skysight-inc/HackerNews huggingface dataset:
I don't get it. None of this has anything do with health. That's fitness/sports/activity data.
Bootstrap Material Design
It's the market at work. Because It's an oil town and cost of living is so high, they need to pay a higher wage.

That's the key. If you could take that money and spend it in another state, it could go much further. I would imagine the cost of living expenses in that town make it so $17/hour is equivalent to roughly minimum wage in other parts of the country.

A higher minimum wage sounds like a great fix, but it's only a great fix until the rest of the economy catches up to the increased prices by raising their prices accordingly. At that point, your dollar goes about as far as it did before the increase.

Australia is a good example of this. I stayed at a hostel when I visited for a week and there were signs up for unskilled day labor work that paid $18/hour. The hostel also cost me almost $100/night US and most meals..even at the cheapest of the cheap places were over $20/person. A soda and a small bag of chips at 7-11 was over $11. The same thing costs me a little more than $4 in the US.
I keep hearing that, but Linux has quite good backwards compatibility. I run a couple of 15 year old statically built executables on Linux, not because I have to but simply because I've kept them around. I believe Linux also keeps optional support for pre-ELF binaries, and that's even older. So I think Linux fares quite well in this regard.

Most things that create problems are auxilliary programs that people no longer keep around, such as mail transport software that has changed behaviour, or protocols that have changed. Those are things that would give you trouble on any platform.
Input validation is an orthogonal issue here, since bash doesn't know anything about RFC821/RFC2821, doesn't expect data in that format, and doesn't make any guarantees about what it will or won't do on such data.

The only reasonable policy for a shell to follow is to be entirely input-agnostic and never execute code based on the contents of an environment variable (regardless of which RFCs the contents conform to).
> Even if you have the discipline to just use a laptop for simple not taking, research suggests that this impairs learning compared to talking notes by hand. See "The Pen Is Mightier Than the Keyboard: Advantages of Longhand Over Laptop Note Taking", Psychological Science June 2014 vol. 25 no. 6 1159-1168 [1].

That leaves you with a sheaf of longhand notes. So then you have to, what, go away and type them up into a text editor in order to get them into a tractable form? Well, I suppose that's going to further aid retention ... win-win?

I must admit that I have a personal grudge against this nonsense as I can't write quickly enough to take adequate notes; in fact it's touch-and-go even when I can type. But even if you can generally keep up with the lecturer's pace taking notes on his output is a tightrope-walking exercise: one lapse of concentration or understanding and you have a permanent hole in your record. Then of course this whole process is being repeated by each of the n students at the lecture. In this day and age (or really at any time since photocopying got cheap several decades ago) organising a course where getting a complete copy of the important course materials requires you to turn up and spend hours transcribing someone else's speech in person is an insulting farrago and a mass time-wasting exercise. If it's important enough to be examining students on then it's important enough for the teacher to type it out or read it to video camera.
Thousands rally in Hong Kong as democracy campaign heats up
Recruiter: Startups Are Offering Crazy, 1999-Like Hiring Incentives
> The problem is you're demanding that the entire coding population of a large company "get the hang of it" or else be confused by their tools.

The fact of life in C++ is that you have to grasp a number of not-entirely-intuitive concepts before you can be effective with it. Rvalue references are not particularly hard compared to many of the others. Consider how much time newbies spend wrapping their head around pointers -- something that experienced C++ programmers have absolutely no trouble with.

The only reason we're holding rvalue references to a higher standard than any other C++ feature is because they're new, which means that even people who have been coding in C++ for decades suddenly find that there is a language construct they don't immediately understand. Not having felt this way for a very long time, they conclude that this particular construct must be much more complicated than everything else, when in fact it's not.

> The overwhelming number of allocation bugs with C++ code are treated very well by RAII already.

Move semantics make it vastly easier to use RAII in the first place. Without them, RAII does not play nicely with transferring ownership over a call or a return. You can use reference-counted smart pointers, but they are slow (require atomic ops). You can try to emulate move semantics via documentation and conventions, but this is error-prone. Clean ownership transfers have always been a sore spot in C++ prior to rvalue references.

I don't know about you, but the introduction of move semantics into my style completely transformed my code for the better.
Monopolies can be good..if they aren't abused. But at some point, a monopoly realizes they don't need to compete anymore and we get terrible service, prices, and/or no innovation.

Google, Amazon, and Ebay are all near-monopolies in their fields and I have seen all of the above at one point in time.
I went to college in the late 90's, before laptops were really viable for use in lectures (despite what I recall from the 1986 movie Back to School). We did have our math class in the computer lab, so we could graph functions. Of course, I spent most of my time reading newsgroups and mailing lists, the equivalent of modern students on Facebook.

Looking back, I really regret the use of technology. I'm talking about the computer distraction, but also the heavy reliance on advanced calculators like the TI-92 that did symbolic integration and differentiation. The classes were focused on making the graphs appear and getting answers, not on grasping the fundamental, underlying concepts. I'd prefer a strict paper and pencil analysis course.

I also remember the countless student questions, "will this be on the test?" The basic concept of testing student knowledge is that you can only administer a test where a small set of questions are randomly distributed across the much larger subject matter. You aren't supposed to memorize the answers to some questions, you're supposed to demonstrate that you learned everything.

I didn't even learn what learning is until a good fifteen years after I was done with school. I suspect the students engaging in these behaviors, also, don't understand what learning is, and will graduate having passed some tests without knowing much.
“Bitcoiners Are Repeating Forgotten History, and Are Accordingly Doomed”
The X documentation was 2 volumes: 5 inches total. If you throw in Motif, Display Postscript (which came out in early 90s on SGI) and GL, it's still under a foot. I never had NeXTSTEP manuals, but I did have the OPENSTEP box set which was about a foot thick.

I understand the point you are trying to make, but the truth is an expert would find a lot of similarity in those systems. Even today iOS development feels comfortable and similar to the work I did on SGIs in 93.
Seems unlikely:

"Of course, ``security hole in qmail'' does not include problems outside of qmail: for example, NFS security problems, TCP/IP security problems, DNS security problems, bugs in scripts run from .forward files, and operating system bugs generally. It's silly to blame a problem on qmail if the system was already vulnerable before qmail was installed!"

But, I think he can take great satisfaction in thinking of a potential hole that even djb didn't consider. That's pretty impressive (though less impressive since everybody was sitting around trying to think of places where a shell might be invoked in non-obvious ways...I spent half an hour talking to my co-founder and employee during our regular meeting trying to think of ways our users could be effected outside of the already discussed ways, and we spent quite a bit of time testing various theories; one of the vectors we discussed was procmail being called by Postfix).

Edit: And, just in case anyone was wondering, Wietse seems to have considered the environment variable problem, and took measures to prevent exploits in Postfix, so it does not seem to be exploitable by Shellshock, even when calling out to procmail.
Sure -- thanks for not (appearing to) take offense to my snarky tone. :-)

I've also spent a fair amount of time on both sides of the classroom, as student and as teacher. It's really tough for students to understand the classroom from the teacher's perspective.
I doubt it. This would probably be considered a bug outside of qmail by djb.
That's interesting because my dad (other side of the family) is diabetic and was able to keep his blood sugar under control, to the point of no longer needing supplemental insulin, by switching to a vegetarian diet. He tried going vegan, but his blood sugar got too low with a vegan diet.
The app is called "Health"
Sometimes I wonder if ppl actually know there's more stuff in the world then what the eye can see.

Like that there's more stuff in the universe, then just the glowing stars.
Oh, it's a religious belief. I'm curious to know why you and the poster above think you can forcefully bring your faith to the Chinese. Is China not a sovereign country? Does the strength of your conviction override geopolitics?
i wasnt able (yet) to exploit php-fpm, although i was able to sneak the user-agent into it and had an exploitable bash and a system() - call within this file

output -> https://gist.github.com/anonymous/ea60dc2915eccf0b803e

index.php -> https://gist.github.com/anonymous/883b989caba4156e47b6

but maybe suphp seems a little more suspicious?

/etc/suphp/suphp.conf
...

[handlers]
;Handler for php-scripts
application/x-httpd-suphp="php:/usr/bin/php-cgi"

;Handler for CGI-scripts
x-suphp-cgi="execute:!self"
Shellshock: All You Need to Know About the Bash Bug Vulnerability
If you don't already, I strongly recommend lurking on the btrfs mailing list. There are regular fixes to balancing, ENOSPC, send/receive and the btrfs-progs tools; occasional questions and fixes related to the compression code.

Be prepared to update your kernels and tools often and independent of your vendor. Btrfs-progs will likely need to come from the git repo, so building your own packages for distribution around your production nodes will probably be necessary too.

A word of caution: do not run btrfsck without consulting the wiki and mailing list first, and hopefully knowing exactly what you are doing. There are situations you'll encounter which do not require btrfsck to repair (but rather, other tools instead), and it will potentially make a recovery less likely.

FWIW, I have been watching the list for years, and reading regularly for about 6 months trying to get a sense of stability with respect to the features I want.

I would not put btrfs in production yet. Though, likely soon.. I'd guess another year or so.
Agreed, my point was simply that even a textbook healthy diet isn't some silver bullet that protects you from dementia.
Ask HN: Photoshop compatible editor
Several months back I saw a new Image editor here in HN that was compatible with Photoshop (PSD) and Illustrator (AI) file formats. I think I forgot to bookmark it, since I couldn't find it. It was still in BETA and it was not free. Does any one have the link ? I completely forgot the name as well. :(
For Mac OS X, until Apple releases a software update, I've applied the original CVE-2014-6271 (shellshock) patch and the CVE-2014-7169 patch. I will be applying Florian's patch once it or a similar patch come out for 3.2.

Repository and instructions to reproduce without trusting me are located here:
https://github.com/ido/macosx-bash-92-shellshock-patched

Binary releases are here: https://github.com/ido/macosx-bash-92-shellshock-patched/rel...
...including a .pkg file that can be installed with a double-click.

Instruction here:
https://github.com/ido/macosx-bash-92-shellshock-patched/blo...

Pull requests are welcome, especially if you've modified Florian's patch to apply cleanly on 3.2, which is my next task.
> but fastcgi_params does not put attacker controlled data into environment variables

it does

https://gist.github.com/anonymous/ea60dc2915eccf0b803e
Whoa! Didn't expect to see this here! One of the bots, @pixelsorter, is my bot which you can read more about here: http://wayspurrchen.com/pixelsorter/

Some background information: This first got started because I tweeted an image at @pixelsorter and @badpng (see the thread here: https://twitter.com/wayspurrchen/status/514246071464521728/p..., I wrote a blog post here: http://wayspurrchen.com/blog/2014/09/the-eternal-robot-love-...), which spawned a really interesting infinite loop. Eventually, the other bot's creator reset her bot and that infinite loop ended, but people caught wind of it and have been making my bot enter infinite loops with other image bots ever since.

I think @a_quilt_bot and @pixelsorter are a particularly interesting pairing though, because @a_quilt_bot can generate new sources of imagery that my bot can further resort, resulting in a neverending stream of new, automatically generated imagery. My bot is also rate-limited by the Twitter API (350 API calls per hour), so there's no technical reason my bot and another rate-limited bot couldn't keep communicating forever. I'm actually really interested in this idea, and it's the center concept behind my next project idea.
I don't think those point address the question: "I've always wondered if what you do with your mind during your life has any actual influence on this disease."
Who said anything about unlimited freedom? Keeping a few secrets from the state, namely the contents of your mobile phone, is a very limited and modest freedom, and one worth defending. And having that extra bit of privacy is hardly going to unleash the forces of anarchy and chaos.
This is really cool. The other fruit fly project I was impressed by recently was Mihir Garimella's FlyBot: Mimicking Fruit Fly Response Patterns for Threat Evasion [1] which was a quadcopter that demonstrated evasive behavior. I really like looking at biomimicry implementations because there are so many levels on which to do it. Mimir was trying to mimic outwardly observable behavior while Neurokernel is trying to mimic neural pathways.

[1] https://www.googlesciencefair.com/projects/en/2014/6d1893c20...
A Big Data Startup Gives Away Its Software to Make It More Valuable
My mips cpu which boots linux -

https://github.com/andrewchambers/cmips
The good thing about quantum mechanics is that you don't have to know anything about it and still say stuff with it that sounds incredibly profound. "Everything is just a probability! We are all waves, maaan."

(Sort of like Freud's psychoanalysis. Everything is a penis, or your mother.)

This has probably nothing to do with the article though.
Hmm...there were a lot more than 2 volumes on that bookshelf. And again, that was just the windowing system.

Amazon [1] suggests that there were at least 8 volumes.

[1] http://www.amazon.com/Windows-System-Administrators-Definiti...
It depends on the database back-end you use; it can use libmemcached which opens up the possibility to use a CouchBase cluster if you really need to go that far.
I bought a tablet PC for this purpose (OneNote is so freaking great) but have still had instructors claim that it would be too much of a distraction. I'm a grown man. I think at this point in my life, I both know how best I learn and possess the discipline to stay focused on class. Having electronic versions of my notes plus the ability to draw diagrams or use multiple colors/highlights is really, really awesome. It beats the hell out of doing the same with paper plus half a dozen pens/markers/highlighters.
The study doesn't show that writing on paper is necessarily more effective than typing notes on a laptop. The study shows that, when typing, students tends to transcribe verbatim, whereas when writing longhand they tend to paraphrase. This extra processing results in better understanding. This does not mean that you can't paraphrase while using a laptop, just that the students in this experimental setting tended to do that, presumably because they could type fast enough to transcribe verbatim and thus did so. So it's really just an issue of note taking style, not the medium.
Use a two-phase commit to go into and out of your database when your message needs to be turned into data. There is no reason your data in the database can't be consistent with your messaging system.
It's pretty damning of the HealthKit product team that a post like this is required. Why would Apple publish the app at all?

It seems like they should have released iOS8 with some kind of simple pedometer/stair counting app that looked good and was easy to use, like a reference application to show what HealthKit could be used for, and then buried the HealthKit app as it currently stands in some settings menu that most people will never need to look at.

The only thing I can imagine is that they intended to roll out a bunch of HealthKit-compatible apps from third parties like Nike and FitBit along with iOS8, but the bug messed up their release plan.
Scientist discover way to make objects invisible using lenses
I think nobody ever read that book. It's more used as a reference. I tried reading it, but it was the most boring book I ever encountered (even worse than structure and interpretation of computer programs, which is also incredibly boring).
The elephant (ha!) in the room is the fact that lectures are as good at passing on facts as any other method, but very bad for softer teaching goals, including debate and inspiration.

Here's an informal article:
http://www.timeshighereducation.co.uk/news/lectures-dont-wor...

And formal research:
http://isites.harvard.edu/fs/docs/icb.topic38998.files/Bligh...

I'd guess Shirky's classes are more about promoting debate and asking questions than plain 'learn this' science/math/engineering lectures. So the lecture format - even with discussion - probably isn't very efficient for teaching anyway.

Whether people are distracted by devices seems secondary.

Perhaps it would be more useful to students to (say) work out a way to dramatise the effects of device addiction or some other Internet experience, so they can discover it for themselves and make their own decisions about distractions and cognitive loading.

Banning devices might have some of that effect by accident. But I'd guess teaching a class on internet sociology while taking notes on paper is going to be kind of weird.

(Full disclosure: I always used to hate writing paper notes. It's not unusual to lag behind the content, and it certainly never helped me understand what I was supposed to be learning.)
A message queue stores, well, messages, so it is really good for events. But I also need to persist state machines that run for months. They must be queryable and so on. A db is good at this. On the other hand, I've had a very unpleasant experience with the database-as-IPC-channel and do not wish to ever go near that again. So using a rdbms to persist state and a message queue for the events seems like the conservative approach. Am I overlooking something obvious here?
That's a nice strawman you are beating there.

> But there's no need to insult everyone who uses language.

Is that from Go's social media handbook? I have never ever seen users of a language complain about perceived insults as consistently as Go. It seems like it's the only argument they are able to make if they disagree with other people.
I will try being maximally explicit.

What is this software that one fifth of companies run

A ridiculously popular application, written in PHP, which is widely useful to software companies (among others).

why is technically savvy in scare quotes

I originally wrote "startup" then thought "Actually, this is deployed by a lot of people who aren't startups or who are only arguably startups, hmm, that is an unproductive debate, let's just say what I mean then move on."

some veiled reference to something called spray-and-pray?

Many applications have a well-known set of URLs associated with them. A spray-and-pray exploit is one which you can just fire at a well-known URL at every machine which responds to port 80 in IP4 space. The reason I am not identifying the vulnerable software written in PHP is that it would allow any script kiddie smart enough to text edit the existing exploit scripts to exploit that software as an additional vector.

fastcgi_params does not put attacker controlled data into environment variables (without the quotes)

I'm absolutely positive that fastcgi_params does indeed clobber $_ENV with attacker supplied data if PHP is configured as described above. I am less strongly confident that some configurations of PHP will allow $_ENV to get to at least some subprocesses. I am absolutely confident that some configurations of PHP will not allow you to set $_ENV nor set environmental variables. I have figured out ways to configure it which put the fastcgi_params in $_SERVER but not $_ENV and, separately, in $_ENV but not in environment variables passed to subprocesses. I'm aware of a PHP command which the documentation suggests defaults to passing $_ENV as actual environment variables to subprocesses but which I have not been able to verify actually works as the documentation says, due to it being 6 AM in the morning local time and me having insufficient motivation to continue finding more reasons to justify the conclusion that this bug is very, very bad news and bash needs to get patched immediately everywhere.
If you're changing a user's password to revoke access with Google Apps, you're doing it wrong.

Google Apps gives you two options to revoke access: suspending a user and deleting a user. If you suspend a user, you can later re-enable that user. In the event of firing an employee, you probably want to go ahead right away and delete the user - upon doing so you will be prompted to transfer any data to another user.

Edit: Perhaps, they should add a checkbox to revoke application-specific passwords in the change password interface.
Yep, sure have. And you still need backups of your data, that's just good sense.
Could you confirm that you can atomically update a single item inside a jsonb field without reading/writing all of the jsonb data? I know this is possible with hstore (but not 9.3's json type), but can not find a clear answer for jsonb in the documentation. Any pertinent links would be much appreciated!
Correct.

Many automated scripts script kiddies use to DDoS will do a basic check for subdomains like "direct.domain.com" and "direct-connect.domain.com" if the target domain is behind Cloudflare, and the scripts are naive and immediately assume that's the server's real IP.

Setting it to the IP of a site they dislike is also a popular choice.
http://books.google.de/books?id=fBGPBRX3JsQC&pg=PA165&redir_...
OpenStack day two operations tools
Actually, when you NOTIFY a channel in Postgres it gets delivered to all clients who have previously run LISTEN on that channel. And you can send an optional payload (up to 8000 bytes):

http://www.postgresql.org/docs/9.3/static/sql-notify.html
> yet once someone has it deep it no longer matters to them.

Unfortunately, I think it is more accurate to say they are not longer the same person.