talos

Interesting. I understand that popups might not be supported in certain environments, but it would seem the preferable flow in that case would be to forward to Paypal, authorize, then forward back. I just don't see any way to protect a lightbox from phishing, even if that's only on a subset of devices.

I guess I'm not up on the limitations of mobile browsers, but if they really make it so hard to expose the URL, it would seem to re-open a huge array of phishing attacks (and, once these are heavily exploited, mobile browsers will probably get better about exposing URLs.)

That's good to know -- thanks for clarifying that this is a real security concern.

Not quite. If you're not logged in, Google Wallet will open a popup (as opposed to a JS modal overlay), clearly identified as "https://accounts.google.com", prompting you to enter your username and password. The username and password are never entered under the same URL bar as the 3rd party site.

If Braintree's checkout process opened a popup window, with a clear URL bar, into which the user entered their username/password, then this would not be a problem.

When I've used Stripe payment before, I remember just entering my credit card info. I can do this anywhere, regardless of how it's branded.

If someone malicious gets my credit card info, I have a lot of ways to defend myself. Someone malicious getting my PayPal login info could be much, much more dangerous, and I'd have considerably less protection. Essentially we're talking about leaking login info here -- that's very different than credit card info.

Yeah, but those sites don't have people enter in their login/password until after they've been forwarded to an `amazon.com` or `paypal.com` domain. Try it. This is encouraging users to engage in fundamentally unsafe behavior (enter credentials for site A on site B because site B looks like site A).

Huh. I'm confused, what's to stop someone from copying the "Paypal" button and associated modal, but simply directing the form to themselves to absorb the Paypal credentials?

I suppose anyone could do this to take advantage of silly users, but this is encouraging users to trust 3rd party websites by design.

Seems wide open for phishing.

This article seems to have been automatically generated by a computer -- it makes no sense. Almost all paragraphs are one sentence, at most two.

Maybe they should focus on fixing their website so people can look up train tickets:

http://www.amtrak.com/home

It's the middle of the day on Sunday. WTF.

Update from poster: they changed it from $10,500 to $105,000.

I think it was a typo initially -- the ad originally read $10,500.

The lack of any categories for digital-era content creators (particularly noticeable in the "Writers" section) is possibly telling. Haven't been able to find out much about this group, though.

Yes. Having lived in New York for many years and visited Berlin several times in the last few, I can say that the cost of living there is skyrocketing. Also, 1/3 of the price to live in Berlin vs. NYC is a vast exaggeration, especially if you're talking about an English-speaker looking for short-term digs.

Cheaper, easier parking -> more demand for driving -> more traffic -> hard to find parking again. Plus the additional traffic.

A better solution would be to encourage the use of non-automobile transport through increased public transit investment (more service). That would free up plenty of parking for those who still choose to (or must) drive. Or to encourage ride or car-sharing, thus maximizing the effectiveness of existing parking (more people served per parked car). Also, raising the price of parking on-street would make more parking available, both by discouraging some existing parking and making off-street lots more profitable for operators.

https everywhere breaks this, because the 3rd party JS is loaded insecurely, and http://(xxx).heroku.com has a redirect rule to https://(xxx).heroku.com.

The external scripts should instead be loaded securely, or using the same protocol as the main page.

Useless for figuring out how absolutely safe an intersection is by specific mode of transit at a specific point in time, sure.

There are other uses though, you just have to make sure to take into account the unknown denominator. That's why being able to compare layers and run through time is so important.

Yep, without the denominator of how many people were using a specific mode, you can't really determine some kind of safety ratio.

In some ways, the map functions as that denominator. That's still pretty interesting. Also, it's pretty clear looking at the correlation between injuries and auto occupants how much more dangerous it is to get in a car than on your feet. :)

How is this a "bike accident"? It sounds like a hit-and-run murder, for which the driver ought be prosecuted at the very least for vehicular manslaughter.

Ooh, good one to look out for -- thanks!

Totally agreed! I wasn't the decider on the laptop, however. :/

knocked out some other stuff? gothamist/chicagoist/laist/all those other blogs are out.

no crash on safari, but SMTP error on email form.

crashed ("oh snap") in maze just a few seconds in, chrome 18.0.1025.163, mac os x 10.7.3

Disclosure: former Hacker Schooler.

Great experience. If I were asked to name one criticism off the top of my head, though, it would be "gender gap." It was my first foray into tech, and I was a bit taken aback. Now I'm acclimated, but it's great to see they've got the resources to try and tackle the gap head on. The school always draws quite a few tech-experienced people who were in nontechnical (and not male-dominated) fields. This means they can bypass the whole four-years-of-classes-with-only-dudes problem that comes with expecting any shift from academia.

for placing every moment of

the labourer's time and that of

his family at the

disposal of the

capitalist for the purpose of

greater quantity of labour

In addition to a measure

of its extension

ie duration

labour now acquires a measure

-Karl Marx

yowza that's pathetic -- they didn't even bother to efface the 'XCODE' text in the lower right, or the Apple logo on the lower left!

http://hometransformers.tv/wp-content/uploads/2012/03/hammer...

Is it just me, or is the petition broken in Chrome? It wouldn't enable the "Sign this Petition" button even when the footer said I was logged in. Safari worked, but they bound the "enter" key so that it reloads the page without actually logging you in. Thus one must click on the button. blergh.

well said. what kind of lobbying power have Google et al invested in? with their cash flow, I see no reason why they couldn't fund/push for reasonable legislation that defends their corporate existence.

is there any legal recourse against the federal government available to those who lost property in the seizure?

Yup, this is BS. On the other hand, it looks like all this pressure is having (at least a little) effect.