skysight-inc/HackerNews huggingface dataset:
The supports are necessary, as they are in most 3D printers that aren't using a powder substrate, to hold the part as it's printing in air. The specific distance from the build platform is determined in software, and is a consequence of a variety of factors, having to do with optimizing resin flow around the part, to ensuring adequate adhesion to the build platform.
You might want to replace the screenshots of the Android keyboards - you're using the screenshots of the cross-platform keyboards running on iOS devices, and they look different when running on Android devices.
The latter. Some daemons, like CGI scripts will spawn a shell populated with environment variables from the client. With a vulnerable bash, commands in these get executed.
Shellshock: 'Deadly serious' new vulnerability found
It is probably a SHA hash of a one-liner proof of concept that he has that he doesn't want to reveal as yet, but wants to prove that he was talking about at a later date.
An aerospace engineer has completely reinvented the ice cream scoop
Do you own a gun if the government says it's illegal for you to shoot someone with it?
This is extraordinarily useful and unique. My compliments to Backblaze for making this available. This is the type of empirical data I would love to have for as many things as possible: SSDs, monitors, TVs, kitchen appliances, tablets, cars, etc.
So has a new patch come out? I hacked up a temporary patch that fixes this last night after the new PoC was released, but I'd rather have something from upstream.
This is pretty awesome. I would love to see some of the work you do from this.
I don't think this reply works.

Situation 1: There is a window. It gets broken. The shopkeeper pays for it to be replaced, instead of buying a book.

Situation 2: There is no window, and there is no need for a window. But the shopkeeper pays for a window anyway, instead of buying a book.

Situation 1 is restoring the status quo, situation 2 is financing new production - but they seem equally bad, because in both cases you're paying someone to do something that doesn't (at the beginning of the situation) need to be done.

I'm not saying that we're in situation 2 here, because windows are in fact useful. But zizee's original argument was roughly, "let's forget all the benefits that we get from windows, this project is paying the wages of glaziers, this money will get taxed and etc." And I think that that particular argument in favour of this project fails, and I think pravda was correct to point it out.
Douglas Coupland Misses His Pre-Internet Brain
Does anybody has steps what to do really as a sysadmin? Do I only need to install newest bash (on Linux systems) or do I also need to restart daemons like nginx/apache etc. ?
> because they were engaged in new and productive work

Well, new and productive work is not equivalent to valuable work, for possibly a pretty big number of definitions of "valuable". Of course, "valuable" is subjective.

I mean, of course, in the global future context, this endeavor may contribute a lot of value, but what if I am starving and I probably wont be there to take advantage of that value? With sufficient people in this situation, the value of this project is pretty low.
Fake fingerprint fools iPhone 6 Touch ID
Its a bash thing, or more specifically, the issue is with the fact that many (mostly old) web applications/web servers pass content from user straight to bash as environment variables,
not expecting this to cause any problems.
Thanks, but no.

Another detail I remember: its website or the blog of its author was surely online in 2011/2012 and it has a slightly brownish/reddish theme
Did you do anything to contribute? If not, then there's nothing you can be proud of. It's like saying "proud to be white" when Neil Armstrong first stepped on the moon.
Kaya from Future of Programming at StrangeLoop
:) Years ago a colleague carefully crafted an ASCII escape sequence for VT320 terminals that would mess up the screen and program a function key to send a network-wide broadcast message.

He sent a note to an admin... something like: "This is cool. If the screen gets messed up, just hit Shift-F12." Everyone on the network received a broadcast message: "I've been had." Obviously, it could have been a lot worse.
> generic is really useful

Container types are the most obvious. Lists, Arrays, Dictionaries, Vectors, Stacks. You'd be hard pressed to find code that doesn't use a container type of some kind.
It looks similar to a watch I've seen all over the news. Can't remember the name of it though. (Also IP68 isn't really waterproof. I take it back, I thought it was IP67 whoops)
Looks like a great idea. All the best with this!
TextNut – a WYSIWYG markdown editor for Mac
This only works if you already have a virtual machine with a high quality model of the hardware you're trying to test the driver for. For core PC devices like VESA and SATA this is mostly OK (though you still have a high risk of introducing opposing bugs in the device model and the driver which cancel each other out, so it can't replace testing with real hardware entirely). But it won't scale to the huge range of drivers for more or less obscure hardware which the kernel has these days -- writing a device model is about as much work again as writing the device driver, maybe more, and often devices just don't have enough documentation to write an accurate model. Nor is it likely to identify regressions like "we accidentally reverted the fix for this hardware bug that only affects rev 0 SCSI adaptors from manufacturer X".
Unreal Engine and a Small Team – Day 3: Matinee, Perforce and UI
Click-able: http://searchgovernmentjobs.org
Start-ups versus Big Companies
Skimming this post, it appears to only reference CVE-2014-6271 and not CVE-2014-7169, so probably not 'everything you need to know'.

(Searching for '=>' doesn't show anything, which I would expect it to if -7169 was mentioned.)
If you're on Ubuntu or Debian your CGI scripts will probably use dash, not bash.
Search Flickr inside Photoshop
How I organise a large project
Are you kidding? I have to run i2s. I can't afford anything else! :)
"Demand great"
Not just web servers, but anything that calls system() or popen() is really calling the system shell, /bin/sh. On many systems, /bin/sh is really bash in sh compatability mode. That means all those perl scripts, CGI scripts, even DHCP clients expose the vulnerability. Ubuntu runs dash as /bin/sh instead, and most BSDs run ash, so they're not as vulnerable.

Edit: also, if you have ssh access to a non-login account, like for git access, this could execute commands on the remote host as if you had a shell.
Have you read the CodeClimate post '7 Patterns to Refactor Fat ActiveRecord Models'? (http://blog.codeclimate.com/blog/2012/10/17/7-ways-to-decomp...). This book is a whole lot more awesome.

It covers ground that we otherwise learn over a few years of painful experience. To mention a few: namespaces to organize code, extensive coverage of ActiveRecord bloat and how to deal with it, and controllers: consistently thin. And to top it off all: a whole chapter dedicated to managing CSS using BEM.

The book has a lot of code examples and conventions. There is also a chapter titled "Building Applications To Last" that has some great recommendations on how to approach changing fashions, on using gems and thoughts on tests. It is also quite a short book, under 150 pages.
Being professionally involved in somewhat similar industry, this is definitely one of best articles I've read about lottery. Well done!
There is a lot of interest in research on the benefits of static vs dynamic typing. But unfortunately there is not a lot of hard data. There were some experiments, e.g.

http://dl.acm.org/citation.cfm?id=2047861

which seem to support the claim that dynamic typing is better for rapid prototyping. So if you have data that correlate typing disciplines with bug rates, it would be hugely valuable to share it.
I would like to create a landing page service using your landing page in a day service. When you design my landing page service page, please make it read "Landing Page in Half a Day". The cost will be $999.
Dear Rupert
Categories – Happy Birthday Wishes
Give me a keyboard that allows be to efficiently type in two languages with autocorrect,and I am sold.
Keep an eye on the patches directory for whatever version you use:

http://ftp.gnu.org/pub/gnu/bash/

Just had to manually patch a CentOS4 legacy system.

What I find interesting is the patch has been around since the 16th, what took so long and what finally lit a fire under the mainstream *nix releases?
It doesn't, but a long press on the delete key deletes words at a time, accelerating as long as you keep pressing.
Apple is so good with the showmanship that it seems to have sucked the air out of competing watches. Is sony even trying?

BTW, this was announced back on September 3 or sooner: https://www.youtube.com/watch?v=IbDDWubWKaQ
How fast could you visit all 50 states?
Why the Heyday of Credit Card Fraud Is Almost Over
Erm what about mod_php etc?
fake it till you make it I guess?
All my Ubuntu 14.04 systems have /bin/sh symlinked to bash, not dash. I'm seeing articles on the net about Ubuntu switching to dash, but as far as I can tell, it either was reverted, or never happened.
Taking advantage of TCP loopback fast path in Windows
The vulnerability only affects bash when it is parsing environment variables, when it is just starting. So if a process is already running, it's not vulnerable and you don't have to restart it. You should definitely apply the patch from Wednesday, but be aware there is a related vulnerability that has no patch yet.

Add the configuration from this page https://access.redhat.com/solutions/1207723 to your Apache or nginx config to deny malicious HTTP requests.
Most of the iOS ones have been on Android for a long time. Obviously, it's easy to get yourself up to speed on the new platform when you've already done all the R&D and just need to do a port.
That's what I initially figured, but was left uneasy after seeing the Gist and trying to Google about it.
is it just me or are others suffering from "unresponsiveness"? whenever I'm in flow I can't hear or see others around me. my daughter told me the other day "I ignore her and never listen ". Digging further, it turned out she walked up to me and asked me a question while I was programming - I didn't even respond - so she walked away!! It blew my mind ... wonder how often I come across as arrogant to those around me ...
This is why I don't run Apache on my servers. Too many crufty old plugins designed in the days of peace and love.

Give me servers running under JVM that do the focused few things they do very, very well.
FIWARE Accelerator Programme
I know that's just an example and that you probably don't actually write tests like that in your day job, but it's a terrible unit test. For example, it fails to tell apart addition from the constant function 7.

Even if you add more data points, you're still not testing addition.

In a way, "testing for specific values" is very misleading. Consider that it'd be the wrong if you were actually trying to prove something. Now, tests aren't proofs, but we still should write them to be as strong as it's practical.

Strong static typing with property testing (a la quickcheck) whenever possible are preferrable in my opinion.
Learning How (Not) to Learn
Good luck convincing a serious Lisp afficionado that his preferred syntax schema isn't some kind of Platonic ideal though.
'Make in India' is a very ambitious project launched by the Prime Minister of India Narendra Modi to make India a manufacturing hub.
Pity they choose "Golang" instead of "Go" for their default Go image. It's called "Go". And they built Docker with Go.
I don't play for expected value, I play for variance.

And I'm tired of people telling me that it's irrational to play the lottery, it isn't.
You can always just edit config.fish in vim if you want to, that's what I do.
Relevant: https://www.youtube.com/watch?v=PIuMICiFqmE#t=6420

Eric Dollard discussing lightning, he also goes into the skin effect afterwards, which is also relevant to this article. Interesting stuff... this guy.
from my understanding mod_php is not affected. However, if you have any system() calls in your PHP code AND you allow user input to be used in those system calls, then /bin/bash could be executed via the system call. If you control what is running in your system call - i.e.

system("echo 'hello world'");

then I believe you are OK. But that's "security 101" and you should never be opening a system call to user input.
Mean while everyone with a Moto 360 is getting asked "Is that the Apple Watch?!?!" myself included. You should see the deflated look on their face when you tell them that the Apple watch is square.
Another boring black square. I want someone to innovate on the Moto 360 already.
This torrent of chunky rectangular smart watches are all about as sexy as the Casio calculator watches from way back when. I still think those calculator watches are a cool piece of old tech, but I don't know anyone who would wear one un-ironically.
A Simple Guide to Counterfeit Proof Credentials for Event Managers
Shellshock: what you need to do Now about the bash remote exploit vulnerability
Nacl is a good thing. But crypto is just a tool. It's not a magic wand. People have already built vulnerable systems by making bogus assumptions about what Nacl can do.
By definition it must be able to see your keystrokes. What sort of policy are you looking for? I guess you could deny them internet access on a more granular level, but otherwise, it seems like they need pretty terrifying permissions to even work.
>CentOS4 legacy system

Jesus. That's been out of support for well over 2 years. I can't imagine this is the only problem it has. I'm curious: what's keeping the organization from upgrading it?
There's no way that this bug could affect even a fraction of the number of users Heartbleed did. The number of affected machines is probably 1/10000th that of heartbleed, and heartbleed exposed hundreds of millions of users, the SSL keys of servers, etc to attack. The fact that legacy CGI scripts are the only attack vector being discussed right now is proof enough of how outdated this bug is.

Keep in mind that hackers constantly take advantage of old exploitable legacy software in servers around the world to get a shell, and nobody freaks out about it.
Can anyone explain what I should do on OSX?

I've heard that replacing /bin/bash with a newer version of bash from homebrew or even zsh will work but is that going to break anything that assumes 3.2 bash??
That's what I'm guessing too. It's not easy to come up with a patch that will definitively prevent an exploit. It's also very possible the exploit finder didn't understand the intricate details of why the exploit worked; he just knows it works.
OK, I'll bite. First: this watch was introduced before the Apple Watch. I doubt either Sony or Apple knowingly copied the other. Second: it's tricky to define "waterproof". IP68 specifies continuous immersion beyond 1 meter. If that's not enough for you, well... Keep looking. :)
"It’s a game where reason and logic are rendered obsolete, and hope and dreams are on sale."

For a second there I thought the article was about one of the below:

- Starbucks

- BMW

- A diamond ring

- iPhone
This is Sony's fourth attempt at a smart wristwatch, going back to 2010 with the LiveView. I have the first Sony SmartWatch (second in the whole line, released after the LiveView) and it is crap compared to watches that came after like the Pebble, which I also own and use currently.

The SmartWatch 2 was a huge improvement over the previous model, but it didn't impress me enough at the time to buy it so soon after the last one; I ended up getting the Pebble instead. This one though, looks like what I'm really looking for in a smart wristwatch. I'd happily trade my Pebble for one, and probably will once they start selling it in the US.

As for the waterproof rating, IP68 would be "no ingress of dust" (the "6" in the rating) and "the equipment is suitable for continuous immersion in water (immersion beyond 1m)" (the "8" in the rating). That sounds pretty much waterproof to me. Now, if you mean it's not a diver's watch, well of course it isn't, and never claimed to be. A diver will wear a diver's watch, not a device that connects to a phone she wouldn't dive with anyway.
PHP does, I just checked.
I'm finding this a depressing read.

Hooray, we're figuring out all of the tricks to push people into "thinking myopically" and buying what we want them to buy.

Here are the triggers; here's how people make mistakes in buying decisions, and how to exploit that. Here's how to frame your sell (Get them to focus on loss! Remind them of their poverty!), here's how to get them to buy more tickets instead of just one.

Lottery tickets aren't too bad; they're harmless for most people buying them, there's a fun little kick of "what if...?", but (as the article points out) as revenue for the state, they are a regressive tax; poor people pay a much larger percentage of their income into lottery schemes than people who are better off, and of course some of them pay enough to really harm themselves, going for the "Hail Mary" solution to their money woes but just bleeding themselves slowly instead.

Winning isn't actually a positive result, either -- the article doesn't get into stats on attempted suicide, etc. for lottery winners, but they're not good.

Is there anyone out there using this kind of research to actually help people? Or to let people who're just playing a fun game, play it; but still protect the people who are grabbing at a false life preserver?
I'm with this guy, if I have terminal cancer. I'll try a remedy made from dirt if it has a chance. I mean what's to lose, at that point my body becomes a free testing lab.
"Shitty" may not be the right word, since C#'s type system works fairly well for its problem domain. The point is that the type systems found in C# and Java are conservative and in many cases overly burdensome for the type-safety benefits you get.

As a result, when compared against purely dynamic languages, the advantages of static typing in Java and C# are not so clear cut (Hence why so many developers just use dynamic languages).

If your only exposure to static typing is in Java or C#, then you're really haven't seen a good type system at work.
so was I. I click the link expecting to find another click clack community.
I'm still seeing the old design: http://productpeople.club/
This web site makes no sense. Click click click click to find any relevant information. The FAQ is useless.
I occasionally get uncomfortable with this. I had an eerie experience with SwiftKey on Android a few months ago where I was sending someone my bank account details over SMS (I know, I know) so they could wire me some money, and I typed

"My bank account number is"

And the next suggested word from my keyboard was my actual bank account number. Same thing happened with my sort code. I guess I sent my details to someone a few months before and it just remembered the info.

Other than that slight "oh crap" moment though, the fact it listens to and remembers everything I write comes in super handy. Turns out I use the same few phrases a lot more than I thought I did, and swiping away at my keyboard, and having it predict my next word quickly and accurately saves me SO much time.
Remove the Close Button from a WPF Window
It has that rogue intelligence/geopolitical power play to it.
Linux is over 20 years old at this point. How many "reprehensible" rants has Linus had over these 20 years? Maybe 20-30? So ~1-2 rants per year.

Does that really justify the statement "Linus's behavior is often reprehensible"?

I've seen dozens of developers let go over "cultural fit" over the years. I've seen dozens more laid off so a few suits could make a bit more money. Developers with bills to pay and families to take care of. In my opinion, going on a rant, however mean, once or twice a year is not even comparable.
Same specs as Samsung and LG smartwatches, toy-like design, unpractical charging port, 230€, not really interesting.
I like lotteries that are basically just fundraisers. At least I know most of my money goes to a cause that I support.
All Australians are involved in politics somewhat, because it's one of the few countries where voting is compulsory.

That also means that Abbott, unfortunately, represents a majority of the population, not just the politically motivated individuals who would vote without compulsion.
Yeah I just edited my post, I goofed on the IP68 thinking it was IP67.

I had the first sony smart watch and it was amazing for its time. Then I got the pebble and loved it. Now I'm onto the Moto 360 and not looking back.
This test is for public sites. The vulnerability effects web apps too in a big way.
well, in the promos they showed briefly somebody pointing at a kid playing chess against somebody saying "kid's a genius; he's checkmated a chess master in 8 moves", which is beyond ridiculous even against a coffee player.
SCSH: http://scsh.net/
I don't understand.. nothing is happening when it completes. Does this mean it didn't find anything?
Yeah I goofed, I thought it was IP67 specs. Got them confused. Also I was just joking about the apple comparison.
Once you start thinking about immutable infrastructure and auto-scaling, service discovery becomes very important.

Let's say you have a load balancer with 4 web servers behind it, each with its own IP.

If you hit a traffic spike, you'd like your system to automatically provision another web server and add it to the load balancer with no manual intervention.

With a Service Discovery server, your load balancer could be polling the server for a list of nodes it needs to add or remove from its pool. It could also send a signal to the service discovery server that will indicate that it's dealing with a higher traffic threshold. This signal can then be captured by another Provisioning service (also polling Service Discovery) which then triggers the building of a new web server. The web server could then signal to the load balancer to add it to the pool.

Without a system like this, a person has to go in and manually update the configs on all the relevant servers. The idea behind service discovery is to prevent that.
Are you running an HTTP or SSH server that faces the public? If so you need to update or take mitigation steps ASAP. If not you can wait until apple patches.
They used Java as the static language, which is relatively cumbersome as far as statically typed languages go, and is also known for its verbosity. "Rapid prototyping" and "java" does not really mesh to begin with, or at least that's what the common wisdom tends to say.

It seems that they need another survey/study to check the OPs claim (namely do some research on productivity in languages with stronger static type systems than java).
Not only EC2 instances, but also RDS instances.

I received various maintenance email notifications for RDS reboots.
The Secret to Saving Your Marriage
I just sent Justin his new design yesterday. So, can't really blame him for not having it online yet. :)
In another thread, I saw that this was an easy check to see if your bash was affected:

env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

If you get "busted" back, then you're affected...which is what I get with Mac OS X 10.9...however, when I try it on an Ubuntu server (14.x) that hasn't been patched in awhile...I don't get the error...Er, why is that? I thought this pretty much affected every bash since 25 years ago?

(Someone else in this thread mentioned that Ubuntu uses dash...so...all modern Ubuntu servers are OK?)
Would a python web server (gunicorn, wsgi) behind nginx be vulnerable to this kind of problem?

I'm just pondering all the python library code out there which relies on calls to subprocess.Popen() to get things done. It seems like dynamic scripting languages with a tendancy to shell out to the system could be at risk of this or similar attacks.
Usually time and money.