skysight-inc/HackerNews huggingface dataset:
Woah. This is getting blown a little out of proportion now. It's a bad bug, but we don't need a bunch of misinformation about it:

1. The released patch (and subsequent update for many distributions) fixed the only currently-known remotely exploitable version of the bug. The cases found afterward are a different bug, and so far there's no publicly known way to remotely exploit it. These other bugs were published to demonstrate that there are deeper flaws in bash's parsing of environment variables. If you have updated bash with the most recent fix, the odds are in your favor that you're going to be just fine.

2. "Routers, web cameras, SIP gateways, NAS’s" & etc. all need to be running a variant of bash to be exploitable. dash doesn't have this problem. ksh, csh, other shells don't have this problem. ash, used by BusyBox, doesn't have this problem. BSD-based systems don't have this problem (except in rare circumstances).

3. DHCP exploitation requires that you have network-start scripts that are run by bash on your system, and you're getting DHCP from a compromised host.

4. Yes, ssh hosts are vulnerable -- if you already have ssh access to those hosts and your shell is bash. This bug doesn't give most users a level of access that they don't already have. But, it can mean that if a user is restricted to specific commands for sudo without being prompted for a password, then they can run arbitrary sudo commands, which isn't very nice.

5. And yeah, mass-scanning started late last night and the first examples of malware using this as a vector are being seen. As scanning techniques improve -- currently they're pretty rudimentary -- more and more hosts will get compromised.

Keep calm and update bash.
However, a flaw in some software (failure to properly restrict environment variables) is amplified by this feature of the shell; it gives an attacker an instant way to do harm. Whereas without this feature, attackers have to find some other ways by which environment variable contents can lead to an exploit. E.g. smuggle a rogue shared library onto the system somehow, then LD_PRELOAD it or whatever.
Here's my abridged version:

1. Spend less than you make.

2. That's it. You worked out business. And personal finance. And, depending on who you ask, public finance.
Early in my career I did a self-study of the entire vim user manual. My time has been repaid over and over, every single day, ever since.

Normally vim is very snappy for me. Perhaps you have a ton of plugins that are clogging up your installation? Or perhaps just one very badly behaved plugin?
You've just discovered that Electric motors use brushes on their commutators? Welcome to the 20th century.

Brushes are intended to be replaced, and many manufacturers supply spare brushes in the original packaging.

In the 21st century however the traditional brushes have been replaced by electronic switching.

see https://en.wikipedia.org/wiki/Brushless_DC_electric_motor
It's hard to say why it happened, though I'd guess it was in part that the selection of Senators by state legislatures made them more beholden to those bodies than the people of the state or the country. Since state legislatures of the time were notoriously corrupt, they regularly sold off Senatorial seats and used their Senators as puppets for their agenda. State Legislatures of the time were also vastly overrepresented by rural districts, which may have played into Senators having more indifference to national interests over provincial ones.
You're experiencing cognitive bias.

If it is presumptuous to present calculations that may invalidate a _theory_ based on assumptions, then it is also presumptuous to disregard such calculations and state that the _theory_ itself is automagically correct, just because the assumptions are untouchable.

A bold assertion indeed.
Oh, good lord. I thought I made it clear that I wasn't talking about poking fun in a hurtful way.

> Hopefully we never work together.

Indeed.
I tried this and realized, it installs the binary under /usr/local/bin. you'll need to make a symlink or preferably follow ricilake's advice. if you forget to do this and logout, you may never log back in. Btw, the path to the bash in ubuntu is /bin/bash not /usr/bin/bash
A Garmin Forerunner might be up your alley, and their GPS watches are down to around a hundred dollars these days. No other "smart" functionality, though. I leave the Pebble and Samsung Gear at home when I run.
There's probably more profit in a single bottle of JW than a case of beer, but beer is CHEAP. For example - take the local brewery in my hometown in Montana. Most of their costs in distributing their beer was canning. Each can was about 40 cents. The beer itself, the brewmaster guessed, was less than a nickel per can to produce. They sold a six pack for eight bucks, and a twelve pack for thirteen. There's a ton more profit to make in JW, but there's plenty of change rattling around in that beer can too!
drinking less is extremely difficult because at first it goes really well, but then it gradually increases, and then all of a sudden you're drinking to excess again. the term "slippery slope" applies here. saying no to the 3rd drink is MUCH harder than saying no to the 1st - that's why lots of problem drinkers (i'm intentionally not using the word 'alcoholic' here) just stop completely, or drink one glass of wine at thanksgiving per year or whatever.

heavy drinkers find drinking intensely enjoyable - and (subtle difference here...) not displeasurable in any way whatsoever until hangover/puke. if you aren't the kind of person who's ever drank 15+ drinks in a single night, you just have no ability to comprehend this. it's not within your realm of understanding - your personality is just completely different. or your brain chemistry is such that after 3-4 drinks, you feel terrible.

if so, be thankful.
Samsung has more employees than Google, Apple, and Microsoft combined
Linking the structure of your site to the organization of your URLs is a terrible idea. Nobody particularly cares what the URL looks like, but for one key feature: do not fucking break links.

So design your URL such that you won't ever break them. Everything else is rather secondary.
Final four contestant in Hotnewhiphops Heatseekers competition. Check it out
Um, "haven't bothered"? Think about all the Linux/Unix-based devices that could be affected here, it's in the millions. Do you run a local server on your box? How about your Linux-based router? Has it been patched yet? Why not, it's been more than 24 hours now.
It's odd to stay, but taking a break is also needs to be done correctly. You need to find the best way to completely free your find of the project. Simply not working on it at the moment isn't enough.

When I had a short burnout, I tried playing games in order to help, but my mind was still on the project so time passed and still I just couldn't get back to it.
Indeed, lol. It's a bit clearer to me now. Thanks for your comment.

It seems like a sort of loose typing issue. Perhaps if when setting environment variables the app using them could specify a type (eg nonExecutableText) such that bash knows it's receiving textual content that mustn't be executed; would that help?
Particularly when paired with recent detection of water in the atmosphere of an extra-solar planet: http://www.theguardian.com/science/2014/sep/24/water-small-w...

Water, water, everywhere...

There are people who don't understand what a big deal this is. They think that because this small blue dot happens to have a lot of water, and there is evidence of water elsewhere in the solar system, that water must be common. That is a huge unjustified leap, comparable to "everything I see falls toward the centre of the Earth so everything in the universe must be falling toward the centre of the Earth or moving around it in a perfect circle". That kind of leap rarely works out especially well.

These sorts of observations that demonstrate that water actually is relatively common in the universe, and that is extremely exciting insofar as the prospects of life-as-we-know-it are concerned.
The question is, does it call bash in its dhclient-script? I took a look through the FreeBSD source tree, and their version of dhclient-script uses /bin/sh. As long as /bin/sh is not bash (and that script doesn't in turn call any other bash scripts) it should be OK.

The best way to find out if you're vulnerable is by testing. It takes just a few minutes to set up dnsmasq to serve up an exploit. Here were my settings:

interface=eth2
dhcp-range=10.0.1.100,10.0.10.200,12h
dhcp-option-force=114,() { :; }; echo "hi"

Of course, replace that 'echo "hi"' with the exploit of your choice. In my case, the output from dhclient would be printed on screen when restarting networking, so 'echo "hi"' was sufficient to verify that it was being executed.

If any bash scripts are called, with the environment variables that are set by dhclient, then that snippet should be run. If bash is not invoked, then that snippet won't ever run.
>They probably believe that they will not be targeted by it

That would not be rational. They have no capacity (nor does anyone else) to predict which of their behaviors will be cause for targetting at some point in the future. Additionally, once they are profiled for their 'normal usage pattern', any life changes which cause statistically significant alteration of that pattern are likely to result in scrutiny.

For instance, you are currently involved in a conversation on a website called "Hacker News" with people whose backgrounds and motivations you do not know. The likelihood you're NOT connected to someone who is a criminal is probably very, very low. Everyone should expect to be targetted. If not today, then at any point for the rest of your life because all of these stores are maintained forever.
This is best plain English explanation I've seen yet (been looking for an hour). Thanks.
I don't think you can pin "alcoholic" to number of drinks, even if you control for weight/sex/etc.

I drink reasonably heavily, but variably, on the order of 15-35 drinks per week. I wouldn't consider myself an alcoholic, mainly because I can -- and do -- stop whenever I want.
Here is a fun fact: only elements up to iron are produced as a result of fission. The rest, including elements essential to human life, elements in your body, are only produced through fusion. Fusion is known to only occur in stars. You are stars.
This is terrifyingly realistic.
> I've never really understood the whole "alcoholic vs. sobriety" thing. Is it not possible to "learn" to drink less?

I believe that it is both addictive and alters one's state of mine are what makes it difficult to simply "learn to drink less". I suspect that it is technically possible, but going sober (avoiding the addition) is likely to be a much easier choice than trying to control the addiction. When it is something that can impact one's long-term health as significantly as alcholism can, it makes sense to go for the comparatively easier solution of avoiding alcohol altogether.
Caesar:  an easy-to-use advanced cryptography library
There are totally ways to do it, but it involves a good bit of work. I like Archaius for feeding into Zookeeper for configs (though to make it work with Play, as I have a notion to do, I have a bunch of work ahead of me...).
No that's wrong. If 74/week is the average for the top 10 percentile, most likely half of that, a bottle a day, gets you in the top 10.
The Current State of Dental Software Security Culture
I was at a Stripe Hackathon as far back as 2012, and afaik they let many OSS projects use their office space for meetups. Unless they've slowed down on the hackathon front (in which case I imagine for good reasons), I don't think hackathons are an unexplored area for them.

Out of curiosity, what do they cover in their office hours? Basically any questions developers may have with their API and platform?
From what I hear, the roles are quickly collapsing at Microsoft. In the service orgs especially, the role that was previous done by a Test team is now handled by the Dev team. They are also increasing the ratio between PM and Dev (less PMs and more Devs) and many PMs are being asked to code in some fashion (prototypes and tooling). Be interesting to see how long the unique role of PM remains at Microsoft.
1. It is standard drinks. A reasonable sized medium strength beer can be ~1.6 standard drinks, so you'd only need 3 of those for 5 on a weeknight. A standard drink generally corresponds to one shot (44ml) of spirits.

2. You're a "heavy drinker" and 20 drinks on a weekend seems like a lot? I'm done that numerous times and I hardly even enjoy drinking, to the point where I completely quit with almost no effort.
You keep posting links that don't support your claims.

Let's see, from your first link: According to ThinkProgress's analysis of the heavily redacted "be on the lookout" lists, the IRS may have targeted a higher number of progressive groups than conservative groups overall.

Really? ThinkProgress, a left-leaning organization, did an analysis that showed they weren't targeting conservatives, in fact they were mostly targeting progressive groups.

Provide a decent source and we can have a conversation.
I have had 15+ drinks in a single night before, but probably only on 2-3 occasions in my life (one of them being my 30th birthday, where a mostly-sober friend was keeping track until 23 drinks). So I at least know what that's like, in isolation. But my personality doesn't push me to just go and go and go.

I'm not saying there isn't a slippery slope, but I personally cannot imagine my life without at least some alcohol. I assume for the case of someone where their (excessive) alcohol intake has a huge negative impact on their life, zero alcohol sounds like a much better deal than drinking a lot.

But I still question the accepted "fact" that this is really a fixed "personality" thing. We humans have extraordinary brains and have the power to -- possibly with help -- change a lot of things about our personality and emotional state. It seems hard to believe that "once an alcoholic, always an alcoholic" is actually absolutely true.
If there was a terror group operating in the US doing all you claim, access to their phones would provide us with no protection whatsoever. We have absolute, concrete proof of this thanks to the 9/11 Commission Report. The NSA knew where Mohammed Atta was. They knew exactly what he was planning. And they kept it secret. They are so afraid of revealing their methods and capabilities that there is literally NO tragedy so great that they would be willing to speak up to prevent it. When the CIA and FBI both asked the NSA for their information about Atta, the NSA refused to supply it or even warn them.

I think people have a very good handle on how brutal the world can be. In fact, they believe it to be quite a bit more brtual than it actually is. There have been ONE really major terrorist attack in the US in the past century. And having access to every single one of their conversations did not do anything to prevent it. Having separate entrances for pilots and passengers on planes would have prevented it completely, though.
Reminds me of Carl Sagan's description of everything made out of star stuff- https://www.youtube.com/watch?v=iE9dEAx5Sgw
Yes. In this thread: http://forums.freenas.org/index.php?threads/its-bashs-turn-t... a user speculates that bash is included only for user convenience. I didn't know if repeating this speculation was HN-worthy, so I only reported what I knew for fact.

The following indicates than a patched bash is forthcoming:
http://lists.freenas.org/pipermail/freenas-commit/2014-Septe...
What function would feathers serve on an animal that's clearly way too big to fly? Might it have to do with body heat regulation?
> I've never really understood the whole "alcoholic vs.
> sobriety" thing.

Then you've never struggled with addiction.
Perhaps he's referring to something along the lines of URLs potentially being hidden in upcoming browser updates:

>"So [for the] love of god Google, if only to save me from another meeting conversation about this[,] please hide the URL behind a click in Chrome. And hope the marketeers start to think that covering the world in URLs makes as much sense as covering it in ISBNs or catalogue numbers or Amazon product IDs." //

From http://smethur.st/posts/176135843.
I've kept my notes on my blog because it's easier for me to find later (and it's open to everyone else at the same time): http://jonalmeida.com/posts/2014/09/25/htsas-lec02/

How can I prettify your notes? I find it hard to read.
I haven't, that's true. I'm asking these questions because I'd like to understand better, and your flippant response isn't a big help.
Hands on with the New BlackBerry Passport Smartphone
People that are OK with innocent people getting hurt never seen to realize that this usually guarantees that criminals get away with their crimes by the wrong person being convicted. Is that also something you are OK with?
It's easier to accumulate a million dollars net worth if you're two people rather than one, and owning real estate is expensive, and most people are more attractive potential spouses if they have wealth, and having children is expensive, so it's not surprising that these things are correlated with wealth. But that doesn't mean getting married, getting a mortgage, and pumping out a few kids will help you get rich.
It will be interesting to see how this all plays out. Uber has gotten big enough (and has enough cash) to put up a pretty good fight in court.

At the same time, city attorney's have a lot of stuff on their plates. Obviously someone thought this was worth spending on time (aka the higher ups want it to happen).
Did you mean you saw the startup go years without firing the guy with the shitty attitude? That would make more sense.
This Video Induces Natural Hallucinations – IFLScience
How do you have dash/bash setup:

# debconf-show dash
* dash/sh: true

true or false? If it did not work I imagine it is because you have /bin/sh linked to dash, as is the default in debian.
I find it very hard not to get angry at these posts. I'm thinking also of Fred Wilson's burn-baby-burn piece from a week or two ago.

I am the cofounder of a bootstrapped startup company with 7-figure annual revenue, a better than 100% growth rate for the last several years, a great team, a fantastic market, and a genuinely useful product.

One of the biggest problems facing my company right now is dealing with all of the venture-funded idiots coming after my customers, market and employees without so much as a hint of a viable business model. They outspend us on marketing 1000-to-1 and they offer to serve our clients essentially for free, apparently just to be able to win a logo for the "traction" slide in their deck in the hope that they will have enough proof points to get them their next hit of venture money.

I know that nearly all of them are going to vaporize eventually, but in the meantime they completely poison the well for all of us who are trying to do what Andressen, Wilson and the rest pretend they want startups to be doing - creating sustainable businesses in sustainable markets.

Posting this as an anonymous coward because who knows - I may need to raise venture money myself, though I'm pretty sure we wouldn't qualify with "5x being the new 2x" I don't think anyone is interested in mere 100% growth, even if it comes with the advantages of sustainability built on the back of a real business.
http://chadaustin.me/2014/09/connecting-c-and-javascript-on-...
How did we survive? Skills, connections, and some luck. It wasn't that everything vaporized, just a lot of fluff companies built on VC with no profitable business model. Just as when times were good a lot of unqualified people got into the business, when it imploded they got out.
Please lety me know when you do!! email me inaki@axitia.com
Yes,except it's the other way round. Fusion in normal stars makes elements up to iron. Only supernovae create the rest of the elements.

http://en.wikipedia.org/wiki/Supernova_nucleosynthesis
I don't know. I just keep them for my own and thought I'd share them cause they might be helpful to other people. Maybe you can add some Markdown to them and keep them in that format.
It rarely results in meaningful regulation of the business, yet provides endless free publicity and brand building.
I'm not advocating the idea that the laws of physics depend on circumstances. I'm just pointing out that similar processes may have vastly different consequences, even according to the same theory, given vastly different environment variables (as evidenced by the ongoing Bash fiasco).

For example, we know that things tend to behave weirdly at quantum scales. It that because the usual laws of physics do not apply at quantum scales? No, our best theories should be able to explain why the scale makes such differences, and therefore accurately predict phenomena at every scale, both large and small.

Likewise, there would be nothing wrong with singularities occurring under some circumstances and not under others, as long as we can come up with a compelling theory to explain how the different circumstances affect the outcome.

That's the kind of theory we should try to come up with. Not hasty generalizations based only on limited observation of familiar circumstances. I'm not saying we will be successful, but it would be a mistake not to try.
I've never been Involved with AA, so I might not have the most accurate information, but I also wondered this one evening, and ended up reading a bunch of articles, as well as the AA Handbook's section on Step 2[1].

From what I gathered, AA wants you to trust your recovery to a Higher Power, because then you can depend on said higher power to pull you through times of personal weakness (because nobody's strong all the time, let alone a recovering alcoholic). The term Higher Power in the handbook often pretty explicitly refers to the Christian God, but I remember the same handbook saying that the connection to the Higher Power is a distinctly personal one, and that each AA member can choose to define their higher power as they wish.

It is true that a lot of AA members end up finding Jesus as part of their recovery, but many also get through it by trusting in a different god, or in humanity, or in the elegant universe, or in the transcendental power of the AA group itself.

From what I gathered that evening, AA's process is very much faith-based, but what you're putting your faith in is flexible, and doesn't really matter to most AA groups.

[1]http://www.aa.org/assets/en_US/en_step2.pdf
Interesting, today I learned they did ban manufacturing of them. Can't say I mourn the loss of them, given their costs to society and the environment. If an irrational consumer choice harms everyone then regulation seems appropriate.