Glibc getaddrinfo stack-based buffer overflow - <AUTHOR> https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html <comment><USER4> > "The glibc DNS client side resolver is vulnerable to a stack-based buffer > overflow when the getaddrinfo() library function is used. Software using > this function may be exploited with attacker-controlled domain names, > attacker-controlled DNS servers, or through a man-in-the-middle attack."

> "The vectors to trigger this buffer overflow are very common and can include > ssh, sudo, and curl. We are confident that the exploitation vectors are > diverse and widespread; we have not attempted to enumerate these vectors > further."

> "Remote code execution is possible, but not straightforward. It requires > bypassing the security mitigations present on the system, such as ASLR."

It is time for the bimonthly Internet security meltdown. Again. When they say that "exploitation vectors are diverse and widespread", they really mean it. Patch ASAP. This is a race; it is only a matter of time before criminals start automatically and systematically scanning every server on the internet for this, and you really really want to be patched before that happens.

Thinking a bit more long term, it's pretty clear at this point that we need to expunge all C language networking code from the world, replacing it with Rust or pretty much anything else. That's not sufficient by itself, but it is necessary, or else the periodic Internet security meltdowns won't ever stop.

<comment><USER5> All this "Let's replace everything with Rust" is extremely childish.

Be wary of making programming languages a religion. The Java zealots did it, and you can see the results where full Java projects are used in places where a 20 line Python script would have been easier.

If you're serious, one of your pet projects should be trying to implement BSD sockets with Rust. Then try compiling some C apps against your implementation. Then do some performance tests showing memory and time benchmarks of your Rust vs libc implementation. Do a blog post on it. Then we'll take you seriously.

<comment><USER6> The parent actually said "Rust or pretty much anything else", which means any memory safe language. It just happens that Rust came to his/her mind as the first choice probably because it's been talked a lot about lately on HN and memory safety is its explicit focus.

I see no "programming languages a religion zealotry" in parents post, but I see a lot of bitterness in yours. Perhaps it's time to reflect.

<comment><USER7> There are tons of vulnerabilities discovered every month. Most of the them are in Java, PHP, javascript, etc. software because that's what the majortiy fo new code is written in. And those languages have features that can lead to security holes, which C doesn't have. For example, PHP supports eval(), JS has cross-site scripting attacks, Java has classloaders, etc. etc. But somehow only the vulnerabilities in C language software get programming language zealots exited. So maybe you should reflect.

<comment><USER8> Oracle JVM/OpenJDK and .net CLR are deployed in production at basically every profitable company on Earth.

PHP... Is deployed because it's perceived to be easier and friendlier than other religions, and so wins with that popularity war (as MySQL did). Facebook HHVM is another approach. Folks know the likely warts and mitigate to shrink the attack surface by defending deeply from front layers down to backend services.

Postgres was harder to use in the 2000's despite having a clean codebase but got mucb easier to use, in large part due to MySQL, while leading on features inspired by Oracle DBMS and more recently NoSQLs with hstore.

Attacking popularity for what gets the job done is moot because defense is never ending vigilance for anything real.

Perhaps the focus should be on starting to formally-verifying core libs like zlib, OpenSSL, OpenSSH (portable), glibc, etc. for correctness and resilience against side-effects and ABI promises.

</comment></comment></comment></comment></comment><comment><USER9> Redhat (RHEL5 unaffected) - [https://access.redhat.com/security/cve/cve-2015-7547](https://access.redhat.com/security/cve/cve-2015-7547) \- [https://access.redhat.com/articles/2161461](https://access.redhat.com/articles/2161461)

RHEL6 - [https://rhn.redhat.com/errata/RHSA-2016-0175.html](https://rhn.redhat.com/errata/RHSA-2016-0175.html) \- update to glibc-2.12-1.166.el6_7.7.x86_64.rpm

RHEL7 - [https://rhn.redhat.com/errata/RHSA-2016-0176.html](https://rhn.redhat.com/errata/RHSA-2016-0176.html) \- update to glibc-2.17-106.el7_2.4.x86_64.rpm

Debian - [https://security- tracker.debian.org/tracker/CVE-2015-7547](https://security- tracker.debian.org/tracker/CVE-2015-7547) Use "aptitude show libc6" \- needs to be 2.19-18+deb8u3 (jessie), 2.21-8 (sid)

Ubuntu - [http://people.canonical.com/~ubuntu- security/cve/2015/CVE-20...](http://people.canonical.com/~ubuntu- security/cve/2015/CVE-2015-7547.html)

SUSE - [https://www.suse.com/security/cve/CVE-2015-7547.html](https://www.suse.com/security/cve/CVE-2015-7547.html)

Interesting to note this tip:

 _While it is only necessary to ensure that all processes are not using the old glibc anymore, it is recommended to reboot the machines after applying the security upgrade._

From - [https://lists.debian.org/debian-security- announce/2016/msg00...](https://lists.debian.org/debian-security- announce/2016/msg00051.html)

Therefore at the very least you will need to restart anything which depends on glibc. This should give you a list of packages:

      lsof | grep libc | awk '{print $1}' | sort | uniq

<comment><USER10> Ubuntu - [http://people.canonical.com/~ubuntu- security/cve/2015/CVE-20...](http://people.canonical.com/~ubuntu- security/cve/2015/CVE-2015-7547.html)

<comment><USER11> Ubuntu Trusty 14.04 user here. Am I correct that there's no patch out yet?

<comment><USER11> Update: It looks like the patch is finally out.

<comment><USER12> What are you doing to pull this patch? I've apt-get updated and still am seeing Version: 2.19-0ubuntu6.6

<comment><USER9> Does appear to be out - [https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7](https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7)

apt-get update not seeing it at the moment though, guess its the mirror I'm using.

Edit - working now. I can see:

       Version: 2.19-0ubuntu6.7

<comment><USER12> Yep I'm seeing it too. Thanks! Ubuntu just released this:

[http://www.ubuntu.com/usn/usn-2900-1/](http://www.ubuntu.com/usn/usn-2900-1/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> An extra gold star for the valuable comments added by the patch! [https://sourceware.org/ml/libc- alpha/2016-02/msg00416.html](https://sourceware.org/ml/libc- alpha/2016-02/msg00416.html)

</comment><comment><USER14> Can we agree that it's urgently necessary to rewrite most of the core Linux/OSS stack in memory safe languages? Exploits like this come up all the time, and we know how to completely eliminate them. I don't care if it's Rust or D or Go or Haskell or OCaml or anything else, as long as it's not C. The sooner we do this, the better.

<comment><USER15> I'm still unsure why people start projects with C, or C++ (or other unsafe languages), that do not need it. I totally understand that there are use cases where C++ and C make sense.

In my mind, these use cases are quite limited though - integration into 3rd party libraries, legacy codebases, and working in embedded environments. I also agree that performance can be a reason, but see Knuth's opinion on premature optimization.

I also think that when writing C, and C++ it makes a lot of sense to restrict oneself as much as possible a la the kinds of standards in the Google Style Guide, or NASA's style guide.

Can people tell me why they start projects in broad C++, and C still? I may be completely missing some piece of the puzzle.

<comment><USER16> > Can people tell me why they start projects in broad C++, and C still? I may > be completely missing some piece of the puzzle.

Sure.

\---

 _Compelling features:_

\- Unrivaled portability (yes, contrary to folklore C - and to a lesser extent C++ - is more portable than Java)

\- Excellent libraries

\- Excellent documentation and learning resources

\- Unrivaled tooling

\- perfect mapping to how the computer works

\- Unrivaled performance (other than Rust)

\- exceptional, engaging, and intelligent community (specifically referring to the cpp community)

\---

 _Why start a C++ project today?_

\- you want to write a web browser

\- you want a platform agnostc GUI

\- you want to learn OpenGL or Vulkan

\- you want to use Unreal and you're not a visual learner

\- you're want to write the business logic for a cross platform application and share as much code as possible

\- you're implementing you're own programming language

\- your implementing an algorithm or data structure you've been studying

\- you're bored

\- you like programming in C++

\- you want to learn template meta-programming

\- you want to learn functional programming

\- you want to learn how to write a device driver

\- you need the performance

\- you are not writing mission critical software (aka 99% of all side projects)

\- you're a curious person

\- you're a contrarian and everyone you know uses Java

\- you want to become a more well-rounded engineer

\- you want to learn about the ins and outs of language design and features

\- you want make a lot of money

\- you only know C++

Those are a few reasons. Hope that helps you solve your puzzle.

PS: Do the anti-C people realize that a kernel in Rust/Nim/whatever would be under a big unsafe block anyways? Yeah, you have to program "unsafe" code eventually. Those nice high level abstractions are not omnipresent, you know. They need something to abstract.

<comment><USER17>
      > a kernel in Rust/Nim/whatever would be under a big unsafe block anyways?

Only portions of it do. The whole point of unsafe is that you can encapsulate it, and then go from there.

<comment><USER16> Definitely. The ability to encapsulate code that is less strictly checked by the compiler is what makes Rust such a compelling alternative to C. I definitely think Rust is the ideal choice for a hobby kernel from scratch in 2016.

My point is that unsafety is unavoidable. You can encapsulate unsafe Rust or wrap plain old C, it's, for all practical purposes, the same. At that level language features matter a lot less. I agree we should minimize and encapsulate loosely checked code as best we can.

<comment><USER17> Yeah, absolutely. Ultimately, the machine is not safe. Such is life.

<comment><USER18> Exactly... and users are even worse.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> As far as I see the bug primarily lies within this function here... resolv/res_send.c [https://github.com/bminor/glibc/blob/master/resolv/res_send....](https://github.com/bminor/glibc/blob/master/resolv/res_send.c#L952)

Lines 952 ... 1389 [=~450 lines of code], with more than a dozen of variables holding random state. Think about the complexity you have with all the conditionals and loops, often copying and pasting similar conditions with (xx1 && xx2) variants.

While discusions about the relative merits of Rust, C, Ocaml, Intercal are fun, with enough dedication you can write unauditable/unreviewable code in any language. Even though you might avoid memory corruption, you still can't prove that such kind of code does anything correct.

<comment><USER20> You sure can prove that any correct code does something correct, but you can _never_ prove something about a program outside of a machine-checked formal proof.

<comment><USER21> The problem is that it's far more difficult to prove what code _doesn 't do_ than what it does. I can write a function to do X, Y and Z, and I can show, through observation and aggressive testing, that it does indeed do X,Y and Z....but its a _lot_ harder to prove that it _only_ does X,Y and Z and nothing else. Memory safety is just one expression of this problem.

<comment><USER20> In the typical framework (refinement), if you prove your function does X, Y, and Z, then it does exactly X, Y, and Z. Please don't take my comment out of the context of formal, machine-checked proofs. It is hard, and that's my point.

</comment></comment></comment></comment><comment><USER22> Criticism of C aside, when you use a language that isn't very expressive and where it's easy to shoot yourself in the foot, you need to keep it very neat.

I mean just look at this [https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/pos...](https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/posix/getaddrinfo.c)

That size of methods, huge macros, the low ratio of comments to (non-obvious) statements etc.

I know it's easy to criticize very old and tested code, but there is no (and never was any) excuse for code like that.

<comment><USER23> Compare to the musl implementation: [http://git.musl- libc.org/cgit/musl/tree/src/network/getaddri...](http://git.musl- libc.org/cgit/musl/tree/src/network/getaddrinfo.c)

<comment><USER22> It's better. The musl version is slightly smaller and tidier but also doesn't handle all the same proticols so it's not a fair comparison. At least it doesn't have a lot of conditional compilation and macros.

But the musl code too has bloody ZERO comments for a nearly 100 line long method of dense/opaque C code! Why? Is commenting and splitting code into functions frowned upon in "traditional" systems programming?

Who is it that writes code like this? Why isn't code like this rejected by a maintainer with "split this into at least smaller 5 functions and comment anything non-obvious"?

Edit: looking again it's actually not _that_ bad, it does have two lookups already broken out and a lot of the verbosity is just field assignment. Would be happy with a dozen lines of comments and a split into 2-3 functions.

<comment><USER23> I feel like comments are extremely valuable in API documentation, but not so much in the implementation.

When you're reading an API you want to understand how it works without cracking open the source. When you're looking at an implementation it is your duty to load the source into your comprehension, at which point comments become irrelevant, or worse, misleading.

<comment><USER22> Here is how much comments is actually needed: [https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdi...](https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=b995d95a5943785be3ab862b2d3276f3b4a22481)

</comment></comment></comment></comment></comment><comment><USER24> This is why I enabled automatic security updates on all the machines I control. I'd rather get a monitoring alert that something is broken, than to find out much later that someone rooted my server.

<comment><USER25> Unless you automatically restart every service that is linked with a library when you update it, you are still vulnerable.

</comment></comment><comment><USER26> The Debian glibc package update that fixes this vulnerability is dated February 11. But the patch wasn't posted on the glibc mailing list until today. So did Debian get the patch even before it was made public upstream? If so, then why didn't Ubuntu get it early as well?

<comment><USER27> Sufficiently "bad" issues are disclosed to multiple Linux vendors at the same time, via the vendor-sec mailing list. If you're a member of a security team for a distribution this is generally where you hear about issues.

From there coordinated release dates will be agreed, and barring big surprises like one distro pushing out an update too soon everybody _should_ release at the same time.

Sometimes people get sick, take a holiday, or drop the ball for other reasons. I'd expect Ubuntu did get notified, but haven't yet tested/built their fixed packages to push out.

</comment></comment><comment><USER28> So can someone ELI5 how bad this is?

From what I'm reading this should only affect systems that use a compromised DNS server or in a MitM attack scenario. Which is serious but not so easily exploitable (I think).

<comment><USER29> If you request a network connection to an attacker-controlled host, your network software may try to resolve the attacker's host name. The DNS NS record of their domain may then specify your resolver directly look up the record using the attacker's own name server, meaning you are directly doing DNS queries against the attacker's NS.

So in theory, all you need to be exploited is to connect to a compromised host and resolve its hostname.

<comment><USER30> It could be even worse than that. If the attacker tries to connect to you, your server may try to reverse their IP for logging, and the attacker can control the PTR record. Or the attacker could send you an email that's guaranteed to bounce, and they control the return path that your mailer has to resolve.

</comment></comment></comment><comment><USER31> Looking for a quick mitigation technique before patches start rolling out... Would it be wise to limit responses to 512 bytes so the payload cannot be loaded?

Configuring BIND to use a specific buffer size (only for BIND 9.3.2 and newer):

Add the following line to the "options" section of your named.conf file:

edns-udp-size: n

Configuring Unbound to use a specific buffer size:

Add the following line to the "server" section of your unbound.conf file:

edns-buffer-size: n

source: [https://labs.ripe.net/Members/anandb/content-testing-your- re...](https://labs.ripe.net/Members/anandb/content-testing-your-resolver-dns- reply-size-issues)

<comment><USER32> I haven't tested it, but I'd expect not. Given a limited EDNS0 buffer size, UDP responses would either come back with a truncated flag or not at all. Either case would trigger a TCP retry, and the bug can be triggered that way.

</comment></comment><comment><USER33> If this was originally filed on an open bug tracker in July 2015, what were the glibc team doing in the mean time? The Google post indicates they were "working on it" when Google got in touch. How much work was going on, exactly? How did this languish for so long?

</comment><comment><USER34> That's what you get when you have thousands of lines of code with variable names like `thisanssizp`. glibc should die in a fire.

<comment><USER35> The DNS code in resolv/ is not formatted according to GNU coding style - <USER2> can tell by the sane placement of braces.

It's a fork of an ancient version of BIND.

      Starting with version 2.2, the resolver in the GNU C Library comes
      from BIND 8.

[https://sourceware.org/git/?p=glibc.git;a=blob;f=resolv/READ...](https://sourceware.org/git/?p=glibc.git;a=blob;f=resolv/README;h=dbb15108ae025e2896c0dc1d9161f14d6e05d330;hb=HEAD)

</comment></comment><comment><USER36> If alloca could be used to get arbitrary-sized buffer the bug would not exist. Another Y story [https://fosdem.org/2016/schedule/event/ada_memory/](https://fosdem.org/2016/schedule/event/ada_memory/) points out that Ada does not have this limitation. There it is a job of the compiler to allocate bug chunks outside of the stack not to cause stack overflows. C really needs such API.

</comment><comment><USER37> Buffer overrun on the stack...this makes me sad. It's 2016.

<comment><USER38> "There are two things I am sure of after all these years: there is a growing societal need for high assurance software, and market forces are never going to provide it."

\- Earl Boebert

</comment></comment><comment><USER39> Can someone please explain the fix in practice? Is it as simple as upgrading glibc (and eglibc?) on all servers? Or is there a network change I should immediately change?

<comment><USER40> Yes, patching your OS (e.g. an apt-get update + apt-get upgrade) then rebooting once the vendor has released patches should be sufficient.

</comment></comment><comment><USER41> iptables -t filter -A INPUT -p udp --sport 53 -m connbytes --connbytes 512 --connbytes-dir reply --connbytes-mode bytes -j DROP

iptables -t filter -A INPUT -p tcp --sport 53 -m connbytes --connbytes 512 --connbytes-dir reply --connbytes-mode bytes -j DROP

<comment><USER42> Thanks for this. It'll do for my router until a new firmware is out. I tried the above but --connbyte takes a range as input not a single value. Like, "512:8192" or "512:" for "greater than 512". In practice "512:" is interpreted as "512:4294967295". So it ends up looking like,

iptables -t filter -A INPUT -p udp --sport 53 -m connbytes --connbytes 512: --connbytes-dir reply --connbytes-mode bytes -j DROP

iptables -t filter -A INPUT -p tcp --sport 53 -m connbytes --connbytes 512: --connbytes-dir reply --connbytes-mode bytes -j DROP

</comment></comment><comment><USER43> Can someone give me technical reasons why this world isn't possible:

Parts of the linux kernel or glibc or any other critical C code gets replaced by rust code little parts at a time, which is also calleable from C ([https://doc.rust-lang.org/book/ffi.html](https://doc.rust- lang.org/book/ffi.html))? That way these libraries could be made safer in a controlled and incremental manner.

And to reiterate I'm asking for _technical_ limitations, not political or dogmatic.

<comment><USER44> I thought about this before, since it seemed like a good idea to me too. It's not that simple though, there's tons of problems you'd hit and the result wouldn't be what you want. The bottom line is that Rust is simply not a drop- in replacement for C:

You can't just pass a Vec<> to some C code and expect it to work. The reality is that you're going to end-up writing a lot of C-like Rust - Which either acts on C types directly or converts them to Rust types and then does things to them and converts them back. Either way, the safety is largely lost due to this because C types are not going to be safe.

You also can't use any inline C functions or preprocessor macros in your Rust code, meaning that the interop between C and Rust isn't really that good - <USER3> lets you call _functions_ , but functions only make-up a part the C API. The rest would have to be duplicated in Rust and kept up-to-date, which is a huge development burden and very error prone.

And when you're finally "done" and all the C code is gone, what you're left with is just a lot of C-like Rust, communicating with each-other through the C API using C types with unsafe code everywhere. Essentially C but in Rust form. You'd have to do a ton of refactoring to turn this into anything like idiomatic Rust, and you can't do that refactoring till all the C code interfacing with that Rust code is completely gone so you can stop supporting interop with C.

The bottom line is that it you _could_ do it, but it won't work well because it's missing the big picture - If you don't write Rust code like Rust, then you don't get the safety guarantee's, and you can't do that if you're trying to recreate a bunch of C interfaces in Rust. C interfaces are _not_ safe in the way that Rust would want them to be safe. It's the same reason why you can't write a converter to convert from C to idiomatic Rust - You have to design the system differently to get the gains from Rust, which is a non- trivial thing to do. Rewriting small parts in Rust isn't going to result in the design differences that you need, and the interop between Rust and C isn't very good, leading to lots of problems while you're dealing with both languages in the same code base.

<comment><USER17> While this is true in some sense, there are also advantages. A ruby gem written in Rust via C FFI was one of the earliest production uses of Rust; the Skylight people still thought (and think) that it was very, very worth it.

[https://www.youtube.com/watch?v=2BdJeSC4FFI](https://www.youtube.com/watch?v=2BdJeSC4FFI) is a further exploration of this idea and how it works. Yes, you do need that small layer, but future libraries will make it even easier. There's the Neon work, for example: [http://calculist.org/blog/2015/12/23/neon-node- rust/](http://calculist.org/blog/2015/12/23/neon-node-rust/)

</comment></comment></comment><comment><USER45> Why don't more distros use the lighter weight C runtimes?

<comment><USER46> Many applications don't work with anything but glibc, so distributions don't use them; because distributions don't use them, applications don't support anything but glibc.

<comment><USER47> The number of applications that rely on malloc/free being multithreaded fork safe, like glibc's allocator, is astounding. Off the top of my head, any application that uses glib and g_spawn_* is quite unportable for this reason.

</comment></comment></comment><comment><USER48> Is getaddrinfo usually statically linked or dynamically linked to stuff?

Which pkgs on Ubuntu will be necessary to upgrade once they roll the fix to the repos?

<comment><USER49> This is one of those things that usually cannot be linked statically at all. So, not many things to upgrade.

<comment><USER50> Why can't it be linked statically?

<comment><USER36> Glibs uses /etc/nsswitch.conf to decide at runtime which libraries has to be loaded dynamically to implement DNS resolver, user lookup etc. One in principle can compile those libraries statically, but it is rather complicated for no gains, so almost nobody is doing that.

<comment><USER50> Interesting, thanks!

</comment></comment></comment></comment></comment><comment><USER51> I have a question that hopefully someone can clear up for me.

If I understand the Google sec article correctly, this requires a single packet > 2048 bytes to be received by a host using glibc.

> The vulnerability relies on an oversized (2048+ bytes) UDP or TCP response, > which is followed by another response that will overwrite the stack.

Is my understanding correct?

If it is, then it's worth pointing out that many links on the public Internet have an MTU of 1500 bytes. This is an historical legacy of original Ethernet from the 80's. Path-MTU-Detection(PMTUD) doesn't really work on the Internet, so it's safest to assume that you only ever get 1500 bytes.

Given all that, this places a burden on anyone wanting to eploit this. Since they cannot assume a PMTU greater than 1500 bytes between endpoints, they're limited in how they can exploit the bug. Correct?

Please correct me if I'm wrong. I always feel these bug reports are missing that vital piece of information I need to operationalize the bug. And thanks.

<comment><USER32> Datagrams larger than the MTU can be sent, they'll just be fragmented. The point of PMTU is to avoid fragmentation where necessary, but it's still possible.

<comment><USER51> _Sometimes_ datagrams larger than 1500 bytes can be sent, sometimes they won't reach their destination. Fragmentation doesn't really work, and at the very least will almost always ensure out-of-order delivery. Either way you can't depend on it.

PMTUD doesn't work at all on the modern Internet, not for IPv4, and not for IPv6. So again, I'm just wondering how dangerous this exploit really is. I'm not saying it isn't dangerous, I'm saying our understanding of it should be tempered somewhat due to many links not fragmenting properly that have MTUs of 1500 bytes.

</comment></comment></comment><comment><USER52> How is this related to CVE-2015-0235 (the GHOST vulnerability last year)?

<comment><USER4> They are separate vulnerabilities in the same codebase, both affecting DNS clients. This one is new, so having previously patched to protect from CVE-2015-0235 does not make you safe from CVE-2015-7547.

</comment></comment><comment><USER53> Has anyone put together a POC that doesn't require re-pointing the system nameserver and crashing other applications?

<comment><USER54> You can create a small chroot with a custom resolv.conf.

Example (tested on Ubuntu 14.04 64-bit):

      mkdir -p root/lib/x86_64-linux-gnu root/lib64 root/etc
      cp -a --parents /lib/x86_64-linux-gnu/lib{c,nss,resolv}* root
      cp /lib64/ld-linux-x86-64.so.2 root/lib64
      cp CVE-2015-7547-client root
      echo 'nameserver 127.0.0.1' > root/etc/resolv.conf
      sudo chroot root ./CVE-2015-7547-client

If it prints nothing it crashed. Try running with strace to be sure.

<comment><USER53> Brilliant. Thank you.

</comment></comment></comment><comment><USER36> I wonder why alloca+malloc/free was used in the first place and not straightforward malloc/realloc/free. The overhead of the latter should be negligible given that this is a DNS resolver. The overhead in fact could be negative due to simpler code and better cache utilization.

Premature optimization is a root of all evil indeed.

</comment><comment><USER55> I apologize for my bad behaviour on this thread. I'm in a bad place, mentally.

</comment><comment><USER56> I think new generation wants to take over linux with their new ideas but in reality they just want to prove themselves and prepared to completely ruin it in the process.. well. Cos they just young and want new things. They know big words and think they now the world and they hate their parents... so in short - they want to do to the Linux what the previous generation did to windows... karma.

P.s. whatever language you use its irrelevant. Bugs are in the heads. Code is just the reflection.

</comment><comment><USER57> If this causes you serious problems, you should really consider using a patched grsecurity kernel (even though their stable versions arent free anymore)

</comment><comment><USER58> Has anyone actually tried the PoC on their systems? I will test on CentOS 6 and 7 after I have had my coffee. Anyone willing to volunteer to test on Ubuntu and Debian?

Here is CentOS 7

        [  389.064412] do_general_protection: 159 callbacks suppressed
        [  389.064416] traps: CVE-2015-7547-c[1161] general  rotection ip:7fa6b0d8fd67 sp:7ffdaf034a30 error:0 in libresolv-2.17.so[7fa6b0d87000+16000]

<comment><USER59> I tested my ubuntu 12.04 and it did not seem to be affected.

      server:
      vagrant@precise32:/tmp/CVE-2015-7547$ sudo python CVE-2015-7547-poc.py
      [UDP] Total Data len recv 36
      [UDP] Total Data len recv 36

      client:
      ./CVE-2015-7547-client
      CVE-2015-7547-client: getaddrinfo: Name or service not known

      vagrant@precise32:/tmp/CVE-2015-7547$ lsb_release -a
      No LSB modules are available.
      Distributor ID: Ubuntu
      Description:    Ubuntu 12.04 LTS
      Release:        12.04
      Codename:       precise

      vagrant@precise32:/tmp/CVE-2015-7547$ ldd --version
      ldd (Ubuntu EGLIBC 2.15-0ubuntu10) 2.15
      Copyright (C) 2012 Free Software Foundation, Inc.
      This is free software; see the source for copying conditions.  There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
      Written by Roland McGrath and Ulrich Drepper.

<comment><USER12> I'm seeing the same behavior here. Thanks for the update and confirmation. Can others confirm if this means 12.04 isn't impacted by this cve?

</comment></comment></comment><comment><USER60> There's something I don't understand: if it's from 2015, how come it hadn't been fixed until now? At least for debian.

</comment><comment><USER61> A summary of the problem, the affected Linux versions and patching remediations have been posted here: [https://ma.ttias.be/critical-glibc- buffer-overflow-vulnerabi...](https://ma.ttias.be/critical-glibc-buffer- overflow-vulnerability-getaddrinfo-linux-cve-2015-7547-cve-2015-5229/)

</comment><comment><USER62> Everyone's going crazy advising everyone else to update, but the glibc homepage is happily, statically sitting on version 2.22 from 2015-08-14.

Maybe we should start by releasing an update there asap, and go from there?

(I just switched our last Linux server over to FreeBSD, despite some software we use not being available; so I'm happy to sit this one out.)

</comment><comment><USER63> I haven't seen anything come down through yum or apt-get yet. Does anyone know how this can be patched prior to that?

<comment><USER64> Debian has published security announcements for glibc [1] and eglibc [2]. Updates should be available from [http://security.debian.org/](http://security.debian.org/) (and I was able to install them).

Also, keep this in mind:

>While it is only necessary to ensure that all processes are not using the old glibc/eglibc anymore, it is recommended to reboot the machines after applying the security upgrade.

[1] [https://lists.debian.org/debian-security- announce/2016/msg00...](https://lists.debian.org/debian-security- announce/2016/msg00051.html)

[2] [https://lists.debian.org/debian-security- announce/2016/msg00...](https://lists.debian.org/debian-security- announce/2016/msg00050.html)

</comment></comment><comment><USER65> Is there something that can be done about this on the network level? I mean, it seems almost impossible to assure that every instance of getaddrinfo is patched.

I'm thinking about a background tool (iptables plugin?) that simply truncates long DNS replies, so that they can never cause a buffer overflow.

<comment><USER66> See [https://news.ycombinator.com/item?id=11112923](https://news.ycombinator.com/item?id=11112923) on this page.

<comment><USER65> Thanks!

</comment></comment></comment><comment><USER67> Can someone explain in layman's terms how will this affects me as a Linux user who works on Ubuntu?

<comment><USER68> Update your machines and you should probably restart too so any running processes link to the new libc.

<comment><USER69> This. Far too often I see libraries updated by a security patch but without a restart of affected dependent processes, meaning you're not protected.

      sudo lsof -n | grep DEL

is your friend in this matter.

</comment></comment></comment><comment><USER70> It seems tcp_wrappers-libs is using getaddrinfo, so if you have some rules setup there that may be an attack vector. I'm not sure if sshd will want to do a getaddrinfo if you don't have some tcp wrappers rule set up in /etc/hosts.{deny,allow}.

<comment><USER66> See [https://news.ycombinator.com/item?id=8957680](https://news.ycombinator.com/item?id=8957680) for earlier discussion of that latter point.

</comment></comment><comment><USER71> Ubuntu is now patched.

[http://people.canonical.com/~ubuntu- security/cve/2015/CVE-20...](http://people.canonical.com/~ubuntu- security/cve/2015/CVE-2015-7547.html)

</comment><comment><USER72> Don't panic, don't spread fear: [https://00f.net/2016/02/17/cve-2015-7547/](https://00f.net/2016/02/17/cve-2015-7547/)

</comment><comment> Ono-Sendai Looking at that code, which is a tangle of goto statements and buffer allocations and accesses, it's a miracle any of it works in the first place. I bet there are tons more bugs in there.

<comment><USER73> Tangle of gotos? Those gotos all look reasonable -- they go to return conditions no longer than a few lines. Buffer allocations? They allocate to 2-3 buffers. That's all very reasonable. allocations and gotos aren't the devil in C.

<comment> Ono-Sendai Well, the control flow seems complicated at least.

<comment><USER74> No

<comment><USER75> .

</comment></comment></comment></comment></comment><comment><USER76> If I point the local DNS resolver to Google's DNS server as a temp fix (184.108.40.206) in /etc/resolv.conf , will that mitigate the threat before the patch?

<comment><USER66> The problem is DNS/UDP and DNS/TCP responses that are larger than 2048 bytes hitting your BIND DNS client library. Do you have any reason to believe that Google Public DNS (in your part of the world) always limits its responses to smaller than 2048 bytes?

<comment><USER76> Google's DNS relay may take steps to sanitize malicious DNS responses.

</comment></comment></comment><comment><USER77> Newbie questions:

Are "upload file by URL" functions potential vectors? (payload in malcious dns response)

Is this contingent on a cooperating DNS server (not truncating the record?)

</comment><comment><USER78> Fun fact: If you have programs written in Go, after patching this you probably will need to recompile all of them.

<comment><USER6> Go 1.5 uses its own pure-Go DNS resolver.

<comment><USER79> Under certain conditions, it does not.

[https://golang.org/pkg/net/#hdr- Name_Resolution](https://golang.org/pkg/net/#hdr-Name_Resolution)

<comment><USER80> When it does not it dynamically links.

<comment><USER78> That does not make sense.

Among others the page lists:

> [...] when /etc/resolv.conf or /etc/nsswitch.conf specify the use of > features that the Go resolver does not implement, and when the name being > looked up ends in .local or is an mDNS name.

Those things you can't check at compile time.

In any case, you can tell whether the binary is statically linked or not.

Statically linked:

        $ file /usr/bin/consul
        /usr/bin/consul: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
        $ ldd /usr/bin/consul
                not a dynamic executable

Dynamically linked:

        $ file /bin/echo
        /bin/echo: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped
        $ ldd /bin/echo
                linux-vdso.so.1 =>  (0x00007fff01fff000)
                libc.so.6 => /lib64/libc.so.6 (0x0000003bcd800000)
                /lib64/ld-linux-x86-64.so.2 (0x0000003bcd000000)

Notice the libc.so.6

</comment></comment></comment></comment></comment><comment><USER81> Can this be used to exploit DNS servers via other rogue DNS servers? What if I setup a rogue DNS and wait for it to be queried by 220.127.116.11. When I own 220.127.116.11 I can exploit every client that queries it. Browsers use getaddrinfo(), don't they?

<comment><USER69> No. Recursive resolvers do not use getaddrinfo(3) to resolve DNS queries.

<comment><USER81> That was what I was thinking but it was stupid idea.

My point is that if you could use this bug to use one rogue DNS to own other DNSes this could be leveraged to bring large parts of the Internet down.

I don't know how hard or easy this could be. A quick glance into PDNS reveals four calls to getaddrinfo()[1]. So it might be possible...

[1] [https://github.com/PowerDNS/pdns/search?utf8=%E2%9C%93&q=get...](https://github.com/PowerDNS/pdns/search?utf8=%E2%9C%93&q=getaddrinfo)

<comment><USER66> Out of those four calls:

One uses AI_NUMERICHOST and thus doesn't do any DNS client activity. A second isn't supplied arbitrary domain names as input, they being the ones configured for the location of a specific back-end data source by the server administrator. The third is used only inside a "zone transfer" subsystem and again isn't supplied arbitrary domain names as input, the domain names again being in local data specified by the server administrator.

And the fourth is not even part of the executable program, the code being disabled with #if 0 .

The "S" in "DNS" stands for "system", not "server", by the way. A rogue DNS _server_ would "own" other DNS _servers_.

</comment></comment></comment></comment><comment><USER82> Does this affect OSX?

<comment><USER83> No. OS X has its own implementation.

[http://www.opensource.apple.com/source/Libinfo/Libinfo-477.2...](http://www.opensource.apple.com/source/Libinfo/Libinfo-477.20.1/lookup.subproj/libinfo.c)

</comment></comment><comment><USER84> Don't use SQL or PHP either! These are vulnerable to bugs!

</comment><comment><USER85> Are there any big efforts to rewrite glibc in something like rust? ... Is that a thing that is even possible? An in-place replacement library for dynamic or static linking.

I'm really worried that I still hear about buffer overflows in this day and age. Of all the libraries in the world, glibc should probably be written in some subset of Idris that compiles into 100% safe C. We have the technology to move to this now

<comment><USER16> I'm not trying to be rude, but I'm sorry...

Are you seriously suggesting that rewriting an implementation of the C standard library in a language that isn't C is something that makes any bit of sense?

I think you have a fundemental understanding of the roll the C-standard library plays in the C language. Not to mention UNIX in general.

Maybe you're suggesting we need an OS based in Rust instead of C (which is more reasonable), but in that case why wouldn't you use Rust's standard library as the backbone of that system?

Let me put it this way, if the GNU/Linux C standard library gets rewritten in Rust or Idris (sigh... seriously?) I will switch to Windows 10 with default settings for the rest of my life. I would rather have the NSA log my every key stroke than participate in a community where that is considered a good idea.

<comment><USER34> Rust can have the same ABI as C - rewriting NSS in Rust should not pose ABI problems.

<comment><USER16> It's still completely pointless. How would mmap be any different if it was implemented in Rust rather than in C? You need unsafe to implement it! The safety mechanisms are practically useless at such a low level.

Wrap existing C with safe Rust, not the other way around! We don't rewrite unsafe C code in Unsafe Rust so that it can be called from all the unsafe C code in UNIX. Such a translation is so pointless and error prone.

I can't even believe I'm the one being called backwards here.

<comment><USER86> _> How would mmap be any different if it was implemented in Rust rather than in C? You need unsafe to implement it! The safety mechanisms are practically useless at such a low level._

They're definitely not. The power of Rust is not avoiding all `unsafe` ever, but wrapping that unsafe into finite-scope, _safe_ wrappers. Something like mmap would presumably interface with the OS's internal memory management routines, which would definitely have to have `unsafe` somewhere since they're hitting the hardware, but it seems very reasonable for the amount of unsafe exposed to much reduced (possibly even to zero). See, for instance, [http://os.phil-opp.com/modifying-page-tables.html](http://os.phil- opp.com/modifying-page-tables.html) . Basically, as soon as you're above the absolute raw hardware level, you can start introducing extra help to reduce unsafety/catch bugs.

In any case, code inside `unsafe` still benefits from all the conventional Rust checks, e.g. iterating over a slice won't go out of bounds due to a typo in the loop even inside `unsafe`, nor will references accidentally become dangling. (Of course, the `unsafe` block may do something explicitly that causes either of these problems, but this exact same risk is pervasive in _all_ C code, rather than just around explicitly marked areas.)

 _> Wrap existing C with safe Rust, not the other way around! We don't rewrite unsafe C code in Unsafe Rust so that it can be called from all the unsafe C code in UNIX. Such a translation is so pointless and error prone._

Note that this is exactly what is done now, the features of Rust for making safe interfaces makes Rust often a far nicer way to use C interfaces than C itself, without overhead (IMO, of course). See [http://blog.rust- lang.org/2015/04/24/Rust-Once-Run-Everywher...](http://blog.rust- lang.org/2015/04/24/Rust-Once-Run-Everywhere.html#safe-abstractions) , for example. Of course, zero-overhead Rust is only as safe as the C code it wraps, it can't (in general) protect against the C code not correctly implementing its stated contract(s).

<comment><USER47> It seems hard (impossible?) to write a safe, full-featured mmap wrapper in Rust, because of the potential for multiple processes sharing mutable access to the memory and defeating Rust's aliasing checks.

Maybe you could separately map shared RefCells to guard the pages returned by the mmap wrapper? If the region is backed by a file, you'd need to check those RefCells on every IO access too, though.

<comment><USER87> What you can do for mmap is have several abstractions (or one using generics and phantom types), one for each different set of usecases, with different access modes.

Examples would be:

* read-only: &ROMemMap -> &[u8]

* read-write: &mut RWMemMap -> &mut [u8]

* write-only: fn set(self: &mut WOMemMap, i: usize, b: u8),

or more generally: &mut WOMemMap -> &mut [WriteOnly<u8>] where WriteOnly<T> has fn set(&mut self, T)

Now for the shared case, consider this: aliasing rules can be avoided with atomic operations, i.e. Arc<AtomicUsize> is shared and can be safely (atomically) read/written by multiple threads.

In the multi-process case, you could provide an atomic API, although we don't currently seem to expose byte-level atomics (likely not present on some platforms) so if you wanted to write a demo you'd need to use the unstable intrinsics atm.

FWIW restricted to single-threaded code, this results in the Cell get/set API which is not hardware-atomic but cannot overlap with other accesses to the same memory, as Cell doesn't implement Share so any threading abstraction will block you from doing any kind of sharing of Cells.

That is, you can share &[Cell<u8>] pointing to any bag of bytes that sits in read-write memory, and anything in the same thread can read or write to it, safely.</comment></comment></comment></comment></comment></comment></comment>


How the Biotech Industry Cultivates Positive Media – And Discourages Criticism - <AUTHOR> http://progressive.org/magazine/how-the-biotech-industry-cultivates-positive-media/ <comment><USER2> I predict intimidation tactics via social media are going to start going the other way ... activists targeting not just corporations, but their managers and executives, doxxing them, ridiculing them, and using other types of public pressure to influence their employers' policies and goals. It's already happening to a limited extent (see [http://www.oregonlive.com/washingtoncounty/index.ssf/2016/01...](http://www.oregonlive.com/washingtoncounty/index.ssf/2016/01/post_71.html)) but I think this is just the beginning.

<comment><AUTHOR> You are probably right, but I think that is because those activists might feel that with such asymmetry of power that is their only resort.</comment></comment>


Location-Aware Load Balancing  - <AUTHOR> http://devcentral.f5.com/weblogs/macvittie/archive/2010/07/07/location-aware-load-balancing.aspx

<comment><USER2> Yet another piece from the f5 fluff factory.

Flagged for lack of content. It's simply a bunch of buzzwords chained together for the sole purpose of collecting google juice towards their linkfarm.

Submitted, unsurprisingly, through a dedicated spam account - see his submission history.</comment>


The GOP tax bill could be a disaster for PhD students - <AUTHOR> https://www.vox.com/policy-and-politics/2017/11/7/16612288/gop-tax-bill-graduate-students <comment><USER2> This analysis has been circulating various mailing lists at MIT: [https://drive.google.com/file/d/1e3oIk8AO9F_UL98z5cieKha1V5e...](https://drive.google.com/file/d/1e3oIk8AO9F_UL98z5cieKha1V5e9azzB/view)

As a summary, a RA at berkeley would experience a ~60% increase in federal taxes while a RA at MIT would experience a ~240% increase in federal taxes. In addition to that it bumps up any additional income you try to earn to a high marginal tax rate.

I can't believe they found a way to make doing a phd even more financially unattractive. It seems that this will either have a significantly adverse impact on STEM phd programs or the colleges will just figure out some different way to structure the tuition waivers.

</comment><comment><USER3> Previous discussions:

GOP tax bill would tax tuition waivers for grad students (chronicle.com)

[https://news.ycombinator.com/item?id=15622544](https://news.ycombinator.com/item?id=15622544) (122 comments)

The GOP Tax Plan Will Destroy Graduate Education (forbes.com)

[https://news.ycombinator.com/item?id=15646571](https://news.ycombinator.com/item?id=15646571) (97 comments)</comment>


Roku fake activation scams: How do they work? - <AUTHOR> https://osint.fans/roku-fake-activation-scams <comment><USER2> Why is Google not held liable for being complicit in an obvious criminal enterprise? They are getting paid to promote the scam. It's one thing if those ended up on the search results accidentally due to SEO, but this is not the case and Google is outright taking money for leading people to the scammers.</comment>


Ask HN: I just gota new macbook. How can I check for NSA sabotage? - <AUTHOR>

Specifically, Intel chips that are known to be sabotaged, or programs I can run to search for network interference? <comment><USER2> Well, it's hard to combat an adversary whose capabilities aren't known.

They _could_ have hardware backdoors installed that would theoretically be undetectable unless you opened your case up and physically compared each chip and integrated circuit against a known whitelist.

They _could_ have software backdoors installed in the form of firmware or microcode. Auditing these things is also very difficult because most of the time the manufacturers do not provide much (if any) documentation.

They _could_ have malicious peripherals installed such as usb cables with hardware keyloggers built in, in which case you'd have to physically cut open all your cables, etc.

They _could_ have rootkits installed, though there are tools such as rkhunter and chkrootkit that attempt to discover these.

>Intel chips that are known to be sabotaged

Check your chip(s) against any known blacklists or whitelists that you might have access to

>programs I can run to search for network interference?

Depends on your level of paranoia, but a sophisticated rootkit could hide network traffic from any firewalls on your machine, so you'd need to do monitoring with a second machine using something like Ethereal (I think it's called Wireshark these days?)

</comment><comment><USER3> Microwave on high for 20-30 minutes. Season to taste.

</comment><comment><USER4> Soak it in water for twenty minutes. The fake identifier stickers will fall off.

</comment><comment><USER5> Step one, purchase a controlling stake in your own chip fabrication plant...</comment>


Hacker News php script - <AUTHOR>

I could not find. Please help me. <comment><USER2> HackerNews is written in Lisp, not PHP. :).

<comment><AUTHOR> php similar ?

<comment><USER2> Not exactly. But really worth to learn and will help you program in PHP better :).

</comment></comment></comment><comment><USER3> Basically you want the source to the site? I somewhat mockingly say good luck, but I would like it as well.

<comment><USER4> How about <https://github.com/nex3/arc> then?

<comment><AUTHOR> not php... but thanks. ;)</comment></comment></comment>


YOLO-Fastest: 0.23Bflops 1.3MB VOC:60.8 - <AUTHOR> https://github.com/dog-qiuqiu/Yolo-Fastest <comment><AUTHOR> Yolo universal target detection model combined with EfficientNet-lite, the calculation amount is only 230Mflops(0.23Bflops), and the model size is 1.3MB</comment>


Ask YC: Submitting News in Spanish - <AUTHOR>

Hi, I've seen many interesting tech news in Spanish, so I wanted to ask you if you'd be interested in reading those news.<p>Thanks. <comment><USER2> I've nothing against it, but I speak no Spanish.

It would be neat if I could declare my linguistic ability in my HN preferences, so it only showed me articles that I can read.

I'd love to see HN full of Japanese links, for example, but I recognize that this would be of little value to most people.

</comment><comment><USER3> I for one would like that. I think we in the United States tend to be too single-spoken-language-minded. Regularly reading articles in a different language would be good for us.

</comment><comment><USER4> Is there a lot of tech information only available in Spanish? If so then of course. Although I, personally, will need good translations.

Or are you talking about the same news but in Spanish?

<comment><AUTHOR> I'm not talking about the same news in Spanish, but authors writing their ideas about tech in their language.

</comment></comment><comment><USER5> Try meneame.com - the spanish Digg?</comment>


ACTA absurdity continues, may only get worse - <AUTHOR> http://voices.washingtonpost.com/fasterforward/2010/02/acta_absurdity_continues.html

<comment><USER2> > _I can only imagine what will happen when the more... motivated Tea Party > types start paying attention to stories with headline descriptions like > "SECRET COPYRIGHT TREATY." Care to take a guess at how the debate will turn > at that point?_

I feel rather guilty about this, but I don't think I'd feel too bad if a horde of frothing mad morons suddenly arose to scuttle this treaty. It's difficult to motivate oneself to resist irrational populist anger when it's working _for_ you.</comment>


Django Djumpstart: Build a To-do List in 30 Minutes - <AUTHOR> http://www.sitepoint.com/article/build-to-do-list-30-minutes <comment><USER2> I kind of like this one better: [http://showmedo.com/videos/video?name=1100000&fromSeries...](http://showmedo.com/videos/video?name=1100000&fromSeriesID=110)

</comment><comment><USER3> There are newer tutorials on youtube!

<comment><USER3> But this is still good to get started.</comment></comment>


V8: Behind the Scenes (December Edition) - <AUTHOR> http://benediktmeurer.de/2016/12/20/v8-behind-the-scenes-december-edition/ <comment><USER2> What does "first class support for node.js" mean in practical terms?

<comment><USER3> (This is my interpretation from reading around)

They went over it a bit at [0], but the "subtext" is that until recently, Node.js has been "following" what V8 does. When V8 makes a change, node needs to react and work with it. When Node needs to do something differently than chrome, they need to kind of figure it out on their own.

Now they are going to be treating node like they treat chrome. Working with them on new features, more integrations with debugging, better support for things that Node.js uses or new APIs to make the Node code simpler.

I'm hoping this also means less breakage between Node versions for native code.

There's also a (maybe new?) buildbot [1] which is continuously integrating V8 and Node's master branch so you can try out the newest at any time.

[0] [https://v8project.blogspot.com/2016/12/v8-nodejs.html](https://v8project.blogspot.com/2016/12/v8-nodejs.html)

[1] [https://build.chromium.org/p/client.v8.fyi/builders/V8%20-%2...](https://build.chromium.org/p/client.v8.fyi/builders/V8%20-%20node.js%20integration?numbuilds=500)

<comment><USER4> I wonder how much this is related to Node.js cozying up to Chakra and other non-V8 JS engines.

</comment></comment></comment><comment><USER5> "we built a small wrapper around the WebAssembly component in V8, that allows it to also consume native code input via asm.js in addition to the native bytecode format."

It's written between the lines, but how I understand it, the optimizations they produce are finally the same that Mozilla did since it introduced asm.js. Later on it's shown in the example:

This:

      "use asm";
      function f(x) {
        x = +x;
        x = x * x;
        return +x;
      }

Is basically reduced to:

        0x10a04e985b0d    13  c5f359c9       vmulsd xmm1,xmm1,xmm1
        0x10a04e985b11    17  c3             retl

Of course, before they acknowledged asm.js, the working part of JIT-ed code was much, much bigger, the author describes it:

"It's a lot heavier since it has to use the JavaScript calling convention."

<comment><USER6> Yes, the approach shares elements with what Mozilla and later Microsoft have been doing. It derives types from asm.js annotations, and uses that to perform AOT compilation.

<comment><USER5> What I wanted to suggest is that they didn't have to wait for WebAssembly. Even if it's now presented as "a small wrapper around the WebAssembly" it was possible to do that since Mozilla introduced asm.js, as in the "ams.js" block is exactly enough information that enables for what they did now.

<comment><USER7> Maybe I'm dumb, but wouldn't a sufficiently clever optimizer compile the quoted function into the quoted output, even if the _" use asm"_ tag was omitted? What is the significance of asm.js here?

<comment><USER6> In theory yes, a smart enough JIT could figure this out. That was in fact v8's strategy for a while. But in practice, it's just not as effective. In a small function like that things are fairly simple, but with large code it takes time and resources for the optimizer to figure out all the types. That leads to noticeable slowness and pauses for recompilation etc. Instead of that, asm.js gives you the option to just receive the types up front.</comment></comment></comment></comment></comment>


Lance Armstrong Statement: "Enough is enough" - <AUTHOR> http://lancearmstrong.com/news-events/lance-armstrongs-statement-of-august-23-2012

<comment><AUTHOR> Last sentence is so inspiring!</comment>


Show HN: Notepad Style Online Calculator - <AUTHOR> https://type-calc.herokuapp.com/ <comment><AUTHOR> I made this notepad style calculator. You can use basic mathematical operators and parentheses and hopefully all will work. You can have comments starting with # that won't be evaluated. Basic percentage operations will work, and hopefully all combinations of the above. The input is saved in your browser so you can revisit the page and have all the text still present. I did everything as a static page so there is literally no framework at play here. Just index.html, index.css and a script.js. I used the amazing and magical nearly.js parser library to get the operators and parentheses working properly.

The most difficult thing for me was the design. Once I had a design in my head it was also very hard to realize it using CSS. I simply don't get CSS. The final version looks a lot less snazzy than I had imagined.

Please let me know what you think of it!

<comment><USER2> Looks cool!

I was playing around with weird/edge case inputs and came across this one that gives a strange result: `(200000 * 23323 * 2423 * 4223 + 30%)` => `62048638409419990,62048638409420000,62048638409419990,62048638409420000` I don't know if this is some sort of thousands-separator or a list of numbers, but I'd be interested to learn how the parser sees this. For reference, both `(200000 * 23323 * 2423 * 4223) + 30%` and `(200000 * 23323 * 2423 * (4223 + 30%))` give sensible results (once you get how the percent operator works).

<comment><AUTHOR> Thanks for finding that bug! The parser is confused. My pattern can match to that input in 4 different ways. So it is outputting all of those 4 ways. However only 2 are unique.

The two ways are:

\- (200000 * 23323 * 2423 * 4223) + 30%

\- (200000 * 23323 * 2423 * (4223 + 30%))

Now I'm not sure how to fix this.

</comment></comment></comment><comment><USER3> It looks nice, although I wonder why you'd treat each line as an independant calculation?

Generally I'd enter an expression, look at the result, then stop. If I wanted to run multiple things I'd use a repl, which would let me copy/paste.

That said it might be useful if you allowed variables to be defined, I updated my own little repl/calculator to allow that recently and found it very useful:

          calc> rent = 700.00
          700
          calc> fee = 92.00
          92
          calc> ( rent - fee ) * 12
          7296

Allowing that makes your multiline input more useful, although I guess you would need to decide if you'd recalculate all lines using a given variable if it's value changed ..

<comment><AUTHOR> Thanks for the feedback! I like the idea of being able to define variables and use them in subsequent lines.

Originally I wrote this purely to try out nearley.js, I was very intrigued by that library. Then I added the IP addresses function because I need to convert IPs to ints fairly frequently in my work. For that the line evaluation made sense.

</comment></comment><comment><USER4> Cool! It is similar to one of my personal projects where I use markdown and Math.js: [http://blog.nishihara.me/playground/calctext/](http://blog.nishihara.me/playground/calctext/)

I didn't know nearley.js. Maybe I can extend my own project to make more natural calculations.

</comment><comment><USER5> Looks interesting. I use this Mac app called Numi which does something similar. Worth checking out

<comment><AUTHOR> Wow that app looks amazing. It's what I wanted my website to be.</comment></comment>


Huawei propose New IP variable length addresing - <AUTHOR> http://prod-upp-image-read.ft.com/6f569c60-7045-11ea-89df-41bea055720b <comment><USER2> The authors of the paper, at the top of the first page, seem to have been (sloppily) redacted.

In my (admittedly very limited) experience, I've never seen an academic paper whose authors have been redacted like this. So, they are:

Zhe Chen, Chuang Wang, Guanwen Li, Zhe Lou, Sheng Jiang

Huawei Technologies Co., Ltd.

{chenzhe17, wangchuang, liguanwen, zhe.lou, firstname.lastname@example.com

\---

Alex Galis

University College London

firstname.lastname@example.com

</comment><comment><USER3> This article is utter total bullshit. But thank you for sharing anyhow. I now understand why China hired a dutch friend of mine to sanitize their nasty BGP issues.</comment>


10 Timeframes - <AUTHOR> http://contentsmagazine.com/articles/10-timeframes/

<comment><USER2> We should in fact value our customer's heartbeats ... but what about our own?

I think the tendency to get things accomplished is stronger in those of us that view our lives as short.</comment>


Ask HN: Entrepreneur or Hacker? Or Both - <AUTHOR>

Trying to get a feel of who uses hacker news. So, are you an entrepreneur? A technical hacker? or both? <comment><USER2> Life long academic. I spend 4 hours a day writing business communication, and about 6 or so programming. When I am speaking to people I am always teaching them something or learning something from them; a very strange take on sales, sure, but I approach sales as instruction, introducing the other to the possibilities and potential of my offering, and learning from them what I can do better.

When I am coding, I and the machine are learning together; sometimes I do the teaching, when I am in the flow, other times it does, when I am debugging.

<comment><USER3> > sometimes I do the teaching, when I am in the flow, other times it does, > when I am debugging.

Poetry :)

</comment></comment><comment><USER3> <http://news.ycombinator.com/newpoll>

both.

<comment><USER4> I would like to upvote you twice for providing both comments I came in here to make.

</comment></comment><comment><USER5> I'm a little bit more complicated. A wanna be entrepeneur turned wanna be hacker aiming to become an entrepeneur, though you could argue that being an entrepreneur is more of a lifestyle choice rather than a job title.

</comment><comment><USER6> Technical hacker gone entrepreneur (at least attempting to).

</comment><comment><USER7> Technical hacker. Maybe eventually the former.

</comment><comment><USER8> Entrepreneur.

</comment><comment><USER9> Both.</comment>


Ron Graham passed away earlier this evening at the age of 84 - <AUTHOR> https://www.reddit.com/r/math/comments/hmngx7/ron_graham_passed_away_earlier_this_evening_at/ <comment><AUTHOR> Prof Graham's juggling: [http://www.math.ucsd.edu/~ronspubs/pro_07_peripatetic.pdf](http://www.math.ucsd.edu/~ronspubs/pro_07_peripatetic.pdf)

</comment><comment><USER2> RIP. I know him through Concrete Mathematics.</comment>


Setting up continuous integration, nightly builds, etc in a .net environment - <AUTHOR> http://blog.binarymist.net/2014/02/22/automating-specification-by-example-for-net/j

<comment><USER2> Did you paste the wrong link? Because that link has nothing to do with continuous integration or nightly builds.</comment>


Can someone explain to me why O(n^3) is valid for Theta(n^3 + n^2) - <AUTHOR>

Can someone explain to me why O(n^3) is valid for Theta(n^3 + n^2) <comment><USER2> Yes.

Now, why should we do that? Can you demonstrate that you've already tried to work this out? Can you show us your working so far? Can you tell us what you've tried? Can you tell us what you already know?

If none of that, how do we know what explanation will provide the greatest benefit?

For a quick answer, try working through the definition using your specific example - here:

[http://en.wikipedia.org/wiki/Big_O_notation#Formal_definitio...](http://en.wikipedia.org/wiki/Big_O_notation#Formal_definition)

Replace _g(x)_ with _n^3_ and _f(x)_ with _n^3+n^2_ , work through the definition given, and then tell us where you get stuck. By doing that you will actually learn something, rather than just getting the answer.

</comment><comment><AUTHOR> You make me ashamed of myself. Thanks for the ass kickin. It was well deserved. I will work it out myself

<comment><USER2> That's a perfect response. If you get stuck, come back and ask, or feel free to email me and I'd be happy to get you unstuck. As I say, working on it for yourself is worth a lot, and I'd be happy to see you get the understanding. Make sure you let me know specifically what you've done, and where you're stuck.

Good luck!

</comment></comment><comment><USER3> O is an upper bound. O( n ^ 99 ) is also valid for Theta. But looks like you actually meant Theta( n^3 ) same as Theta( n^3 + n^2 ), in which case, n^3 grows faster than n^2, hence subsumes n^2</comment>


FDA approves first rapid coronavirus test with 45 minutes detection time - valiant-comma https://www.reuters.com/article/us-health-coronavirus-usa-fda-idUSKBN218105 <comment><AUTHOR> [https://news.ycombinator.com/item?id=22650843](https://news.ycombinator.com/item?id=22650843)

</comment><comment><USER2> Does anyone else find it a little worrying that the FDA is just rubber stamping these? Am I justified in my concern or is that what they had been doing pre-coronavirus but with more lede time? I understand the gravity of the situation, but it seems like little oversight could lead to worse outcomes

<comment><USER3> An established manufacturer of lab tests actually has quite a lot of incentive to produce tests that work.

I also wonder how different this approval is in terms of meaningful scrutiny from a normal approval.

</comment></comment><comment><USER4> Here's a test that works in 15 minutes:

[https://www.biospace.com/article/releases/20-20-bioresponse-...](https://www.biospace.com/article/releases/20-20-bioresponse- to-launch-rapid-coronavirus-test-kits-in-u-s-following-green-light-from-fda/)

<comment><USER5> That's an antibody detection test, not an RNA sequencing test. You need to have had the virus for long enough for your body to have started to produce antibodies against the virus. It's useful for determining whether the cough you had last week was or wasn't coronavirus, but not so good for early detection.

<comment><USER6> Which is useful in its own way. Allows you to stop worrying about getting it again (assuming it doesn't mutate).

<comment><USER4> Even if it doesn't mutate it might be possible to get it again due to a weakening of acquired immunity over time.

This possibility was discussed on episode 591 on _This Week in Virology_.[1] I wrote up a transcript of the relevant segment here: [2]

[1] - [http://www.microbe.tv/twiv/twiv-591/](http://www.microbe.tv/twiv/twiv-591/) about 15 minutes and 50 seconds in to the program

[2] - [https://news.ycombinator.com/item?id=22609136](https://news.ycombinator.com/item?id=22609136)

</comment></comment></comment></comment><comment><USER7> Just to be cynical for a moment, does anyone actually respect the fda this? Didn't they refuse to use other countries tests, build their own, approve their own, then discover their one didn't work?

Id be much happier to have an independent scientist say "this seems to work based on a few tests" then the fda say "we approve this (maybe because we have to be seen to do a something or maybe because it actually does)"

<comment><USER8> That was the CDC. The FDA doesn't develop tests - their only role here is to ban people from using tests that have been developed.</comment></comment>


Show People - <AUTHOR> https://ryanseys.com/blog/show-people/

<comment><USER2> What may seem easy and intuitive to you may not be so obvious to your potential user. Their feedback could help you build a better product as well.

Could you imagine profs using Top Hat without someone showing them first? haha cool post.

</comment><comment><USER3> I agree that demonstrating the stuff that you're doing is really important. Everyone benefits when people share the cool things they're up to.

<comment><AUTHOR> Another reader emailed me and pointed out that as developers, we tend to want to perfect what we are building before we show it off, which is totally understandable, but that urge to make it "a little bit better" needs to be fought back sometimes. MVPs are very valuable in this case as one needs to decide what is important to release and what can wait.</comment></comment>


Announcing Verve – A Type-Safe OS From Microsoft Singularity Project - <AUTHOR> http://www.infoq.com/news/2010/12/verve-msft

<comment><AUTHOR> Interesting to see that they use Typed Assembly Language (TAL) and Hoare Logic to achieve automation, static verification and type safety thro' C#[which compiles to Assembly language].

Direct Links:

* Research Paper: Safe to the Last Instruction: Automated Verification of a Type-Safe Operating System (<http://research.microsoft.com/pubs/122884/pldi117-yang.pdf>)

* CodePlex Link: [http://singularity.codeplex.com/SourceControl/changeset/chan...](http://singularity.codeplex.com/SourceControl/changeset/changes/45126)</comment>


Show HN: Structr - Next-Generation Data CMS Based on Neo4j - <AUTHOR> http://structr.org

<comment><USER2> The main website didn't have a link to the docs, but found them here - [http://docs.structr.org/](http://docs.structr.org/) via the blog link - [http://structr.org/blog/structr-10-data-cms-on- neo4j-release...](http://structr.org/blog/structr-10-data-cms-on- neo4j-released)

<comment><USER3> Only the fat Documentation link beside Download on the main screen (center) ;-)

<comment><AUTHOR> To be fair: we added the button just now.. :)

<comment><USER3> ok ;)

</comment></comment></comment></comment><comment><USER3> Are there some case studies or examples?

It look pretty cool, but I have no idea what i should do with Structr.

<comment><USER4> Ditto! I don't have the time to watch a 46 minute video.

<comment><USER5> The screencast is based on a talk I gave at NoSQL matters in Cologne this year. I know we need to add better videos, but we're just hackers. Will do our best.

</comment></comment></comment><comment><USER6> Sorry to be "the guy", but what unique thing does this do? I see that you build a page by linking nodes together. That is about all I could glean by scrubbing the 45 min talk.

<comment><AUTHOR> On the CMS side, the page rendering process is a graph traversal and thus very fast (just a couple of milliseconds), and Structr doesn't need any caching of intermediate results during page assembly, so it can render protected/private pages as fast as public ones.

And you can create mobile backends and web apps in minutes, using the schema editor to define a custom data model.

</comment></comment><comment><USER7> This is great. I was just looking at building a conceptually similar backend on Neo4j. You guys have saved me months of work and have allowed me to jump into the meat of the project.

One issue: subscribing to your newsletter takes me to a page with a message in German -- not an error, it's just telling me to click a link in my email, but presumably not the language intended given the site is in English?

EDIT: the email received is also in German.

<comment><AUTHOR> Yes, we did not yet manage to change the language. Sorry for that, we're working on it!

Thanks for the hint!

EDIT: Now the newsletter registration is in English

</comment></comment><comment><USER8> Calling this a CMS platform I think is misleading me into wondering what a graph database's use is in something used to "just show content".

It sounds like it's able to do fancy things with rendering pages quickly, but...so what?

The Github explanation says "It was designed to simplify the creation of complex graph database applications" \- a generic platform built around a graph database makes more sense.

So my question is - Is this a CMS or a platform for building applications? Is the graph database cool because it can do fancy things for rendering content, or because you can use it to build relationship models for users of applications using Structr for RAD-style dev?

<comment><USER5> True, it's hard to find the right category for it, so we call it "Data CMS". For some people, the CMS part might just be a nice add-on and the real value is the embedded graph database and the in-graph data model. Many web applications are 80% CRUD-style pages and maybe 20% (complex) queries, so using Structr for the CRUD pages and Neo4j's Cypher for the queries is a perfect fit imho.

</comment></comment><comment><USER9> Hey, I just created a terminal.com container hosting this product! Feel free to test it: [https://www.terminal.com/tiny/2H3UtUvzfi](https://www.terminal.com/tiny/2H3UtUvzfi)

I suggest to start with in a mini or small container.

</comment><comment><USER10> Seems like it's trying to do too much. Webdav/CMIS feels dated, let alone for a roadmap. Widget exchange can require a huge community to be worth the effort. However, the performance and data binding really stand out and could have huge value.

</comment><comment><USER11> Very nice. Alot of Neo4j tools are starting to popup. I'm making a real time framework like meteor too for Neo4j, available here:

[https://github.com/zubairq/coils](https://github.com/zubairq/coils)

</comment><comment><USER12> Looks great.Are CMSs popular in the Java world? I remember things like Vignette years ago,but it's a bit of a tough environment for competition.

<comment><AUTHOR> Thanks! Structr is actually much more than a CMS; it has evolved into a Rapid Application Development Platform with a visual schema editor and an integrated JSON/REST server, so it can even be used for database-as-a-service projects etc.

</comment></comment><comment><USER13> Something from a company based in Frankfurt on the Frontpage! Congratulations guys!

<comment><AUTHOR> Yeah, thank you! :)

</comment></comment><comment><USER14> Would be nice to have a demo site set up.

</comment><comment><USER15> This is not even open-source. Not interested!

<comment><USER16> [https://github.com/structr/structr](https://github.com/structr/structr)

It looks like it is open source, but I feel that the structr.org website should talk more about the open source project, and a structr.com website should focus on the business. Right now, looking at structr.org, I don't see anything about the open source project. It just looks like a sales pitch to me.

<comment><USER16> I should say, the project looks great, and I will definitely be trying it out.

<comment><USER5> Thank you! :-)</comment></comment></comment></comment>


Scan gets $7M to do QR Code Scan To Pay - <AUTHOR> http://techcrunch.com/2013/10/09/thing/

<comment><USER2> PandoDaily just released the story on how Scan secured the funding. [https://news.ycombinator.com/item?id=6523182](https://news.ycombinator.com/item?id=6523182)</comment>


Ask HN: Why aren't more companies source code leaked? - <AUTHOR> Why is the source code of Google or Facebook not leaked more often? With so many engineers it only take on laptop or one rouge developer to leak it somewhere anonymously.
I know of course there would be serious repercussions for the person doing it, but I just wonder why accident haven't happend more often? Like what is the change with 10000 engineers that not one engineer would be unlucky and have their laptop stolen.
I know that Facebook source code was leaked but that was back in 2007. <comment><USER2> 1\. Mammoth organizations like this have very robust monitoring and security measures in place. You could do it, but you'll almost definitely get caught.

2\. The tech eco system of these organizations is probably so vast and has so many layers of abstraction that one developer sharing the 1% of the code base they have access to wouldn't be very valuable to any on the outside.

3\. The exception to this would be code considered to be intellectual property. in this case I'm sure it does happen from time to time, but they aren't dumping that on the internet for all to see. A competitor is paying the FB or Google employee to take that kind of risk so they can gain advantage in the market place. These are behind the scenes deals we will likely never hear about, unless they are successful and implemented sloppy enough that the org owning the IP recognizes it in their competitors product and sues.</comment>


Amazon Prime's latest perk is a new Rewards Visa Card with 5% back - <AUTHOR> https://techcrunch.com/2017/01/11/amazon-primes-latest-perk-is-a-new-rewards-visa-card-with-5-back/?ncid=rss <comment><USER2> There's already the 'Amazon.com Store Card` which offers 5% back on purchases at Amazon.com. It can only be used for Amazon.com purchases.

There's also the 'Amazon Rewards Visa Card' which offers 2% back at gas stations, drugstores and restaurants (all other purchases are 1% back).

So unless I'm mistaken, this just looks like it combines both benefits into one card.

<comment><USER3> It also adds no foreign transaction fees which is common on Chase affinity cards with a fee but wasn't the case with the original non-Prime Amazon card. (Which is a fairly significant benefit if you travel internationally and don't already use a card with that benefit.)

<comment><USER4> No foreign transaction fees is always appreciated. I never travel without it these days.

I will add that typically this perk does NOT apply to foreign ATM cash withdrawals. Only to regular purchases made with the card. Taking out cash using a credit card is always an expensive proposition, doubly so abroad.

<comment><USER3> Right. And in many cases, it's considered doing a cash advance which turns on the interest fee machine. A few years ago, my dad got hit by this much to his surprise even though he's been a huge traveler forever.

I use my regular ATM card to get cash. There's still a (relatively high) fee but it's still probably better than the currency exchange places and, at least in Western Europe, I don't need cash that often any longer.

<comment> nommm-nommm >I use my regular ATM card to get cash. There's still a (relatively high) fee

Are you in the US? If so there's no reason to pay any fees.

Get a Fidelity Cash Management Account and/or a Charles Schwab Investor Checking Account. Both are free without any minimum balance requirements. Neither charge a currency conversion fee and both reimburse all ATM fees.

Personally, I use Fidelity. I couldn't be happier with their products (I also have an IRA and credit card with them) and service. I'm not affiliated, just a happy customer.

<comment><USER3> Thanks. I already use Fidelity. Though, to be honest, I doubt I spend $30 in ATM foreign exchange fees a year. I should look into though.

<comment> nommm-nommm They refund all ATM fees that the the ATM charges as well, which is really nice when you are stuck somewhere without cash, the place is cash only, and the only ATM is some no-name, no-brand ATM in the back that charges and arm and a leg.

I should mention that Fidelity does have a foreign transaction fee on _DEBIT_ purchases, I don't know if Schwab does or not. But I don't use my debit card for debit purchases, just at ATMs, so that doesn't apply to me.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> * on Amazon purchases

Looks like a neat deal to me, but it's a bit weird to say there's no annual fee when you need to have a Prime membership...

<comment><USER6> It's common for cards to have a roughly $99 yearly fee that gives you nothing other than the ability to have the card. It's a stretch, but I don't think it's dishonest to say the card is free* . *With an Amazon Prime membership.

<comment> nommm-nommm Not really extremely common, it's extremely easy to find good cards without annual fees. The annual fees are usually for the more "prime" cards that give you more benefits and rewards.

Even so, the point was it's misleading at best to require something that has an annual fee as a condition to get the best rewards then claim the card has no annual fee.

<comment><USER7> It's not really an annual fee, though. You're paying for a product with Amazon prime -- besides free movies, photos, shipping, etc, you can now get a special card with no annual fee _just for having it_.

</comment></comment></comment></comment><comment><USER8> Awesome update for existing Visa Amazon Chase card holders. Their Store Card already offered 5% back, so it's nice that everybody gets the new rate now.

A bit weird that we have to verify the card to get the 5% back... you'd think the fact that I've been using it for years would be enough verification.

In any case, don't forget to verify!

Go to Your Account -> Manage Payment Options

Then type in your full credit card number and click on verify and rewards will change to 5%.

<comment><USER9> I just checked mine and it was already updated to 5%

</comment></comment><comment><USER10> I'm sorry to be the one to say it, but this is an advertisement.

<comment><USER11> 5% is well outside the norm for what credit cards will give you back. So I think this is an interesting story about the economics of online payments, and how Amazon is positioning itself in the marketplace.

<comment><USER12> Not on specific categories or stores. See Discover, Chase Freedom, and the US Bank product I forgot the name of if you live in the US.

This is interesting from a market standpoint, but it is directly advertising a paid product in the process.

</comment></comment></comment><comment><USER13> Nice! I already had the Amazon Prime Rewards Signature Visa card which I used exclusively for Amazon purchases and I just logged into my Amazon account and looked at my payment methods and it's already updated to say 5% instead of the previous 3%.

</comment><comment><USER14> If only it could be used for AWS expenses!

<comment><USER15> It can't? Isn't this a regular credit card now?

<comment><USER16> You don't get 5% cash back.

</comment></comment></comment><comment><USER17> I see this is a Chase card. Can these points be transferred to ultimate rewards?

<comment><USER3> Don't think so. But it's 1:1 (well 1:100) to Amazon credit which most of the Ultimate Rewards aren't any longer. (Bizarrely, I have a card I can cash out at a higher value in cash than in Amazon credit these days.)

<comment><USER17> Yeah I just got off the phone with Chase. You cannot transfer to Ultimate Rewards.

</comment></comment></comment><comment><USER18> Was excited for a while...but US only. I need UK...

</comment><comment><USER19> 15% interest rate with perfect credit? Not even remotely interested.

<comment><USER20> How do you have perfect credit if you're not paying your balances in full?

<comment><USER21> To maintain 'perfect' (which I doubt is 100% perfect) you just have to make your payments on time. It is okay to carry a balance. In fact, I remember my credit went up higher after paying off a balance I was carrying when I typically paid in full every month...

</comment></comment></comment><comment><USER22> From reading the reviews of the card it sounds like you get charged interest if you don't pay off the full balance each month. That is, it's not the statement bill you need to pay off, but the current balance. Which seems hard to track for a lot of people like me who use their credit card several times per day.

I'd do more research before using this card.

<comment><USER23> That's how all credit cards work, and how they exist as a business. You making minimum payments is how they can pay for everything they offer.

How exactly do you think they offer miles, cashback, etc? It all comes from somewhere. That somewhere being people who pay interest by making the minimum payment.

Learn how to use your credit cards properly. It's simple: Pay off your complete balance every month.

<comment><USER24> > That somewhere being people who pay interest by making the minimum payment.

Skeptical. I have done no research, but my instinct is that banks make more on the transaction fees than the interest. That somewhere is all of us paying higher prices to account for those transaction fees.</comment></comment></comment>


Ask YC: What are some early, start-ups near SF? - <AUTHOR>

I'm a software engineer at one of our favorite massive companies, ready to jump ship for a start-up. Besides the option of starting my own company, I'd also like to consider opportunities that are already out there.
In particular, I'm interested in finding early start-ups in and around San Francisco with realistic business models; especially those looking for seed capital.
Any recommendations? <comment><USER2> Most YC alumni are in the Bay Area. There are about 60 here, in all different stages. If you send me an email (firstname.lastname@example.com) explaining what the ideal startup would be like, I may be able to introduce you to some.

</comment><comment><USER3> Come to a Bootstrapper Breakfast (<http://www.bootstrapperbreakfast.com>) and you will have a chance to meet folks with a realistic business model. I would also try the <http://www.HackersandFounders.com> meetup which a number of serious entrepreneurs attend.

EDIT: when you say "looking for seed capital" I wouldn't mix an Angel role with a co-founder role. You may choose to contribute capital and/or 'sweat equity' as a co-founder, but that's different from an Angel role.

</comment><comment><USER4> Check out <http://startuply.com></comment>