3rd Shellshock Vulnerability Found - <AUTHOR> http://seclists.org/oss-sec/2014/q3/741

<comment><USER2> This is not a vulnerability, it is intended functionality. Some scripts undoubtedly depend on overloading a shell builtin command with a function (even though it is gross).

The post's proposed exploit path is not possible on Linux and most OS's, because you cannot have a setuid script.[1]

[1] [http://unix.stackexchange.com/questions/364/allow-setuid- on-...](http://unix.stackexchange.com/questions/364/allow-setuid-on-shell- scripts)

<comment><USER3> Even if you have a setuid script it appears that bash won't import functions in that case.

However the fact that the script isn't setuid isn't really the concern for these shellshock, since a setuid program could indirectly run /bin/sh.

Again, though, this doesn't seem to another shellshock problem. In shellshock you only needed to control the value of an environment variable, not its name. If you can control the name _and_ the value then there are plenty of other ways you can attack programs.

<comment><USER4> > However the fact that the script isn't setuid isn't really > the concern for > these shellshock, since a setuid program > could indirectly run /bin/sh.

A setuid program which runs _any_ child process without having first cleared the environment or authenticated the caller for root access is already broken by means of LD_PRELOAD.

</comment></comment></comment><comment><USER5> If you're vulnerable to this, then you're vulnerable to someone setting PATH and changing all executables that you refer to.

That's not the "shock" part of "shellshock"; that's a long known issue. Applications which pass arbitrary variables from the network through environment variables already add a unique prefix to the variables, to prevent this kind of problem. That unique prefix also prevents them from accidentally conflicting with the name of an actual executable for this case.

Now, there are still going to be bugs with suid executables not sanitizing their environment, but those apply in many other ways, such as via PATH and LD_PRELOAD.

The "shock" part of shellshock was that it was possible to execute arbitrary code, upon just loading a variable in Bash, regardless of what its name was, depending only on the contents, which in many cases can be attacker controlled.

<comment><USER4> Exactly. If you are letting an attacker define not just the values of environment variables, but also the _names_ , then you've already lost.

Forget bash. LD_PRELOAD by design lets you load arbitrary code into any child process. Many other environment variables affect libc and other common libraries in arbitrary ways. setuid programs must clear their environment at startup to be safe. Programs like sudo can restore that environment once the user is authorized for root access.

</comment></comment><comment><USER6> Wow this is getting out of hand, that's not really a security vulnerability anymore. That's how bash passes exported functions, I'll get back to that.

There is some misunderstanding though regarding the suid shell script. I can't think of any modern unix other than solaris that allows those by default any more. It's just not a concern anymore unless an admin twiddles some sysctl or what not. And in the case of solaris /bin/sh is not bash. Also /bin/sh does it's own setuid after comparing to 100 (unless the -p option is passed) so often if people are not adding users to a group or sudo, they would create a ksh or perl script instead. Anyway that's just rambling, sorry, the short answer is that I would be really surprised if there was any modern system that used bash as /bin/sh and also allowed suid interpreter scripts.

<comment><USER6> Doh, forgot to get back to the first point, sorry.

My thinking is that at this point the whole exporting functions (and anything else other that environment variables, like arrays) is just a bad idea in the default case. I actually do do it, but for a stupid reason and can totally see how I should just put those functions in bashrc for the same effect anyway.

So I really would like to see that all disabled by default in bash and a shellopt added to enable it if anyone really needed it.

I've heard about other ideas like prefix, suffix the name, or add a BASH_FOOBARBAZ that lists exported functions, but it's just not something most people do, and it would be a pita for the people that do need it now needing to change how they do it cause I can totally see people that made use of this having done it in C and perl knowing that if they did added to ENV 'cat=() { ...' or what not it would change what they needed in the subshell after they called system. That would really be annoying for those people to have all that break in a way they would need to change all that baroque code instead of just adding an option, something like system("exec /bin/bash --foobarbaz ... ") now.

Plus there are other programs like sudo that already know how to deal with the '() {' style env vars and clear them-out by default, people would have to update all those (plus what ever ancient suid C launcher programs they already had doing this kind of env var clean-up in their own broken ways from before the time sudo became the way to do this stuff) now too.

<comment><USER7> Debian has already released a batch patched to only treat BASH_FUNC_FOO() as exported functions.

It's the second half of the security fix, so I recommend upgrading.

There is a small potential for breakage as you mention, but less than ripping the feature entirely out.

<comment><USER6> I should not have replied until I had more time to respond clearly, sorry.

The BASH_FUNC_foo()=() { ... is nice, it's how it should have been from the get go. Besides having a nice prefix that owns them all (what about arrays though)it makes it hard to set an exported function from the shell using = cause of the () suffix. That's clever, promotes the use of export -f basically from bash itself.

Unfortunately it breaks how to do it from everything other than bash cause it's not backwards compatible, and people like me had done that. Now I realize that I had done it for not great reasons with other better ways to do what I wanted. I think most everyone else that had exported functions would have felt the same. So very few people actually need exported functions, most can come- up with a work-around.

Taking that into account what is trying to be accomplished here with any patch? Really it's to prevent a future vulnerability, that should be the goal. Going back, the first vulnerability was that when the shell was initializing more got executed than intended. Then the next (which I can't figure-out how to exploit) was because of state from that initialization being kept around (in this case from an error bailing) and then messing-up later execution.

It's sort of a hackish way to do all this, right? It only took a day for someone to find another bug, I was able to get bash to seg fault left and right when I was looking into it myself before the patches. What is the chance that there is another bug in that parser say? Noby knows for sure.

The netbsd approach goes: Fix the current bugs, because there are so few reasons to export functions, so few people do so, most people can find another approach, and the way that they are implemented might be found vulnerable => do not ever export functions by default. As a courtesy to those that have and that still must, provide an option to allow them and do not break backwards compatibility so those with the most trouble need only add the option instead of changing other complicated squirrelly things.

The redhat approach goes: Fix the current bugs, because there are people that export functions, let us do it in a more sensible way. Now since we have a prefix and suffix, we protect against an attacker being able to create arbitrary function definitions. If an attacker could control BASH_FUNC_foo()=, then they would go after lower hanging fruit anyway. As a courtesy, if the people used export -f, it is compatible.

So it's a philosophical thing. The limitation of the redhat approach is there are people like me that feel there will be more bugs in bash. The parser is complicated, it is being called in this early place, state remains for later, I expect that it will not be too much to get bash to segfault again, and then it's careful analysis to see if payload can be crafted to get it to execute instead of simply seg fault. So I would like a way to have it just not do any of that by default. The redhat approach does not give me a way to do that. I value that more, plus being backward compatible. The redhat approach values having a safer way to pass functions, one that continues to allow that by default, but breaks compatibility and does not allow me to disable it at all.

</comment></comment></comment></comment><comment><USER8> It's actually not "new" it's a "feature" that everybody became aware it existed since long ago only once Shellshock bug became known.

Christos Zoulas from NetBsd has the arguments that I really like: it's a "feature" that was widely unknown and that should be disabled by default:

[http://openwall.com/lists/oss- security/2014/09/25/31](http://openwall.com/lists/oss-security/2014/09/25/31)

</comment><comment><USER9> Can we go straight to the part where this is disabled behind a --insecure flag and everyone can spend a release cycle migrating untrusted input handling to languages which were designed for it?

<comment><USER10> > languages which were designed for [untrusted input handling ]

Which languages would those be? There are a few languages with a concept of "taint" (Perl, Ruby), but I've never actually seen a language where everywhere untrusted input could come from _actually_ starts tainted, and every secure function _actually_ disallows tainted input. Especially where third-party- native-FFI library calls are involved.

<comment><USER9> There's an argument that we should be making an effort to add something like Perl's taint mode (which predates the web by half a decade!) or the stronger variants in some academic languages everywhere but even that's overkill for this class of bugs.

The problem here, as anon1385 pointed out is that shells in general, and Bash in particular, were designed to execute things and maintained at best weak separation between code and data – in no small part because the concept originated 40 years ago when computing was a much more trusted place and network connections were rare and not seen as a conduit for never-ending attacks. As a class, makes shells a bad idea for anything which crosses a privilege boundary; almost any normal language would avoid this particular exploit.

</comment></comment></comment><comment><USER11> I just tried this in zsh 5.0.6 (x86_64-apple-darwin13.3.0). It reports vulnerable as well.

edit: Yes, this feature works when formatted correctly for zsh as "function ls () { echo vulnerable }". However, I was wrong in that zsh -c will not run the function (of course running "ls" in the same session will). I'm going to call this not a problem.

edit: When trying this one-liner in zsh: "env x='() { :;}; echo vulnerable' zsh -c 'echo hello'" (as suggested by [https://superuser.com/questions/816622/does-the- shellshock-b...](https://superuser.com/questions/816622/does-the-shellshock- bug-affect-zsh)), the output indicates my shell is vulnerable. Could someone please try and replicate?

<comment><USER12> > I just tried this in zsh 5.0.6

Do you mean that you run bash -c in zsh, or that you run zsh -c ?

<comment><USER11> Good call. I posted an edit to my original comment. zsh -c won't run the function outside of the current session. The "extra step" needed to add functions to the environment variables seems to make zsh much more secure than bash in the context of this discussion (perhaps?). This SE thread was really helpful to me in clarifying: [https://unix.stackexchange.com/questions/33255/how-to- define...](https://unix.stackexchange.com/questions/33255/how-to-define-and- load-your-own-shell-function-in-zsh)

</comment></comment></comment><comment><USER13> If this is how passing functions is supposed to work in bash, then why do I get different results, depending on which system I'm on? I've been madly patching my systems since yesterday and on a RHEL 6.5 system I get a different result than from an Ubuntu 12.04 system:

        [RHEL-6.5 tmp]$ uname -a
        Linux hostname1 2.6.32-431.23.3.el6.x86_64 #1 SMP Wed Jul 16 06:12:23 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux
        [RHEL-6.5 tmp]$ bash --version
        GNU bash, version 4.1.2(1)-release (x86_64-redhat-linux-gnu)
        [RHEL-6.5 tmp]$ ls
        file1  file2  file3
        [RHEL-6.5 tmp]$ env ls='() { echo vulnerable; }' bash -c ls
        file1  file2  file3

        Linux hostname2 3.8.0-44-generic #66~precise1-Ubuntu SMP Tue Jul 15 04:01:04 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
        Ubuntu 12.04:~/tmp$ bash --version
        GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu)
        Ubuntu 12.04:~/tmp$ ls
        file1  file2  file3
        Ubuntu 12.04:~/tmp$ env ls='() { echo vulnerable; }' bash -c ls
        vulnerable

Is this a basic difference in the feature sets of Bash 4.1 and Bash 4.2? Like several posters, I was unaware of this feature and have certainly never used it. Perhaps it should be off by defaults? How big of a mess would that make? I would also like to see more distributions use something other than bash as /bin/sh, but that's another discussion, I guess.

<comment><USER6> You need to use export -f now, the specifics of how functions are exported have changed in the redhat patch, ls='() { ... is not sufficient anymore. Nothing has broken unless you had something calling bash that was not bash and you used this internal to bash implementation hack-like knowledge that 'foo=() {' is how those pre this redhat patch versions of bash did it.

<comment><USER13> Thank you! I haven't had time to read the documentation for Red Hat's change.

</comment></comment></comment><comment><USER14> If I'm looking at this correctly, it appears that the Red Hat patches aren't vulnerable to this particular vulnerability. (I believe they patched bash differently than upstream, as per [https://securityblog.redhat.com/2014/09/26/frequently- asked-...](https://securityblog.redhat.com/2014/09/26/frequently-asked- questions-about-the-shellshock-bash-flaws/.))

EDIT: I tested on CentOS 6.5 and Fedora 18 (for which we'd manually backported the Fedora 19 patches).

<comment><USER15> I've read the page you linked and it's not clear to me how to reach that conclusion based on that information. Help?

<comment><USER14> Sorry! My conclusion (i.e. that RedHat was patched against this 3rd vulnerability) was just by running

env ls='() { echo vulnerable; }' bash -c ls

on my recently patched CentOS box. If I'm reading that right, if I was vulnerable, I'd get the output 'vulnerable'? But, instead, I got the correct output of the `ls` command.

The linked article was pertinent because RedHat did patch bash in a different way than upstream. Here's the relevant quote:

> Our patch addresses the CVE-2014-7169 issue in a much better way than the > upstream patch, we wanted to make sure the issue was properly dealt with.

That help?

<comment><USER15> Yes, it helps, thanks!

And the post below which shows the contents of the RH patches should help, if I knew how to read it. :)

But... it seems to me that if this doesn't work:

        env ls='() { echo vulnerable; }' bash -c ls

...then some scripts are now broken. Sorry, I don't know which ones. Needless to say, most bash scripts in existence don't take input from the wild wire. A sad day for those innocuous scripts.

<comment><USER14> mzs had some info about this in a separate comment[1] if you missed it. I've hit the edge of my knowledge about it. :-)

</comment></comment></comment></comment></comment><comment><USER16> I know this is not really an issue but is there any use for this "function exporting" feature in the first place? I had never heard about it before and when I did it kind of sounded like an ugly hack.

</comment><comment><USER17> I was not able to replicate this on Amazon's linux distro after the second patch was applied. After only the first patch, though, the server was still vulnerable.</comment>


Atoms Are Not Bits; Wired Is Not A Business Magazine - <AUTHOR> http://gizmodo.com/5457461/atoms-are-not-bits-wired-is-not-a-business-magazine <comment><USER2> The whole point of the original article is that changing technologies are allowing smaller scale businesses to enter markets that were previously denied to them. It's _not_ about changing how existing hobby industries work. The author has failed to look beyond the hobbyist examples used in the Wired article.

It's also about being able to enter niche markets that larger manufacturers aren't interested in. There are plenty of markets that require a high standard of complexity in both design and manufacturing, yet are too small for larger companies to care about. As the cost of both drops, so it becomes more viable.

Also, despite the author's disparaging remarks, being able to do small scale runs in China is significant, because not so long ago this was _inconcievable_ for many businesses.

It's fair to bash Wired for the hyperbole -- it's not a revolution yet -- but Giz's critique is shallow and doesn't address the basic argument; that the lowered cost has increased access to equipment and skills for industrial design and manufacture. That this change will lead to greater numbers of smaller businesess operating in new niche markets, or markets otherwise previously denied to them because of scale.

</comment><comment><USER3> This is where I live. I am a small business or two. I have been building my own CNC machines. I manufacture a niche product.

The comments on this article are mostly regurgitated economist speak, efficiency figures prominently. The fact of the matter is, efficiency means one group gets as much of the pie as possible.

There are lots of people and they all need to earn a living. Big business strives for efficiency and they lay people off, because they are efficient. You however are unemployed.

Small businesses are only going to grow in number and the amazing thing about this phase that we are in is that sophisticated tools are becoming widely available. That means that small businesses will be able to produce more and more sophisticated products, creating more jobs as a result of this terrible inefficiency.

The future looks like this: Commodities and niche products.</comment>


NoSQL vs. RDBMS: Two Database Cargo Cults - <AUTHOR> http://pl.atyp.us/wordpress/?p=2368

<comment><USER2> Author seems to forgot. People doesn't use Non-SQL DBs because Famous X site uses that. Most people choose those because it is easy to use for most of use cases, and often that is what they needed instead RDBMS.

Sometime RDBMS are perfect solution. Most of the time simple key-value(or JSON based) DB.</comment>


How the US Rendered, Tortured and Discarded One Innocent Man - <AUTHOR> http://www.thenation.com/article/168621/how-us-rendered-tortured-and-discarded-one-innocent-man

<comment><USER2> Here's an opinion:

People argue about what is and is not "on topic" for HN. Regularly items are submitted, only for people to say that since it's nothing to do with programming, technology, startups, or entrepreneurship, then it's not suitable for HN.

Quoting the guidlelines:

        On-Topic: Anything that good hackers would find interesting.
        That includes more than hacking and startups. If you had to
        reduce it to a sentence, the answer might be: anything that
        gratifies one's intellectual curiosity.

Those are the guidelines as laid down by our host, and that's fair enough. But I'd like to see a cultural shift. I'd like to add:

        If it's not in some way specific to the interests of hackers,
        then it's probably off-topic.

I submit a lot of stuff about education and mathematics, because I think these are subjects that interest hackers, but not the wider public. Topics that of more general interest I'd like to say don't really belong here.

This submission, in particular, should be of wide-spread, ubiquitous interest. It shouldn't be in any way specific to hackers, technologists, programmers, or entrepreneurs. In that way I believe that although it is and should be of interest to pretty much everyone here (including non-Americans) it is in no way specific to the interests of the community, and hence it is not really on topic.

So yes, I'm pleased to have seen it. But I personally think it's off-topic for HN. It should be of interest to HNers, but only because it should be of interest to everyone.

<comment><USER3> What precisely do you gain by having a narrow focus? What do you lose by having this story on the front page for half a day?

What is essentially wrong with being off-topic?

Honestly, I think this place would be awful if it only had the focus you intend. The advertising nature of posts about this new project or that startup frequently crosses the line between informative and irritating.

<comment><USER2> In short, if you don't define and maintain a specific focus then people can and will start posting videos of pratfalls and pictures of kittens. _Some_ focus is needed, and the question is how narrowly to define that.

I would like to see HN stay focused on things of interest to hackers, nerds, and geeks, as opposed to things that are of wider interest. There are plenty of places that cater to other interests, and few that are specific to "us".

        Honestly, I think this place would be awful
        if it only had the focus you intend.

"Intend" is the wrong word, but I hear what you say. That's your opinion, and you are entitled to hold it. If there was _no_ focus here then I'd go elsewhere, and that's also fine. I'd just try to find, or found, another site that _does_ have more of the focus I'd like to see.

</comment></comment></comment><comment><USER4> not HN

<comment><USER5> Why not? You're trying to say there's no place for humanitarianism in HN?

A man was wrongly imprisoned and tortured, had his life torn apart. Now some people need to tell his story in order to get funding so he can get help to get up on his feet. What's wrong with that?

<comment><USER6> Sadly, Jonathan is letting his very strong political views once again get the upper hand and he flagged something he feels is somehow against the "best interest" of his country. For us participating in HN from outside the USA, it is baffling to see guys that can be so involved and intelligent on some issues (he is Creative Director at row27) and at the same time so openly aggressive and irrational on others. And yes, sorry, but it is irrational to say that this is not HN material, but actively participate in other political threads when they are about some political victories of your own political party (as he did for example in "Senate votes to repeal 1099 reporting requirement in health care law"). And BTW, as we always have to sadly explain, this would be the same if he is not republican but democrat or whatever. Some of us just really dislike double standards. And flagging this story because it makes your Military and government look bad, and excusing yourself in "not HN", well...

<comment><USER4> I'm sorry you feel that way, I hadn't thought I had ever expressed a "very strong political view" on HN. I flagged this article as "Not HN" because it doesn't really talk about startups, investing, coding, or anything really related to this forum, and apparently others agreed because it disappeared from the home page minutes later.

But I feel I'm probably feeding a troll.

<comment><USER6> Jonathan, then if you feel that way, why do you never flagged but instead participated in discussions in HN about political voting for the medical health bill? Please explain to us if Republicans winning a vote about it is something to be considered in the "investing", "startups", or "coding" category? Shameful from you call me a troll. You have no arguments, you just insult....</comment></comment></comment></comment></comment>


Apple eyes authors with new iBooks Author app - <AUTHOR> http://news.cnet.com/8301-13506_3-57361898-17/apple-eyes-authors-with-new-ibooks-author-app/?tag=mncol <comment><USER2> Sooo ... how locked into Apple's ecosystem are books created in this way? The notes say:

• Submit your book to the iBookstore for sale or free download with a few simple steps* • Export your book in iBooks format to share on iTunes U or to give to others • Create a version of your book as a PDF file

That footnote is: "Books may only be sold through the iBookstore; additional terms and conditions apply."

So if you export the PDF, can you submit that PDF to, say, Amazon's print on demand service?</comment>


RISC-V from scratch 2: Hardware layouts, linker scripts, and C runtimes - <AUTHOR> https://twilco.github.io/riscv-from-scratch/2019/04/27/riscv-from-scratch-2.html <comment><USER2> RISC-V, System/360 for the 2020s!

<comment><USER3> Indeed, though I think people here think you're saying that as an insult rather than a compliment.

<comment><USER2> Yep.

The real genius behind the 360 was scalablity. Not only could you buy a wide range of different sized machines, but IBM has kept making better 360s to this day.

Intel has accomplished the same with the 8086 (by accident more than design) and so has ARM.

Once you get past the x86 and ARM the price/performance ratio gets a lot worse. Thus you end up with expensive WiFi routers that allegedly can work as a file server but can't really handle it, or things like the Samsung Smartthings hub that has to offload even simple things to the AWS cloud.

RISC-V could make the market for embedded chips competitive again. RISC-V scales even more than the 360 did since you can put in just the features you want, thus you might be able to build something which is high performance but doesn't waste a transistor on features you don't want.

<comment><USER3> > _Samsung Smartthings hub that has to offload even simple things to the AWS > cloud_

Doubly disappointing considering how much money Samsung has sunk into Joyent (though maybe it's not the same division of Samsung, and that's why they don't use it).

> _RISC-V could make the market for embedded chips competitive again. RISC-V > scales even more than the 360 did since you can put in just the features you > want, thus you might be able to build something which is high performance > but doesn 't waste a transistor on features you don't want._

Crucially, I think, it lacks any unusual or frivolous features, so it is virtually free of surprises. For example, it's little endian because little endian won (because it is better).

<comment><USER4> > For example, it's little endian because little endian won (because it is > better).

Could you elaborate on this? My understanding is that Little Endian was introduced to enable some optimizations on low-level mathematical operations or fetch operations. However, as the block size for ram operations increased, together with the transistor count, it was IIRC shown (I can't find a reference) that there were little advantages in using one or the other (different optimizations being possible in either). I tend to prefer Big Endian, as it is closer to our numerical representation, and the network order.

Saying that Little Endian has "won" could be justified if you only look at x86, but I wouldn't call that the whole story.

<comment><USER3> I used to like big endian for the same reason (that it seems more similar to our written numeral conventions), but little endian allows you to narrow and widen integers with no operations, and without changing the pointer. That's why it's better in my view.

</comment></comment></comment></comment></comment></comment><comment><USER5> Exciting writeup! Looking forward to reading this later.</comment>


Kindle typography - <AUTHOR> http://www.dirigibleflightcraft.com/kindle/

<comment><USER2> From my own experience reading ebooks I find that when words are overly hyphenated that it takes away from legibility.</comment>


This is the United States' third biggest housing boom in the modern era - <AUTHOR> https://www.nytimes.com/2018/12/07/business/housing-boom-how-long-can-it-last.html <comment><USER3> I believe as long as there are people who make much more money than they can invest productively in non-housing they will keeping buying houses and drive prices up. That's one of the effects of income inequality. The people who are on the winning side make more money than they can invest.

<comment><USER4> From the data I've reviewed, this is generationally biased. Older people like buying houses. Younger people, when one restricts the population to those who can afford it, don't show as strong of a bias.

<comment><USER5> Maybe because the young people are facing a higher housing prices, and they don't believe that it could raise for the same amount in the future.

<comment><USER6> Maybe Young people are more mobile. The security of buying a house is beneficial when you've got kids at school. When you don't mind where you live as long as there WiFi and transport renting is beneficial, you can move across country on a whim.

<comment><USER7> If you require public transit, there are only a handful of places you can live, each with unique and volatile conditions that make owning especially attractive. It's suburban sprawl which is almost perfectly fungible nationwide.

<comment><USER8> Depending on the type of transit, owning near the stop is only attractive until the transit operator eliminates your stop or your route.

</comment></comment></comment></comment></comment></comment><comment><USER9> As a non native speaker, a "housing boom" sounds like a boom in number of houses, not a boom in the price of existing houses :)

<comment><USER10> The two are closely correlated in practice. The boom in prices incentivizes developers to build more, leading to a boom in number of houses, which eventually leads to a bust. So the pendulum swings again. Control engineers would describe it all as a system that's not very well damped.

<comment><USER11> >leading to a boom in number of houses

The requisite for this seems to be little or no govt intervention. In Akl, NZ, for example, you're only seeing high-end homes being built yet prices & demand keeps going up for all housing. Now they're subsidizing projects for entry- level homes as if building a set number of homes (and failing to meet build targets by a long shot)will solve market woes.

<comment><USER12> There are zero problems with building mostly high-end homes. Then the rich can live there and the less rich can live where the rich previously lived -- win for everybody.

One of the best things the government can do in those cases is ensure that large housing developments are still zoned to allow them to be subdivided. Nothing wrong with four families living in one big mansion.

<comment><USER13> Does this get thrown off if the rich don't buy the new high end homes to live in?

<comment> dan-robertson If you're a developer, build a bunch of high end housing, and try to sell it off, and no one wants to buy it, you have approximately three choices:

1\. Leave them empty to deteriorate. 2\. Cut your losses and sell them for cheap 3\. Let them out for less than you feel they ought to be worth in the hope that people will be willing to pay your high price soon.

Option 1. Is unlikely to happen as it is very unprofitable. This leaves options 2,3, each of which leads to people living in the newly built properties, so the total supply of housing has increased. Even if people are just renting, this means there is less demand for rentals so less of an incentive to buy houses to let them out, decreasing the demand for houses.

<comment><USER14> Developers rarely build blindly. If they build high-end housing, there is _some_ demand which will definitely buy-in... and that opens a new option:

4\. Wait, because operational expenses are cheap compared to the capital expenditure.

They will set an asking lease that is guaranteed to attract enough high-rent leasers to pay for maintenance + loan interest (if any), then hold the price right there regardless of vacancy rates. Rates will be lower only if the market demographics irreversibly change, but otherwise they can afford to wait as the building slowly fills over a decade or more - each additional renter is pure profit, and raises the value of the building as an asset for resale.

The alternative is lowering prices, which attracts a different demographic that makes it challenging to raise rates afterwards. They may generate more short-term income but overall value is lower.

<comment><USER12> > 4\. Wait, because operational expenses are cheap compared to the capital > expenditure.

The problem with waiting is that you're sitting on a huge risk, because holding prices artificially high attracts new construction. If that price makes construction profitable then construction will continue to be profitable until prices come down. To keep prices from coming down, the existing speculators would have to buy all of the new construction. The vacancy rate would keep increasing until it could no longer cover the maintenance costs.

And the higher the vacancy rate gets, the greater the downside risk to holding vacant units, because there are more competing vacant units that the other owners could at any point decide to put on the market, causing lower prices that induce other owners to abandon the conspiracy and put their units on the market too. And the more vacant units there are, the more the price declines when the cartel dissolves.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Everything about our current economy looks like one enormous bubble about to pop, and I think it's going to be much worse than 2008, depending on what actions the government takes. I see malinvestment everywhere, from venture capital to the recent machine learning and cryptocurrency trends.

Edit: As a young person, it scares me.

<comment><USER16> I agree completely! The amount of misallocated capital and the rate with which it is flowing toward more productive uses is extremely disturbing.

There should be ten or a hundred well capitalized Tesla competitors by now rather than all this idiotic old money chasing (fearfully) after dying economies ...

It's very disturbing to think how actively harmful these misallocations are — the amount of money that still thinks an investment strategy that aims to protect the value of existing fossil fuel investment is a good use of capital ... pure blind delusion.

We are well past the point where you can make more money by investing to extend the timeline of fossil fuel returns than you could make by accelerating yourself away from your fossil fuel investments ... somebody needs to remind the investment community about the value of skating to where the puck is going to be ...

<comment><USER17> The misallocation of capital is a natural result of capitalism, which is a distributed, greedy algorithm.

</comment></comment></comment><comment><USER18> It's already collapsing in the SF Bay Area. "PRICE REDUCED" signs are appearing. The bubble is popping. One real estate investor and one Realtor I know admit that prices have been dropping for most of 2018.

<comment><USER19> The data does not reflect this. SF and the surrounding areas are mostly still rising...monthly is still going up and the yearly is up maybe 5%. Most other parts of California are weakening though in price on a monthly basis.

[https://www.car.org/marketdata/data/countysalesactivity](https://www.car.org/marketdata/data/countysalesactivity)

<comment><USER20> It's obvious things cooled off around August specifically during the tariff changes. If these trade talks get worse I imagine the market cooling even more.

<comment><USER21> other things applying downward pressure to high priced RE markets nationwide: the new tax law that reduces a taxpayer's savings from mortgage and property tax deductions, and rising mortgage interest rates

</comment></comment></comment></comment><comment><USER22> Case Shiller index is the highest on record at the moment [https://fred.stlouisfed.org/series/csushpinsa](https://fred.stlouisfed.org/series/csushpinsa)

<comment><USER23> In a normally functioning housing market (with a reasonable amount of inflation), wouldn't this be the norm?

<comment><USER22> The index is based upon median income and median home sale price, not upon house prices as an absolute value. It's an indicator of affordability. I don't know if indexes are comparable across different countries and what they would mean.

</comment></comment></comment><comment><USER24> No. The author here is cherry picking a timeframe [2012-2018]. Nice cherry pick. Unless you were smart enough to buy in 2012 that is gone: forever.

Home prices have _barley_ hit their 2008 prices. These are prices _ten years ago_. If a stock hit its price from _ten years ago_ I wouldn't consider it a "boom".

If you are a zillow user, look around at normal cities [Not manhattan,SF, or LA] linked below. If you have a minute, look at "Price / Tax History", and see what they sold at 2006/7/8\. I see this pattern all over the US. I could add 20 more if you need.

To me we are almost back to normal. Sure this is anecdotal but, averaging all US home prices with a cherry pick is just as silly.

[https://www.zillow.com/homedetails/5435-White-Heron-Pl- Ovied...](https://www.zillow.com/homedetails/5435-White-Heron-Pl-Oviedo- FL-32765/58182051_zpid/?fullpage=true)

[https://www.zillow.com/homedetails/6241-Gobernadores-Ln- Carm...](https://www.zillow.com/homedetails/6241-Gobernadores-Ln-Carmichael- CA-95608/67821430_zpid/?fullpage=true)

[https://www.zillow.com/homedetails/6600-Sutter-Ave- Carmichae...](https://www.zillow.com/homedetails/6600-Sutter-Ave-Carmichael- CA-95608/64591452_zpid/?fullpage=true)

<comment><USER25> Do you have a reason to consider 2008 as normal?

<comment><USER24> normal: %3-%5 yoy increases, basically a little under the mortgage rate. 2008 wasn't normal that isn't what I meant.

<comment><USER26> Yeah, I took your comment to mean something like "2008 wasn't normal. But imagine a "normal" price in 2008, and how it would have risen normally over ten years. Then maybe it would reach the actual 2008 price, which is about what we have in 2018."

Not sure if that's correct, but sounds plausible.

</comment></comment></comment></comment><comment><USER27> It is already popping... like it did last time and like it will do next time. Welcome to the financialization of everything!

Look here for more data: [http://www.doctorhousingbubble.com/](http://www.doctorhousingbubble.com/)

<comment><USER28> I wonder if the application of AI to finance would effectively smooth out bubble/bust scenarios. If you really think about it a bubble is when assets are overvalued usually due to herd mentality and fear of missing out. If AI we're more involved it would be able to short sell when something was overvalued and buy when it is undervalued. This is the essesnce of good investment and you would think machine learning would be able to gather much more raw information than any person and come to these conclusions.

I think this is what Renaissance Investments does to make such amazing returns.

<comment><USER29> Merely having a correct investment thesis isn't enough to make money - <USER2> have to also get the trade timing and execution correct, and bubbles have a nasty tendency to stay inflated long enough to squeeze out the shorts.

Like, the more profitable plays are often the ones that _contribute_ to the boom/bust cycle. In the 2008 crisis, the big winners were people who took out as much mortgage debt as possible and aggressively did cash-out refinancing, ending up strategically defaulting on houses they got more money out of than they put in. When you're in a bubble, people tend to assume that the worst- case scenarios won't happen, so they'll extend credit that you cannot pay out in those scenarios, and you wind up getting some free expected value and positive skew that way.

<comment><USER30> Now that's a depressing perspective.

</comment></comment></comment></comment><comment><USER31> A recession is coming in the next 2-3 years due to demographics (peak baby boomer retiree is happening right around now). I think part of the housing boom is caused by the retirees.

<comment><USER32> A recession is due for lots of reasons, like the boom has continued this long because we juiced the economy with a bunch of tax cuts for rich people and companies that are basically a sugar high. At least since we raised interest rates we'll be able to cut them to stimulate the economy. On top of that sugar high we are pushing it down with stupid tariffs on most of our major allies. And growth periods in our history don't usually run this far. I think our future growth in the us will be significantly retarded because of high student loan debt. That gets some attention here at hacker news, but I don't see 'regular people' talking about it much.

</comment></comment><comment><USER33> Time to get out while you still can.

A lot of the current value is tied up in stuff that will implode like in 2006.

The Fed has created another asset bubble. We are sitting on a powderkeg.

But where to invest instead?

<comment><USER34> > But where to invest instead?

There's literally nowhere you won't lose money when investing in a recession, the point is to find the place where you'll lose the least amount of money -- a.k.a. the place where you are most certain the price has bottomed out -- and go for it. Then wait 5-10 years.

<comment><USER33> What about a basket of really promising startups or VCs?

<comment><USER35> I presume this is a joke, but, if not, good luck. If you can pick the next Google reliably, you're presumably already worth tens of millions.

<comment><USER33> How about a vanguard index of stoks

<comment><USER32> You need a mixture of assets. If you don't need your investments to live on (cause you've got a job and an affordable place to live), then follow the standard policy of different categories of stocks, plus other areas.

In 2007-2009 I noticed that I lost as much in my retirement accounts as I put into them in those years, Ie the value at the end of the year after putting 20k was about the same as at the start. That was something that really reminded me that it was great and lucky to have a good job as a software engineer.

<comment><USER35> The trick is to maintain your job during the recessions and keep investing. Easier said than done, but if you do succeed, you'll be in very good shape when the market bounces back during the next cycle.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Maybe it is not an anomaly, but a message: the huge amount of liquidity pumped into the system is going to break soon in the form of hyperinflation. [0]

[0] [https://www.google.de/amp/s/seekingalpha.com/amp/article/404...](https://www.google.de/amp/s/seekingalpha.com/amp/article/4045250-velocity- money-mean-u-s-inflation)

<comment><USER37> The Fed is planning to shrink its balance sheet by $2 Trillion between now and 2022. They've already shrunk it by almost $350 billion (basically, shredding digital cash.) It is more likely the global economy is more fragile than the Fed realizes (due to China) and we will experience asset deflation, not inflation. We likely (imo) won't see any significant velocity of money changes in the US until well after the unwind is complete. Because banks, while flush with cash, are still hesitant to lend during the unwind and high yield credit markets are not doing well at all.

I suspect we could see a mild recession with little Fed action other than just pausing their unwind for a while, unless there is some serious crisis (which I can't see happening unless the high yield credit market were to completely implode.) One problem that could allow that to happen, is if oil were to completely and utterly nosedive and make a lot of oil service companies with high debt loads default. Again, I doubt this. I am not a doom and gloomer, I think we are about to enter a recession/bear market but the "great recession" has gotten something in people's heads that every recession must be a systemic collapse instead of a resource reallocation...

<comment><USER38> If we have deflation with rising incomes, there would be no issue. If there is deflation with declining incomes, it would create a downward spiral, potentially.

<comment><USER37> Real incomes have fallen during/after virtually every US recession; at least in -real- terms. Nominal incomes almost never fall and just remain flat. Monetary theory is complex, but what the flow of credit remains in tact.

[https://fred.stlouisfed.org/series/MEHOINUSA672N](https://fred.stlouisfed.org/series/MEHOINUSA672N)

[https://fred.stlouisfed.org/series/MEHOINUSA646N](https://fred.stlouisfed.org/series/MEHOINUSA646N)

The only way I can see hyperinflation in the US is some cataclysm or inability to service debt through normal means. Most countries that have hyperinflation generally have massive debt loads they are printing out of with no economic output to back it up. They also are usually very centrally planned economies or war torn.

<comment><USER29> When employers contract their payroll, they do so with layoffs rather than pay cuts. The reasons for this are fairly complex, but if we take this as a given it implies a lot about our monetary policy. Specifically, it argues for something like NGDP targeting, so that employers as a whole continue to have enough money to avoid layoffs even as total real wages decline.

</comment></comment></comment></comment></comment><comment><USER39> It would be nice to see an analysis of the cost to build over time. Obviously, if 5% YoY increase is the new method of valuation accepted by all (per the article) there must come a time when builders create new units and compete on price.

<comment><USER6> Not when the majority of the price is in the value of land.

</comment></comment><comment><USER40> As a 30 yo male who doesn't intend to have kids, I'm wondering if it is a bad idea to buy a 1 bedroom in sf even though the math doesn't seem to work out right now and 1 bedrooms historically do not appreciate as fast as multi bedroom homes.

<comment><USER41> buy a multi unit, you can have 1 or 2 rooms and rent out the rest.

<comment><USER42> That sounds like a job

</comment></comment></comment><comment><USER43> Housing Booms is the United States longest running con. It makes no sense, and is so completely disconnected from reality it creates a separate one most American's participate: the housing lottery for retirement.

</comment><comment><USER44> It's funny cause I just bought my house in 2016 and now prices are declining.. Can't win.</comment>


Model Helps Computers Sort Data More Like Humans - <AUTHOR> http://www.ddj.com/hpc-high-performance-computing/210200736?cid=RSSfeed_DDJ_All <comment><USER2> Heh... My former computer science teacher always called this the "Magic Human Sort."</comment>


Ask HN: What laptop do you prefer for travel in 2017? - <AUTHOR> Hey guys,
going to be traveling soon and I'm in the market for a laptop, what's your favorite laptop for traveling.
General use: browser / light photoshop - illustrator use <comment><USER2> The "Ultra-Slim" Asus ZenBook in the 13" range gets a lot of recommendations: [http://laptopkarma.com/?screen_size=13.3](http://laptopkarma.com/?screen_size=13.3)</comment>


Meritocratic News:  Social news fueled by the submitters' puzzle solving ability. - <AUTHOR> http://numbrosia.com/?cmd=puzzle_n

<comment><AUTHOR> There's no voting here. Rather, the point score of a submission is equal to the submitter's Numbrosia Puzzle score from the last hour divided by the number of submissions made by that submitter.

Note that it makes sense to delete submissions when adding new ones so that the set of submissions associated with you is not too large (otherwise, the score of each may be too low).</comment>


Ask HN: Stuck making a decision whether to hire - <AUTHOR>

I have a contract-to-hire employee who has done satisfactory work for the past 3 months. I need to make a decision soon on whether or not to hire. I'm stuck on the decision.
This person has 6 years of experience. I would consider him a relatively average, mid-level developer. We have one other developer who is very good and experienced - along with me.
The average person has taken feedback well, has shown some improvement and is meeting the requirements. I haven't been impressed, but I also haven't been disappointed. When I ask him to do something, he does it but doesn't do much more. He seems to struggle without structure and predefined tasks.
PROS: He's very eager to learn, humble, has a great work ethic, picks up new technology fairly quickly, takes feedback very well.
CONS: Has grandiose ideas that are often irrelevant to the task at hand. Gets distracted easily. Has difficulty taking an abstract concept and breaking it down to actionable pieces.
Should I be hiring only A+, "rockstar", talent or is there a place for an average developer in a startup? Cost is not really an issue. How can I move past this point of indecision? <comment><USER2> Pros and cons aside, something in your gut is telling you that he's just not "up to snuff." These kinds of relationship just suck all around (in work as in romance and friendships, etc).

So it sounds like you've already made a decision. And the only thing to do at this point is to be as humane as possible about it. Being as it was _your_ decision to hire him. And he's not incompetent (or a jerk) from what you're saying -- just not your long-term ideal.

</comment><comment><USER3> Your startup will not succeed if you build a team of average.

Also you would be well advised to stop looking for a rockstar (i.e. flighty, unfocused, chasing the latest new thing, more ego than needed). Rock Star vs Rock Solid <http://bit.ly/6F4jvv>

Look for someone with some of these characteristics: <http://bit.ly/c5Sar3>

<comment><AUTHOR> This was helpful! Based on these links it sounds like I'm being too picky. I'd consider this guy a 'rock solid'. I scored him on the 50 attributes and he only needs to develop 4:

Focus, Comprehension, Verbal communication, Problem solving

Maybe I'm being overly critical...</comment></comment>


Ask HN: Modern subscriptions for installed apps? - <AUTHOR> I've been looking into how to structure a subscription-based payments platform for a plugin that I'm building (in C#, in case this is useful), but all information nowadays is centered around SaaS.
There have been discussions in HN about on premises B2B software and their differences (and advantages) over subscriptions; but nothing about how to manage yearly billing, subscription management, etc. a la chargebee.com, and I can't seem to find material that is not focused on building the whole thing yourself from scratch.
Does anyone here have an application / plugin / etc. that is locally installed in the client machine, and for which a license needs to be purchased and installed? If so, have you programmed everything from scratch, or are you using some specific commercial service to outsource all that complexity? <comment><USER2> I'm curious--what is your main reason for not launching your plugin through a SaaS model?</comment>


reredd: think you've reddit before? - <AUTHOR> http://reredd.com

<comment><USER2> This site makes me cry... reddit was so great in the past.

</comment><comment><AUTHOR> I can only get one mongrel instance running. Search also broke when I deployed. Working on these, but just wanted to get it out there...

</comment><comment><USER3> according to the interesting links on reredd, killnine is defn pretty good.</comment>


Donald Trump makes history – with massive cuts to Utah's national monuments - <AUTHOR> https://www.theverge.com/2017/12/4/16735910/trump-national-monuments-utah-bears-ears-grand-staircase-escalante-cuts <comment><USER2> This action by the Trump Administration is outrageous. These National Monuments are gorgeous and should be maintained as wild lands protected as a National Monument, not opened up for development and exploitation.</comment>


Ask HN: Why does my monitor flicker when it shows a certain static pattern? - <AUTHOR> When I load a certain static image (basically a blueish or greenish pixel checkerboard), my monitor starts flickering heavily.
Test images: http://engineerjs.com/wtf1.png http://engineerjs.com/wtf2.png. Make sure to download them and use actual pixel-correct zoom (does not work in the browser).
Videos: https://photos.app.goo.gl/rMRuUEe7kHorpwtf6, https://photos.app.goo.gl/NT3LwxCoorYYT2cc7.
What could be going on here? Is the monitor faulty? I bought it 4 days ago. It is supposed to be "FlickerFree" according to the manufacturer (https://www.philips.hu/c-p/276E8VJSB_00/4k-ultra-hd-lcd-monitor). <comment><USER2> The thing to blame is the enhancement filter. It is meta-stablity in this filter that is causing the flickering. It is doing the same as what happens when a visual cortex processes an optical illusion. It can not resolve it to one steady state.

Look in the monitor menu for the setting that turns the following off:

       Picture enhancement: SmartImage game

<comment><AUTHOR> Thank you for the comment. There is no such setting. I have been playing with the settings, but none of them seems to affect the flickering so far. I am going to return this monitor.

On the other hand, I really don't get how the enhancement filter is not stable. It is just a convolution, right? There is no temporal element to it, is there? So if all the input frames are the same, all the output frames should also be the same, I guess.

Bottomline: cheap stuff is almost always more expensive than expensive stuff.

<comment><USER2> It's not in the menu because they have it set up to be toggled by the left directional button. See the manual [https://images-na.ssl-images- amazon.com/images/I/B15IIYjIA0S...](https://images-na.ssl-images- amazon.com/images/I/B15IIYjIA0S.pdf)

<comment><AUTHOR> I see. Now I tried all the settings in that left button menu and the flickering does not go away (it is the same when SmartImage Game is off). It is the same with my desktop computer and my MacBook Pro as well.

I hope the store will take the monitor back. Otherwise, I will make a "will it blend"-style video with it or similar.</comment></comment></comment></comment>