skysight-inc/HackerNews huggingface dataset:
They make the argument that "anything you install can pwn you", which is like saying, any food you eat can kill you. Well, no, any food you pick up off the street that has flies and maggots on it might kill you. That's why we verify our software before we install it, and verify our food is good to eat before we eat it.

Here's some reasons why curl|bash is stupid.

--

Unversioned, unverified software

Like was mentioned in the article, yes, signed checksums are standard ways to ensure you are running only the software the original packager intended. This means that, no matter who could possibly want to attack this software, you will always be positive you are using the correct software, forever.

The author's response to this? "Oh, but we're using HTTPS. So you know the commands we're running are from us."

Anyone could give you exploited software offline, since there is no versioned, verifiable software package.

In addition, anyone who can MITM a remote network connection (like your company, the company who sold you your laptop, the operating system creator or distributor, the browser creator or distributor, any of six hundred and fifty Certificate Authorities, and virtually any internet-connected government in the world) can exploit the software.

In addition to MITM, an attacker, or a Sandstorm employee, can at any time use the company's network itself to distribute exploited software.

HTTPS has had numerous security vulnerabilities over the years, which not only enables MITM of connections, but also attacking and subverting HTTPS servers and using them to distribute exploits.

--

Unknown commands at execution time

Every piece of package-managed software can be unpacked and examined. Even if you don't know what's in the binaries that are delivered, you can be sure what commands the package will run and what files will be dropped and where.

You can also run the installer in a sandbox and reproduce it every time. You can't reproduce curl|bash every time, because it has the ability to change every time it's run. (Unless you save the bash script the first time you download it)

--

Running arbitrary commands remotely

Using curl|bash literally asks a remote connection to execute arbitrary commands on your host inside your network. Most well-defended corporate networks should block this, but some don't.

Of course you're about to say "But we run arbitrary code remotely all the time with web browsers!", which is why we have things like NoScript, AdBlocker, etc to prevent any random attacker with a 0day from compromising unknown holes in our software, not to mention leaking our history, cookies and other sensitive data from otherwise "normal" browser functions.

--

You know why people (like me) get angry about curl|bash? It's a bad troll. It takes obviously bad ideas about security and tries to validate them by waving HTTPS around like a banner of invincibility, then coming up with excuses for why the security problems it introduces are not important.

If you want to be cavalier with your systems, that's fine. But don't try to convince people it's secure when it's not.
I'd say that my action is this: If you don't have something to say, don't say it. If you don't have something to say right now, don't view yourself as being stuck. You don't have to have something to say right now (or ever, for that matter). Don't waste your time trying to have something to say. When you do, you'll know. In the meantime, go do something else, rather than trying to "find" something to say.

Your advice is on how to find something to say, and it's fine (though it's not the only way to get there). My advice is how to think/feel about your situation when you don't have something to say.

I said that your advice isn't the only way to find something to say, because the something to say doesn't have to be something intellectual. Go do some interesting intellectual work - that's fine. But also, go fall in love. Go start playing sports. Go on vacation. Go take up a hobby. In any of those, you can find something to say, not because you're desperately trying to find something to say, but because you're out living life instead of racking your brain looking for something to say.
LSB-compliant RPMS, though there are a few aggressively antisocial distributions that don't support them as well as they should.
Often referred to as a 'moonlighting' clause and by lawyers as 'duty of loyalty'.
>they will work with you

Not so sure about that... Tech giants have the advantage of being able to pick from the best applicants out there. In the same way you could say "having these clauses is a deal breaker for me", it's very easy for them to say "NOT having them is a deal breaker for US".

The difference is that if you refuse the offer, you still have to find a jobs elsewhere (and I suspect that most giants will have the same clauses by default). But if they refuse the offer, there is already someone being interviewed that will accept the clauses.

Maybe I'm being pessimistic, but I think that unless these clauses are deal breakers for most developers out there, then this practice will continue to be done.
This tiler uses an algorithm that recursively subdivides triangles according to certain rules. Moving the mouse lets you easily see each transformation from the previous. Try clicking anywhere on the page too.
I feel like there's some room for building a nice scripting DSL given how strong of a macro support there is. However that does mean you're bringing in a pretty heavy VM for something that could be relatively simple.
Employers are, by default, going to look out for themselves.

I'd argue that the onus is on the developer to understand and fight for better contracts. If more developers were taking these matters seriously then companies would have to respond. However, I doubt they'll be making the first move.

In the meantime nothing stops you from finding jobs that better suit your needs. "No thanks" is an acceptable answer to an employment opportunity.
How can they check? It's certainly possible that Truecrypt has some implementation issues, but I can't see why it's not theoretically possible to do this well.
The paper describing this work: http://arxiv.org/pdf/1507.06947v1.pdf

They trained on 3 million "utterances" of average duration of 4 seconds. These were distorted by noise to get 20 variations (so the training set was 60 million utterances total).

I don't understand if these were labeled somehow There's a section on clustering into 9287 phones, but it isn't clear to me if these were used as labels.
Interesting stuff, but in my usual 15 minutes of attention-span for things like this, utterly impenetrable. Can anyone who has had the privilege of being invited to the Urbit network enlighten us as to just how useful it is shaping up to be in light of, say, the situation with IPFS by comparison? (http://ipfs.io) Because to me, it seems that IPFS may well be ahead in terms of actual applicability right now. Am I mistaken?
My new favorite: "I have discovered a critical security vulnerability in Windows which I intend to present at the XYZ conference. It allows any user with administrator privileges to perform operation Q, something that should be available only to SYSTEM."

http://blogs.msdn.com/b/oldnewthing/archive/2015/09/23/10643...
not really hard but a limit of HSTS in this particular scenario is that it doesn't automatically redirect you to https if it is the first visit to the web site, which means if the http channel is compromised (the scenario calls for MTM) the hsts can't do anything to fix it (you can simply strip the 302 locations or tell the server that the other endpoint is talking https).

only returning visitor will be redirected client side and only if they saw at some point the HSTS header over https.
It's almost as if they copied my blog post from last week...

https://medium.com/@ewindisch/curl-bash-a-victimless-crime-d... (HN link: https://news.ycombinator.com/item?id=10217877)
That's actually an interesting thought:

If my password is "iKilledColonelMustardWithACandlestick" - and it's actually an incriminating fact, how does that factor into potentially self-incriminatory discovery?
Fifa16 ultimate team
Try watching Dancing with The Stars
Ads are psychological manipulation. If there's an unethical party in this whole debate it's the advertisers, not the blockers.

Your ability to get rich is not my ethical concern.
Where are you seeing that? In the paper[1] it says:

Acoustic features are generated every 10ms, but are concatenated and downsampled
for input to the network: 8 frames are stacked for unidirectional (top) and 3 for bidirectional models (bottom).

[1] http://arxiv.org/pdf/1507.06947v1.pdf
It is not a conspiracy theory per se, I'm just skeptical of their optimization claims. In theory, sure. In practice, I'd have to see hard data.
Thanks for the feedback. What in particular did you find difficult or non-obvious about it?
You don't agree with the explanation. I think it's totally fine to come up with an individual explanation anyway. So lets refine the prescription from a vantage point where everyone seems to agree: procrastinating and lacking passion for a given task correlate.

Given that, I found a very simple method to do away with being unproductive while still getting a decent dose of procrastinating. Simply, I started to enrich any activity that tops the to-do list with an element I enjoy about pondering/procrastinating. For me it works repeatedly. I'll give you three examples.

1) On doing the tax-filing. Instead of plunging right into, I thought of people I'd like to contact anyway and make a cross-section of who just recently did that or sports an expertise in that. In my case it was my brother (we usually don't connect too often). Besides enjoying talking about side-topics, I learnt tax rules new to me. Namely, some step-functions where different social security fees apply. Very worthwhile!

2) Physical workout. I'd have a better body and probably mind as well, if I could stick to a rigorous schedule. Now, I like to engulf myself in curiosities from time to time as well. Easy fix: moving the workout session to Venice Beach. Jogging there, some calisthenics plus absorbing new (mostly human) attractions in one sweep!

3) Getting "work" done. I needed to implement this iteration of an ML algorithm. There was no particular deadline. However, knowing that starting soon would yield a better outcome irrespective of any other factor, I decided to procrastinate by researching on sources I would like to read anyhow. That became hackernews quite recently. So instead of randomly reading posts (like this one, lol), I put in keywords of ML into the search box and sort by date. Et' voila.

Conclusion: find out what is it that fancies you about your urge to procrastinate at this exact moment and then draw a link to what you should do. It works.

Oh and here is example 4) I should now follow-up with a dozen of new acquaintances and prepare to meet them for dinner tonight. But I'm on HN right now. So I decided to take the insight from this discussion and use it as a topic for tonight's dinner. Be gentle, be curious and be interesting to people that matter!
Browsers should consider not showing a green lock unless a site uses HSTS.
Ask HN: Which teams received the YC Fellowship?
Wonder if YC will ever announce the ones who got in, since it was meant to be a pilot program.

Does anyone know?
Maybe, but in that case HN seems like the perfect community to take a stand and start telling developers not to sign those contracts.
How long ago was your experience? Was gcc an option at that time? Or did management require you to use the vendor compiler?

What we did was, we used the vendor compilers to compile gcc for a platform (or maybe used gcc to cross-compile itself, I forget). Then we used that gcc to compile gcc for that platform. Then we used the new gcc to compile gcc for that platform, and made sure that it was the same as the previous gcc. This wasn't easy - we had one guy that this is pretty much all he did for months. But it got us to a place where we were free from the vendor compilers.
In general, people don't care how you mine gold.

They care that you have gold to sell.

Tinkering with hyperspatial hoversmelting 0.1.1-beta is a waste of time if you can just crush rocks, leach 'em and sell some flake.
For many big companies it will prove very difficult to push back on any contract term. Contracts are normally standard across the whole organisation and and special casing, for example in an overly broad non-compete or a IP ownership term, will normally be a non-starter.

You might get a waiver for a specific pre-existing project but probably that is about it.

I live in the UK and in the past when I've asked experts about this stuff they say: "It's an Americanism - don't worry about it - if push comes to shove a judge will think it's too strict and throw the entire thing out". Apparently in the UK there is some kind of rule where if a contract is excessively one-sided or otherwise onerous it can be voided. YMMV!
Yep. They have been condemned for fraud and false advertising.[0]

[0]https://en.wikipedia.org/wiki/Oscillococcinum
The I-670 cap in Columbus, OH is a good example. https://commons.wikimedia.org/wiki/File:Cap_at_Union_Station...
> If you are in Japan, then no, trains are clean and people are mostly sane.

Don't they have at least the occasional Chikan issue?

"Interesting people" exist around the world, good and bad.
Really took 6 months if you factor in design/marketing work.
Reminds me of the UK/US game "Sorry!"[1], based on Pachisi; It's not strictly a cross-and-circle game, since it's square and the four spokes don't meet in a cross, but it follows in the same spirit.

[1] https://en.wikipedia.org/wiki/Sorry!_(game)
I believe it was a poor attempt at sarcasm.
Hear hear!

I'm currently trying to fix this culture at my current startup, and frankly it's rolling a boulder uphill. I'm not going to be here much longer, I don't think.

Folks, don't don't don't sign these contracts if you actually care--they won't be easy to fix later.
Google "Accelerating change", it's basically what you're talking about and there's a lot of information about it.
The problem with mass transit mostly isn't other people, it's the fact that it rarely goes from exactly where you start to exactly where you want to go. I take mass transit to and from work every day, but in order to get from my house to the commuter rail station, I have to drive a mile to a bus stop where there's parking (the commuter rail lot is small and fills up quickly) and take a bus 2 miles to the train station. Then on the other side of the train ride, I'm still 3 miles from my office, so I hop on a bike share bike and take that to the station nearest my work. Then I walk 2 blocks to my office. And then all of that back again in the afternoon. Lots of people tell me that they drive because they couldn't deal with my crazy routine.

A PRT system would possibly have a station much closer to my house, so there wouldn't need to be a single commuter rail station for a town of 20K people, and therefore no dealing with crowded parking lots. It would likely have a stop at or near my office, as it's a very busy business district (Kendall Sq, Cambridge.)
How does this work when companies have an "open" culture (aka: every employee has access to most of the codebase)? Wouldn't that meant a side project you are working on is, indirectly, a...

> Result from any work performed by the employee for the
employer?
XORfuscator: post-processor translates MoVfuscated C into only xor instructions
Don't really "weird" things start to happen when physical matter hits 10% speed of light?
I always think of TempleOS as well. Both project maintainers have created some impressive and/or interesting technology that is hindered by inflated self importance and being different for the sake of being different. Another common point - HN has a soft spot for both and upvotes most content related to these projects.
I love IPFS, and it's definitely ahead in terms of applicability.

IPFS is solving a different problem -- it's a storage network, not a personal server. IPFS is more comparable to Freenet or BitTorrent. Urbit is more comparable to Sandstorm, although of course they're technically very different.
I remember looking at it 12 years ago or so, for embedded applications. For some reason I decided to go with ISLISP instead, though I no longer remember why.
One singularity. (At least, that's the current theory. Experimental verification is not in hand at the moment.)
There is still the issue of trust on first use. Unless the domain is preloaded in the browser as HSTS there is no assurance that there won't be at least one HTTP request.
What I sometimes wonder about is whether or not we'll some day seen these kind of personal pods configured for use on existing railway stock. Many times while waiting for a train, I've sat there pondering - "what if I could build some sort of portable segway-like thing that I could just clamp onto one of those rails on the track, step onto it, and propel myself down the line" .. and I honestly can't think of any major reasons why this wouldn't be viable in this day and age. Pods could clamp onto the existing rail, shuttle individuals around, communicate with each other to avoid collisions, and so on .. maybe I'm just not thinking it through well enough, but couldn't we just build better rail-transport devices at the personal level which utilize the existing infrastructure, instead of having to rebuild it all from scratch with incompatible systems?

Something like this, only better:

https://www.youtube.com/watch?v=8YVVSzS3Fco
Actually, given how many problems some Kickstarters have with manufacturing, having a company like Quirky that could come in, having experience with manufacturing, design, shipping, etc, could make many of those a much better experience.
Bypassing the developers say "version 1.15 is out now" instead of "version 1.15 is out:

1) Now + however many years until the next Debian stable

2) Now + however many months until the next Ubuntu

3) Now for Arch users

4) Now + whatever for Fedora

5) Now + a different whatever for SUSE

etc

etc"

Package-the-world-and-freeze distribution schemes are a black hole of suck for development tool projects that have their own ecosystem and want to iterate at a consistent pace.

"Of course," you could say, "the devs should just run their own secondary repos instead of submitting to the official ones".

So now instead of one bash script you just have to trust not to rootkit you, the devs distribute 10 different incompatible package formats you just have to trust not to rootkit you, at only 10x the maintenance, build script, and sysadmin burden as you run all these bespoke repos.
Can't stress this enough. Every success is a side-effect.
nope, probably a sellout or controlled opossition
This university has produced the most VC-funded female startup founders
> But if they refuse the offer, there is already someone being interviewed that will accept the clauses.

I bet most companies wish that was so. Probably it isn't, especially if you follow fashion and reject anyone who doesn't know how to invert a binary tree ;).

If you turn down a job because of a bad contract term the company is probably not going to have someone else waiting to jump on! This is one of those cases where market forces would probably indicate that it's worth negotiating but in practice companies will be reluctant for reasons of bureaucracy
The other problem with SBIRs is that products and sales are usually not deliverables for the money that the government gives via SBIR grants. So it is hard to scale up without other investment.
Alternative CRISPR system could improve genome editing
True. And I applaud the effort. I just think that, in most cases, they won't work with you in this area. So when telling developers to take a stand, we should also prepare them for what is most likely going to happen when they do.
A tech campus deployment makes a lot of sense, since it's always a lot of people going different places— eg, difficult to service effectively with buses or conventional rail.
You can't avoid fixing tech debt. Eventually it impedes your ability to be productive. It happens, to some degree, to every software project. Someone else joked about "we wrote the app from the ground up" but that really does happen. You're not "shipping features" if you're rewriting the app.
A lot of us work oustside of those areas. In my case we got acquired. My choice was to keep steady employement or become unemployed for some unknown time. I took the risk and signed. Then things like this happen:http://www.goodwinprocter.com/News/Press-Releases/2011/Court...
I've definitely had prospective employers say "no, we will not remove that part, because we've been burned by bad employees before".
This has a great (and updated) set of links for all PRT efforts
http://faculty.washington.edu/jbs/itrans/prtquick.htm
Good luck getting a company or "remove this part" of a contract. I've always been told very clearly and angrily that that was not up for discussion.

My current employer technically forbids me from showing photographs of my dog to my mom. Naturally, no one would ever care if I did, but my contract explicitly considers any distribution of anything I produce that can be copyrighted (at work or not) an act corporate espionage.
London Heathrow Airport has Travel Pods like that: https://youtu.be/F5Knmgr2Ge8

Wikipedia article lists five operational systems like this in the world: https://en.wikipedia.org/wiki/Personal_rapid_transit#List_of...
Great idea - I wish this existed for Ruby gems. Currently we use Gemnasium to keep track of our dependencies and have a manual process to:

- check Gemnasium

- bump the gem locally and push to branch to GitHub

- find the changelog for the change (or a diff link) and paste create a PR with that as the description

- merge and deploy if our test pass and the changelog looks OK

Everything except the final step should definitely be automated. I can totally see how doing the same across many repos and sharing aggregated information could make the final step a lot easier, too.

Psyched to see you guys expand.
Might be someone who's first language is not English.
A few years ago, I was on a health list and someone was asking for non drug alternatives for treating a chronic issue so they could get into a drug study. The study would not take them while they were on this particular drug for their chronic issue. For that and other reasons, I am already skeptical about the data from drug trials. Some of his points are pretty scary, like about who has the flexibility to enter a study where they will be locked up for several weeks.
Google Go: Why Google’s programming language can rival Java in the enterprise
What if you required everyone to punch in their destination on a companion app, Uber-style, before even approaching the platform? Then all you have to do is wait until the app gives you the green light to approach the platform (your car is ready), get in, and maybe tap your phone to an NFC reader mounted in the car or something to confirm you're the passenger it thinks you are, and you're off. I imagine that the entire process from green-lighted to doors-closed-and-moving could be 15-30 seconds on average.

There could still be a phoneless kiosk/swipe system for people who don't have/don't want to use the app version, but with cheap Android phones available for $20-$50 (and that's today -- imagine where we'll be in 5 years) I figure 95% of throughput could use the streamlined flow.

---------

All that said, I think I agree with the article's sentiment that this system's time may have come and gone. It's hard to imagine what transport will look like 15 years from now, but I suspect that electric robot taxis as part of a multi-modal transport infrastructure with existing trains/subways could deliver most of the benefit of a personal pod system without the huge infrastructure investments of building a completely new set of tracks all over the city.