Python 3.2 Released - <AUTHOR> http://www.python.org/download/releases/3.2/ <comment><USER2> One interesting thing from the "What's new in 3.2?"[1] page:

After the 3.2 release, there are plans to switch to Mercurial as the primary repository. This distributed version control system should make it easier for members of the community to create and share external changesets. See PEP 385 for details.

1- <http://docs.python.org/dev/whatsnew/3.2.html>

<comment><USER3> Some background:

[http://www.python.org/dev/peps/pep-0374/#why-mercurial- over-...](http://www.python.org/dev/peps/pep-0374/#why-mercurial-over-other- dvcss)

The reasoning was a bit odd (right at the end). For example:

> First, git's Windows support is the weakest out of the three DVCSs being > considered...

True... kinda. In my experience it sucks unless you use Cygwin. I'm not sure how much that matters however. There is excellent tool support for Git on Windows, namely Jetbrains' IntelliJ (with the Python module) or PyCharm. Version control integration is one of those things that Jetbrains excels at with nobody else really coming close.

But, then again, the vim/Emacs Python crowd (over IDEs) are still pretty strong.

I'd be interested to know what the "core developers" disliked about Git too.

<comment><USER4> > I'd be interested to know what the "core developers" disliked about Git too.

I spoke to Brett Cannon --basically the guy who chose Mercurial-- not long after the choice was made. Apparently the most important factor was that Mercurial was the favorite choice in the Python community. That's probably because Mercurial is written in Python, and was used by a lot of Python projects.

Also Git didn't work very well under Windows at the time if I remember correctly.

<comment><USER5> > Also Git didn't work very well under Windows at the time if I remember > correctly.

Yep, Windows wasn't well supported so it was a pain to setup, and it was very very slow.

</comment></comment></comment></comment><comment><USER6> Would someone to care to chime in on an estimate as to when it would be advisable for amateurs to start employing 3.x?

How far along are the libraries and the documentation/tutorials?

<comment><USER7> Use 3.x if you can. Use 2.x if a library you require hasn't been ported (or better, help them with it, although that's probably not a job for a self- described amateur).

<comment><USER8> The problem with that plan is that you might not need a 2.x library right now, but when you need one tomorrow you're going to be really sad. In essence, Python 3.x is a brand new niche/minority language, and should be treated as such by people thinking of using it.

</comment></comment></comment><comment><USER7> The concurrent.futures module looks interesting: [http://docs.python.org/dev/whatsnew/3.2.html#pep-3148-the- co...](http://docs.python.org/dev/whatsnew/3.2.html#pep-3148-the-concurrent- futures-module)

I don't have much experience in that area, so I can't judge if it's as cool as I think it is. Will anyone help me out?

The ability to safely convert string representations of data structures into the structures themselves seems pretty sweet, too: <http://docs.python.org/dev/whatsnew/3.2.html#ast>

<comment><USER9> > I don't have much experience in that area, so I can't judge if it's as cool > as I think it is. Will anyone help me out?

It is quite cool. Strictly speaking, it doesn't have to be in standard library, but Python has always had a batteries-included mentality anyway. Besides, it offers a more sane way to parallelize execution than mutexes, and that mentality should be encouraged.

The entire java.util.concurrent.* library is quite good, actually. No shame in porting it.

</comment></comment><comment><USER10> The main question I have is when-will/should projects begin moving to 3.x?

<comment><USER11> If you can do it based on your dependencies and your time, I don't see why you wouldn't, given the following:

* It's easiest to do when you don't have a wide range of versions to support. If you want to support 2.6, 2.7, and 3.x, writing a single codebase that supports both versions is not really that hard. It gets harder the wider your range gets, but it's not impossible. For example: if you need 2.4-3.x then you don't have the `as` statement, so exception handling is tricker across all versions.

* Run your code through `2to3`, it probably works. A lot of people are surprised at how close they are to working under 3.x, enough that there are some projects which successfully keep the codebase under 2.x and port to 3 via 2to3 only at release time.

* You need good test coverage to have a successful port. Period. This is one of the barriers a lot of people see to porting -- they need to stop and build up tests before they can even think about moving forward.

The initial effort in porting turns a lot of people off, as does the ongoing maintenance, especially when there's no audience for it, but as with the movie Field of Dreams: "if you build it, they will come". We need more projects to be proactive and spend a little time if they can...enough that the PSF will fund porting sprints (see www.pythonsprints.com)

<comment><USER12> No offense intended, but I think that using `2to3` at release time is exactly the wrong way around. I'd rather like to have something like `3to2`.

The idea is to use `2to3` only initially to move your code to Python3. From then on, develop your code in Python3 – that's what "we all" want, don't we? At release time, use `3to2` to also provide a Python2 version.

<comment><USER13> It is definitely not the recommended nor the common way of doing it. Many projects use 2to3 at release time (which hopefully include testing time) to support python 3.x. Numpy and scipy do exactly that for example, and we won't limit ourselves to python 3.x anytime soon.

<comment><USER12> _> definitely not the recommended nor the common way_

Indeed, this proposal is not the common way. But why is that so uncommon?

Why is using 3to2 not recommended? In how far do you limit yourself if you develop in Python3 and use 3to2 at release time?

Rather, I'd guess that developing in Python2 and using 2to3 is limiting, because that limits you to the language features of Python2.

<comment><USER13> The context I was speaking is projects who still want to support 2.x, which is what most projects want.

Obviously, if you don't care about supporting 2.x at all once the conversion is done, modifying the output and using the output as your reference source is fine.

<comment><USER12> _> The context I was speaking is projects who still want to support 2.x_

This is also what I was speaking about. And to reach that goal, you have generally 3 options:

1) write code that works with Python2 as well as Python3

2) maintain your code in Python2 and use 2to3 on release time

3) maintain your code in Python3 and use 3to2 on release time

Given you don't want to do 1) for whatever reason, my argument is that 3) seems to be the preferable solution. It allows you to use our loved Python3 right now, while still supporting Python2.

However, "in the wild" we see 2) way more often, and I don't understand why this is the case.

Why do so many projects prefer 2) over 3)?

<comment><USER13> Because for many contributors, python 3 is not usable as there are so few packages available. And on the other hand, the improvements from python 2 -> 3 are really minor.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Sweet, now when is WSGI going to have 3.0 compatibility worked out so that it's reasonable to start using it?

<comment><USER4> We still need to wait for WSGI based frameworks and wrappers like Django, werkzeug, WebOb, etc. to be ported.

It shouldn't be too long though. I'd bet that in 6 months 1 or 2 projects will already be functional.

</comment></comment><comment><USER15> Anybody done or know of any performance comparisons? Particularly intrigued by:

<http://docs.python.org/dev/whatsnew/3.2.html#multi-threading>

[http://mail.python.org/pipermail/python- dev/2009-October/093...](http://mail.python.org/pipermail/python- dev/2009-October/093321.html)

<comment><USER16> I'm kinda curious too.

<comment><USER17> Since the GIL is still there, I doubt that any drastic improvement has been achieved. Basically, instead of getting significantly worse performance when using threads, you will get close to single-threaded performance. Not better performance.

</comment></comment></comment><comment><USER18> If I could easily update python so that yum still worked fine on centos I would definitely start using python3. As it is I'm still stuck with python2.4 for a majority of the stuff I write.

<comment><USER19> You can always use virtualenv and whatever version of Python you want.

</comment></comment><comment><USER20> Python 2.6 as a language is "good enough", for whatever meaning of that phrase. What would be exciting in Python development is the PyPy + LLVM (and the short stretch of the Unladen Swallow project) backend, and applying the modern optimization techniques for compiling dynamic code into efficient machine code. There is IronPython etc. but the platform is different from CPython's.

</comment><comment><USER21> Seriously rather than moving python 3 forward why can't they put in the effort to upgrade the most common libs so we all can go 3.0 first?

<comment><USER7> Have you read PEP 3003? Python 3 is hardly moving forward.

<http://www.python.org/dev/peps/pep-3003/>

<comment><USER11> I think it would benefit you to read the PEP before making such a post.

<comment><USER7> I have read it, but evidently I'm misunderstanding something, either in the parent post or the PEP. Would you care to be a bit more explicit in pointing it out?

</comment></comment></comment></comment><comment><USER22> This is both wonderful and disappointing.

We're still pretty locked into 2.6. I'd love to move to 3.2 but it would break EVERYTHING!!!!(! added for emphasis!)

Maybe in ~10 years, everyone will be using 3.2, I know I can't wait! :D

<comment><USER23> Move to 2.7 first, which should be fairly easy. From there, moving on to 3.x is much easier.

<comment><USER24> Agreed. Once I made the mental decision to stop supporting Python < 2.7, I ended up with at least one code base that runs under both 2.7 and 3.2. Switching to print() ("from __future__ import print_function"), basing error objects on Exception instead of StandardError, and wrapping loops over .items() or .keys() with list() were the only significant changes, and all of the above are available in 2.7. Runtime for a typical job was marginally slower (8-11%) in my testing with 2.7 vs. 3.1; more than acceptable for me.

(There's some variation in output, thanks to Unicode, but it's a variation that this project could live with.)</comment></comment></comment>


Free version of Ruby in Steel - <AUTHOR> http://antoniocangiano.com/2008/10/06/free-version-of-ruby-in-steel/

<comment><USER2> Although I generally am happy with TextMate, an IDE would be useful for some tasks, especially debugging and code browsing/refactoring. I wish something like Ruby in Steel was available for OS X and Linux. I know there are eclipse and netbeans IDEs. They really suck. Other small players don't build a nice product either; I've tried them all.

I would pay money for a solid OS X and/or linux based graphic debugger and "Smalltalk-style" code browser for ruby.</comment>


IPad 2, iPhone 5, and why Apple is shifting its mobile line to Qualcomm chipsets - <AUTHOR> http://www.engadget.com/2011/01/14/exclusive-the-future-of-the-ipad-2-iphone-5-and-apple-tv-and/ <comment><USER2> Maybe Apple will make me eat my words, but...

As a current iPad owner, I'm really not that fussed agout iPad 2. Two cameras and an SD slot? A screen that is better that the current one, which already seems more than fine for me?

Feels very much like creAting a new version for the sake of having a new version to sell, not because it will be significantly better.

<comment><USER3> The iPad's screen is /really/ low resolution. I mean, yes: it is "fine". But frankly, so was the non-retina iPhone screens. However, now that I'm using the iPhone 4, everything, and I mean absolutely everything, from my iPad and old iPhones to my laptop look like they are made out of horrible blocks, and reading on any of them is frustrating. If that were the /only/ difference between the two units, I think that would easily be enough.</comment></comment>


Test for Dwindling Retail Jobs Spawns a Culture of Cheating - <AUTHOR> http://online.wsj.com/article/SB123129220146959621.html <comment><USER2> The test succeeds in its purpose: weeding out those who cannot figure out how to deal with the immense amount of bullshit inherent to any retail position. If someone isn't savvy enough to tell their employer stealing is wrong, they probably aren't savvy enough to tell the customers the dress makes them look skinny.

<comment><USER3> This is an unfortunate stereotype, to think that retail implies a certain amount of bullshit. I am more inclined to say it's a result of dilution of good practice and good faith when intents and goals are misaligned. You'd probably agree, but the blame isn't all on retail per se.

</comment></comment><comment><USER4> The real problem is that we don't have effective screens for employees. What is an hour-long interview going to tell you? Little. And you're going to have to do many of them. If you interview as few as 10 people at an hour a piece, that's $250 at $10/hr salary rates. Most likely, the person doing your hiring is getting more than that and so it could easily be in the $500-1000 range. And that doesn't even count the time used reviewing resumes. If you're in a labor intensive industry, you'd like to lessen the screening process if at all possible.

I think these tests are stupid. Unions hand out answer sheets to anyone that asks them, answers are available online, and it's not that hard to guess that a company wouldn't want to hire someone who thought that failures were always someone else's fault or that they usually quit doing things in the middle. We need a lot of _good_ research in this area. It's very difficult to tell good workers from bad workers and that causes both businesses and good workers harm as the business can't tell who to hire and compensate at good levels. Anyone have any ideas?

<comment><USER5> I found this interesting:

 _"We see absolutely no evidence of any significant cheating taking place in the use of our assessments or that the cheating is substantially affecting the validity of the assessments," says David Scarborough, who helped develop the test and works for its owner, Kronos Inc._

Of course, that's what he _would_ say, but what if he's telling the truth? If anyone stands to gain from research into what tests correlate well with job success, it's these guys.

It's entirely possible that the test still measures qualities correlated with job success, even when the applicants cheat to pass it. It's also possible that having _any_ prescreening test -- even a totally irrelevant one -- improves the quality of employees.

<comment><USER6> It's also possible he's telling the truth because no one is _looking_ for any evidence.

</comment></comment></comment><comment><USER7> <http://github.com/sproutward/kraplan/tree/master>

"The Kraplan project grew out of parodies of some awful Kaplan advertisements in the Boston subway. Kraplan is a project to use humor and invective to get people thinking about standardized testing. "

if you want to get involved let us know.

</comment><comment><USER8> I must admit, I have failed every one of these automated tests that I've ever taken. On the other hand, I've been offered every position I've ever interviewed in person for.

Maybe I just don't have a temperament suited for this sort of retail work?

</comment><comment><USER9> There are actually people who can't figure out the desired answers to those questions?

<comment><USER5> The answers to some of the statements are not totally obvious. If we assume the "answer key" mentioned in the article is correct (<http://melbel.com>), we are supposed agree with "You have no big regrets about your past" but also agree with "You look back and feel bad about things you've done". Likewise, we are supposed to disagree with "You are good at leading people" but agree with "You are good at taking charge of a group" and "You like to take the lead with others".

<comment><USER10> Also

"You don't give up on things you start" could be good or bad, depending on what it was you started!

</comment></comment></comment><comment><USER11> _John Soong, 18, says that after he had failed to get jobs at several chains that use the test, he began to poke around for an answer key, driven by "altruistic, and maybe vengeful," motives._

Awesome.

</comment><comment><USER12> Reminds me of my favorite example of a prescreening personality test.

Southwest used to put a bunch of candidates in a room together and ask each one to make a short presentation. But they weren't observing the presenter. They were observing the audience. They figured that if you paid attention to your competitors, you'd probably pay pretty good attention to your customers.

Must have worked pretty well. But the cat is out of the bag by now.</comment>


Making Finfisher Malware Undetectable - <AUTHOR> http://lqdc.github.io/making-finfisher-undetectable.html

<comment><USER2> To be clear, running any sample that's clean on VT will probably trigger your AV based on many run-time heuristics - VT is showing _scan-time_ results, not _run-time_ results. These 'crypters' are also effectively worthless - as soon as your sample hits a few computers an AV will upload the sample (or someone will upload it to VirusTotal, and it will subsequently get analyzed) and it will be flagged.

You can almost try this 'at home' \- upload a file to VirusTotal and try to get it to match two or three AV's detections. It will then be flagged by at least ten AVs next week. This is because VirusTotal shares all uploaded files with antivirus products.

<comment><USER3> I remember reading some fictional story where the hacker designed a easily- detectable virus, whose true payload was the signature the AV system generated from it. The carefully-crafted signature would exploit a buffer-overflow in the anti-virus clients as soon they got their regular updates from the central server.

Far-fetched but not impossible. I wish I could remember the source.

</comment></comment><comment><USER4> Kind of scary, but would need successful execution to be really bad. I really like the idea of sandbox analysis, as well as the challenge of writing a program which can detect when running in-sandbox :)

</comment><comment><USER5> The name of one of the protectors is 'Themida', not "Themeda". Aside from that, nice article. I wonder how many of the antiviruses complained when you actually tried to execute your packed file? There should be a second round of heuristics then which would catch the malware after it's unpacked to disk.

<comment><USER6> Do you mean unpacked in memory? Most packers don't write unpacked files to disk (it would make bypassing them a lot easier if they did...)</comment></comment>


Mangoreader-Interactive Story Telling iPad/Android App for Kids - <AUTHOR> http://mangoreader.com/

<comment><USER2> interesting app... i see a lot of stories and languages... the story writing seems pretty straight forward. however the UI and experience is not very intuitive. who is the audience? kids, parents or teachers ?</comment>


Quantum Cryptography Outperformed By Classical Technique - <AUTHOR> http://www.technologyreview.com/view/428202/quantum-cryptography-outperformed-by-classical/ <comment><USER2> After reading through the paper[1] it appears that the only security afforded is an ability to detect energy fluctuations caused by a MITM attacker? A public channel is then assumed to exist to allow both parties to broadcast the monitored energy levels to each other for comparison (evidently over a high bandwidth link and with low latency). A further assumption appears to be made that an attacker is unable to perform a MITM attack on the public broadcast link.

I am naturally sceptical of research of this nature that does not mention:

* practical implementation issues such as the required accuracy of clock synchronisation, required A2D converter parameters, required tolerances for electronic components, etc.

* emanation security/side channel considerations (timing analysis, power analysis and filtering, etc)

* prior work and existing equipment in the space of protected cabling: pressurised cable monitoring, time-domain reflectometry, etc.

[1] <http://arxiv.org/pdf/1206.2534v2>

<comment><USER3> I didn't read the whole paper and I'm no electrical engineer, but I'm also quite skeptical that this works. I'd probably believe it if current propagated infinitely fast, but obviously it doesn't.

My first attempt to tap into a channel with this system would be to tap into two points at some distance apart, then measure then changes in current at each point. Since the receiving resistor is flipped randomly and the sending resistor is flipped with the data, it seems to me intuitively that all you need to do to crack this is use a bit of basic electromagnetic physics to derive a formula to extract the data from propagation delays of the effective resistance experienced by the circuit measured at two distant points. I could be wrong though.

</comment></comment><comment><USER4> First of all, this sort of paper pops up fairly frequently and, so far, none have stood up to peer review for long. There's probably an error somewhere in their proof.

Second, long distance communication and scalable networks cannot rely on direct point-to-point links. You can't build everyone a point to point link with each other and individual links, even for classical signals, can only extend for a few hundred kilometers before signal-to-noise drops so far that any known communication protocol breaks down completely. Yes, commercial quantum systems built to date do rely on point-to-point links, but quantum memory and quantum repeater networks (currently enjoying rapid improvement in research) will allow chained entanglement swapping through untrusted nodes, allowing quantum crypto to work in network topologies very similar to the existing internet. The method in the linked paper does not appear to permit this and would have to rely on trusted nodes at best.

In other words, even if it there isn't an error in their proof, they need to show that their technology can be expanded beyond trusted-point-to-trusted- point links in order for it to be of practical use.

</comment><comment><USER5> If you want truly unbreakable encryption, there's always the one-time pad. In that case, the unbreakability is guaranteed by mathematics, an even stronger guarantee than physics.

Certainly, the one-time pad suffers from the need of each pair of parties to exchange keys beforehand. As far as I can see, the problem is just as bad for quantum crypto or this thermodynamic crypto because you have to arrange a fiber optic cable, a laser line of sight, or a copper wire between each pair who want to communicate.

You can't use quantum crypto or this thermodynamic crypto on the Internet for example. You need to set up unshared exclusive-use connections between each of the parties.

If you're going to the trouble of doing that, you might just as well exchange some terrabyte disks of one-time pad data, and you'll achieve the same (or greater) guarantee of security.

<comment><USER6> Quantum Cryptography is actually Quantum Key Distribution, an algorithm for securely creating a one-time pad between two peers. The proof that quantum crypto is unconditionally secure is just Shannon's proof.

The benefit of quantum crypto is that you can basically setup or even stream a one-time pad over a public network, without having to trust the middle-man. Another benefit over, say non-linear/chaotic systems is that fibre, line-of- sight wireless and satellite communication already forms the backbone of our network infrastructure.

Now only to solve the single-photon detector hardware issues.

</comment></comment><comment><USER5> While this is good science and I enjoy hearing about it, it needs to be said that "unbreakable" encryption is a solved problem.

The existing public key plus symmetric key infrastructure, with a sufficiently long key, achieves "unbreakable" encryption for any practical purpose, including communications that are a matter of life & death and national security.

There are many ways to compromise existing crypto through implementation errors, bugs, or bad key management, but the same caveat would apply to quantum crypto or this new thermodynamic crypto.

The main unsolved practical problem in crypto is getting it built into every form of communication to happen automatically and transparently. And that would happen if people demanded it. So the main problem is a social one: getting people to care about privacy and secrecy enough that they demand it.

</comment><comment><USER7> Alice is essentially sending plaintext and bob is encoding it via the random resistor configurations he chooses. Since the reciever controls the encryption, as dhx pointed out, you could just act as a man in the middle reading signals from alice on one circuit and forwarding them to bob on another, A & B would never be the wiser.

Didn't read the paper yet but it also seems that without having many many resistors the number of signal states would be pretty low (bob's resistor count squared, assuming alice only has 2 resistors, i.e. a digital signal) making it rather trivial to extrapolate the original signal. Would this essentially rule out using this technique for encrypting a digital signal ?

</comment><comment><USER8> This really reminds me of Diffie-Hellman key exchange. Does anyone with a background in physics know how it might be related (or not)?

</comment><comment><USER9> Reminds me of SIGSALY from WW2: <http://en.wikipedia.org/wiki/SIGSALY></comment>


Massachusetts governor defends background checks for Uber/Lyft drivers - <AUTHOR> https://www.boston.com/news/politics/2017/04/20/charlie-baker-defends-results-of-states-background-checks-for-uber-and-lyft-drivers <comment><USER2> I support background checks. I know a woman who had a driver try to grope her when she was getting out. The ones in MA just sound ridiculous. Unlimited look back periods for some crimes. Robbery is a serious offense, but if someone has been a law abiding citizen for a decade afterwards they might actually be rehabilitated.</comment>


A Quiz About Integers in C - <AUTHOR> http://blog.regehr.org/archives/721

<comment><USER2> Qusetion five: "What does the expression SCHAR_MAX == CHAR_MAX evaluate to?" should be undefined exactly because char type can be signed or unsigned (as admitted in the explanation). If the question is about specific ABIs, it should be stated in the question.</comment>


Naming Conventions That Need to Die - <AUTHOR> https://willcrichton.net/notes/naming-conventions-that-need-to-die/ <comment><USER2> Article fails to give examples of good software names. Why? Because names are brands. They don't just describe the product, they need to create an identity.</comment>


JSON: The JavaScript subset that isn't - <AUTHOR> http://timelessrepo.com/json-isnt-a-javascript-subset

<comment><USER2> tl;dr: the JSON specification accepts two obscure Unicode codepoints in string literals that the JS specification doesn't. eval() may fail on valid JSON. Workaround: escape those codepoints.

Plus sensationalistic title and pedantic introduction.

<comment><USER3> Hey, thanks for the tl;dr. That was useful.

> Plus sensationalistic title and pedantic introduction.

This, not so useful (and unkind)...

Had the author written merely the tl;dr line above do you think his important observation would have gotten the attention it deserves?

The author outlined his thought process to show that his observation was actually based on non-trivial research.

While I like tl;dr's, I appreciate intros that put things in context, and I'm more likely to trust observations whose underpinnings are spelled out.

</comment></comment><comment><USER4> This post is based on ES3. Both U+2028 and U+2029 are valid in ES5 string literals as part of a LineContinuation. See <http://es5.github.com/#x7.3> (ES5) instead of <http://bclary.com/2004/11/07/#a-7.3> (ES3).

So really, the title should be: "JSON: The ES3 subset that isn't."

Issue reported: <https://github.com/judofyr/timeless/issues/57>

</comment><comment><USER5> Valid point, but not a great example. You get a syntax error in Safari's Web Inspector even if you type that JSON yourself (i.e. no Unicode funny business):

      > {"JSON":"rocks!"}
      SyntaxError: Parse error

<comment><USER6> Though, to his credit, in the little REPL that he shows, he typed ({"JSON":"rocks!"}), not {"JSON":"rocks!"} - the former is valid.

<comment><AUTHOR> To tomstuart's credit, I fixed the post after he wrote that comment.

 _Meta:_ Right after I originally wrote this comment I saw that tomstuart answered too, so I decided to delete my comment. Well, it appears that so did Tom, and suddenly there were _no_ replies here.

<comment><USER5> HN feature request: compare-and-swap comment semantics.

</comment></comment></comment></comment><comment><USER7> Another caveat: it's unsafe to embed arbitrary JSON in an HTML <script> tag, because a string containing "</script>" will get picked up by the parser.

This particular case can be patched by replacing "</" with "<\/".

</comment><comment><USER8> If you always escape the Unicode characters when you output JSON, you don't have this problem. At least Facebook/Twitter are using this method.

<comment><USER9> One trick is to base64 encode and decode the data

</comment></comment><comment><USER10> It sounds to me more like the javascript specification has a bug or design flaw, rather than saying as a blanket statement that JSON isn't really part of JS. Ideally, javascript and JS implementations should fix that flaw, rather than parsers having to work around it.

<comment><AUTHOR> ECMAScript was standardized over _ten_ years ago. The specification has been publicly available and (as far as I know) every implementation has treated line terminators equally. We can't just change 5+ implementations of JS to make it compatible with a some tiny data format that works fine 99% of the time anyway.

I'm not saying that JSON isn't a part of JS; of course it is! I'm just saying that it isn't a strict subset of JS and that you _can't_ depend on eval() doing the right thing.

</comment></comment><comment><USER11> Does anyone know if the jQuery JSON parser has this fix by any chase?

<comment><USER12> jQuery JSON parser will delegate to JSON.parse where available, which doesn't have this problem.

Using JSONP with jQuery, you have to directly eval() the response from the server, and you don't control what the server sends - it could send invalid javascript with these code points in it. You can't fix that from the client- side, jQuery can't fix that.

The servers have to be patched.

</comment></comment><comment><USER13> Thanks for sharing this tricky bit of knowledge, Magnus. Glad you're helping raise awareness on this further :)

<comment><USER13> Oh, and thanks again for patching the JSONP middleware.

</comment></comment><comment><USER14> JSONP does not force you to use eval. All that JSONP is doing is telling the web service to write JavaScript in such a way to immediately invoke a function with the name of the callback. Usually it's just called with a string. What you do with that string is up to you.

<comment><USER5> JSONP _does_ force you to use eval, because JSONP means "instead of returning JSON for me to parse with a JSON library, return executable JavaScript for me to point at with the src attribute of a <script> element". The string consisting of the argument to the callback is de facto evaled by the user agent (when the executable JavaScript is executed) in order for it to become a JavaScript value at all.

The user agent evals the JSONP response before anything else happens: the server might return the string 'yourCallback({"JSON":"rocks!"});', which gets evaled to a function invocation whose argument is whatever the string '{"JSON":"rocks!"}' evals to. If that string doesn't successfully eval (as per the OP), your JSONP is broken.

<comment><USER15> Perhaps we need a JSONP callback that instead does `yourFunction(JSON.parse('{"JSON":"rocks!"}'))` (though, slightly more sophisticated, I hope).

<comment><USER12> That still won't work unless you escape the line endings. And you'll also need to escape single quotes.

</comment></comment></comment></comment><comment><USER16> Sounds like something that a 3rd party javascript library could handle :). Point made though.

<comment><USER12> No. Using JSONP, you are forced to directly eval() code from another domain - you can't just use a javascript library to change that code.

</comment></comment><comment><USER17> JSON started out with JavaScript and slowly expanded beyond the ECMAScript specifications to become more versatile. I don't see what the big deal is.

Humans prefer easily processable and storable information, and for this reason they like to think JSON is JavaScript Object Notation.

This reminds of how ECMA doesn't like to be called the _European_ Computer Manufacturer's Association, since they have now grown beyond that, and prefer being called Ecma.

<comment><USER5> As the OP says, the big deal is that people frequently assume that JavaScript's eval is an acceptable JSON parser — for example, this is the fundamental assumption which makes JSONP work. If your JSON isn't guaranteed to be valid JavaScript, you might run into actual problems.

<comment><USER18> Wouldn't using eval to parse JSON be quite hazardous in the same way as python's pickle, and thus be limited to pretty specific use-cases (limited moreso than just simply to JS)?

<comment><USER19> It used to be quite common and is still done (and is required for the hack known as JSONP); lots of the time you're retrieving JSON from the same server you loaded the original page from so it's safe.</comment></comment></comment></comment>


Show HN: Gronto - Create a viral flash sale promotion to sell anything. - <AUTHOR> http://www.gronto.com/

<comment><USER2> What is a flash sale promotion, and what sort of businesses would want to do one?

<comment><USER3> A flash sale is a discounted sale that is available for only a very short period of time. It's the model used by companies like Fab, Groupon, Living Social etc. Anyone or business can pretty much do a flash sale for anything they would like to sell.</comment></comment>


Bit Twiddling Hacks - <AUTHOR> http://graphics.stanford.edu/~seander/bithacks.html <comment><USER2> It is amazing what you can accomplish with bit twiddling.

I've been working on a Protocol Buffer decoder, and I was looking for ways to optimize varint decoding. On a Google-internal list I asked how you'd transform the 64-bit integer:

        0aaa aaaa 0bbb bbbb 0ccc cccc 0ddd dddd 0eee eeee 0fff ffff 0ggg gggg 0hhh hhhh

into:

        0000 0000 aaaa aaab bbbb bbcc cccc cddd dddd eeee eeef ffff ffgg gggg ghhh hhhh

Not two hours later I had several impressive transformations that I _never_ would have come up with on my own. The two most effective:

        b = ((b & 0x7f007f007f007f00) >> 1) | (b & 0x007f007f007f007f);
        b = ((b & 0xffff0000ffff0000) >> 2) | (b & 0x0000ffff0000ffff);
        b = ((b & 0xffffffff00000000) >> 4) | (b & 0x00000000ffffffff);

and:

        b +=       b & 0x007f007f007f007fULL;
        b +=  3 * (b & 0x0000ffff0000ffffULL);
        b += 15 * (b & 0x00000000ffffffffULL);

I don't know how these guys come up with this stuff.

<comment><USER3> "b += 15 * (b & 0x00000000ffffffffULL)" might look more magical than it actually is. The crux is:

        b * 4

is the same as

        b << 2

thus

        b += 3 * b

is the same as

        b = b << 2

So plus, a multiply and a mask make it possible to shift only a subset of the bits in the integer. The first transformation uses two masks and bitwise or to achieve the same.

</comment></comment><comment><USER4> Whenever a discussion on rearranging bits and bytes comes up, I can't help but recommend Hacker's Delight by Henry S. Warren <http://amzn.com/0201914654>

<comment><USER5> Yep, I just got that from Amazon a few days ago. I'm a Python/Web programmer in my day job, but I'm looking to get more into the low level stuff. I recently got a Nerdkit too - lots of fun :)

</comment></comment><comment><USER6> Bit-fiddling at the C-level isn't necessarily faster on all platforms. E.g., the "masked combine bits" case where he says that r = a ^ ((a ^ b) & mask) is one operation shorter than r = (a ^ ~mask) | (b ^ mask). On ARM, the (a ^ ~mask) can be performed by one instruction, so the instruction count is actually the same, and the latter way of doing it parallelizes better (only a dependency depth of two instead of three). I.e., the "optimized" version is actually likely to be slower on some CPUs.

</comment><comment><USER7> I had no idea there was a patented way to compute the absolute value of an integer. Insane.

</comment><comment><USER8> Nowadays things like these should only be interesting to compiler writers.

<comment><USER9> There are algorithms that use bits just like there are algorithms that use trees. You wouldn't expect your compiler to write your algorithms for you, would you.

Just recently, I've used the bitboards representation for cellular automata (which lets you compute 64 cells at the same time by doing about 100 non- branching integer instructions). I have difficulty seeing a compiler that can recognize that algorithmic optimization.

<comment><USER10> I took him to mean that compiler writers should provide these bit operations in the most efficient manner on the current platform, e.g. __builtin_ctzl instead of directly using assembly or using arithmetical solutions.

</comment></comment></comment><comment><USER11> This page was a life saver in my fall CS class.</comment>


Show HN: Practice creativity by writing 10 new ideas a day - <AUTHOR> http://10ideasaday.xyz <comment><AUTHOR> I've been following the advice of James Altucher to write ten new ideas a day. Since I'm a junior developer I decided to make a small web app to save my list of ideas. Let me know what you guys think :)</comment>


Fixing the Most Despicable Website on the Planet – Facebook - <AUTHOR> https://arbitraryblog.com/2019/03/13/fixing-the-most-despicable-website-on-the-planet-facebook/ <comment><USER2> When so many millions of users persist in the face of so many established facts, I'd say that each and every one deserves everything they get of the experience.</comment>


IOS 5 packs text macros - <AUTHOR> http://www.extremetech.com/computing/99625-ios-5-hidden-gems-and-features

<comment><USER2> Ironically, I can't seem to view this page in Safari on iOS 5. Can anyone summarize what this says?

<comment><USER3> The relevant portion of the article: In Settings > General > Keyboard you can now specify Shortcuts. Shortcuts are simply text macros: you enter a short phrase (btw, omg, etc.) and the iOS 5 input editor (SMSes, emails) will automatically expand those short phrases into full sentences. Whether this will prevent kids from typing in txtspk is another question entirely.

</comment></comment><comment><USER4> I hadn't heard this and am now incredibly excited at the prospect of never having to type my email address again.</comment>


10 yr anniversary of Napster: interview with Shawn Fanning - <AUTHOR> http://www.sfgate.com/cgi-bin/blogs/techchron/detail?&entry_id=40851

<comment><USER2> I really miss Napster. I was in college when it was first released, and remember completely saturating the network with downloads.

</comment><comment><USER3> Only 10 years since Napster became popular?

Feels more like 30 years...</comment>


Ask HN: What audiobooks did you "read"? - <AUTHOR> <comment><USER2> Some of the lighter business books are great to listen to as audiobooks while you are travelling - while walking through airports, waiting in line, on a plane. If the book is too complex, then you are better off reading the book yourself. Outliers, Rich Dad Poor Dad, The Lean Startup, How to win friends and influence people.....</comment>


Is Android Only Surging Because Apple Is Letting It? - <AUTHOR> http://techcrunch.com/2010/09/05/apple-android/

<comment><USER3> It's a shame he didn't really actually address the question that is the title of his article. Whatever else we know about the Apple vs Google situation one thing is sure: Jobs is seriously burned by Android's success and there is not a chance in hell he is "letting" Android win. Whatever is happening out there is happening _despite_ Jobs' best efforts to stop it, not because he is "letting" it happen.

Personally, I think that just as there is a slightly delusional sense about Apple's competitors that all they need to do is make something in the same category as an Apple device without any of the design brilliance or attention to detail to succeed, there is also a slightly delusional part of the Apple camp where they believe that design and enforced simplicity is the be-all and end all of the user experience. Like this guy who is simply confounded that anybody is buying Android phones and hence comes up with, by process of elimination more than anything else, that it must be AT&T's fault. In reality, many people actually care about features, power and flexibility too. Nobody likes to think of themselves as being paternalised and Apple does that all the time. Not to mention that many people dislike being treated as a channel for mass-market commercialism that Apple wants them to be.

My mother came to me last week for the third time to plead with me to tell her some way - any way - to use something other than iTunes to manage her iPod Touch. She doesn't understand it. It confounds her at every step. She hates it. I told her what I always tell her: "Look, there are ways, but the bottom line is, it is designed to be used a certain way, and only that way. Get to know that way, try it out how it is intended to be used and you might find it is wonderful - many people do. But in the end, Apple is not about choices and alternatives, they are about simplification and control. If you really dislike it after really trying it Apple's way, I think you should think about getting a different device." She came back a bit later and asked me how much her iPod Touch might sell for on ebay.

</comment><comment><USER4> I found very few factual things in that article. He's trying to make a point that android devices are worse or the only _feature_ they have is that you're not forced to use Verizon. (where he's obviously forgetting that there's a universe outside of the US)

 _There are a dozen or more elements that are better about the iPhone. Everything from the big: the App Store versus the Android Market (from the consumer perspective) — to the little: the multi-touch and overall touchscreen responsiveness._

I would think Multi-touch/touch responsiveness has more to do with the devices and not the operating system.

I myself believe that Android _will_ become the dominant OS on phones, because they've got developers on their side. All my hacker friends and developers are really excited to start hacking on android phones (as am I) and not so interested in developing for iPhone. I believe the biggest reason there are a lot of developers (more so companies) that flocked to iOS development is because of the marketplace, the opportunities it brought and that there wasn't any similar device available at that time.

A marketplace for apps will in the end become decentralized and the greatest apps will be for android because the smartest people will want to develop for it. History repeats itself.

<comment><USER5> There's more hacker affection for Linux than Windows, but somehow the year of Linux on the desktop was always right around the corner. Palm also had a devoted developer following, but it couldn't make up for mistakes at the mothership. In short history may repeat itself, but not the way you hope.

<comment><USER6> Yet most of the software development done nowadays is web, and guess which is the favorite target for web deployments?

Linux is coming of age in a post-desktop world, so the question is almost irrelevant. What IS relevant is that the biggest web technologies being used right now, as well as the technologies that will some day become dominant (Ruby, Scala, Haskell, Node.js, and others) are primarily for Linux and by Linux devs.

But as far as smartphones go, the question is still open, the market is still up for grabs, so developer-friendliness is going to be a top priority. Right now iPhone may be the top platform, but I would not underestimate Google's ability to appeal to developers (neither Apple's ability to make successive, giant leaps).

<comment><USER7> Most of the technologies you have enumerated only have mind-share on places like Reddit & HN. The exception is Ruby, which is still a drop in the ocean when compared to big players like PHP or Java. I'll give you the benefit of doubt and assume that you're just joking with Haskell and Scala. There are exactly ZERO Haskell jobs available in my country.

Second of all, those technologies are not Linux-centric, they are all cross- platform. A one-OS programming language/library is worthless in the present, except in rare cases such as specialized hardware-software solutions or in- house software.

</comment></comment></comment></comment><comment><USER8> I think evidence points to this being true. For instance, in Australia - <USER2> technically advanced market where the iPhone is available on every major wireless carrier - the carrier exclusivity doesn't warp market share in Androids favour:

[http://www.theaustralian.com.au/australian-it/surging- iphone...](http://www.theaustralian.com.au/australian-it/surging-iphone-hot- on-the-heels-of-nokia-as-australias- no-1-smartphone/story-e6frgakx-1225879621669)

As of May 2010, Android is at 2.1% smartphone market share, the iPhone is at 40.3% smartphone market share.

In the US, the iPhone's AT&T exclusivity gives Android protection from true competition. When the customer can select a phone on its own merits and not due to network availability I'm sure that the market share picture may be different.

<comment><USER6> That is highly dependent on the availability of handsets and plans, so there's never a true disconnect between OS, handset, and plans.

In South America, Motorola pushed the Milestone model, hard, and it's just as if not more popular than the iPhone, but both are dwarfed by Blackberry, and the Milestone is the only real high-end Android device available. If the Nexus One or Galaxy S were for sale the numbers would be very different.

Australia, just like many other countries, has fairly hefty import tariffs on high-tech goods, so the country of origin of different devices has a nontrivial influence on handset availability, and thus general popularity of each platform.

</comment></comment><comment><USER9> I've done some Android development and didn't think it was that bad. It was definitely something of a struggle at first (not the least because I hadn't used Java - er, a Java-like-language - since my freshman year of college), but it grew on me quickly and it didn't take me long to internalize most of the important design patterns. That being said, I've never done any iPhone development, so I can't really compare.

As to the phones themselves, I don't think its as clear cut as the author suggests. I bought a first generation iPhone, but when it eventually met its demise I picked up a G1 on eBay. The G1 was obviously pretty horribly specced, but I liked enough about it to eventually got a Nexus One and rather like it. Its lacking a lot of the polish of iOS, but seems generally a lot more capable. I don't know anything about the history of using a back button for navigation through multiple applications, but that and a few other things (the notification UI for example) really pay off for Android.

I'll probably get another iPhone at some point (I'm still on AT&T and have never gotten a subsidized phone from them - I got that original iPhone before they subsidized them) to play with development on it, if nothing else. But for my primary phone I'm probably going to stick with Android, at least for the foreseeable future. Its far from perfect but it works a lot better for me.

Of course I'm not at all your typical phone user, so what I think probably doesn't mean that much.

</comment><comment><USER10> They shouldn't let MG Siegler write about iOS v. Android on TechCrunch. :)

<comment><USER11> yep, saw the title, thought 'bet its MG Siegler', opened to confirm my suspicions then closed it. Getting really old now IMO.

<comment><USER10> I really like his social networking trends posts though. :)

</comment></comment></comment><comment><USER12> Every time I see iPhone/Android articles like these I think of this:

[http://www.nytimes.com/2007/11/06/science/06tier.html?_r=1&#...</a>

</comment><comment><USER13> "But the iPhone does exist. And I simply can't bring myself to use an Android phone when I know a superior device is out there."

WTF?

That line reminds me of this video: <http://www.youtube.com/watch?v=FL7yD-0pqZg>

</comment><comment><USER14> The iPhone has many more deficiencies besides being limited to one carrier. Though I suppose that is the only one that most consumers care about.

</comment><comment><USER15> I can't but agree with MG... even when he is an apple fan boy diehard... for the most part everything he writes has some point of trueness.

For me, as a entrepreneur and with a product targeting both platforms, the experience with android has made me think twice the whole idea of iphone and its appstore stupidity, in a way where it makes me believe they are there for a reason.

Apple provides probably the best user experience for a mobile phone out there, everything is consistent, simple and geared to make the life of their users likewise... and apple enforces this but also they provide tools so that we as developers stay that way with not too much pain.

Android on the other hand stays too much to its Linux parenthood... yes it's open, yes you can do lots of stuff with it, it even can power the coffee pot if you wanted it to... but everything comes at a price! And the price that google has have to pay for that "flexibility" comes in direct impact of the experience... and microsoft seems to have learnt this too, hence the level of control they are putting back on the WP7.

Google has to pick up the ball while there is still time... provide developers with the right tools so we don't go reinventing the warm water everything we need to do something and provided them so that it remains consistent with the experience the have created with the phone... and enforce OEMs to do the same.

Now will google do this before apple pulls the trigger on new carriers for the iPhone or before WP7 takes power?... I hope so, as competition is always good for innovation.

in the mean time I will keep my Galaxy (with its 12+ carrier stupid apps) at lab for testing purposes and will carry my iPhone for the every day experience.

</comment><comment><USER16> Has the author not used a Droid X? Swype and eerily accurate speech-to-text are radically better than any input methods I've seen on the iPhone. Before Swype, I couldn't have imagined giving up my Treo 755P keyboard. Now I couldn't go back.

</comment><comment><USER17> I personally haven't seen this kind of discussion change a single opinion.

As for the title question, we've all seen the customer satisfaction numbers and the willingness to switch numbers: <http://blogs.techrepublic.com.com/smartphones/?p=816>, so I think, hinging on the credibility of these data, it's an empirical fact that iPhone stands a lot to gain by going to Verizon. If you're an iPhone developer, like myself, these data ought to be reassuring.

It's clear that the tech blogosphere and its core readership have a hint of counter-consumerist taste which makes it very bad at predicting the success of consumer products (we've seen a ghosts from 2007 this weekend on HN, and I suspect the "iPad will fail" articles are bound to crop up and bite certain bloggers later). The remedy (please) is some good old fashioned market research if we're going to make business/startup decisions based on such discussions. Eh?

PS: The top comment of this TechCrunch article is perpetrating this "Big Brother" analogy with respect to Apple's app store approval. As an English major, this has been bothering me for a while. Have these guys read 1984? "Big Brother" is supposed to represent the panopticon surveillance state, you know, one where your footsteps are tracked and recorded constantly. Sounds more like someone else to me.

<comment><USER18> The people comparing Apple's approval process to 1984 are clearly drawing parallels with the torture scenes where the protagonist is ultimately convinced that he shouldn't have done what he did and Big Brother is ultimately right - which sounds exactly like Apple. If you don't like it, it was a good choice and you're just looking at it from the wrong angle.

You're speaking in black and white where shades of gray are clearly the order of the day. Google exhibits certain traits of the 1984 state, Apple others.

<comment><USER17> Then they are Winston Smith, not Big Brother.

<comment><USER18> No, in the perfectly valid analogy, we are Winston Smith, Apple is Big Brother. Though it also might be argued that in this analogy you are O'Brien.

<comment><USER17> Apple is not Big Brother: they don't use their technology to spy on and track users. They don't opt users into new privacy-violating features, like Buzz. The surveillance is the KEY reason why Orwell set it in the future--it's a technology that he can take advantage of to make the society seem that much more terrifying. If you're trying to find a random dictator whose rules oppress us, you have a feast of other dictators to choose from. If you're going to use Big Brother, if you don't have an analogy to draw with his omniscience and omnipresence, then you aren't making a good analogy. Unless you're in 10th grade and Big Brother is just a proxy for dictatorship.

You know, while we're on the topic, Google aren't exactly rushing full speed ahead to make the best app experience on a phone. It's not their incentive to work towards the best native app user experience, because that takes away from the web traffic that makes them the real money. And they can't track us in apps. But who cares, right? It's free. Another social contract of sorts.

<comment><USER18> Why is it so important to you that Google is evil and Apple is good? That's why Apple is like Big Brother. Fanatical, unreasoning devotion is a key component of Orwell's dystopia. Google doesn't have that.

<comment><USER17> All I'm saying is that Big Brother is a stupid analogy and that it can just as swiftly be applied to Google for its obsession with collecting personal data with their free services. This ultimately damages customer value because it commits them to pushing inferior web app experiences that must be downloaded from scratch each time a user attempts to access a particular service.

I am not for strong accusations and name calling (and I deliberately didn't mention Google by name in my original post), but evidently you have no problem making this personal. If you look over this discussion, you're the one affixing labels on everything (including me). I have no commitment to maintaining intellectually impoverished rhetorical positions. In my opinion, such positions are ruining the discourse. I still don't understand why free and open-source advocates try to brush development, security, privacy, usability, compatibility, and monetization issues under a rug. Can we not fix a price to those elements? Are we so extreme that we can't accept that there are tradeoffs inherent to the system, and that approval doesn't have to necessarily equal malevolent control?

In tech, if we don't appreciate--and point out--the nuances of different kinds of relationships and different stances regarding privacy, cost, and experience, then ultimately we lose as entrepreneurs and developers because we don't see the next big thing coming, or we overvalue something that consumers are not necessarily interested in. Equating app store approval with Big Brother doesn't help anybody, and it deliberately slants the discussion.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> There must have been some sort of "out" for Apple in their contract with AT&T. I've never seen a contract without some sort of early termination section. (I'm not a lawyer, but I work with them on business contracts often.)

It must be a prohibitively large dollar amount for Apple to end the agreement early, which is surprising since I think it's been far more successful than anyone could have imagined -- so I assume what would have at launch seemed like a ridiculous sum would now be quite affordable for Apple to remove the 100lb gorilla in the room.

</comment><comment><USER20> I'm so glad in australia we can have the iphone on all our networks... Just one more reason that this is the best country in the world ;)

<comment><USER21> Except for the internet censorship part ;)

<comment><USER22> There was a lot of noise about that, but in reality the internet "filtering" proposals have not (yet) been enacted and thanks to the latest election result look pretty much guaranteed to be unpassable now.

</comment></comment></comment><comment><USER23> What is the iPhone/Android proportion on AT&T?

How about in countries where the iPhone is available on all carriers?

That would be more instructive than a US/AT&T-centric analysis.

<comment><USER24> I would guess that the iPhone/Android proportion on AT&T is heavily skewed toward the iPhone because AT&T's Android devices are all underpowered and locked down relative to their counterparts on every other US network.

</comment></comment><comment><USER25> This, and other coverage of the android vs. apple competition seems to alway miss an important point. For instance he says "if the iPhone didn't exist, I'd certainly use an android", and that they are much better than other phones that are out there.

But if the iPhone didn't exist, the android phone wouldn't exist in its current form.

<comment><USER26> He didn't miss it, the point is not relevant to the article. The author is focused on analyzing the present and speculating about the future. He's not performing a rigorous "what if" alternate reality exercise.</comment></comment>


Multiple Dispatch in Julia - <AUTHOR> https://opensourc.es/blog/basics-multiple-dispatch/ <comment><USER2> You might also enjoy Stefan Karpinski's talk at JuliaCon 2019 about how multiple dispatch helps make the language more expressive (than OOP, for Eg). _The unreasonable effectiveness of multiple dispatch_ [https://youtu.be/kc9HwsxE1OY](https://youtu.be/kc9HwsxE1OY)

It seems like such an elegant idea, I'm somewhat surprised no one seems to have run with it earlier.

<comment><USER3> I don't think Julia is (or has ever claimed to be) the first system to make extensive use of multiple dispatch. But it seems to be first one to have gotten attention, if not widespread adoption, from the broader community beyond its first intended audience, i.e., scientific computing.

Others mention CLOS, which I don't know too much about. MIT Scheme also supports multiple dispatch ([https://www.gnu.org/software/mit- scheme/documentation/stable...](https://www.gnu.org/software/mit- scheme/documentation/stable/mit-scheme-sos/Generic-Procedures.html#Generic- Procedures)). IIRC this is widely used in ScmUtils, the software library used in SICM ([https://mitpress.mit.edu/books/structure-and- interpretation-...](https://mitpress.mit.edu/books/structure-and- interpretation-classical-mechanics-second-edition)).

<comment><USER2> Julia's definitely not the first, but I don't see too many examples where they took the idea seriously enough as a design principle to build the language around it (that's what I meant by _"run with it"_ ). I've seen Dylan often credited as one of the inspirations for Julia. While many other languages might support multiple dispatch, my impression is that they're somewhat "patched on", thereby limiting the benefits.

<comment><USER3> Absolutely. I guess I was trying to say (not very clearly) that ScmUtils was the only other example I know of that "ran with it." Though SICM is relatively well known at this point, I suspect ScmUtils is not very widely used.

</comment></comment></comment></comment><comment><USER4> Multiple dispatch is such a nice feature that whenever I use other languages, I always reach for it and am immediately disappointed when I realize it's not there, or if it it is, it's not widely used enough to be useful.

</comment><comment><USER5> The problem with multiple dispatch is that by looking at

`fn(a, b, c)`

you really don't know which code it is running unless you know the types of `a`, `b`, and `c` which can't be exhaustively enumerated at the point of the writing the code or reading the code given that someone could use `fn` with totally different types.

This makes Julia readable, but as the code base grows, it can become unwieldly as well.

You really need `@which fn(a,b,c)` with known `a`, `b`, and `c` to see which function it is running.

<comment><USER6> Isn't this a problem in any system that allows function names to be overloaded? Don't you have the same issues if (a) your system has single dispatch and classes that can be extended outside the module in which they're originally defined?

<comment><AUTHOR> I agree and would say that normally dispatch comes in handy for things like `+`, `length` and of course your own functions where the meaning is the same but the implementation must be different depending on the type.</comment></comment></comment>


Getting to Know Python 3.7- Data Classes, Async-Await and More - <AUTHOR> https://blog.heroku.com/python37-dataclasses-async-await <comment><USER2> Shameless plug:

When 3.7 was first released, I created a library to use dataclasses and add some light type validation to them. The library grew and now also supports some basic serialization mapping.

I'd love some feedback/issues/PRs

[https://github.com/abatilo/typed-json- dataclass](https://github.com/abatilo/typed-json-dataclass)

<comment><USER3> attrs is basically what dataclasses haven't dared to be: [https://www.attrs.org](https://www.attrs.org)

For more context see [https://www.attrs.org/en/stable/why.html#data- classes](https://www.attrs.org/en/stable/why.html#data-classes) and [https://www.python.org/dev/peps/pep-0557/#why-not-just- use-a...](https://www.python.org/dev/peps/pep-0557/#why-not-just-use-attrs)

<comment><USER4> True that.

I'm not an OOP person, but to me, dataclasses seem like a solution in search of a problem. Or, even more nefariously, it seems akin to the Clojure model, if the core team didn't develop it, it won't be officially blessed.

I'm more than willing to hear the other side, but I've read some and watched a few talks on dataclasses, and while their implementation is neat, I cannot figure out how I'd used them on a regular basis.

<comment><USER3> > I'm not an OOP person, but to me, dataclasses seem like a solution in search > of a problem.

As an OOP person, I would say that dataclasses are an incomplete solution to a complex, multi-faceted problem, and a solution which doesn't really solve any of those facets. It is pretty much unusable as it is; for any practical use you need to extend it based on the specific needs of your application. But then it makes more sense to use a more complete solution such as attrs, which covers a much wider set of problems.

</comment></comment></comment></comment><comment><USER5> Nice article! I am just getting into writing my own decorators and I will appreciate every example and docs I can find. After 30+ years of preferring Lisp languages, I have been forced to accept Python as my main driver because of the ecosystem for deep learning, probabilistic programming, etc. Both of the books I am writing right now are Python books (one is general building intelligent systems with Python, the other covers knowledge graphs and deep learning and how they play together). Virtually all my work for the last 4 years has also used Python.

Anyway, it is rough emotionally using Lisp languages infrequently but improvements in Python 3.7 as described in this article make it less painfull.

<comment><USER6> Any favorite non trivial paradigms in python for the functional enthusiast?

<comment><USER5> I probably write fewer class definitions than most developers, and write more functions. Avoid global data. Not functional, but I like to write small libraries.

</comment></comment></comment><comment><USER7> Fun fact: contextvars are implemented as HAMTs, the same immutable maps as found in Clojure.</comment>


Bill Gates says putting Internet access before malaria research is 'a joke' - chris-at http://www.theverge.com/2013/11/1/5055454/bill-gates-malaria-research-more-important-than-internet-access

<comment><AUTHOR> "The world is not flat and PCs are not, in the hierarchy of human needs, in the first five rungs"

Best Bill Gates quote I've heard.</comment>


Protecting a Laptop from Simple and Sophisticated Attacks - mike-cardwell https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks

<comment><AUTHOR> All that seems like a big hassle. Why not just put the files that you are most concerned about on an encrypted USB stick?</comment>


Walking Around In Circles: Will People Start Using It Correctly? - <AUTHOR> http://techcrunch.com/2011/06/29/google-plus-circles/

<comment><USER2> Circles is probably its main weapon against Facebook (other than being a great product by itself and being made by Google, for people who don't want to use Facebook).

But so far it doesn't look like Circles is going to be used that much by DEFAULT. This means even if Google+ is successful, it will become almost as _messy_ as Facebook. But I worry this might actually affect its potential success, because as I said, it's one of the main reasons you _would_ switch from Facebook.

Google needs to make it so you WANT to use Circles 80-90% of the time. It shouldn't even take you any thinking. It should be a snap decision, almost automatic. You should want to _intentionally_ make your share public, but the _default_ action of a user should ALMOST ALWAYS be to use the Circles.

Right now that doesn't seem to be the case. The default action of users seems to be to make things public. I don't think this is a user issue, because users don't really decide anything about it. They just do it. So it's a Circles design issue. They should _just do it_ by using Circles, not by broadcasting to everyone.

Google, I strongly believe this is VITAL for Google+'s success not only in the mid-term (i.e. beating Facebook), but long term as well (not becoming messy like Facebook, even after it kills it). The Circles idea was the RIGHT IDEA. Now just make sure people actually use it as intended and as promised. Otherwise it's just a useless bullet point in Google+'s feature list.

Get it right, Google, before the service becomes public!

</comment><comment><AUTHOR> i guess TC read HN ;)

i wrote yesterday that it might be hard / dull to admin circles

and that it should not _mimic_ the real world

<http://news.ycombinator.com/item?id=2706410></comment>


It's Time To Reinvent The Signature Page - <AUTHOR> http://www.feld.com/wp/archives/2010/08/its-time-to-reinvent-the-signature-page.html <comment><AUTHOR> For reference, the recommended solutions (in order of votes in the comments are:

<http://echosign.com>

<http://rightsignature.com>

<http://zosh.com>

<comment><USER2> <http://www.docusign.com/> was also mentioned</comment></comment>


Half of all JavaScript npm packages could have been hacked via weak credentials - <AUTHOR> https://www.bleepingcomputer.com/news/security/52-percent-of-all-javascript-npm-packages-could-have-been-hacked-via-weak-credentials/ <comment><USER2> The npm ecosystem is fundamentally insecure. Some highlights:

* I obtained accounts of 4 users from the top-20 list.

* One of those 4 users set their password back to the leaked one shortly after it was reset.

* 13 users [that I found the password for] had more than 50 million downloads/month.

* One of the users directly controlling more than 20 million downloads/month chose to improve their previously revoked leaked password by adding a ! to it at the end.

* While Skovoroda discovered credentials that granted him direct publish access to only 13% of npm packages, through dependencies, an attacker would have been able to spread his malicious code to about 52% of the entire npm ecosystem.

There is no bandaid to fix this structural issue.

<comment><USER3> I don't see how any of these reasons are why npm is "fundamentally insecure" any more than any other system involving humans.

<comment><USER4> The npm community has a longstanding habit of depending on dynamic version numbers, eg "^1.2.3". Until the recent advent of package-lock.json, normal builds would pull in "whatever was latest"; any compromised upstream dependency would automatically propagate downstream as fast as their CI systems run. Also, builds are pretty much irreproducible.

The maven world, by contrast, is habituated to fixed version numbers for dependencies. A fake release might affect folks downstream that explicitly choose the upgrade, but it won't be automatic.

package-lock.json helps solve the technical problem, but the JS community still has a cultural problem because JS packages are typically fine-grained, released frequently, and upgraded without much thought.

<comment><USER5> package-lock.json doesn't do anything for security unless you're going to walk the upgrades of each transitive dependency before you run `npm upgrade` (since each dependency can run arbitrary code while installing). So I wouldn't say it solves any of the security issues, just gives you a commitable snapshot of your deps.

One of the many things the npmjs.com website needs to do is provide a code viewer for each version of a package. It's a bit annoying that you have to unpack a tarball just to see the code you're going to be running if you install it. Right now everyone just takes for granted that if a NPM package links to a Github repo, that that's the code you're going to be executing.

Nothing is going to solve the explosion of transitive deps though without some sort of cultural change. I don't see that ever happening. I do like the ecosystem of tiny libraries but it's too large of a trade-off for security sensitive applications imo.

</comment></comment></comment></comment><comment><USER6> It's amazing that Node.js comes with a package manager that is not fully open source and is entirely controlled by a private corporation

NPM has some serious issues and unlike node itself we can't fix them because we don't have access to all of the source code.

Npm decided to auto close most of issues raised by its users in Github without addressing them. Many of those bugs still exist, even in the latest version.

It's a shame that the community of all those awesome package maintainers is being monetized by a corporation that is mostly dysfunctional and incompetent.

</comment><comment><USER7> worth mentioning, since this article npm has released two-factor authentication \o/

[http://blog.npmjs.org/post/166039777883/protect-your-npm- acc...](http://blog.npmjs.org/post/166039777883/protect-your-npm-account-with- two-factor)

make sure you turn it on.

<comment><USER8> The problem with measures such as 2FA is that they are voluntarily implemented only by users who are most concerned about security, whereas users setting their password to "password" are on the opposite end of the spectrum.

What we really need is (1) 2FA and other enhanced security measures and (2) the ability to exclude all packages from a project, whether imported directly or indirectly, that do not abide with a minimum level of security.

<comment><USER9> I like the direction you're heading with this, as it touches on supply-chain issues that have most folks just throwing their hands up. What would be most interesting is a standard framework for expressing a security policy combined with some hooks in the build tooling.

I also wonder whether it would be appropriate for the repositories themselves to hold maintainers to a minimum standard as well as their own claims. E.g., package maintainers must set a >12 character password and employ 2fa.

In reality, this isn't just an NPM issue. I suspect that similar issues plague just about every package management framework, App Store, or CDN out there. Having a couple of standardized approaches would enable developers who care to automate checks and start to generate new incentives for the folks that are publishing their work to follow some basic standards.

</comment></comment></comment><comment><USER10> We're building everything on quicksand. I'm constantly amazed anything ever works.

<comment><USER11> Heheh, welcome to JavaScript kid! Hold on tight!

<comment><USER12> For those of us building anything that processes information with any level of sensitivity, it's not so funny. It's almost impossible to verify the integrity of JS dependencies.

I've had to adopt a policy of ignoring anything but the most carefully curated and dependency-minimised JS packages, and to avoid the language in general except when it can't be generally circumvented (i.e. in the browser).

<comment><USER13> And people think I'm crazy for keeping track of dependencies via SCM. Many packages now a day is compile to JS, eg they have 100,000 build dependencies, but all you need is actually just two or thee files, the rest can be deleted.

</comment></comment></comment></comment><comment><USER13> I think key based authorization should work great in NPM. Why are they not using keys ? Passwords should only be used to unlock keys.

</comment><comment><USER14> So, why is it they're not using certificates?

<comment><USER15> I can imagine this would lead to a rash of certificates committed to repositories on GitHub.

<comment><USER14> My bad - I said certificates when I meant public key crypto. They would only check in a public key.

</comment></comment></comment><comment><USER16> Is this even a problem with a lockfile?

I mean even if an account is high jacked the packages must conform to a hash.

</comment><comment><USER17> Obligatory HN reminder that the NPM system is crap and you shouldn't be using it.

<comment><USER18> Please don't post like this; it breaks the site guidelines and discredits both your point and you.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

This applies regardless of whether your underlying view is correct.

<comment><USER17> I'm sorry.

I should have said that NPM is fundamentally and essentially flawed, and that HN readers should not use it, favoring alternatives like Yarn instead.

<comment><USER19> Isn't yarn also accessing npm repos? Also, in 99.9% of the cases yarn is installed through npm.</comment></comment></comment></comment>


Ask HN: What tech stack do you use for quick web side projects? - <AUTHOR> <comment><USER2> This is as "quick" as side projects go: [https://crushentropy.com/](https://crushentropy.com/) (Markdown for hi-res planning). I made it one weekend a couple years ago and I've used it myself ever since.

App served by Flask running on App Engine. Data persisted to Firebase. Costs me approximately $0 per month. 100% uptime afaik.

<comment><USER3> This is cool! Did you document the format or is it really limited to what we see on the front page?

<comment><USER2> Thanks. I'll expand on it. In the meantime perhaps try out the demo. That'll give you step by step examples.

</comment></comment></comment><comment><USER3> Flask (Python) for super simple stuff with no db (I have a custom ldap user and groups manager for example) with semantic ui frontend and crude html. Ktor in kotlin for any API thing that needs to last. Spring boot in kotlin for stuff that require auth and db with vue.js in front using type script. (Makes developing one week viable products doable)

</comment><comment> j-rom Heroku is my go-to for spinning up a quick stack with minimal effort. Their free-tier is pretty powerful. It's mainly for POC-type work so if you're trying to launch something into production, you will most likely need to switch to a paid plan or a different platform / solution.

</comment><comment><USER4> React + Firebase (auth and DB) + whatever minimal CSS I run across.

None of my personal projects get used much so none of the costs of Firebase really come into play for me.

</comment><comment><USER5> JavaScript (vanilla or Angular), Bootstrap, GitHub Pages.

</comment><comment><USER6> rails

<comment><USER7> A few weeks ago I had a bunch of data I needed to be able to play around with. I'm not great at Excel but I spun up a quick app in Rails and fed the data into a local Postgres db and played around with it there very easily. Didn't need auth or CSS or JS or anything but just out of the box Rails. The scaffold pages were more than enough for the data I was playing with. All in all it took maybe 15 minutes to get everything set up and configured.

I sometimes use Flask for the same thing but I end up having to write my own HTML and CSS and routes and... Rails just takes care of all of that. I find it faster by a huge margin.</comment></comment>


Liberating My Neopets Data Through a GDPR Data Retrieval Request - <AUTHOR> https://www.alexwennerberg.com/2019/05/04/gdpr-neopets <comment><USER2> I wonder how many honest GDPR responses actually indicate that....no actually that company doesn't have much data on you.</comment>


Ask HN: Programmers, Does it makes sense to write a tech blog? - <AUTHOR> I am a freelance programmer. I wonder if it makes sense to promote myself by writing a tech blog. What are your experiences? <comment><USER2> I'm a freelance software tester and blog about software testing. I'm building an audience slowly so I would definitely recommend doing it.

I think people are more receptive to working with you if they can see you know what you're talking about. [http://kevintuck.co.uk](http://kevintuck.co.uk)</comment>


Goodness of micro frameworks and libraries - <AUTHOR> http://blog.markwatson.com/2013/02/goodness-of-micro-frameworks-and.html

<comment><USER2> When i started Kaya.gs i drove away from Rails by a similar logic. Rails is quite heavy and abstracts a lot of what is going on, and comes bundled with many things you may not use.

I used Cuba for Kaya and i can safely say I understand the entire stack of the application. For a long term learning of web developing, i strongly suggest fiddling with a micro-framework to get a deeper understanding of everything.

However, now with a much larger understanding, i was annoyed at the process of making things again or tediously , which frameworks already solve. I.E. , simple crud views, user authentication, etc.</comment>


Principles of Software Emulation (a visual intro to the theory and practice) - <AUTHOR> http://bertolami.com/index.php?engine=portfolio&content=paperwork&detail=principles-of-software-emulation <comment><USER2> Neat and comprehensive. I've always been fascinated by emulation but had trouble finding the time to get started. Always wondered why universities never seem to offer courses on this.</comment>


StackRocket launches beta to help developers build virtualized dev environments - <AUTHOR> https://www.stackrocket.com/

<comment><USER2> Yay! I've had this pain for years now, I'm glad someone is finally addressing it. You need a lot more features (the most important being a decent IDE or editor integration with either emacs or something) before I'll use it, but, I'll definitely keep an eye on the project.

<comment><USER3> Thanks for the comments. What kind of IDE integration are you thinking about?

The editing portion is easily handled: since your code lives locally, you could be using any editor or IDE of your choosing.

Were you thinking about automated app restarts? What else?

</comment></comment><comment><USER4> How is it different from <http://vagrantup.com/> \-- Seems to have more features/support for chef/puppet?

<comment><USER3> It is similar to vagrant, but stackrocket adds more features, such as a hosted component as well as supported software stacks.

</comment></comment><comment><AUTHOR> Howdy HN users, right now we have Rails, Django and PHP stacks available. We'll be adding more stacks in coming weeks.

<comment><USER5> It wasn't clear to me from the video, are those stacks preset or can I specify Rails 2.8, MySQL 5.2, and so on?

<comment><AUTHOR> Right now stacks are set based on preference, compatibility to cloud providers, etc

</comment></comment></comment><comment><USER6> I don't see any information about how to run these stacks locally -- are they something I can run using virtualbox?

<comment><AUTHOR> Yes, once you installed virtualbox and our command line tool, stkr, a virtual machine will be downloaded automatically and a stack of your choice will be set up locally.

Visit getting started page <https://www.stackrocket.com/docs/getting_started> or ping me if you have more questions.

<comment><USER6> Ahh, thanks you!

</comment></comment></comment><comment><USER7> Which Clouds/Providers can you push a "stack" to? If I am using the correct terminology...

<comment><USER3> For now: heroku and dotcloud

<comment><USER8> what about PHP Frog for the php/mysql stack?

</comment></comment></comment><comment><USER9> Signed up then got to the getting started and saw it requires MacOS. Doh. Oh well.

<comment><USER3> We are starting out with MacOS X only, but will add more hosts later. What are you running?

<comment><USER10> I switch between Mac & PC... having both would be sweet.

</comment></comment></comment><comment><USER11> Someone's squatting on our name (picplum) -- any way to relinquish?

<comment><AUTHOR> Looks to me that the name is not taken. Do you want to try again and ping me if you have any problems?

<comment><USER11> working now, thanks

</comment></comment></comment><comment><USER12> Any particular reason for Ubuntu 10.04 vs any other os?

<comment><USER3> We needed a distro to start. It was due to familiarity, but it could be any other distro

</comment></comment><comment><USER13> Looks awesome, guys! Congratulations on the launch!

<comment><USER3> Thank you!</comment></comment>


I Do Not Want Your Stupid App - <AUTHOR> http://techcrunch.com/2015/10/03/with-apologies-to-theodor-geisel/ <comment><USER2> Ironically, TechCrunch, the publisher of this amusing rant, has an app:

[https://play.google.com/store/apps/details?id=com.aol.mobile...](https://play.google.com/store/apps/details?id=com.aol.mobile.techcrunch)

[https://itunes.apple.com/gb/app/techcrunch/id526058642?mt=8](https://itunes.apple.com/gb/app/techcrunch/id526058642?mt=8)

<comment><USER3> TechCrunch, in fairness, doesn't beg the user to download the app.

<comment><USER4> Also: Just because the publishing media has one of _those_ apps, it doesn't mean that one of their writers can't express his dislike for those apps. If anything it proves that he has a certain independence from the business facing side and that's always good.

</comment></comment></comment><comment><USER5> > _Redecentralize the web!_

Redecentralize all internet services!

Shameless plug ahead, I believe in this idea so much I co-founded a company to help spread the idea and see it through.

Every person should have their own domain name and have the ability to run arbitrary services in the cloud. The price of computing power and bandwidth has come down so much that it's completely practical to do this now.

Would love feedback/thoughts: [https://portal.cloud?invite=hn](https://portal.cloud?invite=hn) (invite code is just there so free domain discount is applied).

The most important thing is that no company (including mine) should ever have the ability to dominate the internet the way Google, Facebook, and Twitter do today.

We should be able to move from cloud provider to cloud provider with very little friction. If we truly control our own domain names, apps, and data this isn't even hard to do.

Google, Facebook, and Twitter could be just apps we run (webmail, web search, photo sharing, status updates). We shouldn't have to give up our privacy and be locked into a service that feeds us a hundred ads a day just to be able to check our email, search the web, share photos, or post 140 characters to the web.

<comment><USER6> I like the headline! I was initially intrigued because I just started a side project, bought the domain, and set up Google Apps for email. Then I'll probably set up a Medium blog for the project. I thought "oh neat, it's all contained in here, and a free domain that's cool!" Then I saw the price point: $8/mo. Yeah sorry, you need to be more competitive for groups that only want a few services. Google Apps is $5/mo and Medium is free...is it worth an extra $3/mo for me to decentralize project/business type emails and documents? Not really, because I don't have any sensitive documents that I don't care for Google to have access to. Maybe if I were a journalist starting a secretive blog and needing to communicate between journalists over sensitive information - yeah, I could see that.

I think those are the kinds of people you're going to want to market to. Reasonably priced for sensitive documents and files, but more than conventional app solutions who don't really need the extra decentralized security.

<comment><USER7> I think I must be misunderstanding.

You talk about "decentralizing" but you mention Google Apps for e-mail and Medium for a blog. If you want to decentralize, you should be running these things on your own server(s) that you control.

What am I missing?

<comment><USER8> I think acconrad is just saying:

Decentralized is for sensitive things with a need for "extra decentralized security," and that most conventional needs can be met more adequately, and cheaply, with the services 'everyone' already uses.

Basically, it's a philosophical difference, but the ideas expressed may give proponents of decentralization some insight into why we are currently in another centralizing phase of the internet.

</comment></comment></comment></comment><comment><USER9> But how else can these sites get access to your contact list and call history?

<comment><USER10> Require Facebook login - close enough.

</comment></comment><comment><USER11> See, I agree, but this is what this article looks like on my phone: [https://imgur.com/VqchKIp](https://imgur.com/VqchKIp)

Perhaps one should become a good example of an enjoyable mobile experience before one starts throwing stones.

<comment><USER12> Installing an app for everything is not what I call an enjoyable mobile experience...

<comment><USER11> Sorry, not sure if I was clear. What I meant was: Techcrunch shouldn't proudly point out that everyone else is making reading on a mobile device unenjoyable by asking if you want to install an app, because they themselves crap so much non-content on your screen and make their own mobile experience an unenjoyable one.

</comment></comment></comment><comment><USER13> Maybe get a windows phone or something if you want to surf the web and not have to worry about installing any apps...

<comment><USER14> Or just use ad blockers to block app download notifications on the website

<comment><USER15> But then poor publishers might be forced to abandon their terrible ways! How undemocratic of you to suggest that! ;-)

</comment></comment></comment><comment><USER16> This is why I'm super bullish on The Information ([https://www.theinformation.com](https://www.theinformation.com)).

</comment><comment><USER17> I always thought: "Well, those apps, I don't know. I don't use webapps on the pc anymore, because the browser does everyting. And some day, the mobile browser will be just as good and no one will need those apps."

That was before peope discovered mobile ads, access to phonebook/email etc pp.

Maybe it'll change.

</comment><comment><AUTHOR> Apps are only popular because we don't do mobile web good enough. Most of the mobile web is either a banner asking download the app, or tons of adds with no room for content.

<comment><USER18> Mobile web doesn't come anywhere close to replicating the fluidity and functionality of a native app and it never will. Running a dedicated application designed for the system will always beat an application designed for the system on top of the system (web browser). I prefer native applications every time.

<comment><USER19> Yeah, but maybe I just want to, you know, read an article and not _replicate the fluidity and functionality of a native app._ Reading articles worked just fine with NCSA Mosaic, I promise it works fine mith Mobile Safari too.

<comment><USER18> OP's argument was that mobile apps are only popular because the mobile web is not good enough. Obviously when the mobile web is used for it's original intent -- pages of information, mostly text, some images -- and not full web applications with heavy JavaScript dependencies and animation and share buttons and shit, it's a pleasure to use.

</comment></comment></comment></comment><comment><USER20> Email subscription popups ...those are annoying</comment>


Announcing General Availability of GPUS for Google Cloud Machine Learning Engine - <AUTHOR> https://cloud.google.com/blog/big-data/2017/05/announcing-general-availability-of-gpus-for-cloud-machine-learning-engine?hl=sr <comment><AUTHOR> It's just a press release but I've been using them for a while, and it is quite not very to watch a model training or hyperparameter search scale effortlessly over multiple GPUs. It _almost_ makes up for the royal pain in the arse of having to rewrite your code to fit in the newish APIs required by cloud ML engine. Almost.</comment>


What is the most reliable Hard Drive Brand/Model - <AUTHOR>

I had some hard drive issues over the weekend and am in the market for a new drive for my server(24/7 use).
these are my current drives:
WD 250GB WD2000BB-00GUA0 @ 19700 hrs Still running
Seagate Barracuda 200GB ST3200822AS @ 3000 hr Still running
Seagate Barracuda 250GB ST3250623A @ 6200 hr works intermittenly/seek error/
Seagate Barracuda 250GB ST3250623A @ ~5400 hr dead as a door nail
Hitachi 2TB JK1101YBJESBXF  @ 100 hr brand new & still working
--
What are your best and worst experiences with what hard drives? <comment><USER2> Each manufacturer seems to oscillate between building a very good drive and then finding out how far they can cut corners before inadvertently releasing a disastrous production run with huge quality issues. Seagate is the most recent to bottom out with their 1-1.5 TB drives.

[http://www.tomshardware.com/news/seagate-7200.11-failing,684...](http://www.tomshardware.com/news/seagate-7200.11-failing,6844.html)

My advice, check Toms Hardware. They're usually on top of things.

A trick I've learned is to follow the big name server manufacturers. If IBM puts a certain hitatchi model in eseries servers, its a good bet that this is a decent drive. The downside is that these drives are going to be far behind the curve as far as the latest-biggest capacity goes.

Never buy the latest, just released supercapacity drive at Best Buy. This is how they work out the problems before selling them into the "serious" markets.

<comment><AUTHOR> Thanks for the pointers,

Ive been looking into WD raptor drives, I dont really need much space. Itll only be my root&home partition so a 150-300gb drive will do. Even though i havnt had the best experiences with Seagate, i was also looking at the Constellation ES drives, which seem to promise high reliability, but after consulting newegg reviews i decided otherwise.

<comment><USER3> Why not get an Intel SSD 160GB? The majority of my hard drives died due to mechanical failure.

<comment><AUTHOR> hmm those are ~425$, for that kind of money I could raid a bunch of regular drives =/

<comment><USER3> You said reliable; not cheap :) A SSD should outperform regular drives in RAID anyway.

<comment><AUTHOR> True, maybe i should have mentioned that im a average college student and thats != $$$</comment></comment></comment></comment></comment></comment>


"The House of God," a Book as Sexist as It Was Influential, Gets a Sequel - <AUTHOR> <comment><USER2> The submission URL got messed up somehow. I think you probably mean for it to go here: [https://www.newyorker.com/books/under-review/the-house-of- go...](https://www.newyorker.com/books/under-review/the-house-of-god-a-book- as-sexist-as-it-was-influential-gets-a-sequel).

<comment><AUTHOR> Yes, thank you for pointing it out.</comment></comment>