skysight-inc/HackerNews huggingface dataset:
The RedHat advisory had mod_security rules in it. Our rules are our version of that.

https://access.redhat.com/articles/1200223

SecRule REQUEST_HEADERS: "^\(\) {" "phase:1,deny,id:1000000,t:urlDecode,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
SecRule REQUEST_LINE "\(\) {" "phase:1,deny,id:1000001,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
SecRule ARGS_NAMES "^\(\) {" "phase:2,deny,id:1000002,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
SecRule ARGS "^\(\) {" "phase:2,deny,id:1000003,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
SecRule FILES_NAMES "^\(\) {" "phase:2,deny,id:1000004,t:urlDecode,t:urlDecodeUni,status:400,log,msg:'CVE-2014-6271 - Bash Attack'"
Pay your landlord with a debit or credit card
Considering most exploits are found via fuzzing tools, I think your assumption is pretty far away from reality.

If people could casually look at code and see vulnerabilities, then we wouldn't have any.

Also: MS Shared Source initiative
Meanwhile, 6th and Mission (2011)
I think I have the same question.. why is this called a "bash" bug? Is it not a webserver bug? Why does the webserver send data to bash through environment variables? Is there no better way to do it?
So if your server is set up with limited permissions for the apache-user, are you still at risk?

I don't think the apache-user if properly restricted can write to directories, or even read most of the system files?
Edward Snowden: winning Sweden’s alternative Nobel prize is vindication – video
Well if you insist.

You website and products looks like they were happier in the Adobe Flash era of the Internet. The navigation is a disaster; small horizontal bars with lethargic animations make me dread trying to get anywhere on the site. The font selection and logo look like you told a design intern to make something look expensive.

Size wise, your website is 1,600 pixels wide. 1,600! This means you'll see horizontal scrollbars on a 15" Macbook Pro. Since it's not even remotely responsive, you've eliminated anyone coming to your site on a mobile device and even the iPad retina in portrait mode. If you can't be bothered to make it responsive (not really challenging considering the limited amount of content) at least make a mobile optimized site.

Then there are pages like this: https://www.slyde.ch/en/concept/engine

There is no reason the text should scroll on a page like that. It's a drab wall of text with no formatting, links, or really any kind of structure. Why have you made a boring wall of text -harder- to read?

Why is there a carousel navigation at the bottom of the page? Circles like this are traditionally used in carousels (which themselves are universally hated), and not for entire pages. I have no idea where those buttons lead and I'm pretty sure lots of people miss them (you could test that with Google Analytics). The confusion here is compounded, since they -do- work as a carousel on the homepage.

Regarding the watchfaces: am I correct in seeing you're selling these for $100 per engine?! Do you expect to compete on any meaningful level with the iWatch and Android Wear? Or is this one of those 'premium' experiences that certain people are happy to pay for?

So, all in all my feedback is this looks like a site trying to be premium without a clear understanding of what the word means.
I have no doubt that you're right that UX is easier to do on a rectangular screen than a circular one.

The problem is that a watch is an object of fashion first and foremost. That's why you can find people willing to pay $10k for a Rolex Submariner or, say, an Omega Speedmaster "Dark Side of the Moon". They're the ultimate status symbols. That's what watches have become -- status symbols.

Apple clearly understands that with their Edition edition (though they didn't think through that name very well) and the general high-end finish of all the watches (even the Sport edition has a stainless steel frame around the watchface), but I think it was a mistake for them to choose a rectangular screen. I personally had hoped Apple would be the first company not just to make a circular smartwatch, but to also design a custom UI for a circular screen as well (as opposed to just slapping on Android Wear like the Moto 360 does).
Lost Cosmonauts
You're correct, but I believe you have been downvoted because instead of quoting general economist mottos about the misuse of public money, you could have cited factual examples. In fact in my (free) French engineering school, I know quite a minority of people who intended to become actors, musicians, sound technicians, travellers... (and succeeded). As much as I like the idea that artists have a knowledge of how the technical world works, I believe the Australian govt is the smartest at spending this money.
Hmm, it's been a while since I last touched cPanel (almost 10 years), but I recall it automatically included aliases for cgi scripts into each vhost.

Try /cgi-sys/guestbook.cgi on any cPanel website for example (a random Google example: https://www.vidahost.com/cgi-sys/guestbook.cgi)
I've just our few Apache 2 systems that are Internet facing. Some of the site configs did have the standard Ubuntu CGI stanzas in them. However, the `/usr/lib/cgi-bin` directories were empty.

All this has made me a bit nervous though. I certainly didn't change the system to use bash instead of dash.
5 things to learn about computer-science degrees
> I think it was Douglas Crockford that said this. We don't get new and better technology because the old people accept it. We get new and better technology because the people using the old crap just die out.

A bit ironic considering what a stick-in-the-mud he is.
It's less about trying to monetize it than about the cost to us of suddenly inspecting every request that goes through us. We service a huge volume of traffic and part of our core value is performance so keeping our processing latency is low as possible is important.

(Note: I removed sentence about CloudFlare pricing from previous comment to avoid any confusion about monetization)
Website Load Testing Tool in the Cloud for Free
Forget passwords – what if your unique behaviour becomes the key to get in?
When you use any functions in PHP to spawn another process (with the exception of pcntl_fork), PHP will execute a shell to run your process. That shell is then inheriting the parent environment.

If you (or any libraries you use) do not shell out or if you're using php_fpm (which clears the env and passes headers out of the environment), the. You are safe.
Because although you can, you won't - probably because there's not 'news' every week about a billionaire randomly giving a person half his fortune. The lottery win happens to somebody, while the billionaire scenario doesn't.

If someone established a reality TV version of something like The Millionaire [http://en.wikipedia.org/wiki/The_Millionaire_(TV_series)] then I bet people would start having that sort of daydream. Perhaps such a show would even lead to a decline in lottery ticket purchases, since the get-rich daydream would be available from another source.
I updated a handful of machines running an Amazon Linux AMI this morning and they passed the standard echo test after sudo yum update
>>> Or a tool that just generates random
>>> mail addresses ending with a popular
>>> e-mail provider domain.

>> The email to which I'm receiving viruses
>> and spam is not of that form.

> Have you ever replied to a message sent to
> you from someone via LinkedIn? If so, it's
> easy to end up sharing your e-mail address
> with that someone ...

While what you say is true, it's a non-sequitur. It's possible that I have replied to someone, and it's possible that they leaked it, but that has nothing to do with classic dictionary attacks, and the fact that such is unlikely to have succeeded with the address that's been leaked.

Perhaps you intended to reply to a different comment.

Edit: To those who are down-voting this - thank you for the reality check. I don't understand why you think my comment is of negative value, but it reminds me that not everyone thinks the same way.
Yikes, yes. Thanks for pointing that out!

There might be more of an impact than expected on OSX, too -- no telling what Apple does with their system services.

We've seen mention of dhcp-client and CUPS. The latter, at least, could also be an issue on OSX.
There is actually no kernel exploit in this. It appears to be a generic DDoS/Bruteforce bot.

http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3505#p...
> Might be wise to turn all network-listening services off that you don't immediately need until a fix is available.

I would go further and suggest that now is an excellent time to ask which of those services you really need to have at all. The default of blocking incoming connections is right for most people, even developers.
That's how Unix works. Subprocesses by default inherit the parents environment. And the http headers end up there because the CGI spec says so
Part of the benefit of an FAQ section is that you can find answers to questions you may not have even known you were interested in finding the answer to.
Facebook plans for a UAV the size of a 747
> I genuinely don't see how he is being "an asshole".

He bought land subject to (and whose market value is depressed by its being subject to, though it may not seem to be because of the countervailing factors driving up the price of California beachfront property) a law that is well known and has been on the books for decades, but then, having benefited from the law in the purchase of the property, flouts it.

That's being an asshole.

> If people wanted to have public access to your own garden, would you consider yourself "an asshole" for denying them that?

If I bought land in a place which had well-known laws requiring property owners to provide access to gardens on their property, where the burden of such laws were priced into the market price of garden-containing properties, yes, I would be an asshole and scofflaw to purchase the property and then proceed to deny access to the garden.

> It just so happens that his land is a beach - so maybe the problem is that someone sold him that beach in the first place?

Unless the seller misrepresented the material facts or actively concealed the applicability of the pre-existing law to the property, no, that's not the problem.
Writing Fast Ruby
For it to be interesting, it still requires some situation where a shell is run with data provided by someone who could not have just run a shell with the same context (UID, &c) themselves. There doubtless are others - as you say, scripts still run the world - but web is by far the most obvious.
Sexual selection is a huge area of research in evolutionary biology. You don't have to like the wikipedia article, but a quick search on google scholar on the term reveals over 2M+ results. Check it out. Peter's description of sexual selection was much better than mine, so thanks! I brought up the Giraffe's neck because its one of the best examples of bad scientific method leading to incorrect evolutionary conclusions. Giraffe males joust as a dominance ritual prior to mating, and generally the giraffe that can exert more force will win and hence mate. There are no advantages to the neck outside of this ritual as far as anyone has been able to determine, hence it is understood to be a purely sexually selected trait.
If there are other artists who have faced similar treatment, is it not possible for all of them to file against natgeo together?
You also have to pay tax on your winning.
I totally agree.
A more evident case is with the insurances: We also know that the expected value of buying insurance is negative for us; but we pay for reducing the variance of the money we lose.

In lottery, we pay to increase the variance of the money we win.
Learn Ansible by examples: deploy LAMP stack in 5mins
"wat"

I think what you're trying to say is: the page says jQuery is a framework, when really it's a library. Frameworks have more structure (Angular, Backbone, etc), and JQuery calls itself a library...

Author might want to fix that.
X.509 Certificate Validation in JavaScript
AFAIK bash is the default terminal shell in all Ubuntus. So yeah, you're affected.
CGI is an interface first defined 1993, 21 years ago. No one thought setting user data in environment variables was a risky thing at the time.

More modern interfaces between dynamic code and webservers, like even FastCGI or SCGI or dozens of others do not pass user data over Environment variables, and instead pass data in various protocols over a socket.
We use a Synology running their proprietary RAID thing, with a hot spare. It's connected to fiber as central backup hub for all machines through read-only BitTorrent Sync. It's also functions as our Git Server. Next to that we have two remote backup sites for the most recent terabytes, and all Mac's have Time Machines running at home...

And of course everyone has a Time Machine as a fallback at home for their production machines.
Proposed ShellShock Logo
Did you hear back from him? How'd it work?
I think you need to learn whether lottery is a vice in of itself, or a substitute for other vices. I know that in NYC, the lottery basically put the corner numbers rackets (and associated street crime) out of business.

I'm curious if the stereotypical old person wasn't spending a day a month at the casino, would they be drinking more? Sitting around not talking to anyone? Abusing drugs?

We also need to consider the reality of the situation... Is the lotto makin s material impact. People have vices... Sports betting is illegal in most places in the United States, but sports betting is pervasive.
I misread this as SCCS, and thought to myself, people still use that? (FWIW I still occasionally use rcs).

http://en.wikipedia.org/wiki/Source_Code_Control_System
Why we keep paying for insurance, when the expected value is negative ? To reduce the variance of the money we lose.

With lottery is the same, I pay to increase the variance of the money we win.
Should you test your ORM mappings?
Being in Australia, I consider any claim by Rupert that someone else is damaging the public discourse even remotely as much as him to be utterly ludicrous.

Yesterday was just another example of that. I'd qualify which yesterday, but it really applies to all of them.
Our 2 day hackathon product, 8bit Weather, is trending on Product Hunt right now
Anyway it's cheaper than bootstrapping a startup and has similar odds to succeed.

// pessimistic mode off
If something, it's a bug in the CGI specification, since passing HTTP headers as environment variables is part of the standard.
Coincidentally, in the past two weeks - this week in particular I've been seeing a load of crap sent to my address registered with LinkedIn which is otherwise spam-free.

I'd guess it's related to LinkedIn or GitHub as this particular address is only publicly/semi-publicly used on those two sites.
Heh, you should see some of the systems that orgs I work with still have running. Just checked on one of my favorites:

$ uptime
07:26:20 up 3280 days, 16:23, 2 users, load average: 0.00, 0.00, 0.00
$ cat /etc/issue
Debian GNU/Linux 3.1 \n \l

This one doesn't even have the excuse of running a piece of lab equipment (I saw such a system recently running Win95 without OSR1, so it doesn't even have USB support. They move data around with ZIP disks!).
wget --header='Referer: () { :;}; touch /tmp/vulnerable ' www.example.com
If it weren't for one of the comments here, I would have absolutely no idea what this is about. Really poorly designed. FAQ should be a list of questions.

I can guess but not entirely sure who this is from.
Would it be possible to enable it temporarily to see whether the change significantly impacts your processing latency?
I think an important piece missing is the active vs passive decision making. When you purchase a ticket your are actively triggering the thought process.

In your scenario there would be a passive trigger that would dull the entertainment affect.

I wouldn't discount the little piece of paper with numbers on it.
i removed it, didn't know what that was. I copied from amazon on a link clicked directly from google search
Fair enough; that's what I meant when asking if it is feasible for you to do so.

Thank you for clarification!
I have also started receiving spam at my tumblr-only address.
‘Heads Up’ May Be the Notification Suite You’ve Been Looking For
This looks pretty good. It's similar to Sortd.com but is without the very useful email integration.

Sortd has just released another 200 invite codes. Apply fast at http://www.sortd.com to get into the private beta or Tweet for an invite code.
Debian yes, Ubuntu's default is bash. So is Mint's.
The monetization has not been put in place right now. It has always been there (the possibility to add these rules).

If this is a disaster-relief thing-y, CloudFlare should then be eligible to receive government money later. I doubt that would be even considered by any parties.
... didn't the above say "we clear anything that starts with ()"? Doesn't that defang this?
Oppo Find 7: Hands on review
Seriously, for an "Everything you need to know about X" post, they're very light on the details of what exactly makes a web server vulnerable.
Its a campaign by the PM of India to encourage companies to 'make in India' and hence the website name. Of course we all know the label 'made in Xyz', but they probably chose the name based on the campaign name.

EDIT: But I agree that the website fails to clearly state its objectives and provide information to people on how to navigate the ubiquitous red tape.
From idea to delivery we knocked 8bit Weather out in a day and a half for an office hackday. Here's a post to a blog we wrote about it on Medium: http://tinyurl.com/ndexxfp

Visit it here http://8bitweather.co/
Hum. Strange. I just tested with clean Ubuntu EC2 instances, and they are indeed symlinking /bin/sh to dash.

Either I have a part of my standard stack that reverts it to bash (but I have no idea what could be doing that), or it could be my provider (OVH) doing that by default when they install Ubuntu.

Oh well, sorry for the noise.
You're right; thanks! I saw the HTTP_* variables in phpinfo() and assumed they'd be passed on to children through system(), but they actually aren't. In fact the only environment variables passed through look pretty innocuous.
using PHP in a discussion about types evokes Godwin.
India has very cheap labor so you might save some costs on that front. However there are many deep-rooted infrastructure issues that need to be overcome:

Industries need un-innterupted power. There are massive power shortages already.

Mass production requires good road & rail connectivity - the state of roadways in India is pathetic

Freedom to hire (and fire) people - 1950s era socialist labor laws are abundant in India

Pervasive cancerous corruption at every conceivable level

While a laudable concept & initiative by the Modi govt. - first he needs to fix a few things in the country
That actually looks pretty good! Reminds me of 007 Goldeneye for the N64.
Apache user can probably write to /tmp, and from there the attacker can construct a way into the system (bindshell, reverse shell). He can then start reading your PHP config files (db passwords) or try to use other vulnerabilities to escalate his privileges.
Hey, Cucumbertown looks really cool. Can you talk a bit about your tech stack and major design decisions? I'm thinking of something similar for a different niche.
IBM Watson API Coming Soon
Yeah, i think you mean for instance when it says "colors available" and there are TWO. 1. Black (okay), and 2. crazy weird yellow-green. I have no stake in this game, but srsly, you'd think they would understand that more colors/styles => more customers. And that's the easy part. Getting the electronics right was the hard part... gosh.
Simple 8bit fun
While I disagree with almost everything News Corp claimed, I do think this one has a ring of truth to it:

> willing to exploit [its] dominant market position to stifle competition

Google has, on multiple occasions, utilised its search engine to prop up or otherwise give an advantage to its own products over that of third parties. The most obvious example is Google+, however YouTube is also a prime example (the change to video search is fairly recent), as is Google Maps (which effectively wiped out the sometimes superior competition at the time), and Gmail (which was heavily advertised on Google.com).

While Google doesn't, as far as I know, "fix" search rankings to give themselves an edge they do sprinkle adverts for their products before search results (e.g. YouTube, Google Maps) or around the perimeter of the page (e.g. Google+, Gmail).

That all being said however: I'd take what Google does over what News Corp does any day of the week. Google might be a little corrupt, but News Corp is the poster child for abuse of position. Plus News Corp's lobbying has screwed up more than just their own specific market segment, it has had lasting effects on countries (and helped put innocent people in jail, literally).

At the end of the day as the internet stands in 2014, you have a great deal of choice. If you're tired of Google's shenanigans then hop over to DDG, Bing, or even Yahoo!
Performance comparison shows Postgres outperforming MongoDB
I'm sure incrementing strings seemed like a good idea at the time...
Heroku shellshock status update
Sort of I guess, but why does bash need to loop over all of the env variables and execute them? I don't think CGI had any reason to think that would ever happen?

(I guess that's basically what it's doing?)
"Yes, this exploit can be used on any script or program that uses system(), whatever language you use."

Unless that script or program sanitizes the environment before calling system(). In practice that might not presently be any scripts or programs, but it principle it's a tiny bit weaker than you say.
Show HN: Arima – A Q&A site for mass opinon
Abbott represents a majority of the population because the majority of the population knows about politics from the mass media, which is almost entirely owned by Rupert Murdoch, who printed nothing but pro-Abbott and anti-Labor content for months.
But it seems you only need one login to compromise the whole server. If I buy $3 hosting on a shared server then I can pwn the whole server can't I (using cPanel to escalate an attack above my privelege level)? What are the chances that one user account on a shared server is crackable, pretty high I'd imagine.
exactly what I was looking for. I plan on installing this tonight. thank you.
That's a rather loaded question. It assumes that the drug is well-tested and is considered a cure, rather than an experiment. Furthermore, while ebola has always been a concern, the current outbreak is without precedent, so no major preparations were in place.

Yeah, it sucks that there's not enough ZMapp to go around, but on the other hand, it's not done yet.
No. The site is basically a red carpet for foreign businesses to manufacture their products in India. As in, "Come and make your products in India."
> AND you allow user input to be used in those system calls

This is not required for exploiting the vulnerability at hand.
BEER domain names are being released today
This was/is key to why I play:
"For many poor people, he adds, there is “no scenario they can come up with in which they are suddenly going to get very rich.” To them, the lottery may be a low probability event—but so is getting a job that pays six figures."

Even in the case of you making six figures a year, 100,000 dollars, a $2 million dollar win is still 20 years of your life earnings all at once.
How does it compare to something like BrowserSync (http://www.browsersync.io/) which also works for js (and sync throuch devices as well, which is very neat) ?
When is realm.io coming out with android beta?
Einstein, he was the guy who did all that great work in photoelectrics, wasn't he?
I think the idea is to encourage people to make stuff in India, rather than a list of things already made in India... but yeah, it threw me off too.