rst

86 ms·

871.
by rst 14y ago
RapGenius probably don't want their money back --- they want a service that works as advertised. And making this a big, public issue is a better way to get that than legal threats. Besides, even if a lawsuit did get them their money back,
872.
by rst 14y ago
True for Rails 3, though you can enable threading (multiple requests per process). Rails 4 will likely default new apps threaded, but that option would still have to be manually enabled for older ones. (I say likely because there are no f
873.
Are you sure you are using JSONP properly?(homakov.blogspot.com)
2 points by rst 14y ago|0 comments
874.
by rst 14y ago
Many employment agreements claim rights to anything the employee invents which is related to the business, whether or not on company time. And in some states, it's common for the claim to be on all inventions, whether related to the busi
875.
by rst 14y ago
I've got my boss (well, actually the CEO) to sign a paper acknowledging the side project, and disclaiming any interest on behalf of the company. Hopefully, that counts for at least a little more.
876.
by rst 14y ago
It's possible to mount the file system containing the production build of a Rails app (after "rake assets:precompile") completely read-only. In fact, Heroku, one of the more common cloud-management providers for Rails apps, does exactly th
877.
by rst 14y ago
LLVM is also useful for runtime code generation (e.g., in rubinius, a Ruby implementtion), and as a prepackaged optimizer for other compilers (e.g., GHC, the Glasgow Haskell compiler). Both those packages have users outside the compiler re
878.
by rst 14y ago
In normal conditions, yes. But when things go wrong (your "or crashing", perhaps), the pilot is suddenly very much involved, and screwups can be fatal. Take, for example, Qantas flight 32, an A380 that was successfully landed after one of
879.
by rst 14y ago
I'm pretty sure Lufthansa owns their own planes as well. Not so different, really. :-)
880.
by rst 14y ago
Well, some people already give friends and family, at least, a different email address entirely. ("Personal email" vs. "work email".) The system as described seems more useful for the "work" version. Then again, it doesn't fully accommoda
881.
by rst 14y ago
The Python world has had very, very similar problems. Two popular Django add-ons (piston and tastypie) had remote code execution vulnerabilities due to the exact same cause as the recent Rails RCE vulns: insecure deserialization of YAML. S
882.
by rst 14y ago
Boeing and Lockheed are major players, and you're right about the rivalry, but they're not the only ones. ATK (the former Thiokol) is a major player in the Space Launch System project, and politically very well connected; there are also sm
883.
by rst 14y ago
Discussed in the comments on jwz's post, where several people say claims of ImageMagick's death are greatly exaggerated, and it has actually fixed bugs that still exist in GraphicsMagick.
884.
by rst 14y ago
Rails 2.x apps aren't necessarily using Bundler at all, and some folks may have disabled the vulnerable parsers, or installed the security patches only into an earlier version to avoid other breaking changes or new deprecations. (Rails-cor
885.
by rst 14y ago
FWIW, some hosts were more proactive --- Heroku in particular sent out email to the owners of vulnerable apps within a day or two of the announcement.
886.
by rst 14y ago
But the academics can't "wait +/- 20 years" --- they have careers to build now. Grad students, post-docs, and junior faculty have to build a portfolio of work that will be impressive across many institutions where they might get tenure, or
887.
by rst 14y ago
The metasploit folks put a pen-tester's guide to finding Rails-running targets on their own blog here: https://community.rapid7.com/community/metasploit/blog/2013/... In addition to common port numbers and stuff like redmine, their tipoff
888.
by rst 14y ago
Spring isn't the only widely-used Java framework that's had these problems. The Struts developers put a general-purpose interpreter (OGNL) in their parameter parsing pipeline, and thought they'd kept things safe by blacklisting dangerous s
889.
by rst 14y ago
Not all developers have a Facebook account. And the ones that do don't necessarily want their professional activity tied to it. Twitter has no official policy barring the same person from having multiple accounts (though Github does, for f
890.
by rst 14y ago
It's not necessarily Boeing's engineers. A lot of the 787 design (not just fabrication) was subcontracted out, so it's just as likely to have been whatever subcontractor had the combination of low bid and business connections to win the co
891.
by rst 14y ago
Not if you want prompt fixes to the current spate of Rails bugs. As I write, Ubuntu currently has the fix for the last remote code execution vulnerability in Rails marked as being of "undecided" importance, and still "unassigned", even t
892.
by rst 14y ago
If you're referring to the Space Launch System --- the Congressionally mandated program to build another launch vehicle with the Saturn V's capacity --- Congress has mandated that that should instead try to reuse technology from the shuttle
893.
by rst 14y ago
It's oversized for SpaceX's current rockets (a single F-1 has more thrust than the entire Falcon 9 first stage). SpaceX has plans for bigger rockets and engines, but those are rumored to involve different fuels, perhaps for reusability. (K
894.
by rst 14y ago
If stuff isn't running as root, but still running as you, that still gives it access to a fair amount of private data. So, to keep really suspicious code from reading your banking details, etc., you need to run it under a different uid tha
895.
by rst 14y ago
Their current work is under contract to NASA; they're one of three private companies developing spacecraft for possible future use in ferrying astronauts to the International Space Station. (The other two are Boeing and the Sierra Nevada c
896.
by rst 14y ago
It depends where outside the US, one imagines --- but there are certainly places that are generally worse. Law enforcement agencies in, say, China, are not known for their respect for the rights of the accused or their scrupulous attitude
897.
by rst 14y ago
Among other things, several prosecutions of accused terrorists arrested before they could blow stuff up. In almost all of these, the actual instigators were government agents working undercover, and the alleged "terrorists" who were actual
898.
by rst 14y ago
And the worst possible "consequence" is that she has to find another job. Again, no comparison to what she was putting Swartz through.
899.
by rst 14y ago
As the page notes, some of those cases are also very controversial. Particularly the case of Tarek Mehanna, who was convicted of aiding a terrorist organization for translating some of their documents into English. No evidence was offered
900.
by rst 14y ago
Lack of both --- the nameservers are unreachable, but so is everything else. (MIT apparently hosts its own DNS, but attempting to ping internal servers by IP address, bypassing DNS, also fails.)

More ›