skysight-inc/HackerNews huggingface dataset:
Sorry but in this case your application should have been tested to withstand all possible failure scenarios and restart scenarios so I have little sympathy. It genuinely sounds like you don't trust it to come back up which is not something I could sleep on. Things fail, sometimes violently.

Even with our company which has in in-house ops team and our own colocated kit, we expect process failures and restarts and plan accordingly. No sleep is lost even when something explodes at 2AM (other than for the ops team, who in this case you contracted out).
The bug may be bash's, but it's the entire chain that makes it a serious one: http://senko.net/shellshock
Changing databases is extremely painful if there's a fair amount of data already stored there. It doesn't matter how "database agnostic" the code was originally, there are too many edge cases that tend to become front cases over time that you have to adjust for your specific database.

But just like with MySQL, I imagine those who can migrate to another DB would do so at the first opportunity or wait for the equivalent of MariaDB to make a "drop-in replacement" in lieu of messing with their application code.
The point here is that Bash was not designed to receive untrusted user data in environment variables. On the other hand, Apache/dhclient was designed to receive untrusted data, but then handed that over to someone which did not expect untrusted data without validation.

In other words, if Apache/dhclient wants to put things into environment variables, it absolutely should make sure to do this properly and indeed to take into account all possible contexts.
this holds true for most of the US too. If some one gets hurt on your property youre usually liable. Each state varies a little on this though.
yeah, mongodb has flipped from hype to hatred without much in between.

The reason, I think, is that few people using it had a good sense of where the pain points would be. Many of us somehow imagined that because we didn't know where mongodb's limitations were, we wouldn't run into them. Cue frustration when you're bitten by some issue you didn't think about.

I do believe there are good uses for it. But they are pretty specialised, and I'd rather use a relational db for most things.
It's distribution of money, but redistribution of purchasing power, for which money is used as a proxy.
I really don't think making protocols less understandable by humans will solve anything.

This has always been and always will be a hard problem. Consider this quote which I found in The Shellcoder's Handbook:

"Wherever terms have a shifting meaning, independent sets of considerations are liable to become complicated together, and reasonings and results are frequently falsified." -- Ada Lovelace

We've known about this since literally the beginning; we'll be cursing ourselves over it until the very end. Vulnerabilities are going nowhere.
Programming: The Next Generation (2013)
Why is bash the only program which has special permission to trust its input?
Undocumented feature = bug.
> and one of my clients uses DB2

???
Apache does not in general know whether or not data will be passed to bash.

And they can't take into account all possible contexts, because that would involve reading the mind of all possible future users of the interfaces they provide, to make sure none of them decides to call out to programs that treats previously inert data as code.
All the programs at risk here should really be using rbash.
Quoting article: "There's an intriguing exception to the pattern: Classes full of highly skilled students do give highly skilled teachers high marks. Perhaps the smartest kids do see the benefit of being pushed."

Maybe you are in that "highly skilled" group. Unfortunately, average student have different behavior.
This isn't to handle the bash problem?

What is it to fix then?
> I've seen project that leveraged CouchDB to basically return all data for any given view with a single query from a pre-calculated view, something which would have impossible with an SQL database.

This sounds interesting. I've been looking for a good example where NoSQL db is better than relation db. Could you provide more details.
Thank you for the first reasonable comment I've seen on this in a while. So much "lol" sensationalism and not much to say how much I, a fairly typical user, have to care about this.
I guess as a POSIX-compliant shell, Bash can be expected to trust its inputs on stdin and in special environment variables like PATH.

But the problem emerges from trusting 100% of inputs, not just the inputs that are intended to be trusted.
I'll say "it depends."

At work, I have a 450 line function. What it does is very simple:

1) validate the request; if it's invalid, send back an error.
2) look up some information.
3) send that information.

Step 1 is around 300 lines. But a majority of the lines are huge comment blocks describing what the check is for and referencing various RFCs. Yeah, I could have broken this part off into its own function, but ... there will only be one caller and doing so would be doing so for its own sake [1].

Step 2 is one line of code (it calls a function for the information).

Step 3 is the remainder; it's just constructing the response and sending it.

The code is straightforward. It's easy to follow. It's long because of the commentary.

[1] I did have to deal with a code base where the developer went way overboard with functions, most of which only have one caller. It's so bad that the main loop of the program is five calling levels deep. I once traced one particular code path down a further ten levels of function calls (through half a dozen files) before it did actual work.

When I confronted the developer about that, he just simply stated, "the compiler will inline all that anyway." And yes, the compiler we're using can do inlining among multiple object files, which makes it a real pain to debug when all you have is a core file.
The title of this submission is incorrect. Generate is not a preprocessor.
nobody is saying yet, but probably the xen issue that's scheduled for disclosure on october 1
It has permission to trust the input the user enters into it, because that is its job. 20 years ago nobody assumed variable environments were an issue, but this should have been fixed years ago.

I am also pissed that they patched the parser, the feature is still in there when nobody uses it and it has already proven to be a security vuln once.
So if I write a new shell called rash, that executes anything in an env var between, say, backticks, and install it as /bin/sh, it's Apache's job to neutralize backticks in untrusted data? I can agree with some of the things you say, but this seems to be the logical conclusion, and it's crazy.

The most consistent moral I'm deriving here, is that shells are for executing arbitrary commands in a flexible environment, so don't even touch them if that's not what you want. This applies to Apache, CGI wrappers, any other kind of web development.
You say dhclient should take into account all possible contexts before passing data to bash, but it's not easy to know what data shells will parse as code and what they won't[1]. If we have to sanitise data before passing it to shells then the only sane conclusion is to never pass untrusted data to shell scripts. I certainly don't trust myself to know the full range of features in all shells that might suddenly turn a plain text string into executed code. I can't think of any other people that I would trust to know that either.

Is that really what you are advocating here? Don't ever use shell scripts with untrusted data? That has been my philosophy for a long time, but up till now that position has been viewed as extreme by most people I've shared it with.

[1] there are still exploitable bash parser issues to be revealed http://seclists.org/oss-sec/2014/q3/777
Anti-Snapchat
Its used by bash itself for communicating with subprocesses.

Input you type at the terminal is not the same as an environment variable; hackers set environment variables much more often than legitimate users.
if the "cells" aren't visible in such a way that you can distribute your application across them, it doesn't really matter that they exist.
What's wrong with DB2? I know it's commercial and a bit arcane in areas, but it's a far more powerful database than MySQL.
There are other methods of IPC other than shell variables. The shell is a known insecure environment, which is where there are limits on setuid for shell scripts.

By letting everyone on the Internet set shall variables Apache and whatever DHCPd (ISC?) did something they could have known would have bad consequences whether this feature/bug existed or not.

The only data Apache needs to control is Apaches.
Congrats on launching this! I've been looking into using SMS as a delivery mechanism for a while now, for different reasons. Access to, for example, medical information through SMS could be immensely helpful in the developing world.

Two questions that made me stumble were:

- how does the pricing work out? In my research, all SMS services were way too expensive to work at scale, especially with sending to the developing world, Africa etc. You use Twillio, and for developing countries it's mostly 0.01$/message over a local number, but no option to buy a local number.

- what is the difference between land coverage of cellular networks vs. EDGE/3G networks in the developing world? Does it make sense to focus on SMS to increase reach?

Would appreciate what you guys or anyone else has found out about this.
Nope, his insurance is almost gone. He didn't have much employment all his life, but he is looking for part time job now...
Nitpick: PostgreSQL, or Postgres for short. Never "Postgre".
Apache knows what data Apache passes it its own sub processes, which is the issue here. Nobody is expecting Apache to sanitise other apps, just itself.
> even if you are mere a brainwashed Java dev

I see where you're coming from, SLW.
All very well said, but until tools like Protocol Buffers became popular the tooling for working with custom binary protocols has been pretty dire.
I agree with all your points.

I think the real bug is that all this stuff calls out to a shell at all. Sure, it's convenient, but it's basically eval().
> * a company that said about the antenna issue on the iPhone 4: "You're holding it wrong"*

Yes and... that was correct? Every other phone suffers from the same antenna attenuation if you enclose it completely in your hands. But because it's Apple, some news outlets saw a chance to make some pageviews by creating another scandal.

The "antennagate" crap was roughly equivalent to people complaining that a TV won't show any image at all if you set it up facing the wall, and writing lots of grandiose articles about how Apple TV doesn't deliver on its promise in all sorts of common circumstances, etc.
Yes this is true, and much needed.
Did you read the iPhone 6 link? It was done after the Note 4, as mentioned in the write-up. Also mentioned in the write-up was

"Based on our extensive Lab tests and measurements, the iPhone 6 Plus is the Best performing Smartphone LCD display that we have ever tested."
Still sounds like a bug in bash to me.

What if I have a printer called "() { :;}; echo lol", so I manually export PRINTER="() { :;}; echo lol" (see http://www.tldp.org/HOWTO/Printing-Usage-HOWTO-4.html)

I don't think this was the intended behavior even 25 years ago. :)
As a Chinese guy, can I snidely judge Chinese culture?

When it comes to racism, we are among the worst offenders. At least Westerners make the effort to not appear racist - we Asians don't give a fuck.
How much to keep of your startup?
I just listened to Sam Altmans "How to Start a Startup" lecture. One part that irritated me is that it is said that in the end you will probably keep around 10% of your startup.

Im building a startup right now that is suitable for hyper growth. I expect to keep the majority of it. From previous ventures, I have enough money to pay for myself for the forseeable future. And one or two team members if I find them. So far I do stuff on my own. Its a pure software startup. Why would I expect to sell 90% of it?

Zuckerberg owns 28% of Facebook.
Larry and Sergey own 18% of Google.

Any numbers on how much the AirBnB, Dropbox, Pinterest... founders kept?
>So in order to keep food cheap, we have to throw half of it away.

Wut
The Most Extreme Stars in the Known Universe
Enter this PoC in your terminal:

env var='() {(a)=>\' bash -c "echo date"; cat echo

A target patched for CVE-2014-6271 will output the date upon executing that PoC (Proof of Concept):

bash: var: line 1: syntax error near unexpected token `='

bash: var: line 1: `'

bash: error importing function definition for `var'

Thu Sep 25 17:52:32 EDT 2014

There is a new update (#26) for bash 4.3 which fixes CVE-2014-7169 (the old bash update was still flawed/incomplete as demonstrated above by executing the PoC). So, taking into account what everyone before contributed, the new complete patch code would be:

mkdir src

cd src

wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz

#download all patches

for i in $(seq -f "%03g" 0 26); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done

tar zxvf bash-4.3.tar.gz

cd bash-4.3

#apply all patches

for i in $(seq -f "%03g" 0 26);do patch -p0 < ../bash43-$i; done

#build and install

sudo ./configure --prefix=/usr --bindir=/bin --sbindir=/sbin --sysconfdir=/etc && sudo make && sudo make install

Once patched for CVE-2014-7169 the previous PoC should not return the date anymore:

bash: var: line 1: syntax error near unexpected token `='

bash: var: line 1: `'

bash: error importing function definition for `var'

date

cat: echo: No such file or directory

And thanks to all previous contributors!
You could have the best of both worlds with IDE support, once it is there people may stop putting so many innecesary layers if they aren't needed only so that function gets "inlined by the IDE"
But without knowing how other apps treat that data, Apache can not know what needs to be done to sanitize the data.

For what Apache knows, that CGI it executes could treat the presence of the letter "x" in any environment variable as "start a nuclear war".

While it may make sense for Apache to sanitize the data against specific known, common problems, until this week this was not a specific known problem. It might have been if the Apache team audited the code of every plausible piece of code that people might use to interpret CGI scripts, but that's not a realistic scenario.
Postgresql has materialized views now:

http://www.postgresql.org/docs/9.3/static/sql-creatematerial...

Unless I'm misunderstanding what Xylakant means, that's certainly doable in Postgresql and has been in other relational databases for a long time.
I see where you are coming from, and my opinion is mostly the same. However, I can see a use case for relaxing constraints in a distributed scenario, as described by the CAP theorem.

In a distributed scenario, when a partition event occurs, relational databases opt for consistency, whereas nosql opts for availability. This is formally correct behaviour by relational dbs, but comes with a cost. The cost is a serial performance component, that can't be parallelized. Nosql DBs (most of them), in this scenario, go for availability, and may thus eschew some consistency guarantee tasks, with a cost in data consistency and an advantage in parallel performance.

The trick, as ever, is to use each tool in its function. Nosql and relational dbs are wholly different tools, for wholly different problem classes. Using nosql where consistency is paramount irks me to no end, and that is the case 80% of the time I see people using nosql. On the other hand, in specific cases, nosql DBs are a new useful tool in my arsenal.
2015 Ig Nobel award for Politics, right there.

I love this kind of 'research'. It's frivolous, but there is an underlying point about the stressfulness of presidency.
That is the kind of argument a 13 year old would make on tumblr.

Somethings are better than others, not discriminating based on gender, where the gender doesn't matter for the job, is strictly better than discriminating based on gender.

Seriously if this happened in the US you would be up in arms, the Chinese should not be allowed to be different.
I think it's easy to miss the point of docker which is to create a standard unit for deployment. Just like a shipping container is the standard unit of shipping... Which is quite pronounced in their graphics and explanation... Docker helps make it all uniform. You also get cgroups and all the fun stuff that brings, along with a level of isolation and configuration.

I'll concede that my first reaction was "somebody who has finished the docker tutorials should easily be able to make a Go container, what's the big deal?". But, this is targeted towards Go people and not necessarily Docker-Go people.
Debugging Serilog
>Still, what students 'enjoy' is not necessarily what is most beneficial for them in a college course. I think you're setting up the incentives wrong.

This is already overwhelmingly the case in an attempt to secure more and more student loan funds.
Fix Shellshock Bash Vulnerability in OS X Bash
once you start page faulting and hitting spinning disk it's game over for any database's performance, postgres included.
Another example that comes to my mind is Markus Frind, owner of PlentyOfFish. Did he every sell a part of it? I think he kept everything. And makes like 10 million a year. Not sure if that qualifies as "Hypergrowth". What do you guys think?
AFAIK Apache itself isn't vulnerable, because it probably doesn't invoke a shell. CGI apps it invokes might, which is how the vulnerability is triggered.
Serious is a spectrum, someone working on more "serious" problems than you might laugh at the idea of doing any work at all on a single consumer GPU.
Survata (YC S12): Giving Developers Timely Feedback on App Designs
Using Nginx, how could one filter/drop/reject http requests where a http header start with "() {"?

I know patching `bash` is most important (and I have). But it would give some extra comfort.
EMIPS: a dynamically extensible processor
>>
The Kinects can read up to three people on each side, and you can see others through the Cube, which acts as a portal, virtually connecting people who are separated in physical space.
http://www.wired.com/2008/11/eye-contact-tra/

I would expect this to be a hit in Japan where shyness is apparently a taller hurdle to overcome than most of western social norms.

http://travel.cnn.com/tokyo/shop/miteru-dake-videos-stare-ab...
Please describe specifically how would that have helped.

This has nothing to do with parsing text. The problem here is that Apache et all send untrusted data to a process that treats it as code. It wouldn't matter if HTTP was a binary protocol and if bash read a well defined bytecode instead. I mean, look at shellcodes.
It's not about making protocols less understandable by humain, it's about recognising that we are programming computers, not humans and that it's time we accept that there should certainly be a way for the humans to interact with the program at some point we should not force the same kind of interactions on the programs themselves.
It's much harder to make text and text based commands' parsing and handling secure than it is to use binary protocols in the first place.
There are many other ways Bash could do that, though, which would make it much harder for further exploits. Such as opening a pipe and writing them to the sub-process that way so it goes "out of band" from the regular environment variables. Or if it has to be in environment variables: Accept a special argument in the argument list that is a key it uses to sign the variables. It does not need to remain secret - just make sure that just inheriting environment variables with potential attempted exploits is insufficient for anything to get executed.

And/or change the way these definitions are handled - I get that it's tantalizingly simple to just pass this through their usual parser since then you get the function definition parsing for free, but at the very least this parsing of the environment variables shouldn't go through a code path that even potentially executes anything.
If everyone wanted more durability and better battery life we'd still be using Nokias that were indestructible and lasted 7 days on a charge.
SHL EAX,1 and ADD EAX,EAX are the same, time wise. The only difference is that the A flag (auxiliary carry [1]) is undefined for SHL and defined for ADD. SHL EAX,n may be faster than n repeats of ADD EAX,EAX, but there are other ways to do quick multiplication by powers of 2 though.

[1] The auxiliary carry reflects a borrow from bit 4 to bit 3, or a carry from bit 3 to bit 4. It's used for BCD [2] arithmetic, and there is is no direct way to test for it.

[2] Binary Coded Decimal
Just because its a programming language. It can write to disk, open sockets, etc.

"As of PostgreSQL 7.4, PL/Python is only available as an "untrusted" language, meaning it does not offer any way of restricting what users can do in it. It has therefore been renamed to plpythonu. The trusted variant plpython might become available again in future, if a new secure execution mechanism is developed in Python. The writer of a function in untrusted PL/Python must take care that the function cannot be used to do anything unwanted, since it will be able to do anything that could be done by a user logged in as the database administrator. Only superusers can create functions in untrusted languages such as plpythonu."

http://www.postgresql.org/docs/current/static/plpython.html

Incidentally I've been merging my json in perl. It's automatically built into postgres, and the Hash::Merge library with it's configurable behaviour is very handy. Still, looking forward to not doing that. 9.4 is coming before xmas, right?
HelpStack, now for Android developers
threeseed probably wants to use Postgres as a robust transactional backend for MongoDB much like InnoDB is used as a robust transactional engine for MySQL. (There is TokuMX that might fit that use case also).
Get Your FREE PSN Card Pins for a Limited Time
I was about to say the same thing. I've studied economics, and worked in latency sensitive finance, though not for one of these firms, and I've never come across anything that was obvious. Perhaps you could enlighten us about was sort of thing is used, because time constraints seem to imply the algos must be quite short.
The original author of bash (a friend of mine, which is why I have this context) has been being interviewed by various newspapers today regarding shellshock, and finds the idea that he might have anticipated the number of ways people integrated bash into various systems (such as with Apache allowing remote control over environment variables when running software in security domains designed to protect against unknown malicious users) quite humorous. Apparently, it has been an uphill battle to explain that this was all coded so long ago that even by the time he had already passed the project on to a new developer (after having maintained it for quite a while himself) the World Wide Web still wasn't a thing, and only maybe gopher (maybe) had been deployed: that this was even before the Morris worm happened...

> In an interview Thursday, Mr. Fox, the Bash inventor, joked that his first reaction to the Shellshock discovery was, “Aha, my plan worked.”

http://mobile.nytimes.com/2014/09/26/technology/security-exp...
I've always thought it would be interesting to have a statically linked executable that was actually statically linked to externally-visible, signed copies of shared libs that are embedded in themselves, so that the dynamic linker could recognize when two processes, both of which are statically linked, could still share the same pages in memory because they have both statically linked the same lib+version. In other words, you get the memory and io savings of dynamic libs, but you get none of the dependency resolution problems (and none of the disk space savings).