skysight-inc/HackerNews huggingface dataset:
You know, this whole thing would be a lot clearer to everyone if the following would be clearly communicated:

Are you running sshd with ForceCommand? - Get Patching (when a patch is out)

Are you running a webserver that uses 'old style' CGI (are you really sure you're not?) - Get Patching (when a patch is out)

Are you absolutely sure neither of the above is true? Then patch bash in your next patch cycle.

The super-hype vulnerabilities are getting is just muddying the waters when trying to get actual information.
That's just the start. Once people start hitting cpanel servers:

http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...
Assuming yours is the only page he is working on. He really might have dozens of projects going at the same time.
I have some more specific feedback. Some of this might already be in your app but I don't have an iphone, like about 90% of movie watchers. :P

- a kids movie option

- amazon/itunes affiliate links

- chromecast integration, maybe netflix but I think I read they killed their API so I don't know what's doable there

- recommendations based on what's on tv, then you're making something a billion people could use not just the ones who stream movies

- Reddit-powered recommendations would be great too + help drive downloads if you can tap that community, doesn't even need to be a recommendation could just be a list of recommended stuff

I'd also ditch the pricing, every single recommendation can make you money so charging for it is probably going to lose you money overall.

Then when you get this perfect do the same thing for tv shows, movies, books and games!
When it comes to programming language reviews I don't think there is any value in them regardless of who is doing the review. Steve Yegge in one of his epic posts explains why everyone should design a language from scratch to see what the process is like. Once you do that the magic and wonder disappears and you realize both how hard and easy it can be depending on what constraints you have. Here's a nice starting point http://nathansuniversity.com/.
Is there any particular reason why gender listed the way it is?
within their datacenter?
Wtf? Do you have any idea how big AWS is?
My comment was in the context of the "unit tests vs type systems" debate. It was meant to illustrate my opinion that "more general" is better than "specific values" when testing, as much as is practically possible.

I'm aware that addition is a toy example, but suppose we want to test our implementation:

Except for very simple verification, to exclude obviously broken implementations, I'd rule out testing specific values such as 3+4=7. And, like you said, performing an exhaustive exploration of all values is out of the question.

So I'd try property testing instead. Relevant properties in this case are associativity, commutativity, etc.

As an example, I'd try writing properties such as:

for all X, Y: add(X, Y) = add(Y, X)

I'm not arguing that everything can be tested like this, or that the properties are always easy to formulate; but when they are, I think this is the superior approach.

The tools that I'm aware of that can do this (such as QuickCheck or ScalaCheck) come from statically typed languages, though I don't see why they couldn't be used with dynamically typed languages.

The point is that this starts to look a lot closer to static typing and "testing generalities", philosophically, than what proponents of dynamic typing + unit testing propose. Testing generalities is better than testing specifics, because it's at least a step closer to a proof of correctness.
I manage it by having an asston of personal projects I never have time to properly finish. There's always more to be done than time to do it.
Absolutely, I personally think it's one of the best things about the country.

After living and working for a year and a half in the US, and 7 years in Canada, I've seen first hand the impact of charging for university, and how it impacts people lives for decades.

I met tons of people that chose not to go to university simply because they couldn't afford it. I was shocked and saddened that happens in developed countries.

I have tons of 30-something friends that are still paying interest only on their student loans, and it's crippling their life choices.

I really hope we can kick Abbott out before he does much more damage.

Are people in Australia seriously talking about getting him removed? Does anyone even know what the process is in Australia to remove a Prime Minister?
Honestly, when a work problem is too annoying, I open a new tab and go to one of about 4 sites, HN being one.

I stop when I notice I'm doing it, but it's often reflexive. I'm giving my brain a little hit of endorphins to offset an annoying real-life problem. This cycle could easily end up vicious.

Now, pardon me, I need to go back and deal with that bug.

Edit I'm kind of glad Google Reader closed down, because I was spending too much time "keeping up with things" and not enough time "getting things done."
I'm interested in Thiel's upcoming lecture. It seems like there has been a hard shift from "move fast/lean/mvp/pivot" to "make a monopoly". Economically speaking, it is accurate. Hopefully it will motivate people to go after problems previously taboo, ie healthcare, education, finance etc, and less about messaging and photo apps. Our world may depend on it.
I found that curious, as well, and think another commenter's suggestion makes the most sense. EDIT: As opposed to robo-detectors that ask seemingly-nonsensical questions such as, "Are you a human?"

spindritf 32 minutes ago
Maybe as a way to mark people who didn't treat it very seriously?

https://news.ycombinator.com/item?id=8367812
Pretty sure you're trolling, but just in case: http://en.wikipedia.org/wiki/United_States_antitrust_law
Do you think that anyone who runs a large software company is a turd?
okay after more tests on the latest version of win-bash I can confirm that it is vulnerable.
Cat is a dumb option. That being said, the list order seems randomized.
I can definitely see feelings overriding an opportunity for thought. Personally, I have never bought a lottery ticket. I always wear a bike helmet or a seatbelt. I don't really feel anything about these issues. It just makes sense to do or not do them. I could see myself buying lottery tickets if there was a mathematical argument for doing so, as is the case in some lotteries where if you buy a certain number of tickets you are pretty much guaranteed a win, but not in any other case.

If I'm picking something to eat, however, there's definitely an emotional component in addition to the nutrition. I won't just optimize for nutrition. Maybe I'm just the same as the lottery ticket people, but I have different priorities. An emotional attachment to making rational decisions maybe. If that's the case, could a person override irrational emotions with more powerful emotional impulses toward rationality? It would come back to a cultural issue in that case.
Public Beta of Mac OS X Yosemite Now Available
Are the API and app not separate deploys?
Thanks! I've been researching, but it's always good to hear from a hands-on real-world user.
> You can tell who is an entrepreneur and who isn't by those who talk shit about Larry and Oracle.

There is room for a variety of entrepreneurial styles. In economics as in a natural ecosystem, there is room for an astounding variety of survival strategies.

The Disney movie "The Lion King" just isn't referenced enough on HN. Your comment is roughly equivalent to saying "You can tell who is a successful species on the savannah by those who talk shit about Mufasa." The truth is that apex predators like lions are very cool, but, by biomass and evolutionary longevity not nearly the most successful animals in any ecosystem.

And, uniquely to humans, there is a meta-game, wherein what we say about the world influences the world. This effect is so strong that we can indeed redefine what success means with our words. Success in nature is, unambiguously, survival. Live long enough to reproduce, die happy. But we humans can and often do alter this definition. And we do it in economics as well. The traditional definition of capitalist success is (to paraphrase) "die a billionaire". That's a valid definition, and I wouldn't take it away from anyone, but realize there are other valid choices who's existence doesn't affect the validity of Larry's credo.

I would argue that the problem with that definition is the fact that success has to be personally attributable value. Money is, in the end, just a kind of primordial "like". Larry has amassed billions of "likes". But how much more value could he have created had he not worried so much about localizing the rewards?

I'm glad you want to be an apex predator, but I don't think you'll get very far by insisting that the world only needs (or would only benefit from having) apex predators.
> It affects most unpatched bash instances

But it needs something to expose bash to the outside world. Without mod_cgi (or the like) or sshd with a specific configuration, a vulnerable bash isn't going to be remotely exploitable.
One of the conjectures, regarding the freedom to roam in Norway, Sweden, etc., is based on the observation that these lands never had serfdom. It may be that your intuition is based on feudal principles, echoing a feudal lord's objection to the monarch's control.

While an enticing conjecture, I suspect the relative population sparsity of those countries, where property damages of the right to roam are within the capacity of the land to handle, is a greater reason.

Examples involving consumable or personal goods, like a car or bottle of vodka, don't have the same capacity.

As a related example, in Minnesota and likely elsewhere, boaters may use the lake surface even though the lake bottom is jointly owned by all of the landowners surrounding the lake. (See http://files.dnr.state.mn.us/publications/waters/Pardon_Me_M... .)
After the first dotcom bubble just the opposite was praised arguably to the extreme. The answer is somewhere in the middle - focusing on profit from day 1 can stop you from doing things, but taking VC money from day 1 with no plan for revenue is also potentially fatal.
What is boredom to someone who meditates?
Not all entrepreneurs are trying to build super valuable companies anymore. I am trying to build a super valuable developer ecosystem to be a part of. Watsi is trying to build a super valuable nonprofit health insurance network.

There's also reason to believe that being central in such a structure, one you do not own or control, is actually a good strategy for building a super valuable company.

And using different strategic framework can be a competetive advantage. It's harder for a competitor to destroy you completely if they don't understand your support system as well as you do. Doubly so if the framework you are using turns out to be ascendant regionally or globally.
You misunderstand money.

Step by step:

- Government charges people taxes.

- Government uses tax money to pay scientists and equipment.

- Government makes tax-over-tax profits by charging taxes again on scientists salaries (which were already paid with tax money, but now will be charged tax again) and on equipment purchases (sales tax will be charged on equipment that is already being bought with tax money). Everything the scientists spend their income on will also be taxed again.

This is just a ruse so government makes more money. It fools people every time.
> I don't think either you or the author are correct.

This is out of date, but I can't edit my comment anymore.

Carry on. :)
Modern Trends in UX That Ruin Usability
I'm confused by this vuln report and all the attention.

If I don't run any CGI thing and I don't expose SSH without pubkey and only to trusted users, what is there for me to worry about?
> Why would google not promote its own services first and foremost?

Same reason why it was wrong for Microsoft to put Internet Explorer and later Windows Media Player in Windows: It is anti-competitive for a monopoly to utilise its market position to gain an edge into other market.

https://en.wikipedia.org/wiki/European_Union_Microsoft_compe...

> further advance their products would be ignorant

I think you meant "foolish." The word "Ignorant" doesn't work in that context.

Ignorant:

1) lacking knowledge or awareness in general; uneducated or unsophisticated
2) lacking knowledge, information, or awareness about something in particular

More "foolish" or "misguided" in that context.
Bring back Google discussion search
It is not just CGI. It is any process that uses user-controlled environment variables anywhere, that later eventually happens to call something that calls something that calls system() or executes a shell script.

So CUPS printer servers at universities may be vulnerable. Dhclient may be vulnerable to malicious DHCP responses. Anything that calls out may be vulnerable (lots of mail libraries actually call /usr/bin/sendmail or the like; better hope they don't use system() or a bash /bin/sh to do it).

This is a big deal because there's a ton of stuff that uses environment variables that is and is not a web server, and very little time to track it all down before a black hat or oppressive regime gets there first.
Is this different from the previous beta? OS X Yosemite has been available for a while now...
Did those guys reinvent personal communication??
RxISK.org  – No one knows a drug’s side effects like the person taking it
The 10 Skills You Need to Work on Growth
Yesterday my Facebook newsfeed blew up with non-tech friends posting about Ello. No-one is signing up because it works better, they just all want out of Facebook.

I don't know if Ello will take off, but there is definitely a massive demand for "anything but Facebook".
You can’t pick up these skills in a classroom or by reading a few blog posts.
People who work on growth have an inner hunger to combine data and creativity. They can’t be pinned down and defined by traditional business.
They sit at the intersection of your marketing, product and data science teams.

Read more: http://www.referralsaasquatch.com/must-read-tactics-for-cust...
I don't think boredom is the same that having nothing to do.
It's amazing how early and correct he was on what we now take for granted in databases: portable, networked, declarative, and relational.
The number of Facebook app invites I get daily tells me the average social network user understands the concept of invites. It's another step to get them to sign up for a social network, but I've already had people asking me for invites, and they follow through to the signup.
http://www.logointerpreter.com
It wasn't from scratch, it was from ECL. And did you mean Azul?
Technical Architecture in Banking and Gaming
Was the previous beta only available to people with Apple developer accounts?
That's a misunderstanding of the Microsoft situation. The antitrust issue in that case was tying: http://en.wikipedia.org/wiki/Tying_(commerce)

With the notable exception of Google+ (which has now been relaxed), signing up for one google service did not force you into any other google service or product. You can access any google property on IE or other browsers. There is no anti-competitive compulsion in the way that Microsoft forces IE upon windows customers.
If you start 10 seconds earlier, you'll see that she's not talking about ordering the "search results", but about the extra information added to some searches. Stock quotes, maps, calculator and stuff.
Thanks, I did not know about that kind of worms or about the Welchia worm.
Personally, I am not a big fan of putting more acl/config/monitor requirements to the shell. New features add complexity, possible bugs and hacking vectors.

Prefer just simply "git add /{etc,bin,sbin,lib} /usr/{bin,sbin,lib} ... && git commit "

And daily cron jobs run a "git status" would give me some idea, trigger and confident if someone have "hack into" the server.
I have a small python library that does this for stock Arduino boards: https://github.com/thearn/Python-Arduino-Command-API

Not quite as cool as the micro python boards though!
No. There is a Developer Preview, and a Public Beta. Both have been around for a while. Old news.
No. This is the same Beta Program that has been available for a few weeks now.
"Obliterating the competition is one of them" is not a goal or motive, but a tactic used to achieve a goal.

I think it's a stretch to assert that Ellison started in business solely to "obliterate" his competitors.
The governor general can fire the government.
> The tools that I'm aware of that can do this (such as QuickCheck or ScalaCheck) come from statically typed languages, though I don't see why they couldn't be used with dynamically typed languages.

The tools use type information to determine the universe to draw test values from and the mechanism used to do it. You can actually do something very similar for dynamically typed languages, but if you don't have queryable type annotations for parameters, etc., you have to have more verbose test specifications that provide the scope of testing.

E.g., in a statically-typed language (or a dynamically-typed one with optional type annotations), if your add function is defined as something equivalent to:

double add(double x, double y)
{
...
}

then your test system can use that information and a value generator function for doubles to generate the appropriate test data to validate the property.

OTOH, in a dynamically typed langage where you just have something like

def add(x, y)
{
...
}

Without some additional specification, the test framework doesn't know how to generate the X and Y values for the test you propose.
A beta of OS X Yosemite has been available for a couple of months to people who previously registered interest.
yeah that annoying popup they had whenever you went to the google homepage from firefox.
Ask HN: Is a side business good or bad when job searching?
I'm graduating soon, and will be looking for a job as a junior developer, ideally at a startup or a small-ish company. I'm also trying to start a two-man bootstrapped business on the side, which I expect will remain an evenings-and-weekends thing for at least a few years.

When applying for jobs in startups, should I tell them that I have another business? On the one hand, it's business experience, and shows I can work independently. On the other, employers might think that I'd put less energy into my work for them, have divided loyalties, or be more likely to quit. What do startup founders (and HR people at late-stage startups) usually think of employees who have profitable side projects?

(In case it matters - we're selling a customized physical product, and my partner will do the building, shipping and customer support, while I'll do the website and marketing. My partner works another job part-time, and might quit once we're ramen-profitable. We've discussed that I'll have less time to devote to the business than he will, and we're both ok with that.)
I don't see how. Being a blub language has nothing to do with ease of use for newcomers and in fact no language can be a blub language. It is more a reflection of the user. If all I know is imperative programming constructs because I've been writing C for 20 years and I start to learn Prolog but fail to understand what constraint logic programming is really about because I'm constantly trying to use imperative constructs in Prolog then I'm afflicted with the blub disease. Neither C nor Prolog is a blub language.
The name is already taken unfortunately:
http://www.cs.uni-potsdam.de/clasp/

Package: clasp
Version: 3.1.0-1
Description-en: conflict-driven nogood learning answer set solver
clasp is an answer set solver for (extended) normal logic
programs.
Ask anyone who worked on Sun or MySQL whether they think Oracle has been a good steward, even compared to a volunteer-run foundation after the initial sponsor went bankrupt. For example, let's see what Sun's Bryan Cantrill had to say.

https://www.youtube.com/watch?v=-zRN7XLCRhc

No, Oracle isn't a steward. At best they're just using those projects at cash cows. At worst they intended to destroy their erstwhile competitors instead of trying to outdo them. What they are most definitely not doing is devoting the resources necessary to improve or even maintain the health of those projects or their communities.

As for contributions to Linux, here are some figures.

http://arstechnica.com/information-technology/2013/09/google...

Oracle doesn't even crack the top ten (none/unknown/consultant don't count). For a company that makes so much revenue selling open-source-based products, such as repackaging Red Hat's work and selling against them, 1.3% is a pretty paltry figure. What's really sad is that they contribute even less to anything else, from the Apache or OpenStack foundations down to the zillions of smaller independent projects. Just about the only comparable company with less open-source visibility is Amazon.

Lastly, don't think I or others can't see how your claims keep getting changed or reduced as you're proven wrong again and again. First it was about startups not valuing collaboration, then about Oracle producing more useful open source, then about being a good steward of the open source they've acquired . . . and even that isn't true. What's next? Saying we should still worship Larry because (as far as we know) he hasn't actually killed any babies for three whole months? Stop fawning and learn about the topic.
My favourites are still http://work.sweden.se/ and https://www.gov.uk/, both of which are pretty usable seeming. :)
Are you certain that no process on your system ever sets an environment variable to a user-controlled value? Get patching.

Hypothetical: some GPG library is just a wrapper around /usr/bin/gpg. Maybe that library uses an environment variable to set a password that doesn't show up in ps. Maybe that library used system() instead of execve(). That password is now an attack vector.

See also /usr/bin/mail called by mail() functions in scripting languages, /bin/hostname, /bin/uname, etc. If any user-controlled variable is set in the environment, those calls become potential attack vectors
Ugh I wish this worked. I can't get the cli or grunt plugin to install. My current scss builds on save take WAAAAAY too long. This would save my workflow
Invite only. The first profile I see on their homepage is https://ello.co/bitchesonbicycles with 2392 followers. I guess I don't want to be invited.
In moments I used to be bored as a kid I now have something to think about (about work, side-projects, internet comments, books etc.) or have an internet enabled device that shows me something interesting. I might be forced to be bored, for example when I have to watch a boring film, play a boring game or read a boring text, but I guess that's not what they are asking about.
Becoming a manager is not getting promoted. It is a career change. Approach it the same way.