skysight-inc/HackerNews huggingface dataset:
My statement is entirely irrelevant to this topic but I sacrifice Karma because I think it is important that this person not be able to get away from his statements on Snowden. He entirely ignores policy discussions that may have lead to Snowden, placing all blame on Snowden for the potential impact of the NSA's actions on the wider IT industry. Please feel free to down vote me, it would be the logical conclusion.
Vertically integrated, yes. But monopoly?
There have been companies working on the Tricoder XPrize[1] who are trying to replicate the infamous Star Trek tricoder. I personally think it will beat out on cost versus something like the HealthSpot, but I know nothing about what the market wants/will use/will pay for in the future. I do know one thing though, these guys seem well connected with some of the Old Guard and possibly Government to potentially have influence on rolling out pilot programs.
[1]http://tricorder.xprize.org/
The other side of that coin is the potential for creeps and the resulting sexual harassment of the massage therapists.
I think I'll take another shot at it. First time around, I got lost in the complexity and gave up after a day spent on exploring available actions and values to track.
It doesn't matter. If you find another shell that is vulnerable it's still a problem. Apparently it's only bash though.

sh will run whatever is pointed by the symlink. It's a good idea to try that than relying on bash being in its place and that an attacher hasn't masked it. Apache and other daemons will run sh, so that's what you want to try.
It does sound a little silly, I'm using the word "founder" or "startup founder" now, it can replace the word "entrepreneur" around 7 out of 10 times and people get it.
GitGo - Beautifully simple, only GIT!
i upvoted
Some would argue all the things he mentioned are growth activities. Employees are a vital resource... taking care of them can be valuable and can attract new talent as well
Well, in practice the broken generics stop large amounts of reasonable uses of generics, the lack of co/contravariance force you into hideous workarounds everywhere.

As for the promised runtime performance improvements they have yet to surface and worse: the language is still plagued by extremely uneven performance, even for optimized builds. I could go on at great length citing issues that will be hard to fix within the next year or so. Unfortunately. This is what my fairly hard won (15k loc of Swift code) experience with the language has revealed so far.

I can honestly say I really wish you were right.
"Companies that spend money on fancy offices..."

Start-ups actually do this? What's the value in a nice office when you are not established? Does it help to attract talent? Is it one of those everyone else does it things?
Most of the people who are going to be accepted to YC are 20-something kids from wealthy and connected families, or at least families with solid upper-middle-class financial status. They hardly have to worry about any of the things you listed.
Don't Google engineers, with, as we are so often reminded, all that grey matter shooting out of their ears (at such high velocity), have better things to do with their time, and their staggering intellectual prowess?

Like you know, fixing global warming? Analyzing Ebola mutations? That sort of thing.
> I just tried this in zsh 5.0.6

Do you mean that you run bash -c in zsh, or that you run zsh -c ?
Yeah, Stack is really interesting.
This was my first thought when I heard of the bash issue. Hopefully someone runs this with a noticeable payload (but not necessarily that malicious) to help wake people up.

OTOH, every single SIP stack I've tested is vulnerable to IP spoofing (due to the inane rules of SIP which make this attack very easy), yet IP auth is used extensively as the authentication system for wholesale VoIP traffic.

In addition, every VoIP system I've looked at as-a-whole has had all sorts of other vulnerabilities. Easy stuff, too, like "SQL injection on login form leading to full remote access to system". Vendors and customers pretty much don't seem to understand or care. One CTO of a successful SIP-based product said to me "Buffer overflows? That may be possible, but only if the network was very, very fast." His software handles many, many calls, had accidental remote backdoors, and is responsible for "securing" many many millions of dollars of telecom a month.

The telecom mindset seems wholly incapable of dealing with an environment such as the Internet.

But... end-user devices or "PBXes" have enough holes that attackers appear to be content to "smash-and-grab" for the most part. It doesn't seem like attackers are going after the "carriers" yet, although there's certainly enough money involved that someone stealing, say, 1% of a company's total volume would go unnoticed.
Show HN: Pine – OpenTable for Massages
Anybody try this with an iPhone? Not sure if bash is even installed on it.
It took several years around silicon valley for things to get interesting again. I think I became a better developer during that time because it forced me to do/learn things I might never have. Nevertheless, yes, it TOTALLY changed the kind of work many of us were doing at the time.
This thread has gotten way out of hand with the thought experiments that reveal more about the author than the subject... but I can't resist!

If it took 100 people to make/sell/distribute, and you are the owner of the company, you're probably going to still be rich. Figure 99 employees at $150k fully loaded annually would cost you 15 million dollars, leaving 55 million to retire on.

Of course, if you are an employee, you would only have a job for 1 year.
From what I gather watching the video, you only need the xlwing.bas module and the supporting VBA code if you plan to invoke python from within the Excel file. If you're only manipulating an Excel file with Python externally, which was covered in the beginning of the video, it doesn't appear you need the module and VBA code.
Don't stand corrected. The german word is Unternehmer which literally means "under-taker". This is probably not a coincidence and the french meaning is probably the same.
Except for the Windows only factor. Being able to code for all versions of Excel is useful.
Germane to the topic:

Century of Enslavement: The History of The Federal Reserve

http://m.youtube.com/watch?v=5IJeemTQ7Vk
Map caps lock to control and it gets a lot better.
Who has the time to read this much nonsense?
It's still a trademark and if they want to keep it they have to show they're willing to protect it, else they could lose it.
I really don't think it does. zsh doesn't load functions that way at all. Did you copy the bash command when you were testing by any chance?
I do agree valuations are artificially inflated, but before you start drawing parallels to 1999 and every financial bubble of years past remember there are companies with real revenue streams. Sure, there are the snapchat valuations which have no basis, but do uber, airbnb, dropbox, and the like not deserve billion dollar valuations?

Let's entertain the idea that we have another "catastrophic" event where every VC in the world wakes up to the realization that many of these companies are worthless. They can't liquidate their positions. The key idea here is that this is a private market. These startups can't go from $100 million -> $0 in a day. They will tighten their straps, let a few employees go, and extend that runway as long as they need to make revenue. IMHO the easy days will be over and now every founder will learn what its like to really run a startup - No more shots in the dark just because you can
So after listening to the entire show, I'd have to say she doesn't come across as being in the right at all.

The big showdown on whether Goldman had a conflicts of interest policy came down to a difference of opinion that she was clearly in the wrong on. Her boss's request to amend her statement to say that they had one but it was totally inadequate should have been an easy one to agree to. Especially if the Fed's legal department was the one objecting to saying there was no policy.

Instead she comes across as extremely stubborn and unable to compromise or see other viewpoints besides her own. I would have fired her too just because she was so difficult to work with.

Silva does seem spineless in going out of the way to not verbally offend Goldman, but IMO that is more of a personality trait that him ignoring evidence.

Now she's suing wanting to be vindicated that she was really right all along and everyone else was wrong, and releasing the tapes to support that. Not a Goldman fan, but for this report there is really no moral outrage to be had.
Please provide an example why a screw or removable panel would provide less value to the consumer than gluing the thing and making it impossible to replace the battery on your own. I eagerly await your response.
Entirely random. I know almost nothing about Louisiana, I've certainly never been there.
you listen to VCs about this because their whole job is to be sensitive to any risks to their investments, including systemic and idiosyncratic risk. they also have more breadth across the early venture market than most people. that said, they're guessing based on what they see, so it's not a perfect predictor. you're at least getting a glimpse of what they see via articles like this though.
> you make it sound like all the VCs got together and decided to make this happen. it's instead an artifact of the economic system we have. it's due to humans being involved, but not caused by individual humans.

"Your poor returns are an artifact of the economic system we have. The collapse in the value of your investments with our firm is due to humans being involved, but this was not caused by individual humans."

- Every hedge fund manager, mutual fund manager, venture capitalist

> the car analogy would be the waves of stop-and-go traffic on a congested freeway, which is caused by variances in reaction times of people.

I think the pusherman analogy is more apt: he who sells crack gets crackheads.
Samsung: Waiting in the wings
You took the bait.
Inventions like the Easy-Open pull tab [1] didn't seem like much at the time either, but the simplicity in the invention helping increase it's adoption. If an invention makes things easier for people, it's definitely worth investigating and potentially roll out to production.

[1]https://www.google.com/patents/US3391820
So Amazon may save the USPS. Interesting!
When I had to spend a large amount of intimate time with VBA I used to go to

http://www.cpearson.com/Excel/Topic.aspx

http://www.ozgrid.com/VBA/

Old websites but in my case I dealt with Office <= 2003
The woes of the average Joe
Let's take this to email.
And https://pinenow.com/

- https://news.ycombinator.com/item?id=8373501
Got to have a J.O.B
> I will note the author appears to have aesthetic reasons to reject creating a PDF/e-book/etc version of the book, despite people literally offering him money to do so

I am one of those that offered money to buy the ePub version of his book.

I think the root issue here can be found in this sentence: «If you can show me an e-book for­mat that gives me the same con­trol over ty­pog­ra­phy and lay­out that I can get in a web browser, I’ll con­sider it. As far as I know, it doesn’t exist.»

So the author thinks that the typography of the book is important in itself. I see his point, but nevertheless I find _the content_ more important than the presentation.

Also, the author uses the expression "con­trol over ty­pog­ra­phy and lay­out that I can get in a web browser". _A_ web browser? There are hundreds of possible web browser/OS combinations out there. For example, for the Windows users, the version of OS will drastically influence the way fonts are shown. In the ebook world, once you have tested with Kindle, iBooks and Kobo you have covered a huge share of users.

You can also see that the author is more interested in typography than HTML. He uses `<root><topic>bar</topic><root>` instead of `<h1>` and `<div class="subhead">foo</div>` instead of `<h2>`. So being able to perfectly control typography is paramount but publishing completely valid and meaningful HTML is not that important?
Fare Ladies
I guess the answer is pretty simple, they didn't want to have a slice of the app that would be irrelevant for half of their customers. Of course most people won't use the dozen features of the app anyway, but they could/might regardless of their sex/age/race/ etc. Introducing a sex specific feature makes a distinction. Maybe they could have done it so you'd chose for the male or female version of the health app or something like that, not saying that doing it well was impossible but it would require focus and dedication for this particular problem. Maybe we will see it coming in the future, who knows? But it was certainly not their focus at the release!
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
So assuming it's an online EC2 server LAMP stack with an empty cgi folder and a lone html page with hello world. Is that vulnerable to this exploit?
Probably not sufficient. The patient is still using it to guide medical decisions.

It would be worthwhile to speak to someone familiar with Canadian medical regulations.
So that when his dire warnings come true, he can tell you 'he told you so'... =)
It depends on the market conditions. VC funded startups are not a place where I think that really makes any sense. Most billion dollar startups haven't even been through an entire business cycle.

The VC market is not looking for consistent year over year 8% growth for the next 40 years. If they wanted that they would have bought index funds and told startups to fuck off.
Thanks but the search terms are not in the URL, so I guess monitorhook will not work. About the github repo, that's exactly why I asked here, I'm not good at that kinda stuff.

This is sorta public interest, I guess more than one person might be interested in monitoring new product releases before they're announced. Apple executes it well, but most companies don't. Products end up here months in advance of public announcement.
maybe(test).will be_success.on_my_machine

I can’t stop laughing right now. Well done boys, well done.
We've been working on this for the last few months and would appreciate feedback. Thanks!
Modern Kitchen Tools for the Laze
That's within an order of magnitude of lead!

Does lead flow?

The article dismisses it but only in a casual way.
On the contrary, it is well known that ObjC and related languages represent a different strain of OO than Java or C++. In fact, people has gone so far as to say that C++/Java don't really represent "real" OO at all.

It should be obvious that ObjC belongs to the Smalltalk linage, which is quite different from C++/Java. Unless you have understood why Smalltalk is still held in high regard, you haven't understood the language.
loved this rant :)
Yeah, not impressed. I think it sounds far more pretentious to refer to yourself as a CEO when you run a company of 5 people - that's always made me a bit uncomfortable. Entrepreneur denotes startup founder. Fair enough. It's more about tone, etc. than anything else. This reads a bit like hater rant.
That means that the server could of been vulnerable, but it didn't return that it was.
The game is full of in-group/out-group dynamics, but it really depends on players in the area.

I met people treating this game too seriously. People who turned Ingress into source of interpersonal dramas. I met people from the other team, who looked at me with angry eyes when we shaked hands. And then I met others; I stood there at 3 AM in the park surrounded by a family playing for the other team. The father was telling me interesting stories while at the same time his wife and kid were kicking my butt in-game. We had a good laugh and went our separate ways. I had a lot of friendly chat exchanges with "enemy" players.

Like with all competing groups - whether political, sports, business or videogame - hating is a choice. Play by the rules, steer away from people who seek excuses to hate others, have fun and remember that both sides are playing the same game.
You can see this limitation in the video, when generating 100^2 random numbers takes a while.
You weren't listening well then. She agreed to change her statement but said she couldn't agree professionally.
Pathshare – realtime location sharing – now with proximity notifications
Back to the Source: Why FOSS Is More Important Than Ever
Well, in that context, it makes sense that I would be downvoted!
I am a user and I do care. As there's no standard definition a package manager, I collected those as the basic and common features among 99.99% of the package manager in practical wide use today. And, obviously, I'm not alone in this either. Niche, maybe, but not really given a lot of development now happens on OS X. Homebrew, MacPorts, and Fink are nice, but nothing like yum or apt on Linux.
Updated! Thanks for that.
Could YOU crack this code to land yourself a job?
When the system you're testing replies with a '400 Bad request' (as mine do ;) ), you're probably in "safe" territory, no?
Just curious, which German podcasts do you listen to? I'm struggling to keep my German skills up, and while I have a handful of German podcasts, most of them are geared towards people learning German, not people who just want to hear the language as it is spoken.
Right, because engineers trained on mobile systems and mapping technology should just start "analyzing Ebola mutations". Might as well as why strong construction workers aren't helping "build infrastructure in the third world" instead of building condos for the rich.

Ingress is almost definitely an information-collection system to improve mapping technology and determine human walking paths/flow, similar to information we have on traffic on roads. (As well as whatever other benefits Google can mine out of this info.)
Doh, forgot to get back to the first point, sorry.

My thinking is that at this point the whole exporting functions (and anything else other that environment variables, like arrays) is just a bad idea in the default case. I actually do do it, but for a stupid reason and can totally see how I should just put those functions in bashrc for the same effect anyway.

So I really would like to see that all disabled by default in bash and a shellopt added to enable it if anyone really needed it.

I've heard about other ideas like prefix, suffix the name, or add a BASH_FOOBARBAZ that lists exported functions, but it's just not something most people do, and it would be a pita for the people that do need it now needing to change how they do it cause I can totally see people that made use of this having done it in C and perl knowing that if they did added to ENV 'cat=() { ...' or what not it would change what they needed in the subshell after they called system. That would really be annoying for those people to have all that break in a way they would need to change all that baroque code instead of just adding an option, something like system("exec /bin/bash --foobarbaz ... ") now.

Plus there are other programs like sudo that already know how to deal with the '() {' style env vars and clear them-out by default, people would have to update all those (plus what ever ancient suid C launcher programs they already had doing this kind of env var clean-up in their own broken ways from before the time sudo became the way to do this stuff) now too.
This is an older, more vulnerable version of BASH. Our script provides 4.3 with fixes, not 3.2
tried it, loved it. the mts are good but it must be hard for them to scale easily
And most importantly PR people to spin massive ad buys as organic growth.
I would say so yes. Have you tried the exploit cgi listed on the website to test?
Great service, super personal.
How many more times do we need to hear about Ello here, really?
If this is how passing functions is supposed to work in bash, then why do I get different results, depending on which system I'm on? I've been madly patching my systems since yesterday and on a RHEL 6.5 system I get a different result than from an Ubuntu 12.04 system:

[RHEL-6.5 tmp]$ uname -a
Linux hostname1 2.6.32-431.23.3.el6.x86_64 #1 SMP Wed Jul 16 06:12:23 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux
[RHEL-6.5 tmp]$ bash --version
GNU bash, version 4.1.2(1)-release (x86_64-redhat-linux-gnu)
[RHEL-6.5 tmp]$ ls
file1 file2 file3
[RHEL-6.5 tmp]$ env ls='() { echo vulnerable; }' bash -c ls
file1 file2 file3

Linux hostname2 3.8.0-44-generic #66~precise1-Ubuntu SMP Tue Jul 15 04:01:04 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
Ubuntu 12.04:~/tmp$ bash --version
GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu)
Ubuntu 12.04:~/tmp$ ls
file1 file2 file3
Ubuntu 12.04:~/tmp$ env ls='() { echo vulnerable; }' bash -c ls
vulnerable

Is this a basic difference in the feature sets of Bash 4.1 and Bash 4.2? Like several posters, I was unaware of this feature and have certainly never used it. Perhaps it should be off by defaults? How big of a mess would that make? I would also like to see more distributions use something other than bash as /bin/sh, but that's another discussion, I guess.
For what its worth I can relate to that. Recently my wife said "I'm going to go out and buy us some cake".

Two hours later she returned, happily bearing cake, and said "Yeah I got distracted hacking portals". She'd walked something like six miles.

She's certainly keen, and enjoys it, though I've never really seen the point of it myself.
Wow, that's a strong reaction. I had no idea the sides in Ingress had led to this. Perhaps Google will use it to illustrate the silliness in the "sides" available in politics.
It depends on how close together your customers are.

Let's say a driver makes $15/hour working an 8 hour shift, and Amazon's driver salary budget is $0.50 per parcel. Over the course of an 8 hour shift you need to deliver 240 parcels.

You can do that by making a delivery every 2 minutes, starting right at the depot - or by driving 2 hours, making a delivery every 1 minute for 4 hours, then driving 2 hours back to the depot. Or by driving 3 hours, making a delivery every 30 seconds for 2 hours, and driving 3 hours back.
The harsh winter in which you go back to making $120 K as a software engineer?

In tech winter is not white walkers, it's a week of rain.
The solution is simple: always treat each round of funding like it's the last money you'll ever get.
The Making of a Mortal Kombat Punching Bag (and Linux Flavoured Ice Cream)
Can somebody please post a TL;DR. I wish the author had.
The fact that the tv show Silicon Valley exists, as much as I love it, really shows that were in a big boom right now. It's starting to feel a lot like the dot com era again.
The script has been updated to bash 4.3.
There are lots of stories of SELinux saves out there now. This is one I saw just recently:

https://www.reddit.com/r/linux/comments/1xdokz/selinux_saved...

I myself have had several SELinux saves. It's definitely proven itself valuable as an additional security control.
definitely taking you up on this
This is exactly right. That's why I started MASSOLIT (www.massolit.io), which provides video lectures in the arts and humanities. It normally costs £5/month, but if you send me an e-mail (chris@massolit.io) I'd be happy to give you a couple of months for free...
From [1] "Linux ignores the setuid bit on all interpreted executables"

Not a vulnerability.
Home and cloud are mutually exclusive I think. Cool build though.
I'll have to set something up that actually uses cgi-bin.

However, my load-balancer would still kill the request, I suspect.

(EDIT: Sorry.. my point being; your site should probably class 400's as 'safe'?)
ha, I forgot one more point! The fact that I have export -f in my bashrc, broke the common later () { a=[><]\ style redirect IO parser exploit. I thought that was funny.