skysight-inc/HackerNews huggingface dataset:
They're saying that after the kernel release with those features comes out they will make a release that depends on those features, not that the kernel and systemd must always be updated together.
Well you are already getting some good experience from the sound of things. :)
It won't happen for 3 reasons:
1. Performance: web apps run on top of at least two additional layers.
2. Features: OS makers will never make device features fully available to web apps in order to protect its users from malicious code. Read about FFOS privileged API to understand why even an OS that was designed to use web apps exclusively restrains features.
3. Market acquisition/retain: MS became MS b/c Office only run on Win. Same deal with (popular) apps that only run on a given platform. Think BB chat "back in the day".
The Ultimate App Marketing Strategy: Location Based
It runs out that these suggestions were premature, the patch released earlier today DOES NOT fix the problem. https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c24

I just tested this on Ubuntu 14.04 - it's vulnerable.
Let's say you have 10 employees and you decide to work 7 hours/day. All your employees decide well sounds good. Versus, let's say you work 10 hours day and on average your team work 9 hours day. 3 plus 20 = 23 hrs * 350 days = 8000 more hours that year. Your an investor which team do you pick?
What makes you think there's a linear relation between payload weight and cost?
The articles contains quite a bit of wishful thinking. The same sort of disparagement of an prospective enemy that occurred pre WW2 when 'Made in Japan' was a derogatory term. That soon stopped when US forces came up against the superior Zero fighter and the very capable Japanese Navy.

Just because an army's equipment may not match yours in technology is no reason for complacency. The US and Soviet weapons in WW2 were inferior to German stuff, but as Stalin famously said 'Quantity has a quality all of its own'.
I just tested on fully patched Ubuntu 14.04 - still vulnerable per this method.
https://www.djangopackages.com/grids/g/analytics/
> producing a phone that the Verge said ...

What the Verge says is not gospel. The Verge could be right but a product with a completely different approach, in a brand that it's trendy to mock (and The Verge is a bit trendy), is not something I'd implicitly trust them about. For example, if a reviewer, like many, has dismissed Blackberry before the reviewer even sees the phone, then they are unlikely to be open-minded to changes from what they already know (new keyboard ideas, new dimensions, etc.).

Much of the review seemed to have problems with things that were different than the familiar iPhone/Android products. If we make iPhone/Android the rule, then we're choking off innovation. At least Blackberry didn't announce yet another phablet, as one competitor recently did.

Also, consider that many in the industry (and I don't know about The Verge at all in this respect) sell their positive opinions to the highest bidder, something Blackberry might not be able to afford right now.

EDIT: See the Register for a much more useful review.
http://www.theregister.co.uk/2014/09/24/blackberry_passport_...

For example, the following sounds very appealing to me, (also, it displays 66 chars/line -- enough for my text files!)

> The key difference of the Passport, apart from its striking shape, is that the its QWERTY keyboard doubles as a capacitive multitouch trackpad. ...

Firstly, when editing text, the phone doesn’t move in your hands, and your attention doesn’t switch quite so much. Note "hands" – plural: this is a two-handed device.

I particularly enjoyed being able to select and manipulate blocks of text very quickly.
Nike TrollStrikes
How my Linear Algebra book describes shear transformations
The Nebulous and the Infinitesimal
Own It For Life – Quality Products Made To Last
When you update an erlang module, the vm stores the old and new versions of the code. Calls like foo() call the current running version. Calls like module:foo() call the latest version of that module. So typically you would have all the control flow for a given process in one module and it would use the module call to control when the upgrade happens. At that point it gets to pause and migrate it's data.

The process isolation and code swap mechanisms do give you some help, but when it comes to messages sent between processes you are back in the same boat with API versioning or carefully ordered upgrades.

There is no real magic involved. It takes careful thought and tons of testing to make live upgrades work. Most of the projects I worked on preferred to just eat the few seconds downtime instead rather than risk getting the server into some weird in-between state.
I've never told makers to beg for upvotes and in cases where people have incentivized people (e.g. donating money to charity for every upvote -- yes, that happened), we've removed the post entirely.
Very excited to see how the tech world will shape government policy/infrastructure now that they have the cash to change things.
So it's a sort of injection attack that targets inputs to bash that manage to bypass normal sanitisation?

Apache takes SSL_* headers, say, from a client and simply passes those to BASH and this exploit means that BASH will execute a payload dropped in to the header?Am I close? Wouldn't that also be an Apache [httpd] bug in that it's allowing unsanitised user data to hit the shell?

Similarly are you saying that if I set a LANG variable and SSH to a server that the server will use that variable to give to BASH, even if it's not a recognised LANG variable?

Perhaps I'm misunderstanding as such things would be massive holes any way regardless of this BASH issue.

From the example code at the top of the thread it seems that you only need to affect a single variable, that bash reads, in order to pwn the whole server.

Interestingly on Ubuntu the BASH update for this is rated "medium".
Surely though the CGI framework sanitises the headers first? Otherwise this seems like it's a pretty predictable problem - isn't "always sanitise user data" the cardinal rule of backends.

I can certainly imagine that I might have designed a web page that passed user input direct to a BASH script to do a ping or some such, but not if it's public facing.
According to http://wiki.bash-hackers.org/syntax/basicgrammar it appears that this is because bash allows functions to be exported through environment variables into subprocesses, but the code to parse those function definitions seems to be the same used to parse regular commands (and thus execute them).

Edit: after a brief glance over the affected code, this might not be so easy to patch completely - the actual method where everything interesting starts to take place is initialize_shell_variables in variables.c and parse_and_execute() in builtins/evalstring.c, so parsing and execution happen together; this is necessary to implement the shell grammar and is part of what makes it so powerful, but it can also be a source of vulnerabilities if it's not used carefully. I suppose one attempt at fixing this could be to separate out the function parsing code into its own function, one which can't ever cause execution of its input, and use that to parse function definitions in environment variables. This would be a pretty easy and elegant thing to do with a recursive-descent parser, but bash uses a lex/yacc-generated one to consume an entire command at once...

However, all in all I'm not so sure this ability to export funcdefs is such a good idea - forking a subshell automatically inherits the functions in the parent, and if it's a shell that wasn't created in such a manner, if it needs function definitions it can read them itself from some other source. This "feature" also means environment variables cannot start with the string '() {' (and exactly the string '() {' - even removing the space between those characters, e.g. '(){', doesn't trigger it) without causing an error in any subprocess - violating the usual assumption that environment variables can hold any arbitrary string. It might be a rare case, but it's certainly a cause for surprise.
* Did you talk to your employer about your desire to work as a Project Manager?

* Did they provide you with reasons why they don't want you in that role? Since they set the rules, you need to know what they want.

* Project Management is more about social rather than technical skills. Are you a good communicator? Does your employer know that?

* I don't know anything about your skills, but you've just written 260 words in one wall-of-text paragraph. It wasn't that hard to read, but that's not proper style.
New 'Bash' software bug may pose bigger threat than 'Heartbleed'
The Next Big Thing in Responsive Design
How often do Xen vulnerabilities get embargoed?
Physicist here. Imagine a fish swimming down a river. Down the river, there is a water fall, with water falling faster than the fish can swim. Past the point where the water is falling faster than the fish can swim, the fish can not turn back and swim up the waterfall, back into the upper part of the river.

The same thing happens in spacetime. As you get passed the event horizon, there is no way to move through spacetime so as to emerge back through it.
How much research have you done on this? If you dig into the research you will see that Sarno's theory is the best explanation for these conditions. (I've suffered from one of these conditions myself, and done extensive research).
Same for me. If you use OSS stuff quite often, especially in production projects, you'll generally run into bugs or unexpected behaviour.

Often enough it's just edge cases the author didn't think about or small programming errors and is quite easy to fix.
Yes, I see a fallacy and it is in your own argument.

The fallacy you are invoking, in fact, has a fancy Latin name; it may be this one:

http://en.wikipedia.org/wiki/Tu_quoque
There might be a bustling future market for organizations in China and India that can sell to the rest of the world that the US won't let domestic companies sell to.
Compare, contrast, whats the difference?
The question was philosophical (and paradoxical) in nature, but thanks for the link.
How to Be a Not-So-Undercover Boss
h5r has been removed from CRAN "due to licensing problems"[1]. ncdf4 and rgdal use totally different formats. rhdf5 may not be the best library, but it seems to be the only library.

I don't think R support for HDF5 is "limited," I think it's just poorly implemented in a few ways (another is that you need a separate package to get 64-bit integer support, which is another problem with R in general).

[1] http://cran.r-project.org/web/packages/h5r/index.html
Thanks for caring enough to make this comment.

I'm actually fine with the title change as the original title seems to be confusing to some.
The article implies that since singularities can't come into existence now, there can't have been a singularity at the moment of the Big Bang, either.

That sounds implausible. Lots of things that cannot possibly come into existence at the present time did exist at the moment of the Big Bang (and shortly afterward), because the conditions back then were so radically different from they are now.

Perhaps the only singularity that ever existed was the Universe at the moment of the Big Bang. After the One Singularity has blown itself apart, no other singularity can come into existence. I don't see any inconsistency in that scenario.
Semaphore report: Ruby version usage in commercial projects
How is this not 100% rip of http://snip.ly ?
If you look at the public release column you'll see the following date: 2014-10-01 12:00. I'm not sure when the vulnerability was added to the list or what timezone that is referring to but it looks like we'll find out what it is in a couple days.
They say that its fine to reboot but that there is no guarantee that you will land on an updated host. However, AWS does provide a script to run on Windows machines which should tell you if that particular machine has the issue. I took a quick look at the script and deduced that it is indeed a Xen issue.
I've made them clear I don't want to be just an employee who gets in at 9 am and leaves at 5 pm. I want to lead, set up standards within the company on how the projects should be done. I've made it very clear to them that I want to know more about what's going on and not just sit in a corner writing code. But yes, I didn't say " I want to be a project manager". Because I don't think that would be appropriate as I was hired as a developer.
And yes, project management is about connecting with your team, making sure they know the bigger picture of the project as well as company and importantly, make sure you give respect to others and not try to be THE MANAGER.

Sorry for my big para. That is what I am concerned about. What do you think is the good style? I fear I don't know these things. That is what I think I lack. Please help me get to a better style.
BTW this article is attributed to Jean-Marc Valin.
It looks from the article that this results in bounded-time concurrent reads and writes, even in the worst case, as long as resizes can complete often enough to not be overwhelmed by the writers, is that correct?

This looks huge for smoothing the latency spikes out of software networking on Linux.
Yeah, the one I completed, I was completely locked in by ~halfway through, due to the already-invested time.
And with that, physics discovers Pandeism.
Ask HN: Where can I find resources/advice on growing an engineering team?
Background: We are a funded startup with 4 engineers (15 employees) and I'm one of the technical founders. We have a large application and an important piece of it supports our on-the-ground team, so we're anticipating lots of pressure when we launch outside of San Francisco and begin scaling. We've been at it for a year so far and have a solid grasp on our product and user.

Some of the things on my mind are:

1. Prioritizing, organizing and distributing work in a way that makes engineers happy and motivated. The process we have now is okay, but I can't see it working if we had 10 engineers.

2. Define and maintain good (mainly consistent) code quality so new engineers can easily adapt and begin contributing quicker.

3. Implementing good processes for attracting, hiring, and onboarding engineers. Onboarding may involve documenting important business logic.

Any resources/advice would be helpful! I'd love to know how these things are done at growing tech companies. Any advice in general on growing an engineering team is a appreciated!
>systemd has bugs, just like every other program, but by being so intermingled with the kernel, the consequences are much worse.

WHAT? I thought systemd was flawless by virtue of being the creation of god-emperor Poettering. /s

>asserts that there are critical bugs that make the system unbootable

>asserts that changes to systemd break everything

>refuses to provide source

Why should I look for data to support your assertions? If there is any data supporting your assertions you should know where to find it already.
Thank you so much for the reply. You do seem to understand in what situation I am in.
Your suggestion seems to be the ultimate solution but being new to the country without much financial backup, I'll have to put this option aside for the time being.
However, I constantly think about leaving and doing something on my own every day but without a solid idea and proper plan / backup, its tough one.
It seems like providing a script that identifies if your system is vulnerable to an embargoed XSA would be a violation of the predisclosure list, since it would basically be pointing at what the issue was?
Nuclear spins control electrical currents
I notice that comments that are purely sarcastic get downvoted but comments that express some insight sarcastically get upvoted.
You're hired!
-Ben Horowitz
Now, just to repeat the scan with:

Referer: () { :; }; sudo apt-get update && sudo apt-get install --only-upgrade bash

"Why, who was that masked sysadmin? We didn't even get the chance to thank him."
A video of Elon Musk, before X.com became Paypal. He knew he'd be a billionaire
The shuttle was never primarily used to send Satellites into space... It was used primarily for maned missions.

The Atlas V is the current standard for putting satellites into space.

Sierra Nevada Corporation puts a satellite into orbit almost once a week.

The pain you speak of is non existent.
How does one bit of information (vulnerable / not vulnerable) tell you what the vulnerability is?
Maybe folks in India will start asking, hey, we can orbit Mars, how come we can't get clean water around here? Raising the standards of competence, intelligence and honesty for that government probably does far more than piping another $74mm into the same decrepit apparatus.
One of the comments in this thread (http://seclists.org/oss-sec/2014/q3/650 ), seems to indicate that Apache is an attack vector for this vulnerability.
I love how the amazon support person is absolutely not answering the very precise question.
Do you mind emailing me? My email is in my profile.
Yea, no 'aha' moment. But then again it was only the first class... So hopefully more to come :)
It's kind of the equivalent of a web app that basically evals any given GET parameter with a specially crafted value.

Apache sets environment variables, it does not pass user input directly to bash as code or anything like that. The fact that bash can be tricked to execute this code is a problem that needs to be addressed by bash, not any other software.
You have this backwards. To a distant observer, light going into a black hole is red-shifted, not blue-shifted. If this were not the case, sending even a single photon into a black hole would produce infinite energy.
It's not the results of the script that I'm referring to, it's the contents of the script. If I hand you code that can look at your system and determine something about it, you can look at what the code is doing and identify what it is looking at, which tells you where the vulnerability is.

It becomes moderately harder if it's compiled code, but still not very difficult.
This might be more accurately titled "The Craft of Making Text Editors." It is mostly not about Emacs, rather about more abstract ideas around user interface (see the quaint Joystick section) and text editing:

> This model is the basic two-dimensional form. Instead of editing a line, the user is editing in a quarter-plane, with the origin usually in the upper-left corner. Conceptually, the user can move freely in the two-dimensional quadrant. In practice, the editor usually only stores the non-blank portions, as storing an infinite-quadrant's worth of data can be prohibitively expensive. Some systems may impose fixed upper bounds on the width or length of the quadrant.

Sure, that's fine I guess, but this doesn't help me understand how to use or program Emacs. And most of the code is in C, not Elisp.
It might still be an issue. The patches may not have done enough.

$ env X='() { (a)=>\' sh -c "echo date"; cat echo

https://twitter.com/taviso/status/514887394294652929#

env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("
That's not really the risk with this vulnerability. Piping a web-sourced script to bash has always been a vulnerability, but it's one that you choose to live with when you do it.

The reason this is newsworthy is because there are some network-facing programs (CGI-based web servers, some SSH configurations) that will set the value of some environment variables to a user-supplied value, which bash will then be executed by bash when that program spawns a new process.
EC2 screenshot: http://i.imgur.com/OdCehey.png

And copy of the email that was sent out to us...

----

Dear Amazon EC2 Customer,

One or more of your Amazon EC2 instances are scheduled to be rebooted for required host maintenance. The maintenance will occur sometime during the window provided for each instance. Each instance will experience a clean reboot and will be unavailable while the updates are applied to the underlying host. This generally takes no more than a few minutes to complete.

Each instance will return to normal operation after the reboot, and all instance configuration and data will be retained. If you have startup procedures that aren’t automated during your instance boot process, please remember that you will need to log in and run them. We will need to do this maintenance update in the window provided. You will not be able to stop/start or re-launch instances in order to avoid this maintenance update.

If you are using Windows Server 2012 R2, please follow the instructions found here: http://aws.amazon.com/windows/2012r2-network-drivers/ to ensure that your instance continues to have network connectivity after reboot. This requires that you run a remediation script in order to ensure continued access to your instance.

Additional information about Amazon EC2 maintenance can be found at:
http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/mo...

If you have any questions or concerns, you can contact the AWS Support Team on the community forums and via AWS Premium Support at: http://aws.amazon.com/support.

Sincerely,

Amazon Web Services

To view your instances that are scheduled for reboot, please visit the 'Events' page on the EC2 console:
https://console.aws.amazon.com/ec2

This message was produced and distributed by Amazon Web Services LLC, 410 Terry Avenue North, Seattle, Washington 98109-5210.
That will run arbitrary code regardless
I've been looking into these issues for over a decade. Sarno's theory is psychobabble: http://en.wikipedia.org/wiki/Tension_myositis_syndrome.

"The treatment protocol for TMS includes education, writing about emotional issues, resumption of a normal lifestyle and, for some patients, support meetings and/or psychotherapy"

For general back pain, I wouldn't be surprised if this "treatment" involves some very simple stress relief mechanism that relaxes muscles and reduces muscular pain for some people, some of the time.

The theory, however, is nonsense, and you could just as easily substitute "demons" and "exorcism" for "emotions" and psychotherapy" and get the same results. "TMS" is a made up term with no science behind it, just wilful speculation from a professional who should know better.

To suggest it has anything to do with the unremitting pain described in the OP is deeply irresponsible. It's like suggesting homeopathy for cancer. In fact it's probably worse, as it amounts to victim-blaming because the patient isn't dealing with their "repressed" rage/emotions. Awful.
Who would grant `sudo` privileges to `www-data` without asking for a password? That's just asking for a bad time.
Well, they do compress, just not enough to bother to store energy into them. (Sorry, I gotta nitpick the nitpickers.)