skysight-inc/HackerNews huggingface dataset:
As it's already written in the manual...

http://linux.die.net/man/3/wordexp

wordexp, wordfree - perform word expansion like a posix-shell

So, the implementer decided to take the short route, and just spawn a shell which, essentially, gets passed the input data to wordexp(), to do the work. But, of course, having something that starts with such a comment...

/* XXX this is _not_ designed to be fast (...) wordexp is also rife with security "challenges", unless you pass it WRDE_NOCMD it must support subshell expansion, and even if you don't beause it has to support so much of the standard shell (all the odd little variable expansion options for example) it is hard to do without a subshell). It is probably just plan a Bad Idea to call in anything setuid, or executing remotely. */

...in your standard C library wasn't such a smart idea to start with. Scroll down, there are many more gems in the comments!

Sometimes it's better to just implement it as

void wordexp() {
fprintf(stderr,"wordexp() is a security nightmare. Not implemented.\n");
assert(0);
}

or decide to deliberately only implement a safe subset of the full functionality specified (e.g. only ~user-homedir expansion and $VARIABLES), to at least cover the common use-cases without creating a security nightmare.

(EDIT: typos)
Yes, actually they almost always do. Two-character last names are pretty rare (and of those, many are transliterations from other languages).
Isn't that a big setback for adoption though? The world is moving to multiple-cores, albeit slowly.
What's worse than crappy implementations is that every provider has their own version of implementation-specific crappiness that is inconsistent with everyone else's.
People have names outside of [a-z]. (Me, for example.)
Network debugging tools like Wireshark will have pretty printers for HTTP/2, just like they do for TCP/IP.
The difference is that the old methods were large systems made up of many different pieces that all required a ton of domain knowledge specific to speech and language. Training DNNs requires a lot of knowledge about DNNs, but not nearly as much knowledge about speech. Knowledge of how to train DNNs is highly transferable between domains like speech and vision. Similarly, the actual code can be mostly shared as well; something like Theano would be just as suited to running speech nets as vision nets.

I don't think we're quite there yet, but DNNs have the potential to replace every piece of the speech pipeline with one single net that gets audio samples on one side and spits out characters on the other. All those acronyms you mentioned (with many, many PhD theses behind them) will be irrelevant, in the same way that tons of previously successful specialized computer vision feature detectors (HoG, SIFT, SURF, etc) are now irrelevant to the state of the art in object recognition.
What is your definition of "destructive"? A function with no inverse? Just trying to understand...
Instead of responding to breaches, I would recommend an annual (more frequent is better, obviously, but I think annual is fine) cycle of rotating passwords. Just pick a day and spend it replacing passwords. As a side effect, you get a mental update on exactly what identities you're managing and whether or not you want to modify or close them.

This should be fairly straightforward even for non-technical people, if they've got a grasp on actually using the password manager itself. The hard part is (1) getting the list of identities, which isn't too hard if you're hand-holding, and (2) actually remembering to do it. (Which is why annual is nice. You can peg it to a holiday you already celebrate, or substitute it for one you don't. Halloween, for instance, because breaches are scary? Or something.)

Bonus: if a breach happens that actually feels scary, just do the rotation ritual ahead of time. Not that big of a deal.
Investors Should Know Pay Gap Between C.E.O.s and Workers
There are already lots of ML based languages to choose from with more use in the market than Swift.

A Swift compiler without the Mac library will be a very poor choice in regards to any existing ML language.
Olives, hummus, and sourdough bread.

Herbal teas, coffee and wine.

Goat's milk and honey.

Wild greens, beans, and olive oil.

Work in the fields, gathering it all.

A nap in the afternoon, and plenty of sex.

This is a recipe for a long life.
I was just about to say this too... Even in Europe it's common to use accents or diacritics:

http://www.kidspot.com.au/chloe-renee-andre-need-apply-accen...
This is source code from 2011. Checking http://opensource.apple.com will show that it's not longer implemented this way in 10.10.

Here's the current implementation: http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/Fr...
I'm a linux guy I do not need to touch windows or windows clients daily so what I'm talking about is web ui.
Announcing the Fintech 1,000
Good suggestions - thanks!
No rumors, the source are the Greek Labour Ministry and the European Union.

Search for "greek pension abuse" on Google:

* Greece pulls the plug on pensions for the dead (Apr 25, 2012): http://www.reuters.com/article/2012/04/25/greece-benefits-id...

* 2% of Greek population abuse pension system (26 Apr, 2012): https://www.devere-group.com/news/Greek-population-abuse-pen...

* Greece Still Paying Dead Pensioners (Aug 17, 2013): http://greece.greekreporter.com/2013/08/17/greece-still-payi...

* New Greek finance sham: 120,000 families claiming 'ghost pensions' for relatives who died years ago (12 October 2011): http://www.dailymail.co.uk/news/article-2048385/Greek-financ...
Not sure what you mean by where my info went wrong, but my friend worked at a MS datacenter a few years ago, so I don't know what has changed. At the time, almost all of the techs working at the DC were contractors, not MSFT employees. They were severely understaffed and getting cut back constantly. There were a few different companies doing the contracting as well, and all of them were under the threat of losing out to a lower bid company. The competent techs were getting outnumbered by incompetent techs. That and the fact that MS couldn't even renew basic registrations and certificates didn't surprise me with my poor experience with Azure.

Again, this was a couple of years ago. Also, I attended an event that MS held to show off Azure, and a large percentage of participants couldn't spin up an instance within 10 minutes, some of them didn't even start up. The MS people running the event had a direct line to some techs in the datacenter, but they still couldn't solve the problems. I talked with some MS partners/users who told me that Azure was terrible in their experience and even some MS execs admitted as much in private conversation. It sounds like Azure has improved since then, but I really have to wonder how much improvement has occured.
> sometimes you have to get shit done

And Apple have always been masters in selling polished, nicely packages shit as the most advanced technology ever conceived.
Today I Am Releasing Ten Million Passwords
http://en.wikipedia.org/wiki/Roseto_effect

Wow, that is patriarchal oppression and stifling familial roles.
Could someone with legal background please explain the concept of "protected speech"?

I thought the Constitution is "where the buck stops", the Supreme Law. It takes precedent over any law, legal theory, precedent, tradition, etc.

The first amendment, as written, outright "enjoins" Congress from creating any "exceptions" or define what kinds of speech are actually protected.

I also think the Constitution provides one, and only one way for Congress to modify the 1st amendment so there can be categories of speech that can be "abridged": a constitutional amendment.

So, which kind of legal maneuvering, or reasoning as been used to somehow justify the amending of the 1st amendment without actually amending it?
It would be interesting to see a social graph of the moderators of reddit (who are mods, what subreddits do they mod, how many subreddits do they mod, which users moderate multiple subreddits together, etc.)
Uber Apparently Left Part of Its Lost and Found Database Public
Kivy: Cross-platform Python Framework for NUI Development
Hmm thanks for that. Are you by any chance on a chromebook using Chrome? We noticed this issue with chromebooks... but for Macs and Windows using chrome, it seems to be fine (at least from our tests). Can you shoot me an email at adarsh[at]trippeo?
They appear to be using a "wordexp-helper" in Yosemite. I found this in /usr/lib/system/libsystem_c.dylib (and no references to perl).

[ $# -gt 0 ] && export IFS="$1";/usr/lib/system/wordexp-helper
you will want some extra layers of abstraction that aren't available if you limit yourself to FDs and Unix-style permissions.

I have yet to see a single case where FDs and unix-permissions wouldn't have been perfectly sufficient.

I think the real problem is that we are facing a generation of developers who never learned how to properly use them.
Pick a few of these folks and email them directly: https://www.linkedin.com/title/developer-evangelist-at-micro...
How about just changing it to be more sensible, as an interim solution?
"Like a POSIX shell" includes expanding command substitution. wordexp("`echo hi`") should return {"hi", NULL}. So it isn't totally ridiculous to reach for a shell; tracking multiple subprocesses, and nested command substitution (like "$(echo $(echo $(echo foo) $(echo bar)))") is a pain to reimplement correctly.

In an ideal world, we'd have a libsh that exposed all of the steps of what /bin/sh does in a nice fashion, this function would call one of the libsh functions, and /bin/sh would be a 10-line while (true) { libsh_this(); libsh_that(); }.

In a slightly less ideal world, the shell would have a way to separate things with null characters, without bothering Perl.

We really don't live in an ideal world.
I think Zach was drunk on this one.

Also, "eat a dick", really?
Can you explain why wordexp.c on the referenced site has a completely different (and older) copyright? Did they merge in another implementation?
Is the New Raspberry Pi 2 Camera Shy?
"Hung" is a pretty common name. You'd think it wouldn't be on the list for that reason alone.
Why college will never be obsolete
> What was the last time you thought about how OS X or Windows does suspend

Every. Freaking. Time. That is, since an employer equipped me with a cheap Dell. It looks like it suspends, but one time out of ten it'll come straight out of sleep and cook in my bag.

I've only used Thinkpads, with Linux, for my own work before, and they suspend multiple times a day without a problem ever. So this was a big a-ha moment for me regarding Linux usability complaints, to see what it is that people actually try to do.
I think it is a old-timer issue. I'm using Linux on my desktop for ca 15 years. I also had a mysterious permission problem after my last Ubuntu upgrade. In contrast, to 10 years ago, I do not like hours of debugging to get USB working anymore. It was fascinating then.

For the record, my permission problem was solved via "sudo pam-auth-update --force". Thanks Arch Wiki for giving me the crucial hint.
The article seems to be not-so-subtly hinting that Java is an anti-math programming language, and I agree. The language encourages each developer to reinvent and reimplement key concepts in terms of "classes" that are much more succinctly described in languages that embrace abstract algebra. The example of using inheritance and dynamic dispatch to represent a union type, is a perfect example.
If the random characters are stored in the User ID field then 95% of the time the user just has to remember their password. It is only when the user switches to a new computer that they would need to type in the random characters. Wouldn't that be a significant benefit over having to type the random characters every time the user logs in?

I agree with your observation that "hey I had this really neat idea" is almost always an immediate precursor to making things worse. Almost.
I'm guessing that the linked implementation probably hadn't been touched since 2008. My comment that this was source code from 2011 was referring to the fact that this release of libc (Libc-763.11) is from 2011.
Also happiness!
That works if you are using bash, but if you are, for example, using zsh, you would first have to run "setopt histignorespace" which would enable hiding lines prepended with a space in the history (it's off by default).
OK, then I misjudged your situation a bit, and in this case, your problem is likely not the code side of things, but the communication side.

One thing is that you are obviously down on yourself. That is self-defeating and self-reinforcing, because if you are unconfident, people will also assume that there's a reason, and most likely the reason is that you are incompetent. It's not fair, but it's true, and it's very easy for people to sense if you're not confident. This is independent of whether you actually ARE competent or not.

Also, if someone says or implies that you aren't competent (as it sounds like your boss did), that does not mean they're right. YOU are in the best position to know your strengths and weaknesses, and rather than telling yourself "I'm not good at this, I should take a job in tech support", you should be asking yourself, "how do I get (even) better?". Which you have, in this post, and that's a great start. It helps to remember how far you've come since you started. If a boss repeatedly treats you as if you were incompetent, it's time to find a new one. A good boss will be helping you get better, always challenging you but not throwing you in over your head, and giving you a good deal of independence. I myself would prefer independence, challenge, and feeling valued at the expense of a less shiny title or even a pay cut, but that's a personal choice.

Secondly, people do not make hiring decisions solely or perhaps even primarily on technical skill. In my experience, they want a candidate who has a certain skill threshold, and above that, they weigh other factors. Those factors typically include: how well do they fit in with the team, how self-directed are they, how well can they communicate to find what the real problems are, and can they solve them. So, in an interview, unless the interviewer is an idiot, you will get more "points" for clearly showing that you know HOW to solve the problem rather than showing you can write a syntactically correct program on the spot on the whiteboard. Again, communication.

I would be remiss if I didn't add that it helps a lot as an applicant to know or be known by someone at the company. That is the real purpose of using GitHub as a resume: not so you can say, here, look at a sample of my code, but so that someone you're interviewing with might say: "OH, you're the author of the widely-used XYZ library? Well, we can just skip the formalities and start discussing salary." I can almost guarantee that if one of your repos has a few hundred stars, you will not get any negative comments about your coding style.

Finally, your referencing Python as a prototyping language and mention of JIRA make me strongly suspect that you're at a BigCorp. BigCorps are, in my opinion, not a good place to learn, grow, and get independence. You will be treated as a replaceable cog. I would apply at a place where I could find a niche, master it, and be valued, rather than be viewed as "bug fixer #1057".
Advertise on porn networks. Traffic Junky is dirt cheap compared to most other display networks, and these sort of things would likely appeal to the predominantly young male audience.

Another suggestion is reddit ads. Align the categories with various subreddits and write some decent funny copy.
How do we pay for privacy?
George Grey and Bob Booth ride again.

(I worked for gcg @ Tadpole in the early-mid 90s.)
Interesting. We used to use GWT for several projects, but ditched for new ones to simple Java backend and AngularJS.
Now when I had to fix some bugs, etc it feels so unpleasant to work and kinda slow (for dev). Project still uses old GWT 2.5 since transition to new version & 3th party component replacement would cost too much.

Do you use modern super dev mode and latest GWT version? How this turned out? Are there 3th party plugins repository?
I agree with those statements.
In the described setup, HAProxy is doing SSL termination. See the gist for the cert and crypto parameters. This is getting a A+ from ssllabs.
Minnowboard Max is also open.
> When was the last time you read a manpage about launchd or one of its helpers?

Every time I had to write a lauchdaemon to implement the equivalent of what would be done in cron or inetd.

But I do a lot of Mac sysadmin work.
softlayer is truly awesome. We at RedCarpet have been using them from India and the experience has been awesome. They have features like Global IP, which is pretty close to what AWS Elastic IP does. They also have an API that is pretty well integrated with Chef and Python-Fog.
Not really digging the plots with no error bars or labels on the y axis
It was a mistake to release this today.

Everyone knows that legally questionable moves should always be made on a friday. That allows everyone in government to cool down for a couple days. By the time the weekend is over all the news outlets have moved on to whatever war just started up. You don't want some hothead prosecutor tweeting out a threat, forcing himself to follow through later in the week. Nobody picks a fight when 15 minutes away from a weekend.

Watch the NSA/CIA/MIB admissions. They always stage their spying/torturing me culpas on friday afternoons.
I haven't touched Debian in a long time, and I didn't know that unstable was a rolling release. Thanks for the info, I might look into it someday.
10 hilarious celebrity memes
Yep. D-Bus feels, honestly, like someone looked at every RPC mechanism ever invented and decided to pile all their bad parts into one thing. It's not discoverable, it has a frustrating permission system, its interface definition is incredibly verbose with a very low information density, etc.

Of course, the fact that you need a full DE to easily mount a usb stick as a non-privileged user means the whole thing is already failing hard. This is not how this should work.
That's pulping.
Consider Çeşme. It is near Izmir and cheap, especially in the winter it would be a heaven for a nomad. High temperatures than normal winter conditions. Un crowded and peaceful.
New agency to sniff out threats in cyberspace
Doyle Brunson is one particularly famous person who had his cancer just vanish (this is mentioned in the intro to Super System 2). It does happen, either through initial mis-diagnoses or some other mechanism.
Source to wordexp-helper here: http://opensource.apple.com/source/system_cmds/system_cmds-6...

Also the source to the Yosemite implementation is available at: http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/Fr...
Unfortunately, it has to be TCP. You can define other HTTP frontends thought, but then you lose SPDY for that frontend.

You can use the routing capabilities of nginx in the backend to break the traffic further down.
Pluto Is Slowly Erasing Its Face
Practically, it's really less an incentive than a requirement imposed by the shadow of the future/hypothetical IPO and its future/hypothetical underwriter's strong preference (read: requirement) - even at incorporation when founder's purchase stock (perhaps 10 years before the IPO) they are required to agree to a lock-up for the same reasons as a stockholder who purchases stock one-year before an IPO in a growth-round.

In practice, almost all vc-backed companies with decent attorneys will ALWAYS require a lock-up provision in almost every security issuance documents including: 1. founder stock purchase agreements 2. employee stock option agreements and 3. VC preferred stock purchase agreements.

This shows how much influence the underwriter's ultimately have over the entire IPO process, even 10 years prior and with basically less than 1% chance of actually occurring haha.

The reason for the underwriter's ridiculously strong preference (really requirement) is that if insiders of a company (aka. people who work at the company and therefore (supposedly) have inside knowledge that the market does not have) sell 1% of a company quickly after an IPO, it can introduce a significant amount of volatility to the stock price because the market (almost) always reads an insider's sale of stock as a negative signal - this is why there's always buzz about potential price drops before a lock-up (though at this point it's often priced in well before hand).
I learned programming by reading the source code of this game in the fantastic book by David Ahl. I still remember an array called K which contained the X,Y coordinates and shield strength of each Klingon warship.
Yes, one of the keys to reconstructing the harder puzzles was that we found a yellow dot pattern on the paper. At the time, I was reading HN and I saw a headline that said something about the government tracking photocopies using little yellow dots. DARPA had photocopied all the docs before shredding them, so they all had a very high-res repeating dot pattern on them. We made our program snap the pieces to the dot pattern. With that in place, the puzzles came together relatively quickly. Some people at DARPA knew about the concept of little yellow dots, but didn't think much of it. I don't blame them. The shredded pieces were so small that it would be hard to imagine any secret pattern helping with the reconstruction. But I guess it helped enough. :)
http://sfarts.org

http://www.sfstation.com/arts/

http://www.sfgate.com/art/
PeerVPN – Open-source peer-to-peer VPN
Performance is the least of my worries here. I'd be more worried about security, and plain dependency management.

I mean, let's say this libc thing is supposed to be installed in quite a lot of systems, are we really sure that perl thing is installed in all of those systems? And what if, by some crazy coincidence, perl happens to depend on libc?
"Are you a gift shop? Our shop sign up is over here." - no, I'm not, thank you very much. It is German and means something I'd like to use on you if you don't stop bothering me ...
>regex for bad names

This is why you don't use something as simplistic as regex to do your automated moderation. Automated moderation is a pretty tricky area and requires something at least as sophisticated as naive Bayes.
USB drives and suspend were working well for me, for a few years before systemd took over the distro I used (arch linux). Of course, I set it up to work perfectly for me. It wasn't too hard.

It's the reason I started preferring linux in the first place - I run into bugs on windows and mac os x, and I can't make a system fully the way I like it, except with something like linux. But I digress.

Things also work fine now, but during the transitions from "udev and group permissions" to HAL to udisks / consolekit to systemd / logind, stuff broke. It seems like the same group of well-meaning people worked on HAL then dropped it, worked on consolekit then dropped it, and ended up in the systemd ecosystem.

The various desktop / filemanager projects that started supporting one of these previous systems, to be more compatible with the others and theoretically make things easier for users, sort of got pulled from one to the next, whether it was better or not. Because the previous was unsupported and somehow getting more flaky.

Anyway... it's not the end of the world, there are still other distros and more minimal projects, and it's all still open source. There are even people trying to maintain independent udev and consolekit (the end of the usb-drive-access line, if you don't get on systemd).

But it is annoying that there are these people and projects, that have a lot of influence on other prominent, "classic" projects, that are trying to make a linux system like windows or os x, and adding huge amounts of coupling and complexity. All because they want all sorts of things to "just work" and attract the "common user". Both of these goals are futile, and the costs paid are for naught.