skysight-inc/HackerNews huggingface dataset:
In Argentina, in el Valle de la Luna, we have a place with a lot of big natural stone spheres. They are bigger than the sphere in the picture, so perhaps it has a different geological origin. http://commons.wikimedia.org/wiki/File:Valle_de_ichigualasto...

More info about natural stone spheres: http://en.wikipedia.org/wiki/Stone_ball#Natural

Some pages with photos of similar places:

http://101lugaresincreibles.com/2010/10/cinco-sitios-con-roc...

http://www.cesarlizano.name/sibowak/esferas_de_piedra_costa_...
Why would you want that? You can programmatically defibe your interface with Swift/objective-C. JavaScript feels like a step backwards to me.
As a reminder, Yahoo acquired Qwiki for $50M just one year ago...
Think of it this way.

Say that a car manufacturer builds a car for city driving and doesn't warrant or recommend it's use for off roading. However it just so happens that the car is tough enough that it makes a good offroader anyway and soon people start to buy the car for the express purpose of offroading even though the manufacturer does not recommend this use.

Some time later it becomes apparent that there is a weakness in the braking system that manifests itself after extensive offroad use but not with regular road use, and this becomes the cause of many accidents. The manufacturer then does a recall and refits the cars with an improved braking system more suitable for offroading even though they never intended (and still do not) for people to use it offroad they are just forced to accept this use case.
The data comes from project honeypot - the IP you are using has been flagged for abuse in the past.
They are trying to solve this by treating Tor exit nodes / shared IPs differently:
https://news.ycombinator.com/item?id=8297192
The time would be better spent to create a pull request instead of a blog post without any added value.
It's actually quite common for people in academia to get a large raise if they bring in big grants in competitive areas, at least in the U.S. (in Europe it varies a lot by country).

One mechanism is that you can pay yourself summer salary: official university salaries in the U.S. are 9-month salaries, and if you have a big grant, you can give yourself effectively a 33% bonus by becoming a full-time employee on the grant during the summer. (Many grants not only allow this, but require it.)

The other mechanism is the same as in industry: get a raise by getting outside offers. A professor with a big new grant in a hot area, but a low-ish salary, is an attractive target for other universities to poach. The person can then either let themselves be poached, or present the offer to their university and ask for a retention counter-offer. Either way, a raise around ~$20-40k/yr is common in that case, although there is a bit of a soft cap on salaries, so raises are easier from lower starting points. A raise from $90k to $120k is easy-ish to negotiate, and a raise from $120k to $140-150k is fairly common for people with a high profile, but one pushing you much above $150k is difficult (and only a handful of superstars at top universities can get offers over $200k).

If you do really need more than that, though, tenured professor in a science/engineering area is also a reasonably good platform to develop additional income streams (consulting, speaking gigs, etc.), if that's your thing, since the employment contracts are typically much more liberal on allowing that than is the norm in industry. Though imo that's not really the best use of the platform.
AFAIK it's mostly choice, he spends a lot of his time travelling and doesn't have a family.
> Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environment variables first.

CGI was standardised in 1997 to use environment variables to pass information into the CGI program. I'm sure software existed before that that does the same - procmail, perhaps?

No software that's been touched in the past two decades should assume that the environment variable is safe. Especially not a shell, which gets used for all sorts of network-processing-related things.
GNU code in general is hardly beautiful and has plenty of anachronisms. I'm not sure why the author has never bothered to look at the source code of his underlying base system until now.
zealotry? It's one comment in an article dealing almost entirely with other issues.

Github has become the de-facto place to put code that you want others to work with, and it is a platform built to surface such projects and make them accessible in a consistent way.

It's not the only such tool, but it is really familiar to a lot of people, and that makes collaboration slightly easier for those who are familiar with it.
Proprietary software gets compromised all the time. In serious ways. A simple example is the sheer number of bank websites which get taken down, and then we all yell at the guy who discovered it to absolutely not disclose it for fear of prosecution.

The point is, when FOSS software has a bug, there's no small set of developers who are responsible. It's, in some small way, collectively all our faults. Like in the case of Bash - apparently for 20 years, we never actually checked if environment variables were executable.
If someone want to make a modern new shell that has no obsolete concept in them, they should take this as an opportunity to do so.

With no backward compatibility to think of, I can see several nice goals to have. It should use a modern language like python, bridging the unnecessary gap between scripting languages and shell. It should remove environment variables in favor of IPC like kdbus.

And while at it, removing the concept of tty would remove a huge obsolete concept from an bypass age.
What's up with the number 163?
Among some valid criticism, the author complains a lot about trivial things. He also thinks that assignment inside the comparison part of a for loop is 'weird'.

Sure, it could and perhaps even should be avoided in this particular case, but in general it's a useful and common C idiom. Compiler writers are aware of that and avoid issuing warnings if you parenthesize the offending assignment expression.

He also compares pointer values against NULL. If I were as uncharitable as he has been, I'd argue that this shows a 'shocking' lack of knowledge about how C works. In C, comparing against NULL is as 'bad' as comparing boolean expressions against true and false in other languages.

edited: be less cranky
This is completely missing the point and intent of the article.

The author is (IMO, rightly) getting pissed about "technology journalists" at places like Forbes, or bankers at JP Morgan, who will smugly say stuff like, "Oh, there was a really horrible vulnerability in this software, and there's nothing we can do until those incompetent programmers get out a patch" (even if this is not explicitly said, it is often implied in these articles). They completely overlook the fact that

a) The source it right there. You think you can do a better job, please fix it and submit a patch upstream. Or post on the bugtracker.

b) The reason this is a problem is usually because of lack of sanitization of user input before passing it to bash. So that is your problem, not really bash itself. Use one of the patches out there that disable the "feature" that leads to the bug.

How many articles state stuff like "Thousands of organizations over the world use bash, yet no one has discovered this for 22 years. This means a lot of companies are not taking security seriously enough to audit the (open) source of the code they ride on."? Until we start seeing articles that address the complex social and economic aspects of the issue, I don't blame FSF supporters for being pissed at them.
Whilst I feel that making personal attacks on the writer are no good at all, it does look like bash isn't using modern C, and is using nifty shorthands that doesn't make the code particularly clear.

GNU wants freedom for people to distribute code. But do they want us to have the freedom to understand their code? :-)
I do not find it shocking that 25-year-old code is obsolete.

Heck, most any project I've worked on that was started more than 3 years ago has obsolete code. If it was started before it was a near-universal habit to write tests, oh yeah we're scared to touch it.

But I agree with the author that this is a sign of things to come. Our digital empire is built on layers upon layers of bad code, and the economic cost to fix it would be enormous. And that's what's shocking. Expect things to get a lot worse before they (maybe?) get better.
Anyone who bashes open source code for bugs is an idiot. Maybe the "community" should start auditing code instead of blogging and tweeting about how awful things are. This functionality has been around for so long it is generational.

+1 to the person(s) responsible for finding this.

Everyone complaining should stfu
That's correct. Environment variables are implanted by the shell. Don't use environment variables for data transmission.
Hey, at least people are looking now. Of course these condescending blog posts serve little purpose, but the author could've noticed something more important in the process of writing it.

Imagine if heartbleed happened and everyone just moved on because bugs happen, deal with it.
Compiler writers are aware of that and avoid issuing warnings if you parenthesize the offending assignment expression.

I see no parentheses in that code.
If only instead of blogging about how “badly programmed” bash is people went over to the mailing list and helped clean up the code...
Which would have been a valid complaint.
Yes, the CGI spec is obviously broken. Clearing a environment ala Postfix or using a socket would have been the obvious fix in the 90s.
Any of the books by Chris Date are a good place to start, although some find him a bit strident.

A lot of people rip on SQL, but knowing it well is extremely helpful. With all the NoSQL hype it's easy to overlook the stuff RDBMSs are very, very good at--but they're not good at everything.

(With the caveat that PG's JSON stuff brings NoSQL into the SQL world.)
Out of interest, where exactly is the source code history for bash?
Most likely DHS won't be able to use this guy as a federal informant now that this article is out. Did he think that crying to the press would give him some kind of immunity to prosecution?
I have a 16 year old that I setup a few years ago with a laptop and I have two more approaching the pre-teen years now.

I initially set up a linux machine for him but found that in school they were forcing them into Windows and working from that, it wasn't until he got into his high school that has a technology program that he is in that the linux became valuable. Until then though, Windows was way more beneficial for him for school and solved compatibility issues we were having with Microsoft Office and the open source office products, also power point etc. Just a point, and I know you say the laptop is light on resources so Windows may not be possible.

Offline wiki was a great idea, I need to remember that one.

Why not load up some good bookmarks too for things like stackoverflow and other potentially useful resources.

Webstorm is also a great IDE for node.js, html and other projects. It is also from JetBrains and free for students. May not be necessary since you have intelliJ, but I know we use both WebStorm and PhpStorm.

Also, Adobe Reader, Chrome, FireFox, MySqlAdmin, FileZilla, Git/GitHub, Instant messenger of some sort and maybe Skype.

I know my kid uses Skype for classes and for homework projects, and just to keep in tough with his friends of course. My younger ones even use it.

Just ideas. Good luck!
I actually think it's fine to have an opinion on any piece of software.

However weev is completely correct in telling people that shell environment variables were an obviously bad place for arbitrary data set by people on the internet back in the 90s. The shell wasn't designed for that, it's known to be insecure.

HNs defence of Apache doing silly things seems to be more love of Apache and lack of knowledge of Unix fundamentals than hate of free tools.
The texture thing just solved the 3D drawing problem, not the FEA problem, or the machinist/CNC problem

You don't care about vertexes when you're spinning things in a lathe
Good call on Minecraft, my kids are constant playing that when they have free time.
the "area man" on the onion is a satire of local news, the kind of thing you'd see in a small township newspaper
Nobody is bashing Stallman, least of all that Guardian article. I'm honestly not sure what weev is trying to white knight here, but the post is so hilariously off base that I lost what respect for him I had.

The point made in the G by an interviewee (not the author) about the Bash codebase and undermining "all bugs are shallow" is actually quite good in the face of two giant counterexamples, and I would have liked to have seen Stallman counter that. He didn't, and instead took another opportunistic shot at proprietary software, just like the FSF's tone-deaf statement.

That weev would get The World vs. Stallman from that, then invest his time into a defense of poor Stallman and shame the world for not giving him money (when his politics and ideals create an economic scenario where he is unlikely to ever receive money from those who benefit most, and ostensibly he accepted this decades ago), is just bananas. I will continue to criticize whatever I like, bash's codebase and GNU process potentially being on the list, and I do not need weev's permission or acceptance to do so.

Maybe if we on HN and in Silicon Valley culture found his racial epithet organization amusing, he wouldn't have to talk about us like a lower class.
Postfix is of a similar age and does exactly as weev says.
Nope dhclient running under apparmor profile is still vulnerable. I was able to execute linux commands like rm, wget, chmod...
Perl's Problems
"Github has become the de-facto place to put code"

Maybe in some districts of SF and SV, but apart from that, NO

I love Github and I think that it is way better than most of "industry standarts" but amazingly, some people still use self hosted solutions, because they need it.
I have to say, it's ironic that weev is feeling offended by mild criticism though. Given he ran the GNAA to deliberately offend, it seems a little rich that he is so upset.
The best advice for non-professionals is to simply not trade. Taking commissions into account, your expected excess return is negative, i.e. you'll better off just going long on some index fund. All the advice being thrown around at laymen on stock trading are nothing more than empty platitudes that have not been empirically shown to consistently work.

Keep in mind that when you're playing the markets, you're competing against institutional investors and hedge funds that have far superior resources (data, algorithms, etc) to better analyze the market and to even move the market in a direction favorable to their holdings (e.g. Warren Buffet). The most likely outcome of trading is that you'll get out-gamed by these sophisticated investors.
Collada? http://en.wikipedia.org/wiki/COLLADA
From the article:

> e^{pi * sqrt(163)} ~= (5280 x 5280 x 5280) + 744

> e^{pi * sqrt(67)} ~= (640320 x 640320 x 640320) + 744

I really have to ask: What's up with 744?
Given that rms never said the "all bugs are shallow" statement, I'm not surprised he didn't comment. You are thinking of ESR I think.
Re 4, I'm actually saying nearly everyone on Unix considered environment variables to be a problem before. Not sure why you got the opposite impression.

Generally agreed though, I'd love to see the shell actually store data from instructions too, but it would break a lot of things.
This post might shed some light into Stallman's lifestyle: http://gizmodo.com/5853729/please-do-not-buy-richard-stallma...
The best part is when he concludes by passing the buck to "somebody" to fix it.
There's https://ftp.gnu.org/gnu/bash/ starting with 1.14.7 and containing diffs back to 1.14.0.

There's also a corresponding git repository, also starting at 1.14.7: http://git.savannah.gnu.org/cgit/bash.git/log/?ofs=50

No idea about earlier revisions.
His point is that if you have freedom to work at whatever research direction you choose, then it doesn't mean freedom from the other 60% or 80% of your workload (as shown by surveys of tenure track researcher time allocation) that is not really related to research as such, much less your chosen direction of it.

Teaching, administrative duties, grad student supervision, grant proposals, committee work etc make up the majority of the workload; primary research was (IIRC) something like 20% of total working time.
I'm not trying to be sarcastic, this is an honest question: where have you seen the blame against GNU and Stallman related to the bash bug? I ask because I haven't seen it here (thankfully) or anywhere else.
Didn't say it was his. He can comment on it when the topic is process failures that led us to this situation (not saying whether there were any, mind, just that's the topic).
Great explenation. To add to your story: imagine being the car manufacturer, doing this all for free (as in beer) and still having people more or less wishing you dead for building a city car not suitable for offroad use. It simply doesn't add up and makes you feel pretty miserable, I guess.
Agreed. Misuse is a problem. However sometimes being too flexible opens itself up to unintended misuse.

It seems as if though foss is so reliable that people start to act entitled when shit hits the fan. Software has never been problem free and never will.

I'm just glad I haven't seen a libreBash or some other lame fork instead of just adding more eyes to the existing functioning project.
Yes, smart guy. I mean in practice.
Fair enough. However, it's possible that there weren't many eyes on the code. Now there are... it will be interesting to see if someone forks bash.
It's great to be able to make memory allocators faster, but it's also wise to consider the possibility that it's the applications that use them which are where the inefficiency is - and ironically it's the applications that do the most unnecessary allocation/deallocation that would benefit the most from a faster memory allocator.

To paraphrase a common adage, the most efficient way to allocate memory is to not do it at all. Probably helps with reducing the chance of use/free bugs too.
I think that bashing bad code, bad practices and whatever lead to any security-critical bug (and any bug whatsoever, for that matter), should happen. If there weren't rants, flame wars and insults in the free software movement, I guarantee it wouldn't have come near where it is today. It's a big part of what drives innovation in all spheres, not just this one: the harsh (and not-so-harsh, sure) comments, the passive-aggressive forks, the rewritings, the heated discussions.

But bashing a person for writing that code? Never. I can't say my views on software politics are aligned with Mr. Stallman's, and neither I can say I have given that much thought to them. But I have enormous respect for everyone who has contributed to free software and helped shape the world, even with the smallest contributions... And Mr. Stallman's are one of the biggest. Everyone in this area should have the deepest respect for the enormous amount of work this man has done, and given it all to the community. It's hard, if not impossible, to stumble upon an anticonformist such as Stallman, who honestly does not care about the superficial things we all, unfortunately, do. I guarantee he could've leveraged everything he's done and been a multi-billionare by now. Instead he decided that the benefit the community can get from his work is far greater than the benefit he himself can get, so he did the only moral thing to do: he gave it all for free. And look at the GNU project now, or the FSF. Magnificent stuff.

Mistakes such as this one (and a great majority of developers make dozens of these on a weekly basis), are probably the most idiotic reason to call out a person for incompetence or senility. It's ridiculous. It's completely unacceptable to now demonize a man such as RMS, if not for other reasons, then because none of us will probably ever come close to what he has done to change this world for the better.
Good point about prefetch.

The U16 version can probably benefit from a test for the first 256 values, and leave the remainder of the range as vanilla counters. You might get a win for less than 128 on the first test, in fact.
pay is meh until you get tenure. £30k nominal, up to £60k for a professorship

Starting salaries are a lot higher than £30k (US$50k) for CS faculty in many countries. Here in Denmark the typical starting salary is around £45k (US$70K), and you can get tenure w/ a raise after 3-4 years. And at research institutions in the US, the typical starting salary is around £50-60k (US$80-100k). You can still make more in industry, but the pay isn't £30k-level bad.
The bigger news is that Google was a member of a non-legislative legislation writing entity.
Vikings enjoy a huge popularity amongst lay historians and the general populace. We've got a "Vikings" TV series, not a "early Danish kingdoms" series. There's "Viking metal", not "Calmar union metal". Every friggin' fantasy setting has Viking expies, even if the rest is positively Renaissance. When people think of Scandinavian history, it's primarily bearded raiders, not Gustavus Adolphus.

I'd say the only historic stereotype that is more popular are knights, and they share a lot of the same "bad history" characteristics.

So, "bum rap"?
Or they could, you know, just shut off the email client until they are ready to focus on email.
The problem seems to me that bash is written in an obsolete language. It isn't just a matter of style, but the fact that the language and compiler helps you so little is a clear sign that the technology itself is obsolete and unsuitable for critical piece of software.
Interesting article. I checked out http://intersec.com to see what they do, but I got redirected to https://www-preprod.intersec.com/en/

Seems a bit odd?
full quote: "Github has become the de-facto place to put code that you want others to work with".

Maybe I should clarify: "others" == "people who don't know or directly work with you"

Self-hosted solutions do not make collaboration simpler (in an OSS context), which is the reasonable, non-zealous claim made by the article.
Why Should Your Product Waste Your Users' Time
On his personal FAQ, he says:

>Until around 1998, my office at MIT was also my residence. I was even registered to vote from there. Nowadays I have a separate residence in Cambridge not far from MIT. However, I am rarely there, since I am nearly always travelling out of town.

https://www.stallman.org/rms-lifestyle.html

In general, there is a lot about RMS that runs contrary to societal norms. He marches to the beat of his own drummer.
It is not obsolete, it uses obsolete technologies/conventions.

Using obsolete technologies does not imply bad code, either.

One doesn't see blog posts complaining about the shockingly obsolete stuff in the Eiffel Tower, either (wrought iron & rivets. Why don't they rebuild it in welded steel, or, better yet, 3D print it in steel?), or of the over engineering in Gothic cathedrals (the ones still standing use more stone than necessary, now that we know how to do strength calculations)

Yes, if you want to make strong claims about the security or performance of bash, its code probably needs work, but there is plenty of newer stuff that also has its issues (for example, the typical mobile phone OS needs quite a few iterations to get its lock screen right, the average brand-new thing also has security issues, etc)
> [We have been] hiring cryptographers out of Apple

Is that really something to boast about? I never think of Apple as a hotbed for cryptographic genius
The Beale ciphers
Well I'm glad we all learned a lesson from Star Trek IV.