skysight-inc/HackerNews huggingface dataset:
Not every bash is HTTP-accessible. I'd even say it's a minority. SSH, on the other hand, seems to be the main access to bash, as only a crafted login name is enough to exploit.
> It is curious to see how bash is mentioned everywhere, while the real culprit is the interaction between some web server and bash.

The web server side only comes into play for remote exploits. It is locally exploitable too (though the potential for useful exploits that way is lower, it is still a significant risk).
For context, Both Max and Marcus were studying at the Royal College of Art in London at the time. Not sure about the stool, but the Solar Sinter was Marcus' graduation project, and it was quite a hit when it went public.
Law doesn't have an opinion. People have opinions. And you have an opinion that I'm a racist. You can have any opinion, but to 'act accordingly' you'd have to prove your claims - and you don't have anything actionable but your own speculations. You don't even know if its true or not, but you're already making accusations.
BTW I can't really imagine how I could be convicted for thoughts or beliefs - only actions are punishable AFAIK. Or not? http://en.wikipedia.org/wiki/Thought_Police

PS a little thought experiment: you're renting an appartment and two people show up - one white and one black, with similar income, jobs and credit history. You have to pick one, so how can you prove your decision was not racist?
Is this a problem even if /bin/sh is not bash? I'm pretty confused at why one would ever want /bin/sh to be bash (and not, say, dash). If you want bash, ask for it.
Free Bootstrap Admin Templates for Designers
Indeed, a chimpanzee was actually the top performer in 1999, by throwing darts at ticker pages. Bad year for the market.

http://www.marketwatch.com/story/paul-farrells-commentary-ch...

http://www.dailyfinance.com/2011/08/03/in-honor-of-planet-of...
Experiment: Blood testing two people on a fast food diet
Ah. OK, I misunderstood what you were saying. This is right.
I never understood the turning the lights on bit I found bright ambient environments hurt my eyes more when trying to concentrate looking at the screen then dark environments.

Then again most websites I use regularly have been re-skinned to have dark themes since white hurts my eyes regardless of the ambient environment.
the strxxx_s family blow up your program if they encounter something bad.

What most people want is some simple functions that that can tell you if something would have gone bad. (e.g. truncate the copied string and tell you if it was truncated)
Depends. Does any remotely accessible code anywhere on your system end up shelling out to bash explicitly?
OpenStack has some of those tools and some even have AWS backend shims.

I believe Rackspace are one of those involved in its development.
The rebirth of Infor: a transformation led by tech’s coolest character
Sounds like you need to see the optician. I had the same trouble and they sorted it :)
Like Terminal escape sequences? ;)

(On an old SunOS machine in uni back in the day I could create files that changed the colour of ls output. The very same mechanisms sometimes also allow you to redefine keys, depending on the terminal.)
Have you got a source for OS X DHCP being vulnerable? OS X has a copy of bash at /bin/sh so it's pretty vulnerable if you can find a way to remotely set environment variables and call system().
Kali Linux Net Hunter- Hack from Your Android SmartPhone
It's possible to install another package manager like opkg. See https://github.com/progrium/busybox
Kanbanery, native GitHub integration as well as Zapier.
I think it's that all files have mode 0777, i.e. executable by default. I think it can be changed with mount options though.
Care to elaborate? AFAIK this bug is about remote execution, not about privilege escalation. The reason is that the shell would be run with the same privileges as the user who is setting the ENV variables, and only privileged users should be able to set system-wide ENV vars.
From a 2009 article, "EA now typically spends two or three times as much on marketing and advertising as it does on developing a game."
http://venturebeat.com/2009/08/26/eas-chief-creative-officer...

And there's some random numbers throughout history in this article, such as Modern Warfare 2 costing $40 to $50 milion to develop and a total launch cost of $200 million.
http://kotaku.com/how-much-does-it-cost-to-make-a-big-video-...

And yes game dev is a lot of hours for less pay than your fantastic Silicon Valley wages.
The Iphone 4s/5/5s needs your decision to be safe
The Fundamental Distinction Between Brains and Turing Machines (2002) [pdf]
Brain scans reveal ‘grey matter’ differences in media multitaskers
It would be interesting to see what would you do if your child need immediate medical attention and your car won't start because, apparently, "you signed". ;)

Legal != Ethical
Close to the point, add frictionless location to your Android/iOS apps
>The freedom to roam, or everyman's right is the general public's right to access certain public or privately owned land for recreation and exercise. The right is sometimes called the right of public access to the wilderness or the right to roam.

Not quite sure what it's like in other countries, but here in the UK we have 'public paths' that sometimes go through private land. You're well within your rights to use them at any time of day even though it's private.
quite a bit of India's problems are culture based. There was big to do about building toilets all across India in an effort to improve sanitation and health.

Guess what, people would not use them because going to the bathroom in town was taboo. They would walk past the new toilet facility and use the woods.
I would suggest that in democratic affluent western societies the corporate lobbyists influence the government that you get every single day, whereas the people only influence it at election time.

I think you are hallucinating my "idealogical problems with the liberal government". Where did you get that from? No partisanship in my comment.
As long as you're white and healthy.
Page itself looks nice, but why you've decided to have a custom scroll? I think it would be so much better without it. Will try to look into app itself later.
Clear as mud!
Sorry, I posted this and went to sleep so missed the replies. We have one complete and open to the public. We were allowed to dig out the bunker entrance to explore & recover anything interesting, then it had to be sealed back up. The last time this was done was in the 70's, as it is beach-side in an environmentally protected area.
You can only do that if you already have shell access (in which case the vulnerability gives you nothing). The remote exploit works because untrusted users can put code into an environment variable, but the target needs to create a new bash to execute the code.
The Comcast MIT Career Fair Programming Challenge
I believe you are mistaken (unless you aren't talking about 'shellshock'). A patch was available almost immediately from most major distros.

https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.2

> -- Marc Deslauriers <email address hidden> Mon, 22 Sep 2014 15:31:07 -0400

Also, very amusing:
> bash (4.2-2ubuntu2.2) precise-security; urgency=medium

urgency=medium? Shouldn't it be: urgency="don't even finish your lunch; run"
wow, wasn't thinking from that angle. thanks a lot.
Thanks a lot, I was discussing this with a friend and we reached this conclusion too.
Maybe I'm missing something here but I don't see this as being particularly useful?

It's a nice quick way to get an application running in Docker but realistically would you want to be depending upon these images in production?

The power I see in Docker is the ability to create portable images that contain everything my application needs. I don't want to depend upon Docker (the company) to figure out what these images should look like.

Am I looking at this the wrong way?
I've been trying to exploit our own systems which have PHP web frontends running under apache/mod_php, and in my testing PHP isn't passing through any HTTP_* environment variables at all in calls to system() or exec().

Even just echoing back the result of "env" it doesn't look like I get anything user-supplied whatsoever in there (no HTTP_*)

Can anyone more knowledgable confirm what I've seen?
Is DevOps Gobbling Up the Outright-Developer Role?
When a script mistakingly provisioned a ridiculous amount of read/write capacity on hundreds of DynamoDB tables, we were presented with a bill in the thousands of dollars. We got reimbursed after talking with our account manager for 15 minutes.

Maybe my experience is the exception, but my account manager has always been extremely helpful at resolving whatever issues we had.
They demo'd live migration while streaming 1080p video, with no outage. It was described as having the network cable unplugged for a tenth of a second.

There's a story from a partner who was testing it, who at the end of the day said "when are you going to live migrate us?", only to be told that Google had moved them six times that day and they hadn't even noticed.
>This year I'm getting her a refurb MacBook Air

ASK her before if she'd rather have an old 15" MacBook or an Air. If she's complaining about the tablet being to small, she'd probably rather have a larger screen than 13".
I wonder how many people are relying on this behavior for their production systems.

It can't be zero.
I seem to recall that the most likely predictor of whether the next tick in a liquid market will be up or down, is whether the last tick was up or down.

In other words, if the last tick was upwards, there is a >50% chance that the next tick will be upwards too.

A quick'n'dirty Google search turned up some research: http://www.researchgate.net/publication/234834258_Random_Wal...

Looking at the ticker tracks the artist has used, I wouldn't be surprised if the rats are effectively being trained to Buy when they hear high-pitched notes, and Sell when they hear low-pitched ones.
I wonder how much would fail on switching out BASH as default sh?

Ubuntu did that years ago, to speed up booting.
> Probably named that way to avoid suspicion

Correct, it is usually done to conceal the process in process listings (top / ps aux).
toUpper array := map (x => uppercase x) array

Why not just `map uppercase array` ? That way you don't even really need to define a function `toUpper array`. Isn't it customary not to mix lifting and program logic in functional programming languages?

Filter example:

notPrefixedWithA name := not contains (prefix name) ["a", "A"]

then use

filter notPrefixedWithA names
I work for one of the larger corporations on the planet and in a recent presentation it was announced that employees will have a choice between a laptop and a Surface. Quote "our sales people are looking positively old-fashioned visiting their customers with laptops".

So, expect the corporate computer market to take a nose-dive in the next years too, I guess.
But tests test for specific values. Example:

testThatAddWorks
result = add( 3, 4 )
EXPECT( result , 7)
Not sure if you actually work for Amazon, but your apology would probably be worth something if you actually decided to take steps to rebuild Amazon's reputation with madaxe_again rather than telling them they're the exception not the rule.
I can think of a few ways this could be a problem if you sudo. Sudo is configured to whitelist environment variables, so just figure out which ones are on the whitelist, or find half the people who have alised sudo='sudo -E'. From man sudo on OS X:

SECURITY NOTES
sudo tries to be safe when executing external commands. Variables that control how dynamic loading and binding is done can be used to subvert the program
that sudo runs. To combat this the LD_*, _RLD_*, SHLIB_PATH (HP-UX only), and LIBPATH (AIX only) environment variables are removed from the environment
passed on to all commands executed. sudo will also remove the IFS, CDPATH, ENV, BASH_ENV, KRB_CONF, KRBCONFDIR, KRBTKFILE, KRB5_CONFIG, LOCALDOMAIN,
RES_OPTIONS, HOSTALIASES, NLSPATH, PATH_LOCALE, TERMINFO, TERMINFO_DIRS and TERMPATH variables as they too can pose a threat. If the TERMCAP variable is
set and is a pathname, it too is ignored. Additionally, if the LC_* or LANGUAGE variables contain the / or % characters, they are ignored. Environment
variables with a value beginning with () are also removed as they could be interpreted as bash functions. If sudo has been compiled with SecurID support,
the VAR_ACE, USR_ACE and DLC_ACE variables are cleared as well. The list of environment variables that sudo clears is contained in the output of sudo -V
when run as root.

From man sudo on Ubuntu Linux:
Note, however, that the actual PATH environment variable is not modified and is passed unchanged to the program that sudo executes.
That could be changing after student fees get deregulated[1]. $50,000 for an arts degree and $100,000 for medicine. No doubt that price will go up.

Australia is actively being made dumber as we devolve in to a class system.

[1] http://www.abc.net.au/news/2014-09-23/uwa-to-hike-fees-30-pe...
One example: If a server script calls system(), it actually pops up a shell to execute the command.
Also in the UK, from experience most people seem to go through umbrella companies as they will also help find clients, then when you've got some contacts start to go off by yourself and get a Ltd company setup to save on the 20-30% that the umbrella will take from you.

Looks like I might have to do something similar, just a bit risky trying to get them first few customers, especially when you have no contracting experience.
It's not necessarily black or white. Here in Belgium, the sidewalk in front of your house is public but the house owner has to take some care of it. E.g. when there is snow or ice, it's the house owner responsibility to remove it (and is responsible if someone get injured by sliding on it).
The fix for CVE-2014-6271 (shellshock) was incomplete, resulting in CVE-2014-7169 to track a better fix.

CVE-2014-7169 has not been yet been patched.
Shellshock Test
India rolling out the red carpet to investors
Webinar: RedLine13, (Almost) Free Load Testing in the Cloud
Embed eskiis in 4 easy steps
Seems like something that should be turned off by default and enabled when desired/needed.
What will make it unique is its painless support of Apple libraries and platforms.
In regards to optionals, I've personaly found myself using the `property?.member = value` syntax quite a bit, which lets you avoid the nil check in many cases. I don't think a nil optional should be an "error case" as the author puts it most of the time.

Overall, I've been finding Swift to be more coherent and faster to use than Obj-C in my projects, which is nice. But I'm not a language power user.
The problem is in bash so is potentially exploitable where-ever bash is used, while web servers could try to mitigate it with extra request filtering as an interim measure that may not be 100% effective (it comes down to "enumerating the bad" - how do you make sure you filter out everything that could be a problem without accidentally filtering out something valid, required, and safe?).

A malicious user with access to certain commands via sudo or similar could potentially use this to gain further access.
Lemon Law
It is of high importance to note that in order to qualify for the statutory presumption under the California Lemon, you are to have directly notified the manufacturer about the vehicle’s need to be repaired. This means you have to write a letter to the manufacturer and send it to the address shown in your owner’s manual. Write about the problem clearly in the letter and make sure to send it return receipt requested for you to be able to prove you complied with this requirement. Do not forget to keep a copy.
Find us on www.calemonlawinfo.com
If the Dockerfiles were available, I would feel better about it. Just glancing around I couldn't find the stacks Dockerfiles, so not sure those are available.
to bash? or to /bin/sh? Or the user shell? On Ubuntu you are fine unless it explicitly calls bash or (unlikely) uses the user shell.
CGI is affected. When using mod_php, the request headers aren't passed via environment.
Specifically, here's Debian's output of sudo sudo -V:

Environment variables to preserve:
XAUTHORIZATION
XAUTHORITY
TZ
PS2
PS1
PATH
LS_COLORS
KRB5CCNAME
HOSTNAME
DISPLAY
COLORS

Just set any of those on an account with sudo access to something that runs bash. Even if the bash command was something trivial.
Not always, this is on Slackware 14.1:

$ ls -l /bin/sh
lrwxrwxrwx 1 _ _ 4 Apr 3 18:13 /bin/sh -> bash*
> Uh... make that the last 51 years. If you only just noticed, you're not paying attention. And I only say 51 years from picking an arbitrary point (JFK assassination) for when the deep state's evil ways became really obvious.

McCarthyism: 1950[1]

J. Edgar Hoover: 1935~1972[2]

[1]: http://en.wikipedia.org/wiki/McCarthyism

[2]: http://en.wikipedia.org/wiki/J._Edgar_Hoover
> And now the st has hit the fan :(

And now the sh has hit the fan :(
Physically Based Camera Rendering
CVE-2014-6271: Metasploit Module
right, that would be an option, if opkg had packages for python mercurial or bzr. (those are needed for go get to work).
Don't see those in http://downloads.openwrt.org/snapshots/trunk/x86_64/packages...
Silly question, but did you use sudo for the apt-get? I forget to do that sometimes. Because I'm a bit stumped why you're not getting the update, you should be.
This absolute-URI bypass is certainly usable on other applications. Worth a try.
Show HN: Keyboards Club
https://www.youtube.com/watch?v=Iu_30-8ZlmQ

"I wan't everyone to remember why they need US!"
there we go - another example of my point :p
Getting: 502 Bad Gateway
It looks like it's down already
The obvious next step is to try the same with voles, shrews, etc., and start a hedge fund that is actually located in a hedge.
I recently learned that core data wasn't used internally at apple. That freaked me out, because it made me feel that choosing that technology for a serious project was a mistake, despite the numerous documentation and support apple provides for it.
OK, I see your point. Of course, the type system will not substitute this kind of tests. But it allows you to check the whole range of values. This is helpful if you e.g. wanted to handle overflows, wanted to limit the operands to positive numbers, etc.
Of course forums tell you what you've already read. What forums have you gone to in the last decade that didn't?

Discourse is better because you have more fine grained control - you can have all topics emailed to you, or only ones under a specific tag, or only replies to topics you've posted on. Discourse lets you @tag people and have them notified.

Discourse also makes it easy to link topics together, so there's a feature "Reply as new topic" which will start a new topic, but link back to the original so you can read the context.

And aside from that - forums are a lot more browseable and searchable. An email list is a linear firehose of posts. A forum can have multiple categories, and makes it easy to flip back and forth between topics. Also, a forum by definition has all the posts online so that anyone can go back and read them. Some mailing list sites record a history online, but because it's not a main way that they are read, it's often only half a step above plaintext, and not at all pleasant to peruse old messages that way.

Sure... a lot of this stuff can be done with mailing lists, if you work hard enough at it. But discourse wraps it all up in a nice package, and adds things like automatic trust levels so that you can have community moderation of the forums, without need dedicated people chosen to be moderators approving or disapproving every post.
Interesting that they're presumably hiding behind Cloudflare, does it send a HTTP Host header?

FWIW, it doesn't appear to be a new bit of malware - the same strings match this pastebin from March - http://pastebin.com/xa87Gh7q
You are correct, just spotted that myself. Excellent news all around.
Note that I completely ageee on pursuing research, and find the article interesting in that matter. My comment was more a reaction towards people advocating the use of psychotrops despite the fact that research is still heavily in progress.
Why and how you should stay current to make it in the world of code
As i understand, this is ussless, cuz nobody stores any scripts in /cgi-bin folders, or maybe i just didint understand it right, can someone explain how would you exploit it ?
If you think any technical solution is going to solve these things you are delusional.

It will only create an arms-race that will make things worse.

We need laws.
Gamification: not fun and games, but a serious HR tool
Awaiting the alternative article:

"How Nations Fare in Sex by PhDs"
Why should ownership of land be equal to the right to restrict access to said land?

Where I come from (Norway) a land owner needs a good reason to deny the public access to the land. Such a reason might be that the land is very small and surrounding a house (typically a garden), or there are crops planted or animals grazing on the land (typically a farm).

A land owner can't just put up a fence, but is free to develop the land (within county restrictions) or sell it and pocket the money.

Yeah, too bad for introvert billionaires, but hey, most people aren't and that's democracy for ya.
Hello world! Training an army of tiny techies
I think they're here: https://github.com/docker-library
Whoops, blame it on me for some missing basic error handling. It's fixed now, sorry for that.
Here's one way: if you have SSH access to a server but aren't allowed to log in (a Git server, for example) you can use this exploit to execute commands on the server. Only with your own privileges admittedly but without this exploit you wouldn't be able to execute commands at all.
Amazon finally launch netflix for books (Kindle Unlimited)
Yeah you have a valid point regarding the umbrella company. It does offer some benefits (eg. you are a PAYE and if taking loans for car/house you can say you are employed rather than self-employed which could hinder your bargaining abilities). I do not think they help that much when it comes to finding contracts. My understanding is that they handle the paperwork and finances, thats about it.

Just put your CV out there and apply to 2-3 jobs. See the feedback you get and take it from there. I don't think previous experience as a contractor is important - that being said, having professional experience in the field is definitely very important.
JQuery hacked a second time
Show HN: Search CentOS packages online
Innovate or Die – PCI DSS Edition
Nokia Here: 1 App, 200 Countries
What is a text buffer? I use Sublime exclusively and I never "got" emacs and I just assumed it had something to do with me not knowing what text buffers are and where to access them in emacs.
What's wrong with the following much simpler construction: each node contains an array of TWO links, and the hash table itself contains an "int link" field.

Readers traverse the chain using the pointer indexed by the link field.

Resizing rebuilds the chains by storing the new links into the 1-link field. When resizing is done, just set link=1-link. The "only" thing you have to guard against are extremely slow readers, i.e., that the table does not get resized twice while a single reader is traversing some chain.

According to the LWN article, concurrent updates with resizing is generally serialized.

What am I missing...? [ya, filling in the details and formal proof of correctness]
>What's so special about beaches?

For one thing they usually abut the sea which is generally public access. In the UK we have no private beaches. Seems to work fine. You don't get many protesters saying won't you please think of the billionaires.
The other reason is that bash has dependencies outside the core system and is therefore possible to totally break on FreeBSD. Never change root's shell to bash!
MOM Sends First Pictures of Mars
Patch Bash NOW: 'Shell Shock' bug blasts OS X, Linux systems wide open