skysight-inc/HackerNews huggingface dataset:
Your site currently (2pm EST) lists two exploits, but omits a third variant which "Mitchell" posted in your site's comments 8 hours ago. I've tested two fully updated Ubuntu servers. Both are not vulnerable to the two exploits you posted, but both are vulnerable to the exploit listed in Mitchell's comment. I suggest you post Mitchell's variant prominently as well.

The two exploits you've posted:

1. env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

2. env X='() { (a)=>\' bash -c "echo date"; cat echo

The third variant Mitchell posted in his comment:

3. env -i X=' () { }; echo hello' bash -c 'date'

The systems I've tried these on both have been updated with "sudo apt-get update"; "sudo apt-get dist-upgrade".

The systems are:

A. Ubuntu 12.04.5 LTS, running Bash version 4.2.25(1)-release (x86_64-pc-linux-gnu)

B. Ubuntu 10.04.4 LTS, running version 4.1.5(1)-release (x86_64-pc-linux-gnu)
I just use asynchronous tests? Is there more to it?
I'm not the one you should be complaining to. You should take it up with the advertisers who fling so much crap at me that I finally threw up my hands and said "Enough!" If you're advertising, then you're running with that crowd, and while I'm sorry if I took a sandwich out of your child's hand, I'm not going to watch rotten teeth, fungal toes (as mentioned elsewhere here) and have myself tracked any more than I personally care to. It's all a continuum.

I don't think there's an RFC that describes how advertisements are supposed to work on the Internet or the Web. These are just something that people have piled on top, and they hope they make money. But there's no right to making money in any particular way.

I'm pretty sure that most of the sites I look at don't have ads on them. Unfortunately, I have to block all ads by default, because the few have ruined it for me. If I visited your site regularly, and your site prompted me to unblock so you could make money, I would do it. Until or unless I found your ads performing some kind of objectionable behavior, and then I would re-block, and maybe not visit again.

I am quite happy to have my visit blocked entirely because of my ad blocking. You should try that, if you need to keep your kid in sandwiches.

I do pay for some content. For example, I pay for New York Times online access. I also block there, and they've never complained to me about it.

I don't feel entitled to anything at all, except to tailor my Internet experience within the bounds of technology and whatever is allowed by site managers.
If tips are baked into everything they cease to be tips. I find tips are a good thing for services where much of the value is subjective. I like the convention that makes it normal for me to pay more money to a server who goes the extra mile (although I dislike the fact that their base pay can be so low if others don't play along). I love the cashless aspect of Uber, but I hate that tips are included when you reserve SuperShuttle ahead of time. The driver can be as rude and unhelpful as he or she wants, and I still give them "additional gratuity"? Doesn't make sense. It's just a disguise for a higher price.
Who's "we"? You need an about page.
On-the-fly survey for what I'm currently working on: http://utter.io/. Vote up if you have a server(s) at home which you are already virtualizing. I have 5 machines running OpenStack at the house.
Having worked at a few of Goldman's peer banks, I'd also throw in that sometimes the regulatory compliance is more expensive than the fine. I worked on a board level system for tracking regulatory compliance issues and there were hundreds at any given time.

As cynicalkane points out, these regulations are far more complex than "don't be bad." You don't know who's got an ax to grind to enforce a regulation this year that's been lax for years before. Plus, IT is not cheap, generating all the reports vs paying a $50K fine? Just pay the fine, but now you're an evil big bank. You'll get over it.
You are absolutely right about the invaluable experience of attending a university in person. However, there are less fortunate individuals that crave an education but can neither afford nor gain access to the university system. I am of course referring to both students inside and outside of the United States. There are absolutely elements that one cannot replicate online; however, given the choice between online education and none at all? Well, the choice seems painfully clear. I understand that you were not suggesting that online education is futile, and simply advocating the benefits of attending university on campus. I believe that it's important not just to look at where the two experiences are dissimilar, and the disadvantages of MOOC, but rather to also recognize the advantages MOOC offers to many, as the alternative to no education at all.
I wish someone would make the NASA site look less boring.
The average UPS driver is 120 deliveries per day.
http://www.wired.com/2013/06/ups-astronomical-math/

My mailman said he does something like 250 houses + a medical office complex. I expect getting up to the scale/density of UPS or USPS is going to be quite difficult.
I was confused about this one. It appears that it may be for systems only where an authorized server with admin rights is running. I'll have to read more to be sure.

Edit: Upon more reading from (https://www.google.com/patents/US7945947?dq=7,945,947&hl=en&...)

It appears to be non-specific, but an admin computer is needed.

[A] user-definable process is associated to the terminal services session. The user-definable process is selected so that the process can interact with the user connected to that terminal services session and can identify all the desktops registered in the terminal services session that the user-definable process is running in.

[...]

Again, by example, once a process has registered a low-level keyboard hook on a desktop, it is notified of all keystrokes that occur when the input for the keyboard would go to that desktop. Each Vista system prompt service process examines the keystrokes and if the user-definable key sequence (such as CTRL-F10) was pressed, the system performs the action of creating a command shell running as the LocalSystem account.
Is there a video of your presentation? I'm interested in watching it.
You do more than that but really the CA should handle alerts about expiring certificates. They have full knowledge of all certificates, and contact to the responsible party.
I read that and thought, "I didn't know goats were such good work animals!"
Hardly, however there are a few routines that only function properly on Linux, such as syslog(), one or two of the date formatting libs. The cause: these routines depend on system libraries for functionality which don't exist on Windows.
Flow Everyday
Show HN: Airtable, a real-time spreadsheet-database hybrid
I'm pretty sure the E5410s (or any Harpertown/Woodcrest processor) in a standard configuration use fully buffered (FB-DIMM) RAM, as opposed to unbuffered. Super cool that Dell did some trickery in the CS24-SC (apparently CS means "custom server") to bypass that obnoxious requirement.

EDIT: Apparently this family of servers use a bastardized chipset that doesn't require FB-DIMMs; nothing special on Dell's part.
Sure it's not illegal, but do you think it's ethical?

Do you think it's a thoughtful policy for Goldman Sachs?

I know if I were one of the M&A parties, I would irate to find out that the supposed advisor had a personal stake that could have influenced how things shook out.
Once something is massive and dense enough that light is unable to escape, isn't that the definition of a black hole?
>The advice to build a war chest is often quite pessimistic

I think cautious / sensible might be a better description. Few people look back regretting having too much money in the bank. As long as you can avoid blowing it on dumb stuff.
I wonder how this compares to datanitro
There is a Hamburg based startup called Protonet which are targeting smaller agencys with basically the formfactor you describe.

They offer a drop-in solution that acts as your wifi ap, provides everything from "local cloud" data storage to offering a complete groupware solution ontop of it. Thats why they are so expensive, but their potential customerbase is huge and they've got the product design in a good position.

(Not affiliated with protonet anyhow, just like the stuff they do.)
https://protonet.info/en/product/comparison/
I thought this was really interesting to read, because it hinted to me that with enough buy-in... that even a physically embedded and implemented standard can change if enough effort is put in. This gives me hope for some digital standards and updates
There's just something extra weird about the exuberant level of interest, shown by members of a certain set who (according to their carefully crafted image) are just way incredibly smarter than the rest of us, in projects so utterly trivial.
The context where ESR coined "Linus's Law" was one of describing how FLO development could be surprisingly effective. "Someone will see an easy way around any given issue" has nothing to do with "there will be no security critical bugs". Neither "secure" nor "security" appear in the section of CatB under discussion there, and they only appear in the wiki article in reference to separate supporting evidence in a security textbook.

I will grant that the longer formulation's phrasing of "almost every problem will be characterized quickly and the fix will be obvious to someone" could be interpreted as including obscure security issues, but 1) this could reasonably be part of (every - almost every), and 2) I think it is best to separate the finding of a bug from its characterization - the typical invisibility of security bugs from a functional standpoint certainly means that security audits and best practices are not appreciably less important for FLO software than proprietary software. Any effect of "many eyes" on security absent visibility should be expected to be marginal.

The biggest benefits from open source, from a security standpoint, are probably that it enables truly independent audit, and secondarily that it promotes coding as if your code will be published and scrutinized.
You are correct, the Fed has said they would be ending this policy sometime this year and they're on track to do that. How I understand it, the big news here is that they've changed their language about raising interest rates from "we'll do it sometime in the future" to "we're going to do it sometime soon".
Just tweeted about this last night:

1/ The data does not support that there is much of a start-up bubble - if you dig into Ernst & Young VC report: http://www.ey.com/Publication/vwLUAssets/EY_-_Venture_Capita...

2/ The seed glut has subsided & declining for a while across both enterprise + consumer segments, in # of deals, and total $ (page 32)

3/ Meanwhile, VC exits from acquisitions at an all time high, $32.8B from first half of 2014, compared to $43B all of 2013 (page 17)

4/ All numbers are USA btw. Same is true for VC IPO exits, first half of 2014 $5.1B vs $8.2B for entire 2013.

5/ For US seed investments median $ raised in enterprise seg was highest in 04&05 for the past 10y. Post-05, its consistently below $1M mark

6/ Median amounts raised is lower for Series A & B as well, in the US and have been dropping since 2008 - page 46.

7/ In conclusion, substantially more exit $$ and lower median $ in. No bubble. If your CEO is spending too much money, it's your problem.
Why not a spouse?
500 startups: live interviews on Product Hunt
Agreed. Heck, I cancelled my Amazon Prime subscription because of SmartPost. I don't do that much shopping online anyway, and the free two-day shipping was consistently actually 3-5 day shipping.
> languages which were designed for [untrusted input handling ]

Which languages would those be? There are a few languages with a concept of "taint" (Perl, Ruby), but I've never actually seen a language where everywhere untrusted input could come from actually starts tainted, and every secure function actually disallows tainted input. Especially where third-party-native-FFI library calls are involved.
Not only that, but it's going to ask for your sudo password too. No reason to be leary of that ;-)
I listen to Adam Carolla every day at work, I wish I had more money or I'd support the Aceman.
An MOOC for a subject is truly just a big wikipedia article. Text, video, audio resources curated by someone.

Hopefully MOOCs will eventually be similar to epub books; open format, meta data, a collection of digital objects.
To the left of Impossible
I think you're trying to solve a non-problem since the company that sells the certificates warns you (sometimes even more than those intervals), afterall, they want you to renew as well.
As for checking for quality, that should be the sys admin task or the webmaster.
good luck though!
and a false one, at that.
Beer App Is the Yo Clone You've Been Waiting For
The Tiny Wireless Earbuds of the Future Are Made Possible by Software
Speaking specifically about Excel, the most important thing to learn is the Range object, no matter what book you're using:

http://msdn.microsoft.com/en-us/library/office/ff838238%28v=...

Close behind are Collections and UDTs. The best thing to level up after you're comfortable is with 'Implements' for interfaces.

I found that search engines are as good as any book for this stuff. It's smeared all over the internet.

The best place I know of to get a good understanding is http://www.cpearson.com/excel/MainPage.aspx, but it's not a tutorial.

edit: that's what I get for keeping this window open too long:) That's 2 votes for cpearson.com.
If you have any specific questions about VBA feel free to contact me. I spent a couple of years on macros in various contexts and still have loads of links. (I second the links already posted)
Agree with you and the OP, for me I always work with these servers (or am supposed to with my cloud research), and wanted to toy around with one on my own.

The noise of the CS24-SC actually isn't so bad (as others report).

The power is 400W, less pulled when the whole system is idled. So not horrible.

We do not run 24/7, this isn't being used as a traditional server.

We turn it on to manipulate large VM images (my case), or to run an algorithm that needs a lot of RAM and cores (her case).

So it runs at most 8-10 hours, 2-4 times a week.
I tried collecting all the tech podcasts I know about here: https://podcasts.techendo.com/

Does anyone have a more extensive list I can pull in, or know of any more that aren't already on the list I've built?
> In conclusion, substantially more exit $$ and lower median $ in.

That's a bizarre way of defining a bubble.
There are still some seriously annoying gauge incompatibilities in the world. The biggest one is that Russia and the CIS states use a metric gauge, incompatible with both Western Europe and China. The UK and Europe still use crappy link and pin couplers from the 19th century on freight equipment, which is just insane at this late date. Somebody has to climb in between cars to couple them, and car and train sizes are limited because the coupler design is weaker than the US AAR coupler or Russian couplers.
I do cloud research.

I modify the hypervisor.

I do things that no cloud in the world can do.
Does the ISA matter a lot these days? If we look at the mobile world, specifically Android, most programs are written in Java. So, as long as the compiler, the OS, and the JVM are ported to a new ISA, most apps will run happily.

Also, is binary ISA translation restricted by patents?
That's not quite true.

I created RSpec (in early 2005) to draw people's attention away from the word "test" because it was a huge hangup while I was teaching TDD. I kept hearing "You can't test something that doesn't exist, therefore your entire idea is bunk." I wanted to introduce TDD to people without ever using the word "test", and then switch them to using xUnit instead.

Not a joke, but I guess you could reasonably describe RSpec as a tool for performing a good old fashioned bait and switch. In a classroom. (I never intended for it to be used outside of a classroom setting.)

Around the time I was looking for ways to "teach TDD without using the word", Aslak Hellesøy introduced me to Dan North's ideas of Behaviour Driven Development. That's where the word "should" came from. I don't know if it was actually Aslak or Dan (or possibly even Liz Keogh) that first used the word "should", but that wasn't my idea.

Also, I'll point out that mixing #should onto Object wasn't my fault. The original syntax looked very close to the expect().to() syntax of today. It was actually assert(foo).does_equal(bar) at one point, and this was the syntax I was most fond of. I tried dozens of different combinations. "#should" was one of many, and I didn't like it. It got released this way because I was talked into it after that variant was demonstrated (by someone else) to a positive audience.

People liked it. RSpec took off. Whoops.

I later said on twitter, jokingly, that RSpec was a huge troll. That was kind of a joke on a joke. RSpec wasn't a joke, but I didn't build it for actual use. That was a happy accident. That said, it's a great tool these days, if a bit heavy. And it has certainly served my original wish of teaching many people TDD very well.

My $0.02 on the "maybe" syntax: if you need this, I suspect your problems are a lot larger than whether or not an assertion will pass or fail. It's symptom solving.
Consider that it makes Dan's job easier. (And it is a hard job.) Evaluating the question, "Is the normal title for this article too generic and is the user-created title not sensationalistic and is the user-created title accurate?" is much more taxing than "Does the submission title match the article?" It also requires more judgement, which people will sometimes disagree with.

Sometimes it's just easier to have simple rules; there's less surface area for judgement. If there's a particular part of the article that you find interesting, and you want to point it out, then comment on the submission after submitting it.
Mine are more like 8k RPM. And if you have a room to isolate them in, it's not so bad (watch temps!).
> Has the direction of causality been established here?

Immediately after the sentence you quote is the answer to your question: "This could be the result of many other factors"

The other factor you suggest is certainly plausible.
"how come everyone isn't exactly like me? it's easy for me!"
So you believe I can buy 24 GB of non-ECC RAM for less than $30 ?
I'd like to thank Jesse Cooke for pointing me at this. The history of RSpec is something that's often misunderstood by many folks.
You seem to be committing Systemd Logical Fallacy #12: "The Linux kernel is complex, and you use the Linux kernel, therefore you are okay with systemd being complex too"

Full list of fallacies: http://judecnelson.blogspot.com/2014/09/systemd-biggest-fall...
Cool idea. I had the same idea back when Heartbleed was in full swing. Nice to see that someone has actually executed the idea. Bravo!
> No VC will ever say they invested in a company "so they can blow it". They invest so the company can spend on marketing/distribution, product, etc. Not on just-for-fun items.

They'll call it "Recruitment and Retention"
Great idea, will certainly give it a try.

Not a big fan of pricing plans that mix volume with features, always makes me feel I'm being screwed when I only need one or the other. (Even though I might be perfectly fine with paying the same amount if the pricing structure was different.)
Disagree. While the taxpayers funded it, the taxpayers also get the benefit from others paying for it. Charging for the tech gives them information about what others find valuable, so is an important signal as to where they should spend their research time.
Precisely, thanks for reading.

And technically I use it as a mini-cloud for cloud research.

I modify hypervisors and do things no cloud in the world can :-)
I run a customized hypervisor for cloud research.

I do things no cloud in the world can currently do.

My use case is not a NAS :-)
If there is a marketplace then it's value will be determined by that market. If people can move into apartments and can be interviewed for it, the same could apply here. Obviously, I haven't thought this out completely and naturally there are all sorts of complications, but in reality, the question is - why can't people freely migrate from country to country? Naturally there are costs involved, a legal bearing, maybe even a quarantine timeline, but it should be possible. People did that all the time until the 20th century and therefore, it's an artificial barrier that's been put up.
It's not horrible, sounds like a blow drier on low setting when idling.
I'm pretty interested in seeing how this will end up too.
Chris: you need to identify yourself if you're going to push your viewpoint here. You're the only author of a controversial blog post that's pushing what I'll gently describe as an interesting theory - not a casual HN observer just bringing up some talking points. If I hadn't caught your CAP theorem quote ("solve the CAP theorem", wha?) and the Nanex reference, I would have missed this and not drilled down to your user details.

Next time, feel free to add a </disclaimer> of some sort.

I'm not an outsider unless you've got one intense No True Scotsmen definition of the word, and I'll leave it at that. Let's just agree to disagree, and I'll say that you are certainly entitled to your opinion. Thank God, it's a free country and a free market :) Good luck.
The NSA has its own small fab, and they are definitely into manufacturing techniques, because they build their own architectures :)
This guy uses 400W, less at idle.

If I could find a cheap desktop with 24-32 GB RAM (again, also cheap, like $60 cheap), than that would be an option.
$300 for the server, $50 a month to power that heater.
Technology revolution in nuclear power could slash costs below coal
I was looking for the 'secret' sauce used to get python being able to interact with Excel:
http://showmedo.com/videotutorials/video?name=2190010&fromSe...

However, I still haven't looked how the reverse is done (by xlwings.bas in Excel). Is it that XLWings also implments a COM server from which VBA can run Python?
Fixed. Sorry, I was hosting them myself and keeping them hi-res for the magazine.

ACM is fixing something at their end to host them, and at the smaller size.
What if they just sit on the patents though?

I'm still waiting for my Mosquito Laser (http://en.wikipedia.org/wiki/Mosquito_laser).
Au contraire.

See the cloudlets concept: http://elijah.cs.cmu.edu/
One of their offering under technology is converting computer programs with loops to ones without loops. Can anyone help me understand what the point of that is?
Can't believe no one mentioned this sooner. This should be called uber skanky.
> The goal of a startup is to make money, not raising money. the SV scene seems to be concentrating on the latter since its influenced & guided completely by venture capitalists and their interests instead of market opportunities.

I see it as a protocol to reduce uncertainty and expect more protocols (appcoins? kickstarters?) to arise. You know that the next carrot in front of you is going to an accelerator, then raise more money (repeat), then get acquired, get profitable, go public, or simply die.
Maybe it's just me, but I fail to see reason in your reasoning.

There are other ways to find out the what is important, ways that are less prone to errors, ESPECIALLY for research...