recipient.

In sham medicine, all you get is the placebo effect. But when you get actual treatment, you're benefiting both from the placebo effect and from the treatment itself.

I'm not saying that feeling good is not a desired outcome. It's just that if you have real issues that won't be resolved by feeling better, placebo is of no help.

Presumably you may want to use the dock connector for charging.

I read the "GOOG's dearly" part as "dear to Google" not "developed by Google". Google did use Perforce in the past and they still do, probably.

I think that the GP used the phrase correctly, but not being a native English speaker myself, I'm not entirely sure.

I'll leave it up to Steve to answer that, but this may help you get the idea:

https://sites.google.com/site/steveyegge2/five-essential-pho...

This is a Steve's post on how he conducts and what he expects from phone interviews.

It's over seven years old so proceed with care -- it's possible that his views changed since then.

Also, this is probably more of a bare minimum rather than the whole picture.

Sigh, you're right. Thank's for the correction. I guess it's true that nothing good happens after 2AM (my local time).

Having read the title, I thought "hey, all you need is 2 measures".

So the final constraint (not mentioned in the title) is to find out whether the anomalous ball is heavier or lighter than the rest.

That's where the third measure comes in.

I didn't know that you couldn't arrange mass in any way to get a wormhole.

I've never been able to figure out in my (broken, I'm sure) mental model how you could create a wormhole but I suspected that the people who actually understood physics did know.

Thanks a lot, man. Interesting stuff.

Can you please expand on that last line? I read it two ways and I'm not sure which one you mean.

Does the "you can't do that" refer to getting a how-to-build-a-wormhole recipe from general relativity, i.e. "I can't tell you how to build one, go figure it out yourself".

Or is it more along the ways of "You don't have a worm hole? Well too bad, there's no way you can create one. But hey, it could totally hypothetically exist."

If it's 1) then we could possibly build one (or find it in the universe somewhere) and GR just doesn't tell us how. If it's 2) then we know it can't even be created.

Experiments that show that you can communicate faster than light using quantum entanglement?

The great misunderstanding about quantum entanglement is that while it seems like the two parties at the other ends can get the same information about the entangled system simultaneously, they can't actually push any information of their choosing through the system. Which makes it useless for communication.

Could you please point us at papers/experiments that show sending information through quantum-entangled particles? If that's true that would be a huge thing.