Ruining the Magic of Magento's Encryption Library - <AUTHOR> http://www.openwall.com/lists/oss-security/2016/07/19/3 <comment><USER3> Look, I don't care if you use PHP. But if you aren't an expert, and your code hasn't been audited by experts, don't write your own crypto. Use libsodium, or libressl's libcrypto (if you think openssl is a good bet, you really need to see the talk that discusses the reasons for that fork), or libgcrypt. But for crying out loud, use a library that is actively used and vetted by people who KNOW WHAT THEY'RE TALKING ABOUT. And do your best to know what you're talking about, too.

<comment><USER4> No! Libre/Open/BoringSSL's libcrypto exposes the same low-level primitives as PHP's terrible crypto bindings do. Please, please don't build things directly with libcrypto.

<comment><USER3> Ah. Ouch. Sorry.

<comment><USER5> And that - in an ironic nutshell - is the problem with crypto: had _you_ been tasked with implementing the crypto, you would have (unknowingly) done it wrong and called it a day. Someone else would be berating you to "leave it to the experts"

<comment><USER3> I was going to write a comment pointing that out. But I couldn't figure out how to write it.

Go ahead, laugh. It means you'll be hesitant to make that kind of mistake, which is the main thing.

<comment><USER5> I did laugh - but not at you. As I said - the problem is with crypto (not you). Crypto gives the _appearance_ of being simple, straightforward and immutable - but its not. A lot of things can go wrong with your PRNG, or the key exchange, or the cipher, or a combination of any/all of the above. Oh, by the way a novel attack was discovered last week; it's the full package, complete with a mildly ominous ALLCAPS name, a fancy logo and a bloody domain - the state-of-the-art has changed. Again.

I don't know if the 'crypto problem' can be solved for _all_ F/OSS projects that need it - there might not be enough experts to go around.

</comment></comment></comment></comment></comment></comment><comment><USER6> Almost the entire Magento code base qualifies for an example of code horror.

</comment><comment><USER7> I'm not going to say don't write crypto. Instead I will give more useful advice: if you do write crypto, make it boring. Really boring. Do not invent anything. Do not be creative. Use an established modern construction with modern ciphers and use them in only one way. That one way should be the way cryptographers recommend with no deviations.

<comment><USER8> What would be a good, boring, way to do encryption with PHP in 2016?

<comment><USER9> [https://github.com/jedisct1/libsodium- php](https://github.com/jedisct1/libsodium-php)

[https://paragonie.com/book/pecl-libsodium](https://paragonie.com/book/pecl- libsodium)

Docs happen to be written by the OP too...

<comment><USER10> FWIW if I read correctly our own CiPHPerCoder in this thread is Scott Arciszewski from paragonie.

I often find his posts interesting and sometimes a welcome adjustment to some long-running counterproductive memes.

<comment><USER11> Yes, I am Scott. And thank you. :)

</comment></comment></comment></comment></comment><comment><USER12> What does the comment about not using authentication mean? What would be authenticated in this case?

I think I'm in a bit over my head looking at the code, but does the author mean that somehow the data should be verified to come from a trusted source first? But doesn't the attacker have to have some of the encrypted data first for that to be meaningful?

<comment><USER13> Authentication in this context means baking in a way to verify that what you receive is something you encypted and has not been altered. Or, in other words, it lets you know that the data hasn't been tampered with.

As a practical example, imagine using encrypted cookies for a session store (like Rails can do), but imagine that they're not authenticated. It's possible that with clever manipulation of the encrypted cookie, I can alter the cookie such that it still decrypts into the structure ecorcyed, but with different data. For example, maybe I change the initialization vector a bit in a clever way and that makes the userId stored in the cookie change.

For a more detailed explanation and hypotherical, I thought [1] was a great article. It uses PHP for the examples, but it's mostly the theory that's of interest.

Of note, things are actually worse in Magento's case than this hypotherical since you can, as an attacker, get Magneto to use some pretty bad crypto when decrypting your message even if they used something decent when encrypting their payload (remember: since it's unauthenticated, what they give you and what you give back are not necessarily the same).

[1] [https://paragonie.com/blog/2015/05/using-encryption-and- auth...](https://paragonie.com/blog/2015/05/using-encryption-and- authentication-correctly)

<comment><USER12> thanks for this. If I may sum up and you could verify this:

When I encrypt something and give it to you, I should take a signature (hash of the encrypted msg) and append it to the encrypted message. Then if you twiddle bits before asking me to decrypt it, I'll see that your provided signature is incorrect.

I know there's more in it, and I've briefly read through the article you provided, which I may look at it in more detail later, but I think that's the gist of it.

<comment><USER13> Exactly! In fact, that's embarrassingly concise given my rambling. The only major thing missed is that the hash input has to contain something that the attack doesn't know in addition to the message. Or in other words, the private key is usually also involved in the hashing. If you ever want to get into details, the MAC [1] and HMAC [2] wiki pages go into depth.

[1] [https://en.wikipedia.org/wiki/Message_authentication_code](https://en.wikipedia.org/wiki/Message_authentication_code) [2] [https://en.wikipedia.org/wiki/Hash- based_message_authenticat...](https://en.wikipedia.org/wiki/Hash- based_message_authentication_code)

<comment><USER12> thanks for the followup :) and especially for the clarification about private keys (and MAC, HMAC) for the signature.

</comment></comment></comment></comment></comment><comment><USER14> Aside from the obvious deficiencies, who the heck writes code like "if ($false === initVector)"? Is this a side effect of people who speak other languages with different grammatical structures? Very odd to read through code written "backwards" like that.

<comment><USER15> I believe it's a once-popular way to avoid this mistake:

        if (variable = false) // == intended

Which is valid in C and some other languages. But

        if (false = variable)

Is not valid.

<comment><USER14> That makes way more sense than I would have thought. Thanks. Guess I've been away from C for a while.

</comment></comment></comment><comment><USER16> Magento is incompetent on much simpler levels than this.

1\. Someone thought chmod 777 was a good idea, ever, under any circumstances. Not only is this standard practice in Magento installs (it's a how-to step in many books on Magento), it's all through the actual codebase.

The below is from the Magento Enterprise 18.104.22.168 tarball, downloaded from the company (and I double-checked this after someone questioned this last time I brought this up):

      $ grep -r chmod .|grep 777
      ./downloader/lib/Mage/Backup/Filesystem.php: chmod($backupsDir, 0777);
      ./app/code/core/Mage/Compiler/Model/Process.php: @chmod($dir, 0777);
      ./app/code/core/Mage/Install/Model/Installer/Console.php: @chmod('var/cache', 0777);
      ./app/code/core/Mage/Install/Model/Installer/Console.php: @chmod('var/session', 0777);
      ./app/code/core/Mage/Install/Model/Installer/Config.php: chmod($this->_localConfigFile, 0777);
      ./app/code/core/Mage/Catalog/Model/Product/Attribute/Backend/Media.php: $ioAdapter->chmod($this->_getConfig()->getTmpMediaPath($fileName), 0777);
      ./app/Mage.php: chmod($logDir, 0777);
      ./app/Mage.php: chmod($logFile, 0777);
      ./lib/Zend/Service/WindowsAzure/CommandLine/PackageScaffolder/PackageScaffolderAbstract.php: @chmod($path, '0777');
      ./lib/Zend/Service/WindowsAzure/CommandLine/PackageScaffolder/PackageScaffolderAbstract.php: @chmod($path, 0777);
      ./lib/Zend/Service/WindowsAzure/CommandLine/PackageScaffolder/PackageScaffolderAbstract.php: @chmod($path, 0777);
      ./lib/Zend/Cloud/StorageService/Adapter/FileSystem.php: chmod($path, 0777);
      ./lib/Varien/Autoload.php: @chmod($this->_collectPath, 0777);
      ./lib/Varien/File/Uploader.php: chmod($destinationFile, 0777);
      ./lib/Mage/Backup/Filesystem.php: chmod($backupsDir, 0777);
      ./errors/processor.php: @chmod($this->_reportFile, 0777);

2\. The company thinks there's nothing wrong with storing money as floats: [https://github.com/magento/magento2/issues/555](https://github.com/magento/magento2/issues/555)

The way we eventually dealt with hosting Magento (which we had _strongly_ advised against) was a concrete sarcophagus and a thirty-kilometre exclusion zone:

* a cron line specifically to remove o-w permissions from all files in the webroot every minute (which is very inelegant, but the alternative is maintaining our own patches to core).

* Files not owned www-data, except where Magento must be able to write to them.

* deploy all webroot files as a user the webserver can't write.

* cron.sh (Magento's internal cron) runs as root out of the box. We ran it as www-data.

* AppArmor to keep Magento from ever, ever being able to pull shit. This caught Magento's more antisocial tendencies on more than one occasion.

* Admin login: use a path other than "/admin" to foil quite a lot of attack bots at the very simplest level.

We have outsourced our remaining Magento, thankfully, and I don't personally have to maintain the above any more. (You know you've been administering Magento a bit long when you can hum along to bits of "Metal Machine Music" accurately.)

The use case for Magento is (apparently deliberately) confused. It's an unholy melange of a CMS and a shopping basket. There is no good out-of-the-box experience; in practice it's a job creation scheme for consultants.

Even crap-tier "well technically I can tell my boss's boss we have paid support" support, with a four-day response time for them to ask you a simple question you already put the answer to in the original ticket, is swingeingly expensive. I can't say what we're paying for this standard of quality, but I can say that it's public knowledge that Magento is at least $13k/yr: [http://web.archive.org/web/20120215011525/http://www.magento...](http://web.archive.org/web/20120215011525/http://www.magentocommerce.com/product/enterprise- pricing-contact)

The problem Magento seems to solve is when the business wants a quick site without developer involvement. After a few other abortive platforms (Plone, Drupal - which are both fine for what they are, in ways Magento just isn't, but didn't end up matching our needs), our eventual solution to this was Wordpress, which we have outsourced so I don't have to think about that either. Outsourced Wordpress with securing it being the host's problem is totally the right answer.

I don't have a good answer on the shopping basket, but Magento was bad enough at that too that we went back to our in-house homerolled system.

I understand some work has gone into Magento 2.0 to make it less mind- bogglingly horrible.

<comment><USER17> > _The use case for Magento is (apparently deliberately) confused. It 's an > unholy melange of a CMS and a shopping basket. There is no good out-of-the- > box experience; in practice it's a job creation scheme for consultants._

The CMS capabilities of Magento are quite limited, as the Community Edition does not even include a "menu" module or a hierarchy for your static pages. My opinion is similar to yours, it is a powerful shopping basket that will require lots of custom development or third-party module juggling to get a decent result.

I have been working with Magento 1.x CE for a few years now, and I wanted to add a few more factoids from a developer perspective:

* The database API has an "you want it, you got it!" mentality - if you tell it to add a unique index and MySQL refuses to because existing data is not unique, the API will _parse the MySQL error message to identify the duplicated fields /values and delete them silently_. You will get your index, but you might no longer have all your data. [0]

* The model classes store nearly all the in-memory data in an untyped dictionary. You can call $model->setFoobar('12345') and later $model->getFoobar() to get it back - all unknown method calls get forwarded to a "catch-all" method which treats the method name as a key into this dictionary, and gets/sets a value of that key [1]. Most of the time, these calls are unannotated, so IDEs can't make any sense of them (see the "Undefined method" part in [2]). This unknown method forwarding is also a performance issue, so they make optimizations like [3] by inlining pieces of the catch-all handler code for commonly-used data.

* The JavaScript is based on Prototype.js, not jQuery, so half the modules and themes bundle their own copies and drop them in different locations. Some of them provide a configuration setting so you can disable their jQuery and use your own, some don't.

* It includes a "Developer Mode" where php notices and warnings are turned into exceptions like in sane languages. But plenty of modules and themes have never been tested with this setting on and they cause faults on every page load - either you have to disable the Developer Mode, or fix this third-party code.

[0]: [https://github.com/OpenMage/magento- mirror/blob/magento-1.9/...](https://github.com/OpenMage/magento- mirror/blob/magento-1.9/lib/Varien/Db/Adapter/Pdo/Mysql.php#L2739)

[1]: [https://github.com/OpenMage/magento- mirror/blob/magento-1.9/...](https://github.com/OpenMage/magento- mirror/blob/magento-1.9/lib/Varien/Object.php#L616)

[2]: [https://imgur.com/RMxWEgR](https://imgur.com/RMxWEgR)

[3]: [https://github.com/OpenMage/magento- mirror/blob/magento-1.9/...](https://github.com/OpenMage/magento- mirror/blob/magento-1.9/app/code/core/Mage/Catalog/Model/Product.php#L684)

> _I don 't have a good answer on the shopping basket, but Magento was bad > enough at that too that we went back to our in-house homerolled system._

Our clients were originally in love with Magento because "we can just add all these existing modules and get all sorts of awesome functionality without having to pay you for it!" We warned them that that was a pipe dream, but they didn't listen. Now they have several thousands of hours worth of custom development on top of Magento 1.x (95% of it written solely by me, no bus factor problems with that) and it's not even finished yet. Last I checked, the end-of-life for M1.x is planned in December 2018, and the client has no plan for what to do then.

> _I understand some work has gone into Magento 2.0 to make it less mind- > bogglingly horrible._

When I looked at Magento2, they had an amazing solution to PHP's lack of generics: they bundle multiple "template" classes and during system installation, you're supposed to run a CLI script that goes through those classes with a list of wanted concrete classes and generates specialized class files for all of them. If you fail to run this script, don't worry - <USER2> custom autoloader will detect this and _generate those classes at runtime, when they are needed_.

<comment><USER18> > The database API has an "you want it, you got it!" mentality - if you tell > it to add a unique index and MySQL refuses to because existing data is not > unique, the API will parse the MySQL error message to identify the > duplicated fields/values and delete them silently. You will get your index, > but you might no longer have all your data. [0]

Holy shit. Just, holy shit.

</comment></comment></comment><comment><USER19> > Magento, one of the largest open source e-commerce platforms, ships a broken > cryptography library that clueless developers are probably using to encrypt > your credit card information for their client's customers.

Nope. There is a built in credit card method that would utilise the Magento crypt() but you cannot actually hook this up to a bank and get any actual money. The lamest of lamest Magento developers will use an off the shelf payment gateway that will use things like iframes so that even a non https Magento site will not have any credit card information pass through Magento, instead you get payment references.

In theory you could break the crypto and get into Magento admin, to then export out customer email and address details. You could probably refund all customers orders but not get fresh money out of them.

I appreciate the code may be 2008 vintage but there is no new vulnerability here that gives any means to access any Magento credit card data in a meaningful way, e.g. a lucrative way.

</comment><comment><USER20> I think it's great that stuff like this is brought to the surface, but it also troubles me that the author makes no mention of submitting a PR to improve the _open source_ code base... They seem more content to discuss boycotting and abandonment instead.

<comment><USER21> If it were true open source I think the project would get a lot more contributions. The enterprise edition, with the "best" features, is very much not free.

<comment><USER22> This is absolutely true. They actually have a hostile attitude towards contributions. I used to work at a Magento shop (bad times all round) and my (extremely talented) colleague would often submit patches for long-standing bugs through the ticket tracker which would never appear in general release. Tickets would go for months without responses. It's commercial software at the end of the day. With an obscene price tag on it to scam cash out of non- technical business founders.

I didn't like my magento job much :/

<comment><USER23> This is why we have forks.

<comment><USER24> What fork of Magento actually gets usage?

<comment><USER16> None as far as I can tell. There's OpenMage, which accepts contributions. But the problem is that Magento Enterprise is shit, and the Community Edition is shit with the functional bits removed.

Magento is very much open-core in all practical terms.</comment></comment></comment></comment></comment></comment>


Ask HN: I don't like playing games, can I be a game developer? - <AUTHOR> I'm a full stack programmer(Clojure/Java) and I wrote lots of backend and frontend code, mostly web apps.
I want to try something new but I'm confused. I thought building games might be interesting but I'm not that sure because I really don't play/like games.
The thing is I want to improve my programming skills in a different way and it should be fun so what is your suggestion? <comment><USER2> I'm a sample of one, but I was kind of in your shoes. I'm a huge baseball fan and spent lots of time programming tools to help me perform better in my fantasy leagues. From there, I thought, "why not program my own baseball simulator?"

So, I started but I kept running into "I wonder how they do....?" interface questions because I didn't like gaming, so I started playing a baseball simulator.

To say I was fucking amazed would be an incredible understatement. The complexity and depth they achieved was so far out of my league that I wanted to keep playing, partly as a tribute and partly in hopes of figuring out their secrets. But, if you'd asked me then, I still would have said, "Yeah, i don't like games."

And, then for Christmas a few years ago, we got our kids a PS4. At first, I was a fuddy duddy who didn't like games, but then my stepdaughter taught me how to play Minecraft...

Today, roughly four years have gone by since I decided to build my own baseball simulation. As it stands, the simulation might be one of the worst pieces of software ever built, though I cant recall another project where I've flat out learned so much.

</comment><comment><USER3> Games development is a lower paying and more competitive space than others, so why do it if you dont like games?

<comment><USER4> This. Also, even after all the press about crunch time ([https://kotaku.com/crunch-time-why-game-developers-work- such...](https://kotaku.com/crunch-time-why-game-developers-work-such-insane- hours-1704744577)), the hours are still bad.

A lot of the skills are so specialized that they don't transfer directly to more common types of software. Most backend developers don't need to know about graphics pipelines, physics, or any knowledge of game engines or animation engines.

Finally, other than distribution and marketing, the thing that makes or breaks a game is design - whether it's fun ([https://www.quora.com/Is-it-easy-for-a- software-engineer-to-...](https://www.quora.com/Is-it-easy-for-a-software- engineer-to-learn-game-development)). It's hard to design a fun game if you haven't played many. You don't need this skill to work on other parts of a game, but if you're not there for the money, work environment, or personal passion/impact, not much is left.

If you want to tinker and learn something new, spend a few weeks writing a basic platformer with a HTML5 library like Phaser or melon (many tutorials online). You'll have to consider some of the same problems as more complicated games, but it's much less work.

</comment></comment><comment><USER5> i guess it heavily depends on the position you're interested in. A gameplay programmer might be expected to like games, on the other hand, if you're writing an asset handling system, network stuff, rendering, ..... It really doesn't matter. I may be in a similar situation, loving the challenges one encounters while writing games, yet not really into games themselves.

</comment><comment> le-mark I was the same, I used to hobby game dev for many years. I was never a gamer, what intrigued me was creating worlds, and the technical challenge. I learned tons writing things like 3d software renderer, scripting language, path finding, physics. Nothing I wrote ever progressed past a 'tech demo' though.

Nowadays, using thing like unity or whatever, games are essentially an excercise in content creation IMO. Well, this has been true for a long time.

</comment><comment><USER6> I've been making 2D games off and on for years. J2ME, Java w/OpenGL bindings, and now in Clojure. Was a great way to start learning a new language and since I love programming this is a nice way to a) do more, and b) practice, and c) is a completely different domain than the Clojure I do in my day job.

</comment><comment><USER7> Most developers are working on systems that they have no interest in using in their spare time.

<comment><USER8> The difference is that people use most software for a combination of reasons that don't usually impact the game industry.

The first reason is that the programs often help them complete important tasks. Some of them couldn't be accomplished otherwise. The second is that there are lots of industry standard apps that aren't even that good, but its the standard that everyone uses so everyone keeps using it. There are lots of other reasons but these are the ones that immediately come to mind.

If people don't enjoy playing a game, they aren't going to play it.

</comment></comment><comment><USER2> I'm a sample of one, but I was kind of in your shoes. I'm a huge baseball fan and spent lots of time programming tools to help me perform better in my fantasy leagues. From there, I thought, "why not program my own baseball simulator?"

I started but kept running into "I wonder how they do....?" interface questions because I didn't like gaming, so I started playing a baseball simulator.

To say I was fucking amazed would be an incredible understatement. The complexity and depth they achieved was so far out of my league that I wanted to keep playing, partly as a tribute and partly in hopes of figuring out their secrets. But, if you'd asked me then, I still would have said, "Yeah, I don't like games."

And, then for Christmas a few years ago, we got our kids a PS4. At first, I was a fuddy duddy who didn't like games, but then my stepdaughter taught me how to play Minecraft...

Today, roughly four years have gone by since I decided to build my own baseball simulation. As it stands, the simulation might be one of the worst pieces of software ever built, though I learned so much when I was working on it.

But, the biggest difference is that now, I play games. I actually bought GTA5 a few months ago and can't believe how much fun I have playing it.

TL;DR - Go right ahead, even for a side project. However, if you don't play games, you'll likely end up playing a few, just to figure out how others present information and request input. Then, be very careful because once you get over the amazement at what people can accomplish, you might start having fun. :)

</comment><comment><USER9> You should make some games on your own first. Use your Java skills to make an Android game.</comment>


Show HN: Language_tool_Python – a Python grammar checker based on LanguageTool - <AUTHOR> https://github.com/jxmorris12/language_tool_python/ <comment><AUTHOR> I was recently surprised to find that there are no free, easy-to-use Python grammar-checking libraries. I forked some old code that uses a LanguageTool Java server (languagetool.org) as a backend for a Python grammar checker. I updated it to use the latest versions of Java and the LanguageTool API, added a few features, and voila! There is now a free, easy-to-use Python grammar- checking library :)

<comment><USER2> This is actually exactly what I needed. Telepathy works.

<comment><AUTHOR> I've been meditating a lot recently, guess it improved my ESP!</comment></comment></comment>


Primrose: subversive puzzle game by indie legend Jason Rohrer - <AUTHOR> http://primrose.sourceforge.net/

<comment><USER2> It looks pretty enough, but what's so subversive about it? It's not just another block puzzle game?

<comment><AUTHOR> There were a few elements here that I haven't seen in other block puzzle games: playing it through, a few things struck me as very unique.

First off, the nature of the gameplay is inherently submissive. That means that rather than trying to destroy things, you _change_ them. Unlike most puzzle games, where the goal is to clear the way, in this one you can't _just_ clear things. You're also converting everything around you.

It's also different in that it doesn't force you to speed. In some ways it's tactical, only the pieces are random, so your careful thought can't extend too far. The closest thing I can think to compare it to is Solitaire, where you don't know what's coming up in the deck but by taking your time, you can do slightly better.

The real subversive thing is how the game ends: once all you have left is grey, you're essentially in an endgame where you can't help but lose. That was unexpected, the first time I played, and it strikes me as a bit existentialist - fascinating for me because I never thought of gameplay mechanics as at all philosophical, but this one showed me that it's possible even with a block puzzle game. That also makes the game a bit calmer, and it adds an inherent limit to how long the game goes on for. That in turn favors the slower, calmer players, since you _can't_ get a high score without being clever in how you play.

I don't know if I'd have noticed all that without playing Rohrer's game _Passage_ first, but after playing _Passage_ some of these things stand out in pretty sharp relief.

There's also a fascinating Rohrer interview about it, here: <http://wireless.ign.com/articles/956/956026p1.html></comment></comment>


Apple Magic Trackpad as Multi-Touch Input, and Cross-Platform Multi-Touch - <AUTHOR> http://createdigitalmotion.com/2010/07/apple-magic-trackpad-as-multi-touch-input-and-cross-platform-multi-touch/

<comment><USER2> This might actually be useful for a PC project I'm working on. I looked into touch-screen monitors but they are way too expensive. A $100 wireless trackpad might even be more useful since it could operated at a distance from the monitor.

It'll run in Windows on a Mac with an update <http://support.apple.com/kb/DL1068> but I wonder if it will work on a PC with an arbitrary bluetooth adapter.

</comment><comment><USER3> AFAIK, Wacom has a line of affordable (<$100) pressure-sensitive pen tablets that double as as multi-touch surfaces. That's an interesting alternative.

<comment><AUTHOR> The article notes, though, that their driver doesn't support getting discrete touch events that would be needed for any marginally interesting application; the gestures are hard-coded.

There's also no Linux support yet, though I expect the Linux Wacom project to take care of that soon.

<comment><USER4> For me, marginally (and fully) interesting has always been about 2-finger scroll, vertical and horizontal.

I actually find the other gestures to be a tremendous annoyance when activated accidentally.

I'm looking through Wacom's docs now, but a subjective report on the usability of this feature (if it exists) would be appreciated, as well.

<comment><USER5> The Bamboo's scrolling under Windows is pretty poor. It can't do horizontal and vertical at the same time, and you have to drag your fingers too far before it starts scrolling.

Under OS X, the scrolling is a proper 360 degrees, so once you've gotten the speed adjusted to your liking, the only annoyance is that you can't turn off the inertia (which is not smooth). You just have to learn to stop your fingers before you lift them off the pad.

All the multitouch gestures can be turned off, so if there are ones you don't like (or just wish did something more useful) you can get rid of them.

The zoom and rotate gestures aren't as smooth as Apple's, but I think that probably has more to do with the fact that the Wacom drivers only send keystrokes to applications, rather than the full gesture information in real- time.

</comment></comment></comment></comment><comment><USER6> Magic? Really?

<comment><USER7> It's the proper product name, to go along with the Magic Mouse</comment></comment>


Time poverty is a problem partly of perception and partly of distribution - <AUTHOR> http://www.economist.com/news/christmas-specials/21636612-time-poverty-problem-partly-perception-and-partly-distribution-why?frsc=dg%7Cd

<comment><USER2> Sadly, there will always be poor/homeless in a free market.</comment>


Medical Devices: The Therac-25 (1995) - <AUTHOR> http://sunnyday.mit.edu/papers/therac.pdf <comment><USER2> Just another plug for the comp.risks digest. This digest from the ACM Committee on Computers and Public Policy has been moderated continuously by Peter G. Neumann since its inception in 1985. If you don't frequent Usenet like you used to in the 80s, the web archive is here:

[http://catless.ncl.ac.uk/Risks](http://catless.ncl.ac.uk/Risks)

The Therac-25 was discussed here many times, starting with Vol. 3 Issue 9:

[http://catless.ncl.ac.uk/Risks/3.09.html#subj2](http://catless.ncl.ac.uk/Risks/3.09.html#subj2)

</comment><comment><USER3> I've always taken that machine as a argument against event driven programming. Why? Well John Carmack articulated the problems very nicely when he wrote about inline code, covered on HN here:

[https://news.ycombinator.com/item?id=8374345](https://news.ycombinator.com/item?id=8374345)

The Therac problem was a result of states getting out of sync and into an undesirable configuration. I think reading about the machine and then the above Carmack will cause one to see the connection.

<comment><USER4> I see it more generally as the perils of unwarranted complexity. One of the bugs was a _race condition_ that - I'm almost willing to bet - would not have existed if they didn't try to be "overly clever" and incorporate a crude approximation of a multitasking OS in their software.

It is mentioned almost summarily in the report - "Designs should be kept simple" is a phrase in there - but I think that this excessive complexity was one of the biggest factors.

This Hoare quote is relevant: "There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies."

<comment><USER5> > "incorporate a crude approximation of a multitasking OS in their software"

Many embedded systems have a 'crude' OS library... and in many cases this makes them _far_ simpler than including an RTOS. Not having seen the code here, I can't comment on this one, but just including a simple scheduler is not necessarily a bad design decision.

The the other aspects of your "Keep It Simple" answer, I fully agree with.

</comment></comment></comment><comment><USER6> While this is pretty much _the_ Ur-example of faulty software design causing human injury, the fact is that the entire system failed. Had the Therac-25 not removed the hardware interlocks of the Therac-20, the accidents would've been much less likely to occur.

I also think that we should be careful in trying to draw too much caution in what we do from this accident--the majority of software (EHR systems, apps, etc.) being developed in the medical field today would not be served by the sort of scrutiny that would've prevented this accident.

In fact, one could (and I will) make the argument that simply having faster release cycles and better customer interfacing (instead of, say, custom consulting work _cough_ Epic _cough_ ) would cause a better increase in quality than some insanely rigorous pile of paperwork.

<comment><USER7> A thorough review of a software production is _not_ an insanely rigorous pile of paperwork. I think I'm going to have to disagree with you about the kind of caution that we can draw from this incident, in fact I think cases like these should be mandatory study material for anybody that makes or moves into making software for critical applications.

I've built some stuff controlling machinery that would amputate your arm in a split second and 'faster release cycles' would have caused accidents, not better quality.

Exhaustive testing, thorough review and extensive documentation of not only the code but also the reasoning behind the code saved my ass more than once from releasing something in production that would have likely caused at a minimum a serious accident.

One of my rules for writing machinery controlling software is that _I_ determine when a new piece of software can be taken out of my hands to be passed up the chain. The only time someone violated that rule this happened:

It was around 6 pm when we finished working on the control software of a large lathe, a Reiden machine with a 16' bed and a 2' chuck. I put the disks with the new version on the edge of my desk for 'air' (machine otherwise not powered up), 'wood' and 'aluminum' testing the next day. In simulation it all looked good but it's easy to make mistakes.

When I walked back onto the shop floor the next morning it was deadly quiet. My boss was sitting in his office upstairs and I asked him what was up. He'd taken those disks to do a 'quick demonstration' for a prospect before I arrived to show them a new feature (thread cutting iirc). A subtle bug caused the machine to start cutting with a feed of 10mm instead of 1mm, the stainless steel he used for the demo got cut up into serrated carving knives spinning out of the machine at very high speed. Amazingly, nobody had gotten wounded or killed, mostly due the power of the Reiden (it never even stalled) and the holding force of the chuck (which had to keep hold of the workpiece during all that violence), the machine had actually completed its cycle and the customer had left 'most impressed' (and probably a few shades paler than they arrived...). They actually bought the machine on the strength of the demo and some showmanship of my boss, cheeky bastard, for all the same money there would have been a couple of ambulances in front of the building that day.

After that nobody ever tried to use any of the binaries until I had signed off on them on as 'safe for production'.

That mistake would have definitely been caught in the 'wood' testing phase and a 'faster release cycle' would have missed it entirely since it _looked_ very good right up to the moment where the cutting bit hit the metal.

Test protocols exist for a reason, skip them and you're playing with fire, faster release cycles are great for non-critical software.

<comment><USER6> That's an excellent story, and something to remember when working on automated systems, especially industrial ones.

For something like, say, an automated surgery robot or da Vinci Surgical System, or the Therac here, or an implantable insulin pump, or whatever, it absolutely makes sense to be super vigorous in testing.

For something that's basically just a big document database, though? Or a glorified calculator? Or graphing and charting app? Or messaging app?

Hardly necessary.

In fact, the sort of testing and software rigor that makes sense for embedded systems (like your lathe or the Therac machine here) is pretty much the worst way possible to release one of the aforementioned systems on time and under budget and useful enough to actually make people productive.

Adding more "rigor" to these applications would only serve as a barrier to entry for folks trying to improve the industry. It wouldn't save lives and it would only increase the power of the monopolies of existing players.

</comment></comment></comment><comment><USER8> this might be a good guideline for the folks that don't want to read all of the paper.

[http://web.mit.edu/6.033/www/assignments/rec- therac25.html](http://web.mit.edu/6.033/www/assignments/rec-therac25.html)

The Leveson paper is quite long, and not all parts are equally important:

        Skim Sections 1 and 2. You should understand the basics of the Therac-25's design and how it was used. (You may also find this figure a helpful accompaniment to Figure 1 on page 4.)
        Skim Sections 3.1-3.3, which detail a few of the Therac-25 incidents.
        Read Sections 3.4 and 3.5. These detail a particular incident, the software bug that led to it, and the response to the bug. Pay close attention to 3.5.3, which describes the bug.
        Skip Section 3.6. (It describes an additional incident and a different bug—feel free to read if you are interested, though)
        Read Section 4 closely.

</comment><comment><USER9> Similar problems still exist, turns out software is hard: [https://medium.com/backchannel/how-technology-led-a- hospital...](https://medium.com/backchannel/how-technology-led-a-hospital-to- give-a-patient-38-times-his-dosage-ded7b3688558)

<comment><USER10> Nice article, thanks for posting it.

It's ironic that this article mentions the Toyota Production System as an example of a safe and defect-free system. Another article about Toyota was posted on HN today:

«Toyotas Unintended Acceleration and the Big Bowl of "Spaghetti" Code (2013)»

[http://www.safetyresearch.net/blog/articles/toyota- unintende...](http://www.safetyresearch.net/blog/articles/toyota-unintended- acceleration-and-big-bowl-%E2%80%9Cspaghetti%E2%80%9D-code)

Apparently Toyota's software development doesn't follow the Toyota Production System.

OK, that was a flip comment; it's pretty clear that TPS isn't suited to software development. However, it does seem clear that Toyota's software development practices are deficient.

</comment></comment><comment><USER11> Not to be self-serving, but I've always been fascinated by Therac-25. I ended up doing a deep dive a few months back and put together a short 5ish minute podcast episode about it:

[http://tinycast.in/2015/01/27/therac-25/](http://tinycast.in/2015/01/27/therac-25/)

I used this PDF as one of the primary resources and it was a fascinating read.

</comment><comment><USER12> Hey all,

I actually cover this story in my book Tragic Design

([http://shop.oreilly.com/product/0636920038887.do](http://shop.oreilly.com/product/0636920038887.do))

In my opinion, the software bug wasn't to blame but bad user interface design. When the error occurred that caused patients to get a direct blast of 10x rad more than what were supposed to get, the error was caught and displayed. But because there were so many erroneous errors, users were used to bypassing them. I go into much more detail in the book but I thought I'd chime in here. What do you all think?

</comment><comment><USER13> Interesting read, but please label PDFs. I hate clicking on them while on my phone.

<comment><USER14> would be great if HN could just do this automatically

</comment></comment><comment><USER15> Please add a PDF warning.</comment>


Assert() in the hands of bad coders - <AUTHOR> http://blog.erratasec.com/2017/03/assert-in-hands-of-bad-coders.html <comment><USER2>
      Normally, asserts are only compiled into debug versions
      of the code, and removed for release versions.

I know a lot of languages default to this, and it always seemed like a bad decision to me. The performance benefits of most checks are trivial compared to the major downside of not testing the exact code you release.

Several times I've had to track down bugs that have been very difficult to find, as they were 'fixed' by side effects of assert statements and hence didn't show up in debug builds.

If a check really can't be performed in the release version for performance reasons, just separate it out into a unit test.

<comment><USER3> _> bugs that have been very difficult to find, as they were 'fixed' by side effects of assert statements and hence didn't show up in debug builds._

In those cases, the assert() was used incorrectly. However, that's not a reason to include the assert code in release builds.

In a similar way, source code will often have troubleshooting code such as:

      #if _DEBUG    // or #ifndef NDEBUG
        std::cerr << "inspect size: " << invoices.size() << std::endl;
        // more debugging-related code ...
      #endif

Just because some programmers mistakenly put unintended side-effects in between the #if_DEBUG/#endif doesn't mean we _want_ that code in the release builds. The purpose of assert() and _DEBUG is to _not include them in release builds_.

<comment><USER4> Your troubleshooting code flushed stderr. That's a side effect, and occasionally it will matter.

<comment><USER5> stderr is usually not buffered anyway.

<comment><USER4> Usually.

</comment></comment></comment></comment></comment><comment><USER5> The rule is simple: you never assert() things that can happen, you assert ones that _can not_.

</comment><comment><USER6> _This use of assert is silly. The code should look like this:_

In examples 2, 3 and 4 the author explains what's wrong with the code and why it's a bad use of assert(). In example 1 though it's just called silly. What's wrong with that one?

<comment><USER7> The style used doesn't make sense, and defeats the usefulness of an assert error message.

You can read an asset in the form

        I assert that _ will never be true

The style shown is saying

       I assert that false will never be true

And the message for the assert failing will be in a similar format

<comment><USER8> I think you meant "... will never be false", that's what makes the assert(false) so silly.

I feel that some programmers don't understand the actual semantic meaning of the word "assert", they just use it as an opaque key word meaning "check this", or something.

To me, it should be possible to read an assert almost like English, i.e.

        assert(handle != INVALID_HANDLE);

can be read like "assert that the handle isn't invalid", i.e. is valid. Hm. I'm not stating this very clearly, sorry.

<comment><USER7> Indeed I meant false (actually "will always be true" would probably have been easier to understand as well)

</comment></comment></comment></comment><comment><USER9> The nuance of calling people names is lost on the author. Bad code can be written by great coders. It happens to the best of us. No need to insult people to improve code.

<comment><USER10> Do you insult a red car when you call it "a red car"? do you insult a bad programmer when you call him "a bad programmer". It seems that you can't handle reality.

Knowing where you are will help you progress. Believing that you are good while being bad has the only effect that you will not do anything to improve so you will stay bad. Is that what you want?

<comment><USER11> "Red" is an objective attribute; "bad" is a subjective one.

I agree that self-evaluation and recognition of inferior practices will help one progress, but the article would be more effective if the author was less condemning.</comment></comment></comment>


The Multiple Index Problem (Clojure) - <AUTHOR> http://pepijndevos.nl/2012/08/12/the-multiple-index-problem.html

<comment><USER2> There's no way to use Refs or Vars for indexing the same thing from two different places? You'll sure introduce mutability, but you'd still be able to keep a more Clojure-ish style than using an intermediate index.</comment>


German Cartoon Of Mark Zuckerberg Accused Of Being Anti-Semitic - <AUTHOR> http://www.businessinsider.com/mark-zuckerberg-anti-semitic-caricature-2014-2

<comment><USER2> While the image is anti-Semitic it does ring back to the Classic Image of Standard Oil [1]. Which is easily applicable to Google and Facebook today.

[1] [https://upload.wikimedia.org/wikipedia/commons/a/a0/Standard...](https://upload.wikimedia.org/wikipedia/commons/a/a0/Standard_oil_octopus_loc_color.jpg)</comment>


Google Fiber expansion moves fast; San Antonio approves construction - <AUTHOR> http://arstechnica.com/business/2014/03/google-fiber-expansion-moves-fast-san-antonio-approves-construction/ <comment><USER2> Entrenched ISPs have complained that Google is getting special treatment. I find that somewhat disingenuous. It seems to me the difference between existing ISPs limp efforts to expand broadband and Google's is that Google did a decent job of telling municipalities what they needed to bring higher speed data to their constituents—and they did it in a very public way.

I think it's a good example of how one can bring attention to the senseless bureaucracy we all complain about. Instead of complaining, bring about actionable steps.

<comment><USER3> How do they explain why Google is getting special treatment? It's not like cities have a special, irrational hardon for Google. It's that Google is making a reasonable deal to them. If Time-Warner wants to do the same thing, they can make the same deal.

They don't want to make this kind of deal with cities. They want the government to prevent this kind of deal from being made.

<comment><USER4> Is Google making a reasonable deal? I.e. if they didn't have an advertising business to subsidize this with, would the terms still make business sense?

<comment><USER5> It's sort of a funny question.

Do roads make economic sense if we didn't have a federal government to subsidize them? Probably not: Texas derives around 58% [1] of its highway costs from vehicle-related fees (e.g. registration, gas tax, etc.) and the rest is subsidized from unrelated sources.

Then again if we did not have a road system, our economy would be in poor shape, because it is harder to get the store to buy things, and to transport the things around. So from that perspective roads are an economic net positive even if they were 100% subsidized from unrelated businesses.

Gigabit internet is similar to roads. It probably can't/won't be funded 100% by the people who use it. At the same time, it is important infrastructure that opens up new avenues for economic opportunity, and I suspect that any major city that had gigabit as available as roads or electricity would find that the benefits exceed the costs, be they subsidized or otherwise.

[1] [https://www.icloud.com/iw/#numbers/BAKsWA7R5a0YQGg3ptGBpPlvQ...](https://www.icloud.com/iw/#numbers/BAKsWA7R5a0YQGg3ptGBpPlvQVOwHeYiVwiF/Texas_highway_funding)

<comment><USER4> It's one thing for cities to subsidize infrastructure with tax dollars. Another for a private company to do it as a tie-in to its online services/advertising business. Still another for that company to berate ISPs while doing it, for not building infrastructure they themselves probably wouldn't without the cross-subsidy or synergy from their other businesses.

</comment></comment></comment></comment></comment><comment><USER6> Go, hometown! As someone who grew up in what used to be an incredibly lame and mostly uneducated city, this makes me so happy. San Antonio has come so far. A huge driver behind this is the success of Rackspace and the leadership of it's chairman and co-founder, Graham Weston.

I hope that founders of startups will consider forming their companies in SA. San Antonio has so much going for it: the hometown of one of the world's largest cloud hosting companies, fast Google Fiber coming soon, the booming Pearl district, Geekdom, low cost of living, great weather, awesome food, and so much more. I believe strongly that the future of the tech economy will happen outside of the SFBA and I feel that Google Fiber's bets point strongly to that.

<comment><USER7> >I hope that founders of startups will consider forming their companies in SA

Which makes me wonder: can businesses use Google Fiber? I was under the impression it's a consumer-only service.

Would they allow servers not for personal usage for startups?

(I really hope more startups appear in cities where many households have Gigabit connections. I can't wait to see _what_ could be done with fast Internet access.)

<comment><USER8> > I was under the impression it's a consumer-only service.

You're correct:

> We are currently focused on our Fiber-to-the-home network, which is for > residential consumers. We hope to be able to offer Fiber to small businesses > at some point in the future. To stay updated on any new developments, please > follow our blog > [http://googlefiberblog.blogspot.com/](http://googlefiberblog.blogspot.com/)

but that mostly means there's little uptime guarantee, a small business/startup could use GF either eating potential downtime or with a backup stabler line in case fiber goes down.

</comment></comment></comment><comment><USER9> What I don't understand is why google didn't bid on Time Warner.

With very little effort (compared with rolling out fiber in a couple cities) they could have completed the rollout of DOCSIS 3, and provided everyone with 343/143 Mbps using modems available today (zoom 5341j) and in a couple years when the 24 channel modems become more wide spread upgrade everyone to Gigabit operations.

In ten years will google fiber have cost them more than $45 billion? Will they have 1/10th the penetration that TW has today?

<comment><USER10> Speculative, but culture?

Look at how the Motorola acquisition played out. Motorola was a company that had a pretty damn good (maybe just a bit heavy) engineering culture.

If you buy out a culturally bankrupt company infested with assholes, you have to root out all those assholes while simultaneously continuing operations and developing the future. I dare say this would be much harder than a new build out.

<comment><USER11> Also speculative, but Google probably has a set of equipments that don't work well with others. When you play in the access and transport space, there usually a set of standard that you have to follow, in order for it to work together with others.

If Google owns the entire infrastructure, they can build their own equipments that are a lot simpler/cheaper to build, because they don't have to deal with all the standard-crap that other manufacturers have to deal with.

If they bought TWC, then they need to integrate all those devices, including all of the OSSes that are guarded by bureaucrats.

</comment></comment></comment><comment><USER12> I'd like to see government step up in their bureaucratic process more. I am not saying we should approve everything at the speed of light.

I feel bad when I read this article yesterday: [http://cityroom.blogs.nytimes.com/2014/03/11/in-9-years- of-w...](http://cityroom.blogs.nytimes.com/2014/03/11/in-9-years-of-work- just-3-public-toilets-go-live)

Only 3 public toilets go live in nine years. I hope we can break ISP franchise and monopoly too so I don't have to move a few blocks down just to get another ISP.

</comment><comment><USER13> The reason why the customer service at most ISPs sucks is because arbitrary rules are imposed on them by local governments. For example, if the average call can't be over 9 minutes long, don't expect help with a problem that takes half an hour to diagnose. If the same rules aren't being imposed on Google, then there's a problem.

<comment><USER14> I thought they just wouldn't go over 9 minutes due to internal rules (e.g., you'll get written up if your average call time goes over a certain level). Do you have a source for the "local governments" claim? I'd be very interested at yelling at my city council for imposing stupid rules like that.

(My main source for this goes back to Joel's article on Measurement[1].)

[1] [http://www.joelonsoftware.com/news/20020715.html](http://www.joelonsoftware.com/news/20020715.html)

</comment></comment><comment><USER15> Google Fiber is taking over and people will choose it over their regular ISPs because it's better. And soon enough it won't matter what OS your mobile device is running. For as long as you're connecting via Google Fiber, Google has your data.

<comment><USER16> I was a user of Google WiFi in Mountain View, and indeed the terms of service (which no one reads) allowed Google to collect information by watching what you did on the Internet. No PII, of course, but we all know that metadata is enough to identify people.

I solved this problem with a VPN, just like you need with AT&T or Comcast.

<comment><USER17> No they don't. Maybe you were confused by "We may record information about your usage of Google WiFi, such as when and for how long you use the network and the frequency and size of data transfers"?

[https://wifi.google.com/privacy_and_security.html](https://wifi.google.com/privacy_and_security.html)

<comment><USER16> I have no idea if the current document was the one I read last decade. At the time, I was alarmed enough to use a VPN.

(edit: archive.org says this page dates way back to 2012. Presumably it used to be elsewhere...)

</comment></comment></comment></comment><comment><USER18> So is Google actually planning on running new aerial fiber themselves or are they just using existing fiber that terminates to city buildings?

<comment><USER19> They run new aerial fiber. They're asking for the right of way on the poles.

</comment></comment><comment><USER20> As a San Antonio resident paying out the ass for AT&Ts 40Mbps tier, all I have to add to the conversation is this: fuck yes.

</comment><comment><USER21> YES!! When can I give you my money.

</comment><comment><USER22> Yes please. Start putting fiber in Leawood Kansas already.</comment>


Ask HN: Would you really use this on a girl? - <AUTHOR>

I saw this startup up on Thrillist - mydropcard.com - do you see people actually pulling out cell phones to send contact details? <comment><USER2> It could get more mainstream as more dynamic information can be shared via "dropcards" than on business cards. I think it's a pretty good idea, but I would prefer business cards.

</comment><comment><USER3> If someone is working with business cards and gadgets, they really need to try it in Japan. Business cards are extremely important there, but they have many early adopters in the population, too. See <http://en.wikipedia.org/wiki/Meishi> for more information.

</comment><comment><USER4> Well, I think this is a great idea if you consider the importance of business card against the idea that the business card holds all this contact info that you're going to get anyway.

</comment><comment><USER5> Aren't they using the same shortcode as chatterous.com?

<comment><USER6> It's running on TextMarks probably until they can spring for a shortcode.

</comment></comment><comment><USER7> No</comment>


Could Our Brain Be a Decentralized Blockchain System? - <AUTHOR> Are all the nuerons in our brain interacting like a decentralized blockchain system to collectively make up our consciousness? <comment><USER2> Short answer: No.

The blockchain essentially is a ledger, an accounting system. In order for that to work in a decentralised manner it's vital that each node have a complete copy of the data store and its history.

The brain on the other hand isn't an accounting system. It's decentralised, too but its nodes - the neurons - serve a very different purpose than Blockchain nodes. They only need to 'know' about their immediate environment, i.e. the neurons around them. Therefore not only doesn't each neuron need to have a complete copy of the data available but it would rather be tremendously inefficient to do so.

<comment><AUTHOR> I think the blockchain helps the transactions overcome trust issues due to fraudulent nodes on the decentralized network and thus there is a requirement of a complete copy of all the transactions to be present on each of the nodes.

In a brain however, we may consider the neurons to be ideal nodes which will never act fraudulently. So if some data is stored on a neuron, all other neurons can completely trust that the data will not be tampered (due to lack of any motivation for a neuron to act fraudulently).

That means we could skip the blockchain database part completely because 'trust' is naturally present in the network.

Also now I'm not sure if there remains any further scope for us to apply the idea of decentralized operations to the functioning of the brain's neural network. Do point out if any ideas pop into your mind.

<comment><USER2> Well, trustless trust is exactly the point of blockchain technology. If you can trust your participants anyway you don't need a blockchain.

On the other hand, neurons aren't ideal nodes that never act fraudulently. There's plenty of false information or misfiring neurons in the brain. The brain is very good at error correction and heuristics, however. So, 'fraudulent' nodes aren't necessarily a problem.

</comment></comment></comment><comment><USER3> No.

The main idea of the blockchain is that each block has a hash of the previous block that has a hash of the previous block that has a hash of the previous block ... so you get a chain of blocks.

Also, each mining node has the complete information of the previous block and all the new transactions, so it can calculate the hash of the previous block and a hash of the new data and create the new block.

Neurons have very few data available. They can sum, rest and make a small amount of delay and accumulation, but each neuron doesn't know the state of the whole brain and has no computational power to make a hash of it anyway.

<comment><AUTHOR> Applying the idea of decentralization on a network of neurons was what I got curious about. But I understand the blockchain is what makes the decentralization work in the first place. And I agree, the idea of blockchain is to maintain this continuously growing database of transactions on every node. And if neurons have to work like a decentralized system, they've got to have a blockchain like storage. That doesn't seem workable like you pointed out. :)</comment></comment>


The first known time chart: 10th century - <AUTHOR> https://apps.axibase.com/chartlab/5f25c508 <comment><USER2> I don't know what that site is. The Wikipedia entry the image is from is more interesting: [https://en.wikipedia.org/wiki/Howard_G._Funkhouser#A_note_on...](https://en.wikipedia.org/wiki/Howard_G._Funkhouser#A_note_on_a_tenth_century_graph.2C_1936)

<comment><AUTHOR> It's a NodeJS [chart]fiddle app built on top of Axibase TSD to create and test different visualizations using declarative DSL.</comment></comment>


Glamorous Toolkit - <AUTHOR> https://gtoolkit.com <comment><USER2> It would be great the the overview discussed more how it works with anything formats. My immediate questions which I couldn't find answers to were

* Can I import existing files, e.g. code and markdown into this tool? How?

* Can I export my data from this tool into standard formats?

<comment><USER3> These are interesting questions. Would you like to detail them?

GT is a development environment. It currently has full support for Pharo code. However, it is already possible to analyze systems written in other languages. Is this the direction of your questions?

</comment></comment><comment><USER4> To me, this looks like the most interesting (published) work being done in development tools atm.

<comment><USER3> Thanks for the kind words. May I ask what specifically you find interesting about Glamorous Toolkit?

</comment></comment><comment><USER5> [https://gtoolkit.com/docs/analyzing- systems/](https://gtoolkit.com/docs/analyzing-systems/)

<comment><USER3> Indeed, GT comes with an extensive support for various analyses.

</comment></comment><comment><USER6> I just quickly downloaded and tried it. It seems like Pharo Smalltalk with a notebook interface, basically a new UI, but Pharo is still there.

If I had time today I would take my old natural language processing Pharo class library and move it over to GT. There are many other great UI's and visualization frameworks built in Pharo.

<comment><USER3> Indeed, it is built in Pharo. However, the UI is designed as a language made of visual and interactive operators that can be programmed and combined in many ways live.

This enables a new kind of programming we call moldable development through which we construct tools for each individual development problem.

In any case, I'd be very happy to support you in playing with GT. Please ping us on Twitter ([https://twitter.com/feenkcom](https://twitter.com/feenkcom)) or via email.</comment></comment>


Open source Mindcraft server - <AUTHOR> http://github.com/TkTech/Creativity Creativity is a custom, from-scratch Minecraft SMP server developed by Tyler
Kennedy (aka TkTech). Its ultimate goal is to be an exact clone of the the
vanilla server with efficient, low-memory usage and the essential features
required for any game server (user management, chunk ownership, etc..). <comment><USER2> Its using sqlite, which folks say its more for desktop use. I wonder if this would scale.</comment>


Netcat – The swiss army knife of networking - <AUTHOR> http://mylinuxbook.com/linux-netcat-command/ <comment><USER2> I couldn't really survive without socat: <http://www.dest- unreach.org/socat/doc/socat.html#EXAMPLES>

<comment><USER3> I connected an SNMP monitoring system using two socats and an ssh tunnel. One socat to forward UDP over TCP to the locally encrypted port, and another to take it off on the other side and forward it to a local SNMP listener. It was a for a control system we were building that could monitor temperatures and control fan speeds in a computer cooling system. We ran it across several states in the US, and it was just to get an early demo of how the system would work before hardware was more locally available and the damned thing worked...

This made a lot of people very happy and it was really crazy to be on the phone with the other folks and have them rev up the fans in our lab via SNMP through this channel.

</comment></comment><comment><USER4> No better way to get the absolute maximum possible use of your pipe with the absolute minimum amount of security! Netcat has saved my butt when that 12GB package absolutely, positively has to be there within the next minute.

One of the coolest network utilities around. It's literally like a cat piped through the network. These are all great examples.

<comment> c-oreills If that's your use case then have a look at ncp: <http://www.fefe.de/ncp/>

From the site: '"ncp" is a utility for copying files in a LAN. It has absolutely no security or integrity checking, no throttling, no features, except one: you don't have to type the coordinates of your peer.'

<comment><USER4> Sweet :) I wasn't doing it over lan though, totally different subnets here. It's easy to quickly open the port I want to use for netcat on a remote machine and copy files quickly that way.

If you're interested in completely saturating all your resources for the maximum possible transfer speed, check out Tsunami: <http://tsunami- udp.sourceforge.net/> \-- It's a UDP protocol designed for raw throughput. Also no security or checking, but it does support throttling which is nice. I've tested and it actually does exceed netcat's rate by a few percent, but it's a little less reliable (client and server have to agree on a lot of things). Pretty cool to experiment with though :)

<comment><USER5> As an alternative to all of the above, consider UDPCast. It's point is that it can multicast; but it is also great for point-to-point copies. I adds its own reliability layer, so don't be scared of UDP in the name. It can rate limit, if you want. I've used it to great effect to shuffle a lot of GB to a bunch of servers at the time.

Way down at a low level, the network hardware/firmware knows how to send data 1:N. Using that is a single easy command away, but hardly anyone knows it.

[http://kylecordes.com/2008/multicast-your-db-backups-with- ud...](http://kylecordes.com/2008/multicast-your-db-backups-with-udpcast)

</comment></comment></comment></comment><comment> c-oreills See also ncat - netcat for the 21st century: <http://nmap.org/ncat/>

<comment><USER6> This is what everyone should be using instead of 'nc'. SSL, SCTP, IPv6, proxying, hex dump, keep open, waits, and more.

I wouldn't call 'socat' a swiss army knife. More like a tool shed. But it is very handy at times.

</comment></comment><comment><USER7> Ngrep is another awesome tool that is a networking equivalent of a common UNIX utility (although a more loose one in this case):

<http://ngrep.sourceforge.net/>

Also +1 for socat as a netcat replacement, having SSL there when needed is really helpful. I use it a lot for testing when developing network applications, replacing one end point with a fixed set of responses or even typing stuff in interactively etc.

</comment><comment><USER8> Nginx - the swiss army knife to avoid webserver overloading after getting frontpaged on HN (currently seeing error 500 from Apache only).

<comment><USER9> I really don't see how Apache vs Nginx will give you that much performance increase. The majority of the processing time for a request is in the backend (rendering, compiling, db calls, &c). Improved caching would give much better performance gains than just switching a server without any other improvements.

<comment><USER8> Compare memory usage; also Apache has problems with many concurrent connections and low hard limits as default, which nginx handles much better. Varnish of course would also be a valid improvement.

<comment><USER10> Apache can fill your 100Mbit line just fine for most cases. It's Wordpress where 98% of your processing time is spend.

Switching to nginx does not help at all in most cases. I really like nginx but Apache gets a lot of unfounded hate.

</comment></comment></comment></comment><comment><USER11> I love socat, way more powerful than netcat, it also supports SSL and IPv6, I wrote about some netcat to socat examples here <http://www.blackbytes.info/2012/07/socat-cheatsheet/>

<comment><USER12> and it supports sctp.

</comment></comment><comment><USER13> Except it is not Linux specific, rather a UNIX born utility.

</comment><comment><USER14> On Plan 9, where networked I/O is done through a file system, there is no need for netcat, you can use regular Plan 9 tools to do anything netcat does and more.

I miss this dearly on Unix.

<comment><USER15> There are two kinds of operating systems, those that people use and those that people don't complain about.

</comment></comment><comment><USER16> Network REPL, with autocomplete and history:

        rlwrap nc ....

<comment><USER17> It should be noted that rlwrap works on all programs that use readline. I've used it when starting out with programming in SML and getting annoyed at the missing arrow-up command history.

<comment><USER16> Actually, rlwrap works well with all line-reading programs that DON'T use the readline library, and not so well with some that do. Like the python debugger. :(

<comment><USER17> Hm. You're right. Next time I'll read a bit further in the man page.

</comment></comment></comment></comment><comment><USER18> Why is it a _Linux_ netcat command? What about the FreeBSD netcat or the Solaris one?

<comment><USER19> Actually the netcat shipped on most/all common Linux distributions (though IIRC, frustratingly not Cygwin which has a more limited one without the SOCKS features) is the one from OpenBSD.

But obviously the article was written from the perspective of "Fun commands available on Linux". I'm all for giving proper credit where it is due, but it's asking a little too much to expect that every newbie tutorial is going to inflict a full software genealogy on the poor reader...

</comment></comment><comment><USER20> nc is ancient but flexible. want encryption? pipe in openssl's command line to encrypt a stream. i'm pleased to see it so widely deployed.

for fun, find the original hobbit nc source code and read the comments. the complaints in there about writing a portable utility and dealing with platforms' weirdness and brokenness.

</comment><comment><USER21> My favorite use of nc to date:

cat disk.img > nc

nc > /dev/sda

<comment><USER22> This is basically #7, and I found it particularly handy when Ghost barfed on my source image.

Since we had an entire lab to clone to, we combined dd, netcat, and tee to just daisy chain the data out. It worked _magically_.

<comment><USER23> That was exactly my experience, and I nearly wrote the same thing. Frustrating day saved by 2 simple commands.

</comment></comment></comment><comment><USER24> Just in case: if you like ncat and networking tools check out also scapy <http://www.secdev.org/projects/scapy/demo.html>

<comment><USER25> In the situations where nc is useful then scapy is probably not an option. Nc, dd, and a few others are almost always present and great when you are in a real bind... something went wrong in a network install in pxelinux, and you want to copy off dumps or config files, or copy on a missing file. Otherwise, there are better ways to do most of the things mentioned in the article, most involving scp.

EDIT: the number of responses to this article happily highlighting the lack of security in netcat just terrifies me.

EDIT2: Ah, I see what you were saying (and scapy is an awfully cool library). It was just a convenient place for me to highlight was I didn't think was highlighted enough in the article: nc can do neat things, but not much that can't be accomplished better with other tools - its big advantage is that it's almost always present, even if ssh/scp, rsync, netstat, wget/curl, etc are not. Like using cat + sed as a text editor :)

<comment><USER24> I know they are different tools, I meant if you like to play with ncat, tcpdump etc and/or you're learning netsec you may want to play with scapy. Directed to the very few readers that may know about nc and not scapy :-)

</comment></comment></comment><comment><USER26> It seems there are better alternatives to netcat, i.e. socat and ncat. Why should I choose either? I'd like to learn how to use such a tool, but I'm not a CS major.

<comment><USER27> For the simple task of moving bytes through a tcp connection (what the article is about) netcat will be fine.

Socat allows you to use raw interfaces, or fifos, SSL, proxies, serial ports,... as one or both end points. E.g. you can forward arbitrary tcp connections (tcp relay;) but also connect stdin/stdout if a program to a serial port... just very, very, very versatile.

<http://www.dest-unreach.org/socat/doc/socat.html>

<comment><USER26> Thank you.

</comment></comment></comment><comment><USER28> make sure you checkout socat. It's netcat on steroids (<http://www.dest- unreach.org/socat/>)

</comment><comment><USER29> Few months earlier, when I was learning shell programming, I created a simple file transfer script using netcat (nc) and zenity (for little GUI).. Can be used to transfer files inside LAN.. It was actually made to use inside our college lab for my non technical friends..

<https://github.com/zyberkiddy/netcat-file-transfer>

</comment><comment><USER30> I can't seem to get the chat example to work on OS X. Does anyone know if it's limited to working on Linux?

[Edit] I was using nc 127.0.0.1 so I'm not sure if netcat can't communicate with lo. Also tried SSHing into a Linux box I own, now I get "Connection refused" on the client side (OS X).

[Edit Again] UDP works fine!

        Server: nc -ul -p <Port>
        Client: nc -u <IP> <Port>

</comment><comment><USER31> This really cool. I have always wondered if there was tool to quickly open a chat between two computers. It's nice to learn about this.

</comment><comment><USER32> Site's down. Didn't know that HN hugged so hard...

<comment><USER33> Plenty of other previous mentions here for you to peruse: [https://www.hnsearch.com/search#request/submissions&q=ne...](https://www.hnsearch.com/search#request/submissions&q=netcat&start=0)</comment></comment>


Richard Dawkins' jaw-dropping talk on our bizarre universe - <AUTHOR> http://ovablastic.blogspot.com/2008/09/richard-dawkins-jaw-dropping-talk-on.html <comment><USER2> Interesting in parts. Seemed to me like it covered old ground, and it also seemed like Dawkins was being a little dim-witted. He asked the wonderful question about whether there were things we couldn't know, and then proceeded to use old models to illuminate those new concepts -- engaging in a bit of circular reasoning. This served to illustrate his point well to the easily impressed (hey! He's talking quantum physics! Cool!), but left the viewer wondering how Dawkins got so lost in the epistemological forest. In other words, he did the same thing he was describing happening, using old models of reality to speculate on what new ones might be like ("middle world") Throw in a little military-bashing for an audience-pleaser (would it have been as funny using another stereotype?) and I was underwhelmed. YMMV, of course.

Not jaw-dropping.

</comment><comment><USER3> wow</comment>


Quantity discounts on a virtual good: results of a massive pricing experiment - <AUTHOR> http://www.pnas.org/content/113/27/7323.full <comment><USER2> Holy moly this is interesting. I have a bunch of reactions:

1\. I always get wrapped around the axle on pricing discussions - will x offset y? How will different groups react? I'm not crazy! It is hard and the effects do sometimes totally offset. Radically changing your pricing may in fact have absolutely no effect whatsoever. Whoa!

2\. I wish more companies would publish results like this and we didn't have to rely on the occasional (though terrific!) academic study. I'm sure Amazon runs experiments like this all the time.

3\. I feel genuinely bad about the mobile game industry and how these "high value customers". Maybe I'm making a bad assumption but it seems unlikely these folks are the idle rich spending their spare thousands on gold bars.

4\. There might be metrics in your business that are much harder to move than you would think. Local maximums that might be very hard to change.

Terrific, terrific study. Kudos to King for this, at least.

<comment><USER3> > Maybe I'm making a bad assumption but it seems unlikely these folks are the > idle rich spending their spare thousands on gold bars.

Having worked at a mobile games company: they actually are! We were heavily propped up by, among other things, Saudi oil tycoons trying to out-spend their (equally-rich) friends in cash-shop items, for the sake of being on the team with the highest power-level. We were effectively a virtual arms dealer selling to both sides of each little status-war between these folks. We considered them so important to our business-model that we took their likes and dislikes heavily into account in deciding which new games to make.

<comment><USER4> I work in AAA and I've heard (anecdotally) that there are people who 'buy the game'. That is, they buy every boxed edition on sale, every purchasable in- game item, every game guide, the t-shirt, every other piece of tie-in merchandise. They just buy the lot in one go, to the cost of $thousands.

</comment></comment></comment><comment><USER5> It looks like they only varied the quantity on a single price tier with no adjustment to the prices themselves.

I'd be curious what sort of results they'd get by changing the price tiers/anchors in conjunction with this kind of experiment.

For anyone that wants to do the latter kind of pricing experiment, I'm working on an API and looking for feedback: [https://blog.improve.ai/make-more-money- price-optimization-f...](https://blog.improve.ai/make-more-money-price- optimization-for-in-app-purchases-8b544ec9c7c0#.r42nagpmm)

<comment><USER5> Also, I was just at Pocket Gamer Connects and there was a presentation on using massive anchors (like 400 euro for the top tier) driving 3x revenue vs more normal anchors.

<comment><USER6> Are you saying they observed something like if you sell 1 hot dog for 10 shmeckles and 10 hot dogs for 200 shmeckles, people buy more single hot dogs?

<comment><USER5> No. The anchor tier was a slight discount on the primary currency with a huge amount of some unique special currency. The 100 euro tier also had the unique currency and the existence of the 400 euro tier drove purchases to the 100.

This was a hardcore MMO.

</comment></comment></comment></comment><comment><USER7> I wonder how the price changes were marketed and whether people already used to playing Candy Crush knew the cost of gold bars and so had (permanently) made their purchasing decision pre-promotion. "I know that Gold bars cost X, it's not worth it to me. This new pop-up promoting gold bars to me is unimportant, I shall dismiss it as in-game spam."

Also, this is very interesting: "this experiment suggests that some consumers who would have made small purchases were discouraged from doing so when faced with large-quantity discounts." In other words, a consumer wanting to buy one gold bar observes a fixed price of X but when she sees that ten gold bars only costs X*5, she is discouraged from purchasing only one, feeling that they are being ripped off or unduly profited from.

</comment><comment><USER8> A very interesting and well-conducted experiment, although I wish they didnt have the limitations they had (no lowering beyond the current 9% rate of discount; no price changes in the < 100 bars quantities; less so - no two-part tariff group).

I'd very much like to see more like it.

</comment><comment><USER9> Super interesting.

> Subjects were randomized into one of the four possible price schedules, with > a 20% probability of assignment to the standard discount or the radical > discount and a 30% probability of being assigned to the enhanced discount or > the deep discount.

Does anyone know why they would split the experiment group into 20%/30%/30%/20% instead of 25% each?

<comment><USER10> It might have to do with response rates.

If you feel response rates to your experiment are going to be low for a certain group, you make the group bigger so you can have a more robust sample in which to characterize respondents of that group.

</comment></comment><comment><USER11> At the bottom of the page there is a "Full Text (PDF)" link. The formatting of the PDF makes for easier reading, in my opinion.

<comment><USER12> Can't seem to find it. Can you link it in your response?

<comment><USER13> Looks like the PDF link only shows up if you have Javascript turned on

[http://www.pnas.org/content/113/27/7323.full.pdf](http://www.pnas.org/content/113/27/7323.full.pdf)

</comment></comment></comment><comment><USER14> Then (more) moral thing to do would be to provide high volume price discounts to shift the burden of financing a game from few "whales" to some more "medium value customers".

Besides, this would allow medium value consumers enjoy game more because they'd be having more paid features then before.

Whales are buying all they ever need (that's the only way I can explain them paying less after volume discount) so their main gain would be paying less money for that.

And company doesn't loose anything.

<comment><USER5> I'm just curious, but isn't having just the whales pay more "moral"? More people get a huge amount of value for free.

<comment><USER14> Some whales just have a lot of money and they like spending it and there's nothing immoral in allowing them to spend huge amount of their money.

Some even have more money than they should have and you can make the case that by taking the money from them you are actually helping them. Like the young men in Saudi Arabia, who, if they didn't spend huge amounts of money and time on your game would buy a fast car instead and with some good likelihood die in it (car accidents are leading cause of death of young people in Saudi Arabia, unlike anywhere else in the world).

But there's this other group of whales that makes it immoral. There are people who are susceptible to addiction. They will spend on the game way more money they can afford just because addictive loop of the game binds them bit too much.

This is as if the games were like kind of "alcohol", mildly pleasant to lot of people, very cheap, but cheap only because industry was selling it at such a low margin that they couldn't support themselves unless fraction of people got addicted to it and used it in amounts that's unhealthy for them spending all of their money in the process. If you add to this that the industry is giving away free samples on the off chance that some new people might get addicted, you can see how that can be immoral.

</comment></comment></comment><comment><USER15> Let's calm the horses a little.

A) It is one study. Very likely not statistically relevant on its own.

B) It is a certain subset of the pricing world that was tested. It may not apply to yours.

C) They themselves say "we found remarkably little impact on revenue". They looked for something and didn't see it. It's like you sitting in the forrest trying to see a boar. Just because you didn't see one doesn't mean there is none. For instance, one reason they didn't see the expected results may be that their experiment is not the right one, or that the tested population has an exceptional variable they didn't know about.

<comment><USER16> I think the intereting point is that the relationship isn't straight forward, and the "industry standards" aren't necessarily optimal.

</comment></comment><comment><USER17> The value in pricing analytics comes from finding ways to discriminate and/or influence purchase planning, not from blindly optimizing your demand curve.</comment>


2020 OS Migration - <AUTHOR> https://project-trident.org/post/os_migration/ <comment> yjftsjthsd-h Money quote: "Project Trident will rebasing with Void Linux."

Which is... _fascinating_. Switching out upstreams is one thing, but they're switching _kernels_ in the process!

EDIT: more comments from finishing reading:

Looks like they do broadly intend to work with the Void upstream, so I'm quite pleased (as a Void user) that there will hopefully be more people contributing, especially on the musl branch.

> We will not be creating a migration path from the FreeBSD-based Project > Trident to the new Void-based version. Please be prepared to copy your user > data (/home/*) to a temporary location like a removable drive before > installing the new version and copying the data back.

That's quite unfortunate. In particular, if they do integrate ZFS into Void including boot environments, there shouldn't be any reason they can't do it in place; just install into new filesystems and mount the old `tank/usr/home` as though nothing had happened. Unfortunately you would still lose direct binary compatibility, since Linux doesn't have a FreeBSD personality to use, but I don't see why you should need a new pool or home.

<comment><USER2> IMO a migration path between kernels would be expecting too much out of an OSS project, but maybe I just have lower expectations for these things.

<comment><USER3> It's probably not a matter of technical capability to implement, rather lacking the support staff to handle all the requests they get when edge case users have a failed migration.

<comment><USER4> I think they're trying to get around this by explicitly saying there will be no migration path, but it'll be interesting to see whether they actually get away with that.

<comment><USER5> They are a niche distribution of a niche distribution of one of the BSDs. They are moving to being a downstream of the 40th most popular Linux distribution by DistroWatch's measures. What is there to get away with? I suspect most of the people using this are the ones making this decision.

[https://www.distrowatch.com/dwres.php?resource=popularity](https://www.distrowatch.com/dwres.php?resource=popularity)

</comment></comment></comment></comment></comment><comment><USER6> Not familiar with Trident or Void, this announcement seems like a bit of an identity crisis.

From the home page:

> Project Trident is a desktop-focused operating system based on TrueOS. It > uses the Lumina desktop as well as a number of self-developed utilities to > provide an easy-to-use system that both BSD beginners and advanced system > administrators can feel comfortable running 24⁄7.

But after this change they are dropping BSD and TrueOS configuration tools. I'm curious how many users would stay through this transition (lots of other Linux OSes to move to instead).

</comment><comment><USER7> It is a bit weird to see this written as if it wasn't crystal clear that the linux kernel is the only alternative.

Why not just say it?

"Sadly the graphics support is still lacking on FreeBSD since all the driver development is very linux specific, we therefore decided to switch kernels because graphics is a major part of the user experience."

<comment><USER8> doesn't nvidia release FreeBSD graphics drivers?

<comment><USER9> It does, and the FreeBSD ports of open source Intel and AMD drivers are getting close to their Linux upstream. Pretty much the only thing that's seriously lacking is Nouveau.

<comment><USER10> What about all the arm-oriented mainline GPU support like panfrost, freedreno, etnaviv, vc3/4? Things are really picking up in this department...

<comment><USER9> I'm not sure, to be honest. I don't remember any news regarding FreeBSD ports of those.

Having said that, if they use the same frameworks as the x86 drivers, the work on Intel and AMD ports should make porting them easier as well, since it all revolves around linuxkpi - shims that provide Linux-compatible API for kernel code.

<comment><USER11> Someone would have to add the FDT (OFW) stuff to linuxkpi, and that's a lot of tedious work :(

Not only that, there's often some kind of dependency between GPU/display HW and platform clocks/IOMMU/etc blocks that we might have completely different drivers for. This embedded crap is super messy, why can't everyone use PCI for everything inside the SoC >_<

</comment></comment></comment></comment></comment></comment><comment><USER12> I see why one would run Trident over plain FreeBSD on a workstation. But what is Trident offering on top of Void?

<comment><USER13> Apparently it has had good selection of precompiled packages available.

</comment></comment><comment><AUTHOR> Does anyone know what their relationship with iXsystems is and will this affect iXsystems BSD work?

<comment><USER14> From what I understand, the relationship was that project-trident was built on top of trueOS. ixsystems sponsors trueOS.

I dont think there is a direct relationship other than that, aside from ixsystems apparently also supplied some forum hosting for project-trident (more correctly: a subforum on their forum)?

</comment></comment><comment><USER15> This site would benefit from higher contrast and thicker fonts.

<comment><USER16> This is a nice way of saying it's nearly unreadable to the point where i wonder if it looks radically different on the developers device.

<comment><USER15> I don't find it to be "nearly unreadable" myself, but yes it's difficult. I think it depends mostly on the quality of your monitor, and on how it is calibrated.

<comment><USER17> It's the contrast, or lack thereof. Black text on a gray background is going to be hard to read on any display.</comment></comment></comment></comment>


Smaller is Faster - <AUTHOR> http://www.yusufaytas.com/smaller-is-faster/ <comment><USER2> Smaller is faster is nothing new to software developers. Any embedded software engineer that has spent hours to avoid loading a few extra kb of code into RAM on a hardware limited system can tell you that.</comment>


Tell HN: Zero to MVP in 24 hours Interview - Submit Questions - <AUTHOR>

I am recording an episode of IdeaTin shortly, with Aaron Gough from ReadMyCode.org. He went from zero to MVP in 24 hours.
Post all the questions you think I should ask him here.
P.S. This is his post: http://news.ycombinator.com/item?id=1387800 <comment><USER2> Is a simple product a Minimum Viable Product, or just simple? ( <\- this is my question)

I think this service is great. But once again lean startup words are being used when I don't think they're appropriate, or needed.

I feel this partly because, if ReadMyCode required a MVP - there's a much quicker way to prove that people need to do x (it isn't clear to me what it does. Gist comments? Gist has that) by using pen/paper/skype/wordpress.

</comment><comment><USER3> 1\. Who is the intended audience? 2\. How do you plan to make money?

looks like a very very tiny niche to me....</comment>


Junk DNA — Not So Useless After All - <AUTHOR> http://healthland.time.com/2012/09/06/junk-dna-not-so-useless-after-all/?xid=rss-topstories&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+time%2Ftopstories+%28TIME%3A+Top+Stories%29

<comment><USER2> It's really sad that much of the public get their scientific beliefs from misleading press releases that lead to utterly incorrect headlines and articles like this, and the ENCODE consortium should be ashamed of themselves. They've done lots of damage that many other scientists will have to spend time and effort to correct.

splatterdash posted a link to an excellent summary of the problems in this thread, and I'd add a couple more links: <http://www.michaeleisen.org/blog/?p=1172> and [http://www.forbes.com/sites/johnfarrell/2012/09/07/reports-o...](http://www.forbes.com/sites/johnfarrell/2012/09/07/reports- of-junk-dnas-demise-have-been-greatly-exaggerated/)

</comment><comment><USER3> There has been a lot of buzz in the (scientific) twitter/blogo-sphere regarding this. The main point of contention is essentialy the % of functional element ENCODE annotates. As it turns out, their criteria of denoting a DNA element as 'functional' is debatable (i.e. a DNA sequence with biochemical activity). These elements when deleted from the genome often has no visible phenotypic change to the organism (us), which is why the % they put is believed to be way too much.

Here's a recent excellent blog post on the issue, in readable form to the layman: <http://selab.janelia.org/people/eddys/blog/?p=683>

<comment><USER4> Maybe not observable effects. There so many tiny things that must be in our genes that switches that affect anatomy are probably a small percentage. For example, the way people's laughs sound or the fact that almost everyone is attracted to paradisiacal places are probably influenced by genes and not just culture and nurture.

<comment><USER3> That is one possibility. But with subtle things like that, the trick is to come up with an experiment that either supports or falsifies them. Until such data exist, it remains a mere hypothesis.

</comment></comment></comment><comment> guard-of-terra Sorry, but it was obvious to me for years.

DNA is a program. Programs contain data and code. They also contain all sorts of control sections. This stuff is there for a reason and we should think by default that genetic code will have those too.

(For those who think DNA is not a program because it is environment and state dependent - sorry, computer programs are very adaptable beasts too)

Another frequent misunderstanding - any running program looks like it has most of its code never used. This is false, because code falls under 90%/10% law. 90% of code is needed 10% of time. The time for those "dead" genes will come more often than not, and they will fire.

</comment><comment><USER5> This is far from a revelation, and this article is just popularizing what has been known for [at least] the past 2 decades. Several scientists have built their careers on studying so-called "junk DNA" since the 1990s. See Jurka 2007:

"Eukaryotic genomes contain vast amounts of repetitive DNA derived from transposable elements (TEs). Large-scale sequencing of these genomes has produced an unprecedented wealth of information about the origin, diversity, and genomic impact of what was once thought to be 'junk DNA.'"

<http://www.ncbi.nlm.nih.gov/pubmed/17506661>

</comment><comment><USER6> Reminded me of something I read in an article "The Insanity Virus" a few years back.

> _If our DNA were an airplane carry-on bag (and essentially it is), it would > be bursting at the seams. We lug around 100,000 retrovirus sequences inside > us; all told, genetic parasites related to viruses account for more than 40 > percent of all human DNA. Our body works hard to silence its viral stowaways > by tying up those stretches of DNA in tight stacks of proteins, but > sometimes they slip out._

HN discussion: <http://news.ycombinator.com/item?id=1938618></comment>