skysight-inc/HackerNews huggingface dataset:
Summary: people that can run queries on your MySQL server, either by legit access (shared webhosting or something else) or via an SQL-injection vulnerability, can execute commands that might root your server.

Vendor response:

> No official patches or mitigations are available at this time from [Oracle].

> The vulnerabilities were patched by PerconaDB and MariaDB vendors by the end of 30th of August.

Looking at the PoC, it seems possible to overwrite any file that the MySQL user (or whichever user MySQL runs as) can write to.

In the PoC, they overwrite /etc/my.cnf, which is often advised to be chown'ed to mysql, making this possible (normally files in /etc are only root-writable). The new version loads a malicious shared library. This means that you should have made the mistake of making it mysql-writable (on top of others having SQL access to the server in the first place). This is not the case on my Ubuntu 14.04 LTS server, so anyone running that without weird modifications is probably safe as well.

Some wrapper script is mentioned which runs as root (while mysql itself runs as a separate user), which would apparently make it possible to get root on the server. I guess that's another requirement for real impact, but the first 2 compromise your MySQL server already so that's serious enough.

Edit: Updated post according to comment from jstanley. Thanks!
Yes. The NASDAQ meltdown in the dotcom crash affected everything. Arguably the economy never recovered, and just papered over it with a housing bubble instead.
Again, software in most HLL's that uses compilers. There's assembly, macro assemblers, and some HLL's close to the metal. For the later, you can get a list of what various constructs will look like as assembly, heuristics on what to use where, and still don't need to know compilers.
I started watching his videos as well. Interesting stuff. But one thing that stood out for me was what he said once along the lines: "I recommend many stocks, I rarely buy stocks myself".
"was also attempting to ensure that Rhodesia did not secede as an apartheit state"

Which is pretty much what did happen in '65?

https://en.wikipedia.org/wiki/Rhodesia%27s_Unilateral_Declar...
There's the diagrams package in Haskell for vector drawing:

http://projects.haskell.org/diagrams/gallery.html

Juicy pixels for raster manipulation:

https://github.com/Twinside/Juicy.Pixels

And gloss or haskell for mac as a processing kind of environment:

http://gloss.ouroborus.net/

http://haskellformac.com/ (http://learn.hfm.io/fractals.html)

There's an old comment thread from a year ago here:

https://www.reddit.com/r/haskell/comments/2naug0/haskell_as_...

I'd be interested to know what you think about the feasibility of using these tools to produce the kind of things you make :-)
I found this video of a team fight:

https://www.youtube.com/watch?v=SjJT-8bY6x4
Software engineering isn't supposed to be exciting. As you've observed, it's adrenaline-inducing only when something goes wrong.

That said, if you also don't think it's interesting or challenging without that adrenaline rush, you might want to spend some time thinking about what you do find interesting and challenging and consider switching jobs, specialties, or careers. Your post suggests to me that you feel insufficiently challenged.
I don't think Facebook will be dethroned by another Facebook. I also do not think the differentiator for such a new king is technological (e.g. P2P). The only kind of FB rival I can imagine succeeding is an open ecosystem one.

A second FB would have to overcome the network effects, and the only chance for that to happen would be for FB's network effects to decrease.

While negative network effects do occur -- it's what killed Orkut, for instance -- Facebook has learned that lesson well. FB's value for participants has decreased, but is now stable and that network is still a huge barrier for entry.

Technology is largely irrelevant. People do not care if it's P2P, runs on functional code or if it is an engineering marvel. They care about the value provided to them. The article posits that P2P adds negative value, and it is probably right. The article infers from that to the impossibility of a FB killer, which I think is wrong, because the scope of the analysis is wrong.

An open ecosystem social network:

1) Has the possibility of creating use cases that Facebook can't compete with;

2) May be extremely vibrant, if the ecosystem is large enough;

3) Can't be bought by Facebook, as it runs contrary to the main strategy of a walled garden. (It may be bought in order to be killed, though);

4) Can live perfectly well, for an indeterminate amount of time, in second place.

I can't see any other avenue for Facebook's demise.

Side note: Twitter nearly had these characteristics for a while. They squandered the opportunity when they kicked it's developer ecosystem in the nuts. Sad.
>This is highly non-trivial once you realize that the world speaks more than ASCII and things like http://www.xn--n3h.net exist.

I was under the impression that requests to and from the server still used ASCII?

That is, the server would see a host header as this:

Host: www.xn--n3h.net

And not as this:

Host: www.[snowman icon].net

Anything else is a question of URL-encoding, which if not used would raise interesting bugs with space characters, let alone anything more exotic like snowmen.

Edit for completeness: in my server logs, the GET request for a /[snowman icon] URL is url encoded to

GET /%E2%98%83 HTTP/1.1
Java could have been made to have good DOM bindings, I don't remember anyone asking for them.
For 2) It looks like the PoC uploads the malicious library into the MySQL data dir through the same exploit

As for 3) I guess this just something to check for if you find SQL injection vulnerabilities in your application.
Skepticism is the best policy with things like this. It's easy for an anonymous person on the internet to make claims like this.
Using Big Data to Estimate Consumer Surplus:  The Case of Uber
I am actually advocating a new form of authorization that is based on AOL, Prodigy, and CompuServe handles.
Elon Musk Says Tesla's New Autopilot Likely Would Have Prevented Death
Yes it is awful.

How people manage to build applications given the festering pile of rubber bands, glue and fish heads that we call web development platforms these days is beyond me.

There was a time when even I could build a website. Then I stepped away for a few years to do other stuff and came back to witness in complete horror where things are now. Let's be frank, the tooling is abysmal.

I've been taking a look at Polymer, Dart and Flutter recently.

Looking at the goals of those projects I'd say that reading between the lines, even the likes of Google understand that something has to change.
Branding Secrets for Marketers Who Want to Be Rockstars
This was a lot more random than I expected. Very surprised to learn that Dan Luu nearly failed high school, for instance.
> 2) a malicious library has to be present on the system,

If you can overwrite any file the MySQL user can write, does that means you can place a malicious library on the system, or must it be loaded from somewhere in the ld search path?
Is it really square pegs for round holes?

I don't think that the web as a mechanism for distributing applications would look much different even if it hadn't gone through the HTML stage. If not JS, it would have been Java applets. If not HTML, then some weird XML layout schema.

There might have been a time where the web as a platform for applications was beyond silly, but this is not htat time. The platform is decidedly for shipping applications as well as pages.
They have chosen auto, because it was already a reserved keyword, but it was practically useless.
They'll have much better accuracy than you think.

You're connected to one at a time but frequently checking for more appropriate towers in case of signal outages.

Using this they could triangulate you quite precisely.
Organic = https://en.wikipedia.org/wiki/Organic_compound
You probably mean conscience, not consciousness, but your word is amusing in a different way.
My guess is its printing micro dots to identify your printer.
Well, I found the same by pure chance before reading this article, and I suspect many more in the HN crowd did.

If already half a dozen people on HN report they’ve found it and emailed the person about it, it’s likely it’s too late for responsible disclosure.
[Screencast] Two Factor Authentication
The developer customer journey
Or just, when following 301/302, call the same function again – which then validates the link completely again.
"The real heroes are dead"

This is a quote attributed to Cyril Richard Rescorla. Rescorla was British and originally trained as a Paratrooper in BA. He later found himself as a Platoon leader in AirMobile Infantry [0] distinguishing himself in la Drang Valley 1965 in the first American encounter with NVA.

Hard-core as they come.

A measure of a persons character is how they conduct themselves under extreme pressure. Rescorla would sing Welsh tunes to calm his troops in that desperate battle reported by reporter Joe Gallaway. A book was co-written with the Commander, Hall Moore and later turned into a film, "Once we were Soldiers"

It was reported Rescorla, a Security Officer for Morgan Stanley also present in the '93 bombings (great side story, Rescorla infiltrated and identified a radical Iman at a NY Mosque who was later charged) made his views clear that MS should have moved out of the WTC.

Rescorla was in his office on the 44th floor
at 8:48 a.m., when the first plane struck the
neighboring tower. At 9:10 a.m., a plane hit
the second building where Morgan Stanley,
an international financial services firm,
had offices between the 43rd and 66th floors.
Survivors said Rescorla grabbed a bullhorn
and cleared out 3,800 workers from 20 floors. [0]

In being unsuccessful, Rescorla organised and drilled all MS employees every three months in fire evac procedures. [1]

"Rick could be heard saying "... be proud to be an
American ... everyone will be talking about you
tomorrow," and singing God Bless America and other
patriotic and military songs over his bullhorn
to help evacuees stay calm as they left the tower." [2]

The title of the article comes from when Gallaway put the image of Rescorla [3] on the front cover. Rescorla is reported to not have read the book, nor wanted any recognition saying, "The real heroes are dead".

[0] http://www.weweresoldiers.net/rick.htm

[1] https://en.wikipedia.org/wiki/Rick_Rescorla

[2],[3] http://history.army.mil/news/2015/151100a_Rescorla.html
i agree with that .. this isn't remote at all.
See also ESA's FAQ explaining why they decided to end the mission this way.

http://www.esa.int/Our_Activities/Space_Science/Rosetta/Rose...

TL;DR: as it ventures further and further away from Earth, it won't be able to transmit much useful information, and it's unlikely the instruments will survive until the comet comes back again; letting it descend onto the surface while it's still in useful range will give a lot of up-close data.
Analyzing 205 718 Verified Twitter Users
Facility to convert non-recyclable plastic to fuel planned for Canberra
They do. I got a Samsung C480 colour laser printer, scanner, copier a few weeks back to replace a broken Dell. The cartridges are far more accessible than the Dell. All three functions are reliable so far; so it's been a good buy for 208GBP. I'm becoming something of a Samsung loyalist. My Ultra laptop is still going strong after nearly four years, as is my 3 yr old Galaxy S4 phone and 10 yr old flat screen TV.
I would have preferred if HP spent some money on writing a Windows 10 driver for their own printers.
Does this affect any versions older than 5.5?
Your last paragraph describes my experience with web development exactly. Ironically I'm 22, but I've worked with people or talked to people online who want to use the "latest and greatest" for what could've been a simple CRUD app.
file:// urls are awesome! People forget about them and nobody actually understands what to expect from these urls. Consider cross-origin policy implications. Is file:///home/john/bar.html on the same origin as file:///home/john/foo.html ?

Also, XHR is totally allowed to go to file://
The discrete fourier transform is actually finite-dimensional linear algebra.

No infinite series nor convergence problems here.
maybe a sql injection ....and escalate from there..
Weapons of Math Destruction – A Data Scientist’s Guide to Disarmament
Their drivers are cross-platform (mostly Python), no? I've used 3 HP inkjets from my Windows 10 laptop with no issues.
Says so right in the article: quantities greater than 10 days worth of private use...
「react-mobile-datepicker」, a react datepicker for mobile
Sure, sure (and the tip is much appreciated), but this just goes to show that P2P is more difficult than client/server.

The point is that one has to have a very good reason to use a P2P architecture, as it tends to create problems.
In some jurisdictions, a court can dismiss a default judgement, if you show that was a good reason for missing the hearing. That still takes you back to square one though, with an outstanding court case (and missing the next hearing would look pretty negative).

If you manage to stay under the radar, you may eventually escape liability by exceeding the time-limits under a Statute of Limitations, but it's usually a risky and lengthy endeavor.
Can you even "spin down" an SSD, considering that there is no spinning things in there?
Everything thoroughly documented here:
https://www.amazon.com/Snowball-Warren-Buffett-Business-Life...
It is a great book which really explains how extreme an investor Buffett is. Few would be able to stay fully invested for a lifetime like he has.
My Samsunf ML-2525W has been the most reliable printer that I have ever owned. It was cheap too.
With respect, at least part of your frustration comes from the "curse of the installed base."

Long-lived software with real users in any language running on any platform becomes complex, and picks up strange-looking appendages. Sometimes those appendages are nasty hacks, and sometimes they are well-built. But they are, in most cases, necessary to the proper functioning of the software, and responsible for its success with its users.

That's true of long-lived human work product in any discipline. Look at a municipal utility map sometime, and then consider that it is probably at least three decades out of date. That's why utilities send out "dig safe" guys to construction sites. That's why things go wrong in utility work after longtime engineers retire or die.

That being said, the capabilities in web browsers are definitely the utility company equivalent of of a pickup truck full of random bolts, pipes, wires, a shovel, a ladder, and a jackhammer. You can do many things badly with a web browser, and our ways of doing them badly have evolved over the past couple of decades.

I believe your frustration with aging web software is, in fact, a sign that web software has become generally useful to the population.
The question there is your use of "could". Is this something they can do if they want to know about you specifically, or something they're already doing (and storing) for all users?

The ability to decide to track down one person right now for criminal justice purposes is not nearly as concerning as just being able to request anyone's precise location history going back a decade.
I don't get it either. Nothing in history has come close to the current web platform. There has never been a language/runtime/framework/system where you could have this much flexibility, that "installs" in literally seconds (from a cold cache, never having been there in the first place), and works on every platform under the sun (not just linux/windows, but mac, android, ios, windows phone, ubuntu phone, my TV, my car!).

I see people in this thread talking about how it takes them 10X longer to develop for the web than it did for a desktop system, and i'm just sitting here confused as for me it was the exact opposite. I remember having to setup a development environment to get a java swing application ready to start working on. I remember the goddamn readme I needed to write to ensure that the next developer working on my GTK+ project had the right environment, the right libraries, the right platform, and the right compiler. I remember having to find some bullshit bindings to a C library for my python project that really half-assed the implementation, but it's all I had because that C library is the "defacto standard" for what it does, so I need to just deal with it.

For me the web has been such a breath of fresh air. A package system that works so effortlessly that I don't need to spend an hour deciding if that package is worth the pain of setting up another virtualenv, I don't need to worry that this library only supports Java 6 while this other one only supports java 7 and I can't have both (even though I only need the Java 7 one on this project). I don't need to worry that the next version of Windows will break GTK and my project won't support that platform and there is nothing I can do about it.

I run `npm install`, and in a few minutes, every developer with node.js installed can compile, run, modify, and deploy my code. And when deployed, every person with a browser on the planet can run it in seconds. It's amazing.
These glass bricks are a lot more fun when you put controllable LED strips in them and treat each one like an individual pixel. :)
Indeed, not the widest known product group of Samsung, but http://www.samsung.com/us/computing/printers/.

It is not uncommon for Asian (?) conglomerates to have a very wide range of products, as Hitachi, Sony, Yamaha (from trumpets and pianos, motorbikes, engines to electronics) and Toshiba demonstrate. TIL that Samsung even builds drillships.
What's the relevance of that to Warren Buffett?
To improve readability:

document.body.style.maxWidth = "768px";
document.body.style.margin = "auto";
document.body.style.fontSize = "20px"
That'd be funny if only it were funny, you know? The names have changed, and the scale, but that's about all - Facebook is a better AOL than AOL ever dreamt of being.
"Multiple browsers that respond to the same code slightly differently."

Web standards are at a peak level. It's never been better.

I blame the overuse of SPAs. They are far too prevalent to the point that they are becoming the default over static web-pages.
Definitions on the Economics of VC
I think he's a shame to my country (Albania)...

When you hear him speaking publicly you can understand the guy is a douche just by personal judgement without even needing to be influenced by the media.
As for how it got to promoting Mugabe into turning one of the most prosperous nations in Africa into the new Weimar Germany, one interesting reading of the situation:

The Rhodesian Selous Scouts (the new, mixed race, elite force responsible for 3/4 of the enemy casualties during the Bush Wars) made the decision to go after the "moderate" party (ZAPU, led by Nkomo), weakening his troops shortly before the final election (where all Rhodesian troops were called back to the barracks and guarded by British troops).

They correctly expected Mugabe to win the election, since he could take over the countryside with no opposition, and the plan was that he had such an awful reputation that the British would not allow the election result to stand, whereas they'd be fine with Nkomo. Unfortunately, they underestimated a. how much the British were annoyed with Ian Smith and UDI and b. how little they cared about Mugabe's true nature, and generally about the fate of the "natives" in their own colonies, just wanting to wrap up the whole thing as quickly as possible and stop being the centre of global attention.

In fact you can trace Mugabe's rise to the assassination of the moderate, educated, highly competent leader of ZAPU and later ZANU, Herbert Chitepo, a national hero and the country's first black lawyer, by a former British SAS soldier working half on contract, half out of ideology for the Rhodesians. The assassination, which was followed by Rhodesian disinformation to make it look like it was a faction war, was supposed to seed dissent within the enemy camp. Instead, Mugabe took advantage of the chaos to emerge as the leader and the rest is history. For all we know, Chitepo could have been the African Lee Kuan Yew.

The rise and fall of Rhodesia is one of the most fascinating parts of 20th century history and I really recommend getting acquainted with the period. If anybody has ZANU/ZAPU/ZANLA-side sources, I'd love to read them as I could find very little on the subject and much I heard from that point of view was from Zimbabweans whose family members were fighting on that side of the conflict.
Finding happiness at work
It clearly affects all versions <= 5.5.52, <= 5.6.33, <= 5.7.15
Terms and Conditions -
Very few people care about the issues raised by the author. From a practical pov, I think the best way to create something like this would be from some prebuild community that might care like Burning Man or something.
fuckyeahmarkdown fixed it just now.
The point is that it is exploitable from SQL, therefore is also exploitable from the application that is creating the database.

This would be a target for a sql injection exploit and so is remotely exploitable
AWS DevOps for free
I'm experienced DevOps engineer with strong SysAdmin background, actively participating in Open Source projects, I'm doing it for a living with great success, I'm doing it as a hobby with passion (hence Open Source involvement) and I take pride in my work. I've worked and have experience with wide range of technologies, including all sorts of virtualization technologies (AWS, XEN, containers, Open Stack), operating systems (RHEL, Ubuntu and FreeBSD), programming languages (Python, Shell and little bit of Go), automation (Ansible and Puppet), distributed systems (Elastic Search, Zookeeper, ETCD) and everything else around it (databases, monitoring, log gathering stacks).

Since I've decided to get AWS certified, I thought the best way to do it would be to dust off my AWS skills, and the best way to do that is to actually work with the technology. As my current work doesnt involve AWS I thought I'd offer some of my free time to any charity, non profit foundation or organization, or company fighting a good cause that is in need of part time DevOps resource to help them with their AWS projects/infrastructure, entirely for free. That's right, there's no catch here, its not a sales pitch, its simply a form of donation that would benefit both sides, I hope! :)

Obviously, I am more than happy to undergo any security checks, reveal my identity, provide references to my clients, Open Source projects and my publicly available DevOps related work, and will sign any paperwork required.

So, if you are such charity or know one, let me know (PM me or leave contact details in comments), let them know, spread the word (I'll be posting this on Hacker News and Reddit), and lets talk!
Why Do Television Companies Need a Digital Transformation
See how the New Raw is turning plastic waste into useful 3D printing projects
LightNudge Monday Update
Yes, but add face recognition and it will be easy court cases...

I see new services for the future:

+ Upload services that gets video checksums every second (and maybe a picture every 30 seconds), so you can prove that this video was not tampered with.

+ Jamming equipment, so criminals can stop information from leaving the victim (then destroy the logging hardware.)

+ Cheap, fast flying drones that can leave a person being robbed, to send video/audio/alarm to the police outside the previously mentioned jamming radius.
It comes back to that wonderful quote by Bjarne Stroustrup:

"There are only two kinds of languages: the ones people complain about and the ones nobody uses"
Joel Spolsky (FogBugz, Stack Overflow, Trello) wrote this article half a generation ago. It's about not giving in to the temptation to start from scratch when your software is ugly. http://www.joelonsoftware.com/articles/fog0000000069.html
Mobile App Market Insights