skysight-inc/HackerNews huggingface dataset:
Execve, but even that is stretching it, if I write something in Python and someone would tell me "hey use system() or subprocess" I tell them, no thanks, I would rather not do it - then go look for python-way of doing it, if its an image library or whatever it is that needs to be done.

Now you say, but you really really have to run this "utility" with subprocessing or whatever. Well, then its outside of python program and instead of relying on subprocessing Id consider exposing that utility as an interface and writing a small protocl through which the python and utility can exchange data. You most probably have to parse output of utility anyway, better do it right straight away. And if you dont have to parse output of utility - then you send a signal/request/messaging-bus to a listerner which will do what you want - but now with cleaned environment.
'Deadly serious' new tech bug found
Scorpion Brings the Stupidest, Most Batshit Insane Hacker Scene Ever
Tiny structure gives big boost to solar power (2012)
And this, kids, is why we desperately need to teach computing in school.
/bin/nologin exists for this reason - if nothing's supposed to be logging in as that user, surely you want a log of when someone tries!
Apollo, the Everything Board
Hacker Keyboard is my favorite keyboard on Android. I only wish it had swipe support but it seems the developer has abandoned the project.
Google Driverless Car- ABility to Limit Destination
One could argue why should people own land that was created before people existed? We can see the argument for owning the car, but owning land is like saying you own the air.
I genuinely don't see how he is being "an asshole". I guess literally everyone who owns land in US would want to protect it. If people wanted to have public access to your own garden, would you consider yourself "an asshole" for denying them that? It just so happens that his land is a beach - so maybe the problem is that someone sold him that beach in the first place? In many countries you literally can't buy beaches, no matter how much money you have.
Ask HN: Bitcoin startups in London?
Hi peps, I'm trying to gather a list of startups like https://coinbase.com in London?
Are you gonna make browser extensions?
Being in “flow”: the most addictive element in programming
> But you should recognize that your experience is the exception not the rule.

Don't tell people that. They don't believe you.
Wear HQ – Centralized Headquarters for Android Wear
chroot-ing your network-exposed services isn't a bad idea either. Assume they'll be exploited at some point, and contain the potential damage.
5 Reasons Not to Give Up Your Day Job
You're beating the African card, or what? (Then, we could proceed to whether the landlords should own the land in a rural underdeveloped country, whether it really was "the party" it went to, if the Romanian government was responsible for some indeed disgusting things going on there, or their Moscow patrons, whether it is always "from slavery" or rather plain "into better life" people are fleeing across the borders, and to the Transylvanian events)

My best commie cheers from the land of Brutal Dictatorship!

P.S. If your second line is indeed about Hitler regime being on-par (or "better") than the pre- / or post-war Soviet one (despite declared political goals, documented doings, and victim counts), just say so :)
Could we fork bash to make this "feature" configurable?
Don't use bash as a system or scripting shell then - thats exactly why dash, or the BSD shells exist. Exporting functions makes no real sense anyway, at least if you did it by hand it would be obvious how dangerous it is.
Not really. I think there is a useful place to draw a line and call it "ownership" even if there are some restrictions involved. For example, I feel like it's fair to say that I own my house and the land it sits on despite the fact that I have to pay rent on it (property taxes) and I can't tear down the house and build a gas station instead. But IMO, one of the necessary conditions for ownership is the ability to restrict access. Again, I use cars as an analogy: if I can't lock the doors and prevent people from sitting in the driver's seat on a whim, I don't think I can reasonably say I "own" the car.
What about when you are handling external data? Don't you test what will happen when unexpected types are received? How do you test the handling when a JSON key you were expecting to be an array turns out to be a string or an integer or vice versa?

Do you handle nil's correctly in every place they might occur. These are all things that can be covered by a powerful type system (such as Swift's unless you overuse "!"[0]).

[0] Anything other than use for a member that is initialised during the init method is a code smell in my view.
I'm amazed everyone is referring to him as a "Terrorist"... How is his actions different from just a normal "Crazy person attacked a police officer" ?
If you open a file with Elm Reactor, and edit it and save it then Elm Reactor will get notified by that and recompile the code in the browser. See the first video in the blog post.
The default rounding method is round-to-even, so e.g. 0.9999999 would be expected to come up slightly more often than 0.99999994 (the last two floats smaller than 1).

Being more precise would probably require thinking about all the possible int values.
What are the best new products that most people don't know about?
Yes, and in doing so they (well, Debian) upstreamed a lot of fixes for bashisms, so most system stuff is ok.

Apparently a lot of node.js stuff uses #!/bin/bash explicitly in scripts, so removing bash entirely might be difficult if you use node, or otehr stuff.
> That doesn't solve the problem mitigating risk from insolvency

Does FDIC insurance? If the dollar's worth nothing tomorrow, where's the insurance for that?

Everyone in my country has insurance for becoming personally insolvent, it's called welfare. If you have enough bitcoins that losing them would be devastating, you can also get bespoke insurance on them, even if there's not a pre-existing insurance product.
FWIW, I'm not a doctor but have read enough about Ketamine therapy to recommend researching it if you or someone you know is suffering from a form of chronic pain syndrome.
Semiconductor scaling and concurrent clouds
What do you not understand? If you lawfully bought land, and now people wanted to have public access to it, would you not at least try to defend it? It doesn't really matter how much money you have, and I don't really understand how it's about rich/poor people either - it's playing on emotions to say "rich person buys beach, poor people don't have access". It has nothing to do with how much money you have - a poor farmer would fight just as ferociously to stop people walking on his property, wouldn't they?
No, system() uses /bin/sh to run the program.
I find it funny that nobody is pushing for more women in coal mining and truck driving.
Nice that "compatibility mode" does not bother to disable this technically non compatible behaviour...
It does. I installed an up-to-date version with homebrew a few months ago, and it was vulnerable as well. After a `brew update && brew upgrade bash` I had the fix installed, though :)
More precisely it means "almost" (here)
Nice. We now agree that even though the owner of some property does not want to share, there are indeed circumstances where the owner must do so anyway.

Which leaves us with discussing what reasonable circumstance is.

You'd argue that fencing off a five mile long beautiful beach so that nobody else can enjoy this land is reasonable. I'd argue to the contrary, and it seems judge Barbara Mallach, at least, is with me on that one.
Or just run from terminal:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

This should be displayed:

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
The bash bug does not require a system restart. In fact, it can be updated without shutting down the running bash processes, as the vulnerability only affects new shells.
I don't think there has ever been a "Terrorist" attack in Australia that has targeted "White Australians". I make that qualification based on the fact that a number of foreign embassies have been attacked within Australia, but that is quite a different thing.

How was the stabbing "terrorist-linked?" And how is people travelling to the middle east (even to fight), terorrist linked?
Looking for Remote Ruby/Rails or Python Work
I'm a mid-20s long-time HN lurker, looking for remote work with Ruby or Python, or anything else you want me to learn. I've worked in startups and small companies, and recently completed some projects alone.

I miss working in a team, and I'd really love to have experienced engineers to build a long-term mentoring relationship with (I don't need hand-holding, but I appreciate mentoring). I am always, always looking to improve.

I'm also just a good person to have on a team -- I bring a positive, creative, can-do attitude with me, and it tends to spread to other team members. Ask any of my previous employers or team-members!

Experience:
Languages: Python, Ruby, Clojure, Javascript. Front-end Tech.

Tools: Rails, Flask, some node.js.

OS: My first computer career was Linux/BSD system administration. I love Unix-like operating systems. I'm also a strong supporter of puppet/chef/etc. for automation.

Other skills: I was a student of marketing and sales for a long time, and really enjoyed copywriting. Some machine learning (mostly bayesian). Some Natural Language Processing.

Just Finished:
-Weather-station portal. It uses Python, Flask, sqlite (and in the new version, mongoDB), and a bunch of shell scripting to automate remote weather stations and tie them together with a central server featuring publically available data (pictures!) from those stations. A quick overview:

A small board running linux (cubieboard) automates the weather station, taking pictures and gathering data from sensors, then sending it back to the server (using curl). The server displays data from different stations. There is also an admin backend, basic upvoting functionality, and AJAX to load more data into the front-end intelligently. Stations are adminned over an OpenVPN tunnel.

Cool Stuff I've Done:
-Linux Sysadmin Tutorials youtube channel (tutorialinux)
-Wrote a basic system of integer arithmetic in Lisp
-Lisp in Python
-Worked through The Little Schemer
Also blocking outbound requests from publicly accessible servers (i.e. from a public web server, it should be hard to make an outbound request to fetch more stuff to install).

Probably a good idea to check that tripwire is installed/configured/monitored in all the right places.
My Zsh seems vulnerable. Anyone else care to replicate this?

--
➜ ~ zsh --version

zsh 5.0.2 (x86_64-apple-darwin13.0)

➜ ~ echo $SHELL

/bin/zsh

➜ ~ env x='() { do_something;}; echo vulnerable' bash -c "echo this is a test"

vulnerable

this is a test
---
Retired TSA Scanner Donated with Sensitive Data Intact
DHL to Begin Deliveries by Drone in Germany
Stumbled upon https://gist.github.com/anonymous/929d622f3b36b00c0be1

Just to verify; apache httpd / nginx without CGI-support is not vulnerable?
You may want to rethink your statement. How are virtual machines going to help in unit testing drivers that work with real hardware?
Okay, here's the breakdown of the five sample ticker tracks provided by the artist.

NR231 NR287 NR320 NR440 NR442 Totals
Uptick followed by an uptick (UU) 6 5 9 14 5 39
Uptick folowed by a downtick (UD) 2 4 3 3 4 16
Uptick followed by no significant change (UN) 1 0 0 2 0 3
No significant change followed by an uptick (NU) 1 1 0 2 1 5
No significant change followed by a downtick (ND) 2 1 0 0 1 4
Downtick followed by no significant change (DN) 2 2 0 1 2 7
Downtick followed by an uptick (DU) 1 4 3 0 4 12
Downtick followed by a downtick (DD) 8 6 8 1 6 29

There were 58 upticks in total, 39 (67.24%) of which were followed by another uptick.

There were 48 downticks in total, 29 (60.42%) of which were followed by another downtick.
What is the difference between while (true) vs. while (\true)?
It has, there is a patch for bash 4.1

ftp://ftp.gnu.org/pub/gnu/bash/bash-4.1-patches/bash41-012
Booking.com ested the hamburger icon vs. word “menu” on mobile
WWDC app.
I really like Swift, the strong static typing, imutability options, and even generics but there are some features of Obj-C that are lost. Objective C is a very flexible dynamic language with opportunities for runtime twizzling, object introspection. It is really like a lower level Ruby and if you use it a certain way is basically duck typed (you can send any message to any object). Swift is much more a static language and only really enables introspection and downcasting if you enable the Objective C compatibility for a class. This makes some things harder at least to do the same way as Objective-C (JSON parsing with NSJSONSerialization isn't pretty).

As mentioned I prefer Swift but I do acknowledge that there are some losses that others may feel more keenly.
You are using bash there...
I wonder how many people knew about this behavior a week ago.
I think you underestimate attack vectors. d6c477a79ea7a633c2bb0e358e32399c1b18eb7d <-- Will ruin 1+ HNers' day sooner rather than later if they don't patch. Successful exploit doesn't require the exploit writer even knowing that vector existed to say nothing of successfully guessing a URL.
I have seen implementations that shell out to bash scripts throughout my career in web and back-end development. It's a serious antipattern in the wild.
Ask HN: Good ideas to defend against the bash RCE?
Hoping to create a discussion here on ideas on how to defend against the current bash RCE. Probably just a subset of existing "best practices" that are particularly relevant for the current attack vector for the bash RCE. Recommend keeping posts to one recommendation per post so that the best can filter up/down individually rather than as a set.
Generally, that is true for small feats of system automation, but secure applications need to be isolated from the system layer.
Switch sh to bash and it will work (create a file called echo)
Still, isn't sh quite often implemented as an alias/symlink for bash nowdays?
> The pain you speak of is non existent.

That's simply untrue. Access to launchers is the bottleneck to satellite development. Large institutional customers have access to space, but almost nobody else does. The commercial satellite industry has been shaped by the shortage of launchers, with satellites designed to be launched infrequently with long design lives. As a result everything is tremendously expensive.

This is changing slowly with the advent of SpaceX and the develoment of launchers by other countries. There's no reason launches can't be an order of magnitude cheaper. The fuel cost is actually a minimal part of the cost of a rocket system.

I work in the space business. Getting access to a suitable launcher for smaller lower priority projects is hard.
email addr: dave AT project768 DOT com
Here is a description of what the scan does: goo.gl/8vp6eo
In many ways UNIX is built on the philosophy of keeping everything in-band and leaving it up to processes what they do with their inputs. Specifically, "everything is a file" vs "everything is an API".
This might be interesting. I'm not actually interested in C++ (any more) but I'm still looking for the easiest possible way for me to get into LLVM. I think “learning LLVM” seems like the obvious next iteration of what used to be “learning assembler”, except this time around, it's actually portable. I love experimenting with languages and having an LLVM backend ready at my fingertips must feel like Programmer's Heaven...
Hardly surprising when you consider this is the executive producer of the show:

http://en.wikipedia.org/wiki/Walter_O%27Brien
Are you running any remotely-accessible services? If not, I'd just wait for the next OSX update from Apple.
Link to the vulnerability report for Debian if someone needs it: https://security-tracker.debian.org/tracker/CVE-2014-7169
Block outbound request from publicly accessible servers (or white list them if necessary).

This would make it harder for attackers to fetch/install more tools.
I don't know about the iOS version, but on Swiftkey on Android swiping your finger from right to left across the whole keyboard deletes the previous word.

I'm using the ordinary typing mode though. I don't know if this works if you have the Flow mode enabled.
> Could you come up with 1 use case which: .. generic is really useful.

Errm arrays/dictionaries that return typed objects so that you don't have to cast everything from id either with an ugly explicit isKindOf test or just hoping for the best?

There is nothing that strong typing fixes that can't be fixed by just coding it right but when has everything been coded absolutely right without bugs? And even if it is coded right to start with when you make a change if you forget one rare case where it is used during your refactor you can end up with a crash in the field or with Swift a compile time error that you fix in a second.
if you do it correctly by using zsh instead of bash, you would that it is not vulnerable

env x='() { do_something;}; echo vulnerable' zsh -c "echo this is a test"
this is a test
rsnapshot (http://www.rsnapshot.org/) running on a Linux machine with three 2T WD red's in RAID5 config using md. LVM sitting on top of the RAID5 to allow parceling out space as needed. One of the LVM partitions is the rsnapshot backup tree.

Cron setup on the backup server to take nightly rsnapshots of the machines that get backed up. The only machine that does not get nightly's is my laptop, as it is often hibernating overnight, so it gets periodic pushes when it is not hibernating.

Occasional rsync of the rsnapshot tree to an offsite location.

Of course it helps that I have zero mswin machines.
> it still transfers more responsibility to the student than subsidizing education to make it free

Nothing can be made free by subsidizing it. The cost is hidden, but it's certainly still there. When a government subsidizes something, it's just transferring wealth from some people to others.

The end result is much worse, because no one uses other people's money in a prudent way, and no one knows what the best use for your money is to you personally - only you do.
Tool and resource list for new founders
Buy a Brick for the Nikola Tesla Museum
BlackRock: The Time is now to reform bond market structure [pdf]
I agree with you. I wrote an essay once about the need to be sentient about what characteristics of biological evolution one adopts in genetic programming, arguing that sex is arguably just a serendipitous side-effect or at least a sub-optimal solution to the problem of effectively mixing gene material. Much points to this, such as the short-sightedness principle of evolution, and that group or species selection argument is generally hard to make.

However, I am still reluctant to accept your distinction between natural selection and sexual selection. The article you link to even calls sexual selection "a mode of natural selection". The giraffe neck does not have fitness value in the sense of making it a better food processor, quite the opposite. But it does have fitness value in the sense of prospering those very genes, indeed otherwise the giraffe would not exist. Such a definition of fitness does tend to be tautological, but the alternative is no better, because it is inevitably based on a measure of survivability that in the end is necessarily arbitrary.
Correct me if I am wrong, but from my understanding, he does not own the beach itself, but only the road allowing to access it. It is a bit different. It sounds more like a right of way issue.

I guess Vinod's property is the big one on the main road and he also owns the other houses/cabins on Martin's beach road.

https://www.google.com/maps/place/Martins+Beach,+California+...

Street view with, what I assume the barrier, and the no entrance sign :

https://www.google.com/maps/place/Martins+Beach,+California+...
The default /bin/sh, but NOT the default login shell. Those are two very different things.
Why is it that iOS8 already has more fun and quirky keyboards?

Android keyboards have been around for much longer and you'd expect them to be more competitive surely.
Make sure tripwire is installed/configured/monitored.

Watch for unexpected changes to public servers.
No, the article only claims that a singularity cannot arise from a collapsing blob of matter.

We have no evidence that the singularity that existed at the moment of the Big Bang was the result of a collapsing blob of matter. Therefore, we have no reason to think that it could not have occurred.

In fact, it might not even make sense to think of that initial singularity as the result of anything at all, since causality requires time and there was no time before the Big Bang. Time is asymmetric, and this is especially important when we're talking about t = 0. You cannot simply imitate it from the other direction.
You sound like my old boss :-) I used VMs to develop USB drivers with great success.

At my university we wrote basic operating system, VESA and SATA drivers were mostly developed using VMWare.

And it is possible to connect PCIe devices to VMs, but it requires lot of work.
By "execution" I meant the execution of arbitrary code, either shell builtins or other programs, the original point of this vulnerability. Function definitions should really be thought of as being evaluated to make them available for future use.
I got mine!

access.log.1:209.126.230.72 - - [25/Sep/2014:02:14:12 +0000]
"GET / HTTP/1.0" 502 172 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
> You'd argue that fencing off a five mile long beautiful beach so that nobody else can enjoy this land is reasonable

No, absolutely not! I'm happy the judge rules as she did. The disagreement is merely about terminology. I just don't think it's reasonable to say you "own" land that you can't keep people off of.
Nice.

Odd delay between getting the "probably safe" message and seeing it appear in my tcpdump.
Slightly off topic but I have been less than impressed with iOS 3rd-party keyboards compared to their Android counterparts. I noticed they take a bit longer to load and are really inconsistent on when they load. Open AppA, get stock. Open AppB, get Swiftkey. etc. On my wife's iPhone 5 she just wouldn't get a keyboard at all sometimes.
5 Tips to improve your relationship with your manager
Apple apologises for iOS 8 update bug
iPhone6 Availability Monitor for Reserve and Pick Up
Isaac Newton famously had to give three lectures to students at Oxford in order to maintain his status as a professor. His first was so dense and impenetrable that the final two were given to utterly empty rooms. Apparently that did not alter his teaching style at all.

One does not have to be a good teacher to have something worth learning from.

That said I did one of his first courses and found it simple to follow and better in the bite sized format than traditional lectures.
Everything you need to know about the Shellshock Bash bug
Which is symbolically linked to /bin/bash on many of my systems.
Replying to myself just to point bash doesn't seem to be up to date in the "official" repository at gnu.org. Are distros maintaining their own forks?
Actually the ssh-copy-id does everything described in that article and is faster because you don't have to manually copy/paste the key.
We just released a complete quick-test for #shellshock here: https://shellshock.detectify.com/. It's free to use and here's the information about how the scanner works: goo.gl/8vp6eo

Please feedback here: https://news.ycombinator.com/item?id=8366643
Animated GIF keyboard for iOS 8
Sony SmartWatch 3
It took me longer than I'd like to get all three solutions but I sure had fun finding them. Two are easy while I had to think more to get the third.
Suggested name: Virtual Keyboards Club.