skysight-inc/HackerNews huggingface dataset:
Each show is essentially the same as a channel. BTW, the current incumbents also have Netflix-like services. Which are subject to CRTC rules...
> "this should be illegal"

Governments define legality, and governments are likely to be some of Mitnick's best clients. Funny thing is, if I were Iran's government I would be concerned about buying exploits there because for all I know Mitnick has double-crossed me and given the US government info on the exploit and how to neutralize or detect it.

Pervasive encryption only helps if the endpoints doing the encryption aren't compromised, and this type of service is aimed at those endpoints.
> Is `sudo apt-get update && sudo apt-get upgrade` sufficient on an Ubuntu server?

Yes. Patch is out.
Are you certain that no method of invoking a dynamic script sets environment variables to values controlled by requests? If so, it sounds like even an innocent call to system("lame a.wav b.mp3") could lead to code execution.

Edit: also, you may be surprised to find that some "libraries" are actually wrappers around external binaries (e.g. libgpgme). If any of them used a system() or exec() call that preserves environment, and the binary or the library ever invokes bash (e.g. via system()), then trouble will ensue.
Do you have a valid reason to fuel his fearful state of mind without providing any insight in your comment?
If an SSD is written to once, and kept powered on (and at a temperature in the low 70s), while getting regular reads, how long can I expect this drive to last?

If that drive is powered on, but kept at low temperatures (say near or below freezing), does this help it survive longer?

What failure modes would occur in such an environment? Would it just be power surges frying the thing, static electricity?
Am I the only one who finds it deceptive when companies offer something for "free" with a shipping charge attached?

Free means $0, not $0 + $n.
My favorite was a Blue Apron recipe that called for a "farm fresh egg", which came in a cardboard box, which had a plastic egg tray inside, with a single (cracked) egg in it.

I'm fine having sorrel or scallops pre-packaged for me, but getting a triple-boxed egg or an onion wrapped in bubble tape just felt sad.
How exactly does "pioneered what Russian crime rings are doing today" make someone deserving of support & sympathy?
The things I miss in this "done right" approach:

- Continuous Deployment: automatic load-balancing, proper termination of instances, all seem to apply without documentation or not?!

- Redis: MongoDB for persistent data is fine in many cases but for performance nothing beats a key/value storage (also: some session storage works well with redis)

- Where is it hosted? Europe? Unusable for my location :)
It has not reached the lts mirrors yet, but you can get it from http://incoming.debian.org/debian-buildd/pool/main/b/bash/
Can you explain what "assets" Toshiba got to start their 3.5" drive business? Are HGST and Toshiba making very similar 3.5" drives?
> For all practical purposes, once a work is pirated it is effectively supplied by a large number of individual actors within the market, and not the original distributor.

Which just means that content producers are forced to raise unit price on the first few units to amortize the fixed costs over a shorter window (and focussing appeal to that narrow audience willing to pay those higher costs over that shorter window.)

Or, why whenever there is a widely-supported in-theater feature that widely available consumer devices don't support (or at least, don't support well for pirated content) -- whether its 3D or higher frame rates or something else -- movies will tend to make heavy use of it.
How is it possible that ruby is faster than Java? Are they counting jvm startup time or something? That seems rather suspicious to me.
I'm not seeing this on zsh 4.3.17. Exactly what did you run to see this?
Deep-learning algorithm can weigh up a neighborhood better than humans
Does this also work for dynamic "ajax" sites that have their DOM built in script?
It seems like ideally you could link up your pantry management app (and your menu planning, to know what's spoken for) and they could just send you the difference.
Is it just me, or are the patches "fixing" the vulnerability woefully insufficient? With the patch, bash stops executing the trailing code, but it still allows defining arbitrary shell functions from environment variables. So, even though the patch fixes the ability to exploit this via SSH_ORIGINAL_COMMAND or HTTP_*, anything that can set environment variables can still override an arbitrary command. (Note that privileged environments typically filter out attempts to set PATH, LD_LIBRARY_PATH, and so on.)

This applies even if your shell script or shell snippet uses the full paths to commands. For instance:

$ env '/sbin/foo'='() { echo exploit; }' bash -c '/sbin/foo'
exploit
I can see how you're not understanding why people don't agree with you, but it's because you are twisting the meaning of words to suit your case. There are no "channels" on Netflex.

A more accurate description would be: There is a limited library of content that Netflix licences and you can pick and choose what you watch from that library. This is, for the most part, nothing like existing broadcasters who have finite channels which have finite scheduling space. Thus when CanCon rules state X% of that space must be Canadian it has a clear meaning.

With Netflix, I suppose they could require that X% of the library be Canadian shows, but that seems pretty arbitrary.

In the end this is another example of how much the CRTC panders to the existing broadcast industry in Canada. Much as they did when people tried to subscribe to US satellite television providers. It is protectionism at best, corporate pandering at worst.
Where Profit Margins Are Hefty, Online Upstarts Muscle In
If you're still waiting for mirrors and such to sync, you can install these packages manually on the LTS releases with the snippet here:

http://hastebin.com/oraheyipug.hs
I think you're thinking of a synchronous RPC mechanism. I was talking about IPC mechanisms like unix domain sockets, where sending the message doesn't interact at all with the receiving process, but literally just sticks it into a buffer, where the other process can come and get it later.
Your pro-government rant doesn't fit in this case because the government is one of the customers in the zero day market.
ParseHub itself runs on a highly optimized browser engine. The idea is to give a visual interface so that you don't have to worry about low-level details of how to control the browser. This also makes it easier to reason about the logic of what's happening since humans have stronger spatial reasoning than symbolic reasoning.
Doesn't OSX ship the 8-year-old bash 3.2 (2006) i.e. the last version available as GPLv2? (Apple hates GPLv3)
No. Apparently ssh might be vulnerable.
On most systems I've found this works:
LC_TIME='() { :;}; echo vulnerable' ssh <hostname>

Not sure of the impact of this, as the user would need to have a remote permissions anyway for the SSH login to occur. But if there was some form of restricted shell that then spawned bash it might potentially create an attack vector.
Yeah not really ironic; I mean I would be surprised if node.js wasn't a decent or maybe even a better fit but perhaps they had more technical expertise to handle PHP development and the best way to try and start a business is to release early and often.
Some of those later images could use some cropping- this seems related https://news.ycombinator.com/item?id=8362379
The Conventional Thinking of Globalization
Attacker-controlled environment variable names are a rare scenario, and one that probably has you hosed no matter what. Attacker-controlled environment variable values, on the other hand, are not so rare, and if not for this vulnerability they wouldn't be a problem.
Sure, even small hedge funds and propriety trading firms are generally working with millions of dollars.

I agree there must be some niches are that are amenable to exploitation by small independent traders (perhaps anything to do with nanocap stocks).

I have not had success finding niches where I thought I would be successful, but I could very well be insufficiently clever.

But trading highly liquid equities on a multi-day timescale (the strategy proposed here) is certainly not prohibitively hostile territory for large, sophisticated buy side operations.
If you find FreeBSD docs nice, check out the OpenBSD manpages.
For me they set the bar for nice documentation.
AI-Driven/Programmatic Logo and Brand Design
You mean, like how Google, Microsoft, General Mills, General Electric, Lockheed Martin, and others aren't doing basic research?
He's hit the nail on the head - systemd's fundamental design is not appropriate for the server environment:

"I have to provide a system that runs reliably and can easily be reasoned about and yet I have to build it on distributions created by people who consider how long it takes to get to the fucking GDM login screen and if shutting the laptop lid will cause the system to hibernate properly or not."
Congrats, India. Welcome to the club. Hopefully you'll have many more successes.
I believe it's more about tight vs loose coupling, not integration. The contrast is, systemd's parts are relatively tightly coupled together (in a way one can't easily pull, say, journald and use it autonomously, with other init), while, traditional init systems are bunch of loosely coupled mostly autonomous modules that happen to reliably work together thanks to standards' glue (so, they're integrated as well).

I could be wrong on this, though. Just my thoughts.
Storage on AWS
Well, enforcement always was the problem with anti-discrimination laws. But when it is provable in court, you can't just drop the offer. That would be considered a fraudulent offer. In fact, that is one of the few ways that discriminatory landlords are caught: they rescind an open offer after a someone disagreeable applies, and then reopen it later for someone more agreeable.

Property rights aren't absolute. They certainly don't trump civil rights, and anti-discrimination laws are amongst the core of our civil rights laws.
> the rebels and the intellectually vain are easily co-opted politically.

and

> The rise of libertarianism in geekdom seems to fall under the same dynamic.

I can agree to the first, the second can be simply attributed to an understanding of the first. It is unfortunate that you don't see the connection.

The corruption of traditional causes and activism is what leads people toward libertarianism.
Alexey Chervonenkis found dead
You forget its own reimplementation of dhcpcd, IIRC.
You'd typically run those and package the results for a deployment. Unless you're using grunt to run your application it's probably unnecessary to offer that.
Transcript: Lecture 1 – How to Start a Startup
They generally don't blackmail the vendors. Someone paying $100,000 wants to get in someplace.

I can't say I like the money-for-exploits thing, but one good thing is that it's made most companies be very nice to people to want to voluntarily report bugs. Silver lining and all that.
Eccentric Computing: Base64 Over IRC
I too liked the look of this but would want to self-host.

I use Google Keep on my phone and this looks like a great alternative except that it doesn't have the incredibly useful feature of being a widget on my phone's home screen.

Hosting this service myself and an installing an app on my phone with a widget would sell me on it for sure. A hundred million bonus points if I can create a checklist and mark items off using my pebble.
Neat visualization thereof - https://www.debuggex.com/r/v99uZHQj97Tkgnjy
Ah, and even though I can drag notes around to sort of order them, in my 21 notes example, doing that re-arranges notes that I already ordered, so that's a useless feature.
Why does anyone need to legitimately buy a zero-day?
3 axis would be x, y and tilt?
Already out on Ubuntu, I believe?
Google inurl:cgi-bin inurl:.sh
The one thing that drives me nuts about these kits is that they're all designed for two people or more. I live alone. Am I forever destined to eat TV dinners to feed myself? Am I supposed to eat out, because it's cheaper than mailing the box? :/
What if instead of employing an outside company these were in house employees?
Programming languages are human languages
dropbox opened up recently
Any library anywhere in any application you run that calls out to bash that is called by any other library in that application, so long as that application is somehow hooked up to a web server, is potentially an unauthenticated GET request away from code execution; the exploit for this is potentially so simple that attackers can craft a single request, spider the Internet, and collect shells from applications you run that you forgot you even ran, at which point they'll own your whole data center.

Helpful?
Kudos on finding that - it's very well done! To clarify what it means,

"ISE ROZ KHAO"

That's a pun on ISRO as well as the phrase "Ise Roz", which means "This daily". Khao means "To eat". Ultimately - it translates to "Eat this daily".

"Yeh cheez badi hai mast mars" is actually another reference to not just the term "cheese", which is of course its bread and butter business (no pun intended), but also the fact that those are the lyrics to a very suggestive, infamous and controversial song from the early 90s which compared to the attention 'Twerking'received a couple of years ago.
From what I've read in related discussions on HN, current thinking seems to be that customer feedback can be managed more efficiently by directing customers to a web form that answers frequent questions and requires customers to classify their remaining inquiries for the appropriate department by checking boxes. It's like getting customers to do some of your work for you. Since people are being increasingly socialized to accept that kind of treatment, you might as well use it to your advantage.
Why do you say he can't see the connection? The sentence you quoted explicitly points it out.
> For all practical purposes, once a work is pirated it is effectively supplied by a large number of individual actors within the market, and not the original distributor.

Yes but the question is not whether something is possible, but whether it should be legal, and what enforcement options should be made available to the government.

All property rights are legally granted monopolies. There is nothing inherent in the physical properties of, say, a bottle of water that creates or protects the supplier's rights. Instead, society has created a set of legal rules that govern the relationships between the supplier and its distributors and customers. Likewise, society has created rules that create the concept of copyright to govern those relationships.

In discussions of piracy, the degree and manner in which the law enforces IP rights is the very topic of discussion; assuming that such enforcement is impossible is simply a neat trick to try to win the argument before actually having it.

It is incredibly easy to pick up a bottle of water and walk out of a store without paying. The ease with which a law can be violated is not disproof that the law is needed.

In fact, it was the very ease of distribution that led to the creation of copyright in the first place. Prior to the printing press there was little need or concept of copyright; the physical difficulty of copying a book was sufficient protection. After the printing press, when authors started having their books quickly copied and sold by others--that was when the foundations of copyright were laid.

So: arguing today that because it's easy to copy, it should be legal to copy, flies in the face of history and logic. The easier it is to violate property rights, the more important (not less) legal protections become.

The cost/benefit of protection vs. innovation is a great topic for discussion! My point is just that it's not insightful or helpful to try to misuse basic economics to disprove the laws that govern economic relationships in the first place.
Carl Bildt (The Swedish Minister of Foreign Affairs) did not allow the prize ceremony to be held at its regular place at the Ministry of Foreign Affairs building. The stated reason is that he disapproves of Snowden's actions.

http://www.thelocal.se/20140924/row-as-snowden-wins-swedish-...
Goat Simulator Is a Gloriously Weird Tribute to the Old ‘Tony Hawk’ Games
I'd be happier with the low-tech solution of assuming you're not some feral monster who doesn't have eggs or flour in the house.

Oddly, the one thing they don't provide for you is cooking oil. Who are these high-income loners living in a bare apartment with just a single bottle of olive oil?
Because this allows execution of arbitrary commands from any unsantized environment variable.

Web servers pass information about the HTTP client to CGI scripts using environment variables. A CGI script written in bash would be vulnerable to arbitrary command execution if any HTTP header contained the vulnerable string.

GET / HTTP/1.0
User-Agent: () { :; }; rm -rf /

Restricted SSH accounts (like the ones used by GitHub) have a setting to restrict the user to a specific command (e.g. /usr/local/bin/run-git-only --github-user=octocat). The original command is passed in an environment variable SSH_ORIGINAL_COMMAND. If bash is used anywhere along the way (say, if /usr/local/bin/run-git-only --github-user=octocat is a shell script), then this is a problem:

ssh git@example.com '() { :; }; rm -rf /'

There are surely lots of other ways to get servers to run bash shells with arbitrary environment variables. That's why this is bad.

Edit: as others have pointed out, even non-bash CGI scripts that use a shell to run external processes are vulnerable For example, system("/usr/local/bin/whatever --some-fixed-option") would normally be considered safe since there's no untrusted data in the command-line (although perhaps it would be considered poor design), but it'll run a shell to do the whitespace splitting. If that shell is bash....
Do they rack it with the drives or do they rack it empty and then install the drives?
you should update all security updates, reliably, periodically, regardless of HN posts.

you're probably not directly vulnerable for this very vuln, but then again, maybe you are. with enough vulns it gets complex enough to check that its easier to just update with all the security updates..
So the same people who support Silk Road and black markets suddenly say, "Yeah, Fuck Kevin Mitnick!" because he's a capitalist and using essentially the same system to make some money??
I was surprised by the ACLU response given that sharing source code is very clearly free speech.

Is the ACLU of all groups really interested in stopping/censoring people from sharing ideas?
Perhaps the reason there's a tendency towards thinner phones is precisely because of the bulk added on by the inevitable case.

Even a thicker phone is going to risk getting scratched or dented if dropped on solid concrete or rocks.

In my case, though, I choose to live somewhat on the edge and just get total insurance coverage on my phone (a Note 3 currently). In five years of owning smartphones, I've cracked the screen exactly once, and I just got a replacement phone within a week.
I think you give them too much credit.
I think they just want power. It's seductive.

Lawyers have power, Doctors have power, Hackers have power.
There is a lot of fanboys out there still defending Apple with ridiculous arguments.
Being a consumer, for me, this is unacceptable. Paying 800 to 900€ for a phone that has the quality of a sub 100€ phone is simply taunting the actual Apple costumers.

Mark my words. This will be the major flop remembered in the future for the start of the downfall of this brand.

This will make history.

The excessively low production costs with these devices made in China with low quality standards and low QA at an excessively price range for the end consumer. The profit margin in this phone has to be huge and will serve as an example in the future in how a major international manufacturing fiasco is made of.
This is truly amazing.
* Governments also enter into treaties to define international law.

* We need less endpoints in general. You can imagine a blockchain-based encrypted email system, which could not be tapped, pen-registered, and the government would have to issue a subpoena to actual users to see data.
Larger businesses don't ask for discounts... before they purchase the product. They ask for discounts when it's actually time to pay up and they've started using the service.
Try http://hn.premii.com. If you like it, you can add a shortcut to your home screen/launcher.
That's irrelevant. Governments are in the habit of doing lots of things that would be illegal for me and you to do. For example, jail systems can exist while it's still illegal for me to keep people locked up in my basement.
You would still need to be able to pass arbitrary data to the bash command, and if your php (or whatever) script does that, you have a lot of other potential problems to worry about.
Hi, keep going, love it !
It's strange to see FUD deployed against Microsoft for once!
Great presentation and very clear that the rest of the course will be focusing on advice for SV-style hyper-growth startups.

There's still some good advice for those of us not interested in that life style. I was particularly taken with the idea of building something that just a handful of people will really love. Having a rapt-audience for your product would be a huge win if you decide to build more, scale up, or sell out.

I think it's really good that they're at least trying to convey how difficult building the style of companies they're talking about can be. I can appreciate how challenging that must be. The cultural yard-stick for success these days are valuations and IPOs. There's a ton of pressure to go that route especially from YC. I'm glad they're being conscientious about it even if they don't 100% succeed at removing some of the glimmer from the stars in peoples' eyes.

There's nothing wrong with wanting to start a smaller enterprise and aspire to keep just a handful of customers you know by name.
It's not a purse, it's a european carry-all.
More specifically: The environment in general is an attack vector. I mean, it's global input that crosses execution domains! Any name/value pair could potentially mess with any number of programs in unexpected ways. A user should not be able to control any environment changes, period. Of course, whether or not this is practical is an exercise for the sysadmin.
If you talk about Women in Tech and you are male show some support. The treatment of women across the globe brings shame to every man. From slavery, to abuse to simple inequality there seems no end to the mistreatment of women.

A simple 'I agree' can help in many ways, not least because it get's us talking and shows the women campaigning that we are listening.
Off topic:

This is why I keep coming back to HN. I've gotten an amazing amount of useful info on this very quickly. Great discussion - no trolling, no BS, just serious questions and serious answers.
First logoathon dedicated to startups
I don't see anything in this article that sounds like throwing out the rulebook. It sounds a lot like throwing out a few stupid rules. But not the whole book.
This sounds like it is using anycast routing ("single global IP address"). Can anyone confirm? If so, I think that's awesome; I don't know of anyone else offering that as a service. Presumably this also lays the groundwork for offering SSL more cheaply (as it is one IP per app, not one IP per app * endpoint)
This Is Why Poor People's Bad Decisions Make Perfect Sense
thats a really small number of servers actually.. i mean ppl get owned every day, every minute.
theres a bunch of more easily exploitable local bugs that actually elevate your privileges.

this one bug DOES NOT elevate privs. you need a service that passes unsanitized env vars (unchecked user input) to bash with another user id than yours.
Wonder if it works with any plugins?