New York Times has more Twitter followers than print readers - <AUTHOR> http://www.textually.org/textually/archives/2010/10/027107.htm

<comment><USER2> Non link-jacked [http://www.socialtimes.com/2010/10/report-new-york-times- has...](http://www.socialtimes.com/2010/10/report-new-york-times-has-more- twitter-followers-than-print-readers/)</comment>


A billion prices can't be wrong - <AUTHOR> http://timharford.com/2016/05/a-billion-prices-cant-be-wrong/ <comment><USER2> Ooh I worked on this project as an undergrad years ago as a research associate! Awesome to see it get more press! It blows my mind that more economists aren't leveraging big data to address macroeconomic problems & models; the data is less actionable than microeconomic/game theory problems, sure, but the learnings can be more impactful to policy in the long run.

When this project was started, we were only looking at three big markets: real estate, groceries, and general "home goods" (washer machines are an example.) Essentially, using the CPI for inspiration and neo-classical macroeconomics with the "household unit" as the center of importance, those 3 groups seemed ideal as an MVP for the project. What I worry about is how they're going to update the model and structure of the project to incorporate the intersection of globalized markets (going to the iPod example, what if some variability in price can be explained by price stickiness, or lack thereof, of labor prices in China? etc.)

Nevertheless - I'm all for the hacking/big data community seeing more of what's going on in the macroeconomics world, as I think it's just ripe with opportunity.

<comment><USER3> As a student with an undergrad degree in Economics, I got into Python programming specifically for the potential applications of Big Data to Economic policy. A shame that my professional career took me a tangential direction, but I hope to eventually take what I am learning now and direct it back towards Economics at some point the future.

Glad to see actual Economists are exploring the area.

</comment></comment><comment><USER4> This is a graph I made some time ago comparing the Billion Price Projects index data (which I downloaded from their site) with the Argentine Monetary Base as reported by the Argentine Central Bank:

[http://imgur.com/Xyd8RXa](http://imgur.com/Xyd8RXa)

The black line is Argentine Monetary Base as reported by the Argentine Central Bank. The blue line is the BPP data, the green line is the official Inflation rate as was reported by the government at the time. Note: the left Axis numbers represent Millions of Pesos and represents the value of the black line.

Kind of difficult not to jump into conclusions.

Last but not least I did a website that mines Argentine Central Bank Data daily and produces Graphs and reports based on it: [http://estadisticasbcra.com/en](http://estadisticasbcra.com/en) . It includes a public API: [http://estadisticasbcra.com/api/documentation](http://estadisticasbcra.com/api/documentation) if someone wants to use the data I'm compiling.

</comment><comment><USER5> This is a great technique, at one point I had proposed to Google's economist that once they had the last 100 years of newspapers digitized, one could go through the advertisements in them to compute a variations on price indexes and compare them. In particular how important was energy and food? or rent? or substitution of goods?

I got interested in the question at a young age when my mother showed me a picture of a grocery store, where new york strip steak was on sale for 10 cents a pound. And I asked why it cost so much more for steak when I was looking at the picture versus when it was taken. And I got the "simple" explanation of inflation, "Things cost more now."

The real value of the work being done by Cavallo though will be later water when you have both 100 years of prices and the detailed news stream to go along with it. People have a wide variety of opinions about whether or not abandoning the Bretton Woods system had the effect on prices that some claim or if other factors were to blame.

I expect we will see truly actionable economic insights from projects like these.

</comment><comment><USER6> One major problem with inflation tracking, which this approach has the potential to solve (though does't appear to yet), is that measuring the _quality_ of the product over time is hard.

Wages have averaged flat for the last 20 years "with inflation", but $1000 for medicine buys you a much better product today than the "equivalent" amount of money 20 years ago. Traditional basket of goods models tend to assume quality parity.

<comment><USER7> Staple food, furniture, and clothing quality has been going down for decades.

In longer time frames food has maintained value for very long time periods, but salt has dramatically dropped in value. If you compare baskets the prices that stay drown out the ones that drop off a cliff. Which makes inflation a tricky subject over very long time periods.

EX: Food and land in ancient Mesopotamia has value in our modern economy. Clay tablets are kind of meaningless, and pottery is really hard to judge.

<comment><USER6> How do you value the ability to buy oranges at any time of the year? The ability to buy shirts of any color/size, within minutes? I don't know if I would agree that the quality has been going down, it really depends on how you define quality :).

Basically, I completely agree that it is tricky, and traditional hedonistic adjustments really are pretty poor approximations.

<comment><USER7> It's a really complex question. As a trade-off between really tasty oranges or good looking cardboard available year round I will take seasonal oranges. I used to love Oranges, but they have become so bland I simply stopped.

As to clothing, I have bought cotton clothing that barely survives a single wash. Sure it's cheap, but it's like they started designing clothing to look good in your closet if you never wear them. It feels like your choices are 50 loads for 60$ or 2 +/-2 loads for 5$.

PS: The sad thing is even orange juice has gotten worse. Fresh or frozen makes little difference they both suck.

<comment><USER6> Random fact... Orange juice loses its flavor when pasteurized, always has. If you want "real" orange juice, you need either fresh or cold (high pressure to sterilize) pressed, which you can now buy.

</comment></comment></comment></comment></comment><comment><USER8> Tim Harford's a good writer - he's got some books that I highly recommend as a gentle introduction to economic thinking:

* "The Undercover Economist" \- [http://amzn.to/1sCImVw](http://amzn.to/1sCImVw)

* "The Undercover Economist Strikes Back" [http://amzn.to/24bIFT3](http://amzn.to/24bIFT3) \- this one's about macroeconomics.

As well as various others. One thing I like is that they're mostly fairly neutral - he's really trying to explain the thinking, rather than beating you over the head or espousing one position.

<comment><USER9> More or Less is also an excellent radio program he narrates on economics and statistics, definitely worth a listen: [http://www.bbc.co.uk/programmes/b006qshd](http://www.bbc.co.uk/programmes/b006qshd)

</comment></comment><comment><USER10> > While the project confirmed that Argentina's inflation numbers could not be > trusted, it also showed that the US inflation numbers published by the US > Bureau of Labor Statistics could be.

There were conspiracy theories floating around in the 2007-2010 time-frame (and still may be) that the published BLS numbers were being manipulated for political reasons (much as in Argentina), and it's reassuring that there's some confirmation that they weren't.

<comment><USER11> The other way to cross check this is to look at the relevant M2/M3's (definitions vary between countries), but otherwise knows as "the total sum of bank deposits" in a countries banking system.

i.e. compare and contrast:

Argentina: [https://research.stlouisfed.org/fred2/series/MYAGM2ARM189N](https://research.stlouisfed.org/fred2/series/MYAGM2ARM189N)

USA: [https://research.stlouisfed.org/fred2/series/M2](https://research.stlouisfed.org/fred2/series/M2)

The USA's money supply has a doubling function of 2x decade, while Argentina managed something like 12x 2006-2016.

The people who were predicting hyperinflation in the 2007-10 timeframe for the USA were predicating the banking system's behaviour based on the regulatory framework in the old gold standard regimes, and not under the newer Basel capital controls. Which is not to say that you can't get hyperinflation with Basel, but you need to do a little more than just inject asset money into the system.

<comment><USER12> Stricter capital controls are only one (arguably less important) side of the equation, with weak aggregate demand being the other.

<comment><USER11> There's really no evidence for that. The evidence is that the American banking system doubles its money (and direct lending) every decade, and has done for the last 50 odd years. If there was actual weak demand, you would expect it to stop expanding, or expand at a lower rate, and that's exactly what you don't see.

Compare and contrast with the UK for example (M3, because no standard definitions etc.):

[https://research.stlouisfed.org/fred2/series/MABMM301GBM189S](https://research.stlouisfed.org/fred2/series/MABMM301GBM189S)

The UK btw, doesn't have a formal central bank reserve percentage (it has fairly minimal liquidity provisions which are the same thing, but still). Economics needs to wake up and realise it does not understand how the monetary system actually works.

<comment><USER12> [https://research.stlouisfed.org/fred2/series/M2V](https://research.stlouisfed.org/fred2/series/M2V) addresses your argument about the money supply. Important to look not only at the aggregate amounts, but the velocity of money to see spend/save trends.

But there are a lot of other economic indicators that you need to consider outside the money supply when talking about aggregate demand. Look at interest rates as one example, which are a proxy for how expensive (highly demanded) money is, and ask yourself why they are at an all-time low and stagnating at the ZLB, with short-term rates even going negative in some countries.

</comment></comment></comment></comment></comment><comment><USER13> > The Edison phonograph cost $20 at the end of the 19th century; an iPod Nano > costs about $145 today.

It's also worth remembering that an edison phonograph would have probably been useable for about 60-80 years if kept in good condition. Good luck getting 5 out of the Nano. But yeah, collecting a billion prices and forgetting about each after a pairwise collection is a brilliant choice.

<comment><USER14> $20 in 1891 is ~$500 today. I'm sure the iPod nano could be an heirloom- quality device if you were willing to pay $500 for it. The photograph was certainly _not_ maintenance-free so for equal comparison we have to assume even with a massive over-subscription of flash you'd need to replace the memory every 10-15 years. The battery probably every 5.

It's a difficult problem to reason about because our own perceptions are anchored to what we know. You couldn't have had a modern home air conditioner at any price in 1891. Ten billion dollars couldn't have bought you the computing power of a MacBook Pro in 1950.

The quantitative and qualitative gap between successive generations of computing technology is many orders of magnitude beyond what any other technology has ever experienced in human history, and the generations themselves have happened orders of magnitude faster too. I don't even know how you compare these things in economic terms because the baseline equivalence between products is nonsensical to start with.

<comment><USER13> > the baseline equivalence between products is nonsensical to start with.

That's exactly my point. Nonetheless, traditional econometric analyses do exactly that, arbitrarily creating multipliers (hedonic adjustments, e.g.) which normatively make assignments as to what a consumer "should" value in a product. These assignments often throw out important considerations, merely because they're 'difficult to calculate'.

</comment></comment></comment><comment><USER15> For anyone wondering, this is the argentinian site that gathers the prices: [https://www.preciosclaros.gob.ar/](https://www.preciosclaros.gob.ar/) (while I wasnt involved in the development, I work in the same goverment dependency that developed the site)

</comment><comment><USER16> Very interesting, doubt it will happen, but would love to see their data (or some portion of it) released.

<comment><USER17> [http://bpp.mit.edu/datasets/](http://bpp.mit.edu/datasets/)

</comment></comment><comment><USER18> If it doesn't include rental/mortgage payments, or the price of energy, it's not really measuring inflation. It's absurd that inflation in the UK is supposedly <0.5% when rents are going up so much each year.

</comment><comment><USER19> How exactly do these people process the raw prices data? Where can I read about it?</comment>


Three Big Lies (2008) - <AUTHOR> http://cellperformance.beyond3d.com/articles/2008/03/three-big-lies.html <comment><USER2> Thanks for posting! I'm a big fan of Mike Acton and the data oriented paradigm. Abstraction and encapsulation (which is what OOP is to me) often hinders deeper understanding of the problem, or at least hinders efficient implementation. Instead it creates conceptual and maintenance boundaries (which might be what's needed).

<comment><USER3> Yup I'm a fan of Mike Acton as well, always fun to show someone who hasn't seen Data Oriented Design a path to a 10-50x perf improvement that they didn't think was possible.

Back when I first saw it was in one of Bruce Dawson's courses where we did simple image manipulation. I think the task was to implement bitblit(move one rect of a bitmap into another rect on another bitmap).

I remember him grabbing one random student's assignment, throwing in some rudimentary timing and then saying, "lets see if we can do any better". By the end of ~15 minutes he'd sped the thing up 800x with a combination of reading by row rather than column, aligned reads and some other tricks that looked like black magic at the time. Looking back now it all seems fairly obvious once you know how the hardware works.

Good times.

<comment><USER4> Why call it data oriented design? Why not just call it what it is? Cache optimization.

<comment><USER5> Because it isn't just about cache optimization. How you organize your data impacts the types of transformations that can and need to be done. Utilizing SIMD is another thing that is extremely sensitive to data layout.

<comment><USER3> Yup also relevant for subsystems that need to shuffle data across a bus like the SPUs on the PS3 that only have 256kb of addressable memory.

</comment></comment></comment></comment></comment><comment><USER6> > If there's a rocket in the game, rest assured that there is a "Rocket" class > (Assuming the code is C++) which contains data for exactly one rocket and > does rockety stuff.

Probably true.

> With no regard at all for what data tranformation is really being done, or > for the layout of the data.

I agree that OO design is usually not done with regard for the layout of the data.

> Or for that matter, without the basic understanding that where there's one > thing, there's probably more than one.

Say what? In C++, you'd simply create another object that is another instance of the Rocket class. Behold, "more than one".

> Though there are a lot of performance penalties for this kind of design, the > most significant one is that it doesn't scale. At all. One hundred rockets > costs one hundred times as much as one rocket.

Well, see, one hundred rockets have one hundred times the data that one rocket has. I don't see how you can avoid that, _no matter how you represent the data or whether you do it as OO or something else._

But you don't duplicate the _code_ 100 times, just the data. You might also have 100 instances of a pointer to a virtual function table, which means you've wasted 100 times the size of one pointer. That's not impressing me with the inefficiency here.

So you can color me unimpressed with this whole argument on lie #2.

<comment><USER5> You've missed a lot of important real world details about what's going on in the system, which is the heart of what Mike Acton talks about.

> Say what? In C++, you'd simply create another object that is another > instance of the Rocket class. Behold, "more than one".

So now you have a bunch of separate instances of rockets which are probably scattered throughout heap memory which will lead to cache misses on every access. Mike is describing the lost optimization potentials here because you didn't think to reason about how you will use this data.

A simple example, every rocket needs to update its position every frame and probably obeys a velocity equation defined in the game. Iterating through every rocket scattered out through heap memory is already going to kill you with cache misses. But additionally, since all the rockets obey the same equation, we should be using SIMD to compute everything which can let us do 4x-16x operations (or more depending on hardware) for the same cost as doing one. But chances are your Rocket class ivars are not nicely laid out for SIMD (AoS vs. SoA), so you will be forced to copy or swizzle a bunch of data which negates the performance benefits you are trying to win with SIMD. If you designed your data upfront with this idea in mind (many rockets for batch operations), then you get both cache optimization wins and SIMD wins, and now we are talking about speed ups that can be easily 10x-100x. And we haven't even touched the possibility of further parallelizing this across multiple cores.

A real world example they gave at GDC on SIMD was a many-players-to-many-doors problem they had to solve. On every frame, any player near any door had to automatically open like in Star Trek. 30 doors and 100 players means they have 3000 tests they have to run. The original algorithm wasn't data oriented and what Mike Acton would probably call typical C++ BS: A single Door class. On strict CPU budgets to handle everything else in the game, the cache misses alone were worrisome. In the talk they (obviously) convert to SIMD with the idea of 'many' using Data Oriented Design (which also solves the cache miss problem). They got a 20x-100x speed up (depending on the number of players and doors).

</comment></comment><comment><USER7> That font is one of the hardest fonts to read I've ever seen used seriously on a website.

<comment><USER8> Readability ([https://www.readability.com/](https://www.readability.com/)) is a helpful tool for reading sites which with hard-to-read designs: [http://rdd.me/sjahtctg](http://rdd.me/sjahtctg)

<comment><USER9> Readability seems to have ceased all devolopment and communications for the past three years or more. I'd suggest other options.

</comment></comment></comment><comment><USER10> With DAO you are building a refinery- you look at what comes through, how long it takes to process, how its stored and where your pipe has the smallest diameter and what distillation unit takes the longest.

With Object Orientation you will do the same, but with n different typed bottles in boxes, the boxes in containers which are driven around as a whole by trucks. You might be able to do so in great comfort - everybody on this planet knows how to ship boxes. But you will trade off for control and efficiency.

</comment><comment><USER11> I totally disagree that #2 is a lie. Code _should_ be designed around a model of some part of the world, it's just that what the author is describing is a pretty bad way of modeling the world.

Take this part: _" If there's a rocket in the game, rest assured that there is a "Rocket" class (Assuming the code is C++) which contains data for exactly one rocket and does rockety stuff. With no regard at all for what data tranformation is really being done, or for the layout of the data. Or for that matter, without the basic understanding that where there's one thing, there's probably more than one."_

This is an enormous straw man. You don't need to be using C++, or even a real OO language, to design your code around a model of the world. I'd go so far as to say that C++ is a pretty poor choice of language for modeling the real world. And even in an OO language, no decent practitioner writes one-class- per-object. That's not how objects are intended to work, and even pretty bad practitioners of OO don't usually screw it up _that_ badly.

And the underlying thing here is that if you model interactions in the real world accurately, at least the parts that are relevant to what you're trying to do, the data transformations and layout tend to fall into place naturally. Of course there are exceptions; we don't have leak-free abstractions yet.

<comment><USER2> > And even in an OO language, no decent practitioner writes one-class-per- > object.

But that's the stereotypical example of OO design. You have duck->paint(), duck->quack(), duck->plunge() all in one class (file) and of course the dependency mess and the scattering of aspects throughout the project.

These have definitely been problems in my own software design attempts and in many of the projects I've seen.

And even if you make more classes, so that your design is more like one class per concept/aspect, I think the criticism of Mr. Acton is: if you have many instances of a given class, then there must be a better way than calling a method on each individual instance.

In other words, the idea is that classes are fine (they promote modularization), but there shouldn't be more than one instance of each class.

Can't see a straw man there.

<comment><USER11> >> > And even in an OO language, no decent practitioner writes one-class-per- object.

> But that's the stereotypical example of OO design. You have duck->paint(), > duck->quack(), duck->plunge() all in one class (file) and of course the > dependency mess and the scattering of aspects throughout the project.

So much nonsense here. One class per object is absolutely not the stereotypical example of OO design. class != file. And dependency management is usually a problem because junior devs pull in a billion half-baked libraries to solve a problem--it's not an inherent problem with OO and it's _certainly_ not a problem with trying to model the real world.

I'm not even particularly in love with OO. I particularly think that functional paradigms often do a better job of modeling the real world. What I'm really disagreeing with is the claim that modeling the real world is a bad practice.

> And even if you make more classes, so that your design is more like one > class per concept/aspect, I think the criticism of Mr. Acton is: if you have > many instances of a given class, then there must be a better way than > calling a method on each individual instance.

If that was Acton's criticism, then he should have said that instead of saying that "code should be designed around a model of the world" is a lie. Particularly since if you're acting on a large list of objects, then representing it as if you're going through and then each object is acting is a pretty bad representation of reality.

> In other words, the idea is that classes are fine (they promote > modularization), but there shouldn't be more than one instance of each > class.

Now you're just confused. Acton specifically was criticizing one instance per class in the section I quoted, and now you're saying that's what he's supporting?

And for the record, if there's only one instance of your class, you didn't need a class.

<comment><USER2> No need to get personal.

> So much nonsense here. One class per object is absolutely not the > stereotypical example of OO design.

I didn't say that. I said: The stereotypical example is "one class per (concept / class of) real world thing(s)". Like "Rocket" or "Duck".

> If that was Acton's criticism, then he should have said that instead of > saying that "code should be designed around a model of the world" is a lie.

It needs just a little context or reading between the lines to understand the intentions instead of twisting words to make accusations.

> Now you're just confused. Acton specifically was criticizing one instance > per class in the section I quoted, and now you're saying that's what he's > supporting?

I am not confused. He wasn't criticizing "one runtime instance per class", but "one per runtime instance per real world thing". That's something different.

The quote reads _rest assured that there is a "Rocket" class which contains data for exactly one rocket_. I translate, he suggests to combine all "real world rockets" in a single runtime object instead of representing each rocket in its own runtime object.

Concretely, he would make a "Rockets" class instead of a "Rocket" class, because that typically allows for simpler and more efficient implementation. (Of course, if there were also planes or missiles or bullets, he would think twice before making a Rockets class).

As I commented elsewhere on this page, there are very close analogies to relational databases -- especially the column-store flavour.

<comment><USER11> Okay, given your understanding of what he said, I can see why you might agree with him (although I don't), but critically, that's not what he said.

<comment><USER5> Mike has given multiple talks on Data Oriented Design.

Another example he gave at CppCon was a Chair class. In a real game, you may have a static chair, a dynamic lighting chair, a breakable chair, a physics chair. There is a tendency to make these all relate through some common Chair class because they all share some "chairness" in the real world. But in reality, the data and transformations each need have nothing in common and trying to shoehorn them into some relationship because it resembles something in the real world is counterproductive.

</comment></comment></comment></comment></comment></comment><comment><USER12> I'm not sure that code is ephemeral. It seems to congeal into a thixatropic mass. But it's clear that data itself - that mutable-state heterogeneous- structured blob - has deep value, and _handling_ that data appropriately is very important. This isn't treated adequately in the zeitgeist.</comment>


The inside story of Microsoft's secret 'Project Natal' - <AUTHOR> http://www.wired.co.uk/wired-magazine/archive/2010/11/features/the-game-changer

<comment><USER2> Great article, except for the end:

"'Realistically, if you want a one-to- one conversation with an AI-driven character, that's at least five years away,' Andreas says. 'But thinking about where that tech is going,' Burton adds, 'if it's cloud-based, passing the Turing test becomes much easier. You just need a huge internet-like database, then work out how to data mine that.'"

Uh, yeah, easier said than done!

Solving global warming is easy: you just need a huge atmosphere filled with CO2, then work out how to remove that.

</comment><comment><USER3> This is one of those (rare) pieces of technology where I think "How in the world they did that", where I (due to multiple, complex areas of science involved) cannot even imagine how it can be done and this article answers lots of my questions.

Favorite quote: "Incubation is a business of stupidity. If we don't feel stupid, we're not pushing ourselves hard enough."

</comment><comment><USER4> Say what you will about Microsoft, but Project Natal is really, really stunning stuff, even if it only works half as well as claimed. I studied computer vision in grad school; this stuff is _hard_.

Hats off to you, Microsoft.

<comment><USER5> Say what one will, eh? Microsoft Courier. How about if it works 0% as well as claimed?</comment></comment>


To Fight Apple and Google's Grip, Fortnite Creator Mounts a Crusade - <AUTHOR> https://www.nytimes.com/2020/08/25/technology/fortnite-creator-tim-sweeney-apple-google.html <comment><USER2> Why would they use the offensive term "crusade?" People were murdered during the crusades. As a descendant of people targeted by the Crusades, I wince whenever I see this word.

<comment><USER3> Crusade is not an offensive term.

<comment><USER2> Many style guides disagree: [https://www.dailywritingtips.com/crusade/](https://www.dailywritingtips.com/crusade/)</comment></comment></comment>


US court: NSA mass surveillance program exposed by Snowden was illegal - <AUTHOR> https://m.dw.com/en/nsa-snowden/a-54797779?maca=en-rss-en-all-1573-rdf <comment><USER2> Does he get validation for the thousands of documents he disclosed that were unrelated to the illegal domestic surveillance or other domestic activities? He was kind of already validated in the public eye many years ago for the dragnet surveillance reveal, whether or not the letter of the law considered the NSA in violation.

I feel like he would've been much more likely to receive a pardon in the past or next few years if he had only given journalists information about their unconstitutional activities, rather than basically the whole kitchen sink of their operations across the globe.

</comment><comment><USER3> Two large threads about this already:

[https://news.ycombinator.com/item?id=24356741](https://news.ycombinator.com/item?id=24356741) (1637 points/466 comments)

[https://news.ycombinator.com/item?id=24362047](https://news.ycombinator.com/item?id=24362047) (404 points/101 comments)</comment>


Andy Weir, Author of the Martian, Shares Details About His Next Novel - <AUTHOR> http://www.smithsonianmag.com/innovation/andy-weir-author-martian-shares-details-about-next-novel-180958708/?utm_source=twitter.com&no-ist <comment><USER2> Am I the only one who thought the writing wasn't particularly good? Disclaimer: I still haven't seen the movie.

It kind of felt like a throwback to 1950s science fiction where characterization was more of an afterthought than a fully-fleshed out endeavor. I.e. the "I am an idea / political position / plot device wearing a human-suit" school of character design. Except with more pop culture and cool added in this case.

Which isn't to say it wasn't an entertaining book and I didn't heartily appreciate the story!

<comment><USER3> You are not wrong about the writing, which was weak during the parts of the novel that concerned groups of people on Earth or the rest of the crew in space interacting. They all talked with one voice and seemed like stock characters instead of real people to me.

However, the parts with Watley keeping his log on Mars seemed very true to me. Not the fictional occurrences but the tone and style seemed consistent with old-time sailors logs or autobiographies of people caught up in historical disasters.

Interestingly, I attended a book club that discussed this novel, split about 50/50 between engineers and non-engineers. All the engineers agreed that the Watley parts were great and the rest was not so good, but the non-engineers almost uniformly had the exact opposite opinion!

(The film is good)

<comment><USER2> To be fair, it's probably more reasonable to judge it in the stream of epistolary / didactic literature than purely narrative. I remember Defoe's _Crusoe_ and Stoker's _Dracula_ not having particularly inspiring characters by modern standards either.

It is curious about the divergence between engineers and non-engineers. If he ever writes another novel in the same vein, it'd be interesting to collaborate with another author and have a richly-characterized political story on Earth contrasted by a more "engineerly-characterized" space story.

(Keep meaning to watch film, have not gotten to)

</comment></comment></comment><comment><USER4> If you enjoyed 'The Martian', you should read his famous story 'The Egg', if you haven't already:

[http://www.galactanet.com/oneoff/theegg_mod.html](http://www.galactanet.com/oneoff/theegg_mod.html)

<comment><USER5> I like to think that short story was inspired by the [https://en.wikipedia.org/wiki/One- electron_universe](https://en.wikipedia.org/wiki/One-electron_universe)

</comment></comment><comment><USER6> Glad to hear that he's doing another "scientifically accurate". For a while, he was saying that the next book would be a 'typical' space-opera style novel without that aspect, and while I do enjoy that genre, I didn't feel like the writing quality of The Martian would be good enough to carry a space opera.

He's found a niche, something that he is good at, and I'm really glad to see him sticking to this rather than trying to do something that I doubt his ability to pull off.

<comment><USER7> The Martian isn't scientifically accurate, though it's closer than a lot of other stuff. The entire plot device of the storm at the beginning, needed to give a reason for Watney to be abandoned on Mars, was total hogwash: Mars doesn't have an atmosphere thick enough for that. Some other things were questionable too, like the rescue at the end.

Personally, I'd like to see some more movies that really are scientifically accurate, about things in space near the Earth, perhaps one set on the Moon showing a colony there used for asteroid mining and ore refining.

</comment></comment><comment><USER8> I find it kind of sad that he has to take crap just because his lead is a female character. How is this in any way remarkable?

If he announced he's writing a feminist novel or something that specifically addresses gender issues that might have been an interesting line of questioning.

<comment><USER9> Where do you see that he's getting crap for a female lead?

<comment><USER10> They might mean just getting the question "why write a female lead".

<comment><USER9> Why is that "getting crap" though? It's a legitimate question to ask with many possible interesting answers. His answer was actually quite good, no real reason other than it felt right for the character.

<comment><USER11> The flip side is though if he was writing about a man no on would ask the question, which is the issue.

Choosing a male protagonist is default, choosing to write about a women though is strange and needs to be questioned.

<comment><USER12> > Choosing a male protagonist is default

Choosing a protagonist whose gender (and race, etc.) is the same as the author's is the default. I don't think anyone asks Margaret Atwood why she chooses a female protagonist.

<comment><USER13> But they also don't ask why she chose a male protagonist.

<comment><USER12> Margaret Atwood may not be the best example because she so rarely chooses male protagonists, but the gender of the author and how it relates to their characters (and readers) comes up _all_ the time.

It is, for example, why Rowling published Harry Potter as "JK" and not "Joanne"—she didn't want her own gender to affect how readers perceived her book. A large number of female authors have done this over the years.

There does seem to be some asymmetry where male authors struggle to write female characters well and are questioned about it more. I'm not sure where the imbalance comes from.</comment></comment></comment></comment></comment></comment></comment></comment>


World's Largest Yacht to Be Retorted to Clean Up Ocean Platic - <AUTHOR> http://www.techocean.tk/2017/11/billionaire-builds-donates-worlds.html?m=1 <comment><USER2> I believe I met the designer of this vessel 2 months ago. They have some very ambitious goals. Lots of companies are trying to figure out how to provide solutions to the owners demand.</comment>


Show HN: SuperVoc Text to Speech with Google, IBM Watson, Azure and Amazon Polly - <AUTHOR> https://www.supervoc.com <comment><AUTHOR> Hi folks,

SuperVoc is a weekend project (well a few weekends really).

I built it because I needed it for another project (which I'm still working on), that needs text to speech.

I started building it as part of that other project, but then I thought really it could be a standalone site.

Let me know if any problems as I threw it together and launched as quick as possible.

Enjoy!

</comment><comment><USER2> Is the code on GitHub?

<comment><AUTHOR> No, but it's just tied together from all the open code that IBM, Google, Microsoft and Amazon make available to drive their APIs.

<comment><USER2> Would be cool to read about your experience and insights on a comparison across various features, cost, accuracy, quality.

<comment><AUTHOR> If you scroll down the page you can play a whole bunch of examples and do your own comparison.

Some of the voices are remarkably lifelike.

The most lifelike ones are IBM Watson (which I found a bit surprising to be honest), Google Wavenet and Azure Neural. The latter two seems to be based on some sort of AI technology to make the voices sounds more natural.

Amazon Polly does not yet seem to have AI powered voices but presumably they are working on it.

Text to speec has come a long way since the days of SAM that's for sure.</comment></comment></comment></comment>


How the science of human behavior is beginning to reshape the US government - <AUTHOR> https://theconversation.com/how-the-science-of-human-behavior-is-beginning-to-reshape-the-us-government-48145 <comment><USER2> Aren't a lot of psychological studies coming under scrutiny for lack of reproducibility, and now the government is using them in policy design ? This is more than a little unsettling.

<comment><USER3> Did you read the article? They're basically A/B testing their notifications and forms. It's nearly costless and they quickly scrap what doesn't work.

<comment><USER2> From the article " As the evidence for the SBST's programs continues to accumulate, the hope is that behavioral insights become as central in policymakers' thinking as economic ones, helping us build effective policies from the ground up."

My concern is where the behavioral insights are coming from, if they are coming from stringent reproducible tests, that's great. But many recent articles about psychological studies suggest there is crisis in that field, and so called insights need to taken with some salt, especially if the goal is to create national policy.

</comment></comment></comment><comment><USER4> Url changed from [http://qz.com/545515/the-science-of-human-behavior-is- reshap...](http://qz.com/545515/the-science-of-human-behavior-is-reshaping- the-us-government/), which points to this.</comment>


Laravel Nova – flexible admin panel - <AUTHOR> https://laravel-news.com/laravel-nova <comment><USER2> Whilst I understand Taylor has to make a living (I do pay for forge to support him), I am sad that something like this isn't opened to the community as apart of the framework.

<comment><USER3> I totally agree with this. I believe he needs to make a living out of the whole thing, but something that has a wide use-case like this should have been open-source, with some basic feature set at least.</comment></comment>


A Landmark Legal Shift Opens Pandora's Box for DIY Guns - <AUTHOR> https://www.wired.com/story/a-landmark-legal-shift-opens-pandoras-box-for-diy-guns/ <comment><USER2> I'm glad the story brought up the comparisons to the early days when exporting crypto was similarly restricted under munitions laws. That era was similarly full of calls to ban or regulate or backdoor encryption, saying that only terrorists or evildoers had need of such "military-grade encryption."

Putting aside the specifics of the gun control/rights question (if such a thing is possible), it's downright refreshing to see this guy's attitude. It's reminiscent of some of the earlier, more libertarian hacker ethos, of being focused on being able to do something and fighting hard against authority figures wanting (justifiably or no) to step in to suppress it. With the growth of the SV tech industry, it seems a lot of that fire has been stomped out.

<comment><USER3> Why on Earth would we want to blindly cultivate that attitude? Sometimes authority figures overreach, but plenty of laws exist for good reason. We wouldn't look at someone trying to make it easier to distribute child pornography and say "putting aside the specifics of the child pornography question, it's refreshing to see this guy's attitude."

The outcomes of our actions matter. Fighting for something unethical against authority figures who justifiably want to suppress it isn't praiseworthy, it's shameful.

<comment><USER4> Guns can be used for good, and they can be used for bad - exactly the same as cryptography. Child porn is something that relies exclusively on exploiting people who cannot in any way consent to the actions involved. It's in no way comparable. The conversation beyond this depends on your view of the role of government, and _opinions_ there vary. I see the role of the government as maximizing freedom and liberty for people to live and prosper (or fail) in accordance with their own actions. Banning items which the vast majority are completely capable of handling responsibly because of a tiny minuscule of abusers is not something that I think the government should ever do.

And really the fundamental problem is not guns, it's people wanting to hurt other people. London is a good example of this issue. As the demographics and state of that city have changed, their crime and murder rates have soared. Even with extremely strict gun control, they managed to briefly surpass New York City in murders. This has now led their government to begin to implement, literally, "knife control" along with "acid control" given a rise in people spraying others with things such as drain cleaner, as a weapon. And when the perpetrators start killing people with steel rods, will we then move to try to ban weights? If people want to kill or hurt each other, they're going to find a way. Looking at the way is missing the actual problem - which is the people that want to kill or hurt other people.

<comment><USER3> With regard to the "fundamental issue", number of guns is extremely highly correlated with a high murder rate [1]. General crime rate, on the other hand, is not [2]; London's brief passage of New York in murder rate belies this.

More generally, though, OP's statement was explicitly made _without_ regard to whether gun control was right or wrong. It supported standing up to authority figures in the abstract, which is why I used child pornography as an example of something authority figures are (uncontroversially) generally regarded as right in suppressing.

[1] [https://www.nytimes.com/2017/11/07/world/americas/mass- shoot...](https://www.nytimes.com/2017/11/07/world/americas/mass-shootings-us- international.html)

[2] [https://www.vox.com/2015/8/27/9217163/america-guns- europe](https://www.vox.com/2015/8/27/9217163/america-guns-europe)

<comment><USER4> He stated literally that the action was _' reminiscent of the earlier, more libertarian, hacker ethos'._ You are straw manning his comment.

As for the issue, do you really think news articles are reasonable sources on an issue like this? This [1] is a list of countries by intentional homicide rates. This [2] is a list of countries by gun ownership rates. Here's a sampling of your "extremely high correlation."

\</comment></comment></comment></comment></comment><comment>

Top 5 Countries by Gun Ownership -- Intentional Homicide Ranking (lower means more homicides)

1\. USA -- 90

2\. Serbia -- 170

3\. Yemen -- 77

4\. Cyprus -- 179

5\. Saudi Arabia -- 166

\</comment><comment>

Top 5 countries by Intentional Homicide Ranking -- Gun Ownership Ranking (lower means more guns)

1\. El Salvador -- 92

2\. Honduras -- 90

3\. Venezuela -- 60

4\. US Virgin Islands -- unranked

5\. Jamaica -- 73

\</comment><comment>

The numbers get even sillier if you do the top 20. You have to remember that some of the gun heaviest nations in the world include Norway, France, Canada, Austria, Iceland, Germany, Finland, Switzerland, New Zealand, etc.

<comment><USER3> The full sentence you quoted, and the preceding one:

 _> Putting aside the specifics of the gun control/rights question (if such a thing is possible), it's downright refreshing to see this guy's attitude. It's reminiscent of some of the earlier, more libertarian hacker ethos, of being focused on being able to do something and fighting hard against authority figures wanting (justifiably or no) to step in to suppress it._

i.e. it's "refreshing" to see someone fighting against authority figures, whether or not those authority figures are justified. I'm not straw manning his comment; I simply disagree that the "earlier hacker ethos" he describes is something to be revered, and I've explained why.

You are cherry-picking the data in your charts to support your conclusion. The US Virgin Islands, for example, has barely 100,000 people; the US has 320,000,000. Just 4 gun homicides per year there would vastly exceed the US's gun homicide rate.

<comment><USER4> He specifically says the earlier, _more libertarian_ , hacker ethos. While libertarianism ethos would not be in support of child porn, it is in support of many things that people might believe are justifiably prohibited. For instance, many of a libertarian ethos feel that all drugs should be legalized under the logic that the government has no right to tell people what they can or cannot put in their own bodies. This is debatable however, and an example of something that somebody might want to fight against ( _perhaps by telling people how to grow /refine various drugs_), even if others might argue it is something that is justifiably prohibited.

When you're trying to find a correlation between homicide rate and guns per capita, you think looking a listing of nations by homicide rates and guns per capita is cherry picking? If so then, at the minimum, you've got some crazy cognitive dissonance going on. Though I failed in my last link to include the sources. You can see quite clearly that if there is any correlation, it's would be an inverse - though I would not suggest causality there. As I said, the problem is not guns - it's people. And even if the countries the fewer undesirables have more guns, I expect that is probably just a spurious correlation.

[1] = list of countries by intentional homicide rate

[2] = list of countries by guns per capita

[1] - [https://en.wikipedia.org/wiki/List_of_countries_by_intention...](https://en.wikipedia.org/wiki/List_of_countries_by_intentional_homicide_rate)

[2] - [https://en.wikipedia.org/wiki/Estimated_number_of_guns_per_c...](https://en.wikipedia.org/wiki/Estimated_number_of_guns_per_capita_by_country)

<comment><USER3> _> He specifically says the earlier, more libertarian, hacker ethos._

Which was explicitly described as trying to fighting against authority figures' attempt to suppress something, whether or not they were justified. I don't know how much clearer that can be.

 _> When you're trying to find a correlation between homicide rate and guns per capita, you think looking a listing of nations by homicide rates and guns per capita is cherry picking?_

Choosing to ignore other evidence which refutes your claim (in this case, the wide population disparities that prevent direct comparison of the two lists, due to high variance in countries with low populations) is cherry picking.

<comment><USER4> If I say, 'this action is reminiscent of a ruthlessly capitalistic ethos, trying to make a profit wherever one is to be made' that doesn't mean you're endorsing for instance the holocaust even though seizing the possessions of the victims there probably showed a net profit.

There's a reasonable argument to be made for restricting the nations to some minimum population. The typical figure is 250k-300k which is also likely conservatively high. The reason your article wants to restrict the data to populations of 10 million is precisely to cherry pick. For instance this [1] is the murder rate for Jamaica, a country of some 2.8 million, over the past 5 years. The numbers themselves have some variance, but the rate's magnitude is relatively unchanged because of how high that scale is. It ranges from something like 600% to 900% higher than the US over those numbers. It's the same thing domestically within the US. Places like Detroit have obscenely high and consistent murder rates. The population? 672k. Guess we can just discount it as variance?

You can find the sort of same head-in-the-sand attitude when discussing matters with people on the opposite end of the spectrum. For instance, Scandinavia has done some great things. But wait... What about the population? Sweden? 9.9 million. Denmark? 5.7 million. Norway? 5.2 million. Finland? 5.5 million. Iceland? 0.3 million. Well I guess we can completely discount Scandinavia for any and all statistics. Since none of the nations reach that magic 10 million mark, they must be completely irrelevant. Right?

[1] - [https://pbs.twimg.com/media/C2_nhWaXUAgKKfq.jpg](https://pbs.twimg.com/media/C2_nhWaXUAgKKfq.jpg)

<comment><USER3> _> If I say, 'this action is reminiscent of a ruthlessly capitalistic ethos, trying to make a profit wherever one is to be made' that doesn't mean you're endorsing for instance the holocaust even though seizing the possessions of the victims there probably showed a net profit._

Right, except my reaction is to the literal description of the attitude in question, not something that happens to incorporate it. The statement was "I admire X, which is a component of Y", and I'm saying "I find X, specifically, objectionable".

No one is claiming 10 million is some magic statistical number for sample sizes; _that_ is a straw man.

<comment><USER4> Ahh. I would rarely consider, let alone object, to things outside of context. X of course means very different things given varying Ys.

The reason I am talking about 10 million is because it's the magical number that the study the NYTimes chose to run an article on, decided to pick. It has nothing to do with reducing variance, though of course that's used as the justification. In reality even in populations of tens of thousands there is surprisingly low variance in homicide rates.

I mean if you look at what they're doing it's really scummy. They're juking their numbers to try to create a correlation when one does not exist. That's already really bad. But then they take it a step further by just jumping to correlation = causation. Try to imagine that this was a topic that did not confirm your biases. I think you'd be out of your mind with how really trashy this whole article is. It's like they took a list of things you should not do when reporting on statistics, and decided to do them all.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I don't see the story here. You could always make guns. So now you can make them a certain way and it's a Pandora's box?

<comment><USER6> The story is the perceived loss of control over who can (and will) make guns. The thinking being that by publishing the info on the net a great many people who wouldn't have otherwise bothered to figure out how to do so will now make guns. And of course, since the net isn't limited by geography per se, now the issue becomes one of international concern.

For the record, while I expect that there will be an uptick in interested parties, I don't think it will of epic proportions because at the heart of it, people are lazy.

I do, however, wonder how the gun manufacturers feel about this.

<comment><USER7> Just for an example, this is what happens when people need to make guns on the cheap in field conditions: [https://en.wikipedia.org/wiki/Sten](https://en.wikipedia.org/wiki/Sten)

Quoting: "the most basic model, the Mark III, could be produced from five man- hours of work". In any machine shop having as advanced technology as welding and metalworking.

</comment></comment></comment><comment><USER8> > _where firearms result in tens of thousands of deaths a year_

> _" I'd call a militia out to defend the server, Bundy-style," Wilson says > calmly, in the first overt mention of planned armed violence I've ever heard > him make._

I don't see why Wired sees fit to defame and misinterpret people, and misrepresent the facts on this topic. If they're so right, why not let the facts speak for themselves? Calling a militia out to defend the server is not _planned armed violence_ , it's _planned armed defence_ : not even the responding militia wants there to be any actual violence, if anything the armed militia _decreases_ the likelihood of violence occurring (nobody's going to serve a forcible no-knock on a room full of armed men defending a mere library, and engaged in the commission of no offence).

</comment><comment><USER9> You know how everybody is worried about machines taking over human jobs and the resulting unemployment? Well, sort of like Calvin's rant on never being able to die, I think there will be so much demand for staffing in the field of dystopia management and prevention that the chance of that happening is really slim.</comment>


My First Year On My Own In Review (2012) - <AUTHOR> http://www.entrelife.com/2013/01/my-first-year-on-my-own-in-review-2012.html

<comment><USER2> Great post. As for consulting, I have had some really awful experiences and some really good ones.... Here are some tips that might help you with your 2013 goal to consult more.. 1\. Unless its an established client, take at least a 10-20% fee up-front once you and the client AGREE ( as in, they agree in writing by email or on paper ) on the requirements. 2\. Then take 50% of the balance upon demo when the client agrees that the app is up to their liking followed by the remaning 50% on app launch.

Of course, you can vary the percentages to you liking but this has worked great for me so far...

Where I went wrong was being too eager to get the business and getting started on a project without getting any money upfront.

If they are serious about the project and generally a professional entity ( person/business ) they will pay upfront..otherwise run like hell.

You will obviously make a few mistakes along the way but you will get the idea of filtering clients the more you consult.

Some clients can be more demanding than the others, but in general as long as they are paying, you will be alright!

Good luck and thanks for the great post!

</comment><comment><USER3> Hey, interesting post. Thanks for sharing. I had a few questions:

Did you do anything special for Debt Snowball that made it more successful than your other apps, or was it just a good product?

Do you do all the design and code for your apps, or do you outsource graphic design?

Are you worried that developing on 5 platforms will spread yourself too thin?

<comment><AUTHOR> I didn't do anything different per se, but I did have a little bit of luck at launch. I generally send emails to some of the top bloggers to try to get reviews, and by virtue of it being good with a really nice looking design, I got 2 good reviews in the same day. Those sales plus any organic sales pushed it pretty high.

I do all the code and I've done varying levels of outsourcing the design. I've done all the design for some smaller apps, I've hired people using elance.com, and more recently I've been partnering with some top level designers (Debt Snowball+ was partnering with a really good designer).

As for spreading too thin, I hope not. I won't be doing all of my apps as I don't have nearly enough time for that. There is only 1 app at this point that makes sense on desktop, and I only plan on doing the most successful apps on the other platforms for the time being. We'll see how it goes, but I think the diversification will be very much worth some amount of spreading thin.

</comment></comment><comment><AUTHOR> OP here. Feel free to ask me anything.

</comment><comment><USER4> Good stuff thanks</comment>


Maxims or Myths of Beauty? A Meta-Analytic & Theoretical Review - <AUTHOR> http://www.jonathanstray.com/papers/Langlois.pdf

<comment><AUTHOR> Langlois et al 2000 excerpts: [https://plus.google.com/103530621949492999968/posts/TaUWk5du...](https://plus.google.com/103530621949492999968/posts/TaUWk5duC3B)</comment>


Chinese Window Lattice and CSS - <AUTHOR> https://yuanchuan.dev/2019/05/15/window-lattice-and-css.html <comment><USER2> Nice demo. Reflecting complex content like text with effects is hard and this reflection technique could definitely help, but for simple geometry and tiling it is quite trivial to put "pure SVG" into CSS as a background-image and let CSS do the tiling: vector goodness remains preserved, no "DOM polution" happens, and everything stays in CSS, even could remain in readable state.

Some doodles using this approach: \- Using SVG as real XML and explotiting custom entities for fun: \-- [https://codepen.io/myf/pen/yqjQdz?editors=0100](https://codepen.io/myf/pen/yqjQdz?editors=0100) \- Comparing SVG with CSS shape emulation using gradients: \-- [https://codepen.io/myf/pen/Bzmmry?editors=0100](https://codepen.io/myf/pen/Bzmmry?editors=0100) \- SMIL animated SVG background: \-- [https://codepen.io/myf/pen/ZNbrLq?editors=0100](https://codepen.io/myf/pen/ZNbrLq?editors=0100)

<comment><USER2> (Here is realization of that "plain SVG in SVG in CSS" approach:

[https://codepen.io/myf/pen/QRgVdN](https://codepen.io/myf/pen/QRgVdN)

It is in fact nothing more than

        body {
        background-color: dimgray;
        background-image: url('data:image/svg+xml,\
        <svg xmlns="http://www.w3.org/2000/svg" \
        viewBox="-3 -3 6 6" stroke-width=".1">\
        <path id="p" fill="none" stroke="black" \
        d="M-2-1v1h1v-1h1v-1h-1zh-1v1h1zh-1v-2h2v1h1v-1h-1.51l-1.5 1.5" />\
        <use href="%23p" transform="rotate(90)"/>\
        <use href="%23p" transform="rotate(180)"/>\
        <use href="%23p" transform="rotate(-90)"/>\
        </svg>');
        background-size: 25vw;
        }

(Rotations instead of flipping because reasons. Making this work in IE would require extra URI encoding of bracket characters (at least).)

</comment></comment><comment><USER3> One of the example images causes an optical illusion for me:

[https://yuanchuan.dev/assets/images/post/lattice/going- deep....](https://yuanchuan.dev/assets/images/post/lattice/going-deep.png)

</comment><comment><USER4> If you like this, you may like Lea Verou's CSS3 Patterns Gallery library. [https://leaverou.github.io/css3patterns/](https://leaverou.github.io/css3patterns/)

(make sure you allow the cross site request of [http://bytesizematters.com/bytesize.js](http://bytesizematters.com/bytesize.js) which is hosted on another of her domains if nothing is displaying)

<comment><USER2> Or [https://www.heropatterns.com/](https://www.heropatterns.com/) seems nice. Not CSS "gradient shapes" like Lea's collection but SVG background images.

</comment></comment><comment><USER5> With SVG seems like you could divide the author's seed in half (as if using a backslash for the slicer).

Then the seed could be a path with only seven line segments.

That could then be scaled by -1 to get the other half to arrive at the author's seed.

Finally, a few <pattern> elements would be enough to fill in the rest, though I'm not certain which way would produce the least amount of code. There's probably even a tinier code path using nested <pattern> elements. :)

Edit: Also-- either two continuous line segments with one overlap, or three with no overlap. And some "v" and "h" commands in there to be extra terse. :)

<comment><USER6> You could do this easily in SVG, or canvas, or webgl if you're only drawing lines. The benefit of CSS is that you can use any HTML element, and it'll be interactive so hover states and event handlers will work (on the original at least, and I assume the reflection as well, but I'd need to test that). That's a big win.

(Technically you could do it using HTML in an SVG by leveraging the ForeignObject element as well, but that's still more complicated than CSS.)

<comment><USER7> > _The benefit of CSS is that you can use any HTML element, and it 'll be > interactive so hover states and event handlers will work (on the original at > least, and I assume the reflection as well, but I'd need to test that)._

Hover states work fine in SVG as well, and if you don't care about those, you could just use a pattern.

</comment></comment></comment><comment><USER8> Impressive.

What I see is that CSS is slowly becoming more and more of a programming/Turing complete and/or graphics language, rather than simply just stylesheets.

<comment><USER9> Becoming a programming language and enabling awesome creative, aesthetic, and cultural expressions. Both processes feeding off each other.

HTML, CSS, SVG, etc. are wonderful things that I hope we perpetuate.

<comment><USER10> The article is basically a long exercise in avoiding repetition of the source content. For no good reason other than code aesthetics.

The webkit reflect operation can be decomposed into a CSS transform and repetition. If there was some sort of template expansion, you could avoid the repetition entirely.

But people have a hard on for doing it this way instead, even though it just means adding more special case operators to CSS, instead of designing a proper layout and styling system based on orthogonality.

Wonderful is not the word I'd use.

</comment></comment></comment><comment><USER11> If I have to guess, maybe this wasn't accepted because if you nest your elements wrong, you could easily eat up all your CPU cycles.</comment>


Why Apple's 3.3.1 is great for hackers and (smart) founders. - <AUTHOR> http://andreyf.tumblr.com/post/522294486/why-apples-3-3-1-is-great-for-hackers-and-smart <comment><USER2> If you think that license agreements have terms only to be enforced in reasonable cases then probably you also believe that laws that do not make sense will not be used in cases where they really shouldn't.

By introducing a bunch of legalese in its license agreement that states you are not allowed to do a bunch of stuff, then to willfully transgress those rules predicated on

       "apple doesn't care and doesn't have the resources to go after you"

is setting yourself up for a big fall. If you happen to be successful _and_ you happen to be in the way of apple in some way or other you've just handed them your termination clause on a platter.

It's a bit like saying everybody should drive too fast because the government doesn't have the resources and they don't care about it too much anyway. Until some law enforcement officer decides he needs a 'probable cause' to go after you. Of course, since the government doesn't have the resources to go after every driver that would never happen, would it ?

If Apple doesn't care about 'high level languages' they should re-write their terms, and say what it is that they're really after, in stead of 'smart founders' and 'hackers' reading the mental message between the lines that this isn't really about them and will never be enforced.

I don't think Apple should have a say about what stuff runs on computers they sell anyway, if they want to get in to the rental business that's fine with me but then they should say so outright. It looks like these devices are being _sold_ , not rented to me, so Apples influence over them should end as soon as they leave the store.

<comment><USER3> I think Section 3.3.1 is good for hackers in a very different way than explained in the blog post. Good hackers will (by and large) follow the law for their _commercial_ endeavours rather than try to work around Apple's insane (and ever shifting) policies. I for one wouldn't set out to build a _business_ based on explicitly breaking the law and with the _possibility_ of a lawsuit looming.

That said, the IPad, IPhone and AppStore have raised the bar for UI design, user installation, sales (and payment) processing and so on where there is now a clearly defined "what hackers want" gap in the ecosystem. The Apple AppStore is an existence proof of what is possible and this is orthogonal to languages used and so on (as demonstarted by games using Unity3D).

Hackers want to build their own languages that compile down to the "native" language and APIs but they also want the AppStore style payment processing and so on with better facilities for updating our apps, a faster and more comprehensive review cycle (assuming that a review is a good thing) and so on.

If someone (Google? Microsoft? someone totally new? ) were to fill this gap (and someone eventually will), it will be "good for hackers". Section 3.3.1 is good insofar as it will spur development of alternative ecosystems and force disgruntled hackers off the Apple path. No one who _has a choice_ and wants to stay within the bounds of the law will accept such inane terms and conditions. Microsoft had far less onerous policies and far less competition than Apple in the mobile space, and yet, over many years there was a drain of top class developers from MS's platforms to Linux/BSD and later to Apple. Once upon a time MS was the _only_ game in town for commercial projects. The advent of teh Web and Open Source changed that game. The same scenario, with different players and technology, will play out with Apple, but it won't be instant and will take a while.

<comment><USER4> You comments about the importance as an existence proof of the creation of this ecosystem are I think the most interesting and useful thing I've read in all these Section 3.3.1 discussions. Thanks!

</comment></comment></comment><comment><USER5> This is like apologizing for the Patriot Act. As long as you play nice with the feds and you don't look like one of the undesirables, we won't mess with you.

<comment><USER6> The blog post strikes me as a pragmatic observation rather than an ethical justification. It makes a very good point too.

If you use an in-house tool that compiles lisp/ruby/whatever to Objective C, I seriously doubt Apple is going to go through the trouble of detecting this. Even if they did, I don't see them giving two shits as long as you follow the HIG, stick to public APIs and keep the tools to yourself.

Since the do-gooders can't release the tools publicly, the only people who have them are the people who can make them. If you are one of those people, you can probably come out ahead from this whole debacle, even if it doesn't give you a warm freedom fuzzy inside.

<comment><USER7> The flip side is the consumer side: This isn't good for the consumer. I simply have no desire to add apps now, knowing that Apple can remove them at any time. Especially now with all the changes, it's obvious that even a 'legal' app might be removed. Or updates won't be approved. There are just so many problems.

I realize that the average consumer won't see this, but it's a problem. You could argue that it benefits the consumer, because better apps will get through. With more restrictions, less apps will be sent in, freeing up more manpower to approve legit apps quicker. This might happen.

Still, I try to avoid buying software that I can't install at any time, and I avoid buying into harsh DRM. I don't always succeed, but I don't want to rely on a single vendor who has proven their willingness to eliminate popular content, stall important updates, and drastically change rules whenever they please.

</comment></comment></comment><comment><USER8> The piracy comparison is bogus. I don't think anyone is worried about Apple suing them for using Flash/MonoTouch/whatever. The problem is investing a month or three into writing an app only for Apple to say "Nope, sorry."

Or even worse, getting your 1.0 in the App Store, only to have your 1.1 rejected as their "defenses" against translation layers grow stronger with time. It's a peculiar case of FUD against your own partners.

<comment><USER2> It's the weirdest thing ever. To try to control what software runs on your computer is already way out of bounds, to try to limit the _tools_ that can be used to produce software is simply nuts. Developers are a platforms best friends, it's the applications that will make or break it once the 'novelty' factor wears off.

<comment><USER4> It's not _entirely_ nuts if Apple's game is to maintain its lead in the smartphone market by suppressing development on other platforms.

I think Apple is past the "novelty" stage now; the price will be paid in the longer term as certain classes of developers only develop for those other platforms (either they use cross platform tools or non-blessed tools (Scheme, Lua, whatever)). This also makes things messy for companies like Sugar for which there's no compelling reason to make a _really_ good native app, the value they sell in more in what's behind it.

On the other hand, while Apple's approval capriciousness has been a significant issue, this hits developers closer to home in a day in, day out way. And even if they're using blessed tools today, they might aspire to use higher level stuff later. E.g. after they see how much faster it can be to develop with a REPL.

</comment></comment></comment><comment><USER9> I suspect that many people are planning to pass under the radar with their own custom made solution. The reason why we haven't heard more about it is that it depends on secrecy, and if that's your plan then writing a blog post about it would be about the dumbest thing you could do.

<comment><USER4> Arrgh ... yep, and that's another hit by Apple against good development practices and the general improvement in our ability to develop software that the Internet has brought.

Starting in 1996 when I've always had the net available while developing software my productivity has steadily increased, whether it was finding a snippet of free code for CRC calculations (the first thing I can remember) or higher level stuff.

</comment></comment><comment><USER10> I wonder how far you could get bending a combination of the C, C++, Objective-C, and the C preprocessor (assuming it's allowed) to you will to come up with an interesting new language.

But I guess most people don't want a _new_ language, they want whatever existing non-Objective-C language they're already comfortable with.

<comment><USER11> In the jailbreak scene, a lot of us abuse the C preprocessor and Objective-C's runtime functions to make method hooking simpler.

Example: <http://wiki.github.com/rpetrich/CaptainHook/>

</comment></comment><comment><USER12>
        csc helloworld.scm
        strings helloworld.scm|grep -i chicken|wc -l

        2

There are more giveaways that may be harder to hide. I suspect most other cross-compilers have similar giveaways. I suspect Apple will use an automated tool to check for them

</comment><comment><USER13> I said pretty much the same on "Lambda the ultimate", <http://lambda-the- ultimate.org/node/3905#comment-58598>

<comment><USER14> Your comment on LtU reads like satire :)

"Hey ya know, the good thing about WW3 was we all learned really useful survival skills like how to get all the meat offa rat and such."

<comment><USER13> :-)

</comment></comment></comment><comment><USER15> He mentions even ObjC compiles down to C. He neglects to mention it does so with the aid of a runtime that a native C app would not have, and is easily detectable.

<comment><USER16> Writing your apps in C is within the terms of the agreement. As is writing your code in Javascript if it is interpreted by Webkit, which is why _Phone Gap_ seems to be okay.

"...Applications must be originally written in Objective-C, C, C++, or JavaScript as executed by the iPhone OS WebKit engine, and only code written in C, C++, and Objective-C may compile and directly link against the Documented APIs..."</comment></comment>


Tim Ferris comments on his move from Silicon Valley - <AUTHOR> https://www.reddit.com/r/IAmA/comments/7erct8/i_am_tim_ferriss_host_of_the_tim_ferriss_show_and/dq6zrh1?context=1 <comment><USER2> This is a dupe ([https://news.ycombinator.com/item?id=15762035](https://news.ycombinator.com/item?id=15762035))

<comment><USER3> Thanks, we've moved the comments there.

</comment></comment><comment><USER4> You can come up with whatever arguments to backup and support your decision.

It's ok to say I don't know I just feel like making a change.

Most arguments mentioned aren't new and existed for the longest time.</comment>


Reddit is read-only? - <AUTHOR>

Reddit has been stuck in some sort of read-only mode for quite some time now, (five hours so far?)<p>It is confusing me immensely.  I will to them my inner-admin karma the best of luck. <comment><USER2> it looks like ec2 is messed up tonight. i am guessing reddit is trying to stay above water until things get sorted out.</comment>


4 steps to motivate yourself - <AUTHOR> http://irisalden.blogspot.com/2011/05/my-own-advice-i-need-to-remember-to.html

<comment><USER2> Putting it up on my wall!</comment>


Show HN: Epiverse – kind of like AlienTube for all websites - <AUTHOR> https://epiverse.co/ <comment><USER2> When you say alientube for all websites I think this replaces comment threads from websites (eg Disqus on blogs) with Reddit comments from where that site was submitted to Reddit. That would be something I install.

This looks nice but like the others I've seen doing the same thing I'm not interested until it's big.

<comment><AUTHOR> Yes, that's literally what it does.. (in addition to allowing users to comment on webpages)

Well it doesn't actually _replace_ the other comments I guess, it just lets you view the Reddit ones as well. There's a demo on the home page, you don't even need to install it to try it.

</comment></comment><comment><AUTHOR> So I posted this around 9 months ago, and was given some great feedback. Specifically that to attract users, it helps to have some content in place already.

The extension is a web discussion tool that allows users to view and post comments on all webpages. I've now included the ability to view the corresponding Reddit comments as well, which I think is pretty useful.

Please let me know what you think, any feedback is greatly appreciated.

E: Unfortunately it doesn't work well on HackerNews threads, due to the way items are presented as URLs. I can make an exception which would fix it, if people are interested?</comment>


How do remote companies handle psychotherapy for their employees? - <AUTHOR> What do you do when, as a remote company employee, you need psychotherapy or help in mental related issues?<p>Have you felt like feeling psychotherapy when working as a remote employee? What have you done to feel better? <comment><USER2> I think that any employee, whether remote or not, should see a therapist if they are suffering from depression or any other mental health issue.

Hopefully your employer provides you with a healthcare coverage plans which includes a mental health benefit.

<comment><AUTHOR> Thanks for your answer. My company does provide health care, the issue is that as a remote worker I don't want to start face-to-face therapy. I've looked for online therapy but I don't like the things I find.</comment></comment>


Ask HN: Looking for Country/TimeZone/Currency Database - <AUTHOR>

Can any one share an OpenSource data set that contains Country/TimeZone/Currency <comment><USER2> Country/currency is available from [http://www.currency- iso.org/en/home/tables/table-a1.html](http://www.currency- iso.org/en/home/tables/table-a1.html) . See also ISO 4217 [https://en.wikipedia.org/wiki/ISO_4217](https://en.wikipedia.org/wiki/ISO_4217) . I found them by a Google search for "country currency database". The second hit was [http://stackoverflow.com/questions/9392740/database- currenci...](http://stackoverflow.com/questions/9392740/database-currencies- by-countrycode) which links to various resources.

For timezones you likely want the tz database, see [http://en.wikipedia.org/wiki/Tz_database](http://en.wikipedia.org/wiki/Tz_database) . I found it by a Google search for "timezone database". The first hit was to [http://www.iana.org/time-zones](http://www.iana.org/time-zones) .

</comment><comment><USER3> Country Codes, Dialing Codes, Currencies and TimeZones of Countries

[http://fasteri.com/list/country-code-dialing-code- currency-t...](http://fasteri.com/list/country-code-dialing-code-currency- timezone-of-countries.html)

</comment><comment><USER4> For location-timezone, try [http://en.m.wikipedia.org/wiki/Tz_database](http://en.m.wikipedia.org/wiki/Tz_database)

For country-currency, scrape Wikipedia?</comment>


An overview of all possible calls in Elasticsearch - <AUTHOR> http://elasticsearch-api.info <comment><USER2> Man it's almost like there isn't an incentive to clearly and simply document open-source projects that are maintained largely by companies that profit from service contracts

</comment><comment><USER3> This is handy. I find the documentation at the official website to often be severely lacking in many cases, so any additional resources are most welcome.

<comment><USER4> It blows my mind that they are actively opposed to supplying Javadocs. There is a 3-year issue regarding sharing documentation, with the only response along the lines of "just look at the source". The item was finally closed when other developers created servers to host the javadocs, though many of the method names don't have any documentation besides their method signature (ie method name, input types/names, and output)

<comment><USER5> There are $1600 2 day developer sessions concerning all things Elasticsearch offered by elastic.co . The cynic in me might assume that they give just enough documentation to let you know something is possible, but not enough for you to easily do so without the training. :)

</comment></comment></comment><comment><USER6> this is a great resource, wonder how the underlying docs.json is being created. would like to see it being extended to explain the query dsl.

fyi, the table doesn't render in Safari browser.

<comment><AUTHOR> thx, will look at that. The docs.json is being generated from the rest-api- spec repo ([https://github.com/elastic/elasticsearch/tree/master/rest- ap...](https://github.com/elastic/elasticsearch/tree/master/rest-api- spec/src/main/resources/rest-api-spec)). Will see if I can add more on the query dsl as well.

</comment></comment><comment><USER7> This is great! Nice work. I will be bookmarking this. Cheers.

</comment><comment><USER8> Doesn't seem to work on mobile safari. Tapping links doesn't do anything.

<comment><AUTHOR> Will take a look at this.

</comment></comment><comment><USER9> Would be nice to filter on version, because we use several different versions at our company, and ES tends to change fast.

</comment><comment><USER10> Based on which Elasticsearch version was this generated?

<comment><AUTHOR> To be sure, I did it a few months again. Will update and add the version as well. That will allow everyone to choose the right version.

<comment><USER10> Awesome, thanks. Elasticsearch changes a lot between versions (at least the query and filter api), so that will be very valuable.

<comment><AUTHOR> Don't know if you've seen it, but different versions have been added.

</comment></comment></comment></comment><comment><USER11> This is phenomenal.

<comment><AUTHOR> Thx!

</comment></comment><comment><USER12> would be even great if there're examples</comment>


Show HN: My open source, minimal CS Conference Tracker - <AUTHOR> https://github.com/bamos/conference-tracker

<comment><USER2> This looks neat! I keep a similar list for conferences focused on web operations. All the data is in a YAML file, and it's four lines of ruby (excluding the template) to generate the site.

[https://github.com/webopsconferences/webopsconferences.githu...](https://github.com/webopsconferences/webopsconferences.github.io)

[http://www.webopsconferences.com/](http://www.webopsconferences.com/)

</comment><comment><USER3> We published a huge list of conferences at [http://techconfs.co](http://techconfs.co). List has not been updated yet for 2016 dates, but maybe you can find some new conferences of interest on the site.

</comment><comment><USER4> Nice idea. I've wanted something like this before when I was looking for cool conferences to attend. I added OSCON to it.</comment>


Physics Simulations - <AUTHOR> https://www.myphysicslab.com/ <comment><USER2> Awesome stuff! A few months back I found a double pendulum simulation in less than 100 lines of JavaScript. It was a ton of fun to play around with the code.

Code and explanation: [http://www.physicsandbox.com/projects/double- pendulum.html](http://www.physicsandbox.com/projects/double-pendulum.html)

Demo: [http://www.physicsandbox.com/projects/double-pendulum- sim.ht...](http://www.physicsandbox.com/projects/double-pendulum-sim.html)

<comment><USER3> For an accurate double pendulum you almost certainly need a symplectic integrator---not just Euler's method---or risk numerical instabilities that come from nonconservation of energy.

<comment><USER4> An integrator that is symplectic or conserves energy isn't necessarily accurate, especially if the dynamical system is chaotic. Can you recommend particular algorithm that is accurate for pendulum or double pendulum?

</comment></comment></comment><comment><USER5> When I selected the double spring and pulled back the outer mass, as I let go the distance between the two masses went negative. This caused a runaway effect, sending system energy towards infinity.

Cute but the models are not very robust

<comment><USER3> This can be fixed with a more reliable integrator, at the expense of computational speed.

</comment></comment><comment><USER6> cool! Included here: [https://www.tapirgames.com/blog/open-source-physics- engines](https://www.tapirgames.com/blog/open-source-physics-engines)

<comment><USER7> These all look like physics engines for graphics rendering. They all say 2d or 3d, and that means they surely can't handle concepts like relativistic spacetime.

Do you know of any libraries for doing 'backend' physical simulations, such as calculating scattering amplitudes, making projections of spacetime models onto either space-like or time-like slices, and, especially, using tensor networks for modelling condensed matter interactions?

<comment><USER8> Writing a general engine to do all these things is likely not a reasonable thing to do.

Complicated dynamical systems usually involve solving PDEs and for that you need to discretize your domain. How you choose to do so will drastically affect the numerical properties of your simulation. Most "real-physics" simulators tend to be specialized to a given task or even a given domain (for example simulating heat diffusion in an engine part). There's a whole literature on finite element methods to simulate various physical phenomena though it can be quite dense.

The generic game physics engines use very simple models of mechanics and allow for numerical issues (e.g. by using finite differences) in exchange for being real-time. If you're looking to simulate more advanced physical phenomena for a game, you're going to have to make similar trade-offs and will have to choose which ones make for the best gameplay.

<comment><USER9> > The generic game physics engines use very simple models of mechanics and > allow for numerical issues (e.g. by using finite differences)

Most modern game physics engines aren't actually discretizing an ODE or a PDE, at this point. The current standard techniques (see Nvidia's PhysX, for example) are instead solving something that look like a constraint satisfaction problem but gives force-like effects. You don't even get consistency under refinement with these methods, but they are cheap, and importantly, stable when terminated early (to remain under strict time budgets required of game based physics).

<comment><USER8> Interesting. So are these minimizing some constrained energy based on the physical properties and current state of whatever you're trying to simulate? If so, I don't quite understand how you avoid solving (or approximating) a PDE/ODE. My research is mostly in meshing and I'm not familiar with real-time simulation stuff. Do you have a link to a good paper on the topic?

<comment><USER9> Check out 'Position Based Dynamics' by Matthias Mueller, it was the first paper on the topic.

<comment><USER10> Most games aren't using anything remotely near as sophisticated as that. Most games use rigid body simulations, and while the details of each implementation is different, most of them work in a similar way. The common method in open source engines is a projected gauss Seidel [0] which is used in bullet physics. Most other engines (PhysX and Havok) are to the best of my knowledge using something very similar.

[0] [http://www.bulletphysics.com/ftp/pub/test/physics/papers/Ite...](http://www.bulletphysics.com/ftp/pub/test/physics/papers/IterativeDynamics.pdf)

<comment><USER9> > Most other engines (PhysX and Havok) are to the best of my knowledge using > something very similar.

PhysX _is_ position based dynamics. The Mueller guy who wrote that paper was a Co-founder of PhysX (back when it was NovodeX, then purchased by Ageia, then purchased by Nvidia) and is now a lead researcher at Nvidia. [1]

> The common method in open source engines is a projected gauss Seidel [0] > which is used in bullet physics.

PGS is just the numerical method that Bullet uses to solve for the collision impulses between the rigid bodies (there are tons of other possible methods, Nvidia again had a cool paper a few years back, there are also global approaches with better convergence, etc). This is solving a so-called 'Contact Dynamics' contact model [2], which originates in the work of French mechanicians in the 70s and 80s.

Actually, if op is interested in PDEs in games, check out 'Digital Molecular Matter' [3]. It was used in some Star Wars games, iirc. It is a pretty straightforward Lagrangian discretization (linear shape functions on tets) of a linearized hyperelastic energy density. They added a simple fracture model on top which allowed for cool destruction effects in games.

[1] [http://matthias-mueller-fischer.ch](http://matthias-mueller-fischer.ch) [2] [https://en.wikipedia.org/wiki/Contact_dynamics](https://en.wikipedia.org/wiki/Contact_dynamics) [3] [https://en.wikipedia.org/wiki/Digital_Molecular_Matter](https://en.wikipedia.org/wiki/Digital_Molecular_Matter)

<comment><USER11> Great answer!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Here is my physics engine! (Works in your browser too!)

[http://htmlpreview.github.io/?https://github.com/aguaviva/Ph...](http://htmlpreview.github.io/?https://github.com/aguaviva/Physics/blob/master/Friction.html)

</comment><comment><USER9> Very cool! Would be fun to have some implicit integrators to play with, too. And visualizations of the symplectic form.</comment>


Is Your Site HSTS Enabled? - <AUTHOR> http://blog.nvisium.com/2014/04/is-your-site-hsts-enabled.html <comment><USER2> Yes! And boy, it's not something you want to just enable without some thought.

I enabled it on a site that works without Host: inspection. HTTP gets you site A, and HTTPS gets you site B. (Different hostnames). This is obviously an odd arrangement, but it was working well for our little niche requirement.

I enabled HSTS in nginx while I was scrambling to do the heartbleed patch. I enabled all sorts of new age HTTPS options: HSTS, cert stapling, heavier ciphersuites, et cetera.

Of course, the HSTS started forcing all my HTTP users on site A over to site B, and I looked quite the fool. (Which is fair, because what I did was foolish and I deserved a little ridicule)

It's a neat option and maybe even the base case allows for it, but think about it before you flip it on!

<comment><USER3> I'd recommend starting out with a small max-age value so that any mistaken records will expire quickly. (Disclosure: I'm a co-editor of the HSTS RFC.)

<comment><AUTHOR> Yeah. I noticed that paypal.com has a max-age of 4 hours.

<comment><USER4> Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.

<comment><USER5> Is there any downside, when using SSL, in enabling perfect forward secrecy?

<comment><USER6> Make sure you're using an SSL library that support ECDHE cipher suites... the non EC suites are very slow.

</comment></comment></comment></comment></comment></comment><comment><USER7> You almost never want to also include the subdomains, unless you have a wildcard SSL certificate.

I made that mistake, couldn't reach any other subdomain of my site because only 1 was protected by ssl. Clearing that HSTS header information is not so easy..

<comment><USER8> Well, it depends. You shouldn't include subdomains if you have some that do not support HTTPS. That would be an instant self-inflicted denial of service attack.

However, for best security, you must include subdomains. Because the cookie specification is very lax, any subdomain can inject cookies into your otherwise protected (with TLS and HSTS) site. This injection, which will be seen as unexpected by developers, might be used as an attack vector. Note that, even if you don't have any subdomains, a MITM -- who controls the wire and thus the DNS -- can always make up arbitrary names and then inject from them. There are other smaller attack vectors that can be abused unless the entire domain name (e.g., example.com) is under HSTS.

</comment></comment><comment><USER9> Sadly not, because I haven't yet understood the interaction of HSTS and old plain-HTTP URLs.

What happens when a browser goes to retrieve, say, an image at [http://example.com/img223.JPEG](http://example.com/img223.JPEG) but the server now enforces HSTS and pulls-up TLS?

When I've tried this with a subsite the image fails to load, and I haven't yet had time to investigate why.

Perhaps I should just draw a line and let the old URLs break.

<comment><USER10> My understanding is that HSTS is purely for the client side. You can still have a server that serves http if you want, but any client that supports HSTS that has visited your domain since you started sending the header will simply add tls to any [http://](http://) link that it comes across.

So your image link can still be served, but if the client does support HSTS it'll see the header and then make all subsequent requests over TLS.

</comment></comment><comment><USER11> HSTS should be an implicit browser feature, not a server-side add-on. There should not need to be a server-side flag required to enforce this behavior.

If you go to an HTTPS page on a given domain, your browser should always prefer the HTTPS page, even if you try to follow an HTTP page. The reason is, if you were able to reach the page via HTTPS before, you should be able to reach it there again, and HTTP would only expose you to an unencrypted page which is more than likely the same in content. The only downside is that sometimes HTTPS and HTTP URIs serve different resources even though the URI is the same (which I believe should be considered bad behavior by the web server)

Requiring admins to enable HSTS puts the onus on web server admins who are motivated to improve security for their users a tiny bit, and only works for admins who have servers that can support HSTS flags. There are many legacy systems which simply can't or won't be changed to support it. Hopefully the above behavior gets put into the HTTP 2.0 standard so admins don't need to go through a checkist of add-on security measures every time they create a new web server instance.

<comment><AUTHOR> The HTTP 2.0 spec[1] mentions "Implementations of HTTP/2 MUST support TLS 1.2 and it appears Chrome will implement HTTP/2 via TLS only ([http://volgarev.me/blog/75094931827](http://volgarev.me/blog/75094931827)).

</comment></comment><comment><USER12> Good to see the word is spreading about HSTS. EFF started pushing it earlier this month [1], with a perhaps fair claim that it's not widely known about by web developers.

As the article shows it's pretty straightforward to setup; if you can add a response header to your app then you'll be able to figure out how to harden your app with HSTS.

For my fellow web developers who like to learn by video, I've _tried_ to make an easily digested screencast and a page of sketch notes to help get the word out about HSTS and explain what it protects against [2].

[1] [https://www.eff.org/deeplinks/2014/02/websites- hsts](https://www.eff.org/deeplinks/2014/02/websites-hsts)

[2] [http://www.webdevbreak.com/episodes/hsts](http://www.webdevbreak.com/episodes/hsts)

</comment><comment> micro-ram These settings are giving me an A+ on SSLLabs.com...

      # - Apache 2.4 PFS & BEAST attack Safe   /etc/apache2/mods-enabled/ssl.conf
        SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
        SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:!RC4:HIGH:!MD5:!aNULL:!EDH
        SSLHonorCipherOrder on
        SSLCompression off

      # - HSTS Apache directive to force SSL (.htaccess or per site in control panel)
    	Header always set Strict-Transport-Security "max-age=15552000"
    	RewriteEngine On
    	RewriteCond %{HTTPS} off
    	RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [NC,R=301,L]

<comment><USER13> I tried that cipher suite list with Apache 2.2 and got my grade reduced from A to A-:

The server does not support Forward Secrecy with the reference browsers. Grade reduced to A-

Maybe I need to upgrade to Apache 2.4.

<comment> micro-ram Yes, upgrade Apache. These settings are for Apache 2.4

</comment></comment></comment><comment><USER14> In 2014, everyone who uses https should enable PFS (ECDHE) and HSTS, at the very least.

<comment><USER12> If you're on shared hosting, is it down to the hosting company to enable Forward Secrecy? Are there any shared hosts doing this yet?

<comment><AUTHOR> Elastic Loading Balancing for AWS customers & Heroku allow for perfect forward secrecy and Akamai customers can expect ECDHE in Q3 of this year.

<comment><USER12> Is there anything you need to do to enable it on Heroku, other than setup SSL/TLS?

<comment><AUTHOR> ssl:endpoint add-on

</comment></comment></comment></comment></comment><comment><USER15> If you are using a site-signed cert and giving intended visitors a corresponding browser cert (being your own CA), and turn on HSTS, I assume the non-bypassable warning page would _not_ be triggered, and the author's reference to "self-signed certs" is an inaccurate shorthand for "site certs the browser doesn't trust a CA for". (If this interpretation is wrong, HSTS would prevent a secure connection in this scenario.)

And if your server is rewriting URLs instead of using 301, then clients are not vulnerable to the redirect loophole and HSTS gives no benefit in that respect?

<comment><AUTHOR> ds9, yes, "site certs the browser doesn't trust a CA for" is more accurate. You can find the exact details of HSTS and self-signed certs in the draft in section 11.3[1]. I've updated the post to hopefully be more clear.

[1] [http://tools.ietf.org/html/draft-ietf-websec-strict- transpor...](http://tools.ietf.org/html/draft-ietf-websec-strict-transport- sec-14#section-11.3)

</comment></comment><comment><USER16> HSTS is a good concept, and all browsers implement it, but there's no way to inspect which domains are flagged with it in your browser. So if you pick one up by mistake when you're testing the feature out in development, it just sticks, and the only way to get rid of it is to clear your entire browser cache or reset it, which is extremely annoying.

Browser makers: Please, please, please implement a way for me to inspect and remove individual HSTS "flags" so testing it doesn't become so painful.

<comment><USER3> Chrome lets you see some of the HSTS internals:

chrome://net-internals/#hsts

There's no list of HSTS hosts because the host names are hashed on disk.

<comment><USER16> Thanks!

</comment></comment></comment><comment><USER17> Is this a different implementation of Diffie–Hellman? As far as I can tell (and I am likely wrong) there needs to be one successful connection attempt using a secure protocol, in this case HSTS, to detect if the redirect was indeed to the correct site or a MitM attack.

<comment><USER10> HSTS isn't a protocol, it bascailly a flag that tells a browser to only use TLS to connect to a specfic domain. It normally does require one successful connection for the server to tell it, but both chrome [0] and firefox [1] have a list of sites built-in so that even the first time they connect they'd be TLS.

[0] [https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...](https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json)

[1] [https://blog.mozilla.org/security/2012/11/01/preloading- hsts...](https://blog.mozilla.org/security/2012/11/01/preloading-hsts/)</comment></comment>


Drew DeVault's book on Wayland is now readable without a paywall - <AUTHOR> https://wayland-book.com/ <comment><USER2> > Wayland is the next-generation display server for Unix-like systems

The first sentence isn't even accurate, it's a protocol.

</comment><comment><USER3> The last chapters seemed to be empty the last time I've checked?

<comment><USER4> Yeah, it's still in progress (but seems to be getting closer every month)</comment></comment>