skysight-inc/HackerNews huggingface dataset:
> But remember that this is why Meteor is still on 0.x version. This basically means - "we're still working on this stuff and figuring out the API, things will break along the way before we reach 1.0". And that's exactly what's happening. They are doing something so innovative that it's impossible for them to nail it on the first try - sometimes they're test one solution for one point version, but then listen to user feedback and change it. And this is good, because it means that 1.0 will be more mature all battle-tested.

Yeah, this is a good point. I guess what annoyed me though was Meteor had a lot of hype, trying to onboard devs with the message that "Meteor is easy for anyone to build a web app!". It gave off the impression that it was ready for a junior web dev to jump in and start building things, which as it turns out, is quite far from the truth.
The man who found the web's 'most dangerous' Internet security bug
Nice blog, really nice site design.
Show HN: Illookinati.js - make DOM elements look at your cursor
Desktop chrome sync and native ad-block! Woooha! I'm sold!
Thanks for the considerate reply. I'll wait until 1.0 and come back and have another look around when the dust has settled. Backwards compatibility is such a big deal for so many people, I hope you guys can keep things stable post-1.0.

Good luck with Meteor. :)
> 'There are already reports of CFLs and LED lamps burning out long before their rated lifetimes were reached.'

What's more worrying is that Governments have outlawed traditional light bulbs in favor of LED or CFL ones. If that's not some powerful lobby, I don't know what it is.
The nice thing about being paid three times what you need to live comfortably is that you can then save all the money you need to live in a third of the time. You're then free to quit your job and go live your life during that other two thirds of the time.

In my experience, I've found that 3 to 6 month contracts work best for this, as it gives you a good 9 months to a year to relax before you need to start thinking about work again.

As you've noticed, there are no other professions that pay this well and are in this high of demand for talent. Think very hard before you throw that away to drive taxis full time.

Since you say you've been doing this for 12 years, you no doubt have a few dollars saved away (especially since you claim not to have had a "life" during that time in which to spend your money.) I'd recommend forgoing every one of those job offers for the moment and taking a good year off starting today. Go travel the world and find that life. Come back when the money starts running out or (likely to happen sooner) you miss having to use your brain.

Good luck!
http://shellshock.co.za/

i thought this was pretty straightforward
Interestingly, if this was a staged event to create fear, it fits the definition of terrorism.
Yeah I did. I run a niche site that gets about a thousand hits a day. It has a cgi that uses bash. I've got logs going back to January, and the first (and so far only) attempted exploit is from shellshock-scan yesterday. It came after the first bash patch, which I had applied, and did not succeed.
> Why is it so bad to have a bad employee among the first employees?

Bad employees are a cancer. They literally spread and infect otherwise healthy employees.

When a bad employee is retained another employee who is at a similar level who does good work begins to see that management is unfair. It is not fair to compensate two people equally when their work is not equal.

Also, the good employees begin to see that management is failing to do their job managing people.

And the list goes on and on.

In a startup the team is very small and resources are tight. For example, if there are 2 founders and 1 employee (who's bad), then 1/3 of the company's capacity is being wasted. Actually, it's worse than that. What happens is that the 2 founders waste additional time "managing" this employee, discussing how to handle the situation, etc. Basically, it's a big time suck at a point in the company's life when time is extremely valuable.
Surely there's some miscommunication or exaggeration there. I don't think most people could drink 12-14 wine bottles of water a day. Forget alcohol poisoning, you'd be risking death just from hyperhydration.
Indeed. When PassengerLoadShellEnvvars is turned off, or if bash is not the user's configured shell, it will not invoke bash.

Regarding the Debian 7 patch: I can't find the link, but they released bash package 4.2+dfsg-0.1+deb7u3 shortly before we published the advisory. The changelog explicitly mentions CVE-2014-7169. I also tested the exploit code, and wasn't able to trigger the exploit on their new bash.
I'm a vim (loser[1]) and terminal (power) user for 7+ years.

Two things comes to my mind when we talk about emacs and other editors.

The Terminal! In particular iterm.app

Basically with iterm and vim, I'm on osx close to a i3 on linux.

Vim works perfectly inside a terminal (no need to remap meta).
We have terminals on android, ipad etc...

I love working in a terminal because... well, is where I spend most of the time. Running ruby, compiling go, js, logging on a server, running a script, tailing logs...

[1] loser because my vim is "modern" so with mouse, arrows and so on...
I wrote a pretty complex app on 0.6.5. It wasn't hard to bring up on 0.8 when that came out last March. I haven't touched it since May, except to run "meteor update" and start the service up again. I have it running on 0.9.3 now without any issues.

It's a very good idea to limit the number of external packages you depend on in any environment. And if you take the time to inspect the source code behind a package before you commit to using it in your project, you can make things easier for yourself in the future. MDG (Meteor Development Group) is very transparent about what they're changing and why - just follow the meteor-core Google group, and/or watch the commits on their github page. If you're paying attention, you will often have a month or two of warning about what a future release will contain.
Apple Pay + v.zero (Braintree)
we call it the 'shuffle filter' but that is all
Security experts expect Shellshock software bug to be significant
I'm a big fan of SELinux, and for many shellshock attacks it will limit exposure, but Dan should know better than invite people to ask him how SELinux helps mitigate a dchp shellshock attack...
Making a secure elasticsearch on openshift with data from MySQL
does that matter in seo
Mars mission: Key facts on costs of travel to Red Planet
That's a clever bit of scaremongering, if you do the math. Marijuana smoke is more dangerous than an equivalent amount of tobacco smoke, but a typical marijuana user consumes far less than than the typical cigarette smoker. Nobody (or almost nobody) has a pack-a-day weed habit.
As an American I'd never even heard of these things except through internet exploration, but I was always particularly fascinated with RISCOS once I did; even ran ROX briefly. I've been tempted to get a Pi just to try the real deal.
This is actually great! More like this!
> The state of browser benchmarking isn't good.

You can delete the word "browser" from that sentence and it's still true. Just one example: You wouldn't believe how many large projects rely on Dhrystone for benchmarking and selecting silicon.
Why find another way? I like to point to Geert Wilders https://en.wikipedia.org/wiki/Geert_Wilders

The Dutch parliament is the same size and the Australian parliament. In about 5 years they went from a new party to the 3rd largest in the Netherlands. They are still the 4th largest. And these guys seem a little bit wacky. Why can't we get a third party (or the Greens) elected?
Why not actually also stop them?
I'm not sure the folks in Visual Studio are representative of all of MS though. Being a business unit where our customers are developers, the PMs have to also be developers. I'd be surprised to find PMs in WP or Xbox writing as much code as the VS PMs do.
If your heroku costs significantly cut into your profit margins, you should certainly start paying attention to those.

For most well designed services, that is simply not the case. If my revenue from $1000 of heroku bills is $20,000, cutting $500/mo off of my server costs in exchange for any amount of hours or risk is simply not worthwhile.
Build mobile apps in your browser
Day 98 – Choosing the wrong customer
It's not quite the same but since Emacs is primarily an OS it has window managements build in, so by running it fullscreen and making a bunch of horizontal and vertical splits you get pretty close to i3[1] as well.

The only problem is terminals. You can run them inside of Emacs, but there's always issues. You can run eshell[2] which is wonderful. Myself, I prefer to use terminals outside of Emacs.

[1] my development OS is Linux and I run i3

[2] http://www.masteringemacs.org/articles/2010/12/13/complete-g...
It's not indirection. It's signaling.
Some resources in this thread: https://news.ycombinator.com/item?id=8045805
I think it was Alan Kay? who said it's expected to learn a new editor, as well as move into a new house, at least once every 10 years.
Pointer ownership is the most important feature of Rust, and everything is built around it. The management of memory, auto-freeing of resources (a mutex unlocks simply when it goes out of scope). It also ensures that no piece of memory has more than one pointer which is mutable at any one time, allowing many optimisations that const in C++ does, but without actually having to annotate all your variables. You can also guarantee that a new thread shares no memory with another thread, preventing many types of race conditions. Goodbye to memory leaks, goodbye to buffer overflows, goodbye to use-after-free, goodbye to null pointer crashes.
And now you're using evil-mode I assume? (If not, try it out!)
IIRC, a lot of it was credited to the difficulty of getting pure drinking water. Fermented beer (with considerably lower ABV than we're used to) was much safer to drink than water from a river that everyone upstream had been throwing their trash into.
Debian's default /bin/sh is not "really bash," it is dash. The same is true for many embedded distros based on busybox.
Three Questions with the CEO of D-Wave
That test doesn't detect the vulnerability - needs to mention /bin/bash not /bin/sh
Ask HN: How does Google stores GA data?
And what improvements can be done on the same?

If there is any previous thread or resources related to the topic, please provide links. Thanks.
Redhat is "really a 'linux' company."
It is possible to use Emacs + evil without knowing Emacs inside-out, but you do need some basic Emacs knowledge. If you had to do C-x C-c when entering a non-evil mode, you did not have that basic knowledge :-)

The least you should do is the tutorial that's presented on the startup screen or "M-x help-with-tutorial".
Ballmer to Purge His Sportsball Team of iPads
I hear this a lot, what exactly is the problem with running with a smart phone? I run with my 5S all the time and I barely notice it is there. Is this just a problem with larger screened phones? Is it really such an inconvenience that it justifies a +$200 watch to solve the problem?
Statement #2 is the simple expression of the issue that's necessary for understanding it, notably missing or obfuscated in all the other massive verbiage on the topic today.

Thank you, gentle responder.
I was a vim user for years. I accepted a challenge from the programmer who sat next to me (an emacs user): we'd swap editors for a week. Every time either of us swore or complained about the editor, we'd pay the other a dollar.

That was 2011. I've been an emacs user ever since.
Wow, this news almost makes me drool. I will keep my eye on that. I'm on SBCL right now, but I can't wait to see what Lisp can do with LLVM...
What about the other guy?
I'm sorry, everyone in this god damn thread is stupid if you think there is a recipe for this shit. This is all part of the propaganda machine to make YC relevant.

This is just a warning. Down-vote me to heaven.
"A drink" in these studies refers to one of the following, which are approximately equal in alcohol content:

1) A shot of hard liquor

2) A 12oz can of beer

3) A 5oz glass of wine

So a Pint of beer is 1.3 drinks, a generous pour of wine could be as much as 2 drinks and various cocktails are all over the place.
You could probably exploit it via e.g. USB too. A lot of shell scripts get run when you plug in an USB device - And I'm sure you can cram the exploit into one of the device strings that the host queries for.
The default /bin/sh in Debian is dash.
It's glad to see the FSF put out a statement on this. Unfortunately, I wish they took more proactive approach towards this rather than asking for money. That won't solve the problem.

Good code quality, transparency into maintainership, and an open development community are essential to make sure that eyeballs fall on the code.

bash's development is done by one person (Chet Ramey), without any transparency into changes at all:

http://git.savannah.gnu.org/cgit/bash.git/log/

The commit that fixed the CVE didn't even mark it as a security release. It's just like every other Patch Release. This is not how you safely maintain a critical component of an OS.

This will not be the last time we find a security issue in bash.
Whether they work as reliably depends on the language. Emacs + Slime for Common Lisp is fine. Nowadays there's luckily a lot of editor / IDE independent tools like Jedi, ycmd, eclim which improves the situation for Emacs and Vim considerably.

C++ has always been had issues but for me it's good enough especially since I move between languages and OSes a lot. If I was just doing C# on Windows I would probably use an IDE tuned for it.
shellshock_detector.lua seems to let this more obscure exploit slip by, undetected:

http://seclists.org/oss-sec/2014/q3/696
http://seclists.org/oss-sec/2014/q3/734
Under-engineering, over-engineering, right-engineering
> Are there any other former vi/emacs users (like, hardcore - I used to browse the web in emacs) who ditched it for an IDE?

I'm an active vimmer very involved with the community and, for me, using an IDE or Vim is not a political/religious/philosophical choice: it is a pragmatic choice. When I need IDE features I use an IDE, when I don't I use my favorite text editor. Simple.

> I found that the mouse really wasn't a productivity killer for the few times you need to use it in a modern IDE.

"Modern" IDEs expose all their functionalities via keyboard shortcuts so you don't really need the mouse.
(You do know that the programs compiled down to asm.js do actually have strings, right?)
While this is generally true of newer Debian installations, older machines that have been been regularly updated over the years to stable may still have /bin/sh pointing to bash. I fixed a few of my machines yesterday to use dash.
This sequence failed for me because my Ubuntu 8.04 didn't have patch installed.

I found a source copy at https://launchpad.net/ubuntu/+source/patch/2.5.9-4 and built/installed that first. The resulting fix appears to work (after copying resulting bash to /bin as noted elsewhere).
Good question! He switched to vim due to RSI I believe.

Conclusion: neither is better. I think.
TimeSeries.Guru – Fully hosted time series database on demand
The new patch "bash-X.X-env-inject2.patch" is actually http://seclists.org/oss-sec/2014/q3/att-690/eol-pushback.pat... which doesn't work in bash-3.2 from CentOS 5:

$ bash --version
GNU bash, version 3.2.25(1)-release (i686-redhat-linux-gnu)
Copyright (C) 2005 Free Software Foundation, Inc.
$ env -i X='() { (a)=<\' bash -c '/etc/crontab cat'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

for reference, thats how other shell behaves:

busybox$ env -i X='() { (a)=<\' ./busybox hush -c '/etc/crontab cat'
hush: can't execute '/etc/crontab': Permission denied
When they introduced the digital crown as an interaction mechanism I thought it was genius. When they showed the home screen I realised they had lost their minds.
Reasons to be Creative: Exploring through code
Quite possible. But it depends on what level of disaster you want to protect yourself from. Single EC2 instance termination is much more common than an entire availability zone going down. I'd say OpsWorks auto-healing is better than just running a standalone EC2 instance, and configuring a full auto-scaling setup with your own custom AMIs and boot scripts is even better, but also much more work.
Make in India for IT Sector
Simple network bridge configuration for Docker containers
In the EU, incandescent bulbs were banned as part of a directive [1] to reduce energy use, as only 10% of the energy put in was converted to light. That sounds like a sensible move to me rather than lobbying.

In the UK, CFL bulbs were also subsidised and/or given out free to households by the energy companies before incandescent bulbs were banned.

[1] http://www.theguardian.com/environment/2012/aug/31/lightbulb...
I have struggled with addiction, and I don't understand it either.

A person of the right frame of mind can reduce their intake to a point of normality. There is no difference between an alcoholic and a healthy person other than their temporary blood chemistry and a predisposition to drinking. Framing it as an on/off is a tactic used by those who don't believe in the ability of another to moderate volume.
"If you want to use emacs as if it was vim why change?"

-- to get all that juicy goodness that is the emacs environment, that's why. Emacs is far from perfect, but there are a lot of things to like about it -- especially if you want to interface with Lisp or Lisp-like environments (Common Lisp, Scheme, Clojure, etc). Emacs does a better job of interacting asynchronously with other processes -- which is one of the reasons it is better for use with Lisp-like environments.

I've used vim for over 15 years, and I still use it daily, but I prefer the emacs/evil environment for anything where I want to interact with a repl from inside my text editor.
That's a lot of resentment you're carrying around there...
I don't see the new update on Ubuntu 12.04.
What version of bash contains the complete fix? I'm still at 4.2.25(1)-release
> it's not within your realm of understanding

There's another reason which you didn't mention. It's not personality, and it's not that I feel terrible after a few drinks. I drink very little because the following [1] is incomprehensible to me:

Alcohol – Euphoria has been reported during the
first 10–15 minutes of alcohol consumption.

I have gotten very drunk and yet not experienced euphoria or anything similar. To be sure, alcohol has physical effects on me (e.g. impairment of judgement and impairment of coordination). But it just doesn't do anything mental, for better or worse. I'd bet that many/most of the 60% or so of people that have less than one drink a week fall in that category. I.e. to us alcohol is "meh".

I'd much rather have chocolate or sugar than alcohol. E.g. I like Grand Marnier, but that's because it has a pleasant sweet taste, not because it has alcohol. I'll drink a few beers a year, but that's because I'm doing something social, like watching a football game with friends.
YC has exactly shown there is a recipe. And that goes back before they were popular - the very first class in fact.

After all this time of YC doing things, why don't you have have actual criticism, instead of ad hominem. So why troll?
That can get tricky as a general case, but would probably work OK for most people in this specific case. But, then again, hopefully you've patched bash already anyway, so blocking hosts that are scanning for a vulnerability that you've already fixed probably won't accomplish much.

Generally speaking, if you use something like iptables to block abusive hosts, you dive head-first into a very deep rabbit hole. Usually sysadmins don't want hosts blocked forever or iptables with 30k+ lines in them, so now you have to also add some kind of automated ban-clearing feature. Then you want to make sure you don't ban certain networks, so now you have to have some kind of whitelist feature. Then sysadmins will want to be able to tune which networks are trusted and which aren't, so now you have to add some configuration options for it. And so on.

I've written some software for my servers that does this for several different annoyances, and I spend almost as much time tuning the software as I spent dealing with the annoyances in the first place.

If sysadmins really want to auto-ban abusive hosts, you're probably better off letting them do it with something like Fail2Ban, and then all that muckety-muck becomes their problem, and not yours.
Heroku can run containers as non root
This could be a piece of the puzzle: http://www.wired.com/2014/09/the-next-big-thing-you-missed-s...
Worth pointing out that Japan's NHK is actually modelled after the BBC. So that is two "wins" for that funding model to my mind.
dash changelog.Debian.gz entry from July 22nd, 2009:

* Change the default for the system shell to dash.
* Ship /bin/sh in the package and fix the diversion handling
for it to make sure /bin/sh is always present.
* Set debconf priority to high when upgrading from an existing
system.

Unless the admin has--for some bizarre reason--set debconf to critical; during one of those "regular updates" the admin would have been presented with the following question:

The system shell is the default command interpreter for
shell scripts.

Using dash as the system shell will improve the
system's overall performance. It does not alter the shell
presented to interactive users.

Use dash as the default system shell (/bin/sh)?

<Yes> <No>
From my experience, if someone is complaining about scrolling then they're on OSX with inertial scrolling. It really is a pain when websites take control of the scroll positions.
Does this fix CVE-2014-7169 as well, or just CVE-2014-6271?
Start up. Cash in. Sell out. Bro Down.
Docker and Heroku use the exact same sandboxing technology under the hood (Linux namespaces and cgroups). This is not surprising since Docker came out of Dotcloud, a direct Heroku competitor. The pros and cons of linux namespaces have been extensively discussed, it's no silver bullet but when used properly is quite robust and is rapidly gaining industry recognition.
Depends on what you look at. LispWorks is fast, but not really faster than SBCL in Gabriel benchmarks. But what about real programs, garbage collection, etc.? LispWorks is used because its implementation is very capable, widely ported and it has stuff like a GUI toolkit which runs on Windows, GTK+ and Cocoa/Apple.
The actual drawbacks (the author has chosen to ignore them):

- less secure

- you still have to update the system images and redeploy a lot (its made for that so its fine). you cant just spin an image and stop caring for it. libraries will update and potentially breaking ur app because u know, performance, sec fixes, the usual

- docker itself is not very nicely made, hard to debug etc. hopefully will get fixed over time.

what is actually does better?
its faster.. not 26:1 but it is faster obviously. mainly, you dont have to preprovision vms since there is no boot time. so you can deploy fast.
its also providing a much needed API/glue for all the things.
Oddly enough, a few hours after my post we were advised that we'll be getting a credit. Not as much as we'd hoped for, and it's taken three months of daily chasing by us to get here.

Just rather disheartened by the whole thing, tbh!
Using Multiple R servers for distributed processing
Eventually this will work with docker as well when distros enable user namespaces.

but that doesnt change that you share the same kernel, which isnt going to be as good as running a kernel per container security wise.