skysight-inc/HackerNews huggingface dataset:
I was wondering about this too. My thinking was, if a user's laptop is compromised (and has the exploit in LC_TIME, TERM or similar), and the user then SSH in to a server with exploitable bash, the nefarious command will presumably be executed without the user knowing. But of course, if the laptop is compromised that badly, it could probably wreak havoc to the server anyway.
What was the hack? Seems they fixed it / took it down already, whatever it was
While this is not peer-review , it's interesting :

http://www-03.ibm.com/press/us/en/pressrelease/43231.wss
This article fails to mention one of the most popular "tactics" for releasing on Product Hunt: begging your friends for upvotes.

In fairness, the OP did not explicitly ask for upvotes on Twitter, just provided a link to his Product Hunt submission. ( https://twitter.com/aten/status/511904562857254914 ) The difference is that doing that on Reddit or Hacker News will get your post killed and you potentially shadowbanned. And justifiably so, since putting an emphasis on social media popularity in determining ranking takes away from the quality of the submission.

If you don't believe that upvote begging is a problem on Product Hunt, just look at Twitter. ( https://twitter.com/search?q=product%20hunt%20upvote&src=typ... ) Note how most of those have Favorites and Replies from Ryan Hoover himself or another employee.

I doubt this policy will be reversed since it's the reason PH became so popular, but this is the primary reason I'll never take Product Hunt seriously.
I don't feel like there is going to be any investigation on how easy it is to bait the media with a domain name and simple hosting, because the same outfits that got hoaxed all benefited from the generated outrage.
Know what isn't vulnerable to this? Perl CGI scripts with taint mode enabled. http://perldoc.perl.org/perlsec.html#Taint-mode

You may not use data derived from outside your program to affect something
else outside your program--at least, not by accident. All command line
arguments, environment variables, locale information (see perllocale),
results of certain system calls (readdir(), readlink(), the variable
of shmread(), the messages returned by msgrcv(), the password,
gcos and shell fields returned by the getpwxxx() calls), and all
file input are marked as "tainted".

Tainted data may not be used directly or indirectly in any command
that invokes a sub-shell, nor in any command that modifies files,
directories, or processes, with the following exceptions:
Is someone from Heroku online here right now? My apps are all affected and since I am trusting Heroku with this, I am hoping they patch the system as soon as possible.
Hotel wireless connections are sometimes considered harmful. Use a VPN connection of your choice (i.e. your employer, a trustworthy provider or else).
I agree with segmondy. Instead of classifying this news as Indian achievement, we should look forward to it as world's achievement.Surely those guys had it commendable work in such constrained resource! For me, it's new frontier in science...and boy it's cheap! More the affordability, more the chances of discoveries. Remember when a useful pricey thing becomes affordable without loosing usefulness then it's innovation!
Kevin Mitnick is a celebrated nobody
Yes I understand, I need to think about that and ordering.. cause then it seems to me that scrolling would have to happen horizontaly.. but thats and interesting idea!
Meanwhile there are lists :)
Really great list. I hope you keep updating this as the mobile web app development landscape changes.
I agree with segmondy. Instead of classifying this news as Indian achievement, we should look forward to it as world's achievement.Surely those guys had it commendable work in such constrained resource! For me, it's new frontier in science...and boy it's cheap! More the affordability, more the chances of discoveries. Remember when a useful pricey thing becomes affordable without loosing usefulness then it's an innovation!
Often, though, language B's low-level API won't be "language B" so much as it will be "another syntax for language A". At which point, it's often more idiomatic and simple to write in language A, than to write in language B's "version" of language A. (For just one example of this, inline assembler in C vs. actual assembler.)
Am I vulnerable if using the Paperclip gem to manage file uploads on a Rails app (it internally fires up 'convert' to generate thumbnails, I believe).

What if there is an haproxy sitting in front of the Rails app?
"Given the location"? What is it about a forest that makes you think the government was involved? Or do you mean that every death in Russia is a suspicious death?
You can always tell by comparing two of the same letters.

For example, if two lowercase 'e's are exact clones of each other, you know it's a computer font.
clickable link: http://bb-ezinterview.rhcloud.com
I had a "free Kevin" bumpersticker (one of these: http://en.wikipedia.org/wiki/Kevin_Mitnick#Arrest.2C_convict...). I now regret having one.
Definitely don't give up!

I'd guess GSoC brings a lot of 'random internet strangers' to projects whose maintainers are highly motivated to reward known-quantity existing contributors (previously working for free) with the stipends.

Dealing with the personalities involved in open source can be the toughest part of the process; I recommend reviewing how previous contributions from others have been rejected before deciding to contribute yourself. Also, be sure to interact with the developers and community a bit (IRC, forums/issues, etc.) to get a feel for how well you fit in.
I remember seeing a video from the Facebook server engineering/maintenance crews and was really impressed with all that they were doing.

“Many silo these engineering teams –server, storage, database, [and so forth]. We don’t create these barriers,”

Does anyone know how they are structurally organized?

I also wonder who directed that all of these innovations be standard, eg. was it Zuckerberg, Sandberg, Corddry or what?
Not really, TLDR says he found his apartment thru friends in the end, so all this crawling was for nothing.
Some info about the VAT changes can be found here - http://oleb.net/blog/2014/07/eu-vat-changes-2015/
This really depends on how practical you want to get. One of the biggest problems in hospitals is (lack of) staffing. Having a robot that could go around the rooms and check on low-level, treatment related problems would be a huge improvement in patient care. Imagine using CV to check on IV pumps for flow rate, how much of the drug is left, is it leaking, does the patient need more IV fluids, does the name on the drug label match the patient's, etc. These are low level problems that can lead to injury and death of patients in hospitals, and usually handled by overworked nurses. Seems like a perfect application of CV to me.
Every hash function has collisions. It's just nearly impossible to find them if the hash function is secure.
This could def. use some front end love. I'd love to dig into the code. Is it on Github?
The iPad that never was: Apple prototypes revealed
That video give me no sense of how this really works. I just see a jumble of boxes and colors, and a voiceover who keeps throwing single words out there without any context. Nothing on that page or in the video makes me feel like this would truly organize my work any better than my trusted, permanently open, plain text to do list.
Nobody ever explains why people comment before reading articles, yet here we are.
This comment reminds me of my time as a sysadmin in college. I had to rack a lot of 1U and 2U servers (the Dells of yesteryear referred to) and they are EXTREMELY heavy. Racking them was tricky because you had to put together the rack mount yourself and then get it all lined up while you're holding this 100+ lb thing (which is awkwardly too long and wide to handle easily) at chest height and sliding it into the rails in the cabinet.

One day they let me take a decommissioned PowerEdge server back to my dorm room. It was old, but it still had something like 16 cores, 64 GB RAM, and 2 hard drives. As a college student with no money I thought this was pretty cool. Carrying that thing five blocks to my dorm room was one of the hardest damn things I've ever done, and in the end it was too loud to use.

Moral of the story: Rack-mount servers are not designed to coexist with humans.
New Udacity Courses in Front End Development
Another vote from me. It seems from the comment that you have a product that is kind of exactly what many like me were looking for.

I have brainstormed about this problem for a long time but I never took to implementing it because I was busy with other interests. I'm glad and excited to see someone come out with the product I wanted. I take so many notes, I've tried so many apps, but very few of them take advantage of the spatial organization human beings already operate with.

I think it would be beneficial if you kept in mind that there's a huge advantage in spatial placement of information, and took the suggestions of others on this thread regarding notes moving around. If you nail that and make it so notes stay put where I put them, you'll have a brilliant product.

Feel free to reach out if you ever need ideas or brainstorming. I have several drawings and notes on interfaces for spatially organizing notes and I should probably make them available somewhere since I don't ever plan on implementing them (I'm more interested in using the tool than making it, honestly) but hopefully people like you could use these rough ideas as inspiration.
Businesses everywhere would pay for your telepathic abilities to know what people you've never met are using their time on ;)
Broadcom unveils 25G Ethernet, SDN optimized chip
I'm not sure you do. White hat the price is free, the only request here is that you don't sue me for pointing out a hole in your system.
In-App Browsers Considered Harmful
I like the DHCP attack vector which was mentioned in the RedHat posting. DHCP clients invoke shell scripts.
Most places I get takeout are just normal sit down places, not labeled as takeout joints.
Remote exploit vulnerability in bash CVE-2014-6271
Anyone able to express how this affects the default client configuration on Mac desktops and servers?
Sort of a neat service but at $12/meal, a bit on the high side. And amazingly inefficient with respect to packaging & delivery.

It seems that what people might want are 1) simple guide to what basics I should have in the kitchen (spices, oils, etc) and 2) simple recipes where I buy the chicken/fish/veggies fresh. Probably not a fundable idea and likely already exists (although I haven't quite seen it).
As far as I could ever tell, 90% of the sympathy for Mitnick was because of the excessive sentencing passed down by the government. It's less like hip hop idolizing gangsters and more like sympathy for Rodney King, who was drunk driving at 100 miles per hour and resisted arrest before he was beaten by the LAPD.
Three-part Tutorial: Implementing Ajax in Django, via JQuery
Justin Gordon Using React on Rails
Both statements ring true... what's your point?
Moto 360 bootloader unlocked
> "Know exactly when and where your email was opened, and see how long your content was viewed."

Since most email applications (including web apps) don't auto-load external images, how exactly is this supposed to be achieved?
Looking at that example, I wonder why that Porcaro quote is listed as evidence. It doesn't relate to Jackson's album at all.
That takes balls:

"The second largest cruise ship in the world, Oasis of the Seas, used this effect as a contributing factor to pass under the Great Belt bridge, Denmark, 1 November 2009, on her voyage from the shipyard in Turku, Finland to Florida, USA.[5] Without the presence of the squat effect, the ship wouldn't have been able to clear the bridge safely - the margin would have been very slight. However, travelling at 20 knots (37 km/h) in the shallow channel, Oasis experienced a 30 cm squat, allowing sufficient room to clear the bridge safely."

So, you are captaining this brand new billion dollar cruise ship, and the deck of the bridge is too low to pass under it. Now, order your crew to speed up as much as they can, and trust physics to do its thing.
One thing that bothered me about this was the choice of pronouns for the two roles. Probably, its more likely that a product manager is female, and an engineering manager is male, but wouldn't it have made just as much sense using neutral pronouns?
I upvoted this. It's not spam; it's a recipe and a call to action.
Sorry, zemvpferreira, but this is for SirPulse:

SirPulse, if you happen to revisit this thread it looks like you were hellbanned about 6 months ago. FYI.
I'm old enough to remember this guy's moment in the sun by getting himself arrested. It was easy to fall into the "Free Kevin" mindset but now he's just trading on the name to make money. It's hard to keep that same "fuck the man" vibe when you become the man.

EDIT: I realize he's been trading on his name for a while now but I was cool with it when he was a "white hat".
It's not just you. The fact that an environment variable can override e.g. "git" to do something else is a real problem requiring separate protection. However, that's effectively PATH injection rather than code injection so it's already addressed in many cases.
What really strikes me here, aside from the technical aspects, is the note on p. 21 about how the project was supported from the top because SEO was lagging as a result of site load time, and this line especially: "NYT became an e-commerce site since the last redesign."

Once you are focusing on e-commerce and SEO as an executive team, are you still committed to journalism?
When will Watson instances be open for access?
Yes, they're just looking at the dev side not the actual upkeep I think.
you might be interested in http://opp.io/
Fourteen-foot-high racks? In earthquake country? I guess that's cheaper than a reinforced second floor + HVAC etc. But what the eff?
So the premise here is that governments can hack into your computer but the people that sell the government the tools to do it are criminals?
If you have fixed ad sizes and known locations you could make those spaces empty boxes of the correct size and then asynchronously fill them with data. I haven't tried it, but it seems like it should work.
> Mitnick is a criminal and all the pro-hacking sympathies have been wasted on a very, very undeserving person.

Wow, he hacked into some corporation's computers, that's just so awful. Pacific Bell - a shady monopoly who is granted a monopoly by the government, and in return showers politicians with bribes, I mean donations, and sends our calls and web history off to the NSA for monitoring and permanent storage.

> in reality, the rebels and the intellectually vain are easily co-opted politically

In reality, he has been doing security consultations for corporations, so he has already been co-opted. "The service has offered to sell corporate and government clients high-end 'zero-day' exploits". That doesn't really smell of rebel. Of course, everyone has to grow up and make a living.

I can think of a number of IT companies that were founded in the past 20 years, sold for billions of dollars, or worth billions or even hundreds of billions of dollars, that were founded by ex-hackers, or at least people very associated with the hacker scene and whose first technical hires were ex-hackers. It's mentioned in the tech press, in interviews, in blogs etc. It's easy enough to look up if you want to. I mean, one of YC's founders is rtm, and he was around back in Viaweb days.

It's difficult for me to perceive of a modern working class kid interested in technology today, it seems he has more resources at his disposable (although not many - a dinky Vic 20 booted people right into a programming environment, whereas a kid with an iPad and iPhone today would find it very difficult to program his own device - it is pretty much that definition of an embedded system of a device that can't program itself). Back in the 1980's a working class kid with a Vic 20 and 300 baud modem could only call people locally, call local BBS's, and be stuck with poor computing power.

If he hacked and phreaked, he could call around the country, access teleconferences, call BBS's around the country, access powerful Unix, Vax/VMS etc. systems, access the Internet, access x.25 networks and x.25 chat networks in Europe etc. He could follow the law and accept his straitjacket of being designated by the Relations of Production to be one who works a menial job, and for the privilege of being allowed to work he can kick up his expropriated surplus labor work time to the idle class job creator heirs who own his company. Or he can bend the rules, see new vistas, and somewhere down the line maybe co-found a billion dollar company, or a hundred billion dollar company. Then he, or his apologists like you, can then go around complaining about the kids hacking into his company's computers.
Worse than a reseller. If you read his website, it turns out he's just a broker. He doesn't actually buy them from the researcher and then try to sell them. He just brokers a deal between the researcher and the buyer (if he can find one); taking an exorbitant fee in the process.
The issue here was not that the port was closed; but that people helped to build it and gave their time for free on the assumption it was going to be free and readable. My post

https://groups.google.com/forum/?hl=en#!topic/qilang/PJyM6xC...

opened this topic. The rest is history.

I have a clear policy of not contributing my time to closed (for money) software unless I am being paid as a consultant. I do not have any objection as such to closed source software.

Mark
IBM used FUD (fear, uncertainty, doubt) to sell computers. Not unlike the sales tactics in this email. The actual positive "value" is only vaguely described.

http://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt#Def...
Elixir is pretty hipster. A lot of Ruby hipsters are banging down the door trying to write crappy DSLs in it.
Since even lots and round numbers don't matter anymore in the stock market, seems a strategy would be to _not_ follow the $10-25 guide.
No https and the login form is submitted in plain text. That doesn't really inspire confidence.
Why weren't any of these objections heard back before Canonical knuckled under? Was upstart even worse? I really enjoyed the "impotent rage" piece linked in TFA's comments.
Don't upgrade to iOS 8.0.1 or you may experience “no service”
Many users are reporting on Twitter that it causes "No Service" and Touch ID to stop working. Do a search for iOS 8.0.1 on Twitter to confirm.
The drive sleds are easy to insert and remove but to remove the drive itself from the sled for replacement you have to remove screws. At least that was my experience. I remember typically 4 easily accessible screws though, not really as big a deal as the article makes out.
There are unfortunately lots of bad scripts in the world that start with:

#!/bin/bash

So for example, with a foo.sh script of:

#!/bin/bash
echo "loser!"

Then for example:

vagrant@ubuntu-14:~/bin$ X='() { :; }; echo foo' python
Python 2.7.6 (default, Mar 22 2014, 22:59:56)
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.system("./foo.sh")
foo
loser!
0
>>> import subprocess
>>> subprocess.Popen("./foo.sh")
<subprocess.Popen object at 0x7f04a115f350>
>>> foo
loser!

It should be noted that if the shebang is #!/bin/sh this doesn't work when sh == dash, but given that this wiki page exists on ubuntu:

https://wiki.ubuntu.com/DashAsBinSh

That recommends changing broken scripts to #!/bin/bash or changing to sh == bash as solutions. I would guess that there are going to be plenty of easily vulnerable debian/ubuntu systems.

More importantly though, it literally does not matter if this bug is "directly privilege escalating" or "1 step removed privilege escalating", the are fundamentally the same thing. It doesn't matter in any case where a script is executed with bash instead of dash.
Startup Class Notes, Sam Altman and Dustin Moskovitz
QR codes for kernel panics is actually brilliant, because it encodes the data which would otherwise just be serialized to screen in a manner that makes it portable.
Really excellent! I was glad to see that our platform does almost all of these out of the box by default.
This is always a no win situation. I am actually a male product leader and it was written by a female product leader. It is much easier to write (and read) with a "he" of "she" vs "they." We are sensitive to this issue and do our best to mix the pronouns in posts. Thanks for the comment.
Unrelated, bit it irks me that in 2014 there are three countries left that have not adapted to the metric system: Liberia, Burma, and the United States. So when I read

"1,141 feet long with room for more than 4,000 passengers"

I have to mentally translate it to:

"348 meters long with room for more than 20-score passengers"
Molecules, a chemistry game
Connect Molecules together to get points. A cool and addictive new game for iOS. Made by two teenager from the Netherlands. Download now: https://itunes.apple.com/nl/app/molecules-a-chemistry-game/id910014218?mt=8
It really depends how you use it. "Technical analysis" refers to techniques that are as disparate as "cooking". There is evidence of some technical stuff being quite valid--the relevance of momentum to returns, for example--but there are also plenty of people who misuse it.

My own view is that it's a window into the pricing process and adds depth to the practice of reading the market that many analysts go through. Ignoring technical analysis when looking through charts is kind of like watching TV in standard definition instead of HD. Even though it's kind of still the same thing, I enjoy it.
Лосиный means elk?

Moose is американский лось

I've been working on a Russian language app. It's kind of important that I understand the nuances.
Did you really expect a service for node.js to not use meaningless buzzwords? :)
What the actual fuck is up with that intro paragraph? Robot housewives? Not a bad article after that, but crap on a cracker that was painful to read.
Not sure I follow. So you are dismissing PH because some people are publicly asking publicly for instead of via gchat, gmail and FB like ppl do for HN?
Thanks, that makes perfect sense. I guess my worries came from the fact that in my current company I don't know of any of the 100s permanent devs that came from a contracting background, so I sort of raised flags for me. That could possibly be because contractors dont often go back to permanent roles, rather than them being undesirable for a permanent position.

Really good point on the Math's side of the business. I am based in the UK, hence things like Health and Dental and very good and free, therefore no need for costly private insurance. Pensions, the same, although I would make arrangements myself to contribute to it privately also. Taxes and other deductions, I plan to hire a good accountant that can both ensure I have all my affairs in order as well as look after my financial interests. PTO/Instability is the only true financial downside I can see, however, for the latter (at least in UK) even if you are a contractor they need to give you 1-2weeks pay should they wish to terminate the contract early - which should keep me afloat while finding new work.

All that being said, I think the main difference between US and UK when it comes to permanent salaries is that the US has much higher base in average rates than when compared to the UK. Not to mention the buying power of that salary is order of magnitudes higher than over here. Therefore in a way, it seems more unlikely (if I were to be over there) to do contracting when balancing the pro's and con's of both options.

Thanks again for your words, and advice.
Can confirm on AT&T / iPhone 6 :(
Rudal Attacks Bombard Islamic State – ISIS