When Microsoft Threatened to Sue Us Over the Letter "E" - <AUTHOR> http://steveblank.com/2012/08/20/when-microsoft-sued-us-over-the-letter-e/ <comment><USER2> Standard operating procedure.

Everyone knows that if you don't try to protect your trademark, you end up losing it.

The logos are somewhat similar, and I'm also not surprised that nothing came of this.

The "threat to sue over the letter 'e'" is an exaggeration to get pageviews, and this article should be deleted.

<comment><USER3> Title should be "threat to sue over the letter 'e', with arrow above it. Game changer!

<comment><USER4> I don't know. IE's logo certainly doesn't have an arrow above it.

</comment></comment></comment><comment><USER5> "somehow had saved what he claims was my response to Microsoft's legal threat and sent it me."

While I understand how the response was many years ago, I fail to see how someone couldn't verify a letter that they wrote (it tends to be easy at least to know your style of writing and it's hard to believe he wouldn't remember writing to Gates about this). And what was the form of this letter (a printout of an old email, a copy of a physical letter, something hand written)? Certainly Doug didn't verbally remind him. There must have been something physical to look at.

His letter by the way is naive with respect to trademark law. Microsoft most likely wasn't objecting to the "e" but the stylized element above the "e". Steve's letter addresses only the "E".

</comment><comment><USER6> This is a great example of standing up for yourself while emphasizing the mutual interest of both parties. As this letter helps demonstrate, sometimes reacting with humor and kindness is the best way to deal posturing.

<comment><USER5> "reacting with humor"

Well first this was a letter allegedly (Blank doesn't fully verify, he says, "he claimed was my response" which as I pointed out in my other post is a little strange) sent to Gates and the use of humor is somewhat patronizing. Not the mention the fact that if you are hoping for Gates to call off his legal dogs (and once again I don't know the relationship between Gates and Blank) using humor could very well not be the correct way to do it. Because it make someone (probably not Gates of course) feel stupid.

Let's say for example a well know internet industry person decides to write to PG about something going on at a company that he just picked for a YC class. PG thinks his organization is picking winners. And now you write him a letter essentially saying "the children you put in charge at Babbozify are ..." (and insert something you think shows they have no clue). How is PG going to feel? How would the average person feel about this? People don't want to be told people they put trust in are doing stupid things. And if you do this you have to be very careful to show concern and not be belittling.

<comment><USER6> I think you missed two key words in my comment:"sometimes" and "reacting". I didn't say it worked for every situation (see word #1). Your counter example isn't relevant to what I was stating either since it wasn't a response to an empty threat (see word #2).

</comment></comment></comment><comment><USER7> I would be far more interested in reading the original Microsoft legal letter to E.piphany and the detail of the claim.

I highly doubt it was over just a letter...

</comment><comment><USER8> Reminds me of of the description of Abraham Lincoln in How to Win Friends, although I guess here Steve wasn't the one that decided not sent the letter - it seems like it was a wise choice either way!

For those that haven't read, a good description: <http://www.lettersneversent.com/pages/about/index.php>

</comment><comment><USER9> <http://en.wikipedia.org/wiki/A_Void>

Fortunately Georges Perec had already prepared a book that would circumvent Microsoft's claim on the letter E.

I imagine the inherent daftness of the situation became apparent and the Microsofties just forgot about the case...

</comment><comment><USER10> Has he told the story behind the dot? Better than this story IMHO.</comment>


Why Crowdfunding Changes Everything Part 2 - <AUTHOR> http://unreasonable.is/opinion/why-crowdfunding-changes-everything-part-2/ <comment><AUTHOR> There's 5 parts total, but the others are not really HN-worthy, IMO.</comment>


Engineering Security Through Uber's Custom Email IDS - <AUTHOR> https://eng.uber.com/custom-email-ids/ <comment><USER2> The article doesn't mention any of the current, state-of-the-art solutions, nor does it tell why they aren't satisfying. I would have expected a lot of competitors in this area.</comment>


No consensus in exactly-once - <AUTHOR> https://fpj.me/2017/07/04/no-consensus-in-exactly-once/ <comment><AUTHOR> Flavio discusses what we mean when we say exactly once, breaks down the relationship between FLP, distributed consensus, and exactly once, and debunks the notion that we can't have exactly once (as commonly understood) because of FLP.</comment>


Ask HN: What's it like sifting through remote opportunity applicants? - <AUTHOR> How do you filter through the hundreds of applicants? Is the approach different at all than non-remote jobs? How do you deal with international applicants? <comment><USER2> There's a Beat The Clock aspect—

In seconds you must determine if this person is Hot or Not.

Meaning, can they demonstrate in their application they have the desired skills/experience/other strengths, etc...

Essentially, are they within range of someone I want to spend time interviewing.

I know that GOOD People only pop up their heads up for opportunity occasionally. They will have options in short order. So I must act quickly.

Additionally, I'm competing with other noise in my world. Constant demands for my time. Including, the COVID-19 craziness. Wifey is working at home and I've got school age kiddos. Focused Work time blocks are at a premium.

Location not so important. My chief criteria— is the candidate accessible and responsive.

I've found Top Performers in Mendoza, Tulsa, Kiev, and Melbourne. All of them World Class Pros!</comment>


Apple Park Opens to Employees in April - <AUTHOR> http://www.apple.com/newsroom/2017/02/apple-park-opens-to-employees-in-april.html <comment><USER2> Matthew Roberts (not me) has been posting awesome drone flyover videos of the construction. The video is absolutely stunning and filmed in 4k. Highly recommended.

[https://www.youtube.com/watch?v=gvkh5udzKds](https://www.youtube.com/watch?v=gvkh5udzKds)

<comment><USER3> I'm guessing Segways will be popular there.

<comment><USER4> or bikes

</comment></comment></comment><comment><USER5> Naming the theater after Jobs is a really nice touch. His product introductions are among the most iconic parts of his legacy, and you could always tell just from watching that he took great pride in doing them. A fitting tribute.

</comment><comment><USER6> My only issue is that I bet the center of the building is going to be a complete waste and totally deserted except for employees occasionally taking a shortcut between sides (if the doors are set up to do that). The building is big (I drive by it regularly), but not so big to give the central area any sense of privacy, so when you walk out into it, you're going to sense that 12,000 eyes are watching you. I've been in large central courtyards like that before (in square configurations, of course) and the feeling of being watched is always palpable. Maybe the trees they plant in there will help, but I doubt it.

<comment><USER7> In a building that size and with the California climate being what it is, _everybody_ will take those shortcuts. Also, inside the old Apple campus, I've seen people play frisbee on the lawns during lunch breaks.

This space also is large enough for bootcamp, yoga classes, etc, and enough people will work there to find people willing to take part in such activities.

They could even 'hide' a basketball court inside if they wanted (dig a one feet hole to hold the court; surround it by a 3 foot 'wall' for spectators to hang around on; add trees and shrubs for camouflage, and nobody will see it from inside the building)

</comment></comment><comment><USER8> It's literally a walled garden. Oh the irony.

<comment><USER9> Why is that ironic?

<comment><USER10> Because Apple makes software walled-gardens.

<comment><USER11> Isn't that actually the opposite of "ironic", then?

<comment><USER12> There are multiple kinds of irony; I keep forgetting this isn't something well known.

<comment><USER13> is "wrong" one of those levels

</comment></comment></comment></comment></comment></comment><comment><USER14> Probably I would inevitably think this about any ring-shaped building, but it looks quite a bit like the GCHQ headquarters in Cheltenham.

[https://en.wikipedia.org/wiki/Government_Communications_Head...](https://en.wikipedia.org/wiki/Government_Communications_Headquarters#/media/File:GCHQ- aerial.jpg)

I guess the Apple version is somewhat more slender and (unsurprisingly for Apple?) a bit shinier.

<comment><USER15> Circular buildings have been around for a lot longer then that. The Pentagon is essentially a round building with a grassy area in the middle.

<comment><USER16> > The Pentagon is essentially a round building

I burst out laughing at this comment, because [https://en.wikipedia.org/wiki/Essentialism](https://en.wikipedia.org/wiki/Essentialism)

Aristotle: the essential qualities of an object are those properties that make the thing what it is, without which it would not be that kind of thing

jonwachob91: a pentagon is essentially a circle

Aristotle: u wot m8

<comment><USER17> [https://en.wikipedia.org/wiki/Topology](https://en.wikipedia.org/wiki/Topology)

<comment><USER18> Reducing complex shapes to topology only muddies the discussion. The Pentagon and Apple HQ toruses. Humans are also toruses when you consider the alimentary canal!

<comment><USER19> I would argue that humans are not topologically equivalent to toruses as most humans have many holes beyond the alimentary canal.

<comment><USER20> Is a torus made of swiss cheese not still a torus?

<comment><USER19> ... ... correct.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> You can see it from a nearby hiking trail, Rancho San Antonio. It's really rather stunning.

Also, I really appreciate whichever jurisdiction gave the go ahead and funded the expansion of the on/off ramps on Wolfe/280 (likely Cupertino?). The traffic in the area has become really miserable over the years and I'm hopeful that things are a bit better than the current De Anza Blvd situation.

<comment><USER22> De Anza is nightmare to drive; biking is also a fun adrenaline rush because you have to dodge traffic.

Vallco/Stevens Creek will probably become more congested as a result of the new campus opening.

</comment></comment><comment><USER23> This building seems super wasteful landwise, but I guess it's in the sprawling silicon valley suburbs so no one really expects or cares about compactness or efficiency.

It'll likely be arduous for someone to move from one part of the building to the other, but I suppose Apple employees don't typically need to do this that much.

How long is the walk across the inner square by foot I wonder?

<comment><USER24> It is HUGELY wasteful. The statement "one of the most energy-efficient buildings in the world" is a prime example of obscuring the truth, as well. When considering full-system efficiency this is undoubtedly one of the most wasteful structures in the world. 12000 employees, 14000 parking spaces, and a 1-hour walk to the nearest point of mass tranportation (Lawrence Caltrain, which is poorly served; the more frequently served Sunnyvale Caltrain is a 75-minute walk from this building).

<comment><USER25> There are VTA buses. They come every 30 minutes, and it would take you about 30 minutes to get to the Sunnyvale Caltrain station.

<comment><USER24> As far as I can tell from the schedule the minimum bus trip from this site to Sunnyvale Caltrain is 44 minutes, plus an average 10 minutes for headway. That assumes you did not start off on the east face of the UFO, in which case you should add a walk of up to a mile to get to the VTA stop on Wolfe.

Walking would be just about as fast.

<comment><USER26> Do you really think Apple is going to make their employees walk to the train station? They will obviously have shuttles running

<comment><USER24> That doesn't seem obviously true to me. Google for example doesn't run shuttles to Mountain View Caltrain.

Apple operates door-to-door shuttles to SF and other population centers but that isn't really the point. The point is they have obviously provisioned enough parking to give each and every one of their employees a parking space, with some left over. It's just irresponsible given the traffic situation in the area, and to call it energy efficient is greenwashing.

</comment></comment></comment></comment></comment></comment><comment><USER27> Wait there's _17_ megawatts of solar on this thing? Would love to hear more about how this integrated into the facility. That is an immense PV array.

<comment><USER15> In another comment someone shared a youtube video of a flyover of the facility. It includes a shot of the solar array, it is absolutely amazing

</comment></comment><comment><USER28> Wow, for all of Apple's perfectionism, I'm surprised the distorted reflections on the circular sunshades aren't driving someone bonkers.

<comment><USER29> I saw the same thing and thought "If Steve was here, he'd delay opening 3 months while they replaced those undershade panels".

</comment></comment><comment><USER30> According to Trulia one of the closest houses for sale by this thing is $4.1 Million.

[https://www.trulia.com/for_sale/37.316929278047,37.342590905...](https://www.trulia.com/for_sale/37.316929278047,37.342590905897,-122.02655364826,-121.98535491779_xy/15_zm/)

<comment><USER31> It's multiple parcels that are subdividable, they're selling the property for new development of multiple homes.

</comment></comment><comment><USER32> Building a fancy corporate HQ is often a signal that management has lost touch with the core business.

EDIT: I can easily make the case this has happened at Apple. Look at their iPad lineup, for example. How do I figure out which model to buy? IIRC, this lack of focus on the product line was one of the first things Jobs addressed when he returned to the company in 1997.

This is not to say that Apple isn't one of the most successful businesses ever. It argues against bigness. When you're that successful, you can't (it seems) help but make very expensive decisions rooted in hubris and grandiosity. Imagine what could have been done instead with a $1 billion new building and $4 billion in venture capital, for example.

The US government has the same problem. The amount of wealth captured from the overall economy gives government leaders/lobbyists too much power, and we get the f-35.

</comment><comment><USER33> There's a Steve Jobs Theater but no Steve Wozniak Engineering Complex? Ow.

</comment><comment><USER34> This is so beautiful and inspiring. A real legacy. Imagine a world without Apple computers pushing the envelope. We'd still be using wired mice and ugly black boxes.

If only Steve Jobs had taken the traditional medicine route he would have been with us for another 50 years.

<comment><USER35> As much as Steve gets credit, the real credit goes to the thousands of engineers that were the ones who created the envelope of which to push, and then kept pushing that one as well. Its never one man.

Its unfortunate he chose to not use proven medicine as a treatment, though.

<comment><USER36> Why not quote Steve Jobs? He said it much better.

"Great things in business are never done by one person. They're done by a team of people." Steve Jobs

</comment></comment></comment><comment><USER37> The size of the glass panels struck me as amazing. Then I read, "clad entirely in the world's largest panels of curved glass."

0.0

<comment><USER38> Apple has a lot of practice with large glass panels from their stores.

</comment></comment><comment><USER39> That looks great - and even with that, Apple has SO much cash on hand.

<comment><USER33> ... that they haven't paid taxes on

</comment></comment><comment><USER40> If I could I would work there tomorrow. Sadly I am 3000 miles away and don't work for Apple today (I left a year before Steve came back, my bad).

</comment><comment><USER41> Fun for the people who will work there! The Google campus nearby has an ad-hoc feeling, assembled as existing buildings were purchased (at least when I was a contractor there). It is expensive, but designing a large beautiful campus must be great for employee moral.

<comment><USER42> It was definitely a boon at Blizzard when their new campus opened. Unfortunately, by the time it opened Blizzard had already outgrown it and some departments were left in those ad-hoc nearby buildings.

</comment></comment><comment><USER43> Windex.

<comment><USER44> Buying all the stock I can right now.

</comment></comment><comment><USER45> Considering that Jobs single handedly saved Apple when he returned I would think he would get a bit more of an honor than a theater named after him.

<comment><USER46> What did you have in mind?

<comment><USER20> A 50-foot statue made of gold that shouts criticism at employees as they walk past?

</comment></comment></comment><comment><USER47> my favorite part is the natural ventilation. will need to check up on what larger buildings pull that off

</comment><comment><USER48> Great Newspeak for their Office Building. In this "Office Building" approximately 70% of all the employees' time will be 1) writing emails and 2) having meetings in conference rooms. But instead it is "Apple Park" where work is leisure and being inside working is actually frolicking.

<comment><USER49> I think that's an extrapolation gone too far with the word 'Park'. Another take is that Apple is designing a campus that embraces nature with a wide open space in the middle, accessible equidistantly to everyone.

</comment></comment><comment><USER50> Parts of this should be open to the public. The public has had to endure all of the construction and has lost a large amount of land-space that could have been used for the community. Instead, we have a completely private & inaccessible area. Sure, there are cafes, fitness centers, and working areas within the building but none of it is public and all at the expense of the people who live there.

<comment><USER2> > Parts of this should be open to the public.

Who do you think financed this? Apple consumers and investors (I am one) that's who, not taxpayers. Why should it be open to the public? If it were a government project it would still be under construction for the next 10 years.

> The public has had to endure all of the construction and has lost a large > amount of land-space that could have been used for the community.

Or, in reality, Apple bought the real-estate, and pumped hundreds of millions (actually I just looked it up, it is billions with a B) of dollars into the economy and put scores of construction, engineers, and high skilled people to work building it. This isn't soviet Russia comrade.

<comment><USER51> Nor is this Howard Roark's wet dreams (even if it does also involve architecture). Your points are not unfounded, but I don't think the Godwin's Law-esque strawmaning is helpful here.</comment></comment></comment>


Ask HN: What's that service...? - <AUTHOR>

There's a service I saw once on HN that reminds you to follow up.  You send an email (or BCC) an email to something like 3months@theirdomain and they'll send you an email in 3 months reminding you to follow up.<p>I should have bookmarked it because now I can't remember the name and it's a difficult topic to search on. <comment><USER2> Hey Matt, glad you found it, I thought the name is pretty intuitive right? :) (I'm the founder). Let me know if you have any questions. Thanks.

</comment><comment><AUTHOR> Nevermind. Found it. <http://www.followup.cc>

</comment><comment><USER3> why not just use the calendar in outlook?! or calendar app on any phone :S?!</comment>


How Two Bored 1970s Housewives Helped Create the PC Industry (2015) - <AUTHOR> https://www.fastcompany.com/3047428/how-two-bored-1970s-housewives-helped-create-the-pc-industry <comment><USER2> I love the part where the engineer suggests naming the company "Vector Graphics" because that was what he wanted to build, but never got around to making it.

Kind of a shame the board decided to fight IBM head on instead of adapting to build clones. It seems like they were just enjoying their fat margins a bit too much to want to change, and then it was too late.

<comment><USER3> My recollection is that there was a Vector Graphics in Woodland Hills in the San Fernando Valley around 1972 that was doing something with high-resolution black-and-white video graphics powered by a PDP-8 or something similar. Was that a previous enterprise by any of the same people? Maybe my recollection is in error???

<comment><USER4> Perhaps you are thinking of Vector General, Inc. which is located in Woodland Hills? [1]

[1] [https://companiesmd.com/company/F01641729/vector-general- inc...](https://companiesmd.com/company/F01641729/vector-general-inc.html)

</comment></comment></comment><comment><USER5> Great story, but the ads on this site are super aggressive. Enough so that I didn't finish the story. Pop ups, interstitials, and even redirects to other sites. Fastcompany... seriously? You're blacklisted now.

<comment><USER6> I always forget the "typical" web experience until I use one of my kid's android tablets, but uBlock Origin is truly your friend for sites like this. It makes the web sane again!

<comment><USER7> For their safety and sanity you may want to set up a network-wide ad blocker like Pi-hole [1].

[1]: [https://github.com/pi-hole/pi-hole](https://github.com/pi-hole/pi-hole)

</comment></comment></comment><comment><USER8> Discussed at the time: [https://news.ycombinator.com/item?id=9929333](https://news.ycombinator.com/item?id=9929333)

<comment> mark-r Thanks for digging that up - I made a couple of comments on that thread. I remember Vector Graphics fondly, but I don't remember knowing about their female-dominated management structure. I only knew they made good products.

</comment></comment><comment><USER9> Sounds a lot like the first season of 'Halt and Catch Fire'.

</comment><comment><USER10> Endlessly playing video which follows the main body of text you're trying to read, just to the right of the article. Distracting and with no relation to the content. If you hover over it to show an interface you can hit pause, but then the video restarts as soon as you scroll. It appears to only show once - after a reload the video is not shown - which makes me think it only affects first time visitors. But what a terrible impression to make alongside what is a thoughtfully researched piece.

<comment><USER11> Firefox Focus might be the browser for you.

<comment><USER12> Can I install it on Linux?

<comment><USER13> Yeah - but it's only available for one distro: Android.

<comment><USER14> f-droid and anbox.io to the rescue?</comment></comment></comment></comment></comment>


Go Static or Go Home - <AUTHOR> http://queue.acm.org/detail.cfm?id=2721993 <comment><USER2> "Little Johnny Tables". Um, yes, that was "Little Bobby Tables" [1]. Obviously not a big deal, but it seems emblematic of how sloppy this piece is. The article confuses – seemingly willfully, since Paul Vixie should know better – the concepts of dynamic language, dynamic page generation, lack of proper input hygiene, and various other orthogonal issues. The argument that dynamic languages are less secure depends an awful lot on the language – I don't think anyone is going to buy that C is more secure than Python. Haskell vs Python? Now that's a debate to be had. Certainly, websites that do no dynamic content generation are probably more secure – but then you're stuck with the Internet circa 1993. And of course, nobody is in favor not sanitizing inputs properly.

[1] [http://xkcd.com/327/](http://xkcd.com/327/)

<comment><USER3> Calling any Turing complete language "more secure" is probably nonsense. It is possible to write secure applications in C, and it is possible to directly pipe attacker controlled input to a shell in Haskell.

<comment><USER4> I know a total of zero working security researchers who think C is just as safe as Scala.

The obvious flaw in your example: you can exec a program unsafely in both C and in Scala, but only in C can you do it accidentally simply by _idiomatically_ copying a string from one place to another.

<comment><USER5> FWIW, idiomatically copying a string in C is done using strncpy, and that doesn't introduce any RCE bugs. I would not in my right mind defend the premise that C is just as safe as Scala, but the truth is that sloppy programming can do harm in every language imaginable. It just becomes about damage control.

<comment><USER6> Sorry, if you get the third argument of strncpy wrong, you are right back in the area of trouble.

<comment><USER7> Even when you don't get it wrong (i.e., no out-of-bounds writes), you can still get out-of-bounds reads because strncpy does not always null-terminate strings. C strings suck.

<comment><USER8> To be fair, the real issue here is 'strncpy', whose destination argument does _not_ operate on C strings, despite that it's name starts with 'str'.

<comment><USER4> We can repeat this subthread with examples of UAF bugs, which are equally common, if anyone really wants to get the full flavor of how wrong it is to suggest that C is comparably as safe as Haskell.

<comment><USER8> My post wasn't meant as disagreement on the issue of whether some languages are safer than others. I apologize if this is is how the message was received. I was trying to point out that w.r.t. C strings, using strncpy is almost always the wrong thing to do.

<comment><USER4> Oh, sorry, I didn't mean to sound like I was snarking at you!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm not concerned if a web app or a shopping cart is dynamic. But I see dynamic blogs all the time. Blogs with no comment system, or one that's used infrequently. What's the point of making that dynamic?

While I'm on the subject, can anyone tell me the reasoning behind loading blog content with javascript? I hate when I visit a blog with no script turn on, and get greeted by a blank template. Why does it need javascript to grab the page content?

<comment><USER10> The point of making a blog dynamic is so a non-technical user can easily manage the content via a dashboard. I'm a big fan of static site generators (which is what I presume you're inferring people should use for blogs instead of wordpress et al), but it is silly to think that uploading markdown files to a server is a reasonable workflow for most non-programmers.

As for loading content with javascript -- I totally agree, this bugs the shit out of me. Also, I browse with cookies disabled by default and it is always frustrating when a site that is only serving content doesn't load properly without cookies. wtf?!

<comment><USER9> I'm not advocating static page generators that use markdown. Far from it. I used to use a blog platform called Movable Type. It was just as easy to use as WordPress but it generated static pages. You'd make changes in the back end, click publish, and Movable Type would generate a new static page to serve up.

You can make WordPress generate static pages too. They have plugins for that.

<comment><USER11> Six Apart's MovableType is still around.

[https://movabletype.org](https://movabletype.org)

<comment><USER12> I used MT for years. Versions 4 and 5 had various problems, coincidental with various changes at the parent company, SixApart. (At one time they had three blogging products: Vox, TypePad, and MT.)

I've been searching for a suitable replacement ever since MT 4. I tried to switch to WordPress but hated it. Maybe just preferences, but I've never warmed to WP, in spite of trying each new version that launches.

I see that Byrne Reese, former SixApart employee and co-founder of the MT- based OpenMelody project, is now using Ghost.io for his blog. That's the system I'm testing now as well. (Have used Tumblr in the meantime, with some success.)

</comment></comment></comment></comment></comment><comment><USER13> I've been an evangelist of static sites for a while. With over 15 yrs of experience doing sites I started in static and saw the "dynamic movement" born and grow (at some point I even programmed my own DCMS!); in most cases the motivation to install a DCMS was that the client wanted to update content in- house instead of paying a webmaster (a sound business idea?) but the reality is that even when using a dead simple DCMS clients always find it difficult to run it and still contact the webmaster. Furthermore, the vast majority of sites are seldom or never updated so having the 'kick me' sign in those cases is nosense. I guess a strong selling point of DCMS that made us all buy in even knowing that it was a bad idea where themes and plugins! So many of them, so nice looking, cross-browser tested and so easy to install. Clients where über happy with the end product.

So a couple of years ago I decided to do static sites for ALL my clients (there may be dynamic components that I normally implement with a back-end data service). I still have a few dozen sites and web apps with DCMS but the goal is to migrate them as well.

<comment><USER14> The best mix may be a (hosted) dynamic editor that generates and deploys the static site. Have you considered this solution? It probably won't eliminate the need for a webmaster, but it should help reduce the requests for small changes while keeping the benefits of the static site.

<comment><USER15> I think I tried a blog engine once that did this. Maybe it was [https://movabletype.org/](https://movabletype.org/) ? In any case, I really wish more people/tools employed this strategy.

<comment><USER13> I think more devs will adopt it when we have plugins and themes that can be installed with a click! So far I have been able to adapt HTML themes to a front-end MVC (Angular or Backbone) but it is a long manual process...

</comment></comment></comment></comment><comment><USER16> Ok, I understand that there's reasons for using static pages, but I don't get the feeling this guy really understands what he's talking about.

 _> Even if [..] and there's nothing like bash installed on the same computer as the web server _

Bash installed? Huh? Why Bash exactly? I feel mentioning jails or containers here would be more on point..

 _> This is because every DCMS page view involves running a few tiny bits of software on your web server, rather than just returning the contents of some files that were generated earlier._

Sure, but guess how those pages are returned? By running code on the server..

It seems like hes real beef is with "dynamic" (vs staic) sites, but he keeps mentioning CMS's for some reasons (ike you can't can have "dynamic" sites witjout a cms)

 _> The web server executes no code on behalf of a viewer until that viewer has logged in.._

1) Of course it does, 2) How do the site check your info without executing code? :)

etc etc..

There's a case for static sites, but this post just confuses things.

<comment><USER17> > Ok, I understand that there's reasons for using static pages, but I don't > get the feeling this guy really understands what he's talking about.

I think he might know a little bit: [http://en.wikipedia.org/wiki/Paul_Vixie](http://en.wikipedia.org/wiki/Paul_Vixie)

<comment><USER18> None of the things on that wikipedia page makes me think he actually knows anything about web servers. Sure, he obviously should know about some of the things that make the internet work (BIND, cron, etc) but nothing on there has anything to do with making web sites. All of it is about the infrastructure.

Either this article is filled with intentional hyperbole, or this guy doesn't know what he's talking about when it comes to serving web pages.

<comment><USER4> Ordinarily I'd be bristling at a comment like this, but you are articulating some stuff --- a little rudely, but still --- that I believe about Vixie as well. I won't pretend not to have noticed and let you take all the heat. Paul Vixie's reputation among software security people is a little bit fraught.

</comment></comment></comment></comment><comment><USER19> High traffic and high volume sites driven by CMSes, like newspapers, tv stations, etc., largely cannot rely on static files to deliver their content. Rather, they use caching layers for speed and security. There are two better ways to improve security for sites like these, which are highly targeted and poor candidates for static sites:

1) Use a headless CMS. WordPress on the backend that provides and API which is consumed by a Node app, for example.

2) Shift any user-facing dynamic feature off the CMS. Commenting, login, subscription management, etc., can be handled by purpose-built apps that tie into the CMS-driven site via Javascript, preserving the security and cacheability of the CMS.

That's not to say that it's impossible to drive a large-scale news site with static files. I believe CNN does exactly that with their in-house CMS. But no open-source CMS that generates static files is powerful enough to use in a newsroom context, or popular enough to gain traction.

<comment><USER20> It's simply a matter of inversion. Is the page generation and publication performed upon each change (by editors/authors/etc) or upon each access? Obviously, the former is much more efficient, even for frequent changes, and even across millions of data points. (Just ask Twitter).

Just because we don't really have common, enterprise-grade authoring tools for non-technical people that publish static sites anymore doesn't mean that it's not the better way.

<comment><USER21> Sure we do, it's called caching.

There is a minimal difference between a webserver serving static pages and a caching server serving static content. When you get down to it caching is simply a more flexable approach to the classic (autoring tool) -> static webpage approach. In many ways the only difference is the authoring tool is a website not a stand alone program.

<comment><USER14> Caching is usually done on demand, though, not ahead of time. That means the dynamic portion is still launched by the request, which increases the probability of security flaws being exploited.

<comment><USER20> Exactly.

In other words, some fraction of the requests are responded to dynamically and then the result is cached. That dynamic nature can be exploited. Site search engines, etc, are also often (but not always) dynamic, server-generated results that have a greater likelihood of exploits via XSS, CSRF, SQL Injection, etc. Login forms almost always require server interaction and are great targets.

(I say "almost" because REST interactions might be stateless and thus login forms really just serve to generate an access token and verify that it's working; this is how Userify works, for instance. It's still theoretically more exploitable than pure static files, but it raises the bar quite a bit.)

</comment></comment></comment></comment></comment><comment><USER22> A castle with no gate is also more secure. And kind of useless for its inhabitants. Like being under siege all the time.

My point being, sure you can get a more secure `something` by making it more and more static, but you'll probably cripple it somehow.

It's simply a balance you have to find for your use case.

<comment><USER23> There are castles with no gates.

I think problem is that current dynamic websites are sort of crippled already. Right now even simple shopping app requires UI based on HTML + web. Not a chance to use command line, some automated devices etc... In future we might see radically simplified protocols/webservices for more universal access.

<comment><USER24> I hear what you're saying, but it doesn't have to be so.

All of the web apps I make at work are all javascript in a page apps. But before I start doing any of that, I make a REST API. 100% of the interaction between javascript and the web server is REST.

There are many reasons for this, but a key one is that it allows _easy_ command-line or programatic interaction. Much easier than with traditional, server generated web apps.

<comment><USER25> Same here. Increasingly products I work on do almost no server side templating; frontend templates call REST services that I can test with curl, postman, or other tools.

<comment><USER26> Are there any downsides to this design?

<comment><USER25> Not really, you can achieve this using a Rails (or rails-like thing like Play) very easily and use in their built CSRF, SSL, etc. but this type of design also makes it easy to build from scratch (which may lead you down the path of reinventing things).

SPA + restful endpoints makes it easy to pick a library centric approach vs. a framework approach but it certainly does not preclude you from using a framework.

I guess people who disable javascript don't get to use your site...but I don't really care about that segment of the population.

<comment><USER24> I've also found it easier to secure my apps. The attack surface seems to be much smaller.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> I'd love to see how different people solve the highly dynamic plus static problem.

This usually boils down to the shopping cart and checkout example... you can always attack the checkout process as it is a unique, dynamic part of the process that no web store wishes to ever be unavailable.

How does one "go static" with web applications that by necessity involve interactions with datastores?

<comment> Arcanum-XIII The idea is not that everything need to be static - some contents are by nature updated too fast, or too often, to be static. Still, there's lot of page that could be pre generated since the content of the datastore itself is not evolving a lot. Most blog could use a static blog generator for example, with the comment being the only dynamic part - and a lot of cms page too ! Pre baking stuff is so much easier, faster, and cleaner.

<comment><USER28> True. My personal site is static (generated with Hakyll), and uses Disqus for comments (only because I haven't yet seen a simple, self-hosted alternative which has been battle-tested).

<comment><USER29> I work on a statically generated site in which the comment form simply feeds back into the generation workflow. It's certainly not 'battle tested', but it has the advantage that a) we get to own the comments rather than giving them to someone else b) everyone can partake in the discussion c) much less demand on the client when rendering

</comment></comment></comment></comment><comment><USER30> There was a submission briefly on the front page here where someone was proclaiming security by not using c/c++ for projects, yet, they left their blog comments and site wide open for some idiots who have already tried to post silly comments with JS popups.

I guess maybe we need people to use static sites, like trainer wheels on bikes, until they become more security concious.

<comment><USER28> Security is additive: the more precautions you take, the more secure you'll be. Avoiding C/C++ when safer, higher-level languages could be used is one example. Escaping Web site comments is another. Doing both is best, but either on its own is still better than neither.

Becoming "security concious"[sic] doesn't mean outgrowing best practices. If Bruce Schneier used "password" as his password, he wouldn't avoid getting attacked just because he _knew_ it was a bad practice. Likewise, understanding the tradeoffs between static and dynamic Web sites doesn't make someone's dynamic site secure.

As the article points out, even a locked-down, well-tuned dynamic site with CAPTCHA-protected registration forms is orders of magnitude easier to bring down with DDoS attacks, since dynamic sites must perform more work per request, eg. to render "Hello CaptchaFarmUser99999" at the top of the page. If they _don 't_ need to perform more work per request, since all pages are always fully cached, then you've just re-invented static sites :)

</comment></comment><comment><USER31> Startup idea, free for the taking: create a service that "ossifies" dynamic websites into static HTML.

(By ossify, I mean to take something dynamic and make it static).

For example, that WordPress site you commissioned for a movie 3 years ago? Its a huge liability, but you don't have to take it offline - just ossify it. No one is updating that blog anymore!

Under the hood, it would basically be a crawler, and the deliverable would be a zip file containing a 1-to-1, static copy of their website with all URLs still working. I suspect most folks here could whip up a shitty proof of concept in 48 hours.

If someone does this, email me! I have a couple of potential clients for you (I'm a former consultant, with lots of WordPress sites in my history).

<comment><USER32> This is already a product that exists many times over. Besides the aforementioned wget, I've recommended less technical users to SiteSucker, a Mac/iOS app.

I'd be happy to bill your clients to do it for them though!

<comment><USER31> Here's the thing: they don't want to run SiteSucker. That's only slightly more helpful than telling them to just run wget!

They want to write a check and get back to business, not become a web developer!

(I think that tool is awesome though, and I appreciate the tip!)

</comment></comment></comment><comment><USER33> And there we have it. Security needs stability, stability decreases on a daily basis. We can't have that traditional kind of security. We need to move on to a more proactive way of thinking.

</comment><comment><USER34> Static site is more secure only if the server is also up-to-date and setup properly to trim down all unnecessary options. Putting static site on a general purpose apache installation that will happily serve PHP and CGIs from user home dirs is not such a big security improvement.

</comment><comment><USER35> Also, in times of SPAs, LocalStorage, WebRTC, Parse and FireBase you can sprinkle your static web-sites with some dynamic functionality, when needed...

</comment><comment><USER36> Noob qn:how does custom search work on static sites? May not be the best approach, but a simple SQL query would do the trick for dynamic sites.

<comment><USER37> I used Google Site Search ([https://www.google.com/work/search/products/gss.html](https://www.google.com/work/search/products/gss.html)), which starts at $100 per year. Outsource all that infrastructure to a company who's good at it, park your static HTML on a CDN, and enjoy fast worldwide access with searchable content.

That's not the only option, but it's a boss-friendly company to name drop. Most organizations wouldn't blink at the price, especially if it means you can move off dynamic hosting to far cheaper static hosting.

</comment></comment><comment><USER38> I'm going to say that the bigger problem in dynamic languages isn't that they are dynamic. It's that they have weak, nonexistant, or very undeveloped mechanisms for creating strong communication protocols that you can depend on as safe or reliable.

Take the classic case of SQL injection. You have string input into your system that turns into string input into a SQL query that turns into string input to a database. That is dangerous because if you don't check on what the input string contains, it might contain nothing, or a semicolon, or it might not be a string at all!

We understand that putting a string direct into a SQL statement is dangerous at this point, but we have yet to fix its root cause - nonexistant protocols or boundaries in most code we write.

What a static language changes in that regard is compiler checked type signatures on your code. That generally stops you from say passing an Integer into something that needs a String. That solves a certain class of problems for sure, and the complier does it for you every time you change your code, so there is a convenience there.

What static typing doesn't give you is actual data correctness. Things like buffer overflows or SQL injection can still happen with static typing. You could use a language like Scala or Haskell to have stronger/more complex types that would have more distinct notion of value correctness and at that point the complier would be doing most of the work to ensure your program is correct.

Leaning on a type system in that regard is basically turning your types into the protocols that determine correctness in your system.

It is also possible to lean on stronger protocols that check messages in a dynamic languages to achieve largely the same thing.

In the end, to write safe, high quality software, you need to define the communication protocols between methods/functions/routines/services and enforce them much as you would with an externally facing REST api.

The difference between a dynamic system with dynamic protocol checking vs a static system with compiler type checking is the mechanism you are using to enforce the protocol and how easy it is to interact with it.

Dynamic systems might be easier to interface with externally because you don't have to understand a complex type, just pass a Hash/Dictionary sort of like a JSON API, vs a static system where you need to use the right types and so on, similar to a SOAP/WSDL API.

Performance is also a consideration, but really when you compare static vs dynamic, it is important to understand that at the end of the day you can write Ruby/Python/PHP that is functionally equivalent to C/C++/Java. They are all ultimately going to be able to do the same kinds of things.

The tradeoff is in how they solve the problem and how well that fits with the team writing the software.

</comment><comment><USER39> Interesting. Also if you are interested read [http://programmers.stackexchange.com/questions/206558/why- do...](http://programmers.stackexchange.com/questions/206558/why-does-the-us- government-disallow-dynamic-languages-for-secure-projects)

<comment><USER40> Did you read the article? It's about static vs. dynamic site generation. It mentions eval() in a passing, but it's not about dynamic vs. static typing.</comment></comment>


My Co-founder is Just Not That Into Us - <AUTHOR> http://www.undertheradarblog.com/wp_blog.html?fb_2042860_anch=4751617

<comment><USER2> Your link floated away. Try this one:

[http://www.undertheradarblog.com/wp_blog.html?fb_2042860_anc...](http://www.undertheradarblog.com/wp_blog.html?fb_2042860_anch=4752510)</comment>


Ask HN: What do you think about piracy-thwarting measures in software? - <AUTHOR>

There's an undeniable trade-off between the efficacy of protection, the time it takes to implement, and the impact it has on its users. You can create an absolutely piracy-proof system by installing your software on one computer, and having your customers each take turns flying to and using that computer as if it were some cheap carnival ride... or you can take the alternate approach by investing absolutely nothing in piracy-thwarting measures and relying on the honesty of your users to generate income.
What have you found is the best way to balance these factors? To what degree does the honesty and integrity of your market affect these factors? Is it even fair to make assumptions as to their honesty and integrity?
What I typically do in programs is provide a single authorization code that unlocks the program. It's something that can easily be cracked, but I do auth checks in pretty obscure areas of the program; it'd take at least an hour or two for a pro to crack. I also do some tricks with by adding "useless" instructions to the compiled form to create a de facto signature for each copy of the program that's downloaded. That way, if a copy leaks, I have at least some idea as to the origin of the leak. <comment><USER2> Generally speaking, I think users are better served by uncrippled products. Preferably open source. All the time spent building copy protection, is time NOT spent on useful features, tech support or bug-fixes.

But I'm a free software zealot and my own startup is not cash-flow positive yet, so what do I know? ;-)

<comment><AUTHOR> There's something to be learned from that model, as well. What makes users want to pay for something instead of use a free/open alternative? From my experience, it's ease of use.

Users don't want to waste time, so they try to find the quickest way to the solution. It's immaterial whether that means pirating software instead of going through the hurdles of purchasing and registering it or buying software with free/open alternatives with a higher learning curve. It seems like the most important factor is the time it takes to solve a problem.

<comment><USER2> I think generally people want solutions to whatever problems they have (boredom may be considered a problem, thus paying for entertainment).

How acute and urgent the problems are determines what people are willing to pay - whether they pay with money or with time invested depends on their situation. So yes, people trade money for the luxury of not having to learn how to use a complicated FOSS tool.

But note that as a business, your revenue in this case doesn't depend on lock- in, it depends on making things easier. You could in many cases distribute your stuff under the GPL (to your customers only, nobody says you have to distribute it to everyone) and still keep the same customers.

Making your product worse through anti-features like DRM and copy protection ultimately just gives any competition a clear opportunity to be obviously better than you by simply _not doing work_. If you have no competition or your product is vastly superior to the alternatives, then anti-features may help you extract more money out of your existing customers, in the short term. But they're not going to like you for it and clever consumers will avoid you entirely because they don't want to be locked in.

On the other hand, if you are an underdog with limited resources, I'd wager you'd usually be far better off spending the time/money on marketing and giving your customers what they want, than on implementing copy protection at all.</comment></comment></comment>


Imperial mathematician scoops $3M Breakthrough Prize - <AUTHOR> https://www.imperial.ac.uk/news/203853/imperial-mathematician-scoops-3m-breakthrough-prize/ <comment><USER2> There is a 2014 Quanta Magazine article on Martin Hairer which I found interesting.

[https://www.quantamagazine.org/hearing-music-in-noise- martin...](https://www.quantamagazine.org/hearing-music-in-noise-martin- hairer-wins-the-fields-medal-20140812/)

<comment><USER3> One thing I learned: he did his work while at Warwick. Warwick is kind of under-estimated among UK universities. It's reasonably well-run (which makes it almost unique), regularly hires smart people, and doesn't have the Brideshead Revisited hangover of Oxbridge.

<comment> dan-robertson Basically since Warwick was founded, it had a reputation for being the place people went to when they were rejected from oxbridge. This sounds bad but one subtlety with the U.K. system is that almost all students may apply to at most one of Oxford and Cambridge in any given year and those universities tend to get more sufficiently good applicants than they take in. If one of Oxford or Cambridge is commonly considered better than the other by applicants then Warwick the distribution of the abilities of the rejects is higher than if they had all applied to a single top university equal in size to the sum of Oxford and Cambridge. Therefore Warwick gets to take in lots of very good undergraduates.

The university was founded in the 60s out of what used to be a research retreat for mathematicians. At its inception a large portion of its mathematics department (at least the topologies) came directly from Cambridge (I believe the story is that Christopher Zeeman went around his colleagues telling them that all the others were going to Warwick). And in the mathematics department in particular has been strong ever since.

I believe the course structure is also different there than from oxbridge (or many other U.K. universities) in that it is meant to be more like an American university with more choice to pursue courses from different subjects or with wide varieties of specialisation.

<comment><USER4> Don't a number of universities belong to that category? I've certainly heard it about Durham:

[https://en.wikipedia.org/wiki/Oxbridge_reject](https://en.wikipedia.org/wiki/Oxbridge_reject)

<comment><USER5> Yeah it's definitely Durham. I've never heard it said about Warwick.

</comment></comment></comment></comment></comment><comment><USER6> > He won the Fields Medal in 2014

Damn. I'm sure he appreciates the $3M (elsewhere he joked that he could finally afford to buy a house in London) but the Fields Medal is a much bigger deal in the world of mathematics.

<comment><USER7> Which actually made me wonder - where/how do London academics live? I find it hard to imagine them commuting for hours from the suburbs - it does not seem very consistent with an academic life - but I do not see them being able to afford to live near their universities either.

<comment><USER8> > I find it hard to imagine them commuting for hours from the suburbs...

Why? It's as easy to commute from certain places outside of London as inside. For instance, it takes longer for me to get from where I live in south London to e.g. Kings Cross than it would to get there from Cambridge. The amount of time you save by living more centrally is probably less than 20 minutes.

<comment><USER9> Ha I agree with the broad point, but as someone who (used to until Covid) commute from South London to Kings Cross everyday, this doesn't seem true timewise until you live quite far South in London. And I live a 15 minute walk from a tube station.

Having said that, I agree with the sentiment!

<comment><USER8> Tooting -> Kings X is 49 minutes according to citymapper. Cambridge -> Kings X is a 48 minute train. I personally wouldn't consider Tooting to be deep south, but maybe we have different definitions. I have a friend who lives near Kingston, it's roughly an hour commute for him.

<comment><USER9> I don't know how City Mapper is getting that number to be honest. TFL gives 35 minutes, and that includes 5 minutes for walking out the tube at Kings Cross.

The trick is you have to change at Stockwell onto the Victoria Line.

Nb. I did almost this journey every day pre-lockdown and the numbers are accurate for me at least.

</comment></comment></comment></comment></comment></comment><comment><USER10> Oh, it's actually called the _Breakthrough Prize_.

I thought perhaps three of the Millennium problems had been solved, and the apocalypse were here.

BTW, for those interested in P=NP and not so much in the direct mathematical research, one interesting way to approach is via hash functions. If we had P=NP, then hash functions would be more easily invertible (eh, left or right invertible). I think in polynomial time. Sorry for the "I think", this isn't my field and I try to find ways to reinterpret it.

<comment><USER11> P,NP, and the invertability of most hash functions are not related, as far as is known. Most one-way functions of use are not known to be NP hard or NP complete, so having P=NP or P != NP would not affect currently widely used hash functions.

[https://en.wikipedia.org/wiki/One- way_function](https://en.wikipedia.org/wiki/One-way_function)

[https://www.quora.com/Is-cryptographic-hash-inversion- believ...](https://www.quora.com/Is-cryptographic-hash-inversion-believed-to- be-NP-complete-or-NP-hard-etc)

<comment> proto-n While not NP complete, reverting a hash function is in NP( _), so it is very much affected if P=NP.

(_) Ok obviously it can't be in NP as it's not a decision problem, but asking "is there a preimage starting with 1, with 1A, etc." _is_ in NP. From the it's trivial to generate a preimage in P.

<comment><USER11> Inverting hash functions isn't in NP, except that it's constant time, so it's also trivially in P. Thus P=NP is irrelevant. It's just the constant is large. Since each common hash function is fixed size, inverting them is fixed size.

For a problem to be of interest regarding the P=NP question, the problem needs to have arbitrarily large size. 3-SAT can be arbitrary sized, thus is a candidate to ask if it's NP hard, complete, etc. If we consider 3-SAT with fixed, bounded size, then 3-SAT is constant time.

For example, inverting SHA-512 requires at most on order of 2^512 ops to invert. This is constant time, not even polynomial time.

So no, hashing is not generally affected by P=NP.

<comment><USER10> Chris, I am a bit over my head usually with P=NP, since it's not my area and I have to warp it before it is.

One question I would have on your comment is: What kind of proof or counterexample for P ?= NP _would_ in fact influence our study of hash functions? This is a subjective question of course, but essentially I am wondering what approach to P ?= NP _might_ introduce new mathematics that indeed would have something to say about hash functions.

<comment><USER11> >What kind of proof or counterexample for P ?= NP would in fact influence our study of hash functions?

None. Hash functions are almost all O(1) to invert, that is, constant time. It's just we designed that constant to be prohibitively large.

And hash functions are not generally based on NP hard problems - they're based on bit mixing, which for all common hash functions are completely orthogonal to the question of P and NP.

Quantum computing, via Grover's algorithm, did impact hash functions one and all, since it allows searching N unstructured items in O(sqrt(N)) time, while classical computers require O(N) time. But this simply turns a 512 bit hash into a 256 bit hash, still intractable.

Again, however, this has nothing to do with P?=NP.

For a problem to be changed by P?=NP, since most think P != NP, that problem must be in NP/P, and hash functions are not (almost ever, and no common ones) from that class of problems. Also the problem has to part of an infinite family of such problems with unbounded sizes. Hash functions again are not in this class.

Of course, it may be that we can build computers in the future with closed timelike loops (CTL), in which case all problems are constant time, and that may prove for that class of machines that the complexity hierarchy collapses, but that is a long time off, if ever. We may be able to build machines that exploit topological quantum field theories (TQFTs) some day, like in Friedman's work, and again, that may break things, but again that is a long time off, if ever.

I'd personally bet on P!=NP being a fundamental law of physics, built into the fabric of the universe, in the It from Bit idea from Wheeler and others. I think this is becoming more and more the mainstream science belief, as the universe is looking more and more like computation.

</comment></comment></comment></comment></comment></comment><comment><USER12> I wonder how prize winners feel about such huge sums of money. Especially that very succesful people who win such prizes tend to win multiple prizes.

<comment><USER13> Also, what does a tenured professor of mathematics do with such a sum other than spend it on himself? It's not like he's going to build out a lab and hire a bunch of research staff.

<comment><USER14> He's renting right now so him and his wife are going to buy a house.

<comment><USER15> Nice, he can get a shed in South Kensington now. Nice and close to Imperial.

</comment></comment></comment></comment><comment><USER16> "to focus fully on the world of ideas" \- very interesting choice of words.

</comment><comment><USER17> That's not what "scoops" means!

A scoop is publishing something before a rival can. You scoop the rival, not the story/prize.

<comment><USER18> I've never heard of scooping a rival - otherwise this is the same usage. A publisher 'gets the scoop' (a great story, a win) or scoops the story just as a mathematician scoops a prize.

<comment><USER19> Journalists get a scoop on their rivals when they publish impactful news first.

<comment><USER18> I've never heard that usage before either. ('on their'.) Whenever I've used or heard it, the scoop is the prize-analagous story.

</comment></comment></comment></comment><comment><USER20> Kinda sad that emminent mathematicians can only rent...

</comment><comment><USER21> This prize isn't too highly regarded. The physics prize has mostly consisted of string theorists giving it to their friends in the field.

<comment><USER22> What an ignorant thing to say.

<comment><USER23> Examples of criticism of the physics prize:

[https://physicsworld.com/a/breakthrough-prize-criticized- for...](https://physicsworld.com/a/breakthrough-prize-criticized-for- rewarding-failed-ideas/)

[http://www.math.columbia.edu/~woit/wordpress/?p=11138](http://www.math.columbia.edu/~woit/wordpress/?p=11138)

[http://backreaction.blogspot.com/2019/08/special- breakthroug...](http://backreaction.blogspot.com/2019/08/special-breakthrough- prize-awarded-for.html)

<comment><USER24> They are all related to a single award -- 2019 (special) for supergravity.

<comment><USER23> They are just examples - and intended as counter to the "ignorant" accusation which implies there was no truth to the idea of criticism.

<comment><USER25> Fair enough.</comment></comment></comment></comment></comment></comment>


Opentype.js: read and write OpenType fonts using JavaScript - <AUTHOR> http://opentype.js.org/ <comment><USER2> Excellent library - I used it to do some super fun things last year [http://jon.gold/2016/05/robot-design-school/](http://jon.gold/2016/05/robot- design-school/)

</comment><comment><USER3> By the way, OpenType.js has problems with parsing many fonts (old structures of TTF tables) and also with rendering some OTF (CCF) glyphs. If you are looking for a more versatile library, I recommend using Typr.js [https://github.com/photopea/Typr.js](https://github.com/photopea/Typr.js)

<comment><USER4> Typr.js doesn't seem to have a way to write out fonts after editing them. In what way is it more versatile?

<comment><USER3> You mean writing a font back into a font file? Yes, this feature is not available now.

OpenType.js throws errors for many font files. It supports just a specific subset of standard font structures. It also renders some glyphs incorrectly. Typr.js does not have these problems (at least not during my testing).

</comment></comment></comment><comment><USER5> Neat. Although the rendered text isn't screen-reader accessible. An aria-label with the text content would solve this, though.

<comment><USER6> Definitely raise an issue: [https://github.com/nodebox/opentype.js/issues](https://github.com/nodebox/opentype.js/issues)</comment></comment>


Dynamic Pricing and Major League Baseball - <AUTHOR> http://knowledge.wharton.upenn.edu/article/is_dynamic_pricing_a_hit <comment><AUTHOR> Link to the referenced paper, [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2796407](http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2796407)</comment>


China military able to detect U.S. F-22 stealth fighter jets - <AUTHOR> http://en.people.cn/n3/2016/0218/c90000-9018486.html <comment> ju-st Quote:

That being said, Russia, China and others are developing advanced UHF and VHF band early warning radars that use even longer wavelengths in an effort to cue their other sensors and give their fighters some idea of where an adversary stealth aircraft might be coming from. But the problem with VHF and UHF band radars is that with long wavelengths come large radar resolution cells. That means that contacts are not tracked with the required level of fidelity to guide a weapon onto a target.

As one U.S. Navy officer rhetorically asked, "Does the mission require a cloaking device or is it OK if the threat sees it but can't do anything about it?"

[http://warisboring.com/articles/how-to-detect-a-stealth- figh...](http://warisboring.com/articles/how-to-detect-a-stealth-fighter/)

<comment><USER2> > As one U.S. Navy officer rhetorically asked, "Does the mission require a > cloaking device or is it OK if the threat sees it but can't do anything > about it?"

Depends on the mission. And if full stealth is not necessary after all, why have such an expensive stealth system in the first place?

<comment><USER3> How did you go from "can't do anything about it" to "not necessary after all?" The stealth is what makes the aircraft harder to shoot down, that is what makes it "necessary."

</comment></comment></comment><comment><USER3> F-22 isn't a "stealth fighter" it is a fighter with stealth features to reduce its radar cross-section and by extension reduce the distance at which it can be detected.

F-117 and B-2 were attempts at making an actual stealth fighter (completely radar neutral) and even an F-117 was shot down by a Isayev S-125 in 1999. I'd imagine China has at least access to that level of technology.

There's also work on infrared detection and optical detection which weren't possible way-back-when, but with access it inexpensive compute power, might now be a viable way to track even a radar neutral aircraft.

All I am saying it, I believe them, but I am also unsurprised. Against a nation like China I wouldn't even trust the B-2 Spirit to remain immune from interceptors, let alone the F-22, and frankly if China and the US ever went to war drones and missiles would likely play a greater role than manned fighters.

</comment><comment><USER4> > _...if the unidentified objects appearing near ADIZ over the East China Sea > turned out to be F-22 from the U.S., it would be a good opportunity for > China 's military to practice its ability to find, identify and intercept > stealth fighters._

Please pardon my bit of chuckling, but in the past Chinese Air Force pilots can't even intercept a prop-plane without hitting the thing. An F-22? Going to need a lot of practice.

It's nice they can see the F-22 though. It didn't really help in the Middle East that much[1] years ago with the SR-71. But it's something to feed the press!

[1] [http://www.airlinepilotforums.com/cargo/19456-fantastic- sr-7...](http://www.airlinepilotforums.com/cargo/19456-fantastic- sr-71-story.html)

</comment><comment><USER5> Chinese domain, sparse on details, cites "military experts."

Meh.

</comment><comment><USER6> this is not horribly surprising. Stealth has always meant "less significant radar cross-section than you are advanced enough to detect".

Plus, its a plane, with a big ass engine, flying through the sky at hundreds of miles per hour. There should be other ways to detect the damn things.

</comment><comment><USER7> Given they stole the full specs years ago, this is not a surprise.</comment>


Producing Open Source Software: The Book - <AUTHOR> http://producingoss.com/

<comment><USER2> For my year of the Google Summer of Code(2007), they gave signed copies to all the students. This should be required reading for all CS students IMHO.

</comment><comment><USER3> PDF download link is broken. It looks good though!

EDIT This link works: [http://webyes.com.br/wp- content/uploads/ebooks/book_producin...](http://webyes.com.br/wp- content/uploads/ebooks/book_producing_oss.pdf)

</comment><comment><USER4> Well, that's demotivating. I always thought that producing OSS was a matter of hadcking something awesome and putting it on github with a nice readme.

Turns out you have to read a 300 page book first.</comment>


Suicide Linux: Where typos do rm -rf / - <AUTHOR> http://qntm.org/suicide

<comment><USER2> Haha, a bit too hardcore, but I'm sure some of us will appreciate :)

On the topic: Short of a more elegant solution, Trash-cli or some similar tool should be a default alias for rm in distros, in my opinion.</comment>


Google Launches Flight Search - <AUTHOR> http://googlewatch.eweek.com/content/google_search/google_launches_flight_search_sans_ita_data.html

<comment><USER2> Wow, I got a totally unexpected feeling of joy of getting immediate, concise results from a flight search instead of the usual drag of navigating through 3 - 4 screens and getting long waits, pestered with ads, special offers, etc. If Google can link this to actual bookings then they are on to something huge, especially if they tie it into their other services (think - book flight, have it appear in your calendar with maps in the entry etc.). More or less like TripIt but more integrated and convenient.

<comment><USER3> > Wow, I got a totally unexpected feeling of joy of getting immediate, concise > results from a flight search instead of the usual drag of navigating through > 3 - 4 screens and getting long waits, pestered with ads, special offers, > etc.

Had you never tried hipmunk before this?

<comment><USER4> There's also <http://www.skyscanner.net>, which does not seem to get much love around here, even though it was doing flight search well before hipmunk even got started.

It's especially good if you want to do an open-ended search, as in you know where you are leaving from and which month you might want to leave, but you're flexible as to where you want to go.

</comment></comment></comment><comment><USER5> more warning for anyone in a lucrative space on the web...Google will eventually come for you.

It happened to mortgage rates companies, it happened to flights, and eventually given enough it'll happen to any service that acts as a broker/affiliate for other companies.

<comment><USER6> Warning to anyone in any lucrative market, you will have competition.

<comment><USER5> no this is different...with your competition you are more or less on a level playing field. With Google, they get to always place their stuff before you.

which means on the back end much lower traffic for the companies, which in turn drives down the rates you can charge for the leads.

<comment><USER7> Search engine traffic isn't the only source of publicity. Google Flight Search isn't going to be first in a search for 'hipmunk', nor anywhere on the first page.

</comment></comment></comment></comment><comment><USER8> I still think that hipmunk (<http://www.hipmunk.com/>) does a better job.

<comment><USER9> Hipmunk only shows the flights that have tickets to sell through their partners.

Google has a lot more in terms of schedules.

<comment><USER10> Aye, mostly true. But Google doesn't tell you anything about whether the fares are available at all, or what they would cost—it's possible a flight's sold out or prohibitively expensive.

They also don't have mascot, or hotel search ;)

I'll leave it there.

</comment></comment></comment><comment><USER11> I'm not seeing flight information in my Google search results. Anybody else?

<comment><USER12> Seems to work only with US to US flights. "LGA to ORD" works, "FRA to SIN" and "HAM to TXL" don't.

<comment><USER13> Works for international flights with one end in the US. (SFO to LHR, SFO to SYD I've tried...)

<comment><USER12> Hm. JFK-FRA works, JFK-SIN doesn't. SFO-(AKL|SIN|BKK|BJS) don't, JFK-WAW doesn't, DEN-MEX doesn't, JFK-YYZ doesn't. So, US-US, US-Western Europe, US- Australia. Strange dataset.

<comment><USER13> Well it only has nonstop flights, so JFK-SIN shouldn't work (afaik no aircraft has that range). Likewise SFO-SIN, SFO-BKK.

SFO-AKL has direct flights though. I know, I've done it. NZ8. Nice plane.

edit: Actually I checked and "sfo to akl" does in fact give me results.

<comment><USER13> And I'm just coming back to this thread because I learned something today. There are no flights from Singapore to JFK, but there is one to Newark. It's the longest scheduled air route in the world, at 18 hours and 40 minutes.

Oh, and it's in a 100-seat all-business-class A340-500. I'm guessing they couldn't do it with a fully-laden economy section. Then again I'd hate to fly 19 hours nonstop in economy.

</comment></comment></comment></comment></comment></comment><comment><USER14> Yes, something like this is nice. I just wish someone else besides Google did it. Google is way too big. I'd much rather have a majority of the internet comprised of many small companies than several internet giants. It's much healthier..

</comment><comment><USER15> I suddenly have the feeling this is just opened the doors to something MASSIVE in the travel startup niche.

</comment><comment><USER16> Includes Southwest Airlines flights!

<comment><USER17> And low cost in Europe (e.g. Easyjet) which aren't usually aggregated in flight search.

</comment></comment><comment><USER18> Asked Marisa Mayer today: so when can I sort by price and buy direct via google checkout? No reply to date. Anyone else know / speculate?

</comment><comment><USER19> I wish Amazon would do this as well. I want 1 click flights, and something that almost all these booking sites lack... awesome customer service. These are 2 things Amazon can do well.</comment>


The Eight Myths of Erlang performance - <AUTHOR> http://erlang.org/doc/efficiency_guide/myths.html

<comment><USER2> According to <http://erlang.org/download/>, R6B & R7B were released around 2000 and 2001. If the eight myths were dispelled almost 10 years ago, then why bring them up again? Nevertheless, it's great to know that they don't exist!

<comment><USER3> Yeah, these days we have totally different myths like "Erlang is the fastest programming language" and "Erlang automatically scales your code on multicore".</comment></comment>


Trend Micro antivirus zero-day used in Mitsubishi Electric hack - <AUTHOR> https://www.zdnet.com/article/trend-micro-antivirus-zero-day-used-in-mitsubishi-electric-hack/ <comment><USER2> > A source with knowledge of the attack told ZDNet that the hackers exploited > CVE-2019-18187, a directory traversal and arbitrary file upload > vulnerability in the Trend Micro OfficeScan antivirus.

Security software is like any other software in that it needs to obey the principle of least privilege.</comment>


Show HN: Sysdig introduces deep visibility into containers - <AUTHOR> https://sysdigcloud.com/let-light-sysdig-adds-container-visibility/

<comment><USER2> This product is awesome, one of the biggest issues I have with docker is the low visibility inside containers.</comment>


Ask HN: How do you find mentors? - <AUTHOR> A pretty straight forward question, how do you find a good mentor, I'm finding it a little difficult to find someone to ask questions that are relative to developer career paths. I'm almost a new-grad, and the company that I'm interning does not really have anyone that can answer my questions. <comment><USER2> Every successful person has struggled at some point. Usually someone helps them through it. They are grateful and want to pass it forward, or sometimes resentful of the thing that caused them hardship. These people are satisfied by mentoring.

Very often, if you work hard and struggle, people who have been through the same struggle admire you for it. The key to finding a mentor is to have one observe you through the struggle. Sometimes this means just blindly moving into (and possibly failing) at something. This was how Eminem met Dr Dre. But it doesn't help to work at and fail at something silently.

A potential mentor will sit, observe, and cheer you on. They may offer to help you. But sometimes you have to establish the relationship.

This is a lot like dating. Both sides want a relationship but don't want to seem too eager. It's awkward to say "will you be my mentor?" Sometimes you need to ease into it. Spend time together, discuss similar topics, especially in your field of work.

</comment><comment><USER3> I'd start by finding a good company to work for, one that attracts talented engineers and fosters a culture of learning and respect. I tend to learn the most from the people I work with.

<comment><AUTHOR> Actually this was one of the questions that I had, currently the company that I work for offered a full time technical consulting role, but it seems more directed toward enterprise IT (office365). There are not many engineers that I have access to, hence limited room to learn.

Damn, thanks for that perspective. I realize that the learning potential is limited at this company.

</comment></comment><comment> rc-1140 If I can piggyback on the OP's question, I have my own scenario: I'm still considered a "recent grad" by my current company despite my previous post- college job (not in a software field) and while I can ask workplace/codebase questions and have seniors who keep an eye on me, there's no mentorship available since I think this is the first time the team I'm on has taken on a junior. I've looked on Meetup for events and such, but anything local to me is dominated by web development (there's one woman who owns somewhere around 3 or 4 meetup groups in my area that are supposed to be about different subjects but after researching them, the groups all come back to her site/company Daniweb and the subject matter is all about introducing people to HTML/CSS and surface-level discussion about trending things like VR and cryptocurrency); otherwise, I'd have to commute into the city to attend a meetup during a weekday, which isn't viable considering my commute from work just to get home.

Are there any options for me?

<comment><AUTHOR> I think there is, have you spent time within the Freenode IRC server? There seems to be a little older of a generation of devs. In there, most are able to answer and give good feedback.

You solve the commute issue and get a little more in-depth of a knowledge base.

</comment></comment><comment><USER4> I am happy to answer questions about developer career paths (email@example.com).

More broadly, you can find lists like [https://ishansharma.github.io/twitter- mentors/](https://ishansharma.github.io/twitter-mentors/) where people might have skills that are relevant to you.

</comment><comment><USER5> I happened across a couple of websites recently for finding mentors, which look promising -

[https://mentorcruise.com/](https://mentorcruise.com/)

[https://www.mentorconnect.me/](https://www.mentorconnect.me/)

</comment><comment><USER6> Maybe try to find tech groups and hacker spaces around you. Here in Europe we have the Chaos Computer Club, there's probably equivalents where you live. Or join hackathons. I've always found it easy to connect to people at places like these and you might find someone who can guide you a bit.

</comment><comment><USER7> You could find good connects at Dev conferences. Usually not free but could be worth trying out. Better if your company sponsors

</comment><comment><USER8> Maybe there are startup networks or accellerators near you? You can ask there.

<comment><AUTHOR> Well I'm located in the SFbayarea, there's no shortcomings of developers, it's just networking with others that I find a bit challenging. I don't necessarily have an issue with the communication, but rather access to pick the brains of others.</comment></comment>


Linux based Development Setup - <AUTHOR> http://dalibornasevic.com/posts/28-development-setup

<comment><USER2> I'm surprised more website developers don't use Linux to develop in. It is what we all push to in the end after all. I use Ubuntu 10.04 w/ Sublime Text 2, GIMP, Chrome, Firefox, VIM, Vagrant, virtualenv, git, and ssh. Then whatever framework I happen to be using at the time. Mostly Django.

It's just easier to develop in Linux than it is in any other OS. Being able to hit "sudo aptitude build-dep python-psycopg2" and then being able to "pip install psycopg2" without having to hunt everywhere for deps and it just work is one of the greatest things of all time.

<comment><USER3> > It's just easier to develop in Linux than it is in any other OS.

Uh...

> Being able to hit "sudo aptitude build-dep python-psycopg2" and then being > able to "pip install psycopg2" without having to hunt everywhere for deps > and it just work is one of the greatest things of all time.

Implying other operating systems don't also have package managers. There's myriad Unix-like operating systems (and one fully-ceritifed Unix I can think of) which can run that exact same software stack.

<comment><USER4> Yeah, but few people actually run their production environment on that "fully certified UNIX", so if your goal is to be as similar to production as possible, that those package managers exist elsewhere is meaningless.

<comment><USER3> Sure, but that doesn't support his claim that Linux is "easier" to develop in, which is what I was refuting.

</comment></comment></comment></comment><comment><USER5> I used to develop on a mac at work, and started using ubuntu after I had to give it back. Ubuntu is still very buggy (atleast for the HP HDX I have). Wireless and sound drivers are randomly not recognized and the battery indicator has issues. During a hackathon once, Ubuntu completely just gave up (refused to connect to the internet even though all the cards were recognized and I had to reinstall the entire OS to make it work).

This whole 6 week experience left me running back to windows.

</comment><comment><USER6> FYI You can easily have a hybrid development environment. One box (or virtual machine) runs Linux with all the stuff you need. The computer in front of you runs Windows or Mac OS and you ssh to the other box. Especially useful if your production environment is Linux. You can have the Linux box match your production environment.

I personally prefer this setup, as it allows me to use Adobe (Photoshop, Illustrator, etc.) and Microsoft (Office) and a few other favorites not found on Linux.

</comment><comment><USER7> I just moved to Arch (always wanted to use it) from Ubuntu 11.10 after Unity (compiz) became intolerably slow on my 5 year old machine. Now running a custom DE using Openbox. It's blazing fast and highly customizable.

</comment><comment><USER8> I just use Ubuntu 11.10 with a fairly standard set up of Sublime Text 2, Chrome, FileZilla, and vim for quick file editing when I'm in the terminal or SSH'd into another computer. This was after originally trying to cope with Eclipse and other IDE's that weren't my cup of tea.

Mind, I'm looking to switch up the OS (or at least the window manager) because Unity offers a less productive environment, and Gnome3 on Ubuntu really disagrees with my hardware for some reason. Even Classic appears messed up.

<comment><USER9> I've just switched to xubuntu for similar reasons.

I'm finding it a big improvement on gnome 3 or unity so far, although I've only been using it for about a week, so I still count it as testing at the moment.

<comment><USER10> Kubuntu - been using it since I moved to GNU/Linux - but on my netbooks still can't decide between Lubuntu, Xubuntu, or the big K - I'm running lubuntu as a trial, its still young and stroppy but hey I get to edit its text config files.

I earn my beer vouchers from what I do with the apps running in VM's (VirutalBox 4 me), when working full on I'll have 3 VM's running chatting to each other and out to the networks, but normally just have one or two up. Using VM's had been the biggest boost - I can shag around with the various OS's - a clean install, install vbox hook up to my existing disk images and I'm up and working - can be up and running in 30 mins from a clean install.

I keep saying it - many thanks to all the fine folk that put together the various distributions - u add the spice to working life.

</comment></comment></comment><comment><USER11> I'm trying to switch to a Slackware environment with Fluxbox running in the front. I've used Ubuntu for years, but realized that I had huge gaps about actual Linux knowledge because I was so used to the automation that Ubuntu provides. Also I'm trying to learn emacs and vim now, and I'm really making an effort to go to a more keyboard/terminal oriented workflow. I'm getting faster and faster with it.

</comment><comment><USER12> I've found Komodo Edit to be indispensable for PHP development on Linux. I haven't yet found an editor that does such a good job mixing PHP and HTML syntax highlighting, has solid autocomplete--even of custom classes--and is so easy to set up. Eclipse is far too massive, emacs/vim are too finicky to learn and set up, and gedit with lots of plugins is actually close doesn't do autocomplete well.

<comment><USER13> I recommend checking out KDevelop 4's PHP plugin, which probably offers the best semantic PHP support in an IDE on Linux (including 5.3's namespace support).

</comment></comment><comment><USER14> I use Awesome, but it's really not for someone who doesn't want to configure it to their tastes. I use it because unlike alternatives, I _can_ easily configure it to my tastes. It takes time, but in the long run it helps my productivity.

</comment><comment><USER15> I have the same setup more or less, interesting that we both switched to gnome 3 at the end.</comment>


Ask HN: What's the best way/source to learn Python (total noob) - <AUTHOR> I've always considered myself a technical person, but in reality my coding skill is close to 0. I interested in learning python (from what I've read it seems to be a good starting point). Anyone would be nice enough share tips on how I should do this, sources or best practices? No shortcuts expected. <comment><USER2> My own personal breakthrough was going through the course "Complete Python Bootcamp"[0] on Udemy.

I've tried books, boring stuff, and many online tutorials. But taking an actual course was what helped me.

[0]([https://www.udemy.com/complete-python- bootcamp/](https://www.udemy.com/complete-python-bootcamp/))

</comment><comment><USER3> _Think Python_ , 2ed. It's available for free online.

Follow it up with _Automate the Boring Stuff with Python_.

</comment><comment><USER4> codecadamy, Treehouse, Learn Python the hard way, Automate the boring stuff with Python. r/learnpython

Good Luck.

<comment><USER5> I share the same sentiments. Learn Python the Hard Way was probably my favorite, but the rest are solid choices as well.</comment></comment>