skysight-inc/HackerNews huggingface dataset:
IMO, The problem is that the manager of the cloud product isn't the person that is ordering the reboot. The manager of the cloud product considers communication with customers to mitigate their issues a primary concern. Person ordering the reboot is more 'technically' focused and representative of why engineers have a hard time as managers (eg ignoring the potential ill will this type of action can create).
Can anyone confirm that this is still a security issue?

My reading of this is that it's weird, and it's certainly a bug in the parser, but because you don't get to put the executable code in the environment variable it's not an RCE exploit like the last bug was.

Does anyone have confirmation that this new bug allows you to RCE with control of the value of an environment variable alone?
Zizee had 4 paragraphs, and pravda pointed out that paragraph 3 was fallacious. The fact that paragraphs 1 and 2 are not doesn't change this.

I have no idea why pravda is being downmodded, beyond silly mood affiliation.
>Every dollar spent by the government into the economy is one dollar taxed out of the economy

Not at all, most governments print their country's currency.
Wait... what? I'm a bit confused here.

Can someone please explain why Samsung isn't selling laptops besides the article's dismissive "It's common knowledge that the PC market is in decline."

Is it that they are spinning off their laptop division, or is there is some other dominant manufacturer? Why on earth are laptops not selling?
"Why do people always pass judgment [...]"

I wonder this as well.

I would like to share one story and one HN comment that I think are both eloquent and highly relevant to the discussion:

Why Explore Space?

http://www.lettersofnote.com/2012/08/why-explore-space.html

Who Saves Lives?

https://news.ycombinator.com/item?id=4025495

* * *

I commented in an earlier story today, but I think this mission will serve to kindle a fire in young people, stoking their interests in technology, science, orbital mechanics, etc... particularly in India, but will hopefully resonate throughout the world. In the broader picture, this mission represents the seeds of inspiration being planted for a future generation. Imagine the scientists and engineers that this event will bring forth and blossom.
Died from Ebola: Photos from the last three days of Marie Finda’s life
Those are completely made-up objections. strlcpy also fails to fix me coffee in the morning, ergo it should be avoided.
You have a lot more faith in insiders, schmoozers and career bureaucrats than I do. I personally favor the dartboard approach.
You should add your view to the cell's contentView instead of directly on the cell, which allows you to keep the default behaviors and also reuse the view.
From a 4k Site Purchase to Close to $100,000 in Revenue in Less Than 6 Months
No. Most of the costs are people costs as the article rightly explains, not fuel. Fuel is an extremely tiny fraction of the overall mission costs.
The codec wars are almost over thanks to Moore's Law. The decoder will soon be streamed with the content, taking up more than a couple seconds of bandwidth. And not surprisingly, the decoder will be written in Javascript/WebCL. The codecs no longer have to be installed on the system, they can be pushed along side the content. Two to three years from now, on modern hardware, you will be able to use the codec of your choice.
In QA literature it is often used in the "unverified fact" sense (which is also mentioned in Wikipedia article).

The Wikipedia article says it well:

A factoid is a questionable or spurious (unverified, false, or fabricated) statement presented as a fact, but without supporting evidence, although the term can have conflicting meanings.
An electric power plant on the roof of your car?
Bash Exploit Test and Fix
What sanitization do you expect the CGI framework to apply to the header value representing the user agent? str_replace($userAgent, '() {', 'no bash bug for you')?

Only a few environment variables are given any meaning by the system. Other environment variables don't have any predefined meaning and can be any null-terminated string.
After having used Emacs exclusively at work for a few years, I am in the process of switching to Sublime Text full time. ST delivers solidly on the excellent concepts that Emacs helped pioneer, including multiple cursors and using generic text buffers for every task. Plus it made the smart move of making ido-mode built-in (and improving its algorithm greatly in my experience).
Exist a distilled example of this? I'm totally lost in how make compiled/static code to work as dynamic.
It's not psychobabble. There is extensive evidence showing that stress and depression result in pain, that FMS is triggered by stress, and that psychosocial factors are important in recovery. The same is true for CFS and IBS, which overlap with FMS.

And the pain isn't muscular in nature, it is neurological.

I've done extensive research into this area for 15 years, written a book about it, and published research, as well as suffering from it myself (and recovering).

Although I haven't digged very deeply into Sarno's theories, I can tell you that from what you have posted above, it is right on the money. However it's not simple 'stress relief' or 'relaxing muscles'. It's more to do with rewiring your brain through changes in behaviour.
Actually, about 6 months ago Microsoft did an about face. They're now approaching near complete C99 support, adding features deliberately rejected by C++, such as designated initializers and compound literals.

In fact, compound literal syntax is probably incompatible with C++, because similar syntax in C++ requires entirely different object lifetimes--expression scope in C++, block scope in C99.

Actually, I think the target may be C11, as I doubt they'll add VLAs.
(I posted a similar comment a few months ago.[1] To be clear I have nothing against the India, its space program or its achievements, but it's impossible to discuss the low price of the mission without discussing the elephant in the room)

There is clear lack of sterilization techniques being used on the ISRO spacecraft. This is clearly visible in the public photos and videos. NASA spend a great deal of time and sterilizing deep space probes to reduce the chance of Earth microbes colonizing a place like Mars, or a moon of Jupiter, but ISRO does not.

Watch this video and showing assembly of this particular spacecraft http://www.space.com/23199-indias-first-mars-mission-prepare...

Compare the NASA cleanroom assembling Curiosity - http://www.nasa.gov/centers/jpl/images/content/482654main_pi....

Most engineers at the Indian Space Research Organisation seen directly operating on the spacecraft are not using facial masks or even gloves for interplanetary missions, let alone full cleanroom coveralls. http://www.thehindu.com/multimedia/dynamic/01608/vbk-05-mars... (via http://www.thehindu.com/sci-tech/science/indias-october-28-m...)

It would be a huge shame for us to have doubt whether the first extra terrestial microbes we find in the solar system were really alien or simply Space Age Earth based life

It also jibes with this anecdote https://news.ycombinator.com/item?id=6552078

This comment has nothing to do with India, ISRO, politics or Mars, but I am curious if anyone with expertise can comment on the clean room practices seen applied in this video. Is it odd that the workers don't have on full 'bunny' suits and have (what seems to be) a relatively large amount of skin/hair unprotected? I don't know if it matters that much, it just seems a little lax given the cost of failure.

Firstly, I've visited ISRO Bangalore(A few years back). And I did see the exact things you mentioned. I did ask the guy(Not sure, if he was the PR guy) who took our class for the tour. His answer was, they were likely assembling some test equipment and not the real equipment that was going to space.
(Which unlikely given parent's NYT article:)

The modest budget did not allow for multiple iterations. So, instead of building many models (a qualification model, a flight model and a flight spare), as is the norm for American and European agencies, scientists built the final flight model right from the start.

It's unclear whether the room is a climate and particulate controlled cleanroom up to the standards required for inplanetary probes, but they may (hopefully) do sterilization through chemical and heat treatments - but that alone isn't enough for planetary protection.

[1] https://news.ycombinator.com/item?id=7964261#up_7964499
Sounds like a good tool for C++ for those times you have to use C++.
That was my initial reaction too, but I'm not so sure now that the bash maintainer has responded. I'm trying to get a better PoC working.

edit: OK, I give. I don't understand how this is different from,

env z='' echo oops

So, assuming you have Stupid Server 2.0, and SS 2.0 allows you to send an Accept: header with,

'' evil command here

...you still need to find a way to execute that command, which is different from CVE-2014-6271, which caused function embedded in environment variables to be executed when they were read.

Am I missing something?
As best I can tell no one has (publicly) demonstrated a mechanism to turn this into an RCE (despite efforts to do so).

http://seclists.org/oss-sec/2014/q3/679

Of course, that doesn't mean there isn't one. It's clearly a reasonably significant issue - the setting of environment variables can cause unintended file system writes (and the same parsing bug can be used for reads) - and you're better off assuming that someone will determine an exploit based on it.
I believe this could be very good for India on multiple fronts.. But I feel the comparison to NASA's spending is somewhat superficial and borderline disingenuous.
PoC floating around:

rm -f echo && env -i X='() { (a)=>\' bash -c 'echo date'; cat echo
> It's even harder because my old boss is now in charge of the relevant funding stream and she shouldn't be working with grants that further her former avenue of research.

That's one very depressing thought. I understand her reasons, but I see the existence of them as a failure in getting all of us to a rational society.
All the best. I'll contribute, what I can.
I wonder if a second stationary cell phone can be used to do differential GPS and cancel out some of errors?
> I would have expected Amazon to rush out a tool you can use to check or add a little marker to the dashboard or a simple API to query. Some sort of synchronous option.

I would expect Amazon to mark unpatched hosts as bad and not permit new instances to be deployed to them, similar to queue draining.

Not cool Amazon.
> Isn't the cost of the sales force built in to the cost of the product, so if the hardware cost went down the end price would be reduced somewhat but still include the cost of sales?

Yes. He was saying that, sure, they might be able to reduce their manufacturing cost by a factor of ten, but not their prices. If the goal is to massively price-reduce medical devices--we're talking by at least a factor of 10 or more--that's a big problem.
My trust in metaphysical and other such sciences dropped significantly on the day I realized that most modern conclusions are just theories and half of them have already been proven wrong.
Go to ISRO's website and look at the starting salary for an engineer. Even for the most paid fields there it is not more than 40000 rupees per month or roughly 650 dollars
Here's an idea: don't install plugins. They are mostly irrelevant to browsing.
Forgive me if this is stupid, but this could work for implement a concurrent VM?
That was not really my point. What people need to understand is that each nation gives certain priority of all the problems and accordingly invests money into those problems. Saying that spending money on X is a waste when you have problem Y unsolved is stupid.

India has 1/6th of world population and has very good reason to invest in space research. India is going to needs its own satellite guided missiles, ASAT, GPS and other systems down the line if those 1.2B people have to see a good future. Or these people will be held hostage to USA's Military Industrial Complex.

India was already one of the largest Shipbuilding nation and had more Aircraft maintenance centers than most other countries in 1950s. India did not invest well into these industries, today our defense imports are obscene. We cant even manufacture a reliable pistol leave alone mortar. Had we invested in those tech also we could have saved a lot more money today which could have helped the poor.
Developer platform to Bitcoin-enable your apps
If you're using hostnames in your config file, that is a form of service discovery. One that relies on DNS. But DNS is a general solution. Are you using a public DNS server? What if it goes down? What's the minimum TTL it'll support?

Also, don't you find it a little odd that you use a hostname to avoid being bound to a specific IP, but you've still hardcoded a port? Either there's value in being decoupled from the address of the service -- which must include the port -- or there isn't.

It generally comes down to gaining more control over the process to achieve higher availability and greater flexibility. Maybe you want all authentication requests from frontend12 to be routed to auth2 for some reason. At scale, it's unruly to do these types of changes by touching config files.
It has to be that. Can't think of another reason why you need to mass reboot the servers the instances are running on and serious enough they are patching through the weekend. Wonder if its being exploited in the wild. Also none of our C3.2Xlarges are getting rebooted, those use SR-IOV which can virtualize PCIE devices at the hardware level so it probably a network boundary exploit allow you to pull other instance traffic.
The same trick can be used to read files as well

$ date -u > file1
$ env -i X='() { (a)=<\' bash -c 'file1 cat'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
Thu Sep 25 02:14:30 UTC 2014

Though obviously it's going to be trickier to find an system that issues commands in a way that can act as a path for that sort of exploit.
Get Your Hands Off My Laptop: Key-Extraction Attacks on PCs
If India really did make it to mars before the US did, we would probably congradulate them, not try to compete with them. When the USSR put Sputnik into space, the US's response wasn't because oh no we need to beat them to the moon! it was because the fact that they could put a satellite into space meant they could also land a nuclear warhead on US soil.
"why were there so few doses [of ZMapp] on hand?"

Don't underestimate how hard it can be to make medicines, especially novel new ones for rare ailments.
No, it will not fly through thousands of pages at a blinding rate using multiple ip addresses, it goes about at a human like pace to avoid getting banned. If an ip is banned a new one may be assigned. If you need to go faster you will need concurrent jobs.

All the jobs use chrome browser, and supports any website.
Not sure. I've been using it since launch and I had no problem whatsoever (on a 5s).
Clear skies and steamy water vapour on a planet outside our solar system
This was just now presented at CHES 2014 [1] in Busan, Korea.
The speaker did a live demo during his talk, which was quite impressive :).

[1] http://www.chesworkshop.org/ches2014/start.php
Your unescaped quotes don't pair up.
The Long Fall – Or San Francisco Summer
That comment wasn't originally about breast pumps, so I can't speak to that specific market. But the comment about sales force costs was about selling products like ultrasound into emerging markets. And if you have products that require lots of training and servicing, and lots of high-touch sales to get to acceptability -- yup, that's gonna cost you! And regardless of the price point of the product, you still have the associated overhead with reaching those markets. There are things you can change about that 'associated overhead' but that's a totally different story.

My gut instinct is that I don't think sales costs are really a huge driver of how companies have been approaching innovation in the breast pump space. There is indeed consumer psychology around how to price products, but the thing that really came across during the hackathon was the frustration people felt about the design and engineering of the pumps -- not the price point.
Reproduced from my comment on the discussion of the previous CVE

The same trick can be used to read files as well

$ date -u > file1
$ env -i X='() { (a)=<\' bash -c 'file1 cat'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
Thu Sep 25 02:14:30 UTC 2014

Though obviously it's going to be trickier to find an system that issues commands in a way that can act as a path for that sort of exploit.
Mobile Bar Services in Atlanta GA
How the Google X Moonshot Idea Factory Works
Sarcasm (and cynicism) all too often act as pseudo-intellectual facades over a posters' inability or unwillingness to exercise critical thinking or empathy. Sarcastic posters are rarely as funny, clever or even honest as they believe, rather, their cynical view is usually obvious, banal and lacking in anything which moves a discussion forward.

Although when they are funny, I usually upvote them.
This wasn't for breast pumps, it was for fetal monitors.

Fetal monitors exist in a fractally broken market. The people delivering medical devices have little motivation to be price-conscious because the people making purchasing decisions about their products have limited motivation to be price-conscious. The people making purchasing decisions have little motivation to be price-conscious, because they just pass the costs on to patients. Patients, in turn, do not ask about costs associated with fetal monitoring up-front, are not in a position to do any negotiation regarding fetal monitoring in the moment, and in any case aren't too worried because their insurance company picks up the cost. Sort of. The insurance company, in turn, doesn't worry too too much about the cost of the fetal monitors that the hospital chooses, because they still figure out how to pass the cost back to the patient - which they can do successfully because in the United States it's exceedingly rare for consumers of health insurance to comparison shop. Instead, they just go along with whatever option is chosen by some HR folks who are mostly spending other people's money and therefore have all sorts of incentive to not worry too terribly much about the best interest of the consumer.

So yes, there is some weird consumer psychology at play. The weird psychology is that we've got this crazy aspect of our culture where it's not just OK for our employers to be meting out important and expensive health care decisions to us (a bizarre proposition if you look at it objectively), it's actually desirable, so desirable that many people are unwilling to consider taking jobs where a health plan isn't included in the benefits package.
https://news.ycombinator.com/item?id=8153670
22 maps and charts that will surprise you
Being electromechanical though, flip-disk displays apparently have significant maintenance costs, as display elements fail quite frequently. Eink would probably be much better on that front, which would be very beneficial for applications in hard-to-service locations ... like billboards...

One of the earliest applications of eink (before eink "paper" was a thing) was actually in advertising signs with huge feature sizes (10s of cm), so big pixels are not something new to eink.
Oh, the first world problems!
"Why exactly is US spending so much of higher education when most of the public elementary education is good enough to mass produce kids whose only skill is flipping burgers ?"

I'm not sure what point you're trying to make about 13 year olds, but I assure you I don't care what you have to say.
They don't need to. "\" isn't an escape sequence inside single-quotes.

echo 'abc\'

will echo 4 characters: a , b , c and \

The \' in the original command isn't trying to escape the quote, it's ending the environment variable in a "\"
PC sales (laptop and desktop) in general have been on the decline since 2010 or so and the margins in that market for players who aren't Apple are generally so low that the declines don't have to be that bad to really put a squeeze on manufacturers.

The iPad/Tablet market gets almost all the credit for this decline in the media but while I'm sure that's part of it I personally think the fact that we hit a point around 2010 where desktops and laptops were just plain good enough (truly good enough, not 640k good enough) for almost everything people normally do was as much or more of a factor than tablets. Short of having a machine die on you there are precious few reasons to run out and buy a new system anymore.

I'm a software developer, a hobby photographer who shoots in RAW and a gamer and even I haven't bought a new desktop or laptop in 4 years (and I used to be someone who would build an entirely new desktop system yearly with major upgrades 6 months in to boost it up).
This happened in Australia as well and it really sucks. I run a 15" Series 9 machine and the only thing you can fairly compare it to is a Macbook Air. They're beautiful pieces of hardware somewhat let down by their crappy LCDs.

I guess my next machine will be a Macbook.
Earlier on a mailing list someone pointed out that there is still an awful lot of string processing going on by bash even after this afternoon's fix. So further bugs were likely to be found now that everyone is constantly sniffing around the place.
I wonder if differences in implied warranty cut into margin in Europe.

It's not super clear what the actual standard is, but I know that (for example) a laptop that I had failed at about 13 months old because of a design flaw and in the US I was SOL, but other complainants with the same flaw in the UK had the motherboard replaced because the laptop was considered "not fit for purpose" which if I understand the Sale of Goods Act in the UK is good for 6 years after purchase — that could really eat into the margins in the hardware industry
I only use plugins that are relevant to my browsing. ABP, Boomerang, Buffer, DownThemAll, Firebug, NoScript, Wallaby...
Hackers
World Best Hackers: Our Set of professionals provide Quality Hacking Services. We have series of testimonies from our clients Worldwide.
We are base in Asia and We are Proficient in Hacking every areas of ICT which include:

* Hack and access DATA FROM ANY COMPANY Web Sites
* FUND TRANSFER FROM ANY BANK WEBSITE
* HACK AND UPGRADE UNIVERSITY GRADES
* SALES OF HACKING SOFT WARES & ONLINE Tutorials
* HACK INTO YOUR PARTNER's FACEBOOK ACCOUNT without their knowledge/Notification
* Hack into any GOVERNMENT AGENCY WEBSITE
* HIJACK A USERNAME & PASSWORD TO ACCESS ANY SITE
* Hack into SECURITY AGENCY WEBSITE and ERASE CRIMINAL RECORDS
* HACK AND OBTAIN CASH ADVANCES
* HACK AND OBTAIN SOCIAL SECURITY NUMBER
* Hack into any DATA BASE
* Hack PAYPAL ACCOUNT, MASTER CARD, AMERICAN EXPRESS etc.
* SERVER CRASHED hack
* HACK INTO COURT SYSTEM AND CLEAR CRIMINAL RECORD
* WE ARE EXPERTS IN DATA AND FILES RECOVERY...
* HACK BANK ATM CARD, PIN and PASSWORD DEVELOPMENT

NOTE

We Offer Expert training on hacking and Pin Generation with our e-Book and online tutorials
* Is your partner cheating on you, we can teach you how to Hack into their phone, monitor their text and conversation.
* Hack and use Credit Card to shop online
* Monitor any phone and email address

contact us at worldbesthackers2020@gmail.com
With a good GUI, and you could do some amazing live coding.
Good point, I wonder if they didn't because that would have crippled capacity due to people rebooting, using up the patched hosts and leaving others without the ability to spin up VMs as it sounds like a significant % of hosts are bad at this point..
Hacking is good for all...