A brief look at async-await - <AUTHOR> https://javascript.christmas/2019/9 <comment><USER2>
      check()
        .then(result => {
          if (result) {
             // set state to finished
          }
          check()
            .then(result => {
              if (result) {
                  // set state to finished
              }
              check()
                .then(result => {
                  if (result) {
                     // set state to finished
                  }
                  check()
                    .then(result => {
                      if (result) {
                        // set state to finished
                      }
                      check()
                        .then(result => {
                          if (result) {
                             // set state to finished
                          }

                          // set state to not done
                        })
                        .catch(error =>  // set state to failed);
                    })
                    .catch(error =>  // set state to failed);
                })
                .catch(error =>  // set state to failed);
            })
            .catch(error =>  // set state to failed);
        })
        .catch(error =>  // set state to failed);

For the love of everything that's sacred, please don't do this. The strength of promises is that they can free us from that exact kind of callback hell, and they do that by being chainable.

      const resultOrNull = await Promise.resolve(null).
           then(result => result || check()).
           then(result => result || check()).
           then(result => result || check()).
           then(result => result || check()).
           then(result => result || check()).
           catch(error => null);

Calling .then/.catch inside of a .then/.catch is a huge red flag. Almost always, you want to return the promise and chain instead.

<comment><USER3> You're right of course.

But you having the "." dot one line above made my spine tingle in all the wrong ways. Not that it matters.

<comment><USER2> The dot one line above is the better style. Change my mind.

Pasting

      check()
        .then()

in node REPL gives :

      > check()
      undefined
      > .then()
      Invalid REPL keyword

Pasting

      check().
        then()

Gives the expected result.

More generally, Javascript rules about whether a newline constitutes the end of a statement or not are pretty confusing (at least for me), so I prefer using a form that makes it explicit when a statement continues on the next line.

<comment><USER4> I see your perspective but a function call on a line with just the two spaces looks like poor formatting. At a glance it doesn't appear connected to the previous line until I look at the end of that previous line.

My statements end in ; Lines that begin with something other than const or let are likely function calls. If it starts with . then it is connected with the previous line and the statement isn't complete.

But if you're consistent in that style that is all important. Better consistent style in a project than one style over another.

</comment></comment></comment></comment><comment><USER5> There should be some review process for these .christmas articles. I get it - creating tons of articles quickly is hard, but the core message should not be incorrect.

I tried to look up a github reference on the page, so I could send a PR to fix the linked article, but it is not available.

<comment><AUTHOR> We decided to keep the content in a private repo until every article is posted.

If you could share what you found incorrect, we are happy to update the article accordingly

<comment><USER5> > "thus forcing the code to be synchronous"

This (incorrect) message is then repeated again ("and act synchronously").

There are some other - minor - issues with rest of the article. I.e. asyncFunction and someFunction are not equivalent and as such can cause confusion (the same issue is in waitAndCheck vs chain.

<comment><AUTHOR> Update the article based on your feedback.

Additionally, we included a link to the "Top level await" proposal. Currently stage 3.

</comment></comment></comment></comment><comment><USER6> The article would have been better without the last example. It doesn't clarify much and it's not something that anyone should ever write.

<comment><USER7> It serves as a nice reminder that having a blog does not make a person an authority.

</comment></comment><comment><USER8> Presumably the "// set state to finished" involves a return statement, otherwise "check()" will continue to be called and ultimately the state will be set back to not done. This applies to both the async version and the chain() version. Personally I find it confusing that the comment hides a control flow statement when the text of the comment suggests that it's just setting a state variable.

Surely a better comparison for the async function would be a chain() that manually recreates the loop using a parameter or local captured variable, like shown below. They're still complex but if anything show the complexity more clearly, especially if 6 is not hardcoded but could be passed as a parameter. I suppose having the unrolled version from the article plus one of these would be best of all, to show the problem from all angles.

        function chainWithParam() {
            var checkAndIterate;
            checkAndIterate = (result, i) => {
                if (result) {
                    // set state to finished
                    return;
                }
                if (i == 6) {
                    // set state to not done
                    return;
                }
                check()
                    .then(result => checkAndIterate(result, i + 1))
                    .catch(error => /* set state to failed */);
            }
            checkAndIterate(false, 0);
        }

        function chainWithCapturedLocal() {
            i = 0;
            var checkAndIterate;
            checkAndIterate = result => {
                if (result) {
                    // set state to finished
                    return;
                }
                if (i == 6) {
                    // set state to not done
                    return;
                }
                ++i;
                check()
                    .then(checkAndIterate)
                    .catch(error => /* set state to failed */);
            }
            checkAndIterate(false);
        }

I'm not a JavaScript programmer so there could be mistakes in the above code. I'd be interested to know if there is, especially whether it was really necessary to declare the checkAndIterate variable on a separate line to its assignment.

Surely the "manual" function could be implemented with some sort of loop-like

<comment><USER7> I think most JS programmers do something along the lines of...

        function check() {
            return new Promise(async (resolve, reject) => {
                for(let i = 0; i < 6; ++i) {
                    if(await doCheck()) {
                        resolve(true);
                    }
                }
                reject();
            });
        }

or...

        async function check() {
            for(let i = 0; i < 6; ++i) {
                const status = await doCheck();
                if(status) {
                    return status;
                }
            }
            throw new Exception('failed the 6 checks');
        }

Though, the same thing could certainly be accomplished with pure promise chains. One could also use the setTimeout method in situations where elapsed time is more important than a fixed number of calls.

</comment></comment><comment><USER9> I appreciate that the author is trying to illustrate something with an intentionally contrived example, but there is really no need for "await" in his "chain()" function:

      function chain () {
        (function loop (i) {
            if (i > 5) {
                // set state to failed
                return;
            }

            check().then((result) => {
                if (!result) {
                    return loop(i + 1);
                }

                // set state to finished

            }).catch((error) => {
                // set state to failed
            });
        }(0));
      }

This is one of my pet peeve with proponents of promises actually. They come up with convoluted examples to argue against callbacks but it's not the callbacks that are a problem, but the person writing the code.

Actually, I would argue that promises really made no sense until "await" became available because they introduce extra complexity and (small) performance penalty for no added benefit. Worse, it encourages less experienced developers to write code in a serial manner in situations where this is not necessary (a much bigger performance problem).

Even with "await", the only time when it is really useful is when there have to be a several asynchronous operations that must happen serially because they use the result of the previous call. It depends on your field of work, of course, but in my experience these situations are really not that common.

Some time ago I wrote an article comparing performance of callbacks vs async/await but it is also an example to show that callback code does not have to be more tedious to write:

[https://gir.me.uk/posts/node-8-async-await-performance- test....](https://gir.me.uk/posts/node-8-async-await-performance-test.html)

<comment><USER10> > This is one of my pet peeve with proponents of promises actually. They come > up with convoluted examples to argue against callbacks but it's not the > callbacks that are a problem, but the person writing the code.

While I agree the author's examples are convoluted, the async-await code is much easier to read, write, and validate. Why bother tracking state and having to keep tracking of JS lexical scoping when you can write "boring" code that will be just as fast for the tiny iteration counts you'll be dealing with?

> Even with "await", the only time when it is really useful is when there have > to be a several asynchronous operations that must happen serially because > they use the result of the previous call. It depends on your field of work, > but in my experience these situations are really no that common.

Concurrent tasks are more pleasant with await as you can combine it with Promise.all(...) to get efficiency and legibility:

        async function doStuff() {
            // Fetch things concurrently
            const [
                foos,
                bars,
                bazs,
            ] = await Promise.all([
                getFoos(),
                getBars(),
                getBazs(),
            ]);
            // Do stuff with them...
        }

<comment><USER9> > the async-await code is much easier to read, write, and validate.

With the exception of necessarily serial code that I referred to, this statement is not true in my experience. Your "legible" example is only legible because you are not doing anything actually important like error handling and logging. In the real world each call may need different logging or even error handling logic and that is when promises really turn into a rats nest.

Validation, i.e. tests, are really the same regardless which approach you are using.

I do agree that async/await made promises actually usable, as I said above.

For running a bunch of asynchronous functions that do the same thing the semaphore + collector pattern works just fine and is not much more verbose.

<comment><USER11> >Your "legible" example is only legible because you are not doing anything actually important like error handling and logging.

        async function doStuff() {
          try {
            // Fetch things concurrently
            const [
              foos,
              bars,
              bazs,
            ] = await Promise.all([
              getFoos().then((res) => {
                console.log(`getFoos done with ${res}`
                return res
              })),
              getBars(),
              getBazs()
                .catch((err) => {
                  // handle only the error in getBazs
                }),
            ]);
            // Do stuff with them...
          } catch (err) {
            // handle any errors
          }
        }

it still isn't what i'd call "pretty" code, but it's simpler for me to read and comprehend than doing most of those things without async/await or Promise.all or other helpers like that.

<comment><USER10> I was about to write up that _exact_ example of the nested handlers.

<comment><USER11> I actually love slinging promises like that, but I tend to avoid it in most cases as there are MANY devs that would be somewhat rightfully frustrated at the code I just wrote.

As always, who you are working with matters a LOT, and if I were on a team where a good portion of the devs weren't comfortable with that style of code, then I'd use more verbose ways of doing it that are more inline with what they are expecting.

But on the rare occasion that the complexity necessitates the advanced promise stuff, or in jobs (like my current one) where all of us devs are super comfortable with promises being used like this, then it's a dream to work with them!

</comment></comment></comment></comment></comment></comment><comment><USER12> I know its kind of meta, but what's with all the blog posts lately hosted on a *.christmas domain? These posts seem to have nothing to do with the holiday

I'll admit the only reason I've noticed the domain is my corporate IT seems to have all sites on weird TLDs blocked by default :/

<comment><USER13> Apparently it's supposed to be some kind of advent calendar type thing, 25 posts in 25 days. Which explains the christmas tld.

<comment><USER3> Exactly that. Bekk, a Norwegian agency, has built a few advent calendars themed around various aspects of programming and product development. There's FP, JS, Kotlin, UX, etc</comment></comment></comment>


A Spanish quest to hand down prehistoric secrets - <AUTHOR> http://www.france24.com/en/20170501-spanish-quest-hand-down-prehistoric-secrets <comment><AUTHOR> The title is a little on the spectacular side. I found this very moving, somehow.</comment>


Lush Cosmetics website hacked, credit cards compromised - <AUTHOR> http://www.techwatch.co.uk/2011/01/21/lush-cosmetics-website-hacked-credit-cards-compromised/ <comment><USER2> See also: <http://news.ycombinator.com/item?id=2127498>

<comment><AUTHOR> Apologies, did check, but couldn't see a previous posting!

<comment><USER2> There is some value in the same story being reported from different sources - I mostly cross-reference to try to avoid split discussions. Currently there are no discussions on any of the three submissions (there was one after this)</comment></comment></comment>


Self Host a Wiki or Knowledge Base for Your Team - <AUTHOR> http://chsasank.github.io/outline-self-hosted-wiki.html <comment><USER2> Unless I am remembering wrong (and the copy stored at the Internet Archive seems to agree with me[0]), you're not allowed to use the Outline source code for production use and you're definitely not allowed to use it in a way that lets third parties contribute to it.

A non-free blob of software that requires integration with a _definitely_ non- free separate service (Slack) that I can't also self-host doesn't sound all that attractive to someone (like me) who is interested in self-hosting.

The software is pretty but those sparkly binds are a bit too tight.

0 - Had to check here since, as of writing, Github is under the weather: [http://web.archive.org/web/20200614175138/https://github.com...](http://web.archive.org/web/20200614175138/https://github.com/outline/outline/blob/develop/LICENSE)

<comment><USER3> The BSL is meant to be open source "in spirit", with the sole restriction being that you can't run a competitive hosted service because that's the only way the project sustains itself.

Internally hosting a copy for your own company is purposefully within the bounds of the license.

<comment><USER4> There's no such thing as "open source in spirit". Either something is open source, and I can use and redistribute the software per the requirements of the Open Source Initiative, or I cannot. "Open source in spirit" means, in practice, "closed source, but we probably won't sue you if we like you". While that's certainly fine for a _personal_ wiki, I would have strong qualms about using this for a business.

<comment><USER5> Open source isn't a term exclusively owned and defined by the OSI.

You can define it however you like, but that term has long been used to describe projects that don't quite fit in OSI's box.

To be clear- I think OSI has the best definition that I would like to see- but 'somewhat open source' is certainly better than nothing.

<comment><USER6> I think those of us who like the OSI definition of "Open Source" should actively push back on use of the term to mean something other than the OSI definition. I'd rather see licenses like the BSL called "source available" or some such.

<comment><USER3> Yea, at this point we're careful to only use the language of open source where it applies, for example our editor _is_ OSI compatible

</comment></comment></comment></comment></comment></comment><comment><USER7> Outline is proprietary software. [https://github.com/outline/outline/blob/develop/LICENSE](https://github.com/outline/outline/blob/develop/LICENSE)

Also, are you saying it requires you to run Slack alongside?

There are many good and free software wiki engines, I don't see why one would choose such a headache. [https://en.wikipedia.org/wiki/Comparison_of_wiki_software](https://en.wikipedia.org/wiki/Comparison_of_wiki_software)

<comment><AUTHOR> I looked at BookStack, dokuwiki, mediawiki and multiple other open source wikis. None of them are as intuitive and easy to use as outline.

<comment><USER8> Did you look at wiki.js ( [https://wiki.js.org/](https://wiki.js.org/) )?

I've been evaluating wikis too, and that's at the top of my list because it checks the boxes of having a git backend, markdown, and third-party auth providers.

Only downside is that it's NodeJS, which I'd rather not deal with given our existing tech stack, but as an internal app it should be fine.

<comment><USER9> I've installed wikijs for a small team of developers at their request.

The biggest selling point for this piece of software, compared to showing them 5 other alternatives, is that it looks good, it's eye candy. And that is exactly what I've seen people want from software like these. They want to feel good when they open it and browse, they want to see a modern look, it makes the experience of using and maintaining a knowledge base more appealing so they engage more. Feature wise it's no confluence, nor xwiki, it's just a page editor with user management, but it's quick to set up, uses extreemely little memory by default, feels fast and looks good, so they don't mind if they see some functionality missing.

Among more and more tools that I install for people I see this pattern where they are judged by their looks above features, and it's not easy for me to fully understand it... But then again I started learning and programming ruby for the same reason, it looked and felt good, so I stuck with it.

So I guess the big takeaway here is not a large pepperoni pizza from domino's, but the fact that software looks matter, a lot, and it's probably going to matter more and more in the future.

<comment><USER10> What's not so easy to understand that the looks matter?

I've gone through a list of wiki apps a few months ago as DokuWiki was showing its age, every time the demo page looked like some web from the 90's, I don't care what features it has but closed it instantly.

I do full stack web but I make sure it's also visually pleasing for anything I build because there's no reason to give users eye pain.

I'd rather think that anything that doesn't look good means the author had no time for visual adjustment as the internals still has a lot to be desired.

</comment></comment></comment></comment></comment><comment><USER11> 2003-2006 my team used Lotus Notes as our team wiki. It was so much nicer than an actual wiki if only because there was a tree view on the left and it would highlight in bold anything that had been updated since you last read it.

The tree view also let you see the entire content rather than just a random bunch of pages you might have to spider through to find things.

Any wikis do that? Track individual reading? and which ones have the best non- techie UX where I can easily add images, diagrams, video, without having to jump through hoops?

<comment><USER12> > Any wikis do that? Track individual reading? and which ones have the best > non-techie UX where I can easily add images, diagrams, video, without having > to jump through hoops?

OneNote - while not a real wiki in my opinion - was close enough and could do this and I sometimes recommended it to Microsoft centric clients of mine.

Now they are leaving the version I liked behind but some people might enjoy the new version.

<comment><USER13> I wish One Note allowed markdown blocks, I like how easy you can paste things like pictures and drawings, but it does not work well for stuff like code blocks.

<comment><USER12> Off the top of my mind tagging is also a weak spot (it insists on users using one of a number of defined tags, and while tags can be added it takes time and you also cannot type them out but have to rely on clumsy nested dropdows for all but the top 10 that can be reached via keyboard shortcuts.)

I'm fairly certain there was more problems but all in all OneNote still used to be a good solutions for smaller companies that was stuck in Microsoft land anyway.

</comment></comment></comment></comment><comment><USER14> I started using mediawiki as a personal knowledge base and it's working very well for me.

Working with categories is still on the todo list for me, as I would like something similar to a tree-view, but I'm in no hurry.

Also, I plan to play with mediawiki's API to see how far I can go.

<comment><USER15> what kind of backups do you make, just regular database dumps?

<comment><USER14> I take a snapshot of the underlying zfs dataset.

</comment></comment></comment><comment><USER16> There are dozens of good open-source wikis available. Getting one set up is generally less than an hour's work.

Getting people to contribute can be a problem, but if the workflow is easy and there are things to document, it will work out.

Cleaning up after the fact is usually a bigger problem. Even with full-text search (a requirement, IMO) a large wiki can become a terrible dump. Library science is a real field, and if you can afford a librarian, you definitely want one.

<comment><USER17> > Getting people to contribute can be a problem This is so spot on. and I > don't think it even has to be a problem.

The way people actually work is they 1) write a ton of private notes 2) share a small amount of these notes ad-hoc 3) publish a tiny amount of this to a wiki

To make knowledge more available, the key is to streamline these steps.

Building an app that's grounded in this workflow. Would love to hear the community's feedback on it.

[0] [https://bytebase.io](https://bytebase.io)

</comment></comment><comment><USER18> > We experimented with TiddlyWiki. [...] But its non linear organization makes > it super unintuitive and confusing.

The main reason I like TiddlyWiki is precisely because it is so simple and easy to use.

<comment><USER19> TiddlyWiki is ideal for a few scenarios I work on.

1\. It's great as a notebook for organizing a creative endeavor like tabletop roleplaying. 2\. Its tagging querying capabilities are robust. So robust that I've had success using it to tag media and run complex queries (e.g., select all items having tag1 and exclude items having tag2 and exclude items with value "value1" for key "key1") to where I can use it to manage media

</comment></comment><comment><USER20> For a small startup team, we now simply do this as Markdown files in our monorepo.

Some such Markdown files correspond 1:1 with code, and (for things like devops processes with a script component), are named the same, or with the same codename, often with just the filename extension differing. Other Markdown files have names like `ops/aws.md` and `20200713-foo-braindump-meeting- notes.md`.

Normally, these are in the git main branch (unless some documentation addition/change is really tied to changes in a development branch).

Just putting it in the repo means one fewer place people have to look (or not see) for important info. GitLab handles all the version-preserving, awareness of changes, etc.

I usually use GitLab Web IDE for quick changes, and my favorite file editor for bigger changes.

I do this after previously using wikis for key information, and decided that the monorepo is simpler, and seems more likely to be kept updated. (I previously loved wikis, and wrote an Emacs mode for one of the wikis when I used it at a well-known company, but I'm liking the monorepo approach even better for the current startup. [https://www.neilvandyke.org/erin-twiki- emacs/](https://www.neilvandyke.org/erin-twiki-emacs/) )

</comment><comment><USER21> If you're already using Google docs internally then [https://youneedawiki.com/](https://youneedawiki.com/) is a great front end for a quick and easy wiki

</comment><comment><USER22> If you like low-tech [https://dokuwiki.org](https://dokuwiki.org) (PHP, no- DB).

<comment><USER23> Been using DokuWiki for personal worklog and team notes for ten years. Love it.

</comment></comment><comment><USER24> I appreciated the design of Outline, until I looked at their website and found that... it's a complete rip-off of Notion?

I've been using Notion for a while, and the commands/block mechanism has been bothering me the most. I don't think it's the way forward for WYSIWYG markup editors.

</comment><comment><USER25> Others have already pointed out that outline is not really open source, so I will just link to the one alternative that worked for me as a self-hosted, open source (straight AGPL) alternative to Confluence: [https://documize.com](https://documize.com)

<comment><USER26> Also worth noting that Outline's license seems to come from the future:

      Change Date:          2023-07-03

<comment><USER27> That's the date when the licensed software becomes GPL-compatible. That's the main feature of the BSL.

</comment></comment></comment><comment><USER28> [Bookstack]([https://www.bookstackapp.com/](https://www.bookstackapp.com/)) has been working very well for us. Lots of great features and good UI. Also it integrates with LDAP and is open-source.

</comment><comment><USER29> I looked into self-hosted wikis for our team earlier this year. Outline looked very promising, but as the author here mentioned, the documentation was indeed lacking. It seemed to me that they're more intent on pushing their paid plans.

Ultimately we landed on BookStack ([https://www.bookstackapp.com/](https://www.bookstackapp.com/)) and people in our org love it. Deployment instructions were pretty easy to follow for someone who doesn't do many server deployments, the UI is great, and the feature set is sufficient for our needs. Plus, the lead developer is extremely helpful in answering questions on Discord.

<comment><USER30> BookStack creator/lead dev here. Great to hear your users like the platform and that installation was smooth. Hope the platform works well for you going into the future.

<comment><USER31> Thanks for creating such a great product. After trying (and being dissatisfied) with many different self-hosted Wikis, we stumbled on BookStack - and never looked back.

</comment></comment></comment><comment><USER32> Interesting. I am currently building a personal self-hosted knowledge base program that uses ElasticSearch to find and organize your data but is also synced into your filesystem with markdown files. So you create a new file in your data/ dir and it will automatically create a new search index that you can view in the software's ui.

It also allows you to have bookmarks where it actually downloads the contents of the bookmarked webpage to make sure it's preserved on your own system.

</comment><comment><USER33> Quite surprised it hasn't been mentioned here yet, but Wiki.js [0] is absolutely phenomenal. We use it in our research group as a team knowledge base, using LDAP authentication and scheduled backups to our GitLab instance. It's open source software that, in another era, we would have paid $10k for a license.

[0]: [https://wiki.js.org](https://wiki.js.org)

<comment><USER34> Has wiki-style linking been added yet? I gave it a trial run for several users and was baffled by the lack of linking features (short syntax, autocomplete of existing paths, highlight non-existent endpoints) which I consider part of the essential functionality of modern wiki software.

<comment><USER10> You can link to another page by selecting from the list of existing pages.

Why do you want to link to a non existing page? You can create an empty page first and link to it.

</comment></comment></comment><comment><USER35> I for one have had a huge success for my private note taking as well as my own team's collaboration with BookStack. [https://www.bookstackapp.com/](https://www.bookstackapp.com/)

</comment><comment><USER36> Has anyone used the GitHub wiki as part of a professional work group? Wondering how that went? If you're already using paid github it seems no brainer.

<comment><USER37> We tried. But github search is such a joke that it's basically impossible to navigate; hence looking for something else now

<comment><USER38> That's also been my experience. To be fair, most of today's search engines suck really bad. No exact match, no special symbols, no wildcards, etc. The power user had better tools at their disposal back in 1999.

</comment></comment></comment><comment><USER39> The main problem with Outline is that it does not support collaborative editing. That's a deal-breaker (for our team at least).

<comment><USER40> Hey hey — I'm an Outline contributor (OS, not part of the company). It's on the roadmap, a big part of the reason for a major recent rewrite of the underlying engine was to set up support for live collaborative editing.

</comment></comment><comment><USER41> Why do you need slack for a wiki?</comment>


Assemblino.js - Modeling and Simulation for Robots and Mechanisms - <AUTHOR> https://assemblino.com/ Newborn online tool for building simple models of robots and simulate them, with JavaScript, and some drag and drops.
Requires WebGL, Chrome recommended.
GitHub repository: https://github.com/nrox/assemblino.js
Consult docs: https://assemblino.com/docs.html
Check the database (ongoing work): https://assemblino.com/explorer.html
Examples: Neural Network and Robotic Arm: https://assemblino.com/show/public20123372.html
Servo with brackets test: https://assemblino.com/show/public18979576.html
Multiple servos: https://assemblino.com/show/public19060338.html <comment><AUTHOR> Newborn online tool for building simple models of robots and simulate them, with JavaScript, and some drag and drops.

Requires WebGL, Chrome recommended.

GitHub repository: [https://github.com/nrox/assemblino.js](https://github.com/nrox/assemblino.js)

Consult docs: [https://assemblino.com/docs.html](https://assemblino.com/docs.html)

Check the database (ongoing work): [https://assemblino.com/explorer.html](https://assemblino.com/explorer.html)

Examples: Neural Network and Robotic Arm: [https://assemblino.com/show/public20123372.html](https://assemblino.com/show/public20123372.html)

Servo with brackets test: [https://assemblino.com/show/public18979576.html](https://assemblino.com/show/public18979576.html)

Multiple servos: [https://assemblino.com/show/public19060338.html](https://assemblino.com/show/public19060338.html)</comment>


Four in 10 Americans Believe in Strict Creationism - <AUTHOR> http://www.gallup.com/poll/145286/Four-Americans-Believe-Strict-Creationism.aspx <comment><USER2> "the 40% of Americans who hold the "creationist" view that God created humans as is 10,000 years ago is the lowest in Gallup's history of asking this question, and down from a high point of 47% in 1993 and 1999."

Here's the trend for the last decade:

2000: 47% God created, 40% evolved with God's help, 9% evolution without God's involvement

2010: 40%, 38%, 16%

</comment><comment><AUTHOR> I can't imagine this is true. I would say the made up the study to be more interesting.

<comment><USER3> The study is true, sadly. If it was about basic geography the results would have been even worse. A surprisingly large number of Americans cannot find their own country on an unlabelled map.</comment></comment>


Macedonia changes name, ending bitter dispute with Greece - <AUTHOR> https://www.theguardian.com/world/2018/jun/17/macedonia-greece-dispute-name-accord-prespa <comment><USER2> I continue to regard this as the stupidest geopolitical dispute our reality can safely support.

<comment><USER3> What would it mean for Portugal if Spain decided to change its name to Iberia?

This is exactly what is happening here. They want to be named after a geographical region which is way bigger than their borders.

<comment><USER4> Yea, it's as silly as a country claiming to be the "United States of America" when lol, Canada and Mexico and all of South America would like a word...

<comment><USER5> I eventually figured out that this is largely an issue with terminology.

In Central/South America, it's generally taught that everything from Nunavut to Cape Horn is a single continent, America. When the US calls itself "America," that's seen as a deliberate attempt to claim primacy over the whole continent.

In English-speaking North America, it's generally taught that "America" is the country and "North America/South America" are the continents, so we're befuddled by the irritation.

This is why Canada, actually, doesn't appear to have an issue with the "America" thing.

<comment><USER6> >in English-speaking North America, it's generally taught that "America" is the country and "North America/South America" are the continents

aaaaaand you don't see any problem here, no?

Let's try again. With that logic, there'd be no problem with Germany calling itself "Europe":

"What's the problem? When we say 'Europe', we mean our home country, a large part of the region known as 'Western Europe', and disjoint from 'Eastern Europe' \- everybody here is befuddled by why the Greeks are upset! The Austrians are totally on board with it, by the way."

<comment><USER7> Words can mean different things in different languages and different contexts.

In English-speaking cultures, North and South America are separate continents. "America" is understood to mean the USA. The polite term for someone from the USA is "American". Calling a Canadian "American" is impolite.

In Spanish-speaking cultures, América is a single continent. "Estados Unidos" is understood to mean "de América", not "Mexicanos". People from the USA are commonly called "estadounidense", "norteamericano", or "americano". It's polite for outsiders to use "estadounidense".

Neither language is indigenous to the Americas, so why not just use the polite words in each language?

</comment></comment></comment></comment></comment></comment><comment><USER8> Considering how strong nationalistic propaganda is these days in the Balkans, if this thing passes all the referendums, etc needed to make it a reality, it will be a huge win. Congrats

</comment><comment><USER9> I really hope things change for the better. Being from the north of Greece I know first hand the difficulties with the name. I am very passionate about it but I understand we live in a different world. My feeling is that the Greek government and their NATO, EU allies pushed this forward now in order to stop the imperialistic plans of Erdogan in the region. I think with more Balkan countries in the EU, NATO influences start and stop with the West not the Russians, not the Erdoganites.

<comment><USER10> >I am very passionate about it

Could you perhaps expand on this a little? I have a very hard time understanding why someone would be passionate about something like this.

<comment><USER11> FYROM is a neighboring country to Greece. For the last 20+ years, the two countries were on a stalemate on this. Greece did not invest much into their northern neighbor. Turkey with Erdogan has more economic involvement in FYROM than Greece, even if there are no traditional links between them.

<comment><USER4> I don't think the question was "what is Macedonia" but more like "please explain why this matters to you".

</comment></comment></comment></comment><comment><USER12> "...ending...": in fact, it has just begun.. There's a long way until this 'agreement' becomes a 'reality' (referendum and constitutional changes in FYROM and then vote in both parliaments). But most importantly the will of the people has been ignored so only the near future will show what will actually happen.

For a historical reference about this issue and the Greek identity of Macedonia: [https://history.stackexchange.com/questions/6265/was- alexand...](https://history.stackexchange.com/questions/6265/was-alexander- the-great-greek-or-macedonian)

<comment><USER13> Which will of which people was ignored?

<comment><USER14> Both.

Nationalist Greeks are angry and so do nationalist Makedonians.

I would think both countries have more important things to protest about than name change, but then I don't live on Balkans.

<comment><USER15> Will of the people != will of the nationalists.

Can't really say the will of the people is being ignored when referenda are planned, referenda which one can reasonably still presume will be binding.

<comment><USER16> Both Greece and Macedonia are national countries, so in this case will of the people == will of the nationalists.

<comment><USER4> Greece probably shouldn't have elected an anti-nationalist governing party then.

<comment><USER16> Some nations have home: their own country, so in these cases people == nation, and will of the people == will of the nation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> A total embarrassment for both nations that it lasted so long.

<comment><USER11> It has been a big embarrassment.

The 'macedonian' (irl: south slavic) language was recognized as a language in 1977 at a UN standards meeting that took place in Athens.

When Yugoslavia was broken in pieces, the issue of the name for FYROM should have been resolved then and there. The most promising name was North Macedonia. Oh the irony.

<comment><USER18> I think that relative to the other issues that occurred with other former Yugoslav republics, a naming dispute was easily ignored at the time.

</comment></comment></comment><comment><USER19> I personally do not care about the naming. Name each place / country whatever you want. What I care about is the political games that are being played behind it.

People in this thread miss one point about FYROM, they want to use the name Makedonia with relations to the ancient Makedonas. Which in turns creates issues with the Greek nation.

Now with the new "deal" they will take the name North Macedonia but they strictly mention that they do not have any relation to the Ancient Makedonas. So at the end of the day, why didnt the two goverment or EU or UN take 20 historians and ask them, "guys do they bare the right to have that name?" Whatever the historians say should be the verdict.

Now as for the name, there is a reason it is being pushed right now. The balkans are a chessboard for many many years and we will see soon the effects on "North Macedonia".

<comment><USER20> > Now with the new "deal" they will take the name North Macedonia but they > strictly mention that they do not have any relation to the Ancient > Makedonas. So at the end of the day, why didnt the two goverment or EU or UN > take 20 historians and ask them, "guys do they bare the right to have that > name?" Whatever the historians say should be the verdict.

The name Macedonia expanded to cover the modern country of Macedonia sometime during the Roman Empire. The historians (well, everyone but the Greeks) would all agree that there is absolutely no issue with calling the modern country of Macedonia from a historical naming perspective. Sure, there's confusion between the Slavic-speaking Macedonians and the Hellenic-speaking Ancient Macedonians, but this is far from the only instance of the same name referring to completely different entities.

<comment><USER3> As you said the Macedonia region covers way more territory than the territory of the modern country. Add to this the fact the nationalists want the modern country to eventually gain all these territories. And before you claim, that these people are minority, having been there it seems that a lot of people share these feelings. For example you can see everywhere maps where the borders of the modern country are way more expanded including a huge part of Greece.

<comment><USER2> > _Macedonia region covers way more territory than the territory of the modern > country_

Should people in Western Turkey get pissed off about Greece calling itself Greece?

<comment><USER21> Are you aware of Cyprus?

</comment></comment></comment></comment></comment><comment><USER22> So can Luxembourg claim the Belgian province of Luxembourg back then?

<comment><USER23> Greece didn't claim the country for itself, it claimed the _name_ for it's own northern province.

<comment><USER22> Greece's logic in disapproving of the name Macedonia is that they fear that Macedonia (the republic) could some day claim the Greek province of Macedonia. By that logic, so should Luxembourg (the grand duchy) be able to claim the Belgian province of the same name.

<comment><USER24> There's a difference though, in that the province of Luxembourg was indeed a part of Luxembourg (the country) not even 200 years ago. So it would be a much more legitimate claim.

<comment><USER25> I don't think the rich Grand Duchy would be terribly interested in acquiring the empoverished Belgian province.

</comment></comment></comment></comment></comment><comment><USER26> > By agreeing to rename itself the Republic of North Macedonia the country > will replace an interim accord under which it joined the UN 23 years ago as > the Former Yugoslav Republic of Macedonia.

> The agreement means Skopje will need to make more than 150 changes to its > constitution before Greece brings the pact before its own parliament for > ratification – a task replete with challenges for Zaev, who like Tsipras has > taken a progressive view on the issue, and faces considerable opposition > from nationalists. Macedonia's president, Gjorge Ivanov, has refused to > support the deal, presaging a stormy few months ahead.

Seems silly that a name change means that legal agreements have to be re- ratified.

<comment><USER27> They should've used a _COUNTRY_NAME_ global variable.

</comment></comment><comment><USER28> In Greece there's quite an uproar for this agreement. 70% of the population is against it and in the northern parts of the country the government's acceptance rates have dropped to single digit percentages.

<comment><USER29> This is just a poll from a right (I would argue even far-right) paper, so better take it with a grain of salt.

<comment><USER28> True dat

</comment></comment></comment><comment><USER30> Relevant:

[https://en.wikipedia.org/wiki/Demographic_history_of_Macedon...](https://en.wikipedia.org/wiki/Demographic_history_of_Macedonia#Macedonian_Question)

</comment><comment><USER31> If their troll game were more on point, they could have gone with "SuperGreece".

</comment><comment><USER32> Yet Guardian still calls it macedonia though

<comment><USER11> It makes you wonder if anything will change when this agreement gets implemented.

The official name is still FYROM and will switch to North Macedonia when the agreement starts getting implemented. In a few months or so.

</comment></comment><comment><USER33> So, naming is important, then?

Would never have guessed that.

</comment><comment><USER34> I was born in what was then Yugoslavia (now North Macedonia). In order to get a good full perspective of this issue I think you have to talk to several Greeks and North Macedonians. This has been my perspective and experience:

It's mostly split between the population -- half (probably most) of us don't really seem to care about this issue, the other half feels pretty upset about it. It's really important to note that not a single Macedonian I've ever talked to has ever claimed that Ancient Macedonia isn't part of Greek history, I really don't know where Greeks are getting that from. Almost everyone here goes to vacation in Greece every year, and concedes when some Greeks say "Skopje?" to suggest that we're not Macedonians. We just nod and shrug it off, and say "Yeah, Skopje". Most people really don't care about this, if we did we wouldn't be going to Greece on vacation or buy Greek products, both of which we do a fair amount of. Some of us even wonder why we're celebrating a serial killer at all (Alexander the Great). In order to understand what's going on, I think you need to separate yourself from what politicians are thinking and doing compared to what the people are thinking and doing. Also let's face it, governments love to manipulate group identities to serve their interests.

What Macedonians are upset about is that they feel like Macedonia has a shared history and Greece doesn't want to acknowledge it, and it's leveraging it's strong international influence to set us back and/or make us look bad. We're a small, formerly communist, landlocked country in the Balkans, we barely have any international influence at all. It's a no-brainer that most countries will side with Greece, and why there's EU pressure for us to change the name. We definitely wouldn't be able to dispute Greece's territory, especially since 1952 when Greece became part of NATO. We're seriously no threat to them even without NATO. I don't think this is about the name or territorial ambitions, or if it was it was like that a long time ago and is no longer relevant. It's deeper than that.

People on the thread and the previous one have talked about the Balkan Wars being relevant to understanding this, and that the then conservative Greek govt in the mid-20th century suppressed a lot of North Macedonian speaking peoples living in Greek Macedonia to force them to say that they're Greek and that they can't speak slavic, much like how Bulgarians forced us to say that we're Bulgarian and speak Bulgarian when we were occupied by them, or how some people think we should be part of Greater Albania, or how some Serbians view us as South Serbians, and that Greece wants to cover this up. There's probably something there to look into, the Balkans is full of territorial grabs like that. I don't really know anything about this part of history.

A lot of us just feel like we're being bullied to an extent, and that Greece is basically being a d*ck about it. Ancient Macedonia has mostly been part of Greece, but Paeonia (North Macedonia) has for a large part of it's existence, either been a dependent territory of Ancient Macedonia or has been fully a part of Ancient Macedonia when it was at the height of it's power. We didn't just pull the name out of nowhere, we've been called Macedonians since forever. Some of us that are upset about this think that we shouldn't be giving in to powerful external forces and that we should just make a stand. And that by giving in we're showing ourselves as weak and easy to manipulate, and would affect future negotiations. Some of us others think we're being stubborn, and that we should be the bigger person and just concede, because it's a pretty stupid dispute and I agree. A lot of us just don't care, or if we used to care we're jaded now after all this time and don't care anymore.

We have a lot of shared history, we're neighbors after all. We don't have the same language, sure, but our traditional dress and textiles looks similar, our dance is similar, we both say "Opa!", we have similar traditional food. We used to be the same country several times in history, during the Roman, Byzantine and Ottoman Empires. I don't think this is really about the name, it's more about that North Macedonia is mostly made up of slavic people with a large Albanian-Macedonian population and from a formerly communist country, and Greeks just don't want to be associated with former communists or slavic people.

It really sucks because I like a lot about Greek history and culture, one of my favorite college professors taught Greek Philosophy to me. Greeks gave us democracy and the best philosophers along with India and China, all of which is still extremely relevant today. I'm glad we've come to a consensus about the name. We've both wasted a lot of energy over something pretty stupid, and we really should be getting along a lot better. We've wasted our time with what could've been quality time with our families or more richer life experiences, or improving the human condition. Nationalism, tribalism and groupthink are all diseases that I hope the 21st century will rid itself of.

<comment><USER35> Greek here.

The term 'Macedonia' does not refer to a geographical region only. It refers to a geographical region plus the connection to ancient Greece.

Slavic people like you have no right to use the term Macedonia, because you are not related to Macedonia, the ancient-Greek derived sub-ethnicity. You only live in Macedonia, you are not a Macedonian.

History is full of examples of people that moved to other areas but did not 'steal' the history of the area they ended up into.

Turks moved to Ionia, they didn't become Ionians. Greeks moved to Pontos, they didn't become Turks. Spaniards moved to America, they didn't become Indians. British moved to Australia, they didn't become Aboriginals.

Just because your progenitors moved to the area of Macedonia, that does not entitle your people to claim they are Macedonians.

Yes, you are a separate people, you have your own culture, language, you have become a nation, and we, Greeks, certainly recognize that.

But claiming you are Macedonian and you speak the Macedonian language? that's a fallacy. You should just use another term.

I am saying all the above in friendly spirit and with the relevant historical sciences in mind. I am not a Greek nationalist, I only want justice. And in this case, judging from the historical records, justice means you Slavic people are not entitled to use the term Macedonia in any form.

The ancient Kingdom of Macedonia was 100% Greek, judging from the historical records, the written works, the names of places and people, the language used, the art forms, and the fact that the rest of Greece accepted Macedonians as Greek.

Beyond justice, what might be the reasons for us Greeks not wanting other people to take our history? well, here are the reasons:

1) there is the danger that, in the future, the connection between North Macedonia and Greek Macedonia becomes the geopolitical cause for an unforseen yet block of power to change borders in the area.

History is full of examples of geopolitical blocks using specific interpretations of history, culture and geography to cause problems.

2) Greek products from Macedonia can no longer be named 'Macedonian' in other countries.

I understand it's difficult for you to accept it, but you have been actually scammed. From the moment you were born, to now, in all your life, you have been indocrinated to believe you are Macedonian, that you speak Macedonian, etc. What a shame! this has been done for political purposes.

If only you could let the notion that your people and any form of the word Macedonia has any connection, the world would be so nice!!!

<comment><USER36> This is ridiculous.

You're saying people don't have a right to use a certain name because it meant something else hundreds of years ago.

Your comment is as flawed as "my culture is not your prom dress." Nobody has a monopoly on culture.* That's now how culture works. It's always changing and shifting, and getting borrowed between people.

Go back far enough in history, and you'll see that Greek identity didn't always exist. Greece was a bunch of independent city states, and people were more likely to identify with that city state than with the notion of a greater Greece.

*That is not to say that every borrowing of culture is respectful, or fair. Obviously, whenever you borrow from another culture you must be responsible in how you do so.

</comment></comment></comment><comment><USER37> last time I was in Macedonia I saw a man pulling a big plough by hand. No horse or tractor. Unrelated, I know.

</comment><comment><USER38> Isn't it ironic that things like Mickey Mouse are super copyrighted that even if you name your son that you will get in trouble. On the other hand things like historical references(Macedonia) are up for grabs by anyone and they even attract supporters of the type "self naming is a right"..

<comment><USER39> Disney hasn't had a "regime change", and the regime question was quite clear at the time Mickey was invented.

Macedonia (Kingdom? Empire? Ancient ethnicity?/dialect?/polity?) had lots of regime changes. We can't even be sure that the Greeks, at the time of Philip & Alexander considered Macedonia to be "Greece." You could argue either way. You could also argue that half the world is the "real" Macedonia. Bagdad has a decent claim.

I can see how Greece sees it, that naming may lead to territorial claims. That aside, Names are just names. I don't think this name is a crime against logic/history.

This is like insisting that what gay "really" means is happy. It's neither true or false statement. It's nonsensical.

<comment><USER40> >> We can't even be sure that the Greeks, at the time of Philip & Alexander considered Macedonia to be "Greece."

This is plain wrong. There is absolutely no dispute what so ever among historians about the Greek origin of Macedonia. The new country of Northern Macedonia in no way disputes this either. Comments like yours are the prime proof that what happened is very very wrong.

This is a quote from Wikipedia about Alexander the great.

>> Alexander was awarded the generalship of Greece and used this >> authority to launch his father's pan-Hellenic project to lead >> the Greeks in the conquest of Persia.

<comment><USER39> If the wars had gone differently, Greek historians would have recorded a glorious defeat of the northern barbarians by the Greeks. Alexander won, and so the story features "awarding a generalship."

I'm not making the case for either narratives. I'm making the case that both narratives are fictions, a symbolic language narrating a one-damned-thing- after-another truth. I don't think Alexander/Macedonia was "really" Greek or not Greek. I also think this meant different things at different times. Modern nationalism is a very dominant paradigm in our times. It is new though. Even though it's hard to imagine it, "nationality" was not a dominant paradigm either for personal identity or politics throughout most of history. Alexander didn't seem to give much of a damn about nationality.

<comment><USER11> Ancient Macedonia was part of Ancient Greece.

Yes, the city-states have been fighting all the time, just like Athens and Sparta. But they have been part of Ancient Greece.

In the case of FYROM (still the official name until the agreement gets implemented soonish), they have been appropriating the Greek identity. That was not just some individuals at FYROM, it was the whole political apparatus of FYROM since the 90s.

<comment><USER39> Again, these are narratives.

Was ancient Libya/Carthage or even Spain a part of ancient Lebanon/Israel? They were certainly a part of the same culture, in the same way "Hellenic Culture" was a thing. They spoke the same Language, shared customs and myths and such.

I understand that if Jordan remained themselves "Canaan" or "Phoenicia" then Israel, Palestine, & Lebanon might object. Territorial implications, etc. It's not made up though. Jordan has a "right" to that legacy too. That language and culture were spoken and practiced in Amman as well as Tyre even if Tyre is what we think of as the original "hub."

</comment></comment></comment></comment></comment></comment><comment><USER41> Greece has objected because they can; they have a veto on new EU members and have made this a red line. Other EU countries technically can tell Greece to accept Macedonia as it is (was) or no aid etc, but that's an extreme.

Considering that "Macedonia" extends also into Greece it's not unreasonable to differentiate, into Northern and the other part. Without wanting to start a war, today's "Macedonians" are mostly slavs, and Albanians make about 25-30%.</comment>


ActiveRecord Vulnerability - Circumvention of attr_protected - <AUTHOR> https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/AFBKNY7VSH8 <comment><USER2> I want to shamelessly give a shout-out to Ryan from our MTV team on this one; Rails ActiveModel was I think? the first real piece of Ruby code he ever looked at, and he found the permset Blacklist regex bypass (joernchen found the other one) inside of an hour. Everyone here will testify that I was no help to him at all; my contributions mostly consisted of throwing a large rubber balancing ball at him from the other side of the office.

Finding people like Ryan to work with--- "sleepers" who don't have long track records of filing public vulnerabilities, but who are secretly terrifying killing machines --- is the single best thing about my job.

Ryan found us on HN after beating the Stripe CTF. If you're like Ryan, ping me; I will go out of my way to make sure we tell you everything we can about why you should work with us.

Back on topic: if I was going to place a bet on something about Rails security, it'd be that there are more regex vulnerabilities in the tree. I am uncomfortable with how much Rails leans on regex for policy decisions.

Finally, said this before, saying it again: if you have a Rails app with customers, you need to be following @joernchen on Twitter full stop.

<comment><USER3> I want to send a big thank you to everyone looking closely at Rails right now. I really appreciate all the work that's being done. I can't tell you how happy it makes me to know that Rails becomes more secure every day because of efforts by teams like yours.

<comment><USER2> I think Phenoelit is doing more than anything else to motivate us right now.

</comment></comment></comment><comment><USER4> Shortly followed by two others:

[https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/KtmwSbEpzrU) (Rails 2.3 and 3.0)

[https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/4_YvCpLzL58) (JSON library)

And in a short followup:

"To be clear, updating Rails doesn't necessarily mean the JSON gem will be updated. Please ensure that you are running JSON version 1.7.7, 1.6.8, or 1.5.5. You can do this by adding the dependency to your Gemfile." -- Aaron Patterson

<comment><USER5> Also a good time to remind people to subscribe to the security mailing list:

<https://groups.google.com/forum/#!forum/rubyonrails-security>

<comment><USER6> We have new emails to rubyonrails-security triggering PagerDuty alarms as well.

<comment><USER7> Ouch. Sorry about that. :-(

<comment><USER6> Heh, it's okay. We just want to make sure we can patch right away. Your 5 emails at lunchtime today were fun. :)

</comment></comment></comment></comment></comment><comment><USER8> This one seems pretty amateur and should have been caught as part of a pull request/code review process.

       - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/
       + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/

^ and $ only match the first line in ruby, whereas \A and \z match across all lines.

<comment><USER2> This is an extremely common bug that is not specific to Rails. It would be worth reviewing your code to look at every regex to see if you have similar flaws.

<comment><USER9> I seem to remember a blog post about this regex issue here on HN a few months ago. It definitely surprised me to learn that Ruby doesn't treat $ as end-of- string by default.

<comment><USER10> I blogged in <http://advogato.org/person/fxn/diary/498.html> some key differences between Perl and Ruby regexp flags (which includes this gotcha).

</comment></comment></comment></comment><comment><USER11> Is stuff like this vulnerability present in Django as well, and just not being discovered as quickly, or is there something in the water (or was there years ago) in the Rails camp that caused all these bugs?

<comment><USER12> One of the core issues here was a serialization library that was too convenient, with the ability to deserialize into arbitrary classes and end up executing code from them. In the Python world, this vulnerability has been a bit better known for a while (which is not to say that they are immune, but it's at least been common community knowledge for a very long time now, at least a decade). Pickle is well-known to have it, but it's frequently pointed out in the docs that it is possible and that you shouldn't unpickle things from users. But other libraries may have this too, and if Django uses them, have a poke around. JSON libraries would be one obvious point. There's probably some extant Perl vulnerabilities in this area too. PHP wouldn't surprise me (though it would be a particular framework and probably not the language as a whole).

<comment><USER13> I doubt it's an issue of Python community vs Ruby community. Instantiating arbitrary objects is the sort of feature I'd expect an _object serialization_ library to have, but not a _document serialization_ library. Pickle is clearly an object serialization library, and I would have naively assume that YAML is a document serialization format, but apparently either the authors of the Ruby YAML parser or the creators of YAML don't see it that way, and see YAML as an object serialization format that is by default permitted to specify arbitrary objects to instantiate.

<comment><USER14> Python's YAML library is also capable of serializing python objects[1]. My understanding is the YAML spec allows these extensions but does not require them.

If you are using PyYaml.Loader instead of PyYaml.SafeLoader for anything coming from a user, you are at risk of this problem.

[http://pyyaml.org/wiki/PyYAMLDocumentation#YAMLtagsandPython...](http://pyyaml.org/wiki/PyYAMLDocumentation#YAMLtagsandPythontypes)

</comment></comment></comment></comment><comment><USER15> Shameless self promotion: we're working on something to make dealing with these patches less painful.

It's not out yet, but soon: <http://gemcanary.com>

<comment><USER16> xcanary would be better... e.g. alerts on mysql, django, ubuntu... anything :)

<comment><USER17> could you please post link to xcanary? Google doesn't helps to find it :(

<comment><USER18> It doesn't exist yet. Gemcanary is the MVP.

</comment></comment></comment></comment><comment><USER19> Surely you should be using attr_accessible with config.active_record.whitelist_attributes = true anyway? I can't imagine a situation where you'd want to have to manually blacklist attributes over whitelisting them.

<comment><USER20> How about when you want the majority of your attributes whitelisted? I understand the urge to whitelist, but lets be reasonable here.

If i have a table with 20 columns, 19 of which i want accessible (lets exclude a private UK). I also expect the schema for the table to be volatile. Why should i even consider while listing 19+ over blacklisting 1?

<comment><USER13> The idea is to fail in the direction of being safer than unsafe, if for example someone adds a database column and forgets to write "attr_protected" in the Rails code.

</comment></comment></comment><comment><USER21> Looks like this is actually an ActiveModel vulnerability and maybe mongoid is affected too.

Just like when rails people said they had a vulnerability in action dispatch but it was actually a YAML vulnerability. (both used in a lot of non-rails projects)

So please don't overlook this issue even if you are not using rails.

</comment><comment><USER22> Patio11 is indeed the security soothsayer

<comment><USER23> It didn't take much "ear to the ground" to tell that a lot of people had started very carefully sifting through Rails code.

<comment><USER24> The _idea_ for his post was nothing special, but the post itself was very well written and deserves a lot of credit.

<comment><USER23> Sure, fair enough, he's a good writer.

</comment></comment></comment></comment><comment><USER25> I'm building a fairly large web-product for my startup in Rails, and I'm really worried now. I'd paint the recent security vulnerabilities with one broad stroke -- someone trusted the client too much. Isn't that something really, really basic when dealing with data received from a remote client? Never trust anything?

Right from the Github mass-assignment [1] vulnerability to the recent YAML & JSON parsing vulnerabilities, it's the same core concept being violated.

This gets me thinking -- is Rails the right choice for a large project with JSON, XML, & regular HTML endpoints?

PS: I'm not sure what the code-review policy for Rails is, but now would be the time to call-out people who wrote this bad code and NOT auto-merge their future commits without at least two peer reviews.

<comment><USER26> Now is a good time to review alternative frameworks. A lot of them are simpler to understand, rely on less magic, and have communities around them that are interested in security as well as functionality.

<comment><USER27> No, before starting to build a product is a good time to do that.

Now is a good time to patch your code and keep building your company.

Every framework has security bugs.

Jumping ship to a framework you don't understand, possibly one that is harder to update, is a knee-jerk reactionary response to the problem.

If all these compromises worry you, invest some time in setting a HIDS (Host Intrusion Detection System), subscribing to the relevant security mailing lists, and ensuring that your deployment workflow allows you to patch production code within a few minutes.

<comment><USER26> At the end of the day, it is a trade-off: do I stick with a current framework full of security holes, indicative of poor design and keep the daily patch cycle fingers-crossed, or do I draw a line, migrate to a less magic less shiny but more secure better engineered framework and focus my time on building my apps instead of spending it all on patching. Tough call.

</comment></comment></comment></comment><comment><USER28> If I'm not using AR (mongoid instead) and I don't have any explicit JSON.parse in my code, am I OK?

<comment><USER29> It looks like this is specific to active_model.

[https://rubyonrails- security.googlegroups.com/attach/bb44b98...](https://rubyonrails- security.googlegroups.com/attach/bb44b98a73ef1a06/3-2-attr_protected.patch?view=1&part=6)

</comment></comment><comment><USER30> Yikes, looks like my morning is shot now

</comment><comment><USER31> Given that there is no 3.0.X update this time, where's a good resource to learn about applying the manual patch?

<comment><USER32> I have a blog post here: [http://blog.steveklabnik.com/posts/2012-10-04-run- rails-with...](http://blog.steveklabnik.com/posts/2012-10-04-run-rails-with- custom-patches)

<comment><USER31> Thank you. Also, info about git patch rather than a git cherrypick, in-case it's useful to anyone:

[https://ariejan.net/2009/10/26/how-to-create-and-apply-a- pat...](https://ariejan.net/2009/10/26/how-to-create-and-apply-a-patch-with- git)

</comment></comment></comment><comment><USER33> what is bypass?

<comment><USER34> it means it was circumvented, i.e. you evaded the piece of code that was supposed to lock you out.

In this case, apparently it was possible to 'hide' your attribute behind a newline, making it invisible to the attr_protected code, but somehow the attribute could still be valid (for no reason rails calls #strip on it or something?).

<comment><USER33> that's why I asked. I know attribute_assignment.rb code pretty well - no strip is called.

So conclusion: this doesn't lead to mass assignment. only DoS.

<comment><USER35> i can't actually explain why it works but it does work. I think it is result of both of the buggy regular expressions.

<comment><USER33> i am checking agains rails 4.

[29] pry(main)> x.update_attributes("client_\nsecret"=>1) (0.1ms) begin transaction (0.1ms) rollback transaction ActiveRecord::UnknownAttributeError: unknown attribute: client_ secret

But DEPRECATION WARNING: The method `sdf client_secret=', matching the attribute `client_secret' has dispatched through method_missing. This shouldn't happen, because `client_secret' is a column of the table. If this error has happened through normal usage of Active Record (rather than through your own code or external libraries), please report it as a bug. (called from block in assign_attributes at /Users/homakov/.rvm/gems/ruby-1.9.3-p194/bundler/gems/protected_attributes-369818eedeaa/lib/active_record/mass_assignment_security/attribute_assignment.rb:67)

So it's hidden in method_missing!

</comment></comment></comment></comment></comment><comment><USER36> I don't use rails but it seems that the quality of releases have been going downhill over the pass months.

<comment><USER37> The quality was always terrible, these are ancient bugs that are just being noticed now. Rails is designed with a 'convenience first, then use a couple regexes to "secure" it' mentality. Any software designed like that will be full of these sorts of holes.

<comment><USER38> I've spent the last 10 minutes reading your comment history. You come across as an opinionated argumentative snide jerk. Note: before you take my comment apart and feed it back to me realize that I have no desire in getting into a verbal sparring match with you and won't reply to you.

I suggest that you follow the advice, "if you can't think of anything nice or constructive to say, bite your tongue". The irony is not lost on me that in taking you to task for the tone you couch your comments in I am failing to live up to my own advice, but I'll make an exception here.

<comment><USER39> <http://en.wikipedia.org/wiki/Ad_hominem>

<comment><USER38> Indeed, but not quite. Ask yourself if it was my intent to counter the person's claims by attacking the person. No, that was not my intent. I never intended to counter the person's claims. I was explicitly calling the person out based on tone and style of his/her comment and others in his/her comment history.

The thought even crossed my mind while carefully drafting the above comment that I ought to preempt the accusation that I was committing this logical fallacy but I decided not to and now I wish the opposite.

Anyway, I hope you see the difference?

<comment><USER40> Pro-tip: People are going to have strong opinions here. Rebutting their message rather than the delivery ends up rebutting both.</comment></comment></comment></comment></comment></comment>


Government Pension Fund of Norway - <AUTHOR> http://en.wikipedia.org/wiki/Government_Pension_Fund_of_Norway

<comment><AUTHOR> Of particular interest: Wal-Mart Stores Inc. is excluded because of breach of human rights and labour rights and Alstom is under observation because of risk of gross corruption.</comment>


FarmBot: Open-source automated farming machine - <AUTHOR> http://wiki.farmbot.it/ <comment><USER2> This strawberry picker was in the news last couple of days:

[http://www.japantimes.co.jp/news/2013/09/26/business/latest-...](http://www.japantimes.co.jp/news/2013/09/26/business/latest- robot-can-pick-strawberry-fields-forever/#.UkRjXIZ9t5Y)

</comment><comment><USER3> I would definitely be interested in some form of 'gardening bot'. This but at a smaller scale just for my garden.

At a smaller scale, I can sow the seed myself. I can harvest myself. What I do need automated is the areas where I consistently fail when trying to grow my own vegetable patch. Watering is the main one. Just having a sensor to detect when to switch on and off the hose pipe would probably save most of my crops. Slug control would be another - something to detect when a slug gets to close and zaps em with (preferably) a laser.

</comment><comment><USER4> Ever since the Telegarden [0] shut down I've had an idea like this in the back of my mind but not solid enough to give it a name or draw plans. I'm glad someone is making it happen!

[0] [http://www.usc.edu/dept/garden/](http://www.usc.edu/dept/garden/)

</comment><comment><USER5> Eventually, robots will be growing all kinds of food. The roofs of our houses will be covered with gardens.

They'll even inspect plants at regular intervals and remove bugs. They'll decide when fruit is ready to pick and share all the data with systems that buy, transport and use produce.

</comment><comment><USER6> Half-baked pie in the sky musing:

What about a spindly-legged robot (picture those tall things in Half Life, or the killers in War of the Worlds) that wasn't constrained by rails? It used a camera to identify where to safely step, returned to a base to charge (solar on shed roof nearby) or replenish its (small) water and seed supply.

Sensors helped it check water moisture and know when to rewater. In its travels, it got a picture of which regions had the most sun, so it knew what would grow best and where.

Wonder if it could (with camera or sensor) identify what was growing where to help with decisions, or even remove upcoming weeds before they got established?

</comment><comment><USER7> Some input as a former organic farmer: wheels.

But a start is a good start, and really wheels can be a hassle, seeing as tractors can't operate on muddy soil (well, shouldn't).

I'm actually somewhat glad someone is doing this. I had a similar idea way- back-when, for gardening, but I had no idea how to handle the issue of having the seeder/weeder/watering device climb over taller vegetables, such as tomatoes, which can get up to 4ft tall, or the mighty sweet corn plant, which can get up to 6ft and higher, at least not without making the thing ugly as all hell or severely manhandle the crop. This is an attractive looking step in a good direction.

I'll follow you on Facebook and occasionally remark about the hell that is trying to grow vegetables in East Texas.

</comment><comment><USER8> This seems to work on a very similar principle to automated industrial cutters like those you would in factories slicing fabric or even automated drawing machines or dock cranes.

Two tracks on either side with one main gantry and tool in the middle. The design is very simple (which is very good) and I think the principles are straightforward enough for the DIYer to begin tinkering almost immediately. 3D printers, while getting cheaper, aren't as cheap as inkjet printers and until that becomes are reality, making parts will be a bit expensive.

But for a small green house version I can see someone using furniture drawer tracks or screen door tracks from the nearest hardware shop and begin building one of their own. Someone with basic woodworking skills can put together a basic version fairly quickly. Arduino programming is also pretty simple that a novice can get working quickly. A motor controller board will really help with a smaller version.

I especially like the design for the Crop Circle Bot : [http://wiki.farmbot.it/file/detail/Sketch%2C%20FarmBot%20for...](http://wiki.farmbot.it/file/detail/Sketch%2C%20FarmBot%20for%20Crop%20Circles%20%2809-20-2013%29.pdf)

</comment><comment><USER9> Really interesting idea. I could see this being used to remotely manage a farm from anywhere in the world. Picture a dashboard with hookups to your video feeds and statistics. When it's time to harvest take it out of the ground put it in a hopper and wait for pickup.

Not to mention the impact of testing different field configurations in varying climates all over the world. Whether the robotic design of the system is cost efficient or not, we should be at least collecting and sharing this data now.

</comment><comment><USER10> I'm most interested in pushing this technology forward so we can use it on the moon or on mars. I think the moon would be a much more attractive destination if they had a few nice big gardens growing up there...

</comment><comment><USER11> I think the follow up circular design is far more efficient. A huge X-Y table is terribly expensive in materials.

<comment><USER12> I think x-y scalability would be easier/more versatile/easier to locate than an ever-enlarging circumference.

</comment></comment><comment><USER13> This is really cool. If these were ever used at scale it could make organic farming cheaper than non. For example instead of pesticides a robot like this could pick off bugs (and or scare them away).

It could also pull weeds getting rid of the need for herbicide.

<comment><USER14> The design seems fundamentally unscalable due to the rails. I've been to farming areas and fields can go on for miles.

They could have come up with something far more powerful just by sticking it on the front of a tractor and having some tanks/bins for consumables.

Heck, they could have even started from common irrigation systems where you can have 400m of pipe on wheels you roll across the whole field.

I have to wonder how much farmer experience anyone behind this has and if they even looked at current farming equipment before just scaling up a computer printer and sticking a different end on the head.

<comment><USER15> Dont you see? It's a robot for growing organic weed! Maybe some lettuce on the side.

Here is an idea for a startup: Shipping container weed farm. Order one online, plug in, insert seeds, press button.

</comment></comment></comment><comment><USER16>
      "If you have another way to donate in mind"

Seems like this would be an ideal project for a kickstarter, that way at least the project could create a more informative project page and detail exactly how they hope to spend the money with perhaps the goal of building a prototype in a given time-scale.

At the moment it looks a bit too much like someone's had a great idea, done a bit of initial design and thrown together a wiki page. It doesn't seem serious enough for me to donate at this stage.

<comment><USER17> Hi, my name is Rory and I am the one behind the project.

We are working towards a crowdfunding launch in 2014 as stated on page 47 of the white paper: [http://www.scribd.com/doc/169536137/FarmBot-Humanity-s- Open-...](http://www.scribd.com/doc/169536137/FarmBot-Humanity-s-Open-Source- Automated-Precision-Farming-Machine)

We've received a good amount of donations so far and will be ordering materials for the initial design this week and next.

I'm currently recruiting other students at my local university to work on the project, and we plan to flesh out the wiki with timelines, design files, and progress updates soon.

Thanks for checking out the project!

<comment><USER16> Thanks for clearing it up. However, I'm still not sure on what my donations would be used for at this stage (I guess you could say a lack of transparency) but I wish you the best of luck and hope you get enough backers to make this work.

Could be something of REAL benefit to the world, which is more than most HN stories can say.

</comment></comment></comment><comment><USER18> Very cool. It would be awesome to automate as much as possible of permaculture and everything you need to create small communities that can survive entirely off the grid in a way that affords people plenty of free time.

People who did this might want to also check out the Global Village Construction Set:

[http://opensourceecology.org/wiki/Global_Village_Constructio...](http://opensourceecology.org/wiki/Global_Village_Construction_Set)

<comment><USER19> off the grid, yet with a powered robot?

<comment><USER20> Plenty of off-grid power options, like solar, wind, and water.

<comment><USER21> And gasoline.

<comment><USER20> Yep, that does power plenty of tractors and tills already.

</comment></comment></comment></comment></comment><comment><USER22> As someone who does farming (part time), I don't see these being practical. For low value bulk crops (corn, wheat, soybeans) the robot is too expensive and existing mechanization is too good. Even for high value stuff (grapes and other fruit) it will be too expensive. Maybe inside a highly controlled greenhouse this will be practical, but there are no food crops that are economical to grow inside a greenhouse. (It is getting there as high-tunnel becomes cheaper to install.)

As an aside, mechanical harvesters for grapes are hilarious. You still need people to run them. One person's job is to find and remove possums from the fruit bin before the critter is buried by a thousand pounds of fruit.

It is a distraction to talk about the gantry, XY or radial. Any gantry based system is going to be a headache from the start because you've got those rails cluttering up the space. Eventually you'll find something the robot cannot do and then you'll be trying to figure out how to get your general purpose tractor around without crushing the gantry.

The radial system is cute, except now your installation and operating costs scale linearly with the amount of crops. With an XY system, one can plant more and extend the rails and have the existing robots do more work. Not possible with the radial system, unless you are going to physically pick up and move the units between circles few times each day. If time is tight (plague of locusts coming in tomorrow, need more robots to squish them) you can increase the robot density by sliding more robots onto the XY gantry. Not possible with radial.

Ultimately it will be about the vision processing and manipulators. And then you might as well mount the vision/manipulator unit on a tractor and have a robot-tractor drive up and down the fields, just like any other piece of equipment. Vastly cheaper and more flexible than gantries.

Eventually we will get there, but it probably won't be until vision processing and lidar gets a whole lot cheaper. We might be on the cusp though, based on the computer vision advances in video gaming.

User roryaronson, I've done a lot with robotics and outdoor electronics too. If you want I can give you a fairly lengthy piece of constructive critism about your whitepaper. You've got a lot of good ideas in there, but just as much misinformation.

<comment><USER23> I can't read the whitepaper due to work network restrictions (scribd? really?) but superficially this seems more directed towards DIY-er gardener types rather than industrial farming. That is to say, people who have no need for a giant combine harvester.

For that purpose it seems to have the capability to automate some tedious jobs quite nicely. I would pay for a machine that grows vegetables in my backyard with little to no input from me.

That said, the possum remover must be the most hilariously bad job in farming.

<comment><USER22> They've probably fixed the possum thing by now :-)

Your comment makes me wonder what a good pricepoint would be for such a system. How much money and how much space would you be willing to give up, for example.

Less hypothetically, why the fixation on machines? We've got all sorts of crazy services these days. How much would you be willing to pay for a gardening service that maintains your garden for you and occasionally leaves a crate of produce at your backdoor? It would be like a lawn service, but without all the terrible effects on the local ecology.</comment></comment></comment>


I was the wife of a Wall Street 'Wolf' - <AUTHOR> http://nypost.com/2013/12/09/i-was-the-wife-of-a-wall-street-wolf/ <comment><USER2> How is it that he was able to get out of jail and head straight to a multimillion dollar mansion? Was he not sued for everything he was worth? It doesn't really seem fair if crime does pay and you just have to do a few years in jail. I doubt the movie will really address the aftermath.

Kind of weird to think of Jonah Hill and Leo playing real people that had real lives. They must fucking love watching a movie that portrays them as such badasses.

</comment><comment><USER3> Sound familiar?

 _It was all about getting these young hungry guys pumped up to become players. "Look how much money we make!" Danny was saying. "This could be yours someday, too!"_

<comment><USER4> So I'm assuming you're saying this is similar to current tech-boom & silicon valley culture. If I'm wrong, ignore this whole comment.

I don't think what's going on these days is a scam. I see some valuable things coming out of tech these days. The dot.com crash of '99-2001 was not a system like today's. Back then I had classmates pulled out of school for 80k+ jobs just because they knew some HTML and Unix. $30k sign-on bonus, insane stock- options(that ultimately were worthless). Another company gave all new hired programmers a new car! A new personal car, never to be returned to the company. It was truly insane back then. Today other than some of these crazy valuations(snapchat $3B?), things at least still resemble sanity. In 1999-2001 there were companies that hired people to do literally nothing. Just sit there and look busy while the CEO brought in potential buyers. They'd look around the office and see how "cool & young & fresh & busy" everyone looked. CEO would give the most convincing sales pitch ever about how the internet was the new thing and they needed to get in on the ground-floor of e-commerce; small company bought out... everyone laid off, CEO gone... and it took the bigcorp 8+ months to figure out it had been fooled.

I don't know how many people here on HN are old enough to remember the first dot.com bubble but it was nuts-&-bananas. Just a circus; not unlike the recent housing-crisis. That's just not what's happening in today's tech "bubble"[1]. At least, not nearly to the degree it was back then.

1\. If this is a bubble, it's the strongest bubble I've ever seen. If it pops it's really gonna devastate a whole bunch of people.

<comment><USER3> _$30k sign-on bonus_ — Facebook gives $30k signing bonuses to undergrads.

 _valuations(snapchat $3B?), things at least still resemble sanity._ — They use that $3B valuation to cash out $10 million per founder so they never have to create value for employees (also see Groupon and Zynga insider trading shenanigans).

 _Just sit there and look busy while the CEO brought in potential buyers._ — Many companies today admit to doing that. Just bring in friends to sit around and look busy while your potential investors tour the "office" that appeared out of nowhere yesterday. Palantir talked about it in a startup school presentation (but he also made jokes about killing and/or raping babies, so he's not exactly stable).

 _nuts & bananas._ — I'm hungry now.

 _not nearly to the degree it was back then._ — Back then, everybody thought they could buy a mansion when their IPO popped six months after founding. Today, success is more isolated towards the top end instead of the possibility of success through the entire spectrum. It took Twitter six years to get line- level employees anything while the executives were doing just fine cashing out along the way.

<comment><USER4> ok, now I'm scared....

</comment></comment></comment></comment><comment><USER5> "As for me, eight months pregnant and hardly in the mood for a party, I couldn't help wondering what had happened to the simple guy I'd first married, whose idea of a good time had once been grilling in the backyard with a beer in his hand."

Why do they all go into deep denial? I bet she was sewing her own clothes, and buying at discount stores. Ladies--just be honest. You took the money, and started to expect it. You really, don't care how it's made. How much will she get for her pity book?

<comment><USER6> It really is a bit one sided. Eventough she generally did no wrong, I strongly doubt that she had no idea of what was going on. I mean if your husband hands you one contract after another you should at some point at least read through them.

<comment><USER7> Not at all. My first wife not only didn't know what I really did for a living ("Oh...he does something in IT..."), she didn't give two shits as long as the money kept coming. And if signing a piece of paper and not asking questions meant more money coming, she would have happily done it without a second thought. I can completely relate to this level of willful ignorance.

<comment><USER8> Why did you marry someone like that?

<comment><USER7> I didn't. Somewhere along the line, however, she became that person.

<comment><USER9> When you have 3 kids to take care of and have no background in finance/accounting/etc. do you really want to start getting into THOSE details too? Why would you doubt your husband, the man who's supposed to take care of you until the death do you part?

...Right?

</comment></comment></comment></comment></comment></comment><comment><USER10> This is the reason I don't mess with the stock market anymore.</comment>


Y Combinator Startup Class – Live with Sam Altman - <AUTHOR> https://courses.platzi.com/classes/startup-class/live/

<comment><USER2> Is the audio in this driving anyone else crazy? The guy with the accent is so loud compared to Sam I had to stop listening.

</comment><comment><USER3> Off-topic: I always hate sites that limit my sign up options to Facebook or Twitter...

<comment><USER4> I agree. I am a total facebook user but I am beginning to take a second thought to the idea of giving my whole friend list to random companies (which is what the sign up page offered).

I decided not to sign up because I just don't want to give that information out to every company that asks - especially when that company doesn't even respect me enough to offer e-mail sign up.

It's like - yeah, if you want to verify my identity through facebook's API, great. It's fast and you trust facebook. If I choose to save time and do that instead of email sign up and it is my decision, that's great. But why do you need access to my friend's list? And not giving me the option of using my email means you aren't really looking to protect me as a user... which means I definitely am not giving you access to my friend's list.

I use facebook every day, but that doesn't mean I want to leak my complete friend list to every site on the web.

<comment><USER5> In the new version (2.0) of the Facebook API, Facebook no longer gives the friend list to developers.

<comment><USER6> On the app permission page: "Mejorando.la will receive the following info: your public profile, friend list and email address."

I thought the new api always had friend's list as a an option.

</comment></comment></comment></comment><comment><USER7> What is the difference between this and the How to start a startup series?

<comment><USER8> The Startup Class has amazing contents. Sam wanted to share new ideas from a recent post using our live streaming platform.</comment></comment>


Ask HN: What concepts one has to be aware to be claimed as core python developer - <AUTHOR> I have been using python for almost 4 years. But I still feel I am naive in python. How can I  improve my understanding of python and how it works internally. Some of the concepts I am referring are:
1)How actually "sets" works to store only unique things?
2)What is the role of hashing in python?
3)Why people are saying python is slow?
4)what makes the numpy arrays faster than core python arrays?
5)What is the purpose of adding "compile()" function in the python core?
6)What is the exact problem with python threads?
These are some of the questions I ignored but just used it. Instead I want to know/get answers for the questions like these? How to think in this way to not just use but understand how it really works? <comment><USER2> You have a good starting set of questions. Every time you have a question—dive in and find an answer.

E.g. "what is the role of hashing in python?" Googling finds some unrelated stuff, but then on first page there's [http://www.asmeurer.com/blog/posts/what-happens-when-you- mes...](http://www.asmeurer.com/blog/posts/what-happens-when-you-mess-with- hashing-in-python/) which at first very cursory skim seems informative.

Repeat for each question.

</comment><comment><USER3> The term "core Python developer" seems to have a very specific meaning: someone who works on the implementation of the Python language itself, and has commit privileges for that project. For example:

[https://devguide.python.org/coredev](https://devguide.python.org/coredev)</comment>