Learning to code kept me sane when I was a diplomat - <AUTHOR> http://www.vikparuchuri.com/blog/how-learning-to-code-kept-me-sane/ <comment><USER2> The article shows an interesting illustration of the disconnect between programmers and normal computer users. Like the author says at the beginning, any experienced developer knows that automating interaction with a GUI is a crazy idea. It's a painful, fragile way to move data around. But to the author and anyone who's done data entry, it's an improvement to their workday that demonstrates the power of programming.

So much programming instruction seems designed to teach people who already understand programming how to solve problems that nonprogrammers wouldn't even understand. A tutorial that started with automating tasks like this might be more effective than all the ones that start by demonstrating how to do basic arithmetic in $LANGUAGE and go on to a detailed explanation of $LANGUAGE's object system.

<comment><USER3> I'd be interested in seeing an accompanying article by the author or another developer laying out how you would solve the same problem if you were an "experienced" developer; I have done a little of the same type of programming at my job, and a side-by-side comparison of the 'novice' and 'pro' approach would be extremely helpful.

<comment><USER2> Maybe I was too vague. I meant that a programmer would always use an API rather than scripted interactions with a GUI. An ordinary user might assume that programs use interfaces designed for humans, because the concept of an API doesn't even have a place in his mental model of how computers work.

</comment></comment></comment><comment><USER4> This is a really great post. For me, the recurring theme is knowing what's possible.

From a class he took in high school, Vik knew that some sort of automation was possible. That spurred some reading and exploration, which led to some success.

Success led to thinking about other opportunities for automation and more exploration of what's possible, which in turn led to more success.

To me, it absolutely doesn't matter that things could have been done in other ways. Nothing to cringe about here. A developer can only use approaches that he/she knows or suspects are possible.

In the day-to-day work of a developer, knowing what's possible is perhaps the most important thing. Anything else can be googled.

<comment><USER5> Equally important to knowing what is possible is to not know what is considered impossible, or at least considered very hard. Automation is often considered futile, and knowing that can be intimidating. We are often limited by what we think is impossible, but really isn't.

It is said that most Nobel prizes are earned for research done before 30, since any older and they would know the breakthrough they are trying to accomplish is impossible :)

</comment></comment><comment><USER6> This is a fantastic article and illustrates a HUGE problem in government systems, where data gets aggregated, but not associated.

<comment><USER7> I had a government job and my boss loved me for doing automation stuff. All of the documentation and data requirements seemed to be written as though a person had to manually do everything -- like they expected a human brain to be making decisions at every step of the process.

It just reeks of a lack of care not only for the power of automation systems, but disrespect for the people who have to do that work. Design your processes in such a way that easy stuff can be done easily and important stuff can be done by people who have some authority.

This is my biggest (personal) problem with bureaucracy. "You have to do it this way because it's the only way _I_ know how to do it, and I don't care if you know a better way, because you don't get paid enough to have good ideas."

<comment><USER8> Yea my university IT job was like that too. Except automating things was part of my job description and I still wasn't given much lee-way to automate things much.

</comment></comment></comment><comment><USER9> Oof. Had a hilariously similar experience doing data entry at my first internship, which was at a financial services firm.

I knew nothing about programming, but I had taken an intro stats class that had a few assignments in R. A super simple R script did half of my day's work in seconds (plus some debugging because of course I did next to no error handling).

In retrospect, I've realized that if I knew a thing of two about regular expressions at the time, I would have been able to automate my whole summer internship.

So it goes.

</comment><comment><USER10> I haven't seen much discussion of a more ideal way to solve this problem (to say: as a one-off like the author was doing, not reusable software), so I thought I'd just think about how I'd do something similar.

Luckily there are libraries that are great at interacting with a web page or multiple pages at the same time without needing to actually have a browser instance open. There's selenium and its various scripting environments, which are meant for browser testing but work just fine for many automation tasks: [http://www.seleniumhq.org/](http://www.seleniumhq.org/)

And, newer, are headless technologies like phantom.js: [http://phantomjs.org/](http://phantomjs.org/) and Dalek.js: [http://dalekjs.com/](http://dalekjs.com/)

This is SO much easier than using Javascript to find purple links on a page, and so much more reliable.

He could have looked up each link on DB1, then used the data to look up the DB2 information.

In any case, what he did saved him hours and hours of time and started him on a lifelong interest in programming.

Also, obligatory relevant XKCD's: [http://xkcd.com/1319/](http://xkcd.com/1319/) & [http://xkcd.com/1205/](http://xkcd.com/1205/)

</comment><comment><USER11> This is golden. I've wondered more often than once myself what would it be like to have a "normal" office job.

For instance, take some city department or some big firm where things generally flow at a slow pace and require a lot of time spent on work items, doing possibly repeated tasks each week. What would a programmer do? Exactly as described in the article:

\- learn what kind of tasks the job consists of

\- identify repeated actions and patterns in work

\- think of a way to automate the easiest parts, still requiring human to finalise the task

\- gradually learning more and automating the harder and harder parts and building tools bottom-up based on earlier blocks

\- finally ending up with a software mechanisation puppet that I can instruct and program to do my work

\- gradually spend first some of my time doing the automation and as it would slowly take over I could devote more and more of my time automating the rest, and when all is done, I would feel the job is "completed" and get bored.

This is something that feels so natural to a programmer: I have dozens of little tools to aid in doing my programming job at work. The goal of a programmer is to program anything that can be automated and only work himself on the hard tasks that can't.

It's intriguing to imagine how you could apply those skills outside programming jobs.

<comment><USER12> Often you have to change the tasks slightly to make them properly automatable. The fancy term is process improvement. See [https://en.wikipedia.org/wiki/Business_process_improvement](https://en.wikipedia.org/wiki/Business_process_improvement)

</comment></comment><comment><USER13> Love it. I started my career in International Development and one of my team's first projects was figuring out how many miles our organization's 1000+ staff flew in a year (why is a separate story). The travel agent could only provide records in PDF. 1000's of them.

The intern I shared an office with was assigned to go through each record, type the origin and destination airport codes into an online flight distance calculator, and enter the results in a spreadsheet. After two days of watching this I volunteered to take over and spent a few nights learning enough Java to read/write CSV and make the HTTP request. Saved days of pain for the intern and was a satisfying accomplishment as a novice.

<comment><USER12> And you even learned some Java in the process!

</comment></comment><comment><USER14> Brings up old memories reading this. I remember my first job about 20 years ago at NEC as a data entry operator. It was 8 hours each day of taking a bunch of mal-formatted CSV files from some reports the previous day and importing it into excel and drawing graphs. I was just getting into learning C at the time and ended up writing an importer (parsing and formatting in C and ODBC to write back to excel along with excel macros to draw graphs). Very hacky and ugly but got the job done. It got the 8 hour job done in about 30 minutes - most of which was detecting patterns in the input and adding rules for those, which was fun in itself.

</comment><comment><USER15> Before you knock on "writing code that clicks things" remember that on Windows clicking things is the primary if not solitary interface to most of the system. Even the administrative interfaces are secondary to the visual interface. A lot of programs don't offer an API available to outside processes.

The most important thing about any program is correctness: does it work and do what it is supposed to do. The only thing cringe-worthy about having to script GUI interactions is that fact that the operating system and environment requires it.

<comment><USER16> For the server versions, Windows finally leaves this path, making PowerShell (that admittedly also takes some getting used to) a first class configuration system. You even can do something in the GUI and then check in a log what PowerShell commands were executed under the hood.

<comment><USER17> From which version of Server? Where does the log go? I have a use for this.

<comment><USER16> I think it's from 2012? Here is a link that describes it:

[http://www.learnmsexchange.com/windows-servers/windows- serve...](http://www.learnmsexchange.com/windows-servers/windows- server-2012/593-what-is-windows-powershell-history-viewer-in-windows- server-2012)

</comment></comment></comment></comment><comment><USER18> Why has no one mentioned Autohotkey? ([http://www.autohotkey.com](http://www.autohotkey.com))

It was practically made for this use case, and has an active community behind it. It even has its own script editor (SciTE4AutoHotkey) and was recommended as a Kevin Kelly-approved Cool Tool ([http://kk.org/cooltools/archives/4147](http://kk.org/cooltools/archives/4147)).

My go-to program for my desk job.

</comment><comment><USER19> this reminds me of when i started to code - find the first solution to the problem that comes to mind and hack it until it works, even if was something as abstruse as manipulating the UI. of course the outcomes were incredibly fragile and broke at the first possible moment, but in the end they still did the job they were supposed to do most of the time.

today i couldn't do that anymore; i've grown too uptight to try any of those inefficient "solutions". i guess i'd rather give up and admit defeat if there were no APIs or passable hacks (i'd say using phantom.js would be a passable hack) i could work with than solve the problems this way.

i'm usually unable to follow the advice given by the xkcd automatisation timetable described here: [http://xkcd.com/1205/](http://xkcd.com/1205/) "is it worth the time?" \- if a dirty hack is destined to run more often than once, i just _have_ to make it passably elegant, readable and efficient. i'm sure nine out of ten times the effort is pretty much wasted.

i guess i've just grown old.

</comment><comment><USER20> > I decided to write a program that clicked on things.

I cringed a little. I'm glad he's learned enough to know now that this is not the right approach.

<comment><AUTHOR> I thought this way before, and looked down on what I had made, but I'm slowly coming around to the idea that its more about how well the approach works and what it teaches you than about the technical details. I definitely wouldn't code it the same way today, but it worked well and taught me a lot. I wouldn't stop anyone who's in a similar position from doing the same.

<comment><USER21> The worst that could have happened was that you talked yourself out of automating it because there wasn't an 'easy way'

</comment></comment></comment><comment><USER22> The biggest problem is not the lack of code and automation.

The biggest problem is that apparently Guyana allows the US embassy to search their criminal records system:

> Search a different database with a separate program ("DB2") for criminal and > other history

So either Guyana allows the US wholesale access to its criminal records system or the US systems gather this data more or less illegally from somewhere.

edit: downvotes? seriously?

<comment><USER23> I have no idea what DB2 was. It's my understanding that every country in the world wants to know the criminal history of anyone asking for a visa for any reason (the host country may ignore that history, if it believes the crimes were politically motivated). And it's my understanding that INTERPOL allows countries to get at least some criminal records information. And there is clearly some system in place for countries to make extradition requests -- which would require some criminal history information.

So it's not clear to me that the US must have wholesale access to Guyana's criminal records system, or that it must be illegally gathering data to populate DB2.

Even without INTERPOL, I would expect countries to have treaties to share some criminal records information. If Guyana is trying to capture a criminal, clearly it's in Guyana's interest to ask countries to help prevent that criminal from fleeing.

<comment><USER22> > It's my understanding that every country in the world wants to know the > criminal history of anyone asking for a visa for any reason

I'm actually fine with that. And if I ever apply for a visa, I gladly sign a waiver allowing the respective country to request the data from my country. But I am _not_ fine with any government in the world being able to research my criminal record without authorization! Push, not pull.

> If Guyana is trying to capture a criminal, clearly it's in Guyana's interest > to ask countries to help prevent that criminal from fleeing. There's a > system for this: take away the criminal's passport and don't let him out of > the country. That's a job of regular Guyana border police.

edit: oh, and who guarantees that (e.g.) the US respects expiration dates? In Germany, records have to be entirely wiped after certain dates (5-20 years, [http://www.gesetze-im-internet.de/bzrg/__46.html](http://www.gesetze-im- internet.de/bzrg/__46.html)) - but I highly doubt that the US respect this and just keep the data instead.

<comment><USER24> >But I am not fine with any government in the world being able to research my criminal record without authorization!

Criminal records are a matter of public record in most countries (including the US). That means that _anyone_ can search your criminal history, not just governments.

There may not always be a central database, but the information is out there.

<comment><USER22> Back when the rules placing criminal records in public were drafted, these records were usually kept at a courthouse, thus greatly restricting their use to those who actually traveled to the courthouse/archive and manually searched.

These days, everything can be searched online and especially copied and stored everywhere, far after expiration. And this is not a good development at all.

<comment><USER24> Yes, they used to be stored in a courthouse, but most people didn't leave the area they were born in either, so for the average person everyone you were likely to meet knew about your past.

Criminal records were always meant to be as public as possible.

I do have a huge problem with the content of criminal records, because I have a huge problem with what we consider criminal--drug offenses mostly.

I also worry a lot more about the non-criminal mistakes we make being available for anyone and for all time.

<comment><USER23> > I do have a huge problem with the content of criminal records, because I > have a huge problem with what we consider criminal

While the US wants to know immigrants' criminal history, the US isn't required to care about all of the crimes that show up on the record. For instance, convictions for performing or having an abortion (say, in Brazil) probably won't result in a denied visa.</comment></comment></comment></comment></comment></comment></comment>


Ask YC:  open geoip databases? - <AUTHOR>

Hello,<p>Is anybody else using geoip on their sites?  I remember I used it a while back and it was off of a maxmind database.  Is there anything else out there besides maxmind?  Google isn't much help here. <comment><USER2> I use the free Maxmind country database.

</comment><comment><USER3> The GeoLite Country database at:

<http://www.maxmind.com/app/geolitecountry>)

is just fine for countries. The Ruby gem works nicely:

[http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby- talk/...](http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/140379)

... and there are other APIs as well:

<http://www.maxmind.com/app/api>

MaxMind is the standard.

</comment><comment><USER4> <http://www.hostip.info> works great for me on www.newshoured.com

</comment><comment><USER5> I looked for a solid week earlier this year, and didn't find anything that was really free or open. Kind of disappointing.

What I needed was to be able to take an IP, and get a reasonably accurate (25 miles) lat/long out of it. If anyone knows of one that exists, please let me know...

<comment><USER3> The MaxMind GeoIP City Database includes latitude and longitude. You could buy their "Web Service" at $20 per 50,000 queries...

<comment><AUTHOR> I guess if you were really clever you could cache it too, if you had a site with a ton of traffic.

<comment><USER6> Just hope that you get you get returning visitors then. And even then, address mappings change over time.

</comment></comment></comment></comment><comment><USER7> <http://geocoder.us/>. It's very accurate and you can set it up locally for speed -- it uses Perl and BerkeleyDB and the TIGER database</comment>


GoogleSharing - A Special Kind Of Proxy - <AUTHOR> http://www.googlesharing.net/index.html <comment><USER2> I bet Google will be delighted about this use of their trademark.

</comment><comment><USER3> How much result quality is lost by doing this?</comment>


Why is anyone listening to Tim O'Reilly? - <AUTHOR> https://theoutline.com/post/2413/why-is-anyone-listening-to-tim-o-reilly <comment><USER2> This essay made some excellent points yet structurally undermined its work by being unfocused.

E.g. It used O'Reilly's own metaphors as jumping off points to make deeper observations. Yet on water the reviewer rambles instead of making the point. And on O'Reilly's poor Alderaan metaphor -- well that's just a stupid metaphor not worth the discussion.

On the other hand, some of the excellent points: \- The gold rush was in many ways a disaster that we still are paying for, and reflects a "strip mining" mentality that has been repeated, such as: highly polluted land on the Peninsula thanks to chip production (you can't drink the groundwater in any of the industrially-zoned land in the city of Santa Clara, for example); the destructive style of farm production in the Central Valley (brought from Oklahoma by people who had destroyed their previous environment with the same system), and now strip-mining of middle class economies. \- The fact that the narrative arc of the "high tech revolution" has followed the self-narrative arc of US baby boomers \- The decades long privatization of the "common weal" has made it brittle, failed to serve the people it was originally designed for, and has broken up the social sense of common purpose.

I like Tim, have known him since he started with the Nutshell books, and think this essay is a bit of a hatchet job. But there's a lot of meat hidden in there too.

</comment><comment><USER3> _These increasingly destructive techniques, coupled with the San Francisco peninsula's population exploding from roughly 1,000 people in 1848 to over 36,000 in 1852, irrevocably changed the landscape of California, pulling up old growth forests, pushing aside rivers, and literally washing away into the Pacific Ocean some of the richest arable land on the North American continent. The Gold Rush turned huge swathes of California into "sacrifice zones" — geographic areas that have been permanently damaged or poisoned by industry._

We're still dealing with the environmental impact from those days. Precisely the places one is likely to find gold, one is likely to find other heavy metals like mercury. Those places are also the part of California where SF gets its water from. Fortunately, metallic mercury is fairly nonreactive. Much of that washed-away soil is still making its way down into reservoirs. There are actually plans to safely mine that sediment for the mercury and gold.

</comment><comment><USER4> God that was good. The thickness of the bubble is exponential in the amount of money one has.

</comment><comment><USER5> Tim's core business, tech book publishing, has certainly been disrupted by technology. Glad to see he's not getting all Luddite over it.</comment>


Quotes for developers - <AUTHOR> https://fortrabbit.github.io/quotes/ <comment><USER2> > Always code as if the guy who ends up maintaining your code will be a > violent psychopath who knows where you live

This is attributed to Martin Golding, but I've also seen it attributed to Damian Conway in the past.

Also, if the website owner is reading this, please choose a different color for ::selection. I thought at first that the website is blocking text selection.

</comment><comment><USER3> These would be useful if indexed and unfurlable.

</comment><comment><USER4> Did I miss the train or do developers really love Chuck Norris quotes? It's been around 10 years since those were relevant.

<comment><USER3> Still relevant here where I work, for better or worse...

Multiple custom chuckicons in slack...

</comment></comment><comment><USER5> Those are dated. And to be of any use today, should come as a slack/discord bot: /quote :)</comment>


Why learn C? - <AUTHOR> http://radar.oreilly.com/2012/06/why-learn-c.html <comment><USER2> If you're interested only in learning about lower levels of the computer, and don't need to actually write at lower levels, it may be better to learn, say, MMIX.

But lots of people do need to learn C. They might not be working on hip new social web services, but they're out there.

In my work, I have observed recent computer science graduates filter in and get assigned to program embedded systems using C. Their knowledge of C was minimal. Their code tended to be suboptimal, or even bizarre to the point of, I wasn't sure why it compiled. I recommended they get a copy of K&R. They did. I don't think they got much out of it.

I don't blame them personally. They simply had not been taught C in school, and had never had a reason to learn it before. Trying to learn it on the job with antiquated books didn't seem to work very well. (Though some did eventually come to learn C well. Others migrated to different assignments not involving C.)

Whatever your reason for wanting to learn C, be it purely academic, or if you actually need to program with it, fresh, modern educational resources are a good thing.

</comment><comment><USER3> Yes, C is just another arbitrary abstraction layer among many others, but it occupies a special position in modern computing.

C is the lowest abstraction layer that compiles on the most hardware. "Where the falling angel meets the rising ape", as it were.

</comment><comment><USER4> Because if you don't know C, you don't know what's actually happening when you write software.

Because if you don't know C, you've only seen the map, not the territory.

Because if you don't know C, you're looking at the finger, not the moon.

Because if you don't know C, everything you think about computers is a leaky abstraction.

The counterpoint is that flawed models are often good enough. Newton's theory of gravitation comes to mind.

But if you like knowing what's going on, either for personal satisfaction, or because what you're working on is not fully encapsulated by a different language (inevitably, originally, written in C), then C is both interesting and useful.

<comment><USER5> Comments like these seem to have the underlying idea that C somehow explains how things work. It doesn't. It doesn't explain at all. It's only an abstraction among the others - granted, it's a lower level abstraction.

To understand how a computer works when it executes a program, accesses some data, writes to a disk, spawns a process and forks it, then kills the child after a certain interrupt can pretty much only be learned by learning assembly and some hardware and OS-related literature. Of course, for most programmers(let alone people in general) this is nearly useless information today. It's obsolete. And that's good.

But what C teaches you about how "things are under the hood", is just a leaky abstraction. C doesn't care about such low-level things because they are implementation details. Standard C could be ran by pen and paper just as well as on a computer. It's a "black box". Takes input and produces output according to the standard.

Frankly, the only "low-level" thing C has over e.g. Java is that most domains in which C is used are working close to the hardware and it runs on "the real hard machine". With C, in it's modern domains, you are exposed to these "low- level" details, not because of C, but because of the domain. With many other languages the user doesn't have to deal with such problems because of the problem domain is different.

<comment><USER6> Of course C doesn't "explain" how things work. C is a language, it doesn't explain anything. However, when you write and read real-life C code, you have a chance to learn how software works under the hood much better than with higher-level languages. The low-level rigid type system makes you see how data structures are really laid out. Pointers and direct memory addressing makes you realize how memory is really managed, the real meaning of passing things by value and by reference, and many more things.

<comment><USER7> _However, when you write and read real-life C code, you have a chance to learn how software works under the hood much better than with higher-level languages._

getchar(); //C STDIN.getc //Ruby getChar //Haskell System.in.read(); //java How do any of those show me how software works under the hood? In none of them do I have any clue how a character makes it from my terminal to my program.

int* a; Teaches me nothing about caches, memory latency, NUMA etc. Hell, dereferences are even guarantied to read the same physical location in memory(just the same logical location.)

struct stuff{ int a; int b; };

Doesn't teach me anything about memory layout. C assumes you are running on some hardware from the 70s, it doesn't know about virtual memory, address spaces, memory pages, NUMA, ram with multiple channels, the no execute bit, GPGPU programming. The only thing C has going for it is simplicity.

<comment><USER8> > The only thing C has going for it is simplicity.

But it's an interesting /kind/ of simplicity.

FORTRAN is simple, for instance. Yet we don't use it much any more.

C is simple enough to not make you go bananas trying to learn the language [C++], but rich enough that you don't go bananas solving large, interesting problems [assembly]. It pretty much nailed the uncanny valley of just complex enough.

It's a bit creaky. It desperately needs namespaces. I'm on the fence about memory models (this is a platform thing, in my mind), and definitely Do Not Want threads jammed into the language. I would love a decent macro language, but that's probably a decade-long debate (if what happened in the Scheme community is any indication). I would love a compilation system that didn't suck [yes, macros and a Go-like build system probably don't mix well].

I've been writing C for over 30 years. I plan to keep writing it for another 20. The unscientific, neat thing about C is that it's /fun/. I know this doesn't go over well with standards types and cow-orkers who feel the urge to override operator = and take dependencies on Koenig lookup all the time, but C has a charm that other, similar languages have been unable to capture.

<comment><USER9> _FORTRAN is simple, for instance. Yet we don't use it much any more._

Computing is like an iceberg, with the web being the bit above the surface.

 _rich enough that you don't go bananas solving large, interesting problems [assembly]_

Two words: macro assembler. It may surprise you to know that not that long ago, sophisticated GUI apps were written in assembly language (in fact the IDE I use on my ST, Devpac, was written in assembly, and it's everything you would expect of a modern IDE - editor, compiler, debugger, etc - running under GEM). Many games were written in pure ASM.

<comment><USER10> Indeed and even more... The entire GEOS operating system, gui/windowing system, application suite, and the vast majority of the rest of the apps were written in 8086 assembly language and ran on an original IBM PC.

<comment><USER9> Even business apps on mainframes were written in assembler... In fact a quick Google shows they still are! [http://www-01.ibm.com/software/awdtools/hlasm/library.html?S...](http://www-01.ibm.com/software/awdtools/hlasm/library.html?S_CMP=rnav)

<comment><USER11> There are a few niches where new code is written in assembler (numerical code, parts of standard libraries), but in general, I think 'maintained' is a better word to use.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I think learning many different kinds of languages is important. The breadth of experience makes you a better programmer as a whole. During the trial and sampling of many languages you will fall in love with one. Stick with that one! Your job should be fun. Each person has different learning modalities and concepts they just "get" that are congruent with how they think so no one language is perfect for everyone.

But, why learn C? Learn C to broaden your experience and gain a marketable skill in the most popular programming language[1]. You don't have to become an expert in it but I think everyone should dabble in it a little bit!

1: TIOBE index, June 2012

<comment><USER13> >I think learning many different kinds of languages is important.

I agree with you, 100%. There are no ultimate languages. You have a broad field, as a developer, of words to use - choose the one you a) get along with, b) can comfortably use, c) and are interested in actually using for something.

What I have observed is that good developers learn other languages faster, the more they do it, i.e. if you set your goal higher, you get better at it each time you iterate. I tend to think, as a generality, that eventually there is a point for each individual developer where the effort to learn some new language/codebase/taxonomy gets flatter and flatter, to the point that there are no 'easier nor harder' levels of it any more.

C is still very, very useful. $35 worth of pocketable computing power and a built-in C compiler can still deliver kick-ass results.

</comment></comment><comment><USER14> I've recently started relearning my C skill, since I've had not touch it in almost a decade. I'm combining LCTHW, K&R and Sedgewick's Algorithms in C series in the process.

I have not had so much fun programming since high school. The general feeling of increased brainpower lurks with me these days mostly because of it.

</comment><comment><USER15> Well. Think about it. Probably 95% of the instructions executed on your computer were generated by a C compiler or inlined withing a C program. Check out how many of your programs are linked to a standard or special C library. Perl, bash, Python etc. are written in C. Most libraries are written in C.Throw in what's basically C programming in Objective C and C++ and we're closer to 99%

<comment><USER16> If C++ counts, does Java/C# count as well? If so then we'd definitely hit around 99%

<comment><USER15> No. C++ is a superset of C. You can write C and jam it into a C++ program. This happens often enough in C++ programs. Java absolutely does count. The Sun JVM was written in C !!! So, yes, every java program is executing instructions generated by a C program.

<comment><USER17> Some JVMs are actually self-hosting:

<http://jikesrvm.org/>

      A distinguishing characteristic of Jikes RVM is that it is
      implemented in the Java™ programming language and is
      self-hosted i.e., its Java code runs on itself without
      requiring a second virtual machine. Most other virtual
      machines for the Java platform are written in native code
      (typically, C or C++). A Java implementation provides ease
      of portability, and a seamless integration of virtual
      machine and application resources such as objects, threads,
      and operating-system interfaces.

</comment></comment></comment></comment><comment><USER18> C is the lingua franca of computing.

Pretty much every programming language in existence has bindings to C.

<comment><USER19> except all those written before it?

I program on a mid range system. If I want to write in C for it I could but I have no reason too. I use two languages that appeared well before C and produce very effective and near bullet proof code because of it.

There are some big names in the language world that were here before C and some probably had influence on that language.

While I would not mind refreshing my C, having not had any use for it since 85, I am not even sure where to start.

<comment><USER20> > except all those written before it?

Out of curiosity, what do you use? My history is not too great, but I can't think of many languages that came before C that are still in use today. I actually use fortran at work (along with C), and I'll give a pass to Lisp (it seems like c predates the dialects that are still in common use, ie common lisp and scheme), but it seems like most others (Pascal, COBOL, Basic) are more curiosities in the modern world. Please correct me if I'm wrong.

<comment><USER21> Actually Cobol is pretty much everywhere in the substrate, but not in visible places... banks, insurance companies, and the like have tons of cobol code in use.

<comment><USER22> And if we count VBA, VB6 and VB.net as spiritual successors to BASIC there's an absolutely ungodly amount of new BASIC code in use and being written every day anywhere people use Excel. It's ugly, but it's a large part of how business is done.

</comment></comment></comment></comment></comment><comment><USER23> Because when programming in any language, you can't rise above your own proficiency in C.

That is my observation anyway. I think it has something to do with the deeper understanding of references and dereferencing, and the inner workings of languages in general.

<comment><USER24> I think that may only hold when working with sufficiently C-like languages.

<comment><USER25> In particular, I think that Lisp hackers of old put a solid lie to the claim.

</comment></comment></comment><comment> mike-cardwell I've been programming Perl for going on ten years, I know a bit of Java as well, and have spent the last 4 or 5 years learning a lot about web development. I even recently learned nodejs and coffeescript to a pretty decent level and released <https://emailprivacytester.com/> using it.

I just started to learn C and C++ about a week ago. I did a module of it at University many years ago, but I never kept it up afterwards and forgot nearly all of it. Anyway, I am completely _loving_ learning it at the moment. It just feels like I have so much more control of what I'm doing, and I can't wait to build and release my first non-trivial application using it.

I want to know C well. Mostly, I just want to be able to confidently hack on the massive amount of software that has been written in C over the years.

[edit] I've always had this feeling in the back of my mind, that no matter how good I am at Perl or JavaScript or HTML or Java, I will never feel like an "expert" until I am good at C.

<comment><USER26> Coming from a web development and Python background, and starting to really learn C about a year ago, I know the exact feeling you're talking about. As many cool Python programs I had written, I just didn't feel like it was a "real" program until I programmed and compiled an application in C. And I love how C has made my Python so much more powerful, both through ctypes and Cython. Finally, C was the gateway to Lua, which I'm now enthralled with: a tiny, extraordinarily fast and flexible scripting language that is easily compiled into a C program, thus giving me that single-file binary executable I cherish so much. I know I could do the same with Python, but LuaJIT is just so easy to embed, and yet so incredibly fast. Learning C has opened a lot of doors.

<comment><USER27> I first dipped my toe into C waters at 12 (years old) and very soon felt out of my depth enough to leave it alone. Cut to much later and I think I'm ready to try again.

I've no project in mind yet, but, Eric, your libtm plan caught my eye a few months back and if you've anything on github I'd be interested to follow along. I'm a translator myself and often find myself optimising how MemoQ could be matching segments.

<comment><USER26> Hey, I just e-mailed you. I've ended up starting to prototype libtm in Python -- getting started in C just wasn't working. I still "think" in Python. Python works out well because all the libraries I'm using (leveldb and ICU, mainly) also have very nice Python bindings. Once I've got the prototype in Python, I'll port it to C.

I'll see if I can put what I've got in Python up on github after I finish this big project at work this week and next. I'd be really interested in your input. Did you read the Tim Baldwin presentation on translation retrieval I referenced in my post on libtm? He's done some really cool research that has had a real impact on the way I keep my TMs (e.g., trying not to go over 20,000 segments).

</comment></comment></comment></comment><comment><USER28> This quote is the most important out of the whole bunch: "It's an important, foundational language that requires you to understand the full stack of the technology. If you learn C, you'll understand computers at a much more profound level than if you don't."

We should be careful about the word "learn." I read it as "understand C and master C," not simply being able to write C code.

Why read Shakespeare when you're learning to write? Why study Bach when you're playing jazz? You can definitely skip Shakespeare and Bach, but I think it's universally acknowledged that studying their work gives you important foundational knowledge even if they don't apply directly to your work at hand. Same with C.

</comment><comment><USER29> There's so much C code in so many critical environments that this language is going to be around for much longer than anyone would like...

It'll be the Latin of computing. There will be some poor soul studying and using C in a thousand years.

<comment><USER30> > There will be some poor soul studying and using C in a thousand years.

I would hope that by that time there will be powerful algorithms you can use to transcompile old C code into $LANGUAGE code.

EDIT: Well actually I would hope by that time strong A.I has been invented and asking flesh and blood humans to write code will elicit some _really_ strange looks.

<comment><USER31> That made me sadder than it should have.

</comment></comment></comment><comment><USER5> I think C++ has greatly made C obsolete in many fields, I'd rather see people embracing C++ than C when it comes to learning and using either. For example almost everything C teaches about "low-level" and "how things work" is learned by C++ too, while giving possibility to remain at higher level of abstraction most of the time - if so desired.

<comment><USER32> Agree but kinda Disagree

C++ is built on C. You _need_ to know C (but maybe not the C library) to know C++. Like pointers

<comment><USER33> "Built on C" seems like the wrong phrase to me. "Extension of C" is a better fit.

</comment></comment></comment><comment><USER34>
        > Kernighan and Richie's The C Programming Language is one
        > of most popular, if not the most popular, programming books,
        > and it defined the ANSI standard.

Wait, what? ANSI defined the ANSI standard, which had quite a few additions from K&R C. It'd be more proper to say that the book defined C itself before the publication of the standard.

</comment><comment><USER35> the subtitles on the interview are just amazing

</comment><comment><USER13> I've been a professional C developer for 30 years. I've written C in practically all spheres of application - in embedded firmware, drivers/OS stack, userspace, web, &etc.

These days, I'm not writing so much C, but more heavily depending on the deep understanding I have of how various layers of the whole stack of a computer, running an application, work. How C works, what a compiler is doing with C code, how to write good (and bad) C code .. all of this is a deep skill, still applicable to understanding and debugging at the OS _and_ Application level.

The reason to learn C is this: there are a _lot_ of components of the modern stack that are still composed of it. If you learn C, and know C, and can comfortably produce reliable, rock-solid, working systems around a C framework, then you will have exercised an ability that is, naturally, broadly applicable throughout the computer world.

That is not to say that you should not make C your main language; moreso, use other more advanced, more tailored languages as you see fit. But if you're going to exercise the ability to freely shift over the whole stack, C is going to be a mightier tool than most.

Re: giving K&R to newbies: it should be, give K&R plus "Expert C Programming - Deep C Secrets" to newbies, and professionals alike. Together, those two easy to read books will help you gain a fast grasp of how to write C programs, why to write them in certain ways, and so on. I find K&R a great reference, but Deep C Secrets a rather fun read; only have the latter on the crapper shelf in the bathroom, for example. Plus, I _never_ get DeepCSecrets back when I loan it to fellow coders (ever), so I have a few extra copies, too, to give to newbies I work with. See: ([http://books.google.at/books/about/Expert_C_Programming.html...](http://books.google.at/books/about/Expert_C_Programming.html?id=4vm2xK3yn34C&redir_esc=y))

If you are learning C, and haven't heard of cscope, you can do no better than get it set up, do the tutorial, learn how to use it as a tool. cscope is a very capable text-based navigation/browsing tool, for large C code bases. Unpack your favourite F/OSS application, fire up cscope on the root dir, search for main, build a key word list, navigate freely. Bonus points: it has superlative vim integration.

See: (<http://cscope.sourceforge.net/>) & (<http://cscope.sourceforge.net/cscope_vim_tutorial.html>)

C will not fail you when most other languages might. There are times you may realize, in fact, you are doing things that would be _easier_ in C, off in Java and Haskell and Ruby land, ad&infinitum..

One last really, really good reason to learn C: Lua.

Lua kicks ass. Why? Because you can glom Lua into _any_ C code base, and give yourself a much comfier language to do business/game/architecture code in, while still having a fairly large degree of raw control over the C runtime power, to boot. Master putting Lua into a small C lib collection, and you'll see what I mean.

Learning to add Lua to a big code-base is like .. somehow .. a final 'delivery' of the whole 'write code once, run it everywhere' promise, albeit its a developer mantra, not some CorporateOS-decides-to-bundle-your- interpreter/runtime issue.

Anyway, just my two cents worth. Hope I still see new C coders being made in a few more decades, eh ..</comment>


Ask HN: Xbox One or PS4? Help me decide - <AUTHOR> https://docs.google.com/forms/d/1C1r8vGqZm7PiKZwYI7v1WnXJAJxlENOvi_7cXJlK7qQ/viewform

<comment><USER2> For the first time in history it may seem the correct answer is neither.

The reasons are numerous - there are no must have exclusives, the current gaming season is mediocre at best, there will be glitches for the months to come and most of the good stuff will trickle down to PC anyway

<comment><USER3> This is the route I'm going. I plan on waiting till sometime next year and let the war play out for a little bit. Maybe the steambox will be my choice? Too early to tell right now.

</comment></comment><comment><AUTHOR> Results of the question here: [https://docs.google.com/forms/d/1C1r8vGqZm7PiKZwYI7v1WnXJAJx...](https://docs.google.com/forms/d/1C1r8vGqZm7PiKZwYI7v1WnXJAJxlENOvi_7cXJlK7qQ/viewanalytics)

This is a follow up post from my 2010 post asking for help in deciding between Xbox 360 and PS3: [https://news.ycombinator.com/item?id=1191884](https://news.ycombinator.com/item?id=1191884)</comment>


Two-hour 'dose' of nature significantly boosts health – study - <AUTHOR> https://www.theguardian.com/environment/2019/jun/13/two-hour-dose-nature-weekly-boosts-health-study-finds <comment><USER2> Here's the original study: [https://www.nature.com/articles/s41598-019-44097-3](https://www.nature.com/articles/s41598-019-44097-3)</comment>


Encrypted VoIP data is usually not secure - <AUTHOR> http://security.stackexchange.com/a/16953/10863

<comment><USER2> As with all scientific papers, this has to be taken with a grain of salt.

The assumptions of this paper about the way speech is encoded, encrypted and fragmented are quite extensive. For example, the need for a vbr-codec for this method to work is a deal breaker. Most consumer grade voip is not compressed a lot (considering that 64kbit/s isn't a big deal nowadays) and definitely not using a vbr codec (e.g. G.711 is used quite often, a cbr codec).

So, at least for this method, encrypted VoIP data is usually secure.

<comment><USER3> See also RFC 6562</comment></comment>


Entrepreneur Musk lobbies for government control of AI programs - <AUTHOR> https://www.recode.net/2017/7/15/15976744/elon-musk-artificial-intelligence-regulations-ai <comment><USER2> Already discussed: [https://news.ycombinator.com/item?id=14780752](https://news.ycombinator.com/item?id=14780752)

<comment><USER3> The original lacks the actual video of the event though

</comment></comment><comment><USER4> I think Musk is taking the supervillan jokes a little too seriously. "AI", even though it has produced a number of useful and probably-useful techniques, still has yet to demonstrate anything near enough to intelligence to be dangerous of its own decision. And it's not even close. It's still all parlor tricks or narrow domain-specific applications.

If any AI product is dangerous, it'll be because it's not good enough, or its limitations aren't well known, or because it's been poorly used or built or is otherwise buggy... like any other piece of software.

<comment><USER5> That doesn't mean we shouldn't have controls in place to regulate it.

The biggest "danger" in regards to AI is that people often wrongly assume that any significant level of human like intelligence is required, beyond that they also wrongly assume that we would be even able to recognize if it does reach a level of intelligence that poses a risk.

One of the most common thought experiments is a basic optimizer that goes out of control. This "AI" doesn't need to be intelligent it just needs to have sufficient agency in the real world and basic problem solving capabilities.

In fact a stupid AI with excessive agency arguably scares me more than a rogue Cortana. If only because the latter can be negotiated with while the former could launch a nuclear strike against every population center except 3 because it thinks it's the best way for American Idol to beat Big Brother in ratings.

</comment></comment><comment><USER6> They'll probably nip this one in the bud like they wish they had with the internet and encryption.

When radio first came out anyone could set up a broadcast station until the government put regulations on who could broadcast. Same with TV. It's becoming more and more apparent that the internet has the potential to threaten the current power structures, as does encryption. AI will be another threat to the current power structure.

50 years from now the internet will be as regulated as television and you'll need a special license to use encryption, set up a server, use AI, etc.

</comment><comment><USER7> I'm still failing to grasp how you would be able to regulate something like this. I completely understand why it could be important to regulate, but what exactly would that look like. I also feel that the US Government probably knows the least about AI at this point. A lot would have to change for them to be able to effectively regulate it.

</comment><comment><USER8> AI has countless benefits and, later on, obvious dangers, but until we learn to cope with the problems humanity has, no-one will unite on this issue, so even if Musk gets a country, even the US, to listen, others (China) won't care and, as people like Bostrom have described, you only need one instance that crosses the threshold.</comment>


Build and Deploy Heroku Apps with Docker - <AUTHOR> https://blog.heroku.com/archives/2015/5/5/introducing_heroku_docker_release_build_deploy_heroku_apps_with_docker

<comment><USER2> The announcement I would love to hear from Heroku: "We found out about Moore's law and are passing some of that on to you."

As far as I know, their dyno specs have _never_ improved or decreased in cost.

This is coming from someone who loves Heroku, but wish the dynos were better.

<comment><USER3> They have new pricing coming soon that includes new dynos but they're not getting any cheaper - and ditching 24/7 free dynos.

[http://notes.ericjiang.com/posts/881](http://notes.ericjiang.com/posts/881)

<comment><USER4> According to that link, the price for 1X and 2X dynos is dropping from $35/month to $25/month and from $70/month to $50/month, respectively. That's cheaper, no?

<comment><USER3> Oops I didn't catch that change.

</comment></comment></comment></comment><comment><USER5> I've heard lots of good things about Docker, and lots of seemingly valid criticisms of Docker. I love the concept - I'd benefit from having a development environment that's identical to the environment I'm deploying to.

I'd love to hear from people with significant experience deploying apps. What's your take on Heroku's approach to using Docker?

</comment><comment><USER6> Following the instruction for "heroku plugins:install heroku-docker" and got

Installing heroku-docker... failed ! Could not install heroku-docker. Please check the URL and try again.

I've already upgraded to the latest Toolbelt. Thoughts?

<comment><USER7> you sure you're on the latest version? 3.35.0?

<comment><USER6> Hmm, looks like the toolbelt website ([https://toolbelt.heroku.com/](https://toolbelt.heroku.com/)) is not for the latest toolbelt?!

I updated using gem update and got the latest 3.35.1.

But then when I updated heroku gem, I got the deprecation warning... ! The `heroku` gem has been deprecated and replaced with the Heroku Toolbelt. ! Download and install from: [https://toolbelt.heroku.com](https://toolbelt.heroku.com) ! For API access, see: [https://github.com/heroku/heroku.rb](https://github.com/heroku/heroku.rb)

<comment><USER7> don't use the gem, install with the toolbelt

</comment></comment></comment></comment><comment><USER8> Honestly, if anything, I think Heroku needs servers in Asia</comment>


Apple sues Qualcomm, saying chipmaker withheld $1B as "extortion" - <AUTHOR> http://arstechnica.com/tech-policy/2017/01/apple-files-1-billion-lawsuit-against-qualcomm-over-patent-licensing/ <comment><USER2> Qualcomm double dipping (charging chip vendors & their customers) is plain unfair. The only thing they aren't doing is sending IP notices to end users of phones, like you & I.

That said, sympathizing with Apple is hard. Ironic for a company that hardly allows any freedom on it's hardware (blocking NFC for 3rd parties for instance, requiring MFI certification for accessories at a steep cost) or app store (ultra strict, often whimsical app approval policies that stifle innovation) to cry foul.

Apple & Qualcomm deserve each other.

</comment><comment><USER3> Without knowing more, not particularly sympathetic to either party involved here, (lawyers are good at drafting statements about how hard done by their companies are over patents infringement and royalties/damages), but qcom have done well out of e.g. cdma patents [http://www.wsj.com/articles/SB112056555346377303](http://www.wsj.com/articles/SB112056555346377303)

<comment><USER4> I do believe Qualcomm patents are worth something, but if those quoted numbers are true, (Qualcomm insists on charging Apple at least five times more in payments than all the other cellular patent licensors we have agreements with combined.)

Then this is a ridiculous amount.</comment></comment>


Life and Death in a Troubled Teen Boot Camp - <AUTHOR> http://www.rollingstone.com/culture/news/life-and-death-in-a-troubled-teen-boot-camp-20151112 <comment><USER2> Reminded me of Camp green lakes, [https://en.wikipedia.org/wiki/Holes_%28novel%29](https://en.wikipedia.org/wiki/Holes_%28novel%29)</comment>


Is OpenSMTPD worthy of OpenBSD inclusion? - <AUTHOR> http://thread.gmane.org/gmane.os.openbsd.misc/225512 <comment><USER2> It's an SMTP server, started just two or three years ago, written by people who care about security and hope for it to be included in OpenBSD, written in... C.

(Edit: Corrected by vezzy-fnord, started in 2009.)

The only currently-extant memory-unsafe language.

I... just... argh... when we will finally be rid of this albatross? What hope is there for the world of computer security if we can't even greenfield a solution to what has already proved to be one of the most dangerous security domains there is (thanks, sendmail) in something other than C? Why are the words "buffer overflow" appearing in relation to such young code? What am I doing with my life? Why am I even trying to write secure code in a world where this is even remotely considered an option?

<comment><USER3> I am hoping that Rust will make in-roads into the BSD world, since it interoperates well with C and is much safer by default while not imposing overhead like a managed language+runtime would. It also has very liberal licensing (GCC being GPL has always been a tough pill for some to swallow, FreeBSD at least has already switched to Clang) [https://github.com/rust- lang/rust#license](https://github.com/rust-lang/rust#license)

The OpenBSD folks have done great work through auditing and writing safer code in C, and I agree that using a language that ameliorated at least some of the common mistakes programmers make would be a net positive.

Related - this blog from @tedunangst is worth reading, regarding the limit to which even a language like Rust can protect against specific exploits (the OpenSSL "Heartbleed" vulnerability, in this case) [http://www.tedunangst.com/flak/post/heartbleed-in- rust](http://www.tedunangst.com/flak/post/heartbleed-in-rust)

<comment><USER4> From what I understand, Rust is not making in-roads into the OpenBSD world for at least these reasons:

1) Rust's use of LLVM means it will not work on some hardware platforms that the OpenBSD folks are committed to run on.

2) The Rust project currently does not offer a long term support release.

These are important to the OpenBSD team. Additionally, I am sure that they value the memory safety that Rust offers.

I wonder if the OpenBSD team would ever design a systems language?

<comment><USER3> Note I said "BSD World" :) FreeBSD is already using LLVM (Clang) instead of GCC, and support fewer platforms - I think this would be a more pragmatic place to push something new like Rust.

If it works out there, OpenBSD could audit and import things at their leisure, at least in theory.

</comment></comment></comment></comment><comment><USER5> I ran my own mail server using OpenSMTPD and Dovecot for a little over a year, and found OpenSMTPD to be very easy to set up and configure. I needed something light, that I could easily tweak to fit my needs. I mostly got things working reading the man files, and asking for help in the IRC channel (thanks Gilles). I also looked into Postfix, and I'm sure it's great, but the amount of configuration options were a bit daunting.

I think the project deserves more contributors and more eyes to look at the code. A fantastic foundation has been laid, but we can't expect Gilles to be able to do it all alone. This is a diamond in the making!

<comment><USER6> I think you stumbled onto the recurring problem:

"we can't expect Gilles to be able to do it all alone"

Just like with GPG. In FOSS circles, there's all kinds of people that want to take the code but few to create it. So, people gripe about the state it's in while putting no effort in to improve it. At least the author contributes significantly. However, gotta wonder how many users it has vs how many are contributing code/audit.

Bet the difference has an impact on the situation. It's why I spend time here and there investigating proprietary, open-source models that require money or contributions to use the software. Doesn't even have be a lot: at least enough for a significant product to support at least one developer. That way the users are always investing into it and esp bug fixes happen.

<comment><USER7> gilles operates in a community where problems like this are taken very seriously, and where enough developer resources exist to sweep the smtp code base several times over. I expect a lot of fixes coming up over the next few weeks.

The real problem is that the OpenBSD community didn't realise the state of things internally, because gilles and eric were trusted to not fuck up. This happens, since not everybody has time to follow every corner of the tree all the time. But when focus on a particular area is needed we can do it.

It's good that Jason pointed out these problems, however the manner in which this was done creates huge public exposure which puts pressure on all of us (especially gilles and eric) to produce results very quickly while we prefer moving slowly and being careful because that produces better results in the long term.

<comment><USER6> To be clear, I wasn't smearing any developers or the project relative to others. Just noting a common problem in OSS development that probably hurts their project to some degree.

Appreciate you adding detail on the project's situation. Also on how you all view the post and its effects. As HN gets exposure, do you a specific, alternative approach for anyone reading that might end up Jason's shoes to get the OpenBSD team focused on a particular project and digging into it? I'm guessing he didn't make an attempt outside the public disclosure or made an ineffective one.

<comment><USER7> Find out who's been involved with the area of the code base recently, and mail all their @openbsd.org addresses directly in one mail.

If they don't reply after a few attempts, or give unsatisfactory answers, try mailing Theo. He acts as arbitrator in such situations.

If even that doesn't help, your last option is to write good fixes yourself, and keep submitting them as diffs to tech@ until you're either banned from posting to the list (at which point you should just give up) or your diffs end up being commited.

<comment><USER6> That's crystal clear: now anyone reading knows the best approach. Makes sense, too. Except that last part.

I agree it's the best option to rollup the sleeves and just fix the problem you're griping about. However, a write-up like Jason's is a valid option, too, if person doesn't have time/resources/skill for that option. Because, at that point, known issues would've been ignored by everyone up to Theo despite it being in default install and under OpenBSD's quality image. A write-up drawing attention to the issue would be justified to prevent users from placing unjustified trust in that component. Being informed lets them take action either on improving the component themselves, limiting damage it could do, or just avoiding it altogether.

Still agree that the gripe should go to the developers and Theo first.

<comment><USER7> But Jason did send diffs, and we are discussing his situation as an example.

Anyway, like it or not, in the OpenBSD community, working diffs, especially ones that fix a security issue, are the best way of winning an argument. You can try to blog about it but you probably won't be taken as seriously. So if you really care to convince the community from the outside and everything else has failed, and you can't code C youself, find a friend who can and ask for help.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> What worries me is the lack of updates for OpenBSD. Is those issues he's talking about are for real? I run "pkg_add -u" frequently and I don't see any updates. I'm running "stable 5.7". I understand that OpenBSD doesn't provide updates or bugfixes after release, but security updates should be pushed.

I'm casual OpenBSD user and may be I don't understand something.

<comment><USER9> > I'm casual OpenBSD user and may be I don't understand something.

Yikes.

"pkg_add -u" is just for ports/packages. Security updates to OpenBSD itself are distributed via patch and are listed here for your version here: [http://www.openbsd.org/errata57.html](http://www.openbsd.org/errata57.html). Explanation on how to apply them is found in the patch file itself.

<comment><USER10> Just to be complete, the openup utility from M:Tier covers this as well (see my other comment for more details).

</comment></comment></comment><comment><USER11> Probably a dumb question but why did the world need another SMTP solution? What was OpenSMTPD supposed to do better?

<comment><AUTHOR> It's a lot simpler to setup and configure than Postfix or qmail. It promises all the nice privilege separation of those daemons too. The appeal for me initially was that it would be small, simple, and very secure.

<comment><USER6> Could people have just improved the configuration or setup of already rock- solid qmail?

<comment><USER12> The qmail code and configuration are both quite unlike what many people are used to. It definitely wasn't being imported with the config/service model it uses, and reworking it to be like every other daemon would involve a lot of code changes.

<comment><USER6> Appreciate another insider viewpoint. Going by this:

[http://cr.yp.to/qmail/qmailsec-20071101.pdf](http://cr.yp.to/qmail/qmailsec-20071101.pdf)

Do you think they could apply any of that to current project? Particularly in sections 3-5. I defer to you here as your experience is directly relevant. Would any of his approach, on top of looking for top 10 C issues, have improved the security of this app? Or was none of that applicable?

<comment><USER12> I think the approach is quite similar, but the devil's in the details. From looking at a couple bugs, the efforts to reduce TCB were not as effective as hoped.

</comment></comment></comment></comment></comment></comment><comment><USER6> "it threatens the OpenBSD.org frontpage security claim"

This misinformation is my only problem with the article. That claim has probably never been true. If it was, they wouldn't be regularly fixing shit that might be exploitable. Still, I came up with a way to test it years ago on Schneier's blog for anyone that wanted to try:

"Watch mailing list for bug announcements. Quickly determine if it's exploitable. If so, turn it into a payload. Hit target system. Profit." So, it's special in terms of quality focus but still can be hacked if anyone bothered to try. (Few bother.) Especially at layers below kernel that they don't care about, privilege escalation because they refuse M.A.C., in a VM because Theo doesn't worry about those issues, and covert channels because they probably never heard of them.

Note: It's reputation adds more risk as it's often used for "fire-and-forget" appliances. This can be reinterpreted as "they don't patch or they patch very rarely." The more they trust it, the more likely the bad guys get in. ;)"

<comment><USER13> "That claim has probably never been true."

Well, pretty easy to disprove. All you have to do is name a single remote hole in the default install in the last, oh, 8 or so years.

<comment><USER6> Real quick, as I'm clearly not an OpenBSD user. Does the "default install" include the apps a deployment will almost certainly use? That is to make the claim meaningful. And have there been any software defects in OpenBSD or its critical apps over past "8 or so years" that could've been exploited by attackers?

That would be a start. My guess was that OpenBSD team didn't track (and update web site claim for) the number of defects that might have been exploitable: just fixed all defects as they found them instead. If so, that makes for great QA practice but inaccurate claim on web site. Otherwise, there's a tracker somewhere listing all bugs found in privileged software, their exploitability, and time it took to fix them. That tracker will have a huge list of issues with only 2 marked as security issues.

<comment><USER14> OpenSMTPD is in the default install, however in the default configuration it does not accept remote connections.

<comment><USER6> That's a good start.</comment></comment></comment></comment></comment>


Now You Can Take Google Glass Photos Just by Winking - <AUTHOR> http://www.tomshardware.com/news/Google-Glass-Photos-Winky-Winking-Developer,22401.html <comment><USER2> Cool stuff. You'd need to jailbreak your Glass to install the app though. Glassware only works as web services over the Mirror API for the time being, not as installable software.

</comment><comment><USER3> How does Glass tell if you're winking or blinking?

<comment><USER4> I imagine duration and "measured muscle tension" around the eye would work. A deliberate strong wink should be distinguishable from a blink. It can work the same way a long click or long tap works (think about how you cause the icons on the iPhone launcher home screen to wiggle so you can rearrange or delete them)</comment></comment>


Keep laughing; Cuil isn't quitting yet - <AUTHOR> http://www.businessinsider.com/cuil-office-tour-2009-11 <comment><USER2> The name probably caused them more trouble than it should have. It's the same criticism being thrown at Bing (the idea that Google is a verb now, and you need a name that works well for that).

I can't just tell my friends "hey, try out Cuil", I have to spend a few seconds explaining how to spell it. That's no way to get the word out.

The technology is good, the site is very fast and relevant. But there's a lot in a name.

<comment><USER3> People forget that Google had the same problem. Before Google, "google" was spelled "googol".

<comment><USER4> It still is, google is the misspelling.

As for CUIL, their crawler was such a nuisance at some point that I blocked their complete network. I doubt I'm alone in that.

And if those 'twiceler' guys don't start playing nice I'll do the same to them.

<comment><USER5> Pretty sure twiceler is Cuil....

<comment><USER4> Ah! thanks.

That clinches it then. One more agent for the ban list.

Apropos, I think that plenty of bad guys are masquerading as twiceler as well.

Mozilla/5.0 (Twiceler-0.9 <http://www.cuil.com/twiceler/robot.html>

When 'CUIL' first came out their crawler was all over my servers, sometimes to the point of making them inaccessible for users, I remember having a devil of a time getting rid of them because they came from lots of different IP blocks.

Apparently their bot is called twiceler, maybe they should name it 'CuilBot' or something to that effect.

<comment><USER6> Judging by your response, maybe they _shouldn't_ name it Cuilbot.

I wonder if their overzealous bots and subsequent blocking are reasons why they launched with such terrible results. I heard several reasons for that catastrophic failure:

* Overstressed subject-specific servers failed, leading to porn on hamburger searches and that kind of thing

* Crashing, random result variations due to overload

* Excessive media hype exacerbated the load issues

Another one to add to the list?

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm sorry, but 7 petabytes for the largest search index in the world? I'm hoping the reporter misquoted the developers here. If we conservatively assume servers with half a terabyte of hard disk space, that's 14,000 servers for the web index. Google was estimated to have 450,000 servers in 2006, and presumably has many more than that now. So less than 5% of their server stack would be required to store that size of web index. Considering that web search is still Google's core product, this seams easy to believe. And much more if you include image caching, maps, videos....

</comment><comment><USER8> The name is silly, but who cares. The search results just aren't very good. My impression is that the ranking algorithm is passable, but that they just don't have nearly the depth of Google. Less popular but highly relevant pages that come up in google are completely missing from cuil.

</comment><comment><USER9> I'm still awaiting the day Cuil does phrase queries. I know, most casual search users don't do quoted-phrase queries -- but Google and Bing do, and I occasionally use them, and Cuil has no chance of being my default search engine if it doesn't take the trouble to support them, too.

</comment><comment><USER10> _making Cuil the neighborhood store stocking the hard to find antique and offbeat books._

Cuil's design is too slick to pass as a neighborhood book store. It needs more rough edges and needs too appear old and established. Instead it feels young and fresh and naive.

</comment><comment><USER11> Personally, I would worry about having my livelihood run on those servers. What's their redundant power system now? Do they even have one?

Their wooden pallet/cables hanging over table system seems like every Sysadmin darkest nightmares...

</comment><comment><USER12> I've given feedback to Cuil to change their results page. But they _ignored_ it.

</comment><comment><USER13> their search quality id even not matching duckduckgo, not mentioning google and bing

</comment><comment><USER14> when i looked at this, i wasn't excited or envious of all the geek gear, i just thought it represented a massive waste of resources. they took their shot, they flopped...any time/mindshare leftover for google alternatives now belong to bing and players to be named later (blekko etc). to continue to pour money into hardware and development just seems like a massive waste. just give the money to an inner city school...actually put that wealth to some positive use for humanity</comment>


Automated cross browser testing with JavaScript - <AUTHOR> http://dalekjs.com/

<comment><AUTHOR> Most interesting in the regard of (eventually) being able to replace Selenium in our stack. While currently in an early stage - it will be capable of doing pretty much everything Selenium can do - without requiring Java. Functional / UI / E2E testing with a Node.js based stack would allow an even greater audience to create meaningful tests.</comment>


Web 2.0 Gets Big and Corporate - <AUTHOR> http://bits.blogs.nytimes.com/2008/11/07/web-20-gets-big-and-corporate/ <comment><USER2> I thought something was getting smelly on the web; am I the only one who is peeved with a web littered with senseless features that don't solve anything?</comment>


Ajit Pai's "Harlem Shake" video preparations must remain secret, FCC says - <AUTHOR> https://arstechnica.com/tech-policy/2018/04/fcc-wont-reveal-the-secrets-behind-ajit-pais-anti-net-neutrality-dance-video/ <comment><USER2> Why is he like this

<comment><USER3> He's a "useful idiot."

The White House is being run like a reality TV show. The news outlets are all fixated on its theatrics-- "you'll never guess who Trump fired this week!" in between meaningless gossip and muckraking affairs with washed-up porn stars. It's a hit parade of scandal.

Neutering net neutrality was a big, dramatic deal that upset a lot of people and drew a lot of attention. Putting this offensive moron out there is just another sideshow that soaked up a lot of energy and made us all feel helpless about the outcome of something many cared about. Like Shkreli's antics, stunts like his get us emotionally invested in hating him because he's baiting and trolling us all the while.

Meanwhile submarines like the CLOUD act get passed with no fanfare. Trade wars with China are begun. Nobody notices, because we're all busy throwing rotten tomatoes at the dancing fool.

<comment><USER4> I think the current news media should share some of the blame for chasing dollars through emotion way more than journalism.

Shkrelli was a small bit player in that realm. Much larger companies with much more money and power are doing the same thing doing much more damage by sheer volume than Shkrelli. We certainly don't see article after article about that.</comment></comment></comment>


Analyzing Caltrain Delays - <AUTHOR> http://www.svds.com/the-trains-project-analyzing-caltrain-delays/ <comment><USER2> Data scientists blog about Caltrain data, come up with convoluted hypothesis about bias in sensors at two stations.

Commenter on blog notices that Caltrain is occasionally single-tracking between those stations due to a bridge replacement. [1]

"Data science" ends up with a bloody neck from Occam's razor.

[1] [http://www.caltrain.com/projectsplans/Projects/Caltrain_Capi...](http://www.caltrain.com/projectsplans/Projects/Caltrain_Capital_Program/San_Mateo_Bridges_Replacement_Project.html)

<comment><AUTHOR> There are a couple of reasons that this isn't the explanation.

To pick one, the random data selection in the blog post showed data from October 2015 -- Feb 2016, and this Caltrain link appears to show the bridge work starting Feb 26th, 2016.

So, no the just-so story doesn't appear to be just-so.

<comment><USER2> The data is very much consistent with the bridge work hypothesis. The website indicates a series of bridges are being replaced. Starting 9/28/15 with Tilton Ave. and proceeding northward to Monte Diablo Ave then Santa Inez Ave.

</comment></comment></comment><comment> guard-of-terra Seriously, need to break that vicious cycle: you get used to things going bad, people who run them get used to not delivering, breaking due process, posting unrealistic schedules, and BAM - now you think the problem can't be solved, only plotted.

I don't remember last time when I have not seen a train at a station at scheduled time, and the place where I live doesn't expire confidence. When something is late, it gets in the news. Not every week.

<comment><USER3> To be (grudgingly) fair to Caltrain, a lot of things are perhaps indirectly out of their control-stuff like suicides (until you get gated platforms to stop people from jumping in front of Baby Bullets) and vehicles stopped on tracks are hard to predict. Likewise they are a victim of their own success- standing room only trains make boarding and unboarding longer than they have to be.

Of course, Caltrain has put off electrification and grade separation for a long time, and even now its massively expensive and ruinous (see the CBOSS fiasco) so its not like they are totally off the hook.

<comment><USER4> I can't help but feel that if there was a BART line where the Caltrain currently runs, things would be about a hundred times better than they currently are, on all fronts. Alas...

<comment><USER3> Electrified Caltrain is infinitely preferable to BART.

<comment><USER5> Why electrified vs normal caltrain? Will that decrease the variance or door to door time of using caltrain?

<comment><USER6> Faster acceleration. Each stop will cost less time, and Caltrain has a surprising amount of stops between SF-SJ (22 weekday) for its length (47 miles). You can see this effect already with the amount of express schedules that Caltrain has and their varying trip times.

<comment><USER5> Yeah I couldn't find any estimates about how much time though. It seems like the express train would not be affected much at all.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> If only Caltrain had a decent API for developers that produced data that is needed for any serious analysis (like train number, speed and lat/long). I hate having to resort to hackey workarounds like scraping for this info. I believe the NextBus API for MUNI has actual positional data and vehicle info. Caltrain, being the mediocre agency it is, has a next to useless API (if I remember the docs correctly on 511.org).

<comment><AUTHOR> An API would go a long way and realtime information would obviously be awesome. It appears that even if Caltrain provided historical data of actual departure times per train per station, that would be a huge improvement.</comment></comment>


'Google go home': the Berlin neighbourhood fighting off a tech giant - <AUTHOR> https://www.theguardian.com/cities/2018/may/09/fuck-off-google-the-berlin-neighbourhood-fighting-off-a-tech-giant-kreuzberg <comment><USER2> I think Berlins "Poor but happy" times are fast coming to an end. Rents have been rising quickly the last few years and tech companies and startups becoming more prevalent. Heck, Neukölln went from being a cheap alternative to being as trendy and expensive as Kreuzberg.

Berlin kinda, from what I understand, enjoyed it's special culture much because it wasn't an industrial city and lacked an large international airport, but cheap rent, international vibe and fun hipster values seems like the perfect void for tech to move into now that rents and prices in the usual "big cities" have gone through the roof. I can also imagine cities like Amsterdam and Berlin getting some Brexit escapees.

Mark my words, Berlin will be Europe's Silicon Valley within a few years.

<comment><USER3> No way. Europe's Silicon Valley will establish in Eastern Europe, where living is cheaper and governments are more willing to ease up on regulations to accomodate the flexible start-up employer-employee relationships. Warsaw, Sophia, Tallinn, those are the spots to keep an eye out for.

<comment><USER4> Speaking of Estonia, I was at their embassy in Stockholm last fall and they were pushing hard for Tallinn as the next European capital of tech. Nearly every conversation you had with them, regardless of topic, would somehow gravitate toward how great Estonia is to set up a tech shop. Whether because of cheap real estate or the quality of their work force, or the prevalence of craft beer – it was all just a great place to be.

Frankly I kind of bought it. I'm going to visit this summer.

<comment><USER5> Honestly speaking, Tallinn is a boring place. Might be good for business but I don't see it as attractive for people willing to move, maybe in the short-term for a job but it's not a place I'd see many settling in.

Go visit it anyway, that's, of course, just my impression, but even living in Stockholm (a place I consider a bit boring for my standards of big city life) I found Tallinn very very dull.

<comment><USER6> Tallinn is massively more fun than Helsinki

<comment><USER5> Haha, that I really can't disagree with.

</comment></comment></comment></comment></comment></comment><comment><USER7> I live in the neighbourhood, very close to where the "campus" is being built. I understand that Google has a lot of symbolic value in the protests, but I don't think that it actually will have such an impact. Paul-linke-ufer is already full of startups and relatively affluent american hipsters flood the caffes in the hood. That is also ok, I guess, (like UFO361 says hahaha), people in the end can live wherever they want. But what is not ok is the cartel-like tactics that Berliner landlords use to rise rents. In Germany people tend to not own flats, but this means many buildings are owned by big companies with lots of pressure power when they want to do mass rent increases. They do really shady things like playing with the WBS (social housing) rules against the renters, like with these renters in Maybachufer: [https://www.neues-deutschland.de/artikel/1086567.falsches- sp...](https://www.neues-deutschland.de/artikel/1086567.falsches-spiel-am- maybachufer.html) The rents went up 17% last year in and this rate is increasing every year. This is really worrying and I hope the city becomes serious about it.

<comment><USER8> Paul-Lincke-Ufer was my first flat in Berlin, in 2008. A bedroom then went for €400/mo, and that was considered high then. Now I imagine it is 3-4x that.

<comment><USER9> I had a tiny studio with coal heating on Maybachufer in 1996 for under 200 DM (!) per month, "warm" (i.e. with the coal it was about 200).

But even back then: a single company owned the building, and kicked everyone out so they could renovate and get their gentrification bonus. To help motivate the older residents they started the exceptionally noisy renovation work at 6am every day.

</comment></comment></comment><comment><USER10> I always find it amusing that American companies, be it Amazon or Google, are surprised that people don't want them here. They seem to really believe people love them, whereas in fact people use them because they have to, and put up with problems caused by them also because they have to.

<comment><USER11> I don't think that anyone is surprised here. The quote is:

> I think Google were surprised that they came up against opposition," says > Stefan Klein, a local activist with the GloReiche neighbourhood group at one > of their twice-weekly open sessions.

So, one activist thinks that Google is surprised (which sounds quite naive IMHO).

Then later in the article:

> A Google spokesman in Berlin says that the company has spoken to residents > about their concerns and is incorporating their feedback into its plans. "We > live in Berlin ourselves, we understand the concerns of neighbours about > gentrification and know how Kreuzberg has been developing in recent years."

<comment><USER12> I'm not saying Google was surprised, but a spokesperson would have to be pretty poor at their job if they admitted they were caught off-guard.

</comment></comment></comment><comment><USER13> One important thing that's not at all clear from the article: this is _not_ a campus for Google employees a la Googleplex, but a capital-C Campus run by Google for Entrepreneurs, meaning basically a coworking space/startup incubator that happens to be run by Google. So even if it's built, the people working there won't be Googlers, but random startup people in Berlin.

[https://www.googleforentrepreneurs.com/campuses/](https://www.googleforentrepreneurs.com/campuses/)

<comment><USER14> Thanks! That was _really_ not clear in the article, and after their list of existing Google campuses, I wondered what had happened to Zurich and Sydney...

</comment></comment><comment><USER15> I live in this neighbourhood and my office is on the same street, one block from the new campus. The area is nice and lively, so I get people want an office there (hell, I did the same!). But Google has the means to positively impact the less hip, more strugling parts of Berlin. I bet people would welcome them with open arms in Marzhan or Wedding.

<comment><USER9> Yes, but would the people Google wants to hire want to work in Marzahn or Wedding?

<comment><USER16> If Google is there, they would. And if not Berlin is one of the few cities on this planet where people actually live in the city center and drive outside for work.

</comment></comment></comment><comment><USER17> I live right in the middle of this and have been been collecting photos of posters and other relics - which I always promptly send to my friend now working at Google (elsewhere). The neighbourhood is definitely changing. A key fact is that the protests stem from the anarchist / squatter scene that is based literally next block.

</comment><comment><USER18> [https://fuckoffgoogle.de/](https://fuckoffgoogle.de/)

There is now a website even.

</comment><comment><USER19> It kinda seems like the protestors build their arguments around the fact that they don't like Google, not vice versa.

Also it's amusing how the article struggles with "Umspannwerk"

</comment><comment><USER20> Obviously they can oppose all they want, but the fact of the matter is that most people are going to love the jobs and opportunities it will bring. Whether that is high-paying jobs in engineering or management, middle-paying in hospitality, construction, renovation, or lower-paying in cleaning/janitorial.

At least it's my perspective that these sorts of neighbourhood changes are impossible to prevent. Does anyone know of any examples otherwise?

<comment><USER21> Kreuzberg is different. It's a traditionally leftist district. Every May Day there are clashes with police. At least when I lived there. It may eventually change but the people there are not as money focused. They are more culture focused in the sense of wanting local business over large corporations. Most people there are not going to love the accompanying jobs. Some jobs aren't worth the cost. Some are.

</comment></comment><comment><USER11> The article makes it sound really bigger than it is. From what I experienced the opposition is quite small, signs anti-google are only visible in a few specific locations in one neighborhood, and in general only a few people are vocal against it (mostly anarchists or anti capitalists activists). I would expect some level of opposition from a fringe of the population in any city where Google or other tech giants want to open offices.

<comment><USER22> "Google campus will only have 6-10 employees"

Kreuzberg is...special.

<comment><USER23> Why would they build a whole campus just for 10 employees?

<comment><USER8> Because lots of Google employees travel for a significant amount of their time and many visit Berlin often.

<comment><USER23> But to me, campus sounds like something that can host at least 500 to 1000 people. So Google should communicate properly that they are building a private co-working space, not a real campus

</comment></comment></comment></comment></comment><comment><USER24> As a Berliner, I find it hard to understand the resistance. On the one hand everybody cries out here about the rising rent and the stagnating wages and on the other hand there is this opposition against bigger companies (e. g. Google or big media companies at the Spree). Gentrification will happen anyway because of investors buying off apartments, houses or complete blocks. Berlin has one of the highest tax on purchasing housing space in Germany which is really bad for people buying apartments but doesn't matter for investors that buy as a business since they can get them partially back with their tax returns (not possible if you use the space yourself instead of renting it out).

Big companies would give the market some incentive to raise the wages, which I know is at first bad for small startups but also attracts so much talent that it will balance out at some point (I hope).

I guess this is part of the Berlin culture, being innovative and free minded but also being completely against any change. Only 10 waking minutes away from the future Google campus there is this big fight about reworking the riverside of the Landwehrkanal which should make it accessible for Wheelchairs and baby strollers as well as bikes but people are protesting, living in one of the best appartments with still cheap rent because of their old contracts. Before that there was this even bigger fight about a small part of the old Tempelhof airport area. The city planned to build houses and office space there. I can't imagine any other city (with a housing crisis) where people would oppose to this. The fear was that a nature reservation area would suffer which according to plan would have been not be the case.

Probably it's a matter of view points, there are the new economy workers like myself waiting for companies to settle in Berlin (not so many there because of the cities history) and then there is the other side with people in really low paying jobs that fear exclusion, totally valid. I don't have numbers but I could imagine that Berlin as quite a bit discrepancy between low and high income households with quite many on the lower end because it has so few big industries.

Cheap Berlin only exists in some parts and mainly myths. Friends of mine pay the same rent in Munich for comparable apartments while going out can be cheaper in Berlin but only if you know where to go, the beer price is mostly the same, food depends. The wages are much lower in Berlin, for developers it's at junior entry at around 10.000€ per year less.

</comment><comment><USER25> As a Berliner I find this hideous. There are so many high end work spaces in Berlin which push the rents anyway. This is mostly invisible to the angry mob but with Google they have a fall guy. This is completely distracting from the underlying structural problems.

</comment><comment><USER26> ces allemands sont fous

<comment><USER27> The right way to say that would be :

"Ils sont fous ces Goths"</comment></comment>