Ask HN: Going to College with NIL Family Support? - <AUTHOR>

I see in quite a few HN threads an assumption, sometimes spoken and sometimes unspoken, that a young person pursuing an undergraduate degree will have financial support from parents. What about the young person who does not get any financial support (not even living at home rent-free) after age eighteen? What's the most reasonable plan for such a young person to launch a career as a hacker? Don't go to college at all? Go to a college with the lowest possible list price? Join the armed forces?<p>I hope to avoid my own children facing this situation, but I ask on behalf of a very bright young man who may face this situation. He has already received a very enviable offer of admission from a top high-tech college. He may not be able to afford to go. What are all the options? <comment><USER2> The income of his parents makes a big difference. If they are professional class, their incomes will make it so he doesn't qualify for financial aid. If they won't cosign loans, it puts said young person in a very tough situation. In this case, the young person needs to talk to the financial aid office and establish that he is entirely supporting himself. This can be very difficult. Right now, he should make sure that his parents aren't declaring him as a dependent on their taxes.

If his parents have lower incomes, then he should apply to a lot of colleges with hope of getting a good financial aid package. Generally, when you're paying for it yourself, it's not worth going to an expensive college, but computer science is special -- the education from CMU or MIT is worth the extra money. Owing 100k in student loans is a lot more manageable for a high end professional degree. If he was majoring in sociology, he would want to go to the school with the lowest sticker price.

He should definitely go to college and almost no one should join the armed forces, certainly not as a launching pad for a career as a hacker.

Also, this bill goes into effect this July and would allow for emancipated minors to file independently for financial aid. Assuming he is already 18, it is probably too late to take advantage of this. <http://www.washingtonwatch.com/bills/show/110_HR_5.html>

<comment><AUTHOR> _If they are professional class, their incomes will make it so he doesn't qualify for financial aid. If they won't cosign loans, it puts said young person in a very tough situation._

Yes. That is the problem. The college financial aid principles in the United States

[http://www.collegeboard.com/prod_downloads/highered/fa/Econo...](http://www.collegeboard.com/prod_downloads/highered/fa/Economics- Primer-2004.pdf)

make an assumption that parents are the funding source of first resort for any young person pursuing an undergraduate degree at the usual age, and young people not supported by their own parents don't have enough creditworthiness to borrow their way through an elite undergraduate college.

<comment><USER3> I am not certain if the works in the United States, but you could divorce yourself from your parents.

Then their financial standing would no longer affect you, because they would no longer be legally considered your family.

<comment><AUTHOR> Here's an MIT statement from the director of financial aid:

"For MIT, our definition of an independent student is one where there are no parents to rely upon for information (in cases of deceased parents or abuse or neglect). The bar is set pretty high, so we do not generally allow students to be considered independant."

[http://www.mitadmissions.org/topics/finaid/financial_aid/its...](http://www.mitadmissions.org/topics/finaid/financial_aid/its_february_2nd_do_you_know_w.shtml)

</comment></comment></comment></comment><comment><USER4> Scholarships, loans, and work is how I did it. The scholarships covered tuition, loans and earned income covered living, lab fees, and books. I lived in a small apartment complex and acted as an assistant manager in lieu of rent part of the time. I sold calligraphy (certificates, your name in calligraphy, mailboxes and street signs) and art (illuminated love poems/poison pen poems, decorated letterhead designs, wedding invitation designs) and did some studio portraiture photography. I also graded a billion papers, did odd jobs on and off campus--I.D. photos, repairs, hauling, cleanup, drafting home additions/remodels, writing short pieces for newspapers on events, selling cartoons to newsletter editors, stereo repairs, typewriter repairs.

I also got fed by friends in clubs (historical recreation group, astronomy club, computer club) when all I could afford for myself was a sack of potatoes (no margarine, just salt.) I checked out textbooks from multiple libraries to get through the quarter without buying (interlibrary loans make this work, along with reading ahead and study groups where you can get exercises from others during gaps.)

The loans were hard to swallow at the time, but I used the money carefully and it worked out.

</comment><comment><USER5> Plenty of schools offer generous academic scholarships ( Rice, Carnegie Mellon, Vanderbilt). If you shoot for a school a half tier lower than where you'd otherwise go, you can probably get a good scholarship. That's probably your best option.

<comment><AUTHOR> You are referring to what is called a "merit scholarship." That takes off the table all the colleges that do not have such scholarships as a matter of policy. (So that means no chance at any of the eight Ivy League colleges, nor at Stanford nor at MIT.) But I agree that Rice, Carnegie Mellon, and Vanderbilt, among others, seem to offer some great learning opportunities. So certainly a young person who might otherwise get into, say, MIT should be sure to apply to one of those colleges as well.

<comment><USER6> Actually the Ivy League might be an incredibly attractive option for him. Harvard states that for families whose parents make less than 60k, the family will be expected to pay nothing at all. And MIT seems to be very generous with financial aid too. They will make sure that all of the financial need is met. They define financial need to be expected expenses minus EFC. They cover the rest with an expectation that you will work some (earn 2850 a year) and then will cover the rest in grants. Most elite colleges seem to be making a serious effort to make sure every family can afford their college. Of course the problem is in the details. But it sounds like these schools would all be willing to make sure that he could afford college.

Harvard Financial Aid:<http://www.fao.fas.harvard.edu/fact_sheet.htm>

MIT Financial Aid:<http://web.mit.edu/sfs/financial_aid/index.html>

<comment><AUTHOR> Agreed that Harvard (and Ivy League colleges in general) can offer great financial aid. But the offer is based on _demonstrated_ need, or, as one old Harvard document said, "ability to pay, not willingness to pay." That's why a student whose parents don't agree to step up (the situation I am asking about) is hosed. Families with low incomes and assets, who apply, are likely to be bowled over by the generosity of the financial aid offer. See the Princeton online estimator

<http://www.princeton.edu/admission/financialaid/estimator/>

or Dartmouth's cost estimator

[http://www.dartmouth.edu/apply/financialaid/calculator/index...](http://www.dartmouth.edu/apply/financialaid/calculator/index.html)

for examples. But please note that if the parents have some estimated family contribution above zero but are unwilling to pay that, the student is stuck. I'm asking about the plan B in such situations here, on behalf of a friend and similarly situated young people.</comment></comment></comment></comment>


Inside Google's Accessory Development Kit demo hardware - <AUTHOR> http://www.engadget.com/2012/06/29/google-accessory-developer-kit/ <comment><USER2> Oh I would like to have my hands on one of those! Hours and hours of things to explore with a toy like that. Is Google making them available elsewhere? They have a website with guides regarding working with it but I'm not seeing a page to pick one up.

For starters on the simple alarm clock concept alone, I wonder if the accelerometer is sensitive to isolate motion from the sleeper nearby. Might be some interesting applications in sleep monitoring, etc.

<comment><USER3> +1, would love to play with one of these and experiment with all of the sensor interfaces

</comment></comment><comment><USER4> In case anyone is wondering, it uses an Arduino Due[1] board which has an Atmel SAM3U 32-bit ARM processor[2][3]. The Due is not yet available and is _due_ sometime later this year.

You could theoretically build one of these fairly cheap. Google's posted the source code for everything.

1\. <http://arduino.cc/blog/2012/06/28/android-adk2012-is-here/>

2\. [http://arduino.cc/blog/2011/09/17/arduino-launches-new- produ...](http://arduino.cc/blog/2011/09/17/arduino-launches-new-products-in- maker-faire/)

3\. [http://www.atmel.com/products/microcontrollers/arm/sam3u.asp...](http://www.atmel.com/products/microcontrollers/arm/sam3u.aspx)

</comment><comment><USER5> If this is truly interesting to you and you want to get your hands on something similar, an arduino board can be had for $25-$50 and all of the sensors and more are available from sparkfun.com or other similar sites.

<comment><USER6> Yep, this is a great way to begin exploring electronics. If you want to get a little more crazy, there's also the Beaglebone board, which allows you to run a complete Linux system on an embedded device. You hook up your accelerometer, etc., and they're then accessible in /dev. Lots of fun to be had.

</comment></comment><comment><USER7> We have only begun to scratch the surface of devices that interact with/are controlled by our phones. Good to see Google popularizing the concept. I wish Apple would make accessory design more accessible.

</comment><comment><USER8> The main additions (which are pretty cool) in version two of the Android Open Accessory protocol (AOAP) are support for:

* Connection over Bluetooth in addition to USB

* Audio over USB

* USB HID capability (accessory can act as an input device)

IMO the biggest issues with the original AOAP were the lack of device support, convoluted demo app implementation and lack of documentation. Very little has been done publicly with the platform as a result--which is unfortunate as it has great potential.

Device support is slowly improving but there's still no easy way to know if any particular device has support for the protocol as there's no _requirement_ for manufacturers to support it.

For people coming from an Arduino background learning to code for Android is a _huge_ learning curve and I think this acts as a disincentive for people to play with the technology.

In light of this I created the "Handbag for Android" project which enables you to create Android accessories _without_ writing Android code:

* <http://HandbagDevices.com/>

After installing the Handbag app on the phone/tablet you can create an Arduino sketch that describes the UI and this gets uploaded to the Android device each time the accessory is connected. Check it out if you'd like an easy way to get started with Android accessories. (Yesterday I gave the project some improved installation documentation and updated it for easy compatibility with recent Arduino releases.)

I'm speaking about this project at OSCON in July: "Arduino & Handbag: Create Android Accessories Without Android Code" (<http://www.oscon.com/oscon2012/public/schedule/detail/23946>). If you're there come and say "Hi". :)

(When the project gets AOA2 support depends on when I get my hands on a board. :) )

If you're coming from the Processing world I also recently worked with the Arduino team to simplify and improve the way to get started there too-- documented at:

* <http://labs.arduino.cc/ADK/AccessoryMode>

(BTW If you'd like to get started with Handbag, don't have a USB-capable Arduino but do have a network-capable Arduino get in touch--I might have an alpha release for you to test. :) )

</comment><comment><USER9> One on ebay.

[http://www.ebay.com/itm/Android-Accessory-Development- Kit-2-...](http://www.ebay.com/itm/Android-Accessory-Development- Kit-2-0-Google- I-O-/221060314241?pt=LH_DefaultDomain_0&hash=item337838b481#ht_500wt_1187)

</comment><comment><USER10> Looks awesome! I would definitely buy this for $199 instead of nexus 7

</comment><comment><USER11> If he keeps tapping the pins and PCB with his sweaty static loaded fingers it will soon be a magnetic brick.

</comment><comment><USER12> How long until I can connect my Lego motors with this?</comment>


A Collection of Algebraic Identities - <AUTHOR> https://sites.google.com/site/tpiezas/Home <comment><AUTHOR> >""Everything has beauty, but not everyone can see it."

\- Confucius"</comment>


Tolerating the Surface Pro - <AUTHOR> http://ozar.me/2013/05/why-im-tolerating-the-surface-pro/

<comment><USER2> I don't see battery life as being a small problem on a tablet. My ipad mini (with LTE) has become my primary communication device because I can use it intensively and forget to charge it for days at a time. 12 hours usage in addition to several more days of standby with all the features (push email etc) enabled means I go to my ipad over my blackberry that can't last a day or my mba that can't last a day. 3-4 hours for a portable tablet device is just pathetic. It defeats the whole purpose of the form factor.

<comment><USER3> _"3-4 hours for a portable tablet device is just pathetic."_

True, but I wouldn't call the Surface Pro 'tablet portable'. It's fairer to compare it with a notebook. With TypeCover, the Surface Pro is 2 centimeters thick, while a MacBook Air 11" has an average thickness of 1 centimeter. The Surface Pro is also a little heavier than a MacBook Air. Curiously, both devices have the same CPU, GPU, SSD, and RAM – but a MacBook Air 11" is $30 cheaper and has 5,5 hours of real world battery life.

If we were to compare Surface Pro with a 10" iPad, it would look even worse. The Surface Pro is twice as thick, 3 times as heavy, has one-third of the battery life, has a screen with a lower resolution, and it's $300 more expensive.

<comment><USER4> The MBA 11" is 0.68" thick. The Surface Pro is 0.53" thick. The Type Cover adds .23"; the Touch Cover only .08".

It gets the same run time per charge.

It weighs less, not more; less than 2 pounds versus 2.38.

The difference is that you can snap off the optional keyboard in a split second if you really care about thickness -- well, that and the fact that it's a tablet with a touch digitizer behind the glass too.

<comment><USER3> _> The MBA 11" is 19.2mm thick_

No, it's not: "Height: 0.11-0.68 inch (0.3-1.7 cm)" <http://www.apple.com/macbookair/specs.html>

The body has a wedge shape, on average 10mm thick: <http://imgur.com/Ung7IQ3>

_> It gets the same run time per charge._

No, it doesn't. The Surface Pro gets 3,75 hours of battery life. [http://www.engadget.com/2013/02/05/microsoft-surface-pro- rev...](http://www.engadget.com/2013/02/05/microsoft-surface-pro-review/)

<comment><USER4> For what conceivable purpose would you want to compare _average_ thickness? I own an SP; it does not get 3.75 hours of battery life no matter what I do with it, and I could pull out a dozen review links to say that as well. Why are you trying _so_ hard to make it look worse than it is?

<comment><USER3> _"For what conceivable purpose would you want to compare average thickness?"_

Along with length, width and depth, that's what determines the volume of the object (=portability). The Surface Pro has 60% more volume as a MacBook Air 11". And yet, it gets hot, has loud fans, and has less battery life. That's just bad engineering. As a replacement for a notebook and a tablet, it really should have _at least_ as much battery life as an iPad. Given its volume, that would've been possible.

Surface Pro: 10.81 x 6.81 x 0.76" = 55.95 cubic inches

MacBook Air 11": 11.8 x 7.56 x 0.39" = 34.79 cubic inches

EDIT: in an earlier version I mistakenly wrote 'mass' where I meant 'volume'.

<comment><USER4> Weight and size are what determine portability for everyone else, not how much water it could hold if it were doubling as a canteen. That's not mass, it's volume, by the way. The MBA is longer, wider, taller and heavier -- yet you've contrived a way to label that as "more portable"... ridiculous on its face.

I'm not going to make this valueless discussion thread any longer, so to your reply: those numbers are made up. Larger screens make things less portable, not more.

<comment><USER3> The MBA is less than an inch longer and wider (because of the larger screen). It's not as thick ('tall'?) as the Surface Pro and it weighs less (2.38lbs) than a Surface Pro with TypeCover (2.55lbs).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> So the gist is "good hardware, really really unacceptably crappy software experience"

> _I bought the Surface Pro to use as a backup laptop: a secondary > presentation device in case my main laptop bit the dust. I make a living > teaching people via PowerPoint. For a long list of reasons, I can't really > switch presentation tools, and the iPad doesn't cut it as a secondary > presentation device. The Surface Pro does._

This isn't a typical situation, and if this is the only justification one can have (or perhaps one of the few) in owning a Surface Pro, MSFT has a whole lot of issues on its hands.

<comment><USER6> Essentially, yes. I convinced work to buy me a Pro after around a decade of being Windows free... and I'm underwhelmed. I like the hardware. But having two entirely separate interfaces is really terrible. Like he pointed out, it's no longer intuitive how to interact with the device, you have to constantly switch between input modes which is extremely annoying.

<comment><USER7> A big part of the Metro nightmare is that the built in apps (other than the core shell) suck.

For instance, Metro lacks a file chooser where you can easily find files anywhere in your system. If the Metro interface had a good file chooser, you wouldn't have to drop out to use the file desktop chooser to find a file on any filesystem.

If Windows 8.1 adds a good file chooser and if Microsoft addresses a few specific problems like that, life in Metro could get much better.

I hope Microsoft can get its branding straight -- I find it weird that I click on a music file across the network and it pops up in a pretty Metro app with the tag line "Xbox Music". There's also some thing (which has never quite worked for me) called "Xbox Games" which I'm not sure will do anything for me if I don't own an Xbox.

Or is everything that runs Windows 8 an "Xbox" of some kind? And how come I see tiles for all kinds of music except for the music that I've got in my own collection?

<comment><USER8> Why are you trying to work with files in the metro interface?

I'm having trouble coming up with a use case where I'd need the file chooser to do any of the things you'd want to do in the touch interface.

I can't speak to the music file thing because I haven't dealt with music files in years, it's always been an annoying and tedious experience for me (as is working with any large number of files with wonky metadata), so I switched to streaming and haven't looked back.

EDIT: That said, videos on my NAS just show up in the metro "Videos" app and I can watch them without issue. I haven't tried it with music but I can't imagine why that would be any different.

<comment><USER9> Videos and music based on a NAS do indeed show up automatically. I just don't need that part - I need the music and videos when I'm on the road. (Streaming doesn't work on most airplanes.)

</comment></comment></comment></comment></comment><comment><USER10> All Surface reviews read like this. "It's pretty good, except for this long list of things that are terrible about it."

</comment><comment><USER11> I switched to the Surface Pro as my primary development box. Surprised that I could get VS2012, SQL Express 2012 and IIS working with decent performance.

If you are using an SDXC card to supplement your storage and don't intend to eject it on a whim, you can get better performance by going to the device manager and changing the removal policy and the write caching.

Options for 256gb or 512gb SSD would have made this an easier choice for many.

<comment><USER12> Wow, glutten for punishment.

My primary development box is a fully loaded 17" laptop. Tablets are too small screen wise and performance wise when doing real work either in the OSS or Redmond realm. (I deal with tons of Data and run a few VMs as well.)

<comment><USER11> I carried a Lenovo W510 15" that was simply not workable on flights and heavy and clumsy for standing in line at security checkpoints. And "pro" systems like this don't play well with airline power systems. The surface has worked on Qantas, Air Canada and Lufthansa flights where I have had power. At my desk I project to a big monitor and it has worked out pretty well.

</comment></comment></comment><comment><USER4> My biggest gripe is that you really need DPI scaling to use some desktop apps at 1920x1080 on a 10" screen, but half the apps I use don't scale well or at all (I'm looking at you, Chrome). I still use the SP on a daily basis and it was a worthile purchase for a few things:

1) It's a great tablet when you want a tablet. With no keyboard attached, it's a joy to read reddit and play games on in bed.

2) I throw it in the car with me whenever I leave home. I'm always on-call if a site/server goes down. The SP is a full computer with a hard keyboard, so there won't be any situation I need to drive back home to handle, even if it takes several hours to resolve.

3) It's a suitable desktop replacement for anything but hard gaming. I stick it on my desk, plug in a big monitor, and pair a bluetooth mouse. Now screen size and DPI scaling don't matter, and the Core i5 has all the power I could need for compiling software, photo editing, etc.

</comment><comment><USER7> My boss uses a Surface Pro like a laptop and is happy with it.

Add a good quality wireless mouse and a USB 3 hub, leave the keyboard at the desk and you've got a docking station as good in practice as anything on the market.

<comment><USER9> That's interesting. How does he work around the high-DPI resolution problems when connecting an external display? I'm assuming he's using one - when you say "a docking station as good in practice as anything on the market", that usually means an external display.

<comment><USER7> I'll say that if you've been using Windows for years you get used to using Windows on strange screen systems, everything from 640x480 to video wall panels. If you adjust magnification factors, font sizes, and such for the apps you actually use to help out a lot.

One thing I found with Windows 8 is that it is even better to use keyboard shortcuts to access the shell. Instead of groping for the 'Start' button, I hit the Windows key and the same thing happens if I am running Win7 or Win8. So Win8 didn't cause me disorientation at all, it just trained me to do the right thing.

<comment><USER9> Yes, but then you're constantly switching magnification factors, font sizes, and such every time you plug into the desktop dock or unplug to hit the road?

</comment></comment></comment></comment><comment><USER13> "I end up using the finger very often, and not to touch the screen, either".

</comment><comment><USER14> The author needs a laptop, possibly augmented with a Wacom tablet to draw during presentations. With the myriad of amazing laptop/netbooks available in the windows ecosystem a tablet would be my absolute last choice for his use case.

The other angle is to consider that Surface is but one choice. Other manufacturers make excellent tablet/hybrid Windows 8 devices. They are probably a far better choice for general business use.

I don't really get people who complain about, for example, not being able to use Excel with your fingers. I'm sorry, touch is not the best solution for every application. Using touch absolutely sucks for a wide range of applications. A on-screen keyboard is the simplest example. It sucks. Functional, but it sucks. I can't even think of the idea of using Excel with mi fingers on the screen. It would be ugly, cumbersome and slow, very slow.

Tablets have their place. Please don't complain if you try to force it into a non-ideal application.

I still own a ten year old little Sony mini notebook with a nice 10 inch display. It's about the size of an iPad and twice as thick as an iPad 3. I still have XP on it. It is absolutely wonderful for travel, even in the most cramped aircraft. It has a great physical keyboard. It is fantastic for PowerPoint presentations. Battery life is 6 to 12 hours. I have written tons of code on this thing in flight. I can run a Linux VM. And do web development, etc. I could go on.

Tablets have their place.

<comment><USER9> Brent the author here. As I stated in the article, I do indeed do have a laptop. However, carrying around a laptop, plus another backup laptop, plus a Wacom tablet is a little beyond what I'd like to travel with.

About Excel with your fingers - you'd be surprised. The touch experience is surprisingly compelling once you get used to it. I'm always surprised at how often I reach out to touch the display on my laptop after I've been using my iPad or the Surface, even just for a few minutes. (This is especially true when using the Surface because the Type Cover's trackpad is laughably small.)

<comment><USER14> Ultimately we all make the choices that make sense to us. I've travelled extensively in the US, Europe and South America conducting seminars and product demonstrations. I know the pain of carrying hundreds of pounds of equipment with you. Most memorable: picking up my large Pelican cases at Schiphol only to feel they were covered with yellow slime.

Anyhow, for business travel I would nearly always buy laptops in pairs. Really easy to clone them just before a trip and have true backup.

Two laptops and a Wacom are not going to be a significant departure from one laptop and surface. You can easily fit all of it in a laptop bag with room to spare. For convenience I eventually migrated towards wheeled laptop cases. You don't have to lug them around and they offer lots of room for gear and sometimes even a minimal overnight set of clothes, etc.

I am sure that eventually some tools will develop usable parallel touch UI's. I guess my point is that I can do everything I might generally have to do during a typical business trip on a ten year old notebook. Newer notebooks are far cheaper (I paid $3,000 for the Sony ten years ago) and far more capable. A tablet would be my absolute last choice as they are still really cumbersome and inconvenient to use.

<comment><USER15> Yellow ... slime?

I know it's not exactly on topic, but please do elaborate.

<comment><USER14> Funny story. Not at the time, but it was hilarious once I got to the hotel and wrote an email describing what I went through.

This was my first time going to Amsterdam, about twelve years ago. Last minute business trip. I had no choice but to carry about 400 pounds of equipment with me. I think the excess baggage bill was about $2,000. It consisted of a set of anvil cases and pelican cases with all manner of equipment, even FPGA prototyping boards. I effectively had fully finished product as well as prototype hardware in order to be able to work on code based on feedback and demonstrate it.

The ordeal started in Los Angeles when I didn't have all of the right paperwork, including the necessary carnet, etc. Mad rush to get it all sorted the week of the trip.

I planned ahead and designed a custom heavy-duty dolly out of 80/20 extrusions to be able to move all of this stuff at both airports and within the city/hotel. The dolly had large wheels and could be taken apart and stored in the pelican case. Pile it on with the gear and a couple of ratchet straps held it all in place. Great plan.

I arrive at Schiphol and go to the carrousel. These things were pretty heavy, 60 to 90 lbs per case. This meant that when I saw one on the carrousel I had to be "all in". There was no messing around. Grab and get your whole body into it to pull the thing off the carrousel.

I see the first anvil case come around. I setup to grab it. The plan was to rotate it quickly onto my leg and use that as a fulcrum of sorts to rotate the case off the carousel. When I go to grab the case one of the handles feels really slimy. I mean, imagine if you squirted it with motor oil or pudding, somewhere in between those two. I was committed, so I ignored it. I pulled hard with both hands, put it on my leg, then, supporting it with my chest I got it down. It sounds awkward but it was a very natural move. Think olympic dead lifting but not quite going over your head.

Then I realize I am absolutely covered in yellow slime. Again, think somewhere between oil and pudding. Not quite liquid but not quite solid. Yellow and cold. Didn't smell. A few expletives later I had no choice but to get the other cases. All four of them were covered to some degree with this stuff.

By the time I get my luggage I look like I had gone mud wrestling in yellow slime. I was both angry and laughing my ass off. What are you going to do? Just roll with it.

I literally sat on the floor to take a moment. I was wearing loose fitting exercise clothes to be comfortable during flight. Thankfully the slime didn't go through the fabric.

I couldn't leave all of that gear alone. There was no way to clean myself up at that time. I got my dolly out and assembled it right there. Loaded all of the slime-covered cases onto it and set out to find the Custom's office.

When you travel with a lot of gear like that you need to have this document called a "Carnet" signed just about everywhere you go. It lists what you are carrying so that you don't have to pay import duties everywhere you go.

I soon learned that the Customs office was three buildings away from my terminal. And, of course, the only way there was to use this walkway that ramped up between buildings.

By the time I get to the Customs office I was sweating like a pig and covered with yellow slime. I can't even imagine what I must have looked like.

When I entered the room it was like I was Moses and the water parted. I mean, everyone got the fuck out of my way. It was hilarious. I get to the counter and the customs officer just signs the paperwork without even attempting to look inside the cases. I guess she didn't want to play with yellow slime.

As I go back to the hallway a janitor is making the rounds with his cart. He sees me and takes a look at my pile of cases covered in yellow slime. Without either one of us uttering a single word, the guy grabs to large rolls of paper towels and a full bottle of cleaner (like windex) puts them down on the floor next to my gear and continues walking.

Again, laughing my ass off as the entire thing was surreal beyond belief. So, here I am, windex-ing the shit out of everything, including myself, in front of the Customs office. Of course, when it came to my clothes I got a lot of slime off but also ended-up smearing a lot of it everywhere. I mean, I looked like shit.

Now I had to make the trip back three buildings to get back to my terminal and go through the immigration area. Everyone was pretty nice. I was asked about the contents of the cases, my paperwork was checked but nobody was interested in opening the cases. Also, oddly enough, not one person asked me what happened or why I looked the way I did. Are the Dutch that polite?

Once out I was able to go into a bathroom and at least wash off some of the slime and sweat. I didn't change my clothes because I just didn't want to dirty another set. I did clean the cases to a reasonable degree.

Getting a taxi was a real challenge. Few seemed interested in carrying that much stuff.

When I finally got one the guy took one look at me and another look at the equipment and said "I have a bad back, sorry". So, I had to load all of the equipment onto the van. By this point in time I was absolutely exhausted. Under those conditions humor and a good attitude makes a good situation bearable and you just move on.

When I get to the hotel I found out that the hotel attendant also has a bad back. Throughout my stay in Amsterdam it seems I always managed to find people or taxi drivers with bad backs. Again, it became really funny after a while.

In talking to the airline I came to find out a shipment of some sort of lubricant was ruptured in the cargo area and, wouldn't you know it, all of my cases were located right next to it. They apologized and bumped me to first class for the trip back. Good deal.

It's funny how we don't remember the museum trips or the city tour but stories such as this one remain etched into your mind and actually become the kinds of stories you smile about when you remember and tell them.

Also, every time I think "CEO" I remember myself covered in yellow slime and sweat.

</comment></comment></comment></comment></comment><comment><USER16> I'm not sure what was happening with his MD file extension, but I don't think it could be what he thought it was. Windows 8 has only one unified set of file type associations – there's no concept of desktop versus "Metro" there. Probably the app just didn't register for that extension?

<comment><USER17> That's a fair point. I know 7Zip has this same problem; no matter which computer I'm using, I have to manually tell Windows that 7Zip is the program to use to open a .7z file.

It's possible for a program to not register file extensions.

</comment></comment><comment><USER18> "On the regional jet I'm on now, even first class doesn't have a tray big enough for the Surface." "In comparison, when I take my MacBook Pro or my iPad [...]"

<http://www.quickmeme.com/meme/3ufht1/>

</comment><comment><USER19> I've had a surface pro since launch -- and all I can say is that I can't imagine using different portable right now (before that I was using a x230).

once I got used to the form factor and what it was designed for it's changed how I compute in subtle ways.

Last night for example.. rather then going to my desk .. I watched some lectures on the couch while using the pen to take notes in one note .. then docked it to do some work.

that's just one example of many; but for me personally i feel like i'm doing more with my computer then I was before

though, I've usually docked my laptops when doing any serious work .. and my mobile work is usually restricted to coffee shops for only 3-4 hours at a time ..

battery life I guess could be better .. I usually only get 4hours or so off power when streaming movies off amazon but it's not really bad IMO, but of course I'd like it to be longer .. my main worry when it comes to the battery is that it's not user replaceable honestly</comment>


Ask HN: Recording sales calls for training and posterity? - <AUTHOR>

The free audio bridge we use has a recording feature. I turned it on once, and tested it to check, and it does announce when people join that the call is recording.
I have a team which would love to be able to listen into the calls, and I can imagine audio could also be useful as training material, both for myself personally to improve my own presentation, as well as internal training. Finally, it seems like logging customer calls would be useful as accounts develop and progress through the customer life cycle.
But even so, I still feel awkward turning on the recording feature and wonder if participants would feel awkward being recorded. It's funny how despite all the bulk collection and recording that goes on all around us, this would still stimulate any anxiety.
Anyone have any thoughts or feedback on recording the audio for meetings or presentations with customers? Does anyone do this? Does nobody do this? <comment><USER2> Check out Close.io

<comment><AUTHOR> I really would like a better way to track calls. I don't want to make my calls through Close.io. Sorry, I know it makes their life harder, but I still want it as close to automatic as possible.

Ultimately I think those are tools for sales reps to track their activity, I don't like the idea of imposing it, but I'm happy to provide it. Tools like that have to be asked for, not imposed.

I also tried PipeDrive but the guys were not impressed, they said it was missing key functionality. For example, went to enter a contact's Job Title and the field was missing. Didn't matter to them that I could go into Custom Fields and add it, to them it was an inferior CRM. They know Salesforce, they want to go with Salesforce. It's not a significant cost.

But this question was more about ethics and strategy than tools. I am curious if people think it's worth asking to record a call, versus forgoing the recording so you don't have to ask. Not asking and recording is not an option.</comment></comment>


Use pew, not virtualenvwrapper, for Python virtualenvs - <AUTHOR> http://planspace.org/20150120-use_pew_not_virtualenvwrapper_for_python_virtualenvs/ <comment><USER2> Wow, all these comments seem to be about all the different environments to use -- new suggestions, and talking about what makes others not the best.

For those just starting Python, I'd say just go with virtualenv. It works, it's common, and there are tons of tutorials about it. Don't feel bad about using the old mediocre libraries. And in general, learning basics isn't embarrassing.

</comment><comment><USER3> The discussion here has quickly gotten out of hand and at the risk of causing more confusion I would like to point out that pipenv([http://docs.pipenv.org/en/latest/](http://docs.pipenv.org/en/latest/)) seems to be the officially recommended Python packaging tool now[1], though venv and pip work too.

[1] -- ([https://packaging.python.org/new-tutorials/installing-and- us...](https://packaging.python.org/new-tutorials/installing-and-using- packages/))

<comment><USER4> We are talking about packaging tools now?

<comment><USER3> Kindly don't shoot the messenger(i.e. me) but pipenv does the work of pip + virtualenv + requirements.txt so packaging tool seems like a good name for it. Virtual environments aren't a lot of fun without local packages and reproducibility I assume.

<comment><USER5> Last time I tried pipenv (a month ago?) there was a breaking unresolved bug on Ubuntu 16.04.

I'm not easy to hold grudges, but such a critical low-level tool manages to break for what I see as one of the most likely server environments to run on... I hold off on converting the (annoying, but working) virtualenv(wrapper) stuff. Just not worth it, now that I spent weeks of my life handling the annoyance that is python packaging and deployment.

</comment></comment></comment></comment><comment><USER6> What I really want is to be able to type "<magic> foo.py", where <magic> creates a list of all necessary dependencies to run foo.py. Then "<magic> run <that-list> foo.py" would automatically do whatever voodoo needs to be done to run foo.py regardless of where you run that command.

The idea is that we all have global pip installations, which is great for hacking. I have a ton of Python scripts that depend on my pip installs. All my scripts run successfully on my box. The goal is to be able to send you one of my scripts along with <that-list>, then you can run "<magic> run <that-list> foo.py" on your box, and everything "just works."

That way there is literally zero configuration. I don't have to tell any tool anything, and it's effortless for you to run it with all the benefits of a virtualenv.

<comment><USER7> Sounds almost like `pip freeze > requirements.txt`. This creates a list of all your currently-installed packages, which you can install with `pip install -r requirements.txt`.

The biggest problem with this though is that this will make the other person install _all_ your installed packages, rather than just the ones needed for the particular script.

</comment></comment><comment><USER8> The preferred environment for Python development and deployment changes more than the latest trend in JavaScript frameworks.

<comment><USER9> Nope it's been virtualenv for at least 3 years.

<comment><USER10> I've used it continuously for 6 years.

<comment><USER9> Yeah I've done so for three - I'm happy enough with it and confident enough to recommend it that I didn't bother to look up how long it's been around for..

</comment></comment></comment></comment><comment><USER11> I'll take a chance to plug `vrun` [https://pypi.org/project/vrun/](https://pypi.org/project/vrun/) here as well which is a very lightweight wrapper around activate that only applies to the current command. You can use it to start a subshell if you wish.

The fundamental problem is that virtualenv scripts are not actually bound to their actual virtualenv. If you forget to activate and a script shells out in a subprocess to execute another script it will not find the version installed into the virtualenv. This should be fixed upstream but so far it doesn't look like it is.

        $ python3 -m venv env
        $ env/bin/pip install vrun
        $ env/bin/pip install foo # assume foo depends on bar and tries to start bar via subprocess
        $ env/bin/foo # fails because bar is not on the path
        $ env/bin/vrun foo  # works

`foo` is now executed in a process in which the virtualenv is fully activated and will find appropriate dependencies on the path if it tries to run a subprocess, etc.

<comment><USER12> When you get a chance, try out Hatch and its `use` command i.e. `hatch use myenv pip install ...`

[https://github.com/ofek/hatch/blob/master/COMMANDS.rst#use](https://github.com/ofek/hatch/blob/master/COMMANDS.rst#use)

</comment></comment><comment><USER13> Why not just plain virtualenv?

<comment><USER14> There's a link in the article which explains why

[https://gist.github.com/datagrok/2199506](https://gist.github.com/datagrok/2199506)

<comment><USER15> You can use virtualenv without `bin/activate`. Just refer to `bin/python` (and other scripts in `bin/`) explicitly. Don't bring in the magic until you need it. And when you need it, consider what kind of magic you need. If you're typing `bin/` too much, do you need something that adds `bin/` to your path, or do you need to write a script for this task that saves you from having to type both `bin/` and a bunch of other command-line flags?

(I do add my virtualenv's `bin/` directory to my path, but mainly so my editor can find the right tools, so I do it from elisp instead of bin/activate in a shell)

<comment><USER14> How do you manage dependencies? One of the best parts about virtualenv (to me at least) is that I can do pip install without infecting the rest of the system.

I guess I've never looked, does virtualenv provides a bin/pip which already knows the path of the virtualenv? Does the bin/python in there come with a path that uses the project pip install?

<comment><USER10> There is a bin/pip you could call directly and have it install packages to the correct path. Even commands installed from packages work that way.

I would only use 'bin/python' directly from scripts called from cron, or other similar places.

</comment></comment></comment></comment></comment><comment> rye-neat As someone who is finally getting into Python development (via Django) after following tons of tutorials over several years: should I be using pew, virtualenvwrapper, or something else? This article is from 2015, how relevant is it today?

<comment><USER10> Most people I've met use virtualenvwrapper. It doesn't work on other shells like fish though. However, I'd simply focus on learning how virtualenv works, and use whatever tool to manage it as you feel like.

<comment><USER16> Virtualfish is amazing: [https://github.com/adambrenecki/virtualfish](https://github.com/adambrenecki/virtualfish)

<comment><USER10> Yeah, it works really well. That is what I use for my fish shell.

</comment></comment></comment></comment><comment><USER17> I still use vex and am very happy with that

[https://pypi.python.org/pypi/vex](https://pypi.python.org/pypi/vex)

[https://news.ycombinator.com/item?id=7987259](https://news.ycombinator.com/item?id=7987259)

</comment><comment><USER18> Why not use pyenv + pyenv-virtualenv ?

[https://github.com/pyenv/pyenv](https://github.com/pyenv/pyenv)

[https://github.com/pyenv/pyenv-virtualenv](https://github.com/pyenv/pyenv- virtualenv)

<comment><USER19> I personally found that the way pyenv conflated python versions and environments when using this produced confusing behavior around pyenv local settings and other features. At the time I tried it, there was also some opinionated behavior going on regarding shell prompt modification, etc., that caused it not to inform my prompt theming correctly.

Ultimately, I decided I didn't really want pyenv determining how I used virtualenv, I just wanted virtualenv to work well in pyenv.

The opinionated dynamic may have changed since then, but for me the happy medium has been pyenv-virtualenvwrapper. Instead of pyenv trying to take responsibility for my virtualenv behavior, it just takes responsibility for implicitly enabling virtualenv+wrapper on any given python version on first use. That's the right split for me.

</comment></comment><comment><USER20> Use neither. Use Nix.

</comment><comment><USER12> I'd say [https://github.com/ofek/hatch](https://github.com/ofek/hatch) is the more robust (and easier) choice for virtual env management.

FD: I'm the author

</comment><comment><USER21> Why not use conda?

<comment><USER22> Because conda (and by extension, Anaconda) harms the Python ecosystem with their non-standard package format. If Continuum Analytics cared about making scientific packages like numpy and scipy more accessible, they would make binary wheels for Linux/Windows/OSX with the MKL. There is no technical reason that prevents them from doing this. Instead they lock you in to their package/environment manager and create confusion when you have pip and conda packages installed at the same time.

<comment><USER23> Conda is a package manager for more than Python. It manages libraries that are shared between Python and R and other tools. This isn't possible with a purely Python-based solution.

It also does envs better than most other solutions since it will prefer hardlinks which allows environmental isolation at a very small cost in terms of disc space.

Full disclosure: I work for Anaconda Inc. where I am trying my best to make package management and scientific computing easier.

<comment><USER22> Shared libraries were invented at a time when disk space was very scarce. In my opinion, the fact that we still use dynamic linking today is largely an accident of history. Literally the only advantage over static linking (or distributing any shared libraries along with your application) is that you save some space, at the cost of requiring a complex package management system. Also, a sufficiently smart filesystem can deduplicate this transparently.

And of course, it makes distribution of any application that uses shared libraries a whole lot more difficult.

Disk space is the cheapest and most abundant computing resource in 2017. If you want to make these packages more widely available, just create wheels/whatever the R equivalent is. Good, well understood, and interoperable tooling for these already exists.

<comment><USER24> Dynamic linking is hugely helpful when, for example, you want to update to the latest openssl without updating half the binaries on your system. That packages are statically including openssl in wheels, and then wheel versions being explicitly pinned in projects, is introducing some juicy attack vectors.

</comment></comment></comment></comment></comment><comment><USER25> Why not docker? One docker image = one virtualenv

<comment><USER26> This is my thought too. Bonus: it's like virtualenv for _every_ language/platform.</comment></comment>


Reddit XSS worm (Don't mouseover Reddit comments and use FF+Noscript) - <AUTHOR> http://www.reddit.com/r/self/comments/9oo78/anyone_else_click_on_the_comments_to_a_story_and/ Infected page:
http://www.reddit.com/r/self/comments/9oo78/
Discussion on proggit:
http://www.reddit.com/r/programming/comments/9oo8j/source_code_for_the_redditfirefox_exploit/ <comment><USER2> <http://img503.imageshack.us/img503/9640/1254105520402.jpg>

Mousing over the comment causes you to submit one like it. According to 4chan, someone in proggit found the exploit at around 22:30. -- <http://zip.4chan.org/g/res/5994620.html>

<comment><USER3> Yep, an early comment in the submission with the pics of O'Reilly's "JavaScript: The Definitive Reference" and "JavaScript: The Good Parts" had the exploit, I didn't pay much attention, thought it was just someone screwing around with a JS snippet. Sounds like someone ran with the idea.

Hate to say it, but disabling JavaScript's the best workaround. Right now the infected comments are too prevalent to reliably avoid.

<comment><USER4> I just keep my mouse in the right column, over the ads. Seems to work so far.

</comment></comment></comment><comment><USER5> It really wasn't a good idea to link to a page _full of the 'infected' comments_...

<comment><USER6> Nothing seems to be happening to me. Do you have to be logged in to be affected by the attack?

<comment><USER5> Yeah, and you need to hover over one of the comments for it to work, too.

</comment></comment></comment><comment><USER7> Anyone know what this is a problem from? I've heard it's a Python Markdown vulnerability, or is it just in reddit' implementation of something?

<comment><AUTHOR> [http://www.reddit.com/r/programming/comments/9oo8j/source_co...](http://www.reddit.com/r/programming/comments/9oo8j/source_code_for_the_redditfirefox_exploit/)

comment this line in markdown.py

[http://code.reddit.com/browser/r2/r2/lib/contrib/markdown.py...](http://code.reddit.com/browser/r2/r2/lib/contrib/markdown.py#L291)

</comment></comment><comment><USER8> There was something similar going on earlier with a bookmarklet-style virus on proggit: [http://www.reddit.com/r/programming/comments/9okv7/ok_whoeve...](http://www.reddit.com/r/programming/comments/9okv7/ok_whoever_js_bombed_the_javascript_picture/) (note that this link also has the XSS worm in it, take caution)

Today is not a good day in redditland.

</comment><comment><USER9> This guy suggests some firebug code to run to delete all your comments from a page (in case you were hit by the hack):

[http://www.reddit.com/r/netsec/comments/9ooif/has_someone_cr...](http://www.reddit.com/r/netsec/comments/9ooif/has_someone_created_a_reddit_worm/c0dpwrv)

I have not tested it myself.

</comment><comment><USER10> It's not actually a XSS problem

<comment><AUTHOR> Yeah, it's not exactly cross-site, but cosider XSS as a paradigm shift

<http://en.wikipedia.org/wiki/Cross-site_scripting#Background>

</comment></comment><comment><USER11> IE8 isn't vulnerable, if you want to check it out safely.

<comment><USER12> Is that with the XSS protection (the built in functionality) on or off?</comment></comment>


Introducing Git protocol version 2 - <AUTHOR> https://opensource.googleblog.com/2018/05/introducing-git-protocol-version-2.html <comment><USER2> The current (and pretty much only, ever, despite Linus having been the creator) maintainer of git is a google employee [1], in case anyone else was wondering.

[1] [https://en.m.wikipedia.org/wiki/Junio_Hamano](https://en.m.wikipedia.org/wiki/Junio_Hamano)

<comment><USER3> Thanks, that really helps.

As an open-source advocate, my first thought was, "Why the hell is Google releasing a version of a protocol that Linus Torvalds wrote?"

Without that context, it would be like Google throwing up an announcement, "Introducing Google's Linux Kernel 5.0!"

<comment><USER4> That may seen odd, but it could happen in a open-source world: multiple parties releasing different versions of the same piece of software and calling it the same.

<comment><USER5> One fun example of this is the so-called RPM "5" fork[0], which is basically dead and almost entirely unused[1].

The result is the main RPM everyone uses will probably stay at version 4.x forever.

[0]: [http://rpm5.org/](http://rpm5.org/)

[1]: [https://en.wikipedia.org/wiki/Rpm_(software)#RPM_v5](https://en.wikipedia.org/wiki/Rpm_\(software\)#RPM_v5)

<comment><USER6> They could skip a version like PHP did. Among other reasons, since books and articles about PHP 6 had already been written long before PHP 5+1 came out, they went with 7.

<comment><USER5> Sure, they could. I don't think they've felt the need to. RPM tends to change slowly and conservatively.

</comment></comment></comment></comment></comment></comment><comment><USER7> Let that be a reminder to all the coders out there: if you ever design a protocol or file format to communicate between machines always remember to add a version field or some other way to allow for updates and revisions later without breaking everything. Having a way to specify extensions in a backward- compatible way is nice too.

<comment><USER8> > if you ever design a protocol or file format to communicate between machines > always remember to add a version field or some other way to allow for > updates and revisions later without breaking everything

Also, somehow make sure no servers, clients, or third-party middleboxes break when the version field is incremented. The TLS protocol designers had to give up on the version field; it's now going to forever be stuck at "TLS 1.2", since too much would break otherwise.

<comment><USER9> It's an universal truth: if you want to keep something from jamming up, you need to exercise it. It's true for the human body, for machine parts and for protocol features.

<comment><USER10> HTTP was at 1.1 for a very long time but it appears the upgrade to version 2 is going fine. What is the difference here? The protocol version exchange mechanism?

<comment><USER11> The HTTP 1.1 to 2 upgrade is only going fine due to massive work (mostly by Google) over a period of years. HTTP/2 was also able to benefit from a lot of pain that SPDY and WebSockets went through earlier. Protocol ossification is still a hard problem.

<comment><USER12> IIRC WebSockets has basically nothing to do with the way http2 is handled, and websockets are still going over a simple HTTP1.1 Connect/Upgrade. What is the connection between websockets and http2?

<comment><USER11> Early version of WebSockets exposed bugs in HTTP proxies, some of which were security problems: [http://www.adambarth.com/papers/2011/huang-chen-barth- rescor...](http://www.adambarth.com/papers/2011/huang-chen-barth-rescorla- jackson.pdf) To fix these kinds of problems, the final version of WebSockets does not use a straightforward upgrade but instead has a kludgey handshake and content masking: [https://en.wikipedia.org/wiki/WebSocket#Protocol_handshake](https://en.wikipedia.org/wiki/WebSocket#Protocol_handshake) [https://trac.ietf.org/trac/hybi/wiki/FAQ](https://trac.ietf.org/trac/hybi/wiki/FAQ)

HTTP/2 doesn't have the same problems because it requires TLS+ALPN, but IIRC that "clean" solution was only arrived at after years of discussion and experimentation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> The specification of the v2 protocol is here: [https://github.com/git/git/blob/master/Documentation/technic...](https://github.com/git/git/blob/master/Documentation/technical/protocol-v2.txt)

One of the more exciting things is that it can now be extended to arbitrary new over-the-wire commands. So e.g. "git grep" could be made to execute over the network if that's more efficient in some cases.

This will also allow for making things that now use side-transports part of the protocol itself if it made sense. E.g. the custom commands LFS and git- annex implement, and even more advanced things like shipping things like the new commit graph already generated from the server to the client.

<comment><USER14> If you are to link to a git repo, don't link to some unoffical mirror. That would just confuse search engines.

The specificiation of the v2 protocol is here: [https://git.kernel.org/pub/scm/git/git.git/tree/Documentatio...](https://git.kernel.org/pub/scm/git/git.git/tree/Documentation/technical/protocol-v2.txt)

(There are a couple of repos listed as official mirrors, such as the googlesource.com one, but the one you linked to isn't one of them.)

<comment><USER13> The repository I linked to is official. See [https://public- email@example.com...](https://public- firstname.lastname@example.com/)

What list are you referring to? If it doesn't list the one on GitHub it needs to be fixed.

<comment><USER14> I had a release announcement open for other reasons and noted the different URLs, but I was wrong and the link is absolutely fine. Thanks. If I could edit the post I would, so I'll just let this sit here in case anyone is confused (as I was).

</comment></comment></comment></comment><comment><USER15> Too bad they didn't make Git LFS part of Version 2[0]. Most vendors[2] support LFS already but because it isn't required, some still lack it and its support cannot be assumed.

[0] [https://git-lfs.github.com/](https://git-lfs.github.com/)

[1] [https://github.com/git-lfs/git- lfs/wiki/Implementations](https://github.com/git-lfs/git- lfs/wiki/Implementations)

<comment><USER9> I say that's LFS' fault. Why do you even need a custom server? It should just be able to use any ol' file server or S3-API compatible service, and do everything on the client side.

I find git-annex a much better solution, it's a shame everyone went with LFS.

<comment><USER16> My experience with git-annex is that it seems heavily designed for individuals and not for projects. The places it looks for files are often just a computer you were once developing on, and it sometimes expects you to go find that computer. It never forgets about any crazy place your files have been.

It was very hard to use in asymmetric cases where different people have different credentials, such as where one person has access to a computer and others don't, or where a couple of core developers have authenticated R/W access to a file server or an S3 bucket and everyone else just has HTTP.

<comment><USER9> Git-annex doesn't look for files in random places. It uses the regular git remotes, plus something it calls "special remotes" which are basically accounts on file servers/S3/etc that you can manually add.

If Github et all thought this was confusing, they could have made a "beginner's mode" that auto-selected the storage server based on the git server, like LFS does. Which would still have been better, since it wouldn't have required a custom server API.

 _It was very hard to use in asymmetric cases where different people have different credentials_

Right, but LFS can't be used in asymmetric cases at all - it assumes anyone with access to the git repository has access to the LFS storage area.

<comment><USER16> > Right, but LFS can't be used in asymmetric cases at all - it assumes anyone > with access to the git repository has access to the LFS storage area.

Wait, really? I thought that Git LFS let people with push access push files to the LFS area, which can then be read by anyone. That's asymmetric in the way everyone expects from GitHub. But I didn't use Git LFS because it's too expensive.

Yes, I probably encountered extra weirdness from git-annex, from the fact that the codebase was on GitHub, which doesn't support git-annex, so _everything_ in git-annex had to be on a different remote.

If it was meant to be used with the upstream as the only remote, that makes things make a lot of sense, and explains why my attempt to use it felt a lot like early Git, where there was no good upstream service like GitHub.

</comment></comment></comment></comment></comment><comment><USER17> I'm a very (very) minor contributor to git.

If you are at all interested in hacking on Git, it's not that difficult. Knowing C and portable shell scripting for writing tests are the big things.

One sticking point, you need to submit patches to the mailing list, you can't just do a github pull request.

See [https://github.com/git/git/blob/master/Documentation/Submitt...](https://github.com/git/git/blob/master/Documentation/SubmittingPatches)

I still see github pull requests rather frequently, even though they have never been allowed. All discussion AND patches go through the mailing list, much like the linux kernel.

<comment><USER18> It's unfortunate that github doesn't let a project disable the on-website UI for pull request submission; as it is it's easy for somebody to end up wasting their time trying to submit a change that way. (QEMU has that issue too.)

<comment><USER19> Totally agree! I made nopullrequests.com to help solve this.

<comment><USER17> And that's nice, but I'd also love to see a bot that formats the pull request into a patch email for you.

</comment></comment></comment></comment><comment><USER20> Sometime in the far future, someone will write an interesting story about how a double null byte came into existence in the git request protocol, and it will be amusing and interesting to look back. As the saying goes, hindsight is always 20/20\. I'm glad that they found ways to maintain backward compatibility, at only a minor cost to understanding things.

</comment><comment><USER21> It's quite a comedy that this feature has not been implemented for at least 6 years, solely because the raw git:// protocol's parameter handling was severely broken, and feature detection by disconnecting and retrying [1] was ultimately deemed far too dirty.

[1] [https://public- inbox.org/git/CAJo=hJtZ_8H6+kXPpZcRCbJi3LPuuF...](https://public- inbox.org/git/CAJo=hJtZ_8H6+kXPpZcRCbJi3LPuuF7M1U8YsjAp- firstname.lastname@example.com/)

</comment><comment><USER22> Wait, why was this posted by Google? I thought Git was made by Linus Torvalds.

<comment><USER23> Git was _created_ by Linus Torvalds, but out of the 50k+ commits on the repo, only 250 or so are from him, with only 14 in the past 6 years. [1]

[1] [https://github.com/git/git/graphs/contributors?from=2012-03-...](https://github.com/git/git/graphs/contributors?from=2012-03-11&to=2018-05-10&type=c)

<comment><USER24> Here is a more detailed analysis, which shows all contributors:

[https://public.gitsense.com/insight/github?r=git/git#b%3Dgit...](https://public.gitsense.com/insight/github?r=git/git#b%3Dgithub%3Agit%2Fgit%3Amaster%26t%3Dcontributors%26rg%3Dhistory)

These are contributions by Linus:

[https://public.gitsense.com/insight/github?r=git/git#b%3Dgit...](https://public.gitsense.com/insight/github?r=git/git#b%3Dgithub%3Agit%2Fgit%3Amaster%26q%3Dauthor%3Atorvalds%40g5.osdl.org%5E_%5Eauthor%3Atorvalds%40linux- foundation.org%5E_%5Eauthor%3Atorvalds%40osdl.org%5E_%5Eauthor%3Atorvalds%40ppc970.osdl.org%5E_%5Ewindow%3A10000%26t%3Dcommits)

and as you can see, his contributions, really tapered off after 2010, while contributions from Hamano remained steady from 2008 to present date, as shown below:

[https://public.gitsense.com/insight/github?r=git/git#b%3Dgit...](https://public.gitsense.com/insight/github?r=git/git#b%3Dgithub%3Agit%2Fgit%3Amaster%26q%3Dauthor%3Agitster%40pobox.com%5E_%5Ewindow%3A10000%26t%3Dcommits0).

</comment></comment></comment><comment><USER25> Is there a git protocol variant that allows the client to avoid downloading objects that it already has stored locally in another repository or cache?

For example: I have the Linux kernel already cloned in some directory. I clone a second repo which has the Linux kernel as a submodule. Can I clone the second repo straightforwardly without having to download Linux a second time? (Well yes, but only by manual intervention before doing the git submodule update - it'd be nice if objects could be shared in a cache across also repos somehow).

<comment><USER26> You could literally link the two object directories?

I just tried this and it seems to work:

      git clone git://github.com/git/git
      mkdir git2
      cd git2
      git init
      cd .git/
      rm -rf objects
      ln -s ../../git/.git
      cd ../
      git remote add origin git://github.com/git/git
      git fetch # returned without downloading anything
      git checkout master
      ls # etc.

If you seriously want to use this, you'll probably want to hard link the contents, instead. But iirc git clone from local disk already does that, for you?

In short: clone your local copy and taking it from there?

<comment><USER27> You can also use alternates:

      echo ../../../git/.git/objects >> git2/.git/objects/info/alternates

or use the original as a reference:

      git clone --reference git git://github.com/git/git git2

This sets up the alternates for you.

</comment></comment></comment><comment><USER28> AIUI, the git ssh protocol is just the git protocol tunnelled through ssh. So why do they need different mechanisms for signalling V2?

<comment><USER29> Because if you tunnel through ssh, you can signal v2 using ssh mechanism of setting environment variables. If you don't tunnel, you don't have this option. This is clearly described in the article.

<comment><USER30> I think what the person you're replying to is asking is why not, in the case of ssh, use the signaling in the git protocol, since it will be there anyways. That is, if you don't tunnel, you _must_ signal w/ the git protocol. If you do tunnel, why use a different mechanism, since the signal in the git protocol must be there?

I _think_ that this is because the SSH protocol _isn 't_ just encapsulating the Git protocol directly (the initial assumption of ssh "just" encapsulating the git protocol is not fully correct), and one of the parts that differs is this particular part. (Since on the git protocol side, we need to select a "service":

> _a single packet-line which includes the requested service (git-upload-pack > for fetches and git-receive-pack for pushes)_

which in SSH would be done not by transmitting that packet-line but by instructing SSH to run that particular executable.

> _This is clearly described in the article._

It really isn't, IMO; if you don't have precise knowledge of the protocols involved, I don't think anything in the article particularly spells this out.

</comment></comment></comment><comment><USER31> > Server-side filtering of references

I wonder if this will be somehow exposed by git daemon. It could be used for easy per ref access controls.

For example Git Switch [0] that uses Macaroons had to clone the repository to implement per ref ACL.

[0]: [https://github.com/rescrv/gitswitch](https://github.com/rescrv/gitswitch)

</comment><comment><USER32> I thought google uses hg, have they switched over to git as well?

<comment><USER33> For all the "big" Google projects they use a proprietary system called piper.

I think all their open-source stuff (Angular, GoLang, Android) uses git (and sometimes Gerrit).

Although given Google's scale, I'm sure there's some teams/projects that use Mercurial.

<comment><USER34> Gerrit is a review server that uses git. In fact, Gerrit now stores the majority of information in git itself for all the information it uses.

So for Google external projects, they use git.

> Although given Google's scale, I'm sure there's some teams/projects that use > Mercurial.

I doubt it. Their tooling is probably pretty specific, and now that code.google.com has shut down, they probably don't have any review servers that support it.

<comment><USER35> Yes and no. The answer is actually quite complicated... and I have no idea if I'm allowed to talk about it publically or not.

<comment><USER35> The most recent reason public reference I can find to this is from 2016: [https://cacm.acm.org/magazines/2016/7/204032-why-google- stor...](https://cacm.acm.org/magazines/2016/7/204032-why-google-stores- billions-of-lines-of-code-in-a-single-repository/fulltext)

Here's the money quote:

"The team is also pursuing an experimental effort with Mercurial an open source DVCS similar to Git. The goal is to add scalability features to the Mercurial client so it can efficiently support a codebase the size of Google's. This would provide Google's developers with an alternative of using popular DVCS-style workflows in conjunction with the central repository. This effort is in collaboration with the open source Mercurial community, including contributors from other companies that value the monolithic source model."

Project that forward logically by two years.

<comment><USER32> Not sure why I got heavily downvotes. This above was the pieces of information that got me to think they were all on hg. So judging from the comment I stand corrected.

<comment><USER35> Your assumption was pretty reasonable based on the public information. Honestly I'd love to talk about how Google does source control/ code review etc. because it's actually pretty interesting at this point. You know... for some values of interesting.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Is Git a Google project now?

<comment><USER37> No, but many of the core contributors are employed by Google and spend time on it as part of their day job (with Google's knowledge and permission). This post straddles both the open source part of their jobs and the "Git deployment at Google" part.

</comment></comment><comment><USER38> This is disgusting. So little forsight in the past... At least the outcome of quite useful.

<comment><USER39> IIRC, they were in a serious time crunch when they drafted/made git. I can't remember the whole story...

<comment><USER40> I thought Linus Torvalds was almost wholly responsible for the initial development of git? Even so, everything, especially software, is easier in hindsight....

<comment><USER39> Sorry, I was using the 'singular' they.

</comment></comment></comment></comment><comment><USER41> oh neat, and it's on a google blog.

That's great. Another subtle reminder that this ad company has way too much control.

</comment><comment><USER42> Interesting that they took to the Google blog to announce this; is there a corresponding LKML post?

<comment><USER37> Why LKML? Despite Git's origins from and use by the Linux project, it isn't especially tied to it now.

LKML would presumably be the place for Linux to announce when they adopt this.

The Google open source blog is among the several credible options for this post, since Google employs much of the core Git team, and this post discusses their experience deploying Git protocol v2 at Google.

As noted in the blog text, it's not in a released version of Git yet, just Git master branch. So maybe it'll appear on a dedicated Git announcement list, if any, once that happens.

<comment> joatmon-snoo Junio posts on the list when there's a new release, e.g. [https://public- firstname.lastname@example.com...](https://public- email@example.com/)

It seems that [https://groups.google.com/forum/#!forum/git- packagers](https://groups.google.com/forum/#!forum/git-packagers) is the closest thing to a formal announcement list that there is.

<comment><USER37> Okay, I guess that tie continues for historical reasons. At least people who don't otherwise subscribe to LKML can still receive Git release announcements via the second link.

I presume Git 2.18 (the first release supporting protocol v2) will be announced via both channels once it's out.

</comment></comment></comment></comment><comment><USER43> Git didn't have a proper version number or extensibility field in its protocol? That's quite a bit of hubris.

<comment><USER44> Or, more likely, an oversight.

<comment><USER43> Hmm, I haven't designed very many data formats or wire protocols, and I won't claim I got it right any of those times, but I included some kind of extension possibility every time.

<comment><USER45> I damn near released a (private) message protocol without a version field a couple months ago, and I know better. Fortunately stopped myself and added it before any actual data got released.</comment></comment></comment></comment>


41 percent of Android phones are vulnerable to 'devastating' Wi-Fi attack - <AUTHOR> https://www.theverge.com/2017/10/16/16481252/wi-fi-hack-attack-android-wpa-2-details <comment><USER2> Wow, that's devastating. My phone could be devastated. It's devastational how devastating this devastation is.

</comment><comment><USER3> Sensationalist title. This affects every implementation of WPA2. It's just hat Android was "exceptionally devestating" in that you could use an all-zero key. This just makes it easier.

<comment><USER4> The fact that a lot of OEMs don't push monthly security patches doesn't help.

</comment></comment><comment><USER5> Is there better reporting somewhere than The Verge? What's the best write-up people have seen?

</comment><comment><USER6> What a bad title! It could also have been "100% iphones are vulnerable".

<comment><USER4> The difference here, IMO, is that iPhones and Windows/Linux/Mac PCs will receive a patch in a couple of weeks, but how many perfectly working Android phones are now abandoned by their manufacturer? How many Android phones beside Google Pixel/Nexus receive monthly security patches?

<comment><USER7> Hundreds of millions of perfectly working Apple devices no longer receive patches.

<comment><USER4> You're right. This is bad.

</comment></comment></comment></comment><comment><USER8> Google hasn't been perfect, but they have had, and continue to improve, ways of addressing the update problem. If you are a first tier OEM you have the clout to make your chip vendors update their BSPs and support them for a decent length of time, and you have the resources to update your customers' phones. If you are a lower tier OEM, you should have gone with Android One, and shipped a more up-to-date Android in the first place and dumped the update problem on Google.</comment>


Google Changing Its Stance on Chrome OS Windowing? - <AUTHOR> http://www.thechromesource.com/google-changing-its-stance-on-chrome-os-windowing/ <comment><USER2> A simple split-screen would be a good start. If that's not enough, have a tiling window manager.</comment>


Vape pen kills man after exploding in his mouth - <AUTHOR> https://www.washingtonpost.com/health/2019/02/05/vape-pen-kills-man-after-exploding-his-mouth <comment><USER2> These stories scream of unsafe after-market modifications. Such as the popular method of dropping coil resistance super low which is massively dangerous

</comment><comment><USER3> I guess he will be cool now...</comment>


AMD may be facing irrelevance - <AUTHOR> http://arstechnica.com/gadgets/2012/09/op-ed-amd-may-be-facing-irrelevance/ <comment><USER2> Even after the merger, the company still basically makes 2 things: Desktop/laptop CPUs, and desktop/laptop GPUs. While these processor types _are_ merging, they aren't merging fast enough _in the desktop space_ to make the merger's syngeries valuable anymore.

A better way to say it is that smartphone/tablet form factors are really driving that merging, and the desktop/laptop space is just benefiting from it. Yet AMD isn't near any real tablets - they aren't in any Windows tablets, and they aren't making ARM CPUs.

The low-budget PC market really is being subsumed by tablets and smartphones - checking email, fb, twitter, websites, getting directions, and most common computing tasks are handled more easily by these low-power appliances than by an underpowered stationary desktop PC.

Even nVidia has Tegra processors running many popular tablets, and nVidia didn't even make general-purpose CPUs when AMD and ATI merged. Strangely enough, nVidia may be doing better in the mobile space than Intel.</comment>