My Case Against Code Comments - <AUTHOR> http://www.jakusys.de/blog/2010/12/my-case-against-code-comments/

<comment><USER2> I think everybody hates comments like "getFoo: Get the value of Foo", and huge blocks of commented-out code.

However, I _love_ seeing the following types of comments:

1\. The high-level overview of how things fit together: _This class represents a compiled method at the VM level. It does not contain the actual native code. If native code exists, it is handled using class Blah instead._

2\. What should work, but doesn't: _You'd think the following two lines of commented-out code would work, but they don't, because libfoo 1.7.1 and earlier has a stupid bug, so we need to do things the hard way._

3\. The epic warning: _Apple's Component Manager API does not work the way you'd naturally assume. First of all, it constructs a single 'instance' of a class before it initializes the class. Second, the memory reclamation system is really weird..._ and so on, for a page and a half.

<comment><USER3> Exactly. Code is for expressing how things are done.* Comments are for expressing why.

* Or if you're not into the whole imperative languages bit, what things are done.

<comment><USER4> Totally OT: How are you managing to use an asterisk as a footnote indicator and not ending up with the two asterisks invisible and the text in between in italic? I've seen this before and I've tried to replicate it and I can't do it. :-/

<comment><USER5> An asterisk followed by whitespace doesn't begin italics, so you get * word * rather than _word_.

<comment><USER4> Oh. Thank you!

</comment></comment></comment></comment></comment><comment><USER6> Summary: "Bad comments are bad. Good comments are good."

</comment><comment><USER7> Is the "Error establishing a database connection" on your site illustrative of their mischief at work?

[I don't comment unless it's a TODO or a DONT EVER... ]

<comment><USER8> Google has a cached version:

[http://webcache.googleusercontent.com/search?q=cache:-cU7R0Q...](http://webcache.googleusercontent.com/search?q=cache:-cU7R0QdkYUJ:www.jakusys.de/blog/2010/12/my- case-against-code-comments/&cd=1&hl=en&ct=clnk)

</comment></comment><comment><USER9> Nobody writes clearer code than Peter Norvig, yet he usually gives everything a line-or-so doc comment -- e.g. <http://norvig.com/lispy2.html>. That's pretty far from the comments-should-be- _rare_ credo. I like it.

My actual argument for that style sans appeals to authority: [http://stackoverflow.com/questions/499890/what-is-your- perso...](http://stackoverflow.com/questions/499890/what-is-your-personal- approach-take-on-commenting/500268#500268)

<comment><USER10> Worthy of a standalone post somewhere so I can add it to my bookmarks. :)

<comment><USER9> Thanks -- maybe I'll get to it soon.

</comment></comment></comment><comment><USER11> It's nice to see that yet one more person has come to their senses. Not much new in that post, but sometimes that's ok.

The code itself is _always_ the first, best, and final authority on how it works. Comments should add something beyond that, or they should not be there at all. The __Thou Shalt Comment __mindset is responsible for most bad comments. Ignore it and only comment when it will do the reader a service.

<comment><USER10> In theory everything you've said is accurate. In practice it's usually really hard (if not impossible) to know exactly who "the reader" will be in six months. Nothing says "prima dona" to me quite like encountering a few thousand lines of someone else's code that they couldn't even be bothered to document the major functions.

<comment><USER11> I comment for "me in six months" and that works ok. Not perfect, but ok. Nothing says "unthinking clod" to me like a few thousand lines of code with comments where I'm told that _i_ is a loop index.

<comment><USER10> I don't think anyone is advocating for comments explaining that $i is a loop index.

<comment><USER11> I don't think so either. But that's what comes out of Thou Shalt Comment. And yes, I _have_ seen loop index comments. Haven't you?

I think we'd both agree if we saw a good comment. I just want to focus on the 'good' part rather than the 'comment' part.

<comment><USER10> Of course I've seen loop index comments, and redundant variable declaration comments, and all manner of bad commenting. Thing is, I'll take a bad comment over blank code any day.

Crap comments warn me ahead of time that I'm dealing with a developer who's either too inexperienced to know how to comment well or too sloppy to do a good job at it and in either case I need to be paying closer attention to their code than I might otherwise.

</comment></comment></comment></comment></comment></comment><comment><USER12> Commented out code: frequently due to lack of version control, in my experience. Or one-off tests that should've been removed, but they forgot.

      /** Class FooBar - The purpose of this class is to do XYZ... */
      public class FooBar { ... }

> _This is one of my favorite examples. Almost an entire line of comments > wasted_

Not if you use a documentation-builder. They frequently result in simple documentation turning into several lines (@param desc \n @param desc, and the like). /* * does xyz * / _does not imply_ it is documenting that class and only that class. It could easily be meant for two or three classes in the same file, as they could be part of a greater whole.

</comment><comment><USER13> I am currently getting a "Error establishing a database connection" for the page. I hope where ever that happens; there might be a comment in the code explaining why.</comment>


America the sleazy? (based on its diplomats not paying tickets abroad) - <AUTHOR> http://www.economist.com/blogs/freeexchange/2009/08/america_the_sleazy.cfm

<comment><USER2> The congestion charge certainly looks like a tax from where I sit (the US).</comment>


Ask HN: How to pursue an unadvertised/nonexistent internship? - <AUTHOR>

I live in a Midwestern state where I am approximately a college junior (I am a 31-year-old non-traditional student who is changing careers from PR to software development). For a few years now, long before I decided to go back to school, I have been teaching myself Python and its associated web frameworks, as well as a few other languages in which I've dabbled.
I am more than willing to accept intern pay -- that is, market minimum or less, or none -- for an internship opportunity where I can be surrounded by people smarter and more experienced than myself. Unfortunately, there is only one company here who does something does something I consider really interesting.
How do I approach this company about an internship? Or should I even do that? The CEO hosts local Python meetups once a month, which I have trouble getting to since I have class on the nights they're held. We have exchanged a couple of emails (Me: "Does your company host any learning opportunities for aspiring programmers?" Him: "No, not really, what kind of format would interest you?" Me: "Shadowing would be cool." Him: None) but nothing really came of it.
How do I approach a company about internship opportunities they might not advertise or, in fact, even have available? (This company is seeking a python dev right now, a job I'm sure I'm not qualified for) <comment><USER2> When I was a sophomore in college, I knew I wanted to get into a startup as an intern. (I think there is a pg essay somewhere giving that advice, I followed it). I knew as a mechanical engineer with some software development experience I didn't want to be in one of the web 2.0 startups. I posted an Ask HN question about how to find startups in Manhattan (I lived in New Jersey, about 1.5 hour commute to manhattan each way). HNers posted two groups (NYTech Meetup, and TechNY?, forget the second one off teh top of my head). I sent an email out to those two groups basically saying, here is my resume, I would love to intern for a startup company, preferably one that does hardware, does anyone have any tips.

One of the members on the 2nd board told me about Bug Labs, and gave me the contact email for one of the guys there. I then went through about a 4 week process of playing phone and email tag. I never gave up. I'd get in touch about every 3-5 days and push for an interview. I finally got one, I think just so they'd shut me up. They really had no need/use/idea of what to do with an intern. But I think they knew I wanted it badly enough that it was worth taking a chance on me.

I ended up staying there for the rest of college doing 2 summer and 2 winter internships, and it was definitely the best experience/job I've ever had.

My suggestion is: figure out exactly what you want to do, find a contact in the company (for me it was HR not CEO) and just lay it out really clearly why you want to work for them and what you will do. For me I made it clear that I would pick up all the low priority tasks and free up the other engineers to do other things. That meant at first writing a lot of the manuals, testing, and writing tutorials. It was probably less programming than some other internships, but I was surrounded by some of the smartest people I've ever met, and it was a great place to work.

So just don't give up on contacting them, people in startups are busy, and make sure you make it clear what value you are going to bring to them becuase startups don't have the time or money to keep on interns that don't pull their weight.

</comment><comment><USER3> A bit of free advice from a consultant: if you get asked for a proposal, write a proposal which includes includes exactly what he needs to know to say "yes" and then ask for the "yes." That doesn't quite come across in that gloss. I don't know if I'd be angling for internships, though.

Do you know what the difference between you and the typical junior Python dev is? The junior Python dev _gets paid for programming Python_. Seriously. Apply for the freaking job. The worst thing that happens is you get told you have a hole in your engineering skillset. The likely thing to happen is that you will discover engineers are not hired for engineering skillset, because if they were there wouldn't be so many terrible ones still on the payrolls of corporations big and small.

<comment><USER4> This is exactly right. I ended up in an awesome internship that didn't exist until I proposed the position and me as the best candidate for that position. Think of something that they could use or would be advantageous for them and then offer to do it as an internship for them.

</comment></comment><comment><USER5> I've been looking around for (post-grad) internships for the last few weeks. The most successful tactic so far has been to just email and ask directly. Make sure to link to some existing projects that you can show off so they know you won't just be dead weight. Show that you have actually researched the company and are interested in what they do. I've had a few interviews already with this sort of thing:

      > Person X, I saw your job posting on HN and wonder if you also accept interns?
      >
      > I have professional experience with python, erlang and ocaml and have
      > previously worked in a startup environment. I have
      > little practical experience in machine learning or data mining but I
      > do have some classroom learning as well as a solid background in math.
      >
      > I have a resume and portfolio online (
      > http://scattered-thoughts.net/all?jid=2&tag=about ). A few of the
      > smaller projects in there are vaguely relevant to Company X - a personal
      > job hunting agent (
      > http://scattered-thoughts.net/one/1274/311469/330868 ) and an email
      > chat bot for 419 baiting (
      > http://scattered-thoughts.net/one/1274/311469/329424 ).
      >
      > I am hoping to start a phd in September so I cannot accept permanent
      > positions at the moment. I am not a US citizen but I am eligible for a
      > J1 visa and able to move to SF without financial assistance.
      >
      > Thanks
      >
      > Jamie

Edit: Fixed the formatting

</comment><comment><USER6> The best way to get their attention is to build something in Python that they would be interested in.

For example, do they have an API? If so, build off their API. Make a cool related service. Make a microsite. Develop a prototype of some technology/algorithm that would be useful in their business.

Forget resumes/shadowing/etc, just take the initiative to build something they will notice and love, and you'll have an instant connection.

<comment><USER7> If you take my word for it, aepstein's advice above is _solid gold_ \- very similar strategies have won me _paying customers_ in the past.

Go for it and all the best.

</comment></comment><comment><USER8> I'm in a similar vessel over here in Scotland/UK 30yr old, CS undergrad, wife/daughter etc. I've no experience other than the 1.5yrs coding from University and mostly in Java & php. Around 3 weeks ago I used linkedin to target companies in and around Edinburgh that I thought I could work in, loosely based on product/location but not tech stack. I also used google finance and used different phrases to find larger companies. I contacted managers and HR staff via unsolicited email with my CV and academic transcript.

I've had 3 interviews so far and a further 1 next week with. I've had 1 offer of p/t during term and f/t in the summer.

All 3 companies don't let interns loose on their codebase, understandable tbh. They look at setting a side project, within their 'product roadmap', to develop a proof of concept. Sometimes this ends up not being useful, but the company can keep their current dev team on more pressing issues while undertaking 'research'. Might be worth approaching with this tangent?

I'm assuming that an internship is the same over here as in your locale; a summer job? If python is your chosen path great but don't let it stand in the way of applying to different companies. All 3 of the companies I've interviewed with use .Net and MSoft stacks, of which I have no experience. I found most of the interviewers had been focused on assessing my communication skills instead of technical prowess. Learning another language can't be a bad thing?

Good Luck!

<comment><AUTHOR> Heartily agree on all counts. Learning new languages I am definitely not opposed to. I don't have a "pet stack." I just want professional experience for when I move to more, ahem, lucrative locales.

Thanks for responding.

</comment></comment><comment><USER9> I am also a university student and I just got an internship by talking to PHD students about their projects. I finally met one who was leading a super- interesting one. I asked about internships (+ bachelor thesis) and he got in touch with the company leading the project with the university, where I then applied and was just taken. It wasn't advertised, so just go and ask people with connections to the industry.

</comment><comment><USER10> Ask in person and keep on asking.

Be flexible in what you're willing to accept too, the idea is to get your foot in the door and either learn straight out, or make connections with people you can learn from.

Also make sure you're ready with the resume and everything else.

</comment><comment><USER11> Get to know a professor with industry connections and demonstrate to him/her that you're smart and/or hard-working. Use that as an inroad to a programming internship. It'll take some time, but it might be your best bet if there aren't a lot of internships on the market.

</comment><comment><USER12> Be direct, honest and keep it simple. That means, (1) be very clear on your abilities and expectations, (2) don't make them loose time, and (3) if you want to know whether they are looking for / would be interested in someone like you for an internship or not, just ask.

</comment><comment><USER13> I'm also a college junior and have been looking to gain development experience. I recently just had success emailing a startup in my area using their firstname.lastname@example.com address. I listed some of my skills, gave a link to a project that I did, and told them why I was passionate about what they were doing. The CEO ended up emailing me back the same day.

If anyone else is in this position I'd recommend trying this first since it's very good way to express interest in a possible job opportunity with a company.

</comment><comment><USER14> My advice would be to be very clear in your writing (e-mail exchange, cover letter) what the value is that you're going to bring the company. In this case, it seems like you want to sell yourself as a junior dev - someone who can do the coding that is busywork for the other devs - and you really want to stress that you'll be low maintenance for them.

If you can prove that you bring more value than you'll take, they should give you the internship.

</comment><comment><USER15> 1\. Write something they'll love. Something using their API or something. Something simple is ok, but something that shows that you'll provide value.

2\. Then apply for an unadvertised junior Python job, not an internship and show them what you wrote.

</comment><comment><USER16> I have had two interns in the past. Both of the positions came about because the person approached me and told me what they wanted to do. I didn't have to think too much about their proposal - they had it figured out for me. So I said yes.

</comment><comment><USER17> "Shadowing" is asking them to do something for you and offers nothing in return. It's a net loss for the company. You probably need to be willing to do whatever -- get coffee, stuff envelopes, sweep the floor. I have not done an internship of the sort you are wanting but did arrange an internship I needed for a college class. I went and asked. The longer I was there, the more I shaped it to what I wanted to do for them. I initially did "whatever" but as I got to know people better, opportunities came up for me to say "let me fix x for you". When that went well, they were more willing to listen to additional suggestions and work with me. It had the potential to become a self-created paid position had I not left the area when I did. It was a non-profit, so I would have had to find funding for my own position but the interest was there from their side.

<comment><AUTHOR> And when I'm there in person, what do I say? If I was qualified for a position, or it was an advertised internship, it's a well-worn dialogue on what to do and say. However, this is the first time in my life I've been passionate enough about something to be willing to ask someone what I can do to help with nothing to gain from it but knowledge. Looking for specific "talking points," I guess.

<comment><USER18> With reference to patio11's comment above: Your talking point is "I want to write some code in Python for your company."

Then, if and when they turn you down for that job, you can approach the CEO at one of those local meetups and say, "Hey, I'm trying to become a better programmer; what should I study next? Here's a couple of my projects on Github so you can see the sort of things I've been working on."

You keep talking about how unqualified you are. Perhaps you are merely too shy. But if you're certain that you don't know Python well enough to write code in Python for money... learn more Python! You will have to teach yourself, of course, using books and blogs and example code from Github and Stack Overflow and semi-random Googling and surfing through your system's source code. You will have to get used to that: Web programmers are autodidacts, as they have had to be since the Web was invented, and as they will continue to be for at least another decade.

<comment><AUTHOR> My friend & mentor keeps telling me to quit being a wussy and that I'm about as skilled as he was when he was a fresh graduate. I need to put on my big boy shorts and just apply. I am an enthusiastic autodidact so no problem there.</comment></comment></comment></comment>


Teach Yourself Computer Science, updated for 2020 - <AUTHOR> https://teachyourselfcs.com/ <comment><USER2> What about Harvard's CS50's Introduction to Computer Science?</comment>


Tesla Full Self Driving Demo on HW3 - <AUTHOR> https://www.youtube.com/watch?feature=youtu.be&v=tlThdr3O5Qo&app=desktop <comment><AUTHOR> I'm both excited and skeptical. There was a similar demo in 2016 and then repeated claims that full self driving ("coast to coast with no interventions") was less than a year away. How is this different? Apparently people at the event were taken on demo rides and it was very impressive. However, Tesla's current system has several notable issues like crashing into stationary vehicles at highway speeds. So what's the truth here? Very exciting if this is the breakthrough we've been waiting for, but I'm skeptical of all claims until released into the wild and shown to be generally true.

<comment><USER2> Claims are that the self driving capabilities have increased dramatically since 3 years.

<comment><USER3> The new systems are vastly improved over the ones from the last few years. I have a 4 year old one. They were explicit that you have to keep your hands up and on the wheel, but they still chose that vastly too suggestive name "autopilot". I want to see more explicit public testing, even though I own (an older) one. I want to see them test it with people walking on the side of the road, walking across the road, riding a bike on the side. Someone weaving or suddenly stepping in the road. Those are the things I want to be reassured about. My car is great at following roads with lines on them or just cars, if the lines peter out.

<comment><USER2> I am not supporting Elon or Tesla, but they did mention that Autopilot in Tesla is akin to how it's used in flights. Pilots are required to be vigilant at all times. It's more of assist than FSD.

<comment><USER4> Pilots are highly trained at flying and will fully understand what Autopilot in planes can and cannot do. To apply this logic for an application that will be used by mass consumers is a bit reckless.

</comment></comment></comment></comment></comment><comment><USER5> There's no dismissing how incredible this really is... there's no way I'd have imagined letting a machine control my car at 50mph in the city and highway just a few years ago. A mass-market video processor capable of 2000 frames/sec being piped to a machine learning system capable of >100 trillion instructions/sec is mind blowing tech.

Elon successfully uses the same 'distortion reality' shield that Jobs did. This forces his staff to keep trying to achieve his practically impossible demands.

Success requires that it keep working over and over while not burning out critical staff and investor's money.

</comment><comment><USER6> The video was impressive, but I'd like to see videos where the self-driving failed and the driver had to take over. Those would give me more confidence in the technology since I'd know what the limits are.

Now it seems very staged (probably isn't but still - i'd imagine they'd pick the most impressive video to post out of all their tests)

<comment><USER7> A CNN journalist experienced the new autopilot on a test drive, and he has a brief description of a situation in which the Tesla representative chooses to hit the brakes:

[https://edition.cnn.com/2019/04/22/success/tesla-navigate- on...](https://edition.cnn.com/2019/04/22/success/tesla-navigate-on- autopilot/index.html)

</comment></comment><comment><USER8> Strange. It's very impressive, but it feels _less impressive_ than the demo that released in 2016 [0], because the 2016 version had significantly more time on non-freeway roads. I skimmed through the latest video and didn't see any pedestrians. The 2016 video does have interaction with pedestrians and cyclists [2]

[0] [https://www.youtube.com/watch?v=VG68SKoG7vE](https://www.youtube.com/watch?v=VG68SKoG7vE)

[1] [https://youtu.be/VG68SKoG7vE?t=479](https://youtu.be/VG68SKoG7vE?t=479)

[2] [https://youtu.be/VG68SKoG7vE?t=97](https://youtu.be/VG68SKoG7vE?t=97)

<comment><USER9> The thing which most amazes me is how many people taking this one sped-up video of a country drive in perfect conditions as proof that Tesla has solved level 4+ autonomy.

Waymo shows a similar video and everyone's asking about whether it can correctly interpret a police officer's hand signals asking it to perform an otherwise-illegal maneuver at night in a thunderstorm, or change its own tyres, or come up with a 'right answer' to the trolley problem.

</comment></comment><comment><USER10> I wonder if the number of attempts at a clean run can be inferred from the battery level at the start.

</comment><comment><USER11> Passing on the right? How barbaric.

<comment><USER12> The only country I saw to this date in which drivers (almost) never pass on the right is Germany.

<comment><USER13> It's illegal in my state in the USA

<comment><USER14> And yet leaving the left lane open isn't...

</comment></comment></comment></comment><comment><USER15> But how does it fare in the freeway section that previously caused the barrier fatality?

</comment><comment><USER16> Full self-driving? Nah, _rural_ self-driving.

</comment><comment><USER13> Why are these always on a highway and never in the city?

<comment><USER17> Highways are relatively easy (always the first target for almost any type of driving assist). And highways account for large amounts of the distance people drive. Maybe not for the time spent driving though.

If you can do full self-driving on highways and similar roads, you can start shouting about full self-driving on high percentages of distance driven.</comment></comment>


Stopword removal for 54 languages in Node.js and the browser - <AUTHOR> https://medium.com/norch/22-new-stopword-languages-54-in-total-30370cf2d8c5 <comment><USER2> This looks pretty cool, but given I don't know much about natural language processing, what is it useful for?

<comment><AUTHOR> It's good for minimizing search indexes and query response. The size gets smaller when you don't index all those words that exists in all documents and mean nothing. And query/result response gets shorter when it doesn't have to calculate relevancy between a too large result set.

I also see a lot of people use it for chat bots and machine learning.</comment></comment>


How To Make Your Own Text Adventure On A Computer (Python) - <AUTHOR> http://www.bluzeandmuse.com/final_site/how_to.html <comment><USER2> Ooh, text adventures! Some suggestions:

If you haven't played any before, your first question may be: Why would I play a game made up just out of text? The IFComp is a good place to start. It really helps to what really talented people can do with the medium. Here are two worth playing:

1) Taco Fiction (<http://ifcomp.org/comp11/play.php?id=201>) and

2) Violet (<http://jayisgames.com/games/violet/>), both previous winners.

Inform7 is a very widely used tool for making IF now (<http://inform7.com/>); I haven't played with it much, but from what I've seen, it does some really great stuff. It's a good way to get started writing your own games.

\--

Full disclosure: My current project is a way to make CYOA from the browser. (<http://adventurecow.com>)

</comment><comment><USER3> There are many DSLs for just this purpose that almost always should be preferred to a general purpose language like python. <http://www.ifwiki.org/index.php/Inform_7> is the most commonly recommended.

But there are many others: <http://www.ifwiki.org/index.php/Category:Authoring_system>

<comment><USER4> I wrote a little game engine for the purpose of LPTHW... went a bit beyond what was required. The Inform 7 guide was a great tool to help. It probably is true that if you want to actually create a game that would be the way to go, it appears full featured enough to port just about any game out there.

That said, if you want to understand how such an engine works, it was alot of fun creating something in Python.

</comment></comment><comment><USER5> Playfic is another terrific tool for doing this. <http://playfic.com/>

It's a community for making and sharing interactive fiction (aka "text adventures") entirely from your browser, using a crazy-ass "natural language"-inspired language called Inform 7.

Some stuff is broken and missing, lots of rough edges.

</comment><comment><USER6> I love text adventures (P&C, too) and I always enjoy using them for teaching purposes. If anyone is interested in picking up Prolog anytime soon, I really enjoyed this tutorial: <http://www.amzi.com/AdventureInProlog/advtop.php>

</comment><comment><USER7> I wrote a cool iOS Text Adventure game framework for anyone interested, I was thinking of porting it to ruby motion but the niche I was going for ( learn to program ) probably don't have the cash for a Ruby Motion license.

<http://wibblequest.com>

</comment><comment><USER8> The return of Choose Your Own Adventure would be most welcome as well

</comment><comment><USER9> A very interesting read.

Relevant: I once built a very simple text adventure engine in C, in a few hours for a /r/dailyprogrammer challenge: <https://github.com/tech-no- crat/Cadventure-txt>

</comment><comment><USER10> Hmmm, maybe it's time for something like LambdaMOO[1] to get all cloudified...

Done carefully, I'm sure it could all run on Node.js

[1] <http://en.wikipedia.org/wiki/LambdaMOO>

</comment><comment><USER11> I think a better example for a text adventure would be Advent or Zork... Old, But very detailed, complex, and user-friendly.

</comment><comment><USER12> Join torilmud.org on port 9999 using telnet.

Their community is awesome!

</comment><comment><USER13> wow looks like this was written by a 12 year old, I'm impressed.</comment>


Understanding Integer Overflow in C/C++ (2012) [pdf] - <AUTHOR> http://www.cs.utah.edu/~regehr/papers/tosem15.pdf <comment><USER2> _In fact, in the course of our work, we have found that even experts writing safe integer libraries or tools to detect integer errorssometimes make mistakes due to the subtleties of C /C++ semantics for numerical operations_

Another nail in the coffin for the meme that "good programmers don't write code with undefined behavior".

<comment><USER3> Is that really a thing? That sounds almost as illogical as saying 'good programmers don't write bugs'. Should be more like 'good programmers are aware of undefined behaviour and try to not invoke it' or so.

<comment><USER4> Yes, it totally is a thing, although it's usually described more as "C(++)'s undefined behavior isn't a problem because any good programmer should be able to easily avoid it"\--a sentiment that I have seen (and challenged) on Hacker News a fair amount. The contention that I (and the authors) have is that integer overflows are so pervasive that it's not practicable to expect that even good developers are capable of avoiding them.

Some things to really emphasize here:

1\. This study found 47% of packages tested exhibited undefined integer overflow on their test suite. This isn't using fuzz testing or anything to try to find corner cases to make overflow far more likely, this is more or less "opening the application triggered undefined behavior"-level pervasiveness.

2\. The study also looks at unsigned integer overflow, which is well-defined but often no less problematic. The classic example I'll give is the calloc bug --calloc takes two arguments and multiplies them to find the size to allocate, and virtually every time that I've seen this function implemented, an exploitable CVE can be found (when the multiplication overflows).

3\. The prelude to this work (that produced the IOC, and, ultimately, Clang's UBSAN) is what really woke the community up to the problem. It actually did prompt the C and C++ specifications to make changes (INT_MIN % -1 is now considered UB, and C++, but not C, makes 1 << 31 == INT_MIN defined behavior).

Now that memory errors are slowly disappearing, it's integer problems that are becoming the pain-in-the-neck for exploits. My personal opinion is that the treat integers as ℤ_{2³²} model is no longer a good idea as the default integer model, and we need to start looking at bringing back models like big integer (à la Python), saturating, or explicit trapping models (à la Ada); I was quite disappointed when Rust opted to keep the wraparound model.

<comment><USER5> > Now that memory errors are slowly disappearing, it's integer problems that > are becoming the pain-in-the-neck for exploits

What fraction of integer overflow exploits crucially have to be _combined_ with an unsafe memory model in order to be weaponizable? I suspect the number is close to 99%.

(I know there are a handful of overflow-related security problems that are independent of memory safety--someone mentioned money overflow issues in online games when this topic came up last--but they are few and far between.)

> I was quite disappointed when Rust opted to keep the wraparound model.

That's oversimplified. In debug builds, Rust panics on overflow; in release builds, Rust may or may not panic. It doesn't right now out of performance considerations. That is not a decision that is set in stone if the performance becomes acceptable in the future.

<comment><USER6> This means that Rust has experience with wraparound and with panics. So this question should be answerable by someone on the Rust team: how much does the check cost? A few percent? A factor of 2? Surely not more than that?

<comment><USER5> Depends. The problem is not so much the overhead of the check itself as that it introduces a lot of control flow edges which interfere with optimizations. For example, on x86 you can kiss most uses of LEA goodbye...

<comment><USER6> Sure, but when all is said and done, what's the cost? There are plenty of Rust benchmarks by now, possibly some of them are part of the test suite. How much do they slow down?

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Wild and whacky idea: has anyone ever built a language with separate types for ordinal/cardinal numbers and nominal numbers? The idea would be that with nominal numbers you don't care about the precise result of individual calculations, just statistical properties like determinism, distribution, etc. So arithmetic on nominal numbers would be permitted to overflow, as operations are just various ways to jump from one nominal to another. However, most numbers would be ordinals/cardinals, and any overflow when generating an ordinal/cardinal would be considered an error.

[https://en.wikipedia.org/wiki/Nominal_number](https://en.wikipedia.org/wiki/Nominal_number)

<comment><USER6> What can you usefully do with a nominal number, besides input/output and comparing two of them for equality? I don't think you need language support here, library support should suffice, unless I'm missing something.

<comment><USER7> I was imagining that you could do everything with nominals that you normally do with integers. Arithmetic saving results in nominal numbers would just disable overflow checking. This would allow all operations involving regular numbers to double down and perform extremely strict overflow checking.

<comment><USER8> The question is (and I think was), what arithmetic do you do with numbers whose values don't matter and what concrete value they happen to have is purely accidental and arbitrary and unimportant.

<comment><USER7> From the OP, examples of intentional overflow are "..hashing, cryptography, random number generation, and finding the largest representable value for a type."

<comment><USER8> Which are not categorical variables? Those all are examples using _actual_ numbers, meaning the values matter.

> _Nominal numbers or categorical numbers are numeric codes, meaning numerals > used for identification only. The numerical value is in principle > irrelevant, and they do not indicate quantity, rank, or any other > measurement._

You talked about nominal numbers up to (but excluding) this post.

"nominal" means "in name only", so it's a "number", not a number. It just happens to have the same name as a number with a value.

<comment><USER7> Yes, I'm still calling them nominal numbers, but you can give whatever name you want for "I don't care what the precise results of arithmetic are." I'll stop here because there's nothing I hate more than pedantic arguments about semantics.

<comment><USER8> It isn't pedantic. You asked about arithmetic of nominal numbers, which makes no sense at all.

        >  "I don't care what the precise results of arithmetic are."

This is wrong! That is NOT what "nominal numbers" are!

I already quoted it, "nominal numbers" _have no value_!

You are absolutely right though: This conversation has lead nowhere. I'm not sure your identification of who is to blame is correct though.

 _You_ asked about nominal numbers, and when asked for details your examples all are about _actual numbers_. When I point that out your reaction is to be offended. How mature.

You can't talk about "nominal numbers" and then be miffed that people don't understand that you are not actually talking about nominal numbers at all! I only come to understand that now. Tip: Don't talk about water when you mean sand, and then act confused when someone brings you water instead of sand.

<comment><USER7> If I choose to add my phone number and yours, who's going to stop me? Would the universe explode? Would my phone number not be nominal anymore? It's a sort of "if a tree falls in the forest" question. Regardless of whether you're right or wrong (I just read the wikipedia page and didn't see anything about arithmetic, but maybe you have a phd in math), the essence of pedantry is to continue to insist I used the wrong word even after you understand what I meant.

<comment><USER6> Hm, I'm still missing something here, but I think your comment about phone numbers might be the key to the mystery, so let's go with that for now.

If you choose to add two phone numbers, I think we both agree that the phone numbers are still nominal. But I think we also agree that you have computed nonsense. There's nothing you can do with that sum. Which naturally raises the question: why should a programming language support this operation?

<comment><USER7> Come on guys, you're getting hung up on the wrong aspect here. I'm starting with precisely the operations the OP mentions as requiring wraparound overflow support: computing digests, hashes, random numbers, things like that. Currently we use unsigned numbers when we require overflow, but things are still extremely error-prone as the OP shows. So my thought was to come up with a new dichotomy: instead of signed vs unsigned, just ask for whether you want wrap-around overflow or not. Pretty please can we just forget I ever used the word 'nominal'?

If you think adding two phone numbers can have no possible useful application, what do you say to taking strings of text, converting them to numbers, and repeatedly folding them over each other to compute a cryptographic digest? You're right that it is meaningless in the context of the original domain, but it clearly has application. The two are distinct ideas.

<comment><USER6> Okay, finally I get it! As far as I know, Rust has a few types in the stdlib that are guaranteed to overflow, that you can use if that's what you want. C# has something even more interesting:

        checked(a+b) // crash on overflow
        unchecked(a+b) // wrap on overflow
        a+b // use the default of the surrounding context

The global default is provided by a compiler switch. Here's the thing though: the default setting of that compiler switch is to wrap on overflow. Even in debug mode! And you yourself identified the cause: most of the time, you're not doing crypto and such; most of the time, you do not want wrapping. But if you make overflow checking "opt-out" instead of "opt-in", the program slows down.

<comment><USER7> Most interesting. Yeah, I'm inclined to just eat that one-time slowdown. We've all anchored ([https://en.wikipedia.org/wiki/Anchoring](https://en.wikipedia.org/wiki/Anchoring)) on running our programs without these runtime checks, so that our apps seem slower with them. But if we take on that one-time cost the programs will eventually get faster with faster hardware, better compilers, more cores, etc. And we'll be safe from these issues for ever more.

Thanks for letting me know my idea finally got across. I was massively under- estimating its subtlety.

<comment><USER6> > Yeah, I'm inclined to just eat that one-time slowdown.

Maybe eventually the world will agree with you. We already eat the slowdown that comes with bounds-checked arrays. And indeed, compilers are getting better at removing that bit of overhead, compared to, say, the 1970s.

<comment><USER7> Since I have you here: I teach programming with this portable, safe assembly language (as opposed to the portable, expressive assembly language that was C). It has bounds-checked arrays. It always initializes variables. The type system is strong, so you can't ever create an address out of a number. It compiles with -ftrapv so any signed overflow immediately triggers an unrecoverable error. It has pointers and requires manual memory management, but it has refcounts so you can't ever have a use-after-free error. As a consequence any copy of an address incurs some overhead to update refcounts, and any copy of a struct incurs even more overhead to update refcounts of all addresses contained within. Between initialization, bounds checking, overflow checking and refcounting, I think I've pretty much eliminated all sources of undefined behavior.

[http://akkartik.name/post/mu](http://akkartik.name/post/mu)

[http://akkartik.name/about](http://akkartik.name/about)

[https://github.com/akkartik/mu](https://github.com/akkartik/mu)

<comment><USER6> I've superficially glanced at mu. It seems to have even more awesome stuff than I realized. But still: you're basically programming in glorified assembly. You can't add three numbers without splitting the thing into two statements. Is this really a pleasant way to program? I think this may be a good way to teach programming, but only because no one writes big programs when starting out. On the other hand, you claim to have written the UI in mu itself, so maybe I'm just plain wrong here. (Or did I misread that?)

<comment><USER7> You're right that I wouldn't want the whole world to program this way.

That said, it's been surprisingly ergonomic. If it had a compiler and could generate binaries, and if it had parity in libraries with C, I think I would strongly prefer using it to C. The massively increased safety is worth giving up a lot of expressivity for, IMO. No comparison with HLL languages for prototyping, of course. Eventually I hope to get the usual HLLs reimplemented atop it. One subtle point is that since it's refcounted at the Assembly level, any language built atop it requires minimal GC support.

The fact that it's Assembly has caused some confusion with others, so I want to point out that:

a) you can add any number of numbers in a single instruction; that gets handled behind the scenes. Many instructions are variadic where it makes sense.

b) you don't need push/pop/call to call a function, function calls look just like primitive operations.

c) Mu knows about types, so it knows how to allocate them, how to print them, and (eventually) how to serialize/unserialize them. These things can be overridden, but they work out of the box for any new types you create.

d) Mu supports generic types. Here's a generic linked-list, for example: [http://akkartik.github.io/mu/html/064list.mu.html](http://akkartik.github.io/mu/html/064list.mu.html). Types starting with underscores are type parameters.

e) You get structured programming by default using the _break_ and _loop_ instructions which translate to jumps just after the enclosing '}' and '{' label, respectively. Factorial in Mu looks surprisingly clean: [http://akkartik.github.io/mu/html/factorial.mu.html](http://akkartik.github.io/mu/html/factorial.mu.html)

What's common to these features is that I could imagine implementing them in a compiler using just machine language and Mu. What I'm trying to avoid is having to write a complex optimizer. These features (I think) don't massively increase the impedance mismatch between Mu and machine code; they can be implemented with basically glorified search-and-replace.

The Mu editor is built in Mu, yes. That's just because I don't have a HLL yet. It's not to say that I think everyone should build apps only in the Assembly layer. It's a little like the early days of C and Unix: until the language got stable people built the original versions of compiler and OS in Assembly. But they were eventually able to move to C.

<comment><USER6> Okay, factorial and linked list changed my mind. This is way more ergonomic than I gave it credit for. It doesn't seem to quite agree with /post/mu; in particular, I see no usage of next-ingredient and instead I see the typical function prototypes you seem to be critiquing. Does this mean next-ingredient is gone, or is it optional or...?

<comment><USER7> Ah, thanks for the feedback! I'd written that article before Mu got function headers, and never gone back to re-read it.

a) _next-ingredient_ is still around, and I still teach it first before graduating students to headers.

b) Headers get translated to _next-ingredient_ calls behind the scenes, but without the need to type-check ingredients at runtime.

c) You might still choose to use _next-ingredient_ if you want to implement optional arguments, or variadic functions. A weird one is _interpolate_ (in [http://akkartik.github.io/mu/html/061text.mu.html](http://akkartik.github.io/mu/html/061text.mu.html)), which scans through its arguments twice, first to compute the size of the array to allocate to hold them, and then a second time to copy them over. Since calls to _next-ingredient_ can get arbitrarily complex, Mu doesn't bother type-checking them. It just moves the type-checking for explicit calls to _next-ingredient_ to run-time.

I'll update that post. Thanks again.

<comment><USER6> Cool. Two more silly questions. (1) How fast is mu these days? Is it roughly competitive with CPython? (2) You mentioned it would be nice to have a compiler someday. It occurred that maybe something like the JVM would be closed to the existing semantics than x86. It's also strongly typed and has bounds-checked arrays and stuff. Hm. I guess that's not a question. Never mind.

<comment><USER7> Not silly at all!

(1) It's a good question. I think small benchmarks will likely be much slower in Mu since Python probably has optimized primitives for the common things whereas Mu is still (naïvely) interpreted. On larger apps I think the gap might come down, since Python will start relying more on unoptimized primitives. But I should probably measure at some point..

(2) Lol. I actually modeled Mu's on JVM to some extent, so it's intended to be a better replacement of that layer of the stack, something that compiles down to native rather than relying on a bytecode interpreter, and also something that is designed with higher-order functional programming in mind, as well as generics out of the box (so no type erasure and so on).

<comment><USER6> Thanks again!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Author here. FWIW the linked paper is the extended edition as published in TOSEM 2015, not the original ICSE 2012 paper, which I was surprised by given the year in the subject.

That said, I'm glad this edition is getting a bit of attention as we were able to be more thorough given the longer format (as well as more time), including an automated study of the top 10k Debian packages. The paper details what's new in more detail.

Let me know if you have any questions or comments.

May your integers be safe!

<comment><USER7> I'm curious to hear your thoughts on [https://news.ycombinator.com/item?id=12063597](https://news.ycombinator.com/item?id=12063597)! The long thread beneath it basically convinced me that calling them 'nominal' was a bad idea, but perhaps if we had a chance to do C over again we should replace the dichotomy between signed and unsigned with abort-on-overflow and wrap-on-overflow?

</comment></comment><comment><AUTHOR> Also, Robbert Krebbers's PhD thesis titled "The C standard formalized in Coq" [0]. From the summary:

Our formal specification of C is faithful to the C11 standard, which means it describes all undefined behaviors of C11. As a consequence, when one proves something about a given program with respect to our semantics, it should behave that way with any ostensibly C11 compliant compiler such as GCC or Clang.

[0] [http://robbertkrebbers.nl/thesis.html](http://robbertkrebbers.nl/thesis.html)

</comment><comment><USER10> >a truncation error on a cast of a floating point value to a 16-bit integer played a crucial role in the destruction of Ariane 5 flight 501 in 1996. These errors are also a source of serious vulnerabilities, such as integer overflow errors in OpenSSH [MITRE Corporation 2002] and Firefox [MITRE Corporation 2010], both of which allow attackers to execute arbitrary code. In their 2011 report MITRE places integer overflows in the "Top 25 Most Dangerous Software Errors" [Christey et al. 2011].

Wow, that's more than a little enlightening.

<comment><USER11> It's interesting that the article mentions the Ariane 5 bug, but doesn't mention that the Ariane 5 software (at least the component that caused the bug) was written in Ada, not C.

The real problem is that the Ariane 4 software was used without re-testing for the new rocket. The overflow could not occur on the Ariane 4. The higher acceleration of the Ariane 5 resulted in the overflow. The overflow was caught by the Ada runtime system, and generated an error message. The error message was then processed as data.

<comment><USER12> This is not targetted directly at you, but when I spot people talk about Ariane 5, it is generally only to cover one particular aspect of the bug which confirms their personal opinion or agenda. So for reference, here is the full report: [https://www.ima.umn.edu/~arnold/disasters/ariane5rep.html](https://www.ima.umn.edu/~arnold/disasters/ariane5rep.html)

> 3.2 CAUSE OF THE FAILURE

> The failure of the Ariane 501 was caused by the complete loss of guidance > and attitude information 37 seconds after start of the main engine ignition > sequence (30 seconds after lift- off). This loss of information was due to > specification and design errors in the software of the inertial reference > system.

> The extensive reviews and tests carried out during the Ariane 5 Development > Programme did not include adequate analysis and testing of the inertial > reference system or of the complete flight control system, which could have > detected the potential failure. </quote>

Some interpretations:

 _Put it in the contract: The lessons of Ariane_ ([https://www.irisa.fr/pampa/EPEE/Ariane5.html](https://www.irisa.fr/pampa/EPEE/Ariane5.html))

 _The Ariane 5 bug and a few lessons_ ([http://www.leshatton.org/Documents/Ariane5_STQE499.pdf](http://www.leshatton.org/Documents/Ariane5_STQE499.pdf))

 _I heard tell that Ada was to blame for the Ariane V disaster. Is this true?_ ([http://www.adapower.com/index.php?Command=Class&ClassID=FAQ&...](http://www.adapower.com/index.php?Command=Class&ClassID=FAQ&CID=328))

</comment></comment></comment><comment><USER13> Do there exist any good tools for identifying undefined behavior in C or C++ code? Compiler warnings are getting better, and "sanitizers" can catch undefined behavior that actually happens at runtime, but I still haven't found anything that consistently catches unwanted optimizations based on compiler assumptions of "no undefined behavior".

Stack ([https://css.csail.mit.edu/stack/](https://css.csail.mit.edu/stack/)) is the best tool that I've found, and while it's a great start, it's extremely difficult to install, clumsy to use, doesn't appear to have been touched in years, and only catches a limited subset of constructs. Is there anything else out there? If not, is it because it's perceived as too difficult to do, or is it just not perceived as a need?

<comment><USER14> Probably Coverity ([http://www.synopsys.com/software/coverity/Pages/default.aspx](http://www.synopsys.com/software/coverity/Pages/default.aspx)) is the best / most complete implementation of this idea.

Although it has impressive capabilities, you'll need to deal with their sales people, get a license, and invest a non-trivial amount of time learning the system, modifying your software build, etc, to get a lot out of in. Unless your code is mission-critical, it's probably more trouble than it's worth.

</comment></comment><comment><USER15> Integer overflows don't kill people; people kill people with integer overflows.

I'll show myself out :)</comment>


4 Things You Should Do To Prepare for A Hackathon - <AUTHOR> http://blog.onemonthrails.com/4-things-you-can-do-to-prepare-for-your-first-hackathon/

<comment><USER2> I cannot imagine attending a hackathon without a branching strategy. It may be out of touch for some beginners but I highly recommend Nvie's GitFlow ([https://github.com/nvie/gitflow](https://github.com/nvie/gitflow)).

My first hackathon was one of the best coding experience's I have had since jumping into the programming community but... man, it would've been so much better if my team didn't have an anxiety attack every time we merged code. It also saves you a ton of time which is crucial at a hack.</comment>


Ask HN: Is there "non-evil" antivirus software besides Windows Defender? - <AUTHOR> We've read a lot lately about evil things that AV programs do, MITM'ing TLS connections, breaking browser defense mechanisms by inserting DLLs [1], shipping horribly insecure browser extensions (just look at all the vulnerabilities discovered by Tavis Ormandy), and, of course, making your whole computer crawl.<p>Is Windows Defender actually the only AV software that doesn't to most of these things, or are there other AV programs (with better detection rates) that don't do more harm than good? Can you name specific examples?<p>[1] http://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html <comment><USER2> On one security seminar lecturer claimed antivirus software stops max. 40% of threats, remaining 60% goes unnoticed (as per 3 years ago, it might be even worse today)... So I'm not sure if there is any antivirus software that can really help if user won't take time to educate and stop doing things that introduce those threats.

<comment><USER3> Forgot to add, but you are totally correct if more people were educated on the potential and where/how to get malware, you would be much safer. I don't use an av and dont get malware.

<comment><AUTHOR> _> I don't use an av and dont get malware._

Neither do I. There are however users who firmly believe that they need AV, and in some cases, I might even tend to agree; hence my question.

<comment><USER3> Oh yeah, I would never let my parents go without an AV, they would never stop calling me otherwise. Back to your question though, are you running into any problems with existing products, which ones are you having trouble with.

<comment><AUTHOR> Kaspersky MITM's TLS connections by default and inserts JavaScript into sites that you visit. It installs its own root cert even if you disable TLS interception.

Are there free AV products that simply offer a good file scanner, no TLS interception, no broken browser extensions, etc.?</comment></comment></comment></comment></comment>


The Dark Side of C++ (2007) [pdf] - <AUTHOR> http://www.fefe.de/c++/c%2b%2b-talk.pdf <comment><USER2> This presentation is from 2007. It's outdated and full of errors. I'll refer to the comments at /r/programming [http://www.reddit.com/r/programming/comments/193o4p/the_dark...](http://www.reddit.com/r/programming/comments/193o4p/the_dark_side_of_c_pdf_you_lucky_firefox_19_users/)

<comment><USER3> I call BS on most of the presentation. For example, throwing exceptions from a constructor is not only acceptable, it's the only way to prevent construction.

<comment><USER4> Exactly. One valid criticism could be that getting exceptions right in C++ can be quite a challenge; i remember that at one point i was very into the language and was blown away by reading Exceptional C++ ( _really_ recommended for any C++ programmer), i was like re-discovering the whole language altogether.

<comment><USER5> Most people just miss the common C++ idioms that solve many of the exception issues in very elegant ways (and give a lot of benefits at the same time).

E.g. the example with file open + close in the presentation is laughable. Every C++ programmer knows that this is something that should be done with RAII. I.e. instead of manual close calls you let the destructor handle it. This is both exception-safe and spares you remembering to add a close call on every possible exit-path.

Also one should point out that C++11 has unique_ptr and shared_ptr which in many cases remove the need for the programmer to manage things by himself.

<comment><USER6> "I.e. instead of manual close calls you let the destructor handle it. This is both exception-safe and spares you remembering to add a close call on every possible exit-path."

Unless closing the handle causes an exception to be thrown. Either you never see the exception or your program aborts, and neither one is particularly good if you want to write reliable code.

<comment><USER7> "Unless closing the handle causes an exception to be thrown."

That is a straw-man argument. If the underlying file-closing API can throw exceptions, they must be caught from the destructor. If that means that they get ignored, then that is what it will have to be (much the same as most C programs ignore the return call from `printf`). Also in this case, the RAII wrapper should provide a member function which can execute the underlying close call early and expose the failure, for users who may be interested in guaranteed reliability.

In any case, provide RAII _safety_ does not intrinsically reduce reliability. If your destructor is executing code which _must_ succeed or be handled at a higher level, then a good developer will not put it in the destructor. No language feature can solve the question of "where should the program stop caring about failure?"

<comment><USER8> > in this case, the RAII wrapper should provide a member function which can > execute the underlying close call early and expose the failure, for users > who may be interested in guaranteed reliability.

Indeed; this is a useful technique. However, it means that you now have a close() method which you have to call on every exit path, because if you miss a path, that's a path which could have an exception thrown from a destructor. And that basically means you're not doing RAII anymore.

So yes, RAII is intrinsically incompatible with this kind of reliability.

<comment><USER7> > However, it means that you now have a close() method which you have to call > on every exit path, because if you miss a path, that's a path which could > have an exception thrown from a destructor.

Not true at all. `close` and the destructor should be idempotent. In the main path, `close` will get called and failure will propogate upward. In any other failure path, the destructor will attempt to perform the underlying close and allow the stack to unwind without any further interruption.

Of course, anyone can come up with pathological cases where this is not acceptable behavior from a high-reliability sub-component. And in such a situation, RAII may not be the best answer (nor would lexical scoping i.e. constructor/destructor, for that matter!) But in my experience, this approach is just fine for most application-level code.

<comment><USER6> ...or we could retool exceptions so that destructor exceptions are safe (as long as they are caught). Conditions in Common Lisp, for example:

[http://www.gigamonkeys.com/book/beyond-exception-handling- co...](http://www.gigamonkeys.com/book/beyond-exception-handling-conditions- and-restarts.html)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> While some points may be incorrect and some outdated in this 2007 presentation there are valid points. Especially it is true that the behavior of a line of code in C++ cannot easily be inferred from it alone, which can quickly become a problem as a code base grows in size and there is no common coding standard. A coding standard and automatic tools to enforce it (think clang-based compiler plugins that run before commit) can solve such problems and make C++ still one the best languages out there for high-performance programs, while guaranteeing good maintainability of the code.

There is C++ code out there which reads beautifully and is correct, you just have to work a little harder than in other languages. When you need the performance and control then it is worth the additional effort.

<comment><USER10> To be fair, template error messages are still a black art. They can take half a page. Reminds me of the old CFront days when C++ compiler was a front-end for another compiler. Templates are not very well integrated still.

<comment><USER9> clang has solved this problem mostly with their template type diffing. gcc has also improved in that area.

<http://clang.llvm.org/diagnostics.html>

<comment><USER10> Cool, but the template examples leave me unconvinced. When I get to work, I'll paste in an epic template error; hard to see how clang could make it all better :)

</comment></comment></comment></comment><comment><USER11> Hmm, I found some of the criticism unfair. E.g. the example with "baz = foo->bar(3);". Yes, "bar" could be a number of things here, but that's why variable naming conventions help.

The point about operator overloading is accepted, but this is not too different from what happens with metaprogramming in Ruby or say macros in lisp.

Even python has some quirks. See: [http://stackoverflow.com/questions/1132941/least- astonishmen...](http://stackoverflow.com/questions/1132941/least-astonishment- in-python-the-mutable-default-argument)

<comment><USER12> > Hmm, I found some of the criticism unfair. E.g. the example with "baz = > foo->bar(3);". Yes, "bar" could be a number of things here, but that's why > variable naming conventions help.

Then why must variables have static types?

<comment><USER13> What does one thing have to do with the other? Static typing reduces runtime errors by requiring you to be explicit when you want a nontrivial type conversion. There are entire classes of errors and security vulnerabilities that come from poor type checking. SQL injection is purely a result of SQL not requiring type information, which causes the SQL server to be unable to properly distinguish between the end of user-provided data and the start of the next statement, foisting that task onto the programmer who neglects it at his peril.

</comment></comment></comment><comment><USER14> Some valid points, but I was hoping for more meat, maybe references to what I call "dark corners" of C++. Take, for instance, writing a simple logging class that can log to multiple places and can be used in place of std::cout. The solution I initially came up with is a variation on <http://wordaligned.org/articles/cpp-streambufs>, with some manipulator magic thrown in to adjust severity level. Ah, but that's not good enough, you have to pull some interesting gymnastics to ensure order of IOStream initialization: <http://accu.org/index.php/journals/264>. And after all that, I'm still not sure it works, as looking at the data structures in a debugger looks like garbage (guess why I'm in the debugger in the first place).

All that being said, I still love C++. I'm glad I know it as well as I do so that I can (usually) avoid problems, but even then I run into compiler (or build!) dependent problems that shouldn't be happening. C++ has problems, and we need to address them. I'm happy to say that even though I am stuck with old compilers that have inscrutable template error messages, time moves on and I am aware of this problem being fixed in newer versions of compilers.

</comment><comment><USER15> C++ is a really tough language, especially when compared to more modern ones (Python, Ruby, Scala,..). There are two things which I've always found frustrating about the language. The first is that there are so many arcane elements to it that even highly experienced devs can make mem alloc mistakes that will cause the app to SIGSEGV down the road, and it's pure misery to root these out. The 2nd has to do with that it's not really cross platform in that it can be super hard to move code between win and nix, something that languages like Java and Python have all but made transparent. I know there's a lot of work done on C++ the last few years, but nowadays while we still write C++ for some parts of our app there's almost always a legacy part to it.

</comment><comment><USER16> Another bad article against C++. There is no perfect language and C++ is not perfect too. But using some other langauges I fell offten like be prisoner...

<comment><USER17> I was exploring some features of Android this week and every other line I kept sticking comments in like "gosh, if only java had first class functions / closures / operator overloading / namespaces / global primitives that aren't hackneyed"

</comment></comment><comment><USER18> Haven't had one of these anti-C++ threads/rants in a while, prbably not much new here

<https://news.ycombinator.com/item?id=4969372>

<http://news.ycombinator.com/item?id=4539251>

<http://news.ycombinator.com/item?id=3712292>

______________

this mechanization of the lang spec in Coq looks interestng

<http://hal.inria.fr/hal-00674663/en>

</comment><comment><USER19> Some valid points, some outdated ones. I have found C++11 surprisingly enjoyable. Real lambdas, templates, and unique_ptr/shared_ptr have let me write exceedingly Lispy and highly-readable code. With great performance characteristics.

Minimizing the use of OOP helps avoid the language's sharp corners. With C++11, I highly recommend abandoning the "C with classes" style.

</comment><comment><USER20> Ugh. These C++ bashing articles, although being highly popular, are extremely grating. All languages have issues. The End.

<comment><USER21> Different languages have different kinds of issues, and these have different levels of importance for different projects and audiences.

</comment></comment><comment><USER22> I checked over the reddit thread mentioned in one of the comments, and a few of the comments here, and notice people mentioning how outdated the information is.

Out of intellectual curiosity, what resources (books, sites, etc.) would be recommended for modern, best practices C++?

</comment><comment><USER23> I literally didn't know that vector<T>::operator[] doesn't do index checking for me. I've written some C++ code in Python extensions where I use vector<T> to simplify from (T* arg, int arg_length) which I now find out could randomly segfault.

Blergh. This stuff is why I use Python (with snippets of C for speed): when I do something stupid, I get an error message and line numbers, not a faceless segfault (+even when I get a C segfault, I can still get the python stack back with faulthandler..)

</comment><comment><USER24> This a download link for a PDF. Please either don't do this or note it in the title. Not everyone wants to download a PDF to their mobile device.

<comment><AUTHOR> Updated the title. Sorry for the inconvenience.

</comment></comment><comment><USER25> C++ is complicated before you know more about it.

</comment><comment><USER26> The author also runs a blog written in C (blog.fefe.de)

<comment><USER27> And written an own Libc: <http://www.fefe.de/dietlibc/>

</comment></comment><comment><USER28> full of crap. It sounds like when an office clerk in a publisher house demands abandoning latin words, puns, ironies figures of speech etc. because he is too dumb to use them properly. There are poets and there are mba-style bullshit writers. Great C++ code can read as beautifully as poems in style and elegance (c.f. Elements of Programming by Stepanov).

<comment><USER29> Well, the compiler error messages (few examples given by the author of the article) also looks like poetic phrases to you :D

</comment></comment><comment><USER30> "There is no dark side of the moon really. Matter of fact it's all dark."

</comment><comment><USER25> Is there an article named The Dark side of mathematics?

</comment><comment><USER31> meta: how come this didm't get scribd'd?

<comment><USER32> My bet would be that it's because the URL doesn't end in '.pdf'.

</comment></comment><comment><USER33> Man, never noticed how the quality of front-page HN posts on a Sunday morning really bottoms out.

</comment><comment><USER34> That's just ridiculous. C++ has no light side.

</comment><comment><USER35> I agree. C++ is a poorly designed language with a lot of "bugs" in it.

Languages do not pass the usual development cycle that includes collection of requirements, beta-testing and bug fixing. C++ have some obviously stupid design decisions that apparently will never be fixed.

Strangely or not, people tend to approach languages religiously rather than rationally.

Languages are like holy scripts that are written by one or a few people that are perceived like gods, and there is no proper critism or improvement following the development of a language.

Hence what we have today.

One of the most popular languages is full of stupid design mistakes that will never be fixed, they rather die with the language.

Actually, an example of a language that fixes many of the C++ problems is C#. But it inherently cannot be a replacement of C++.

Again, people are not rationally thinking creatures.

And to all who are not rationally thinking, I just say: fuck you.

<comment><USER9> You cannot determine the "best language" (for a given project) from a computer science aspect only. In the real world things like availability of programmers, existing code/interfacing with libraries, support of different platforms etc. play a much larger role.

D may be superior to C++, but if you have to build a firmware in one year and you will need 20 developers you cannot use this language since you cannot hire that many experienced developers and the D compiler may not even target your platform.

Even luck and being in the right spot at the right time by coincidence play a large part. Consider Javascript, which was never designed to do all the stuff people use it for nowadays. But for all its flaws it solved people's problems at the right time and therefore got popular. It was the same with C and C++.

</comment></comment><comment><USER36> Yea, let's write all of our higher level object juggling in C++! Such a nice language, isn't it? And there aren't much alternatives either, right? Let's be honest: if you find yourself complaining about C++ syntax and error messages while coding your higher level logic, chances are you either like the pain or you have lived under a rock for the last 15 years. In the latter case, go open your browser and type "Python" (or "JNI" or "Javascript" for that matter).

<comment><USER37> Yeah, because you can write hard real time code in Python or JavaScript.

<comment><USER37> Better stated, there are applications where you can't use JavaScript or Python due to timing requirements - software defined radios for instance.

<comment><USER36> I agree. And that's exactly why there exist interface languages such as JNI so you can write your higher level code in a nice language and get down to C/C++ for the time-critical parts. I don't see much of a problem here.

<comment><USER38> This introduces a whole new category of pains in the ass. You need to run two debuggers at the same time. Inverting control with callback interfaces is tricky. there can be friction between the memory ownership models in the managed and native code. And it just makes the system that much more complex. I've been working in a python / c++ interop system for a while and I think some of the c++11 features make the benefits pretty questionable.</comment></comment></comment></comment></comment>


A curated list of websites that accept guest blogs - <AUTHOR> https://writeforus.io/ <comment><USER2> This is a great list! But I guess I figured this list would be categories within tech (e.g. UI, AI, AR/VR, Networking, Security, et al), rather than tech being one of a large collection of categories that generally don't resonate with the HN crowd.</comment>


Apply HN: Obaas – OpenBazaar as a Service - <AUTHOR> OpenBazaar is a brand new, decentralized marketplace. It cuts the middle man and puts all control in the hands of the users. But it comes at a big cost: Users need to install and run software to take part in it. Vendors even have to run the application 24/7. And they have to set up their store and all of their products. Obaas takes away all of that pain. All functionality of OpenBazzar is available via a web interface. Obaas automatically imports your products from Shopify, Magento, Ebay or Amazon and sets up your OpenBazaar store. If you already sell products on one of these marketplaces, you will be able to sell on OpenBazaar in 5 minutes via Obaas. <comment><USER2> Nice idea.

But the whole idea of OpenBazaar is that it's decentralized. I guess you'll be the "center" in this case. If OpenBazaar becomes big enough, I think this will work (and face competition from hundreds of clones) but if it stays the niche it is today, I'd assume this won't work because currently the only people who use it are people who care about the "decentralized" part. The reason for that is everything else at OpenBazaar currently sucks. (Early stage problems)

I could be wildly wrong though, I'm not an expert in this domain.

<comment><AUTHOR> Yes, OpenBazaar has to gain traction for this to work.

Obaas is like the exchanges for Bitcoin. Bitcoin is decentralized in the same way as OpenBazaar. Most people use exchanges to take part in the Bitcoin network. So if OpenBazaar takes off, the first webservice that makes it accessible to the masses will have a nice headstart. Similar to how Mt.Gox had a nice headstart. When it was still active, 60% of all bitcoin trades were done via Mt.Gox.

<comment><USER2> Great argument, I'm convinced.

Referencing Mt.Gox is a risky move, though :)

</comment></comment></comment><comment><USER3> I've never heard of openbazaar so you'll have to explain that part to me in your pitch. This pitch would probably make sense if I was a storeowner who wanted to use openbazaar but didn't know how or it was too complicated. But your whole business depends on people having heard of this thing that I haven't heard of. Can you explain to the storeowner why they would want to be on openbazaar?

</comment><comment><USER4> Random feedback on your name -- my brain automatically added an "m" between the two a's in "Obaas."

<comment><AUTHOR> It is just a working title. I am open for better ideas.

</comment></comment><comment><USER5> Where is the link?

<comment><AUTHOR> As of yet, it is only an idea.

<comment><USER5> I'm sorry, I got confused about the thread. I thought this was at Show HN.

Considering it as an idea, I like it a lot. I'm not very familiar with OpenBazaar, however. Are there many people using it?</comment></comment></comment>


Show HN: Deep Learning Python Library for Stock Market Prediction and Modelling - <AUTHOR> https://github.com/achillesrasquinha/bulbea <comment><USER2> Very interesting! How do you deal with a lot of machine learning algorithms not being able to handle timeseries data? Or have I not been up to date with the latest advancements?</comment>


Blizzard bans pro esports player after he voices support for Hong Kong protests - <AUTHOR> https://www.businessinsider.com/blizzard-bans-esports-player-blitzchung-supporting-hong-kong-protests-interview-2019-10 <comment><USER2> Overwatch's Mei is becoming a symbol of the Hong Kong protests & should lead to a total ban on Blizzard/OverWatch itself.</comment>


Ubuntu 18.04 LTS Bionic Beaver Released - <AUTHOR> https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes <comment><USER2> Extensive discussion about this release commencing 20 hours ago and still on page 2:

[https://news.ycombinator.com/item?id=16931491](https://news.ycombinator.com/item?id=16931491)

</comment><comment><USER3> I plan to run LTS on my laptop from now on, so that I get a stable desktop environment. I used to be a sucker for running the latest and greatest, but I guess I'm too old for that now.

I wonder how my applications will fare. I would like to have the latest version of Firefox, emacs, git, and so on. It's the desktop environment and OS itself I want to be as stable as possible. I'd also like to get the most recent kernel, I think, since the kernel is pretty darn stable and rarely has regressions, at least in my experience.

I also learned that there's an official plan for 18.04.1, to be released July 26th. This is the release that will prompt 16.04 LTS for an upgrade. In other words, the official upgrade path for an LTS is to wait for the first patch release, and not upgrade immediately. So I'm considering waiting to update from 17.10 until 18.04.1 is out.

<comment><USER4> I would avoid running LTS unless you _really_ need the stability. Otherwise, having the latest applications (and utilities like git) is going to be difficult.

<comment><USER5> It is worth noting Ubuntu comes with snap and flatpack support since latest two releases, and it works flawlessly for most of GUI applications. Sadly there isn't many CLI tools available to download like aforementioned git or zsh.

<comment><USER4> On newer laptops, disk space is at something of a premium (SSDs are expensive, so the disk size got smaller again), so Snap / Flatpak / Appimage are a bit of an issue.

</comment></comment></comment></comment><comment><USER6> Great release, with great features, and still a really (really) bad UI. The new theme has so many inconsistencies and bad decisions made. And I find it really cringy for an LTS release to distribute this new theme as the default one.

I hoped hard the communitheme would be the official theme of this release, but no.

Examples:

\- The active directory effect in Nautilus's sidebar makes me thing there were two sidebars with different purpose [1]

\- Changing the background of every other rows in the settings look weird. The fact they are splitting settings by group do not help. I thought it was a theme glitch, and found out it was an actual feature [2]

I understand why people are interested in more serious theme (arc-theme) or even other Ubuntu-based distros (elementary...).

[1] [https://pbs.twimg.com/media/Dbxn7TrV4AItn2f.jpg](https://pbs.twimg.com/media/Dbxn7TrV4AItn2f.jpg)

[2] [https://pbs.twimg.com/media/DbxoSISVwAAn1fV.jpg](https://pbs.twimg.com/media/DbxoSISVwAAn1fV.jpg)

<comment><USER5> Personally I have no idea why they rolled these theme styles for nautilus while they have been worked on Communitheme [1], which does not have tab-like menu [2]. However I'd like to note even in adwaita (and many other styles) there is design inconsistency between nautilus and gnome-tweak-tool. Sadly, Ubuntu dev team and community have not released any stable version Communitheme yet, so they were too late to bring new, consistent theme to 18.04.

[1]: [https://github.com/ubuntu/gnome-shell- communitheme](https://github.com/ubuntu/gnome-shell-communitheme)

[2]: [https://itsfoss.com/ubuntu-community-theme/](https://itsfoss.com/ubuntu- community-theme/)

</comment></comment><comment><USER7> I suspect Ubuntu (even after 18.04) will still randomly tap my shoulder and complain about my full /boot partition -.-

<comment> blubb-fish yes - and the best solution I found is a long and cryptic series of commands involving "apt-get purge" ... as long as those kind of issues bother users Linux is practically not usable for non-technicians.

</comment></comment><comment><USER8> Weird, I am still getting "No new release found." when running `do-release- upgrade`...

EDIT: Found the answer in another comment:

> I also learned that there's an official plan for 18.04.1, to be released > July 26th. This is the release that will prompt 16.04 LTS for an upgrade. In > other words, the official upgrade path for an LTS is to wait for the first > patch release, and not upgrade immediately. So I'm considering waiting to > update from 17.10 until 18.04.1 is out.

<comment><USER3> If you really want to upgrade, you can run `do-release-upgrade --devel- release` (or just -d), which will get you from 16.04 to 18.04. Apparently, 18.04 is considered an development level release from the perspective of 16.04?

(I don't really know what I'm talking about here.)

<comment><USER9> Upgrades between LTS versions are officially supported until the .01 of the newest LTS afaik (so you'll get the update prompt when 18.01 is released)

</comment></comment></comment><comment><USER10> > Window control buttons are back on the right.

Does anyone have a list of how this has evolved? Are we getting more or less stable on this, the ultimate bikeshedding issue?

<comment><USER11> [https://www.omgubuntu.co.uk/2017/08/ubuntu-moves-window- cont...](https://www.omgubuntu.co.uk/2017/08/ubuntu-moves-window-controls- right) has some info about this.

</comment></comment><comment><USER12> I wonder if they had this Bionic Beaver in mind, I hope not :)

THE FAMOUS BIONIC BEAVER Our Signature Drink for Sharing! Seagrams Vodka / Gin / Rum / Triple Sec / Peach Schnapps / Light Beer / Grenadine / Splash Cranberry

[https://guava-beach.com/menus/drinks/](https://guava-beach.com/menus/drinks/)

</comment><comment><USER13> No fractional scaling still. Why?

<comment><USER3> Afaik they rolled back wayland, 18.04 uses Xorg. So maybe that's why.

</comment></comment><comment><USER14> Any news on Powermac build? I know there is a Community effort behold the ppc big endian build.

I am praying to the open source gods for it to happen.</comment>


A Future Of Pipes - <AUTHOR> http://www.overcomingbias.com/2013/11/the-bright-future-of-pipes.html

<comment><USER2> I recently scored a copy of Maxwell's Demon, a book containing a collection of (among others) Landauer and Bennett's papers. As I was skimming them, I couldn't help but think that if there is a correspondence between heat and information erasure, can that be used to move "heat" in a fundamentally different way?

The idea would be you do some computation at point A, the related information erasure at point B, and the heat associated with it get "transported" faster than it would be by moving pipes around. The hope is that sending the bits along something like an optical network would be faster than laminar fluid flow.

I'm sure HN's more knowledgeable folks will tell me exactly where I'm wrong, but it seemed like an intriguing possibility.

<comment><USER3> There's a comment on the post by Tim Tyler talking about "digital heat", which seems to be close to your idea. He's written more about it here: [http://cell- auto.com/reversible/](http://cell-auto.com/reversible/)

</comment></comment><comment><USER4> Hanson needs to brush up on his thermodynamics. Reversible computers need not generate any heat. But they do need to grow larger as they are operated (their size scales with the number of operations performed). This means SPACE = TIME, which is a pretty sad state of affairs and probably the reason why all practical computers and known lifeforms are irreversible machines.

<comment><USER5> > all practical [...] known lifeforms are irreversible machines.

Not necessarily true. There is that 'immortal' jellyfish that basically reverts back to a polyp and then grows again.

[http://en.wikipedia.org/wiki/Turritopsis_dohrnii](http://en.wikipedia.org/wiki/Turritopsis_dohrnii)

<comment><USER4> That's an interesting animal, but its unusual life cycle in no way negates the fact that its metabolism is irreversible (both at the cellular and ensemble level).

</comment></comment></comment><comment><USER6> It's not a good bet that data centers will need to build out at a constant rapid pace into the future to keep pace with demand. A lot of the work in servers in recent years has been about improving utilization of available resources, and I expect that there is still a lot of headroom left for improvement. It's probably safe to say that across all datacenters, the vast majority of heat is generated while servers are mostly idle and have too little to do.

I don't think that it's safe to anticipate reaching some kind of fundamental limit on power efficiency, either. Nobody has come up with a viable replacement for the silicon transistor, despite decades of trying, and current CPU technology has practically stopped generating any improvements for the past several years. I think the important quantity to measure is the energy that goes into powering up the cpu for one clock cycle, because clock cycles are what drive computation forward and their individual energy usage basically just add together. For decades after the invention of the transistor, this energy dropped rapidly due to shrinking the wires. However, the wires reached a point where their capacitance began to fall off with decreasing size, and there have been no significant energy improvements since. Solving that problem requires either a revolutionary discovery about the physics of conductivity, a completely novel mode of doing computation that isn't based on electronics (photons?), or a fundamentally novel principle of organizing a cpu that somehow avoids being clock-bound (I heard about an effort over ten years ago, but I have not heard of it since). Any of those improvements could have surfaced at any time in the past few decades and been eagerly pursued, but none did, so the odds don't favor the miraculous appearance of one of them in the foreseeable future.

<comment><USER7> > a brand new model of computation that somehow avoids being clock-bound

like asynchronous circuits?

CPUs based on them have been around, and more can certainly be done. they're just a lot more complicated.

<comment><USER6> The fact that the idea has been around a while and not gone anywhere is a pretty good indication that it's a technological dead end.

<comment><USER8> It says nothing. OLEDs are 50 years old now, capacitive touch likewise. Electric cars were around 120 years ago.

<comment><USER6> What you're saying is that it's impossible to accurately predict the future. I agree. But you can make informed judgments about what's likely.

</comment></comment></comment></comment></comment><comment><USER9> Is it "SPACE = TIME", or is the limitation actually set by the surface area of the volume enclosing the machine? In space-time coding for communications, the limitation on achievable spectral efficiency is related to the surface area of the volume enclosing the antenna array, in units of wavelength. It would seem sensible if this was reflected in a fundamental property of information.

Maybe a fundamental limit of the universe is that the minimum surface area of a volume containing a subatomic structure is related to the information required to define that structure? My maths is a bit fuzzy, but isn't there a fundamental relationship between a volume its boundary, involving a Fourier Transform? That could then mean that a limitation on surface area is equivalent to a limitation of the (4-dimensional?) volume occupied by some other quantity?

The above is speculation on my part, but is there a HN reader our there who can say whether such thoughts are garbage, or whether they have some basis?

<comment><USER10> I think that the relationship you're referring to is the holographic principle - [https://en.wikipedia.org/wiki/Holographic_principle](https://en.wikipedia.org/wiki/Holographic_principle)

My physics abilities are far from what I'd want them to be, but it does sound to me that there may be some insight in what you're saying.

</comment></comment><comment><USER11> > _Thus in future cities crammed with computer hardware, roughly half of the > volume is likely to be taken up by pipes that move cooling fluids in and > out_

A lot of this post reads like nonsense.

<comment><USER6> Presumably those would be domed cities like you see in futuristic predictions from the 1960s. That's why you can measure their volume and predict the percentage that will be dedicated to pipes to carry waste heat from computers.

</comment></comment><comment><USER12> The author assumes the demand for CPU cycles is elastic in the long term (i.e. as prices of cycles drop, people will continue to use more and more of them).

General-purpose desktops and laptops today often don't come close to using all of the CPU horsepower available to them, and many server applications are limited by memory, network bandwidth, and storage.

It seems conceivable to me that at some point, before reaching thermodynamic limits, CPU cycles will stop being scarce for many application spaces, and future computing investments will mainly be in networking, memory, storage and software.

</comment><comment><USER13> > The future of computing, after about 2035, is adiabatic reservable hardware. > When such hardware runs at a cost-minimizing speed, half of the total budget > is spent on computer hardware, and the other half is spent on energy and > cooling for that hardware. Thus after 2035 or so, about as much will be > spent on computer hardware and a physical space to place it as will be spent > on hardware and space for systems to generate and transport energy into the > computers, and to absorb and transport heat away from those computers.

The computer almost sounds alive...

<comment><USER14> Not almost. It is alive. The only fundamental difference between computers and "life as we know it" is that the computer's genetics are encoded on magnetic media rather than DNA.

</comment></comment><comment><USER15> Didn't Seymour Cray say that HPC was mostly about plumbing - to the manage the heat

mm maybe I ought to dust off those old steam tables eh.

</comment><comment><USER16> There's a long way to go before building permanent structures on the Moon is a possibility (meteoroid detection/destruction, understanding seismic activity, etc.), but its far side would be a great place for building data centers.

<comment><USER17> Space is a terrible heat transfer fluid.

<comment><USER18> But a top notch heat sink.

<comment><USER19> Not really. (Disclaimer: I'm not an expert at all, much of what I say is wrong)

Consider your CPU's heat sink. The CPU gets hot, but it can transfer that heat to your metallic heat sink (thermal conduction?), which in turn can dissipate that heat to its surrounding air (thermal convection?).

If you're in space, the only way to get rid of that heat is by radiating it as light (radiation; the same way a metal glows white hot) but that's much less efficient. You can't transfer it to another mass because there isn't other mass in a vaccuum.

<comment><USER7> i think there is a bit of a terminology issue.

to give brudgers as much credit as possible, space is a pretty good heat sink, in that it can absorb all of the heat you can ever produce, without changing temperature. (and since heat transfer is proportional to temperature difference, your transfer rate will never drop because of it.)

but it is terrible for heat transfer.

the metal widgets we stick onto our CPUs aren't really heat sinks, they're for reducing the thermal resistance between the CPU body and the atmosphere, which is the "final" destination for the heat.</comment></comment></comment></comment></comment>