someone13

Another good parser is python-markdown2 [1], which has a very extensive set of test cases, and the code is very readable and well-commented.

[1] https://github.com/trentm/python-markdown2

Looks like Sublime Text 2 (http://www.sublimetext.com/2).

Since the other submission seems to have disappeared, here's the associated blog post:

https://stripe.com/blog/stripe-connect

I'm a big fan of Mynt (http://mynt.mirroredwhite.com/) - it's very simple and easy to understand, but is powerful enough to do just about anything you need.

One of my major wishlist items for Storm is an end-to-end tutorial on how to get it working for a non-JVM language. I'm not a JVM coder, nor do I know much about it, and the documentation on how to get it working for Python is hard to follow at best, IMHO.

So, if you create a customer, Stripe will check the CVC and AVS and return the results of those checks (Ctrl-F for "CVC and Address Verification Responses" on https://stripe.com/docs/api). From there, you can make a decision whether or not to create a charge for that customer.

Edit: To clarify a bit (and because I've got a couple minutes of free time), here's more details:

1. Create a customer, giving the "card" parameter with the CVC, address_line_1, and address_zip included. This can be done with Stripe.js, or whatever.

2. The returned data from the "create customer" api method will contain a "active_card" dict, with details as shown in the "Creating a new charge" section in their API docs.

3. Given this active_card dict, check the active_card. cvc_check, active_card.address_line1_check and active_card.address_zip_check values. From this, make a decision on whether to charge the customer.

4. If you've decided to make the charge, then create a new charge with this customer.

Two things:

1. bitsweet, your post below in this thread seems to be marked as [dead]

2. If the cost is solely to cover shipping / production, it would be a good idea to put this on the main page. I'm pretty sure I wouldn't sign up if I knew people were making money off this, but if there's no profit involved, I'd be more interested.

Stripe currently has a Canadian beta going, if you happen to be based there. Send them an email and ask!

Check out pythonbrew [1] - it makes installing different Pythons pretty simple. Perhaps not the best solution for a server, though.

[1] https://github.com/utahta/pythonbrew/

EDIT: pythonz is pretty good too (http://saghul.github.com/pythonz/)

Actually, I think it's a good read for all developers, irrespective of platform. The underlying message of the post above is relevant to anyone writing something that interfaces with third-party code. Not to mention, it's a good look into how one of the larger software companies approaches compatibility.

One thing that always worried me about self-driving cars - what about an emergency? For example, hypothetically, if my wife was giving birth and I needed to rush to the hospital, would I have to poke along at 50km/h and hope to get there on time? There are times when it's perfectly justified to break the speed limit (other examples: outrunning natural disasters, going to visit a dying relative, and so on).

For people's information:

"All problems in computer science can be solved by another level of indirection." - Butler Lampson

And, from what limited sources I could find:

"[above] ... Except for the problem of too many layers of indirection" - David Wheeler

Official time: 9:56AM EST, and it took place over Western Australia. Congrats to SpaceX!

Didn't want to test this, in case it's actually a problem, but the usage examples seem to include your Mailchimp key. You may want to remove that :-)

> Microsoft makes a lot of money from the security holes its own products, many of which were put there deliberately as "marketing features" that later turned out to be security vulnerabilities that apparently Microsoft finds it unprofitable to close.

[citation needed], please. I'm not being snarky - in fact, if you have a citation, I'd love to be able to use this in my discussions with others.

Some initial thoughts:

- Not a huge fan of the "Pingdom killing" tagline in the title here. It sends a negative message that's unneeded, IMHO.

- I like the main page, but the multiple black boxes that popped up are distracting from the main content. Specifically, the "we're not here now" Contact button in the bottom-right, in addition to the Support button and the Sign Up button.

- You can't drag the scrollbar on the "Edit Check" page - it selects part of the page instead.

Other than those points, some small stuff: it doesn't say how I get notifications, the "contact us" black button obscures the "Follow Us" when you scroll to the bottom of the page, and, like bhauer mentions, the color depth seems a bit much - it's almost TO flashy.

All criticism aside: I'm still using it for my personal website :-) It looks like a good product, so keep up the good work!

In short, you try to make it not worth the cyberstalker's (or troll, spammer, etc.) while. No matter how many protections you put up, if you make your service available to the public, people will be able to register and harass other users. So, firstly you make it harder for them to do this (to a degree). Some methods include:

1. Verified accounts - e.g. a confirmation email.

2. Social media (Twitter, Facebook, etc.) - obvious caveat being, some people don't have them, or won't want to sign up with them, etc.

Then, you make it harder for the cyberstalker to determine they've been banned. "Hellbanning" is a good example of this - you ban the user, but don't notify them. Everyone else just doesn't see the comment. There are variations, but the idea is to make it harder for the person on the other end of the screen to determine when to switch accounts.

Thirdly, you implement some sort of user control. For example, an "ignore" button - press this, and suddenly that user's comments aren't visible to you any more. Without notifying them, of course. Alternatively, let the project owner hellban/ignore any user from their project.

And then there's the other stuff - community moderation like Reddit and HN, automatic spam filtering, disallowing registrations from throwaway emails like Mailinator, and other stuff like that.

No matter what they implement, "please go away because you're being stalked" is NOT the right choice. There are technical solutions to this kind of thing, and if they're not perfect, they're certainly better than nothing. And at the end of the day, it's not about being perfect, it's about making the person that's sitting on the other end of the screen not want to spend the time to harass you, or post spam, or troll, or whatever else.

Yeah, Dr. Web is very well-known in Russia, and among the wider security community. They have some very talented people working for them, and, as far as I know, Dr. Web is still one of the only AVs that can disinfect the Rustock.C rootkit/virus successfully.

Worth noting that since there's no "halt" instruction, people often use an endless loop to designate the end of the program. This causes Chrome, at least, to suck up a lot of CPU.

I personally prefer Logbook [1]. It's written by mitsuhiko (author of Werkzeug, Flask, and lots more), and makes logging very easy. The whole idea of using with statements to manage handlers is a bit tricky to wrap one's head around, but I find it much nicer to use.

[1]: http://packages.python.org/Logbook/

Something I wrote a while back, using Python and PIL.

    import sys
    import math
    from PIL import Image

    def getSize(len, width):
        h = int(math.ceil(float(len) / width))
        return (width, h)
        
    def getImage(file, width=256):
        d = file.read()
        s = getSize(len(d), width)
        im = Image.new('L', s)
        im.putdata(d)
        return im
        
    def main():
        if len(sys.argv) < 2:
            print 'Usage: file2img.py <file> <output> [width]'
            return
            
        with open(sys.argv[1], 'rb') as f:
            if len(sys.argv) > 3:
                width = int(sys.argv[3])
                img = getImage(f, width)
            else:
                img = getImage(f)
            img.save(sys.argv[2])
        
    if __name__ == "__main__":
        main()

Here's a visualization of user32.dll on Windows. Notice how you can actually make out the images that are embedded in the resources!

http://i.imgur.com/7yEHR.png

It's not quite as bad as it would be in a program other than an emulator, granted, but I can't imagine that it's easy to notice a bug in a 200-character line of:

    int pos=(ram[PC++&0xffff]+X)&0xff; byte v=ram[(ram[pos]&0xff)|

And so on. It just seems like some sort of code generation would be much easier.

I really hope that code is auto-generated. Because that coding style is ATROCIOUS.

I don't know if I'd call XSS "the real bitch". I remember reading a blog post a while ago (that I sadly can't seem to find now) which recommended using a good variable naming system - something like us_blah for unsafe content, and s_blah for safe content - and only writing / storing safe content. Furthermore, the only thing that returns safe content is the appropriate escaping function, so you can look at each line and notice that "s_blah = us_blah2" is wrong.

I always wondered if it'd be possible to use the type system of a language to do something similar - make a "safe to output" type, and a "not safe to output" type, which are not mutually convertible, and then write a function that converts between UnsafeStr and SafeStr. Then, you can write all your code to only work on and only print a SafeStr.

Thanks, I didn't realize that. Specifically, this link mentions it:

http://www.zeromq.org/area:faq#toc5

Appreciate the heads-up!

Something else worth noting: from how I understand it, 0MQ isn't safe to use over the internet. Safe in your infrastructure, inside your firewalls and such, but not over the internet. So, in terms of making, e.g. public-facing API, you don't really have a good choice except HTTP.

EDIT: This is incorrect, read below.

I built a similar device myself, following instructions given at [1]. Very handy little device, for multiple non-malicious reasons. I can carry a wireless router, power supply and cable around in my jacket pocket, and you can do fun stuff like telling the wireless router to transparently send all traffic through something like OpenVPN (or Tor, if you're paranoid). Makes security in potentially hostile environments very straightforward.

[1]: http://www.minipwner.com/

For example:

    <body onload="javascript:document.evil.submit()">
      <form name="evil" method="POST" action="https://mail.google.com/mail/u/0/?logout">
      </form>
    </body>

The massive button is left as an exercise to the reader ;-)

A bit of a note regarding REST:

RESTful services are as vulnerable to CSRF as anything else. See [1] for more information (and I'm really sad that there's no second post, like mentioned). However, since RESTful services imply no state on the server (i.e. no token), the question is, how do you prevent CSRF attacks?

One really simple method is to deny all requests (on the server) with the application/x-www-form-urlencoded content type, and deny all multipart/form-data requests that include non-file parameters, which are the only two content types that can be sent from an HTML form. For your application, XMLHttpRequest can change the content type, and isn't affected by CSRF.

EDIT: Also, sort-of-related: I recommend you set the X-Frame-Options header too, in order to prevent clickjacking. Info at [2].

[1]: http://blogs.msdn.com/b/bryansul/archive/2008/08/15/rest-and... [2]: https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_respons...

I actually like that a lot - relatively short, to the point, and doesn't have any conflicting intrinsic meaning.