polvi

We do pretty exactly what you described on the monitoring overview -- except for the filter in #1. Great feedback, however, and we will look at including that!

This is a very different take on visualizing your infrastructure. I encourage you to setup your servers and post on the big screen at your office. After watching it for awhile, you will start to be able to see when something is an anomaly just with a glance.

Joining the ASF adds structure to the project that will help it grow the community and product. This includes formalities such as contributor agreements, so that all IP is released to the ASF, or votes so that consensus is reached by a group instead of individuals. It does add a little overhead, but the overhead is there to help grow the community in general.

I guess it all depends how you design it and what you are doing. I would have to agree with others, the out of request cycle image processing solutions are definitely the right way to go overall.

The solution to use an image processing library such as RMagick, http://rmagick.rubyforge.org/

Setup git bash completion + put the branch name in your PS1 (previously mentioned on HN).

http://www.simplicidade.org/notes/archives/2008/02/git_bash_...

Congrats, guys!

Sexual Assault Facebook app.

Allow people to report when they are victims of sexual assault. I started discussions with the local sexual assault center, but after hearing feedback, it seemed like people did not want stuff like "3 of your friends were inappropriately touched last night" popping up on Facebook. Although, I do still think part of the problem with sexual assault on college campuses is that nobody talks about it.

Has a possible business model too: rev share with legal teams.

Feel free to run with the idea!

Wanted to give an update explaining what happened and how we fixed it.

The main issue is that we offer the ability for a user to change their email address. This is a very common feature, and thus something a lot of sites fall victim to. The basic nature of an XSS is that a malicious site can cause you to POST or GET arbitrary URLs. Since cookies are always sent along with the request, if you are authenticated, the attacking site can cause you to hit traditionally protected URLs. This is normally a non-issue, as only your browser reads the content -- the attacking site has no visibility into the data. However, it is an issue when there are side-effects, when the malicious site can change things to their advantage. In this case, they changed the email address to their own via a post. From there, all they had to do was hit the password reset function for their email address.

As soon as we found out about this, we immediately turned off email and password reset. This prevented the XSS from working, as the urls in the attack 404'd. This was a temporary solution.

Next, we now require you to enter your current password when you reset your email. This would also prevent the XSS, as the attacker would need to know the users password. It also prevents against other attacks, such as someone with physical access to your logged in session from resetting your email address with out you knowing.

We also implemented the Django CSRF middleware. This protects the rest of our forms on the site from similar problems.

As for impact, our audit logs show that only the attackers account was compromised for the sake of his demo. Fortunately, he did not randomize the email address used to change the password. If anyone did become a victim to his example, it would not have changed the email to his address (we only allow unique email addresses in the system). However, it is possible this XSS was in "the wild" with other addresses, but according to our logs and the nature of the vulnerability, it is highly unlikely that it impacted any users.

As others mentioned in the comments, it would have been great for the author to contact us before posting this. As motivation to future security researchers, we will happily offer a bounty if you report your bug to us before posting it publicly. In fact, if you're really good -- we'll happily make the bounty a full time job with benefits! :)

If you have any questions or concerns about this issue, please do not hesitate to contact me personally! polvi@cloudkick.com

(Alex from Cloudkick) This XSS is no longer valid. Thank you for the bug report. This was definitely a mistake on our end, and we deeply apologize for the error. Will post another report shortly...

This is great. Any idea if they will do the same for the FriendFeed datastore?

Who is Jamie Reilly?

None of the providers (that I know of) support OCCI. libcloud could support OCCI once it has gotten some support.

No problem, try this one:

  git clone git://github.com/cloudkick/libcloud.git

Yes. Although we're willing to add more providers and more functions to the API (such as "list_images").

It is true, we're initially targeting providers that will give you a "server via API call". When you're developing against AppEngine (and I imagine Azure), you're committing to that platform, because it is very very specific. Whereas when you develop against Amazon or Slicehost, the server is the common unit ... which you are free to do whatever you like with.

That said, I think there is a lot of room for a similar project with storage. Amazon S3, Rackspace Cloud Files ... and maybe Azure will fit in there?

As for libcloud, we're trying to provide a DBI like thing for cloud server providers. It's not the end-all solution, but it is a clean first step towards cloud portability.

We're looking for folks who would be interested in "owning" a particular provider. Shoot us a note on the mailing list if you would like to participate! Although, patches speak louder than words. :)

If anyone is interested, here is a more detailed write-up about the crop circle. It was put together by a group of us a few years. If you zoom up really close, you can see us laying in the field nearby. Awesome to see it still getting used. :)

http://lug.oregonstate.edu/events/firefox/crop-circle

If anyone is willing to share... Who here does this solve a specific problem for, and are you actively/planning on implementing it ASAP? What is your use case? It's a sweet feature, and I can't wait to see how it manifests in the hands of hackers.

Maybe that is why they want hackers, to help create the "new news".

Pretty quiet weekend. We (cloudkick) would be happy to grab a beer with some folks in south bay (san jose, caltrain friendly) on Saturday evening if others are interested.

That is amazing! Made my fan start screaming, but well worth it!

Would you recommend this as a funding option for any of the YC funded companies?

why is that?

True, newspapers are having a hard time. However, I would still rather give my "exclusive" to the new york times.

I guess I'm just trying to say that TC is doing something wrong, and hypothesizing it is articles like this. If I was TC and saw this graph, I would be worried!

http://siteanalytics.compete.com/mashable.com+techcrunch.com...

For me, this is another reason why I feel like TC is dying. Posts seem to be getting more and more negative (lay-offs, this, etc), less about start-ups, and simply turning into a personal rant platform. Not sure if this is the reason, but something is causing traffic to slip over the past few months.

http://siteanalytics.compete.com/techcrunch.com/?metric=uv

Anyway, if I were to launch something, I would not prefer to have my product story nestled between a piece about Yahoo layoffs, and a rant about PR (sorry AllFacebook, in this case).

Would be great if the application was available via .pdf

Huh, when I hit the link it was: http://www.npr.org/templates/story/story.php?storyId=9790953...

Go Pat! Congrats on the success of the book!

We're interviewing too, I'm located in San Jose (close to the San Jose airport, if you're flying in there). I have three extra couches and even more floor space... would be pleased to put you up (or anyone else coming in for the weekend)! alex@polvi.net

even 1 cent per 1000 emails would fix it!