skysight-inc/HackerNews huggingface dataset:
It doesn't necessarily. But what it does do is pass information about the request in environment variables - that's step 1: attacker controls the contents of an environment variable. Then, if at any point the script invokes bash, or calls something like system(), exec() or popen() and has bash set as the default shell, then bash will run, with those environment variables set. That's step 2, and the server is now the attacker's.
Kinesis Advantage MPC, with the recessed keys. Here's a picture of me with the keyboard: http://www.railsonmaui.com/about/

It's very important that the keyboard is low enough so your wrists are straight. In other words, avoid putting it on top of a high desk.

I've been using this keyboard since working with Richard Williamson and Paul King at Infoscape in in 1997. It does take some getting used to, and you might want to configure the location of some of the keys. I have all the mac modifier keys accessible to my thumbs on BOTH sides so that I hit the modifier with one hand and use the opposite hand for the key, almost always.

Here's a link on Amazon:
http://smile.amazon.com/Kinesis-KB500USB-BLK-Advantage-Conto...
I had a recruiter advise me to remove side businesses from my resume if they are ongoing, or put an end date on them because companies will be suspicious that you're working on them during business hours or that you'll leave if the side business takes off. I ignored her advice because I wanted to be honest about the side business (an outsourcing company that took very little of my time aside from billing customers and paying contractors). I got that job, and several others with no problem. Several of the companies that hired me also hired my outsourcing company for projects as well.
The dangerous thing is that lots of things that look like a library call to the unwary developer actually call out to other processes (visible if you run strace). This vulnerability will not be limited to web servers, either, and there will likely be systems that escape or unescape parameters in ways that evade app firewall rules.
There's something incredibly meta about this that I love.

This does seem useful though. I've probably underestimated the impact a landing page can have on idea validation and conversions.
> Initial appraisals are that public-facing systems are likely not subject to shellshock.

All the managers I know will stop reading after this, sit back and think "aaah, those silly techies. Worrying about nothing".

I gave exactly the opposite advice: We should assume every public and non-public facing system is vulnerable (many were). I'd rather cause a big stinky scare and be proven wrong than downplaying the issue and being proven wrong.. the hard way.

You probably had a good reason for saying this to your organisation, but it's not something that other people should blindly re-use for their own purposes.
Americans abroad are giving up their citizenship as banks shut down accounts
And environment variables are typically inherited by subprocesses, so if the CGI script executes anything (that executes anything, recursively) that uses bash (including system() if /bin/sh is bash, e.x. on OS X) this bug becomes exploitable?
Read how that test is run. It's showing a static image. There's nothing changing, there is no rendering in that test at all. So of course resolution didn't have an impact, the test is built to test purely the display's power draw and does excactly that.
Is there something in english?
Why should it be left to the states when there is an argument to be made that because of interstate commerce you need to implement a mandate at the federal level if you are to avoid a race to the bottom?

What is wrong with federal laws for the general good? The EPA and FDA fall under that very idea. Would you rather have food and drugs managed at the state level? We've already seen what happens if environmental concerns are managed at the state level [1].

[1] http://en.wikipedia.org/wiki/Acid_rain#History_of_acid_rain_...
It doesn't claim that YouTube doesn't dominate video search. Just that YouTube doesn't dominate when it's not the source.

Seriously, compare Google video search to Bing Video search, Yahoo video search, Duckduckgo video search, and see how YouTube links appear in the top results.
mocl is different from many other implementations: it is a batch compiler for whole programs to C. The generated code does contain a limited evaluator and no compiler. Some dynamic features are gone...
It is, however when you create a user its default shell is bash unless otherwise specified.
Happy to jump on a google hangout to help you figure it out.

namit.chadha@gmail.com
This is a Perl script that connects to a IRC channel and waits for commands.

Commands can be:

portscan (scans a host for open ports)

tcpflood (try to keep 1000 TCP connections open to a host for a specified period of time);

udpflood (send UDP packets to all ports on a host with an payload of a specified number of 'A' characters for a specified period of time);

httpflood( send HTTP requests to a host for specified period of time [with HTTP Keep-Alive header]);

shell (execute arbitrary commands on the host);

google (use google to find other hosts to infect [targets modules.php]);

version (returns bot version)

All commands send status back via IRC.

There are several brazilian portuguese strings and comments, although is not clear if the author is brazilian.

Interesting stuff.
Show HN: Can you tell HBO's "Silicon Valley" from the real thing?
What sales people can learn from engineers
Large projects work too. It works with Bootstrap 3 & Foundation, for SCSS though not LESS.
A More Natural Time Management System?
I think the "super-hype" is warranted. You've missed out a large number of possible ways this could be exploited, so the above advice would leave a lot of people vulnerable. Furthermore, because it's such a common thing to pass environment variables and to invoke bash, people expect far more attack vectors to be discovered as this unfolds. In addition the current patches rely on huge swathes of bash code being bug-free, we've already seen one patch circumvented and with so many eyes suddenly on code that wasn't closely inspected from a security angle for over two decades, I would bet on seeing far more things being found over the next weeks or months.
Of course, but what's the exploit vector in that case?
Even the majority of TAG Heuer watches are round. That's not anecdata. The Monaco is clearly the exception, not the rule.
I would call a cab. It's what people who don't own cars do every day. Ethics has no meaning in this context.
Here is a simple c program to demonstrate this.

#include<stdio.h>

#include <stdlib.h>

int main()

{

setenv("VAR", "() { :;}; echo vulnerable", 0);
system("ls");

}

#./a.out

vulnerable

a.out

#
We address some collective action problems, with varying degrees of success (certainly, some things we fail horribly at are collective action problems).

My statement wasn't meant to say, "Oh, it's simple, we just X!" Just that it's not necessarily outside the realm of things we could address. In particular, "adaptive" - when it comes to humans - is only relevant at time scales of many generations. Much changes over those time scales.
I am familiar with the gene-centered view of evolution proposed by Williams and popularized by Dawkins with the so-called selfish gene theory. Within this school of thought sexual selection by no means stands in contrast to natural selection and is not labeled an alternative to it. Instead, in fact, sexual selection is argued to be a direct consequence of natural selection as a phenomena you would expect with Darwinisitic reasoning when assuming the gene-centered view. As is made the case, the gene-centered view is the extension of Darwin's original argument, that is, Darwin's argument taken to its logical conclusion with the modern facts at hand, the DNA molecule not the least.

One of the central themes in Dawkins's The Extended Phenotype is the putting into question of the validity of traditional role of the organism in Darwinistic reasoning and why Darwin's original definition of fitness does not hold up. There is actually an entire segment on the many modern (back then) definitions of fitness and problems with each of them. I don't recall what the final conclusion is but it is certain it is not the clear-cut case you make it.

I suppose you have background in a field where your definition of fitness is more firmly established. For instance, I know biological mathematics has come a long way, and I'm not up to speed with what definitions they are using.
In general, I think you might consider [0] a beneficial read; it pretty much answers all your questions and debunks your points. For me, your comments sound a lot like libertarianism turned into religion. A lot of dogmas that sound nice, but are trivially easy to be shown false.

To respond to a particular point,

> Not having to compete with anyone does not make a product cheaper, it makes it more expensive. Competition drives prices down. So the government having a monopoly over a service makes that service more expensive.

True in many cases, especially if you only care about end-buyer price, but false in others. Some things fail spectacularly when you make them competitive. Things like basic research, things like exploiting a limited pool of shared resources, things like schools and prisons - they all go to hell when you try to run them on free-market rules. Some would say medicare is another similar thing. The market price is not the only important metric; some others are: quality, accessibility, efficiency, externalities.

> Advertising is not a waste of resources, it is investment of resources - literally, money spent buying leads in order to try and convert them into customers.

Who, were you not to convert them, would go to the competitor. It's a total waste of resources - you spend money (and more importantly, fuel and man-hours) trying to one-up your competitor, he does the same; on average, you still get the same amount of clients, only both of you wasted resources on a stupid zero-sum game. You'd both be better off if you agreed to not run any more ads that it take for people to discover you exist; yet since you can't agree on that, you're stuck in a zero-sum game.

[0] - http://www.raikoth.net/libertarian.html
On my site, I promote my stuff. I own it, I'm allowed. So should google. It's not a hard argument, they aren't common carrier.
There is no intended use, it's a pure evil bug in bash. I wouldn't be surprised if it was discovered that it has been implanted intentionnally.
Show HN: Javelin Browser
"Common Lisp Analytical Statistical Package" = CLASP, ca. 1990

http://www.cs.cmu.edu/afs/cs/Web/Groups/AI/lang/lisp/code/ma...

http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.138....
http://dl.acm.org/citation.cfm?id=896952

Later another CLASP: Common LISP as simulation program (CLASP)

https://github.com/openlisp/clasp
A Card That Automatically Unlocks Smartphones from a Distance
What do we think of this? It's got some security issues, I think, but I'd definitely be on board for something like this or similar. Is there anything out there that's similar that we know of?

https://www.kickstarter.com/projects/2018413691/salt-keyless-entry-for-your-phone?ref=nav_search
An Insanely Detailed, Hand-Drawn Map of San Francisco
When someone gets entertainment value from playing the lottery, is it really about the chance of winning multiplied by the amount of happiness the money would bring? Or does it have more to do with the excitement that comes with each drawing? (Similar to how I can enjoy watching a football season even if my team doesn't win the Super Bowl.)

I think it's more likely the latter, though I don't personally see the entertainment value of playing the lottery. I wouldn't lose respect for someone for having a hobby I don't share or understand, though.
> The money would alternativly also have been spent on thing bought in india, also gone into the pockets of shops and other things. This money would also have been taxed, just the same as it is now.

Maybe, or maybe it wouldn't have been. They could have spent the same money on imports.
I think that you're misunderstanding the motives of some players.

I fully concede that some people play because they think they're going to win. They had a dream or some charlatan has convinced them that this is their lucky day to play. That kind of thinking is not rational.

People like me, exchange money for entertainment. It's no different than paying to see a movie or to listen to a streaming music service.

It's entertainment, not investment and it's not irrational.
That guess would be wrong by a decimal order of magnitude then :)
How did they fail to substantiate the claims? There wasn't even anything to actual counter there, News Corp's letter had nothing of substance. Google responded by quoting Yelp, who has said that the algorithm changes have not harmed Yelp (aka, an independent 3rd party is also disputing News Corp's claims).

As for the Android Google Play lockin allegations, what more is there for Google to say? Android is open source and usable by anyone, this is simple fact. Google even calls out Amazon and Nokia doing exactly this. There literally does not exist a certification process for Android-related products. There exists a certification process if you want GOOGLE PLAY, but not if you just want Android.
I think you meant 'homing' but kerning helped your typo slip under the radar. :)
As far as I can see, this is largely correct. But do realize:

- that environments are inherited by child processes.
- It's not just Web servers that might execute scripts (DHCP could also be vulnerable, SSH with command restrictions, many other things too).

That's the big shitstorm about this bug. It's very hard to determine when you're actually vulnerable. The safest thing to do is to upgrade bash everywhere. But wait! The patches they rolled out don't actually fix the issue all that well. So there's no easy one-stop guide you can follow to fix this. Everybody actually has to think about every single system that might potentially be vulnerable and come up with a good solution all by themselves.
1.3% is likely more than most meaningful contributions of most of the latest web 2.0 of startups. Most startups do not contribute to open source at all, especially not any parts of their core product.

The rest of this comment is weird personal attacks.
I suggest you read my post and maybe let it roll around your head that I've considered my environment and the domain of my problems in a way you aren't giving me credit for. Perhaps even, with that whole mention of devops, I do something such as--crazy thought incoming--install an updated version of bash on every system I must provision, just as I do Ruby, Python, etc.?

"Decent shell script" is not a synonym for "portable shell script" and the presumption therein is what I was addressing.
all of our instances scheduled for maint. are indeed system-reboot event types; it is indeed a stop/start situation.

stop/start can possibly put you on another physical - but it all depends on how aws has setup the hypervisors and their instance schedulers.

this, the maint from aws, appears to be security related - but that doesn't mean that aws is not getting folks off of old hardware if they have that desire.
I find it actually pretty ironic that Larry is so derided here. It seems to come out more due to jealousy (also see: Google, Apple, Facebook, Craigslist now that also have lots of money) than anything else.
Installing DreamFactory on Pivotal Web Services
Is there some easy way of detecting a site you don't control is vulnerable without bringing it down?
How to authorize your Rails app with a Google API
I did find that they were top posting amusing. Well done for the other contributors in the thread for ignoring it though.

[1] http://en.wikipedia.org/wiki/Posting_style#Top-posting
And how many of those are remotely callable? It is a local exploit without something that makes bash directly callable remotely.

That's why mod_cgi or sshd (in one configuration) make this bad, they execute whatever command passed by design. To do that with most everything else, you would need a remote exploit in that program, making the bash exploit somewhat moot in that case. Or you're not sanitizing your inputs in which case you have another problem anyway.

Bash, on it's own, is not remotely callable.
Isn't a car a general purpose machine in the same sense that a computer is? Cars, at some point, were also "genuinely new and disruptive for all kinds of markets", just like computers were long before the Macintosh. I'd say that the Macintosh was little more than an incremental advance in a particular direction of personal computers, and I'll stick to my point that Tesla is just an electric care in the same sense the Macintosh is just a computer.
> you just don't write tests for types, as they are subsumed by the value tests

I think this is false.
I think you screwed up your test, I have not managed to get it to work with the LD_PRELOAD workaround installed.
The anatomy of a door-to-door Taobao delivery
Glad to have the team sharing more on this!
EXASOL establishes largest, fastest in-memory performance benchmark ever
Ask HN: What do I need to know to do this?
I want to:

1. collect and store data from an API in a database

2. analyze and do some simple calculations with the data (such as find the maximum value within a range)

3. publish some of the data on a web site

What do I need to learn so I can do this? I don't need to be great at it, I just want to play around and get something working.
Generally I think of entrepreneurs as wanting to create a growth business with sustainable competitive advantage, which in turn creates great wealth for customers, employees, and investors.

The alternative is starting a lifestyle business. This is fine, but not a source of great wealth beyond your family.
It's more aptly described by "small business owner" or "self-employed".

Either angle can shape the person you become, but I'm not sure it's so easy to correlate "awful" with "growth company founder". Certainly Jeff Bezos and Elon Musk are in this category, and they've been brutal to their competition. Are they turds too?
I highly recommend the LLVM Kaleidoscope tutorial. [1] It takes you through all the steps required to implement a REPL for a simple single-type language, and is surprisingly concise given the end result.

Regarding the JIT aspect, if you are like me, you will be in awe when you encounter the single operation

f_ptr = engine->getPointerToFunction(f_def)

It turns a function definition (in LLVM IR) into an actual function pointer that you can invoke just like any other C/C++ function.

[1] http://llvm.org/docs/tutorial/LangImpl1.html#tutorial-introd...
Same as for any other computer: Das Keyboard 3 (or Filco TenKeyLess otaku).

The point being to use the same keyboard and the same mouse on all the computers you use (and configure the keyboard layout to be identical or the closest possible on all systems you use). This is how you increase the ergonomy of your human/computer interface. Consider the keyboard/mouse part of your body, and use USB as human/computer interface instead.
Ask HN: Open-source projects that could use documentation help?
Hey HN, a friend of mine is a budding technical writer, and is trying to get some actual documentation experience under her belt. Anyone have a project they could use some docs for?
This begs the question: Would you take an investment from Vinod Khosla?
For those looking at the usability of the website, here's little context.It's not a great website. It's a change (in good direction) in the existing India government websites that use yesteryear technologies.
Smart little tool to check if your website is vulnerable http://milankragujevic.com/projects/shellshock/ It can also do a deep check that checks many known URLs, not only the home page.
Well, not once you've bought the I2's, no...
Sure, but we could probably say the same about say Valve's contributions.
What you can do:

http://apple.stackexchange.com/questions/146849/how-do-i-rec...

If you need a temporary fix until there is a new update - this can prove to be quite useful.
I think it's more complicated than that. Because Amazon is claiming that if you let them handle it, you keep your instance data. That's not a stop-start (at least what we ordinary users can do).

It's more like a system restart with a little downtime managed by them.

You can try a stop-start yourself, but it's not guaranteed to help. And a restart yourself doesn't do anything.
Here is a simple tool that you can use to check if your website is vulnerable: http://milankragujevic.com/projects/shellshock/
It doesn't appear that SwiftKey allows for swiping across the keyboard unless you give it full access. I just installed it and then removed it because of this.
Here is a simple little tool to check if your website is vulnerable http://milankragujevic.com/projects/shellshock/
Right at the bottom he mentions that only 15 slots are available, first come-first serve. So he blocks out each day for a single client.
Notch isn't an entrepreneur, he's said so himself. He has no interest in creating or running companies.

He's the success story of a brilliant founder that hands off his work to a parent (Microsoft) to do the dirty work.
A few of my co-workers have that and like it, but if you don't want laptop keys there's always the Microsoft 4000 (what I use), or 8000 for wireless. On the 4000, things like the volume buttons work out of the box with a Mac, but not all of the other special keys do.
Russia Sent Investigators Intel to Ukraine
Or do so on a small percentage of free traffic and see how much CPU headroom you still have left.
Thank you for the description and the link.
Anyone have code that might work on 13.04 please?
We're taking a slightly different approach with our startup, MorphMail (still replacing email, but not going the todo list route): https://www.morphmail.com/
"Live long enough to reproduce, die happy."

I'm not sure it's relevant to your central thesis here, but this conflates the experience of the individual with the workings of evolution. Living long enough to reproduce (more precisely, having a high inclusive fitness, which typically includes reproducing but strictly doesn't have to) is roughly equivalent to nature saying "more like that" which can be counted as "a win" - but the dying animals are still probably dying in pain.
I never knew about this place, but now I'm certain I will be getting in the water there soon.
Question for you: who do you think has the luxury to be able to choose who to take money from? In my view, not many people. We're all scrambling to put food on the plates of our children (if not our own). It's extremely difficult to be picky and choosy about where we take money from... because it's what we need to survive.
Shifting "Indian" (nationality) to "white" (racial grouping) in your analogy is disingenuous and inflammatory.

Policing other people's entirely natural and unobjectionable pride and joy is annoying and tiresome.

("American" would have been a better substitution, but maybe you judged it to be less effective as a rhetorical hammer?)
Don't get too drawn in by the online hype. Abbott and LNP proposed plenty, but much of it hasn't materialized into any sort of legislation and probably won't. The Labor party dominating government wasn't a good thing either.

Still a long way from becoming as bad as America. Consider that health insurance premiums for a family of four average at $16,000/year with $2,000 deductible in the U.S.

Mass surveillance will get you no matter where you are in the world.

Australia's real problem is its deep anti-intellectual culture and generally ignorant populace. Kind of the same deal as the US. At least your people are generally a bit more skeptical.