God Mode Unlocked – Hardware Backdoors in Via C3 CPUs (2018) [video] - <AUTHOR> https://www.youtube.com/watch?v=_eSAF_qT_FY <comment><USER2> This is about ancient VIA C3 CPUs processors - not your modern Intel/AMD. This isn't to say backdoors are implausible on modern processors (vulnerabilities in Intel ME/AMD PSP come to mind), but I would like to see some hard evidence before we panic and freak out. For now, "God Mode on x86 Processors" isn't something I will be losing sleep over, but I will cry about it into my beer ...

[https://en.wikipedia.org/wiki/VIA_C3](https://en.wikipedia.org/wiki/VIA_C3)

<comment><USER3> and Wikipedia has an article on this VIA "Alternate Instruction Set", too: [https://en.wikipedia.org/wiki/Alternate_Instruction_Set](https://en.wikipedia.org/wiki/Alternate_Instruction_Set)

It's still great hacking and fuzzing to find the privilege escalation instruction.

<comment><USER4> It seems the wiki article was created after the Blackhat Conference:

> 15:22, 10 August 2018 Sladen (talk | contribs) . . (2,003 bytes) +2,003 . > . (initially populate based on news reports)

[https://en.wikipedia.org/w/index.php?title=Alternate_Instruc...](https://en.wikipedia.org/w/index.php?title=Alternate_Instruction_Set&action=history)

</comment></comment></comment><comment><USER5> It is a great story to tell. But actually it is a documented feature like this datasheet from 2004 describe: [http://datasheets.chipdb.org/VIA/Samuel2/VIA%20C3%20Samuel%2...](http://datasheets.chipdb.org/VIA/Samuel2/VIA%20C3%20Samuel%202%20Datasheet%20V1.12.pdf)

ALTINST is well known among C3 processors.

</comment><comment><USER6> Previous discussions:

[https://news.ycombinator.com/item?id=17727140](https://news.ycombinator.com/item?id=17727140)

[https://news.ycombinator.com/item?id=17735830](https://news.ycombinator.com/item?id=17735830)

</comment><comment><USER7> This chip is 18 years ago. It was not uncommon to ship with debug feature on back in those days when microcode is innovative

</comment><comment><USER8> Url changed from [https://hackaday.com/2019/02/03/unlocking-god-mode- on-x86-pr...](https://hackaday.com/2019/02/03/unlocking-god-mode- on-x86-processors/), which points to this.

</comment><comment><USER9> Article is new, but the linked YouTube video dates back to Aug 28, 2018.

</comment><comment><USER10> I see someone found this. kudos op. The most important takeaway from this is the practice of instruction set walking. The method has wide utility. All digital devices on the mobo can be probed with similar methods, this includes but is not limited to memory controllers bus controllers harddrive controllers, basically any embedded or integrated device. This is all about showing you how to get your foot in the door for a wild ride into low level hardware reversing. my favorite sport.

</comment><comment><USER11> Is the minix - intel has similar hack?

</comment><comment><USER12> I guess,it's maybe because VIA's CPU is translate x86 instruction to RISC.So there is not hide RISC core,the core is RISC core,it can be configure to x86 mode,and this guy find the hidden op code to switch the two.

</comment><comment><USER13> What motivates a person to give a talk like this at Blackhat? A method to compromise cpus by feeding them secret instructions seems like trouble the world doesn't need. Sure, he's only focused on an outdated system, but he's shown how to do it, and even gives away the tool. Is it like making smallpox virus available, so it can be studied? But how can hardware designers make any system safe from such tenacious probing? Imagine how different the world would be if there was no threat of exploitation.

<comment><USER14>
        > Is it like making smallpox virus available, so it can be studied?

You do realize that small pox was eradicated by introducing a malign version of small pox as a vaccine? Kinda like 'black hat medicine'.

<comment><USER15> Did you mean chickenpox?

<comment><USER14> [https://en.wikipedia.org/wiki/Smallpox_vaccine](https://en.wikipedia.org/wiki/Smallpox_vaccine)</comment></comment></comment></comment>


Does Facebook Have a Secret Paper Fetish? - <AUTHOR> http://www.collectorsweekly.com/articles/facebook-secret-paper-fetish/ <comment><USER2> Now I've heard of companies like Google having on-campus hackerspaces, but an on-campus print shop is pretty damn badass. Credit to Facebook for extending the hacker mindset to ink and paper.

<comment><USER3> Almost all large businesses and many medium ones have their own print shop. Most people just don't know about them because they're hidden in the back and aren't really integrated into the normal activities of the rest of the staff.

Marketing materials are far from paperless even in the internet age.

</comment></comment><comment><USER4> If you're not familiar with Ben Barry's work, you should definitely check out his portfolio. Really excellent stuff. <http://designforfun.com>

Another great example of print design making its way into the digital space is Metro, Microsoft's UI for Windows Phone 7 (and probably Windows 8, Xbox+, etc.) It's fundamentally based on typography and space, which are core to timeless and pervasive print design. <http://en.wikipedia.org/wiki/Metro_%28design_language%29>

There are lots of lessons about visual language that have been figured out in the hundreds of years since print was invented. Pixels are relatively new, but form, weight, space, typography, readability, color, contrast, and aesthetics tend to transfer over quite well. (Until you add interaction, which is certainly a new discipline of design.)

Also, even if you're an engineering-driven company, having good design on the walls helps people develop an intuition for your company's culture and brand. More than anything else, these projects at FB seem to be about internal communication, which is essentially marketing your mission and goals to your team. As an organisation grows rapidly, this is one of the most effective (and subtle) ways to keep your goals aligned.

</comment><comment><USER5> The subtext of this headline seems to be "Why does Facebook have a secret paper fetish?" rather than "How awesome is it that Facebook has a secret paper fetish?"

Personally, I'd be far more motivated by a fantastic screen-printed poster than an 'internal memo'.

</comment><comment><USER6> Great, now we can never have a poster that says Hack on it because Ben Barry has one and will complain on Twitter if you do.

</comment><comment><USER7> Ben Barry actually released a number of these posters under Creative Commons: <http://www.designforfun.com/facebookposters/>

</comment><comment><USER8> FB has been doing cool type/print related projects for awhile. They've been showing up on For Print Only for a couple of years. Very cool stuff:

[http://www.underconsideration.com/fpo/archives/2009/12/faceb...](http://www.underconsideration.com/fpo/archives/2009/12/facebook- holiday-gift.php) [http://www.underconsideration.com/fpo/archives/2011/05/presi...](http://www.underconsideration.com/fpo/archives/2011/05/president- barack-obama-at-facebook-tickets.php)

</comment><comment><USER9> The "Analog Research Lab" reminded me of the Graffiti Research Lab. They pointed out that a lot of graffiti artists act like technophobes, and they wanted to bring the art and "urban communication" into the electronic age. <https://en.wikipedia.org/wiki/Graffiti_Research_Lab> video: [http://www.graffitiresearchlab.com/blog/projects/laser- tag/#...](http://www.graffitiresearchlab.com/blog/projects/laser-tag/#video)

Who knows, maybe they'll meet somewhere in the middle :)

</comment><comment><USER10> What was the name of that website where every other word was linked to another page on the same website? Reading this article felt a bit like that.

<comment><USER11> everything2.com ?

<comment><USER10> That's it! I thought it was [something]2.com.

</comment></comment></comment><comment><USER12> This isn't really a big deal - even in PR terms it's not something that will cause any issues - but it interested me none-the-less:

> _"We're barraged with e-mail all the time," he adds about life at Facebook, > "but when you go to the café for lunch and you see one of the posters while > you're waiting in line, I think it has a more of an impact."_

That's basically the opposite of the message Facebook would like to send to advertisers, the idea that digital (i.e. through Facebook) is the best way to get ROI on advertising.

I like the fact that he didn't have to hold back from stating the obvious fact that, just because adverts are a key part of their revenue, traditional advertising is still relevant today.

</comment><comment><USER13> This is one of the coolest things I've read about Facebook.

</comment><comment><USER14> This is some seriously SEO-enlightened content

</comment><comment><USER15> If we wanted to buy posters like these (minus the whole Ben Barry fiasco), what would be the best place to buy them?

<comment><USER16> They're available under a CC license here -> <http://www.designforfun.com/facebookposters/>

I'm assuming you can't buy them anywhere else, since the license is non- commercial.

</comment></comment><comment><USER17> Facebooks' analog lab has been around for quite a while. I think it's probably one of the best parts of Facebook, culturally, as a whole. It's a commitment to communication methods, whatever they may be.

</comment><comment><USER18> Are you fucking kidding me? The words "desk" and "photo" are linked to store results from this site? No thanks, this is 2012, that's not how we monetize content anymore.</comment>


Trump Picks Staunch Opponents of Net Neutrality to Oversee FCC - <AUTHOR> http://fortune.com/2016/11/21/trump-net-neutrality-fcc/ <comment><USER2> I'm not very sympathetic to some who are hyperventilating over this.

Yes, Net Neutrality is important.

But if you're on Team Pepsi, you shouldn't be very happy when your captain makes things happen due to technicalities and the ability to skirt Congress; Team Coke is going to be in charge _at some point_ and all of these easily- implemented changes are so easily undone.

So now Team Coke is going to be running things, and the very means by which Team Pepsi got what they wanted will quite possibly be the same means by which they are removed.

The hand-wringing is over the wrong thing, and years too late. The focus should have been in placing proper legislative protections in place when the political environment was favorable.

This possibility was predictable and, given enough time, inevitable.

<comment><USER3> your cynicism and the oh so impressive "I've seen it all attitude" adds nothing constructive to the conversation. You try to belittle valid concern over corporate lobbyists taking over the agencies that are supposed to keep them in check. If I were a corporation trying to control the message on social media I would use pretty much the same language.

Resistance to the slowly creeping dismantling of consumer rights and freedoms will require frequent hyperventilation and the ability to be outraged. Having grown up in a totalitarian state, it all felt banal and common place. I'm not saying this one piece of news indicates that's the future in the US, but we will get there with hundreds of compromises like it.

<comment><USER4> The solution has been, is and will be to free the market for smaller ISPs to compete without being regulated to death; and this will not change until economies are no longer a thing due to human extinction and/or reaching the singularity; certainly it will not be because AT&T, Comcast et al grew a conscience.

During 8 years of Obama the only thing in the table was _more regulation_. Now your only hope is for a Trump administration that pushes for more competition; which given his policy on healthcare I'd say that's a battle worth fighting for.

<comment><USER5> "If all men were angels, no government (regulation) would be necessary."

<comment><USER4> I'm certainly not blind to the necessity of government and the need for some regulation to exist. The problem is that when regulation gets handed out like candy instead of being heavily looked at and discarded if its purpose is not clear or doesn't align with the interests of the population at large; then you have left the door open for oligarchy to come in and shit all over.

</comment></comment></comment></comment></comment><comment><USER6> Net-neutrality is already being skirted by zero-rating. Why do you think AT&T wanted to buy Time Warner? We should instead focus on ISP monopolies and trust in the free market to quell ISP throttling abuse.

</comment><comment><USER7> I'm thinking of the day that I create a video to demonstrate the effects of this (eg. only getting faster access to YouTube because I paid some special fee to my ISP). Thanks Trump!!! I recall seeing some doomsday video about this. Will have to compare that to what transpires.</comment>


Prisma app competitor beta-testing on GooglePlay - fast-bird http://alter.photo <comment> fast-bird It allows to upload your personal style</comment>


Clojure at Netflix (2013) [slides] - <AUTHOR> https://speakerdeck.com/daveray/clojure-at-netflix <comment><USER2> Would be interested to hear their experiences with Clojure at Netflix for the 5 years that have followed since then.

Did they keep writing more Clojure? If so, how much of their code is now in Clojure compared to Java? How much more did they rewrite from Java to Clojure? Do they use Clojure rather than Java for new code?

What other languages do they use? Python? Erlang? Rust? How much, in terms of functionality, is written in each language they use? How many lines of code do they have in each language? To what extent did they find existing libraries for the different languages usable for what they are doing?

Among the things that seemed great with Clojure in 2013, did they find that some of these were not so great after all once the codebase grew? Any other problems?

<comment><USER3> I am very glad you asked!

I wrote and deployed (to production) some Clojure code at Netflix just yesterday. Among other things at Netflix the Mantis Query Language (MQL an SQL for streaming data) which ferries around approximately 2 trillion events every day for operational analysis (SPS alerting, quality of experience metrics, debugging production, etc) is written entirely in Clojure.

This runs in nearly every critical service, ~3000 ASGs and easily > 100k servers and Clojure allows us to also compile it for our NodeJS services as well.

<comment><USER4> Thats an interesting point that doesn't answer any of the questions the parent asked. :)

Perhaps you can answer this simpler one:

Netflix has been using clojure for a long time now; has that been a positive experience broadly speaking, that means clojure is still being used for new projects, or not?

Having a large successful project in clojure is lovely, but much of the community's concern around it is that its hard to maintain, and falling in popularity, broadly speaking.

It would be very nice indeed to see _those_ points addressed by a large scale user of clojure.

<comment><USER3> Hey, sorry I saw that and typed a quick response just as I woke up. I'm not usually at a computer so early in the day. I'll address these now that I'm in front of a machine. :)

> Did they keep writing more Clojure?

Yes but it has never been the primary language at Netflix.

> How much more did they rewrite from Java to Clojure?

Very little, if any was rewritten from Java.

> If so, how much of their code is now in Clojure compared to Java?

A very small amount given that it isn't the primary language and Clojure code bases tend to be much smaller than Java.

> Do they use Clojure rather than Java for new code?

This is a personal choice each engineer makes when they write new code. Those who like Clojure might reach for it more often. Clojure is also easy to use within the environment at Netflix since everything was JVM based.

> What other languages do they use? Python? Erlang? Rust?

NodeJS and Javascript, Python, Ruby all have a seat at the table but the majority of back-end code at Netflix is on the JVM, the majority of that is Java.

> Among the things that seemed great with Clojure in 2013, did they find that > some of these were not so great after all once the codebase grew? Any other > problems?

I've always found larger Clojure code bases to be a bit unwieldy. Fortunately you can usually continue to abstract and keep the size small. If you choose your abstractions carefully you can get a lot of mileage out of this.

I've found the lack of static typing to be a bit of a pain at times especially when refactoring. My safety net for this in the project mentioned in the GP post is to have comprehensive unit tests. If I were to initiate this project today I'd likely explore using Spec to make type assertions.

<comment><USER5> >Clojure code bases tend to be much smaller than Java.

What are the reasons for this? FP language vs. OOP? Less boilerplate (again maybe due to FP)? Higher-level abstractions in the language or libraries?

I have seen that F# code (another FP language, although I've read F# is more from the ML family via OCaml, vs. Clojure being from the Lisp family) can be significantly shorter than equivalent C# code, for example, as shown in some comparisons on the fsharpforfunandprofit.com site.

Interested to know.

<comment><USER6> I worked at a shop that used Clojure and Java.

One big difference is that Java APIs tend to require the collaboration of various class instances to get something done, things that you would implement as a single function + options object on your own.

Bouncy Castle is a good example. You may need a Hasher, HasherStrategy, ASNEncoder, DERParameters, and ASNSerializerStrategy instances to execute what you would've implement as `(asn-encode thing)` otherwise, maybe even having to subclass some of them to change some behavior you'd expect an option flag for.

Clojure's own Java-helper macros will compact your 1:1 Java interop code as well, so you have fewer lines even when writing Java from Clojure. Also, short-cuts like ad-hoc reification in Clojure will spare you LoC where you might otherwise have created a whole file for a class with custom interface implementation in Java.

Of course, line-to-line code is also just more compact in Clojure, but ecosystem/api difference is one I don't see mentioned as often.

I don't think this is just good vs bad, though. There are certainly upsides to the more rigid everything-in-its-right-place code you tend to have in Java which has been making big strides in improving itself over the past decade.

<comment><USER5> Interesting, thanks.

I agree with your last point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Latacora has its token Clojure person: me. I write Clojure every occasion I get, we've shipped Clojure code to customers, et cetera et cetera.

Most of the stuff I'm doing in Clojure would be possible in other languages, but in a sense that's only one notch below "Turing tarpit" possible. So, in the only sense that a startup should care (would you f'ing ship it?): only possible in Clojure or a handful of close cousins.

I'm hearing less about it on HN these days? But it was a great language yesterday, remains one today, and there's constant development of tooling and community :)

<comment><USER8> I think some of that is due to the nature of the people it attracts, namely, grumpy, older, I've been burned before, programmers. I use Clojure constantly and have for 10 years, but I've never felt a strong need to proselytize. I just make money and enjoy coding, day in and day out.

</comment></comment><comment><USER9> I'd like to learn a modern production-ready functional language (I have some academic experience with SML), since they seem like a good way to grow as a programmer. Main contenders so far are Haskell, Scala and Clojure (Reason might go on the list soon too) - but the fact that Clojure is dynamically typed is a bit of a turn off for me. My experience with dynamic vs static typing is that as a system grows in size and complexity, the value of static typing goes up. Doing a major refactor is one of those things that I find especially error-prone in dynamic languages, while statically typed languages make this much less daunting (of course they come with the opposite issue that you might not be able to compile for a day until you've fixed all the type errors - but I'd take this trade-off any day of the week). Can anyone with experience comment whether Clojure suffers from this too or if it somehow handles the lack of static typing better than other dynamic languages?

<comment><USER10> There are a lot of people who claim they're more productive in Clojure, in spite of or because of its dynamic typing.

I'll just throw my anecdatum out here: I found that dynamic typing was a major pain even on my own personal projects. I also never found REPL-driven development to mesh well with my workflow.

In Scala, for example, entire classes of error that I just shouldn't be able to make don't exist. Maybe I'm just the kind of person who works better with static typing.

Clojure overall is an excellent language with really good features. It just won't get out of my way sometimes.

<comment><USER11> Try to grok REPL-driven development before dynamic typing. You won't like the latter until you love the former.

<comment><USER12> Haskell does REPL-driven development fairly well. It's not the _best_ REPL, but it works, especially if you take a moment to learn a few of the commands to drive it. Dynamic types are not necessary for REPL-driven development.

<comment><USER11> Yes, that's why becoming happy with REPL-driven development is more important than becoming happy with dynamic typing. I think much of the productivity boost attributed to dynamic typing is in fact caused by heavy use of a REPL, and not dynamic typing.

<comment><USER10> I'd maybe consider that perhaps becoming happy with REPL-driven development isn't a universal solution. It's not like I didn't understand the concepts, the tools, or the process. I just didn't find that it made me any more proficient at building software.

<comment><USER11> Of course that's possible, but the evidence suggests that most people become more productive when using the REPL to experiment while developing large projects.

One issue with trying to adopt the habit midway through a project is having a design that makes it easy to load small portions of the project with test data into the REPL. It's not quite the same as having code that's easy to test.

Do you use an interactive debugger? It's the same principle, but earlier in the lifecycle of development.

<comment><USER10> I appreciate your earnest approach, but I also feel somewhat patronized. I've been doing this for a while. I used Clojure extensively for years, was productive and found much to like. The REPL wasn't part of it, and I don't miss it. I still use Clojure on occasion.

This response is pretty common: "You probably weren't doing it right. Trust me, this is the way!" While I agree that suspending beliefs/old practices and trying new things is important when using new technology, I'm also pretty confident that I gave Clojure a more than fair shake, and just find that I don't get much out of the technology surrounding the REPL in that environment.

I was more productive in Scala in days than I was after years of using Clojure, and the difference between what I'm saying and your response is that I'm not claiming my experience is universal.

<comment><USER11> No condescension meant. It's hard to estimate how experienced someone is from a few sentences in the forum. I'm generally careful to make assertions about _most_ and _in general_ rather than _all_ or _universally_.

<comment><USER10> None taken personally - I just find it valuable when I read comments against the grain, and had an experience that I know many Clojurists find atypical and wanted to share that my style of work just doesn't lend itself to Clojure as supported today.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> What happened to Clojure? Was it just a fad, or are people still using it in their day jobs? Are people still hiring Clojure devs? If you write Clojure at work, are you happy with it?

<comment><USER14> While other posters comment that "Clojure still works", IIRC the "promise" was that Clojure/Lisp would be _much, much more productive_ , and _that claim_ I feel like must been disproved in daily work, otherwise Clojure would still a main topic around here.

Reminds me of the classic Erann Gatt post: [https://news.ycombinator.com/item?id=2308370](https://news.ycombinator.com/item?id=2308370)

(I loved to play with Elisp, Clojure, Lua, Factor, Ion, Ioke and hope dynamic languages become fashionable again someday...)

<comment><USER15> I think _individual developers_ are most likely to become _much, much more productive_ when using Clojure/Lisp vs. Java, C#, and the like, but _software development teams_ are unlikely to experience the same benefits.

And it's not even because Clojure is bad for teams, it's because teams often form because there are nontechnical stakeholders, and suddenly an individual contributor's code-writing productivity is a much smaller factor when compared to the communication practices and other parts of the development process outside of writing code.

</comment></comment></comment><comment><USER16> This is a bit tangential to the post, but I've seen a couple comments in this thread that amount to "Clojure is hard to read", but I think that's a really unfair comparison, because people are unwittingly comparing apples and oranges. It seems to me the reason people think Clojure is hard to read is that the language is so powerful and expressive, that when you're reading Clojure code, you're typically trying to understand the actual problem that's being solved, as opposed to just reading a bunch of code that's necessitated by the lack of power afforded by the language. For example, I can easily "read" a bunch of nested for loops in Java, but then I still have to try and understand what the actual problem is that's being solved. People seem to confuse those two things when comparing Clojure with other languages.

<comment><USER17> I worked in a large company where clojure was used. After the original developers moved on from that project (they always move on), it was a giant struggle to get people who could work in the code base. They ended up rewriting it in something more standard. Whatever benifit clojure provided was outweighed by the high cost of maintaining the code base and the inability to find devs who wanted to work on it.

That's my only data point with clojure.

<comment><USER18> It saddens me to hear such stories as they show up from time to time. I can't help but feel that a lot of programmers just decide to stop learning at some arbitrary point in their career (my observations suggest that point is around the end of their university term or their first job). The industry too seems biased heavily in favor of using lowest-common-denominator, dumbest possible solutions they can get. And not "dumbest" in the sense of "simple therefore robust" \- but in the sense of "barely suitable for the job at hand". It's like wanting to dig a pool, and hiring a lot of people with spades, even though you can get excavators for free - but what, you couldn't be bothered to find a few drivers? And the spade crew comes and is all, "no way we're going to learn to operate an excavator, that's too much, let's dig by hand".

I can't explain it any other way. Learning Clojure, or another Lisp, to the point of being comfortable around a codebase, is a matter of weeks for an experienced programmer. It's comparable to the time you need to even figure out how to rewrite an existing mid-sized codebase, and since you have to read it to understand it, why not learn the language along the way? Then suddenly the rewrite isn't needed. But it feels like a concept of learning a new language on the job isn't even considered by people.

<comment><USER19> > I can't help but feel that a lot of programmers just decide to stop learning > at some arbitrary point in their career (my observations suggest that point > is around the end of their university term or their first job).

Indeed.

I had the frustrating, but ultimately fortuitous, situation of having my first job be one where I was asked to build a solution with woefully under-powered tools. I'm not even talking about the difference between hand tools and power tools - I was essentially asked to use kid toys.

That situation made me very angry, and I was constantly working overtime to make up for the lack of productivity of my tools - even then we were going to miss our deadline.

Finally, I managed to convince management to let me and my team use real tools - nothing super advanced, but well suited for the job. Very quickly we turned around the release, I started working normal hours, and when I left that job shortly after the release my employer found that they didn't need to hire a replacement because the workload was so much less.

This experience taught me that the power of your tools _does_ matter, and that the initial pain of technology transition can easily be outweighed by the benefits of using something better.

For me, the quality I look for in my tools is: does it reward mastery? I'm not (primarily) looking the initial growth curve and how long it takes before I get to my current productivity. Rather, I'm looking at where the ceiling is.

</comment></comment></comment></comment><comment><AUTHOR> via tonsky: [https://twitter.com/nikitonsky/status/1057317735766593536](https://twitter.com/nikitonsky/status/1057317735766593536)

      - Migrate as you go
      - 1/10th the code that does 10× as much
      - Life with existing Java codebase is better with Clojure macros
      - Eliminate boilerplate with custom DSLs
      - REPL to live servers

</comment><comment><USER20> We have used Clojure in our data processing and API code for five years now at Studio71, and it's been a huge success for us. We have much smaller dev teams than our competitors so Clojure has helped us keep pace with a smaller code base and fast data processing, but it has been a challenge to hire new developers when we need one, but with patience it has always worked out.

</comment><comment><USER21> This talk goes into detail how Clojure plays out in larger teams, particularly how they worked to maintain REPLability for a huge monolith: [https://www.youtube.com/watch?v=BThkk5zv0DE](https://www.youtube.com/watch?v=BThkk5zv0DE)

That said, I think a lot of the preoccupation with rewrites is just premature optimization. Just a while ago I noticed some open source Clojure code of a startup acquired by FB got rewritten in Haskell. Was very glad to see founders don't seem to be working on this new code-base. Probably moved on to do higher value things.

<comment><USER22> FWIW I think this is the startup code referenced: [https://github.com/wit- ai/duckling_old](https://github.com/wit-ai/duckling_old)

<comment><USER21> Yep, that's the one

</comment></comment></comment><comment><USER23> I love Lisp, so I thought Clojure would be a great productivity booster. And it is, if you are a one-man or one-woman shop. But try to build a team around a Clojure project and it's another story. The language basically begs you to make "magic" happen with domain-specific constructs. That might make you feel powerful as a programmer, but it's also a nightmare for new team members to get up to speed on.

And then, as others have mentioned, it's hard to find Lisp programmers. Most programmers are turned off by the syntax and/or immutability. I happened to take a Lisp class as an undergrad, but I would otherwise probably be in the same boat.

<comment><USER24> "Most programmers are turned off by the syntax and/or immutability."

Programmers who don't see the value of immutability or can't understand it are not programmers you really want to work with.

<comment><USER25> > Programmers who don't see the value of immutability or can't understand it > are not programmers you really want to work with.

I'm not disagreeing with you, but since you just described easily 90%+ of all working programmers, it's kind of unavoidable.

One place I worked, one of the lead engineers knew I was into functional programming and asked me if I thought it would be a good idea to introduce Scala or Clojure into our pure Java code base. I said "No. The majority of the programmers here couldn't make the adjustment."

Put another way, if I could assemble a hand-picked team of all of the engineers I would rate as "great" who I've worked with over my 12+ year career thus far -- I'd have a team of about 7 people.

</comment></comment></comment><comment><USER26> Is Clojure still a thing? It seems to have fallen off my radar. Java seems resurgent after 8, even Scala seems to have lost momentum.

<comment><USER27> to talk about something new, you need to have something new to talk about

i dont think that scala or clojure have lost momentum i think both clojure and scala, stopped adding new features that are worthy of blogging about

you cant just add feature, just to keep people talking about you

clojure, is what it is, a nice language, a very smart leader (rick hickey), and a nice vibrant community (check #clojure on twitter)

the most talked about language nowadays is actually c++, and i think this mainly because they suddenly decided to have a very ambitious roadmap, and keep adding features, so there is always something new to talk about

does this make c++ better than clojure, well, i dont think they are even comparable, but it just make c++ more talked about than clojure

<comment><USER28> >>i dont think that scala or clojure have lost momentum i think both clojure and scala, stopped adding new features that are worthy of blogging about

More like Clojure is in Cathedral mode of open source development. Most of the development is in private discussions, implementation and prototyping at Cognitect, and once they have something to share, they release it to the world.

That's more a communication and marketing thing. For example, you can try Googling but you won't be able to see anything on the Clojure roadmap. No one knows what's the plan even year or two from now.

But thanks to smart leadership, and brilliant development team they have, its mostly a non issue if you don't really care about the everyday minutiae. You can bet the top dollar that they are working on something good, and it will be eventually released to the world.

To people coming from other open source tools, that can sound as strange.

<comment><USER29> [https://clojureverse.org/t/roadmap- to-1-10/1581/8?u=alexmill...](https://clojureverse.org/t/roadmap- to-1-10/1581/8?u=alexmiller) is a pretty good overview of where Clojure has been going and will continue to go.

</comment></comment></comment></comment><comment><USER30> As the leader in online affiliate marketing, we've just launched our analytics and insights platform that is written in Clojure [0]. If you like Clojure, come work with us [1].

[0] [http://junction.cj.com/article/introducing-insights-cj- affil...](http://junction.cj.com/article/introducing-insights-cj-affiliate)

[1] [https://engineering.cj.com](https://engineering.cj.com)

</comment><comment><USER31> amazed to see there are people who find

myObject.myMethod(x, y, z);

easier to read than

(my-function x y z)

\- that's 2 delimiters in Clojure vs 6 in your C-style language

<comment><USER32> In fairness, it'd actually be:

        (my-method my-object x y z)

But yes, the Lisp version is so much clearer to me. I just don't get why it's not more popular.

<comment> trevor-e How does this work with autocomplete if you need to know the method name before the object you're working with? Maybe I'm not getting something but that sounds incredibly painful to use in practice.

<comment><USER32> In Common Lisp, it works because symbols are scoped by package, not by object. So if you're in the package foo and start typing 'bar,' then your editor would autocomplete symbols in the foo package starting with 'bar'; likewise if you typed 'baz:quux' your editor autocomplete would autocomplete symbols in the baz package starting with 'quux.'

Common Lisp most definitely doesn't have one namespace; this is really nice in practice.

<comment> trevor-e OK so my confusion was from thinking Clojure is statically typed, which apparently is not true. I was basically asking the same question as [https://www.reddit.com/r/Clojure/comments/6f6cq2/how_to_comp...](https://www.reddit.com/r/Clojure/comments/6f6cq2/how_to_compensate_for_clojures_lack_of_dot/)

</comment></comment></comment></comment></comment><comment><USER33> Interesting stuff. I'd be curious to know how Netflix are getting on with it now.

</comment><comment><USER34> I love Clojure! It's honestly the best language ever.

</comment><comment><USER22> I always see loads of Static vs Dynamic and Functional vs OO opinions breaking out in the comments. While the discussion is often interesting and insightful, it would be nice to see some empirical analysis of the trade-offs here. Stuff like development time, error rates, maintainability (no idea how you'd measure this one...).

Anyone know if such studies exist? Feels like they should be out there given the amount of discussion the topics generate

<comment><USER35> There is some research available on the topic. There's a good summary of it here [https://danluu.com/empirical-pl/](https://danluu.com/empirical-pl/)

<comment><USER22> Lovely, thank you!

</comment></comment></comment><comment><USER24> I would like to know the words spoken for this slide:

[https://speakerdeck.com/daveray/clojure-at- netflix?slide=29](https://speakerdeck.com/daveray/clojure-at-netflix?slide=29)

</comment><comment><USER27> is clojure still used at netflix [2018]?

</comment><comment><USER36> One strategy which i learnt from a tech company executive is that if you want to hire best of best at low cost, develop products in interesting new programming languages as the most curious programmers who are very serious about programming care less about money and more about work in a particular language of their interest.

No wonder the company had successful projects in every asoteric languages.

Now, I come from executive background in corporate job where going with anything other than Java is considered risky. This came off as suprise to me.

<comment><USER37> _...if you want to hire best of best at low cost, develop products in interesting new programming languages as the most curious programmers who are very serious about programming care less about money and more about work in a particular language of their interest._

The problem is that the particular language of their interest probably changes every 6 months.

<comment><USER38> >The problem is that the particular language of their interest probably changes every 6 months.

As a language nerd, one of the nice things about Lisp is that the language is easily extended into other paradigms. I've stuck with Clojure for a long time because of this. It had Go style CSP-concurrency as the core.async library within a few years of release. I can use types by just loading core.typed, or I can play around with logic programming with core.logic. Whenever I find a cool feature in another language, I usually find out that it's already available in Clojure as a library.</comment></comment></comment>


What are your most used design patterns? - <AUTHOR>

I'm reviewing all sorts of design patterns, just to refresh my memory. What are some of the most used design patterns in the Hacker News community? Just curious. Thanks! <comment> jarek-foksa Publisher/subscriber and composite patterns had the greatest impact on the quality of my code, apps that are composited from small decoupled parts are much easier to reason about.

I'm also using delegate and prototype patterns a lot, though those are rather dangerous when misused. Deep inheritance chains or excessive method overrides can easly make the code unmaintainable.

<comment><AUTHOR> is this different from the observer pattern? which languages do you program in?

<comment> jarek-foksa I'm not aware of the observer pattern. I'm using CoffeeScript and my implementation of pub/sub is here <https://gist.github.com/4489352>

Sample usage:

        button =
          toggleOn: ->
            @trigger 'toggled', 'on'

        window =
          init: ->
            button.listen 'toggled', (buttonState) =>
              @showWindow if buttonState is 'on'

</comment></comment></comment><comment><USER2> I get a lot of mileage out of the delegate pattern. We used visitor exactly once in our codebase, but it's pretty fantastic for that one place it's needed. We use observer extensively. More than other patterns that one strikes me as something the language should do for me.

<comment><AUTHOR> what kind of code is this? C#? Java? im looking into the delegate pattern and it seems to be something C# and Java devs like to "talk" about

<comment><USER2> I'm doing Java at work, but I use delegation a lot in all OO languages. For instance, today I wrote some code in a managed bean that handles access control. My requirements have stipulated that users fall into three categories and they have different sets of rights. So I made an enum for the three categories which provides methods for each of the rights, and my access control bean delegates to the enum. This way when management decides to relax the restrictions around these users I can delete the enum for these categories and change the delegate methods to just return true or false and none of the callers will be the wiser. I'm protecting the user's-category information from leaking into the rest of the system while allowing the ramifications of the choice in through the appropriate gateway.

</comment></comment></comment><comment><USER3> I suspect that the most used pattern in the HN community is the ActiveRecord pattern although many who use it probably are not aware that they are doing so.

</comment><comment><USER4> Service Layer, Repository, Unit of Work. Those are the first I can think of (and use very often).

</comment><comment><USER5> In JavaScript I'd say I use the module pattern and prototype pattern the most.

</comment><comment><USER6> Composed Method.</comment>


Ask HN: Did AI invent blockchain? - <AUTHOR> or can you like tottally rule it out? <comment><USER2> You can, like, totally rule it out.

<comment><AUTHOR> really? how? I'd be curious what theories you have</comment></comment>


Ten Things That Occurred to Me When the Twitter Turned Off - <AUTHOR> https://medium.com/@davepell/ten-things-that-occurred-to-me-when-someones-turned-the-twitter-off-abea82666b4e <comment><USER2> it sounds very interesting to me!</comment>


Conceive, Choose, Create, Communicate: Advice for successful projects from a hacker - <AUTHOR> http://www.media.mit.edu/events/movies/video.php?id=lee-2008-09-23

<comment><USER2> The title sounds interesting, but it's a video, which is sort of a non-starter for me unless it's something like a personal message from Donald Knuth to me. It says I don't even have the plugin in any case.

Is there a transcript?</comment>


Show HN: Predictive Models for Student - <AUTHOR> Last few weeks I am very much interested in building an interesting tool #PredictEasy which can simplify the way we see predictive models. Students can start using it for projects.
Please check it out and let me know your feedback, you're always awesome - http://predictEasy.com <comment><USER2> There is nothing to play with or try out, just the opportunity to provide an email on the plans and pricing page. I think getting a buggy half-baked implementation online would be more productive than assembling a pricing page and harvesting emails because a buggy half-baked implementation _might_ create actual users and a providing an email does not make a person a user.

Unfortunately, there's nothing else to give feedback about.

Good luck.

<comment><AUTHOR> Yes! For sure. Going to put the MVP online in a couple of days.</comment></comment>


The State of Network MIDI - <AUTHOR> https://mclarenlabs.com/blog/2019/09/14/the-state-of-network-midi-2019/ <comment><USER2> I'm curious, what is used, hardware-wise, for Network MIDI? Does network MIDI use a separate physical layer, separate from other network traffic? Or is layer-2 or -3 QoS used?

At work, our largest cluster uses Ethernet for front-end traffic, but uses Infiniband for back-end storage traffic (Lustre).

I wonder if studios etc. have looked at Infiniband for Network MIDI traffic. The low latency of Infiniband might be helpful! And (as I understand it) since MIDI is fairly low-bandwidth, older Infiniband technologies (like DDR) could be used, to save money.

<comment><AUTHOR> For RTP MIDI, UDP is used. So anything that can transport UDP.

Simple Ethernet is more than good enough... but of course the lower the latency, the better.

<comment> mclaren-tom That's right. But many studios will have a separate Ethernet network for MIDI traffic different from the internet and file transfer traffic in the studio.

</comment></comment></comment><comment> mclaren-tom article author here, ask me anything :-)</comment>


Color Cancer Test Benefit for All Employees at YC, Slack, Stripe, Instacart - <AUTHOR> https://getcolor.com/benefits <comment><USER2> This is awesome. Kudos to both Color and their partner companies for being proactive and offering these benefits. I do think that this is the path for wide-scale adoption of these types of services for consumers, curious to see which other companies follow suit.

</comment><comment><USER3> This looks great! Is this program open to any company or just those listed?

<comment><AUTHOR> Any company can sign up for this by contacting Color here: [https://getcolor.com/benefits/employers](https://getcolor.com/benefits/employers)

</comment></comment><comment><USER4> My personal experience with Color has been great! Great values and great people. Hope to see more initiatives like these in the future!

</comment><comment><USER5> Really cool to see companies rallying with Color to support women's health :)!

</comment><comment><USER6> What a great way to show employees that you care about their health and wellbeing!

</comment><comment><USER7> love this program. genetic screening is definitely under-utilized and is useful for prevention even for relatively younger employees at startups. will sign my wife up.</comment>


Python3 Asyncio for middling developers - <AUTHOR> https://whatisjasongoldstein.com/writing/im-too-stupid-for-asyncio/ <comment><USER2> > That seems wrong. I should be able to run normal Python code as async, > right?

No, that is not the case. To better understand this you should look at an async library, like [https://github.com/aio- libs/aiohttp](https://github.com/aio-libs/aiohttp) Look at what it actually calls all the way down under the hood.

If it were as simple as adding `asyncio.sleep(0)`, then that library seems as though it would have been much easier to write. :P

Just look at the code you posted at the end, it actually runs faster synchronously, without `asyncio.sleep(0)`. The sleep is what happens async, not the print statements, therefore, all you're doing is introducing delay.

Similarly, the Django ORM DB calls you make in the other examples are all still happening synchronously. However, you're just adding a delay that causes them to get picked off in an inconsistent order.

<comment><USER3> So what you're saying is it needs an 'async' version of the Django ORM for the example to work

In other words what is really needed is an ORM that would allow you to write:

      source = await Source.objects.get(id=source_id)
      await source.update()

(?)

<comment><USER4> Yes, in a cooperative async model anything which would block will stop progress of every coroutine, so you would need an async version of the ORM library for this to work. When you await something, you're telling the event loop to stop running this coroutine, and wait for something (usually IO) to happen before resuming execution. Because of this, if you block on IO without using await, the coroutine doesn't know to yield and will simply pause; thus execution of every single coroutine is blocked.

This leads to a sort of infectious need to make everything async as even a single non cooperating coroutine can bring the whole show to a halt. It's essentially the red vs blue function problem of Python. However, there is actually a nice alternative, gevent. gevent will monkey patch all functions in the standard library which would block, e.g. reading from a socket, attaching an implicit await to them. If the author has used gevent, the example Django code would actually work as expected, since the code would execute until the database connection was written to/read from and then immediately await.

Either way, async IO is still a somewhat tricky thing to understand and get right. It took writing a non blocking event loop with epoll in my case to really grok what was going on under the hood of something like asyncio.

</comment></comment></comment><comment><USER5> For OP's case, I wouldn't have jumped to async, but instead either to multithreading or multiprocessing. Pool().map makes this really trivial. Taking their example, and tweaking it slightly:

      import requests
      from multiprocessing import Pool

      def fetch_things():
          pool = Pool()  # defaults to number of CPUs
          urls = ['https://example.com/api/object/1',
                  'https://example.com/api/object/2',
                  'https://example.com/api/object/3']
          return pool.map(requests.get, urls)

      print(fetch_things())

Output (because those URLs are nonsense...):

      [<Response [404]>, <Response [404]>, <Response [404]>]

It's just as easy to do it in threading. Just switch that "from multiprocessing import Pool" with "from multiprocessing.dummy import Pool"

<comment><USER6> Have you timed it? Starting threads in Python is slow...

<comment><USER7> Have _you_ timed it? Not in general, but for this specific case? Thread creation is relatively expensive to some operations, but maybe the speed is entirely irrelevant to the task at hand. In this case, the author of the article is auto-curating some articles from a list of people he finds interesting. If this were done once per day as a cron job, it could almost certainly be done entirely _serially_ with zero concurrency and full blocking and still finish fine. Adding in concurrency is nice, but certainly any method will do with this volume.

This is certainly one of the cases where you should just do whatever is simplest (to _you_ the programmer). The first step is always to optimize for cognitive overhead. I.e. make the code easy to reason about. Next (and relatively rarely) is it necessary to good to optimize for different bottlenecks in your code.

<comment><USER8> I went back and timed it. The overhead is at _most_ 100ms in my use case (there's some ambiguity because of other problems with the async implementation, I suspect it's actually lower than this). Given many of the requests are 1s long and this is a background task, that's totally fine.

</comment></comment></comment></comment><comment><USER9> I'm sure someone will correct me here, but in my experience, Pythons Async model is a cluster-fuck.

It feels very much like it was just kind of thrown in to keep up with the trends, without any thought as to whether it made sense or whether it was the most "Pythonic" way of implementing it.

<comment><USER10> A lot of thought was put into it, including input from designs ten years older. Whether it is a good design I'll leave to others as I haven't used it much.

</comment></comment><comment><USER11> Async IO libraries tend to make very simple things very complicated. I spent half a day trying to use Boost.Asio to receive a UDP frame before giving up and using QUdpSocket (which took less that 5 minutes).

Agreed with the author's sentiment of feeling stupid.

</comment><comment><USER12> coroutines are tacos, and monads are burritos. Repeat after me.

ps: for the author, my only theory about the 0s sleep is that coroutines aren't preempted like threads, they use collaborative concurrency, so unless they actually say "ok I agree to pause now and let others do something" well the interpreter will evaluate all the instructions until completion. My 2 cents

</comment><comment><USER13> this is actually titled "I'm too stupid for AsyncIO"

and its about NOT understanding AsyncIO.

<comment><USER12> I was kidding with other devs yesterday that I had more fun trying designing multithreaded code than learning asyncio.</comment></comment>


Understanding How the Time-Based One-Time Password Algorithm Works - <AUTHOR> https://blog.digitalbunker.dev/2020/08/27/how-do-time-based-one-time-password-totp-services-work/ <comment><USER3> I did my own deep dive on TOTP a few years ago and wrote a blog post on how to implement a Google Authenticator compatible 2fa system in java including generating QR codes[0]. Demo code is on GitHub[1].

[0] [https://www.asaph.org/2016/04/google-authenticator-2fa- java....](https://www.asaph.org/2016/04/google-authenticator-2fa-java.html)

[1] [https://github.com/asaph/twofactorauth](https://github.com/asaph/twofactorauth)

<comment><USER4> The code samples make it super easy to follow. This is fantastic; thank you for sharing!

</comment></comment><comment><USER5> What confuses me is that TOTP is usually referred to as "something you have" (the app on your smartphone, with the secret), as opposed to "something you know" (your password). But the TOTP algorithm and the current time is known to any attacker. What remains, is just the secret, which is the same as a password (a password given to you by the service provider instead of a self- chosen one). So in the end, TOTP just increases password complexity, doesn't it?

EDIT Trying to answer my question: it prevents a MITM attacker from sniffing your password hash once and using that forever, since the TOTP code is different each time and the attacker would still need to brute-force the secret. But if that's the only benefit of using TOTP, couldn't that be combined with the password: The service where I want to authenticate sends me a "challenge" (random number), I enter my password and an algorithm on my client combines the challenge and my password-hash to create the result to send back to the service. This way the value sent over the insecure line is always different, since it is based on the challenge. The user would not have the added inconvenience of having to enter the TOTP code.

<comment><USER6> Kind of, but TOTP differs from passwords in important ways. Unlike user- selected passwords, the TOTP secret is guaranteed to be unique and strong as it's generated by the server. Observing some TOTP codes doesn't reveal the secret, so even if the password leaks the TOTP secret probably remains safe. Finally, the TOTP secret is typically managed in a device separate from the one where the TOTP code is entered, making it harder to steal.

<comment><USER7> I think you can get most of the advantages by just assigning users their passwords. Users either have a password manager to store the assigned password in, or they're totally insecure and can't be trusted to make up a password. Either way, just assign something random to them.

<comment><USER8> It's not all that difficult to remember a strong password, and if you use it with pwdhash, it's unbreakable.

<comment><USER9> But you need multiple strong passwords for (almost) every site. You need at least one to start, and when one of those sites inevitably leaks all of its passwords you'll have to change that one. Also 50% or more of the sites will have incompatible password content rules, so you'll have to work around that.

Password managers are a lot easier than trying to keep the state for a deterministic system. They're just as unbreakable with a good master password, and actually work with real-world site's rules around passwords.

<comment><USER8> See how it works: [https://pwdhash.github.io/website/](https://pwdhash.github.io/website/) \- the master password is hashed with the site name, you supply the resulting hash as the password, you can't reverse this hash if the master password is strong. The result has uppercase letters and lowercase letters and digits, which is good enough for most sites. In practice I saw one site restricting password length to 16 chars, but in case of a hash 16 chars are decent: they contain 95 bits of entropy. And saw one site requiring fourth complexity - punctuation characters - this is easy to circumvent by adding a minus at the end, you can store this information in the open, since circumvention of password policy doesn't affect password strength.

<comment><USER9> I know how it works. It doesn't help the issues I listed. You can't change passwords when required without storing a database of site names & increments (or similar) to allow you to get the right password. So it's not stateless, and you may as well get all the other benefits of a properly encrypted storage database (autofill, metadata, storing extra things like TOTP keys, SSH keys, etc).

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Years ago it took me a few times encountering these keys to realize how they were working (like for Google, etc). Now, on being presented any shared secret to initialize my Authenticator app, I screen capture / print out the secret and store it in my files at home. Just like those recovery codes. Too much of my life is with Google not to have this stored somewhere safe.

<comment><USER11> Google Authenticator now allows exporting your entire list as a single QR code, so you don't have to save the initial QR code. It's a godsend for migrating between phones.

<comment><USER12> Googling that, it appears to be available only on Android.

</comment></comment></comment><comment><USER13> I wrote a TOTP library and a client program that uses this library (in C - <USER2> an attempt of learning C) to make the desktop tool compatible with andOTP encrypted files. Things went well. I was able to get OTPs from andOTP encrypted JSON files. But I am unable to get time to work on it further. The code is open-source. It was fun :)

[https://gitlab.com/grijul/libzotp](https://gitlab.com/grijul/libzotp)

[https://gitlab.com/grijul/zotp](https://gitlab.com/grijul/zotp)

</comment><comment><USER14> So the HOTP/TOTP rely on the same secret being stored "plaintext" by both the server and the client? I am guessing this is not as concerning at all, as storing a password plaintext on the server, since this mechanism is used _on top of_ a password...

<comment><USER15> Yes. The main thing going for these mechanisms is that they're so _cheap_ to implement. A Nokia 6310 can run the algorithm, the set of people who could receive SMS based one time codes but can't do TOTP on their phone is close to zero. If you have a "programmer" employed and they can't add TOTP to your system check they said "computer programmer" \- my father was a "programmer" who figured out the "programme" as in schedule for a paper factory, that's the wrong kind.

In every other respect they're pretty bad:

The article suggests they can resist phishing. Against a poor adversary (e.g. Email links to a web form masquerading as "fraud check" by your bank) that hasn't considered TOTP they might be enough, but there are ready-to-use tools to help phish TOTP, SMS one time codes, RSA-style key fobs, even the _old_ crude Yubikey one time code thing where you press a button and it squirts text into a form field.

If _either_ the server or the client gets knocked over, the attackers get this long term underlying secret that they can use to fulfil the role of the other permanently.

It's not _as_ likely you'd stupidly log the underlying secret as a password sent to your server in an HTTP POST request, but you still might do it and then you're screwed.

The right take away is probably that this is the low bar, it's so easy that it's inexcusable for a site to pretend it cares you used a "good" password (e.g. by having password complexity rules or requiring Pwned Passwords checks) and then not even bother having TOTP. Oh you want _me_ to put in real effort to protect your stupid web site but then you aren't even doing the bare minimum, how about fuck off?

<comment><USER8> Oh, do all dumbphones run unsigned code? Big if true.

<comment><USER15> I don't know about _all_ dumbphones, some models from last century (many of which won't function on today's networks because the radio standards they need are no longer deployed) aren't even smart enough to manage over-the-air firmware updates and it may be impossible to meaningfully reprogram those. But, like I said, if it doesn't speak a modern radio protocol it can't use the network so who cares?

I believe a Nokia 6310 is just barely new enough that it should work everywhere in the world, although I might be mistaken.

This phone (and many from that era) implement Java MIDP, a thin Java API to do some simple things commonly across different models of mobile phone. In particular we need to discover the UTC time (or at least a local time and then use a stored offset) and remember a secret, and then calculate the TOTP code and display it.

Getting a program _onto_ these phones isn't necessarily easy though. It's not like they're running a web browser and you can just type in a URL somehow. You need to either have a dedicated program and a cable to connect it to a PC, or else you might be able to use WAP, a long obsolete simplified hypermedia protocol for these phones.

</comment></comment></comment></comment><comment><USER16> There's an bug - the base64 value is being hex-encoded, not the binary SHA1 result. So the hex values are wrong, and the rest as well.

</comment><comment><USER17> I didn't know how it worked. Thanks for the blog.

</comment><comment><USER18> >TOPT and HOPT</comment>


Show HN: Debian packaging for Node.js apps - <AUTHOR> https://github.com/ehartsuyker/node-deb

<comment><AUTHOR> Author here. I'm not a node or JS guy or even much of a sys admin, but I had to throw this together to help some guys at my company with deployments. Feedback is very much welcome.</comment>


3D-printed microscope enables computational super-resolution imaging at $1200 - <AUTHOR> https://f1000researchdata.s3.amazonaws.com/manuscripts/23450/6576bc13-4d38-494d-a56a-92ef864de3c3_21294_-_brian_patton.pdf?doi=10.12688/f1000research.21294.1&numberOfBrowsableCollections=19&numberOfBrowsableInstitutionalCollections=5&numberOfBrowsableGateways=22 <comment><USER2> Neat, hadn't seen this. I actually work in the research group at Uni of Bath that develops the original OpenFlexure design. If you have access to a 3d-printer and are interested in microscopy then I recommend building one. You don't have to spend $1200. There are different versions of the design you can choose from. Some just use the Raspberry Pi camera optics and are hand- actuated which makes them much cheaper.

[https://openflexure.org/projects/microscope/](https://openflexure.org/projects/microscope/)

</comment><comment><USER3> This is unfortunately just sensationalist at best, trying to milk "superresolution microscopy" with the other microscopy concepts, with this study using the 3D printed microscope as the gimmick.

To be clear, the OpenFlexure project is quite awesome and I am planning to build my own "garage" microscope sometime, and this design is the lead candidate. Two things you _cannot_ skimp on in a decent microscope, however, are a good objective and a good camera, and they both cost in the thousands at the least.

The constant struggle with biological microscopy (and I suppose most imaging technologies) is to try and extract the most amount of information possible for every photon your sample gives out. This will simultaneously allow you to observe samples without affecting them too much and get higher spatiotemporal resolution.

The whole field of superresolution started because we thought we hit the fundamental theoretical limits of how much resolution we can get from _any_ light microscope, even when using the cutting edge imaging technology. Superresolution techniques tried to trick and work around the limit by adding some extra imaging criteria (image one molecule at a time, screw with the illumination psf, fancy fluorescent proteins, etc). If you use suboptimal optics and then apply superresolution techniques, the image quality you get would just be worse with superresolution in this setup than with a regular microscope with good optics. That is actually clear in the figures in this paper - the "superresolution" images in the paper are worse than what any regular graduate student would get from a department confocal microscope.

Can't fault the particular study though: the entire superresolution microscopy field was a multibillion dollar blackhole of research funds with almost nothing to show by way of meaningful biological insight (leave alone deserving of Nobel prizes so soon).

<comment><USER4> Building on your comment, I think that while it does help to have high quality cameras and objective lenses, it is always worthwhile to push the limits of how cheap we can go. There have been many nicely done papers in this vein recently, showing for example, how cheapER cameras perform on supperresolution microscopy setups [1]. That paper showed that the setup is able to resolve cellular structures (actin filaments) less than 100 nm apart and measures the standard deviation of localization of single fluorophore emmitters.

Super-resolution implies that you are imaging below the diffraction (Abbe) limit. While the Fourier ring correlation can be used as a surrogate for resolution (it is frequently used in both cryo-em and fluorescent microscopy) you must define the correlation cutoff or else the measurement is meaningless. I do not see any mention of a cutoff used in the linked paper.

I would be more convinced if they actually imaged something smaller than the diffraction limit of their microscope, like the nuclear pore, which was recently proposed as a standard for the field [2]. Nonetheless I am impressed by the image quality given how un-rigid and prone to thermal drift/expansion their microscope probably is.

[1] [https://www.nature.com/articles/s41598-018-19981-z](https://www.nature.com/articles/s41598-018-19981-z)

[2] [https://www.biorxiv.org/content/10.1101/582668v1](https://www.biorxiv.org/content/10.1101/582668v1)

</comment></comment><comment><USER5> Here's a great video presentation on the project:

[https://www.youtube.com/watch?v=0F1pBmWuU3M](https://www.youtube.com/watch?v=0F1pBmWuU3M)

I'm very impressed with the hardware and software design of this project.

</comment><comment><USER6> Beautiful, frugual sciences and accessible technics production (and affordable) is key to opening up biosciences to more people and possibly liberating costs to equipment making parts of biotech akin to what has become for computing when it comes to areas such as microcontrollers and others things (Thinking rapsberry pi and arduinos)</comment>


StackEdit: Markdown editor with real-time HTML preview - <AUTHOR> http://benweet.github.io/stackedit/ <comment><USER2> Love the synchronized scrolling (and the fact internal links work - `#foo` scrolls both panes to the `# Foo` heading)!

The source is a simple textarea, right? Nice, I didn't realize you could reliably scroll one. [[https://github.com/benweet/stackedit/blob/master/res/extensi...](https://github.com/benweet/stackedit/blob/master/res/extensions/scrollLink.js) seems to do the magic.]

</comment><comment><USER3> Looks good, better than [http://markdownlivepreview.com/](http://markdownlivepreview.com/)

</comment><comment><USER4> this field is getting pretty crowded these days, but you've got a very nice implementation here...

-bowerbird</comment>


Ask HN: What is your most important factors when choosing an employer? - <AUTHOR> <comment><USER2> Pay, and benefits. Culture is pretty important too.

<comment><USER3> Add to that, your direct boss and team not being assholes/idiots.

<comment><USER4> how do you look for any signs of that pre or during interview?</comment></comment></comment>


Gene transfer on the fungal highway - <AUTHOR> http://www.ufz.de/index.php?en=36336&webc_pm=53%2F2016 <comment><USER2> This is fascinating work (IMHO).

As a side point it points to what I consider the major risk of products like Roundup (glyphosate): as a side effect it breaks up the shallow subterranean structure of fungal hyphae, bacteria etc that manage water percolation, nutrition, soil replenishment etc. Glyphosate has been attacked as causing cancer (I still doubt that) but it is probably very dangerous at the macro level, where people aren't paying attention.

The real fix is robots doing the farming (weeding, pruning etc) instead of humans and chemicals. Probably in my lifetime.</comment>


Show HN: Ndm – Npm Desktop Manager - <AUTHOR> https://720kb.github.io/ndm <comment><USER2> OT: I noticed in the GitHub repository that there is `.jshintrc` as well as a `.jscsrc` and `.eslintrc`

Why are you using 3 different JavaScript linters, instead of just 1? Especially since one of them (JSCS) was merged with the other (ESLint). There was a blog post about this in April[0] and even the front page of JSCS says that it was merged with ESLint[1], so why use both of them, in addition to yet another linter?

[0] [http://eslint.org/blog/2016/04/welcoming-jscs-to- eslint](http://eslint.org/blog/2016/04/welcoming-jscs-to-eslint)

[1] [http://jscs.info/](http://jscs.info/)

<comment><AUTHOR> that's because we setted up the projects months ago.

if you can please contribute, just PR PR PR PR :)

</comment></comment><comment><USER3> In general I like Electron, it makes it easy for web developers like me to get into making desktop apps. However, if you're not building it cross-platform, what's the benefit of Electron? If you disregard easy for web-developers.

<comment><USER4> Let's flip this around, what are the benefits of writing a native app when there is Electron? It's democratizing cross-platform Dev tools in one of the most standard rich environments, the browser.

IMO, the question should always be, why native?

<comment><USER5> > Let's flip this around, what are the benefits of writing a native app when > there is Electron?

\- Speed

\- Native UI

\- Native OS hooks

<comment><USER4> IMO those are specific choices for specific types of applications, when most people just need a simple front end for their app.

<comment><USER6> What about the energy performance hit that electron apps introduce?

<comment><USER4> I haven't noticed it, and use Atom (Electron based) on a Laptop often. It's a MacBookPro, so already one of the better in terms of battery consumption, but I use it disconnected from Power for upwards of 5-6 hours at a time with no issues.

</comment></comment></comment></comment></comment></comment><comment><USER7> Not to nitpick, but I fail to understand the problem you are trying to solve. Even if something like this would be bundled with some IDE, the reason is unclear to me. It's nice as a side project to get used to electron though.

<comment><USER2> In their README, they have a section describing why one should use this project[0] which essentially says something like this:

Not everyone knows how to use the npm CLI, and they oftentimes cannot use it for "intern/office/job" reasons, or they are simply unwilling to use the cli at all.

However, the learning curve for the npm CLI, at least for the tasks that this project accomplishes, is not steep at all. For example, installing a dependency is as simple as `npm install dep` where `dep` is the name of the dependency you want to install. Furthermore, I have never heard someone say "I couldn't use npm because it's a CLI and my job does not allow me to use those", nor have I ever heard someone who wants to use npm say "I am not willing to use a CLI"

I'm curious, in what job setting is one not allowed to use the npm CLI? And, since this project itself uses the CLI[1], wouldn't using Ndm be just as bad as using the npm CLI?

[0] [https://github.com/720kb/ndm#i-love-the-shell-why-use-an- app](https://github.com/720kb/ndm#i-love-the-shell-why-use-an-app)

[1] [https://github.com/720kb/ndm/blob/master/lib/js/npm/npm- api....](https://github.com/720kb/ndm/blob/master/lib/js/npm/npm-api.js#L96)

<comment><USER4> To say nothing of the fact that a programmer can't use the CLI? What programmer is that?

I mean, I'm all in favor of tools that integrate into the IDE, that reduce the overhead of running commands, but not being able to use the CLI would be a huge red flag.

In fact, you now have me considering writing a new interview test to make sure people are literate with the CLI.

<comment><USER5> > To say nothing of the fact that a programmer can't use the CLI? What > programmer is that?

People who use Excel, maybe. There are a _lot_ of people who do "programming" in their job without their job title containing "programmer". I can absolutely believe that these days there are people out there brewing up little JS scripts to help them with their day-to-day tasks.

<comment><USER8> >I can absolutely believe that these days there are people out there brewing up little JS scripts to help them with their day-to-day tasks.

I can't. At least if we're talking about people who can't use a CLI or read JSON.

<comment><USER5> I personally got my start in programming through Access -> VBA -> VB.NET -> C# -> JS/Ruby/Python/whatever. The first four involved little to no CLI work.

</comment></comment></comment></comment></comment></comment><comment><USER9> Why have page that tells almost absolutely nothing about your project? I could understand if it was aimed at non-tech people but I have serious doubts that anyone that isn't developer will be interested in your project. If I read title on hacker news that says 'Npm Desktop Manager' I would like to be able to read a little more about it before I decide to use it without having to go to github. Like, the information that there is no stable release is only in FAQ section of github project.

<comment><USER10> I thought it was pretty clear what it was by the screenshot on the page...

<comment><USER9> It is but additional info like release version or minimum required npm version would be nice. Or have any info from 'Recommendation' and 'FAQ' section from github displayed.

</comment></comment></comment><comment><USER11> 168 mb for a dependency manager seems a bit steep

<comment><USER12> 45M for the downloaded DMG file;

387M of extracted/mounted data;

314M in the Contents/Frameworks directory _(which is where Electron is)_ ;

73M in the Contents/Resources directory _(which is where the application is)_ ;

73M is actually the size of the "Contents/Resources/app/node_modules" directory :D

<comment><AUTHOR> Yes, the whole js app is a dist/ folder and weight does not exceed 1mb i guess, the outer weight is the price to pay

</comment></comment></comment><comment><USER13> Offtopic: There are merely 40-50 words on that page, but 3 different font families and several sizes and weights. Almost every line is styled differently.

<comment><AUTHOR> hi, thanks for the feedback, you can PR on Github if you want feel free seriously we'll be glad a lot!

</comment></comment><comment><USER14> This looks nice. I'm really tied to using creationix nvm at the moment and it seems like these two libraries would be competing for control over how to manage node/npm. There's no GUI on nvm though, so if this tool can handle installing multiple different versions of node/npm then maybe it is a better alternative.

<comment><AUTHOR> thanks! nvm, node, npm, yarn, as well as brew for example, and so on: all different tools made for different scopes.

</comment></comment><comment><USER15> Next: Nwm- Npm window manager based on Electron. Works on Mac and sometimes Ubuntu.

</comment><comment><USER16> Good job. I think it's useful purely for the fact that it can tell you the latest available version for each of the packages in your project. It's handy to have that at a glance

<comment><AUTHOR> That's what this is supposed to be/do/handle/visualize/inform/etc/

Glad that you find it useful, many thanks!

</comment></comment><comment><USER17> This is comparable to what JetBrains has built into their IDEs for viewing project modules with option to update.

I like this solution better because it manages all projects compared to opening each project separate in an IDE.

A few commands in my terminal can be equal in functionality to what this app does but I can see myself using this app regardless.

<comment><AUTHOR> thank you for your impressions!

</comment></comment><comment><USER18> It looks great, but mac only?

Isn't Electron meant to be cross platform? Shouldn't this also work on Windows and Linux?

<comment><AUTHOR> OFC, Electron is cross-platforms.

This is a beta release, due the fact we need to spot out many other possible and common bugs/problems before to make it really stable, that's the only reason why ;)

<comment><USER7> Don't forget that you can have platform specific bugs ;)

<comment><AUTHOR> Ofc, just you know ... too much meat on bbq it will be quite degenerative :)

Actually, the API used is require('npm') that mean if it gets stable on OSX there will be quite 99% possibilities it will be stable the same on Linux and Win. Then templating and releasing will be quicker ;)

</comment></comment></comment></comment><comment><USER19> What's the point of this? By that I mean what would you actually use it for?

Is this a GUI version of nvm and if so, seriously who would use it? The whole point of nvm is to be able to pop in/out of node versions as you're working on a project. That doesn't make any sense for a global GUI.

<comment><USER16> It's for npm, not nvm. It shows the installed packages in a project, the version that is installed and the latest available version which is handy. You can install/update packages too but don't see much use for that since the CLI is there but the displaying of info is decent.

<comment><USER19> Okay now I get it. So it's a GUI to see what's in use by a given project. I mistakenly thought it was a tool for managing node installations.

I guess the git analogy would be something like gitk?

<comment><USER16> Yeah sort of. I wouldn't use it to replace npm CLI or anything (even though you can), but like I said being able to glance at installed modules and see the different versions (installed vs latest) is a nice thing to have.

</comment></comment></comment></comment><comment><USER20> Congrats on shipping!

<comment><AUTHOR> Oh well thanks :)

</comment></comment><comment><USER21> (for Mac)

<comment><AUTHOR> (beta) i forgot that too sorry ;)

</comment></comment><comment><USER22> npmDM?

<comment><USER23> NPM Package Manager Desktop Manager

<comment><USER22> Node Desktop Manager (whatever that means)</comment></comment></comment>


Glasgow is trying to make urban living less miserable - <AUTHOR> https://mosaicscience.com/story/urban-living-city-mental-health-glasgow-cities-happiness-regeneration/ <comment><AUTHOR> _For ponds, she says, it might be that the presence of a certain type of newt tells you whether or not the water is healthy. In cities, the newts are children. "If you can see children, it's probably a healthy and happy city."_

Large [presumably US] Cities With the Lowest Share of Families With Children

      San Francisco    16.5%
      Seattle          18.7%
      Washington, D.C. 18.9%
      New Orleans      20.7%
      Miami            21.4%
      Minneapolis      21.8%
      Philadelphia     22.5%
      Portland         23.2%
      Denver           23.3%
      Cleveland        23.7%

[https://www.citylab.com/life/2019/01/top-cities-for- families...](https://www.citylab.com/life/2019/01/top-cities-for-families- with-children-data-childfree/580372/)

<comment><USER2> I can't speak for SF or Seattle, but I suspect a big reason for lack of families with children in many large American cities is that, for the most part, public schools are unacceptable for any family that cares about education.

DC, Philly, Baltimore, Cleveland... all the same story. Even in gentrifying and resurgent neighborhoods, parents with the means to do so leave as soon as their kids get to school age or enroll them in extremely expensive private schools. Some might try charter schools or selective magnet schools, but the local neighborhood school in your typical big city is typically a hard "no go".

<comment><USER3> SF has a lottery system. With the wrong stroke of luck, your child can be damned to hours of commuting across the city every day, just to go to a crappy school, when a "good" one might be across the street.

That's an extreme example, and in the worst case scenario there are plenty of good private schools to send your children. But choosing to live in SF comes with such a set of pros and cons that many parents of school-age children who have a choice choose to live outside of it.

<comment><USER4> Is a lottery system really worse overall than just letting people buy their way into desired school district? That model obviously hasn't been working well either.

<comment><USER3> Depends on your goals and metrics. I'd say yes, it is worse.

An interesting read: [https://www.nytimes.com/2019/04/25/us/san-francisco- school-s...](https://www.nytimes.com/2019/04/25/us/san-francisco-school- segregation.html)

<comment><USER4> Thanks, that was a genuine question.

</comment></comment></comment></comment></comment></comment><comment><USER5> Glaswegian here.

I would love to support the merry picture this article is painting but most of the examples are happy accidents.

The diet aspect is cultural and will be around for many generations. You can try and "chip" away at it by education and social mobility but it will still be around. In fact I could murder a fish and chip supper right now.

In terms of open spaces and such, Glasgow council is selling land like its going out of fashion to developers. The joke being "oh theres more student accomodation being built". Plus the city's infrastructure is under strain as Glasgow approaches the 1 million mark.

The weather will always be crap.

<comment><USER6> > Glasgow council is selling land like its going out of fashion to developers

Guessing the sentiment here is that this is bad? Why exactly? Is Glasgow not growing and ever more people needing roofs over heads?

I've never once heard a person hate on farmers for producing too much food for consumption but the moment developers come even close to meeting demand for housing they are considered on par with criminals.

Both are essentials for life. Yet an abundance of one may reduce an individuals personal wealth.

In my country developers are banned from political donations, bikie gangs (organised criminals) are not.

<comment><USER7> Because private developers only build housing for a profit, which does not make it possible to satisfy everyone's needs and is therefore not in line with the supposed purpose of the council. If it truly cared about the needs of its constituents, the council could contract out to develop the land itself and provide housing at a cost accessible to everyone. Instead there is a lot of money sloshing around for the wealthy and powerful, and a lot of poor people with inadequate housing. This is why these people are considered "on par with criminals" and why your farming analogy is not really relevant.

</comment></comment></comment><comment><USER8> I lived 5 years in Glasgow to get my engineering diploma, coming from a quiet village from the french countryside. It was a shock when I arrived there, barely speaking english, having never lived in a city before, but my god I loved this city so much.

Weather is depressing as hell, violence is common, the food is the worst I ever tasted and there is still this silly war between catholic and protestant. But glaswegians are so friendly, and the city is so mad that I felt so alive there. Living there was surreal every time of the day, from the morning hangover, the awful food to the mad parties at night.

Having said that, I never saw myself raising a family there, Glasgow is just too much of everything.

</comment><comment><USER9> Glasgow may be in the words of Frankie Boyle "like Blade Runner without the special effects" but it is worth noting that it is definitely one of the friendliest cities, whereas here in Edinburgh we might have one of the most beautiful cities in the world but the inhabitants tend to be comparatively grim of mood.

<comment><USER10> And a large Glasgow City Centre apartment about half of the price of a similar apartment in Edinburgh. Making urbanization a lot more affordable. That said, moving 30 minutes out of Glasgow (Kilmarnock), you can get a similar end unit apartment for a third of the cost in Glasgow walking distance to a direct line to Glasgow.

And here I am in the States driving 50 miles a day and paying triple for my house what a nice City Centre flat costs in Edinburgh.

<comment><USER9> ~30 mins by train from Edinburgh Haymarket gets you across to Fife - which is where we moved from central Edinburgh ~3 years ago.

</comment></comment></comment><comment><USER11> > Anna recalls the change. "When we were in the tenements, you'd shout up to > the window: 'Mammy, I want a piece of jam!' Before you knew it there was a > dozen of them being thrown out of the window." In the tower block, she did > not let her own children play unsupervised. Neighbours only spoke if they > took the same lift. Her daughter was threatened with a bread knife.

Interesting that this anecdote is the same theme as the children's song we learned at school "You cannae through pieces oot a twenty story flat"

</comment><comment><USER12> Chicago, USA, had similar urban "renewal" woes, resulting in the construction of high-rise housing projects (called housing estates in Scotland). The Robert Taylor Homes were a particularly egregious example. [https://en.wikipedia.org/wiki/Robert_Taylor_Homes](https://en.wikipedia.org/wiki/Robert_Taylor_Homes)

They were demolished in the early 21st century. But, unfortunately, Chicago remains a city where it's a vast dangerous struggle to live in poverty.

'twould be interesting to compare Glasgow's sectarianism with Chicago's racism, to see whether ways of mitigating one could mitigate the other.

</comment><comment><USER13> If anyone is interested in this type of thing I would recommend reading 'Seeing Like a State' by James C. Scott. It is one of those books that makes a point so definitively that many articles on the topic could just be appended as examples.

From Wikipedia:

> The book catalogues schemes which states impose upon populaces that are > convenient for the state since they make societies "legible", but are not > necessarily good for the people. For example, census data, standardized > weights and measures, and uniform languages make it easier to tax and > control the population.

<comment><USER14> What's wrong with "standardized weights and measures"?

<comment><USER15> Pre-Industrial Societies: Anatomy of the Pre-Modern World ( [https://www.amazon.com/dp/1780747411/](https://www.amazon.com/dp/1780747411/) ) makes the case that standardized weights and measures do indeed make things easier for the state, but that in this case the state is on the side of the peasants against the nobility who would like to enserf them.

History supports this view in some obvious ways -- European peasant revolutions included demands _for_ standardized weights and measures as a counter to abuse of nonstandard measures by local lords.

</comment></comment></comment><comment><USER16> I think UK did not get highrise development right. Building residential highrises far away from workplaces,social facilities, and no good transit pretty much defeats the purpose of building highrises.

In other words, UK cities with "depressive" highrise communities unknowingly copied Moscow suburbs.

<comment><USER17> You're right that the UK government bungled the high-rise housing in the 60s and 70s (as documented by Adam Curtis in "The Great British Housing Disaster" \- [https://www.youtube.com/watch?v=Ch5VorymiL4](https://www.youtube.com/watch?v=Ch5VorymiL4)).

But I'd like to explore the UK/Moscow comparison though. I don't have first- hand experience with Moscow but I _am_ familiar with the Czech Republic where _paneláky_ house a sizeable chunk of the population. Many of my friends live in them and they're generally quite pleasant, well served by transport and amenities (shops, bars, things like hairdressers and such).

What I'm getting at is that this - in the "west" there is a lot of misunderstanding about life in Warsaw Pact countries. From my Czech experience it would not surprise me in the least if much of the Moscow mass-housing you're referring to was planned and constructed _better_ than similar developments in UK.

So I think the comparison between (say) Red Road flats in Glasgow or the Banana Flats in Leith and Moscow's suburbs might be unfair _to Moscow_.

<comment><USER16> I'd say Moscow improved since Soviet times. The issue with Moscow suburbs were that they were made to house a lot of lower end Soviet proletarians, densely, cheaply, and most importantly away from Soviet elites.

They had no or bare minimum in terms of living infrastructure like shops, schools, daycare and people had to travel to Moscow for everything.

The only connection they had to the city centre were busses, and trains whose routes and schedules were very peculiarly planned, again to frustrate residents from faring to city centre too often.

Those bedroom communities were only linked to the metro like a decade or so ago.

</comment></comment></comment><comment><USER18> Used to live in Glasgow and it is my favourite city. I left for a job elsewhere.

The weather and the dark winters are the real issue. Association with violence is outdated - it's much safer than London, for example.

Association with drinking alcohol entirely accurate. If you like that, Glasgow is a great place to party. It also contributes to a very communal feel around the pubs there. And it brings the downsides you'd expect - increased levels of alcoholism and domestic violence.

The Protestant catholic thing is a regular source of annoyance when the orange marches are on, but you can otherwise ignore it. Some momentum against the marching is developing now, hopefully the council will act.

Now the positives: long beautiful summer evenings, relatively warm winters, incredible arts and music scenes, best pubs and bars in the UK, beautiful parks, stunning architecture (really, really stunning), beautiful tenements you can afford to live in on an average wage like you're in some kind of Parisian movie, great museums, Loch Lomond about 30 min drive away and lots of other beautiful countryside nearby, great staging post for the highlands. Incredible urban landscape to explore. Two great universities. Very vegan friendly - a bunch of the major venues for music and general hipster things are vegan.

But the biggest plus is the people - the most kind, warm, friendly people you'll meet in the UK. People shouting out of their windows to invite me in for a drink. Starting conversations with me as I walk down the street. Drinking whisky with strangers you've just met at the bar. Community organisations (like the Children's Wood mentioned in the article) spring up everywhere. This innate sense of fairness. It's so hard to describe, but go visit and you might be lucky enough to understand why "people make glasgow" is both a council marketing slogan and also perfectly true.

</comment><comment><USER19> Hi guys. We develop a new way to elevate the wellbeing in cities, you want to try it? Download it our app In Iphone: [http://bit.ly/Mind_plus](http://bit.ly/Mind_plus) and in google play: [http://bit.ly/app_MindPlus](http://bit.ly/app_MindPlus)

</comment><comment><USER20> _The weather will always be crap._

Climate change will solve that problem.

<comment><USER21> Please don't do that here.

We detached this subthread from [https://news.ycombinator.com/item?id=21272073](https://news.ycombinator.com/item?id=21272073) and marked it off-topic.</comment></comment>


The Mind-Expanding Ideas of Andy Clark (2018) - <AUTHOR> https://www.newyorker.com/magazine/2018/04/02/the-mind-expanding-ideas-of-andy-clark <comment><USER2> I don't know the bases of Friston's theory of intentionality, but it sounds like it was likely motivated by the notion made popular a decade or so ago that free will didn't really exist, that evidence from Functional MRI-based analyses indicated that human action preceded the brain's decision to act. Presumably that idea was fundamental to Friston's suggestion that volition arose only after the arm was already in the act of moving, where the mind's will to move arose as a surprise reaction to the arm NOT already moving.

Fortunately the bases for this freaky model of reaction preceding initiative seems to have since been resolved as error -- we improperly interpreted the FMRI signals.

I wonder how this resequencing in the mind of cause to once again precede effect has reshaped Friston's theory of perception and free will. Or Clark's.

A well written article nonetheless. I'm often impressed that writers can so capably embrace the conceptual models of others without injecting their own doubts or biases, even when the bases for these theories often seem tentative at best.

</comment><comment><USER3> I think you can argue the opposite as well ... the world is in fact defined in our minds as perceived by our senses. So the two people in the opening part of the article may both believe they know where MOMA is, but do they really share the same perception of the location? More simply, we agree on what defines the color red, but we have no real way of knowing that our mental model of red is the same.

EDIT: I just noticed there was another link on the front-page that describes this duality better than I can - [https://news.ycombinator.com/item?id=22374366](https://news.ycombinator.com/item?id=22374366)

</comment><comment><USER4> Discussed at the time: [https://news.ycombinator.com/item?id=16684973](https://news.ycombinator.com/item?id=16684973)</comment>


Show HN: I'm doing a gem-by-gem guide for social networks in Rails. Feedback? - <AUTHOR> http://www.developingandrails.com/2015/02/a-social-network-in-rails-gem-by-gem.html

<comment><USER2> Have you ever read Railspace? It might just need an update from someone like you. [http://www.amazon.com/RailsSpace-Building-Networking- Addison...](http://www.amazon.com/RailsSpace-Building-Networking-Addison- Wesley-Professional/dp/0321480791)</comment>


Wow, I just read that my startup will fail. - <AUTHOR> http://joerussbowman.tumblr.com/post/656825367/wow-i-just-read-that-my-startup-will-fail

<comment><USER2> I'm in pretty much the same boat as the author for most of the points he makes. Reminds me of Finding Nemo (my kids love that movie) "Just keep swimming, just keep swimming..."</comment>


Show HN: Operations CMS for Shopify - <AUTHOR> https://github.com/openshiporg/openship <comment><AUTHOR> Hey guys, maker here. I built Openship to manage the backend operations for my Shopify stores. I used to manage them using Zapier and Google Sheets, but after getting tired of staring at spreadsheets all day and wanting to optimize even more, I decided to learn React and build a dashboard and a marketplace as a Shopify app.

Openship allows you extend Shopify GraphQL API as well as route orders to different sources like ShipBob, ShipMonk, Amazon, other shops directly, and even custom 3PL solutions.

Our long term goal is to provide a sleek and intuitive operations dashboard for e-commerce shops that they can host and customize how they see fit. With this, we want to have a tightly integrated marketplace where they can easily list their inventory.</comment>


Australian worker wins unfair dismissal case over fingerprint scanner refusal - <AUTHOR> https://www.fwc.gov.au/documents/decisionssigned/html/2019fwcfb2946.htm <comment><USER2> This is the first decision in as long as I can remember that I've heard from Australia, in _favor_ of civil righrs.

<comment><USER3> Same, seems that us Australians in general love to throw our rights in the trash, along with our political will.

The apathy is palpable.

No wonder Australias economy is so weak when there is no future vision being sold to us but rather holding onto old power structures like coal and copper.

It's very concerning to visit Melbourne every year and watch the number of homeless people continually increase.

</comment></comment><comment><USER4> Solidarity for May Day.</comment>