Multiple vulnerabilities in parameter parsing in Action Pack - <AUTHOR> https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion <comment><USER2> An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with a new rails application without any controllers.

Here is the commit where it was introduced: [https://github.com/rails/rails/commit/27ba5edef1c4264a8d1c0e...](https://github.com/rails/rails/commit/27ba5edef1c4264a8d1c0e54675723d37a391dd8#L5R133)

<comment><USER3> I don't speak Ruby. Can you or someone else be more precise about where that introduces the vulnerability? (Surely it isn't that YAML::load(content) can run arbitrary shell code?)

<comment><USER4> Calling YAML::load on attacker-controlled content in a Ruby app of any complexity is very bad news. As Ben and 'judofyr said: this is remote code execution.

<comment><USER5> Is this because Yaml doesn't whitelist the classes for the objects that may be instantiated? They are allocated and then instance_variable_set'd so I'd be _Very_ interested to learn how this poses a risk.

<comment><USER4> The people saying that they have POC code for remote code exec aren't making it up.

<comment><USER5> If I implied that I doubted them, then I failed to communicate my point effectively -- I am very curious about how to turn a class allocate + instance_variable_set into remote code exec. I see how you can create the arel objects for sqli, but not arbitrary ruby.

<comment><USER6> If you wait a couple of weeks you are much more likely to get an answer. Since all rails apps were vulnerable, most people who know how to execute arbitrary code are keeping silent for now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'm just commenting here so that people can have a central thread for love / hatred. ;-)

But seriously. This is extremely critical, please upgrade!

<comment><USER8> As there have been many exploits / issues recently realized in parameters parsing, why isn't there more of a focus on security here? Specifically, this is where users/hackers can put _ANY DARN THING THEY WANT_ and your server has to deal with it.

As a simple solution, one could pass a signed auth-hash of the fields generated by form_for, and the server could re-hash the fields submitted to ensure the form data you asked for is what you get (this solves the primary issue with attr_accessible). I feel getting this right is crucial to Rails' future.

<comment><USER9> > why isn't there more of a focus on security here?

More compared to what, exactly? This vulnerability was responded to pretty damn quickly after it was reported, given that almost nobody is even paid to work on Rails. If you saw Aaron tweeting about "working over the weekend" a few days ago, well, now you know.

That said, you mention attr_accessible in your post: that's gone as of the next release of Rails. Basically everyone agrees that strong_parameters is a better approach, which is why a gem was released that works with 3.2: you can use that better approach now.

As was mentioned below, security is a process, not a result. Nobody wants these kinds of issues to happen, but they will happen, and do to every single framework that's used by lots of people.

<comment><USER10> Nothing gives me confidence in a platform like "almost nobody is even paid to work on Rails."

<comment><USER11> I thought some come of the core committers had their work sponsored by their employers.

<comment><USER9> Aaron is the only person on core who is paid to work on Rails. (Among other things.)

I am a committer, and part of my job is to work on open source. Ish.

Other than that, it's everyone else's spare time, IIRC.

<comment><USER11> Wow, that actually gives me more confidence because we have people doing it because they feel passionate about it. Thanks for your hard work....

I've been busy with some other small OS projects (and stuff that pays the bills) but personally feel like I need to try to carve out some time this year to do something to contribute back to Rails.....

<comment><USER9> <3

If I can help you help us somehow, please let me know.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER2> This vulnerability is also present in other other Ruby libraries. I would advise anyone to do bundle install --deployment in there development environment then 'grep -r "YAML::load"' and 'grep -r "YAML.load"' in the vendor/bundle directory. If you have YAML::load(user_controlled_value) or YAML.load(user_controlled_value) then you might be vulnerable to remote code execution. There are some other ruby libraries that are vulnerable to this attack but I don't want to post about them until their authors have fixed them.

<comment><USER12> Good reminder, but this has always been true. Giving unfiltered user-specified content to YAML has never been a good idea.

</comment></comment><comment><USER13> I don't use Rails, and read up on the vulnerabilities. Here's a quick summary:

1\. This class of problems is not unique to Ruby.

2\. Similar problems have been identified in Struts, and python's pickle.

3\. Specifically in this case, YAML.load() can deserialize unintended object types. In the case of Struts the problem was the expression library used can also deserialize unintended object types (like File), plus setting properties on these types can have side effects (such as dropping files into your system).

4\. I took a look at Microsoft's WCF. The DataContractSerializer states that it only is allowed to load types that are specified by a contract. [http://msdn.microsoft.com/en- us/library/vstudio/ms733135(v=v...](http://msdn.microsoft.com/en- us/library/vstudio/ms733135\(v=vs.90\).aspx) This should be the gold standard. In addition, it warns that even loading XML documents can be dangerous if we then load remote DTDs for validation.

5\. For the old salts, remoting or RMI have similar issues - both mitigated by restricting the types that can be deserialized. [http://msdn.microsoft.com/en- us/library/5dxse167(v=vs.71).as...](http://msdn.microsoft.com/en- us/library/5dxse167\(v=vs.71\).aspx)

6\. Here's another vulnerability which targets serialization <http://wouter.coekaerts.be/2011/spring-vulnerabilities>

In summary,

1\. all deserializers should be viewed with suspicion.

2\. A deserializer which does not implement a whitelist of types that it can deserialize to is not suited for handling arbitrary data.

3\. For example, it is capable to creating untainted/trusted objects in application servers, which some time later, may be used for XSS, or execution in SQL. In the Struts case, the standard Java libraries have constructors and methods that deserializing is enough to result in an arbitrary file being dropped on the remote file system.

<comment><USER4> Very similar vulnerabilities have definitely been discovered in other platforms.

This vulnerability is most similar to the object loader vulnerabilities found in Spring a few years back. It is the kind of vulnerability that is occasionally found in Java web stacks.

It is a simpler vulnerability. This is a double edged sword. On the one hand, it is easier to fix (and to be sure we've fixed) than the objectloader-type stuff. On the other hand, it's so easy to reason about and work with that the exploit is straightforward. It was very difficult to find ways to talk about the general pattern of weakness in this code without immediately disclosing the exploit.

The vulnerability is similar in spirit to Python's Pickle, which is also unsafe for untrusted data. A difference between Raila and Django, though: while specific Django apps have had Pickle exposures, I'm not sure Django itself ever did.

PHP has vulnerabilities that are similar in impact to this vulnerability. But there's a big difference between this flaw (and the Python issues) and PHP: PHP grappled for years and years with a publicly known bug class (remote file inclusion) that coughed up code execution. It's not impossible that more RCE flaws will be found in Rails, but it's unlikely to become a class of bug that every Rails developer will need to adopt best practices to stop.

No mainstream web platform has ever survived long deployment in popular applications without some horrible finding. Nobody's hands are clean. It is very difficult to get security right in every single component that a full- featured web framework needs to offer. It only takes one mistake.

You are dead right about deserializers in general.

</comment></comment><comment><USER14> This is bad, bad, bad, bad! SQL injections, remote code execution, DoS. Pretty much _everything_ is possible with this exploit. You don't even need the secret key which was required in the previous vulnerability.

Upgrade _NOW_.

</comment><comment><USER15> <http://www.insinuator.net/2013/01/rails-yaml/>

Some explanation why YAML user input is evil.

It works like this

        1.9.3p327 :001 > id = YAML.load("--- !ruby/string:Arel::Nodes::SqlLiteral \"1 --\"\n") # if user input can contain arbitrary YAML
        "1 --"

It looks like string, but it's not.

        1.9.3p327 :002 > Keyword.where(:id => id).first
          Keyword Load (0.3ms)  SELECT `keywords`.* FROM `keywords` WHERE `keywords`.`id` = 1 -- LIMIT 1

<comment><USER16> Posting the gory details this early on is not a nice thing to do. It's probably best to hold off for a while until everyone has had a reasonable chance to upgrade.

<comment><USER17> Do you think not selling guns on an open market stops criminals from obtaining them as well?

<comment><USER4> If anybody thinks we're solving vulnerability full disclosure once and for all on an HN thread about a Rails vulnerability, that person is pretty naive.

We've now officially captured both sides of the argument and can safely move on.

</comment></comment></comment></comment><comment><USER18> Before anyone wonders if they're having deja vu, this is different than the SQL injection vulnerability that was discussed 5 days ago:

<http://news.ycombinator.com/item?id=4999406>

<comment><USER4> This isn't a SQL injection vulnerability at all.

<comment><USER19> But you can use this to trigger the earlier SQL injection vulnerabilities, right?

<comment><USER20> It's (apparently) a remote code execution bug. You can also use it to trigger SQL in the sense of _simply executing arbitrary SQL_. There's no need to bootstrap or trampoline, the doors are swinging open already.

</comment></comment></comment></comment><comment><USER9> To emphasize:

        > Due to the critical nature of this vulnerability, and the fact that portions
        > of it have been disclosed publicly, all users running an affected release
        > should either upgrade or use one of the work arounds *immediately*.

</comment><comment><USER21> I'm the author of the "Rails SQL injection vulnerability: here are the facts" blog post last week. This vulnerability is a different and unrelated one, and is very serious. Upgrade immediately.

</comment><comment><USER22> For those of you interested in more details about this bug: I've posted a first analysis at <http://www.insinuator.net/2013/01/rails-yaml/>

<comment><USER9> I don't think this is very responsible of you. You should post this, but you should really wait a week or so.

<comment><USER23> According to tptacek, "it was discovered by multiple teams independently" and "Lots of people have working proof-of-concept exploits for this".

I think your week started Jan 02 with CVE-2012-5664.

<comment><USER9> But it was not knowledge to the general public until today. That's what matters. Those people have POCs, but they're not spreading them.

<comment><USER23> One should never assume that he has a handle on everyone who knows the existence of a bug.

I think you underestimate your adversary. <https://twitter.com/mikko/status/288766998228393984>

<comment><USER9> You completely mis-understand my point. I don't think that this is the only person who knows this, that'd be idiotic. They are, however, the only person who posted it in this thread. Giving it more publicity. I don't think that that extra publicity is appropriate.

<comment><USER23> Even now you _still_ think it's useful to hide information from the "general public" and avoid "extra publicity"?!

The cat is out of the bag. You can no longer negotiate with this reality.

Publicly disclosing a bug is like birthing a baby. Once it's sticking halfway out, just get it all the way out because it's counterproductive to try to hold parts of it back in.

<comment><USER4> Gross, dude.

<comment><USER23> Yeah, that analogy definitely seemed more elegant before I wrote it out.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Rails noob here... with this and the other vulnerability from a few days ago, do all you need to do is update your rails gem to become safe?

Current version at time of my post is 3.2.11, if I'm using that am I safe or do I need to perform additional steps?

<comment><USER25> That is correct. The latest 3.1.10, or latest 3.2 series have this update. See the top of the linked notice:

Versions Affected: ALL versions Not affected: NONE Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15

</comment></comment><comment><USER26> This hits one my basic complaints about Rails: it activates too many features _by default_. Even if your app does not parse XML params, the parser is active. I know its convenient, but hey - is this worth the price of exposing _everyone_?

<comment><USER4> That's not a fair critique here. The problem isn't that Rails exposes XML by default. Everyone knew it did, and just processing XML isn't the issue.

The problem is that the XML code used in the untrusted request path was also used by code that handled trusted messages elsewhere, and those trusted messages had requirements that weren't appropriate for request-path messages.

Because JSON is so much more popular than XML in Rails apps now, a reasonable workaround for this problem is to just turn off XML if you're not using it. More importantly, it's a workaround that (a) does more to reduce the attack surface given how XmlMini works, and (b) was a workaround that disclosed less of the vulnerability last week. But don't let that confuse you about the nature of this bug.

<comment><USER26> Yes, it is a valid critique. You are right that just deactivating XML parsing is a reasonable workaround - and in my opinion so reasonable that it should never be activated by default in the first place.

A lot of people get bitten by a component they never consciously used and activated in the first place. While the second part is true for almost every part of a framework, the first one is problematic. ("XML? Why do I have a vulnerability through XML and YAML in a JSON-only app?")

</comment></comment></comment><comment><USER27> I hope in consequence of this incident the Rails-team will build in an automatic security-update notification mechanism.

I'd like my apps to poll rails.org (or whatever) every few minutes and by default shutdown hard when an incident like this is announced.

<comment><USER28> You can set up a system like Debian or Ubuntu to automatically install security updates.

<comment><USER27> I want my rails instances to shutdown within minutes of an announcement, not hours or days.

<comment><USER29> Headline of the future:

> Tens of Thousands of Rails Applications Remotely Disabled Following > Rails.org Intrusion

<comment><USER27> Yes, that is to be expected - and absolutely worth it.

The aftermath of an incident like the current one is a lot more expensive than an unplanned downtime.

<comment><USER29> Just playing devil's advocate here: a truly evil attacker could use the access logs from all the apps phoning home to build a list of vulnerable targets! :)

<comment><USER27> Well, you are right, the idea wasn't thought out very well. I was in a bit of a bad mood during patching up various rails deployments around here...

However, perhaps they could just promise to post a signed message, in a specified format, on a dedicated twitter account, if such a thing happens again. This would seem like a relatively low-tech approach, about adequate for such a rare event (just keep that secret key secret!).

The community can then roll their own gems to watch said twitter-account and act according to any user preference. Perhaps one of these gems would even make it into rails-core after sufficient review.

Obviously one can always argue whether such a rare case deserves dedicated infrastructure. But on the other hand we have yet to see how many rails deployments will be bitten by this incident in the long term. It's not uncommon to see years of exploitation for a vulnerability in a popular piece of server software.

<comment><USER30> Your entire thread of comments here make me want to gouge my eyes out. A signed message on twitter? Low tech? What in the hell are you talking about?

I'm going to be the asshole here, because it is vitally important that no one responsible for security ever listen to what you're saying. You're advocating some Orwellian kill-switch mechanism based on unspecified "signed messages" over a third-party social messaging service (limited to 140 chars, no less), and throwing in meaningless phrases like "low tech". What about this problem leads you to believe we all need something low tech?

I am not qualified to design such a system. You are negatively qualified to even comment on such a system. Please stop.

<comment><USER27> I'll try to put this more politely:

Since you apparently neither understand what was discussed (an _optional_ rather than an "Orwellian" kill-switch), nor the implementation options (a signed message via any broadcast mechanism), nor why using twitter as the transport would be feasible and "low-tech" versus most alternatives, you should perhaps refrain from commenting on this thread at all. - And especially not in that tone.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> As a newcomer to the Rails ecosystem all these posts of vunlerabilities and open doors leaves a bad taste in my mouth.

God know I love programming in Ruby now, but is Rails really that insecure?

<comment><USER32> Who'd have thought it? Hugely dynamic language turns out to be difficult to audit or analyse for security issues.

It was never about Java(C, C++) vs. Ruby despite what fanboys on either side made out. It was about conservative vs. devil-may-care. All that "convenience" and "it's so clean" came at the price of a whole load of code executed behind the scenes. You didn't write it, and the Gods of TDD preached that you don't need to test it because that's Someone Else's Problem. Auditing it is nearly impossible not least because it's a moving target, so you either get stuck in a backwater of obsolete versions that once got audited and approved or you live on the bleeding edge constantly (and DevOps hate you forever).

FWIW we (large satnav company) prototyped the last major service in Rails (actually a one-man hack proof of concept) then implemented it in production in Scala (and that was a bridge too far for a lot of people) because no-one wanted to run Rails in production.

<comment><USER33> This is a straw man.

These kinds of issues are open to all software.

I'm happy you work in the kind of place that audits all of its software, though. I'm sure you've all read through all of Hibernate, Spring and not to mention all the .NET framework code.

<comment><USER34> >These kinds of issues are open to all software

Really? Could you show me how I could possibly create such a hole in a language like ocaml or haskell?

<comment><USER35> > Could you show me how I could possibly create such a hole in a language like > ocaml or haskell?

First you'd have to _write_ the equivalent of Rails in Haskell (I'm not talking about an MVC framework, but something as large, complex, and featureful.)

<comment><USER34> No, I am asking how you could actually create this vulnerability in haskell at all. No framework required, just actively, intentionally trying to create this hole.

</comment></comment></comment></comment></comment></comment><comment><USER4> Patch right now.

<comment><USER36> Someone should change the title of this post. I didn't read it for a good 3 hours because I didn't realize it was related to Rails.

<comment><USER37> I hate to say it, but if you're running a public facing Rails application, it's near imperative that you know what Action Pack is and why it's significant.

</comment></comment></comment><comment><USER38> Hmm, this may explain why the vulnerability patched in 3.2.10 was more dangerous than it seemed, eh?

The 3.2.10 announcement provided an example of `Model.find_by_id(params[:id])` as an exploit, but nobody could figure out how you could get a hash with a _symbol_ key into `params[:id]`, which is what it would take for that to be an exploit. So people were confused.

But the pre-3.2.11 exploit, apparently, possibly provides ways to do just that, eh?

<comment><USER6> That's how this vulnerability came to light. After finding out about the last vulnerability, there was a huge amount of interest in seeing if parameters could be exploited, leading to a number of people simultaneously discovering this flaw.

</comment></comment><comment><USER39> I heard through the grapevine that YC affiliated companies were tipped off to this exploit/patch before it was made public (really; a YC affiliate asked me today about the vuln before it was disclosed). Could anyone comment on that?

<comment><USER4> The existence of this vulnerability (without details) was disclosed publicly last week. So far as I know, nobody was told any details about the vulnerability itself; just that a patch was coming, and it was very important to apply it.

</comment></comment><comment><USER40> So I've applied the workaround, which is great, but how do I test that the workaround is indeed working?

I realize that providing an in-depth answer is tantamount to publishing an exploit how-to, but some reasonable way to privately test this would be very useful.

Maybe a "simple" URL tester hosted by a trusted Rails source (e.g. rubyonrails.org)? Ok, has the obvious issue of showing the world who they should target, but maybe you can riff on that theme?

Auditing and stuff you know. For some reason people in charge get really upset when all our base are belong to the bad guys.

<comment><USER41> [https://github.com/rails/rails/commit/46e0d2397ea10a0bf38092...](https://github.com/rails/rails/commit/46e0d2397ea10a0bf380926c9fe3cfcf14d5c499#L0R119)

</comment></comment><comment><USER42> At least people are getting practice at following security bulletins.

</comment><comment><USER43> I might be the last one on earth that still runs a Rails 1.1.x app. This time the ancient one dodged a bullet.

"ah, actually 1.1.x isn't vulnerable. The issue first arrived in 2.0" - <https://twitter.com/tenderlove/status/288777229276704768>

<comment><USER2> we had some rails 1.x apps at work and we were happy.

</comment></comment><comment><USER44> Why doesn't Ruby (and Python and all other languages) have Perl's tainting built in and always running?

I'm not advocating it as the only security mechanism, but rather as another barrier to be overcome just like address-space-randomisation, data-exection prevention and all the rest...

(Haven't Google recently shared a valgrind-lite runtime bounds checker which is being incorporated into GCC etc? Might lead the way on how this can be down with the minimum of runtime cost.)

<comment><USER45> Because tainting is an inherently flawed way to do security. Blacklisting capabilities/methods/data _always_ leaves holes behind, and it's nearly impossible to secure a system using tainting alone. Even the Perl folks say it shouldn't be used as a security mechanism...it should be used to help thin out security issues during development and testing.

If you want to secure a system...whitelist, don't blacklist.

<comment><USER13> If the runtime overhead is low, then shouldn't tainting be used _in addition_ to other techniques? ala Defense in depth?

<comment><USER45> You certainly can do that. You can also add more and more locks to your doors while leaving your windows open.

</comment></comment></comment></comment><comment><USER46> Can anyone with a more intimate knowledge of the inner workings of Ruby on Rails speak to how detrimental this exploit is in practice? I seem to recall a fair number of people feeling the SQL injection exploit from a few days ago was being blown out of proportion and I was wondering how this particular exploit stacks up against it.

<comment><USER18> I'm not going to say "told you so" because I said nothing and I'm just a layman in this...but when people were pointing out last week that the bug was "overblown" I had wondered if they were underestimating the tendency for such vulnerable patterns to propagate. The mechanisms that let even an edge case in are not always isolated.

<comment><USER47> Oh I'm saying "told you so". Since years and years.

The real problem is the very mentality of the people who downplay security issues, always saying _"this is not a serious issue"_ (or, worse, saying _"but language xxx / framework yyy"_ suffers from issues too, it's how the world works).

That mentality is the reason why such exploits do exist in the first place. Security is nearly always an afterthought.

The most braindead argument being: _"My goal is to sell xxx, not to have an unbreakable server"_.

Once you read that one, you know you have reached the low of the low.

<comment><USER21> Or maybe some issues are overblown, while others are not.

Also, the message was not "overblown". It was "don't panic, but still upgrade ASAP".

</comment></comment></comment></comment><comment><USER48> I was curious about why Rails parses YAML nested inside XML to begin with. Turns out it was put in way back when so that ActiveRecord's from_xml/to_xml work as expected when a model contains serialized (ie. yaml) attributes.

Patch/issue from the old Rails issue tracker:

[http://web.archive.org/web/20071218105822/http://dev.rubyonr...](http://web.archive.org/web/20071218105822/http://dev.rubyonrails.org/ticket/7502)

</comment><comment><USER49> Correct me if I'm wrong, but looks like this should only be a vulnerability if your app uses XML parameters?

<comment><USER4> No, it's a vulnerability if your app SUPPORTS XML parameters, which _all modern Rails apps do_.

This vulnerability is exploitable even if you don't have any exposed controllers.

<comment><USER36> Wait, what? What if the app does not parse ANY user provided XML or YAML at all?

<comment><USER4> That does not matter.

<comment><USER36> Holy cow. I just figured out how to send the payload. This thing is seriously bad news.

I still haven't figured out an attack vector yet, but least I now know that my patches are working!

</comment></comment></comment></comment></comment><comment><USER50> Thinking aloud, do we need some kind of auto-update feature for rails apps? This kind of exploit suddenly exposes the multitude of Rails apps out there to remote code execution. I know it wouldn't be a trivial thing to make, but we already have yum auto update for linux and auto updates for Windows, OS X etc, it should definitely be feasible. Scope could be severely limited, so for example, a monkey patch for big vulnerabilities like this, while sending a notification email to the app maker.

<comment><USER16> Replacing one RCE with another :)

</comment></comment><comment><USER51> I am shocked that it's considered a smart idea to make it possible to execute code from XML files (and that this is the default setting)!?

<comment><USER6> Of course it's not considered a smart idea. That's why this was fixed. It was a (critical) bug.

</comment></comment><comment><USER52> I really don't understand the last part "This vulnerability was reported to us by numerous people, many thanks to [...]".

Considering it affects all versions, what are the odds of multiple people pointing this out at the same time?

Rails has a very good track record regarding these things, but I'm just curious.

<comment><USER4> The last Rails SQLI vulnerability was mitigated by the way ActionPack parsed request parameters, so lots of people dove into that code to see if the mitigation could be evaded with JSON or XML. That gave people incentive to review Rails XML parser wrapper class. The problem with that class is pretty obvious.

<comment><USER52> Makes perfect sense. Thanks for pointing this out.

</comment></comment></comment><comment><USER2> if you are using extlib gem you may be vulnerable as well.

it has just been updated:

[https://github.com/datamapper/extlib/commit/633974b2759d9b92...](https://github.com/datamapper/extlib/commit/633974b2759d9b924657f3888473d5fd681538dd)

</comment><comment><USER53> I've thrown together a little script for checking your github repos for out of date rails apps: <https://gist.github.com/4492021>

Should come in handy today.

</comment><comment><USER54> Github.com (built on Rails) is currently having issues. If I had a tin foil hat, I'd put it on. Hopefully their issues are not related to this vulnerability.

<comment><USER55> More likely the result of millions of Rails site owners crying out in terror... pulling and then committing updates. I fear something terrible has happened.

</comment></comment><comment><USER56> As someone stuck maintaining an older rails app with no hope of upgrading anytime soon, any information on patching rails 2.1.0 against this vulnerability?

<comment><USER57> Best idea would be to apply the workarounds presented for Rails 2.3 in the group post: [https://groups.google.com/forum/#!topic/rubyonrails- security...](https://groups.google.com/forum/#!topic/rubyonrails- security/61bkgvnSGTQ/discussion).

Place a couple of lines in a file in config/initializers, and you're good,.

</comment></comment><comment><USER58> Heroku apps rely on Heroku's version of Rails gems (right?), so how does one tell if Heroku has patched these vulnerabilities yet?

<comment><USER59> Heroku runs whatever version you say in your Gemfile. You must update your apps yourself; There is nothing Heroku can do to update your app for you.

<comment><USER58> But am I protected if I'm currently using a fixed version of Rails? (3.2.11, 3.1.10, 3.0.19, or 2.3.15)

<comment><USER59> yes

</comment></comment></comment></comment><comment><USER60> For a less hammered server, can use:

source '<http://bundler-api.herokuapp.com>

in your Gemfile

<comment><USER61> Gems are unsigned. Patching from a different source is idiotic. Do not use: you have no clue who is the owner.

<comment><USER60> Not so idiotic if you know the owner. It is done by Heroku's Ruby team

[http://hone.heroku.com/bundler%20heroku/2012/10/22/rubygems-...](http://hone.heroku.com/bundler%20heroku/2012/10/22/rubygems- and-the-dependency-api.html)

</comment></comment></comment><comment><USER62> Ok. I'm quite new to Rails. How do I apply this patch? Or am I better upgrading rails completely? How do I do this.

<comment><USER63> Update to 3.2.11, 3.1.10, 3.0.19 or 2.3.15, and you'll be good.

<comment><USER62> Already in my gem file ...

gem 'rails', '3.2.3'

I think that patch maybe? But I dont know how. Google is not helping,

<comment><USER63> Change it to

      gem 'rails', '3.2.11'

and run

      bundle update rails

</comment></comment></comment></comment><comment><USER47> I'm tired of the logical fallacy that consists in always saying: _"Every software suffers from security issues"_.

It is just plain wrong to reason like this.

So let me ask something to the ones using the above fallacy: are all programs (say webservers) equals in the face of security?

It's an easy question right? And the answer is: "no, they're not all equal".

So stop saying: _"But Java had several DoS bugs affecting Tomcat in 2011 too, so we're not doing anything wrong here"_.

And start coding (and documenting) to higher standards.

<comment><USER64> You make it sound as if "Every software suffers from security issues" was brought up as a reason not to put effort into security. It was not.

It is very valid to reason within constraints of reality. Like knowing that a car "which will never ever have an accident. ever" is a lie. We know that driving a car brings a risk of an accident. That is realism. Some turn that reality into dangerous behaviour. Saying things like "Statistics tell me I will have an accident no matter what. So I can just as well finish this bottle of whiskey before driving at 150Km/h home". You are making it sound as if the Rails developers follow that logic.

They don't. There simply is a certain realism that, no matter how much effort you put into security, there will be security issues. But nothing more. Or less.

</comment></comment><comment><USER65> ruby on cracks

</comment><comment><USER66> 1\. Keep this link bookmarked.

2\. Pull it off next time someone starts with the 'test-replace-static-typing' argument.

3\. WIN

<comment><USER67> This problem is due to deserialization creating object (sub)graphs which are unintentionally too powerful. Statically typed languages (especially without dependent types) can do this too, even when the root object(s) matches the type(s) expected by the caller. The cure is <http://en.wikipedia.org/wiki/Capability-based_security>: write out what the caller is currently allowed to do, rather than blindly granting dangerous privileges and relying on the code's design never to use them. Even tainting, a very crude manual form, seems like it could have caught this.

</comment></comment><comment><USER68> Upgrade instructions:

update your Gemfile and set the version you want. In my case:

gem 'rails', '3.2.10'

locally, run

'bundle update rails' which will update your Gemfile.lock

check-in and deploy your code. If you are using capistranso, the default 'deploy' task should handle everything for you. Otherwise, run 'bundle update rails' on your production server.

<comment><USER38> 3.2.11 not 3.2.10.

Which is in fact why it's probably wiser to list `gem 'rails', '~> 3.2.10'` (or 3.2.0 or anything) instead, and then `bundle update rials` will update you to latest 3.2.x (but never 3.3.x), in this case 3.2.11, instead of only to the exact version you specified (3.2.10, incorrectly).</comment></comment>


Public Diaspora Seed is up, but buggy. - <AUTHOR> http://openspora.com/

<comment><USER2> There's absolutely no description anywhere on those pages about what it is. I happen to know what Diaspora is, but if this link gets passed around outside of this community people will be confused and immediately form a negative opinion of the service.

At least put up a "What is Diaspora?" link to their homepage or Wikipedia or something...

<comment><USER3> _people will be confused and immediately form a negative opinion of the service._

Trust me, if they understood it was supposed to be the privacy-aware Facebook alternative and started using it, they would have a _much more negative_ impression within, oh, I give it less than 48 hours.

<comment><USER4> For whoever downvoted Patrick, he's referring to the gaping security holes that are in this release. Nobody should be running publicly accessible seeds yet unless they want their boxen to get pwnt.

</comment></comment></comment><comment><USER5> The page should also mention that this software is pre-alpha release. Even on HN people are freaking out about things not working properly, sucks that this is already giving people bad feelings.

</comment><comment><USER6> This just linked to a password protected page. Am I missing something? Maybe not ready for the influx of HN readers?

<comment><USER4> This is what the index page of a diaspora install looks like.

</comment></comment><comment><USER7> Is this an official site of the project or someone just running their code on a new domain? The DNS registration doesn't even come close to the joindiaspora.com domain. Seems there's at least a few sites like this:

<http://trydiaspora.com> <http://openspora.com>

Any others?

<comment><USER8> AFAIK, this has nothing to do with the diaspora team, it's just random people tossing up public instances.

</comment></comment><comment><USER9> Is there a way to remove my account from Diaspora?

<comment><USER10> As far as I can tell, there isn't even an admin interface for administrators to remove your account from Diaspora.

</comment></comment><comment><USER11> Need a friend? firstname.lastname@example.com

<comment><AUTHOR> <http://openspora.com/people/>

is a really usefull page. I am email@example.com.

<comment><USER12> I went there and got:

      Please, stop that.

      We've been notified about this issue and we'll take a look at it shortly.

Does not bode well.

<comment><AUTHOR> I think I broke it by posting it here. Still works for me whilst logged in.

<comment><USER13> Site completely unresponsive now. Oops.

<title>We're sorry, but something went wrong (500)</title> ...
Please, stop that.

We've been notified about this issue and we'll take a look at it shortly.

<comment><AUTHOR> this merits the age old question: Is the server too light? or is the code too heavy?</comment></comment></comment></comment></comment></comment>


Message from Anonymous: Facebook will fall Nov 5, 2011 - <AUTHOR> http://www.youtube.com/watch?v=SXLxiMemYc0

<comment><AUTHOR> Just reposting what I saw online :P</comment>


Customizing Redis – Adding Graphs - <AUTHOR> http://qunsul.com/redis_part1.html

<comment><USER2> Nice! Redis really does have a great code base to work with. I previously wrote on article on adding a custom datatype, essentially walking step by step through each necessary modification.

If interested, this article can be found here: [http://www.starkiller.net/2013/05/03/hacking-redis-adding- in...](http://www.starkiller.net/2013/05/03/hacking-redis-adding-interval- sets/).

</comment><comment><USER3> This is quite cool. I have had a few frustrating experiences with graph databases before, but this, as a simple graph data store, looks promising.

</comment><comment><USER4> Nice! Graph implementation in Red is could be really awesome!</comment>


Ask HN: Is Twitter's Blog a Spam site? - <AUTHOR>

Just tried to submit "SpiderDuck: Twitter's Real-time URL Fetcher" from its blog ( http://engineering.twitter.com/2011/11/spiderduck-twitters-real-time-url.html ), which seemed quite interesting, and got the infamous Stop spamming us. You're wasting your time.
After reading PG's explanation of the message ( http://news.ycombinator.com/item?id=2660975 ), it seems that twitter is a spam domain. Which I get, as submitting twits to HN can be really frowned upon.
But their engineering blog? Seemed like a bit extra-careful design to me. What are your thoughts? <comment><USER2> oh wow, ok, so that wasn't just me then? good. Engineering blog is fine, probably getting clumped in with some flagged .twitter.com domain spam......oh well</comment>


Hardcore coding contest by Quora & InterviewStreet - <AUTHOR> https://quora.interviewstreet.com/challenges/

<comment><AUTHOR> Announcing Codesprint Quora, the first-ever company sprint, in collaboration with InterviewStreet (YC S11).

Feel free to ask us questions anytime at firstname.lastname@example.com

Questions will also be posted at <http://quora.com/CodesprintQuora> so you don't have to sign up for an account to read them.

This sprint is designed to seriously test your programming prowess on a wide range of tasks ranging from algorithms and product design to machine learning and data analysis. This comes from our intention to hire only the very best engineers, product engineers and data analysts. Come and participate, and learn about any or all the challenges we face in developing these systems: \- Quora Feed Optimizer \- Quora Trend Analyzer \- Quora Typeahead Search \- Quora Browser Extensions \- Quora Nearby Redux \- Quora Answer Classifier Redux and more!

<comment><AUTHOR> The three week-long problems are now up here: <http://www.quora.com/CodesprintQuora>

</comment></comment><comment><USER2> In other words, work on Quora problems for the privilege of working for free. Of course, there is the promise of being recognized, but no promises on being hired.

<comment><AUTHOR> These aren't stuff we are looking to use ourselves. We're choosing these problems (which we have already solved in a more complex form ourselves) because we think it'll be interesting for others to try to apply their programming skills at "real world problems" that startups solve.

<comment><USER3> So my question is what problem did Quora solve? other than mostly copying idea (pardon: being inspired) by websites like Yahoo Ask, Hunch, etc.

</comment></comment></comment><comment><USER4> Slightly off-topic, but hopefully others can benefit as well:

I am learning to program on my own, and I have tried some of the CodeSprint Fall 2011 questions ([http://csfall11.interviewstreet.com/recruit/challenges/dashb...](http://csfall11.interviewstreet.com/recruit/challenges/dashboard)). Often, I find solutions that "work", but that score poorly because they exceed the time limit (e.g. Card Shuffling, 3/10, 9 points).

What books should I read (or what videos should I watch, etc.) to get better at things like this? Any suggestions would be much appreciated.

<comment><USER5> Also look up google code jam, I think they might have some links for learning. In general the kind of solutions sought are called "dynamic programming". I think there is also a book about solving TopCoder problems, though I can't find it atm, and haven't read it.

Edit: this might be the book I meant, "The Programming Contest Training Manual" [http://www.amazon.com/gp/product/0387001638?ie=UTF8&tag=...](http://www.amazon.com/gp/product/0387001638?ie=UTF8&tag=fractality-20&linkCode=shr&camp=213733&creative=393185&creativeASIN=0387001638&redirect=true&ref_=sr_2_1&qid=1054943434&sr=2-1)

</comment></comment><comment><USER5> Starts at midnight where I live. Signed up out of curiosity, but I don't think I'll stay up till 5am. Wish I had learned about it sooner.

<comment><AUTHOR> Don't worry. We actually have it in 2 parts. 4 questions in a sprint over 5 hours, 3 other questions lasting a week. You might find the weeklong ones more fun.

<comment><USER6> Is this information on the web site? I, too, wish I heard about this sprint earlier in the week (before I made weekend plans).

<comment><AUTHOR> The three week-long problems are now up here: <http://www.quora.com/CodesprintQuora>

<comment><USER5> Interesting, though I have to say these seem more like "working for Quora for free". Would be nice to at least get some interesting data sets in exchange.

Granted, I probably won't improve on Quora's code in a week, but still.

I guess I am simply not the target audience, as I had no plans of applying to quora.</comment></comment></comment></comment></comment>


Silicon Valley is terrified of California's privacy law - <AUTHOR> https://techcrunch.com/2019/09/19/silicon-valley-terrified-california-privacy-law/ <comment><USER2> I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - [https://techcrunch.com/2018/06/28/landmark-california- privac...](https://techcrunch.com/2018/06/28/landmark-california-privacy-bill- heads-to-governors-desk/)

\- Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with.

\- Businesses would be required to comply with official consumer requests to delete that data.

\- Consumers can opt out of their data being sold, and businesses can't retaliate by changing the price or level of service.

\- Businesses can, however, offer "financial incentives" for being allowed to collect data.

\- California authorities are empowered to fine companies for violations.

I totally understand that this will impact a lot of tech companies' profits...but that's to be expected if you're making money selling people's data to third parties without their permission.

<comment><USER3> > \- Consumers can opt out of their data being sold, and businesses can't > retaliate by changing the price or level of service.

This is something I object to. It's just fundamentally stupid and doesn't make sense. The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services _for free_.

EDIT: I'll also add that it strongly favors incumbent tech companies, by explicitly carving out "selling to third parties" as a disfavored tactic. Google can monetize your data internally. Your average startup may not be able to. Specifically carving out "selling to third parties" favors large, incumbent players over small startups. But then, regulation always does.

<comment><USER4> Charging different customers a different price for the same product is illegal under US law, and California laws don't change that.

EDIT: Several comments below point out the innumerable businesses operating in such a way as to make mine an impossible claim.

Enumerating the established methods to avoid meeting the legal parameters of price discrimination is not the same as price discrimination being legal.

My bar for following just laws is higher than the minimum required to avoid being prosecuted. I'm sure experts can help work around any future privacy laws too, so why even worry?

Surveillance already creates a different product one can charge more for, though your lawyer might advise you call it "personalization" in memos.

<comment><USER5> _Charging different customers a different price for the same product is illegal under US law_

Demonstrably untrue.

It is illegal to charge a different price based on a protected class like race or gender. But travel sites, for example, are notorious for charging different people different prices based on their GeoIP, whether they're on mobile or desktop, or Windows vs Macintosh.

<comment><USER6> "Demonstrably untrue."

Robinson-Patman Act says "Please read me, and understand me and the Clayton Anti-Trust Act which I amend."

</comment></comment></comment></comment></comment><comment><USER7> Lot's of (mis)information floating around regarding CCPA. I recommend taking the time to read the actual text[1]. The text is not particularly long or dense. There has been a lot of speculation about complex compliance procedures, but the main thrust of the bill is to provide users with information about how their data is collected, who it is shared with, and the rights to prevent certain types of selling or sharing of said data. The leginfo site also includes non-partisan analysis (under the "Bill Analysis" tab) of the bill and amendments as it moves through the legislature, which is useful for getting an understanding of how specific issues are being considered and addressed. Something to consider is that bills change substantially through the amendment process, so often critiques you read are based off old versions of the text that have already been addressed.

[1] [https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375)

<comment><USER8> The main problem is that the bill is rushed and the legal bits have a lot of ambiguity.

source: CCPA and its potential compliance has been a big PITA

<comment><USER7> No argument there; just pointing out that many of the common complaints around ambiguity are explicitly addressed in the text of the bill already.

<comment><USER8> They're really not - the definition of using California household vs resident creates a huge unenforceable gray area for compliance

<comment><USER7> Agree to disagree on this example I guess. "household" is referred to in the bill when defining re-identification, and this is an important improvement over the language in GDPR, especially when it comes to geolocation data, which is often sold at the household level (ie: Experian sells household level market segmentation profiles that tell you a lot about a person's behavior without directly linking to an individual).

The only other place households are referred to is in the section defining which companies the rules apply to, which is also pretty straightforward in a plain reading. If a company's number of consumers, households, _or_ devices exceeds 50k, they qualify.

> (B) Alone or in combination, annually buys, receives for the business' > commercial purposes, sells, or shares for commercial purposes, alone or in > combination, the personal information of 50,000 or more consumers, > households, or devices.

</comment></comment></comment></comment></comment><comment><USER9> We need to have a conversation about jurisdictions in the digital age. The way governments have decided that having a website accessible in a country makes you liable to respect the law of this country is a convulted and hacky notion that has been accepted way too fast.

The physical establishment rule was the only sound approach. The fact that some countries started to lose shouldn't have allowed them to rewrite the rules (especially in such a hacky manner).

Can you imagine owning a grocery store and having to ask every customer their nationality to check which law you must follow to do business with them? Then multiply this hell by 10 and soon 1000 considering new laws created left and right and you have the environment these dishonest politicians have created.

<comment><USER10> > We need to have a conversation about jurisdictions in the digital age. The > way governments have decided that having a website accessible in a country > makes you liable to respect the law of this country is a convulted and hacky > notion that has been accepted way too fast.

You know if you turn that around and say "How come we have to respect the laws of every country we do business in?" it sounds a lot more self serving.

Nobody said your website had to serve Californians. Nobody said your iPhone game has to be accessible in North Korea. Nobody said your movie has to be viewable in China.

If you're intending to serve any product to an entire planet composed of nations, states, societies all pulling from different experiences, different cultural attitudes, I think expecting a completely friction-free experience in doing so is more than a little unreasonable.

And more to the point that this particular discussion is about, these are principles that pretty much every society could reasonably get behind. Sorry that means mining data isn't a solid business model anymore, but I'm also not even remotely sorry. Adtech should die. It's a blight on our society.

<comment><USER11> > Nobody said your movie has to be viewable in China.

You will of course forgive me if I do not find economic favoritism that benefits politically connected industrialists, the restriction of freedom of thought by oppressive governments, and the general Balkanization of the Internet, to be things that we ought to celebrate.

Once upon a time the memes of Internet culture would suggest that "information wants to be free!" Oh, sweet halcyon days of yore!

<comment><USER12> _> Once upon a time the memes of Internet culture would suggest that "information wants to be free!" Oh, sweet halcyon days of yore!_

Turns out it's _not_ free — it's actually _very valuable_ , and the cost is borne by society writ large.

<comment><USER13> Information does want to be libre.

Information is not gratis.

</comment></comment></comment></comment></comment><comment><USER14> So the author would rather see each state/country implement it's own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisdictions... awesome.

<comment><USER15> The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

<comment><USER16> Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. How do you scan all the logs that might somehow have an association with the requesting user that are in cold storage and alter data on write only archived optical media? You have to make an entire copy of it with those data removed. It's not about just treating customers better. It's government dictating the technical architecture.

<comment><USER17> >Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous.

Bummer dude. As an engineer type, I say, bring it on. Hard for me to have much sympathy ZuckerBrin can't afford another island or whatever because they made unethical decisions in the past. And if companies blow up because of it: good, that's the idea. There needs to be consequences.

<comment><USER18> Facebook will be just fine and probably come out ahead. Same with google. They have the money and resource to comply. These kind of regulation that don't take reality into account when written are a god send to large corps.

</comment></comment></comment></comment></comment><comment><USER19> It's jarring to see such headlines on TechCrunch. They fed the valley by giving every little news a place and are ne of the original hype masters for startups. They profit off the area by hosting the disrupt conference as well, which is again a huge pat each other on the back event. So now they turn around and post a headline like that is just somehow ugly to me. It's absolutely in their right obviously.

<comment><USER20> Pet peeve: when editors/authors throw their opinions on the end of headlines. [ _and why it 's a good thing / and why you should care / and why it's dangerous / etc_]

Just give me the facts and let me decide on my own after reading the facts. I don't need your opinion up front.

</comment></comment><comment><USER21> I'm pretty concerned about it, and we are a tiny political digital agency. My reading is that basically any small sized email list, website, service etc that 'receives for the business' commercial purposes' data on more than 50k 'devices' or 'consumers' must be compliant which is a very low bar. Like small business email lists would hit this, though maybe burden falls onto Mailchimp for most.

It should be fairly easy to add a contact us address for delete and info requests to the bottom of websites. A lot harder and would take development time to automate a UI for a person to see all data associated automatically (e.g. lots of separate analytics; would have to build api to lookup ip/device/user data match across tables/dbs, and then how do I verify a user is requesting their data and not someone else's). Also harder to 'block' new data collection of device/consumer post delete request.

What I'm less sure about is 'inform consumers before the point of collection.'

Does a privacy policy link in footer count? If not what is required for compliance? What about advertising?

Another big concern for me is that this is going to be weaponized in my industry (politics). I think a political campaign wont fit the bill's definition of 'business' (profit seeking for shareholders) but I think it will still be weaponized by opposition campaigns and service providers.

<comment><USER22> Sounds like you need a Data Privacy Infrastructure provider so you don't have to worry about the implementation details. The startup I'm working at, [https://transcend.io](https://transcend.io), offers that.

</comment></comment><comment><USER23> Does anyone know the real implications of the CCPA for things like Sift Science, Google's Recaptcha, and maybe even Cloudflare?

All of these are based on many companies contributing information about users to create profiles which curb abuse. And Sift/Google/etc. get commercial benefit from this data sharing, which might trigger the CCPA. But you can't give bad actors the ability to opt out of this kind of data sharing without crippling them.

I think these kind of companies are really important to a functioning internet. I hope there are carve outs of some sort, but seems like they're living on the edge right now.

<comment><USER24> If Recaptcha gets the ax due to CCPA, the internet will be better off for it.

<comment><USER23> There needs to be some way to identify non-humans and/or malicious actors.

<comment><USER25> Malicious actors? Yes. Non-humans? No. If my bot is playing by the same rules a human would, what do you care as a website operator?

</comment></comment></comment></comment><comment><USER26> How is this not a violation to the first amendment? Does the first amendment not extend as follows: (?)

As a citizen don't I have the right to create a business and privately take notes on whatever I'd like to about my customers? If i run a dry cleaners and take notes about my customers, should I be obligated to disclose these notes or even the existence of these notes to my customers? I don't see why extending the dry cleaning business to a mobile app or website effects anything. What about journalists, are they required to disclose what data they're collecting about people as they do their job?

I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech both the right to take internal notes and documentation and the violation of one's speech rights by forcing this disclosure.

however IANAL and I don't live in California. Could someone share some insights onto the first amendment side of this?

<comment><USER27> >I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech

Gonna have to stop you there.

The First Amendment doesn't mandate a right to free speech. It only prevents Congress from passing laws abridging that right.

There's nothing, Constitutionally speaking, preventing _states_ from doing so.

Edit: nope, Apparently I'm wrong on this one.

<comment><USER28> That's not the case. The Bill of Rights now does largely apply to the states.

[https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_R...](https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_Rights)

</comment></comment></comment><comment><USER29> Many comments here make the false dichotomy of paying for a service with money vs paying with your data. That ship has sailed. In the current market selling user data will win every time. Only laws can make sure that a company you pay for "premium service" or "no ads" won't turn around and sell your data anyway.

</comment><comment><USER30> A significant part of the fear comes from how poorly worded it is.

<comment><USER31> Broad wording means companies have to be conservative (collect less data) and less loopholes. That's a win for the ordinary person.

<comment><USER18> Or realistically it means they will collect the same and wait for clarification. Since it's worded so poorly they won't be punished for it or going by past examples in California the fine will be so small it was worth it.

<comment><USER31> The US has a common law system. What is not specified in the statute will be slowly clarified by the courts.

</comment></comment></comment></comment><comment><USER32> As much as most browsers have implemented a standardised payment API, a generic, browser-level Privacy related GUI would be helpful. By that I mean something less repetitive than the multitude of consent screens people have to deal with (not to mention dark UX patterns in the existing solutions).

<comment><USER33> Yes, please!!

</comment></comment><comment><USER34> People keep comparing this to the GDPR. I have lived in the UK pre and post GDPR and the US. I like the GDPR a lot. It isn't just internet businesses either. Because it was such a crazy bogeyman, plenty of brick and mortar businesses have paid a bit more attention to their data security. I like being told what's gonna happen with my PII, and having the right to control my data. Most people seem to like the effects of the GDPR in my (anecdotal) experience. Yeah you have people using it as some bizarre bogeyman to stop you doing normal things, but it makes you think about it. From a business perspective, the ICO provides great advice to people and companies when they need it. It's not as though what you need to do is a secret. You just need to do business in accordance with peoples' rights.

</comment><comment><USER35> What will these laws accomplish in real terms?

This just seems like poorly written legislation with the purpose of pandering to the populist public. I guess if it makes you all at least feel better.

<comment><USER36> Nothing, except soon there will be annoying legalese on every website form. Just like the GDPR. Large businesses will benefit at the expense of smaller ones. Lawyers will make more money selling these legalese templates, and sometimes when a big company doesn't pay the right bean counter they'll end up being investigated by regulators, and paying the state money to continue doing the same thing.

But it will be celebrated as a heroic victory because "privacy good. Business bad. I want a banana."

<comment><USER37> The GDPR does a lot to protect user data. As someone that's implemented stuff at a huge company for GDPR and at my startup, it was waaaay harder at the larger company. The ICO has been beyond helpful with the few questions I've had recently and implementation for my startup has been fairly straightforward.

<comment><USER36> "The GDPR does a lot to protect user data"

As you proceed to state absolutely nothing. Before GDPR my information was in a bunch of databases managed by other people. After GDPR my information is in the same databases managed by the same people. Except now they have legalese stating this totally fucking obvious fact.

Before GDPR if my information was hacked and used to hurt me, the business was not liable. After GDPR they still are not liable. Oh and if they violate the GDPR the state gets money, but the victims don't. Such amazing protection of consumer data...

<comment><USER38> Dude, GDPR's effects just began. Give it time. A sudden enforcement of GDPR would destroy too many business and so it's being enforced gradually. Still, there are beginning to discuss the complete outlaw of the real time bidding in adtech because completely incompatible with the GDPR. That means destroying bilions of dollars of businesses, so they go slow until there's enough political consensus to do so without fear of retaliative lobbying. This is not something that is done overnight.

<comment><USER39> You know that GDPR is just a refinement of ideas that began over 20 years ago, right?

The EU really isn't engaged in a three decade campaign to destroy American companies.

Two nice timelines:

[https://edps.europa.eu/data-protection/data- protection/legis...](https://edps.europa.eu/data-protection/data- protection/legislation/history-general-data-protection-regulation_en)

[https://iapp.org/resources/article/a-brief-history-of-the- ge...](https://iapp.org/resources/article/a-brief-history-of-the-general-data- protection-regulation/)

<comment><USER38> Sure I do know, but these processes take time. And don't frame EU as a singular entity, there are many interestes involved.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> > Since the law passed, tech giants have pulled out their last card: pushing > for an overarching federal bill.

>In doing so, the companies would be able to control their messaging through their extensive lobbying efforts, allowing them to push for a weaker statute that would nullify some of the provisions in California's new privacy law. In doing so, companies wouldn't have to spend a ton on more resources to ensure their compliance with a variety of statutes in multiple states.

Is it really that much easier to control a federal vs. state legislator?

I wonder if the idea might actually be to prevent the likely future scenario in which 50+ different privacy regulations need compliance. Setting a national standard could prevent such an outcome.

Privacy advocates should favor the state-by-state solution, though. The more difficult it is to comply with regulations, the more expensive it becomes to collect the data in the first place.

As the cost of compliance increases, the alternative of simply not collecting the data in the first place becomes more attractive.

But that itself can lead to unintended consequences. It would mean that only the biggest companies could afford the regulatory burden of collecting the data. And these are the very companies that have received the most negative attention.

All of which makes me wonder whether at some point we could see a private data settlement along the lines of the tobacco settlement:

[https://en.wikipedia.org/wiki/Tobacco_Master_Settlement_Agre...](https://en.wikipedia.org/wiki/Tobacco_Master_Settlement_Agreement)

</comment><comment><USER41> This:

> The bill would authorize businesses to offer financial incentives for > collection of personal information.

Means it's nothing like the GDPR. This might actually be a sane law. And it doesnt implement punitive fines if you get hacked. Nor does it bring about a massive cookie alert insanity.

The right to delete may work in europe , but i think in the US it is going to clash with free speech laws. So it might not work at all.

</comment><comment><USER42> This law is a step in the right direction, although in its current form it's toothless and uses disgustingly submissive language (e.g. the user may not out or the user needs to be informed about how theur data is going to be abused). The final goal of such laws should be to poison user data: so that collecting it and storing would open all sorts of legal and criminal troubles and that no company would want to touch user data with even 10 foot pole. This will open more ethical business opportunities that currently can't compete with data mining model. An analogy in real world. If theft and robberry was legal, no other business model could exist: if you sell gas for 3 bucks a gallon and your neighbor sells it for a negative price, but sells user address to theft agencies, you'd be out of business long before everybody realises the true cost of that "free" gas.

</comment><comment><USER43> I can't help but view it with disgust just at the headline of having the wrong kind of mentality. It is a spiteful logical fallacy of the worst kind. "Soviets terrified of plan to nuclear first strike whole world - good!" Just because even the vilest foe dislikes it doesn't mean it is a good idea.

The whole article seems to be about shutting down thinking and manipulation via playing with emotions.

I am probably an outlier but I view that as an active sign that is terrible because otherwise they would lead on better points. The article made me /less/ supportive of it. It is perhaps unduly harsh but I would call it an outright propaganda piece not because of the message but how it was delivered.

<comment><USER44> "Shutting down thinking." Reporting on transgressions and laws designed to hold parties accountable is designed to shut down thinking now, and how those who would be affected by it are literally trying to kill the bill is considered "shutting down thinking." This is literally what you just said.

<comment><USER43> You proved my point ironically. It is all about "punishing the bad ones for their past sins" as opposed to going forward the impact of the law - the part to actually think about. Instead straight to emotionally knee jerk driven narratives of "they are bad and must be punished" instead of what the law is actually about. See emotions come out and the thinking on the topic like "would it actually help with Cambridge Analytica 2.0" go kaput.

It is an old trick narrative for pushing terrible "tough on crime" laws for advancement. If you point out that it isn't a well thought out idea you support bad people!

</comment></comment></comment><comment><USER45> While I think CCPA is a step in the right direction from the status quo, which is basically a free-for-all, it's still a mediocre privacy law. GDPR remains the gold standard because it's opt-in, CCPA is opt-out.

The only reason it was even passed was because some guy was going to force the issue with a ballot initiative so lawmakers scrambled to do something. If not for that, California would be the last state to pass meaningful privacy regulation.

</comment><comment><USER46> In short: laws against things that never sbould have been.

One can only hope they make sure it hits big actors more than any other ones, because they are what makes this kind of data collection dangerous for societies.

</comment><comment><USER47> LMAO, Google should just make itself unavailable in California due to 'involuntary violation' of this law to see it repealed real quick. Those who complain can use bing.

</comment><comment><USER33> Besides the tremendous onus laws like this may place on small startups and side projects:

Does anyone know how companies are supposed to comply if "user data" literally cannot be deleted? I'm thinking in the case of blockchain type applications, where one users' actions feed into another users' actions, and you can't deleted user A's actions without deleting potentially tons of other stuff and destroying the application.

Like does this law basically ban GitHub and code collaboration too?

<comment><USER38> For the 1) you just don't commit data in the blockchain itself. You can commit an ID that points to external data and drop these external data if requested. This clearly looks like an anti-pattern but putting personal data in an immutable data structure is an anti-pattern too, since those data don't belong to you.

What if a bank put the gold of their customers in a concrete pillar instead of a vault? Fuck the back, I guess. I don't see why not.

<comment><USER33> Again, the GitHub example is a good one. I have some commits in Django core from years ago. What if I "request" my data be deleted from GitHub? What are they supposed to do? If they rewrite the history it will destroy the project; and if anyone can rewrite the history in the future it leaves projects open to hostile actions.

I suppose the argument would have to be made that it's not personal data; it's an act of public publishing or something. So in this case it's akin to me publishing a blog and other people quoting it years later. I can delete the original blog but not the reprints in newspapers or quotes.

Or that it stops becoming "your" data and becomes instead "the other user's" once eg the Django project accepts the PR. So you can delete user A's PR but not the Django project's now-integrated copy. I think this rationale makes the most sense. After all, someone could still have the repository on their computer and push it back to GitHub again.

I realize this is an edge case that doesn't apply to 99.9999% of companies, but as an engineer I find it interesting!

Edit: after thinking this through more, I suspect that e.g. GitHub could argue they comply as long as they delete User A's repo. Subsequently integrated PRs, etc wouldn't have to be deleted because they could argue they're no longer User A's.

I kinda feel like if language to allow this was added to the law explicitly it would be open to abuse, so I suppose this kind of thing has to remain vague and open to interpretation in e.g. the courts if someone is being nasty.

</comment></comment></comment><comment><USER48> Is this an opinion article or a legit journalism? The article clearly has a slant, but TechCrunch didn't classify it as Opinion.

</comment><comment><USER49> The whole system is rotten to the core. Allowing companies to portray themselves in a positive light on privacy

> "The time to act is now,"

While pushing a federal law geared towards undermining privacy rights?

Doublespeak anyone?

</comment><comment><USER50> Instead of complying with the law they are wasting time lobbying. If they don't comply on 1st of JAN what excuse are they going to have?

</comment><comment><USER51> I wish I lived in California. I'd be requesting the deletion of my data ALL OVER the internet.

</comment><comment><USER52> If the Environmental _Protection_ Agency can hold a straight face while revoking California's ability to protect its own environment with higher standards, I'll hold off on getting excited about privacy laws until we see the FTC/FCC/etc.'s response.

</comment><comment><USER53> I think everyone's data must belong to their own.

</comment><comment><USER54> Can someone who has actually READ this law summarize the main provisions from it?

</comment><comment><USER55> Project Gutenberg currently blocks users from Europe to avoid having to comply with GDPR. Logically the next step would be to block users from California as well.

</comment><comment><USER56> Anyone remember when TechCrunch actually took the side of "Silicon Valley"?

</comment><comment><USER56> So many NYC-based journalists who love to spit all over "Silicon Valley".

Is there room for a TechCrunch-like publication with a more Silicon Valley- influenced editorial bent? (There's already a massive surplus of sneering Brooklyn-based scolds in "tech media".)

<comment><USER57> >Is there room for a TechCrunch-like publication with a more Silicon Valley- influenced editorial bent?

are you actually asking for someone to purposefully preach to the quire? The function of journalism is to speak truth to power, you think facebook et al need any further help? I think they actually paid the telegraph for a series of agitprop articles, you might want to check those out.

<comment><USER58> "are you actually asking for someone to purposefully preach to the quire?"

He's both rightfully pointing out that TechCrunch is preaching to one minority choir and asking for another publication to preach to a different choir. Ironically the publication he's asking for was TechCrunch before it was bought by AOL and ruined.</comment></comment></comment>


Build a Digital Clock in Conway's Game of Life - <AUTHOR> http://codegolf.stackexchange.com/questions/88783/build-a-digital-clock-in-conways-game-of-life/111932#111932 <comment><USER2> Previous discussion:

[https://news.ycombinator.com/item?id=13846083](https://news.ycombinator.com/item?id=13846083)</comment>


Karen Uhlenbeck, Uniter of Geometry and Analysis, Wins Abel Prize - <AUTHOR> https://www.quantamagazine.org/karen-uhlenbeck-uniter-of-geometry-and-analysis-wins-abel-prize-20190319/ <comment><USER2> Uhlenbeck is delightful, and one of her big ideas discussed in this article -- bubbling -- truly has changed both her field and algebraic geometry. It's a cool idea. In a previous thread here (How I learned to love algebraic geometry, [https://news.ycombinator.com/item?id=19397957](https://news.ycombinator.com/item?id=19397957)) there was some discussion of singularities. Algebraic geometers like polynomials, while symplectic geometers like Riemann surfaces. These coincide at times but Riemann surfaces include lots of non-polynomial examples.

Anyhow, as an algebraic geometer, the place I learned about Uhlenbeck's work was in compactification of moduli of curves. Basically, say I want to look at all the polynomial curves that can live in a certain 'environment'. (One 'application' is string theory -- what particle interactions can occur given a certain set of energy constraints? The particle interactions are curves traced out over time by particles/Riemann surfaces traced out over time by the little loops that represent closed strings in string theory; the energy constraints constrain the shapes the particle interaction can take.) If you want to look at limits of families of these interactions, you're looking at some odd behavior. An example is the equation xy = t^2 -- this gives you nice hyperbolas for values of t not equal to zero, but as t -> 0, you get something singular, two crossed lines. Or x^2 - y^2 - z^2 = t^2: you have a nice smooth hyperboloid when t neq 0, and a double cone when t=0. However, these examples are just showing you the idea of how singularities appear in families of smooth polynomials. Uhlenbeck's older work really worked with the system of constraints that I mentioned -- figuring out what can appear under those constraints is a considerably more complicated problem!

This is a very imprecise discussion above and I'm totally blurring together Uhlenbeck's bubbling and compactness theorems from gauge theory -- but I never followed her work in a systematic way but instead was plunged into seeing its aftereffects from another related field that the work affected.

Last quote really resonates: "Along the way I have made great friends and worked with a number of creative and interesting people. I have been saved from boredom, dourness, and self-absorption. One cannot ask for more."

<comment><USER3> Meanwhile as a mathematical physicist, I learned about her through instantons.

Quite a wide career.

</comment></comment><comment><USER4> _" Mathematics research had another feature that appealed to her at the time: It is something you can work on in solitude, if you wish. In her early life, she said in 1997, "I regarded anything to do with people as being sort of a horrible profession.""_

This sentence struck me as slightly odd if only because Erdõs was renowned for his social approach to mathematics[1], and my layperson's understanding of mathematics departments being somewhat collaborative within their sub-fields.

I know there are some notable examples of other solo breakthrough endeavours, such as Shinichi Mochizuki[2] or Yitang Zhang[3], and but those examples seemed to be exceptions to the rule.

Perhaps I'm channeling too much Terence Tao[4], or maybe the lone wolf researcher only applies to literal geniuses who work exclusively in academia.

Is mathematics research still a primarily solitary activity?

[1] [https://en.wikipedia.org/wiki/Paul_Erd%C5%91s](https://en.wikipedia.org/wiki/Paul_Erd%C5%91s)

[2] [https://www.quantamagazine.org/titans-of-mathematics- clash-o...](https://www.quantamagazine.org/titans-of-mathematics-clash-over- epic-proof-of-abc-conjecture-20180920/)

[3] [https://www.cnet.com/news/yitang-zhang-a-prime-number- proof-...](https://www.cnet.com/news/yitang-zhang-a-prime-number-proof-and-a- world-of-persistence/)

[4] [https://terrytao.wordpress.com/career-advice/does-one- have-t...](https://terrytao.wordpress.com/career-advice/does-one-have-to-be-a- genius-to-do-maths/)

<comment><USER5> It is interesting to read what she saw in math, why she liked it. For me, I just thought it would be useful, especially for physics which I thought was even more useful!

No one ever explained to me how a career in academic math research would work: I never suspected that just digging into questions that were fun and curious and maybe someday somewhat useful, making discoveries, and writing papers could be a career that could support a family.

In particular, I still don't understand why the US has so much respect for research universities: My guess was that college was for teaching the students. But in a research university, nearly all the effort by the professors is their research, and the teaching is a sideline. E.g., might have a really good researcher in far out topics in analysis teaching junior level linear algebra. So, the money to the university, for people directly paying full tuition often a LOT of money, is only a little for that teaching but much more for the research. An analogy for restaurants would be that each hamburger had to come from some three star Michelin place and cost $200.

E.g., when I was a B-school prof, I was really discouraged to see that what the B-school was teaching had next to nothing to do with business. Instead, the school was interested in _research_ , e.g., the question P vs NP. If medicine were taught that way, then no one would go to a hospital no matter how badly they hurt. B-school tried to be academic research, not professional training.

Besides, for me as a college student, I had to conclude that after junior year level material, the profs really needed to understand what they were teaching much better than they did. For that, they just needed to do a much better job learning and presenting what was already in the library and without more research. E.g., I never had a math or physics prof who had a good grasp of the theory and applications of Stokes theorem, classic potential theory, multipole coordinates, or both the theory AND applications of Fourier theory. None of my undergrad physics profs knew either general relativity or quantum mechanics at all well. I wanted to learn that stuff, not for research but for applications.

Math research solitary? It always has been for me. For learning the standard stuff, sure, can have people to talk to. But if they are in the same course and it is competitive, then maybe they don't want to talk?

The reason my math research was solitary is mostly just because the new work I was doing was so focused that no one else around knew much about it or had much interest in it. For a lot of math research, being focused is close to necessary and, then, the solitary aspect gets to be close to automatic.

Moreover it appears that there can be an effect from outside: Some people are more socially skilled, polished, talented, interested, motivated, etc. than others. In some fields, such social skills are important for success. But in math, if you can learn it, mostly on your own, then you can teach it -- good social skills can help but can get by with not much. This is even more the case for math research: Pick a problem, do some research, get some results, type in a paper, send it to an appropriate journal, maybe all with essentially no contact from anyone else.

So, since in math can get by with less than the best social skills, people without great social skills can find math, be successful, and stay, and, then, the result is that comparatively math is not a very _social_ field.

But, a lot of people can learn to be social: Gee, a lot of grade school girls (sorry to bring gender into this) have just astounding social skills: E.g., it seems clear enough that long ago Hollywood discovered that among child actors the girls were much better -- they paid attention what was going on socially, reacted to others, had lots of facial expressions on tap, were good at glancing, averting, head tossing, pose striking, cases of body language, expressiveness in their voices, etc. Well, what a grade school girl commonly knows others can pick up, too! Okay performance in the lessons is not seriously difficult.

Reading some of what Uhlenbeck said about herself, she was doing well in the E. Fromm recommended social activity "Giving knowledge of oneself" and that can help a person be social because they are letting others know who they are. Or little so interests people as other people; if some other person communicates no better than a stone wall, then there's not much for others to be interested in; Fromm's _giving knowledge_ can help with that.

For a nutshell description, my view of mathematicians is that they are less manipulative than most other people. Well, in some activities, can seem to get progress by manipulation, but in math, can't prove a theorem by a fake, manipulative proof!

<comment><USER6> >I never suspected that just digging into questions that were fun and curious and maybe someday somewhat useful, making discoveries, and writing papers could be a career that could support a family.

I am interested in pursuing a PhD in Pure Mathematics. What are the career prospects for it? Based on what I read academic prospects don't seem too thrilling. It appears you may have to do multiple post-docs at low pay, and still not be able to be hired at a good school. What is the path to becoming a professor and making a livable salary?

If that is the case what are the industry prospects? Would whatever software company want to hire you, if your pure math specialization isn't directly applicable to what they're focused on? In turn, it seems better to learn how to code. But will your pure math specialization (as in not applicable to anything anyone is doing) + coding abilities set you apart?

I would rather study mathematics, pure mathematics and not be unemployable. But I don't really know what the job prospects are like. Could you speak to that, say, from a realistic perspective?

<comment><USER7> I did a PhD in pure math and now work for a big tech company. Having the PhD will get your foot in the door basically anywhere, so you'll at least make it to the screen, but ultimately you have to pass the same interview as anyone else. That means doing LeetCode and reading Yegge's stuff etc.

If your goal is to maximize lifetime earnings, a PhD is maybe not the right choice, but if you want to spend years studying something you love while financially breaking even then go for it. I definitely don't regret it, even though I would be worth a lot more if I had gone into tech straight out of college.

Btw, finance is also a common destination for pure math PhD's looking to leave academia.

<comment><USER6> Thank you. This is exactly what I wanted to hear. I'm more interested in studying math than maximizing my income, but post-graduation opportunities is a concern, since I'm not well off. Your reply gives me the encouragement I was looking for to pursue my passion. Thank you.

<comment><USER8> To add to the discussion. I did a CS PhD with a statistical bent. It's served me well. However, I would see if an MS provided you with equivalent benefits from a career standpoint. Very few companies do "research". And if you're in the US, unless you acquire funding with yourself as the PI its going to be impossible to find an academic position.

</comment></comment></comment></comment></comment></comment><comment><USER9> Enjoyed her IAS lecture on Emmy Noether's laws. She's incredibly fun to watch. Well deserved. Congratulations, Karen.

</comment><comment><USER10> The closest I will every get to something like an Erdõs number is that I can now claim the one and only female Abel prize winner was my Differential Equations teacher at college! I missed taking a class with Steven Weinberg when I got to UT because he semi-retired the year before.

<comment><USER11> I felt very lucky to have had her for an experimental mathematical modeling course (M375) back around 2000. She was simply delightful as a professor, even for a mathematical lummox like myself. :) Encouraging, informative, brilliant ... we should all be so lucky as to have teachers and influences like her in our lives.</comment></comment>


Twitter, an Evolving Architecture - <AUTHOR> http://www.infoq.com/news/2009/06/Twitter-Architecture

<comment><AUTHOR> Here's the presentation slides from the author's blog:

[http://blog.evanweaver.com/articles/2009/03/13/qcon- presenta...](http://blog.evanweaver.com/articles/2009/03/13/qcon- presentation/)</comment>


Global debt surges to highest level in peacetime - <AUTHOR> https://www.ft.com/content/661f5c8a-dec9-11e9-9743-db5a370481bc <comment><AUTHOR> Although the really bleak graph is when you look at the long-term debt projections given the retirement of the baby boomers.

The US and UK both publish long-term projections: [https://imgur.com/PbyCJNJ](https://imgur.com/PbyCJNJ)</comment>


Coinbase closed account with 7 figure USD worth crypto and not allowing withdrawal - <AUTHOR> Hello everyone,
I am writing this out of desperation more than anything else. I found out last month that i had a significant amount of ETH (in today's term) that i had bought in presale. I logged into my CB account after years to liquidate it but could not withdraw much as my ids are expired. As i transferred ETH from my pvt wallet to CB and sold some but could not beyond a limit. After a few attempts at validating my account Coinbase closed it stating that i had violated terms of use. They still show the option to 'withdraw' my ETH when i try to log in but the option never works. I also see that the balance is slightly lower than what it was. After 3-4 weeks of no luck from Coinbase i finally got through a representative who escalated the issue but the team did not get back to me still (has been a week).
My worst fear is that Coinbase has lost my crypto, it is not even telling me the reason for closing my account. I needed my transaction for tax purposes and they have not even checked on that issue.
I am losing my sanity, health and everything. First to find out that i have a significant wealth suddenly and then to see it disappearing into Coinbase without any valid explanation.
I have seen many Cb issues for much smaller amounts here, can you imagine my case. I am really out of ideas here, have spent the last few weeks distraught, frustrated and unable to do anything. <comment><AUTHOR> My lawyer and i checked that Coinbase terms state that they can stop doing business with someone without explaining the reason. I understand this but why withhold the crypto and without enough help to individuals in distress.

1\. They never stopped me from receiving a large crypto from a private wallet in the first place 2\. They never allowed me to submit my new ids, explain my situation and condition to them.

I would like to proceed legally but i need to at least make sure that my funds are safe. Because they are slightly less than the original amount i think that is not the case.

Also i do not have any other exchange account, i only recently got verified for 1 and all other requests are pending.

</comment><comment><AUTHOR> Please note that i am using throwaway because of the sensitive nature of the subject and have been on HackerNews for fairly long time, with an account but mostly upvoting and lurking, i understand that unknowingly i may be breaking some site rules (especially the figure part) but i really am at loss of options right now and i waited and tried other avenues before doing this

</comment><comment><USER2> Very sorry for the frustrating experience. Can you please let me know your support case number? Thank you for being a customer.

[https://support.coinbase.com/customer/portal/articles/176660...](https://support.coinbase.com/customer/portal/articles/1766604)

</comment><comment><USER3> Lawyer up or write it off and move on with your life. If you're really losing health and sanity over this, consider the forced exit from this volatile asset a blessing in disguise.

<comment><AUTHOR> I have a lawyer but i need to understand how to proceed. I need to protect my funds first and see what i can do there.</comment></comment>


Show HN: Eeegl startup pros - <AUTHOR>

Have you ever thought how nice it would be to outsource the monotonous stuff in a startup and focus really on your core business problem? We take care of your startup's non-core activities including server setup, CRM & project management tools, social media presence, analytics and more.<p>We would love to hear your feedback ! <comment><USER2> I feel like a lot of startups might find value in outsourcing some of these items, but depending on the startup many of those things will be core competency. Server setup isn't something you want to completely outsource because without it you have no startup. Project Management tools are equally as critical and will vary based on the team. Some teams work well with items like Pivotal Tracker, some with basecamp, others prefer a much more structured waterfall execution with a long planned gantt chart. It sounds like a lot of these items are either a key part of how the team executes personally or are very low touch items. The general of idea of this I like but the specific services I feel are off base in what startups would like to outsource.

<comment><AUTHOR> Sorry for the delayed response.

Outsourcing is not an all or nothing deal. The startup could outsource server setup to us, do their product and as they get time slowly take charge.

A lot of startups have very limited time to get their idea executed and make it a real success. One of the founders might quit, the team might run out of funding or a big competitor might make your product offering unnecessary. This makes the first few months really critical.

Setting up your server with the right web server, installing wordpress & configuring other tools, keeping the packages updated take a lot of time and those few extra weeks can be the difference. What we do is help the startup get going and your team could take control of the stuff over the course of time as you get comfortable with the components.

For SaaS startups our offerings like creating an effective landing page that is connected to mailchip for double opt-in, managing inhouse development with project management, keeping track of marketing & sales with CRM tools will be useful.

And then once the product is done launching the startup with affordable PR tools, improving their site's search rankings, tracking with right analytics tools can also be done.

</comment></comment><comment><USER3> Looks like something that could be useful to many startups coming up in the mushrooming boom and the thriving Internet economy.

I guess a 'Why us' type page would inspire more confidence and make more people sign up for your beta.

HTH

Edit: You might want to check this thread and perhaps, think about a strategic alliance with the OP:

<http://news.ycombinator.com/item?id=2276344>

<comment><AUTHOR> Thanks for your feedback. We are launching our complete website soon and it will have detailed info of who we are and what we offer.

</comment></comment><comment><USER4> That baby is pretty creepy. Also, you may want to get a native English speaker to look over your copy. There are some weird grammar / structure things going on there.

Who is your customer? Are you targeting non-SaaS startups? I would imagine that any SaaS startup would want to be hands on with server choice and setup.

<comment><USER3> > That baby is pretty creepy. Also, you may want to get a native English > speaker to look over your copy. There are some weird grammar / structure > things going on there.

Ditto on all three above.

> Are you targeting non-SaaS startups?

I would imagine so - perhaps the OP will post his views on this.

<comment><AUTHOR> Our offering applies for both Saas and non-Saas startups.

For SaaS startups our offerings like creating an effective landing page that is connected to mailchip for double opt-in, managing inhouse development with project management, keeping track of marketing & sales with CRM tools will be useful.

And then once the product is done launching the startup with affordable PR tools, improving their site's search rankings, tracking with right analytics tools can also be done.

</comment></comment></comment><comment><AUTHOR> clickable: <http://www.eeegl.com></comment>


Show HN: Lockdown Project – A Data Management Tool - <AUTHOR> https://github.com/rhinoman/odmp <comment><AUTHOR> This might be on the edge of being a bit early for a Show HN, but I thought I'd share what I've been doing with all of this unexpected free time:

An open source data management tool. See Github: [https://github.com/rhinoman/odmp](https://github.com/rhinoman/odmp)

I also wrote a blog post about the project here: [https://jamesadam.me/2020/09/08/my-lock-down-project-a- data-...](https://jamesadam.me/2020/09/08/my-lock-down-project-a-data- management-thing/)

I've used much more fully featured (not to mention expensive) tools in the past but wanted to try creating something that was easier for simple needs. And also, open source.

Does it work? Sorta. I've run some data through it, squishing a lot of early bugs in the process, but haven't seriously tried to stress it yet :)</comment>


Ask HN: Does a strong editor improve language adoption? - <AUTHOR> Does having an IDE for a new language matter?
Does it help with language adoption?
Do you bother investing in a language that doesn't have a Language Server Protocol ( LSP ) or mode for your favorite editor?
Does a tightly coupled set of tools help elevate a new language above others? Should a language "win" even though it doesn't have these tools but just because it is "good"? <comment><USER2> You're basically asking if usability matters for a language, and of course the answer is yes. Lots of languages have useful and verbose type systems that would be painful without IDEs. With them, they make refactoring and autocompletion look close to magical.

</comment><comment><USER3> I started coding Java in a text editor while Java was still in beta. There were good IDEs for C, Pascal, assembly, etc.

It was clear that a great Java IDE was possible, but it took a decade to get there.

Java IDEs compensate for the pain of Java being wordy. The debuggers work, even when you are debugging a process with both Jdb and gdb at the same time.

</comment><comment><USER4> I did Haskell for a while in nvim with basically no features (there are several, I just didn't set them up). I simply had ghcid running in one tab, nvim in the other, and did what the compiler told me to do.

So that didn't matter to me because the compiler is great and ghcid is very fast and sufficient.

<comment><USER5> Haskells tooling is abysmal, which saying out loud it doesn't make sense. Such a great compiler with the most über of type systems, one would think that the tools used for it would be a shining beacon of hope.

Yet setting up the most basic system from scratch can easily take hours.

I definitely appreciate the sense of pride and joy one has with surviving the challenges, but jeez, stop for a second and take a quick look at Rust's package manager or F# and Ocaml's ide experience.

It might, just might, help bring in new blood and users to grow the community and with it bring better tooling and other useful libraries.

<comment><USER4> In general I agree but have you used ghcid? I'm not really sure what people want in ide tooling, I'm quite fine with compiler output and everything else I want from an ide should be language agnostic: goto, search, replace, file navigation, etc.

</comment></comment></comment><comment><USER6> I sure hope so. As a developer for a language, we're planning on creating a language server and debugger to make it easier for people to use our language.</comment>


Show HN: Track That Artist – Emails for New Spotify Releases - <AUTHOR> https://trackthatartist.com <comment><AUTHOR> I was never really that happy with the Release Radar playlist and decided to just make something while I was hanging out with the family over Christmas. Lots of new releases today which was pretty cool to see! Maybe you'll find it useful</comment>