The Principles of Versioning in Go - <AUTHOR> https://research.swtch.com/vgo-principles <comment><USER3> I understand why this rubs some people the wrong way, but it really is consistent with Go's vision since the start. I don't think Russ is trying to imply that the issues they are facing when designing the language (dependency management, generics, etc.) are unique or impossible to solve in any way. I think he is simply saying that they are complex problems whose solutions introduce complexity to the language and ecosystem, and when presented with such a trade-off, the Go team has always preferred to lean towards simplicity, even if it means not implementing a feature that some (or even many) developers want/need.

While I don't personally agree with many of the decisions they've made, I still respect the choices they've made and I think there is plenty of room for languages with competing philosophies. Because of Go's philosophy of not catering to every demand, it's never going to become the next Java or take over all of Software Engineering, but I think the Go team is fine with that as long as it continues to be useful as a tool for solving problems.

<comment><USER4> C is a simple language and yet it constitutes the guts of most computers on this planet and Mars. Simple works.

Go is really close to C. In fact, Rob Pike's Go CLI programs on his Github looks pretty much like a standard C program using getopt. Interfaces are just a nicer virtual function table. interface{} is just void *. In that sense, it's already treading ground that is proven to work. Go didn't have to do anything revolutionary because C was already great.

I hope the Go team will continue to embody what made C great so the next generation can receive the lessons its taught us.

<comment><USER5> Thanks to UNIX adoption.

C is the JavaScript of systems programming.

Had it not been for UNIX workstations and universities adopting it, we would probably using BLISS, PL/I or something else instead and not bleeding billions of dollars per year fixing security exploits.

<comment><USER6> Maybe we would be using oberon. But then, go owes as much to oberon as it owes to C.

<comment><USER5> Oberon was good for its time back in early 90's, too little for modern computing.

We would be better served with Modula-3 or Active Oberon, which Go failed to learn from.

</comment></comment></comment></comment></comment><comment><USER7> A very large issue with go tooling around dependency management is that it's based around concepts like this:

> _If an old package and a new package have the same import path, the new > package must be backwards compatible with the old package._

Which are effectively fine conceptually. Every dependency system also supports that, you just make a new project named "thing-v2" instead of bumping a major version. Making it explicit and encouraging it when possible (instead of forcing breaking changes) is good.

The problem is that there's absolutely nothing to help you achieve that. Or detect failures to achieve it. Or anything. You can't even reliably rename _a single package_ with existing refactoring tools, good luck copying and refactoring most of an entire repository correctly. If you do it wrong, you might have to do it all over again because it's probably another breaking change.

Without fairly strong tooling to push people towards correct behavior, "every change is breaking" is _the default behavior_. And the frequent accidental behavior even if you're being careful.

<comment> ainar-g > The problem is that there's absolutely nothing to help you achieve that. (…)

There were talks about "go mod release" from the very beginning, but you are currently correct here.

> (…) You can't even reliably rename a single package with existing > refactoring tools. (…)

Strictly false. There is gomvpkg[1]. The absolutely ironic thing is that it's still stuck in the GOPATH mode, despite being a part of the official x/tools repo, but it's not "absolutely nothing".

[1] [https://godoc.org/golang.org/x/tools/cmd/gomvpkg](https://godoc.org/golang.org/x/tools/cmd/gomvpkg)

> Without fairly strong tooling to push people towards correct behavior, > "every change is breaking" is _the default behavior._ And the frequent > accidental behavior even if you're being careful.

I agree. Honestly, the slow progress in moving the community's favourite tools, including gomvpkg, to work in the new ecosystem is a massive failure on the Go authors' side. That just means that they haven't made the move easy and simple enough.

<comment><USER7> > _Strictly false. There is gomvpkg[1]. The absolutely ironic thing is that it > 's still stuck in the GOPATH mode, despite being a part of the official > x/tools repo, but it's not "absolutely nothing"._

IMO renaming packages is a necessary prerequisite, but otherwise orthogonal to handling breaking changes. Personally I don't include it in the "something that could help" group.

Either way, it's _wildly_ unreliable in my experience, so that point stands.

<comment> ainar-g I've used gomvpkg several times during refactorings and rewrites of orphaned code and never had an issue with it (in GOPATH mode that is). But oh well, YMMV, I guess.

<comment><USER7> By "in GOPATH mode" do you mean it only looks at your GOPATH, not vendor? If so, that could be (part of) the issue - my GOPATH is definitely not up to date with whatever project I'm working on.

Also that'd mean it's a few years behind even basics like the vendor folder, so I'd be comfortable putting it in an "abandonware, effectively does not exist" category.

<comment> ainar-g I've never had the need to rename anything in vendor/, so I can't really answer here. I've only renamed stuff in my project's internal/. Can I ask you why did you feel the need to rename something in your vendor/? It feels completely unnecessary and counter-intuitive to me.

<comment><USER7> Sorry, I meant "does it only try to use my GOPATH for imports while type- checking my source". My dependencies are in ./vendor, so ignoring it would lead to lots of problems.

Renaming stuff in vendor: almost never. It could be useful for handling library updates though, if it worked and were possible: you could refactor it to the v2 path, automatically updating your code, and then pull the new update for real and be mostly done (for minor-but-breaking changes). I've done similar things in other systems for library updates, since there's usually zero automated migration help for library _users_ , only _authors_ , despite users greatly outnumbering the authors.

<comment> ainar-g Ah, I see. As far as I know it is vendor-directory-aware. At least it always renamed my packages that imported stuff from vendor/ with no problems.

I don't deny that you could have issues with the tool, I simply have never encountered any myself.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Spending my time as of late in npm's particular flavor of DLL hell, I appreciate the Go team taking a stab at this hard and persistent problem. I agree with other commenters' observations that the tooling hasn't caught up with the philosophy, but the philosophy seems on-point (and the key observation that as the dependencies of a project approach infinity, the odds of two branches of a dependency tree wanting to rely on two different versions of the same library approach 100% and there should be a sane way to address that need... npm does a 99% decent job of addressing this, but I've definitely hit issues with npm where objects generated by a newer dependency version have leaked into a codepath where an older version is calling the shots, and it's an absolute hellscape to debug).

<comment><USER9> Npm seems to lack, in the context of the article, the _ecosystem_ and _community_ aspect. It's all like herding cats. Case in point, leftpad.

* > as the dependencies of a project approach infinity, the odds of two branches of a dependency tree wanting to rely on two different versions of the same library approach 100% *

With experience, I've found that this is precisely the case, with bounds much, much smaller than infinity. The ersatz standard lib can't even standardize, there's underscore and lodash. I think eventually the community will Ostwalt ripen in a sense, small packages will dissolve by attrition and big ones will grow. But the argument is strong for simply decreasing n = number of discrete packages.

</comment></comment><comment><USER10> The basic issue with this criticism of Cargo is that the fact that updating dependencies can cause breakage _never actually goes away_. The package management tool either makes this problem easy, or it makes it hard. The approach Cargo chooses is to make "cargo update" more likely to work by allowing library authors to specify incompatibilities. This can go wrong in edge cases. But that's inherent to the problem itself. Minimum version selection only seems to work because it doesn't actually solve the problem of keeping dependencies up to date. The moment you want to do that, you're stuck with "go get -u", which is just a worse version of "SAT solving" because it doesn't know how to detect and avoid incompatibilities.

(As an aside, I don't like the term "SAT solving" for the problem of package version selection. By focusing on an implementation detail, it makes the problem seem scarier than it actually is. Register allocation is NP hard too, but nobody calls the register allocator "the SAT solver".)

<comment><USER11> I think calling it a SAT solver is appropriate here. A lot of package managers were "organically grown" i.e. they were created in response to a problem that arose. Not much thought was given to the underlying problem and in the long term users suffer with e.g. dependencies taking forever to install and strange deadlocks. Recognizing it as a SAT problem from the start means we can easily throw Z3 or similar at it instead of manually adding heuristics everytime a user files a GitHub issue. (See Bundler and other pre-2018/2017 package management tools for example) Also, it's not always a SAT problem. For npm, Java Classloaders it's just tree traversal because conflicting sub dependencies of a dependency can co-exist.

That said, the Go's team (and to a lesser extent Python's too) dropped the ball here. None of the challenges of dependency management was unknown or unsolved. Anyone who has used e.g. Maven should be more than familiar. (A 11 section blog post is indeed nice though, good for onboarding new programmers I suppose) If developer experience was considered a first class priority, this could have been solved from day 0.

(My personal favorite is NPM since conflicting dependencies can co-exist at the expense of greater disk usage, but memory is cheap these days. No one with an electron app on their desktop has any right to complain about the memory usage of plain text source code.)

<comment><USER10> See, that's the reason why calling it a SAT solver makes the problem sound scarier than it is. Using Z3--or even MiniSAT--is massive overkill. The naive exponential algorithm is fine, and it leads to more maintainable and understandable code. Rust's build performance has nothing to do with dependency solving. I've never heard of a package manager in which core dependency solving was a speed problem; dep was slow because of I/O, not SAT solving.

<comment> ainar-g > The naive exponential algorithm is fine (…)

Define "fine". In my experience, Go with modules[1] solves a project's dependencies _exponentially_ more quickly than dep. And that is especially noticeable on big projects with three or more dozens of dependencies. I don't mean any disrespect to the people behind dep, and the whole debacle was a massive miscommunication disaster, but go mod is just quicker.

[1] While we're at it, I'm still low-key mad that the Go authors called modules packages and packages modules. Gah!

<comment><USER10> Again, that's because of I/O. The CPU bound part of the algorithm is very fast, as Cargo demonstrates.

<comment> ainar-g I don't get it. The number of dependencies is constant. Which means that both of them need to make approximately the same amount of network requests. Where does the I/O difference come from then?

Also, since you've mentioned Cargo. Its slowness actually used to be one of the main pain points about which the Rust people at one of the companies I've worked for in the past complained a lot during the water cooler discussions. Granted, that was a couple of years ago, and Cargo has probably made progress since then.

<comment><USER10> As I recall, dep had to parse Go code over and over during the dependency resolution process instead of caching it.

And any cargo slowness is likely the fault of rustc or I/O. It's received a lot of profiling work and the core dependency solver has never been a performance issue to my knowledge.

<comment><USER12> It would seem this is correct. From the docs: [https://github.com/golang/dep/blob/master/docs/FAQ.md#why- is...](https://github.com/golang/dep/blob/master/docs/FAQ.md#why-is-dep-slow)

There are two things that really slow dep down. One is unavoidable; for the other, we have a plan.

The unavoidable part is the initial clone. ... Fortunately, this is just an initial clone - pay it once, and you're done.

The other part is the work of retrieving information about dependencies. There are three parts to this:

* Getting an up-to-date list of versions from the upstream source

* Reading the Gopkg.toml for a particular version out of the local cache

* Parsing the tree of packages for import statements at a particular version The first requires one or more network calls; the second two usually mean something like a git checkout, and the third is a filesystem walk, plus loading and parsing .go files. All of these are expensive operations.

\</comment></comment></comment></comment></comment></comment></comment></comment><comment></comment><comment>----

For context, in comparison, Cargo has the same #1 problem. But for #2, the information on all dependencies is stored in the index itself; this means that Cargo can figure out what dependencies you need without any network calls at all, let alone downloading, git checkout, and filesystem walk.

I do not know how go mod compares, off the top of my head.

</comment><comment><USER13> Side note, I just noticed that [https://godoc.org](https://godoc.org) does not support Go modules with major versions being incremented (e.g., ending in `/v2`). The new pkg.go.dev does but not the existing godoc.org.

This echos some of the other observations of tooling not being easily updated and still not being there, yet.

<comment><USER14> pkg.go.dev is the module aware replacement for godoc.org.

<comment><USER13> The tools, habits, and existing links haven't been updated. godoc.org don't point people to the new site. The "replacement" experience is a little broken.

</comment></comment></comment><comment><USER13> > The answer is that we learned from Dep that the general Bundler/Cargo/Dep > approach includes some decisions that make software engineering more complex > and more challenging.

Are those documented anywhere? Are they detailed, discussed, or otherwise dealt with. The people behind those package manages have a significant amount of experience with dependency management including many real world situations. It would be good to have some public discussions on this for everyone's benefit if this is really true.

> Principle #1: Compatibility

The whole section on compatibility doesn't sit right...

> It is intended that programs written to the Go 1 specification will continue > to compile and run correctly, unchanged, over the lifetime of that > specification. Go programs that work today should continue to work even as > future "point" releases of Go 1 arise (Go 1.1, Go 1.2, etc.).

This doesn't seem to apply to the tooling. For example, `go get` has a new behavior since the introduction of modules. The behavior changed. So, the compatibility idea only extends so far. Is that hypocritical as an idea because people use the `go` CLI for scripting and the behavior of it changed.

> What does compatibility have to do with versioning? It's important to think > about compatibility because the most popular approach to versioning > today—semantic versioning—instead encourages incompatibility. That is, > semantic versioning has the unfortunate effect of making incompatible > changes seem easy.

Incompatible changes happen. How many long lived pieces of software have needed to make incompatible changes while supporting people through that process. Do you rewrite? Do you copy the whole codebase to a new sub-directory and add more there? This is what the Go project has started to recommend. If you do that you loose history and some projects move fast (look at Kubernetes client-go).

Tools like npm, cargo, and dep provide a means to stay at older versions if that's what you want. The choice is up to the consumer of the package. With Go the choice is now up to the Go team by limiting choice. Is that a good thing? Not if you don't like the choice.

<comment><USER15> "This doesn't seem to apply to the tooling. For example, `go get` has a new behavior since the introduction of modules.... Is that hypocritical as an idea because people use the `go` CLI for scripting and the behavior of it changed."

It does not apply to tooling. It is not hypocritical because it was never claimed that it applies to tooling. It has always been a promise about code.

<comment><USER16> Build systems are code.

<comment><USER15> That's not the question. The question is, what was promised, not what can you can you twist their promise into if you choose different definitions than they do. They have only ever promised that code written in Go 1.0 will be forwards- compatible, not that the build systems will all be the same.

When I promise my kid that I'm "taking them to the park" this weekend, they have no grounds to complain when I don't take them to a full-fledged amusement park just because "taking them to the park" would technically cover that too.

</comment></comment></comment></comment><comment><USER13> Both Red Monk and TIOBE [1] are noting a decrease in the popularity of Go. Red Monk wondered aloud if this had to do with the way the Go modules / dep situation happened [2].

I wonder if the posts lately are an attempt to win people over to their thinking or to win back popularity.

[1] [https://www.tiobe.com/tiobe-index/go/](https://www.tiobe.com/tiobe- index/go/)

[2] [https://redmonk.com/sogrady/2019/07/18/language- rankings-6-1...](https://redmonk.com/sogrady/2019/07/18/language- rankings-6-19/)

<comment><USER15> Tiobe fluctuates wildly, and it isn't really plausible that it plummeted as far as it did on Tiobe in just one month. The chatter on HN will tend to amplify problems beyond what the general public actually feels the correct level is, and even on HN this hasn't exactly been a big topic. (When generic Go topics discuss "what's wrong with Go" this is not generally something that is mentioned.) It seems far more likely that, yet again (this isn't exactly a new thing with Tiobe), the search engines did "something" and the searches changed again. Many, if not most, of the programming language names are susceptible to that, between things that are too short to search for like C and terms of general interest like Python, but Go really has to be the worst.

Ten-year-old+ programming languages with at the very least tens of thousands of users (I see "millions" claimed, I find myself a bit skeptical, but maybe... conservatively tens of thousands for sure, though) do not lose 33% of their users in a _month_. That'd be somewhere in 2-3 orders of magnitude faster than Perl 5 has declined. Implausible.

<comment><USER13> TIOBE notes that it is looking at popularity. This is different than use. Go didn't loose a bunch of users. In the ways TIOBE measures popularity... it lost some popularity.

<comment><USER15> It did not lose one third of its "popularity" in a _month_ , either.

You're putting a "just so" story on top of noise. Nor is this special pleading on my part; "Tiobe is mostly noise" has been my position for years, along with a lot of other people. Signal probably exceeds noise for maybe the first 3 or 4 or maybe 5 slots, after that it has a history demonstrably absurd claims about the popularity of things like REXX, which spent many years in the so- called "top 20", which is just ridiculous.

</comment></comment></comment></comment><comment><USER17> _> If an old package and a new package have the same import path, the new package must be backwards compatible with the old package._

Simply put, this rule is too strict, and biases modules' UX and semantics too far toward consumers.

Not all packages are so mature, and consumed by enough consumers, that they should be forced by the language tooling to maintain backwards compatibility. That requirement creates a great deal of pointless work for the majority, perhaps vast majority, of package authors, who write small and uncertain packages for use by themselves or a small number of their immediate colleagues. For these authors, strict backwards compatibility is not only unnecessary, it's actually undesirable, as it creates needless toil.

 _> The answer is that we learned from Dep that the general Bundler/Cargo/Dep approach includes some decisions that make software engineering more complex and more challenging._

For a minority of use cases, where packages are large and mature and imported by many, many consumers -- sure, maybe. But the vast majority of Go code, written by private organizations and used internally, doesn't fit this description.

<comment><USER18> Nothing's physically _stopping_ you breaking backwards compatibility without using a new import path if you want to. You might piss off your users but if they don't care then go for it.

<comment> grey-area Doesn't the go tooling mandate this if you are >= v2.0?

The rest of mod looks fine but tying paths to major version changes was a mistake IMO.

</comment></comment></comment><comment><USER19> (Kind of meta-venting out below, also known as rant.)

1\. I don't know why I find Russ's writings are so irksome, even unpleasant to read, sorry. (Please help me on that, maybe I am in "questioning authority" mode and cannot flip out of it.) I cannot shake that feeling of being patronized all the time without being asked. The whole article, no - bunch of his posts, - reads like "we know better". Is it a Google thing, or heavy Rob Pike's influence?

Yes, he is bringing some good points, and some very questionable ones. And for the questionable one (Compatibility section for example, or SAT solver question (nobody did it before?), or version naming, or paths for the sub- components...) it feels like he is trying to push explanation about his (and his team?) reasons and motivations behind these decisions, but... it is a monologue. There are more opinions and whole wide world of different software shops with own ideas and practices.

2\. Go2 was a promised land, that later translated into "incremental, no code breaking" approach. Nowadays it feels like they are not even talking about it anymore!

Looking at general history of programming languages, pretty much every language has had it's "C++" or Modula-2 moments. It is a natural process - <USER2> evolution - when unneeded parts disappear, and useful ideas added/extended. Amount of gotchas in Go is not zero, and to me (YMMV) it feels like Go2 would be (was?) a good time to shake off under-thought items, and enforce some new rules. Maybe even add interoperability between .go and .go2 files, maybe even semi-automatic upgrade path to run `go2 fmt ` on old files a la to Kotlin from Java - I don't know. But it feels like an opportunity and momentum for a "peaceful revolution" is lost.

3\. Even with non-breaking changes style of change they have managed to break stuff. I, for one, still sit on 1.12 branch - because when I tried to upgrade to 1.13 (twice now), and our pure-Go code just plainly did not build with some obscure messages (I think it was linking or module cache errors). So, why pretend? Code rot is unavoidable - do we like it or not.

99\. There are couple more points about chilling effect of "we know better" on a community as whole. (One example would be this whole "error" debacle that visible reduced activity on issue tracker and golang-nuts mailing lists after "hey all, we are going this way because we already went there". Immediately after it felt like people just gave up and left. "Empty town square" feeling.) It would be interesting to see this year results of "the state of Go" survey, but I don't think we will see a worrisome drops there -- the amount of new people coming in would easily override any opinions of people leaving.

/end of rant, sorry for a long post

<comment><USER18> I think you're wrong on all counts (or I have no idea what you're trying to say).

> nobody did it before?

As far as I know no other dependency system is the same as Go's.

> "we know better"

I mean, it is Rob Pike. How successful do you have to be before you get to say I know better? In this case it _is_ better.

> Nowadays it feels like they are not even talking about Go 2 anymore!

This very post is about Go 2 (in the sense that there was ever going to be a "Go 2").

> pretty much every language has had it's "C++" or Modula-2 moments. It is a > natural process - an evolution - when unneeded parts disappear,

I can count on one finger the number of parts that have disappeared from C++.

<comment><USER13> Go modules are in the post Rob Pike era. Russ Cox is how the sole lead of Go and this was his project</comment></comment></comment>


Ask HN: What options are there for executing untrusted code in Node.js? - <AUTHOR>

Over the past couple of weeks while prototyping various ideas I've kept on running into a hurdle when it comes to trying to run untrusted JavaScript code in Node.JS.
One solution I found early on was Sandbox (http://gf3.github.io/sandbox/), which seems to be fairly safe security wise, but doesn't offer much else.
Node.JS also has a vm module (http://nodejs.org/api/vm.html), but it it is 'Unstable'.
I've also come across sandboxed-module (https://github.com/felixge/node-sandboxed-module), however I can't figure out what it actually does, and also js.js (https://github.com/jterrace/js.js), but it's much too slow to be of much use.
So, does anyone else know of any other solutions? <comment><USER2> I never ended up using it but take a look at [https://code.google.com/p/google- caja/wiki/JsHtmlSanitizer](https://code.google.com/p/google- caja/wiki/JsHtmlSanitizer)

and there is a node wrapper here [https://www.npmjs.org/package/google- caja](https://www.npmjs.org/package/google-caja)

Funny about Node Sandbox. I was fluctuating from grasping it completely to asking wtf is this myself, lol.

<comment><AUTHOR> I'll have a look at Google Caja, thanks.

</comment></comment><comment><USER3> Perhaps if those tools aren't meeting your needs, you could run the Node interpreter in a sandbox, instead.

</comment><comment><USER4> What about Sandbox doesn't suit your needs?

<comment><AUTHOR> It'd be great to be able to access the scope of the sandboxed code from the script using the sandbox. I vaguely remember another sandbox-like project having this as a feature, but I can't remember the project name.

Sandbox doesn't really offer much in this department except for concatenating variable declarations to the start of the untrusted code, which isn't exactly nice to work with.</comment></comment>


Windows apps made on Linux hit by security fail - <AUTHOR> https://www.zdnet.com/article/windows-apps-made-on-linux-hit-by-security-fail/ <comment><USER2> Title should probably be "MingW on Linux yields ineffective ASLR" but then again should probably also link to a better source such as:

[https://www.kb.cert.org/vuls/id/307144](https://www.kb.cert.org/vuls/id/307144)</comment>


The "Friend" You Only Spent 5 Minutes With - <AUTHOR> https://medium.com/millennials-guide/the-friend-you-only-spent-5-minutes-with-948ce73eae25 <comment><USER2> I have an iterative unfriending algorithm, because doing big clean ups is a mental task. Whenever Facebook notifies me that somebody has a birthday, if I don't feel like telling them happy birthday, I'll unfriend them instead.

<comment><USER3> So the key to remaining your Facebook friend is to not publish your birthday on Facebook!

<comment><USER2> That's true. Also no annoying vacation diaries. If they don't get filtered I might unfriend you for those, too.

</comment></comment></comment><comment><USER4> The problem is not spending your time getting updates from Albert J. Random. The problem is getting bombarded by videos and other social-media-tailored content Albert (or any of the other people you've spent 5 minutes with in your life) didn't create but just happened to like or share.

The only thing that interests me on Facebook is what my "friends" have originated. My interest and time spent have declined in direct correlation with the amount of said content.

</comment><comment><USER5> I always thought it was weird when someone sent me a friend request after meeting me one time. I made it my policy to ignore these requests and just let them sit. Then if I ended up meeting the person 2 or 3 more times and it seemed like we were connecting I'd hit "accept". Sometimes this would happen months later and the person would be surprised. They'd have forgotten they even sent the request.

Eventually I realized I wasn't getting a lot of value from facebook and left entirely.

</comment><comment><USER6> That was exactly my first step to drastically reduce facebook usage:

1 - Unfollow all your "friends".

2 - Unfollow friends that post too much. Only get in touch with them by email or presencial.

3 - Facebook becomes so static that you hardly ever have the urge to visit it.

<comment><USER7> My solution was to stop using Facebook cold turkey and request that my friends contact me another way. My real friends did, the rest didn't bother. I spend more time interacting with people I care about and less time "interacting" with "friends".

<comment><USER8> Came here to say this.

Deleting my fb account has been a positive experience. Real friends stay in touch, and the stressful negative/argumentative comment threads and posts are gone.

Admittedly I still use instagram. Their model works well to let me keep in touch loosely, without highlighting every like/repost/comment of the people who I follow.

</comment></comment></comment><comment><USER9> I'll counter: There have been quite a few instances of FB friends like this in my life. I rarely deny a friend request or go on deleting sprees. If I meet someone doing interesting things, I'll be the requestor even. What happens occasionally is I find out someone I spoke with in person for only a few minutes, reveals over weeks, months, or even years, has very similar interests, humor style, etc. Comments on each other's post increase in frequency, until the fake friend becomes a real one after reaching out via a message that doesn't really come off as odd at all at this point. Who I do find myself unfriending is those I dated briefly that inevitably get married and have kids. Good for them, but time to disconnect. As I grow older, I realize more friends are a function of convenience. Your "real friends" will go on to do things in their life that distance them from you, and seem less like real friends, and your "fake friends" will become real friends when it seems logical. This ebb and flow may seem ugly to some, that would prefer to view all their friends as genuine stakeholders in their life with unwavering caring, and some of that does happen, but there is beauty in friendships being temporal as well.

<comment><AUTHOR> The friendship with Albert is a shallow one that the main character is not interested in. The "friends" you are referring to are people you admire but do not know well. I definitely have some of those friends, some who are a source of inspiration for me. With these people, it's easier to enhance the friendship over social media than in person. For example, people who are into painting or photography upload their work online. Viewing, liking, and discussing their art would teach me more about them than talking in person.

I like your idea of "real friends" VS temporal friends. One problem with only having "real friends" is that people get hung up on them, and if circumstances separate them they'd have a harder time acclimating with the change.

</comment></comment><comment><USER10> This is worse on LinkedIn. Every recruiter wants to connect with you blindly before they'll share details about some mysterious job they have in their pocket, just waiting for you.

If you keep LI to _only_ people you've actually spent more than 4 weeks working with, it becomes a lot more sane.</comment>


Ask HN: How much time do you think you waste on Cookie prompts? - <AUTHOR> I am finding this to have become a major distraction, not only because it steals in sum a few minutes of every day, but because it is a major distraction that disrupts my train of thought, when e.g. looking up on thesaurus. It doesnt help that many sites think it appropriate to prompt again every week. <comment><USER2> Very little. I use I don't care about cookies [0] for my casual surfing, it automatically dismisses them.

[0] [https://www.i-dont-care-about-cookies.eu/](https://www.i-dont-care-about- cookies.eu/)

</comment><comment><USER3> Not enough to build a startup to remove them. Actually sometimes they help me to stop procrastinating. These occupying entire page or with some usability issues are effective dopamine circuit breakers.

</comment><comment><USER4> None. I ignore them. They usually are just an ignorable message on top/bottom of the page. If a site does make a modal prompt about it, I just close the site.

</comment><comment><USER5> The difference in experience browsing the web in the UK vs Canada makes me think the EU made a mistake with these regulations. The end results is basically making things a PITA for the end user. [Edit] I realize I didn't answer the question, the answer is: too much.

</comment><comment><USER6> Total time? Very little. Critical time when I just need to be able to use a website. 50%.

</comment><comment><USER7> I have made a little game out of ignoring those prompts; I have not yet clicked on one to dismiss it. Just sort of try to filter them out of my awareness like I used to do with banner ads.

</comment><comment><USER8> You can block these using uBlockOrigin. Look for "annoyances" blocklists in the Filter List settings, especially Fanboy's Cookie List

</comment><comment><USER9> However long it takes to click the button to make it go away is the amount of time wasted. The EU felt it was their right to pass a regulation that achieves nothing other than annoying millions of people several times a day.

</comment><comment><USER10> Would ublock origin be able to block those?</comment>


The Phantom Time Hypothesis (2011) - <AUTHOR> http://www.bbc.co.uk/dna/place-london/plain/A85654957

<comment><USER2> [http://en.wikipedia.org/wiki/Phantom_time_hypothesis#Argumen...](http://en.wikipedia.org/wiki/Phantom_time_hypothesis#Arguments_against_the_hypothesis)

<comment><USER3> Wow, I thought it was a pet theory of Fomenko [1] only.

[1] [http://en.wikipedia.org/wiki/New_Chronology_(Fomenko)](http://en.wikipedia.org/wiki/New_Chronology_\(Fomenko\))

<comment><AUTHOR> This is what I was originally looking for when I found the Phantom Hypothesis instead.

Thanks for the link.

</comment></comment></comment><comment><USER4> There is other history apart from European history. I see no confirmation from Arabic, Russian or Chinese history which would certainly show a 'sudden jump' over the years which were supposedly invented.

<comment><USER5> Grep the article for "If someone had changed the calendar, wouldn't anyone else – say the Muslims? – have noticed?" \-- a paragraph which ends with:

"All these areas would require an enormous amount of research either to validate or refute the theory, research that is unlikely to be undertaken by anyone not interested in rewriting the timeline."

</comment></comment><comment><AUTHOR> Though most probably incorrect, it remains an interesting idea.

io9 provides a good graphic showing the 'Phantom Time' and how it would affect our current dates.

[http://io9.com/5801363/infographic-explains-the-phantom- time...](http://io9.com/5801363/infographic-explains-the-phantom-time- hypothesis-in-which-the-middle-ages-never-happened)

<comment><USER6> I don't understand this infographic: what does the sine wave represent?

<comment><AUTHOR> Time moving forward. The only reason I can see for it being a wave shape is to more clearly mark each year. The years can be found at the highs and lows of the wave.

If you ignore the shape and just think of it as a long multi-line spanning timeline then it should make a little more sense.</comment></comment></comment>


TCP and Websockets for Games - <AUTHOR> http://ithare.com/tcp-and-websockets-for-games/ <comment><USER2> Great article. I have seen this "most popular TCP bug" in dozens of applications (including commercial ones). Seems to be the default misunderstanding about TCP.</comment>


Bitcoin sets a new record at $ 12,573 - <AUTHOR> https://bitecoin.it/bitcoin/bitcoin-segna-un-nuovo-record-a-12573-dollari/ <comment><USER2> Ummm, that is not the record in most people's minds</comment>


The REST with Spring series - <AUTHOR> http://www.baeldung.com/rest-with-spring-series/ The REST with Spring series discusses the process of building a RESTful web service with Spring. <comment><USER2> It looks interesting but reading through the articles I can't help wondering who this (what audience) this is written for. I do not know much about Spring, Maven and all that and it seems, that even though I'm comfortable with Java, a bit alien to me.

<comment><AUTHOR> Spring is just one of the ways to implement a RESTful service with Java. That being said, as long as you're using a framework and not writing everything yourself (which I imagine is not the case), this type of implementation should be familiar. If however you're outside of the web/REST context, then yes, the code may look odd. So the audience should be developers working on a RESTful architecture with Java and Spring. Thanks for the interesting feedback. Eugen.</comment></comment>


Sphinxtr: Creating a Portable PhD Thesis - <AUTHOR> http://jterrace.github.com/sphinxtr/singlehtml/index.html <comment><USER2> Unfortunately this (good) product will take at least a generation to make it to the academic world.

I put my thesis together in HTML using Pandoc, customized to look a bit like a Tufte publication with margin notes. It had animations, anchor links when cross-referencing paragraphs, and in my eyes, made sense for a document like a thesis.

My committee members, on the other hand, were in consensus that a thesis should be a PDF with page numbers, not some multimedia document with _hyperlinks._ When I made a PDF[0] and submitted it to the university, someone even checked it to make sure the page numbering switched from Roman to Arabic at the correct point as stipulated by the submission guidelines (it didn't, hence my knowledge of their thoroughness).

Considering that universities today often don't even want a hard copy of a thesis, this is a world that is tied very strongly to the paper paradigm.

[0] Fortunately Pandoc did this quite nicely, though I did have to make a few changes to deal with citations. Incidentally, there is no good, cross-platform way to put an animation in a PDF.

<comment><USER3> There's a good reason to require proper page numbers: citations. In general you can't refer to a particular passage in a huge HTML document. Anchor links are a technical solution, but that's not how normal citations work.

I think that more generally when a document becomes sufficiently complex it is better to use a page-oriented, typesetting approach. You'll want to fiddle with where certain page breaks and figures end up, and if you do that you might as well stick with one canonical format.

You can view it as the paper paradigm. Alternatively, you can also see it as sticking to a uniform, canonical format. Getting fluid layouts right is a very difficult problem, and manually getting the layout right for a fixed format is simply a much better solution for this purpose.

<comment><AUTHOR> The HTML format does generate multiple pages for different sections and chapters, completely configurable. The format above is the singlehtml format where everything is on one page. I'd much rather have a link to a specific anchor tag on a page that goes directly to where I want than a citation to a page number on a 200 page document.

<comment><USER4> "As show on pages 105-107" looks much better than "As shown in sections 4.5.4, 5.1 and 5.1.2". Really. You don't have the first option with HTML and/or sphinx. Oh, and can I have some bold italic text please?

<comment><AUTHOR> You can _link_ to a section with a URL. No "section xyz" or "page n" needed.

<comment><USER4> Yes, you can place a link. But the link, unlike the page _range_ , points only to the place, not to the _scope_.

<comment><USER5> Why can't you link to divs on a page? When I'm given a page range, I don't typically first go to some arbitrary page in the middle of a range.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> As someone who did typeset his thesis not too long ago to forget all that lot of tiny tweaks I had to make to get a perfect print out from LaTeX, I would say that this project has a lot of issues. Some of them a more or less easy to fix, but some of them will be hard. Consider wrapping some specific paragraph in a \fussy / \sloppy pair, or hammering a specific float to this page, or ... (this list is really long). Not to mention bibliography tools. I don't claim that these issues are unsolvable, but the deeper you go into solving them the more you will discover that you are basically re-implementing LaTeX.

While the idea of multi-format thesis, or at least double format - PDF and HTML, is very compelling, I doubt there could be good enough solutions for that for any thesis which contains more then just text and some inconsiderate amount of figures/tables/formulae at all.

<comment><AUTHOR> Agreed, but for my case, I didn't really care too much about the PDF output. The printed version of my thesis is going to sit in my university library untouched forever. I'm much more concerned with having a semantically correct, searchable, beautiful HTML output.

<comment><USER4> Why not to go the other way round in this case? Typeset your thesis in semantically correct, searchable, beautiful HTML5, and then just add some specific CSS to get the hard print copy?

<comment><USER3> One big reason is math, which TeX is very good at.

<comment><USER4> I don't argue that TeX is good for typesetting thesis. I doubt that sphinx, even with some plug-ins is good for that. Also don't forget that reStructuredText has its own problems (not found in HTML and LaTeX). Can I have some bold italic or italic monospaced phrase example in reStructuredText please? No, really?

</comment></comment></comment></comment></comment><comment><USER6> This is what thesis writing procrastination looks like.

<comment><AUTHOR> To be fair, I only released it after my thesis was done :)

</comment></comment><comment><USER7> This is an impressive undertaking, but good lord, what an unfortunate name.

<comment><USER8> To be totally fair, a sphincter (I'm assuming this is what you're referring to) refers to a circular muscle structure in the general case. Not just the butthole.

There are sphincters in your eyes.

There is a sphincter in your esophagus.

Your body is full of sphincters.

The anal sphincter is just one of many sphincters.

And now you really _do_ know.

<comment><USER9> That's irrelevant, because the association is ever-present.

As an example, if people lived on Venus, they would be called "Venerials" by the proper genitive form. Alas, doctors got to it first (Venus, Roman goddess of love...) so it was changed to "Venutians". (Source: Neil DeGrasse Tyson's podcast, StarTalk radio).

<comment><USER10> _...would be called "Venerials" by the proper genitive form..._

I'm going to keep telling myself that your use of 'genitive' right next to 'Venerials' was entirely conscious and deliberate.

<comment><USER9> Heh, not at all.

</comment></comment></comment></comment></comment><comment><AUTHOR> Other output formats: <http://jterrace.github.com/sphinxtr/>

GitHub repository: <https://github.com/jterrace/sphinxtr>

</comment><comment><USER11> Sorry, but the project name is totally unfortunate.

<comment><AUTHOR> intentional :)

<comment><USER12> Love the name, laughed my ass off ;)

Disclaimer: I'm immature...

</comment></comment></comment><comment><USER13> How does this compare to existing text formats that generate multiple outputs, in particular pandoc (which supports an extended version of Markdown)?

</comment><comment><USER3> The section on typography is actually about formatting. Also, an epigraph is not the same as a quotation:

         [...]
         2. (Literature) A citation from some author, or a sentence
            framed for the purpose, placed at the beginning of a work
            or of its separate divisions; a motto. Epigraphic

<comment><AUTHOR> Pull requests accepted :)

</comment></comment><comment><USER14> This is awesome! I can totally see myself using this. We also need better make files for Latex. Changing one line, hitting make, and then watching crap fly across your screen is not a pleasant experience ...

<comment><AUTHOR> It's using <http://code.google.com/p/latex-makefile/> which is a really awesome makefile. It has nice colored output and throws away all the garbage output.

<comment><USER15> At least you can build your own scripts around this stuff. Building LaTeX for me goes like this:

I use vim, change a line, and hit ":w". My git-onNotify [0] script detects a change and issues "make show". The Makefile uses rubber or latexmk to build a pdf, then issues "gnome-open $PDF", which opens the new version in my pdf viewer. If my screen is tiled, the preview on the side just updates.

Essentially, I just save my tex file and wait for the change.

[0] <https://github.com/beza1e1/dot/blob/master/bin/git-onNotify>

</comment></comment></comment><comment><USER16> Looks nice. Currently, I am quite happy writing my thesis in LyX [0], which outputs to various formats, including HTML.

I also have a script which periodically converts the source files from LyX to both HTML and PDF, then dumps them in the webroot of the Apache server running on my Uni computer. This folder has a .htaccess file which restricts access to my supervisors and myself using the Uni's LDAP server.

It works a treat for me.

[0] - <http://www.lyx.org/>

</comment><comment><USER17> I have written my Bachelor thesis in org-mode and was incredibly happy with it. There is certainly a difference in requirements for a PhD Thesis, but I cannot think of any missing feature or hard to overcome problem right away.

<comment><USER18> What did you use to convert to pdf / html?

<comment><USER17> org-mode comes with HTML/pdf/DocBook export and you can extend the exporter with your own formats.

<comment><USER18> Did you find it easy to extend with your own formats? Or to modify an existing format, say html, to produce slightly different output?

I usually use perl/sed/awk + markdown for generating html from my own made-up mini-formats. I'd love to keep the sources in org-mode instead, but I wonder whether elisp is the right language for the type of text munging I want to do.

<comment><USER17> elisp isn't really good at text munging (that sounds counterintuitive at first, given it is the extension language of an editor) and works much better if your data is structured as s-expressions. AFAIK there used to be project to build a modern parser for org-mode files, but I couldn't tell you how much this has progressed or how usable it is. So, if your export process contains heavy text-munging I'd avoid it.

Modifying the HTML output (adding classes etc.) was fairly OK, I haven't tried anything crazy though.

</comment></comment></comment></comment></comment><comment><USER19> Looks cool. But I guess doing things like using IEEE classes is out of question? And does it really miss a way of typesetting inline math?

<comment><AUTHOR> It has inline math. I just forgot to add an example for it. If by IEEE style, you mean bibtex, then yes, you can easily swap the bibtex format.

<comment><USER19> I mean writing things meant for publishing in IEEE conferences, using the IEEEtran class.

Another concern is: is it practical to include figures drawn with Tikz? I find it the easiest way to lay out many things, but it effectively means LaTeX lock-in.

</comment></comment></comment><comment><USER20> Also relevant: <https://github.com/coolwanglu/pdf2htmlEX>

<comment><AUTHOR> This is a nice project, but different goals. I don't want my HTML output to look like a PDF. I want it to look like a nicely formatted web document

</comment></comment><comment><USER21> I don't get it, what's the problem on writing good handcrafted (no WYSIWYG editors) LaTeX?!

<comment><USER15> It seems out of place in a web-dominated world. Compare Brat Victor's "learnable programming" [0] or "Scientific Communication As Sequential Art" [1], which includes animated or interactive things.

[0] <http://worrydream.com/LearnableProgramming/> [1] [http://worrydream.com/ScientificCommunicationAsSequentialArt...](http://worrydream.com/ScientificCommunicationAsSequentialArt/)

</comment></comment><comment><USER22> here's an eclipse based editor specifically built for writing/managing your thesis. <http://www.chapterlab.com/>

</comment><comment><USER23> I read that as Sphincter...

</comment><comment><USER24> If the tex2html tool is poor, why not improve that tool? Re-inventing TeX seems like quite a waste of time.

Every time someone invents a new markup format for absolutely no reason, I die a little bit inside.

<comment><USER3> TeX and restructuredtext have very different goals. The first lets you specify every little typographical detail for a fixed page-oriented output. The latter focuses on a minimal set of semantic markup which can be used for different presentation media.

<comment><USER25> What you said is just the difference between TeX and LaTeX. If you want just semantic meaning, use LaTeX without lower level TeX commands, then use an automated tool to convert it to html or other formats.

<comment><USER3> No it's not. LaTeX is still page-oriented. You can convert it to HTML and other formats but not as well as multi-format markup specifically designed for that purpose.

<comment><USER24> The whole point of LaTeX and TeX is not to worry about the exact format, but to worry about the semantics of the content instead, and let the layout engine decide for you. Like all automation, this generally works very well, except when it doesn't. When it doesn't, the solution is to give it a little manual shove in the right direction, not to rewrite everything in the markup language flavor of the week.

Incidentially, semantics, not presention, was originally the point behind HTML, but it got warped and twisted over time into a kinda-sort presentation- oriented language.

restructuredtext, on the other hand, was originally developed to create documentation for Python programs. It might be good for that purpose (wouldn't know; haven't used it.) But it's certainly not good for typesetting mathematics, research papers, academic quotations and so forth. Hence the large amount of wheel reinvention going on here. It's a little bit like writing your research paper using JavaDoc comments. Sphincter indeed.

<comment><AUTHOR> You've never used ReST but you somehow know it's not good for typesetting research papers?

<comment><USER24> I used it a little bit back when I still wrote Python. It seemed a lot like HTML, but much terser, and whitespace-sensitive. ReST could do the same kind of stuff as HTML: build bullet lists, create tables, italic text, and so forth. However, since I had already learned HTML, learning another language that did the same thing felt like a waste of time. I fully believe that Restructured Text is a better markup language than HTML in some ways; however, I simply don't care because the differences are minor, and HTML is so much more powerful.

On the other hand, TeX was developed by Donald Knuth, a guy who spent his entire life doing research and writing papers about it. It has excellent math support, and is a true semantic language. I've written a few papers in TeX and been very happy with it.

Anyway, if RestructuredText were good at typesetting research papers, there would be no need for this project, would there?

<comment><AUTHOR> You're confusing the language with the build system. LaTeX wouldn't be very useful without the awesome build system. This project is a build system for producing both high-quality HTML and high-quality PDF (through latex) with a single, high-level ReST markup language. It also _uses_ latex formulas for math.</comment></comment></comment></comment></comment></comment></comment></comment>


Curl Goez Parallel - <AUTHOR> https://daniel.haxx.se/blog/2019/07/22/curl-goez-parallel/ <comment><USER2> Can it transfer the same file in parallel? I had to use aria2c for that. It's a pain to waste rx/tx rings and CPUs when transfering large files. I believe you can use mulitple sockets(optional) with HTTP range options to do this.

<comment> T3OU-736 Explicitly 'no' from the announcement

</comment></comment><comment><USER3> What was the normal work around? Looping over the urls and `curl &`?

<comment><USER4> Your xargs may have a -P option.</comment></comment>


Blockchain enabled Trust and Transparency in supply chains - <AUTHOR> https://medium.com/@jrgensvenneviknotland/link-to-original-paper-https-www-pdf-archive-com-2017-02-01-project-thesis-anders-j-rgen-project-3921bf4cbdd7#.pwaecog5r <comment><USER2> Sweet article, what are you focusing on in the master thesis?

<comment><AUTHOR> The data recording process: How the process of recording information to a blockchain system can be trusted. A corrupt person or a compromised/hacked hardware might enter erroneous data or refuse to enter any data at all.</comment></comment>


The Unmarked Federal Agents Occupying Washington, D.C - <AUTHOR> https://www.politico.com/news/magazine/2020/06/05/protests-washington-dc-federal-agents-law-enforcement-302551 <comment><USER2> If there is one group of people who are constitutionally (heh) ill-equipped to monitor free citizens who are exercising their constitutional rights to petition their government for redress of grievances, it's people whose entire job history has been the exercise of power over incarcerated federal offenders, who do _not_ have the right to peaceably assemble.

Doubly so when they're prison riot control officers who all look like they're clones of Byron Hadley, The Screw Everyone Hates from "Shawshank Redemption".

When a prison guard sees a crowd chanting protests, they are going to react _very badly_.

Get them out.

And get badges on the rest of them. Then get _them_ out, too.

<comment><USER3> The lack of badging is unconsciounable, that shit needs to be fixed.

But I would argue that Bureau of Prisons riot units may well be better equipped to handle civil unrest of this sort than most conventional police depts on the following grounds:

The US doesn't have much institutional experience dealing with rioters or massive protests of this nature. What little there is, is in the hands of local agencies, and hasn't necessarily spread to other departments. The closest thing to a law enforcement agency with significant crowd control experience is the Bureau of Prisons.

Your average beat cop is trained for day-to-day enforcement actions, and is accustomed to a certain level of respect or deference not typically granted to prison guards. They're also accustomed to significantly outnumbering the belligerent actors they encounter. The stress of operating in situations where you're significantly outnumbered by contemptuous and openly hostile people is more than likely alien to them.

Conventional police forces - to my knowledge - do not train riot control techniques with any regularity. Comparing livestreams of the Floyd protests with Greek and German crowd control operations, the American police tend to be less coordinated in their advances (more gaps in their lines, they tend to be spread out from one another, they respond less quickly in a coordinated manner), and are quicker to react to potentially hostile actions with violence. Though I'll admit that this could be a difference of crowd control philosophy, or an adaptation to America's wider streets but it does strike me as being more likely to result in unnecessary injury to protestors, and vulnerable to charges by rioters. I believe that the near ubiquitous misuse of rubber bullets by LEOs during the protests are evidence of this.

The Bureau of prisons riot control units may not be accustomed to the scale of the current protests and unrest, but I expect them to be better equipped to coordinate police actions, and operate on the front lines than somebody that writes tickets, and occasionally has to deal with Karen, or an angry junky.

<comment><USER4> _" The US doesn't have much institutional experience dealing with rioters or massive protests of this nature."_

Surely you're joking! Grab a history book. Now where would you like to start? I'd suggest you begin 1861 (or a little before) when US Americans went on a four-year mad spree to kill each other which they did in such huge numbers that the death toll tallied more than that of all other wars the US has fought in (WWI, WWII, Korea, Vietnam, Iraq, etc.).

(From my observation of the present troubles, it seems to me that many of the issues that caused the 1861-65 _War Between the States_ still aren't resolved 155 years later.)

<comment><USER3> A riot is not a civil war. And I doubt that any law enforcement agencies would be able to tap a civil war veteran's experience, even if it were.

Crowd control - especially when that crowd is being adversarial - is its own art, separate from the typical functions of law-enforcement, and one rarely called upon. My point was that few LEOs have experienced real riots/unrest or regularly trained for that function, because it is such a rare occurence. Most of those who have are likely retired, and their successors largely operating on second-hand knowledge.

</comment></comment></comment></comment><comment><USER5> Police who refuse to identify themselves and carry no markings used against an administration's political opponents sure sounds like something everyone should be opposed to, no matter their political camp.

If someone thinks that's a healthy part of a democracy, I'd be real curious about your reasoning.

<comment><USER6> I'd rather they be counterbalanced with a well-armed citizenry, such as the "cosplaying" the article insultingly describes.

<comment><USER7> That makes things a lot more volatile: you have one side with a LOT more guns, armored vehicles, and aircraft — all you need is one mistake for them to start thinking force protection and a whole bunch of people are in the crossfire. When the dust settles, a lot of people will believe this says the protests were an Antifa army even if the first shot came from the other side.

<comment><USER8> There have already been instances of well armed African-American people openly carrying large guns forming parts of these protests. The effect? The police have known better than to respond with violence.

<comment><USER9> And yet in Vallejo this week a Latino man was shot for suspicion of having a gun in his pocket (not a crime) which turned out to be a hammer (also not a crime).

<comment><USER8> Not the same thing in the least. I'm talking about people openly carrying guns as 'scary-looking' as assault rifles. I found the story you referred to. The difference is, the victim (at best, from the perspective of the police' defense attourney) looked to be hiding a concealable gun (not saying he was, or that the incident wasn't an atrocity): the man looked relatively defenseless. The people I'm talking about have the appearance of being able to win that same shootout, and the police can see it.

</comment></comment></comment></comment></comment></comment><comment><USER10> So I guess my proposal is that any officer who carries a gun should be required to wear a "badge number" of some form, readable from 15-feet, on their back. The badge-number should be a ID that can be matched against a public website to identify the individual, name, bureau, and a picture of course. After all... If they aren't doing anything wrong they have nothing to hide...

I'd also add that failure to do so should result in a $1,000 penalty, half of which should go as a $500 reward to anybody who reports the case (photo would suffice as proof). Officers should have their whereabouts tracked via there phones for accountability purposes, which could be used to verify such reports or identify officers.

<comment><USER11> And body camera footage should be always streaming to a well known bucket, encrypted of course, but with publicly verifiable keys. Anyone should be able to "backup" body camera footage for any cop for any time range. Getting access to the decryption keys should be a matter of filling out the proper forms.

<comment><USER11> Body cameras should never be able to be turned off. The most that should be done is an officer should be able to hit a button to drop a marker into the timeline.

</comment></comment></comment><comment><USER12> I don't care who brought them there, prison guards have no business working in public, they are not trained to do so, have no idea what legal protections ordinary citizens have, and refuse to identify themselves in violation of laws all other agents of the Federal government have to follow (though some might flaunt that too).

I wonder if they are exempt from punishment or oversight if they screw up (which I presume will happen).

<comment><USER13> There's no need to wonder: yes they are exempt from punishment and oversight.

It doesn't matter what laws they break because it's pretty clear that the executive branch has no intent of abiding by any laws; they won't do so unless forced and clearly no one has the power to force them to do so.

I have no idea how this will end, but I'm fairly sure it won't involve justice for the people.

</comment></comment><comment><USER14> This article uniquely gives a deep historical perspective on the story.

> What is surprising is that those two agencies now facing down Black Lives > Matter and crowds protesting systemic racism historically have been enlisted > by the federal government to protect blacks against white protestors. > Attorney General Robert F. Kennedy, for instance, deputized officers from > the Border Patrol and the Bureau of Prisons to work as U.S. marshals and > secure the University of Mississippi in 1962 to protect James Meredith as he > enrolled at the school after desegregation. Similarly, the Border Patrol > once watched over the Freedom Riders in Alabama and Mississippi in the > 1960s.

</comment><comment><USER15> So, how are you to distiguish between one of these "Police Forces" and some rogue vigilante militias? Is there some secret hand-signals they use to cross- identify?

<comment><USER16> Federal law enforcement are obligated to present printed ID cards identifying the officer and their agency. Anyone unwilling or unable to do so is an armed civilian in violation of DCs open carry laws, and the DC Metro Police should be notified.

<comment><USER17> The law obligates them to present ID, but they have refused and faced no consequences from either DC Metro Police or their own superiors.

Laws are worth zero if the law enforcers ignore them with impunity - a lesson familiar from Caribbean and African banana republics.

<comment><USER18> President Andrew Jackson famously shrugged off the US Supreme Court decision in Worcester v. Georgia by (probably not) saying "John Marshall has made his decision; now let him enforce it!". Like you said, "Laws are worth zero if the law enforcers ignore them with impunity". This is why we need a system to police the police. At some point, we as a society need to commit to forcing those who swear to uphold the laws to also live by them.

</comment></comment></comment></comment><comment><USER19> >> There are more gun-carrying agents employed across the federal government by inspectors general .. than there are ATF agents nationwide; the roughly 4,000 inspector general agents nationwide, in fact, is roughly equivalent to the entire size of the DEA. The Department of Veterans Affairs' police department, who guard the nation's veteran hospitals, facilities and cemeteries, is larger than the entire U.S. Marshals Service.

Why don't security guards guard hospitals and normal investigators work in watchdogs? Why are they all police-style groups? Is there some historical reason?

<comment><USER20> Note: I performed security audits of VHA facilities for a couple of years.

Unlike non-federal hospital, this is due to jurisdiction. VHA Hospitals are federal land so local police departments wouldnt have any jurisdiction, and the federal government typically looks at its responsibility to enforce laws within the land it owns. Also, some VHA facilities are on large campuses in more rural/less urban areas which effects the size of the police forces there.

</comment></comment><comment><USER21> This is an outgrowth of the excess proliferation of federal laws. Taking a page from the UK and appointing a Law Reform Commission to simplify, consolidate, and reduce the body of federal laws would reduce the need for so many policing forces.

<comment><USER22> If the court system was doing their job, they would strike down many unconstitutional laws and decrees that enabled the growth of big government.

<comment><USER11> Unconstitutional laws are only struck down when someone with standing challenges it, if it is never challenged, it gets to remain even if obviously unconstitutional.

</comment></comment></comment><comment><USER23> The article is a mixture of useful and distracting information. The ever- increasing number of federal crimes really is an issue (the example of it being a federal crime to sell jam made from more than five types of fruit is remarkable). The growth in federal law-enforcement agencies is also something which deserves some attention, as is using prison guards to police the streets.

OTOH, I think that comments such as 'What is surprising is that those two agencies now facing down Black Lives Matter and crowds protesting systemic racism historically have been enlisted by the federal government to protect blacks against white protesters,' 'D.C. Mayor Muriel Bowser … finds herself in the odd position of not controlling the police forces patrolling her own city' and 'ou read that right: The former head of the Fraternal Order of Police was considered too liberal for the GOP' stoke fire rather than illuminate. The first sentence is unsurprising: the police are not on the streets of DC because of _protesters_ but because of _rioters_ ; they are there to keep the peace. The second comment, too, is unsurprising: the federal district … belongs to the federal government. It is no more surprising that the mayor of DC is subordinate to the federal government than it is that the mayor of Chicago is subordinate to the state of Illinois. Nor is the third comment particularly helpful: I imagine that the concern with the nominee could very well be that a former police chief is too _authoritarian_ to helm an agency which has been accused of some pretty serious mis-steps since the Bush years.

I'm not taking any position here on the goodness of any of this, just noting that the author is not making the most of his opportunity to discuss substantive issues and make reasoned arguments.

<comment><USER24> > the example of it being a federal crime to sell jam made from more than five > types of fruit is remarkable

Wow! I really applied myself to looking for a motivation for regulation but failed. Any hints?

<comment><USER25> ~~I'm not a lawyer and the citation provided in the article is too much text for me to try to parse, but I have to assume this is a case of unintended consequences. I expect that each individual section of the law makes sense, and it's only when you read them with an eye to finding gotchas that you realize they work together to prohibit this. In other words, congress needs better QA.~~

Edit: I take it all back. It turns out that you only have to read 21 CFR §150.160(b)(2) to see it, and it turns out that that law is just unreasonably prescriptivist.

>(2) The following combinations of fruit ingredients may be used:

>(i) Any combination of two, three, four, or five of such fruits in which the weight of each is not less than one-fifth of the weight of the combination; except that the weight of pineapple may be not less than one-tenth of the weight of the combination.

It's against the law to make a jam with more than 5 fruits because the law only explicitly allows jams with up to 5 fruits. Bizarre.

<comment><USER26> My best guess: this prevents situations like selling jars of "strawberry jam" which is only 10% strawberry.

Which is partly backed up by 21 CFR § 150.160 (e)(1):

(e)

>(1) The name of each preserve or jam for which a definition and standard of identity is prescribed by this section is as follows:...

<comment><USER25> Well, no, the section you quoted is what prevents you from selling "Strawberry jam" that has fruits other than strawberry. The section about number of fruits seems to just be about arbitrarily restricting the amount of any fruit present to at least one fifth of the total (except pineapple for some reason). I don't see why that's necessary, but you could at least write the law as

>(2) The following combinations of fruit ingredients may be used:

>(i) Any combination of such fruits in which the weight of each is not less than one-fifth of the weight of the combination, or in which the weight of each part is no less than half the weight of any other part; except that the weight of pineapple may be not less than one-tenth of the weight of the combination.

I'm not quite sure what the right legal wording is for or such that you can comply with whichever half works for you is, but that would both allow for everything the existing law allows and allow for arbitrary numbers of fruit without requiring that they be mixed in exactly equal ratios.

</comment></comment></comment></comment></comment><comment><USER27> I'm guessing the actual reason why the guys in question are dressed in mixed uniforms is that someone in the department of justice hit the "send everyone" button, which included investigators typically not kitted out for field duty.

</comment><comment><USER28> What's the chance the DC police chief would ask for volunteers to go surround these "officers" and demand identification ?

<comment><USER29> It is unlikely that the DC police Chief is a moron, so probably zero.

</comment></comment><comment><USER30> Looks like Government bloat and unconstrained regulation growth applies to law enforcement as well.

<comment><USER13> It applies almost entirely to law enforcement and military, where budget cuts are rare and accountability is negligible. There's an entire cottage industry devoted to exposing wasteful government spending and they'll expose $600k going to some research scientist at a university, but ignore police departments wasting 100x that amount on equipment that can never really be used.

</comment></comment><comment><USER31> What I am confused about is why does no one who is in the area follow (at a safe distance) some of these unidentified agents to see where they go after they are done with their patrol?

</comment><comment><USER32> Interesting story, but I don't know why the writer had to put so much emphasis on the race of the officers, activists, etc.

<comment><USER5> Maybe you aren't from the US -- there's a long history of systemic racism here, The protests that are happening across our nation are in response to those systemic issues, particularly how policing and race interact. Race, therefore, is a core part of the conversation going on in our country right now.

</comment></comment><comment><USER6> Searching the FBO.gov you can find interesting solicitations, like the Department of Education needing 125 shotguns.

</comment><comment><USER33> fascism is getting closer everyday

</comment><comment><USER34> Is this relevant to hacker news?

<comment><AUTHOR> From the Hacker News Guidelines[1]:

>What to Submit

>On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one's intellectual curiosity.

I found the story intellectually stimulating, and thought others might too.

[1]: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER35> And yet posts on Kobe Bryant's death were all flagged.

<comment><USER13> Perhaps individuals should have contributed posts that discuss interesting and lesser known aspects of the man's life and accomplishments.

60 posts of "Extremely Famous Person Dies in Accident" is boring. But learning that said person had a little-know passion for bird conservation or something is interesting.

</comment></comment></comment></comment><comment><USER4> In armed conflict/warfare, if one deliberately hides or removes one's uniform, or pretends to be a combatant of an force other than one's original allegiance—and if caught by one's enemy—then one is deemed to be a spy and the usual penalty is death.

If one substitutes one's original uniform for the enemy's (or another) to pretend to be other than what one is then the Geneva protocols don't apply—in essence, you're shot rather than be taken prisoner or war.

What these guys are doing is similar. When a State resorts to such action/deception then it's hard to see how the rule of law can apply. Essentially, anarchy has broken out.

From an outsider's perspective, it seems to me that the US is now so polarized that it's almost become ungovernable.

Heaven help the the rest of the free world let alone the poor unfortunate law- abiding US citizens who cannot help but be caught up in this damned mess.

<comment><USER29> All of your premises are incorrect.

The law of war doesn't work the way you claim. At all. The Geneva convention specifically addresses non uniformed combatants and people wearing the wrong uniform, and does not permit them to be shot rather than taken prisoner.</comment></comment>


The Best Time to Post on Hacker News - <AUTHOR> http://nathanael.hevenet.com/the-best-time-to-post-on-hacker-news-a-comprehensive-answer/ <comment><USER2> I have quite high karma on HN and I got it two ways:

1\. By writing original content that the HN audience is likely to like

2\. By submitting that content at the right time

#2 is useful to know and anyone can do an analysis and figure the best time. I did it myself some time ago and came to my own conclusion about the best time (which is similar to the OP). But #1 is far more important than gaming the system. Focus on writing good stuff.

<comment><USER3> I'd imagine a corollary to #2 is by replying to comments at or near the top.

<comment><USER4> I see what you did there...

Just kidding. But to contribute something to the discussion: I was just recently wondering when the best time to publish a "Show HN" would be. In that case, your content is what it is. The time factor would definitely be important then to help you get the "early exposure" that you'd need to even arrive on the front page in the first place.

</comment></comment></comment><comment><USER5> The real answer, as anyone who reads HN knows, is "a few hours after an already high ranking post, on the same controversial subject, but taking the opposite stand" :)

<comment><USER6> You forgot a crucial part: reversing the original title.

"No, NYC is NOT playing second fiddle to silicon valley"

<comment><USER7> Or if you're a REAL expert, "Is NYC playing second fiddle to silicon valley?"

<comment><USER8> And then, for bonus karma, leave a comment to the effect of "The answer to any headline ending in a question mark is no. <http://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines> ", as if you're the first and only person to have ever heard of it.

<comment><USER9> Remember to include a snide remark with a vague reference to some sort of a logical fallacy, in order to demonstrate your superior mastery of logic. Bonus points for using pompous latin expressions.

<comment><USER10> ipse dixit?

</comment></comment></comment></comment></comment></comment><comment><USER11> There is already an interesting tool[1] out there for this. I am surprised it wasn't mentioned anywhere in the post. I would also be curious to know how similar or different they are.

[1] <http://hnpickup.appspot.com/>

<comment><AUTHOR> Hey, author here. I'm going to transgress my no-HN rule this one time because I did in fact look at HN Pickup very closely and I already have a follow-up post planned in which I was going to mention it.

Now the difference between my post and HN Pickup is it's a prediction tool, so it's trying to pin-point precise moments when it's best to post, whereas I'm analyzing past data.

So in my post today I talked about the best time to post on average. But, I can also look at my data and say, for example, last Monday from 10 to 11 AM, 30% of submissions reached the frontpage and so it was, in effect, a great time to post.

And with that I could look at HN Pickup's past predictions and tell you how accurate they were, ie. at a time when HN Pickup was telling you it's a "very good time to submit a story", what percentage of stories actually made it?

It so happens that I've actually been able to do that. HN Pickup's creator was kind enough to provide me with a history of predictions for every 15 minutes of a whole week, and after comparing it to observed pickup percentages I found a rather weak correlation (0.25). So it would seem HN Pickup isn't a very effective tool.

Also its goal is only to look at frontpage pickups, it doesn't account for the duration of the stay on the frontpage or HN's traffic at the time, which I do in my analysis.

<comment><USER12>
       for example, last Monday from 10 to 11 AM, 30% of submissions reached
      the frontpage and so it was, in effect, a great time to post.

But it might also mean that less people see your post, which is still better than not making the frontpage at all, but not the same as getting there on "prime time", this should also be taken into account.

<comment><AUTHOR> It is taken into account in my article...

</comment></comment></comment></comment><comment><USER13> The best time to post on HN is when you have something interesting to share that will benefit the community.

Same holds for your email marketing, social media, etc. Good content is an order of magnitude more important than time-of-day optimizations (which in my experience, only helps some people some of the time).

<comment><USER14> In my experience, that's not always the case: sometimes interesting posts get drowned out.

<comment><USER15> I've seen this happen a couple of times. An article is submitted once only to drown with around five upvotes, and then reach the frontpage on a second submission.

</comment></comment></comment><comment><USER16> It depends on the source. Articles move up two ways. One is by votes, the other is by resubmission by different users. Peak times also mean peak competition.

If you are the first to post an article from a commonly frequented site such as TechCrunch, then it will tend to gain exposure because others are submitting it.

On the other hand, I've found that posting articles from less mainstream sources benefit from sitting longer on the "New" page. This means posting during times of lower activity. I have woken up to find something I posted just before bed has gained significant traction.

<comment><AUTHOR> Interesting. I wasn't aware of this resubmission mechanism.

<comment><USER16> It's probably the way that some blog posts make it.

</comment></comment></comment><comment><USER17> Some other suggestions to get you on the frontpage:

1\. Posting anything by Marco/Gruber/Atwood/37Signals/Stripe.

2\. Posting anything making fun of PHP.

<comment><USER18> Don't forget Github. Most of their blog posts that aren't regarding new hires hit the front page.

</comment></comment><comment><USER19> I would like to see a scoring algorithm that dampens (if not totally eliminates) time-of-day effects. Essentially, clock time shouldn't be a factor at all: just some other synthetic 'tick'. That tick is probably 'sitewide votes' (but might be 'legitimate votes' or 'net upvotes' or 'homepage views').

Secondarily, I would like to see a decay function that gives an older story with a current surge as much credit as a new story with similar recent surging.

(For example, imagine story A submitted at hour 0 which receive no votes for 6 hours. At hour 6, story B is submitted. Between hour 6 and hour 7, story A gets 12 upvotes, and story B only 8. Over the current-comparable period, A is hotter... but I'm pretty sure the HN algorithm and most similar sites penalize A for the earlier-submission time. And yet due to things like headline corrections, the eventual arrival of a story's natural audience, etc. the A story may in fact now be 'better', in those attention-deserving qualities that the ranking/decay function is trying to detect.)

<comment><AUTHOR> As long as the quantity of good submissions varies consistently depending on time of day, there will be times when more good submissions are competing for a fixed amount of frontpage time. Thus it's unlikely you could eliminate time- of-day effects.

I like your second suggestion though.

</comment></comment><comment><USER20> Posted at 9:04am Eastern it would appear.

<comment><USER21> I just posted something about the impact we humans are having on planet earth. It was a documentary I listened to on the BBC world service in the wee small hours 3 days ago during my customary insomnia and about which I've not been able to stop thinking. I'd love it to spark a discussion but it looks like it's dropping into oblivion

<comment><USER22> This is probably not the best way to try to hijack this thread. If it was interesting and/or warranted discussion I'm sure folks would have started discussing it.

<comment><USER21> I'll concede your first point but I don't think your second always holds true.

</comment></comment></comment></comment><comment><USER23> I've seen posts of the same link with the same title only a few hours apart get dramatically different traction (5 vs 285 up votes). There are tricks to try and game the system but it also involves more luck than most people seem to think. That said, posts that are truly insightful and anything from PG will make it to the top, it seems, every time.

</comment><comment><USER24> This is the third or fourth article I've read on HN about the best time to submit content on HN.

Fair warning: the next time I read this topic here, I am going to write a comment about the best time to submit comments on articles about the best time to submit articles.

</comment><comment><USER25> This is basically true of all US oriented news sites. Also, generally monday and tuesday morning are ahead of the rest of the week. The best time to try to get something to 'go viral' is about 10 - 11am EST tuesday morning.

</comment><comment><USER26> I'd be interested to see the analysis with the day of week included.

<comment><USER27> If the 7am-noon trend is caused by the social factor of EST to PST working coming in to work, it'll likely be mon-fri, with spikes on mon and thu.

That is the usual pattern for sites that people check when they come in to work.

</comment></comment><comment><USER28> I did a similar post about a year ago, though the focus was on other things than best time to post: [http://foundation.logilogi.org/2011/5/9/the-best- time-to-pos...](http://foundation.logilogi.org/2011/5/9/the-best-time-to-post- on-hn-and-other-time-effects)

</comment><comment><USER29> It would be interesting to include day of week as well. I have read that Sunday is a good time for example, but taking into account viewer traffic, time on front page etc, (as the OP does of course) that might well be different.

</comment><comment><USER30> What's the deal with EST or PDT? Can't you Americans just use some GMT-n so we can all convert it? Despite most stories being American-based or focussed here, the world does not center around you. Yeah it does on your maps - it's confusing, I know - but no the world is not actually about you.

<comment><AUTHOR> Hi. I'm the author and I live in France. I used EST for 2 reasons.

1/ Most HN readers can relate to that easily.

2/ GMT doesn't account for daylight savings time.</comment></comment>


Autonomous human transport project [video] - <AUTHOR> https://www.youtube.com/watch?v=SOkYHLDI23o

<comment><USER2> Url changed from [http://qz.com/438723/watch-this-crazy-video-of-an- engineer-r...](http://qz.com/438723/watch-this-crazy-video-of-an-engineer- riding-a-human-sized-drone/), which points to this.</comment>


Writing Exploit-Resistant Code with OpenBSD - <AUTHOR> https://lteo.net/blog/2019/04/27/carolinacon-15-writing-exploit-resistant-code-with-openbsd/ <comment><USER2> Useful additional context/counterpoint:

[https://twitter.com/halvarflake/status/1125169161125158913](https://twitter.com/halvarflake/status/1125169161125158913)

<comment><USER3> I haven't been following any back-and-forth, but I'm a fan of exploit mitigation so I'll chime in and say to anyone browsing here that [https://www.openbsd.org/papers/ru13-deraadt/mgp00001.html](https://www.openbsd.org/papers/ru13-deraadt/mgp00001.html) is an excellent explanation of them.

(I was shocked when I just googled "exploit mitigation" and all I got back was infomercial articles by Symantec and Sophos etc. Scary. So for people browsing here and googling terms, dig deeper!)

I think we need exploit mitigation _and_ process isolation _and_ the principle of least privilege.

Fwiw, the twitter article mentions capabilities. Something I can pontificate about! I've been lucky enough to chew a _lot_ of cud with some GNOSIS/KeyKOS/caps luminaries etc. And we were still mega-fans of the Capability Object Model but _not_ believers in Capability-Based Addressing. When I did some design work with Norm Hardy on the Mill CPU I designed a temporal variant of the former that protected ... memory. OpenBSD is actually damn serious about the former. The twitter link is advocating the latter as a fix for something?

I would love to chat with anyone who wants to convince me that Capability- Based Addressing _works_ or is workable. I know that others from KeyKOS etc moved more towards the caps addressing. Anyone want to read up on some of this stuff, I warmly recommend the papers and talks for CHERI, even though I'm not a fan of caps addressing.

<comment><USER4> > I haven't been following any back-and-forth, but I'm a fan of exploit > mitigation so I'll chime in and say to anyone browsing here that > [https://www.openbsd.org/papers/ru13-deraadt/mgp00001.html](https://www.openbsd.org/papers/ru13-deraadt/mgp00001.html) > is an excellent explanation of them.

Is it possible to get this resource on a single page? Having to click through each page just to read a sentence or two is quite cumbersome.

<comment><USER5> There's a thumbnail index for MagicPoint slides: [https://www.openbsd.org/papers/ru13-deraadt/index.html](https://www.openbsd.org/papers/ru13-deraadt/index.html)

I also highly recommend checking OpenBSD's events page for additional slides/papers and videos.

[https://www.openbsd.org/events.html](https://www.openbsd.org/events.html)

</comment></comment></comment></comment><comment><USER6> If you aren't able to watch the video, be sure to check out the slides from his talk!

[https://lteo.net/assets/pdf/lteo-openbsd- carolinacon15-20190...](https://lteo.net/assets/pdf/lteo-openbsd- carolinacon15-20190427.pdf)

</comment><comment><USER7> The mitigations probably do increase exploit difficulty. I still think most of the security is much like we saw with Mac's years ago: virtually nobody targets them. The mitigations in CompSci, such as CFI, often get broken when another team spends some time on them. Those talented folks probably only attack a tiny sample of designs, though. Much like black hats who go wherever the users, data, and money are. The more return for attack, the more they focus on that platform. That's mostly Windows, Linux, iOS, and Android.

Right now, I assume any "success" of OpenBSD's mitigations are a mix of (small one) actual increases in difficulty and (big one) benefit of being obscure system best breakers aren't interested in. Long as they're uninterested, it should stay safe from most attackers regardless of which mitigations they use. Much like Mac was with hardly any security.

We won't know if the mitigations actually work until the kind of people who break mitigations, white or black hat, start focusing hard on beating them one by one or bypassing them all together (eg hardware exploits). Any talk of how strong they are is just speculation. The proof, if it turns up, would be prolonged attempts by highly-talented people to break them with consistent failure and/or less access/damage resulting.

<comment><USER3> The biggest success of OpenBSD's mitigations is that all the other operating systems adopt them.

All the attacks that these techniques mitigate on other operating systems are proof of the usefulness of these mitigations on OpenBSD.

<comment><USER7> "The biggest success of OpenBSD's mitigations is that all the other operating systems adopt them."

That just means they're popular, not successful against attackers.

"All the attacks that these techniques mitigate on other operating systems are proof "

This would be evidence if it's true. So, what attacks do they mitigate? Were those attacks designed to bypass the mitigation of not designed to bypass the mitigation? I find most assessments of mitigations focus on success against attacks not designed with mitigations in mind. Once it's important to attackers, they start focusing on the mitigations. Further, how do we assess whether hackers are having a hard time with the mitigations given they don't disclose most of their successes?

One guess I have is to look at exploit prices from firms such as Zerodium. I figure the prices will be much higher for targets that are harder to reliably exploit. If they're low, that might indicate they already have plenty of exploits for it. If it stays low or high, then that might show how consistently it was easy or hard to exploit. One variable to eliminate, though, was a vendor raising prices on one or more items just to further incentivize 0-day hunters. That happened at least once with Zerodium.

Let's look at the prices for desktops and servers:

[https://zerodium.com/program.html](https://zerodium.com/program.html)

The highest payout is a Windows 0-day for remote code execution. There's no mention of Mac or Linux payouts for the same thing. Instead, they offer $50,000 for privilege escalation on both. They also have $100-500k payouts for RCE's on services that often run on Linux hosts. These do get lots of eyeballs from bug hunters, some getting hit for long time, which might drive prices up a bit. The combo suggests the attackers mostly hit a service/app on Mac and Linux followed by privilege escalation. In any case, the Linux boxes cost them anywhere from $150k-550k for exploits with Windows about a million.

If it counts as field evidence, that would argue strongly against what many might suspect is safest route to security. Whatever Linux is doing isn't working. Whatever Windows is doing is working really well. On mobile, iOS is the champ of comparable value. Note that they're not soliciting 0-days for OpenBSD on that page. That may or may not mean their clients don't care about it. If it did mean that, it would support my point about the OS being secure due to obscurity first, mitigations second.

So, I check another article to find they're offering $500k for UNIX exploits, esp BSD's:

[https://securityaffairs.co/wordpress/74050/hacking/zerodium-...](https://securityaffairs.co/wordpress/74050/hacking/zerodium- linux-zero-day-exploits.html)

They explain that how many systems are impacted with what level of interactivity largely determines the price. Implicitly corroborates what I said about attacker focus, too, if these incentives matter to them. For BSD's, I can't tell if the price is just to get a first-mover advantage against BSD's in their market or because they're harder to hack. Might have to wait a while. They did put a number on what Linux vulnerabilities were worth at the time: "as high as $45,000."

Maybe we ask Zerodium if they have an OpenBSD exploit with what level of interactivity. Although I doubt they'll say, maybe someone could sell them on the marketing benefit of it if they do have something. The OpenBSD devs might feel proud if they're consistently not on the list with the bounty going up every year or something.

<comment><USER8> You didn't account for competition here. Because Windows is more popular they have to offer more to keep things out of the hands of hackers. Of course some researchers are honest (one would hope most) and will never sell on the black market, but there are always a few.

</comment></comment></comment></comment><comment><USER9> > Always use fork+exec to spawn the child processes

Why not posix_spawn?

<comment><USER10> posix_spawn is fine for that point in particular: it's encouraging the use of exec to regenerate state in servers that fork child processes as workers, so that accidentally leaking information from the child doesn't also leak it for the original parent process as well.

posix_spawn-style interfaces aren't particularly friendly to spawning processes with reduced privileges though, because you don't want to drop privileges in the parent.

</comment></comment><comment><USER11> I was at the talk and really enjoyed it. I was honestly surprised at the amount of security features implemented in OpenBSD. I really like the idea of Pledge's.

<comment><USER12> Did anyone take a better video? Because that was painful to try to watch.

<comment><USER11> I think I heard someone say that there was audio recorded? I'm not sure though.

</comment></comment></comment><comment><USER3> Tangential, but its so sad the room is almost empty. Just a sea of empty chairs.

I was toying with making a long trip to a 'con of some kind this year. The last one I went to was a pycon in, I think it was, 2016. But are they dying?

<comment><USER11> Hi, there were a mixture of reasons for the lower than normal turnout this year, mainly stemming from the Con moving from Raleigh to Charlotte.

<comment><USER12> Some of us didnt even hear about it existing until the latest issue of 2600 dropped. The website normally updates around the new year, letting us plan to go - February rolled past without such.</comment></comment></comment>


Judge refuses to lift gag order on MIT students in Boston subway-hack case - <AUTHOR> http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9112641&intsrc=hm_list <comment><USER2> This doesn't make any sense... the information is already out there, and by holding up this ridiculous gag order, they're simply bringing MORE attention to the issues!</comment>


Steve Jobs Was Always Kind To Me (2011) - <AUTHOR> http://thewirecutter.com/2011/10/steve-jobs-was-always-kind-to-me-or-regrets-of-an-asshole/

<comment><USER2> Turns out the guy who found the Iphone 4 and sold it to Gizmodo regrets it as well. At least Gizmodo earned a pretty penny, though.

"Gizmodo told me they would give me $5,000 for the story, and another $3,000 after it was confirmed by Apple to be real. They knew that there was no way in hell I was going to be able to ask for the $3,000 after the story aired, but I didn't. I ended up having to hire and expensive lawyer and had to pay him much much more than $5,000."

[http://www.reddit.com/r/IAmA/comments/1h2m81/i_leaked_the_ip...](http://www.reddit.com/r/IAmA/comments/1h2m81/i_leaked_the_iphone_4_ama/)</comment>


Stop ads without adblock - <AUTHOR> https://github.com/Jermorin/adstop <comment><USER2> Doesnt that slow down my network extremely?

<comment><USER3> Haven't done testing but I'm afraid you are right.

I use this one:

[http://someonewhocares.org/hosts/zero/hosts](http://someonewhocares.org/hosts/zero/hosts)

Smaller and works alright

<comment><USER2> I currently use Pi-Hole. Same technic but offloaded to a DNS Server what seems way more performant to begin with than a hosts files (which i think gets checked for each single request)</comment></comment></comment>


Show HN: FU Malaria – Open Source Malaria Detection Prototype - <AUTHOR> https://github.com/fu-malaria/fu-malaria <comment><AUTHOR> Hey guys this is a Skunk works project which we did in our spare time that has been open sourced, appreciate any assistance or feedback</comment>


Aural, podcast app for iPhone (with promo codes) - <AUTHOR> http://aural.fm

<comment><AUTHOR> A friend and I released a simple and nice podcast app, focused on experience rather than features, what do you think of?

Here are a few promo codes:

6XA7TML4996F 9AR9Y9FLMMKL 9LWJP6PRT6J9</comment>