Planet Satellite: British super-plane or magnesium flop? (2015) - <AUTHOR> https://hushkit.net/2015/10/16/whisky-business-the-strange-story-of-the-planet-satellite/ <comment><USER2> That first image looks startlingly similar to this modern thing:

[https://www.thedrive.com/the-war-zone/30948/potentially- the-...](https://www.thedrive.com/the-war-zone/30948/potentially-the-most- revolutionary-aircraft-you-have-never-heard-of-has-flown)

Disregard the sensational title.</comment>


Takeaways from the Leaked Files on China's Mass Detention of Muslims - <AUTHOR> https://www.nytimes.com/2019/11/16/world/asia/china-muslims-detention.html <comment><USER2> I don't understand why the BDS movement against Israel gets so much attention when stuff like this, or worse, regularly occurs in China. I have been making an effort to reduce what I buy from China recently, which is difficult in electrical engineering. I hope others consider the same. We need a BDS (Mainland) China movement.

<comment><USER3> Does it get a lot of attention? In any case, the government policy is pretty much the reverse - China is getting (in my opinion long overdue) tariffs and sanctions, while Israel is getting (probably 1st Amendment infringing) protections against the BDS movement: [https://theintercept.com/2018/12/17/israel-texas-anti-bds- la...](https://theintercept.com/2018/12/17/israel-texas-anti-bds-law/)</comment></comment>


Brutalist Architecture Masterpieces (2016) - ur-whale https://www.architecturaldigest.com/story/brutalist-architecture-masterpieces <comment><AUTHOR> > Proponents praised its explicit functionality

If it were about functionality you wouldn't build massive structures at weird angles like the Wotruba Church. You wouldn't build physics-defying overhangs to compensate your wanting for a nonexistant first floor like the Giesel library.

There's no functional basis for the design of the buildings outlined here. Only some superficial notion of functionalism because of the revealing of the underlying structure. Meanwhile, so many creators of brutalist structures are on the record for hating humans for messing with their grand designs.

The world would be a better place without this blight masquerading as some purity of design.

<comment><USER2>
       functionality

Functionality has multiple dimensions. Often brutalist buildings were rather functional on a micro level (e.g. central heating, indoor toilet etc) which was usually better than what they replaced. But on a macro level they were often terrible, e.g. the extreme focus on being car friendly (e.g. you had to cross an 8-lane motorway to meet your frriend in the neighbouring building).

The former has nothing to do with brutalist architecture and is now available for all styles of architecture. The latter was a crazy mistake.

</comment></comment><comment><USER3> Boston City Hall is not only ugly on the outside, it's ugly on the inside. For one of the meeting areas (city council, I believe) they have this wooden furniture and some tapestries and old paintings on the concrete walls, but it can't make that cold space warm.

Outside, Government Center plaza channels the wind coming off the nearby harbor. It's also the site of one of the most infamous images from the 1970s bussing crisis ([https://www.npr.org/2016/09/18/494442131/life-after- iconic-p...](https://www.npr.org/2016/09/18/494442131/life-after-iconic-photo- todays-parallels-of-american-flags-role-in-racial-protes)) which tainted that space early in its existence.

<comment><USER4> It's a profoundly ugly building. The whole hulking slabs of inevitably discolored and gross-looking concrete look is really not good for a government building; it just looks seedy and corrupt and authoritarian. It gives off too many dystopian vibes, and makes me think of the police station in Mad Max or City 17 from HL2.

Particularly in Boston, which has its own style and so many beautiful old buildings.

<comment><USER5> It's even more evocative of a totalitarian state with the giant face of John Collins on the side of the building.

</comment></comment></comment><comment><USER6> What a really unpleasant website to use. Horrible slideshow functionality, interstitial adverts breaking screen flow, rise-up article suggestions. Ugh.

<comment><USER7> Despite a strong interest in Brutalism I couldn't make it through because of all this

<comment><USER8> Same. I tried to mess with the grid in dev tools in a last attempt to make the damn carousel resize appropriately but to no avail.

</comment></comment></comment><comment><USER2> Summary: The article doesn't really answer the question why the buildings in question are masterpieces, or why they should be reconsidered. Likewise, it doesn't engage in a meaningful sense with the question why brutalism is so widely disliked. Instead 22 photos are presented, over half of which are _not_ of buildings, but of detail (e.g. a door handle, or grafitti).

<comment><USER9> So generic listicle image gallery on a generic content farm?

</comment></comment><comment><USER10> The architectural school it's trendy to hate at the moment is Façadism[1], whereby the façade of an older building is preserved, the main structure demolished behind it and a modern building built, eventually connecting with the façade so that the new building is 'invisible'.

It's trendy to hate because it supresses opportunities for new interesting architecture to preserve older (but not neccessarily interesting or even good) façades, simply to prevent people moaning about ugly new buildings.

1: [https://en.wikipedia.org/wiki/Facadism](https://en.wikipedia.org/wiki/Facadism)

</comment><comment><USER11> Anyone who studied CS at Edinburgh University grew fond of Brutalist Architecture through repeated exposure to this monstrosity.

[https://en.wikipedia.org/wiki/Appleton_Tower](https://en.wikipedia.org/wiki/Appleton_Tower)

<comment><USER12> Made all the more jarring by the general Harry Potterness of the surrounding city.

</comment></comment><comment><USER13> Too much of this architecture in London. I wish the South Bank centre and the Barbican would be demolished and re-developed.

Fun fact about the Barbican: The central heating is controlled centrally. Tenants get a notification about which day it will be turned on for winter.

<comment><USER14> I'm not disturbed by the Barbican as such (it can be argued that it really is a masterpiece), but by the exhibition venues, which, in my opinion are really utter crap. Unfortunately they sometimes run really good exhibitions.

Compare that to the Centre Pompidou in Paris [1], on which arguments about the building will probably never cease (personally I think it's brilliant), which went up at about the same time. But it's hard to argue about its quality as an exhibition venue (or rather venues).

[1] [https://blog.artsper.com/en/a-closer-look/five-facts- about-t...](https://blog.artsper.com/en/a-closer-look/five-facts-about-the- construction-of-the-pompidou-centre/)

<comment><USER13> Yeah, I guess the Barbican flats don't look as bad as the theatre bit etc.

I prefer the Lloyds building to the Pompidou. Less Fisher-Price colours.

<comment><USER14> The colors are not arbitrary, since they encode functionality. From [1]

 _One of the distinctive features of the Centre Pompidou is the striking presence of colour. Four strong colours – blue, red, yellow and green – clothe the structure and enliven the façade, their use governed by a code laid down by the architects:_

      blue for circulating air (air conditioning)
      yellow for circulating electricity
      green for circulating water
      red for circulating people (escalators and lifts).

[1] [https://www.centrepompidou.fr/en/The-Centre-Pompidou/The- Bui...](https://www.centrepompidou.fr/en/The-Centre-Pompidou/The-Building)

<comment><USER13> A friend was a senior IT guy at Lloyds. He said the building was a pig, functionally. All the network cables etc had to go down the pipes on the outside of the building.

</comment></comment></comment></comment></comment><comment><USER15> If you're in the Vancouver area there are two noteworthy brutalist examples. One is the MacMillan Bloedel building:

[https://www.google.ca/search?q=macblo+building+vancouver&oq=...](https://www.google.ca/search?q=macblo+building+vancouver&oq=macblo+buil&aqs=chrome.1.69i57j0l2.3584j0j7&sourceid=chrome- mobile&ie=UTF-8)

The macblo building is also CGIed into the New York City Nazi party HQ in Amazon's adaptation of The Man in the High Castle.

The other is pretty much the entire SFU campus.

</comment><comment><USER16> Blindly hating brutalism is just as mimetic as blindly loving it.

<comment><USER17> I don't think anyone blindly hates it. I mean... use your eyes! It's easy to see what people hate about it. It's ugly. Simple as that. The very best examples rise to "ok that's an interesting design" but they're still undeniably ugly.

The Barbican is a very interesting design, but anyone who has actually been there would agree that it is ugly.

Contrast them with something like a modern glass skyscrapers (e.g. the walky talky). They may be rather bland and boring but I don't think many people would say they are _ugly_.

<comment><USER18> > The Barbican is a very interesting design, but anyone who has actually been > there would agree that it is ugly

I find it one of the most beautiful and peaceful places in London. Some of us actually like these sort of forms and concrete as a material.

> walky talky

I find that thing grotesque, it's like a bad joke on the London skyline. Some skyscrapers are nice like 30 St Mary Axe but when they're done bad the fact they're made of glass doesn't make them any more attractive.

In the end its all completely subjective.

<comment><USER19> I think your subjective might be a minority view though. I'm not talking particularly about the barbican, but the worst most people could level at the glass towers in London is blandness.

To many/most the concrete monstrosities of the 60s and 70s are actively oppressive.

</comment></comment></comment></comment><comment><USER20> The website is super non functional similar to the buildings: ads everywhere, side bars that open up as you scroll, popups to subscribe. It's hard to see where the content is. I'm on mobile on my home WiFi. I also run pihole and the website was still a sh*@hole.

</comment><comment><USER21> I see your masterpieces and raise you Cumbernauld Shopping Centre in Scotland.

[https://flic.kr/p/7VgANo](https://flic.kr/p/7VgANo)

This place is horrible!

</comment><comment><USER22> What's more interesting to me, is why HN is so attracted to Brutalism? Is it a sense of minimalist aesthetic, an expectation of structural integrity, the economics of minimalism, a detachment from previous architectural genres, or perhaps an affinity for the writings of Ayn Rand (whose characters espouse the virtues of Brutalism, and whose book, "The Fountainhead" was about a brutalist architect).

I spend a lot of time exploring and studying music in former Yugoslav countries, and while I find the Brutalism fascinating in it's relationship to Soviet/Yugoslav poverty & austerity, beauty is not a word I would ever use positively in the same sentence.

<comment><USER2> I can think of three main reasons for this.

(A) It's a form or contrarianism, in that it's an negation of mainstream preference, hence unusual. Even better, this negation of mainstream preference isn't really threatening anybody, hence good way of attracting mainstream attention.

(B) Brutalism is often associated with left-wing / communist large-scale social engineering, and the left reflexively celebrates anything done by the left. (Aside, the association of brutalism with the left is historically quite false, e.g. people like Le Corbusier didn't meet a dictator he didn't like.) So where brutalism is celebrated by somebody who's explicitly and self- consciously political, it's a Gramscian hegemonic strategy [1]. An example of such a writer is Owen Hatherley [2].

(C) Cities with a lot of brutalist architecture, prevalent in the former Soviet block, use it to market themselves are tourist destinations. This ties in with (A), for why would you go and visit a city unless it had something unusual to offer, something Instagrammable, something to talk about when you are back?

[1] [https://en.wikipedia.org/wiki/Cultural_hegemony](https://en.wikipedia.org/wiki/Cultural_hegemony)

[2] [https://en.wikipedia.org/wiki/Owen_Hatherley](https://en.wikipedia.org/wiki/Owen_Hatherley)

<comment><USER22> > (B) Brutalism is often associated with left-wing / communist large-scale > social engineering, and the left reflexively celebrates anything done by the > left. (Aside, the association of brutalism with the left is historically > quite false, e.g. people like Le Corbusier didn't meet a dictator he didn't > like.) So where brutalism is celebrated by somebody who's explicitly and > self-consciously political, it's a Gramscian hegemonic strategy [1]. An > example of such a writer is Owen Hatherley [2].

Huh, quite an interesting take. On the contrary, I associate an appreciation of brutalism with those who post staunch free-market capitalist comments.

I have many taken architectural tours in Bucaresti, Plovdiv, Sofia, Skopje, Moldova, Tbilisi, Beograd, Kiev, and Moscow. Unanimously, the tour-guides presented these buildings with disdain for their aesthetics and association with authoritarianism. All of the tour-guides were definitely left/liberal- leaning, some to the point of dreadlocks and Che Guevara hats. (Thanks for the links, by the way, I had never heard of Own Hatherly before!).

<comment><USER2>
       presented these buildings with disdain

That could be explained a difference in background (growing up in the west vs in the Soviet zone of influence): It's much easier to have a rosy view of communism/socialism if you have no experience of living in a communism/socialism yourself (or your parents).

As far as I'm aware, Own Hatherley is a high-ranking cadre in UK communist parties, although I have lost track which, since they have a tendency to split and splinter. As far as I'm aware, publishers like Verso Books and Zero Books were outlets of the SWP (Socialist Workers Party), although that no longer exists. I don't know which of the SWP-descendants is now in control of those publishers.

</comment></comment></comment></comment><comment><USER23> I'm surprised there was nothing by Tadao Ando on that list. He is a master of smooth supple concrete, and of light and shadow.

</comment><comment><USER24> even though i am an atheist i think the shape of [https://en.wikipedia.org/wiki/Cologne_Central_Mosque](https://en.wikipedia.org/wiki/Cologne_Central_Mosque) is beatiful. Don't know if it would qualify as brutalist though.</comment>


Apocalypse 2012 T-Shirt - <AUTHOR> http://www.apocalypsetee2012.com

<comment><USER2> I am confused why there is an Aztec calendar on the t-shirt, though.

<comment><AUTHOR> Didn't make it, just thought it was interesting. Always enjoy how people capitalize on every event with a t-shirt.</comment></comment>


Professor Unbanned by Google, No Insight Provided - <AUTHOR> https://twitter.com/salilstatistics/status/899863971817238528 <comment><USER2> Here's the first account I found of what happened:

[http://www.zerohedge.com/news/2017-08-21/one-statistics- prof...](http://www.zerohedge.com/news/2017-08-21/one-statistics-professor- was-just-banned-google-here-his-story)

If you can find a better account of the history of this event then I'd be grateful.

 _Update:_ Here is the HN discussion from a day ago:

[https://news.ycombinator.com/item?id=15065742](https://news.ycombinator.com/item?id=15065742)

<comment><AUTHOR> Sorry, I assumed most people would know the back story.

The account was reinstated with no explanations to the public.

<comment><USER2> Yes, that much is obvious. What's not obvious is when it happened, or anything else about it. All this link tells us is that some account - of which we know nothing - has been reinstated.

And you _still_ haven't provided any additional information.

<comment><AUTHOR> But you did?

Edit: I don't think I can do much more than comment at this point.

<comment><USER2> Do you have better sources for the back-story? If so then it would be nice to see them. If not it would be nice for you to say so. That way lies closure.

<comment><AUTHOR> I do not, read about it from the same source you shred.</comment></comment></comment></comment></comment></comment>


I use only one password for all web sites - <AUTHOR> http://justmybloghere.tumblr.com/post/6760078650/i-use-only-one-password-for-all-web-sites <comment><USER2> A better title might be: "I use only one linkbait title for this blog post".

The author does not describe a single password, but rather an algorithm for creating passwords predicated on domain names.

Personally I'd prefer to memorise one complex password and use that as a key into a KeePass database.

</comment><comment><USER3> I've been using a system like this for a while. It doesn't need to be as complex as this article suggests.

Something like this would work fine:

Get the domain name, take the first 3 letters, reverse it, replace each character with the character that sits to the right of it on a keyboard. Append (or prepend) this to an already secure, remembered, password.

The only way a person can know which part of the password is variable is if they have access to two passwords generated by this system, from different sites. Highly improbable. Moreover, even if they do figure out which part does change, they have to try to reverse the algorithm.

</comment><comment><USER4> Just reading the process hurts my head. Please. Security, yes, headaches, no!

Personally, I use rude sentences depending on the site, with numbers and punctuations. And a throwaway password for your "Show HN's" ;)

</comment><comment><USER5> So really, you're using a primitive hash of the domain name, where the exact algorithm is a secret. Why not use a proper hash of the domain name plus a secret, like this does:

<https://www.pwdhash.com/>

<comment><USER6> I assume because you would have trouble with that if you didn't have the ability to generate the hash. In the case of pwdhash, what if you don't have the ability to install the extension?

<comment><USER5> That's a valid point, although I suspect the algorithm subscribed is just about complicated enough to tempt you to write down frequently used passwords anyway.

You could carry around a little pwdhash implementation on a smartphone or whatever, I suppose, the algorithm isn't rocket science: [http://crypto.stanford.edu/PwdHash/RemotePwdHash/hashed- pass...](http://crypto.stanford.edu/PwdHash/RemotePwdHash/hashed-password.js)

It's a pity this sort of thing wasn't build into the input type="password" in the first place ... maybe HTML5 should introduce an input type="passhash" ...?

</comment></comment></comment><comment><USER7> I think an idea like this could be great if combined with a partial javascript bookmarklet. Counting how many characters are in the domain name isn't exactly mentally taxing, but it would get tedious pretty quickly.

<comment><AUTHOR> I am doing it for a while now and you get quickly used to it.

But your idea of a bookmarklet is interesting!

</comment></comment><comment><USER8> That is a really bad way to set and remember passwords for most people. It's so complex, it must take a couple of minutes to calculate the password every time. Security that people actually USE, needs to be simple.

I usually use sentances with 4 or so words, that is odd enough to remember. I combine that with keepass safe for sites i only log into on my computers and synch it using dropbox. I also have access to it on my iphone and ipad. The combination of these techniques enable me to log into most sites without a password manager and all of them on the fly.

</comment><comment><USER9> It's so complex that I'd rather use password manager.

Or better yet - actually use the same simple password on all web sites which are not important to me.

</comment><comment><USER10> Surprised no one has mentioned 1password here yet. It generates passwords, has extensions for most browsers, and can sync between iPhone and your computer. I find it super handy, although it's funny when I'm using a friend's computer and my iphone isn't around and I have to tell them, "actually, I can't log in to facebook because I don't know my own password."

</comment><comment><USER11> SuperGenPass does this just a lot better. Originally a bookmarklet, more securely implemented by extensions for Firefox and Chrome, an android App and I think even an iOS app.</comment>


RailsApps Tutorials Launches, Learning Rails Will Be Easier - <AUTHOR> http://blog.railsapps.org/post/40960545250/railsapps-tutorials

<comment><AUTHOR> The tutorials are not intended to supplant the great introductions to Rails we already have (including Michael Hartl's book). Rather, they are intended as a next step for developers who are gaining proficiency. That seems to be an underserved niche.

</comment><comment><USER2> Congrats to you on your launch Daniel!</comment>


Show HN: Server Hunter – Easily browse over 11,000 VPS and Dedicated Servers - <AUTHOR> https://www.serverhunter.com <comment><USER2> Most VPS hosters "share" CPU time between users on a host server (Which mean CPU type/speed doesn't mean much).

So it would be great if you could filter for that on serverhunter to paint a fair(er) picture, because a few hosters give dedicated cores by default.

When we tried benchmarks on the Hetzner Cloud we found that some servers had as low as 10% max CPU on a crowded host server, which makes sense as to why they charge 8 times more for dedicated CPU cores.

<comment><AUTHOR> That makes sense! Unfortunately, it'll be hard to obtain benchmarks for every plan with every provider, and it'll be even harder to get enough benchmarks with each provider to paint an accurate picture.

Even with the same provider, there can be massive differences between VPSs, it just depends whether you end up on an idle host node with no noisy neighbors or one where everyone is busy mining their favorite cryptocurrency.

Regardless, we do understand the need for accurate performance numbers, so this is something we will explore further in the near future.

If you have any ideas, please let me know. :)

<comment><USER2> Maybe you can simplify it, have a checkbox for "Dedicated CPU Cores" so that we can filter those who provide it officially.

I think it's safe to assume that those that don't have this information available at least somewhere, are shared cores by default?

<comment><AUTHOR> Happy to report we have added a "Hybrid" product type, which is a virtual server with dedicated resources (VDS): [https://www.serverhunter.com/?search=99A-37F-5BB](https://www.serverhunter.com/?search=99A-37F-5BB)

You'll see that while the amount CPU cores will usually be less, they are dedicated to you and not shared with other VPSs.

Hope this helps! :)

</comment></comment></comment></comment><comment><AUTHOR> What's new in ServerHunter?

\- Improved search results display on mobile

\- Smarter text searches

\- New filter: BGP Sessions

\- Badges for 'Annual billing' and 'NAT IPv4'

\- Separate page for "Write a review"

\- Preserving newlines in reviews

\- Added a new "Price per specification" option to sorting and columns

\- Added a graph with pricing history in offer's page

\- Ability to save your favorite searches

\- Added offers from several providers

Our VPS giveaway is ending soon, join now for a chance to win a VPS subscription for one year. Enter here: [https://www.serverhunter.com/giveaway](https://www.serverhunter.com/giveaway).

<comment><USER3> If you distinguish broken and non-broken IPv4, maybe you should also distinguish broken and non-broken IPv6? Currently, it's impossible to distinguish offers with a proper /48 from broken crap with a single /64 or even less, which makes the comparison mostly useless for me, as there is a lot of broken crap in that market to wade through.

<comment><AUTHOR> Since IPv4 space is starting to become a significant cost, they make up a large percentage of the price for the cheapest VPSs. This is why some providers have started offering NAT VPSs - ideal for backups, monitoring, etc. Since NAT IPv4 is not the norm, this is something they clearly advertise on their website, and hence something we can easily distinguish.

With IPv6, the information from the provider is usually limited to "IPv6: yes/no", if they even mention it. The actual IPv6 space varies wildly from /48 to /56 and /64 - some providers even offer just tunnels or 10 IPv6 addresses. Since this is usually not mentioned on their website, we can't actually distinguish between them either. :(

<comment><USER3> Well, I see the problem, but then, a search site that doesn't allow you to use effective filters is ... kinda useless?

Though I think there is a more important thing to note here: Maybe you should explicitly support handling of unknown values in the UI? Failure to do so is IMO one of the biggest problems of most specialized search sites.

Sure, there are attributes that cannot always be determined reliably if at all --but instead of either ignoring the attribute completely or forcing it to "false" or "true", or some other explicit value, why not allow the user to specify whether entries for which the attribute is unknown should be shown? That way, if my requirement is proper IPv6 support, for example, I can decide whether I am in the mood to wade through tons of crap, but still have you filter out all entries for which it is known that proper IPv6 is not supported, or whether I want to ignore those and only look at the (probably more expensive) selection of providers that clearly advertise that their product isn't broken.

<comment><AUTHOR> I understand what you're saying, but for the vast majority of people, just knowing whether it has IPv6 available or not is enough information. We do have to strike the right balance with the UI between power users like yourselves and people less familiar with hosting.

Right now we do support unknown attributes, they show up unless explicitly filtered out. For example, a server might have an unknown CPU speed, in which case it will show up in the results unless a CPU speed filter is applied.

Just to make sure we're on the same page, you'd like to see the size of the IPv6 range assigned to the server, correct? Is there any more information you'd like about the IPv6 support?

Thanks again for your feedback. :)

<comment><USER3> > I understand what you're saying, but for the vast majority of people, just > knowing whether it has IPv6 available or not is enough information.

Well, that's somewhat of a chicken and egg problem, though. It's not like those broken networks are actually necessarily good enough for the purpose that people use them for, it's just that noone is even aware that the network setup is broken and that that is the problem they should be fixing.

> Right now we do support unknown attributes, they show up unless explicitly > filtered out. For example, a server might have an unknown CPU speed, in > which case it will show up in the results unless a CPU speed filter is > applied.

That's exactly what I think is broken, in that unknown values are not handled explicitly in the UI, but forced to an explicit value. When I specify "I need at least 2 GHz", say, that says nothing about whether I want to see servers for which you don't know the CPU speed, as such a server very well might have a 5 GHz CPU. All it says is that I don't want to see servers for which you know that the speed is less than 2 GHz. So, you shouldn't make assumptions about whether I want to see those servers, but rather let me choose what to do with them.

Now, I don't know whether this is important for clock speed, but often there are cases where there is a particular attribute that is known for many products to have a value that doesn't fit my needs, so it would be great if you could say "not any products where this attribute has value X" ... except that suddenly half of the remaining candidates vanish, too, because that attribute happens to be unknown for those, which then means you have to do all the filtering by hand after all, instead of using the search/comparison site to weed out 90% of the candidates and then investigating the remaining 10% by hand.

> Just to make sure we're on the same page, you'd like to see the size of the > IPv6 range assigned to the server, correct? Is there any more information > you'd like about the IPv6 support?

Well, yes, prefix length (or number of addresses for offers that don't even have a prefix, I guess), and I guess whether that prefix can be routed completely to the server, as that is, as ryanlol noted, something many hosters fail to do correctly as well. If you can figure it out (or for providers that are willing to feed you machine-readable data), it would also be useful to know whether the reverse zone of the IPv6 prefix can be delegated.

</comment></comment></comment></comment></comment></comment><comment><USER4> This is very useful and way overdue, thanks. Being able to filter by BGP session support has already saved me hours of work this month (if any DigitalOcean sharks are reading: please match Vultr soon in BGP capability).

I trust you've shared it on LowEndTalk. Now: keep it up to date, not slammed with ads, moderated for accuracy, and profitable. Best of luck.

My main feature request would be the ability to filter out specific hosts that I have had bad experiences with or do not trust (perhaps an X by their username when browsing).

<comment><AUTHOR> No problem! You can already do this using the Provider name field, just use a negative sign, e.g. "-Foo -Bar". Example: [https://www.serverhunter.com/?search=1A6-C01-E8D](https://www.serverhunter.com/?search=1A6-C01-E8D) :)

</comment></comment><comment><USER5> This is the best Show HN I've seen in awhile. Really really useful!

<comment><AUTHOR> Thank you! :)

</comment></comment><comment><USER6> It would be nice to also incorporate ratings somehow. I chose some filters that I wanted. Searched lowendbox for the vps provider that came up first and there are some truely awful reviews. I recommend anyone visit there first before purchasing.

<comment><AUTHOR> We have reviews on our website but, unfortunately, most providers haven't received any reviews yet. We're hoping this will change as our website grows and we're working on getting more reviews on our website.

Do note that, as with most businesses, it's easy to get bad reviews and difficult to get good reviews. Make sure to check multiple sources of information to make an informed decision. :)

</comment></comment><comment><USER7> I like the idea, but there still seem to be some glitches: When I look for VPSs with at least 5GB RAM, I get a lot of VPSes with 1.5GB RAM (e.g. [https://www.serverhunter.com/?search=D21-C9F-3C1](https://www.serverhunter.com/?search=D21-C9F-3C1)).

Also, when you use the "reporting" feature, the report seems to get sent, but submitting it clears the "Issue description" field which is then highlighted in red which at first made me think something went wrong... Probably it should just close the modal window after the submission?

<comment><AUTHOR> Oops, this has now been fixed for those providers you found - I'll check if there are any others I can find.

The issue with the field being highlighted in red seems to be specific to Firefox, I'll investigate and hope to have this resolved shortly as well.

Thanks for letting us know about these issues. :)

</comment></comment><comment><USER8> The idea of creating a index of server providers is good, but all implementations are less-than-ideal, and in the worst case, useless. The core problem here is data quality, the magnitude of noise is usually high:

* The server providers do not give out machine-readable data.

* It's difficult to distinguish some details from specifications, such as vCPUs or dedicated cores.

* Promotions and discounts cannot be recognized programmatically.

* There's no reliable way to detect discontinued or withdrawn plans.

Ultimately, people will find the result of their search is either withdrawn or unusable for some reasons, and they still have to purchase the server from a well-known provider... And lurking at lowendtalk.com is still a better way to find a good deal.

Improving the quality of data sounds like a good machine-learning project.

<comment><AUTHOR> You're absolutely right, getting accurate data is one of the biggest challenges we're facing at the moment. I'd like to believe we're making great progress with it though. :)

Initially, we started off with static data together with a management panel for hosts to add/edit/delete their offers. As you might have guessed, most providers didn't feel like doing this, and those that did made mistakes entering the data or didn't keep it up to date.

This is why we've put most of our effort into automating the data feeds and getting up to date information. Right now, 60.3% of our offers are automatically retrieved from the provider and kept up to date every 24 hours.

Whenever a provider adds, edits or deletes an offer from their website, it's automatically synced to our website accordingly. We also try to do this for stock, but some providers do not expose this information before ordering.

While I'll freely admit we still have mistakes on our website, I hope that it's still useful in finding the right server for your needs, and appreciate your patience while we keep working on improving it every day. :)

P.S: We have deployed some small scale machine learning and are experimenting with it as we go, but since our knowledge in this field is lacking, progress will be slow.

<comment><USER8> Thanks for your detailed response. I sincerely hope your project will be successful, so I don't have to spend a week, looking at all the details such as BGP tables and available payment processors, just to find a usable server in the future ;-)

<comment><AUTHOR> We'll do our best! If you have any specific feedback, let me know and I'll look into it. :)

</comment></comment></comment></comment><comment><USER9> Is there a tech writeup on how the site was built? What software is behind the faceted search?

The site and search experience is fast and I'd love to learn more about how it was built.

<comment><USER10> With only ~11,000 entries and what looks to be a pretty defined set of searchable fields, it should be a simple setup. I'd guess the search is powered by either Elasticsearch or Postgres/MySQL.

I think the more interesting part of the product is going to be the procurement of available servers which I don't have any guesses outside of public API's + web scraping to do that.

<comment><USER9> What was interesting to me is the search ID, [https://www.serverhunter.com/?search=157-857-0B2](https://www.serverhunter.com/?search=157-857-0B2) for example. Each change results in a new search ID. If you toggle the same option on and off, the search ID is different every time. I originally thought it was a way to reference a unique combination of the facets but it seems to create a new search session for each query.

<comment><AUTHOR> The search ID is indeed unique, it's a reference to our database which stores your filters, sort order, and column selections.

We might replace it with something that doesn't require the backend at all, but the URLs will end up quite long if you have a few filters selected.

For now, we figured a short URL is nicer to share with other people. :)

<comment><USER3> Well, a URL that stays valid would be more important than a short URL? I am assuming that you do garbage collect your DB?

<comment><AUTHOR> We will change the URL structure in the future, but it'll be backwards compatible - old URLs will continue functioning forever. :)

</comment></comment></comment></comment></comment></comment><comment><USER11> I am wondering who is providing the information? Vultr list their "Dedicated" as 8 CPU, when it is not dedicated by Cloud VM, which I presume it is shared. And its CPU are not CPU Core but CPU Threads.

These differences make the comparison a harder. Because in Dedicated you talk Core count, in Cloud VM you talk Thread Count ( vCPU ).

<comment><AUTHOR> Sorry about that! They should all be cores rather than threads. In the case of Vultr, we get the information from their API: [https://api.vultr.com/v1/plans/list_baremetal](https://api.vultr.com/v1/plans/list_baremetal) \- "cpu_count":8

Usually, we rely on our own database for core count and speed, but Vultr doesn't actually mention the CPU model in their API either.

For now, I've hardcoded a fix in our backend and I've contacted Vultr whether they can clear up their API in regards to cores vs threads.

Thanks for letting us know! :)

P.S: Every offer has a "Is some information missing or inaccurate? Let us know!" link at the bottom, in case you find more mistakes.

</comment></comment><comment><USER12> A nice to have but relatively unimportant feature suggestion, the option to filter by total capacity independently of drive type.

That aside, this will be useful for figuring out hosting for side projects, thank you for sharing!

<comment><AUTHOR> This is now possible! :) [https://www.serverhunter.com/?search=ADF-3C3-EB9](https://www.serverhunter.com/?search=ADF-3C3-EB9)

</comment></comment><comment><USER13> GCE and Azure is missing or did I miss that?

And a info on the provider AS or a link to the PeeringDB/looking glass would be nice to have. Other than that a super helpful site, thanks.

<comment><AUTHOR> You didn't miss it, we're still trying to figure out the more complex pricing systems of providers like AWS/GCE/Azure. Just to give you an idea, the JSON file describing the EC2 pricing is 650+ MB. :)

We have added AWS Lightsail since the pricing is a bit more straight forward and I'll double check tomorrow if there's anything from GCE and Azure we can add.

</comment></comment><comment><USER14> How did you collect all this data? How do you keep it updated?

<comment><AUTHOR> Custom crawlers, API implementations and lots of automation. Like most search engines, it's not flawless, but it's getting better every day. :)

<comment><USER15> Yeah, some info seems to be incorrect. Like it shows vmhaus has Windows instances but after signing up I could only find *nix.

<comment><AUTHOR> The VMHaus offers were actually added by the provider themselves in August 2018, they specifically selected Windows to be available.

On June 2017 they wrote: "Custom ISO - Use our available Windows & FreeBSD or bring your own ISO." (source: [https://www.lowendtalk.com/discussion/116203/vmhaus-new- uk-l...](https://www.lowendtalk.com/discussion/116203/vmhaus-new-uk-location- uk-nvme-kvm-starting-at-2-70-month-10-off-recurring))

I've sent them a message to clarify. :)

</comment></comment></comment></comment><comment><USER16> Are the sliders keyboard accessible? I use Jaws for Windows as my screen reading software and am unable to adjust the price slider in either Firefox or Chrome.

<comment><AUTHOR> Happy to report the sliders are now keyboard accessible! :)

Turns out keyboard support was only introduced 10 days ago: [https://github.com/leongersen/noUiSlider/issues/724#issuecom...](https://github.com/leongersen/noUiSlider/issues/724#issuecomment-461009737)

We have plans to do some more comprehensive accessibility testing in the near future, but in the meantime, please let me know if you come across any other accessibility issues.

Thank you!

<comment><USER16> Just gave this another look and the sliders do work with my screen reading software which is an improvement. As far as I can tell the page up and down keys don't move in larger increments. Home and end don't move to the top or bottom either. Because of this when looking for servers priced between $0 and $5 I had to repeatedly hit left arrow a bunch of times. Ideally I could have gone to the maximum price slider, hit home to set it to 0, then hit right arrow several times to find my maximum price. I assume this is behavior of the noUiSlider framework and not code you have written.

</comment></comment></comment><comment><USER17> Looks good, congrats! It would be awesome if you could include links for testing speed and latency for each provider (when available).

<comment><AUTHOR> Thank you! Unfortunately, I haven't found many providers offering this, but I'll look into adding it for the ones that do.

In the meantime, you could ping their domain name to get a rough idea (if they don't use CloudFlare or block ICMP) and contact their sales team to see if they can hook you up with something more accurate.

<comment><USER17> Generally the "serious" ones do, and if not then we should try to encourage them to do so. A few examples after a quick Google search:

\- [https://www.linode.com/speedtest](https://www.linode.com/speedtest) \- [https://www.futurehosting.com/network-test- files/](https://www.futurehosting.com/network-test-files/) \- [https://speed.hetzner.de/](https://speed.hetzner.de/) \- [https://turnkeyinternet.net/speed-test/](https://turnkeyinternet.net/speed- test/)

<comment><AUTHOR> Looks good! I'll see if I can squeeze some of this information in. :)

</comment></comment></comment></comment><comment><USER18> Thank you for creating a hub where server providers are indexed. I've been looking for something like this for a while now. :)

<comment><AUTHOR> No problem, I hope you can find something that suits your needs. :)

</comment></comment><comment><USER19> Hetzner would be a great provider to add to this, even better if you could integrate with their server auction :D

<comment><AUTHOR> We already feature Hetzner, including their server auctions: [https://www.serverhunter.com/?search=F61-1A4-E7D](https://www.serverhunter.com/?search=F61-1A4-E7D) :)

<comment><USER19> I missed that, great stuff!

</comment></comment></comment><comment><USER20> My only interest is missing as I see at first glance: GPU support

Edit: found it as "Graphics Card" :D

<comment><AUTHOR> There are not many providers that offer it, but if they do, it'll have that feature. What do you use it for, if I may ask? :)

<comment><USER20> I don't use them yet, but I'd render shaders. I need to test it if it's worth it since it's probably possible without GPU-s.

</comment></comment></comment><comment><USER21> Thanks for this quite useful. Finally, some other dedicated providers than Hetzner pop-up

<comment><AUTHOR> Happy to hear that! :) Hetzner has some great value servers in Europe, but fortunately, there are still plenty of alternatives around.

</comment></comment><comment><USER22> Wow, how much I'm paying and how little I could have been!

</comment><comment><USER23> Could you indicate the billing frequently beside the price?

<comment><AUTHOR> We're a bit tight on space in the price column.

For now, you can click the one of the column headers in the middle and change it to to "Billing interval", like this: [https://www.serverhunter.com/?search=B3E-305-AF8](https://www.serverhunter.com/?search=B3E-305-AF8)

</comment></comment><comment><USER24> Question for hosting and db experts- should one go for ssd or HD when hosting? I'd think HD is better because you can anticipate failure using smart. Ssd has the advantage of being faster to load data.

On that note- are database systems now able to make better use of ssd's? Most optimizations centered around contiguous storage in hdd era.

<comment><AUTHOR> You'd always want some kind of RAID mirroring with off-site backups, regardless of HDD vs SSD. If you take care of that, you can safely go with SSD. :)

</comment></comment><comment><USER25> Css for adblocking:

#tbody_results > tr:first-child { display:none; }

<comment><AUTHOR> Our ads won't always show up or be the first row, you could simply use .advertisement { display: none } for now.

Do note that our advertisements are not served via a third-party provider, there's no tracking, no chances of malware or rogue JS and they're actual offers from our website based on your search filters.

It would be appreciated if you kept them, but in the end, that's entirely up to you. :)

<comment><USER26> A site owner correcting someone on how to properly block ads on their site - an internet first?

<comment><USER6> It shows they are responsive and open. Also they know so few people will do this it doesn't matter.</comment></comment></comment></comment>


SQL Injection Vulnerability in Ruby on Rails; affects all versions - <AUTHOR> https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM <comment><USER2> The overreaction on this page is ridiculous. Has anyone actually read the steps required to exploit this vulnerability?

You do know that to be able to exploit it you have to know the application's secret key, so you can create your own malicious encrypted session cookie that includes hashes instead of strings for the auth token lookup?

You do know that if someone has your app's secret key they can just write whatever they want into the session cookie, instantly compromising a large number of apps anyway? That's the whole point of the secret key!

This is an obscure issue which can be used to get around one layer of defense in rails security. It could never get around all of them. It requires intimate in-depth knowledge of the app to even attempt the exploit. Sure, it's a bug, and it's not to be taken lightly, but the howls of derision here are totally out of proportion.

<comment><USER3> It is not an overreaction.

This is a much more subtle SQL injection.

I believe the takeaway is that too much magic is a bad thing when it obscures the underlying behavior.

Post.find_by_id( ) accepts an argument. Here are some normal assumptions:

1\. It might only take a number

2\. The method might coerce it to a string or integer for you

3\. The method might not coerce it.

4\. The method might throw an error if it isn't an int or the object isn't found.

5\. The parameter is treated like a hash and used for lookups.

This last one seems a bit too much magic to me. I wouldn't even guess that last one as normal, expected behavior.

<comment><USER4> But that is an overreaction. The find_by_* dynamic handlers have always accepted strings and integers, by design. What's insecure about User.find_by_id("27")?

What people seem to be reacting to is the idea that User.find_by_id(params[:id]) is exploitable because you can coerce params[:id] into a hash instead of a string (by using a query string like ?id[select]=some_thing_here instead of ?id=27). True, but what most people here are overlooking is that User.find_by_id actually rejects these hashes because their keys are strings and not symbols. Try it out.

This vulnerability can be coupled with other vulnerabilities (like having someone's session secret, which is a much worse vulnerability IMO), but people are talking about it as if you can do something nasty with it by itself alone. That's why it's an overreaction.

</comment></comment></comment><comment><AUTHOR> FWIW, this is the third time in seven months that Rails had to issue a patch related to how ActiveRecord handles method parameters.

3.2.6 (June 2012) [https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/l4L0TEVAz1k)

3.2.4 (May 2012) [https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/dUaiOOGWL1k)

<comment><USER5> I've always found Rails to be easy to secure compared to most other frameworks.

I think the defaults are all pretty secure.

I'd prefer having constant security patches. It shows people are still constantly testing it for vulnerabilities.

<comment><USER6> SQL injection is the web-equivalent of having a stack allocated buffer overflow. We have built and use (expensive) abstractions that supposedly _eliminate_ these whole class of issues.

With Rails, you get the expensive abstraction and apparently none of the security.

<comment><USER7> Yes, clearly, because Rails has introduced _absolutely no other kind of default protection_.

Is this an argument for hand rolling your own code, or for using some other framework that is apparently immune (or, to be charitable, has a stronger security track record)?

<comment><USER8> Likely its an argument to use parameterized queries which fix the SQL injection problem altogether. I'm not familiar with Ruby, but surely they support it in 2013?

<comment><USER9> They do, but what we're talking about here is an ORM, so there will always be machine generated SQL somewhere. Or do you believe that GP is suggesting that developers use parameterised SQL queries _instead of_ an ORM?

<comment><USER10> Er, why can't the ORM use paramaterised queries?

<comment><USER11> The problem is that ORMs like ActiveRecord really are just domain specific languages for building queries. If these DSLs use inband are carelessly constructed (e.g. they use some form of inband signaling) you can do the injection attack against the actual ORM code and make it build queries the author of the code did not intend.

<comment><USER12> <http://sqlalchemy.org/> is an ORM and does not have these security issues. So it can be done.

<comment><USER9> Searching for "sqlalchemy sql injection" brings up this: <https://bugzilla.redhat.com/show_bug.cgi?id=783305>

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> So does the fact that "Rails is Omakase" ([http://david.heinemeierhansson.com/2012/rails-is- omakase.htm...](http://david.heinemeierhansson.com/2012/rails-is- omakase.html)) mean that the chef tried to serve Fugu (<http://en.wikipedia.org/wiki/Fugu>) but cut it wrong?

<comment><USER14> I think this is a correct analogy, but you have to take something else into consideration: there are no chefs that don't cut fugu wrong from time to time. We should cut fellow programmers some slack.

<comment><USER15> "there are no chefs that don't cut fugu wrong from time to time"

This doesn't seem to be the case: fugu preparation is licensed and regulated, and deaths are very rare indeed. I can't find exact numbers offhand, but according to a paper cited on Japanese Wikipedia, there were 315 fugu poisoning incidents in Japan in the 10 years from 1996 to 2005. Of those, 31 were fatal, and of those, the majority were due to preparation by unqualified individuals (presumably those who had caught fugu themselves).

Given the quantity of fugu consumed nationwide, it seems reasonable to say that, in fact, most chefs never cut fugu wrong - or at least that most chefs never serve wrongly cut fugu.

[https://ja.wikipedia.org/wiki/%E3%83%95%E3%82%B0#.E3.83.95.E...](https://ja.wikipedia.org/wiki/%E3%83%95%E3%82%B0#.E3.83.95.E3.82.B0.E3.81.AB.E3.82.88.E3.82.8B.E9.A3.9F.E4.B8.AD.E6.AF.92)

<comment><USER14> That sentence referred to original post, read it as "there are no programmers that never make bugs". I didn't mean the real chefs!

</comment></comment></comment></comment><comment><USER3> I am mostly a Django programmer so excuse my ignorance of rails. How does this keep happening?

In Django you would do:

Post.objects.get(pk=request.GET['id'])

There really is no way to do SQL injection this way.

This line in rails looks almost exactly like how you would do it in Django:

Post.find_by_id(params[:id])

Also this seems really serious. It's not like a edge case where you need to grab a post by id. This is probably a very common use case of that method find_by_id.

<comment><USER16> You are going to have problems with this whenever you are composing SQL statement with any type of user-provided data as part of the raw SQL string passed to the server.

This generally happens in one of two says:

1) (most common) You have a SQL statement that takes a user-provided parameter and you compose your SQL statement as a string, including that parameter (eg., sql = "SELECT * FROM person where id = " + form.id, or similar). This is typically solved by using parametric, prepared statements. Basically, you prepare a SQL statement that contains "?" for the parameter values and then bind values to the statement.

2) (Common in ORM frameworks) A user provided string is used to compose some other (non-parameter) piece of the SQL statement, such as a column or table name. This is usually caused by laziness. Rather than combining the string provided by the user (form values, URL components, etc.) you should instead look up the string to use from some internal data source, such as a list of domain classes, etc., and use that instead. In that way, the data that is user provided is kept entirely separate from data that will be executed.

You'll hear a lot of people talk about "why isn't this being escaped". And, frankly, it's a good question. But the real question is "why are you trusting data that could come from anywhere on earth?". Don't take it for granted that only your users will be sending queries to your application.

The code you write for Django (Post.objects.get(pk=request.GET['id']) is only secure from 1 and 2 if the framework is written in an appropriate manner to avoid trusting user provided data.

The fact that this keeps happening on Rails is the #1 reason I haven't bothered to take the time to do anything real with it. I don't have the time to read the code for the framework and I don't trust that it's written with security in mind.

ps. This type of problem applies to any kind of "data that is executable", be it strings passed to an "eval" function or strings passed to a web browser. SQL is just a giant eval() function.

<comment><USER17> This is not the problem. Please stop spreading misinformation.

ActiveRecord _does_ escape user input.

The exploit here is that under certain obscure circumstances it is possible trick ActiveRecord into thinking the user input is an options hash passed by the caller.

From my understanding this is non-trivial to exploit on most applications, and requires passing in a Hash with symbol keys.

This is still a vulnerability that needs to be (and has been) fixed, but it is nowhere near as stupidly obvious as you are claiming.

<comment><USER16> Umm.. I didn't say that ActiveRecord doesn't escape user input. So, stop spreading misinformation about my post ;-)

The fact of the matter is, whether its in some dark edge-case or not, user- provided data is being used to compose a SQL statement that is being passed to the server. Escaped or otherwise, that's a recipe for an injection attack.

<comment><USER2> > user-provided data is being used to compose a SQL statement that is being > passed to the server. Escaped or otherwise, that's a recipe for an injection > attack

How do you implement authentication if you can't check an email (user provided data) matches a password (user provided data, probably hashed but still)? How do you look up blog posts by a user-provided tag, without using that tag in query composition? How do you save any user provided information at all without somehow including that information in an SQL query?

You have to use escaped user provided data _all the time_ in a real application. Any actual web developer would know that.

<comment><USER16> Simple: use parametric prepared statements instead of composing a SQL string with the user-provided data (escaped or otherwise).

This has been available in numerous database APIs for like, ever.

For example [1], [2], [3]. Any actual web developer will have read something along the lines of [4].

A lot people seem confused by my original post, which was in response to a Django user's question about how this sort of thing happens. I provided a general response which seems to have offended some people.

Yes, Rails does appear to use parameterized statements. However, when it is building those parameterized statements it's still using user provided data to build the SQL. If that weren't the case, then this wouldn't be a bug at all, would it? Of course not, so obviously it is using user-provided data in some way, otherwise an HTTP cookie's value wouldn't be getting passed to the database, would it? The prepared statement string shouldn't be composed with anything user provided.

[1] <http://php.net/manual/en/mysqli-stmt.bind-param.php>

[2] <http://bit.ly/WlPEFR>

[3] <http://rubydoc.info/gems/mysql/2.9.0/Mysql/Stmt>

[4] <https://www.owasp.org/index.php/Top_10_2010-A1>

<comment><USER18> The attack is targeting a secondary method signature that #find_by_* can hold with the express purpose of executing arbitrary SQL. That is, when #find_by_* is invoked with a hash with a key such as :select or :conditions it expects a SQL string, probably hard coded.

The bug however is that it's possible for user input, with a session hijacking, to provide that hash with symbolic key. There is no SQL injection, this is straight up arbitrary execution of SQL.

<comment><USER16> Out of curiosity, all other debates aside, would it not be helpful to have (either built-in or as a separate plugin) a way for Rails to run a simple set of sanity checks on the SQL it passes to the DB server? For example, checking to make sure that the generated SQL doesn't contain "--" wouldn't fix the underlying problem, but it could be used to prevent the exploit from ultimately working (and, if someone tried this, would alert you to that fact, assuming the error was logged).

I get that this would create some performance overhead, so it would ideally be configurable.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Im not a RoR developer, so forgive my ignorance. But how does this keep happening? I thought ActiveRecord is a mature product by now. I hear about these types of bugs happening with RoR pretty often, is the "magic" of ActiveRecord and hiding SQL from the developer really worth it? I wonder how many RoR developers even understand what SQL injection actually means.

</comment><comment><USER20> It seems like this is being conflated with the session token issue? How do you submit params with symbolized keys? Hashes are easy enough, but it doesn't work with hashes that have strings as keys, only symbols.

EDIT: Just to be clear, tenderlove (Ruby/Rails committer) confirms that you do not need to edit the session to exploit this (<http://news.ycombinator.com/item?id=4999767>). It's still unclear how it is possible otherwise though, I assume he's being purposefully vague.

<comment><USER21> Rails param parsing automatically converts all param keys to symbols.

<comment><USER22> Just to expand on what others have already said...Rails converts params to [http://api.rubyonrails.org/classes/ActiveSupport/HashWithInd...](http://api.rubyonrails.org/classes/ActiveSupport/HashWithIndifferentAccess.html) which means that `params[:foo]` and `params["foo"]` will both return the same thing. The function [`assert_valid_keys`]([http://api.rubyonrails.org/classes/Hash.html#method-i- assert...](http://api.rubyonrails.org/classes/Hash.html#method-i- assert_valid_keys)), which is called in [`apply_finder_options`]([http://api.rubyonrails.org/classes/ActiveRecord/SpawnMethods...](http://api.rubyonrails.org/classes/ActiveRecord/SpawnMethods.html#method- i-apply_finder_options)) does not, however, treat symbol and string keys as the same, even if given a `HashWithIndifferentAccess`.

<comment><USER14> To expand on your expansion: when a hash with indifferent access is asserted over a list of symbols (as is the keys) it will _always fail_.

        1.9.3p327 :025 > {:a => "b"}.with_indifferent_access.assert_valid_keys([:a])
        ArgumentError: Unknown key: a

</comment></comment></comment></comment><comment><USER23> This affects all versions of Rails, not just 3.x.

This is a really, really bad hole, and you should patch or upgrade ASAP.

<comment><AUTHOR> Thanks, fixed the headline. All versions are affected, only 3.1, 3.2 have official support

</comment></comment><comment><USER24> You need the contents of secret_token.rb to exploit this (via a forged session). This makes it much more of a danger to OSS projects than to those in the closed source space.

It's not _just_ a SQL Injection vulnerability. With that secret token, you can set any session value you like.

<comment><USER25> This is how I understand the issue as well. Many people in this thread are commenting about massive dangers, but I don't think anyone has bothered to actually read the references in the CVE.

Also, even open source projects typically ensure or recommend that the secret token be regenerated when using in production environments.

<comment><USER26> I think the CVE description is inaccurate in this case. Check out the Rails security email list description, which never mentions sessions.

[https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...](https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails- security/DCNTNp_qjFM)

</comment></comment></comment><comment><USER27> The irony of this security vulnerability being announced by 37signals on Google Groups on the same day they release a new product called Basecamp Breeze [1] which is a direct competitor to Google Groups (and they compare it to Google Groups) ... hasn't gone unnoticed.

[1] <http://basecamp.com/breeze/compare#google>

</comment><comment><USER28> Would appreciate if someone could explain the issue in a little more detail for non RoR developers

<comment><USER14> Assuming you have no ruby knowledge:

ActiveRecord (rails' default ORM) has a feature called "dynamic finders". When you call a method like `Forum.find_by_url('news.ycombinator.org')` it gets a first forum with such url. This is a sugar over `Forum.where(:url => 'news.ycombinator.org').first`.

Normally, you use it like that `Forum.find_by_url(params[:url])` where `params` is a hash of parameters (that is auto-generated from http get/post params). What happens if instead of "normal" value like "news.ycombinator.org" you pass a hash?

        1.9.3p327 :018 > Forum.find_by_id({:select => 'id FROM forums --'})
        Forum Load (0.5ms)  SELECT id FROM forums -- FROM `forums` WHERE `forums`.`id` IS NULL LIMIT 1

Uh-oh.

However, not everything is lost. Rails params are converted to a special hash class. It's called HashWithIndifferentAccess, because you can access its values by string keys and symbol keys likewise. So that

        h = {:a => 1, "b" => 2}.with_indifferent_access
        h["a"] # => 1
        h[:a]  # => 1
        h["b"] # => 2
        h[:b]  # => 2

What happens if we pass user-generated params? It seems like not much:

        1.9.3p327 :024 > Forum.find_by_id({:select => 'id FROM forums --'}.with_indifferent_access)
        ArgumentError: Unknown key: select

So I guess they are erring on a safe side here.

<comment><USER29> What's the great benefit of these methods? Why not just do find_by("url", x)? I just don't understand the desire to move string parameters into member names.

<comment><USER14> There is slight benefit in readability for cases like find_by_name_and_role("Jack", "admin"), but other than that, no benefit whatsoever.

In Rails 4.0, most dynamic finders are deprecated and removed from the source into a separate gem.

</comment></comment></comment></comment><comment><USER30> I've written a blog post which explains what this vulnerability is, how it works, what the facts and non-facts are: [http://blog.phusion.nl/2013/01/03/rails-sql-injection- vulner...](http://blog.phusion.nl/2013/01/03/rails-sql-injection- vulnerability-hold-your-horses-here-are-the-facts/)

<comment><USER31> Thanks for that: really clears things up.

It would have been really useful if the upgrade notification had included this level of detail to start with so people could make a much more informed decision about when/if to upgrade, rather than having to dive through bug reports, commits etc just to work out if our apps are vulnerable.

</comment></comment><comment><USER32> For someone just learning RoR and having installed it via <http://railsinstaller.org/>, how should I upgrade?

<comment><USER33> Run "bundle update rails" in your project's root directory (where your Gemfile is).

<comment><USER34> This won't work if your Gemfile declares a version of Rails (Rails 3.2.9 did this). You have to update the Gemfile and then bundle update.

</comment></comment></comment><comment><USER35> It seems easy to blame the magic finders for this (because they seem magic), or ActiveRecord alone, but really the problem is that 'secure by default' can trick you into thinking the framework will do it all for you.

It probably will most, if not all, of the time for you. But the complexity of such things understandably means there will be obscure vulnerabilities that are hard to track down.

Sanitising -- and even validating -- your params at the controller level is a nice way to stop some of these problems before they reach your models.

</comment><comment><USER36> This isn't a problem if you check the type of data you get from a user before you use it. You should be doing that anyway.

The article says a work-around is to use .to_s or .to_i on user input. My standard practice is to cast to int for all IDs I get externally (in PHP too). Some projects I work on go so far as to validate type and data ranges of every argument passed in. Those applications would therefore not be vulnerable even though Rails itself is.

<comment><USER37> "You should be doing that anyway."

A huge selling point of Rails, other web frameworks, and ORMs in general, is that you don't have to be doing these checks. You can push the query through without concern of SQL injection, and handle the failure case there. This is convenient because you often have to handle that failure case anyway.

Rails' own "Getting Started" guide uses this technique because it's assumed to be secure: [http://guides.rubyonrails.org/getting_started.html#showing-a...](http://guides.rubyonrails.org/getting_started.html#showing- an-individual-post)

We know you can "break" the application by tampering with IDs, but you shouldn't be able to pose a security threat.

Validating type and data ranges is common with things like dropdowns, where you need to ensure an actual option was selected. This is a very common security flaw, and it's definitely good practice to be checking (especially when it leads to adding/updating database rows).

<comment><USER38> The getting started guide does not use that technique. It uses `Post.find(parms[:id])` The vulnerability is in `Post.find_by_id(params[:id])` and any other `find_by_*` dynamic finders.

</comment></comment></comment><comment><USER39> Having just finished upgrading my production rails because of today's news I thought I would pass along a how-to for rails 3.x

update your Gemfile and set the version you want. In my case:

gem 'rails', '3.2.10'

locally, run

'bundle update rails' which will update your Gemfile.lock

check-in and deploy your code. If you are using capistranso, the default 'deploy' task should handle everything for you. Otherwise, run 'bundle update rails' on your production server.

</comment><comment><USER40> Does anyone know of a patched version of rails 2.3 series on rubygems?

<comment> rob-anderson No but you could do what we did: [http://robanderson123.wordpress.com/2013/01/05/applying- back...](http://robanderson123.wordpress.com/2013/01/05/applying-backported- security-patches-to-rails-2-3/)

</comment></comment><comment><USER41> I believe that its a test of how quickly you can patch your applications when something like this does come out - We did it in 3 hours from time of bulletin - how about you? [http://blog.assembla.com/assemblablog/tabid/12618/bid/93731/...](http://blog.assembla.com/assemblablog/tabid/12618/bid/93731/Continuous- Deployment-is-Secure-Howto-Patch-3rd-Party-Apps-Uber-Fast.aspx)

</comment><comment><USER42> So it only the only the dynamic finders (find_by_) that have the vulnerability, not Model.find(params[:id])?

<comment><USER43> Yes, it's the dynamic matchers only.

</comment></comment><comment><USER44> The more I read these stories (and not just in Rails, though they seem to be the most talked about), the more I seriously consider taking the time to evaluate frameworks such as Yesod where the type system makes these kinds of security flaws impossible.

</comment><comment><USER45> Oh. I always figured it was bad coding, but I normally use the workaround anyway. Post.find_by_id(params[:id].to_s)

Regardless, I think I have some patching to do tonight.

</comment><comment><USER46> Does something similar affect mongodb or am I OK?

<comment><AUTHOR> This is an ActiveRecord issue...MongoDB uses its own ORM (Mongoid/Mongomapper)

<comment><USER46> That's what I was referring to. Do mongomapper and mongoid have this problem?

<comment><USER47> On the bright side you need not fear this bug for your apps using MongoDB. Mongoid and MongoMapper do not use SQL, so there should be no SQL injection problems using those two options.

<comment><USER46> I'm aware they don't use SQL, but someone on HN once told me there was some kind of JavaScript injection you could do in theory. Was wondering how mongoid would handle this technique.

<comment><USER26> Example: [http://www.idontplaydarts.com/2010/07/mongodb-is- vulnerable-...](http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable- to-sql-injection-in-php-at-least/)

</comment></comment></comment></comment></comment></comment><comment><USER48> Does this affect friendly_id?

edit: friendly_id does not use the dynamic find_by_x methods. I guess it should be safe.

<comment><USER34> This particular exploit doesn't either.

</comment></comment><comment><USER49> Just wait until you find someone named Robert'); DROP TABLE STUDENTS; --

</comment><comment><USER50> One could lament that the real issue is the (maybe not so) accidental complexity (and hidden deep down complexity lies insecurity) that results when you're using utter non-sense like an ORM.

The very concept of an ORM is broken. I know most devs don't know SQL well enough to do more code directly from SQL and I know most devs don't know anything else than SQL... But it's a bit sad to see all these "frameworks" tailored to the masses.

dev: "I want objects. I don't really understand set theory but I still want SQL because it's all I know."

chef: OK, here's a framework doing nearly everything from you.

Seriously guys. Mixing orthogonal concepts and posting provocatively titled blog entries like "OO and SQL aren't orthogonal concepts, there's no mismatch impedance" ain't going to help.

The only thing this creates is a lot of needless complexity and, of course, there shall always be major SNAFU like this one.

Maybe, just maybe, that we could realize that if the reader is set to "from now on do not eval anymore" code shall not be eval'ed? And maybe, just maybe, that we could realize that if you're not using SQL you're not subject to these monthly SQL injections issues?

How far does the SNAFU need to go for you to consider that OO + SQL is actually a very, very poor mix?</comment>


Ask HN: Daily Available Startup Domain Names... Interested? - <AUTHOR>

It may sound totally ridiculous but coming up with a name that has an available .com domain name is the part I despise the most about new projects. There is just something wrong with trying every single permutation at a domain registrar only to end up with a crappy, "settled for" name hours later. Naming tools kind of suck too in my opinion.
So, a month or two ago, I got fed up of this and decided to use my programming skills to tackle this problem. Using drop lists, algorithms and quite a few metrics, I finally managed to produce something that gives interesting and available .com domain names as results!
The daily quantity of both suitable and available domain names varies, but I generally get 20-40 without a problem.
To give you an idea, here is the list I generated yesterday:
arcticpack.com basetable.com bashtracker.com bulletstocks.com campusrally.com carbongenie.com chilltree.com codesmell.com crowdcome.com earthunit.com extrasmiles.com fiberoasis.com filmshout.com foxyflyer.com gatorhire.com geekimpact.com goodprog.com mailshaker.com metafollow.com ownerfind.com phonemama.com calltap.com racerapp.com rubycoach.com snappyapp.com sourcefully.com stripspots.com targeteyes.com topicbased.com writerslate.com
Not the best I've seen (there are good and bad days!) but it sure beats looking at the 86000 domains expiring everyday, or even worse, trying your hand at coming up with something that isn't already taken. All of them where available yesterday and could still be right now... As a bonus, the names generally also give startup ideas! ;)
I'm imagining I was not alone having [domain] naming issues and am simply wondering if this is useful and/or interesting to anybody else. I can easily do it everyday if I get a good response. The important thing for me is to keep it in the startup/hacker community. I don't want the domainers/squatters on these too. I would also like ideas on how to potentially monetize this a bit if you have any. I was thinking of making a daily newsletter with the names and maybe sell 1-5 at a very reasonable price like 30-50$ or not selling names but charging a small yearly fee to get on the newsletter.
Anyhow, I'm waiting for your comments and ideas. Bonus points if you register a name from the list! <comment><USER2> Sounds exactly like Dan Rubin's mailer from justdropped.com. His is free, you pay when you buy a domain name (usually in the $60-$200 range, sometimes more). The email comes out daily, with about a couple dozen domains, quality very similar to your list.

My observation from being on that list for the last couple years: it seems like a great idea but nothing ever pans out. Just so you get an idea, a few examples of my targets: personal domain for a generic computer consultancy, budget around $300; publishing company e-reader, budget around $20k, friends' projects from yoga studio to nightclub to astronomy, budget around $100, etc. Criteria: relevant, easy to remember, easy to pronounce, no competitors in the same space... the usual.

Try it for yourself. Make a quick list of 10 real-world businesses. Then take a week's worth of your mailers, put yourself in a prospective owner's shoes, and try to match them up. I suspect you would see that it doesn't add much value. There are kinda sorta cool names on your list for sure, but nothing that a few friends over beers (or thesaurus.com) couldn't come up with in 15 minutes.

Sorry to be a downer... I very much agree that domain generators suck. A better offering would be killer.

Perhaps it's just not a "computer problem" (i.e. a repetitive task with well- defined parameters). I'd love to be wrong on this one.

<comment><AUTHOR> I'm actually on Dan's newsletter too and though he seems to be doing quite good, I personally find his domains are overpriced for the quality. It feels to me like he is targeting the domainer market with the quality, but at prices that exclude bulk buyers like them.

I agree with your observation and realize I probably worded my post wrong. The idea is not for you to periodically watch the lists waiting for your perfect domain. That won't work. It is more to just casually browse it, and if one just screams at you, you get it at a reasonable price (< $50) or even at reg fee.

And about the quality of the names on my list, everything is relative. I try to focus more on a niche (startup/service/product/blog names) even though I have quite a few good names available in other markets too. If you are looking for something outside of what I'm listing, of course quality seems a little lower. Five names on my little sampler got registered in a few hours so I believe there is some sort of interest.

In my opinion, most domain name related problems truly cannot be solved with a programming approach. One that can, however, is extracting gems out of dropped and available domains. I'm not saying it's easy, but I plan on working on it!

<comment><USER2> His pricing appears to be fairly random. I recall seeing aftersixty.com which I thought was a potential goldmine, 60+ being a well-monied yet underserved community, and it was priced under $100. A couple months later, it was listed again, this time for over $1k if I remember. So he doesn't appear to use a pricing formula.

Anyway, best of luck with your project... hope to see a follow up post from you on here.

</comment></comment></comment><comment><AUTHOR> Alright so I read the feedback and it seems there is at least a little bit of interest in this. Here is how I will proceed: I'll make a FREE daily newsletter you can sign up to using MailChimp (or some other good alternative... feel free to suggest) where I list the domains. I will most likely experiment with putting a small percentage of the names on the list for sale everyday and I guarantee prices will always be $50 and lower.

I will post a link to the signup form on this page and maybe also submit it as a new entry. Be on the lookout for it if you want in.

Oh and some more available names for you all :) Enjoy!

arcadehud.com backmaker.com barkmap.com beaminfo.com booktakers.com bubbleless.com cablezap.com clicksir.com clothi.com codecollect.com condovia.com connectmix.com coopsquad.com crowdlead.com discodeep.com duelpit.com echocoach.com flatside.com fluxplay.com gametrex.com gatespell.com hipstatus.com jamshell.com liveways.com mailslide.com marketsensor.com metastyles.com meterclicks.com patterndeck.com picacast.com pitchlove.com playsync.com presshack.com pushcamp.com reptable.com sheetstrip.com shieldset.com sleepmeter.com smartscaling.com springsites.com tagsmash.com talentlever.com torquefive.com travelgage.com wordables.com

</comment><comment><USER3> This is something that I would definitely subscribe to. The available names that you shared are pretty nice.

I do think that it would be hard to find people willing to pay for a list of available domain names, unless it were a very small amount, but even then you wouldn't likely have very many subscribers (and I think most would be domainers).

I think a way to monetize a free service/list like this would be to charge a fee for specific requests. Once you had established yourself as someone who could definitely come up with good names, I expect people would come to you, and you could charge to come up with a private list of available names for whatever their topic is.

</comment><comment><USER4> I usually hunt for domain names _after_ an idea strikes my mind. So the signal noise ratio of your mailing list will probably be too low for my taste. Thanks for posting a sample of your findings, though!

</comment><comment><AUTHOR> OK it has been a while but the newsletter is finally ready along with the website! I'll be surprised if anybody sees this comment but I did say I was going to post an update here.

You can subscribe and learn more at <http://domainwhirl.com> and can read the Show HN post here: <http://news.ycombinator.com/item?id=1761541>

Enjoy!

</comment><comment><USER5> It's a pretty good idea though I usually am able to find a decent name using bust a name.

I'd consider doing it woot/groupon style and just selling one a day. Based on your examples maybe categorize/tag them ("green" "travel" "hacky/geek" "mail" etc).

I personally wouldn't pay to be on a mailing list but I'd probably try and jump on a good one here and there.

</comment><comment><USER6> Count me as interested. Whatever business model you end up with, it sounds like you can find decent names, which I would gladly pay a small premium for.

Since this post will fade away soon, you should set up a basic email list so that people here can at least follow what you plan to do.

</comment><comment><USER7> >>the names generally also give startup ideas! ;)

That was a good one!

The newsletter can work well as a brainstorming tool in coming up with names for ideas one may have.

It sure was tough to come up with names for some ideas that popped up a while ago.

</comment><comment><USER8> I liked sourcefully.com and grabbed it to use as a place for my friend and I to deploy app ideas. Visit it in a couple of months, we may have something good on it :)

The list is really nice, I'm not sure if people would be willing to pay for this though.

</comment><comment><USER9> I probably spend too much time picking up domain names and not enough creating the services to run on them already. That said, I'm working on getting codesmell.com :)

</comment><comment><USER10> I'm curious; what do you call people who are willing to pay for lists of potential domain names they could buy, if they're not "domainers"?</comment>