skysight-inc/HackerNews huggingface dataset:
FWIW, it's always been easier for me to think of it as 'moving' more quickly along the time axis - which would appear slowed down to someone farther away from the source of the gravity. Perhaps that's what the parent was getting at?
Deutsche Post DHL to Deliver Medicine via Drone
Another PoC:

env -i X='() { (a)=>\' bash -c 'echo curl -s https://bugzilla.redhat.com/'; head echo

Creates file called echo and outputs the contents using head.

(from https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c24)
Basically, in my experience, Dell and Lenovo now rule the corporate market, while the consumer market is now 1) smaller (since tablets and smartphones cannibalized some of it) and 2) clearly split between Apple and "everything else", where "everything else" runs on thin margins and is perceived as cheap and uncool. My anecdotal datapoint is that, in the last 5 years, I haven't seen anyone in my sector (finance / IT in the UK) using anything but Dell, Lenovo or Apple laptops (with the very occasional Sony Vaio, which Sony recently stopped selling).

On a larger scale, the rise of smartphones and tablets has clearly shrunk the traditional PC market, a market that already struggled with the end of Microsoft-led forced upgrades (that "good enough" level others mentioned; Microsoft used to periodically redefine what "good enough" was, but their products have substantially fossilized in the last decade). This doesn't mean PCs and laptops will go away for good; it's just that large margins are now elsewhere, so the industry is adapting.
not sure I follow this either. So you are setting a variable with a function def which is not supposed to be allowed, and calling bash.

Is the naughty thing that the improper function def is supposed to prevent bash to be executed?

If so, I still dont get how this is a possible RCE. nothing from the environment variable definition persists.
Any reason why the devkit is three beacons and not four? If you need a minimum of four.. it seems a bit daft not to have that as the default size and then sell single addon beacons as necessary.
The redirect at the end of the env var seems to be "remembered" even though the syntax error aborts the function definition, then the first arg is taken as the path to redirect to, and the following args as the command to execute. (I haven't dug into the actual parser, this is just my intuitive understanding.) It does seem to be about like $1 > $0, so not generally exploitable.

Here's an example using it to read files instead of write: https://news.ycombinator.com/item?id=8365205 But still, not as universal of an exploit as the original.
Agreed, the last great upgrade was the SSD. After that, for people using their laptops as non-intensive consumer devices, what else do they need?
Be as efficient as possible.

Don't waste time on presentation, so you don't feel like a marketroid.
Am I missing something?

I think so, but the sample exploit isn't really designed to give a clear understanding if you don't already know what's going on.

Try this:

$ export X="() { (a)=>\\"
$ bash -c 'echo date'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
$ cat echo
Thu Sep 25 02:27:07 UTC 2014

Setting "X" in that way confuses the bash env variable parser. It barfs at the "=" and leaves the ">\" unparsed

AFAICT (without digging deep into the code) that leave in the execution buffer as ">\[NEWLINE]echo date" which gets treated the same as

date > echo
Taking that a step further - why not a busybox image to get even smaller?
Vinod Khosla Must Let the Public Access His Private Beach, Judge Rules
Ideally, that would be great. I doubt that would be an option though due to capacity. Would you rather stop/start your instance and risk a capacity error or have your impacted instances rebooted in 48 hours?
Ask HN: How does Mint and Lastpass stay so seemingly secure, quiet, and popular?
My first thought as someone who has high comorbidity of autoimmune diseases is that this sounds like extremely severe neuropathic pain.

Since I wasn't familiar with CRPS I did a quick search for it and found this article

http://www.ninds.nih.gov/disorders/reflex_sympathetic_dystro...

A search for autoimmune on that page turns up this nugget,
"CRPS is more common in individuals with other inflammatory and autoimmune conditions such as asthma." Seeing as how it is a rare disease very little research is going to go towards this, so I'm just throwing out some conjecture that CRPS is likely an autoimmune disease itself.

Autoimmune diseases often cause neuropathic pain. Link below provides some details, a quick excerpt though is provided here.

"Neuropathic pain is distinguished from other pain conditions where the pain generator begins with disease of nonneural tissues. These nonneuropathic pain entities are said to be nociceptive and include conditions such as osteoarthitis and inflammatory pain."

Now to put it in layman's terms from a patient that doesn't understand the medical condition (me); the pain comes from my nerves/brain not working right.

I'm nowhere near as bad as the guy in this article; I am highly functioning on a day to day basis, but still have to use benzodiazepines in conjunction with opiates. As I understand it the former helps to slow down the overreaction of messages going between the nerves and brain, while the latter helps to take the "edge" off from the constant pain that remains.

The pain can come from anywhere and everywhere. I really feel for this guy; on a real bad day the pain has gotten so bad I can barely get out of bed and move. On the rare occasion that happens I double up on the drugs and sleep it off. Sounds like this guy is suffering times 1000 on a daily basis what I am on my worst days. That's some seriously awful shit.

http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1810425/
Suitsy – a business suit onesie
Also https://news.ycombinator.com/item?id=8364971 and https://news.ycombinator.com/item?id=8364446.
Comments moved to https://news.ycombinator.com/item?id=8365158.
I would say, contrast focuses only on the difference between the entities being contrasted, while compare can mean, you also focus on the similarities. Not sure, how you use the words, though.
Own It for Life – A curated list of durable products
I think the negative comments on here have got it upside down. I research and treat cancer, and I think this is great. The fact that it costs billions to develop a drug is why we should support novel pathways of organising drug development, rather than disparaging it.

It may not really be obvious from the outside, but there is a coming crisis in that we won't as a society be able to afford new cancer drugs. It is regularly reported that new drugs which are typically priced around US$120k per year (for multiple years in some cases) are not cost effective. Case in point: crizotonib. This is a drug that works very well at shrinking tumours and controlling disease in incurable lung cancer. It is targeted - it only works if your tumour has a particular gene fusion, which occurs in about 4% of lung cancer patients. It is well tolerated compared to chemotherapy. It's the kind of personalised medicine we are hoping to achieve more broadly in the future. And the way it is priced isn't cost effective [1].

I can guarantee you that the coming surge in immunotherapies will be exorbitantly priced. And these are drugs we will be giving not to 4% of cancer patients, but > 50% of advanced cancer patients in a given tumour type.

These problems are even worse in countries where the government pays for drugs, because they are far more restricted in what they can afford. Patients just end up missing out. And if you think having cancer is bad enough, knowing there is a drug that might help and not being able to afford it is just heart breaking.

So good luck to them, I hope they can draw some money away from nonsense like crowd funding potato salad.

[1] http://jco.ascopubs.org/content/early/2014/02/24/JCO.2013.53...
Reproduced from other discussion thread

Try this slight variation:

$ export X="() { (a)=>\\"
$ bash -c 'echo date'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
$ cat echo
Thu Sep 25 02:27:07 UTC 2014

Setting "X" in that way confuses the bash env variable parser. It barfs at the "=" and leaves the ">\" unparsed

AFAICT (without digging deep into the code) that leave in the execution buffer as ">\[NEWLINE]echo date" which gets treated the same as

date > echo

It causes the command to be interpreted (executed) in a totally different way than it was supposed to, with the nice side effect of modifying files.

See one of my other comments for an example that uses the same flaw to read files.

I don't think anyone has found an RCE path for it yet though.
Lenovo is doing good and getting better.

http://www.cnet.com/news/lenovo-earnings-soar-on-solid-pc-sm...
Twitter handles every startup should follow
I'm still waiting for them to stabilize wifi on the iPad sith iOS 8. Their quality has really started to slip for me since 10.9 on Mac.
> Would you rather stop/start your instance and risk a capacity error or have your impacted instances rebooted in 48 hours?

Is there that little slack in Amazon's compute capacity? I would hope not! If there isn't capacity to start my instance back up, I would hope that hitting Stop would generate a dialog to the effect of "Hey there, you won't be able to start this instance back up if you stop it right now."
The Samsung Q30, that many of you might know as the Dell X1 was a subnotebook so far ahead of its time. It was 12", pretty decent 1280x800 resolution, 1.1kg, fanless, less than an inch thick at its thickest.
OK two questions:

1. Does zsh (or other shells) also have these kind of string processings where bugs are likely?

2. Is there a way to completely remove bash from the system and use zsh (or other shells) instead?
And having dealt with ec2 support, I would have expected amazon to half-ass this just the way they did.

Another reason to consider owned & operated hardware. Or at least something like monthly rentals.
IANYL.
Why doesn't he just juice the raw plants for the THCA? I doubt the THC actually has any significant benefit, and then he wouldn't have nearly as much of the mental fog.
U.S. Forest Service Wants to Fine You $1,000 for Taking Pictures in the Forest
If you want proven crypto, there's always this project: https://github.com/idris-hackers/idris-crypto
What I'm really worried about now is every single cable modem and router out there, as they are very rarely updated. They run their shit for years. The bigger routers yes, but smaller ones and the modems not.
Thank you very much. For those of us living in countries with have poor internet connection, this is really helpful.
If you know of some old neglected bugs like you keep saying then point some out. I would love to see an actual source on something other than the constant made up retorts of "PID 1 now has an HTTP server" or "Now kernel panics display a QR code".
The secret ingredient of a true Entrepreneur
Not 2012.
metaphysics: the branch of philosophy that deals with the first principles of things, including abstract concepts such as being, knowing, substance, cause, identity, time, and space.

astrophysics: the branch of astronomy concerned with the physical nature of stars and other celestial bodies, and the application of the laws and theories of physics to the interpretation of astronomical observations.

Much of the nature of the cosmos is indeed a mystery, but that doesn't diminish the importance of the multitude of things we've learned about our universe from various physical observations and measurements.
The Women I Pretend to Be
Not saying I agree with it, but personally I would be worried about prosecution from doing something like the scan he is doing.
Ok, ignoring the moral repugnancy of the whole thing for a moment.

> T. Candice Smith, who testified before the Nevada Legislature that her car, which had a starter interrupt device installed, was shut down while she was driving on a Las Vegas freeway, nearly causing her to crash

> Others said their cars were shut down while idling at stoplights.

How the hell is that legal?! Surely you should only be able to disable a car when the engine is not running just on safety principles.
That is science at its best. What, indeed, is the alternative to admitting we were wrong when confronted with new and more accurate information? There is no "trust" in science, there is only truth, and you must always leave room for doubt.

Astrophysics appears volatile simply because there is so much we do not know, but that is also what makes it fascinating, and of critical importance.
There very well could be. If this issue is related to only handful of instance types then there goes all that extra capacity.
Sorry, my mistake. I appreciate you pointing it out.
The shellshock scan is setting the Host header, which might set the SERVER_NAME CGI variable in some environments and is not included in the Common Log Format or widely used Combined Log Format (which adds the Referer and User-Agent). For example, Apache's httpd directive UseCanonicalName is set to "off" by default, allowing the client to set SERVER_NAME via the Host header, possibly passing it to vulnerable scripts.

Furthermore, an admin might use directives to log the requested host in a name-based virtual hosting environment to facilitate parsing. For example, when using Apache's httpd LogFormat/CustomLog directives, if "%V" is used as the format string and UseCanonicalName is set to "off", the string provided by the client in the Host header will be written to the log. Naive parsers might choke on this or even execute the code. If the shellshock scan results in a delayed surge of pings from a single host, this is likely to be the cause.
It's a long-running debate in the security community, almost as big as full-vs-responsible disclosure.

On the pro side, it's better than you get patched than stay vulnerable and fall into someone else's zombie list.

On the anti side, you don't know what you are messing with and could break things, oh, and it's illegal and you can go to jail.

On the anti-anti side, if you can't be held responsible to patch your machines, don't complain when someone else does it for you.

That's the barest summary.
HP also has a chunk of the corporate market, but of course they aren't Sony or Samsung who are the subject here.
Thanks, that does entirely clear it up for me: I was missing the obvious (in hindsight):

Under normal circumstances:

$ bash -c 'echo date'
date

With this attack, it is not going to print out the actual date, but is actually executing something like

date > echo:

So what happens then as you and others demonstrated:

$ export X="() { (a)=>\\"
$ bash -c 'echo date'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'

$ cat echo
Wed Sep 24 22:38:19 EDT 2014

"echo" is now a file in my current working dir. Definitely fishy business. .. the whole flip flop of echo date to date > echo so easy to miss
So you think all the studies linking stress with inflammation are some kind of conspiracy?
I just got notified that my Elasticache instances are getting restarted, too.
It is likely untrue, but anecdotal. That said, how are subprime loans still legal??
That actually might be nice but don't get your hopes up, systemd isn't actually part of the linux kernel as some conspiracy nuts would have you believe. The systemd project can't possibly just add random stuff to kernel panics, all of that code is in the kernel, not userspace.

I think a little while ago there actually was some work done on making kernel panics display a QR code but I doubt it'll ever be merged in if it's even done.
While people may be painting Amazon in a bad light here, the business-level risk of wholly committing to a single infrastructure provider (cloud or otherwise, across multiple 'availability zones' or data centers or countries or continents, or otherwise) is real. There is a clear need for many service authors to work with disparate infrastructure in a cloud provider and platform abstracted manner, and arguably no solid tools for doing it right now.

What will the future look like? I believe that a standard, git-like command line tool for infrastructure, sort of a 'brandless ec2' or 'P-abstracted IaaS' version of heroku, will replace all of the current-era providers with a free market for infrastructure based on transparency, real uptime and performance analysis and incident observations by multiple third parties with cryptographic reputation management. Two angles converging on that at http://stani.sh/walter/pfcts and http://ifex-project.org/
If you want to learn more about the Civic Tech/Gov Tech space, checkout the Code for America Summit live stream when it continues tomorrow at http://www.codeforamerica.org/summit/

(Shameless plug: I will be presenting about our start-up tomorrow)

It's not just A16Z who's getting into this space. Check out the new fund by Ron Bouganim.

http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/15...

And obviously, Y-Combinator is now getting into the government space. https://www.ycombinator.com/rfs/

It's been a slow build, but the industry is huge.
No, any photons that are emitted from matter close to the event horizon and travel toward the distant observer will be redshifted. Photons falling into the potential well of the black hole will be blueshifted. Of course, the distant observer is not able to directly detect photons falling into the black hole because he is far away from it. All he can do is calculate what he would expect the energy of the photons to be. This calculation gives an infinite energy as the photon approaches the event horizon, but it's not a "real" energy, so the black hole doesn't gain an infinite amount of energy.

An analogous effect occurs for an observer stationed at rest, hovering above the event horizon. Such an observer will observe the photons from afar to be blueshifed in agreement with the distant observer. Moreover, as this stationary observer gets closer and closer to the event horizon, the photons will be blueshifted to infinitely large energies.
What if there's a leak in the salt mine?

I mean, a salt mine is just a large hole in the ground. What assurance do we have that it doesn't have any hairline cracks through which compressed air can escape?

And if the air does begin to escape and erode the surrounding rock, how do you prevent a massive explosion occurring at some point? Is the weight of the rock above the cavern enough to keep the air compressed at 1100 psi?
Especially as it's actually executing code on other people's computers, you can't even really say it's just observation at that point.
Indeed. If you have a late 2008 all Intel laptop with a Penryn CPU and an X25-M SSD (fiendishly expensive at that time) to this day, six years later, it's hard to see what's the point of getting another laptop.

For a few more years, the decreasing costs of SSDs were giving incentive but yes, once you have that, what incentive remains? The high resolution screen is still more trouble than advantage.

I was purchasing newer and newer ThinkPads for a few more years, until I could put 16GB (for a sw developer, having lots of RAM is helpful) in a 14" model, then stopped at the T420 in 2011 and that's the end of laptops for me for the foreseeable future.
They'll remain legal as long as they're at all profitable and that profit exceeds any fines or losses in lawsuits.
Shill: A Secure Shell Scripting Language
this has been true for us so far as well. But I wouldn't rule out that they have more scheduled maintenances that haven't been put out yet.
On AWS you should be prepared for an instance to disappear at any time, for any reason. Why is a scheduled reboot such a big deal?
It is likely untrue...

Why do you believe this?
The Apple iPhone 6 Plus 'BendGate' Is Already Out of Control
Portal Dev Responds to Glitch Question
It's not a question of intent but of the site rules. The rule is to use the original title unless it is misleading or linkbait [1]. In this case it was arguably both, so the original title was ruled out.

One reason why baity titles are precluded is that they cause precisely the sort of bikeshed title war that brought this thread down.

1. https://news.ycombinator.com/newsguidelines.html
Oh that's neat.
Glitch description http://www.reddit.com/r/GamePhysics/comments/2gxb7b/portal_w...
The woman who needed a pickup to deliver pizza is symptomatic of a different problem too. In many places it would always be the responsibility of the pizza joint to provide the vehicle because typical consumer auto insurance expressly forbids commercial use. The pizza chains not only pay minimum wage, they also expect their employees to provide the business equipment...
Of course it's not legal. However, the article also quotes the "other side" claiming that it's impossible for the device to do that, and the manufacturer claiming that the device has is not designed to do that, and that they have no record of it doing such a thing. And on their website they say the device "can never shut down a running vehicle."

So...presumably either Smith is mistaken and/or lying, or the device is defective. It's possible that her car broke down on the freeway, and she assumed it was the starter interrupt when in fact it was not. But it's exceedingly unlikely that the device did so while operating according to design.

(Or Passtime is about to get one humongous fine and/or judgement...)
If we skip the moral indignation and look at the situation plainly, this sort of technology enables a whole subset of people to actually own cars that were considered too risky before. That's a good thing. Given the choice between no car and a car that won't start if I don't pay, I'll go with a gimped car.
Curious, what do large scale companies in the cloud currently do for this?
Paypal to Offer Small Business Loans in Australia
I recently saw a colleague with a surface pro (version 1) as a workstation, I was rubbing my eyes, because I couldn't believe that this is working.

That said, I'm now working (as a programmer, yes) from a Sony Vaio Multi-Flip 13". It has everything I ever wanted: Good resultion, sleek, quite remarkable performance for that tiny little thing, convertible, etc etc. It also "look good", as the apple devices do, and, in addition, you can flip it over to a tablet. Well... in theory the best thing that I ever had. In theory. The closing mechanism sometimes doesn't recognize a "is closed" properly and the notebook shuts down and comes up again in camera mode. I recently had to replace the keyboard, because the return key was broken, which is not easy with an ultrabook when warranty is over, since its soldered or brazed (or how you call that) with plastic pins. When I got it, I think I got a refurbished device, one key was stuck, and circumstances required that I open it myself and fix it and found the inside overwhelmingly full of fingerprints and screws in wrong places. I could continue like that and I am not alone. All these things, these little quality and qc glitches between an Apple device and "all the others" are (for me) the main reason why everyone runs to apple. They are producing just the best quality and for me as a consumer, its still affordable, and it even looks better and feels better. I am no friend of iOS, I grew up with windows and linux, which is no excuse not to buy an Apple, but I would still first look everywhere else for alternatives. So, that samsung is also shutting down is very sad, since they produces very nice models. A friend of mine has the older samsung series and has also quality glitches. Beside apple, it seems the market has realized it has to produce good quality, good looking and good functioning devices, but most of them are all show and no substance. For my understanding.

I was hoping they would slowly slowly introduce newer models, better processing, better overall quality. Instead they are shutting down. I'm sad.