skysight-inc/HackerNews huggingface dataset:
When I was brainstorming this idea about self hosting or federation kinda came to mind but i was not sure about interest in that. Actually at the moment As its Node and MongoDB there would be not problem to self host, but I need to think about that :)
I think it comes down to a jargon vs technical language thing. In formal settings arbitrary code execution is a different thing from privilege escalation. In casual jargony talk though, security guys tend to equate code execution with privilege escalation with box ownage.

Basically it goes "why would anyone not follow the execution -> escalation -> own path?" It's such an automatic assumption, combined with the basic premise of "there's no such thing as a secure computer", that the exact details are a hand-wave. This comes from the repeated demonstration that it's almost always true.
It looks interesting.
There are two features that would make me really excited (could be that I just didn't find them in the few minutes I looked for them). The first is the ability to link notes directly to each other and then view the notes in a graph view, mind-map style. I see the graph view for tags, but nothing for viewing notes in a graph. The second is a mobile app, cause I do most of my note-taking on my phone. The web interface is useable on my phone, but not really ideal, as many of the controls are too small for my finger to reliably hit.
I don't know how much I line up with the target audience here, so there could be good reasons that those aren't planned or prioritized.
What does Civil Engineering have to do with tape reliability?

I back up to tape as well (write+verify). It's a risk mitigation strategy (as well as a cost savings). I don't expect to read the tape 10 years from now; I expect to read it an hour or so after a drive fails. The 3 or 4 times I've had to rely on this strategy, I've never lost data.
Most people don't fetishize this asshole
Can be solved by funneling the profits into some other neutral cause.
I was involved in the Israeli Security establishment for over 5 years. I never saw any ethnic cleansing, massacres, or any of the other horrid things you talk about. As a combat commander, I had to give 1hr lectures to my soldiers about ethical behavior before EVERY mission. It was crazy, and I thought it was over the top, but even during the intifada, we were held to a crazy moral standard as soldiers.

For example, the rules during my time stated that if an Arab throws a rock at you (big, heavy, can break your skull apart), you are not allowed to shoot. If they have a knife and are charging from a distance, you are still not allowed to shoot. If they have a molatov cocktail, but are at a distance where it can't hurt you, you are not allowed to shoot. If you shoot and kill in these situations, you will be tried before a military court for murder and jailed.

The Israel you talk about is an anti-semitic PR fantasy that holds no resemblance to the reality of what goes on there. Part of my job taking care of terrorists with blood on their hands that we'd arrested was to ensure they got hot bloody food while we took care of them.

Not exactly a world of massacres and ethnic cleansing. Sorry, your rant is just rhetoric.
Thanks! We initially made the site for a competition at school but then took it down after we decided we didn't want to continue working on it. We decided to revisit the project a couple days before the YC class and put up the new YC lecture. The design definitely needs some work and there are a lot of crucial features missing, but we'll be adding more stuff soon.
Err. I thought it had been closed- but you're right, it still exists. Earlier this year AOL sold it to Hale Global (http://online.wsj.com/news/articles/SB1000142405270230414940...), maybe that's where I got confused.
Using fixed point and tracking your multiplier is exactly like using floating point.
People will decry this, but I'd argue a free and open market for vulnerabilities would be a great thing. Here's why:

1) It would result in more vulnerabilities found

This is fairly axiomatic. An open market increases the price of vulnerabilities which in turn increases the number of vulnerabilities found (unless you want to argue the ability to find vulnerabilities is inelastic for some reason).

2) It would result in more vulnerabilities being disclosed to the proper authorities rather than malicious parties

This is more debatable, but since there should always be significantly more incentive on good actors to prevent the exploit (i.e. the software creators and/or community) than bad actors, the good actors should always win the bid. Indeed, one could argue that it is only the prevention of free negotiation in the sale of vulnerabilities is the reason an exploit is ever sold to bad actors (e.g. if I found a Windows vulnerability and told Microsoft $10m or else, I'm a criminal).

3) It would ultimately increase the quality of software

Given more vulnerabilities are found and more vulnerabilities would be disclosed to good actors, the quality of software increases.

I believe that 2) is essentially the Coase theorem (http://en.wikipedia.org/wiki/Coase_theorem), but I am only
an arm-chair economist. Also, I'm not sure that what Mitnick is doing actually is a free and open market for vulnerabilities.
There are tens of thousands of software developers employed in the New York metro area. This is not a reasonable approach to identify tech companies.
A "bug bounty" is kinda like a vendor buying a zero-day about its own product.
No code is perfect and I'm sure there could be many other sort of niche communities that can benefit and help you build this into a greater platform.
It might not be vulnerable, but any context where a user can pass environment variables might be dangerous.

Eg, if you allow ANY environment variables in SSH rsync-only logins, or pass on any variables (for good or bad) in sudo scripts, etc.
How are you testing it? If you're just pasting one of the proof-of-concept lines into zsh, such as this one:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

...then you're really just executing bash. Replace "bash" in the line above with "zsh" and the "vulnerable" line is not printed.
Wearable exoskeleton “chair” for factory workers
> Watson is the most extreme blue sky research out there

Do you mean it is the most blue sky research being done in the field of AI by large companies? Even if it was closest to blue sky research being done in machine learning by large tech companies, that really doesn't automatically mean that it is blue sky research.

> It happens to have a customer base that intersects with IBM's current base

The definition of blue sky research is "research without any clear path to a product". It isn't diminishing the importance of research to say that it is blue sky (in fact many people would argue the opposite). Watson was already being touted for an actual product launch by the time that it was on Jeopardy.
No one ever explains why having children in poverty makes perfect sense. It's not that unavoidable either.
It seems like a much better idea for 99% of people is:

1. Learn three or four fast single-pan recipes so that you can do them without this hand-holding.
2. Eat more things out of cans, for days you want variety beyond your standard pan dishes- Just because it's in a can does NOT mean it's unhealthy, if you choose the right cans.
3. Take the money you saved in steps #1 and #2 and use it to eat meals prepared by a real chef in a real restaurant, with real fresh ingredients.
So... none?

Unintegrated desktop linux is painful, and the fixes for it so far have mostly been hacks. Systemd actually attempts to create some kind of modern cohesive system which is a good thing.

Maybe you don't see the downsides to the lack of integration because you're just used to putting up with them.
Good idea! I'd be interested to see this "coming to a city near me!"

As a west coaster it been too long since ive heard anything but Rob Ford news come out of TO :)
DigitalOcean NYC2 Network Issues
In case anyone else is experiencing issues trying to install updates for CVE-2014-6271, it looks like NYC2 is having network problems at the moment.

https://status.digitalocean.com/
JQuery hacked
It appears that Linode changes /etc/apt/sources.list to point to their own mirror of Ubuntu repositories, and as far as I can tell those are not updated yet. So I guess the solution is to wait or edit sources.list. Just FYI if you're on their systems!
Yes but you eliminate errors when working within a type of unit. NASA's problem came from converting one kind of length to another. You are clutching at straws here.
Isn't this blackmail?

"Pay us for all your secret vulnerabilities or we'll sell them to the highest bidder".
It looks very interesting. Congrats!

Is it possible to have more than one widget associated to an item. Let's say, I create an item and add a countdown timer and a to-do list. Would it work?
JQuery site hacked
That's the most that we have on the calculator, but we can help you with whatever your need. Email me (mark@catalyze.io) and we can work with you to meet your infrastructure needs.
With the drives. They really are little torpedoes.
It's all very nice hoping that a free market for this kind of thing will improve security, but I don't see how that's going to happen. Government agencies are probably going to be his top customers... let's face it, they obviously have more funding for this kind of thing than they know what to do with, and it saves them having to do any hard work.

It's going to bring way way way more detriment than it is benefit, especially if his clients start looking at using semi-legal tactics to protect their investments.
>Qi’s confluence of features, including an optional type system (actually, its type system might be more accurately classified as “skinnable”), pattern matching,3 and an embedded logic engine based on Prolog, make it a very compelling choice indeed.

Note that the post is from 2011, in the meantime Clojure got core.typed (optional type checker), core.match (pattern matching), core.logic (logic engine)-
The Craft of Text Editing: Emacs for the Modern World (1999)
Show HN: World of X – An Interactive Exploration of the World of Marvel's X-Men
Follr Rewards Feature: Monetize Your Community Management Efforts
They probably ran

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

but failed to spot that the second command invokes bash not zsh.

My tests suggest that neither zsh 4.3.17 or 5.0.6 (the versions that ship with Debian stable & testing respectively) are vulnerable to this exploit - if you replace bash with zsh in the test oneliner then the code after the end of the function definition in the environment variable is not executed.
Maybe they should add a kernel, then it would be the "systemd OS with Linux compatibility."
OpenGov, a startup intended to transform the way governments manage tax dollars
ClearSlide Mail – A Sales-focused Email, Calendar, and Contacts App for iOS
Its generally understood that traits that encourage reproduction regardless of whether or not they encourage fitness will outperform other traits (https://en.wikipedia.org/wiki/Sexual_selection). This is why you will see the appearance of coloration and seemingly useless adaptations faster than actually beneficial traits within a population (i.e. a giraffe's neck; its not for reaching those high leaves). Natural selection is generally concerning traits that promote survivability over time, a much slower process. A major hypothesis is that sexual selection may be a driving force behind differentiation of the sexes, probably originating from genetic information sharing among single-celled organisms. A competing hypothesis is that there is an intrinsic advantage to sexual reproduction versus asexual reproduction. I generally favor the former hypothesis because it generally fits the "short-sightedness" principle of evolution.
Visualize U.S. discretionary spending
Most code executions vulnerabilities aren't remotely accessible, which this is, which makes priv-escalation particularly nasty. (eg: incorrectly assuming that since www-data user doesn't have access to anything sensitive, this bug isn't a big deal)
Cross-posted this to Designer News, but just wanted to share it here as well as I just finished building and deploying this morning. Ever since Marvel announced their API, I've been looking to find something to build using it. A friend of mine is big on MeteorJS, so I decided to combine the two - using Meteor, the Marvel API, and the Google Maps API, I put together this interactive map that lets you explore the world of the X-Men based around key locations in their history and the stories based there.
t'would appear he cares about nothing and no-one, and has opted to use his powers for evil.

We shall have wait and see how that works out for him.
There actually were "Fuck Kevin" stickers all over DEFCON a few years ago.
Habitually, since marriage (25+ years), four days a week, Thursday through Sunday, we cook.

1. It is by now largely out of habit, but both of us enjoy cooking.
2. Thursday and Fridays are often leftovers, or something quick. Saturday and Sunday are usually decided in a five-minute phone conversation before my wife goes to the store on Friday. Midweek there might be brown rice and broccoli or something with lentils.
3. This can be seasonal. During the warm weather, hamburgers once most weeks. During the tomato season, pasta with cold tomatoes etc. at least once every other week. Stews in the winter, etc. My wife is good with desserts--pies and cakes.
4. No.
5. Think about the leftovers when you plan the meals.
Are you certain God doesn't exist?

This is far from the first environment variable attack to impact CGI scripts, and CGI's successors have avoided passing data in environment variables.

It's possible some moron decided to create their own CGI replacement using environment variables, but it's not going to be in widespread use.
I didn't see anything about shipping or free in that article
Bond Street
Have you ever looked at the backend web interface of some of the most popular residential wifi routers? It's shell script. Why? It's a cheap and accessible interpreted language; no need to clutter up your tiny embedded OS with the huge requirements of php, perl, etc when you have all the tools you need in busybox.

CGI apps execute shell scripts all the time. Even if an app executes an app executes an app executes an app, if that app four layers down runs a shell script, the environment is still passed down. Turtles, dude.
or you could just write it as a single CLI command: https://github.com/strongloop/express/blob/master/package.js...
It made me think of the Neil Simon song.
I don't quite get the point of all these services; one of the joys of cooking is shopping for fresh ingredients, choosing them, prepping them.

Putting pre-cut ingredients in a pan for a specified amount of time is not "cooking".

You can get pretty good / excellent meals that have been separately cooked sous-vide in a factory, that you simply reheat in a microwave -- they're much faster, much cheaper, probably better tasting than these pretend-cook meals (and just as healthy).
So for example if you don't run web servers that are front facing on the internet (and you trust your (for example) intranet) then does this become an "asap" rather than a "drop everything"?

"is potentially an unauthenticated GET request"

Are you saying that if you don't have a web server that allows "get" requests (only posts) then this exploit is not an issue at all?
The Cardinal Sin of Software Engineering
> He's hit the nail on the head - systemd's fundamental design is not appropriate for the server environment:

[Citation needed]

From where I stand, systemd is what I always wanted on a server.
At below market rates.
Agreed. Most people I know look at him with amusement. He's hardly an idolizing figure, besides some alright books about past exploits long ago.
The chances of the stock moving from {$25 - $24 = 4.00%decrease} is much more likely than a move from {$25 - $27.5 = 10% increase}-plain intuition. To be brutally honest, it will most likely hit both of those price targets assuming the stock has been trading between that range and they are within one standard deviation of the historical price records.

The most important part of being a trader is TIMING and the second most important part is being able to make decisions based off of analysis of technical parameters and NOT based off of your emotions.

This type of analysis tells me that you are not comfortable emotionally with losing more than $50 on one trade which I see as a sign that you should be looking into more traditional investment practices.

I would suggest you analyze the opportunity cost for the amount of research, training, and actual trading it will take before you become profitable. Don't forget about taxes!

As a seasoned trader, I can assure you this is the type of analysis that will result in lost money and unimaginable negative emotions. It is too simplistic and lacks both fundamental theory and actual technical analysis.
No, I'm arguing that the market is efficient most of the time and that most people don't have the time and inclination to find underpriced securities.

Also, most people underperform the market because of fees. If you invest in a mutual fund with a 2% management fee, then the fund needs to outperform the index by 2% to breakeven. It needs to do significantly better than that if you're invested in a hedge fund with a typical 2-and-20 fee.

Edit: in particular, small-cap stocks tend to be inefficiently priced because it doesn't make sense for institutional investors to research them heavily since they cannot allocate a large percentage of funds to them without: 1) significantly disturbing the market price 2) in some cases owning a significant percentage of shares (5% or 10% I think) that requires filing with the SEC.
How the U.S. Screwed Up in the Fight Against Ebola
What do you find to be painful in using linux on a desktop without systemd?
None of this seems crazy unlikely, but I'd still like to hear a confirmation that that's what was meant. Especially since korzun was talking specifically about Debian and Ubuntu where bash is only used as a login shell and so presumably those with access could already just run the app.
You should also reboot to ensure no running instances of bash are vulnerable.
You don't need a $250k salary to save $1mio in 10 years.

My rudimentary calculation shows you need to save ~50k in the first year, get 4% raises, keep expenses constant, and get a 5% return. Bonuses, options, etc are on top of that. Also, you could get step-raises in the middle for bigger promotions. And, you could marry someone doing the same thing and get there faster.
GoogleX to circle the Earth with Internet-connected balloons
A pan-roasted spatchcocked chicken is one of my favourite easy meals, it's rewarding to see it glorified in the NY Times. However, I'm a bit disappointed they'd use it to sell us on a 16,000 recipe database.

Is it really helpful to have 44 years worth of different dinners on your iPad? Isn't a simple and malleable classic like the chicken dish proof that all you need to get by are a handful of recipes and the skill to play with them?

(disclosure: I'm the founder of a home cooking tech startup, and biased against the recipe-library approach)
At least this way large corporations will start paying more for their bounties.
I read about him just now, admittedly was not aware of him prior.

My first thought though given the location was "so what was this guy doing the government didn't like?".
> So the same people who support Silk Road and black markets suddenly say, "Yeah, Fuck Kevin Mitnick!" because he's a capitalist and using essentially the same system to make some money??

Who says it's the same people? Because it's people on the same site?

If you treat the commenters here as a single entity you'll really hurt your head trying to make sense of the HN consensus. There often isn't one because so much of this boils down to opinions about and attitudes towards governments, economics, personal responsibility, corporate responsibility, and laws.
Is it remotely accessible on systems where sh is dash, though? That's specifically what was under discussion.
Why?

I primarily find that browser base stuff is inefficient as it doesn't tell me what I've already read, and I have to remember to go a specific site to remember to read new things. Whereas I can subscribe/sort email lists. But then I am so 1999 :-)
multiply by 10 to get US labor prices

as any US software company knows
How an Online Survey Company Joined the $1B Club
apple has specifically advertised the iphone as fitting in a pocket.

http://www.youtube.com/watch?v=ZxtyxCAxGNE
SFTP would be a better idea, but documentation says they do support FTPS: http://www.evennode.com/docs/ftp-access#tls

As for criticism... that they charge premium for TLS on custom domains. While this is probably reasonable business decision, it does community a bit of bad service - additional costs for security discourages users from having one. And TLS already has that bar quite high.
We tried the Shitake Miso meal last night, it was tasty and fun to make. We work long hours, so it was a nice treat to cook without the time sink of shopping and prepping.
Omelets are actually hard for a non experienced cook since it is SOOOO easy to overcook eggs and omelets specifically require a bit of intuition (at least for me).
Update [9/24]:

https://twitter.com/jquery/status/514811609752289281

"We have detected a new compromise of http://jquery.com and are taking action to mitigate the attack. Updates to follow."
Selling to SMBs Part 1 – Getting Past the Gatekeepers
The hermit and the cedar wood (YOLOSWAG Manifesto)
Governments are almost always the market for zero-days. Private security companies also buy them, but guess who their primary market is? Look at FinFisher's customer list.

There is nothing libertarian about the defense industry or their actors. Unless you mistake neo-liberalism as libertarianism as far too many people do.
Twitter Interview with Ashish J. Thakkar at 19h00 GMT +2
In this case, there's no "sharing" of code. They're selling 0-day exploits, which is considered bad form by many in the security industry. If Kevin were sharing the exploit code publicly, so that the associated vulnerabilities could be properly fixed and defended against, there wouldn't be such backlash.
Pluto is a Planet Again?
I love the game, but IMO there are a couple of major bugs to fix before releasing it :
-It often crashes when you switch to another app, then return to it.
-For some reason, the app does not have any sound anymore, after a couple of levels.
-Some time after resuming, the level changes randomly.

Again, I love this game (and you talk about it at droidcon was pretty interesting) but there are a couple of issues to fix.
Does anyone have a link to more info on their differently sized racks or the storage arrays described in the article? I'm not too familiar with the open compute project, but the storage vault design they have is 2U:
http://www.opencompute.org/projects/open-vault-storage/

which doesn't match the article.
So basically this is a takeaway restaurant where you just heat the food yourself.

Give me a break, people. You are not busy, you are just wasting your time being distracted by your phone! It's about priorities.
It's not quite the same, because the first time you launch the FitBit app, iOS asks you if you want to give the FitBit app access to your motion data. This works the same with every 3rd party app.

With the Health app in iOS 8, it grants implicit permission and there is apparently no way to remove permissions to your motion data for the Health app.

Is that data going into Apple's cloud? I don't believe so. Is it a big deal to this cloud-conscious guy? Not really.