skysight-inc/HackerNews huggingface dataset:
Einstein guy his for his work with Brownian Motion. Nobel prizes aren't typically given for science that lacks a body of supporting evidence, which was the case at the time for Relativity.
Double Special Vegas-Style Condom Challenge
I'm 28. My first memories of heavily using the internet were internet explorer 4.0. I'd say that web accessibility has gotten better and I can use most web applications. Some of this is do to the fact that I am a power user and know my screen reading software well. I can't talk much about how the GUI has effected blind users since I started teaching my self to program at 14. WHile learning to program I also learned to use the commandline and find it is still better for some things. For example I use todo.sh on my PC along with the todo.txt touch app on iOS to keep track of tasks since I find that on the PC a commandline interface for something like task tracking is quicker. FOr email I use the standard gmail web interface or Thunderbird instead of a text based email client because I find it easier to use especially since I do not have a lot of email to deal with.
Ssssh! Nobody talks about Keyboards Club!
Anybody else uncomfortable with the fact that these drop-in keyboard replacements are effectively sanctioned keyloggers that send keystrokes to a remote server?
Yes, just put a bash script called ls $HOME/bin, put that directory in $PATH, run sudo ls, and off you go...

Hopefully you would not be white-listed to run things like that (always put the full path in sudoers), so you will need some sort of "obviously bash" in the log, but we all know what we have done at moments of interaction with paper-cuts. We have probably all lessened our security to ease discomfort here and there.
The core concept of emacs, for me, is Lisp; that it's always there, an M-x eval-region away in any buffer, that creating new commands and altering existing commands is utterly trivial. I wouldn't give that up when moving to another editor.

I find helm much better than ido for most purposes. I couldn't live without helm-git-grep - it's how I navigate everything. I even add all my installed gems to a git repo just so I can use helm-git-grep easily when browsing / debugging 3rd party code.

I've gone through maybe 6 editors and IDEs in the last 20 years. I wish I'd started using Emacs 15 years ago instead of 15 months; I'd have wasted less time configuring keystrokes, and be more cumulatively productive.
Thankfully, there is a good chance that they are screwed:

"Other features of the new Asrar Al-Ghurabaa' project, according to the announcement, is that it uses a special or unique encryption algorithm."
I did Web Dev in my spare time as a hobby, managed to get some work from a designer on a forum i was part of, and it just kinda went from there, got to a point where i was making about as much doing web dev as a chef, so just quit the chef job.

I've basically always been freelance, had a few permie jobs but im not very good at having a 9-5, too business minded for that crap. If i was to do contracting for a whole year, i'd make around £100k, but i tend to instead do contracting around 3 - 6 months a year and do my own business related things the rest of the time.
Movie Shaker iOS app is designed to find a great film to watch in 10 seconds
You want your keyboard to be fun and quirky?
Emacs has a bunch of jargon that takes some getting used to.

A buffer is a file opened in the editor. The cursor is called the point, the text selection is called the region and is the text between mark and point. You open files by "finding" them. A pane in the editor is called a window.

Cut is called kill, paste is called yank, and there is no single simple jargon for copy - it's killing without deleting the text.
Shellshock Bug Logo - http://imgur.com/vlriele
When you turn them on, Android will even warn you of that possibility. SwiftKey has some sort of cloud (opt-in) feature[1] so it's a keylogger with benefits.

[1] http://swiftkey.com/en/more-about-cloud/
Yes, but you need the actual physical hardware to work with. It's completely impractical for the kernel to unit test drivers that work with hardware that most developers do not have access to.
Ask HN: Feedback for my first site
Hi all,

I recently put up my first website at http://searchgovernmentjobs.org. My initial thought was to just put something out there on the internet, so I searched data.gov until I found a relatively usable API, put a wrapper that lets you query it, bought a domain, and set it up on DigitalOcean.

Now that it's up though, I would really like to make it self-sustaining. Currently having it up costs around 7-10$ per month. Does anyone have any thoughts on how I could monetize it to generate at least that much ? I have thought about using SEO to get it up search engine rankings, but this is a competitive space (job searches) in terms of SEO keywords. Additionally, Google seems to have overhauled its algorithms often enough and recently enough that advice on the internet tends to be outdated.

Also if anyone has feedback on what I could do to make the site better, I would love to hear it. Any next steps you have in mind would be great to hear as well!

Thanks!
Landing Page in a Day – Get a custom landing page that converts
I just saw something from 89.207.135.125 -- no idea who that is.
The proposal seems to be "use more hyperlinks than you already do", while being quite arrogant about it.

Mathematicians already use numbered equations and steps in proofs and quite a bit of referals and links, while trying to keep things readable.
Adding absolutely trivial remarks like "This corollary to the previous theorem uses the previous theorem" do not add any value and are thus rightfully dropped.

Further, if you are already dropping trivial steps (e.g. working with fractions in step 5) then it boils down to:

Number all your steps down to a level of triviality I want, which is going to be different from the one you want.
I have been using SwiftKey for like 15 minutes now and it is amazing! I don't know how I missed it. Where was HN?
What about this counter-example - do you own a bottle of vodka if the government says that it's illegal for you to let a child drink it?
So only servers actually executing bash with input from browser (cookies etc) are affected (like CGI)?
Level Up your Nmap skill with these 7 Recon scripts
Fully agree.

Just as info for others.

This is the model followed by environments for Common Lisp, Eiffel, JVM, ML languages, .NET, Dylan, Erlang.

Best of both worlds, JIT/Interpreted for development and JIT/AOT for production.
If you control the client software, theres no reason to use a certificate authority instead of making your own CA or just using self-signed certificates.
One of my favorite early Rust features, in theory, was the interactive shell called "rusti". In practice it was awful to use because it was slow, crashed all the time, and required whole blocks of code be entered at once (declaring, defining, and using a variable for example). Some of that was attributable to beta status of the language but it seems like they ditched it in the end. Is there actual value to this sort of thing for languages that are classically compiled instead of interpreted? At least for Go, Rust, and C speed of compilation is less of an issue overall but compiling C++, even with clang, is so much of a bear that I can't see this catching on.
His talk about himself and Scorpion at Global Wealth Summit

https://www.youtube.com/watch?v=JeVVSr6Xx60
Awesome product. Just tried it with HN and my startup site. Very cool.
Ask HN: Selected for Microsoft Interview, which department to choose?
Hello Guys,

A friend of mine has been selected for Microsoft technical interviews for both IDC and IT departments. There's a dilemma because there's choice to appear in only one of them.
I'm in need of suggestions of where to apply and why?

Thanks
RubyMotion for Android and Renewals Pricing
AppSpice – Get FREE Downloads and FREE Cross Promotion for Your Apps
Hi all

Get FREE downloads now with the new platform - AppSpice:
http://www.appspice.it/

Join now here: AppSpice | Register to get 100 free downloads for your apps.

Why use AppSpice?

- Get FREE Downloads for your apps
- FREE Cross Promote your apps with the SDK
- Simple traffic share model - you get 80% of the cross promotion traffic, the rest is for AppSpice promoted apps
- Get your app promoted in our apps for FREE

The promotion will last only a week, so get it while you can

Join for FREE: AppSpice | Register

Kind regards,
NaughtySpirit team
Wasn't that hotwire? [1]

1: https://pypi.python.org/pypi/hotwire
Marketing Technology: Where to Invest for Your Small Business
Fun interactive tool to improve those unproductive team meetings
Am I the only one uncomfortabke with a third party managing my keyboard? I wish Android had a sane security policy for keyboard controls but they don't.
That's not how to think about it. Your web application is vulnerable if it spawns shell scripts, with any user supplied data in the environemnt.

One way for that to happen is if your CGI-application runs things via os.system() / system(). It is not the web server itself that has the problem, nor any common CGI-setup (unless you write your CGI-scripts in bash, in which case you are guaranteed to have other problems).
Sudo already has a feature like this.

/* Skip variables with values beginning with () (bash functions) */
if ((cp = strchr(*ep, '=')) != NULL) {
if (strncmp(cp, "=() ", 3) == 0)
continue;
}
A buffer doesn't have to correspond to a file, e.g. "built-in" stuff like Messages or Help or scratch. I often "C-x b asdlkfj RET" to create a new "scratch" buffer for quickly jotting down something or transforming something. I can of course save that buffer to file, or I can just kill it.

When coding elisp, you often use the (with-temp-buffer …) macro to do more or less the same thing :-)

Also, several buffers can correspond to one file: "C-x 4 c" runs clone-indirect-buffer-other-window which creates two views on one and the same file. This is not the same as splitting the window: The two buffers can each have their own, different narrowings applied. Say you have two functions defined in one file, they're almost the same, so you want to compare them. Now, clone the buffer, narrow the first buffer to the first function, the second to the second, and now you can run ediff on the two buffers :-) Or you can even open the same file in different major modes at the same time …
http://www.cvedetails.com/vulnerability-list/vendor_id-6276/...
Migrating release data to GitHub Enterprise
Because the guy who wrote this website is an iOS junkie?
Plus any DHCP client that runs shell scripts using parameters from The Evil DHCP Server, for example.
Useful Tools for Python Developers
Piktochart Infographic: 9 easy steps to encrypt your emails
My question "but what if a real value is ever sent that looks like one of these magic values?" is usually countered with "but who's ever going to send this value?"

Have experienced the same situation so many times with CSV... "Who's ever going to have a doublequote in their name?" At least there is an escaping facility in most formats.

I haven't seen any "how this was discovered" for the bash bug, but my bet is that someone needed to store "() {" in an environment variable in a shell script. It's not inconceivable - the first thing that comes to mind is a shell script that generates shell script functions.

There are so many ways of transferring functions to subshells that don't involve magic values in a free-form key/value store, but all of them would have been more complicated, so people chose the quick hack.

I'd say the problem is more that they chose to use the name of the function as the name of the environment variable; this would not have been an issue if it stuffed all the function definitions together in an environment variable with a special name, like BASH_FUNCS. Shells already interpret environment variables with special names in certain ways (e.g. PS1, PROMPT_COMMAND), up to and including command execution, so this way would fit with that model far better.
the rat animal for the right job...
You're right and there hasn't been a terrorist incident in Australia targeting Australians (I don't think ISIS is specifically targeting white Australians, rather Australians in general), but I think that there being an 'increased threat level' is still appropriate.

Whether or not the perpetrator of the stabbing had an actual link to ISIS isn't clear, but he had his passport cancelled over concerns he would fly to the Middle East and he had previous posted photos online with the ISIS flag: http://www.theage.com.au/victoria/numan-haider-from-teenager...

Of course most Australians travelling to the Middle East are involved in terrorism, but there are Australian residents or citizens travelling to the Middle East to fight adn they have been involved in two suicide bombings as well as apparently joining organisations designated as terrorist by the Australian government, and so I'd say that they are certainly linked to terrorism.
Agreed, I was expecting a discussion about mechanical keyboards
Ask HN: Ideas for a “Hacker/Developer Space”
We've been brainstorming ideas on developing that perfect hacker/developer space, where people curious about programming can come, learn and teach each other. Basically an awesome place where you'd love to hang out and talk about programming.

One of the major long term goals is to develop and foster the developer community in and around this area (Eastern Iowa).

There are collaborative spaces here, but they are mostly focused at growing businesses and entrepreneurship. They are doing a great job with that, but we as developers find the whole ecosystem lacking support to allow developers and the developer community in general to grow.

So far, we have our ideas listed here: https://github.com/verma/iowa-hacker-workshop

Just wanted to put this here and get some feedback, suggestions and general advice.
Restarting an instance (not stop-start) doesn't change the hardware you're on, so I don't think this has a physical explanation.
How people are going online in Africa now [video]
Swype supports two simultaneous languages.
> Relatedly, "many eyes makes all bugs shallow" is, and always has been, totally horsepuckey.

Consider that the contraction of the more complete saying "Many eyes make bugs shallower than they would be if there were only few eyes".
جنازة خالد صالح من مسجد عمرو بن العاص بالصور والفيديو بحضور الفنانين
Ownership can be subjective, but I'd agree that you don't have meaningful "ownership" of the land if you have no ability whatsoever to limit access. There's a wide range of in between, though.

In this narrow case (public access to the Martin's Beach), I'd say Khosla still clearly owns the land. He's just not allowed to use land ownership to cut people off from the coast. The court has required an easement, based on historical access routes. Nobody is allowed to wander off that trail and hang out in Khosla's garden or living room. In this sense, public access is limited, and provided to the minimal extent necessary to ensure that public ownership of the coast is meaningful ("minimal" could be debated, some might claim that our ability to get to this coast on a kayak is good enough, but courts clearly have interpreted this to mean land-based easements).

My understanding is that in Norway and some other nordic countries, land ownership does not include the right to prevent people from reasonable travel across it. That may even include camping on the land briefly. That's definitely a more limited concept of land ownership than you typically see in the US, but even that doesn't really mean you don't "own" the land, as the owner clearly has greater rights to it than the public.

I don't think the car analogy advances the argument much here, as there are clearly different kinds of property rights ("if I can't lock the doors and prevent people from sitting in the driver's seat, clearly I don't own the lyrics to the song I just wrote…").
Mostly using the application-specific backup tool (pgdump, mongodump, etc) to S3. For system configuration it's all in Chef, so I backup chef.

For a few flat file tools I just tar up the directory and upload that.

Sometimes, I just take AWS volume snapshots. That'll get the whole data or / partition, which also lets me instant restore the machine, or attach the data partition to a newly built machine.
If I understand it correctly, nginx in that gist refers to a binary that is not nginx and is only named so that it won't look suspicious in the process listing. apache httpd / nginx without CGI should be not vulnerable. However, if you use PHP or any other language and that performs some sort of system() call, there's a vulnerability.
Yes the syntax looks familiar, I got few more responses that match the commands from that pastebin. Seems like a general C&C setup where they just add new exploits as they get published.

Anyhow, doesn't seem like it sends anything to Cloudflare. I think it just checks if the IP is alive (perhaps this is how it tests connectivity to the internet). It also checks my routing table and extracts the MAC address.

P.S as of now, the CC server at 89.238.150.154:5 is not accessible.
The standard way of doing things in Python is to use subprocess __without__ Shell.

https://docs.python.org/3.4/library/subprocess.html#security...
I like the idea of offering the service for a flat fee. The "before/after" section is cool, too - although it reminds me of the "lose 20 pounds in 2 weeks" ads I see on Facebook :-)

This is productized consulting at its best.
yes. contrast:

1) Beaker is language neutral from the ground-up, and not only can you mix languages, they can communicate. IPython does not have good support for multiple languages in the same notebook. And the backend is still pretty python-specific. Jupyter is working to address this, but I don't know how far along they are or how far they are going to take it.

2) Beaker UI has some nice new features: eg hierarchical sections that you can open and close, and one-click sharing.

3) Beaker is highly configurable and extensible via plug-in APIs so you or your organization can add your own languages, media types, security and authentication protocols, data sources, formats, menus, etc, and not have to worry about merging when a new version comes out.

4) Beaker has a great R backend.

5) Beaker is hiring! See http://www.twosigma.com/careers/position/936.html and http://www.twosigma.com/careers/position/935.html

compare:

1) Both have the same notebook and cell document metaphor.

2) Both are Open Source.

3) Both are great tools that I love.
Water vapour absorption in the clear atmosphere of a Neptune-sized exoplanet
The advent of SSD has been redefining moment in PC history. Earlier when friends or relatives complained about slow PC, solution offered was add more "RAM" which was not possible as "RAM" always kept evolving with tie up to motherboards.

But now my first suggestion for them is to go for SSD, which instantly fixes their old "slow" PCs. Thus eliminating the need to buy a new PC/laptop.
The real reasons are management overhead and big corporations viewing all developers as equivalent, expendable resources even though it leads to subpar work, extended deadlines and constant industry burnouts. Technology getting more complicated is a poor excuse for the AAA game industry's gross incompetence in mismanaged funding.
Micro Python store is now open and taking pre-orders
Pyret is implemented in JavaScript so we can have a completely in-browser runtime. And since the Pyret compiler is implemented in Pyret, that comes along for free and can be run in the browser as well. JS is far from an ideal compilation target (especially for a functional language, it requires jumping through some extra hoops [1]), but compiling to it lets us deliver the language to students with no installation necessary [2].

[1] http://www.ustream.tv/recorded/43777177
[2] https://code.pyret.org
From the article:

"Of course one means of mitigating this particular attack vector is simply to disable any CGI functionality that makes calls to a shell"

If you're on Ubuntu:

a2dismod cgi
service apache2 restart

If you're NOT running any CGI scripts this will disable CGI support in Apache. Not sure if that takes care of things 100%, but might be helpful.
Excellent, a comprehensive write up on the issue. Exactly what I was looking for.
I was going to note that 8pen[1] was left out of the Android list, but it doesn't appear to be on the Play Store right now. According to their website they are working on a new version.

[1] http://www.8pen.com/
The Wacko in the Morning Show 09/25 by the Wacko Network
There were around 480,000 ticks in my sample - who do you believe? ;)

The difference is probably in what is defined as a "tick" for the purposes of computing the stats. If you are using traded prices as opposed to quotes, for example, you will get very different results. If you sample at regular intervals (e.g. 1s) you will get different results again.
A little more detail and an interview with Jonathan Fraine in the Washington Post, http://www.washingtonpost.com/news/speaking-of-science/wp/20...
What does "d6c477a79ea7a633c2bb0e358e32399c1b18eb7d" mean?

Also, I'm learning about this and am primarily concerned about the possibility of remote exploits -- if a web server returns 404 for an invalid URL, how does the attack vector work if the exploit writer does not successfully guess a URL? Thanks.
The scale of pwning going on is unbelievable.
But wget is not specialized security software.
Took them 2 years but they finally made it: https://news.ycombinator.com/item?id=5016242
Very true. SSD make a huge difference no matter your hardware, and certainly makes any old system look fresh as new.
"you're not free to booby trap the path to your front door"

In UK you can't even booby trap inside of your house. Even killing someone who is trying to kill you is not recommended.
Apple doesn't allow third party keyboards when you're using a password field, so someone is thinking of it.
There's a much less sinister reason for WD buying HGST: SCSI/SAS support. Way back when in the '90s WD tried to enter that market, and a company I was at even got some of those drives, but from what I heard while their read rate was OK their write rates weren't competitive with Seagate and IBM (which sold their disk drive business to Hitachi after the Deathstar screwup). And they exited that segment of the business, and hadn't, last time I checked, returned to it.
Growing Rails Applications in Practice
I'm wondering if it wouldn't be possible to still support "export -f" while making it harder for attackers to fake it out. For example, if "export -f foo" put the function body in an environment variable named "BASH_EXPORTED_FUNC_foo", instead of just "foo", then the next bash, on startup, wouldn't have to even attempt function-body parsing on environment variables which lack that prefix, including a lot of the currently trumpeted attack vectors (SSL_whatever, HTTP_whatever, TERM, SSH_ORIGINAL_COMMAND, etc.)

This wouldn't be complete mitigation, and isn't a substitute for the current patches, but it could possibly reduce the attack surface for exploit of any similar remaining problems.

(I can imagine that someone, somewhere, as added an "export -f" env var to an AcceptEnv whitelist, or some such thing, and would need to change it, but that's probably a very rare situation.)

(Edited for clarity.)
I would also be interested in a landscape only package at a reasonable price.
So trying to understand the issue here, is this actually a bash thing or a problem with the web server forwarding commands to bash? I don't understand why bash would be listening to network traffic on its own.
So, you are arguing for K to 12 education to be private? And you are arguing for public health systems outside of the US to adopt the US model which is much more expensive with no demonstrated better outcome for the general population?
Exploring MVC Architecture
Often? what language does '12 + "34a" gives 46'? Not even perl does that.
Stopped reading when you referred to 'shitty implementations' in C#.