tswicegood

I would love to see this for Erlang!

hehe - my first comment when I saw this post was "nice, Intel caught up with Smalltalk and Erlang." :-)

This sounds vaguely familiar. It was fiction a few years ago when Cory Doctorow wrote about it. :-(

Really? I thought it was kinda funny and worth sharing. Not necessarily something I'd consider SEO spam.

I haven't used the dashboard, so I'm basing this solely on the video, but... umm, yeah, you did pretty much rip off Pivotal Tracker. You moved the Icebox over to the left, added a few new buttons, but in the demo when you start adding values and commenting it's a one-to-one from Pivotal. So much so, that I even looked at the company bio to see if someone from Pivotal Labs was involved.

Great idea, but just because you believe in an open enterprise doesn't mean you should go around lifting everyone else's hard work to kickstart your own.

EDIT: I sit corrected. The dashboard is a dead rip off of Pivotal. I just did a comparison of one of the dashboards linked above to the source of the tracker on one of my projects. Shared class names throughout, exact same structure.

I expect this out of an MBA with no idea of the culture and ethos behind dev, but someone who's at least knowledgable enough about HN to post it here. Wow, that's a new low. At this point, saying you're going to send private emails of apology isn't enough, if you want to be truly open the only way I see to repair your reputation is a mea culpa on your blog. Really disappointed.

Because it's deployed on nearly every web server and has ubiquity. If you're building a web app and you want people to be able to run, chances are good if you build it in PHP, people can run it. Would be nice to say the same thing about server-side JS.

@duke_sam: If this article from Jeffery Goldburg is to be believed, there are TSA officials on record as saying the groping is directly intended to push people through the other scanners, all the while ignoring any cavities which could hide plenty of explosives or other contraband.

http://www.theatlantic.com/national/archive/2010/10/for-the-...

I love this idea! In the PHP community we've started to have more and more talks show up on the conference circuit about getting involved, but this is even better. I bet in every major city there's people who would be interested in getting involved in open-source who aren't going to go to a conference just to find out, but they might spend a day or two some weekend doing just that.

I can't wait for the material for this to come out. It'd be great if it was on GitHub or some similar service so we there's an open source way to get people into open source.

Not explicitly tech related, but since a lot of tech folk are photographers and we all tend to fly a bit more than the average person, thought it was good info to have here.

Just wait until someone tries to smuggle something onboard using their iPad or Kindle. shakes head

I agree to some extent, but most of the time all you want is generic data. What is used to get that generic data and turn it into some format that you can consume (be those objects of data structures) is irrelevant.

That assumes the session is killed on logout. I know from first-hand experience that at least one version of Merb didn't do that. I hacked a pretty popular geo-socially site by grabbing the session cookie and playing around, then logging out. Was still able check-in after I had logged out and for good measure verified that my session was still valid after changing the password. I assume they were using the default sessions setup so I guess it expired. Didn't keep it around to see how long it stayed around.

On reporting it, the response was essentially, "oh you didn't have to go to that much trouble, you could have just used your user/pass from curl…" Completely obvious to the fact that they're app/site was completely vulnerable to session hijacking.

One of the problems of app frameworks, if you don't know what they're doing (and more importantly, not doing) you can get yourself in a heap of trouble before you even realize there's an issue. But boy, you sure can make it to market fast. shakes head

Someone correct me if I'm wrong, but that's the exact vector point for a man-in-the-middle attack. First request over HTTP gets hijacked, redirected to a "secure" server, then you (the user) see the lock and go to town, secure in the knowledge that you're communications with this server are protected because they're encrypted.

Clay Johnson's InfoVegan is quickly becoming one of my favorites: http://infovegan.com/

I wonder how long we go until there's flip-thinking in the cloud -- "use bare metal, it's retro and might make you faster..." :-)

I'm putting money on UberCab becoming a members-only service/co-op type system where you have to be a member in order to request a car. I'm not intimately familiar with the taxi laws, but I bet they don't specify what private organizations can do.

FWIW, I don't believe Jacob recommends zc.buildout any longer. virtualenv + pip is easier and more Pythonic instead of Zope-like.

You're both assuming the point got across. Reading Damien's post, I got the impression he didn't really get to convey what he thought was the right points because he "kept getting sidetracked."

Doesn't matter how good of a hacker you are, if they haven't heard of you or what you do, you still have to impress. I've known a lot of gifted hackers that sound like buffoons when they get sidetracked and a lot of mediocre (but generally very successful) coders that don't get phased by anything.

I think Damien and crew can and will get their pitch down and find a funding source in the near future. My money's on this one being one of YC's shoulda's.

Comments on the thread are good -- here's the one that pointed me to the article in the first place: http://www.webdirections.org/blog/help-stop-the-spread-of-ni...

Ahh - that makes sense. I linked to the exact article, you know, for RESTfulness and such. Still, annoying, but makes sense.

I disagree that you have to pick one language and one language only to be really good at. At least after you've become a decent programmer. As a polyglot (I can start a project comfortably in PHP, Python, Ruby, JS, Erlang, and wouldn't feel too out of place working in Clojure or Objective C), I think a "master" programmer is someone who's gotten to that point to realize that a programming problem is a programming problem regardless of language. Language is only the syntax you use to formulate your answer.

Naming the company is different than badmouthing the company. It's not like they wouldn't have the opportunity to respond here as well if they felt they weren't getting a fair shake.

For those of us not familiar with CodeModel it would be more useful if we had an idea of what you're trying to do?

Are you looking to generate code because you want to write a DSL (or full language) and have it spit out valid JavaScript? Jison (http://zaach.github.com/jison/) does that.

If you're looking for code generation just because you're coming from Java and think you need to generate code because everything is so complex and that simple tasks require 5+ classes, each implementing more interfaces than that, and… well, you're in luck. JavaScript is much simpler than that. Welcome to modern languages. :-)

Just came across these guys. Looks interesting, to say the least. Former Kiva folks involved too, so they know how to do the micro thing. Curious from thoughts/experience/feedback from other HN types that have worked with these guys.

This seems like a potentially huge man-in-the-middle hole. Preliminary reading on WISPr makes it sound like you can adjust wifi and such.

It's sad that they didn't just tack onto an existing project like Pinax and add functionality to it to handle the federated system. There was no need to reinvent the wheel, the existing ones just needed a little truing.

Glad you're already enjoying it. Thanks for the purchase. :-)

Well, I might be biased, but I think there's a place for both books on a bookshelf. :-)

The first book is aimed at getting your started down Git with little or no previous knowledge, the second book serves the same purpose assuming you have a basic grasp of VCS, but it serves a dual role as a reference.

Check out some of the excerpts that are available on the book's site to get an idea for what it looks like. The idea is that it gives you a quick reference when you're trying to remember how to do a particular task.

Correct. My first book is part of the Pragmatic Starter Kit which is aimed at people who are just starting out. There's a lot of good material in it for people who have used VCS but don't understand them well, but it starts off explaining what a repository is, what a commit is, and so on.

This book is much more concise and assumes the reader has a basic understanding of version control systems and is looking to get up-to-speed on Git.

Looks really cool - but it needs real-time collaboration. If you could pull in something like Etherpad/AppJet to it and make it editable in real-time by multiple people, then I think you might be onto something.

Ok - so welcome to last year? I recall a PyCon talk on security a few years ago where one of the speaker's first slides was a list of passwords with the text "if this is your Twitter password, change it, then change your Twitter client."

Most of these startups treat the iPhone as if it were some magical device that's plugged straight into their API. I actually participated on a Get Satisfaction thread for Gowalla where one person claimed they liked that it was iPhone only (which dates how long ago it was) because it made it "secure" and couldn't be "hacked the way Foursquare can."

Needless to say, they were disabused of that notion pretty quickly when checked in at the Gug, the Apple flagship store in London, and my home within the space of 30 seconds. It literally took 3 minutes to figure out - most of which was spent setting up my iPhone to proxy through my laptop. They were (and keep in mind, this is back when Gowalla was still iPhone only) sending everything in clear text.

They also didn't regenerate session IDs for anything at the time. I logged out and logged back in, same session ID. I logged out via my iPhone, loaded up their site and changed my password, then logged back in, same session ID. Basically, once you had sniffed one session ID you were set. I tried it a week later and was still able to use the same session ID without any problem.

It's amazing that things like session hijacking are so unknown and unfamiliar to people people relying on web frameworks to do everything for them. At the time they were using Merb---I found out by hitting an "/unknown/and/unknowable/" page and seeing their backtrace output. Session hijacking is a solved problem, why they were subject to it I can't fathom.