skysight-inc/HackerNews huggingface dataset:
Yes, because that is what the CGI spec demands.

There is nothing inherently insecure in that: The environment is just a bunch of strings.

Whether or not it is insecure depends 100% on the CGI that gets executed. Which programs that is 100% down to the person configuring the website.

Apache does not even have a theoretical way to ensure those applications does not do anything stupid with the data no matter the method used to pass it.

You have the simple solution if you are concerned about environment variable passing of not trusting mod_cgi. Most people have not used it for years anyway, because of the performance impact.
An open source platform for emulating the fruit fly brain
Oh Unicode, Why Are You So Frustrating?
That does not conflict in any way. Only code you got from File Exchange is subject to this licensing. You can get the same code from any other source with any other kind of license.

Think about it this way: The copyright holder grants MathWorks the permission to publish their code in a way MathWorks seems fit. MathWorks publishes that code under an “only with MathWorks” license. That does not prevent the original copyright holder to publish the same code under a different license, as MathWorks was not granted exclusive rights.
They could be partnering with a root or intermediate CA for generation. But I don't see why they wouldn't get their own intermediate CA cert.
They offers SSL with CloudFlare-issued cert for non-free plan already. I assume they use the old method of obtaining cert. Also, I think at their scale they can get special plan from CA.
To be clear for the Haskell newbies, he's talking about an implementation of the protobuf library, not Haskell. You can fairly easily lift from Template Haskell types into IO in GHC (not sure about TH in other compilers).
Are you referring to compiler plugins like the one providing regex! macro or is it something else?
Or, in likely more regular instances, that person is actually forgotten and left out of conversations and events; simply because it's easier to select from a list of friends provided to you rather than think about who is left out. This regularly happens to coworkers I've had who have deleted their FB pages over the last three years.
No not like that, something more like this:

()SOMEVAR@%=...

You will get a parse error. There is little more than [a-zA-Z0-9_] you can use in identifiers (except bash adds a few more, grrrr). You can probably pull it of with /usr/bin/env though.
They pay GlobalSign roughly $4000 (most are 3 yrs in length, that's for all three), which is only used to power SSL for about twenty domains (this obviously varies but it's what I've seen before, and it should be able to support 50 or 100 total domains).

Free SSL would not be practical with their old method.
One nice thing about this technique is that its time complexity is essentially the same as evaluating the original function. This property is shared by dual number differentiation mentioned by iadunning above.

Try symbolically differentiating deeply nested functions, and you will see that you end up with n^2 terms, where n is the depth of the nesting. E.g. Try differentiating
n = 10
for (i=0; i<n; i++)
x = sin(x)

Then notice that evaluating this function with a complex argument is only O(n), not O(n^2).
We changed the title (from 'Holy S#&# Mathworks Is Evil”: Can OSS License Nullification Happen?') to a sentence from the post.
Qubes: The Open Source OS Built for Security
Yep. More broadly, I think the most sensible strategy for determining whether a system is at risk is "If it has bash and isn't airgapped assume that it's vulnerable because it is highly likely someone will find the vector you overlook."
I'm just a beginner iOS developer and I'm trying to learn Android. Could you give the names of these Android Libraries ?
FPGAs for dummies? This is FPGAs for dummies (and it's in pure Australian) https://www.youtube.com/watch?v=gUsHwi4M4xE
Guessing this is because they wanted the more exciting headline, which the Washington Post was more than happy to provide.
If they created their own root instead of partnering with another CA, which is what I assume you meant, then they would need a lot of time (2 yrs just to be included in apple+msft+mozilla) and the process would be public.

An intermediary created by a partner would solve the problem but would require a partnership.
TL;DR: HN, or to be exact Graham and YC have (big financial) interests and views on this industry, which can lead to a conflict of interests with HN as a (neutral) news aggregator, which encourages discussion. While this is only a theoretical flaw and with a transparent and open site this is not a problem, the moderation is intransparent and harsh and there are reported casues, where users get banned, because their opinions interfere with Graham's/YC's.

Besides this, HN has also technical flaws and sees little to no development/innovation. He proposes some systems and functions, who would improve HN. Though at the end he would like to see a P2P based, better, version of HN

Disclaimer: While some of his points are exaggerated and he is kinda harsh to some persons, I agree on the gist of his article
Build Your Own Soft Robot
Well it appears that 20 years' experience doesn't trump some total amateurs with a cloud to play with...
we do : GNU
The improvements to hstore (primarily to make it hierarchical and add array support) ended up becoming jsonb.
StartSSL's <keygen> for SSL is good but it's not great - mainly, you have to give your computer access to the SSL key and your server, as opposed to only your server storing the key (and you providing StartSSL a CSR)
Agreed, DB & Persistence and automated restful APIs are library problems, and ones pretty well solved by some existing solutions. Realm is awesome, and solves both pretty well.

Personally, I love Swift, and after having written a medium sized application in Swift over the course of about a month, I can say I saw significant productivity gains over objective-c.
No, you can add new functions that switch over the different types without having control over the code. That way you don't have to add the same method to each of the classes.

It's a different dimension of extensibility.
Simple Lists with ES6/Harmony Proxies
Interesting. And looking at his previous video (the one that went viral) it got 40m views. So he could potentially have made $80,000 from that?
Except KSM is not as well-suited to this problem as a dynamic linker would be, since KSM doesn't have as much insight into the semantics of the pages it's analyzing. I don't know all the details of how KSM works, but it must apply heuristics to predict whether a page is going to get written to, whereas the dynamic linker knows exactly which sections of dynamic libs can be shared. Not to mention that KSM works less efficiently by recognizing duplicate pages after the fact and merging them, rather than skipping the duplication in the first place.

That's not to say that the KSM approach wouldn't be a big benefit (and you're right, it's much easier given that it's completely transparent), but it's definitely a less precise way to approach this specific problem.
Apache has no control over what application code it is that receives the evironment variables via mod_cgi, and most of the time it will not be bash, but indeed a special purpose application or script interpreter that is designed to receive untrusted user data in environment variables since that is what the CGI spec dictates.

That sometimes people opted to use bash as the script interpreter and/or that people sometimes shell out to bash from within other environment without sanitizing the environment they pass along, is not Apache's fault.
This is completely wrong in numerous ways.

Firstly, the "security concern" is definitely a bug.

It is related to bugs in a feature; nobody is saying that that feature itself is a bug, though many are saying it's a "misfeature". So the idea that the feature itself is a bug isn't something that requires opposition.

The idea that it's the Apache people's fault somehow, because they didn't inspect the implementation of something that they rely on, is wrong.

> When reusing a component with missing specifications and lacking documentation, checking the source of the implementation should be standard procedure, but it has clearly not been done by Apache or DHCP developers.

Firstly, the CGI mechanism doesn't rely on Bash; it relies on the passage of environment variables.

Secondly, for the shell language, there is a specification: POSIX. Someone calling a shell implementation should be able to rely on the interface contract. Nowhere in POSIX is it documented that code from environment variables is to be executed by the shell.

Apache can run on systems that don't have Bash. A shell other than bash can be used for running a CGI shell script. You don't get the source code, necessarily; how can the Apache developers inspect the source code of a proprietary shell on a proprietary Unix?

Even if the Apache or DHCP developers were to (insanely) take responsibility for this flaw, the workarounds in their code would be Bash-specific hacks: basically they would have to parse anything that goes into an environment variable and validate that it doesn't have the syntax which exploits the Bash issue. That would clearly indicate that it's a Bash problem.

What also indicates that it's a Bash problem is the way it is being handled: fixes have been issued against Bash, not against other programs. The fire is where the smoke is, generally, and that's where you pour the water.

Lastly, please don't post diatribes to a code paste hosting service; it is not your soap box. Thanks!
I wonder if he makes exceptions for assistive technology.
I honestly find that a good module system (like OCaml's) is much better for organizing code than objects.
Let me get this straight: the 46 year old author started dating a 23 year old and then concludes that millennial culture is immature? That's utterly asinine.

If the author is "exasperated by how him and his friends [...] deal with the world" perhaps he should grow up and date somebody his own age.
My first semester in college, in a general chemistry course, a professor eventually was tired of seeing all the kids on laptops, almost all of them assuredly playing solitaire, etc.

So he told the entire class to stand up and turn around, and took every computer and pulled out the battery.

Now, let me be clear: this guy was a great educator. I would show up an hour early every class and talk nonsense about chemistry, science, sometimes news-of-the-world. And he was literally the last full time Chemistry professor at the school, so he was invaluable as well -- if he left then they would have to scrap the chemistry major.

After this event, I took a considerable amount of effort to make sure the event wouldn't be replicated, including a multipage report on failings and missed opportunities to the head of math and sciences.

He was fired one semester later, the chemistry program shut down.

I have no regrets. I honestly cannot imagine I was even the only one in the class to do anything.

This is all by means of saying: be careful about your use of power. In the end, being right or wrong on that one issue is meaningless if your compulsion to exercise control over others is too rough or invasive.
I could point my personal domain at the FBI in 3 seconds if I felt like it, completely legal and commonplace.
Does anyone else feel that Ello's design is really poor? It feels "over designed," actually.

Also, who just calls their FAQ/Help a "WTF page?"

https://ello.co/wtf
Exactly, it isn't. And we don't make our web server software try to guess how to sanitize input in order to prevent SQL injection, because it can't: It does not have the context to, e.g. differentiate between SQL injection and someone talking about SQL injection on HN and giving an example.
Google’s Panda 4.1 Rolls Out but What’s the Effect?
I feel you misunderstood the article.

To my understanding, his point is that we need database persistence, automated RESTful APIs, triggers and responses and better ways to do UI layout, but what we got was Swift which doesn't address any of these things. The things we actually need.

So we end up with a new language which we have to spend time mastering, and when we are done doing that, we still need to fix those problems we had before we got Swift, so what is the point? Why do we need Swift?

That's how I read the article anyways.
Java is just a programming tool and, while I would have preferred to use C++14 for all my Android projects, it is what it is (NDK make sense only for heavy duty applications).

Now, imagine for a second that you are a junior programmer, that only knows Java. You've heard of this thing called Clojure and you want to read and learn more about it. What would you think if someone called you brainwashed just because you only know Java ? For most people this means EOD (end of discussion). Calling someone brainwashed just because he doesn't have your level of expertise with other languages will just make it ignore the good parts of your comment.

In the end it is about what is more important to you: vent some steam about how much you hate Java or guide someone to learn more about a Lisp language.
I would not say "no evidence." There certainly is...
HARD PNIS is serious business.
Also interested to know more.
I think the hate is the result of how hard they are trying to sell it. My subjective analysis: It is clearly awesome tech, but the obviously high production value of the video detracts from viewers' inclination to appreciate the project.

The polar opposite would be Johnny Chung Lee's videos. Here's an example: https://www.youtube.com/watch?v=5s5EvhHy7eQ

I suspect the ratio of marketing budget to project budget might be a good informal indicator of this effect. Or maybe it's just an aversion to anything big-budget?
On the Design of Editors for Small Computers (1972)
Those services have existed for years before Cloudflare came around. They'll continue to exist even after they're welcome on Cloudflare.

Censorship-resistant networks are an incredibly powerful tool, for good and bad uses alike. We shouldn't criticize the tool just because some choose to use it in a way we disagree with.
It's sad that this is still a problem. Every time it comes up the old "just open source it", "just dynamically link everything", "just make a package for every distribution and version of libc" people come out and stop and sort of progress.

Autopackage gave up because of this lack of progress.

So we are left with two equally awful "solutions":

1. Do all your development on years-old linux distros.
2. Use docker and essentially package an entire distro with your app.

This is never a problem on Windows.
This is a tremendously good and well-written piece. I absolutely love the metaphor of the elephant and the rider, and of devices and social media "whispering" to the elephant. Although that is not the author's invention, bravo for a great use of it. I know a few young programmers who should read this about six times and have it tattooed on their forearms.
Start with the stuff from Square:

http://square.github.io

And also GSON from Google.
They did switch /bin/sh to dash, which is why it seems to me that grepping for "bash" would be quite effective.
"Bromine has no necessary function in the body. Substantial exposure to it can cause iodine deficiency, which will ultimately wreak havoc with the thyroid and every tissue in the body."

http://www.bodybio.com/content.aspx?page=bromine-bullies-iod...
The difficulties with this position are at least two-fold.

First, you claim that the use of bominated fire retardants is "unnecessary" because we can build flame-retardant materials without them, but the problem they are solving is not "building flame retardant materials" but "building flame retardant materials under some very specific constraints of cost, longevity, storage, transport, manufacturability of the product they are used in, etc". People who have never actually manufactured anything are often given to under-estimating the number of constraints on the process and airly wave away the issues faced by the people tasked with doing so (a common name for such people is "senior managers").

How good are the alternative flame retardants? Do they cost more, increasing price pressure and causing people to not replace their old electronics with new for a longer period of time, therefore actually increasing overall population risk? How do you calculate all that?

Second, "the risks outweigh the benefits" leaves unanswered the question "to whom"? The distribution of risks and benefits is not uniform. Replacing one product with another may well shift the risks and benefits, but can you tell me that we won't be having this conversation again a few decades from now, as the unexpected consequences of what you currently believe to be safer (not "safe" but "safer") alternatives become clear?

What is obvious to you is clearly not obvious to others (many of whom also have interests in the matter that might cloud their judgement, although of course the same is true of NGOs, which are in general even less science-based than industry risk-analysts.) This is why in any regulatory question of this kind treating the decision as a no-brainer and your opponents as the root of all evil is likely to be counter-productive. A better approach is to acknowledge a) the legitimacy of their concerns, including their concern about making a profit and b) bring up concrete, specific and detailed ways that the industrial processes in question could be improved. It's easy to think of abstract improvements that won't work.

The debate regarding ozone processing in the pulp and paper industry is a good example of how abstract claims that ozone was a perfect substitute for chlorine if only those evil capitalist industry dunderheads would come to Jesus turned out to be less than entirely true: ozone does have potential and is being used, but in practice turns out so far to be a less-than-complete replacement for chlorine bleaching: http://en.wikipedia.org/wiki/Bleaching_of_wood_pulp#Ozone
This is akin to saying people have a right to smoke cigarettes in a room, because it is their choice. This behavior has a clear impact on other people. When you see the people to the right and left of you glued to their screens, its like they are not even there at all. This is extremely demotivating, and causes a chain reaction of inattention.
Should be https://qubes-os.org/
Research unveils the process of change
If your interpretation is correct, that means you may not post code to MathWorks to which you do not have such a right: the right to distribute it under an altered license. Mathworks cannot add additional restrictions to the redistribution of GPL-ed code, so if you aren't the author of that code, you simply can't post it there. If you do they have to remove it, or else make an exception for that code. If they just keep it there, then there is no effect on the code; that code is still GPL-ed, since MathWorks has no legal right to change that. The situation is that the person who posted it there violated the terms of their agreement for the use of the site.
> lb-in

Ugh. What's that in microtonne-millileagues?
That's a bit ad hominem, don't you think? I thought the author made good points regardless of his personal circumstances.

[Disclaimer: Didn't downvote you]
Euclid's proof isn't a proof by contradiction. As the wikipedia page says:

>"Euclid is often erroneously reported to have proved this result by contradiction"

It simply says that if you are constructing a list of primes, you can always add one more to the list, therefore there are infinitely many.
I start reading Aeon articles - of which we seem to see one on the front of HN every few days - with the best of intentions, but somehow I never make it to the end. This was no exception.

(Yes, this is a worthless comment. Sorry.)
Template Haskell code can runIO I/O actions, including reading files.
> I never pretended to be an expert on Millenials and my harmless tweeting about them was solely based on personal observation with the reactions to the tweets predictably running along generational lines.

"I intentionally stirred shit and called a generation too sensitive, and some of them got upset by it - which just proved my point!"
As soon as they have wind of it. Microsoft takes credit for other peoples hard work and creativity. Word of warning if your inventive..
Not so long ago a student of a good school in US would know Scheme and C, not Java or Python, and the move to Java as the language for teaching CS is, in my opinion, the result of the same regrettable process of brainwashing.

btw, I never talk Java issues in a context of a personally, only in a broader sense of a "social phenomena" partly explained by well studied "effects" in social psychology.

Unfortunately, Clojure will not be suitable for Android development in observable future exactly because "Java" cannot fulfill its promises - Clojure's runtime is "too heavy and too slow" (too wasteful) to run even on a newest smartphone hardware, and in this, again, so-called reality re-asserted itself.
My favorite Imperial unit is velocity expressed in furlongs per fortnight. I can't understand why people don't use it more often.
I completely agree, as a member of the generation in question. Most of my peers disgust me, and I'm not above these issues myself - but I try very hard to fix it.

Fortunately, life has kicked my ass soon enough to wake me up, and my parents did no do a bad job at it either.
Just because you haven't had a failure yet, it doesn't make the test any less true.
I believe this just applies to bash, not sh?
OSU creating mechanical wrist implants for trauma patients
Proto-Spam: Spanish Prisoners and Confidence Games (2013)
“I Am Ivan Fyodorovich and BankID Is Like Stealing Candy from a Child”
Yeah, it's not beautiful at all. It's just trying too hard.
While that might have been great, the alternative is: People should not have used shells as CGI handlers, and people should (irrespective of CGI) sanitize any environments passed on when spawning other programs from their applications.

This latter is really something we should do irrespective of where the input is coming from. Even if the content comes from trusted sources, passing the environment unchanged to sub-processes means we risk all kinds of unintended consequences if an application developers decides to spawn a sub-process that exec's into some process that makes decisions on various variables.

It's a bit like letting our applications call functions with random junk in the argument list.
Considering you can get much of this functionality from programs created by CAs (for example, https://www.digicert.com/cert-inspector.htm from my CA), this seems... way too expensive.
Yes and no. You can still unintentionally call out to bash if you, say, protect your PATH:

$ x='() { :;}; echo vulnerable' perl -t -le'$ENV{PATH}="/bin";print `:;date`'
vulnerable
Sat Sep 27 10:51:12 PDT 2014
I don't think this is very in-tune with the actual buyers.

iPhones always outperform Androids in battery life in the real world IME (there are exceptions that probably break the rule, but with compromises elsewhere I'm not willing to make so I haven't bought those devices). My 6+ is living up to the "2 days" claim.

I absolutely wouldn't trade thinness, and more importantly, weight, for longer battery life.

The battery life is fine. The weight is good. The thinness allows me to add a case and still only have it be as thick as an iPhone 5.

For me, someone who actually paid for an off contract 6+, they made the right call.
This isn't a test of the materials though, it's a test of the phones as a whole. When I sit on my iPhablet it's going to have more leverage working against it than an iPhone 5.
Quantum mechanics as a generalization of probability (2007)