skysight-inc/HackerNews huggingface dataset:
dhcpcd-6.4.7 is hot off the press, the main improvement being mitigating the bash "ShellShock" exploit by escaping all characters as noted in IEEE Std 1003.1, 2004 Edition, 2. Shell Command Language, 2.2 Quoting except for the space character.

Needless to say, the entire BSD family is not affected by this bug as bash is not the default shell and to be fair a lot of Linux distributions are not affected either. If bash is your Linux distributions /bin/sh, OR you have applications directly calling bash, you should be telling them to get with the times as most people have since moved on to ash, dash or busybox for more efficient processing.

Regardless, shell is such an important in part of the system - it allows non programmers to "do things". Thanks to the dhcpcd hook system, a user was able to start tcpdump on hotplugged interface before dhcpcd actually started using it during the boot process. Why he wanted to do this, I don't know, probably for some debugging. But the point is, how would he have done this without shell hooks?

The important thing to take away from this is don't lock yourself into one technology - strive to be portable. dhcpcd works on many OS's, libcs, shells and userland tools. If any of them prove faulty, swap them out - including dhcpcd itself! But please at least tell me why you're swapping dhcpcd out so I can improve it :)
Why would you believe a company that said about the antenna issue on the iPhone 4: "You're holding it wrong". There are way more complaints and pictures to be found on this issue than the ones that Apple reports.
That may be true for some, but not for me. Not only was I paying most of the tuition bill, I selected classes based on what I though was knowledge I needed for the career I wanted. An "easy A" didn't figure into it.

I wasn't interested in paying lots of money for nothing. I also wasn't interested in attending a university known for easy grading.
Huh. That's a little silly given the venerable HSTORE already has this capability:

create table foo (d hstore);
insert into foo (d) values(hstore(ARRAY['key', 'key2'],
ARRAY['value', 'value2']));
-- "key"=>"value", "key2"=>"value2"
update foo set d = d || hstore('key', UPPER(d->'key'));
-- "key"=>"VALUE", "key2"=>"value2"

Seems like JSON / JSONB need operators to merge two objects. In fact isn't JSONB sharing the data format with the new HSTORE2?
Samsung Galaxy Note Edge as Powerful as Galaxy Note 4
dhcpcd-6.4.7 is not vulnerable to this issue as it sanitises variables before calling the shell.
Come on. To call itself a database the product should have state-of-the-art storage technology implemented, not just a simple API which always returns OK before actual data has been committed to disk.

In old times you could suddenly switch off power of a running Informix server and it will correctly restore the state on that very moment after reboot, dropping all partially (unfinished) transactions, keeping all the committed ones, so it was possible to have a clean state of the system.

How does it work? Append-only so-called "physical logs" on an direct-access, unbuffered by an OS and hard drives storage, proper partitioning on separate physical drives (for real parallelism), etc.

Again, real databases are all about data-storage (architecture, data-structures, algorithms, design decisions, proper implementation) not some "user-friendly" APIs and "well-written" docs to quickly gain popularity among ignorant.

Database back-ends are among the hardest problems in programming and the amount of research which has been done in 80s and 90s in this field is quite remarkable. I doubt that a bunch of punks with professional marketing and sales techniques could adequately replace implementation of a high-performance and fail-safe storage back-end, which is called a database.
The Rise of the Middle Kingdom: China Now at the Center of the Technology World
SSA should be thought of in terms of control flow. The immutable variables are a tool that makes it easier to reason about control flow and that flattens variable scoping. When you have nested lexical scope and immutable variables, that looks nothing like SSA. No one ever calls Java code that uses final SSA.
Some people like to solve this problem with 'goto's, as in the 'small' subfunction in https://golang.org/src/pkg/math/gamma.go

Personally I'd like to see something like Haskell's "where", to create a scope for private functions in the "B style":

void largerFunction(void) {
small1();
small2();
} where {
void small1(void) {
...
}
void small2(void) {
...
}
}

Until that becomes possible, we can always just make sufficiently small modules with few public functions.
Regarding that since 2005 many more people have gotten access to the internet, it may be unavoidable that the percentage of people directly interested in programming specific articles corrects itself to a normal level that reflects interest measured over the whole population, instead of only a special group of tech enthusiasts. The title is link bait and the page not really worth much.
IIRC, that wasn't a official response but an off-the-cuff answer from one man, who is now dead.
Tentatively - this might not really be much of a problem? In many situations, we deliberately make sure we have excess capacity because it's better to have too much than too little. For example, I have a server running idle most of the time, but it's available to pick up a large long-running task when a user requests it. Analogously, when catering for an event, people often aim to have more than enough food for almost all scenarios, so they'll throw away food almost all the time. Running a restaurant is catering an event every day. When I was a teenager, I worked at Subway and we'd try to have more than enough bread (we only ran out once when we didn't anticipate a large sports-win-based city-wide party), so we'd throw away excess bread at the end of each day.

Of course, people are starving and that's terrible. But reducing food waste in developed countries doesn't seem like a powerful lever to reduce it. Non-wasted food isn't going to be transported to developing nations. Reducing food demand would likely decrease food prices, but I wouldn't expect a large decrease. If my understanding is correct, the food supply is quite elastic, meaning we can easily produce more if there's people willing and able to pay for it.

I think that the two main problems behind starvation are the lack of purchasing power of the poverty-stricken, and broken political systems. Solving those would eliminate starvation, even if the developed nations waste as much food as they like.

(I'm no expert on this and welcome any corrections or opposing views.)
How can it be that Linkedin's mobile site is faster than its native app?
I find this baffling?
Well, you won't find one. That's a property of the way the system works. It can be either good or bad, but you won't find an example on how to store and query whole documents with a map/reduce implementation on an SQL database. Both can be either a good fit or a bad fit to your needs - I've seen project that leveraged CouchDB to basically return all data for any given view with a single query from a pre-calculated view, something which would have impossible with an SQL database. That's a good fit. Using a document store as drop-in-replacement for an SQL dabase is most of the time a very very bad fit.

The general issue that I often see is that people don't choose their databases by "is this a good fit or a bad fit for our use case" but rather by "that looks cool" or "we need that to attract talent" or "we did that project with X, so X is also fine for that new, totally different thing". And then they also try and stick with it at all costs, instead of acknowledging that the choice was a bad fit. And then they call you and say "we have an X database in flames, can you come in and rescue our data? Best would be yesterday?"

This is not restricted to document databases. I've seen apps run on mysql on a cluster with 10 Sun XFires where after a man-month of index-optimization 3 would have been sufficient. That was like shooting dead fish in a dry barrel. A lot of developers don't want to bother with stuff like "how does that complicated piece of machinery actually behave if I push it."
I'm sort of struggling to imagine anyone really using MongoDB at all in a couple of years.

But then again, plenty of shops still use MySQL (and one of my clients uses DB2...).
Anaerobic -- so, composting it would not produce methane?
Russia's new law: the beginning of the end for Facebook and Twitter?
So CouchdDB qualifies? Given a proper hardware underneath it will at most loose the last, unfinished write.
Hukou was something introduced by the Japanese during the occupation to "subjugate the Chinese population." Strange that the CCP decided to keep that.
Bromine, bromide and brominated organic compounds are all completely different chemicals. Like chlorine gas (Cl2) and the chloride ion in table salt (NaCl), they behave completely different.

Even with the brominated organic chemicals, each one can behave differently. Very subtle differences in organic molecules can lead to drastically different behaviour. Lumping all those compounds together doesn't make much sense, they have to be evaluated individually (or in closely-related groups).
On building portable Linux binaries
This is very interesting. Around when MongoDB was quickly becoming the cool thing to do I'd ask people about why it is better than just storing things in Postgres. People would have answers that would be grammatically correct but would not make any sense.

That being said, I find it weird that now it is cool to make fun of MongoDB. Some people on this thread have even said they want to know if a service is using MongoDB and they'd not use that service. I am pretty sure they'd be all over Stripe (who store your money related stuff in MongoDB) in a different thread.
It is hard to believe but it seems to be true. Also, it ignites another discussion; Are we alone or do we have some company in this universe.
No problem, you were right to correct me.
From what I've read most (of the few that there are) bending cases happened with a 6+ in the back pocket. If you stuff a giant phone into your pocket and then sit on it, and then it bends, tough shit. What do you expect?
Oh dear. You've got a lot to learn about trolling, I'm afraid. Subtle is the key.
I feel cheated that this isn't about the terminal control library.
How Giving Thanks Can Backfire
How to lose weight without eating suplements (Leptin secrets)
Decade ago it was the same story with mysql.
MongoDB work well ONLY if indexes (and working set) fit in the memory. What are the indexes size in the benchmark? (I doubt as I see you are running a 145GB database on a 32GB instance)

http://docs.mongodb.org/manual/tutorial/ensure-indexes-fit-r...
About 7 years ago I remember in Australia we had a couple of bad years of drought and there was a food shortage.

I remember reading in the paper that this would put the cost of food up, in some cases because we would be importing but in other cases becasue of the simple fact that when things are scarce they cost more.

What was really striking to me is that no-one was going to go hungry - we weren't going to run out of food. It would just cost more. Therefore people would naturally waste less food I suppose.

So in order to keep food cheap, we have to throw half of it away.

The same goes for virtually all resources: power, water, petrol etc. what the political debate always dodges here is that in order to reduce consumption the cost has to go up which means discretionary spending power will decrease and the economy will collapse.

The sooner the better.
Are you confusing MySQL and MongoDB? InnoDB is a MySQL storage engine.
I use literate programming for exactly this kind of tension. You can have blocks of code written elsewhere with a high-level overview for your function, but in the built program, you can see it all in one place the way it will be run.
Someone's already done a proof of concept of this, see https://github.com/JerrySievert/mongolike
I do not share your optimisim about reputation systems. One of the benefits of an employer (who can be regulated) is that they have an economic incentive to do that filtering on behalf of the customer in order to protect their own bottom line. I don't want to spend time figuring out if a cab driver is legit or not, life's too damn short for that. That's part of what I am paying for when I hire a cab.

Meanwhile Uber has another PR headache as of last night...
http://www.sfgate.com/crime/article/Uber-driver-accused-of-h...
That's a great explanation!
The ones Karmack talks about. Several "concepts"(functions in this case) with implicit relationships (like what calls what, and in what order) are (sometimes) more difficult to absorve than a huge block of sequential code.
Blackberry Z10.
Exactly! I can't imagine anyone using MongoDB at all in a couple of years either. Everything will be in Node!

But then again, I am going to say the opposite of what I just said to hedge my bet and point out plenty of shops still use MySQL. No serious company like YouTube, Facebook, or until recently Google Ads would use it.

I love sitting in my armchair and passing technical judgements without providing any technical details!
> Except it is not extendable.

Function pointers are a good way to achieve extensibility in such cases.
The ones Karmack talks about. Several "concepts"(functions in this case) with implicit relationships (like what calls what, and in what order) are (sometimes) more difficult to process for a human brain than a huge block of sequential code.
> This feature is documented under the -f option of the export built-in command. The implementation detail of using an environment variable whose value starts with "() {" and which may contain further commands after the function definition is not documented, but could still be considered a feature.

This undocumented implementation detail is also a limitation on the use of regular environment variables, and should be documented. When reading documentation about a mechanism, I expect that special magical strings which change behaviour of the mechanism are clearly documented. If such documentation had existed, someone might have noticed it and guarded against it.

> Assumedly programs like apache filter out environment variables properly. But unfortunately, in the validation of input data, they fails to validate correctly input data because they don't expect that data starting with "() {" will be interpreted by their bash child processes. If there's a bug, it's not in bash, but in apache and the other internet facing programs that call bash without properly validating and controlling the data they pass to bash.

It isn't easy to validate and control data against an unknown magical feature in one of many possible shells.

> But on the other hand, it is free software and not difficult to check the source to see as the nose in the middle of the face, what is done. When reusing a component with missing specifications and lacking documentation, checking the source of the implementation should be standard procedure, but it has clearly not been done by Apache or DHCP developers.

I think the shell is specified in POSIX/SUS. Checking the source of all possible open-source shells would be a huge job. I don't know how they should check source code of the closed-source shells. I don't blame them for using the environment variables according to available documentation.

Edit: typo
You are right on all counts.

As someone who evaluated and eventually recommended against implementing MongoDB for a new product, I entirely agree with you. The Mongo implementation was shot after about three months of wasted time after failure in pre-production testing. It was rolled back at great cost to SQL Server with a light document-style abstraction as Mongo failed miserably on precisely what you said: reliability, consistency, scalability and storage management.

Proper relational databases (PostgreSQL, Oracle, SQL Server in my scope of experience) can take an absolute incredible amount of punishment without breaking any guarantees. The relational bit above is optional but it is at least something you can choose to use or not.
Sitka High School District's Design and Fabrication Lab [video]
had that same problem and additionally performance problems on ssds with fast writes (postgresql) even when turning off the COW
A new addicted game?! I love-hate it!
Interview with Peter Piot Discoverer of the Ebola Virus
basically you need to integrate an ldap server with a decent frontend.
P0sixspwn jailbreakDownload Pangu and latest jailbreak tools
> Reading this story in Hofstadner's GEB destroyed my ability to accept mathematical proofs as "proven".

I'm not sure I understand why. If the tortoise had insisted that one plus one is three, would it have destroyed your ability to accept arithmetic?

I'm not sure what Carroll intended by this piece, but what I take from it is that there's no sense arguing with irrational people. One can certainly claim to accept A, and accept if-A-then-B, but deny B; one can also claim that up is down and the sky is candy-striped.
in a enterprise setting you rarely want to remove devices/space.
What the man in the viral video did was focusing the force in ONE POINT, not in a line like in this experiment.

He focuses the force on the lateral side of the iPhone in order to bend it.

This is probably not very representative of having your phone in your pocket as Apple says but makes for an impressive video that gives you views(and money).
The reason you didn't starve wasn't that people just wasted less, but also that you had the capacity to import. The economy that you so hate is what prevented you from starving in the first place.

The countries that experience hunger are either too poor to afford imports or involved in a conflict.
You mean the then CEO, Steve Jobs?
Skip the article. Three points seem most important:

> "I am Allen Funt's son!"

> A Candid Camera remake is coming soon. Watch it!

> The NYT can't find enough news, so it fills space with entertainment
Dropped by dead-code elimination. A compiler might conceivably issue a warning that the first break is unreachable, though that's never happened so far.
Syrian Tank Destroy Enemy Bases in a Building
Well that is a service I won't use then.

First of all you communicate all details so I know how I will be affected. Secondly you don't shut down my service ever, for any reason, other than lack of payment.

If you can't do those things you don't get to claim to have excellent support.
Iterate until success
The 6502 also has a similar 1-stage pipeline, and the concept was old already at that point, though not used much commercially outside of Cray's designs for CDC.
I agree. This is an interesting idea, so I upvoted the paste. But I don't think this author knows how deeply the bug runs, either; the most recent way to exploit it is to export an environment variable of, say, ls to a bash function. [1]

Usually the amount of toxic environment variables are considered to be finite; PATH, LD_PRELOAD, etc., etc. If the name of any executable on the PATH is dangerous, than the number of toxic environment variables is infinite -- are we to scan the entire PATH for each environment variable to make sure it isn't dangerous? What if the CGI script updates PATH?

There is no way to solve this problem with sanity checks. I've yet to peek at the source, but I'm told this feature is vital to implementing things like backtick operators. I think it is too dangerous however, and I don't want shellshock to become a class of bug rather than an instance of toxic environment variables. We're going to have to rip this feature out and re-implement large portions of functionality.

The author is right that this is a product of bash being written in a more trusting time. This is not the first nor the last time the 1970s security models will come back to bite us.

edit: forgot reference:

[1] http://seclists.org/oss-sec/2014/q3/741

edited to add:

Also, Apache does have a mechanism to filter out toxic environment variables; headers are added as HTTP_HEADER_NAME, because its generally the names of environment variables that allows them to be dangerous and not their content. Executing code as a result of parsing the value of an environment variable with no special meaning is a vulnerability.
Thank you, I really appreciate the comment.
Can't believe all the down votes for this!
People in India HATE their neighbourhood.
http://www.washingtonpost.com/blogs/worldviews/wp/2013/05/15...
It's an "internet tech" bug. Every developper should know how hard it is to parse textual data vs well defined binary in a secure and fool proof way. Yet every damn internet piece of infrastructure is based on handling textual data, mash it up, pass it around, escape and unescape it in hundreds of stupid formats. No wonder that most security troubles surfacing over the years are some form of abuse of this crazy design flaw: buffer overruns, sql injection, the openssl bug a few month back and now this. Let's go back to sanity and use well defined binary protocols where there is no damn way to send a command by text but only very explicit semantics, and stop the unix way of thinking that text should be more than a human interface. Text should never be used as a command language in between complex programs. Period.
I never really "got" the new wave of NoSQL databases. Mongo seemed to be the one I could most easily wrap my head around, but still.

I was never sure, though, if that meant I had never faced a problem suitable for one of these DBMSs or if my mind is just so warped by years of using relational engines (mostly Postgres, or SQLite for simple projects) that I could not think of modeling my data any other way.

Recently though, I had to get familiar with the database schema of the ERP system we use at work, plus some modifications that have been done to it over the years, and it kind of feels to me like somebody was trying force a square peg through a round hole (i.e. trying to model data in relational terms, either not fully "getting" the relational model or using data that simply refuses to be modeled in that way).

I sometimes think the people who wrote the ERP system might have enjoyed a NoSQL DBMS. Then again, with a multi-user ERP system, you <i>really</i> want transactions (personally, I feel that ACID-compliant transactions are single most useful benefit of RDBMS engines), and most NoSQL-engines seem to kind of not have them.
> If there's a bug, it's not in bash, but in apache and the
other internet facing programs that call bash without properly
validating and controlling the data they pass to bash.

It's absurd to think that a transport layer should be responsible for "validating" all possible contexts in which the data it transports could be used. How is apache supposed to know the difference between using a magic string and simply mentioning it? How is apache supposed to know what magic strings apply to all possible subprocesses of sh that inherit environment variables? A program that receives user data has to be responsible for validating that data, and it's not productive to characterize the lack of validation as a "feature" just because it can be used to provide functionality.

This kind of misguided thinking leads to practices like mod_security refusing to allow comments that contain the magic strings "1=1" because they might be trying to inject SQL into something.
Yeah, I hope I never have occasion to walk through an undocumented minefield, I mean collection of "features", designed by this person.

I say this without animosity to bash devs. I think some blame can be shared. But putting it all on people you expect to understand under-documented behavior and "implementation details" in every possible version of every possible flavor of /bin/sh is madness.
That sounds like that could cost a poor person more than a rich person. If a poor person pays 30 days wages he won't be able to pay rent. If a rich person pays that then it could not impact them at all.
They show something around the 102nd minute: https://www.youtube.com/watch?v=w1RXbYMTz7Y&t=102m00s