Amazon India is now live - <AUTHOR> http://www.amazon.in/ <comment><USER2> The key thing that people need to be aware of is that Amazon is still not allowed to sell anything in India. They are exclusively a marketplace because the Indian govt does not allow foreign investment into e-commerce.

Instead for now they are an intermediary. The end customer pays Amazon the money who passes it onto the actual seller (after taking some commission). Amazon might even handle the logistics for some sellers. But the transaction is between the marketplace seller and the customer.

Until Amazon is granted approval to become a seller on their own right, their impact on Indian e-commerce will be much more limited than it would be otherwise.

<comment><USER3> Allowing foreign investment into e-commerce can't come soon enough. The main reason the e-commerce space in India has not picked up fast enough is this.

<comment><USER4> Why do you feel that foreign investment into e-commerce is the solution?

<comment><USER5> There are many reasons. Biggest is competition works wonders for consumers.

Secondly, It creates an environment where a lot can be learn't from others.

The current environment for start ups in India is in large part due to inspiration, effect and to an extent competition from the silicon valley.

</comment></comment></comment></comment><comment><USER6> I think the key to successful ecommerce model in India is hybrid of online and offline experiences. I had the following idea floating in my mind for long time now . Let me know if it makes sense

a) You franchise out "ecommerce" physical shops. This is a physical location where customer can come in surf ecommerce websites and place an order.

b) There is someone at this shop who will collect money on behalf of ecommerce websites. This could be cash credit debit whatever. Make these shops available at every nukad (every street). Hell give other shop owners these ecommerce terminals (just like sim card selling process or prepaid minutes fulfillment process) .

c) The packages are shipped to this shop or your home. Since these shops are conveniently located, near train stations, in airports, malls, picking up packages is not an hassle.

d) serve complimentary hot tea while people are shopping.

The actual order is fulfilled at an warehouse just like amazon.

<comment><USER7> This is quite similar to way convenience stores work in Japan. You can pay at a convenience store and get Amazon to ship your goods to a convenience store. Japan (similar to India) is still very much a cash based society and I suppose some people prefer to pay in cash at a convenience store instead of paying online.

India also has loads of tiny convenience stores, I think this is an excellent idea. It also simplifies the logistics. The eCommerce company only has to build out a supply chain to the convenience store instead of having to deliver to each customer or rely on the Indian postal service.

(I have lived both in India and Japan)

<comment><USER8> In China you can have Amazon (and other major e-commerce firms) ship things to your home or office and pay in cash on delivery (for most items).

The amount of delivery people in Beijing, especially near lunch time, is quite impressive.

<comment><USER9> What's the protocol when the customer can't pay on delivery?

<comment><USER8> As far as I know, the company keeps the goods. And the more high-priced items (laptop, TV, etc.) can't be paid in cash on delivery (only credit card or Internet banking accepted for those).

<comment><USER10> In India, laptops can be cash-on-delivery. When I order from Flipkart(India's very own Amazon), I always opt for cash-on-delivery. I see no point in paying up-front when sometimes they don't have the goods and I have to wait for refunds. The delivery person carries card reader, so there is no need to carry large amounts of cash.

<comment><USER11> Mostly everything from Flipkart (and for that matter, it appears, from Amazon) can be bought cash-on-delivery.

<comment><USER10> > Mostly everything from Flipkart (and for that matter, it appears, from > Amazon) can be bought cash-on-delivery.

I know most of the things can be bough cash-on-delivery. I was responding to "high priced items viz. laptops" can't be bought cash-on-delivery.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> As a Canadian, let me just let you know you're going to have to wait a few years for it to stop sucking. Amazon Canada was a joke for most of its existence, and had only gotten close to the American offerings in breadth and pricing in the last year or two.

<comment><USER13> I wish I was as optimistic as you: I still find the Canadian store to be pretty pathetic.

</comment></comment><comment><USER14> Interesting- there's free delivery and also COD "cash on delivery"

Screenshot: <http://i.imgur.com/Og9xMtn.png>

Policy: [http://www.amazon.in/gp/help/customer/display.html/ref=mk_ss...](http://www.amazon.in/gp/help/customer/display.html/ref=mk_sss_dp_1?ie=UTF8&nodeId=201193510&pop- up=1)

<comment><USER15> The COD part is somewhat cultural. Very few people in India will trust a credit card based system that requires you to hand over your credit card number online and accept delivery at some point in the future. Cash usage in general is disproportionately higher than other forms. I think direct payments from bank accounts is next. Cards rank a distant third.

<comment><USER16> It is also the case that Debit Cards are insanely popular in India, a lot more than Credit Cards. Secondly, Online Banking (banks exposing merchant APIs) is also very popular for internet purchases as it removes the middleman.

<comment><USER17> What's an example of "banks exposing merchant APIs"?

<comment><USER16> Unfortunately, I couldn't find any documentation for these services. It is possible that the APIs are published only for the merchants who are authorized to use them, payment gateways like CCAvenue and TPSL being some of them.

</comment></comment></comment></comment></comment><comment><USER18> Interestingly amazon is in the backseat here and it will be interesting to see how they succeed. From my understanding <http://www.flipkart.com/> is the dominant player in the online shopping marketing in India

<comment><USER19> The reason they are in the backseat is that protectionist legislation prevented them from trading in India. The end result is that Indian book prices are quite high for a country with largely third-world living standards.

<comment><USER4> I was under the impression that the books sold in India (and some other Asian countries) are low-priced international editions of those books. This is specially true for college textbooks with foreign authors.

<comment><USER20> Extremely low cost and I practically(and truly) can't afford a book Amazom USA, even an eBook. So, ones that is not available in India or is available at sth like INR 3000 or 4000 or so, I pirate.

<comment><USER5> I admire your courage for saying this.

For others, this is how it always happens here in India.

On the other hand when the books are priced well. There is actually sweet spot for which Indian consumers will happily pay. For example I can quote of Rashmi Bansal's books. Especially 'Stay hungry, Stay Foolish'. It was priced so well, I hardly saw any pirated books on the footpaths people were more than happy to buy the book.

Compare this to say with a book like "Seven habits of highly effective people' there was a time when hawkers on the footpaths would have something 100 copies always stocked because the original book was expensive and pirated ones sold like hot cakes.

You won't believe this, a while back I would visit Avenue road in Bangalore and one round with foot path hawkers could give you a hint on the best sellers in the market currently.

<comment><USER20> I had bought Rashmi Bansal's book when it was released. I am not sure how high it was priced at the time but I guess it was not more than 125 or so. It was a well priced book. I think she had reduced the middleman's[0] commission to a great extent.

Funny thing about that book, you can buy it legitimately at ~90 and even street vendors(pirated copy sellers) usually sell it at 50+ and people still buy :-) I think they never got that taste of that feeling when you read a book, hold it your hand, travel with it and then over the time appreciate the crease on it and dream passing it over to your bloodline hoping they would love reading books.

Anyway, I still feel bad having to pirate any book or film or songs. Very bad. Though my next statement is technically incorrect but there are times I can't avoid pirating a book.

I have reduced my music piracy. I've reduced/ the number of songs I listen to around ~ 7GB (almost all of them 320kbps or 8-20 MB on an average). Out of them around 4GB I've purchased and to be honest a lot of them is from Flipkart's 10 day freebie bonanza, but I've purchased from other sources a lot and I must say that A 7-9 Rupee DRM free song is a deal sweeter than saccharine so I like a song and I buy it. I can even go a lot more if the cost goes directly to the artist or most and I do it. Like Indian Ocean's music. I hope in a few months I'll not have any pirated song on my pc or phone. I use Spotify so that also covers a lot.

I've not have any good and affordable[1] alternative for fils. I hope sth like Netflix/Hulu comes up in India or even a good DVD/BRay rental online shop which offers quality with a price. The ones we have don't have many worthwhile films int heir inventory.

Yes, you are right - pricing does affect privacy, in a positive way to check it. However there are people who would just pirate! Piracy is imprinted on their minds and they never bothered to check whether it's a necessity and or is there a mid-way like a friend who stopped using WhatsApp the day his 1 yr trial was over, he just had to pay INR 55 for another year. Though I should have been this judgemental, still active in piracy myself.

[0] Publisher, distributor, agent etc

[1] Again, this is my point of view and someone else can just say I can buy the movies at INR 500 a dvd and this is just an excuse to pirate.

<comment><USER21> For movies checkout Bigflix. Their subscription plan seems cheap but don't know anything about movie collection or T&C.

<comment><USER20> Tried them. The quality is at least 3-4 times worse than the DVDRips and not even mentionable in the same breathe as a BRRip.

And it used to decide to crash from time to time and then it would simply stop streaming and buffering and you couldn't do anything about that.

There's a new player in town CatchFlix. Haven't checked them.

There's also BoxTV which worse than them all.

And range sucked in all of them.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Launch infographic - [http://g-ec2.images- amazon.com/images/G/31/Press_Releases/Am...](http://g-ec2.images- amazon.com/images/G/31/Press_Releases/AmINmarketplace.png)

More - [http://www.amazon.in/b/ref=footer_press?ie=UTF8&node=159...](http://www.amazon.in/b/ref=footer_press?ie=UTF8&node=1592137031)

</comment><comment><USER23> Don't know why Kaspersky Internet Security is warning about phishing url for all the Amazon.in links. Has anyone else seen it?

<comment><USER24> I'm seeing it too. Probably people have used domains like amazon.XYZ for phishing in the past.

</comment></comment><comment> copper-horse Ah, well, they'll find the right person to pay eventually and they'll be a real business in India...

</comment><comment><USER25> Used to work in International Dev for a ecom company, and India was a serious target. We ended up going elsewhere because of delivery infrastructure and local competitors, that free delivery is going to be a huge advantage.

</comment><comment><USER26> I'm visiting India currently from the States and the biggest hurdle to launching delivery sort of services here must have been effecively locating homes.

Addresses that most "western" countries consider expected (ex. 1 Apple Loop, City, State Zip) don't exist here. Companies literally print on ads "On ____ Road, near ____ Terminal behind ______ City, State".

If Amazon somehow figured this out for India delivery - they'll do great.

Lastly, a 30 day return policy (or any return policy) is unheard of here. Electronics, clothes, anything I bought here strictly said no returns no matter what (even if defective).

<comment><USER27> I don't know how the address is a issue. Care to explain?

30 day return policy? Check out flipkart.com, amongst others.

</comment></comment><comment><USER28> Interesting that the IP address resolves to their datacenter in Ireland. I would have assumed either Singapore or Tokyo. Is there any reason that a continental connection is preferable to an.. aquatic one?

<comment><USER29> Bandwidth is very expensive in both Singapore and Tokyo.

<comment><USER28> In e-commerce, doesn't latency == $$? Is the bandwidth premium really that much higher? Or is the performance difference between the geographies negligible?

<comment><USER30> This is true for places that have good conditions and internet. You have to remember, power outages are a daily occurrences in even built up places such as Bangalore, and internet connectivity isn't crash hot anyway. Latency of the website won't have as much of an impact in these conditions (IMO, anyway)

</comment></comment></comment></comment><comment><USER31> Its good to see that amazon has price similar to similar competing website, which is mostly $2-$5, rather than US standard price $10-$14. Compare the price of bestselling books in flipkart and amazon.in from <http://www.flipkart.com/view-books/l327/> and <http://www.amazon.in/gp/bestsellers/books/>

</comment><comment><USER32> Great to see a good selection of Hindi novels, wish they were available for Kindle though. (Don't think the e-ink Kindles can even render Hindi though)

<comment><USER33> Not true, they can render hindi.

</comment></comment><comment><USER34> Finding it odd that they are using an image instead of unicode for INR, ₹. Is the browser support simply not there?

<comment><USER35> I can't see the symbol you posted, so apparently not. (both FireFox 21.0 and IE8, Windows 7).

<comment><USER34> I see it fine on Chrome (latest stable) Win 7 Pro, but that explains it.

</comment></comment></comment><comment><USER36> Looks like they have only launched with Movies and Books - hopefully other categories will follow.

</comment><comment><USER37> They plan to manage delivery too: <http://www.nextbigwhat.com/amazon-india- courier-service-297/>

</comment><comment><USER38> First point one sees on the page is so India "Genuine Products" :)

</comment><comment><USER39> What about <http://www.junglee.com/>. Thought that was Amazon's India store.

<comment><USER40> Junglee didn't sell anything but instead offered referrals to third-party seller sites[1].

[1] <http://en.wikipedia.org/wiki/Junglee.com>

<comment><USER41> Yup it is similar to google shopping www.google.com/shopping

<comment><USER42> I think they are still doing the same thing. Doesn't look like any products are actually sold by Amazon.

<comment><USER43> They're providing transaction processing, inventory tracking, and in some cases (e.g., <http://www.amazon.in/gp/product/9380349300> selected at random from the gateway) fulfillment services.

Given the scope of their 3P seller business in other markets (say, the US), this constitutes a much larger entry into the market than some comments are making it out to be.

</comment></comment></comment></comment></comment><comment><USER44> Threat to Flipkart? I think yes, let flipkart create a good market for you and now come and rule. Smart Idea!

<comment><USER45> The founders of Flipkart (Sachin Bansal and Binny Bansal) used to work for Amazon. So, I think there's no doubt of where they got the business model for Flipkart from.

<http://en.wikipedia.org/wiki/Flipkart>

</comment></comment><comment><USER46> Wasn't FDI in retail for online sales banned in India? When did that change? (If it ever was the case).

</comment><comment><USER47> Possibly dumb question, what is the difference between amazon.in and junglee.com ?

</comment><comment><USER48> WTF, only books and movies on the first day, Who wants to buy these.

</comment><comment><USER49> I hope they could enable the Kindle store soon for amazon.in

</comment><comment><USER50> Are they planning to have their own warehouse in India?

</comment><comment><USER51> Wasn't Amazon already in India under a different name?

<comment><USER2> Junglee is a product discovery site. It was basically created to give them an in with sellers within India and make feelers in Indian e-commerce until they could work out their own logistics and other issues.

</comment></comment><comment><USER52> Wow this has taken like forever. But congrats!

</comment><comment><USER20> It's the beginning so I wouldn't say "the inventory disappoints me" outright. But it does. It's not a garage startup's inventory for haven's sake.

Two friends have started a sort of startup for books and movies and their inventory is comparable, though with a shitty interface for which I have shamed them many times.</comment>


How oAuth Support Can Help Build a Better Politicial Transparency Movement - <AUTHOR> http://blog.jamtoday.org/post/72515095/a-real-example-of-how-oauth-support-can-help-build-a <comment><USER2> I don't really see the connection.</comment>


Ask HN: Is InspiroBot a real AI? - <AUTHOR> This site: http://inspirobot.me/<p>I was wondering whether it's a real AI (neural network trained with sample motivational posters) or whether they're just joking around and it's random solutions inserted into templates? <comment><USER2> I'm fairly certain it isn't. It's phrases are repeated, certain nouns or other parts of speech are used way more than I would imagine a neural network would be limited to.

</comment><comment><USER3> I'm also interested in this question, chiefly because the quotes do not seem purely "random", as some media are describing them - even in the sense of syntactically correct but random - and because there doesn't appear to be readily available information from the creators.</comment>


Extreme Design - <AUTHOR> http://24ways.org/2010/extreme-design

<comment><USER2> Sounds like a pretty cool adventure. I'm impressed that it went so well. I've never been on a team of more than about 3 people that didn't include someone who overcomplicated everything and slowed everyone down to the point that everything took 10x as long as it should have.</comment>


Namecheap Account Panel updated - <AUTHOR> https://blog.namecheap.com/ready-to-roll-your-new-account-panel/ <comment><USER2> Still listing domains I've transferred away (with no help from you).

Never mind, you still have a great name that describes your business to a tee.

</comment><comment><USER3> it absolutely blows. they totally wrecked DYNDNS. currently 51:31 deep in support chat to fix. Rich Kirkendall, call your office.</comment>


Gnome removes maximize and minimize buttons from program windows. - <AUTHOR> https://afaikblog.wordpress.com/2011/03/01/where-did-the-buttons-go/

<comment><USER4> This is hard to make sense of without knowing how the redesigned Gnome 3 desktop looks and works. You can get an idea on their website:

<http://www.gnome3.org/>

<http://live.gnome.org/GnomeShell/Design/>

</comment><comment> X-Istence I really don't use the maximise button ever, then again it is generally considered "broken" in Mac OS X anyway.

Now, a minimise button I do use, and my windows neatly get hidden away behind the icon they belong to (it's an option in OS X and I love it). Now, when I move my mouse to a corner of my desktop and activate exposé I get to see all of these windows as thumbnails.

Removing minimise is in my opinion definitely disruptive, sometimes it is nice to clear all the windows off the screen, using different workspaces is not always the right answer.

I assume that the overview they are talking about (and having read the linked email) looks and acts like Exposé does on the Mac, while nice, a lot of full screen applications and it becomes difficult to select the right window because the thumbnails get too small. The suggestion offered in the email looks a lot like what Mac OS X does.

I do hope that when Gnome 3.x is available in your standard Linux distributions that turning the minimise button back on is available.

<comment><USER5> > it is generally considered "broken" in Mac OS X anyway.

It was broken since... System 6, at least

> Now, a minimise button I do use

It's useful if you have stuff on the desktop (like I do). If the desktop is nothing but wallpaper space, then minimizing windows make little sense - <USER2> get your windows on the front (which is hard to do without a dock)

I like the drag to snap option. I only hope Gnome folks don't accidentally step on a patent land mine laid by those free-software lovers at Microsoft.

<comment> X-Istence > It's useful if you have stuff on the desktop (like I do). If the desktop is > nothing but wallpaper space, then minimizing windows make little sense - > just get your windows on the front (which is hard to do without a dock)

At times (especially at work) I will have many different windows open at the same time. Exposé at that time will become very cluttered and it will be very hard to find the window I want, minimising removes that because now the windows I do want are bigger than the small minimised ones.

From looking at more screenshots from Gnome 3 it looks like their "activities" overview is a lot like Exposé.

<comment><USER5> I tend to have them maximized, which blocks the clutter, but, then, the maximize (or "let me focus on this") button never worked properly in Macs. This is somewhat addressed with the full-screen apps on Lion.

When I have to use more than one window, I use the "Always on top" option on the WM. Since it's usually a terminal, I can make it small and leave it near a corner or on another screen.

Having said that, Xcode seems fond on lots of windows. I don't think my approach would work.

</comment></comment></comment></comment><comment><USER6> I was on the fence as to whether Gnome 3 looked good or not, and this change drops me in to the "don't want to try it" camp. I don't like Unity either (and I _have_ tried that one)... so now will I have a choice when running Ubuntu? I really hope someone maintains the old Gnome-panel system so that I can somehow graft it into future distro releases.

I use Ubuntu on my work laptop. I need to be productive on my work computer, and I just don't have the time or inclination to futz around with drastically changed desktops and unlearn 15 years of muscle memory and comfort level. My computer needs to be familiar and simple to me so that I can spend time building and deploying apps, not trying to remember how to minimize a window or what hotkey is the 'switch workspace' key (since I don't use even them right now).

<comment><USER7> You might want to try out one of the other WMs, whether thats KDE or something less well known like xfce or openbox. I've myself been using gnome just about continuously since early 2.x and I may end up switching to something else as well. A nice thing with Linux is there's always a million alternatives, giving you a good chance of finding a close approximation to what you're looking for.

Also, something I've found _extremely_ useful at both work and home is the compiz "Grid" plugin, which allows you to set up easy keyboard shortcuts for window placement. I think it can be found in "compiz-fusion-plugins-extra" on bunters. A video of it in action: <http://www.youtube.com/watch?v=cHMKhiZmlV0>

<comment><USER8> KDE 4.5+ has really come into its own, I highly suggest trying it out - I've been using it as my desktop for over a year now, and I've never looked back. One not very strong point is the KDE 4 application launcher, I'd suggest using a dock like cairo or you can configure the old gnome like launcher behavior to be default. I'm not sure how kubuntu looks, but fedora 14 and opensuse 11.4 both provide great kde experiences.

<comment><USER9> Old KDE fan where, moved from KDE to Gnome, then back and using Gnome for about 4 or 5 years now.

Last week I tried KDE 4.5.1 that comes with Ubuntu (I do so every now and then to see if I'll move back). After 30 minutes of trying to get Network Manager to start a VPN connection, and Googling for answers and reading the docs, I gave up and started the VPN connection from the command-line.

Now, I'm confused, how hard can it be to start a VPN connection? I clicked, I right-clicked, I reapplied the settings. Or it so simple that this long-time user can't figure it out?

<comment><USER8> knetworkmanager having a bug doesn't shock me, though my VPN seems fine in fedora 14 / kde 4.5.5. I did once have to start a wireless network from the command line after knm just refused. While not ideal, I'm sure you could run gnome's nm-applet instead - I don't think your vpn issue is indicative of a general kde quality issue, though everyone has their own standards. openSUSE 11.4 will be out on the 10th - it might be worth trying their livecd for a polished kde-centric view. I feel like Canonical commits most of their resources to their gnome build.

<comment><USER9> I'm thinking of just going back to old friend Debian (which I run on my Desktop). Ubuntu almost seems to be trying to be so friendly to newbies that it just gets in my way.

</comment></comment></comment></comment></comment></comment><comment><USER10> This is a huge change and whether it is better or not, it won't overcome the aversion to such a dramatic change in something most people find so fundamental.

Regardless, I'm glad to see innovation in linux gui and expect it will be disableable through some hack or another.

<comment><USER5> > I'm glad to see innovation in linux gui

I am glad we are seeing some change. We have been stuck with the same windows on a desktop metaphor since the Lisa. I understand this, at least, means someone is trying something new.

</comment></comment><comment><USER11> I thought this was silly until I read the article - as pointed out, the maximize function isn't being removed at all. Only the maximize button, which is an arguably terrible UI for the action, is being dropped in favor of dragging windows to the top of the screen.

Minimize, however, is being dropped because there's just nowhere to minimize too. I rarely use minimize and this wouldn't be a big deal for me.

<comment><AUTHOR> Minimize is also not being removed,you can do it via short cuts or right click menu.

<comment><USER11> Good to know, thanks. It appears that all they've done here is change the surface UI to make it lighter-weight by not doing things just because they've always been done. Makes sense to me.

</comment></comment></comment><comment><USER12> new devices are going to change the way we use our windowing managers. For example on my air things close and open so fast I try to close most things (especially those that remember their state) when I'm not looking at them - <USER3> don't minimise I close.

Looking at the gnome 3 design can't help wondering if someone shouldn't be thinking of putting it on a tablet eventually (or rather working on a tablet directed branch) - might meet the "open" needs of hackers more than android.

</comment><comment><USER13> This will probably be much like the Ubuntu "buttons on the left" event. Lots of whining before the change, and not a peep afterwards.

</comment><comment><USER14> Thieving garden midgets...</comment>


How Long Does it Take to Build an App? (Infographic) - <AUTHOR> http://www.ideatoappster.com/how-long-does-it-take-to-build-an-app/

<comment><USER2> Also this:

[http://readwrite.com/2013/01/09/how-long-does-it-take-to- bui...](http://readwrite.com/2013/01/09/how-long-does-it-take-to-build-a- native-mobile-app-infographic)</comment>


Kisparse – From Kismet to KML - <AUTHOR> https://github.com/mypluribus/kisparse <comment><USER2> Curious how it compares to PyKismetKML.

[https://code.google.com/archive/p/pykismetkml/](https://code.google.com/archive/p/pykismetkml/)

<comment><AUTHOR> Actually, it is based off the initial implementation of that. However, it looks like the old version is no longer being maintained. If you look at the code, you'll find the original code in the ORIGIN/ folder.

I cleaned up the function structure and added a couple features.</comment></comment>


"Facebook Business Solutions" - <AUTHOR> http://www.facebookbusinesssolutions.com/

<comment><USER2> Notice the "Sign Up" link points to ConnectU, who is currently suing Facebook? Might be a little more at work here than mere satire...

At any rate, it definitely took me a minute to realize that this was NOT real.

<comment><USER3> Heh, I also thought that Beacon was fake too. Sometimes, reality is stranger than fiction.

Alex3917, had a really good post on this. He basically said that as FB becomes more and more desperate for revenue, they'll try more and more audacious ways of selling your personal info. So I don't think this parody is that far off at all.

Edit: <http://news.ycombinator.com/item?id=86427>

</comment></comment><comment><USER4> I hear folks at facebook planned on adopting a corporate philosophy like "don't be evil" but instead decided upon "too late"

</comment><comment><USER5> Surf already exists-- it's called behavioral targeting. Of course, no one (not even facebook) is stupid enough to directly report this information back to the user or the user's friends, except in the form of targeted ads.

Image Scan actually sounds like a pretty good business plan-- once again, for ad targeting. Although there are some quality issues--- do you really want your ad showing next to someone burning one of your shoes, or a picture of a sweatshop worker?

Locate-- facebook might not be working on it, but google definitely is.

Diary-- livejournal. fb notes. 'nuff said.

Receipt-- Beacon on crack. Marketers have been chasing the holy grail of tracking customers purchases across all channels. If you've ever given a "source code" or "catalog code" when ordering from a paper catalog, that's what you're doing. Cross-channel microtargeting is the future!

One wonders if the credit card processors are doing the kinds of under-the- table clickstream-data types of deals that the ISPs are doing.

</comment><comment><USER6> Wow, for a moment I thought it was for real :)

edit: good job, BTW.

</comment><comment><USER7> Image Scan, Receipt, and Locate are all only a few years away. And in lesser forms, they could actually be cool features.

</comment><comment><USER8> Someone's going to get sued.

<comment><USER5> Protected- satire. Though a clearer "satire warning" is probably needed for true CYA.

<comment><USER9> IIRC satire isn't protected speech, only parody.

<comment><USER10> Funny, the first entry in my thesaurus for parody is satire. And vice versa.

Also, last time I checked, the first amendment protects pretty much all forms of speech.

<comment><USER9> The first amendment doesn't protect using someone else's brand with only a few exceptions, parody being one, satire not being one. As for the difference, parody:satire::sarcasm:facetious

<comment><USER10> The distinction is highly subjective. Nevertheless, its actually a somewhat interesting subject.

This paper outlines the historical legal perspective:

[http://www.abanet.org/litigation/committees/intellectual/rou...](http://www.abanet.org/litigation/committees/intellectual/roundtables/0506_outline.pdf)

Among other things, it suggests that the dichotomy of satire and parody is artificial, and furthermore should not be within the realm of the courts to distinguish.

<comment><USER9> Excellent paper. For those who don't want to download the PDF, the relevant paragraph is as follows:

"The dichotomy approach is certainly easier to apply: if the new work arguably criticized or commented on the original, a parodic character reasonably can be perceived ... and a fair use finding is quick to follow. On the other hand, if the new work used the original work as a mere vehicle to criticize something else (such as society in general), it is satire, not parody, and therefore not fair use. However, while the parody/satire distinction has become the central issue in many cases, the proper dividing line between quintessential parody and satire is blurry at best. Creative lawyers and judges have taken advantage of this blurriness..."

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> It became unreal when the status bar kept trying to ping onlinehome.us</comment>


Eloy Durán steps down as Cocoapods' lead developer - <AUTHOR> http://blog.cocoapods.org/The-captain-leaves-the-bridge/

<comment><USER2> It's been a great time!</comment>


JQuery Mobile Alpha 1 Released - <AUTHOR> http://jquerymobile.com/2010/10/jquery-mobile-alpha-1-released/

<comment><USER2> This is outstanding! The UI is beautiful and for an alpha release things seem quite polished - then again, I was checking it on an iPad, which is probably easy to develop for.

I really like the focus on wide compatibility and progressive enhancement, but mainly I like that it seems that coding with this framework will still feel like regular, mobile web development, using technologies familiar to web developers.

As opposed to a whole new framework, we get to use jQuery and jQuery UI, which many of us have grown to rely on. The prospect of using this to develop amazing mobile technologies is incredibly exciting.

Thanks for all the hard work. I'm looking forward to subsequent releases but I plan on starting to build something now!

</comment><comment><USER3> This looks great! I'm curious why they chose to use the "data-role" attribute on divs to denote page structure, like this:

...

...

...

instead of using the html5 elements already designated for those purposes (since they're using html5 anyway):
 ...
...
 ...

(see the "NEW SEMANTIC ELEMENTS IN HTML5" section of <http://diveintohtml5.org/semantics.html> )

<comment><USER4> This was due to the fact that we're targeting a lot of platforms - many of which may not be able to support those elements. For the first alpha we wanted to pick something that would absolutely work - we can absolutely re-examine using those elements, though.

<comment> todd-parker I just added this as an issue in the tracker - thanks: <http://github.com/jquery/jquery-mobile/issues/issue/209>

</comment></comment></comment><comment><USER5> Very impressive on my iPad. Love that the form toggles slide.

One annoyance is a strange page 'flash' when using the Back button. The transition appears to flash a view of the previous page. But, hey, it's alpha. (Edit: I'm referring to the Back button provided by jQuery in the header of the page, not the Back button on Mobile Safari.)

Many thanks for the work on this.

<comment><USER4> Yeah - we've noticed the 'flash' as well - we suspect that it has to do with the CSS transitions but we're still looking in to it (and it only appears to happen on some platforms, but not others, making it all the more frustrating).

<comment><USER6> I've noticed the Flash as well, on iPad Safari.

</comment></comment></comment><comment><USER7> Switch Theme functionality is broken on webOS. More testing now.

Edit: (Here are more things that are broken in quick testing)

* The back button jumps you back to the webos starting page

* Transitions and dialogs are very jerky. Stuff like slideup ends up just flashing/flickring with no actual visible transition.

* Animations unfortunately feel very Apple/iPhoneish (not a criticism, just an observation). Comparatively, the Jo framework seems to be more aware of each device platform's UI quirks.

Understanding that this is still brand new and looking forward to the improvements. Hopefully, you are in touch with the Palm dev team to address some of the issues you are encountering.

(not an employee, just a user).

<comment><USER8> I'm on webOS overclocked to 800mhz and things are pretty smooth. This has been my experience overall since overclocking. More than the experience being x% faster, its more like the bar has been cleared that makes things feel fast.

That said, I'm also experiencing a number issues -- a good number of the form elements just don't work.

Overall I'm still really impressed and excited!

<comment><USER4> Can you file a bug on the form elements? (Specifically which one(s) you are seeing the issue on) It'll help us to pinpoint the general area in which problems are happening - thanks! <http://github.com/jquery/jquery- mobile/issues>

<comment><USER8> If there is a better way to submit these, let me know: <http://github.com/jquery/jquery-mobile/issues/issue/194>

</comment></comment></comment></comment><comment><USER9> Impressive. I'm not the best tester and I haven't dug too far into each feature, but a couple of things I came across:

The toggle control doesn't want to switch back to ON fully. If you tap it from the ON position, it happily switches to OFF. Tapping it again, however, makes it act like a slider control and it refuses to switch back fully. Using it like a slider and dragging it back to ON just forces it back to OFF completely.

On the initial load of the slider control, I drug it to a position (say 78) and the clicked the text box to see if I could edit it directly. I was able too, but the number switched back to 0 instead of staying at 68. After entering a new number, playing with the slider again and going back to the text entry, it retained its value. Exiting the page and going back in to repeat the process produced a similar bug, but this time the textbox was empty and had a placeholder of "input".

On one occasion, I had a weird navigation experience: Form Elements > Clicked Slider > Went to Slider > Clicked Back > Went to Form Elements > Clicked on Checkboxes > Went to Checkboxes > Clicked Back > Went back to Slider??

On the FORM Example page that has all the different form elements on one page, clicking on nearly _any_ element that brings up the soft keyboard causes the display to scroll, however it doesn't scroll into the right position and the element you're modifying is no longer visible. Exiting the soft keyboard doesn't consistently scroll your view back to the correct location.

This was all on an HTC (Droid) Incredible, Stock Android 2.2, Default Browser.

That's all I've got so far. Still really impressed and looking forward to playing with this some more!

<comment> todd-parker Glas you like the direction of the framework. Thanks for all the detailed feedback, we need to hear about all the issues on each platform (they're all quirky) help us improve by logging each at: <http://github.com/jquery/jquery- mobile/issues>

The toggle switch was working perfectly until Friday, we had a bit of a regression on that one.

</comment></comment><comment><USER10> This is fairly impressive, I'm eager to try it out. Now, I'm surely nitpicking, but isn't the name a bit misleading?

You know, jQuery (not mobile) is not a UI framework, maybe 'jQuery UI Mobile' would be a better name.

Just saying.

</comment><comment><USER11> Awesome job. I've been eagerly awaiting the arrival of this since it was announced. I have spent the morning porting our app from using our internal mobile framework to jQuery Mobile.

First thoughts, this is really really well done. Each page is taking next to no time to change.

Secondly, is anyone noticing crashes on chromium (ubuntu)? The browser seems to crash every few minutes..

Edit: also noticed a major part of the header doc missing: <http://github.com/jquery/jquery-mobile/issues/issue/197>

<comment> todd-parker Crashing may be a memory issue. As you click around,the framework loads the new page with Ajax and adds it to the DOM. We haven't yet implemented a system to only hold X pages in the DOM and dump older ones to keep things tidy. So if you click around, the page will eventually get pretty large.

For now, you can add a rel="external" to links. This tells the framework to do a full page reload and will give you a fresh start. Might make sense to add this to certain links to ensure that the DOM is cleaned up periodically.

</comment></comment><comment><USER12> This is really great! Works perfectly and fast on my iphone. I wonder if it'll be possible to modify a current existing desktop version into a mobile version using this, if I reach the site from a phone.

</comment><comment><USER13> Is this not using hardware acceleration on the iPhone? Even on iPhone 4, the transitions are extremely choppy.

<comment> todd-parker We're using CSS transforms that are supposed to be hardware accelerated but we have a lot of optimization to do to improve the smoothness of transitions.

</comment></comment><comment><USER14> Looks great on my desktop browser (Google Chrome).

However, I tried on my Android 2.2 phone (HTC Hero) and the graphics are sometimes a bit jagged or pixelated looking, and the scrolling is also quite slow and not smooth at all. That probably has to do with the phone, seeing that HTC Hero is a slow phone, despite its 500-something MHz clock rate. I also think it's got to due with the browser being un-optimized.

<comment> todd-parker We're going to be doing a lot of optimization to improve performance on devices with less horsepower. We've been using a Google G1 as our low-end Android device for testing and see similar issues - slow scrolling, lockups, etc. because of the slow processors and limited memory.

Some of the rendering issues may be that the browser doesn't anti-alias elements with border-radius or cleanly re-size graphics. CSS gradients can be a bit expensive to render too. We'll look into that, but please log any specific issues on the Git tracker for us. <http://github.com/jquery/jquery- mobile/issues>

</comment></comment><comment><USER15> Testing it out on Android 1.5/ Motorola Backflip, looks good so far.

1\. Found that I need to check off 'Auto-fit page' - Format web pages to fit the screen in Browser settings. Without that, the elements would extend far off to the right of the screen.

2\. Flip-switch and Slider form elements have issues with long presses. If I try to touch-drag them, browser asks whether I want to 'copy/share page' the text.

3\. On Form Gallery, testing the selection box that allows me to choose 'Your state', when the choices show up, it's pretty much impossible to drag up or down. The click registers almost every time I try to touch-drag.

<http://jquerymobile.com/demos/1.0a1/multipage-template.html>

located on page [http://jquerymobile.com/demos/1.0a1/#docs/pages/docs- pages.h...](http://jquerymobile.com/demos/1.0a1/#docs/pages/docs-pages.html)

<comment><USER4> Thanks for the note about Auto-fit - will look into that. Also that demo page should be fixed now.

</comment></comment><comment><USER16> This is awesome! Thanks, John.

One thing that I find a bit unfriendly is that on an iPhone, every switch to a new page briefly shows the URL bar at the top. Other than that, everything seemed to work for me.

</comment><comment><USER17> Doesn't work on my HTC Wildfire running 2.1.

Demo page loads okay, and I can switch theme, although it's a bit flaky. However, none of the buttons go to their linked page, it just sits there on the original form. the buttons glow green to acknowledge they've been touched.

Looks great, though, and I'm off to try and run it with phonegap.

Edit: I raised a bug against this <http://github.com/jquery/jquery- mobile/issues/issue/195>

</comment><comment><USER18> also testing on webOS .. hoping for a webos theme and back gesture support (along with support for hiding the back button on pages). i'm ready to test on webOS and to contribute back.

<comment><USER4> So we're not planning on doing a webOS theme (or a iOS theme or a Blackberry theme) as we wish to create something of a unified experience across the platforms - although if you wish to contribute one, we'll absolutely accept it.

Unfortunately it's impossible to hide the back button from a web page on webOS. There are a number of limitations of the platform that are impossible to work around.

<comment><USER18> >Unfortunately it's impossible to hide the back button from a >web page on webOS. There are a number of limitations of the >platform that are impossible to work around.

i was talking about the back button at the top-left location .. that is an iPhone only feature (webos uses the back-gesture while android has the hardware-back-button). i'm looking forward to test jquery mobile together with phonegap on webOS.

<comment><USER4> Ah, gotchya - yeah, that's totally a reasonable thing to assume. We'll work on that! And thanks for the testing.

</comment></comment></comment></comment><comment><USER19> There is quite a demand for a lightweight Phonegap app that calls on remote pages, but frameworks like JQTouch don't handle remote injection of pages (breaks navigation, tapping,etc).

I hope to see JQM support this without a lot of fiddling. It would be killer to have an app that was essentially PhoneGap + JQM UI + loading of JQM- compliant pages. No XML request, parsing, mapping to UI elements needed.

</comment><comment><USER20> From a G1, Android 1.6: It's very slow. Multi-second UI hangs and then the UI becomes responsive but nothing has happened with the selection I made.

<comment><USER4> Hmm - do you have any more details regarding where the hangs happened? We were testing against a G1 w/ 1.6, as well and didn't see issues like that. If you could take a moment to file a quick bug report we would appreciate it: <http://github.com/jquery/jquery-mobile/issues>

<comment><USER20> Sure thing: <http://github.com/jquery/jquery-mobile/issues/issue/193>

<comment><USER4> Excellent - thank you!

</comment></comment></comment></comment><comment><USER21> Awesome work! Looks really great. Been looking forward to this a lot. Read through the documentation now, and will port mobile web app to this in the upcoming week, just gotta read through the source and plan a little.

I'm not yet seeing anything for special tablet layout stuff, I had expected it to jump between tablet and phone mode with media queries. Well off to read the source.

</comment><comment><USER22> If this really enables web programmers to make functional phone apps as it seems to do, I predict two things:

1) More useful apps will be out on the market with an influx of new developers. "The best will get better"

2) The amount of money earned by your average app (already pretty low) will continue to decrease as developer supply grows.

</comment><comment><USER23> 1\. just flipping great

2\. this is a dead link Developing jQuery Mobile form <http://forum.jquery.com/developing-jquery-mobile>

3\. did not see a link to download the demo files

4\. did I saw awesome!

<comment><USER4> 2\. Fixed! Thanks for the catch :) 3\. Good point - for now you can grab a download from Github: <http://github.com/jquery/jquery-mobile/archives/master>

That'll have everything in it - including the demos.

<comment><USER23> Thanks - downloaded already.

Any google maps examples on the way?

</comment></comment></comment><comment><USER24> This page does not work on BB OS 5.2 (Bold 9000): <http://jquerymobile.com/demos/1.0a1/>

It display's, but nothing happens if you click on a item. Also the 'hover' animations lag and flash multiple times.

<comment><USER4> The fact that it's displaying is a huge step up from where we were just recently. (BlackBerry 5, and especially 4 can be really rough. We'll definitely look in to this, it's one of tr platforms we want to get working for 1.0 final.

</comment></comment><comment><USER25> It's too bad they didn't include anything to get around the positioning issues when on a mobile browser and zoomed in.

</comment><comment><USER26> Looks great, but wouldn't it make sense to support Kindle's WebKit-based experimental browser too?

</comment><comment><USER27> I guess the Sencha Touch guys are up for some reeaaally good competition.

</comment><comment><USER28> running more or less smoothly on the android. if jquery and html 5 keep getting better in terms of ux then coding a native iOS or Android app might someday become unnecessary.

</comment><comment><USER29> Great news for the mobile web. Thanks, team JQuery!</comment>


Odeo - <AUTHOR> https://www.odeo.com/ <comment><USER2> At what point are current social media options too painful to encourage users to switch? Was Facebook really ever about connecting, or was it simply to entertain you with an endless feed. Of course, people value authenticity, but I have to go somewhere nobody else is, there is no authenticity to be found. A network effects catch 22.</comment>


Google Glass taking orders the 15th - <AUTHOR> http://www.google.com/glass/start/how-to-get-one/# <comment><USER2> Did they reduce the price or is glass still $1,500? I could not find this information on the web site.

I am very curious about what will be the final price for glass and more specifically, if it will be more expensive or cheaper than an iPhone or equivalent Android phone.

<comment><USER3> They sent me an email:

> This isn't the same Glass you saw last April. In the past year, we've > released nine software updates, 42 Glassware apps, iOS support, prescription > frames, and more, all largely shaped by feedback from our Explorers. The > Explorer bundle costs $1,500 + tax and includes Glass, charger, pouch, mono > earbud, and your choice of a shade or a frame for no additional charge.

</comment></comment><comment><USER4> Has the hardware been improved or are they simply slowly rolling this out?

<comment><USER5> I hope it has because right now it is pretty unimpressive imo

<comment><USER6> what makes it unimpressive?

<comment><USER4> The battery is a major flaw.

</comment></comment></comment></comment><comment><USER7> [http://imgur.com/nbS7BJo](http://imgur.com/nbS7BJo)</comment>


Movie Quotes Applied to Software Development | JavaWorld's Daily Brew - <AUTHOR> http://www.javaworld.com/community/?q=node/8026 <comment><USER2> This list was pretty good, except that I actually had to read each snippet to see what movie the quote came from. I was hoping to see more obvious quotes like "I'm the king of the world!" (Which is what I say everytime an algorithm comes together) =)</comment>


The new California digital currency bill: How Coin Center is responding - <AUTHOR> http://coincenter.org/link/here-s-an-update-on-the-new-california-digital-currency-bill <comment><USER2> Does the bill actually references cryptocurrencies?

<comment><AUTHOR> "However, what constitutes actual delivery of cryptocurrency has not been well defined."</comment></comment>


DeepMind Ethics and Society Blog – "The Case for Fairer Algorithms" - <AUTHOR> https://medium.com/@Ethics_Society/the-case-for-fairer-algorithms-c008a12126f8 <comment><USER2> This is becoming a real problem really fast. Resumes are automatically trashed because of keywords, employers sharing histories and data of previous workers is just around the corner, credit decisions, insurance costs and access to certain services will be denied based on opaque (and often wrong) ML algorithms, personalized price gouging in web stores is in the making, and who knows what's next.

What we need is a law preventing companies from treating customers differently unless there's a strong reason (ie pregnent women, age restriction) and they specify exactly why. We also need to ban companies that collect and trade personal data. Of course that's a mammoth task and the easiest way to achieve the goal is to create technological interlocks preventing leakage of personal data while busting the biggest data trading companies.</comment>


Obama Said to Outline Steps to Assure Public on Surveillance - <AUTHOR> http://www.businessweek.com/news/2013-08-09/obama-said-to-announce-steps-to-assure-public-on-surveillance

<comment><USER2> Bury it on a Friday afternoon. I do a lot of media / pr work, this is intentional.

It gives the administration the ability to have it in the headlines that "Obama is curbing NSA fears," without having enough people around to truly scrutinize his message.

Not trying to be a cynic, but they put out the declassified powerpoint slides a few weeks ago on a Friday, too. Not much scrutiny. Greenwald has been the one mostly pushing the story forward.

It's likely the only reason Obama's doing this at all is because his internal polling indicates that people are hitting the threshold of caring and he's trying to prevent the media from going too much further. Look at what the New Yorks Times editorial board said today, Obama wants to avoid more of those. He can weather Greenwald, but he needs the rest to fall in line.

He'll probably spin this as, "Bush authorized this stuff and I'm going to clean it up."

That's garbage, most of the practices were expanded under his watch.

I'm pissed and I voted for the guy twice. :-X

<comment><USER3> I voted for him too. Disappointed doesn't cover it. I know his speeches were rehearsed and all politicians just want that golden seat at the top, but i honestly thought he would follow through with a few more promises. I was actually shocked that he chose to openly back the NSA. I unvoted for him in my head that day.

<comment><USER4> Why were you shocked? He was opposed to the Iraq war, but it became clear very early on in his presidency and even during his original candidacy that his opposition was to that war specifically, and not based on some broader liberal foreign policy views. Tellingly, his response to "what would you have done?" was always "doubled-down on Afghanistan and hunted down Osama bin Laden." I distinctly remember him talking about this before he was elected, because I remember initially disliking him until I heard his strong foreign policy stance. Given that expectation, I can't say anything about his presidency (e.g. drone strikes) has surprised me (other than the general ineptitude of his DOJ--I expected a lawyer to have a better handle on that).

</comment></comment></comment><comment><AUTHOR> This was the closest article I could find on it.

Several news outlets are now hinting as of 2pm EDT there is going to be an announcement about surveillance reform.

He will appear around 3pm EDT (just under one hour from this post).

</comment><comment><USER5> It's easier and saner to just ignore every defense the government has to say about surveillance. It's all lies and reading the media's wrapper around bullshit is time consuming.</comment>


CVE-2019-5418 – File Content Disclosure on Rails - <AUTHOR> https://github.com/mpgn/CVE-2019-5418 <comment><USER2> This was fixed in 6.0.0.beta3, 22.214.171.124, 22.214.171.124, 126.96.36.199, 18.104.22.168 one week ago.

[https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6...](https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have- been-released/)

The two HN posts didn't get many upvotes though: [https://hn.algolia.com/?query=https:%2F%2Fweblog.rubyonrails...](https://hn.algolia.com/?query=https:%2F%2Fweblog.rubyonrails.org%2F2019%2F3%2F13%2FRails-4-2-5-1-5-1-6-2-have- been-released%2F&sort=byPopularity&prefix&page=0&dateRange=all&type=story)

Admittedly there is probably a lot of applications out there running outdated versions.

edit: Kind of surprising this gets upvoted while we rarely see things from exploit-db / fulldisclosure

<comment><USER3> I'm a bit confused here, perhaps because I don't really understand Rails (possibly also the HTML spec).

I was under the impression the 'Accept:' header is a list of media types, so why would that be making filesystem calls? Or does Rails implicitly organize assets in a filesystem structure (something like ~/assets/audio or ~/assets/text)?

<comment><USER4> Because the media types are parsed and used to select layout templates (layout.html.erb vs layout.xml.erb, etc).

<comment><USER5> So why wouldn't we just have a mapping between mime-types and extensions for look ups? Why bother examining the accept header beyond splitting and searching within the list? Like in such a way that we're opening arbitrary files with it?

<comment><USER4> That's essentially what the patch does; the "symbol" call only resolves for known-good mime types.

<comment><USER5> Where would this code be in the rails code base? I usually don't touch ruby. I'm mildly curious what was there originally.

<comment><USER4> In the template resolver in ActionView. It's spread over multiple files and a bit hard to follow, which no doubt contributed to the problem.

<comment><USER6> Unfortunately a lot of rails internals are like this :(.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> This is a really bad bug. Arbitrary file read on Rails applications can be pretty close to RCE. Worse still, it's present in all the mainstream versions of Rails, so it'll be lurking in commercial Rails applications for years to come. It's pretty amazing that the bug lasted as long as it did.

<comment><USER7> Notably, though, this only impacts calls which use the `file:` option on render calls, which in my experience is a relatively little-used feature. Not sure how many commercial Rails app this actually impacts in practice.

<comment><USER4> I'm not sure why people think this feature is so rare. It's like the Stack Overflow answer for "how do I render a static 404 page that doesn't go through Rails layout templating".

You have to do something wrong to have the bug --- render a file without specifying the format --- but you have to do something extra to avoid that mistake, and the feature works just fine if you don't, so I'm not surprised that we've found it in real applications.

<comment><USER8> Were I evil, I'd be looking at anyone who has upvoted or commented on such SO posts, and then looking at what companies they work for, and trying to run attacks against every site/repo/app they are linked to to see if they use this technique.

Or just, you know, looking in Github for anyone doing this and open sourcing their site.

</comment></comment></comment></comment><comment><USER9> Does the code fixing this feel a little too innocuous to other people? Reading the code it seems really unlikely I'd see this and realize that deleting it would create a severe security vulnerability:

        v = v.select do |format|
          format.symbol || format.ref == "*/*"
        end

[https://github.com/rails/rails/blob/efb706daad0e2e1039c6abb4...](https://github.com/rails/rails/blob/efb706daad0e2e1039c6abb4879c837ef8bf4d10/actionpack/lib/action_dispatch/http/mime_negotiation.rb#L83-L85)

<comment><USER10> Ya, that's one reason I rewrite the commit message to add the CVE. Hopefully people will view the blame before changing.

<comment><USER11> Don't we have tests for this?

<comment><USER12> The tests are far from obvious too [https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f...](https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f00af0c7fd632e26715#diff-10fcdd9642eb5b16366cccceb7da3116)

</comment></comment></comment></comment><comment><USER13> I put on my white hat, found a site that is probably still vulnerable with a bug bounty program, tried to run a modified query, only this time pointed at `/dev/random` and....

 _" Sorry, you have been blocked"_

 _" This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data."_

Apparently, Cloudflare's great at detecting threats. Bummer.

<comment><USER2> You could get the origin IP and bypass Cloudflare, there are many many ways to do this.

<comment><USER13> Thank you for the idea! But in general, it'd nice to be less mysterious when helping people ;) but you're right, there really are many ways to uncover the origin IP[0]

[0]: [https://www.secjuice.com/finding-real-ips-of-origin- servers-...](https://www.secjuice.com/finding-real-ips-of-origin-servers- behind-cloudflare-or-tor/)

</comment></comment></comment><comment><USER14> My thanks to the original reporter of the vulnerability, and to the Rails folks for fixing it.

I strongly recommend using at least one tool to help you know when a publicly known vulnerability is reported in a component you use. Then you can update, run your automated test, and immediately ship. Modern systems are typically mostly reused code. Being unprepared for vulnerabilities in them is a little crazy, because you know that such things will happen.

</comment><comment><USER15> I was looking forward to reading the technical breakdown here:

[https://chybeta.github.io/2019/03/16/Analysis- for%E3%80%90CV...](https://chybeta.github.io/2019/03/16/Analysis- for%E3%80%90CVE-2019-5418%E3%80%91File-Content-Disclosure-on-Rails/)

But I could not without my fans blasting and overheating my laptop. The page is using js to continuously render a moving background.

</comment><comment><USER16> The background on [https://chybeta.github.io/2019/03/16/Analysis- for%E3%80%90CV...](https://chybeta.github.io/2019/03/16/Analysis- for%E3%80%90CVE-2019-5418%E3%80%91File-Content-Disclosure-on-Rails/) is extremely distracting (especially on mobile).

Having things wandering across the screen draws the eye away from the content you are trying to read.</comment>


Most Ridiculous Site Ever? Upgrading Entire Internet To Web 2.0 in One Click - <AUTHOR> http://www.cashblasterpro.com/index.php?c=28479

<comment><USER2> I like the Script-fu generated text all over the place. We could all learn a thing or two about web design from this guy. I also like the brilliant use of testimonials. Extremely convincing, and not at all as though they were written by the same person:

"Thanks for allowing me to be a part of something that will be just as big Google!"

"I believe, hold up a minute. I mean I know web 2.0 is the future of the internet, thanks!!!"

"Wow! the prototype site of Web 2.0 technology is FANTASTIC. Can't afford to be left behind. It's real!"

I'm sold! Sign me up! Amazing!

</comment><comment><AUTHOR> __I Am Not A Part Of This Program. You Can Only View The Site With a Referral Id Entered. Just DONT Join, ONLY View __

Is this not the most ridiculous shit ever? Full Internet Upgrade?!?!? WTF

It's 3 AM, and I had to share this with everyone. I don't even know wtf to say.

<comment><AUTHOR> Had to add in the number one quote from the site:

" REMEMBER: We are upgrading the Entire Internet for FREE! Who wouldn't want to upgrade from Web 1.0 to Web 2.0 for FREE? "

</comment></comment><comment><USER3> It says "since April 1st 2008"... isn't it _simply_ a joke? That's way to ridiculous to be a serious scam...

</comment><comment><USER4> REMEMBER: We are upgrading the Entire Internet for FREE! Who wouldn't want to upgrade from Web 1.0 to Web 2.0 for FREE?

<comment><USER4> <http://cashblasterpro.com/index.php?c='>);SHOW%20tables;

Query failed : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ';SHOW%20tables;','','18.104.22.168','Array ( [language] => english ) ','200' at line 1

Looks like they learned how to sanitize spaces right. How about that apostrophe now?

</comment></comment><comment><USER5> My favorite part was at the end:

"Remember, it's FREE to join and there is NEVER any obligation to buy anything in order to earn. Just refer other free members and MAKE MONEY! WOW!

Click below to fill out the SHORT registration form!

[JOIN NOW button]

Completely Global | Safe | Friendly | Reliable | Fun | Lucrative"

</comment><comment><USER6> [http://siteanalytics.compete.com/www.cashblasterpro.com/?met...](http://siteanalytics.compete.com/www.cashblasterpro.com/?metric=uv)

</comment><comment><USER7> I think the most ridiculous part is that the website doesn't look Web 2.0 itself!

</comment><comment><USER8> a link to his stupid cashblastpro.com domain is all he wanted - and he got it :-(

<comment><AUTHOR> no no, look at my karma. I'm pretty sure the rest of the community here will:

a) Find this f'ing hilarious b) Be smart enough to NOT sign up or do anything worthwhile.

<comment><USER8> I'm not saying YOU want a link to that site, and I'm sure it's not your site. I'm saying that the owner of that site is interested in just getting links for his other make-money-on-the-web scams...

</comment></comment></comment><comment><USER9> MLM for dummies.</comment>


Light painting with temperature - cheap thermal imaging - <AUTHOR> http://www.maxjusticz.com/light-painting-with-temperature/

<comment><USER2> There might be a startup opportunity here. If these devices have a real economic use -- spotting heat leaks -- and the only available alternative is orders of magnitude more expensive.

I don't do hardware (although this project looks simple), but it would be interesting to own one of these and a lot of people like me might be willing to part with a few bucks for the privilege of owning one (especially if it helps spot leaks that are adding to the heating bill).

<comment><USER3> It's basically an IR thermometer that outputs a color instead of a number reading. Those "gadgets" are already pretty cheap, so not sure if replacing the expensive passive display with a 15 cent rgb led would make anyone profit.

I use this one for checking the oil on my pan to see if it's hot enough for my ribeye steak: [http://www.amazon.com/Digital-Non-Contact-Laser- Thermometer-...](http://www.amazon.com/Digital-Non-Contact-Laser-Thermometer- Display/dp/B008QUJILI)

If they used an rgb led instead of the read-out, you might be able to buy one for $5.

</comment></comment><comment><USER4> Previously I saw a project which used a scanning pan-tilt head to collect data, but they used a narrow beam temperature sensor: MLX90614ESF-DCI which includes a black metal barrel. <http://www.cheap-thermocam.tk/>

</comment><comment><USER5> Very clever! What would you say your cost of materials and time to assemble was?

<comment><AUTHOR> Thanks! Total cost of materials was ~$50 or so excluding the Arduino which I already had. With most projects like this one I try switching to a barebones ATMEGA328 (the microcontroller at the heart of the Arduino) if I can to save money, but in this case I needed the Arduino's onboard 5V regulator. I assembled the entire thing this evening.

<comment><USER3> why not just get an external regulator then? those things are dirt cheap, around 20 cents for one.

<comment><AUTHOR> Great point, but at the time I didn't feel like running to the store to buy one at 6:00 PM on New Year's Eve. I very well might still do exactly what you are saying!

</comment></comment></comment></comment><comment><USER6> I bet this would look pretty cool outside mixed in with some other light painting gear. Always a pain to get the background/environment the colours you want.</comment>


Fake News list by assistant professor Melissa Zimdars - <AUTHOR> https://docs.google.com/document/d/10eA5-mCZLSS4MQY5QGb5ewC3VAL6pLkT53V_81ZyitM/edit <comment><USER2> "Some sources not yet included in this list (although their practices at times may qualify them for addition), such as The Daily Kos, The Huffington Post, and Fox News, vacillate between providing important, legitimate, problematic, and/or hyperbolic news coverage, requiring readers and viewers to verify and contextualize information with other sources. "

I really appreciate the fact that she put this in here. The HuffPo is the worst offender on the list for waffling between legit news and total hyperbole.

And this wasn't much of a surprise.. she linked to another list, where the commenters are just screaming that the author is a right wing shill and a Trumpkin.

This is why we can't have nice things.

</comment><comment><USER3> That's a remarkably incomplete list!</comment>


Ask HN: Is that true startups on small business space are too crowded? - <AUTHOR>

Why ask: saw lots of big name in this space, groupon, living social, google, square, even apple ... and some "smart" products.
However: the fact is most of the SMBs are still struggling a lot on their business.
Why this happens, does it mean it need more innovation to jump in?
Or they just can't leverage the power of technology? <comment><USER2> I don't think the space is too crowded. For many opportunities, the sales force necessary and the dollar opportunities make it a significant challenge.

Groupon and LivingSocial have to maintain a huge sales force to keep new daily deals in the pipeline. SMB's aren't serving themselves.

Square is a one-time purchase with recurring revenue for the business, and a massive benefit to the business. Square also has a significant amount of money to spend on marketing.

Google is the go to solution for e-mail, so again, a no brainer.

Innovation (technical) isn't the solution to everything. I believe to break into this space you need sales innovation as well. Remember, many people in this space are non-technical, so selling them a technical solution that they don't NEED can be a challenge.

<comment><AUTHOR> I am a big fan of one point u just mention "SMB aren't serving themselves" for the groupon livingsocial like products.

I think "serving themselves" is the first step to really help them to boost their business, which must be very non-tech friendly, so that they can understand what happen there and trust the product.

The sales innovation I think might be the most challenging part, since there is almost no virality between SMB. Maybe an accurate sales targeting on the tech early adopters among them could be a potential solution, just like the accurate ad for consumers.

</comment></comment><comment><USER3> there are infinite opportunities in this space, always will be

easiest way to make money is help other people make money</comment>


Show HN: Pandascore the e-sport API - <AUTHOR> http://www.pandascore.co <comment><USER2> This is great! BUT: I think on of the biggest concerns with this right now, is reliability. Many sources that you get your data from are just heavily unreliable (I'm looking at you Valve). Our startup would heavily rely on an API like this, but I guess we'll have to wait until Valves and other API get more mature and offer solutions for websites under heavy load. I see the problem you approached here and it's definitely a big one in the community. I wish you guys best of luck!</comment>