skysight-inc/HackerNews huggingface dataset:
This is wrong on numerous levels. For starters, such a service would be materially inferior to what Uber is providing. The payment mechanism is almost irrelevant. What you describe would not be any more legal nor much harder to police. And you drastically overstate the commodity nature of the service (in fact, it's a winner take most/all scenario).
Apache will pass data via more secure means unless you explicitly use mod_cgi, which happens to have an interface that requires that the data is passed via the environment.

If you don't want random person on the internet to be able to set shell variables, either don't enable mod_cgi, or don't use CGI's written in a shell script.
No, the problem with style A and B is that smallFunction() might have only been correct under the context of it executing inside largeFunctionA(). IMO this risk is actually increasing even more if it originates from a refactoring from style C, since you didn't design smallFunction() from bottom up considering all possible use cases, you most likely just highlighted a random block in largeFunctionA() because it was getting too big and clicked "extract method" in your IDE.

Imagine two months later someone writing largeFunctionB() is browsing around the code and finds smallFunction(), thinking it will do the job he requires but actually it has a hidden bug that was never triggered under the context of it executing in largeFunctionA or under the limited input range that largeFunctionA was using.

See in particular this paragraph from the article:

Besides awareness of the actual code being executed, inlining functions also
has the benefit of not making it possible to call the function from other
places. That sounds ridiculous, but there is a point to it. As a codebase grows
over years of use, there will be lots of opportunities to take a shortcut and
just call a function that does only the work you think needs to be done. There
might be a FullUpdate() function that calls PartialUpdateA(), and
PartialUpdateB(), but in some particular case you may realize (or think) that
you only need to do PartialUpdateB(), and you are being efficient by avoiding
the other work. Lots and lots of bugs stem from this. Most bugs are a result
of the execution state not being exactly what you think it is.
Employees Are the “weakest Link”:Data Breaches Hit Nearly Half of US Companies
> I think this actively demonstrates that societal sexism might not the reason for more women not being interested and working in technology

I don't really agree. What I understood from the article was that, in the past, when programming was marketed as a women's job, it was mostly women doing it, whereas now, when it's stereotyped as a male job, it's mostly men doing it.
Go generate is for package authors, at which point you check the results into your repo. Then anyone else can go get your package as a dependency and not need to regenerate that code. So, yes.
I like ello. Looking forward to it. Looks clean and simple. There's room for this sort of thing out there I think.
Fashion is more than just clothes. If everyone you know is on FB, then not being on Fb is like being the only person in a room without a purple hat on. You stand out. You end up being the only person that your buds have to call/text to talk to. People remember the exceptions. It's not always a statement, true, but it is noticed.
GCSS – Pure Go CSS Preprocessor
The one major one I found was the DHCP vulnerability; if you use ifupdown and configure and interface via DHCP, that uses dhclient, which invokes dhclient-script with attacker controlled variables. dhclient-script is explicitly written in bash, so is vulnerable.

I've tried doing explicit grepping for bash throughout various source code, but it's a lot of work to then trace back if that particular script is ever executed by some chain of commands that ultimately originated from something networked which sets environment variables to attacker controlled values.
The hardest lesson: How to take criticism constructively
Actually it's not really a big deal. You just put a header at the top that tells people not to hand modify it. Every C# winforms project already did that.

The nice thing is that you can diff the newly generated code versus the old code and make sure changes make sense.
I like this. Looking forward to it. Looks clean and simple. There's room for this sort of thing out there I think.
Aside: FB will likely buy out ello if it gets big enough, just like whatsap. I wonder what will happen when Fb runs out of cash to do competitive acquisitions like this? A bifurcation of social networks?
Remember the students start at 18, and many have not had these choices before. They can really benefit from having expectations clearly explained to them. Profs in first year are responsible for setting norms. This is not the same as babysitting - it's part of the students' education.

Not all 18 year olds make great decisions without some help.
It is an amazingly powerful bug. In what system can you plug a magic value ("() {") into a variable which everyone expects to hold static data, and have the value of the variable interpreted as code and executed spontaneously on invocation?

And: The magic value is undocumented.

And: Any instance in the entire tree of calls will do this.

Some of this is strictly on bash. But some of it also has to do with the environment feature of Unix, which is basically a god object with all the power and temptation ("look what we could get for free if we let it be a function!") that entails.
Apache doesn't have the option of using a socket for implementing the CGI spec. The spec specifies environment variables.

Apache could refuse to provide a mod_cgi, in which case it would never have gained the position it did, and some other server with support for CGI would have.
From Clouds to Roots: Performance Analysis at Netflix
Sounds interesting but I was immediately put off by the 1990's web design.
There's a lot of manual management of potential null-values. Which may be a good thing for app stability but is ugly in code. Currently you also get a lot of mysterious crashes and very often the debugger is useless when you do. So it's back to print statements to find errors. As the language and runtime matures this will be less the case.

Probably the biggest issue with Swift right now though is that it has to accommodate all the older Cocoa APIs so in practice it's often just a slightly nicer syntax for the same code. Cocoa functions tend to return untyped values or things like NSArray so you have to do a lot of manual casting, etc.
Totally agree, as a hobby eBay is fine.

I avoided these guys (and others like them) because of the premium cost on top.
This appears (to me) to be another good temporary fix for OS X:

http://apple.stackexchange.com/a/146851

It provides a one-step copy and paste into the terminal to download, patch and compile bash from apple.com and gnu.org.
It's not streaming per se but there's an asset manager similar to Rails' for Python: http://webassets.readthedocs.org/en/latest/
Someone else already pointed this out in my comments section. I'm working on an update.
In my opinion Java is the biggest fraud and waste in the history of IT (next comes SAP) - nothing but hype, ignorant parroting of silly memes by "managers" (so-called bandwagon and peer effects) lies, and taking advantage of ignorant.

People who "know no better" (cannot even visit the rosettacode.org, dismissed plain old C - these evil pointers!, Erlang - functional programming is for academy, or CL - not an enterprise level, etc, etc) are, well, brainwashed.

I am not blaming the people, I am just describing reality as I see it, and my view is by no means new or even "original".

Java was just a way to make money (in 2000s) like "derivatives traders" in the last 10 years. Same manipulations, same techniques.

For example, almost all of the very few popular apps I have installed on my Nexus4 are NDK apps - FB, Viber, Skype - you name it.
>"People should be able to curate their own content over time. To intentionally create their own filter bubble.

If I vote down a story that you voted up, your vote should count less in my rankings of stories. And vice versa. The same holds for comments."

I really like this suggestion and wanted to bring it out for those who may not read through the entire article. :)
I've had ton of issues with Magical Record once they started on 3.0.

These days I recommend
https://github.com/SugarRecord/SugarRecord
http://realm.io
and https://github.com/yapstudios/YapDatabase
I'm not as in love with Swift as I was when it first came out after having used it for some small hobby projects. I agree that it doesn't solve any of the big problems in software development, and more just amalgamates ideas from multiple languages (bringing them into the Cocoa world which is a good thing) and makes things safer.

However, a lot of Sinclair's arguments are misguided/misplaced/misdirected. Let me address each of his 4 core issues:

Databases & Persistence – This is almost certainly a library issue rather than a language issue. As others have pointed out, third party libraries solve this problem quite well on other platforms and there's no reason they can't be solved just as well with Swift. In fact isn't that kind've what Realm is doing?

Automated RESTful APIs - I don't think I even need to explain for the crowd here why this is a library issue and not a language issue.

Triggers & Responses – Swift actually has some rudimentary support for this in the form of Property Observers (didSet, willSet). These aren't useful for all of the same scenarios as KVO, but they're a start and I see this as an area that is clearly getting renewed attention with Swift.

UI Layout - How did he manage to criticize this issue so much and not mention Interface Builder? If you're primarily doing your layout in code, you're doing it wrong. I've been fighting AutoLayout a lot the last week, so I'm not in a mindset to give IB too much praise. AutoLayout in IB is still buggy and still has some ridiculous error messages, but I don't spend my days doing geometry calculations as he seems to imply. I'd like to see IB improvements, but again this is not a language issue.

So, it sounds like Sinclair mostly wants better libraries and better tools. Don't we all?
Slightly more precisely: /bin/sh on ubuntu points to Dash, which is substantially more minimal than bash. Probably not chosen for security (I imagine speed was on their mind), but good either way.
IBM Research: Brain-inspired Chip
Posted and killed by user flags a few months ago: https://news.ycombinator.com/item?id=7505685.
"the most recent way to exploit it is to export an environment variable of, say, ls to a bash function."

Even before the redhat patch you would need something to set echo=() { ... but how will an attacker do that when they can only set something like HTTP_USER_AGENT=() { ... ? See how overriding a builtin is not and never was a vulnerability?
You're right. I was quoting the overall height not just screen size.
Two days after this was posted I found my home IP blocked from Hacker News (or rather slowbanned to the point that Cloudfare gives up), reinforcing everything I said above.

Was it really necessary to ban him? I found this post very insightful not just with respect to HN, but in regards to moderation of social websites in general.

While his criticism of specific people is harsh, he does make some worthwhile points about transparency and conflict of interest and how they can potentially affect the nature and course of discussion.
Intriguing read, but to me it's FUD.
This of course assumes that bash is set as the default shell for those users all those programs run under. None of my systems have bash installed, thus they aren't vulnerable. FreeBSD by default does not ship with bash, and unless it is specifically installed for 3rd party software use, it is not required for anything, and certainly won't be found as /bin/sh...

Shell shock is being blown out of proportion, people are worried local machines they use to browse internet are going to get popped when in reality it is only really Linux machines that have bash as the default shell that should be worried.
> Have you done a lot of teaching?
> As a matter of fact, managing a course-long sequence of lectures in a way that keeps everyone engaged is infinitely more difficult than keeping everyone engaged in a one-off conference presentation.

No I haven't and yes that's totally understandable. But in my experience a lot of lecturers don't even try (or they probably do, but fail to different extents)

> The only way to make sure everyone has good reason to pay attention is to teach a very difficult topic. Which is why "not paying attention" is nearly non-existent in canonically difficult courses, regardless of the quality of presentation style.

Not in my experience. I've been to plenty of classes that were extremely difficult, but I just could not bring myself to pay attention to the presenter for longer than a minute at a time. I just couldn't.
I think that in an ideal world, it is more effective to refrain from multi-tasking and instead to focus on an influx of information provided by a skilled teacher. Unfortunately, many classrooms do not represent the ideal world. Teachers may be unengaging, uninformed, or just plain not good. Students may be unprepared, overqualified, or uninterested. Sometimes there is simply a mismatch in expectations and understanding. If the professor and students are driven to overcome these inefficiencies, and work incredibly hard to avoid them, then and only then do I think that this "rule" should be put forth. Although, one could argue that students and professors should strive to achieve this goal in every setting.
Not too familiar with the selection and admission process, but

* can people be denied hospice care based on ability to pay?

* why wouldn't someone in that position go through non-profit institutions first?
Going to be interesting how they've solved this - my guess is an intermediary cert they've obtained. Must be pretty recent though, as it's not in my intermediary database[0].

GlobalSign also has an unlimited SSL cert offering, but it doesn't come with SANs (they could have arranged something though).

0: https://github.com/iangcarroll/ca-intermediaries
This post is inane. Most of the "tech world" has never even heard of Hacker News.
I don't want my language to be that complicated. "Powerful" has nothing to do with it.
Why Small Exposures to Fear Increases Your Chances of Taking Action
That page is disappointingly light on actual arguments. Its points can be summed up thus:

-Sun presented a paper saying it wasn't worth it

-Plan9 doesn't use dynamic linking and some of its utilities have smaller binaries than similarly named utilities on FreeBSD

-People like dynamic linking for the same reason they believe in god

-Statically linked binaries aren't as portable as one would like.

It reads like more of a rant to be honest.
Looking at Productivity as a State of Mind
Re: /bin/sh versus /bin/bash (or similar) - note that many Linux systems link /bin/sh -> /bin/bash, so seeing /bin/sh, or knowing that's what system() calls, is not sufficient information on its own to determine your risk.
> So ruby and perl are specifically designed to be a handler of untrusted data?

Perl actually is when used in taint mode. http://perldoc.perl.org/perlsec.html
> yeah, mongodb has flipped from hype to hatred without much in between.

The hatred was always present, it's just that the hype has died down as the early adopters have (re)discovered the sharp corners in both architecture and implementation.
Why a leading professor of new media even teaches in class?

Teaching in class to a medium-sized set (more than five but less than a thousand) of students is sooo old media.
The Fappening 3: Cara Delevingne Nude Photos Leaked with Jennifer Lawrence
The point you are missing is that people who don't want to live in the 1970ies avoid Go in the first place, so the Go community by definition consists only of people who think Java-1.0 style programming is perfectly fine in 2014.

Yes, there are reasons why the intended audience of Go just didn't care and Go is mostly used PHP, JavaScript, Python, Ruby etc, developers today.
Another thing that interested HNers can feel free to bird dog: PHP + Nginx is often deployed using fastcgi. (And, in my limited experience, far, far more likely to be deployed in greenfield development in the 2010s versus an actual CGI script. I think probably in excess of 20% of "technically savvy young software companies" I run this, the vast majority motivated by one ridiculously common piece of software that I'll refrain from naming because it suggests a trivial spray-and-pray for loop.)

fascgi_params puts a lot of attacker controlled data into "environment variables", but depending on php.ini's variables_order setting those might not actually go into what the rest of the word thinks is an environment variable (and hence not get passed to subprocesses, which is the point of the exercise). If php.ini's variables_order includes an "E", then the environment variable QUERY_STRING (among other things) will include attacker-chosen data. variables_order does include E by default, but does not in the php.ini which ships with the obvious apt-get commands for e.g. Ubuntu.
I think a big factor of this is the number of reports in the time-frame... Nine reports over the course of a year is one thing, nine reports over the course of the premiere week is something else entirely.
> being ignorant from history of programming languages

Isn't that Go's design principle?
http://www.reddit.com/r/programming/comments/2hkget/using_yo...
All those osx machines have bash as /bin/sh by default too.

It's unclear how often shellouts happen within OSX for various operations.
Twitter image bots stuck in an automated loop
Of course, that doesn't mean that tens of millions of people don't do it every single day.
Even if they don't explicitly invoke bash, it's possible that they call a program which calls a program which invokes a bash script somewhere.

Debian switched /bin/sh to link to dash a while back, but some maintainers decided to simply change the #!/bin/sh at the top of the shell scripts in their packages to #!/bin/bash rather than remove the bashisms. dhclient is the worst offender in the current kerfuffle, but I'm sure there are others.
> Newspapers have been subsidised by advertising for years (the cost of the paper basically covers distribution costs). That never made them any less useful.

Are you kidding? I can come up with better, but John Oliver is funny: http://www.youtube.com/watch?v=PDylgzybWAw

> Yes, I understand "if you don't pay for it you are the product". I think that's bunk - or rather, I don't think that makes it any less useful.

That's like saying smoking's long term carcinogenic effects don't make it any less enjoyable.

By the way, advertising doesn't subsidize anything. Advertisers get their money from us. There is no free lunch. In fact, advertising gives us lunch that is less tasty, costs more, and gives us food poisoning: https://news.ycombinator.com/item?id=8372640
Even better! One-click cert gen and installation would be magical!

StartSSL is nice because you don't need create a csr. But Cloudflare could make it simpler still, since you've already got domain-level verification through them implicitly. And if you need a better trust chain for your certs, then you can provide your own.

This just got even more exciting!
> Sometimes this is not enough. If you started with a room full of people doing something else, and the talk is sufficiently technical so that you can't start paying attention midway through, sometimes you can be faced with the very hard task of catching people's attention during the first few minutes when they still haven't noticed that someone else was talking...

I've come up with a simple script to combat this problem. I start like this: "HI! Wow what a beautiful audience, you guys are awesome! Let me ask you something, <insert question about topic>"

The "HI!" is a universal attention catcher, everyone subconsciously responds to that no matter what they're doing. (try it sometime in a busy office or something, just say HI). The second part tells the audience that this is going to be about them not you. And it establishes an instant connection - this trick I picked up from Russell Brand's standup routine. Finally, the question engages people's brain and gets them to start thinking about the topic.

Granted, this approach might not work well in a classroom setting. But starting with a question should work great there as well.

> There's also another thing: professors teaching their students may not feel like it is their duty to earn their audience's attention, to have a slick and attractive presentation style, so as to compete with any possible distraction... They may feel like they can teach the class as they like, and it is the students' role to adjust. I think this balance between the professor's sense of entitlement and the students' varies a lot across cultures (also depending on how much the students pay for tuition, e.g., much less in France than in the US). But this is something where there can be a difference between classes at university, and conferences.

One of the most entitled professors I've ever had, was also the only person I've ever seen fill a classroom on a sunny May afternoon on a Friday. He literally considered students no better than cattle. The only prop he'd ever use was a piece of chalk and a chalkboard. No slides, no computer, not even any notes. Just scribbles on the chalkboard.

But he had amazing charisma. When he entered the room, everybody listened and for the whole class, everybody paid attention. It was beautiful to observe.

And even he would always start by establishing a personal connection with his audience. Every time. Because, if you want to teach people, the first step is always getting and keeping their attention.
Please see the section on reposts in https://news.ycombinator.com/newsfaq.html.
I would actually say that the main problem is that the sentence "The main problem is that unlike for food, there are no regulations in place requiring chemicals in products to be proven safe for humans" is incoherent.

The very concept of "chemicals in products" that are made out of chemicals and nothing but chemicals makes no sense. Food is either safe, or it is not. Insisting we test "chemicals" rather than "foods" is like insisting we test "cows" rather than "beef".

That is: beef as it is delivered to you in the store contains both industrially manufactured, extremely complex, highly artificial, poorly quality-controlled cows, and a few simple, refined, relatively pure substances. Calling out the latter as "poisonous" (which everything is in some dose under some circumstances) while ignoring that cows, world-wide, kill hundreds of people every year makes no sense.

Or rather: it makes no sense to be concerned that a steak will be deadly because it contains a constituent (cow) that is deadly.

I'm not against testing of foods as they come out of the factory--and I agree that people in industry, like people in government and people in labour unions and people pretty much everywhere are not above lying to make something that is unacceptably dangerous to most people appear acceptably safe--but I am against this kind of focus on constituents that are completely unrelated to the form they are found in foods, be they a pure chemical like bromine or an animal species like cows.

It makes no more sense to be concerned about bromine in foods than it does to be concerned about cows in food. It does make sense to be concerned about food safety, but looking at the components of the constituents tells us nothing about food safety, so as soon as you seen someone wringing their hands about "bromine" rather than the specific bromine compound in the specific quantities used in a specific food product, you know they don't care about food safety.