skysight-inc/HackerNews huggingface dataset:
> But there's no zero sum here

Government spending via redistribution is absolutely zero sum.

Every dollar spent by the government into the economy is one dollar taxed out of the economy. Money that is given to some has to necessarily come from others. Just because the benefits are concentrated and the harm is spread out doesn't change the fact that you've only taken money from A and given to B. No additional wealth or prosperity is being created in that transaction.

Now, it may be the case that once B has the money, he spends or invests it more efficiently (in new skills, new assets or what have you) than A would have. But such a multiplier effect, if it happens, is happening in spite of, not because of, government redistribution.

> Hopefully, at every step of the redistribution, at every split, some wealth was generated

The key word is "Hopefully." It is highly unlikely that a government bureaucracy will distribute money such that it is spent more efficiently and productively than an individual taxpayer would if he still had the money to spend himself.

Yes, the economy creates wealth, but only when productivity increases. Redistribution does not create any wealth, only "spreads it around," except for the rare cases when someone in the bureaucracy makes a better decision with the money than the people who paid it in taxes. But I can't really think of a time that has been the case...
I would love to see an entire animation or TV show done in that style.
Does this qualify as white-hat or grey-hat hacking? Does the doing only good outweigh the bad of modifying someone else's system?
Only for amd64 though, ctrl+f for "4.3-9.1":
http://ftp.debian.org/debian/pool/main/b/bash/
This is not related to the scheduled reboot maintenance. The script that you are referring to has to do with a separate Windows networking driver and Xen.
Billionaire must let public access Martins Beach, judge rules
Interesting read. Thank you for posting it.
you are right and judging from the regressive and reactionary fears this project is generating from the "professionals" the man is onto something.

good luck doc, you have everything it takes to start moving history in the right direction, right now.
Post the script?

It seems they could easily hit the metadata service to determine if a machine is patched or not.
In my (naive and possibly flawed) tests, the division method is giving uniformly distributed results. Can you explain more what the limitations of that approach are?
>What makes you think there's a linear relation between payload weight and cost?

...or that payload weight is correlated with scientific value.
The journal is a bit of a contrived example though, it is pretty much the only mandatory part of systemd outside of pid 1 and you can still replace it, you just need something to fill the place of it and no one wants to put forth the effort to create some journald compatible rsyslog daemon because it would be mostly pointless. Also, if you really hate it you can still configure it to not even store run time logs by throwing Storage=None into the config file.
Unless the fixed version of Xen exposes some kind of signal to its VMs that says "Hi, I'm not affected!" - which then could be read by this script. I don't know if and how that's possible with Xen though.
The same people who write CGI applications in bash?
This is the end game for smartphone OEMs as well.
“Zero to One” by Peter Thiel and Blake Masters – Review
Just tested on Ubuntu 14.04 patched.

"still vulnerable :("
So far I'm 3 for 3 on stopped/started machines that come back no longer having the scheduled reboot event - maybe the problem isn't as annoying as we're thinking?

(Edited because I said "reboot" and meant "stop/start")
If you genuinely can't hit a price being shown, ever; I'd call that market a fraud. A spread you literally can't ever trade is not a spread it's a lie. I've never seen any evidence of it. And it should be really easy to spot. Spread width n millis before execution. Spread at execution. IF the latter is consistently wider it's not a market it's a con, take your business elsewhere. Of course with two players vying to be at the front of the queue showing the tightest possible price, well spying on your ioc order and backing off just means you make no money. Competition is good like that. Only one market maker in a market? Yeah that's always been a problem and likely a worse one when it's some rich, fat bastard who knows it, knows you and can rip your face off. And they do. Michael Lewis made a career out of documenting it. In the Big Short, in Liars Poker etc. etc. But it doesn't seem to happen when there's HFT does it because if you quote a market like that you make no trades and someone else gets the pennies on offer.

The actual spread that you can actually trade when you want to trade is the only thing that is interesting when discussing liquidity. No really. If that spread that you actually can trade is wider it's more expensive, if it's tighter it's less expensive to transact in the market. The rest is a load of BS. And smelly BS. That spread that you can actually trade has been shown to be consistently tighter in the presence of HFT. Evidence showing otherwise is something, we all will be very interested in.
So make the code query an opaque EC2 api, instead of testing the machine. You could still find a machine that is vulnerable and one that isn't and attempt to find out what the difference is, but that's a much harder task.
Actually, they aren't. Go read the Federalist Papers.
Proposed Terror Law: Australia's Entire Internet Monitored with One Warrant
I was scanned several times - looks like there were a few false starts and different ping commands: http://pastebin.com/badL7dtk
How does something like this work in general? My naive idea about how to make such a thing essentially seems like a virtual machine, which is quite a bit of effort.
Sysdig, a 'Project to Watch'
Heh, I thought the answer was very clear: no.
maybe just checking a version number or a compilation date? Indirect check?
This is great. I love it when academic research is broken down to such an accessible level. This kind of documentation beats the pants off of reading academic journals or emailing authors when you need to figure out the basics of a technique like soft robotics.

It would be interesting to see a website that did this kind of translation for more scientific techniques. I wonder if anyone is working on that yet?
The post claims that it could take several hours before their scans identify hosts that were claimed during restarts.
When Apple forces an app to be less secure
I sometimes imagine a world where OpenBSD is the norm for most data sensitive services, not just firewalls.
Patched bash is still vulnerable in some contexts
but since he came from a rocketship, I think he's pointing no matter what it's hard on you.
Your impulse library works terribly on Windows Phone.
I didn't read "no" in the answer, just circonvolutions around: "it's no but we're mangling it, plus we're not changing our course after your feedback". A clear answer would be: "fuck you".
As far as I know this is totally unprecedented. This level of detail and openness from hardware research is just staggering. All I can say is a very enthusiastic "Thank you!" to the team that put this together. I will have a lot of use for the tools and tutorials.
Someone not wanting to stick out might only probe headers that are less-often logged, but still possibly passed-along as environment variables. Has anyone logged 'HTTP_FROM' in a long while?
True, and if that's the case, my concern is resolved.

That said, if they were just checking software version or querying an Amazon API endpoint, I'd expect them to give out a tool or URL you could use that would give you the state for all your systems at once, rather than a script that you'd run on the machine itself.
What is EAR?
you could prolly get around that

if their httpd.conf has incorrect privs set, you could run a script that changes the "user to run as" to root, then set up a script that would run on next reboot to apt-get upgrade and remove the root privs config line. you'd have to wait for the server to go down or reboot however long in the future, but hey it would work.
A reboot won't address it at all (it also keeps you on the same host).. no point in doing that. From the e-mail notification: "You will not be able to stop/start or re-launch instances in order to avoid this maintenance update."
Yet another (#5) Unauthorized source IP address
Changing the distro underneath would break all other Dockerfiles that assume they are running on a certain distro. How do we have to deal with cases when the distro is switched from debian to centos for example?.
1. Sarcasm is often difficult to discern without tone of voice.

2. Humor for its own sake is less valuable than humor that makes a point. I wish I could find it, but I read an interview with the New Yorker's cartoon editor who said something similar.

3. It is easy to tear down with sarcasm but very hard to build with it. There is too much negativity in anonymous / pseudonymous forums in general.
With the patched bash, if you run

env X='() { (a)=>\' sh -c "echo date"

This is equivalent to running

date >echo

That is, you can put something in the environment which causes it to drop the first token, run the result as a command, and redirect the result to the dropped first token.

An example of a context where this would be exploitable, is a CGI webapp which accepts an uploaded zip file, stores it in a FAT filesystem, and and runs system("unzip /path/to/file"). Then putting a corrupt string in a header would cause the file to be executed, rather than unzipped.
Chet (bash maintainer) says he has a fix.

http://seclists.org/oss-sec/2014/q3/682
Relevant helpful viruses:

https://en.wikipedia.org/wiki/Welchia
http://virus.wikidot.com/codered (CodeGreen)
AWS to Reboot a Substantial Number of EC2 Instances
Sorry, I should have phrased better. I issued a "stop and start". Per the AWS thread:

> While executing a stop/start is absolutely fine to do, there is not a guarantee that you will land on an updated host. We are periodically polling for new instances and those impacted will receive new maintenance notifications accordingly.

Which I take to mean there's a chance you could land on an updated host. I'll update if any of those machines come back to the Events view.
If only C++ were actually "forward" from C, it would be reasonable to tell people to move forward.
So it seems a cycle of collapse and Hawking radiation will occur until the star no longer has enough mass to collapse.
"The federal government does not know how to write a check". --- Well, actually it is very very easy for a government to write a check. Except that in the US, it has been made so extremely hard for them, that stuff like space travel, general and medical research just doesn't get funded quickly enough. These regulations have their merits, but the downsides are hardly ever discussed when people want to stop federal overspending...
networkd is still under development but if you're running a version of systemd that has it, it's already very nice so long as you don't need wifi. Right now I'd recommend it over NetworkManager for users who don't mind config files instead of using a GUI if they have access to it. It just works and it's automatically triggered by udev right when the hardware appears on the bus and sets everything up without the pile of shell scripts that is the status quo right now.
Bash 'shellshock' bug is wormable
Fissler Cookware
No, it is not. Who you are should matter, we don't want to stop a major advance in tech just because the one who will lead its creation may be a prick.
“Finally, someone took me aside and said, ‘We could make cheaper technology, but it wouldn’t support the cost of our sales force, so we have no motivation to do so.’”

I don't understand. Isn't the cost of the sales force built in to the cost of the product, so if the hardware cost went down the end price would be reduced somewhat but still include the cost of sales? Is there some retailer or consumer psychology at play where people don't want a cheap breast pump?
No connection with Estimate personally, but given what I've observed about their beacons' signal strength and what they said earlier focusing on mapping the four walls of a room, I would place the beacons along the store's four edge walls, and for better coverage in isles, I'd place beacons at the far walls of each isle end. If the device can't see both beacons, one on each end's facing wall (the outer wall, that is) then I'd consider placing more in the middle, perhaps one every 3-5 isles? It's tricky, because if the signal strength is uneven, I expect the algorithm might get confused, unless the calibration or additional beacons can help. It's possible that they'll also release an update (if it doesn't already work this way) that will support beacons "in the middle of the room" but I expect the initial release was to map rooms with the fewest number of beacons possible. In a grocery store, you might even want a beacon per "section", so if you approach frozen pizzas, you can offer those deals, or whatnot. Detecting one beacon is a lot less work than trying to locate someone using every beacon within range.

The biggest sticking point for me, seeing this release, is remote management if you deploy that many beacons (how do you know if the battery died in one?) and/or powering the beacons from other sources at some point to ensure they last longer? Oh and it said iPhone, so does this mean Android is excluded, or this is simply a first release, and as iBeacons, you can't really advertise for Android these days? :)

Finally, it would be very interesting if you were also able to use WiFi and any other signal strength indicators to assist in triangulating where a user happens to be, including perhaps M7/M8 motion. I'm sure you've thought of this. Bravo for the work so far!
Why Are Your Co-workers' Salaries a Secret?
This isn't a direct answer, but for others who are coming to this page and need help on where to start, here is some info on what to do now from RightScale's CTO, it also has a little comparison to what happened in Dec 2011 reboot too (just an interesting side note): http://www.rightscale.com/blog/rightscale-news/aws-reboot-su...
Interesting, I'll test this. Thanks!

Btw, what is the advantage of this over dividing? Is it faster, does it give better distribution?
I see you!

209.126.230.72 - - [24/Sep/2014:15:04:17 -0700] "GET / HTTP/1.0" 200 62 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...

209.126.230.72 - - [24/Sep/2014:17:14:58 -0700] "GET / HTTP/1.0" 200 62 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
50 NYC VCs You Need to Know About
That explains a lot.

And it's very sad: Linux won, thus Linux becomes everything it stands against.

Let's restart the cycle for the next 30 years. Maybe FreeBSD this time? Or is it time for a plan9-like system?
There's a possibility that this issue might be related to HVM. All of our AWS systems are on older, non-hvm instance types, and none have been rebooted, and there are no maintenance events listed. Friends who are using newer instances (which are all hvm) are reporting the reboot issues.

Anecdata, but a possible explanation.
Yeah, I had considered this, but I can't imagine the effect continuing beyond the un-greying of the parent post. I can see it rallying to that point, though.

I should also note that I've seen a lot of early-greyed posts come back from the dead after 30 minutes or so even without the "omgwtfisgoingon" posts underneath them as well. Sometimes even becoming clear winners on their strata of the post's comments.
The economic case for paternity leave
"Early stage research" is such a wacky term you haven't a hope of getting that nailed down.

If you sit down like a serious person and look at a well-defined question, like "where do drugs that end up being administered to patients start their existence?", you get

58% from pharmaceutical companies.

18% from biotech companies.

16% from universities, transferred to biotech.

8% from universities, transferred to pharma.

http://pipeline.corante.com/archives/2010/11/04/where_drugs_...
You can't really blame them, Kickstarter is composed of artists, not scientists.
Miss a Payment? Good Luck Moving That Car
Is the reason you cannot simply use a software/cell phone GPS solution to accomplish the same thing that there's poor granularity and potentially also poor indoor GPS reception indoors?
Barometric sensors are one potential source - the latest Nexus has one at the least.
It's the Galileo Gambit: they laughed at him, they laugh at me, therefore I'll be proven later to be right!

Or,

"The fact that some geniuses were laughed at does not imply that all who are laughed at are geniuses. They laughed at Columbus, they laughed at Fulton, they laughed at the Wright brothers. But they also laughed at Bozo the Clown." -- Sagan
MIT 6.858: Computer Systems Security (Lectures on YouTube)
You should put your contact details in your profile (In the "About" section - your email address isn't publicly visible).

Anyway - I'm really interested in this area. I have Q/A system built that can answer (some of) the broad-type questions you mention.

I think grouping Google/Wolfram/Watson together misses that each has their strengths and weaknesses, and that they take dramatically different approaches.

Google traditionally relies on ranking information it finds to answer questions (though the whole knowledge graph thing is moving it closer to what Watson does).

Wolfram relies on manual curation of facts and probably the best "calculation" engine of the three.

Watson relies on manual curation of sources, and automatic extraction of facts and ranking of them.

I think it's quite interesting that Google is moving to a model more similar to Watson.

Anyway - I'd love to hear about your approach and what you are doing. My contact is in my profile.
Not so much a VM as a jit compiler.

In principle, you can use any compiler of your choice to fake this: Just create a dynamic library for each line that has been entered into the REPL that you immediately load and call into.

Now, 'all' you need to do is cut out the middleman and directly output properly relocated code to memory. There are compilers that can do so. Clang/LLVM is one one of them. TinyCC is another.
>OpenSSH, that sets ORIG_SSH_COMMAND variable to the command that the user supplies //

So they set shell vars without sanitising them first?
"It is highly unlikely that a government bureaucracy will distribute money such that it is spent more efficiently and productively than an individual taxpayer would if he still had the money to spend himself."

This talking point does not hold up to scrutiny.

There are plenty of examples where individuals fail to build infrastructure that, if built, would help everyone much more than the cumulative cost to build the infrastructure. The same goes for research and technology development.

Basically, the talking point assumes that individuals are rational economic actors in a rational market, and this is just not true. Additionally, even if the individuals were rational and fully informed, there will be highly suboptimal Nash equilibria.
It feels like they've built a startup, put only the essential things in and build a truly minimum viable product that works and that too quite well.
Australian Government Scrambles to Authorize Mass Surveillance
Luckily, post Dot-com bubble, most companies have realized that generic named websites are not the way to brand your product. How many times have you gone shopping at shopping.com or read the news at news.com (forwards to a brand name). The only thing you would do with that domain is forward it to your branded website.
As early as 1989, there was an interactive C interpreter/REPL/debugger called 'Saber-C':

http://webcache.googleusercontent.com/search?q=cache:xZ37OrB...
Yes. Wifi triangulation can work, but it's not precise enough unless you have quite a few routers. You end up having to use other signals that you're nearby, and track the device's own movement, I expect. In a way, what you have here is "indoor GPS", it's just tricky to get things as accurate as we expect right now. Ultimately, I expect we'll have to rely on lots of signals, including (for some use cases) cameras or Kinect-style tracking.
Yep. A current i386 debian is still vulnerable, some hours later. Curses.

Edit: I see that even those who got the patch are in fact still vulnerable.
Do you mean ITAR (http://en.wikipedia.org/wiki/International_Traffic_in_Arms_R...)?
Fuel cost increases at a square of the delta of force required. So the NASA project was actually more efficient.
Can you recommend how to wrap crypto _around_ our applications if we aren't building it in?
There are penalties for giving out drugs to everyone who asks (potentially jail); there are no penalties for not giving out drugs apart from feeling like an asshole.
Pretty crappy that you cannot immediately check if an instance has restarted on a patched host or not.

I would have expected Amazon to rush out a tool you can use to check or add a little marker to the dashboard or a simple API to query. Some sort of synchronous option.

Having to wait possibly hours for an email to see if your vm migrated to patched host or not is a terrible solution.
These are two very different missions. The ISRO mission is primarily a tech demo, and as such can tolerate greater risk. The NASA mission is focused on a specific science question, and carries several very complex instruments sufficient to answer the question.
I won't cover the ground the other response covered (implementing your own fixed point because IEEE754 isn't good enough for you is ... nutty) but the issue here is using daft units vs. using SI units, and the thinner and thinner straws people clutch at to claim that using SI units isn't simply better. Good grief.
And I paid about $2000 in 2003 for a 53" rear projection High def TV. It's still going strong though.
> The fundamental difference here seems to be app.net always charge

You answered your own question. Some of us can't afford to throw down several dollars a month on a social network. The free tier is unacceptably restrictive. Or was the last time I thought about it.
Printing Lenses on the Form 1+ 3D Printer
Theorem provers?
I think it's a bit naive to say that science doesn't turn on belief. Scientist aren't robots, mechanically and dispassionately ingesting evidence and spitting out theory. They're humans with imaginations, beliefs, agendas, and egos, guided (hopefully) by a methodology that leads to discovery. I think belief is what drives science, and it's not all that bad of a thing.
CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
https://news.ycombinator.com/item?id=8365158
You've turned the logic around. The statement being made is more like: "It isn't OK to be a prick just because you created a major advance in tech."
Annex K is so useless that last time I checked not even Microsoft, the sponsor, implemented it completely.

Also, if you dig into the Annex K API there are quite a few problems with it, both technical and practical. It was half-baked. Some parts are salvageable, but really the API as a whole should be trashed.

strlcpy is useful and prevalent. Let's not let perfect be the enemy of good.

Trying to solve string management problems in C by getting everybody to agree on a "safe", comprehensive API is misguided and a waste of time.
The ecosystem is actually bigger, and includes projects such as TweetNaCl.js (pure Javascript implementation), Salt (pure PHP implementation) and Chaos.NaCl (pure C# implementation).

All these projects play well with each other: they have a decent set of primitives and constructions in common, accessible via a very similar API.