skysight-inc/HackerNews huggingface dataset:
It is L^2 for infinite dimensional Hilbert spaces like position or momentum, where quantum states become functions.
For finite dimensional Hilbert spaces such as spins, quantum state is a complex vector rather than a function, and the "braket" is not an integral but vector product.

But I don't think that's even the point. The whole article is a rationalization of basic rules of quantum mechanics; when I look back at the history of physics, rationalization of known --at the time-- physical laws (which are often replaced by "better laws" after a while when get a better we understanding of nature) is most often counter-productive.
Stop Bashing Bash and GNU
Does this unofficial patch work with a source code compile of bash 4.3 and patches 001 to 026? (Does this patch work on 4.3? Does this patch need to go on top of 025 and 026, or do I need to omit 025 and 026, or some other approach?) Thanks for advice -- much appreciated!
These universal constants (vacuum permittivity and permeability) are themselves dimensionful quantities, so the same comment applies to them. They can only be measured by comparing to a reference, and there is no natural sense in which they can be said to change over time.

By the way, these constants are no more 'universal' than the speed of light itself.
The above link doesn't work for me, but this appears to be the same story:

http://bits.blogs.nytimes.com/2014/09/27/more-open-source-fo...
From Bunkers to Businesses
A Blog About Monetizing Mobile Apps
Works that work
Ultimately disappointing article ... discusses productivity in the purview of line-workers/data-entry type jobs, and clumsily tries to extrapolate to contemporary work environments/jobs that require more creativity and mental skill to perform :\
Not everyone has the most recent versions of the compilers, either; my institution is still working on the upgrade path from Ubuntu 12.04 LTS to 14.04 LTS, so I had to get a modern gcc manually compiled to get proper C++11 support, because nothing in the 12.04 package manager had full support.
I'll pose the inappropriate question. Unless you are going to do it right (RethinkDB) why write a brand new database at all (MongoDB?)
Must say I'm rather hesitant to recompile it myself with some code someone suggests will "harden" it somehow. If it's a good patch, why wouldn't it be included in the repositories? Or will it, but it probably takes a few days?

Edit: To clarify, after recompiling I would need to manually update it in the future (or switch back to the repositories once they include it). Applying this patch is not a apply-and-forget action. I don't really see the value of applying it myself, especially when I don't connect to public/company/school networks during the weekend.
The problem really is with calls like system("command") which ultimately translate to: '/bin/sh -c "command"'.

I'm quite sure that's what happens in DHCP case.
Ascii tables for all MS-DOS charsets with pixel precise graphical symbols
For Google Docs/Drive, the data transfer is simple. Other apps? Not so much. And that's not even getting into third-party apps that use google apps authentication.
C'mon you know that isn't fair reasoning, you could say the same about running backups. Just because someone hasn't seen the need for backups for three years after numerous customers doesn't mean thats a good enough reason to not keep backups.

I'm not saying you shouldn't use Mongo, but to say Aphyr's assessment of database shouldn't be considered in all deployments isn't wise.
I respectfully disagree with the Daniel's blog post. Changing a password should not inherently reset all application-specific passwords, and though he doesn't mention it, it shouldn't revoke all OAuth associations either.

Perhaps I look at it in a different view point. Application-specific passwords, username/password combo, and OAuth are all separate authentication methods. The compromise of one shouldn't necessarily compromise the others (though additions/modifications subsequent to a compromise should be suspect). When the protocol for disabling a user is that you use the reset password functionality, that's using the wrong tool for the job. This is especially true when a disable user button is quite prominent on the Google Apps admin dashboard.

I worked in a K-12 school district for a while and password resets were a fairly frequent event. We also had many other web services that used Google OAuth. I'm not sure I would be keen on having to reset all of their accounts every time they forgot their password. At least 95% of password resets I did were because of forgotten passwords (remember, Google Apps doesn't have a forgot password system) and not due to a compromise or suspected compromise.

Finally, I'm not really sure what the point of changing a user's password to disable an account is. The argument could be made that you might want access to some of their data, but there's other tools in Google Apps admin dashboard for that. Want an e-mail audit? That's there (well, it was an API when I last used the dashboard extensively). There's also tools to migrate all their Google Drive data to another user. If you have the higher end Google Apps account, then you'll have Google Apps Vault which will give admins access to almost all of the user's data even once the account is suspended.
Headline is stated linkbaitly, poorly.

tl;dr: Admin reset password to disable user access, was irked that app-specific passwords were not revoked. Did not read docs how to revoke app-specific passwords.

Should there be a simpler interface for admins? (Revoke all access YES/NO?) Arguably, yes. Is this a vulnerability? Arguably.

My complaint with the headline is that it implies that Google App organizations are at risk RIGHT NOW and that these organizations should be up in arms RIGHT NOW.

Instead, there is a mild to moderate risk of continued access to very specific data - which will vary by organization - by terminated employees whose access should be revoked. In the case of email, e.g., they may - and likely do? - already have all their old email on their computer, so the risk increase is mild for this case. Other apps will vary.

Better headline: Google Apps user deprovisioning controls inordinately complex, may lead to post-termination security exposure
Florian (the author of the new patch) is from Redhat - not just a random internet stranger.
DIME, Formerly DarkMail, Promises Secure Email
See https://news.ycombinator.com/item?id=8378203
Gosh, you are so clever.
So then surely Mint's (or Ubuntu's) team will include it in the repositories?
Erm, no?

Try installing a copy of Half-Life 1 from '98 on a modern machine (go on, I'll wait).

Note that it runs just fine, other than being confused if you've got more than 4GB of ram (which you can fake and fix in other ways).

Windows had a lot of DLL issues, but the VC redstributables and vendors packaging their own blessed libraries solves almost all of those issues. I'll take that over the crackheaded Linux story any day.
So you're saying it'll be included, but it might take a few days and it's better to get the update right now?
Agora Tor Market Hacked
Quantitative Easing: Who wins and who loses?
The issue is that the environment isn't a bash-specific thing. Anything can and regularly does set environment variables, and there's no space in there to set a flag for "this is executable" - if it's in the value, anything can set that flag, and the problem here is triggered by programs setting environment variables from external data.
GamerAid- Lets Raise Awareness
He'd have to, or else lawsuits.
Stuff like this makes me really regret being a C++ developer. Companies and projects are adopting new features at a glacial pace and yet the programming world is still moving forward and it feels like despite the best efforts of the committee and the compiler teams C++ is doomed to continue being a 'legacy language' as companies either continue migrating to C# or sticking with C++98.
Application Security Charter
Looks like it's in Ubuntu's build:

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 12.04.3 LTS
Release:	12.04
Codename:	precise
$ dpkg -l bash | tail -1
ii bash 4.2-2ubuntu2.5 GNU Bourne Again SHell
$ foo() { echo foo; }
$ export -f foo
$ env | grep BASH_FUNC
BASH_FUNC_foo()=() { echo foo

Is this a correct test?

Probably as of about 13:27 UTC yesterday, if I'm reading correctly here: https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/precise...
Does postfix stop the procmail MATCH shellshock attack? And how - does it mangle all mail headers?
https://news.ycombinator.com/item?id=8363738
I think they have: https://news.ycombinator.com/item?id=8378320 It'd be good to have confirmation that my little test is correct, though.
Has anyone else noticed the 4 or more tabs in a row layout bug in latest stable Chrome?

https://code.google.com/p/chromium/issues/detail?id=418268

It's interesting that it happens in .124 but not .122. Does anyone know if it's possible to see the list of changes between those releases?
I disagree, the article did provide examples that may have boxed you into such a narrow conclusion; delve deeper and you can see the fundamental attitude that is still relevant in a modern complex global economy. Creativity and risk-taking can drastically improve production, for this reason many corporations hire experts to create environments that spur and foster such culture. Methodologies might have changed, but the core concept has not.
I never said anything about percent of food, my comment was based on type of food. We have huge subsidies for some types of food. That does not mean ex: pot growers get a large subsidy. It's really a fairly narrow group of foods which get the vast majority of subsidies and are then produced in truly mind boggling quantities.

There was a great corn documentary a while ago where a small processor kept making larger larger grain silo's for a while as productivity increased. Until, they simply gave up they now just have a huge pile with a tarp over it. http://www.imdb.com/title/tt1112115/
Awesome, that fixed my issue, thank you
It's really incredible how much time qmail has been alive without any security hole bugs and still distributions use sendmail by default.
There's an interesting article on negative probabilities by Gábor Székely in which he shows that they can be generate by flipping a "half coin" -- a coin that, if flipped twice, gives the result from a single flip of an ordinary coin.

http://wilmott.com/pdfs/100609_gjs.pdf
Which makes you wonder why they even bothered including the app on the iPhone 5. It's got to be the most pointless app on my phone.
Unfortunately, the evidence with vegetarianism points towards the opposite. In addition, a healthy vegetarian diet includes grains, including rice and potatoes, to make complete proteins when paired with legumes. Sure, you can go overboard, but so can everyone else. Nuts are not a complete protein and still need paired: Avocados are a complete protein, but there isn't all that much in it. Sure, they are healthy and variety in diet is good, but more isn't necesarily needed.
The more I look at these measures, the more I wonder whether Apple has a plan for all of this or if they're just throwing spaghetti on the wall and seeing what sticks. Some of these seem like there's tie-in (body measurements can be assessed through a Withings scale, sleep can be assessed through a Jawbone UP or similar device, and the "Me" section is mostly static), but does Apple have any plan to get people to track their Molybdenum intake on a regular basis? Or their BAC? Or their body temperature?

I'm not saying they need to, but in the past it has seemed like when Apple provided an affordance, they also had a clear use case. If nothing else, you could fully use the device/service in the way they describe, and that would sufficiently justify its adoption for many. With Health, I'm not seeing that. I wonder if this will threaten the overall adoption of Health, which in general seems like not a terrible idea - anything that gets people thinking more about their activity and diet seems like a good thing.

One could argue that their solution is to leave it to third party devices and integration. Apple doesn't need to make a scale to help you track your weight (Withings has already done it, as I'm sure others have), nor does it want to touch the quagmire that is nutrition by claiming to measure the nutritional value of any food. Let some food-related startup do that dirty work, as long as Apple provides some interface for the measurement to end up in this data silo.

This argument seems weaker to me than the argument seemed when Apple first started accepting apps for the iPhone (later iOS). Health currently leaves huge swaths of its UI barren for lack of data, and I'm not sure that hardware developers can swarm to fill in those gaps the way software developers could with the platform.

Maybe I missed the part of their talk where they made it obvious how they envisioned Health (and HealthKit) to be used in a fuller way; if that's the case, I'd appreciate a pointer.
Scott Aaronson.
A new way to pitch, or just amateur behavior?
Shellshock: a bug bigger than Heartbleed?
So,hypothetically, if in the future we do get household 3d printers, large ones at that, and we can 'print' out our cars. And that whole "You wouldn't download a car." becomes a very real thing. Do you think we would be able to come up with a way to prevent 'Car Piracy'?
One caveat is that I haven't gone through YC, however I am running my own startup right now in Los Altos/Palo Alto.

Our next biggest expenses after salaries are legal bills and IT stuff. I believe YC really helps keeping the legal bills down (we're not so lucky), and many cloud services companies will offer you free cloud servers (including my own; do you need any instances?). Oh, also, office space costs an arm and a leg here, but presumably you can just work out of someone's house in the true start-up spirit.

Other than that there's not much to worry about at first unless you need a foosball table. You're not going to have much time to play it though.
You can't. Others in this conversation have pointed out this is targeted for 9.5, though it may available as an extension before that.
In fact, it's explicitly listed in the man page for qmail-command:

ENVIRONMENT VARIABLES
qmail-local supplies several useful environment variables to
command. WARNING: These environment variables are not
quoted. They may contain special characters. They are
under the control of a possibly malicious remote user.

edit: which is to say, yes, djb thought of it a long time ago.
AFAIK, Florian Weimer is also in the Debian security team.
The fundamental constant you're looking for is the fine-structure constant (often referred to as alpha). It's a dimensionless ratio of physical constants, and if its value changes, physics is different.
We are currently building a system that does this, but it feels inefficent.

First, write the job to the DB, then put a message on the queue to notify the job processor(s) that there's work to be done. The processor then updates the DB to indicate that the work is done.

The goal is, of course, to prevent polling the DB via repeated queries for jobs. But wedging in an entirely new layer/API/messaging server just feels like overkill for the simple task of initiating a job.
I came here to say precisely this. I didn't even know Asimov at the time; I started with some of Arthur C. Clarke's stuff). Years later I had to hunt it down to find it again, and that resumed my love affair with Asimov.

It's hard to believe he was 21 when he wrote Foundation. Easier to believe when you see how profound he could be in such short bursts as with OP.
>> Which countries can be left safely this way, in view of the border patrols? :)

You knowingly misrepresent my point. That is the only argument you have left. Sad.:-(

People couldn't leave East Europe freely, unlike the democratic world. (Hell, Romania charged Germany/Israel to let German speaking and Jewish Romanians leave.) And if they tried anyway, they were shot down.

Again -- I stopped reading after the first paragraph. If you hand wave at references with links to real research, you're just not serious.
Its not impossible to eat a vegan ketogenic diet, but its much harder then if you consume animal fats / protein. Vegan and non-vegan ketogenic are already very restrictive, making a ketogenic vegan much more restrictive then either. Also, many people in ketosis have very low blood sugar as their body is mostly running on ketone bodies like β-hydroxybutyrate in lieu of sugar.
3rd party apps and fitness trackers will be able to feed data into the app now that 8.02 is out.
What’s the Big Idea? David Ermitage on “Big History” (2012)
In most cases dhclient scripts are written in bash. In any case they are executed by dhclient-script, the shebang of which - at least in Ubuntu - calls for it to be executed by /bin/bash for the specific reason that the maintainer did not want to rewrite out bash-isms when the default system shell was switched to dash.
> Go is mostly used PHP, JavaScript, Python, Ruby etc, developers today

Could be dynamic typing has had its day, just like visual programming from the 1990's. Or maybe users of those languages wanted to use one with a large corp backing it, like Java and C# have. The most common glib response I get when I say I'm trying out Go to write something is "You're using Go? So you wanna work for Google, do you?" Perhaps that shows the real motivation of why a programmer learns Ruby or Python or Go.
discussed at http://www.solutionary.com/resource-center/blog/2014/09/shel...

Bad news.
It looks like you're right. Thanks!
There is some research to support this however it is by no means conclusively demonstrated

More likely there are contributions from multifactorial elements: some propensity to form Amyloid plaques (from APP mutations or downstream processing mutations), some contribution from tau; there is a significant body of evidence to show that APOE3 carriers (cholesterol transport proteins) have a higher risk (something particularly relevant for myself given I am an APOE3 heterozygote) and the more recent 'type 3 diabetes' studies, which seem promising however the way they are bandied around by the 'sugar is evil' crowd my gut feeling is that they push the line a bit more vehemently then the evidence would suggest at present
I don't see a security vulnerability, but bad security practice.

Either they: Delete the account. All is well.

Either they: Take over the account. It is common sense then to change the phone number associated with the account. All is well.

You could solve this "bug" by reading the documentation and creating a better security protocol (which is currently putting your organizations' data at risk).

I clicked the title with just one thought it the back of my mind: "If this is an active serious vulnerability then why did OP not apply for the vulnerability program and have it fixed beforehand"?

My experience with the vulnerability team has been great (one honorable mention and one pay-out). If you did not get an honorable mention then it means the security team did not file a bug report. Your feedback could probably still be used to improve the UI.

As an aside: Hunting real security bugs on Google domains is insanely addictive (because they are so hard to find). Try to generate all their different error screens. Try to find the Google property running on aspx. To practice there is also https://google-gruyere.appspot.com/
Not sure why this article is on Hacker News.
Maybe a small note, but the variable needs to start with the bytes "() {", not the characters.

For example, () {̀ also triggers the parsing code. That's a ` over the { using Unicode.

FWIW, I haven't been able to actually exploit it this way, but referencing that variable in the new shell generates errors, so there might be something there:

bash: () {̀ :;}; echo vuln2: invalid variable name for name reference
It should work on top of the original patch with 4.3. Don't omit 025.
Doesn't seem to happen on Chrome 37.0.2062.94 on Linux Mint.
This is a must read for anyone interested in the possible connection: http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2769828/
Are we running this VM inside another VM?
A Company That Got Rid of Email
I worked at a mass notification company that used a similar approach and it worked well with a handful of workers pulling in batches that could push out 300 to 500 of messages per second and could queue a quarter million messages in a few seconds. There wasn't really a need to optimized past that since the throughput on the rest of the system was the bottlenecked by outside components.

The problem with queuing in {insert new hot queueing system} is that persistent and failover support is often weak. They are by default are more efficient and simpler than RDBMS. If you're running Snapchat, Redis or RabbitMQ or whatever is entirely reasonable.
ML programmer's guide to ATS (2008)
It's somewhat complicated.

The changes to Chromium itself are here:
https://chromium.googlesource.com/chromium/src/+log/37.0.206...

But this is more likely to be a result of one of the underlying repositories. For instance, it looks like Blink was rolled back from 091cb19dc52917020bfda19b2a41d8f097c02d92 to 6894b21e75041bc3e050a7591388f866cbe7282b.

Thank you for reporting this level of detail; having a narrow revision range is helpful for tracking down bugs.
I think the reason Apple didn't market this to us is iWatch and the lack of third party integration as of now. They might be wanting to show this off as part of iWatch integration or let the third party apps do the marketing.
That is one position, yes, although surprisingly not all that common among working scientists, because it's often seen as too skeptical of a position. The strong version, "instrumentalism", boils down to roughly: science does not discover any "truths" about the universe, but rather is just a process of building mathematical models that correctly predict observations. And we can say little else about these models except that they predict experimental data accurately so far. In particular, in this view, we cannot say that any components of the mathematical models are necessarily physically "real" or in any strong sense "explain" reality, merely that they correctly predict observed regularities.

Despite not being that popular a view among scientists generally, it is however a fairly popular view among quantum physicists, many of whom aren't that willing to commit to the physical reality of a good deal of the mathematical apparatus of QM.
> Only an idiot does unit conversions in their head.

Or every elementary school kid outside the few countries that still don't use the metric system as it's a pretty common exercise.

I probably shouldn't have answered as I'm pretty sure you're just trolling.
The best I can tell is that the Health app is more of a hub to see aggregated (raw-ish) data, and set/update permissions on what apps have access to what data.

I don't think their intent is to compete with any of the apps out there that use the data though.
I'm not quite so sure about that. One of the early examples I've seen of Unix use (I think Ken Thompson was actually in the video, from early 80's) showed using the various tools to process file data that got downloaded from somewhere else (where that data was supposedly created by another user). So if you had a script that did:

cat downloaded_file.txt |\
while read inputline
do
#some processing
#call another shell program
done

In this case, bash would still be vulnerable even without the Internet involved -- just processing a data file you got from Bob in Accounting.
What drove this home for me was the inclusion of a separate measure for BMI.

I've already given it my height (hopefully static, but apparently deserving of a line graph), and my weight. Yet apparently calculating my BMI from these inputs (admittedly a crude measure of health) is beyond the capability Health app?
We're cutting out cholesterol from the diet. Of course there's going to be an Alzheimer's epidemic.