skysight-inc/HackerNews huggingface dataset:
There's a lot more than just maternity (or paternity) leave holding back Japanese women: the cultural expectation remain that women are there to pour cups of tea, marry eligible salarymen, and drop out and rear their kids while said salarymen work insane hours.

My wife (MBA, ex-Microsoftie, etc; not your average "office lady") briefly worked for a super-old-school Japanese trading company in Australia. Her boss wanted her to go on a business trip to suppliers in Japan with a client; HQ held out as long as they could (because what would the suppliers think if they sent a woman?), but eventually gave in because there was nobody else suitable. So they called up all the employees and proudly announced: We're sending a woman to Japan, for the first time ever! Everybody, a round of applause at how progressive we are!

So when was this? In the 1970s, perhaps? Nope: 2011.
I don't think a lot of people are really understanding how much of a larger issue this would be for us if AWS didn't patch a major security issue before it was made public.

The company has treated me very well over the years, from AWS to retail. My stuff arrives on time, if it doesn't I get reimbursed, most of the time with an extra few bucks for my trouble. The AWS platform is more mature and feature rich than anyone else and keeps getting better.

These reboots are going to save a lot of peoples butts, they wouldn't give a 48 hour notice if they had a better option.

That being said, I'm very curious to see what info is released next week.
> ...I'm happy to answer any questions people might have.

would the same principles that apply for chaining, apply for linear probing and cuckoo hashing as well ? thanks !
Thank you. Cheers !!!
I don't think it is right to jump to conclusions based on those images. I have been to one of the clean rooms, where the satellite ASTROSAT was being created. We were in the outer most room. And for that too we had to wear these bunny suits covering all of our body, hair and skin. The actual satellite was in inner levels, where standards were higher and we were not allowed to go. We were not allowed to take any instrument inside of that room. So there were no photos. May be that is the reason for this perception, it is just bad PR. Based on my experience I do find that ISRO takes these standards very seriously.
Tried this patch on my system and was unable to get any of the latest PoC's to trigger the bug.
Install Android L on Your Mac Pc
Yeah, the annoying thing is it sounds like there isn't a full patch yet and new vulnerabilities are being discovered. Just trying to understand if I should shut the machine down until everything is sorted out.
I was downvoted very badly yesterday for just saying ISRO engineers were paid less. Actually comparatively even compared to many Indian IT professionals salaries of these folks is actually low.

Most people don't realize how low it is until you start comparing yourself with people of your same age some 10-15 years in to your career who are working with other software companies.

Any decent IIT grad joining something like Amazon or Google gets ~15L-18L per annum these days, If you are from other colleges you can still get ~10L per annum. And this is for writing some HTML or some application around a data base. Heck even people working at IT services industry get paid around ~4-5 L per annum, and plus they can always move on to some nice after a few years, most do and within 8-10 years of their careers can reach atleast ~15L per annum. Plus some people also get foreign travel opportunities. If you have a good saving and investments discipline you can buy youself a home, a car and may be a nice wedding and a good deal of gold within 12 years of your career.

To know how far those people who started their careers in the IT industry in 90's are, many are settled in the US. Many own 2-3 homes in a city like Bangalore drawing insane rent income, Many own stock options worth money you have never heard of. You can talk of Mars mission, pride and all that. But when you see your college mate driving a Honda Accord and eating a 3000 rupee dinner with his family after spending another 2000 on a movie on a Sunday evening. You begin to realize money has its own importance in life.

Working in Government firms went out of fashion as early as mid 90's.
The Brain Nebula – An online social experiment
Feelings of India's Mangalyan Reaching the Mars Orbit
The word "dynamic" in the grandparent post refers to dynamically relocatable object files, i.e. all the memory references in the binary are written as relative offsets so that the binary doesn't assume anything about what address it will have within the process when it gets loaded. Concretely, this means the difference between "JMP 0xDEADBEEF" versus "JMP (special_register)+0xBEEF" so that the .so or .dll file doesn't assume it'll get loaded at 0xDEAD0000.

For a less confusing explanation, see https://en.wikipedia.org/wiki/Position-independent_code

(Also: no, it's not really implemented by using one offset register for each .so file in the process.)
I am not normally one to put on a tin foil hat, but all the events of the last week seem so orchestrated that it is hard not to be cynical. Security agencies facing the sunsetting of powers granted after 9/11 "suddenly" discover all these threats the very same week that laws are due to be voted on. There seems to be almost no evidence against individuals raided, only one arrest and that on the basis of some intercepted conversations where the idea of attacking someone was mentioned (and all this, we are taking on faith from security agencies themselves which have a massive vested interest in getting new laws passed). Even if you interpret the threat literally, one individual was proposing to attack one Australian - for this we need to discard our basic freedoms protected for hundreds years (deriving from the magna carta no less)?

I think there ought to be a moratorium on passing any new laws until there is not any current terrorism scare, it is exactly not the time to be making rash judgements about what laws we need.
you don't own your apartment, but renter laws generally forbid recording and spot inspections by landlords...
No doubt. Still using a 7 year old Core 2 <something> Thinkpad and it still works great. Resolution and speed are not a problem. Replaced the hard drive for a solid state, the fan at some point but otherwise I just don't see a good reason to spend another $1k or $2k on a new laptop.
The ecosystem of linux software that shells out to bash is ridiculous, and coercing an env var is a very light requirement.

Virtually any software that takes input from the internet can be a target, and enumerating the combination of versions and configurations is futile. We all need a working bash patch.

Not running a webserver protects against GET spray-n-pray, but you shouldn't feel safe.
Let's put it this way, the question could be turned around, would you have no public property? Would it be satisfactory to have no public parks, monuments, museums, even streets, or other amenities?

Of course not. Cities, states, regions need to preserve public spaces for the public good. The beach is a rare and precious natural asset that can't be duplicated, so logically ought to be open to the public.

Once you've seen the Pacific Ocean from most anywhere in the Upper Left Coast you'll know it's beautiful and inspiring. Furthermore, it's an important recreational resource and since ancient times a source of food for many people and remains so to this day.

Despite having many differing political points of view in our state, AFAIK no one has ever suggested closing off beach access to the public. If such ideas were broached at the state level, I expect it would set off quite a loud and negative reaction.
Occupational Hazards of Working on Wall Street by Michael Lewis
This is a bit of cultural inertia that I don't understand. An accident of history could have easily made the debate over private ownership of mountaintops. After all, why should we let rich people restrict others from experiencing the beautiful views at the tops of mountains? Or the sense of achievement one gets from having hiked to the top?

Instead of being so absolutist, why not impose high property taxes on such lands? The revenue collected can be used for things that more than offset the harm caused by private ownership. And it wouldn't be hard to set taxes at a level such that only a fraction of mountaintops and beaches would be privately owned.
First U.S. Stealth Jet Attack on Syria Cost More Than Indian Mission to Mars
*Kilowatt/m^2
Indeed, it appears as if you are correct [1]. This issue is with Windows Server 2012 R2 network drivers as is from Sep. 17, 2014. If you're interested in the script you can download it from that page.

[1] http://aws.amazon.com/windows/2012r2-network-drivers/
Honest question: does this mean this vulnerability has been in bash for essentially its entire history and someone only discovered it now?

Seems quite likely that someone would have discovered it sooner, especially since it's so simple to exploit.
Amazon may be working on connected home devices
What are the best OS-specific alternatives to bash, which could be linked to /bin/sh until bash fixes are stable?
How does "shill" relate to security in any kind of fashion? Am I missing something?
Do you have any actual sources of their average instance uptime over the year?

I see an SLA of 99.95%(~4hrs/year) on the site but cloudharmony.com/status has AWS at the top. Googling average ec2 uptime has people posting instances running for years with nothing.
Welp, I'm about to take a hammer to all of my data centers and get busy, then move deep into the woods. Good luck to everybody else who decides to leave their equipment functioning; it was nice knowing you.
So now it's ThinkPad or MacBook Pro. What is it like to run Linux on MacBook Pros these days? Does Ubuntu and other popular distributions install without much fiddling? Does any of the hardware not work with Linux?
May you never know a lawyer or their billing. What about political costs?
I never really considered the importance of that. It always seemed like some weird crotchety UNIX thing to default to /bin/sh, and usually my first 30 minutes on a FreeBSD box are portsnapping, cd /usr/ports/shells/bash, and a make install clean.

Now I get it
At the risk of sounding indelicate, why did he buy the property when the real possibility of maintaining public access was there? I can understand he wanted some peace and solitude, but if that's the case, there are options available to him as a billionaire that aren't available to the vast majority of the populace.

Access was in the law books before his purchase and claiming the 1848 Treaty of Guadalupe Hidalgo as being present before the 1972 Coastal Zone law is ridiculous in the extreme. There were many other things legal in 1848 that aren't today for very good reasons.

"The judge could have fined Khosla $15,000 a day for every day the gates were shut,
but she waived all fines."

Why?
The Metasploit folks released their exploit not too long ago. I haven't had any hits monitoring my Apache logs all day until just recently. Good luck/god bless to everybody.
And my servers? Is there anything I can do without taking them offline?
yeah, we had a few minutes downtime but nothing too bad; definitely rather have some few time off than a security threat.
Land is a limited resource in general, but special land features are both more desirable and important to people than others, and more scarce, and have a long history of special treatment, and so we tend to place special emphasis on securing access to certain types of land.

There's also no need to do away with private property to guarantee access. Consider the principle of Freedom to Roam [1], which is today most protected in Scandinavia, but used to be more widely recognized (and have in fact in recent years gotten more recognition, with the expansion of legal rights in the UK)

Basically, when I grew up in Norway, everyone expected that we were free to walk in any forest, access any beach, and in general have unfettered access to nature, irrespective of property rights to those areas. This includes protections to prevent property owners from blocking access. Trying to limit such access is pretty much seen as morally similar to theft.

The modern justification is that any restriction of access is a substantial limitation of the freedom of the public, and that if you wish to maximize freedom, you must limit the ability of property owners and find a balance that protects their ability to secure their home and business and protect their privacy but without taking away public freedoms that predates even our written laws. (In Sweden, this right is even part of the constitution)

[1] http://en.wikipedia.org/wiki/Freedom_to_roam
The Science Behind Why Jeff Bezos’s Two-Pizza Team Rule Works
I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines

How about "I don't run bash"? There are other perfectly good shells, you know...
On FreeBSD, /bin/sh is a good alternative to bash.
It's not an appeal to authority. "Because Justinian said so, and he's emperor so he should know." is an appeal to an authority.

But here, Justinian's argument is given. Seas and rivers are part of the commonwealth, so nobody should be denied access.
I don't think the issue is related to HVM. I have instances scheduled for system reboot that are not HVM.
I have a macbookpro which is my developer workstation. It is in a default configuration, it is on 12 hours a day, always behind a NAT. What do I need to do to protect myself?
He did answer the question: This has a very long historical precedent.

That we continue to accept some historical precedents as good, but have discarded others is not at all odd, and does not invalidate the historical importance placed on access to waterways just because the same people also had lots of ideas we consider idiotic today.
I'd be interested in learning more about this.
Riesgos en niños por la utilización del teléfono móvil
Ask HN: Project based interviews in SF?
Are there companies in SF that do project based interviews? I am currently looking for a job in the bay area (from the East Coast), and I am finding it extremely tough/nerve wracking to do these live coding sessions that every SF based company seems to do. As I am still currently working, trying to line up these phone sessions during my days off are tough, but I really do not want to go on-site and do these white board tests as the only technical test of my ability. It seems like I have to pass them to get any kind of offer, and I feel like it would be beneficial (to both parties) if they can judge me of my abilities before they pay me to fly over there.

I just find it frustrating as I always hear about the huge demand of developers in the bay area, and I believe I have a great resume and work experience (at least good enough to get a response to companies I like) to at least get some type of position, but trying to schedule all these interviews and the added pressure of "performing" in front of someone that can make or break my plans is just not a very pleasant experience. That's why I'm looking for other ways to show off my technical abilities, and project based interviews seems to be ideal. I can work on them nights/weekends and overall, it is less time consuming (vs studying/planning/flying). Plus if a company rejects me, I feel like they at least judged me by my code rather than some interview question that I didn't get because of being too tired/stressed/etc.
Surely it's inevitable that everything will be surveiled. The quicker we realise this and "encrypt all the things" the better.

What's the point in fighting legislation when you can solve the problem with technology? If the technology doesn't exist now then this stupid legislation should spur it on.
Setting an environment variable is often pretty easy, but the Host: header is the wrong way to go. The webserver will usually ignore a bad Host: header. User-agent: is much more availing.
I am the same. I can ignore it until a certain level, then I just have to stop being productive and ride it out.

The trick is to not worry about the effect stopping to ride it out has on your life. Worrying about not working/playing/socializing because it might annoy a boss/client/girlfriend/family/friend or because it will mean less money/friends/etc.

Edit, and hang in there friend. I don't know about you but for me its unlikely to ever get better. I am not an optimist, but there is still a lot of cool shit in this world to enjoy. We are lucky to live in the age we do.
XSA-108 perhaps? http://xenbits.xen.org/xsa/

AWS is certainly large enough to have access to an embargoed update.
From just a functionality standpoint, how is even the patched version supposed to work? It seems to undefine the variable:

% E='() { echo hi; }; echo cry' bash -c 'echo "-$E-"'
bash: warning: E: ignoring function definition attempt
bash: error importing function definition for `E'
--

Since everyone's favorite example seems to be CGI scripts, doesn't this result in the script having no variable, as opposed to just a text one? Suddenly the script can break because an expected variable is no longer present simply because the input had a certain odd looking form?

In fact, if I wanted my variable to be a function, why wouldn't I just explicitly eval it? What's the use case at all for this functionality?
Not only do the residents of Malibu do an amazing job of keeping the general public off their public-access beaches, they also seem to have a knack for crafting ordinances and environmental regulations that keep outsiders from moving in.

In 2000, Malibu had a population of 12,575. By 2010, the population had grown by a mere 0.55% to 12,645. Compare that to the entire state of California, which during the same period grew over 10% and added 3.5 million residents.
update bash (https://apple.stackexchange.com/questions/146849/how-do-i-re...)
or switch to a different system default shell until bash is updated.
No, CGI is just the most obvious use of user-controlled environment variables. Other systems may also set environment variables to user-controlled strings for whatever reason. If such a system ever invokes bash, even indirectly or implicitly, with user-controlled environment variables set, that system is vulnerable.

Example non-CGI vulnerable systems from RedHat: CUPS, dhclient.
> not try to compete with them

I seriously doubt this. Sure, it wouldn't be seen as a threat, but it certainly would be seen as a clear sign of America's decay in technological leadership and capabilities.

> oh no we need to beat them to the moon!

Everything I've seen documented from that era actually points to this being exactly the attitude. Sending satellites into orbit and launching ballistic missiles with nuclear warheads involves a different set of skills then sending humans into space. Sure you need to launch rockets in all cases, but life support, pushing the extra payload (into orbit, and then the moon), developing a whole set of extra skills (docking, space walking, etc.) It's just way more complicated and expensive to send people into space and there was no military advantage for either country to do it. Both countries wanted to beat each other in a game of technological machismo, just plain old competition at work.
I don't need those “perfectly valid” email addresses. Person who create such addresses potentially dangerous.
>forbid recording

True. But as for the inspections... In Canada my landlord only need give me 24 hours notice before they enter my apartment whether I agree to it or not. It's not even necessary that I receive and confirm their desire to enter. Simply a note on or under the door 24 hours prior is enough.

Even worse... all a landlord must do to enter my apartment without any notice given at any time of day is deem their entrance an emergency.

If I owned my apartment and all payments had been made, this could never happen.

http://www.ltb.gov.on.ca/en/law/STDPROD_078964.html
Plug: While we don't support alerts of security incidents, you can use https://commando.io to easily execute yum -y update bash or apt-get upgrade -y bash on groups of servers. We also integrate with DigitalOcean, AWS, and Rackspace.

See the following tweet: https://twitter.com/alexandermensa/status/514811145887027201
I'm not aware of Xen being particularly susceptible to security vulnerabilities. Any software you have on your box could end up being compromised. I'm not sure why it's less urgent if you have your own hardware. And of course the other downside is that while you set maintenance windows, you also have to do all the maintenance. Not that owning your own hardware isn't something worth consider, just not sure that's the most compelling argument.
iOS Engineer? Join Us and Fight the Telco Monopolies
Join us in building a new kind of phone company and fight against the Telco monopolies.

If you're interested, please drop us a line: jobs [at] sendhub [dot] com

About SendHub: We're building tools to make it fast and easy for businesses to communicate with their customers and employees.

Founded to help educators in under resourced communities, we’re taking on the Telecom giants. Hate your phone carrier? Us too. Telecommunications is a duopoly dominated industry, which has systematically suppressed competition over its 150 year history, in order to keep prices unfairly high. We’re going to change this, starting with business phone service. We have a ~$1M annual run rate and have raised ~$8M.

We’re looking for a talented engineer with a strong sense of ownership to lead our iOS efforts. We want you to take our iOS apps to the next level; building communication features that are immersive, reliable, and performant.

The Role: You’ll be in charge of building out our next generation voice application on iOS. Responsibilities include building features, fixing bugs, and collaborating with our technically skilled design team to deliver the best possible end-user experience. You’ll iterate on the application in market with small, but frequent, releases.

Skills: At least 2 years of Objective-C - building apps for the iOS or Mac OS X platforms, SQL (SQLite), Git, and a thorough knowledge of design patterns

Nice to have: Unit Testing with OCUnit, Inversion of Control (Injection) frameworks.

Our Philosophy: We believe in taking care of our customers and each other, so together we can build wonderful products. We work hard delivering the best to our customers and we wouldn't want it any other way. We're hungry and you need to be too.

We're based in Menlo Park, CA, and while we're flexible on working remotely, you'll need to be around the office and eligible to work in the United States.

Benefits: Health, Dental, Free meals and untracked vacation
I showed by examples of your double standards that you are a lying hate propagandist, which have no problem even with teaching children racial hatred.

If you could have shown that was wrong, you would have. Instead you just classify me...
Test your local machine:

export evil='() { :;}; echo vulnerable'; bash -c echo;

Vulnerable computers will print 'vulnerable'.

Test a CGI:

curl -i -X HEAD "http://website" -A '() { :;}; echo "Warning: Server Vulnerable"'

Vulnerable scripts will emit a "Warning" header. If you get a 405 error, try it with a GET request.

I don't know the PoC fo new version which wiggles around the patch.

I've tried the PoC on ksh, csh, and dash; if they're effected, its more nuanced. Its advisable to rename bash, and replace it with a symlink to dash; it shouldn't break any scripts, and even if it does its better than getting owned.

mv /bin/bash /bin/_bash

chmod ugo-x /bin/_bash

ln -s /bin/dash /bin/bash
One of my more recent contributions to Wikipedia was a 'Mass Surveillance in Australia' page: https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia
That being said, I do wish the practice of "neither admit or deny wrongdoing" wasn't standard in class action settlements etc. eg. the employee poaching scandal
Poole – The Jekyll Butler
In the past 3-6 months?
Day 97 – Don't Humiliate your developers