skysight-inc/HackerNews huggingface dataset:
> They're such different bugs that they're hard to compare.

I mentioned it because people are having a field day comparing the two (which results in some good old fashioned fear mongering). A random sampling:

CNet: ​'Bigger than Heartbleed'
Gizmodo: Why the Bash Shellshock Bug Could Be Even Worse Than Heartbleed
Mashable: Shellshock: The 'Bash Bug' That Could Be Worse Than Heartbleed
The Independent: Shellshock: Bash bug 'bigger than Heartbleed' could undermine security of millions of websites
Errata Security: Bash bug as big as Heartbleed

> The CGI doesn't have to be written in bash

This was covered in my second item, about using system(). I'm certain that there is software out there that does this, but it is in no way common or has ever been best practice.

The panic over this presumes that people use CGI all the time. It's awful, it's always been awful, and should never be used for anything public facing for lots of other reasons. Note that FastCGI is not impacted.

> If you're on a network with nodes you don't trust

Correct, but this isn't the case for most (but not all) server deployments. In your own datacenter environment, you control the network and all of the hosts on it -- if someone busts in to run a DHCP server, you have bigger fish to fry.
Shellshockbashbug.com
They'll continue to not gain traction until someone tries to figure out why. I ran into roadblocks trying to interact with people on different sites. I'm not sure exactly how to overcome them, but I guess it's something like an OpenID sign-in. I never bothered since I had other networks to try out.

This is probably why ello is gaining traction where app.net and similar didn't. You make an account, and there's no counterintuitive steps--relative to dominant social networks--to connecting with other people.
> Why do you need to maintain a reference to a hash node?

> Or do you mean maintaining a reference to the value stored?

The hash node is the value stored; many hash tables are maps from keys to objects, and the objects get linked directly into the hash chain without further indirection.

The Linux kernel hash tables have a structure hlist_node which contains a next and previous pointer, and objects linkable into a hash table will contain an hlist_node as a field. This avoids having an extra level of indirection to get from a hash node to the hashed object.
> Projects like this generate huge amounts of value for a country

Wow, I'm interested. Let's hear them!

> they help to push money around the economy (worker salaries and equipment invoices)

But that already happens with any new enterprise. Any new company created helps push money around through employee salaries and equipment invoices. What's special about a space mission in this regard?

> but also in terms of the skills gained by everybody that works on the project

But that already happens naturally in the free market. We have an explosion of tech jobs now that are increasing everyone's skills. It's almost a given now that an employee must be computer literate. Advances in technology have required that people have more skills. What's special about a space mission in this regard?

> as well as the international capital of being a spacefaring country

A.k.a. bragging rights. Do you really think international investors care if a country is throwing rockets when deciding to invest in that country? That they are that frivolous?
I've no idea why you've been downvoted. The numbers you point out seem to be accurate and not taking external investment does indeed leave you with more equity (as does sticking with the public company and the associated stock awards). I believe Microsoft was another company that didn't take much (if any) external investment.

It's worth pointing out that VC as an industry may not have been very mature around the time of these companies.
Rise and Fall of the biggest discovery of the century?
Almost certainly can't. The closest you can get is using clicc or ECL or something similar to generate C code, and then compile that with emscripten.

This invokes llvm at runtime, and AFAIK emscripten isn't ported to emscripten.

FWIW, I've tried other lisps under emscripten:

Most lisps generate machine code, store them in RAM, and then execute that RAM. This is not possible under emscripten.

Clisp is a good candidate, since it's byte-code interpreted rather than generating machine code, but clisp makes so many assumptions about how the machine works (in particular it strongly wants a C style stack and does manual stack-pointer manipulation). I actually got fairly far into the bootstrap process under emscripten, but the minimal lisp interpreter it compiles generated bizarre errors.
Fixing vs. Replacing Email
That works, and has been tested, but would drastically increase memory usage. And you still need a way to track those readers still looking at the previous version, which you'd probably still want to use RCU for.
I suggest you read the accepted answer at http://stackoverflow.com/questions/19428418/what-is-the-use-... for a brief look at why portable shell scripts are a better solution than bash specific scripts.
Mangalyaan-moi-simulation-230914.gif (520×390)
I understand why its a big deal.

What I don't understand is why everybody seems to think its necessary to start posting every script kiddies attempt at spreading their crappy ddos / botnet scripts via the vulnerability.
Ask HN: What is your favorite keyboard for a mac?
I recently started a new job as a developer, and I was given a Macbook Pro by my company. I have been looking for an ergonomic keyboard with the same key layout, but it doesn't look like there are too many options. I know a ton of people develop on Macs, what do you use?
Flux vs. Fluxxor vs. Reflux for React?
Any comparisons of Flux vs. Fluxxor vs. Reflux for React?
That doesn't suggest Swift is a Blub-like language to me.

Though not explicitly stated in the Blub paradox, I'd say it implies that a fresh programmer, unfamiliar with both Blub and the more advanced language, would pick the more advanced language.

The Blub paradox doesn't automatically apply to every language whose syntax you find bizarre. It also has to be a more advanced language, and the reason that you don't like the language's syntax and constructs must be because you don't understand the advanced features they enable.

This is clearly not the case with Obj-C and the post you mentioned.
Billionaire ordered to unlock Martin's Beach but won't be fined $20M
Ask somebody on IRC (#micropython on freenode)?
Kind of old-fashioned, don't you think? All that hard work and patience, building a solid product that people actually need. Much easier to win the VC/exit lottery with a Cat-Pictures-as-a-Service product.

On a side note, boy, I'm at a loss to come up with a reason for someone to down vote you. Factual statement, complete with a reference to where you got your information, and some little shit who doesn't like facts comes along and clicks the down button. That, or someone on a mobile device who tried to click one of two buttons that are separated by about four pixels, and hit the wrong one. The good news is that one of those can be fixed.
They kind of have to contribute to Linux in order for their database software to be fast.
I think the below one hints to it being for compat reasons but you're right no explanation as to what possibly could go wrong if they did it automagically -

> Existing Applications and Loopback Fast Path
The default behavior of the TCP loopback interface is unchanged in Windows Server 2012 thereby preserving compatibility.

Microsoft being overly compatibility cautious as they should be - it's worked well for them. But on the other hand they should have pondered on what sort of compat issues might pop up if they defaulted to setting the flag for everyone and disabled it on per app blacklist basis or something like that.
"He didn't have unique entrepreneurial DNA. He had some skills that were valuable, others that were deficient, and enough luck that the former outweighed the latter."

Luck plays a part in every success story. However, I find it dubious at best to consider that luck is the main factor in Ellison's and Oracle's success.
"Softwar" is an insightful book about Larry Ellison, written by someone who had access to Ellison. I do not want to chime in with my own opinion, but would suggest to read the book to learn a lot about the history of Oracle and Ellison.

You will learn a lot of things, including:

* How being adopted affected his personality

* How he wandered around for a long time without any clear objectives

* How someone filed a false case of rape against him, and how he survived

* Death of one of his co-founders due to cancer

* How Oracle competed with other database companies, including the technical details (this is the part which I found most interesting)
In your case, but in mine, my circle of friends are just computer casual users, and Facebook invites are not mandatory to join, you can go to www.facebook.com and join there, no invite required, you can tell your Friends to go there and join and not to "hey, waith till I send you an invite", and that's another issue.
I'm not too worried, since a) that makes it about as fast as cpython and b) there is a lot of low-hanging fruit. There is work being done on integrating the Cleavir compiler which does a number of tricks. In particular escape analysis and lambda lifting should both help a lot on certain types of code.
Larry Ellison Is the George Lucas of Tech
No, it doesn't. Bash is already indirectly exposed to the world by anything that calls system() with bash as /bin/sh. More library functions than you might expect are wrappers around external binaries (e.g. mail() calling /usr/bin/mail) on PHP, Ruby, etc. Their authors probably thought they were safe with escapeshellarg()-like functions, but now any user-controlled env var set for whatever reason, not just CGI, is an attack vector, and not just through HTTP and not just through headers.
Naruto Shippuden Episode 379 Dub English
Many systems still use passwordless sudo to permit certain users to run specific commands -- but now, if those commands are shell scripts run via bash, the users can execute arbitrary commands (this isn't an uncommon class of privilege escalation problem, though).
Avoiding format=flowed is a feature on development mailing lists; it mangles code and patches.
I would point out that MOCL https://wukix.com/mocl pretty much provides this functionality only with full Common Lisp compatibility. It compiles the CL to C and adds methods to expose your functions to Obj-C / C code (if you want). Works just fine. Builds with Xcode, which as I understand, does everything on/via LLVM.
A lot of people didn't get the idea that this is an art project, not an in-earnest investment strategy.
When astronomers measure the mass of the black hole, they simply measure the acceleration of nearby stars, using newton's formula. They might use fancy words, but the math is very basic.

Now, if time ran faster, like if you made the measurements while accidentally having the video speed in fast forward. The stars would accelerate faster, and you would get a higher mass.
Very well said.

My version of being an entrepreneur includes having enough time to be with my family and raise awesome children who will have the ability to be entrepreneurs as well.
Everything else is yours too, like getting an ROI out of the capital your spending. It's nice you have that kind of money laying around to spend on iron instead of advertising (as an example), but not everyone does.
This data isn't all that useful since the gender distribution of the countries isn't considered. Latvia, for example, seems to favor women in most fields, but there are 8% more women than men which I am sure could account for some of the differences.
> The “50 people” was motivated by his dream that we could just have the very, very best developers in the world, and hardly any salespeople—it was just talk. I think he came to appreciate the sales culture later on.

I found this statement interesting as many entrepreneurs still think this way. Seems like it's a right of passage to hate sales people and then later grow to love them as you watch them bring revenue into your company.
I dunno, Notch seemed to do alright for himself. Having made at least a billion as a result of starting his own company. I suspect that qualifies as an entrepreneur. He didn't seem the KKND type, but I could be wrong.
How the iPhone has changed over time
The article points you you can run the following code to check you are affected:

env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

However... This just shows that the bash installation has this problem. If your webserver that is running is not interacting with bash, then there is no problem at all.

So look at your webserver. Its not per-se a problem in bash. Its more a problem of webservers using bash directly.

Or is this bug more serious?
>Successful exploit doesn't require the exploit writer even knowing that vector existed to say nothing of successfully guessing a URL.

I'm not following. My CGI application is at example.com/stuff/cgi/webapp

So now the attack doesn't need to append /stuff/cgi/webapp? It can just point to example.com? How does that work?
How well does this cope with more complex stylesheets?

I tend to live edit my CSS experimentally right in the browser, and then when I'm happy go back to the actual source files. This is not quite as nice as the demo, but my (LESS) files take several seconds to compile -- which isn't an issue when live-editing rules inside the browser.
Here is the link to the referred HN discussion: https://news.ycombinator.com/item?id=4228402
How Many Paths Are Possible in an 18 Hole Round of Match Play Golf?
Someone said hedge fund managers don't run on coke and models any more. But hey, now it's coke the beverage, and mathematical models...
Really? That is a useless (to me) article that contains a whole bunch of expensive stuff you don't need.

Your kitchen isn't my kitchen. The stuff I find important for my needs isn't the stuff you find important for your needs.

No, you don't have to spend almost $30 on a damn strainer!

I'm a big fan of only buying the stuff you actually need when you need it, not the stuff you might need in the future because someone else told you you need it. If you find yourself needing a blender, buy one. If you find the food you like to cook doesn't require one, don't buy one.

This guy says get a stand mixer and not a slow cooker! WHOA THERE! I use a slow cooker all the time and never once in my life did I think about getting a stand mixer. The other thing is I (and probably 90% of everyone else I know) don't have room for a stand mixer. I don't even know a single person who has one due to their bulkiness and expense.

And a kitchen scale because "Professional chefs measure many things by weight rather than volume since ingredient density can vary?" Um, well I mostly guesstimate my ingredients and my food tastes just as good. I even guesstimate some things when baking which people say will RUIN YOUR CAKE but I never had a problem with it. I also have never used a wooden spoon in my kitchen.
I'm really surprised how many people out there write CGI in Bash. That's one of the things which would have never crossed my mind.
Not sure if it's "ergonomic", but I've been using this for several years, and enjoy it immensely:

http://www.amazon.com/Happy-Hacking-Keyboard-Lite2-White/dp/...
I think atomic commits can either bump or decrease your commit frequency.

If you had a giant piece of logic that wouldn't be atomic in multiple commits, but you have multiple commits on your machine for the sake of saving your butt in case you roll down a weird rabbit hole, then you'd probably squash before merging into master and end up decreasing your total quantity of commits.

If you had a lot of small changes that all were safe seperately, you might break up what could have been a single commit into several commits so that you have a more descriptive history, and increasing your quantity of commits.
The CGI and SSH attack vectors are getting a lot of attention because they are so trivially exploitable. But as someone (I believe tptacek) put it in another thread, this bug has one of the biggest potential attack surfaces in history. Anything that sets any environment variable to an untrusted value and then invokes bash is vulnerable. For example, on some systems, simply connecting to an attacker-controlled network is enough to cause code execution through the DHCP client.

If you choose not to upgrade bash, you are trusting that none of the code on your system uses bash in this way. It's extremely unlikely that the vectors that have been publicized so far are the only major ones.
Posting here as breadcrumbs when I need to find an example of the type of behavior that isn't acceptable on HN.
The US doesn't really supply weapons to India. India develops it domestically, collaborates with Russia, or buys it from Russia.
So anyone who believes in basic business ethics doesn't get to be an entrepreneur in your book? Like many others here, I don't have a problem with Oracle making money or even dominating its market. I have a problem with how they've done those things, and all of the potential innovation they've stifled in the process. Look at some of the lawsuits they've been involved in, or some of the promising projects they've killed by acquisition.

I have personally seen Oracle try to steal my employer's ideas (while I was at Dolphin) and code (while I was at Clam). I was in one of their machine rooms when I caught them making an illegal copy of our source tree, and I most definitely did not get the impression that it was a rogue developer acting on their own initiative. In another life, I've seen how they treat partners, contributing almost nothing to a "joint effort" on a port (impeding it by only providing machine-obfuscated source) even though they were clearly going to benefit most from its completion.

That kind of crap has nothing to do with being hungry, or competitive, or even aggressive. It has to do with being immoral. That's why even real entrepreneurs "talk shit" about Larry and Oracle.
For anyone who doesn't know, there's also a similar "yum-updatesd" for RHEL and derivatives like CentOS, though it only gives notifications of updates IIRC.
> Common Lisp in the browser, here we come!

You have Parenscript for that: http://common-lisp.net/project/parenscript/

(I haven't used it yer though.)
I usually don't comment but this just hits the nerves so hard I couldn't resist; Larry Ellison is as not an entrepreneur, he is a public figurehead chosen to be the face of a company started by a small team of programmers with ties to the intelligence community who then mysteriously got a huge government contract with no company history to speak of despite competitive bids by established, larger companies with experience and concrete histories. Like how, oh, I don't know, another company these days is being shoved in our Face(book)s as a model of success for no other reason than its strategic value to the intell community. Or how Steve Wynn was marketed as a genius developer but it turned out he was just a front for the mob who needed stay in and compete with corporations but couldn't raise funds on wall street due to criminal records. Or how Bill Gates was a "genius" because he insisted on licensing Winblows instead of selling it even though history went on to show that he actually tried to sell it to IBM numerous times but IBM's then CEO, who was a friend of his family and lived a few blocks away in the same neighborhood actually came with the idea to the table and insisted that IBM license the software instead of buying it, which basically set Microsoft with a huge source of un-earned cash just as it was starting up and helped create the mythos of the "genius" entrepreneur.

The only thing this is proof of is inexperience, gullibility and lack of insight into the real workings of the world.

You want to see a good example of an entrepreneur? Look at Jack Ma. No social background, no spoon in mouth, just a lot of optimism hard work and a sense that success can be mutual and open-looped. Started in China, a country notorious for government/business/family-relation corruption but chose not to seek help from the obvious places and instead earned business the hard way - going door to door and manufacturers and asking them to sign up, one boring conversation at a time.

You couldn't make a hollywood movie out of that because its so boring. But it's reality. Any startup story that can have a hollywood movie around it is usually just a public business sockpuppet around a group of allied interests with money to throw around at the next "genius" they want to prop up to create a magical story/script for the next IPO.
I use the wireless Apple one, but the Microsoft Sculpt ergonomic keyboard is very popular in my office

http://www.microsoft.com/hardware/en-gb/p/sculpt-ergonomic-d...
Yea, this I don't like this whole "it's legal--I'm just a great Entrepreneur(Winner!). Make your money, but don't
step on the little guy. Oh yea, a hand shake means more than a contract in my world. I hope it's not a generational
thing? I've been no angel on my life, but I have never taken advantage of someone poor, or naive. I know a few very wealthy Winners. They have all the toys, but very few
friends, and even the third wife really doesn't give a chit
about them. Oh, once their kids realize how daddy/mommy
made all that money--the love turns to co-dependent despise
wrapped in a smile. That said, there are financial and personal heros--Wosniak comes to mind?
> Google has, on multiple occasions, utilised its search engine to prop up or otherwise give an advantage to its own products over that of third parties.

Not in search rankings it hasn't. There is zero, zilch, nada, nothing wrong with google.com showing ads for other google stuff but not 3rd parties, same with the spaces around the search results.

And your "obvious" example is anything but. Google+ does not rank highly, and afaik never has. A search for "Wil Wheaton" turns up lots of results including his twitter and tumblr profile, but his G+ profile (which is fairly active) is no where to be seen on the entire first page.
It's possible to fund early state research using money from foundations, etc. But that wasn't the assertion given by the parent post - it was that the majority of early stage research is both non-corporate and non-government funded.

I'm very skeptical of that claim.
Does your firewall run Linux? What technologies are used to implement its logon page? That's the kind of thing people are worried about.
I'd suggest Hedgehogs :)
Incite Drama: The Emma Watson Hoax Explained
If so, isn't that rather similar to how Visual C++ allows you to modify code in flight while debugging by rolling back to the beginning of the function call?
Its cool. But a language like Go would be much better suitable for these microcontrollers.
Hi madaxe_again,

I work at AWS (npinguy does not to the best of my knowledge). If you've spent $8,000 on maintaining instances you wouldn't have running otherwise to reproduce a bug on our behest, we don't want you to have to pay for that. I'd like to look into getting a refund for you. Is there an email address I can reach you at to get more details on the situation?
system() calls /bin/sh for you. If /bin/sh is linked to /bin/bash (a common thing), then it's exploitable.

Under the hood, system("echo foo") does a fork, and in the child process does execv(["/bin/sh", "-c", "echo", "foo"], env...)
You're right, of course. Exploitable weaknesses in busybox are going to be killer - I think shellshock will turn out to be the start of something really big.

But, to clarify for others, the existing shellshock PoC doesn't work on the busybox environment I tested (v1.20.2).
I didn't say it was. I merely said he had enough luck for his strengths to outweigh his faults.
4 Steps to Chimney Leak Repair – All Roofing Solutions, DE/PA Roofer
This is not an "academic study". No institutional review board of a university would approve this.
Show HN: Navilytics – Visitor recordings, heatmaps, form analytics for websites