skysight-inc/HackerNews huggingface dataset:
Hey xtrumanx,

I do work at AWS - npinguy does not to the best of my knowledge - and we're looking into a refund for madaxe_again. I'm hoping for a reply from him so we can get more details as to which company this is for, as we'd need that to get the refund process going.

At AWS, we work to keep prices as low as possible and we definitely don't like seeing customers spend money where they wouldn't normally - for example, in reproducing a bug at our request. We're totally happy to look into getting some a refund, and if there's any frustrations with AWS that you or anyone else has, please don't hesitate to let us know.

The current security issue that's causing the need for rebooting EC2 instances isn't something anyone wants, and we do not take steps like this lightly. We work to make sure that the EC2 platform is stable and secure, and in the event of a bug that causes security issues that have the potential to affect our customer's infrastructure that runs on AWS, we want to make sure that the impact is as minimal as possible. In this case, we did not have any other options unfortunately, and we are working with our customers to try and keep the impact as minimal as possible. If you're an AWS customer and you're having issues caused by this (or anything else), please contact us so we can assist you.
Can you elaborate on this? I'd like the understand what you mean.
Any weekend compiler project can be faster than CPython.
Wrapping Your API in a Custom Ruby Gem
It's less about writing CGI in bash, and more about writing CGI, then eventually calling system() from within the CGI program.

This is very common, particularly with monitoring pages, etc.
That does not justify a graph with no numbers.
How can a bug be evil? Don't attach morals to things which should be amoral.
I am currently using this. Its not the best but I prefer a mechanical keyboard :)
http://eshop.macsales.com/item/Matias/FK302/
I'm not sure how you interpreted me as a denier or opponent of sexual selection theory. I was pointing out that that very Wikipedia article you refer to clearly states that sexual selection is a mode of natural selection, which is the case I'm making.

I wrote a lengthier answer to Peter Whittaker. Check it out.
But then there's the "Many eyes lead to a sense of complacency" issue -- like "No-one ever got fired for buying IBM|Microsoft|Blackberry"
Pennies for iPhone – Best App Ever
This criticism has no content. You like Go better, that's fine. But that doesn't mean it would be "more suitable" for these microcontrollers, because the whole point of these is to run a dialect of Python, which is novel. If you want to write in a low-level language there are already many microcontrollers you can trivially program in C or whatever.
+100 LNG RATS
I honestly can't see why this is "fine"... I understand it's not the security critical bug, but feeding all environment variables into some sort of interpreter...?!?

Ok, bash needs to transfer function definitions to child processes in order to implement something called inherited functions, and I guess you could argue that an environment variable is a reasonable place to store them. But WHY THE HELL does bash have to use the function name as the variable name?!? That's just insane to me...

Any sane programmer would store that shit in an environment variable with a known name (e.g. "BASH_INHERITED_FUNCTIONS"). Why doesn't bash do that?!?
And functions with malicious shell script appended at that! ;)
My understanding is that that doesn't work correctly in the case of AZ failure; the EBS data isn't duped to another AZ and so your instance will fail to come up. So it's not really a solution.
It's not about the website, it's about an initiative. Strangely, there's too much fixation on the website here, not the business model that would or wouldn't work.
Well, let these _admins_ worry about this. This is of no concern for the moment for a regular Linux or OS X user.

Now, an admin _must_ know every service running on entrusted boxes facing the Internet. CGI scripts hopefully are not common these days. If you run them do stop for other reasons.

So far every "attack vector" implies having shell access to the target machine in some form. No need to panic for majority of people.
You say that as if all venture capitalists are saints. And only Vinod is evil.
It was also already taken by a device for fastening things. And my name was already taken by at least three people before me. Somehow we all get along.
That was my first question as well. The behavior sounds like exactly the kind of magical weirdness you get with shells. Your question is asked and answered here: https://stackoverflow.com/questions/26022248/is-the-behavior... The answer given there is that the behavior is NOT a documented feature; it's a side-effect of how bash implements inherited functions.

I was also very confused about why a web server would need to store HTTP headers in environment variables. Why would a mature piece of software like Apache do something so hackish? The explanation turns out to be very simple: it's how CGI works. Headers are passed to the CGI script as environment variables. If you don't do it that way, you don't support CGI.

There's one thing that still confuses me, though: why would a CGI implementation use the shell to set environment variables? Why would you use a complex, idiosyncratic piece of software that comes in many different flavors instead of just using the C setenv function?
Yes, you can ask it to ping an address you control and record where the pings come from.
I have no sympathy really for people who use `system()`-style calls, or bash in their web servers. Bash is fairly obviously designed with complete disregard for security. I seriously doubt this is its last major flaw.

But anyway, is it really that common? I would have thought most CGI scripts are Python, Perl, PHP, etc. and don't use `system()` type calls. Right?
Simple Aspect Oriented Programming (AOP) Using CDI in JavaEE
I really like the opp.io way of messaging. We are very excited about the idea, even if it needs some fixes, but hey! it's still not in beta yet!
We look forward to use it every day basis in our team.
Investor resigns after daughter,10, hands him list of milestones he's missed
Yes, and silly Google for making the URL for Go "golang.org". Someone should let them know it's called Go, not golang!

This is like the new "It's GNU/Linux - NOT LINUX!" Except with less validity. It's totally interchangeable in common usage, and in fact much more explicit to use the term "golang".
Why is the submitted URL to "tcgtrkr" which, according to Google, is "Instant access to millions of criminal, sex offender, marital records and more with Instant Checkmate. Find out the truth about anybody"?

Additionally, why do you have a affid=196 URL parameter?
Building a better and more diverse community
In my case, both linkedin and tumblr e-mail addresses have been leaked somehow. It was definitely not a simple dictionary attack, based on the addresses I used.
No need for a conspiracy, we are looking at flat out idiocy here folks.
Programming with functions
Startup founders surely do have the luxury to choose who to take money from. Really.

Startup is a high-risk project, most people who take high risks have some sort of acquired resources and/or social support. Also most of startup founders have skills that are in demand equally from SMBs and corporations. That is another advantage that founders have.

Also, survive? Doing on average better than 90-95% of people on this planet is quite far from having problems for securing food for the day and lodging for the night.
>People seem to want the government to mandate the private sector implement these policies, however the U.S. Code is not structured in a way that encourages restrictions on private companies in this way.

This is basically false. There is nothing about the structure of the U.S. Code that is hostile to mandates on private employers, and in fact the content of the U.S. Code already includes wage/hour/leave mandates on private employers.

It doesn't include paid parental leave mandates for private employers, but there is nothing structurally that supports the current mandates but would need to be changed for that specific mandate. Its just that federal decision-makers haven't adopted that specific policy.
If you are just doing a single page its not that different, but if you are building a web app and trying to tweak the CSS inside a modal or something that isn't there on page load it makes a difference. Instead of refresh -> click button to show modal again, it lets you see the changes as you make them.
Well, writing in Go is just as nice as writing in Python in my opinion. But I understand the whole point of these are to support python. Thats ok.
Please give me an example of how somebody not running a Web server and a collection of CGI scripts is affected. A git server? Are you running one of these? Move on, nothing to see for most of us.
Got any ideas what I could put in there?
What if AWS goes pop, runs out of cash?
It works really well. It's a subset of CL that it can compile though so you'll miss out on CLOS, restarts, etc. However the subset does include macros so it's serviceable.
Reminds me of the app the show hidden public gates to access Malibu beaches http://www.nytimes.com/2013/06/13/us/in-battle-over-malibu-b...

android version https://play.google.com/store/apps/details?id=com.escapeapps...
Some good points, but I wasn't trying to equate entrepreneurship with individual success or happiness. I was talking about our broader economic ecosystem, with the managed organization as the primary unit, not the individual.

The question was, what approaches are required for the individual (an entrepreneur) that creates such a managed organization to build a sustainably, very high wealth producing capability?

In this, I do not think your analogy of apex predators follows. Most companies live and die quickly, those that become pillars of wealth and last 50 years+ have tended to carve out monopoly (by their apex predator?) status in certain areas such that they can diversify into new ones.

This is not to say that all organizations need to be pillars of wealth and last two generations. There's plenty of room for survival and happiness with lifestyle organizations. But I wouldn't necessarily call people that start such companies entrepreneurs, I'd call them "small business owners" or "self employed".
> This isn't an economic discussion, but one about which kind of society we want to live.

Its both -- indeed, decisions about which kind of society we want to live in are usually economic decisions (as they are decisions about the preferred rules for distribution of scarce resources.)
Introducing paste searches and monitoring for “Have I been pwned?
Puppet Labs Announces the Next-Generation Puppet Server
So are they policing all the corporations with this law too? Or just Average Joe?
Is it possible for you to make the source for your test publicly available?
Please update your profile's link to Project Marilyn. I almost skipped away and forgot about the whole thing when I saw that you weren't accepting donations. However, you are accepting donations, just at a different page.

Also, I donated some BTC and then felt like increasing it but browsers I use are now reporting coinbase in a redirect loop. You're losing money here, man.
Presumably because Go is hip, new, favoured by people on HN for some reason, etc. ?

The attitude that once a new language comes out we need to drop all the old ones is not very helpful. Python is used by many, many people (more than Go, I'd venture) and having it available in something like this instead of having to work with Arduino and others which can be less user-friendly is spectacular.
First of all, if you want to use python, use it. However go is imho more suitable since

- Python doesnt do parallel programming well, Go does (and low level programming is often async)
- Go compiles to machinecode already (it will be faster, which is often important on lowend hardware)
- Go is just as nice to write in as in Python (!debateable i know!)

So all in all, python doesnt seem a right fit.
I've worked with sysadmins that insisted that CGI be disabled for exactly this reason. If we wanted a dynamic website we needed to use mod_perl or mod_php (it was back in the early 2000s, Rails/Django/nginx hadn't yet been invented). It wasn't a perfect solution - both of them still had plenty of security vulnerabilities - but it cut down the attack surface significantly.

Now I understand what all the security people who said "never use system(). Never, ever" meant.
Docker VM shortcomings and how Hodor can help
From FreeBSD manual page for 'sh':

DESCRIPTION
The sh utility is the standard command interpreter for the system. The current version of sh is close to the IEEE Std 1003.1 (“POSIX.1”) specification for the shell. It only supports features designated by POSIX,plus a few Berkeley extensions. [...]

Again from FreeBSD manual for 'bash':

DESCRIPTION
Bash is an sh-compatible command language interpreter that executes commands read from the standard input or from a file. Bash also incorporates useful features from the Korn and C shells (ksh and csh). Bash is intended to be a conformant implementation of the Shell and Utilities portion of the IEEE POSIX specification (IEEE Standard 1003.1). Bash can be configured to be POSIX-conformant by default.

These two shells are different and the reason that FreeBSD keeps '/bin/sh' is because it was designed to be secure and reliable instead of full-featured. Makes sense as a choice, it is aligned with the general UNIX philosophy: do one thing, do it good, keep it as simple as possible.

Given the fact that the bug was found in bash, I guess it's just (another) win for this harsh philosophy that so many geeks seem to strongly embrace.
If you're having trouble paying for food, you should probably find something other than founding a startup to occupy your time.
We don't have a lot of options for removing him, a few, but not many, one of the most likely is is party throw hi out fearing he is personally is killing their political careers.
Rust is interesting one. The only part I dislike is the pointer ownership. Can they work out a better model/analogy after 15 years of Boost?
A CGI script may not be PHP - it could actually just be a bash script, perl, whatever.
5 Days with iPhone 6
I'm a python developer myself. I just started with Go. I'm just saying that Go fits microcontrollers better. Its cool to use Python. It doesn't matter much.

I'm just saying that cool would also have been a good fit.
Ello, Ello? New ‘No Ads’ Social Network Ello Is Blowing Up Right Now
Ask HN: AngularJS for a large-scale news website?
Having the opportunity to redesign a very large newspaper online portal, I am considering to develop a prototype with the Angular/Bootstrap package.

Companies like MSNBC or Redbull Media drive large news sites with Angular, which seems promising to me.

Other than that, I feel most well known references target a different low footprint/high complexity application profile - rather web apps than classic content sites.

Do you have experience with Angular in combination with large footprint rich media sites?
Looks pretty slick!
Building an API for a Mobile Client with Rails
Who Is Su: On Amnesia
I can get a full raspberry pi for less than one of these though and run linux with python. Seems less useful/practical for a hobbyist.
I have a house not far from this debacle and I can see both sides of it, but what don't understand is that there's a million miles of coastline, well, miles and miles and miles of it, all equally good as Marin's beach. I'm sure it's the principle of thing, but one little stretch really inconveniences nobody and the vast majority of the coast from HMB to SC is completely open, undeveloped and fully accessible. If we really want to protect everyone's writes and access we should be pushing for wheelchair access and braille signage too.
> Google is a “platform for piracy and the spread of malicious networks”

So, like Sky Broadband in the UK, then?
Go binaries are too large for microcontrollers, you'd need some cut down version. Hello World comes out to ~500k on its own see: (shameless self link) https://donatstudios.com/Golang-Binary-Sizes
I like it a lot! Any way you could have it sync with Firefox?
Single Dad
A fight over rooftop solar panels
Gnome 3.14 Video Published
Silicon valley "rat trading" funding announcement in 3... 2... 1...
RethinkDB 1.15: Geospatial queries
Why do you offer it for free?
this sounds so orwellian. Should my dealer have told me if there was such a device in the car I recently bought. If not, is there a way to find out. Not that I'm in danger of missing payments, but it seems like I should be informed of such a device in the car
Developer here!

I've been working on Javelin since Feb this year and this is the 4th iteration, and on Reddit (r/android), and just a quick interesting byte. Javelin actually started as a "porn" browser! See: http://www.reddit.com/r/Android/comments/1xblv9/hey_reddit_s...

PS: I'm headed to SF in October, anyone wanna grab a beer/coffee? I'm contactable at hello@javelinbrowser.com
There are a TON Of servers out there running PHP through good ole CGI. I would imagine that some of those are running web apps that lots and lots of people use. Meaning you now have shell access to those machines.

Mining username/passwords is probably going to be pretty simple. I wonder how many of these machines have credit card numbers stored in the clear? I'd bet that there's a bank somewhere running in exactly that configuration.

It's a big deal.
Maybe not-so-related, but "clasp" is also the name of a pretty popular Answer Set Programming (ASP) solver (link http://www.cs.uni-potsdam.de/clasp).
Yes, a local beach access dispute would not way into the decision for funding from him.
Right, but my point is that the user has control over giving motion data from the M7 to the Fitbit app. The user does not have the same privacy controls for the Health app. I cannot switch off Health app access to motion control in the privacy settings.
The API is there but it's closed for now as it is just not ready for other developers (too raw). Also, not a firefox user myself.
As a citizen of Uruguay I find the last paragraph very funny:

“I feel about the same obligation to file US tax papers as you would if the supreme court of Uruguay all of a sudden decided you were a citizen and had to file a tax return there,” he tells the Guardian.

By the way, Uruguayan citizenship is VERY easy to acquire. American expatriates (and dollars :) ) welcome here :)

Edit: easy as in requirements. There's a lot of paperwork involved.

http://nomadcapitalist.com/2014/03/09/top-5-best-second-resi...

http://flagtheory.com/citizenship-in-uruguay/

"It will take approximately 3 years for a married couple, with a good amount of time spent in country. For singles, it will take 5 years – with a similar amount of time in country. This makes Uruguay more attractive for married couples rather than a single applicant.

Uruguay wants you to prove your residence by documentation – sometimes odd documents such as a doctor’s appointment slip, a library card. The idea is that they really want you to prove you are actually living in the country. This documentation is again, not always what you might expect – so document everything and when in doubt – shoe box it.

After you have received permanent residency, you should talk to an abogado about citizenship and travel document options. Again, permanent residency is required to be able to receive any kind of travel documents. Further, a cedula is somewhat considered a travel document as well and can allow you to get around South America in many instances.

Strong Travel Document

A Uruguayan passport is one of the strongest in the world. Under this passport, you can visit Europe visa free, and most Uruguayans have a 10 year American visa."
"Blowing up". really? Based on the actual article content I would have said taking off, ascending, something meant to convey that Ello is seeing more users and more prospects. "Blowing up" is, at the very least, ambiguous in its meaning.
ClojureScript already exists, and even if it's not Common Lisp, its still Lisp with homoiconity, macros and what not.
Astronomers have found water vapor in a planet in the constellation Cygnus
http://www.astronomy.com/news/2014/09/major-milestone-in-the-search-for-water-on-distant-planets
I remember a time, back in my QuakeWorld addict days, when I use to read .plan file updates.

Are there any technical reasons why the old finger / .plan system couldn't be revived to replace facebook, twitter, etc, with an open and simple social network?
They are being more stringent with foreign banks that deal with Americans.

The foreign banks respond: "Ok, we won't deal with any Americans", which makes life harder for Average Joe Expat
It is correct that PHP's mail() function will fork a shell:

sendmail = popen(sendmail_cmd, "w");

Which calls /bin/sh to execute sendmail_cmd. However, two things must also be true:

1. /bin/sh is bash

2. PHP has set environment variables with user-provided data

#1 is often the case, but is much less common now than in the past.

#2 is not commonly the case, PHP does not even automatically create PHP variables from user-provided data anymore (because it is a terrible idea to put untrusted data into a trusted scope without sanitizing).
5 Things Every Developer Should Know About Syslog
That's actually quite clever, wrt. generating everyone who applies a nonsense pseudonym so there's no unconscious bias happening in the pre-selection process.
Actually you said "much better suitable for these microcontrollers" which you haven't explained yet. I think that's why you're getting these comments. I don't use GO, and think the Rasberry Pi is better than this thing anyway.
It's not as hard to do business in India as it is in Brazil.

<edit> We do about US$800m/yr revenue there.
First patch for Shellshock may not be a complete fix
There is a Pro upgrade as an IAP. There's also an in-built proxy/vpn service in the browser. This is how I see myself growing Javelin down the road with the browser as the razor, and value-added services as the blade.
> How micro is micro?

The reference board for Micropython is the Pyboard, which has a 32-bit ARM chip running around 168 MHz and with 192 kB of RAM. It's legitimately the kind of thing that gets called a microcontroller. Quite a bit cheaper and less powerful than for instance a Raspberry Pi. (Though note the Pyboard isn't significantly cheaper than a RasPi, because it's not being manufactured at the same scale).

Regarding memory footprint compared to C, well it's Python. Reading from the Kickstarter page, the interpreter binary is 60 kB and it can run 'hello world' with an additional 4 kB of RAM. And there's memory overhead for Python objects (32 bytes each apart from integers). Garbage collection takes around 4 ms.

I got my Pyboard a few weeks ago when the store was opened to people who expressed interest after the Kickstarter campaign had finished. I haven't pushed it on performance yet, but it's easy to use and it works. It feels strange (but great!) to have Python running on such a limited system.
Yes, I'm getting really annoyed seeing comments like this pop-up repeatedly, ash has no exporting of functions even:

# type foo
foo is a shell function
# export -f foo
-sh: export: Illegal option -f
I think the most mundane ones are the most useful. Just seeing the subject of an email or a text message that comes in is enough for me do decide if I need to get the phone out and reply or take some other action.
The micro python board has a way smaller footprint and consumes less power than a pi. And sometimes, there are projects where a full OS and all the peripherals of the pi are just overkill.

Don't discount this board as useless just because you in particular have no need for it.
I agree but you are posting on a forum which consists of web developers who do not care too much about Indian politics.