skysight-inc/HackerNews huggingface dataset:
I'm not completely sure, but from what I understand unless you have some cgi shell scripts on a webserver running on your machine (or another way for someone to invoke bash with custom environment vars) I think you're fine.
Hm, so their cheap Mars mission was sort of local manufacturers promotion? Clever move.
Isn't it kind of a security best practice to assume your web user can be compromised and plan accordingly with permissions?
Either of these will typically show you your running terminal:

ps -p $$

echo $0
(command name that was used to invoke the shell)

Not reliable:
echo $SHELL
(preferred shell for the user, not necessarily what is running)

Also note that you may want to remove/fix bash to make sure it doesn't get run by something else. A CGI script may run it despite you changing your default shell to something else.
How could you tell the difference from the regular LinkedIn experience?
I have used Amazon and Smashwords for over 2 years now. Both services have grown, expanded, and improved, in terms of my user experience (checking reports, accurate payments). I had up to 10 books available at one point, still have 7-8 in circulation.

70% of my book sales come from Amazon.
Smashwords gives me more $ per sale.

If you had to go with one service first, I'd recommend Amazon Kindle Direct. Once you get comfortable with how the process works, branch out to Smashwords if you like. It took me less than a day to get set up and they have pretty good documentation.
Just to clarify a little:

By default Debian still uses Bash for interactive user shells, but since Squeeze (early 2011), /bin/sh is provided by Dash.

Dash is used because it's faster than Bash and has less dependencies so its more resilient to failures.

for more info see https://wiki.debian.org/Shell, https://wiki.debian.org/DashAsBinSh and https://packages.debian.org/wheezy/dash
That was brutal. Demolished pretty much all of the serious accusations in the original letter with facts that could not be true if the accusations would be solid.

It was also wonderfully mean to ignore the News Corp CEO who signed the letter and reply to Rupert instead, implying quite a lot about the role of the current CEO.
From Vim to Emacs
Sorry to say but everything about this website feels cheap and generic to me: from the font to the use of huge font-awesome icons, to the texture in the background; to me this page looks like it's from 2012.

"Sound too good to be true? I wrote and designed this very landing page you're reading in 1 day."

Yeah, I can tell.
It's impossible to create a design that will stand on its own in a day, if only for the fact that you need to have looked at it for so much longer than 24h (which is probably more like 10h) to have any kind of perspective on what you've produced.
And, frankly, I feel like somebody who's been doing this for 10 years should know this.

To me, this whole thing just reads as an easy cheap hack for this guy to make more money.
Minimalist Word Processor to Increase Your Productivity – Http://wri.tt
http://wri.tt
It was refreshing to read the entire thread and not see a negative comment about the source of the patch.

The entire thread was limited to discussing the actual patch implementation.

Good for the patch submitter for doing two things:

1)sticking around and answer any questions about the patch. Some people dump their patch and leave.

2) For making their modification stay behind an input flag, ie they aren't pushing this as the default, though it looks like maybe it should be.

And today I found out about "Microsoft Open Technologies, Inc." I've never heard of that group before!
> super-powerful and elegant PowerShell

I'd agree, unfortunately it's pronounced PowersHell.

(by those who have to use it)
Looking at http://code.metager.de/source/xref/isc-dhcp-debian/client/dh...

It seems that server_name from DHCP response is passed to environment variable without sanitising.

3437	if (check_option_values(NULL, DHO_HOST_NAME,
3438	lease->server_name,
3439	strlen(lease->server_name)) == 0 ) {
3440	client_envadd (client, prefix, "server_name",
3441	"%s", lease->server_name);

And script that is run after that (dhclient-script) is written in bash at least on Debian.
Shill: Scripting with Least Privilege
It's a bash bug because the bug is ultimately in how bash parses environment variables. My understanding is quite limited, but IIUC, after the invalid function definition, the bash parser simply stops trying to parse the environment, and the remaining input tokens get used as arguments to the next command executed by the shell.
Post https://news.ycombinator.com/item?id=8367012 suggests that it is actually Swift that is the Blub language...
Two men arrested in connection with 'brutal and barbaric' Newry murder
Don't know why you are being downvoted. What you said is true. I would like to see how these things are being addressed in India on that website.
New rfid applications would be great and by means pursue them! The reason I think this is a great problem for CV is that right now, only a nurse would be able to tell if there is a puddle on the floor from a leaking IV, patient's puke, overflown catheter bag, etc. Also is there air in a line, does the label on the drug match the prescription in EMR? These are common sense, cheap to fix / prevent problems that I'm not sure rfid could solve. RFID would be great for matching drug labeled with rfid with chip in patient's armband. One could think of lots of implementations for that sort of thing!

I guess it really comes down to what sort of focus you want your project to take, and what idea you think your PI will be interested in considering. Good luck!
Best Office Apps for Android 2014
Problems with naming a product: SOLVED
From the article, it sounds like the issue is not just with Apache but also ssh, DHCP and others. So I'd just assume you're still at risk regardless of your Apache user configuration. (in any case, it's safer to act as if)
The structure petty interesting, but which language/framework do you use? I think different language/framework might have their standard.
Ask HN: Development ideas for ComputerSpam.com?
I recently acquired the domain computerspam.com, what should I build out of it to rank it in the search engines?

Any suggestions, HN?
I see what you mean - although given my poor landing page design skills pretty much anything looks good to me.

Can you give an example of a decent landing page?
For Debian that would be debian-security-announce [1], I try to read every post from that list.

1: https://lists.debian.org/debian-security-announce/
How College Students Listen: One Nation, Under Spotify
Clasp – A Common Lisp with LLVM back end and interoperation with C++
It can read your application source code, read your database credentials, access your database, and exfiltrate its contents. Yes, you are at risk.
Top 40 Musical Universities in America: How Students Listen
How to make my FB page verified?
Given that every week you put that $1 aside.
"[W]hen you are sick or old it has no interest in serving you. You're just a problem customer in their portfolio."

Right, with two caveats. A big problem with relying on competition to get good behaviour out of health insurers is that for health care in particular the common pattern is that expenses are low, and then for some expenses get high and stay high. As you say, this means that as soon as you need to actually use your insurance, you're a "problem customer" and - basic incentives wise - they'd rather not have you as a customer any more. If they frustrate you sufficiently that you say, "Screw this, I'm going to your competitor!" they win - they keep all the money you paid in, and it's their competitor that needs to pay out now.

The caveats.

First: employer based health care, as weird as it is, serves a role as collective bargaining. Losing the sick person is good. Losing the sick person and a couple thousand healthy people is bad (or at least less good).

The other caveat is the cap on the medical loss ratio in the ACA. If a company is operating near the cap (and why wouldn't they be?) then the pool of money available for executives and shareholders can depend more on total revenues than on revenues minus medical costs. When that's true, losing any customer hurts - even one that nets negative.

I don't think either of these is doing enough (the second might, long term, but I'm not sure the industry has internalized it yet), but they help some.
I've learned my lesson trying to structure "large projects" inside of a single "project" or logical repository.

A developer I hired at one point had read an article written by someone in the OSS community promulgating the virtues of treating your "projects" like OSS projects and if you have a "large project" breaking it down into smaller constituent projects with their own source repository, dependency defs, README's, tests, Vagrant / Docker environments etc...

This fits well with the ideas behind small composable units of work and it also increases clarity.

[EDIT] Essentially, if you have a large project, it's probably time to re-think how you're coupling or de-coupling functional units. The goal being lots of small, documented, and tested units composed to create a "large software product".
Things like that lower the risk: run everything as a low-privilege account (better, not even www-data but per-site), chroot()-ed, etc. and certain classes of attack will either fail or at least be easier to clean up.

The problem with all of this is that it assumes that you don't have privilege escalation vulnerabilities on the local system, which is often not the case unless non-trivial effort has gone into hardening the server – e.g. all of that privilege separation is a waste if someone sledgehammer-ed a chmod 777 into a script rather than setting the appropriate ownership and permissions or someone delayed a kernel update because they didn't want the downtime and “knew” that only trusted code ran on that system.
Schizophrenic iPhone
If you spend your money on something that makes you happy, then it's money well spent. So, in that context, "irrational" is subjective.
They could always be using the money they're making from selling handwriting-robots to fund homeless shelters and college scholarships.
But there you are fixing the symptom (the web server issue) not the problem (which lies in bash) so you need that fix everywhere that bash is used and not just in one place (in bash itself).

It could be a useful interim measure for code that implements it, but only if the update gets written, tested, and released before the update to bash is available - and it would weigh down the package maintainers for the distros as they'd have a sudden glut of updates coming downstream for this one issue instead of one update for one package.

People who aren't going to update bash as soon as an update is available aren't going to update everything else (where "everything else" is a set containing at least Apache, probably other web servers, and maybe many other apps) as quickly either - so fixing bash is the best course and the quickest resolution, and changing Apache and friends isn't going to have any benefit: either people update in a timely manner (so the bash fix sorts their problem) or they don't (and no end of updates will solve their problem because they don't have any of them installed).
Tails 1.1.2 is out
Do they? This is an open letter that's a response to an open letter. This seems like about the right level of detail for that. It needs to be short, snappy, and readable by a general audience.

I suspect that their interactions with the EC regulator [1] are rather more detailed.

[1] http://en.wikipedia.org/wiki/Directorate-General_for_Competi...
If you bought tickets systematically with a reasonable expectation of making a profit, then the tickets should be tax-deductible as an expense.

Normally lottery tickets aren't tax deductible because of the 'reasonable expectation' test.
I also had the same problem, I've received 2/3 spams to the linkedin address in the past two weeks and never received any before.

They are also passing the gmail filter which is quite impressive in itself.
WOW!!! Didn't know that. It could explain why connecting with someone you know is so important. When I think about it: Here is a situation that has a happened a couple of times in the past couple of years: Someone request to connect with me, we have a lot of the same connections and they really look like an all-star but there is no picture. I connected on the feeling "Why Not, a lot of my connections are connected to this person". I then get emails as if I subscribed to a much smaller service similar to a Monsters.com or Dice.com for technology related positions. I also get recruiters sending me emails for directly, and in one instance a recruiter called the main line to my employer and asked to speak with me and got transferred over.

I've always wondered how these things were taking place but never took the time to investigate because of how infrequent the occurrences were. It usually takes a while to unsubscribe from these services via email, so I just mark as SPAM. I just looked and they're still sending stuff, at least some are. I just removed all people I didn't know from shaking their hand from my connections; which includes recruiters that only request invitation to connect to talk about a job opportunity.

I wonder if LinkedIn knows about this sort of Growth Hacking type of SPAM or just doesn't care?
For those of you playing the home version, this is in Set 6 of our crypto challenges:

http://cryptopals.com/sets/6/challenges/42/

Ironically, Firefox is the only browser that had this flaw when Bleichenbacher originally described it almost 10 years ago.

I'm particularly fond of this bug; it's what started me off down the path of learning about serious crypto attacks.
With only static content (all logic implemented via cron).

$ grep nginx /etc/passwd

nginx:x:105:111:nginx user,,,:/nonexistent:/bin/false

And the only other service listening in this machine is SSH, but it's limited by iptables only to my home IP.

I think I'm safe. Now installing updates patches bash.

Anyway, I've seen that syntax before (I'm talking of years here), on #bash in freenode.

Simply nobody did apply this from a security view point in the channel...
San Diego man's $58,000 nightmare with Tesla Model S
This was about a PHP/Symfony API and a angularjs/phonegap app. I've split it between a PHP app, Node app and a phonegap app previously as well and it felt like a nice workflow and I felt like I was getting more done. You're right it might not be ideal for everything. But for new comers I think it's a solid place to start. Especially for PHP, which can get a bit messy!
Well, I mostly use Debian and Arch:

Debian isn't low volume: https://lists.debian.org/debian-security-announce/2014/threa...

Arch isn't high volume enough(!) https://mailman.archlinux.org/pipermail/arch-security/

Arch recommends the oss-security list, which is all too high volume http://www.openwall.com/lists/oss-security/2014/09/
But people can casually look at code and see vulnerabilities, any time they want.

Although your point about the methods of exploits changing the dynamic is valid.

>Also: MS Shared Source initiative

Fair point.
100 billion using 2.8 million people is 35K per person.
>If you lawfully bought land, and now people wanted to have public access to it

Except it's the opposite. People had public access, then he bought it, then he tried to unlawfully take away public access. If he doesn't want people on his property, he shouldn't have bought property that has a preexisting public easement.
Yes. I have an address which I'm sure hasn't been used for anything except registering on Tumblr, and it started receiving spam about two months ago.
> And they built Docker with Go.

That's why they know "Go" is very often called "Golang", for search-engine-related reasons.
https://tnf.ghost.io/thursday-night-football-live/
Take for example your favorite web app server, rails, django, etc. whatever it may be. (Not saying these are necessarily exploitable, but potentially)

Now imagine that for EVERY request, no matter if it is a valid path or not, one of the things it does is load all of the headers for the request into bash variables...
Watching Larry Ellison Become Larry Ellison – The DNA of a Winner
You can create as many crawlers as you want. If you created a 100 crawler in a month and ran them, it would cost less than a dollar.
So the app needs to set a flag to optimize network code paths if both endpoints are on same local loopback network. Why can't Windows detect that internally and enable the shorter code paths automatically? At that level it should be an implementation detail to the app so doing it transparently shouldn't be an issue.

Also they should have posted some numbers in support of this change - what's improved and how much.
We got a bit more traffic than we expected from shellshock. E.g, we're under very heavy load, but please, try again! We scaled up!
It's hard to explain, but just the fact that it has some huge useless feature bothers me.
Please correct me if I am wrong. Wasn't there a cost associated with using these washrooms? I recall reading a study that surveyed people and found:

a. The primary target market found the cost to high

b. The primary market who had always used the woods were embarrassed of not knowing how to "use" the facilities and embarrassed to ask anyone about it.

c. There were some free locations, that were filthy.
Have you ever applied to a job and wanted the email to be different than the one who have listed?
Bash is a shell, part of it's purpose is to deal with enviroment variables. The bug here is that the parser is getting confused, the feature being abused here is being able to declare functions as part of an enviroment variable, which is used to transfer functions to subshells in bash. Now this itself is fine, but since the parser gets confused it also executes commands after the function definition.
Get Traffic Stats for Any Site or App
Yeah I agree! I used to commit everything into one repo, and I found I was wasting a lot of time downloading thousands of files and vm's etc when I only needed to work on say one component.

I think this structure lets you take either approach, needs some tweaking though for sure.
plus fifty-seven screens of up-selling.
Dude has had an interesting life. Bio from his webpage:

Michaels career, not only as an artist, is a rather unusual one: born in 1969 in Vienna, he got interested in technology, especially electronics and mathematics, already when 7 years old. At the age of 12 he worked as a programmer. He quit school at 17 and started his first own business in the financial field, publishing analysis on the financial markets and managing funds, until he sold his business at the age of 23. The following 3 years he spent climbing and hiking in Africa, USA, Asia, and all over Europe. From 1995 on he was the publisher of werk-zeug, a technology and art magazine, as well as streetfashion, a magazine featuring fashionable people on the streets all over the world. He was also active in the field of software development, is the originator of many inventions, and holds international patents ranging from climbing equipment and bicycle gears to trading systems and electronic payment systems. Already in 2001, Michael decided to sell his companies to start his career in arts and works as he calls it. In the very same year though, he started a side business on eBay that eventually became the world's largest powerselling enterprise on eBay, a company with 80 employees and a turnover of 30 million euros a year. In early 2005, the company went bankrupt, and Michael lost all his money in the process. Never shying away from new challenges, he decided to write a book about the company and its end: English and German versions of "The end of EBay" are available through Amazon here. Qentis' bankruptcy also had its good sides: finally, Michael could concentrate on his art and private studies. Michael’s works are the result of a rich live and a long history of ideas. The artist about his work: "there is no way to (mate)realize all the plans and projects I have on my mind in one lifetime- I can only pick the best and feasible". His work touches a broad variety of fields such as technology, politics, science, social topics, and style.
And as a domestic student those fees are also subsidized so the actual debt is relatively small (software engineering at a middling university ends up just shy of $30k for the entire degree)
Never really work on PHP before, but I think you should include those info so people like me will understand this setup is optimize for which language.
So...maybe I'm being nitpicky here, but I mention it b/c maybe I just don't understand...

They state in the article:
You will have to plunk down your $2 at least 86 million times. Williams...could have simply said the odds of winning ... were 1 in 175 million

It might cost you > $172MM, but aren't the odds 1 in 86 million? Or am I being obtuse?
Ambition (YC W14) Hiring Customer Support/Success
Ambition (http://ambition.com) increases engagement and productivity within sales environments. We do this through an adaptation of the "Fantasy Football" system... management chooses/benchmarks/weights metrics for employee-based teams to compete over week-to-week across seasons.

We're backed by Google Ventures, Redpoint Ventures, SV Angel and our customers range from start-ups hitting traction to Fortune 1000.

With all of that said, we're now looking for individuals to play a vital role in the growth of our company, people who excel at supporting customers and ensuring their success even when there isn't necessarily a manual with all of the answers.

Responsibilities:

* Handle inbound communication from customers

* Proactively monitor and outbound to customers as needed

* Understand customer initiatives and shape product experience to deliver desired results

* Build/maintain documentation, create/refine process, make Ambition better

* Author and live by a Customer Support/Success Manifesto

You'll be working closely with the founding team, c-level executives, IT departments, and salt-of-the-earth salespeople. You'll overcome challenges, learn a lot about a lot, and lead the Ambition team forward as we continue our mission to make work suck less.

Requirements:

* Strong written/verbal skills

* You genuinely enjoy helping people

* You genuinely enjoy solving problems

* You are curious, diligent, hard-working, and have something to prove

Nice-to-Haves:

* Basic technical skills (Python/HTML/CSS/Javascript)

* Salesforce experience

Ambition is located in Chattanooga, Tennessee. Why? Great city, great outdoors, up-and-coming technology scene, fantastic cost-of-living. For those of you that didn't just leave this page, we're looking forward to speaking with you, email us at careers@ambition.com with a cover letter and resume to get started.

Until then,
Travis & The Ambition Team
>While Google doesn't, as far as I know, "fix" search rankings to give themselves an edge

They certainly have done that in the past. Marissa Mayer admitted it in this talk: https://www.youtube.com/watch?v=LT1UFZSbcxE#t=44m50s

>When we rolled out Google Finance, we did put the Google link first. It seems only fair, right? We do all the work for the search page and all these other things, so we do put it first. That’s actually been a policy, then, because of Finance we implemented it in other places. So for Google Maps, again, it’s the first link.
Rocket Internet in Africa
+1. Landscape has gotten zero serious evaluation at our company completely because of their heavy-handed pricing arrangement.
Can Brain Training Help Seniors
Why is my bash version still 4.2.45(1) after this?

# bash --version
bash --version
GNU bash, version 4.2.45(1)-release (x86_64-pc-linux-gnu)

Though it seems the vulnerability got fixed.