skysight-inc/HackerNews huggingface dataset:
Nvidia Proves We Walked on the Moon–Not That It Needed To
I'm a pretty prominent Cocoa OSS guy:

I've always figured that you "just start", but that's a bit like the draw an owl image. So I'll say how I got started. I started by dealing with issues on a large project (CocoaPods). I read all documentation then started dealing with issues that were user errors rather than code. It gave me exposure to the devs in a large project, gave a sense of where common problems lay. Instead of directly working on the product I started to expand the tooling around the project, building websites / logos. Eventually it just gets to a point where writing a PR to anyone on any project is no-effort at all.

If you really want a one step start: go fix typos in other people's READMEs.
Interesting, I never thought of "hating on marketing" as a money defense system.
LogEntries + NewRelic = analytics Mecca
Also don't use bash for running any scripts. You never should anyway, in a sane environment /bin/sh should not be bash - in Debian/Ubuntu it is dash which is not vulnerable. Unfortunately the Redhat derived distros do use bash as default /bin/sh. In the BSDs it is a standards compliant posix sh too. bash is for users not scripts.
I like what Shen has to offer, but it runs on top of other languages hence there's a huge performance hit. There's nothing revolutionary about it, it's just a lisp with pattern matching, lazy evaluation, prolog system, type checking etc.

Having looked at it, it doesn't give much of an edge over say Prolog, I'm yet to see anything that it offer's that Prolog doesn't.
Great tool, perfectly fits to the node.js ecosystem, lightweight and fast.

However in case you use co-mocha[1] to test your generators, istanbul won't work properly, the generators in the reports are shown as uncovered. Therefore I made a mocha fork[2] and directly applied the changes from co-mocha to the source (instead of monkey patching); it solved the problem.

[1] https://github.com/blakeembrey/co-mocha
[2] https://github.com/tfitos/mocha
> hardly anybody uses it anymore anyway

Lots of PHP setups do.
Do you have a source for that? Some articles [0] claim "This affects Debian as well as other Linux distributions."

[0] http://www.csoonline.com/article/2687265/application-securit...
People still shell out to do stuff from scripts from all sorts of languages. Unless these sanitize the environment they would be vulnerable.
I imagine, real estate keywords are probably very expensive. Also, I have an ad blocker.

In cities like Munich, speed is very important - is your search real-time or at least near rt? If so, I'd advertise that. I need to be sure I'm not missing any offerings, and that they aren't slower to show than when going to the 'real' site.
I think it comes down to the burn rate and the shaken confidence of investors. Cuban was quoted during TWIST that he didnt want to burn through hundreds of millions of dollars just to make a few dozen. It might be a bit of a case of between business models as well. Boris Wertz did a fantastic outline of the "Two Ways to Build a 100 Million Dollar Business"
Could it not be both?
Likely meaning that the Debian packages for Bash include the vulnerability
If you are responsible for the security of any system, this is your immediate, drop-everything priority. The technical details of the exploit mean that new ways of exploiting it will be discovered soon. Precedent suggests that automated systematic attacks against every server on the Internet will be coming, on a time scale of hours.
>It is a beast of a ship, 1,141 feet long with room for more than 4,000 passengers

"I want to be crammed on a ship with 4,000 other people" said no one ever.

I wonder how these cruise ships make money between the cost of fuel, food, and expensive mishaps.
Actually, according to the rather useful sociopath/clueless/loser categorization it's the OP who is "clueless":

http://www.ribbonfarm.com/2009/10/07/the-gervais-principle-o...
Anyone could. But it takes a long time. Most people won't do it.
BoA denied my mortgage because I own equity in a venture-backed startup
Yes, the audience wants to be entertained. And they are being entertained, to the extend that the entertainment market is oversaturated and as such the value of entertainment goes down.

I feel like your second paragraph is just a reiteration of what it is like for someone who wants to produce something that is not valued by the majority of his apparent market. We do not really care too much about this in other markets and we should not do so in entertainment. If what he is doing is so incredibly great, he might try crowdfunding, patronship or another form of sponsorship - it has worked great for the artists of our history.

I think my point is, you can't demand to be paid for producing something you want to produce. It's a game of supply/demand.
Shouldn't marketers try the exact opposite approach?

In this paper about "Nigerian" mail fraud
http://research.microsoft.com/pubs/167719/whyfromnigeria.pdf

researchers argue that it's very efficient for attackers to appear fraudulent, because this helps select the most gullible victims (true positives) while weeding out "false positives": people who respond at first, but are not scammed in the end.

From the abstract:

> "Far-fetched tales of West African riches strike most as comical. Our analysis suggests that is an advantage to the attacker, not a disadvantage. Since his attack has a low density of victims the Nigerian scammer has an over-riding need to reduce false positives. By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor."

Shouldn't marketers do the same? Isn't it more efficient to eliminate non-targets as early as possible, instead of dragging into the process people who will ultimately relent. If so, it would seem preferable to send junk mail that is very explicitly junky.
http://www.csoonline.com/article/2687265/application-securit...

Another attack surface is OpenSSH through the use of AcceptEnv variables. As well through TERM and SSH_ORIGINAL_COMMAND. An environmental variable with an arbitrary name can carry a nefarious function which can enable network exploitation.
When will BlueMix have Watson access?
By the time AcceptEnv has any effect, the user is already logged in and can run whatever they want anyway. If you're allowing untrusted users to authenticate to ssh, then, yeah, sure, but you'd be in a niche (and know it).
The reason is bigger banks basically don't make any money off low balance accounts.

Interest spread earnings are minimal and the Durbin Amendment (2010) basically killed debit card interchange as a revenue stream for banks with over $10b on the balance sheet. Smaller banks and credit unions can still make a good amount of money off uncapped debit card interchange, so they do offer free accounts.
Great design and software. Any plans to open-source the code?
does anyone know if bower, grunt, etc. are working?
Multiple Data Center MongoDB Replication (Proof of Concept)
Very rough first pass transcription, I'm ironing out the typos: http://www.bnjs.co/2014/09/25/transcript-lecture-1-how-to-st...
GP here. You're right about the relative unimportance of the side point.

However, the main point is not a prescriptive argument that the product _should_ be free, but rather a descriptive argument that the product _is_ free. I claim the market doesn't care about the cost of production, but rather only about supply and demand, when setting prices.
Doing business with Bank of America is it's own punishment.
The Q&A is not particularly interesting...are there other api's we can experiment with? Also, is there any precedent for getting clojure up on bluemix?
You're right and my comment was unclear. I'm just saying that the impact on Debian will be less than on distros using /bin/bash for /bin/sh. Of course, even a lessened impact can still be really bad!
Debian7 doesn't look to be vulnerable by default (if the code snippet can be trusted to work):

[arch/testbed ~] uname -a
Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux
[arch/testbed ~] env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
Irony is that their website is powered by PHP rather than node.
Very rough first transcript, I'm ironing out the typos and formatting: http://www.bnjs.co/2014/09/25/transcript-lecture-1-how-to-st...
Scientists make quantum leap, teleport data from light to matter
SX command line Bitcoin to empower the sysadmin
With all due respect did you read my post at all? I literally cover this topic on the first line, second sentence.

TL;DR: That's what basic current accounts are for.
Unless you're using CGI, your system environment will not be contaminated. CGI is vulnerable because it relies on passing untrusted data in environment variables. No other gateway interface I'm familiar with does.
AngularJS shopping cart demo with Stripe payments integration
Is rhdf5 the best library? I understand there is ncdf4 and h5r, and rgdal. I understood that R support for HDF5 was limited so I have not used R much for this purpose.
I think it really depends what you're trying to do. There's definitely a class of problems where the impact of a runtime type error would be low. But there are plenty of other cases where you want to constrain what you or your users can do at compile time.
Lots? Really?

PHP was one of the first to have a dedicated apache module. Perl is much more likely to be CGI.
Not solely on that, but of course I would. I actively avoid doing business with people and companies that are dishonest or rude. Tone correlates with consciousness and general human decency.
Now it would be great to integrate this data into OSM to get navigation for bikes that takes slopes into account: this is the shortest route, this is the fastest considering slope, this is the sportiest…
You appear to already have the updated package installed.
Wow, good to know! I'm currently looking for a flat in Berlin and will definitely use the site. Let's see if I also write some automation around it as the OP apparently did :)

Question: how does nestoria make money? Do you get some cut from immowelt etc. in case you end up renting/buying?
Do you mean PureScript?
Major impact of this is elevating privileges, both Debian and Ubuntu will be impacted just like any other system.

I don't think anybody is worried about software on the system that is using /bin/bash .vs /bin/sh.
We had the same problem. We actually wanted to use Heroku just for pre-production as it was the easiest to deploy / manage, but their TCP socket implementation is such a joke.

We would up just using AWS, and sunk a few days into dev / sys ops.

I would happily pay for a solution to this problem
Good point. I was taking the parent's post literally, where jquery.com was used.
Apparently, no. When it does, it should appear at http://lists.centos.org/pipermail/centos-announce/2014-Septe... (if you admin CentOS servers, it can be a good idea to subscribe to that list).
This is what the iPhone launch looks like, now:

https://www.youtube.com/watch?v=Ef_BznBwktw
You might want to check out OpenHatch: https://openhatch.org

"OpenHatch is a non-profit dedicated to matching prospective free software contributors with communities, tools, and education."
I've noticed something similar here in NYC as I've been apartment hunting. There are postings that will ask for a link to your facebook/instagram/twitter before they'll even show you the property. I'm not saying that it's always motivated by discriminatory behavior, but if it looks like a duck and sounds like a duck...
They would be too slow to be useful at any kind of real load. Are you sure you're not thinking of FastCGI? That doesn't pass data through the environment, it goes over a socket.
The typos advice is really, really good.

Here's such a PR: https://github.com/intridea/grape/pull/741
As a former heavier chap I tend to sit down on things gently just in case they don't take my weight. I would say the full weight isn't down until the phone is nicely cushioned by cheek flesh.

Maybe they're dropping down like rocks onto the phone resulting in sudden stresses rather than a (relatively) more gradual stress

iPhone 4s and 5s, frequently in back pocket with nothing more small scrapes/scratches on the edges from being occasionally butter-fingered
Man Jailed for Posting Lyrics to Facebook Says 'It's Pretty Worrisome'
Completely agree.

But they took this decision because they saw that the superior quality of their product(which having owned older Thinkpads I can say it's true) wasn't profitable enough when competing with lower cost "good enough" alternatives.
I would have just deleted the code and moved on with my life. Far simpler.
It's more than it being their job to part you from your money. Because that's a salesperson's job too, and yet they don't receive the same animosity.

The difference is small but crucial. The salesperson's job is - for the most part - to sell to you personally. And the salesperson typically has a personal stake in it - so this is a transaction between two people.

On the other hand, it's the marketer's job to manipulate[1] you[2] into buying an idea and accepting it as your own. Nothing is off-limits - any psychological tactic that a marketer can employ is considered an acceptable means to the end. Astroturfing, deceptive advertising, "submarine" stories -- these are just the tip of the iceburg, and all of them are perfectly OK in the mind of the marketers under discussion.

Ultimately, it comes down to ethics - marketers seem to me to be like behavioral psychologists with no ethical guidelines that prevent them (or even discourage them) from playing out their experiments on people. And the experiments are all geared towards finding the most effective ways to exploit the way our minds work, to the benefit of the owner of the product or idea being marketed. [3]

I am aware that there are some who do have ethics, and apply them scrupulously. But in the marketing that surrounds us every day, I see no indication that they have any significant voice.

For those not familiar with Heinlein, some of the ideas raised in "If This Goes On..." are disturbingly relevant.

---

1. And this is the general "you", not typically one specific individual.

2. The salesperson, too, will naturally try to manipulate you - but a) it's typically an interaction between you and the salesperson. b) you can also use the same or similar tactics on the salesperson. c) foreknowledge of the tactics used by a salesperson are often enough to protect against their effectiveness - not so with marketing.
I can completely understand wanting to be rid of something like this, if only for the author's mental health.
Gnod News now searches Hacker News, Reddit and Twitter
You bring up a good point, but it seems as if Watson was designed with this in mind. If you notice in the JSON response, it lists this query as a factoid class.

It may handle different queries with different attributes differently, such as focusing on certain portions of its corpus or changing what aspects of its search results are more heavily weighed.

A query identified as a factoid might be researched and judged very differently than something a bit more nebulous, such as a comparison, or something with more specificity like the examples you listed.

Admittedly, I am basing quite a bit off of one example response given in their documentation, but it is an intriguing clue as to how Watson will handle that aspect of understanding which info to discern.
If you're on Arch, you might want to think about using dash as your /usr/bin/sh after updating, see [0].

[0] https://wiki.archlinux.org/index.php/Dash
Might have to give this one a spin. Hopefully it's faster than zepto.
It's unlikely that mortgage companies are deluged with bad leads because people thought the handwriting was legit. Weeding out false positives is only an issue if you have a false positive problem.
Some more information was just posted to oss-sec:

http://seclists.org/oss-sec/2014/q3/650
The "it would be illegal to pay you" is easily circumvented: start a company of your own (slightly more expensive than a domain name, but not much), have her pay the company, do not pay yourself from the company until you have completed your course.
What are these "channels" of which you speak? I choose specific episodes of specific shows that I want to watch. There are no "channels," no curated collections that just serially stream various episodes of varied shows.

Please explain how a user of Netflix chooses a "channel" and receives the streaming content of said channel without the need to continue to select content to watch.
Nice work with the 'Oilslick' elevation ramp. That provides for some very neat spatial pattern recognition/identification. I don't think I've seen anything quite like that before.
HN has showed me that this sort of thing is more common than I expected. Any and all experiences shared help people know what to look for.
I have the opposite issue, I'm constantly sending out personal emails asking to help people with getting setup (it's for Heroku SSL stuff and people often misconfigure things) and can't get a response from them.
I don't know. It seems to me that a good entrepreneur would see the proverbial "writing on the wall" here. If I were a proprietor of a check cashing establishment... I would think that now might be a good time to cash out... before the writing gets any more clear.

Alternatively, it might be good to seek out a service that you can offer that would be a complement to what you expect the Walmart service to evolve into. I don't know what that complement would look like... but I do sense that it is likely pretty profitable.

In any case, the WORST thing they could do is sit still and assume business as usual. I mean, there is clearly a train coming...

it's time to get out of the way.
I hope someone loves me
Ask HN: What do you want to be notified about?
Hi.

I'm developing some sort of "any kind of alerts" app. You can think of it like it is ifttt but just with the IFT part: something happens then get notified.

I'd love to know what kind of alerts would you be more interested. Can you help me? I will try to add your notification ideas to the app.

Thx in advance!

ps. I have already included classic alerts: weather, sports, tv shows, mentions, concerts, website-down… but for sure there is a lot of geeky stuff I'm missing.
...if you've installed bash from ports. The base system doesn't appear to be affected.
Am I wrong in thinking that seems a bit worse than Heartbleed?
There are thousands of buy side firms all over the world stocked with stone cold geniuses who do this all day every day after having trained in maths and science all their lives.

The fact that you saw some people you perceived to be clowns once, does not demonstrate the market is anyone's for the taking.
Anyone with an interest in the Holmdel facility will likely enjoy this photo album of the now-empty site.

http://www.newenglandruins.com/bell-labs

It was an impressive building at the time. Having worked there for years, it is rather unsettling to see it featured as an abandoned urban site.
Well I'm sure that age has something to do with it, but a 1% response rate is so ridiculously low that you can't just explain that away with age. I'm sure that under 25 german males are not getting responses 1% of the time.
Seems like the kind of note-taking app I was looking for - something that does not constrain me to the one-dimensionality of text, and isn't just a poor work-around that fact as outlines are. I particularly like that one can visualize the nodes in a canvas and then switch to the columns view. This is really good.

Now the dealbreaker question: can I export my data without losing relationship metadata?
Text summarization in Python with NLTK
Last dist-upgrade was about a week ago, all indications point towards the bash released back in Jan 2013. It's fixed in 4.2+dfsg-0.1+deb7u1 and I'm running 4.2+dfsg-0.1
Im getting closer to a "complete" social search. Any wishes for other communities to be included?
>>I was never able to try USAA despite hearing great things because no one I know was in the military.

You don't need to know anyone in the military to open a checking account with USAA.
Arris Cable Modem Backdoor
You may take issue with it, but it's a fact that a large number of very profitable companies have avoided hundreds of billions of dollars in taxes over recent years. Trying to shame an individual who wants to save a few hundred thousand for retirement is not only stupid, but inefficient.

Contrary to popular belief, not all tax evasion is created equal. A few hundred thousand by an individual is literally a rounding error to tax revenue. Take your tax crusade to Apple, Google, Amazon, Microsoft and the rest of the billion dollar club who are stealing your precious taxes by the hundreds of billions.
#19 and #20 seems the most common issues I've had to deal with in development.

19. Give estimates without consulting the people that are actually doing the work. When they disagree with the deadline, shrug your shoulders and explain that it can’t be changed and people are expecting it to be completed on schedule. Repeat every time.

20. Break the above cycle when everyone is about to quit. Get estimates down to the hour for every single feature. Assume no slippage. Add features but do not adjust schedule.
Using ServiceWorker (a proxy & caching API) in Chrome Canary today
Synergy (mouse and keyboard sharing over a network) goes from free to paid
A basic flaw in the complaint is that that there are, in fact, a number of situations in which an equity holder in C-corp might be on the hook for liabilities incurred by the corporation. Its somewhat worrying that someone who has been involved in multiple startups is unaware of this (and that they are unaware of it increases the likelihood that they might engage in conduct which would realize this risk.)

BofA may be overweighing the associated risk when denying the mortgage, but it is certainly non-zero.
I have a feeling this is blown out of proportion.
Who's running bash setuid exactly? Right.
Who's running shell CGIs today? Right.

So.. who has an example of common scripts that are executed remotely in most servers while accepting remote environment? Til then, the panic seems unjustified...
Well, that's very odd because that command reports vulnerable on an unpatched Debian system, but fails with exactly that error message on a patched system.
Taver's comment is particularly illustrative.

His invocation of Gödel's Incompleteness is particularly interesting. Gödel suggests that any fixed formal system must be true for all compatible models and thus, supposing we built the formal system to capture properties of some model we care about, is going to be overly restrictive to capture what we really want.

Fortunately, typed programming languages (taken as the formal proof systems they are) are extensible. Indeed, that's half of what programming is: adding new types (formally or in documentation alone) to help us capture the reasoning for why our program should work.

So, programmers need not fear Gödel so much. Instead, if you embrace the type system then it will help to calculate (up to the current limitations of the logic you've designed and your willingness to wait) the consequences of the logic you've currently designed. And, should the type checker help you to determine that your current system does not capture the behavior you're interested in...

Well, you just introduce a new type and your formal system grows.