skysight-inc/HackerNews huggingface dataset:
Because negativity is a bane on scientific progress.

People who claim something can't be done are foolish. Claiming a negative - claiming something you can't prove - is anti-intellectual at best, downright ignorant at worst.

There is no need to claim something can't be done. It serves absolutely no purpose. The only possible outcome that negativity can have is to stop someone from trying, when really - thats the heart of scientific discovery. We can't fly, we can't break the sound barrier, we can't we can't we can't.

History is full of people who claim we can't. But history forgets those people, and remembers the ones who actually did.
> [that it's naive to say that science doesn't turn on belief] depends entirely on what we mean when we say "science".

Or it depends on what we mean when we say believe. The weight lying on "science" does form a conceptual framework that completely ignores the notion of something beyond our reach, although it inarguably is the driving force behind science.

> In religion, something is true until evidence proves it false. In science, something is false until evidence proves it true -- exactly the opposite.

alright, but the word of god himself isn't evidence enough? j/k :)

> In religion, something is true until evidence proves it false. In science, something is false until evidence proves it true -- exactly the opposite.

Why do those have to opposite, can't they be reconciled into one, using some form of ternary logic? Edit: I mean, some things in life are unknown until proven true or false and then theres all kinds of methods to counter the fact.
How We Got 2,000+ Customers by Doing Things That Didn’t Scale
> ...if this had been in Windows, no one in the public would have been able to stumble across it...

Kind of a broad statement there, isn't it?

By your logic - Where do zero day Windows vulnerabilities come from then? People outside of Microsoft have certainly reported security issues to Microsoft in the past.
Website not friendly on mobile.. Works better on desktop..
> or call system() to gzip something

Are you serious, who the hell does that!?

Any half-assed language has a zip implementation, use that. Any non-boring language has image-magick binding to that library.

This bug affects complete idiots.
The Content Marketing Power Law
It seems like the pathway must be

exploiter -> machine -> conduit (in this case, a web server) -> bash command through scripting language

but that doesn't really make sense to me. if it's in the header as a cookie header, in php that would require something like this:

$someVar = $_COOKIE['somecookiekey'];
exec($someVar);

this is a super fringe case, and wouldn't warrant this big of a deal. for this to be a 10/10 issue, it has to mean that processing the header files in Nginx/Apache results in some buffer overflow or for those values to be directly fed to bash.

otherwise the risk is super minimal, so I don't think it's a matter of making system/exec calls on user-supplied data.
Hmmm wouldnt it have been better (for portability reasons) to implement the equivalent of unix domain sockets instead?
Ello: You are not a product.
We live in a majority reality. Enough force in the right place causes action.

I'm not suggesting a mechanism that operates on the 51% rule. I'm suggesting we 'elect' certain people to serve in roles that allow quick consensus to be formed when there is disagreement. Put those judgments in a safe place and you have 'laws' that can be referenced in the future.
So many comments from people who clearly did not even read your page! The subtitle states "I'll WRITE, design, and code a custom page...", and the very first paragraph describing your offer states: "I'm an expert COPYWRITER and designer, and I want to help you...".

Don't let the ADHD crowd get you down. Beautifully done.
I think you are misinterpreting what this website is about. It is part of an initiative, that aims to end license raj and simplify the process of doing business in India. What you have stated is not an unknown. The purpose of this initiative is to address exactly that & more. The recent meetings with Japan/China are focused on improving infra ($35/$20 Billion investments respectively).

To quote: http://pib.nic.in/newsite/PrintRelease.aspx?relid=109953

"The Government is committed to chart out a new path wherein business entities are extended red carpet welcome in a spirit of active cooperation. Invest India will act as the first reference point for guiding foreign investors on all aspects of regulatory and policy issues and to assist them in obtaining regulatory clearances. The Government is closely looking into all regulatory processes with a view to making them simple and reducing the burden of compliance on investors."

" The government is committed to improving the physical infrastructure. Development of dedicated freight corridors and investment in improving our ports and airports are underway. These corridors would house Industrial agglomerations along with smart cities. The private sector would be playing a significant role in these developmental works."
Security Update for iThemes Customers (60,000 plain text passwords compromised)
I don't think that $1000 is to much for a service like this. Having worked with many non technical founders I know about their pain of finding someone who builds a landing page for a reasonable about of money.

I also know quite a few solo founders with a technical background who have pretty shitty landing pages, even though they know (technically) how to build one and/or extended one from themeforest. They just forget about white space, proper padding and stuff, but hesitate to hire a designer for a day.
Thanks for the feedback. I coudn't agree more with the remarks you made about the website. It defenately needs some improvements.

> Regarding the watchfaces: am I correct in seeing you're selling these for $100 per engine?!

Yes. These watch faces (we call them virtual engines) are created by professional watch designers.

> Do you expect to compete on any meaningful level with the iWatch and Android Wear? Or is this one of those 'premium' experiences that certain people are happy to pay for?

No, because we are not a smart watch, simply an high-end digital watch. The product is premium by its materials and craftmanship. (For example: The Slyde is water resistant up to 30m).

> So, all in all my feedback is this looks like a site trying to be premium without a clear understanding of what the word means.

Point taken, there is defenately some things we have to improve with the communication.

Thanks for you feedback!
This is way cool for weekend hackers. I think I'm most excited about the python prompt. Using arduinos, writing code, compiling and uploading just to debug an input is super annoying. A live console is way cool.
There is an unofficial patch that takes a much more reasonable approach:

http://www.openwall.com/lists/oss-security/2014/09/25/13
Are you referring to this? https://en.wikipedia.org/wiki/Bhopal_disaster
It is already there...a simple one though https://chrome.google.com/webstore/detail/regionio/alpbmjpij...
Eric Holder to Step Down as Attorney General
Steps to get the partial patch on ubuntu:

sudo add-apt-repository ppa:ubuntu-security-proposed/ppa
sudo apt-get update
sudo apt-get upgrade

unattended auto upgrades from that PPA:

sudo apt-get install unattended-upgrades
dpkg-reconfigure unattended-upgrades

then go to /etc/apt/apt.conf.d/50unattended-upgrades and add a line to allowed-origins that looks like

"LP-PPA-ubuntu-security-proposed:precise"

Also make sure distro-codename-security is uncommented, and comment out the -updates one if you want. Then do this to make sure it all works:

sudo unattended-upgrades --dry-run --debug
Here is the list of security advisories for all Microsoft products and they even list some non-Microsoft products like Adobe Flash, etc:

- https://technet.microsoft.com/en-us/library/security/dn63193...

I don't know where to get the multitude of security advisories for Unix systems listed all in one spot, but here are some links for popular distros:

- https://www.debian.org/security/

- http://www.ubuntu.com/usn/

- https://access.redhat.com/security/updates/active/

- http://www.slackware.com/security/list.php?l=slackware-secur...

Anyone know where to go in order to get the Unix vulns all in one list?
This can often times be summed up as a value-prop against opportunity cost and ROI. Do I have the time to create this page vs. doing something else? What direct return will I get if I spend $1000 and get x% increase?
Love Mailpile, but for what it's worth, I have the exact same problem. Running mailpile on Windows 8. Entered Bjarni Runar Einarsson's email (since I don't have any friends who encrypt), and it searched for his key indefinitely. So I can't figure out a way to add recipient keys either via contacts.
https://security.stackexchange.com/questions/68146/how-do-i-...
I can tell you that many projects have used CoreData, and abandoned it in short order.

Largely because it is a complex beast that many don't bother to become familiar with before they use it. Perhaps that is damning enough.

Lots of SQLite and PLISTS prevail, perhaps indicating the domain of data that needs to be stored for your average application.
Or filter the NVD feeds from http://nvd.nist.gov/download.cfm ?
All I can say at this point is: we’ll do our first public release very, very soon. Email me [redacted] if you want to get early access :)
I would think the most obvious example is Chrome. Most of the google related sites I visit are telling me to change to Chrome, if I use translate to translate a text it'll load a small text before anything else "try a browser that translates automatically"
Force of nature gave life its asymmetry
Since the post is relatively non-technical, I'd like to underscore that there are substantial concerns with the original and the followup patch, because with or without it, the underlying bash code parser is still exposed to the Internet. Nobody has posted an RCE vector that would be universally bad for the patched version, but several people have already identified "hmm, that's unexpected" types of global side effects when attacker-controlled strings are parsed as functions by bash. More is likely to come.

As of today, based on our conversations on oss-security, there is a third, unofficial patch that takes a much saner approach of isolating exported functions in a distinct namespace:

http://www.openwall.com/lists/oss-security/2014/09/25/13

Especially in high-value or high-risk scenarios, you may want to give it a try. And if you're interested in the reasons why the original patch is problematic, check out:

http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-b...
We're doing an Academic Study on Boredom, give us 5 minutes?
Is this much different than running `sass --watch` with livereload? Seems to me it'd be nearly identical.
Here's an easy to use and reliable scanner to test if your website is vulnerable. http://milankragujevic.com/projects/shellshock/
I don't think they ate the stormtroopers. When they were going to eat Han Solo, the method of preparation was to roast him alive. Because they didn't kill him first, this points to an aversion to eating carrion. Either that or they are vicious psychopaths that enjoy watching another creature in pain as part of dinner entertainment. Possibly both.
When Drone Delivery Makes Sense
First, congrats on the launch! Secondly, have you considered giving the consumer the ability to compare (side by side) drugs that are used for the same condition? For example, anxiety meds. Being able to compare side effects on the same screen instead of having to start a new search or click and try to remember what you just saw.
Hey, thanks a lot Tim for the quick response. I am so excited about this product
Looking for fellow hackers for IndiaRising Hackathon.
Hello, I am a full stack developer looking for more developers/designers/interested-people to help me build something for the IndiaRising hackathon.

A CLEAN INDIA STARTS WITH YOU AND I.

You can find more information about the idea here
https://github.com/indiarising/hackathon
Usability issues aside (that FAQ is ridiculous), this site is a step in the right direction.

I've been looking for a way to be handloomed textiles for some time and this website helps find all the government agencies, but then each of their sites are hopelessly broken.

I've encountered bad links, broken pages, email bounce backs and a woeful lack of information. However if they upgrade those sites to the quality level of this one, then business in India really will be easier.
I'm not sure if Google is "corrupt" or not, but I've been reading Thiel's new book and he makes a strong and simple case for Google being a monopoly (and this maybe being OK).
Many of the H1Bs from India studied a field of engineering.
Thanks. So why isn't even being able to declare functions risky? could an attacker overwrite built in functions?
There's a good chance that tumblr@example.org is going to be a real account.

If you started getting spam to tumblr.w8ke2iowieiu3k3@example.org then I'd be suspicious. (I must remember to do this for new things I sign up to.)
It's Officially Illegal to Be an Online Troll in Indonesia
What the actual... Either have multiple displays on your desk or take your laptop with you. I really enjoy not to take tons of stuff with me every day.
I agreed with your comment until my mind went through the places I have worked. One employer was quite in the middle, mainly go home to families, but with enough trips to the pub and social activities to make it interesting. Unfortunately the work environment was awful. Aggressive management style. Code quality was pretty much ignored. Really high turnover, despite working with some pretty decent people.
Any CGI script which was written in bash, that's the worry. Since mod_cgi uses environment variables to pass along HTTP headers, those programs are sure to touch the environment.

Even if the CGI script is in some other language, think of how many .sh wrapper scripts there are out there.

EDIT: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-b... explains it better
This had me in stitches:

> Undermining the basic business model of professional content creators will lead to a less informed, more vexatious level of dialogue in our society

Newspeak indeed.
I recommend you the WordPress version http://designmodo.com/startup-wordpress/, take a look to this video https://www.youtube.com/watch?v=MTN4xvzHUsM
Unless I've missed something, could some benevolent person use the bug to cause remote systems to run something like "sudo apt-get update && sudo apt-get install bash", to patch the vulnerability automatically? (it makes lots of assumptions, but surely it's better to have some patched systems as a result.)
Had anyone suggested and/or implemented something like building a tiny wrapper for bash that would clean environment and then execve("/bin/bash.vulnerable", argv, cleaned_envp)?
I got spam after adobe got hacked... never received a single spam mail before. Wish Adobe had to pay for that! But I'm afraid to register at LinkedIn, because that means I'd to give the last remaining bit of privacy just to get a job. There must be another way to connect to the right people...
>Programmers can expose C++ classes as well as functions and class methods with a single line of code that provides the Clasp name and a pointer to the function/method.

Hellooooo Qt without Smoke bindings.
Doesn't appear to have made it into jessie.
It's a play on the name "Scheme" and "Schemers" which was continued by the "Racket" and "Racketeers" name. There's something of a history of naming things like this in the LISP community. Wikipedia says:

"Scheme was originally called 'Schemer', in the tradition of other Lisp-derived languages like Planner or Conniver."

Your reaction is, however, valid. People outside the Scheme community and it's closely related communities are unlikely to know this etymology.
I wouldn't have an issue paying $1,000 for a landing page, but I do have an issue paying $1,000 for a landing page where the developer only devotes a single day to learning about my business, understanding the problems we're solving, writing copy, designing, and coding.

I'm looking at the before and after example, and there are just a few words changed, previous headlines enlarged and colored, and a call to action at the very bottom. Yes, those are positive changes, but for $1,000 I'm expecting someone to bring far more to the table than a few minor tweaks. If you're asking for a premium price, I'm expecting a premium service.
LOL, News Corp bemoaning that someone's actions might "lead to a less informed, more vexatious level of dialogue in our society". I presume their objection to that is that Google is horning in on their gig...
So he bought a salvage title car and is refusing to sign a liability release form. I see nothing wrong with Tesla refusing to work with him in this case...
Oh please, realize that almost directly it was clear that Soviet divisions wouldn't again "visit" as an answer to democratization in East Europe, the juntas were gone.

And Putin isn't brutal inside the borders, yet. The tendency seems clear. I really wish the best for the Russian people, they if anyone on the planet deserves better after the history. (It is not easy to go democratic for a country with big income from natural resources, see "the oil curse".)

(I didn't compare with the German nazis, I noted that citizens are generally not enlightened about atrocities done by their own country, but I'd guess Soviet did have them beaten in absolute numbers. Number of millions, that is.)
Interview with Adii Pienaar of WooThemes and Receiptful
This is similar in principle to the compromised address, which is why, despite the downvotes I'm getting elsewhere[0][1], I'm fairly confident that this isn't just a dictionary or a fishing attack, but a genuine leak. Other comments suggest that the leak my not be from LinkedIn themselves, but simply from their business model/systems leaking information.

[0] https://news.ycombinator.com/item?id=8367103

[1] https://news.ycombinator.com/item?id=8367296
Circa News – Save time, stay informed
The irony on this was not missed.
Free programming books and resources
> Why do those have to opposite, can't they be reconciled into one, using some form of ternary logic? Edit: I mean, some things in life are unknown until proven true or false and then theres all kinds of methods to counter the fact.

You reconcile them using Bayesian probability. There is no "proven to be true", there is no "proven to be false", there is only probability that flows between different models based on the evidence we discover.

"In science, something is false until evidence proves it true" actually means that any random hypothesis you come up with has an equivalent probability to be right to any other random hypothesis - which is infinitesimal, because possible hypothesis space is huge. Then, as evidence comes knocking, you update those probabilities, and some hypotheses become more probable (i.e. more likely a good models of reality), while other become too improbable to care about.
Is Exercise Bad for Your Teeth?
I am highlighting very dirty technique used by LinkedIn.
LinkedIn mined my emails without my consent. I have four separate gmail accounts to keep things separate.
I am 200 % sure I never linked other three gmail accounts on linkedin. LinkedIn used my current email id , went through all of my emails , matched it with other gmail accounts, mined other gmail accounts and started forcing me to accept contacts from mined data.
Its very hideous way to increase member count.
I now wonder is almost every San Francisco company is highly unethical ? Be it google , Uber, Yelp, LinkedIn on and on.
Why american business can't be honest with their customers?
Why are you apologizing unless you work for Amazon?

If you do work for Amazon, I would suggest this approach is not very good customer relations, it's only going to make people madder.

If you don't work for Amazon, and are some kind of Amazon fanboy trying to do free volunteer customer relations for Amazon... you're not helping.

("Oh yeah, we totally fucked up your account, but I insist you recognize that we're awesome anyway, even though I'm not doing anything to make good on our mistakes. Why do you have to recognize that? Cause most people have 'nothing but good things to say' about us, and besides we work really hard, and you can know both of those things are true because I say so.")
> And today I found out about "Microsoft Open Technologies, Inc." I've never heard of that group before!

Open Tech is the MS group that is trying to push open source as a culture both inside Microsoft and also among traditional .NET developers. They're the reason you can run Node on Azure, can reliably run Redis on Windows, and they're the ones leading the drive on ASP.NET vNext, the next version of ASP.NET.

It makes it a really exciting time to be a .NET dev.

(Not affiliated, just a fan)
The Tim Ferriss Show: Ep 30: Tracy DiNunzio, Founder of Tradesy
> I think pravda was correct to point it out.

pravda did not point that out. pravda claimed zizee was using the Broken Window Fallacy. zizee's argument and your summarization of it are not examples of the fallacy. Nor is situation 2 in your post above. The fallacy has nothing to do with something being useful or necessary.
The text/plain MIME type predates the specification of format=flowed by at least 7 years.
Coffee Is Killing Your Productivity
Open Pokémon – Pokémon in real life
Sure but I have a catch-all and I'm not receiving e-mails to twitter@mydomain, or facebook@mydomain. It's not impossible that spammers decided tumblr is particularly likely because they offer a version of the service in your domain but still pretty unlucky for tumblr.

I must remember to do this for new things I sign up to.

It is a good idea.
PHP, Once the Web's Favorite Programming Language, Is on the Wane
sudo requires a password to be entered by default, right? I would guess that for most setups this wouldn't be possible without some kind of privilege escalation as well (or if the webserver was running with root privileges).
Maybe not now, but someday it will. Satellites which are product of similar R&D, are up there are connecting people, predicting weather, disasters such as cyclones and much more. I'm pretty sure all these benefit society as whole.

Secondly, as it has been said several times Indian space program gets just small fraction of total Indian budget.