skysight-inc/HackerNews huggingface dataset:
indian people being dirty is a wild accusation
Upgrading Django (to 1.7) Part I: Introduction and Django Releases
> groovy apps do that [... if] you somewhere specifically invoke System.getRuntime().run("bash");

That's a one-liner in Groovy, written in the Java style of chained method calls, which is the direct equivalent of spawning a shell in non-JVM languages, so that's not an argument for using Groovy instead of PHP.
I like your spin, but what good would punishment do?
There is Xen exploit that will be disclosed on October 1st. Amazon most likely already know what it is.
You say that startups should be focused on "helping people" and "ethical business" (as if there's another kind that will last in the long-term). You're forgetting two things: 1) the people that bust their backs trying to get the startup off the ground in the first place, and 2) the value those people bring to the lives of their customers when they make a great product.

Also, why the denigration of money? Try paying new employees with something other than money. Any business that doesn't pay the market rate for talent will have trouble attracting new people and retaining the good people it has. Why? Try paying your rent, your car payment, your student loans, etc. with something other than money.
AC Units from Liberty Heating and AC Repair
I can't imagine why people are so paranoid about the tech companies having backdoors (especially when they explicitly deny it) when the NSA or other intelligence agencies could have lots of unknown vulnerabilities to exploit.
How do you connect 2 screens to it? What software do you run on it?
Does it run Visual Studio well?

This looks awesome, tell us more!
yes, adding that lets you see all remote branches, including PR's. The goal with this tool is to eliminate editing .git/config for each project and make it easier to work with pr's locally. This is just the first step. Definitely planning to add more pr-specific feature.
Do open an issue if there's any particular feature you would like to see.
Thanks :)
Isn't the router still at risk after taking these precautions seeing as many routers shell out for ping and traceroute-responses?
I wouldn't be surprised if he found it by accident. This exploit seems a lot easier to stumble upon in "normal" usage than something like Heartbleed for instance.
Government spending via redistribution is absolutely zero sum.

But you are mistakenly assuming that all government spending is redistributive, as if the only thing the government did was transfer payments. Government also provides services (sometimes by contracting out to the private sector) and invests in physical capital (likewise).
I understand the doctor gave her time — that's fine. It's that the cost for that time seems ludicrous. As I said, the pricing seems multiplied by 20.
Meta: Why is this not on the front page? It has 53 points and was submitted 4 hours ago (and is a technology story to boot). The #5 link on the FP is a story with 26 points and submitted 5 hours ago.
I was presuming that you'd want more nodes per bucket, but I suppose once you have a hash that can expand and contract efficiently that becomes less of an problem. The issue though with having an average of 1 node is that about 1/3 of the buckets will have no nodes (wasted space), and about 1/3 will have 2 or more (longer lookups).

Yes, for an efficient closed hash of a larger structure, you'd need to store both a pointer to structure and a means of disambiguation so that that you don't have to follow the pointer to (probabilistically) test if you have a matching entry. For a cuckoo, this might be the hash of the other slot, so it's not entirely wasted space, but it would add 8B or so to each entry. On the other hand, we're presuming a large struct anyway, this might not be too much extra burden.

The model that I'm mentally comparing to is an 2-way cuckoo hash with 8 slots per bucket, with a single SIMD compare to test for a match. It's an approach that makes a lot of sense to me. It's not quite what they describe, but if you haven't seen it, you might check out this paper: https://www.cs.princeton.edu/~mfreed/docs/cuckoo-eurosys14.p...

In any case, neat stuff to think about. Thanks for answering questions throughout the thread.
They won't have to backport the fix, there is a patch directly against bash-3.2 (which ships in OSX): http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052

They do update bash occasionally, even though it is trapped forever in a pre-GPLv3 world: http://www.opensource.apple.com/source/bash/. For instance, bash-86.1 shipped in 10.8 and bash-92 shipped in 10.9.

I don't know if they will hop right on this (and personally I find the issue overblown), but I imagine it will get patched at some point.
You should be paranoid about both because they're the same thing.

One tech company's backdoor is another NSA's vulnerability to exploit (and silence with an NSL).
Perhaps he hasn't read the paper we're talking about :-)
Actually, the first test would be 'which bash', since not all systems have it installed by default.

Notably, FreeBSD, which has never included it by default.
Yeah, Nah. Abbot just learnt what a 'False Flag' operation was and is trying it out so he can feel like a big boy.
For the record, the recent 'terrorist threats' involved an apparent plan to kidnap random citizens off the street and behead them on camera, then send the footage to ISIS for subsequent release.

The raid to stop said threats involved ~800 police officers across multiple states. Its result? Two people charged, with only one having anything to do with terrorism.

Just about every ounce of effort was put in to drumming it up as 'averted disaster at the last moment', yet very little effort was (probably intentionally) made to mention that the mobilsation of over 800 police resulted in the arrest of exactly 1 person on terrorism-related charges.

This is undoubtably an opportunistic move on the back of marginal news. It's a travisty and it will pass without much debate because both parties give approximately no care whatsoever about preserving individual freedoms and privacy, and every care about eroding those rights for increased capacity to monitor and police the public.
I just followed the following instructions on Arch for replacing bash with dash:

https://wiki.archlinux.org/index.php/Dash

The technique is applicable to other distributions as well.

Note: on my Arch install the checks showed there were no scripts relying on /bin/sh being bash.

Edit: direct link to checkbashisms.pl - http://anonscm.debian.org/cgit/collab-maint/devscripts.git/p...
Huntsville schools say call from NSA led to monitoring students online
in the same way that the name "john the ripper" relates to security

it's just a cute name
They are still selling laptops, just not in Europe.
Look at the original announcement from earlier today. This was a known issue and responsible disclosure was exercised -- the issue didn't become public until 5 minutes after the embargo was lifted (i.e., 5 minutes after it was agreed the issue and patch would go public). Since it's so easy to exploit this bug, it'd be impossible to release a patch without people taking notice and immediately beginning to exploit vulnerable systems.

Someone just did a really bad job vetting the patch for thoroughness.
This is the best thing ever written on money: http://capitalismmagazine.com/2002/08/franciscos-money-speec...
I've been on the both sides of the fence: writing native iOS apps and trying to do mobile web iOS apps. From the bottom of my heart: writing native apps is far more enjoyable and productive at the moment.

With the browser engine underneath, you get nice benefits in text layouting, image handling and some inputs, but it requires a lot of work to get good performance, to get touch interaction and scrolling feel natural, to make transition animations to work well. Offline access is also PITA if you have a lot of data - indexedDB crashes left and right if not used carefully. The last 20% of the app takes 800% of the time :) and the result is still not what you wanted.

I haven't encountered many good mobile web apps. HN app by @premii is pretty good (http://hn.premii.com/), and the developer once described here in HN that he didn't use any JS library like jQuery for performance reasons, everything had to be coded manually.
>> "what good would punishment do?"

Make him think twice about being an asshole in the future?
$1.5 billion. Enough money to live like a king for the rest of your life. And for several generations beyond that.

And yet willing to put up such a fight to prevent other people -- poorer people -- from having an enjoyment entitled to them by law.

I'm having a hard time framing this in such a way that doesn't make Khosla seem phenomenally greedy.

I really don't understand.
If you use one of several popular cheap SSL providers, you need to add some intermediate certs to your server's SSL store or Android will show those warnings. It's pretty lame.

https://knowledge.rapidssl.com/support/ssl-certificate-suppo...
While there's no clear benefit to society for private ownership of beaches, there is clear harm - cutting off access to an ocean which isn't privately owned. It'd be a horrible precedent to privatize beaches, since the profit motive would provide incentive slowly sell them away until normal people would lose access to a very valuable recreational area for swimming, exploring, and hanging out in a public space just so a few rich pricks could enjoy the space without all the rabble. Give wealthy people an inch and they'll buy a mile.

Also, the surfers would beat anyone senseless who tried that crap, so it's a pointless debate.
tl;dr Game programmers do lots of memory allocations that C/C++ don't accommodate in a pleasing way. New languages (Go D Rust) have smaller ball&chains but reflect different audiences that can, for example, eat the garbage compiler or pointer safety.

Blow suggests that the game industry should devote resources to a DSL that emphasizes their needs. Rather than, say, make the programmer allocate a block and then fill it with sizeof(x) offsets & allocating index arrays, the hypothetical language, when so marked, ought to allocate and fill a struct's members contiguously.

There's plenty more in the two hour video. He's mainly expressing frustration and hope. So, rather than start on a mailing list, if you have constructive advice, he'd like to hear from you via language@thekla.com
...maybe not. They're promising a fix within 'days' and recommending downgrading [1]

[1] http://9to5mac.com/2014/09/24/apple-ios-8-downgrade-instruct...
the idea that the opposition actually needs to oppose every proposal by the government in power is what leads to the current situation in the US congress.

When it comes to certain thing people happen to agree.

If the government came out against eating babies, does the opposition have to start taking a literal interpretation of Swift?

(I am not saying that the Iraq War is "obviously right", I'm just saying that cooperation in government is a possible thing)
I'm hoping we'll see a patch soon that altogether removes this misfeature.

EDIT: Apparently that's out of the question, but there's talk about using a BASH_FUNCDEFS variable to specify which variables are function definitions instead: http://www.openwall.com/lists/oss-security/2014/09/24/20
It looks like the important part of the patch (bash43-025) is here:

In builtins/evalstring.c:

if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)

In variables.c:

parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);

So what the patch does is create a special mode of parse_and_execute() where it's supposed to only evaluate function definitions. A better option would be to add a flag to parse_and_execute() that disables it from attempting any execution completely, not just function definitions.
I just bought a Lenovo x220 which is about 2 years old, and it runs both Win7 and Linux Mint perfectly. Very fast, and I can even do SOME gaming with it. Best 200 USD purchase ever. There's no clear reason to upgrade laptops every year, until then I was using a 5 years old HP PC, which was working fine, too.

Shutting down your PC line in Europe is stupid, though. Well, that's better for the other competitors, which will fill the gap.
I've felt the same way for a long time... and the only way to get over it is to practice. Buy a whiteboard and practice at home. Buy some books (e.g. http://www.amazon.com/Introduction-Algorithms-Edition-Thomas... and/or http://www.amazon.com/Cracking-Coding-Interview-Programming-...). You can also subscribe to http://codingforinterviews.com/.

Not exactly an answer to your question, I know. Most startups I know in SF/Bay Area at least do a technical test (either coding or just regular questions) on the spot. It is stressful, but as anything, you can learn how to do it.
I run an Ubuntu server in my closet as a general-purpose file server and such, mostly just for my own use or for sending files to friends. I have just turned it off and disabled all port forwards to it, and I will wait at least a few days and check for a more definitive fix before opening it back up to the internet. I recommend anyone in a similar situation do the same.
Redistribution is zero sum in dollars, but only zero sum in utility if you assume that the marginal utility of an additional dollar of income is constant to all recipients. But I think its pretty clear that money -- like most commodities -- has declining marginal utility, and that downward redistribution is positive sum in utility.
Could you please confirm or provide evidence for such speculation?

I don't see anything about this on google.

I heard it is because they are having power issues within their datacenter.
For scientific computing and machine learning Python is quite big, but it is all 2.x.

Moreover, many people in the scientific community applying machine learning are biologists, neuroscientists, physicists and linguists. These people are NOT experience developers.　These are experienced scientists.

What is needed for these people to move to 3.x is mostly adequate library support and a good reason. Many of these will have a hard time understanding why they can't just write print "string" anymore.
Wait, what -- "less irrational"? Wouldn't "more rational" be a bit easier to interpret?
If it's ok to collect electromagnetic emissions in range from 430 to 790 THz [http://en.wikipedia.org/wiki/Visible_spectrum], why it shouldn't be the same for 2.4 GHz?
Autoresizing text areas aren't supported by browsers either, you have to use Javascript to implement it. http://stackoverflow.com/questions/454202/creating-a-textare...
That's the previous patch, and it didn't fix all the cases. Far as I know, the new one is still unpatched, and people are carefully going through the thicket of string parsing to try to fix it for good.
No need to get so worked up about it, apply your talent elsewhere.
> "It's common knowledge that the PC market is in decline."

Mmm, not so much. Apart from what you hear from tablet makers. It's stagnant, but it's not in sharp decline.

Source:
2Q13 shipments : 75,700,902 VS
2Q14 shipments : 75,763,725

Yeah, it's "common knowledge" as they say, if you don't bother checking numbers.

https://www.gartner.com/newsroom/id/2793921
Shock yourself to be more active
Chet (bash maintainer) has indicated that this issue is different to the original CVE.

The problem is the first issue altered people to the fact the the function var parsing was a interesting previously-unpublicized attack vector, and they started looking for more funkiness there.

It would have been nice if the response to the first issue had been to do a thorough and complete testing of the parsing code, but it's not really surprising that it wasn't.
Debian also has a minimalist /bin/sh (via dash), but unlike FreeBSD they do ship bash in the base install, as the default interactive shell. Which is the default interactive shell doesn't matter much, since interactive shell usage isn't the likely vector of this exploit. However some Debian packages may explicitly call bash (rather than /bin/sh), since they can assume it's in the base install, while we know for sure no base FreeBSD packages do. I'm not sure whether anyone's done a survey yet of which Debian packages shell out to bash vs. dash vs. nothing.
No need to go to that length. Ubuntu uses dash as its standard /bin/sh. If you're super paranoid, chmod /bin/bash to 000 and fix any broken scripts that call that shebang; most likely, they don't use any bashisms and can use the stock bourne shell.
If your net worth is $1.5 billion, what % of your annual income would serve as a deterrent?
Tiger Attack at Delhi Zoo
Doesn't that fall apart when the for profit partner needs to pay the other $990 million dollars and then still cannot patent the drug?
Great post. I'm not sure if it's because of my Objective-C bias or not but Swift just seems messy to me. Everything from how it's spaced and structured in the editor to how it's read. (Lack of headers, clear separations between data structures, methods..etc). Say what you want about Obj-C but it was damn organized.
If you are looking for a Linux compatible laptop that is somewhat similar to MacBook Air, look for Asus Zenbook UX* line. Excellent display, good but not awesome battery life, fast hardware and really good keyboard for its size. I've bought two UX31A's, one for myself almost two years a go and one for my dad last Christmas. Everything else works straight away with Ubuntu other than ambient light sensor. I think there isn't any workarounds for that.

I got Lenovo X1 Carbon (2014, Touch) from work couple months ago and while it has better CPU, bigger SSD, more RAM and better GPU than my two year old Zenbook, it's just worse. The Zenbook lid can be opened with one hand, Lenovo requires both hands. Lenovo has too heavy display and too light keyboard part combined with too tight hinges, so when trying to open the lid with one hand, the whole computer lifts up from the table.

Also, Zenbooks have normal keyboards. I hate the keyboard on X1 Carbon. Instead of normal function keys, there's are adaptive touch keyboard thingy that tries to figure out what kind of special buttons should be shown in there with each program, but it just fails. And feels like... well it does not have real buttons, so I can't feel a thing while using it.

Also, delete button is in the upper right corner in X1 Carbon. And backspace is on the left hand side of it. And that makes no sense. Backspace is used way more often than delete, so it should be easier to hit. And upper right corner is easier to hit than almost upper right corner.

And Zenbooks have normal arrow keys that are not too crowded. Lenovo decided to put page up and down right next to up arrow. When ever I accidentally hit page up or down instead of up arrow, I feel like I'm totally lost.

And almost forgot, Zenbooks have good touch pads, X1 Carbon touch pad moves up and down, so it's like a huge button. Really annoying when you just move your thumb on it and accidentally press too hard, so it registers a mouse click even tough you did not raise your finger.

So, in short Asus Zenbook UX* laptops pack awesome hardware, work with Linux pretty much perfectly and have really good build quality.
I think Android uses mksh[1] these days too.

[1]: http://www.all-things-android.com/content/mirbsd-korn-shell-...
There are many point-of-views that one could(should) factor in to explain the circumstances:

1. Mindset due to poverty: There are many people below the poverty line so it makes sense for the scientific programs to aim for the cost-effective solutions not cutting-edge.

2. Experimental: If it was your first space mission, you wouldn't exactly load it with gadgets. Missions have a chance to succeed or to end in failure. Investment would only make sense after tasting some success.

3. Cost of living: If you are well-off in India, you may still be poor outside of India. Cost of living is lowest in India (http://www.numbeo.com/cost-of-living/rankings_by_country.jsp). So cost of research and development will be lower than elsewhere too(maybe not everywhere).

4. Media attention(somewhat): It started with the headlines from British news "We pay for India's rocket to Mars" which raised a lot of eyebrows in India. Even though money from aid was used for intended purpose, it was questioned if India needed the aid. (To me its not worth the brouhaha. They will fancy paying for nuclear programmes next.)

5. GDP: US GDP is the largest in the world. They can afford to spend loads of money without worrying (lets say debt crisis was an exception). India has GDP which is smaller by orders of magnitude.
Show HN: Mine, blockchain content id
Maybe? Who cares? They're just being up front about what they see as a culture fit. Anyone hiring has their own version of these requirements in their head.
> Government spending via redistribution is absolutely zero sum.

Well, at the level of the currency issuer (of which India is one), Government spending is money creation, and not redistribution.
In the UK at least if you walk into a store you will find they have a confusing set of badly specced models of brands you probably shouldn't buy at prices you probably shouldn't pay.

I give a lot of credit to Apple in keeping their line fairly straightforward (usually only devs or photo/video people need upgrades) otherwise everyone gets the same base model for one of a tiny number of variants. The prices across channels and concessions are always the same too.
Ubuntu 10.04LTS has dash as the default shell, as does Debian Squeeze (oldstable).
Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/

It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems.

Full disclaimer: I work for Canonical.
I am seeing:

web22 ~> grep "() {" logs/access_log
209.126.230.72 - - [24/Sep/2014:17:16:46 -0700] "GET / HTTP/1.0" 200 5733 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)" 13378 () { :; }; ping -c 23 209.126.230.74 80 74529
Before You Take a Bite of That Mushroom, Consider This
>>What's the point in fighting legislation when you can solve the problem with technology?

Because encryption can be made illegal.
@someperson : Disagree with you again as in the comments here. https://news.ycombinator.com/item?id=7964499

You are making vague assumptions and supporting with unscientific proof. Using phrases like "there is clear lack" or "clearly visible" etc. doesn't make your assumptions true. What's funny is that you are picking up random pictures from media and using that as evidence. There's

The official word from ISRO is that they comply with 'planetary protection' requirements.
"ISRO said the spacecraft was built according to the planetary protection implementation requirements specified for ‘orbiter’ category of missions."
SOURCE : http://www.business-standard.com/article/current-affairs/mom....

Some articles speculate about the rigorousness but can't confirm. Implying it doesn't exceed them doesn't equate to skipping the sterilization. Besides, it's carrying satellites from developed countries (France, Germany, Canada & Singapore), which I doubt would be complicit in creating an international controversy.
Since when is admitting it only after you got caught being "upfront"?
I'm not sure I understand the point of his post.

In all the examples he gives Swift comes with better and more succint syntax plus more safety than Obj-C, and on par with his "Obj-C 3.0" idea.

And of course it has tons of other features and flexibility he doesn't delve into.

The whole post for me boils down to his "I hate Generics" rant at the end.