skysight-inc/HackerNews huggingface dataset:
Why?

Why don't you uninstall bash all-together? Most programs should be using '/bin/sh' and not bash.(IIRC Linux might have symlink between the two, which is awful) You could install zsh.

You could add further security layers, harden your network-level access, monitor your logs and so forth. Security is a set of policies. If you think that there are users who have unauthorized access to your system or you run bash-enabled cgi scripts, well then disable them (you shouldn't be using those in first place anyway), lock-out unauthorized users, change your passwords, etc.

The panic is for admins who handle systems with multiple users (universities, etc.) and offer (even restricted) shell access. For these guys might be hard to sleep at night, but for someone running a fileserver, shouldn't really make any diff.
Lack of headers?

What is this, 1975?
Harvard wants you (yes, you) to build squishy robots
Samsung wasn't a big laptop or PC seller anyways. I think they are more interested in selling (relatively) high margin devices that they can control and market (like phones and wearables). It's not that PC market is in decline, as others have pointed out, Samsung sees more money elsewhere.
On Debian /bin/sh is already provided by Dash
But when you give it access you can get data for a couple of weeks. So the m7 chip is keeping the data but you dont see it.
I also believe that it only stored on the phone and I think this is a setting to get people to use healtkit.
Doesn't slack have it's own RSS bot? Why not use that?
Regarding meal planning: this one calculates the nutritional information and provides an estimated price for each day, helps put everything in perspective https://spoonacular.com/weekly-meal-planner
As he predicted, I was with him until his rant about generics. While the example he makes support his point, that's nothing specific to generics but instead to the implementation of generics. For example, he uses the following example as "bad" generics:

func reverse<C : CollectionType where C.Index : BidirectionalIndexType>(source: C) -> [C.Generator.Element]

and the following example as "good" non-generics:

func reverse(source: CollectionType) -> CollectionType

However, you can have equally clean syntax with generics. For example, consider the hypothetical syntax:

func reverse(source: CollectionType[a]) -> CollectionType[a]

in which `CollectionType` is parameterized by the type variable `a` [0].

I also take issue with the idea that removing static checks isn't a big penalty. In particular, I cringe a little at the following sentence

> Because it does not actually matter. If an Int gets in my array, it’s because I screwed up and likely had very poor testing around the scenario to begin with.

The benefits of static typing is that you don't need testing of things like that. The compiler guarantees safety, allowing you to avoid writing test case that are mundane and boring, such as checking that you don't put an Int into a String array.

The following paragraph also seemed questionable to me:

> Yes, in this example, I’ve moved the validation from compile-time to runtime. But you know what, that’s likely where many of these types of errors are going to be coming from to begin with because the content of the array is being filled in with dynamic content getting coerced into your given type at runtime from dynamic input sources, not from a set of code statements appending items to your arrays.

I think this is somewhat incorrect. You should never just be type-casting your inputs. (In fact, I think it should ideally be impossible to do so without the compiler generating really big flashing warnings saying "THIS IS DANGEROUS!"). The static verification here will prevent you from doing silly things, and should ideally force you to do input validation at the location of input, instead of blindly casting things to the type it needs.

All in all, not a bad discussion, but I think that this piece demonstrates that bad implementations of static typing can severely detract from the good qualities of static typing, and that it takes some getting used to to program well in a statically typed language (not casting things spuriously is a good example of that). That said, I know very little about Swift, so take all of this with a grain of salt.

[0] It may at this point be clear that the inspiration here is Haskell and ML; I am a big proponent of these languages, and believe that static typing can eliminate many common errors.
They're asking for two years of experience - a fresh graduate, in other words. Do you want to work for a company that hires a graduate as their lead engineer? No? Don't need to pay attention to the rest of it then.

I've seen lots of ads from people who don't understand software but want to hire engineers. They're universally awful. Fortunately it's quick to spot them and move on.
I think you're misunderstanding the term decline as used here. See the following link,

http://www.investopedia.com/terms/d/decliningindustry.asp
This is just a side-effect of the blub paradox disease. One of the symptoms for those that are afflicted with it is ranty blog posts about new languages that the afflicted person does not perceive as being better because it doesn't really have the same semantics as the one language they are used to.

I think it was Douglas Crockford that said this. We don't get new and better technology because the old people accept it. We get new and better technology because the people using the old crap just die out.
It has 9 points and some comments on the blog, so apparently some care. It exemplifies several patterns of job postings that are seen outside of Singapore, which makes it potentially useful for a lot of HN, while being in Singapore satisfies curiosity for some HNers like me.

It's debatable how much value there is in having a well-defined culture rather than one that just emerges, and also how to define one. I think the way the authors of this job posting define their culture is narrow-minded. A lot of people who aren't into a traditional lifestyle don't go out of their way to talk about it, in fact they lead a simpler life so they don't have to think so much about their lifestyle.

Edit: while I was typing this the number of points shot up to 15.
I actually find it very fit to a certain demographic of wannabe startuppers, that may be enthralled by this kind of movie-like I-am-a-nerd-programmer scenario.
Destroy the website
You should add a sarcasm tag.
> Here is all you need to know

4 sentences

I mean, I know some love to think that a blog / tv show full of snarky jokes gives a hint of political driving forces behind decisions, or, you know, anything political in the slightest

but they don't, they are just snarky jokes
Do you guys have a developers API that people can access to easily access information gathered in your DB/submit, etc. A basic developers API?
Nope. It's extremely douchey, but totally honest and not unfairly discriminatory in any way. It reflects an immature and pathetic obsession with "cultural fit" by people that mentally haven't outgrown the high school playground.

What makes me wonder about the author though is when they go off on the basic requirements. Those are not exceptional or excessive requirements.

Douchebags recruiting douchebags. It's only discriminatory in that it's unlikely to attract mentally stable grown-ups or women.

But since there are so many startups with the same attitude that aren't upfront about it (or, if you read between the lines, 50% of all job postings actually tell the same story), I welcome these clear warning signs.
Any decent shell script is written to use "sh" not bash, and on debian/etc sh is provided by dash not bash.

So while a lot of people are affected, your reasoning points to other issues that are very solveable
Ah cool didn't know Slack had RSS integration.
Trello + Zapier

https://zapier.com/zapbook/github/trello/

Works like a charm.
"The through of working till midnight in a warehouse while subsiding on pizza is somehow appealing to you."

Whoever applies will get what he asked for.
Can someone from the internet use this type of attack through CUPS or dhclient then? I was asking about external attacks, not users that are already on the system.
Can anyone outline some clear steps for those of us on Debian Squeeze who have not yet got a patch?
May be this: http://xenbits.xen.org/xsa/

XSA-108	2014-10-01 12:00	(Prereleased, but embargoed)
Per aspera ad astra !
> Disabling buffering in the file library should provide for a similar mitigation outlook

Did you mean logging library? I.e., application-level buffering? In that case, good point.
> This observation reveals the mentality of cynicism which infests the US Federal control structures, and the reality that these structures regard the American people with total contempt.

Yeah, I wouldn't call plans to brainwash and mind-fuck 330 million people a "mentality of cynicism". Contempt is not quite enough either. How about "evil, malicious hostility"?
A laser of 20-100 Watt is enough for Selected Laser Sintering.

So a square meter lens for the sun will give you more than ten times the power professional SLS printers are using.

That is indeed a lot.

Edit: here a nice answer about the heat generated: http://physics.stackexchange.com/a/103039
Can someone explain why bash is evaluating and looking for function definitions in every environment variable? What would be broken if this entire "feature", whatever it is, was completely disabled?

That's almost like a C compiler looking for C programs in string literals. It just doesn't make sense to me.
There's plenty of life in the PC platform. When you'll want to have high quality VR at home, it won't be on PS4 nor on Gear VR, it will be on a High specs PC with an Oculus or Valve headset. So not sure where you see this as an ongoing decline, when new uses are on the rise.

EDIT: besides, based on your link, it should be classified as Mature Phase and not Declining phase. See sales numbers.
dhclient: sort of. If you connect to a malicious access point, or someone runs a rogue DHCP server on a network you trust, they could potentially attack dhclient.

CUPS: If you are exposing a CUPS server to the Internet to allow remote printing.
Buildbox: Bash vulnerability CVE-2014-6271
Ask HN: Anyone migrated from one engr field over to software dev?
Anyone here transition from a different engineering background (Chemical, Civil, Mechanical..) to software development ? If so, how long did that transition take you until you were proficient enough to be employable? Were you still working during your 'ramp up' ?

I'm really enthused about becoming an iOS dev and have been self learning all year long - from time to time I wonder if it'll actually happen. I've only had one opportunity to get hired as an iOS dev but the job location ended up in another state rather than the my town (LA) as originally discussed. I've had a recruiter tell me I have a strong engr background but not what their clients are looking for.

Given I have 5 years experience working not as a SW dev, and only a pair of iOS apps, am I too risky too hire?
Answering my own question, since I got curious enough to look a the source:

if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))

So it has to start with that four character sequence exactly.

I hope there are patches to webservers, sshd, etc to cleanse environment variables with that value. Even if bash is fixed, it is too risky to send untrusted strings to its parser.
iOS Wave custom transition
Ah, Singapore. The "Conversational Mandarin" bit is code for "Chinese people only need apply".

And in case you didn't think it could get worse:

They just celebrated their full launch on 8th July that featured a full Nyotaimori spread, an ancient Japanese ritual of serving sushi on the body of a nude female model.

https://sg.news.yahoo.com/sugar-app-could-savior-small-02300...
This Jakub from Estimote again. Few months ago we have released "Power management" for beacons you can read more here: http://blog.estimote.com/post/91749152580/estimote-rolls-out...

Thanks to these features our beacons can save energy when not used, so if you enable "smart mode" they should last more than 2-3 years.
Water discovered on Neptune-sized planet outside our solar system
Show HN: Track XHR + JavaScript Exceptions
some call it motive and unfortunately it boosts humans that are ultimately driven by hormones.
Power can corrupt and wealth is a form of power.
Wow. You just can't make that shit up.. unless, of course, you're the government and making it all up :)
"I look at the feature set of Swift, and I have to ask myself the question: what’s the point? What is really trying to be solved? And does it provide significant benefits over languages that already exist?"

One reason may be that large companies want ownership of a modern, C#/Java/Go-like language [1]. I was an intern at Adobe when it was trying to develop such a language (ActionScript 4) + VM, and a primary reason not to adopt an existing language is that they wanted control and to be free of legacy baggage as much as possible. Obj-C is reasonable to use today, but its C and Smalltalk underpinnings sometimes feel like anachronisms for people writing App Store apps. This is probably especially true if you're a language designer like Chris Lattner at Apple and are tasked with fixing the most prominent pain points that your language users face.

[1] I realize these are somewhat diverse languages.
Shellshock is a perfect name coming after Heartbleed. But this bug is suffering from lack of marketing, lagging in the news behind the iOS update being pulled.

It's sad to see an RCE somewhere so widespread and so interwoven with other software. It's also costly because now I'm questioning server integrity, thinking about what should really be re-imaged. I assume there are many more like this in the CVE pipeline...

At some point I just have to live with the fact that outside access is possible to anyone so motivated.
On OpenBSD, /bin/sh is a good alternative to bash.
OS/X does use bash as /bin/sh unfortunately so it is fairly vulnerable. Probably most people won't be affected though since there aren't many good attack vectors against a client machine, and not many people are still using macs for servers.

I don't think that the issue is overblown at all though. CGI is old and crusty but it's sitting in all sorts of random places. All you need to do is to find a script that will call system()/popen()/etc and it's game over. Plus those are just the sorts of forgotten environments that people won't remember to patch. I'm sure there will be thousands of exploitations in the next couple days. This is a big deal.
Yes, you can switch to squeeze-lts and then update just bash. First, add the following two lines to your /etc/apt/sources.list:

deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free

(you do not need to change or remove any other lines from sources.list).

Then run the following command:

apt-get update && apt-get install --only-upgrade bash

...which will update your apt sources (but not your installed software) and then will upgrade bash and only bash.
From reading one of the threads I think I get it. It allows you to "export" functions (export -f). I guess that's passed via the environment, so process start scans for them.

The issue is that it was evaluating the whole variable to get them into your process. So if you have "garbage" at the end it's interpreted as the next command following the function definition.
The only aspect that seems like it might fall under the category of anything except for age discrimination is the photo requirement.

Summarizing the highlighted passages:

- they want a go-getter
- they want someone who enjoys working long hours
- they don't want people who do things only for the perceived social benefit
- they don't want people who have no social skills

a.k.a. a culture fit.

Granted, the job requirements are a bit hefty for the salary (US $3.2-4k/mo), and the 1+/2+ ratio of years managing vs. years developing seems a bit... naive, but maybe that's market in Singapore (which IIUC has a flat, low income tax), or maybe perhaps they are just trying to underpay - like most un-/under-funded startups everywhere.
Science Inc. Acquires Mobile Ad Network PlayHaven from Upsight
Cool speculation!

Anyone with anything concrete?

I still heard it is power issues.
The author's comment on the first example is:

> what is the type of $0 and $1?

Surely a great thing about Swift is that the compiler knows the types of $0 and $1 and will prevent you from doing stupid things with them like you can in Obj-C?
not cached. just proxied.
I am no AI expert, but couldn't a modern AI be trained more or less in the same way?
It's so you can export a function into child shells:

http://stackoverflow.com/questions/1885871/exporting-a-funct...

Hardly worth the security cost in retrospect, but some bash scripts will surely break if it were just ripped out.
You don't think it's an accurate remark about how dangerous it is politically to oppose a war drummed up to drive fear into the public? About how major parties lock step in times like these?

"Soft on terrorism", "Can't defend our shores", etc. Huge political risk to work against what's happening.
Or just buy an older ThinkPad X201 / X220 / T410 with 1440x900 display and get a new 9-cell battery.

The things are really cheap, have a proper keyboard, are bomb proof, every part is replaceable for minimal cost, they are 100% supported by all operating systems, have excellent docking support and you can just sling them in your bag. Mine lives down the back of the sofa cushions when not in use.

I knackered the headphone port on mine from overuse. 5 mins on ebay, £7 spent, new board installed in 5 mins with a Philips screwdriver and the service manual.

For every day tasks, I use an i5 X201 with 8Gb of RAM and a Samsung 840 Pro and it's no different to the stacked HP Z620 I have in the office to use. If I need more power then I use that remotely.

Totally awesome machine and I paid virtually nothing for it.

PC tech is moving so slowly now it's a better investment to buy two older machines so you have a backup unit than one new one if you ask me.
Don't let your users choose what to tell you in bug reports
In the EU there's a mandatory warranty of 2 years for all electronics.

At least in Finland, the "not fit for purpose" stuff also applies in addition to that so if you can prove that your hardware failed "unreasonably soon" because it's somehow defective and not just due to "standard wear and tear", the manufacturer has to fix it. Of course it has to be a very valid reason for that to apply.

http://ec.europa.eu/consumers/ecc/consumer_topics/buying_goo...
IANAL, so corrections are welcome, but my understanding is this:

To bring a civil suit against another party, you must have standing, which means you must be able to show that you, personally, suffered damage at the hand of the other party. These 22 people can't just sue Google for damages on behalf of everyone whose data was allegedly hoovered up by StreetView, they have to prove that their data was collected. If they can't, then other people could bring the same suit and look for their data in the evidence as well.

Once a defendant or defendants prove that they have standing to bring the case, they could then petition the judge to certify a class action, at which point the lawyers representing the class would ask for discovery to find and notify all the other class members.

I view this as a very valuable rule of law; without this, there are attorneys who would just spend all day filing speculative lawsuits in hopes of forming a class action.

One other notable places this rule has come into play in the recent past: in litigation around gay marriage, when the government refused to defend its marriage discrimination laws, religious groups tried to step in to take on the defense, only to be told they had no standing because they were not being harmed by other people getting married.
Not dismissing that. It's more a comment of locking step as a response to fear and war. Too politically risky not to. I commented slightly up the chain with a little bit more.
Max Planck said something similar about new theories in physics.
Thank you. This worked.
Bash Bug could be a bigger threat than Heartbleed
You and me both...
Sad state of affairs with ridiculous government propaganda, and major media outlets playing along.
How about a JavaScript-to-FPGA transpiler? :) Go grab a Zynq eval board (http://www.xilinx.com/products/boards-and-kits/EK-Z7-ZC702-G...) and implement that, we'll stick around! :)

In all seriousness, that would be really really cool. Especially if FPGA blocks become more common in general purpose/desktop processors.

It should be possible to design some kind of signal-processing API/framework in JS that lends itself to FPGA synthesis behind the scenes, right?
> Is there that little slack in Amazon's compute capacity?

I'm sure there's plenty of "slack" under most circumstances. However this affects the majority of users so all of them setting up new instances at the same time would likely be impossible.

For the scale of this reboot, they'd have to maintain 30-50% extra capacity which would likely be financially impossible at those rates.
strcpy_s() doesn't appear to be in glibc. At least "man strcpy_s" give nothing on a Linux box.
Front page of the site of one of the major Australian newspapers: "Largest bug ever hits the internet"

I think it will start to make its way out to the public with a bit more time.
I don't know enough about GC to argue about it, but the way I read his response (including the next paragraph which is not about multicore) he seems to claim that there is not a severe performance penalty for a C4 style collector, contrary to the email from Ian Lance Taylor, so I'm not sure he missed the point. He also has a graph showing supposedly how much it's not a severe performance penalty.

He also has like 5 more responses, not just that one.
It's not greed. It's entitlement stemming from a general feeling of exclusivity and superiority.
The model numbers manufacturers have definitely don't help. A friend recently bought an Acer Aspire E1, of which there are about a million different combinations. The range she got has model numbers like E1-472P-XXXX, where the last four digits mean "whatever configuration of components we plucked out of a hat". Her's is Core i5 4200U, 8GB RAM, 1TB HDD - which I can't find anywhere online :D

As another commenter said Apple has it right in that it's easy to say "this is the 2013 model". I bought a TV yesterday, and although they seem to have confusing model numbers too, at least the shop displayed them saying which was the latest models and it was easy to see the difference between them (apparently "dual core CPU" is a feature of TVs now).

EDIT: Typos.
A rough idea of a possibility in the future, the car owner can scan a QR code in the car, confirms the transaction, which is recorded on a blockchain, monitored by a smart contract, which activates the car's engine.
"All but" is synonymous to "completely", as far as I learned.
Imitating reflection in C++
"all data stored on SSDs as a cache" is absolutely wrong. The SSD reliability is not less when compared to HDDs.

The SSD is just as useful as permanent storage as an HDD.

Each SSD drive must be evaluated individually. Some batches or models are very unreliable. This can still be an issue with HDDs however.

All storage without backups is subject to loss, therefore all storage systems require backups of important data. RAID and other redundant systems can reduce the likelihood of data loss in SSDs just as well as HDDs.

If you statement was that all SSD data must be backed up regularly, just as HDD data is, then it would have been correct. As you stated it, incorrect and misleading.
> how would you even make a car less gas-efficient on the fly?

My car has a 'sport mode' which seems to do a pretty good job of this ;)