sonnym

This is the video from the technical demonstration and explanation:

http://www.youtube.com/watch?v=R2Cq3CLI6H8

It should be noted that dustjs is not yet updated for node v0.6.x. I submitted a rather trivial pull request toward the end of October fixing the problem and another user has submitted one since then, but the author has not responded to either.

This makes me question how much the project will be supported in the future - but I suppose having a large company like LinkedIn invested in the technology is a good sign.

See: https://github.com/akdubya/dustjs/pull/36

I was merely pointing out how easy it is to fake, although you are correct a third party site could not do this.

Atwood's point is that checking the "referer" will both be unreliable and, more importantly, lead to false positives; there are better alternatives, namely, double submitting cookies as I have pointed out elsewhere with regard to this article.

You cannot assume a request is coming from a browser.

curl --referer http://www.example.come http://www.example.com

In double cookie submission, you are not issuing two requests to the server, but rather using javascript to append the session id to either the post body or the URI.

Since the browser automatically submits the cookie via HTTP Headers, single submission by itself is not safe. Since a third party cannot read the value of the cookie, they cannot recreate the proper request and will, consequently, fail.

Of course, both our methods will fail under an XSS, but should still prevent CSRF. I still think a cryptographically generated secret stored in the cookie is less guessable than a timestamp.

From http://www.codinghorror.com/blog/2008/09/cross-site-request-...

The HTTP referrer, or HTTP "referer" as it is now permanently misspelled, should always come from your own domain. You could reject any form posts from alien referrers. However, this is risky, as some corporate proxies strip the referrer from all HTTP requests as an anonymization feature. You would end up potentially blocking legitimate users. Furthermore, spoofing the referrer value is extremely easy. All in all, a waste of time. Don't even bother with referrer checks.

My bad, I thought the timestamp was being inserted into a form ala Rails' authenticity_token method in a way that would allow it to go stale if a new request was submitted in a new tab.

Although this makes sense, I feel it is not as safe as double submitting cookies, which effectively creates pseudo-random requests, but should still be safe enough in practice.

How do you mitigate problems with a user opening multiple tabs over a span of time, and attempting to submit the first one opened?

I believe the best practice is to provide the user's session id in their cookie and provide that with the requests via javascript or even at the time of page rendering. Since a third party (untrusted domain) cannot access information from your cookie, they also cannot form a valid request.

This method is called double submitting cookies.

See: https://secure.wikimedia.org/wikipedia/en/wiki/Cross-site_re...

Because you cannot issue cross-domain AJAX calls, the attacker does not have access to the response body as a string that can be manipulated.

https://secure.wikimedia.org/wikipedia/en/wiki/Same_origin_p...

While I generally agree with your sentiment, I was merely writing a brief proof of concept test in the firebug console.

From: http://www.json.org/js.html

"The use of eval is indicated when the source is trusted and competent. It is much safer to use a JSON parser."

FB is still using eval() if you look at their code. As the source of the JSON is their own service, and they can, therefore, trust it assuming proper sanitization; the same applies for my test case.

I imagine they simply remove the first 8 characters from the response string. eval("(for(;;);{})"); doesn't work, but eval("(" + "for(;;);{}".substring(8, 10) + ")"); works fine where 10 is the length of the response string.

EDIT: This is the correct idea. Search for shieldlen or safeResponse in the JS to see how it is implemented. There is always something interesting to be learned by digging through FB's client side code.

Statistics on when posts are submitted can be found here:

http://blog.itlater.com/whats-the-best-time-to-post-to-hacke...

From that, take what you will.

This reminded me of a very interesting interview with Russell Brand I saw recently, in which he discusses the error in seeking celebrity for the sake of celebrity as this ends without any real fulfillment. Instead, he advocates working in a particular field for the love of the craft (in his case comedy, although I don't see why this doesn't apply to any art that has cults of personality, e.g. programming).

Even though I am not a fan of his comedy, his eloquence and thoughtfulness on the subject surprised me.

Video: http://www.youtube.com/watch?v=0qdNBrzAQjo&feature=playe... Originally found on reddit: http://www.reddit.com/r/videos/comments/gvr1o/charlie_sheen_...

The CommonJS module specification uses the require() function to include modules. Because this function can take paths, it becomes difficult to share code between the server and the client without some workarounds.

What this module does (after a cursory glance) is:

1) intercept the request for browserify.js,

2) package all the necessary modules into a single file along with a require function that will link the modules to their identifiers, and

3) send the file to the client in a way that allows the calling document (in the case of the example, index.html) to use require() and module identifiers client side just as you would on the server side.

In short, this is a project which aims to lower the barrier between sharing code client and server side with node, as this ability to share code is one of node's greatest upsides in spite of the difficulties of doing so. I believe there are several other projects that perform similar tasks, but I have no direct experience with any of them.

Single page: http://nymag.com/print/?/health/features/46213/index1.html

I've been using an HP dv6113us for ~4 years now, with every version of openSUSE through that time span working without any deal breaking problems.

When the laptop was brand new, I had some problems with the sound drivers, but contacted someone working on a patch for ALSA and was able to test it out before it was merged. Broadcom wireless is easy on openSUSE as a script is provided, but that should be a solved problem for Ubuntu as well; NVIDIA caused some problems which were easily resolved by installing the proprietary drivers. Today it seems that Nouveau is far enough along to function as a replacement for the proprietary drivers.

That said, the laptop was a gift and were the choice mine, I would probably go with a Thinkpad.

I keep my /home partition encrypted with LUKS, which is where all my source, binaries I have had to compile myself, and even virtual machines live. I have found the overhead to be negligible for the most part and have only really noticed kcryptd using lots of cycles when doing extremely intensive operations on files. Even moving files between one encrypted volume to another over a LAN has not been cumbersome.

An idea that came to my mind watching the keynote was that, by covering upcoming concerts, Ping could become a rather powerful way of not only notifying users of upcoming concerts, but also allowing them to buy tickets.

Apple would, of course, have to work out some arrangement with the ticket conglomerates; considering the potential market I cannot imagine this would be much of a barrier.

Imagine opening iTunes and being informed of the upcoming concerts in your area based on your listening preferences, or your friends' preferences, or even being notified that your friend is attending a concert and, hey, want to buy a ticket?

In my eye, a ticket buying feature like this would be the most game changing in the long run.

Syntax Highlighting: vbnet.vim svndiff vim-rails vim-haml

Other: taglist Nerdtree matchit zoomwin dbtext

I have been working on and off on a web-based (C#/.NET) front end for MSSQL to make working with the beast easier.

http://github.com/sonnym/csmsadmin

Runs on IIS >= 5, and Mono on Apache. It does most of what I have needed for daily tasks, so it has been some time since I have worked on it; should probably get back to it in the near future . . .

This press release is significantly better than the article, sorry I failed to look for it earlier.

http://www.nokiasiemensnetworks.com/news-events/press-room/p...

There are far too many speculative comments on this story. I normally find the comments on HN to be well thought and reasoned - not rapid posting of wild rumors that are currently prevalent.

Perhaps people should wait until the facts emerge before posting more stories filled with inaccurate information.

Quick link to the WHOIS record: http://www.networksolutions.com/whois-search/rubyonrails.org

As much as I enjoyed both Pale Fire and Ada, or Ardor: A Family Chronicle, I cannot, in good conscience, let these be the only Nabokov books to be mentioned here. Having read all his nonfiction and his autobiography over the past three years, I must warn against starting with either of these, two of his most difficult, novels.

You see, Nabokov toys with his readers - he leaves puzzles throughout his books; he writes in defiance of literary criticism (part of his impetus in Pale Fire); he foreshadows with a trail of anagrams. To throw someone in media res of two of his most complex tales (perhaps only surpassed by Lolita and The Gift), might give a premature distaste for Nabokov's heady style.

What I would personally recommend for someone new to Nabokov would be any of Despair, The Real Life of Sebastian Knight, or Transparent Things.

If you like Nabokov, you may also want to try:

Rushdie, Salman - The Satanic Verses

Pynchon, Thomas - The Crying of Lot 49

First, there is an intrinsic problem with just using a person's age in years when talking about chess is that, with individuals reaching such heights at younger and younger ages, 20 going on 21 and just turned 19 becomes a huge difference in age. For instance, look at how the list of youngest grandmasters is now tabulated (http://en.wikipedia.org/wiki/List_of_youngest_grandmasters#R...). Carlsen reached the world #1 something like 18 months before Kasparov - this is a large difference on these scales.

Second, rating inflation is a continuing trend. According to wikipedia (http://en.wikipedia.org/wiki/Methods_for_comparing_top_chess...), "the average of the top 100 active player rose from 2644 in July 2000 to 2689 in January 2010, a 45 point increase." As such, we can presume that Carlsen's rating is also about 45 points inflated, and thus closer to a 2770 compared to Kasparov's 2853 - an enormous difference at that level of play. Moreover, there have never been several others over 2800. In fact, only 5 have ever surpassed that mark, and Kasparov was the first - followed by Kramnik about the time he beat Kasparov for the championship, followed by Anand, Topalov, and Carlsen. It is a highly elite club that few, even with inflation, will ever join.

Finally, of course the contests were close - that is the nature of chess. The position begins drawn, and only through tiny blunders on the part of one player does the position become unbalanced to the point of being won for one player or the other. I suppose what I mean, to be more precise, is that it is often the opinion of those within the chess community that Kasparov was, equivocally, the best chess player during the two decades beginning with his ascension to the Championship until his retirement from the game.

The original Xinhau article can be found here: http://news.xinhuanet.com/english2010/china/2010-03/23/c_132...

There are a few misconceptions about Carlsen in your comment.

The most obvious is that he is not the World Chess Champion, but world #1 - the difference being that you have to defeat the previous champion in an extended match in order to claim the title.

Second, both Carlsen and Kasparov think that Carlsen is stronger and weaker than Kasparov in certain areas. What they have mentioned to the public before is that Carlsen has a better intuitive sense of a position, while Kasparov has greater facilities of calculation. What they both agree on, it seems, is that Carlsen, in large part due to the aid of computers, has reached such a high level of ascendancy in chess at a significantly younger age than Kasparov was able.

Finally, as he plainly states in the article, Carlsen is trying not to be crazy, by living as normal a life as he can and not becoming obsessed with the game to an unhealthy degree.

Aside in relation to a response to your post, since I don't feel like posting twice: It is insanely difficult, if not impossible, to say that Carlsen would beat Kasparov - especially now that Carlsen has been using Kasparov's advise on openings against other opponents, we observers cannot tell what recent innovations have, in fact, been his original work and not that of Kasparov. Another point to consider is that, even with the amount of rating inflation there has been over the past several years, Carlsen's 2813 rating does not come close to Kasparov's maximum of 2851. Finally, Kasparov was uncontested at the top for nearly two decades, whereas Carlsen is still having troubles overcoming some other top grandmasters (specifically Kramnik of late). Unilaterally saying that Carlsen would be Kasparov in a match is, realistically, a rather uninformed opinion.

Obligatory esolang wiki reference: http://esolangs.org/wiki/Piet

I'm surprised that no one has mentioned allmenus.com - a bit menu-centric, but still lists the hours of most restaurants.

It's a spin-off of campusfood.com, so it has online ordering capabilities built-in.