skysight-inc/HackerNews huggingface dataset:
An Android phone is actually quite usable without Google's app store, using alternatives like F-Droid and Amazon. You can't say that about an iOS or Windows phone.
HubSpot Raises $125M in IPO
CVE identifiers are given ascending numbers, after the year-prefix.

You shouldn't try to guess the day/month from the number!
Why does this mean I'm vulnerable? To what attack, exactly? My bash is already patched to not execute code in environment variables, so how is an attacker going to get the above exploit to be running in my shell?

Edit: Using the other test further up thread (which does actually make use of environment variables), my system says "not vulnerable". I think this test is not perfect.
What I Learned Talking to 500 Customers in 4 Weeks
Am I misunderstanding something here? I don't see anything other than an .mp4 video served via a <video> tag from a URL that ends in .gifv. I was interested in seeing how it worked to look into supporting it for a mime type detection library I've written.

The blog post mentions submitting a specification to the relevant standards organization. Are they planning on creating a new mp4 ftyp and registering a mimetype with IANA?
Oh thank god. Finally.

I've been hoping they'd do this for a while. I hate browsing Reddit and finding a link to a little 'video' that then takes minutes to download fully and still looks terrible because it's a 15MB gif.
I dont get the trick.Is it gif or a h264 video inside a "gif" container? looking at the source code,I see a video tag.
The problem with #1 is that the minifier (e.g. http://closure-compiler.appspot.com/home) can't optimize as much.

---------

Example using strings:

var obj = {
start: function(){
'use strict';
console.log('start');
},
stop: function(){
'use strict';
console.log('stop');
}
};

exports.onDummy = function(success){
'use strict';
var method = (success ? 'start' : 'stop');
obj[method]();
};

results in:

var a={start:function(){console.log("start")},stop:function(){console.log("stop")}};exports.a=function(b){a[b?"start":"stop"]()};

---------

Same thing, using if..else:

var obj = {
start: function(){
'use strict';
console.log('start');
},
stop: function(){
'use strict';
console.log('stop');
}
};

exports.onDummy = function(success){
'use strict';
if (success){
obj.start();
} else {
obj.stop();
}
};

results in the much shorter:

exports.a=function(a){a?console.log("start"):console.log("stop")};
Just checked on my Raspberry Pi, Raspbian does not yet provide a fix.
It's fine to have bash on your system as your interactive shell, if that's your preference. The problems occur when you have /bin/sh symlinked to bash. "Bash is for people, not for scripts" :)
Ancient news! It was found - and fixed - over a month ago now :)

This was one of a spate of bugs found when people started poking Bash's parsing.

This particular bug was found by Michał Zalewski.

http://en.m.wikipedia.org/wiki/Shellshock_(software_bug) has a list of the vulnerabilities found (so far).
I'm also watching the 3d printer > sugar printing > test tube blood vessel creation / organ structure creation > implantation. That research, blended with adult stem cell biology shows amazing progress in recreating organs at will.
Case in point: the Crossrail tunnel through Tottenham Court Road has about 85cm clearance both above and below it, and had to be constructed with the Underground tunnels around it still in active service.

Building new lines through relatively soft clay is really hard when you have hundreds of notable historical buildings that you cannot afford to have any subsidence (like, millimetres is enough to cause really damage), and then when you don't really even though where half the other underground pipes are exactly (many of them are hundreds of years old, and some we simply don't know exist)… It's a real challenge.
Is Mediacru.sh banned from Reddit? I just saw a thread the other day where someone said the domain was blocked by admins to prevent it from competing with their preferred service (probably Gfycat).
I don't know if its just me, but the GIFVs embedded on the page dont load for me, unless I click on them to open them in a page on their own, and the second one doesn't play even in this case.

Firefox 32.0.3 on Linux
So... they were losing eyes to gfycat and decided to copy them?
Security by obscurity works. I don't know why so many people think it doesn't. If you don't have the source code to something, you have to poke around rather blindly to try to find holes. If you DO have the source code, you can analyze it and find holes in a targeted and specific manner.

I understand the argument that you want to show your code to smart people so you can proactively find and fix holes in it, but that's not always feasible or smart.
I love this! I 1) abhor offices and 2) feel like i should be outdoors most of the time. This seems like an unbelievably good compromise.
it is also useful for cross browser debugging. having a console.log() in your code running in IE will cause problems if the console isn't actually open. If you use window.console&&console.log() you can be sure that it wont hurt your code running in IE.
You'd figure the timeout would be pretty long, 4 hours or so.
Tricking Markdown to let me use []() syntax within HTML tags
It isn't even close to being solved in Silicon Valley, for a variety of reasons, mainly due to the culture within the industry. My opinion is that there are two strains of cultural thought in this industry that allow developer wages to be kept relatively low compared with the revenues and margins of the companies they work for: 1) the rather Galt-like (and empirically unjustfiable) thought that development work is a meritocracy; 2) the strong line of thinking that prioritizes "enjoying my work" over "selling my very life in the form of time" coupled with the frequent (mistaken, in my opinion[0]) belief that the work is important.

[0] I believe it's mistaken because, frankly, the vast majority of development work is for the very base purpose of commerce. Rarely, in cases where development is related to some scientific or artistic pursuit to advance human knowledge, it's important in any meaningful sense outside of commercial activity. On this basis, the commerce-related importance of a role necessarily implies that compensation ought to be a major factor if considered from a rational perspective.
Ugh, MP4. Terrible choice.
A frugal trade? Americans spend less on food, more on technology
Better details here: http://www.windowsphone.com/en-us/store/app/microsoft-xim/36...

Excerpts:

• Xims only stick around for a little while so you can enjoy the moment with no storage or organization overhead

• Xim is available for iPhone, Android and Windows Phone 8 devices and works in most web browsers

• Xim will initially be available in US and Canada only; we plan to add additional country support shortly
> That's probably what I would end up doing.

Same here. And I would treat it like any other cold call: if I have time I'll waste some of theirs, and if I don't I'll get them off the line quickly with no care for how rude they might think I am.
Why didn't they just use webm?
Self-development can also be encouraged by a company though, by throwing dollars at you. I am often suggesting to go to conferences that my company views as "small" and "not immediately relevant" or that they talk about tech that is "so bleeding edge, it might not be around later".

The value comes from allowing employees to get a little elbow room, think out of the box, grow their skill-set and become more valuable to you. When you show employees that you want them to be better and you'll give them space to do that (and money), they want to stay there.

Why would I, as a husband and father, want to sacrifice very precious vacation time to attend a tech-conference instead of play at a water park with my kids, or invest in my relationship with my wife on a romantic getaway? I wouldn't. But what my company, and several others out there, says by their lack of support for personal development is, "hey, you wanna be a better programmer... great. We'd love that too. Go do it on your own time. That's what we give you vacation for! Not to wind down and unplug and be a great daddy, you kiddin' me?"

The company expresses value for you by letting you have a bit of room to do things you want to.
Very few practical purposes. It was already described what it does - but the thing is, why would you ever want that?

If a function is coming up undefined that I expect to be defined, that's an issue - not one I want to fail silently - because that is no fun to debug.

If something I expect to be defined isn't, that should throw an error and stop execution.

There are some edge cases where it may not matter and there is a legit reason why a function may sometimes be undefined, but I've never written code like that and can't think of anything that doesn't have a much better alternative.
I'm a little tickled by the author's clear concern about the idea of giving coffee to a child, yet in our society we give adderall - amphetamines - to preschool aged children. Caffeine really seems pretty tame in comparison.
>>> That's why 27% would leave over peanuts. One job's as good as another, so why not take the extra cash?

This also depends on the industry. Being a developer right now is like being in a gold rush. Supply and demand is what's driving salaries and contract rates. Need a Jevascript developer? Good luck finding one under 100K per year. When your industry is ripe for you writing your own ticket, then the leverage is with the employee, not the employer, it makes easy for people to leave one company and join another on a small raise since they know if things don;t work out, there's a dozen other companies in need of their services.

What about being a Carpenter? With the housing crash, and the slow recovery, most carpenters don't have the opportunity to be moving all the time. Considering right now the supply outstrips demand, their salaries are being driven down and the power then rests with the employers. The carpenter in this scenario is more likely to just stay put regardless of how much he hates his job or his boss because there is no certainty he'll find something better and get be paid more than he currently is.
Worth reading: Jean-Paul Sarte's reasons for declining the prize when awarded to him in 1964:

http://www.nybooks.com/articles/archives/1964/dec/17/sartre-...
Seems like it was created a month ago today:

Date Entry Created: 20140909

Also, there's been a few more patches since (bash43-030):
http://ftp.gnu.org/gnu/bash/bash-4.3-patches/
This is a valid complaint about Monsanto and it is one that I have myself, but it is also not the complaint that was being referenced. GMOs (not necessarily Monsanto) have great potential, yet just the words "non-GMO" printed on a package are enough to convince people of one brand over another. The fact that GMOs are a political issue in the US is more proof that there is resistance to progress, at least in this particular respect.
So when they are under the train they are no longer a 'customer' but a 'passenger'...
Eclipse Xtext Goes IntelliJ IDEA
It's a month old. There's a filing date on the linked post. You can also Google it.
3 Questions with Dr. Kimberly Scott on Girls in Computing
works for me, chrome / windows
I think it all but caught up lately in VP8 vs h.264 performance. Google kept improving VP8 performance. However, webm has also added VP9 support recently, which is clearly superior.
Social Traveling
Hey guys, we've been working on a little project, Travel Stories (http://www.mytravelstories.net) and will love to have feedback on user experience. The website is a platform to share travel experiences with others using pictures and keeping journals. Any form of feedback on what you think can be done to improve will be very much appreciated. Please bear in mind it is a continuously improving website so there will be constant improvement, especially with the feedback we get from you guys. Thanks.
"With all these improvements, Imgur will now denote converted MP4s with a .gifv extension. The intention is to signal to users throughout the Internet that these links will feature a GIF experience that incorporates all the current and future enhancements made through Project GIFV. Imgur plans to submit an accompanying specification to relevant standards organizations before the end of the year."

This is bizarre. GIFV isn't a new file format. It is just an alias for an existing format. The only reason the letters "GIF" are in this new file extension is to signal that the file was converted from a GIF, but who cares, apart from the so-called cultural connotations?

I mean, does anybody care to have a BMPJ (a JPEG file that was converted from a BMP) or a WAV3 (an MP3 that was converted from a WAV)? Or a .GIFMP4GIFMP4GIFMP4 file, which was converted back and forth a few times?
Right. Whenever evidence is collected, it's not going to be thoroughly analyzed/saved/etc right away. Especially not in a thoroughly sealed environment.

Just an hour - 2 hour long timeout would be sufficient.
Ha! You have just suggested a terrific feature. I have no idea how we could implement something like that even with the parsing logic. I mean, we see way too many writing patterns on a restricted ingredient entry area itself. So imagining the multitude of edge cases makes my head spin:)

But will definitely give it a shot. We had something like this planned early on, but were too scared to try it out. And yes, we have been improving a lot on the site, please do come frequently:)
It is definitely more readable. Best practices would say always to use curly braces though. I go back and forth on my opinion of that.

Also, for example I use a sublime plugin to automatically tidy my code, and that isn't an option in it, so I don't do it anymore.
What Is Gamergate, and Why Is Intel So Afraid of It?
Who needs ten steps? One or two are usually sufficient.
I think animated webp would have been a better choice.
You read the date on the advisory correctly. 2014-09-09.
Prediksi-skor-turki-vs-republik
This is an... odd submission. But I'm the guy who found this and the '78 one. To cut to the chase, run this command from within bash:

_x='() { echo vulnerable; }' bash -c '_x 2>/dev/null || echo not vulnerable'

If it says "vulnerable", you need to:

1) Immediately update bash to the latest version provided by your distro, or manually recompile with all the applicable patches from ftp://ftp.gnu.org/gnu/bash/ (look at bash-*-patches for your version).

2) Make sure that you have a more reliable way to stay in the loop on important security updates in the future, since most major vulns don't make it to HN - and this one is more than a week old.

...

If you're interested in what "CVE-2014-6277" actually is, or what that test does, check out my recent blog posts, probably starting with:

http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-...
Why a new extension?

Doesn't mp4 have enough extensions? .aac, .mp4, .m4a, .m4b, .mp4v, .m4p, .m4v, .mpeg4 so far.

And now .gifv? I don't get it.
On up-to-date servers (according to aptitude) I get a segfault followed by the "vulnerable" message from that.

Id the seg fault a red herring, or does it suggest I hve a verison of bash that attempts to filter out the problem?
> That is the reason why the tube is closed overnight - as opposed to NYC which is 24/7.

AFAIK, this is changing and a number of lines are planning to go 24/7.

> So many design choices from the 19th century made still haunt the system today.

You're right but the expansion since the 19th century has been enormous. It's not only decisions back then that are affecting service today, but decisions in the intervening years not to modernise the system and make it more comfortable. (I'm not discounting the upgrades which have taken place, just pointing out that there have been opportunities over the last century to make it even better).

As an aside, the Glasgow Subway was also constructed in the 19th century (opening 1896). It was a good 40-something years after London, and is much smaller in scale (most rail - which is extensive in Glasgow - is overground). Living in NE Scotland right now I miss a having modern, reliable public transport system and realise how much I took it for granted.
I'm curious about how a system where law enforcement is supplied by a competitive market would work.
Google's top secret weapon – a hacker they call their Security Princess
CTO of Mention built a product handling tb of data and crawls the web in real time
This is a marketing endeavor that is pretending to be a technical innovation.
I'm getting the same behavior in Chromium 38.0.2125.101 (build 290379) on OSX 10.9.4.
We are getting paid peanuts compared to the unfair captation of our values through Intellectual Property.

Let me be clear: we are undervalued by our companies, and overvalued when sold to the customers. Have you looked at apples/googles net (official) margin? 20+% Stuff like Danone are 5%. And They have incentive to underestimate their profit for paying less taxes.

A coder is like 40% ROI once you set your monopole.

The only merit of a boss? Being bornt wealthy, and then all he is doing is walking into the open like Riquet with the tuft. http://en.wikipedia.org/wiki/Riquet_with_the_Tuft

He can act as a jerk, be an asshole, but everybody gives him the credit of the employees real value, and of course the real benefits.
Webm is superior to gif in terms of quality AND file size. (Other video formats, not so much).
> pop it in a microwave oven

Just popped my phone in the microwave oven. Was able to receive a call on 2G as well as 3G.
Excellent perspective, thanks. I've decided to forego having any part-time founders -- I agree, it just isn't possible to have enough skin in the game.
Now that you mention it, I forget why that specific snippet is in my config... it is part of a block of similar-but-more-useful things (specifically, having multiple caches serving the same static content from a variety of different domain names)
Exactly the same for me - Firefox 32.0.3 on MacOS.
All of these ideas are good (from a consumer perspective, it's too early in the morning to think about implementation issues)...but I have to ask out loud what I frequently just think...why don't we just start adopting YAML more? Or, at least, a subset of the "safe" kind of YAML, mostly restricted to what JSON can do?
Before that, you need to define what level of performance is expected from them - i.e. set clear goals that are achievable.
mediacru.sh admin here. We used to be banned, many months ago. I was talking about our past troubles in that thread.
Superior to GIF.
I did have this thought. I figured people must just accept it (like people living in humid countries might), or shower at work (if they have those facilities). Or perhaps it's only that bad during some months of the year.
It's a video served with the video/mp4 content-type, using the .gifv file extension.

(Well, actually, the .gifv is just a web page that holds the <video> tags for the mp4, but...)
Well, that completely misses the point of JSON: simple and unambiguous syntax.

If you want something that's easier to edit for config files, you can use YAML.
Internet for Everyone by Facebook
Is .webm hardware-accelerated?
It would be nice if JSON accepted comments and Python/ES5 have proven the developer ergonomics of trailing commas, but I'm not convinced the rest of these are improvements.
Good point. I forgot about non Google Play 'distribution'. I just wish it was the norm :)
You mean using a gasoline generator to power the miners? I wonder if using the house electricity isn't cheaper. If it cost more, wouldn't people all begin using generators?
As someone who runs a website with something similar, I'm hoping that Imgur is big enough to push for some open standards around this. I want embedding video to become as commonplace as embedding GIFs.
DEA agent sued over Facebook decoy page
Same. FireFox 32.0.3 OS X
Wow, the colors are just gutted in the mp4 version.
Yeah, while this is a neat idea, it doesn't add much value. I rather have structure to my data.
Well, it's patents are free to licence and with open source code, so it's superior in a way that for many (me included) believe trump the others.
No, probably not anyone who is reading hackernews, but imgur has a much wider audience.

GIFV will help communicate 2 things:
1) this file is audio free
2)this file is safe (people don't generally worry about getting a virus from a gif).
Yep. Plus gfycat.com does that since a while now, but imgur comes as "oh look we're so innovative".

" Imgur plans to submit an accompanying specification to relevant standards organizations"

Hi we put a .gifv extension to mp4 can we HTML5 standard this non standard file extension of a standard format?!

Riite.
It is on my phone.

http://wiki.webmproject.org/hardware/devices
It requires modifying DNA to make neurons sensitive to light. Which is easy to do for a mouse, alter some egg cells do IVF and collect the few that survive and breed from there. But, that's not going to work for people. There is some research into using a virus to modify people, but that's vary early in testing and more focused on genetic diseases.

Hypothetically, I suppose we might start doing such DNA modifications to people. But, better neural interfaces seems low on the list.
IMO yaml is too complex. Just take a look at the spec: http://www.yaml.org/spec/1.2/spec.html
Stack Overflow Valued Associate #00001
Optogenetics only works if you can genetically engineer the nerve cells to respond to light. Gene therapy is still... iffy, at this point.
It's probably assumed to some degree that you know what it is at this point. It's the industry standard HTTP full-page cache daemon.
Nice app. I feel like another biggest advantage would be if we can popup reminder on ctrl+alt+del press. Most of the times users step will go out without realizing meeting scheduled. If user see the popup, it will be reminder for them.
Always initialize your variable. There is not aesthetic argument, but there are multiple software engineering argument against failing to initialize variables.

For starter, you don't have prescience. You can't prevent future version from growing new alternate code paths. As the code evolve, checking that every initialization-free variable will still get initialized is a burden and easily overlooked. Then there are more potent evolution that will make it just impossible: the code will get generalized, or moved into a library, or get a a context object to be able to run multiple instances. Or will get a state machine to handle complex combination of options.

You're relying on the compiler telling you the variable will get initialized. But the compiler may change. Or the human compiling it might not look at warnings.

OTOH, double-iniitalization is mostly a myth. If the compiler can tell the variable may not get any initialization and warn you are exactly the same as the case the optimizer will be able to see the double init and optimize it out. I've looked at generated code and see compilers properly eliminate redundant stores.

You're better off betting on optimization and get bitten by occasional double-stores than get bitten by uninitialized variables and give system penetrators yet another free lunch.
Can't wait to see it get the Jepsen treatment.
It's not exactly fair to assume that the author isn't also concerned about the prescription of adderall to kids as well.
Gemini 7 UFO Incident – Gemini 7 Incidente OVNI, الجوزاء 7 UFO حادث
I'm not sure they'd be the ones on the lower end of things because when you don't earn much, you don't want to risk what you already have for almost no increase (given 5% of little money is very little) whereas 5% of a medium salary is much more of a difference/incentive.
Or 3.) They are new developers. I learned to use that at some point and so did you.
It is asking for adobe flash on linux
One reason is that optogenetics is pretty new research that would have to rely on other pretty new research, human genetic modification is not very advanced (like, there aren't reliable methods that are well understood to be safe). Genetic modification is also really controversial.