skysight-inc/HackerNews huggingface dataset:
> It costs $11.95 per person per meal

So if you liken it to getting take-out, that isn't that crazy, maybe a little high. They also seem to have a lot of variety, and might help people segway into doing their own cooking.

I can see the value in it. If you compare it to buying the raw ingredients yourself and then cooking them, yes, it is expensive. If you compare it to take-out (which is a convenience commodity, like this) it is within the ballpark (depends which takeout).

Also locally to me there isn't much selection of healthy take-out. I mean if you want a burger then you have tons of selection. You might even be able to find a solid salad. But beyond that? Meh.
I learned today that some mirrors update their package database a lot faster than others. Had to switch mirrors to get the new bash.

https://www.archlinux.org/mirrors/status/
Update for Ubuntu Server 14.04 is available
That's true of any code execution vulnerability, though - it seems odd to call out the privilege elevation specifically. If that's all the GP meant, then sure, I fully grok.
i have some projects where the meat is in a cross domain connector. no way to test it in units. only functional test in real browsers cut it. otherwise it's just red tape testing.

there is zero coverage tool for this case, until browsers wake up and give me a decent Dev api like opera 12 allowed
On first scan I read that as Google instead of Gobble and though WTF Google?!?

anyway. carry on.
> By arguing that most people underperform the market, you are implicitely assuming
> that it is easy to underperform the market - something that should in fact be hard
> if markets were efficient and everything priced fairly.

I think the argument is that many people (including fund managers) trade too actively, which generates costs that cause them to underperform an efficient market.
only in wheezy (security) right now.

squeeze. jessie and wheezy are still vulnerable.

https://security-tracker.debian.org/tracker/CVE-2014-6271
Time to Show Solidarity with Women Over the World
Oh, you are soooo fucked dude. I can't believe you committed such a terrible crime, and then you come online and tell people about it. You're probably looking at 10 to 15 years minimum.
Squeeze doesn't have regular security support anymore. A subset of packages on i386 and amd64 are receiving long term security support, but you need to enable the Squeeze LTS repo:

https://wiki.debian.org/LTS/Using
Feel free to join the tech industry
So if a machine is not running a web server, does that mean that machine is not vulnerable?
BlackBerry Passport Review: Back to Square One
I tried plated for a while. It was super expensive and came with insane amount of packaging. Like 1 onion was carefully packed in 5 layers of packaging. It was just absurd and silly.
Ask HN: Does Android-development-as-a-Service make sense to you?
My question: would it make sense to offer Android as a Service?

Startups/businesses often don't do Android apps, but your audience likely is on Android. So I'm exploring this idea of doing Android as a Service.

We would design + build + maintain your Android app, as a copy (but adjusted for Android) of your iOS app. The important bit is: it would be JUST AS GOOD, not a crappy Android copy but an Android app that feels Android-y and has a great UX.

Doing this as a subscription service (not a project-based consulting service) would (?) make it much cheaper for you. And it would also mean your Android app continues to get love and polish after launch, which is what you'd want. You'd sign up for ongoing development at a fixed monthly price, and you could cancel anytime.

I am looking for startups/businesses that have an iOS app but not an Android app and that think having a great Android app without tons of distractions, and at reasonable cost, could help them grow significantly.

I want to discuss this idea. It may well be dumb (feel free to criticize in the comments). I'm probably missing a bunch of things.

I wrote down some more detailed thoughts on a landing page here:
http://getandroid.co/
(you can leave your email there too if you're interested in seeing how this turns out)
Really? I haven't been able to find any notice of that, and on 14.04 LTS if I run `sudo apt-get install --only-upgrade bash` I'm still vulnerable.
Clicky http://getandroid.co
I think one of the best ways to start is by just using open source software. Many developers don't realize that they're already part of the community, and can begin contributing by submitting feature requests and bug reports.
I ran

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

and got

vulnerable
this is a test

so I did

apt-get update
apt-get install bash

and now I get

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

bash version 4.2.37(1)-release

Edited: Seems like jvreeland has a clearer picture: https://news.ycombinator.com/item?id=8362309
Fantastic read. Thank you.
I don't get it. What should I be looking at?
AngularJS Inheritance Patterns
HFOSS, Software for Humanity: Building software to solve real problems
BuiltWith for hn
They seemingly do:

http://www.evennode.com/docs/ftp-access#tls
I must agree, there are these subtle usability issues. I'll be definitely addressing these in next updates. Thanks!
I wonder if there is an opportunity for the sellers of these SSDs to use privacy as a USP. "With this SSD, once you delete data it is gone and not even the NSA can find it again"
> You're missing the key fact in the piracy debate, which is that _the market value of a recorded film/music/whatever is ~zero._ It follows from the laws of supply and demand.

(side comment: emphasis; you are doing it wrong!)

The market value is the price point at which the supply function (mapping price to quantity producers are willing to supply) and demand function (mapping price to quantity consumers are willing to purchase intersect.)

That should be the price at where the utility to those willing to purchase at that price equals the total production costs divided by the units delivered including a financial profit equal to the opportunity cost of not putting the production costs into some other venture (this is zero economic profit).

As the fixed costs of movie production are not even close to zero (even if you assume the marginal costs were zero, which they aren't, quite), this is not even close to zero.

Now, there is an economic observation that, with perfectly interchangeable commodities with perfect competititon between suppliers, in the long term the unit cost should be driven down to the marginal cost, because the longer the term (really, the more total units, but, ceteris paribus, longer term = more total units) the fixed costs is amortized over, the closer to zero the per unit share of the amortized fixed costs is, so then the marginal costs dominate.

But that doesn't mean the fixed costs are irrelevant in supply, and thus market clearing price.

Next time, read more than one page of the Econ text.

> As a thought experiment, imagine this this: tomorrow, I invent a machine that can make unlimited free copies of soybeans

That's not really analogous to the situation with movies (even assuming that movie copying is really completely zero cost), as the soybean you are copying exists in nature without human activity, no one needs to be induced to create it before it can be copied; there is no fixed cost if the reproduction is free; well, except the fixed cost of developing the reproduction device, so maybe it is analogous, but then it doesn't support your argument, either.
Strange, it doesn't happen for me.
"Often an Honorary Award is given to a person or group whose work the Jury wishes to recognise but who is not primarily in need of monetary support. The prize money is for ongoing successful work, never for personal use."

Falls pretty short of what the Nobel gives.

"It has become widely known as the 'Alternative Nobel Prize'"

So basically they just co-opted the name.
Judging from my experience on a cruise several years ago, the only major issues are arriving on/leaving the ship in port (and they somehow managed that process so that it wasn't that big of a deal) and scheduling dinner in the evening (there were two or three seatings and, by god, you had to be there on time).
It amuses me to hear how middle-class people are baffled by the fetishization of criminality in hip-hop culture, when we fetishize the same type of assholes in our culture. Mitnick is a criminal and all the pro-hacking sympathies have been wasted on a very, very undeserving person. Funny how easily you can manipulate public opinion with the right PR and anti-government message. Everyone wants to be the rebel against "the system." Everyone seems to think they're the Ayn Rand hero amongst the idiots, when in reality, the rebels and the intellectually vain are easily co-opted politically. The rise of libertarianism in geekdom seems to fall under the same dynamic.
Did that time ever exist? I've gotten the impression that dictating a letter to one's secretary has been a pretty standard thing for at least the last hundred years.
This already exists in a fashion so it's not a terrible idea - http://www.apportable.com/
Design and Document Your RESTful API Using RAML
A good question that so far nobody has answered (as of right now).
Yes, it does! Check out the interactivity tutorial in the extension.
sudo apt-get update && sudo apt-get upgrade
JQuery.com Compromised
My initial thought was "this should be illegal" - but if there's no market for exploits, security will remain poor. So, this sort of business is a bump on the road to global security, which I have some hope we're heading towards.

Either way, an exploit market is a grimy business, basically war profiteering. I wonder who is off-limits to sell to - certainly the Iranians, but who else, and who decides who is evil and who is good? People will die from some of these sales.

I think we'll see pervasive encryption and P2P (blockchain-based) applications that will push back tyranny a bit. There will be technological solutions to things like secret legal proceedings and warrantless wiretaps. And by pushing computation back out to decentralized nodes, there won't be such juicy targets to attack.
Hacking the Breast Pump
The API for system() is not great, but the execve family of functions are not drop-in replacements since they don't take care of forking, changing the signals, and waiting. As long as you're not passing arguments from outside sources to the command, using system() should be OK.
By rank I mean title/position, something like that.
Context would be good if it were done without any kind of emotional undertones (which are often used to win arguments through emotional intimidation) or any kind of logical leaps (which are often used to squeeze in emotional understones).

So e.g. "It's worth keeping in mind, though, that bitcoin is down X% in the last month."
It also seems like a task with inherent parallelism.

Upload the corpus and throw a bunch of cloud instances at it.
>...and is it just me or do the majority of information and sites on data recovery seem to be from Russia?

It's not just you. There is a lot of really interesting data recovery tech that you can only find in Russia/China/India.

I don't really have any good ideas as to why this might be.
Exactly my thoughts -
what about "Unlimited FTP access" - a revolutionarily feature that lets you deploy your app as many times as you want! Sign me up.
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
I've always thought it would be a just punishment for a neutral, but government arbitrated, third party to hold a highest bid auction for zero-day exploits, where the breached company has the opportunity to buy back their bad security at a market price. I feel as though making it public and legal would force larger targets to make better security decisions, instead of the current status quo of letting them off with tiny fines if anything at all.
Ah, looks like I needed to run `sudo apt-get update` first.
As a user of linux on the desktop, I've never felt a moment of concern over the fact that it takes longer to boot than did Windows. I'm not sure who is panicked by this and I'm distressed that we would solve all of our problems with init by embracing systemd.

If Gnome requires systemd, lets drop Gnome.
Integration comes with a huge price.

I'm a beginner sysadmin, and therefore not really knowledgeable about the recent changes in Linux -- however I've seen FreeBSD in production(ish), and it was indeed a more pleasent experience. Paths, configuration, the package system, the documentation (!) all felt nicer.
If i remember correctly Apples stopped updating bash in OSX a long time ago I wonder if this will get fixed.
Another alternative: https://leanpub.com/
Don't know how to use Git but you're a NodeJS dev? Really?
There's nothing wrong with using system anywhere you would happily cover your eyes and paste the string content into a shell. That shouldn't be many places, if anywhere, in production software. It's fine for simple things that would've been shell scripts anyway but for the need to XYZ.
Google HTTP Load Balancing Now Open for Preview
Growth Hacker Interview Morgan Brown
Morgan Brown is a growth guy. He’s been working with startups for years and understands how valuable it is to work at the intersection of marketing, product and data.
By meshing his creativity and experimentation he’s been able to unlock growth for companies like ScoreBig and Qualaroo among many others.
"If you are responsible for the security of any system, this is your immediate, drop-everything priority."

Why don't you explain in plain english exactly why you feel this is the case? "Drop-everything" in other words (or even close to that). Give some scenarios. After all anyone who knows a great deal doesn't need that advice the people who need that advice are ones that don't know enough to know what the impact of this is. [1]

Perhaps you could clarify with some examples of why (see child comment "So, as a amateur sysadmin of a decently popular side project") you think this applies to anyone who is "responsible for the security of any system"?

[1] Me for one because I'm not seeing the "Drop everything" priority for any of the systems that I have control over given the way they are configured. That said I'd like to hear more of course.
For those wanting to criticize Mitnick's actions, what I gather from the following quote is that there is an existing "industry" around finding, and selling these exploits...

"Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between."

Can anyone shed light on these "researchers" and how they sell their exploits now? Or is this just a friendly way of saying "we pay hackers for exploits and then blackmail vendors"?
So, who did he buy the 0days from?

I know he didn't find them himself. The boy can't code.

https://keenot.es/read/kevin-mitnick-is-celebrated-nobody
That's basically the pitch of data-at-rest encryption that the entire storage industry is working on in some form.
My experience in trying Blue Apron (a sous-chef simulator):

* extravagant, simply incredible amounts of packaging. There was easily a 4:1 ratio of packaging to food. I had to stop using the service out of packaging shame

* The produce was often not that good because it needs to withstand transport and storage. The tomatoes were faint pink and could have probably made it through a baseball game without a lot of damage

* It made me try recipes and ingredients that I wasn't used to, which I enjoyed. I feel like it's a kind of Guitar Hero for cooking.

My understanding is that Gobble is taking this stuff one step further, by doing the prep work. I'll be interested to see how they address the problem of having stuff be freshly prepared and transportable/storable at the same time.

This stuff gets marketed at beginning cooks, which seems unwise. If you're just getting started, fancy restaurant meals are not the way to go. Make an omelette or two.
Content Guide:

0:00 – Intro

0:45 – Favorite aspects of working for a startup

2:15 – What problem is Qualaroo trying to solve?

3:01 – HotelTonight Optimization Example

6:13 – NPS Surveying

11:00 – Importance of Qualitative Testing – Getting feedback from the right people. Sign-up funnel optimization.

14:00 – Morgans’ CRO Stack and why you should tie A/B testing to your ultimate business goals.

18:50 – HubSpot and how free tools are a growing trend in content marketing.

23:09 – Airbnb Case Study on GrowthHackers.com and the Professional Photos Experiment.

28:30 – Problems with growth as an industry and the perception that growth is free.

30:06 – ScoreBig customer referral program optimization example.

40:22 – GrowthHackers.com Conference in London Oct 28 – Speaker Lineup.
GitHub Communications Culture and Tools
And in some cases invoking the shell and letting it do its thing is expected, intended and desirable.
-deleted misread original comment :/-
Cirque Du Soleil Does Its Thing… with Drones
Ask HN: How do you record feature requests from users?
A user emails you, requesting a certain feature that's not yet built.

Do you ignore it, or do you write it down? If so, what tool do you use to record user feedback?

I'm struggling to record all user feedback in a nice way. Any ideas?
+1 for the creative thinking. We need the market forces improving security, but at the same time, brokering for profit seems imperfect.
squeeze is not supported anymore but you can use squeeze-lts.

It's been uploaded to squeeze-lts but has not reached the mirrors.

You can get it manually from http://incoming.debian.org/debian-buildd/pool/main/b/bash/ if you can't wait.
Everything goes through an async message send to a gen_event (error_logger). The gen_event itself can have annoyingly synchronous+serial behavior with respect to its backends, but gen_event handlers aren't supposed to do much heavy-lifting; they mostly just decide whether they want a message, and then forward it to some backend process to do the formatting+writing+etc.

This gives you another neat benefit, nearly for free: if you have, say, application Foo on node A, wanting to log to SyslogSink on node B, then Foo first sends its logs to a gen_event on A, and the SyslogSink handler in that gen_event gets the opportunity to drop messages, using whatever logic SyslogSink likes, before forwarding them over to B (which might be half-way across the Internet.)
That's not the motive, that's the method.

Cribbing from the article, one possible motive:

In an uneven economic recovery, Walmart is also pushing to win back customers it is losing to lower-price retailers
Definitely could use this app!
Using Pattern Recognition to Automatically Crop Framed Art
Nice job. This looks like a much better and more complete position sizing tool then the one I built (more of a learning exercise for me.) I wonder if the William Eckhardt position sizing algorithm was used.

http://powerful-reaches-1118.herokuapp.com/ [very much a work in progress.]
Ubuntu has been patched, it appears. If you're on Ubuntu, try this:

sudo apt-get update

sudo apt-get --only-upgrade install bash
“Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.”

A glorified reseller and scumbag. Pathetic.
I used to be a server monkey long long ago, and played with the mockups of these servers that were set up at FB HQ. One thing to realize is they are heavy. Loaded with hard drives, one of these servers is roughly the size, shape and weight of a long 120mm mortar shell.

Easier to rack than the Dells of yesteryear, sure. But there can be up to 120 of these bad boys in a single standard rack, which means 60 of them have to be lifted above waist height during rack and stack. That is pretty strenuous, and technically you should use a moving lift and / or a lifting partner. Especially when you're talking about hundreds or thousands of racks.

Thinking outside the box and keeping the poor floor staff in mind, I've always wondered why we don't build little catwalks or half-height rack units, or even moving racks, like a dry cleaner's.
Well if it was defaced, it's back to normal now.
Yeah, I was current yesterday and I'm current today, with both apt-get update and upgrades. Your version number is lower than mine, you must be on either stable or testing.

ii bash 4.3-9 i386 GNU Bourne Again SHell

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

vulnerable
this is a test

From the FAQ:

> Does sid have security updates?

Not in the same sense that stable does. If the maintainer of a package fixes a security bug and uploads the package, it'll go into sid by the normal means. If the maintainer doesn't do that, then it won't. The security team only covers stable (and possibly testing... there's a pending issue for that case).
iOS Mobile Safari Hover Menu Fix
I was looking at this because I want to make something similar. I've been looking for the software I want for the last ten years, and nothing comes close to the image in my head as to what software can do. So, I'll explain what I want.

I want something similar to this, which will replace email. It doesn't necessarily have to replace email, but it will accept emails and you can send emails out of it. The idea being that email will manage the projects. I'll explain. You create an email to people. You tag it as 'project' and it will create a new project, a distribution list, and automatically give the project a name (based on the subject). Any files emailed between you and others in that project via email will automatically be added to your project's workspace. Appointments set will be assigned to the project, and each appointment occurrence will have notes that you can keep for that occurrence. Tasks can be created for projects as well, and people can be assigned those tasks, and get email reminders.

With those features, if I don't recall what happened in the last meeting, or some client is asking about a file that I supposedly received, I don't have to go looking around trying to find which email on which day it was, as I'll have all project's emails together.

Once a project is finished, then emails between people in that project won't automatically be categorized, but there will be 'suggested' categories.

-- that said, this is nice, however, I can't figure out the ordering here, it appears there is none. Here's a simple test. Add 21 new notes. Just 1 enter enter 2 enter enter... it appears that the new notes are added to the left and that pushes everything else to the right, except when it comes to the extreme right and then it pushes that one all the way to the left and down one. That's an easy way to do it, but it's not easy to read. People are used to reading newspapers, Newspapers have a columnar format, and you read your columns. Classified ads are vertical columns as well, and if you are looking for something you look vertically within the categories. This on the other hand is horizontal categories, which is very confusing, especially since the category something is in is related to what's left of it, and how large that left thing is... in the example I give, you notice now 1,2,3 are from right to left on the bottom. Then 4 is slightly higher than those, on the very left. and then go right again, 5,6,7 all good, and 8 is once again higher... continue on until you get to sixteen, and now it all looks nice and tidy. Now edit 14 to say "14 this is a much longer note just as a test to see what happens with the columns". Now the whole thing looks like a mess.

tldr; use vertical columns to make the output predictable. People are used to spacial relation, so changing that because the content of one cell changes, makes the spatial relationship memory useless.
Patch still exists. Are you talking about it in past tense because it isn't good anymore?
To add to what you said, the hindi word "cheeze" in the line you wrote means "thing" in hindi, and it rhymes exactly with "cheese" in English. Amul, being a dairy products company also make cheese, and this line doubles up to promoting their milk product :).