skysight-inc/HackerNews huggingface dataset:
It's a big deal because about half of my 100 instances are all going down at roughly the same time. Distribution and replication save you if you have 3 boxes and 1 dies. If all 3 die at the same time, you're still screwed.
I assume you're talking about the subprime home mortgage debacle? Because the issue wasn't that the loans were subprime, so much as it was the massive amounts of institutional fraud across many layers of the mortgage business that enabled unqualified people to get loans (or loans larger than they qualified for). IOW, subprime loans were the murder weapon, not the murderer.

EDIT: BTW, a subprime loan is just a loan that comes with terms that aren't as good as they could be due to the applicant having some sort of issue in their application (eg, no credit history, a bankruptcy, lots of missed payments, no collateral, lots of other debt, etc.).
BFL website changed to recievership
ButterflyLabs Placed Under Temporary Receivership
I read this book in college and was captivated. Not terribly long, but fascinating for learning how the insides of our tools work (or could work better).
https://news.ycombinator.com/item?id=8204126
Image posted on butterflylabs.com:
http://i.imgur.com/QVEc9a3.jpg
The parallax scrolling trend really needs to die.
Highly doubtful the car just shut down (unless she perhaps stalled the car). Article mentions the device is tied to the ignition.
That was one of my first thoughts as well. There is way too much code that's being exposed here. This will be a gift that keeps on giving.

For people who want to do environment sanitation, do we know what values can trigger this 'feature'? Is it only "()" as the first two characters? First two non-whitespace characters?
Can't onstar shut down/disable cars that are reported as stolen, even when they are on and in gear and moving?
As this seems a reasonable place to pose the question: I've seen (eg. at meetups) people using bluetooth keyboards with tablets turned around on stands as sort of mini-laptops with shell access.

Has anyone here done this with a comfortable hardware configuration for nontrivial developments tasks? I guess what I really want are tablets that run proper (vs. Android) Linux, can perhaps handle occasionally running paravirt at not entirely painful speeds, and (I believe this is the killer standing in the way) have hardware with open source or reliable enough binary blob drivers that are therefore safe to frequently deploy very recent kernels to without losing wifi, sound, camera, GPS, GSM/CDMA, backlight control, etc.
Yeah, if they wanted to be evil, they'd do deals with the gas companies and the further behind your payment is the worse your gas mileage
Because for someone to believe the ability to stall a moving car is ok is for them to believe the passengers are potential acceptable losses.

More likely is someone who has had a remote start block activated in the past (keeps you from starting the car) likely experienced engine failure while the car was running and associates it with past experiences.

This has no bearing on any argument for or against this practice, in any way. If it was found to be true that the engine could be remotely stalled while moving, it would be horrifying.
What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden.

Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dreaming of making a system to help debian users create and manage a local set of packages, but haven't really had a chance to take it to a point where it'd be helpful in this scenario.

My extended thoughts on the matter: http://stevenjewel.com/2013/10/hacking-open-source/
Maybe people should buy cheaper cars if they can't get a reasonable loan? I guess it wasn't clear from the article if these were loans for new or used cars, though.
To be vulnerable to this I need to be running CGI scripts right? I have my system set up with reverse nginx proxies and haproxy TCP mode pass through to things like nginx static files and Node.js servers. Can he run his ping command on my servers? I am thinking not.
It should give a warning before shutting down, and then only shut down overnight, when nobody is driving it, to ensure people are at least back at home or at a reasonable place. There's no reason why it needs to be able to shut down at a moment's notice.
This is normally what they do when they roll out forced reboots like this.

Note the forum posting says there isn't guarantee of being on an updated host...that is because the patching isn't complete across the region yet.
On a technical note, a "starter interrupt" could not reasonably affect a running vehicle (the starter motor only runs when turning over a stopped engine). However, if these devices actually operate inline with the ignition system--delivering or interrupting spark to the fuel-air mixture during operation--that's an entirely different matter and cause for safety concerns.
I don't think this is onstar. It's a third party device attached to the ignition. Ignition interlocks have been around for a long time -- though not tied to gps device as they are now.
That'd be illegal under US gov't. regulations.
Ouch - that first attempt (ping without the -c option) has probably resulted in a number of long-lived ping processes.
My understanding is that Google was really upfront about apologizing & explaining the mistake [1]. People see money signs though...

[1] http://www.theguardian.com/technology/2010/may/15/google-adm...
You are right, of course, but (IMHO) it sure would be nice to have consumer protections against such weapons.
TLDR: Far better quality than low quality JPEG, same size file. Not a replacement for high quality JPEG due to visible artifacts. Major drawback is slow processing, but tweaks and a well-parallelizable algorithm should resolve this... and be ideal for GPUs (and thus very light on mobile device power consumption).

Search page for 'as a com' to get the definitive jaw-dropping image.
Well fuck...

I make jokes about our current PM being Australia's George W. Bush, but this comes along and it now looks like we're getting our own PATRIOT act to go with our G.W. Bush and suddenly it's less funny.
It can, but it's a very different device. Rather than preventing the vehicle from starting, OnStar talks to the engine computer and can slowly reduce power, or, yes, cause it to come completely to a halt. But OnStar is also careful about when and how they do it.

See, for example, this story where OnStar waited for confirmation that the cops were directly behind the car:
http://www.theblaze.com/stories/2012/07/18/cant-just-shut-it...

Or this story about the slow down feature: http://www.autoblog.com/2007/10/09/onstar-debuts-stolen-vehi...

So basically, OnStar can shut down moving vehicles, but they only do it with the involvment of police (as far as is known). Whereas the auto loan ignition interrupts cannot shut down moving vehicles, but can be triggered with no oversight. Apparently.
It's beginning to seem a little weird when companies refer to either exiting or entering markets in various regions while remaining unchanged in others. Obviously this generally effects retail and not online sales.
I have a question to astrophysicists: what drives the progress in knowing more and more details about smaller and farther planets? Better precision of instruments? Computational power of computers? Better statistical models?
I'm starting to see automated attack attempts using HTTP_HOST headers set to '() {'.
One would think that there is at least some market for high end laptops. Whenever I look, I don't see much in the way of alternatives to the MPB though. That's partly because top of the line models are buried under a pile of 'deals' and other consumer junk.

Maybe there's an opportunity to put together a site that aggregates the top-shelf models from various manufactures with efficient filtering on features geared toward raw performance and build quality (shell materials, keyboard, etc.).
Excellent point.

Apache actually passes along any HTTP header, even undefined ones, as CGI environment variables (of the form $HTTP_HEADERNAME) so an attacker could just make up a header and it would be very unlikely to be logged.
As an analogy, suppose I go to a website written in PHP and register with the username "Robert'); DROP TABLE Students;--". A correct PHP script will sanitize the name; it'll escape the quote and run something like `update users set name='Robert\'); DROP TABLE Students;--'`. If mysql then ignores the backslash and drops the Students table, that is definitely a mysql problem and not a PHP problem. Doing any more on the PHP side to "sanitize" the name would actually break the script by screwing up valid names.

In this case, the shell variables are correctly sanitized by Apache or whatever, and then mishandled by bash. For example, imagine this very simple system:

- Web server receives a GET request with the user's name.
- Web server sets the environment variable USERS_NAME='<whatever was submitted with quotes escaped>'.
- Web server sends back the result of running `bash print_welcome_message.sh`.

It might not be considered great design, but there's nothing inherently insecure in this system, and there are plenty of actual systems that more or less work this way. And it's also perfectly valid for a user to have the name `() { :;}; echo vulnerable`. It ought to work fine to set USERS_NAME to that value and send back `Welcome, () { :;}; echo vulnerable.`

Instead, an unpatched bash will execute the contents of USERS_NAME. The only way for the web server to prevent that would be to change the user's name, which would be wrong behavior -- given a properly working shell, it would print the wrong name in the response. The web server does its sanitization job correctly when it successfully sets USERS_NAME in spite of any single quotes or what-have-you -- this part isn't its problem.
Good California. Funny how some smart and generally good people can also forget the law applies to all equally (or at least it should).
> Because for someone to believe the ability to stall a moving car is ok is for them to believe the passengers are potential acceptable losses.

This isn't as outlandish a thought as you imply, especially when it comes to vehicles and the sales practices around them. Also, someone could believe it's okay to stall a car at any time without even considering the ramifications in the case that it's moving. All they need to be thinking is "deadbeat owes me money, brick his car." Any questions of timing, context, ethics or other considerations needn't enter into the picture.
I've taken a Written Business Communications course as part of my studies a while ago which used this book – http://www.chapters.indigo.ca/books/essentials-of-business-c...

It explains the basics – styling, structuring letters / emails / memos, choosing the medium, etc. I'm sure there must be lots of free resources available online for such a popular topic, but I've never looked it up.
Because for someone to believe the ability to stall a moving car is ok is for them to believe the passengers are potential acceptable losses.

No, it only requires them to fail to test that their device cannot be used to shut off an operating car. Stop and think -- what criteria define an "operating car"? It's not "the car is on" since it's entirely possible to stall out while moving. It's not "the car isn't moving" since that doesn't cover the stoplight situation. It would be trivially easy to code a device that would not permit the car to be restarted even if the car stopped in a dangerous situation.
The USA desperately needs federally mandated paid parental leave and paid pregnancy leave along with strong incentives to actually take the time off.
This might be something to build an awesome community around. Giving users way to add more than just comments: stuff like a way for the public to do more than suggest products - add them to a pool of incumbents that others can talk about immediately, a way to discuss personal experiences, ratings, photographic examples of products after x years of use - examples of failures after x time stuff like that.

I'd love to see a 100 year old Lodge pan or a pair of those keen sandals after 3 years :) Obviously clothes and cast iron posts have significantly different lives.
Each Availability Zone is being rebooted on a different day. Best practices dictate HA clusters with >=1 instance in each AZ. So, in theory well-designed EC2 systems can withstand this without interruption.

But yeah, this still sucks.
Interesting approach to the Amazon Affiliates program.
Yeah, you shouldn't need a loan for a decent used one.
To simplify what a lot of people are arguing, dollars spent by the government are dollars going into science that would have otherwise gone to <some place that isn't science>.

To a country with little established science, this can be a gigantic booster shot to their domestic science abilities both through funding and in the case of space programs, inspiring youth.

As we awknowledge that a healthy scientific community is an economic boon, one could say that money is taken from A, redistributed to B by the government, and in the process creating industry C which will hugely benefit the country in the future.

A modest, very simple example is the US National Park Service. It runs a profit! Government dollars create the Parks, and obviously they are a good that is worth more to the public than the taxes it cost to make them. But that generally would not happen without Government intervention.
wish I'd known, mine was by exam... ;-)
Is Rightscale's multi-cloud offering a step in the direction you're advocating?

http://assets.rightscale.com/uploads/pdfs/RightScale-Technic...
Any company that did this would be risking crippling judgements. And it doesn't look like the technology (starter disabling) permits it.

Cars die. I once had an old car, a Saab 900 SPG (160 hp!), which completely died when I was going at speed on I-78 in the left lane. Turns out it was the ECU. I managed to coast to the side of the highway without incident.

Most of the cars mentioned in this article are older ones, which would have more mechanical difficulties. Put another way, if you can buy a nice reliable 911 Turbo S to cart your groceries around in, you're probably not doing that with a subprime car loan.
Any idea when this happened in Australia? It's not mentioned in the article and I remember seeing Samsung laptops in stores as recently as a few months back, but they do indeed seem to be gone from samsung.com.au.
That does seem to be the case, that is a relief.
That's what I don't get. Sure you could crowdfund a few preclinical experiments. But where do you get the ~$100M to get it approved? It would be awesome if someone said "here's $100M, don't worry about paying me back", but I wouldn't count on it.
Loosened Rules for Startups Also Benefit Older Companies
Passtime really should embrace the full Micheal Barr treatment toothsweet.
The big issue that Apple faces is that when they market their product as perfection... even the slightest issue becomes a potentially big catastrophe. They are a victim of their own success in convincing people to have unrealistic expectations.

This is even before you consider engineering issues like making the unibody too thin to withstand normal stresses that smartphones face every day.
Lol, 1284 slides
Well for one you can type in nearly any language on a software keyboard. Lately I've been using my French and Spanish keyboards to talk to friends and family, I like the predictive features.

I don't think current smartphone vendors are struggling to differentiate. Apple is Apple, the experience and seamless integration across its products, Google is Google, data and democratization of power to its users, MS is MS, late to the party but making very good investments in its platforms so they're not a sinking ship (particularly Windows Phone).
It also affects a population of buyers who would have been sold an ungimped car before, but will now be sold a gimped car

That's not a good thing.

How the two factors balance out is not obvious.
Shouldn't, but might anyway... a lot of folks don't have HN-type dough on hand, and the vehicles in the article were 2005 and 2001 vintage.
Are you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]?

[1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
This might be bash-related, but there doesn't appear to be any further information.
Shameless plug as the owner: https://sysward.com/ - this is one of the reasons I built this - there is even a package view so you can apply just this package update across your systems. Message me if you have any questions!
Except that someone could just kidnap your daughter and demand bitcoins, regardless if you have them or not. If you don't own them, you could still be compelled to buy them and transfer them to the perpetrator, and the banks can't save you from that.

It's become a much more dangerous world, just by the mere existence of Bitcoin.
A lot of these Amazon referral link sites have popped up. Most do a good job of curating products but it does bring up the question of conflict of interest.
New Book: The Meteor Testing Manual
Very relevant timing.

I've all but switched to zsh on my dev boxes but this looks to be a great option for production environments.
I'd love to see small write-ups or justifications as to why these particular products were selected. Also, I'm having some issue with the infinite scrolling.
The BuyItForLife subreddit has some of the things you mention:
http://www.reddit.com/r/BuyItForLife/
Even a harmless code exploit, when run on a computer system you do not have normal permission to use, is a felony in the USA.
Paper money a thing of the past
It really depends on the *nix you are running.

FreeBSD, for example, only had bash as a port and it is not in the base install -- I believe `/bin/sh` is a derivative of ash[1].

[1]: http://en.wikipedia.org/wiki/Almquist_shell
1. This exact bug, I dunno? From what I know about zsh, no, but what I don't know about zsh can fill books. But general string bugs? Probably. String processing is hard.

2. Possible yes, practical no (for most folks). Almost everybody's got a bunch of scripts with `#! /bin/bash` or `#! /usr/bin/env bash` lying around. Good luck excising everything that automatically assumes it's the shell of choice.
I guess it's not that complicated but the whole chicken and large (preferably cast iron) pan threw me off. Serving a whole chicken strikes me as a rare occasion at most US dining tables (vs boneless breast, etc).
Concur, though also anecdotal.
So...presumably either Smith is mistaken and/or lying, or the device is defective.

But the manufacturer, of course, could neither be lying nor could have produced a device that didn't perfectly represent this notional design.

This entire thread is full of people who have no idea how the device actually works or what actually happened jumping to the conclusion that the female poor person is lying or doesn't understand what happened with her own car that she was driving at the time. It is, of course, possible. But it's also classic Hacker News.
Oh, you and your fancy-pants-scientist jargon!
Pretty sad to see HN become a parody of itself on a near constant basis: half of the comments attacked the article as "link bait" without even addressing the actual content. I've been watching OpenGov closely for the last year and have been impressed (and jealous that I didn't start this myself having worked in big gov IT shops my whole career and half jokingly playing around with the idea of a SAAS offering for publishing budget data online; something that seemed a difficult enough problem that I though it was magic when I was able to see it firsthand with OpenGov's software)
I used to work at a company that sold devices for exactly what this article is about. One of the biggest selling features of the device was the fact that they could remotely stop a car from starting. I can't speak for any of the companies competitors but I know the devices we sold were not possible to shut the vehicle off, only disable the starter after it's already been turned off.
"charge a 1,000-microfarad capacity to 30 volts in 25 minutes" == 0.0003 watts, tiny even by energy harvesting standards.
Their explanation sounds pretty fishy to me:

> Google blamed the mistake on a piece of legacy code from an experimental project that had been re-used to programme equipment on the Street View cars

Somebody at some point specifically wrote code to sniff data off wireless LANs.
Will new instances created now not have to be rebooted? A lot of people on EC2 can probably re-create their vms now instead of having to wait for the reboot, no?
The more obscure languages you use through, the more the only good support you'll find is with emacs compared to ST. See ocaml, fsharp, haskell, clojure, prolog, scala etc... But for html, CSS, js, ruby, ST is pretty good
> Why on earth are laptops not selling?

If someone had the answer to that question then Microsoft, Sony, Samsung, etc. would be much, much happier. The entire PC industry has been shrinking for the last few years, sometimes with double digit declines. Nobody wants a heavy, hot, loud, and crappy laptop when a tablet like an iPad can do everything that matters to most people (email and web) and then some.
Overprivileged first world honkies work 8-hour shifts at cushy desk jobs, and now they want paid leave because their waifu plops out babby? Ugh...
Another patch if cannot be bypassed: http://www.openwall.com/lists/oss-security/2014/09/25/10
Well San Francisco, Cape Canaveral, and New York City figure in various episodes and movies. (Just off the top of my head.)
Curiosity is a rover. Rovers require cleanrooms for assembly for the reasons that you just mentioned, since they land. I don't think this is an issue with orbiters. For example, one of the reasons failing orbiters are of concern is that contamination can be an issue if they crash into the surface. See Japanese orbiter Nozomi, for example: http://www.japantimes.co.jp/news/2003/11/29/national/experts...

Using the expert rule, I can't imagine Indian engineers not being concerned about contamination. It is such an obvious risk that it is probably one of the first things they'd look for. I mean, there is 50 years of precedent available to anyone working in this field.

Edit: Also, they may have done their work in non-cleanroom environments and post that, they may have sterilized the orbiter.

Edit 2: Sorry for the multiple edits, but in spite of Hanlon's razor, I sense an underlying bias. Here's another NASA photo of a satellite assembly, and they are using ungloved hands: http://commons.wikimedia.org/wiki/File:Mars_Reconnaissance_O...

ESA Mercury orbiter: http://sci.esa.int/bepicolombo/50304-removing-the-clamp-band... (I think there's a guy leaning over in the bottom left corner of the pic and probably dripping snot on to the orbiter too.)
All but?

Edit: I meant to ask what your setup is like, such that you would describe yourself as being somewhere between "have switched" and "have not switched". It seems to me like it would be one or the other.
There is not enough capacity. I think Amazon did not make this decision lightly.
> It looks from the article that this results in bounded-time concurrent reads and writes, even in the worst case, as long as resizes can complete often enough to not be overwhelmed by the writers, is that correct?

Mostly so, yes. Writers can still contend with each other, but that's less critical on a read-heavy data structure.
Alternative framing: rich guy closed access to a California public beach for four years and pays no penalty.
At Group Sex Parties, Strict Rules Make for Safe Spaces