Introduction to x64 Assembly - <AUTHOR> http://software.intel.com/en-us/articles/introduction-to-x64-assembly?wapkw=%28video%20encode%20white%20paper%29

<comment><USER2> For those of you that went through Z80, 6502, 68000, x86 macro assemblers like myself, it is just me or does the AT&T syntax just suck?

I recently had to convert some code from Intel syntax with NASM macros to GAS with AT&T syntax, and boy what a pain.

<comment><USER3> I agree that indexing looks way better in Intel ("[ebx+3]") than in AT&T syntax ("2(%ebx)").

However, for me, AT&T's "mov X Y" for "move X to Y" feels better for me than Intel's "mov Y X" for "move Y from X" (who says that?). If they wanted to things in reverse, they should have named the instruction differently, for example as "load Y X" for "load Y from X" (as in "LDA #0xFF" from the 6502)

As for movl instead of mov, I like the 68K version (MOVE.L) better.

<comment><USER2> I always read

mov x, y

with coma being a synonym for equals, like mov x = y, hence it feels more natural to me.

But the biggest issues are address modes, specially the more complex ones and the macros seem very light weight in features when compared to the Intel world.

<comment><USER4> I love this comment. It shows how powerful the right metaphor can be in understanding something, which is something we obsess over at Dev Bootcamp when teaching students. It also shows how tiny affordances (<http://en.wikipedia.org/wiki/Affordance>) make us "think" specific thoughts. I mean, it's called "mov" so something must be moving, which means there must be a subject, object, and possibly an indirect object, right?

This is what Piaget meant when he talked about "schemata." (<http://en.wikipedia.org/wiki/Jean_Piaget#Schemata>) So, thank you for the new schema. :)

This particular one had never occurred to me and makes it way easier to internalize.

Sorry for gushing -- few things get me more excited than a new way to explain something. :)

<comment><USER3> I see this more as a) an example of how well humans can learn to ignore misdirection (the word 'move' hints at src, dest arguments) and b) the first small step towards C:

\- read "mov X,Y" as "X = Y"

\- adjust syntax so that it allows "X = Y" (what you see is what you think)

\- similarly, replace obscure syntax for indexed memory acces by such things as "X = Y[3]"

\- getting annoyed with the seemingly random limitations of the language, add an expression parser that translates "X = 2 * Y + 3" into "X = 2 * Y" and "X = X + 3", each of which gets assembled into one instruction. For now, only allow expressions that get away with only using the result register for temporaries.

\- use existing macro capabilities to build a library of control flow statements such as IF and WHILE.

\- introduce standard way to call subroutines.

\- introduce shorthand method for doing such calls: one for the call site that takes a couple of expressions as argument, and one for function entry that uses macros such as 'int' and 'char' to pop arguments from the call stack.

By that time, one almost has K&R C.

<comment><USER5> I wrote my first compiler in M68000 assembler in a similar fashion to your steps. I started by allowing it to recognize M68000 assembler opcodes, and when found it'd just copy the line to output, otherwise it'd parse and compile the line. You could use register names and sizes directly in the statements.

So e.g.

        D0.W = 5

Would translate into:

        MOVE.W #5, D0

I didn't use macros though - handling basic argument passing is simple enough.

As soon as I had the basics of procedures/functions, simple expressions and argument passing in place I started rewriting the compiler using it.

</comment></comment></comment></comment></comment></comment><comment><USER6> The calling convention is a god send.

One thing to watch out for people learning IA-32(e) asm is that there are two syntaxes: Intel and AT&T. Intel, unsurprisingly, uses Intel syntax. GCC, however, mostly uses AT&T syntax (for historical reasons, and that's all I'll say).

You can find a reference to the GAS syntax at <http://en.wikibooks.org/wiki/X86_Assembly/GAS_Syntax>. I wouldn't use it for a reference to any of the instructions (for that grab the linked Intel manuals in this article), but that should get you familiar with the differences if you decide you'd like to write GAS.

You do have the option to set GAS to use Intel syntax with a directive, but if you're modifying legacy code or just want to be consistent with a lot of other GAS code, you may want to use AT&T.

</comment><comment><USER7> I learned by working through the software developers' manuals. Many years ago, they used to ship them as physical copies. Nowadays they just send CDs.

PDF copies: [http://www.intel.com/content/www/us/en/processors/architectu...](http://www.intel.com/content/www/us/en/processors/architectures- software-developer-manuals.html)

<comment><USER6> When did they stop shipping physical copies? I ordered the new manuals for VT-x not 4 years ago and they were happy to ship me the full set of volumes for free.

<comment><USER7> I tried to order in january 2012 and they said back then that they replaced the free physical books with free CDs. Now it says:

Note: We are no longer offering the Intel® 64 and IA-32 Architectures Software Developer's Manuals on CD-ROM. Hardcopy versions of the manual are available for purchase via a print-on-demand fulfillment model through a third-party vendor, Lulu (please reference 1 and 2 below): <http://www.lulu.com/spotlight/IntelSDM>.

</comment></comment></comment><comment><USER8> That 3D "cross" graphic (Figure 1, "General Architecture") might be the worst illustration of a programmer's model for a CPU I've ever seen.

I'm sure it makes sense _after_ you've read the accompanying paragraph a sufficient number of times (once didn't cut it, for me), but not so sure it helps in that understanding.

I guess it's a funny hint that the x86's architecture is complex, when a figure that's just trying to _describe the register names_ is this complex. :)

<comment><USER9> I don't think thats the right graphic - a more reasonable graphic is in the PDF which the article is a copy of.

<comment><USER10> Something's going horribly wrong, I'm seeing a screenshot of code to read and parse CPUID.

</comment></comment></comment><comment><USER11> Intel keeps making up new names for their x86-64 architecture. Now 'x64' did they use that one before? Is IA-32e or EMT64 not better? Also if you want to find out quickly what they mean by 'x64', why is the article tagged with 'ia64' (which means Itanium).

<comment><USER12> \- AMD64 -> Original x86 64bit extension from AMD.

\- EM64T (EMT64 is a common typo) -> Intel's implementation of AMD64, intel traded SSE3 to AMD for AMD64.

\- IA-32e -> Same as EM64T, Intel used this name for a bit, mostly during development.

\- INTEL64 -> Intel renamed EM64T to be more in line with AMD64's naming.

\- x86-64 -> Overarching instruction set, AMD64 and INTEL64 are implementations.

\- x64 -> Shorthand for x86-64.

x86-64 / x86_64 / x64 are just names for the overarching ISA; AMD64 / INTEL64 are implementations.

The AMD64 and INTEL64 implementations aren't actually identical, there are a few differences between them which compilers generally deal with by producing binaries that can handle either implementation.

The x86-64 / x86_64 / x64 thing isn't Intel or AMD's fault, it came about because OS vendors used different terms for the arch. Linux for example added support when AMD64 was the only thing around and it wasn't clear what Intel was going to do, they were still pushing Itanium. So the linux kernel used AMD64 as the arch name. Later when Intel licensed AMD64 linux wasn't about to completely rename the arch (and thousands of packages as a result) so now in linux the AMD64 arch strangely supports both AMD64 and INTEL64 targets. On the other hand Apple used x86-64 and x86_64 in the OSX kernel and Sun / Oracle decided to use x64. Really the OS vendors created this mess in combination with awkward timing of support between AMD and Intel.

<comment><USER13> From memory, I seem to remember that the x64 name originally came from Microsoft. They certainly make good use of it, at least, so Sun/Oracle isn't alone :)

Just to fill in a (the?) missing piece in an otherwise well assembled puzzle ;)

<comment><USER14> I can vouch for the fact, though, that internally the Windows team refers to it as "amd64".

</comment></comment></comment></comment><comment><USER15> I frequently see recommendations that intrinsics be used instead of assembly. The theory is that they are more portable and just as efficient, which they certainly are on an instruction by instruction level.

But I'm not having any luck at writing entire loops with them. All the compilers I've tried (gcc, icc, clang) feel compelled to "optimize" the intrinsics for me, turning my well-tuned and port-conscious loop into a hash.

For a tight loop of all intrinsics, I can often get a 20% improvement if I use raw assembly in the same written order. Is there any good way to convince these compilers to "do what I said" without turning off all optimizations everywhere?

<comment><USER16> Put it in a separate translation unit and compile that with different flags.

But seriously, if you're really at the spot where you have _real_ , debugged code that is better than compiler output, the compiler is providing no value and you might as well use the assembly you've written. The point to intrinsics is to expose hardware features that the C language doesn't, not to promise to do it better than the compiler.

<comment><USER15> _Put it in a separate translation unit and compile that with different flags._

I've tried it in separate units, and haven't been able to get things out in the order I have them in the source. ICC does the most rearranging (which in most cases other than this leads to faster code), and GCC generally does what you say. But both do things like turning my reloads from memory (to reduce port pressure) into register copies. I was wondering if there were flags I'm not finding to prevent this.

 _If you're really at the spot where you have real, debugged code that is better than compiler output, the compiler is providing no value and you might as well use the assembly you've written._

Likely the best plan, but this is being used in an open source library where the rest of the work is done with intrinsics. It's a "when in Rome" thing rather than a technical concern.

</comment></comment></comment><comment><USER17> Poor explanations such as this annoy me:

"By replacing the initial R with an E on the first eight registers, it is possible to access the lower 32 bits (EAX for RAX). Similarly, for RAX, RBX, RCX, and RDX, access to the lower 16 bits is possible by removing the initial R (AX for RAX), and the lower byte of the these by switching the X for L (AL for AX), and the higher byte of the low 16 bits using an H (AH for AX)"

It makes learning more difficult. Something like this would be way better:

"Specific parts of the registers can be accessed separately from the rest of the register, within strict limitations dictated by the format of instructions. These register-parts are given easy-to-remember names. The lower 32 bits of the first eight registers can be accessed as EAX, EBX, ECX, EDX, EBP, ESI, EDI and ESP. The lower 16 bits of registers EAX, EBX, ECX and EDX can also be accessed as AX, BX, CX and DX. Finally, both the lower and the second-lower bytes of registers EAX, EBX, ECX, EDX can be separately accessed as AH, AL, BH, BL, CH, CL, DH and DL, with AL/BL/CL/DL being the lowest-order byte and AH/BH/CH/DH being the other one.

Knowing what things are due to what part of the model, and what parts are conventions, is a big part of understanding, which is just building a good model of the architecture in your mind.

It took me years to understand two's complement arithmetic, and the key missing point was that it is just a convention. A convention with great practical advantages, but a convention anyway.

</comment><comment><USER18> "Intel stores bytes "little endian," meaning lower significant bytes are stored in lower memory addresses."

I would like to meet the person that doesn't know what endianness is, but can still understand that explanation.

<comment><USER19> It's even worse trying to explain Gulliver's Travels (and the origin of Endianness) to engineers that _do_ know it in the data-storage sense.

<comment><USER20> Please try. I've no idea what you're talking about.

<comment><USER19> Jonathon Swift's "Gulliver's Travels", a satire of 18th century England, included in it a long-running bloody war between two religious sects that started over the correct way to eat a soft-boiled egg: the big end, or the little end.

For those not familiar with the history of England, the tome of Western literature (and the genre of satire), or soft-boiled eggs, I've gotten some confused looks when trying to explain this origin. Plus, it doesn't really add _anything_ at all to the understand of endianness in the computer hardware sense.

</comment></comment></comment></comment><comment><USER21> x64 is so much nicer than x86 --- ip-relative addressing, more (mercifully, numbered) registers, and (best of all) a register-based calling convention.

</comment><comment><USER22> Is there a good Windows assembler that doesn't get flagged by anti-virus software?

UPDATE: I just ran across JWAsm and haven't encountered any problems so far. <http://sourceforge.net/projects/jwasm/>

<comment><USER23> I haven't tried it; but how about Yasm?

<http://yasm.tortall.net/>

<https://github.com/yasm/yasm/>

<comment><USER22> Thanks. Looks like it requires Visual Studio in Windows. Was hoping to find a simple "ASM" -> "Windows EXE" tool. I might try WinASM again at home.

<comment><USER24> Actually, Yasm doesn't require Visual Studio. To create .exe files you'll need a linker, but it works fine with ld.exe from MinGW.

Going assembly straight to .exe sounds convenient for learning, but isn't very useful in practice, so not many assemblers implement it. The most common use case for assembly language these days is to write a few functions that get called from some higher level language, and that's done by having both the compiler(s) and assembler spit out object files that are linked together by the linker. I suspect WinASM is just hiding the steps, and it'd be easy enough to create a Makefile that did the same.

The closest thing to assembly->exe that I know of is the "flat" binary output from Yasm. It's similar to really old DOS .com executables. I'm not sure they'll run on modern Windows, though.

<comment><USER22> I'll have to look again, the JWasm needs a linker too. Sadly, I think it was the ld.exe from MinGW that I had problems with in the past :( .

Yea, I'm really just doing this for the fun of it, not any actual needed reason. If the "flat" version you're talking about is the old 16-bit .COM format, then yes it will not work on modern 64-Bit windows. That was the first method I tried with an old version of MASM as it was really easy to assemble directly to a program back in my Assembly class days.

</comment></comment></comment></comment></comment><comment><USER25> This is awesome, now I have something to do tonight. :-)

</comment><comment><USER26> Why is there no R8H?

<comment><USER27> There's also no R9H ... R15H. These "registers", if they existed, would be bits 8-15 of each of R8, R9, etc. Without talking to engineers at AMD, it's probably impossible to say precisely why they weren't provided, but there is generally little/no reason to ever want to use the existing *H registers in 64-bit code, so it's not surprising that they were omitted.

Some combination of low/no demand and added encoding/decode/retirement complexity is an excellent reason to leave things out of an architecture.

<comment><USER28> There are also no RAH, RBH, .... You can only access AH by using the old 32-bit encoding.

This happens because in 32-bit x86, you only have access to AL, AH, BL, BH, CL, CH, DL, DH (no lower bytes of EDI, ESP, etc). These are 8 different possibilities, that are encoded by ModR/M's 3 Reg bits.

In amd64, they decided to regularize the instruction set: those 3 bits are now used to encode the lower byte of EAX--EDI (AL, CL, ..., DIL). To get R8L, ..., R15L you use the REX.R prefix, which acts as the 4th bit.

</comment></comment></comment><comment><USER29> I have an older Intel PDF for the EMT64. It makes for some great reading when you want a really deep understanding of how everything works.</comment>


What is the best way to get notified of Hacker News follow up comments? - <AUTHOR>

I've tried looking online but there doesn't seem to be much discussion on this topic.  How do most people keep up with responses to their comments? Do most people just scroll down the threads section or do they use an external application? <comment><USER2> <http://hnnotify.com/>

<comment><AUTHOR> Thanks!</comment></comment>


SINQ - Swift queries fluently - <AUTHOR> https://github.com/slazyk/SINQ

<comment><AUTHOR> Will the fluent interface catch on now that Swift syntactically makes it nice to look at (as opposed to Objective-C)? Or will you still prefer a string in the old Predicate format?</comment>


A 1950s-Era New York Knife Law Has Landed Thousands in Jail - bra-ket https://www.villagevoice.com/2014/10/07/how-a-50s-era-new-york-knife-law-has-landed-thousands-in-jail/#page-all <comment><AUTHOR> > Carla Glaser, 47, who served as a juror on a gravity-knife case in > Manhattan, calls the situation "ludicrous." She still feels sick about the > conviction she was compelled to hand out, to a man who was initially stopped > by police for being in a city park after nightfall. Although the law was, in > her view, deeply flawed, she felt she had no choice but to vote with the > majority.

I wonder if she realises that she's actually culpable here? Juries should be a check on unjust laws, not an enabler of them. She had a choice; she just opted not to exercise it.

<comment><USER2> Judges specifically filter out for people who know about jury nullification. I suspect the entire systems subconsciously also filters FOR and AGAINST certain types of people in service of whatever the narrative of the time was.

The people who speak out about injustice who have been part of the system are allies. If you expect perfect allies, then you make no change.

<comment><USER3> > Judges specifically filter out for people who know about jury nullification.

I guess you mean subconsciously? Directly asking someone if they know about jury nullification, then rejecting them on whatever grounds would intuitively sound very fishy to me. Rejecting them _explicitely_ for knowledge of jury nullification would sound to me like a direct attack on the jury system itself. And I don't know how to find out if someone knows about it without asking them... Then again, I'm not a lawyer.

<comment><USER4> There is case law suggesting that jurors can be removed if you suspect they are going to nullify the law.

There is also case law supporting jury instructions against nullification and for preventing defense attorneys from using it as a tactic.

I'd go so far as to say that there is an _explicit_ bias against jury nullification in the courts system.

The wikipedia article is particularly weak on this subject, but the reference list is good: [https://en.wikipedia.org/wiki/Jury_nullification#United_Stat...](https://en.wikipedia.org/wiki/Jury_nullification#United_States)

</comment></comment></comment></comment><comment><USER5> > She still feels sick about the conviction she was compelled to hand out

It occurs to me that the entire jury system is basically the Milgram experiment writ large. It's the only thing that helps explain how people can so consistently be persuaded to abandon their own sense of moral judgement and just follow instructions.

<comment><USER6> This one is so fascinating, given that the Milgram Experiment(s) (it was actually a full battery of tests under many different circumstances with a control group) showed categorically that people do not, in fact, follow through with torture just because they were ordered to. However, in one of the tests, the subjects persisted. This instance, for obvious reasons, gets the lion's share of attention, and the actual data generated from the study is rendered inconsequential. A thousand people can do the right thing with no monetary or status gain, but one person acts in 'disgusting' self interest, and 40 years of exposés will be written about the easy fallibility of the average Joe.

All this to say, most people feel guilt in one of two ways: in the commission of an act (or the prior contemplation there of) or upon critical review of the act. Not a profound observation, granted, but which crowd is present during The Review will have a heavy influence on the introspection that occurs. Food for thought.

<comment><USER7> Do you have a source for that? Wikipedia makes it seem like most of the people followed through with the experiment.

<comment><USER8> op may be referring to this:

>"The notion that we somehow automatically obey authority, that we are somehow programmed, doesn't account for the variability [in rates of obedience] across conditions," he said; in some iterations of Milgram's study, the rate of compliance was close to 100 percent, while in others it was closer to zero. "We need an account that can explain the variability—when we obey, when we don't."

[https://www.theatlantic.com/health/archive/2015/01/rethinkin...](https://www.theatlantic.com/health/archive/2015/01/rethinking- one-of-psychologys-most-infamous-experiments/384913/)

the experiment has recently come under more critical attention (along with much of social psychology)

</comment></comment></comment></comment><comment><USER9> Vice News just did a story about this [https://www.youtube.com/watch?v=S2S_4G103Ik](https://www.youtube.com/watch?v=S2S_4G103Ik)

It's short and worth watching. It shows how the law could definitely be used in an unequal manner, the background, and how Doug Ritter and the Knife Rights group works with groups like The Legal Aid Society.

</comment><comment><USER10> I didn't find any true measure of 'racial bias' in the article. We learned that fewer white people are arrested. But we didn't learn what fraction of each profile group actually carried knives.

I wouldn't be surprised at all if bias exists; I just didn't read it in the article.

</comment><comment><USER11> If it's not obvious to others, this is from 2014. I'm not sure how things have changed since then.

<comment><USER12> Looks like Cuomo vetoed it, twice:

[https://www.nytimes.com/2017/10/24/nyregion/gravity-knife- cu...](https://www.nytimes.com/2017/10/24/nyregion/gravity-knife-cuomo- veto.html)

</comment></comment><comment><USER13> The article is from 2014, but it's still a good one.

</comment><comment><USER14> It makes you wonder how many other ridiculous laws there are out there, that just any innocent person could get arrested for.

Considering this, I'd say we owe it to society to at the very least enform everyone what's legal and what's not. Maybe, make basic law part of the high school curriculum or something.

</comment><comment><USER15> It's interesting to watch London implementing stop and frisk policies while practically outlawing all carrying of knives. That doesn't seem to have elicitied much of a reponse from the liberal media in the US of course. I thought the inherently wise Western European policies were the ones the US is supposed to be following.

<comment><USER16> "Sus" (the practice of searching people purely because a police officer decides they're suspicious, which ends up invariably distorted by racial biases) ended years ago. New laws about untargetted searches are of course controversial.

London, like the entire rest of England forbids carrying weapons in public without a lawful purpose. The person from this article had, as I understand it, a lawful purpose. It also isn't generally legal to sell the weapons which the law says have no lawful purpose, such as brass knuckles, and various weapons familiar from martial arts movies. So you can't easily end up owning them and not realising you won't be allowed to carry them anywhere.

If you take your big fishing knife to go out drinking and there's a fight so the police are called, then yeah, there's a good chance you'll get done for having the knife without a lawful purpose - ain't no fishing inside the bar, should have left that at home.

<comment><USER17> What about a chef who is of color in a bad neighborhood? Who is the arbiter of "purpose"?

<comment><USER16> At arrest, a police officer. It's their choice whether they think your excuse means they shouldn't arrest you. After that, a CPS prosecutor, whose job is to decide whether they should try to convict you of some crime or not based on the public interest tests.

At trial, ultimately this would be a matter for a jury. But "bad neighbourhood" definitely doesn't come into it, "I need it for self defence" doesn't constitute a lawful purpose.

The chef's defence gets to introduce any excuse the chef may believe he has, but it's like to be subject to fairly intense cross from the prosecutors. On the other hand sometimes these excuses are ludicrous, and the court is entitled to tell the jury that they don't have to credit such an excuse just because it wasn't explicitly rebutted by the prosecution.

The main thrust of this article is that it's wrong to even be _arresting_ these people never mind jailing them. And you can't solve the former in the courts.

<comment><USER18> While we're on the the subject of English knife laws--do people just not carry pocket knives? I always have a knife with me and use it all the time.

<comment><USER19> I haven't lived in England for years, but the law used to be that as long as it was a folding blade under 7 cm you where OK.

<comment><USER20> Not any more. A man was arrested not too long ago for carrying a potato peeler.

<comment><USER21> A potato peeler would usually not have a folding blade, so this, even if true, doesn't actually contradict the grandparent.</comment></comment></comment></comment></comment></comment></comment></comment>


Colleges Rescinding Admissions Offers as Racist Social Media Posts Emerge - <AUTHOR> https://www.nytimes.com/2020/07/02/us/racism-social-media-college-admissions.html <comment><USER2> I don't think it's fair to directly contrast Cornell and Richmond here. If you watch the video, the Richmond kid said something way worse in response, and the Cornell kid replied to that with "you can't say that" and reiterating that this should not be posted (which Richmond kid obviously then ignored).

Also, it's a testament to the quality of Morristown-Beard that Colgate girl decided to post such an obviously offensive meme the night right after her classmates went viral for racism. I can't imagine she didn't hear the school news, so if even that didn't make her rethink it, well that says a lot.</comment>


Mathematically, what is the optimum pitch for a roof? - <AUTHOR> http://datagenetics.com/blog/december42016/index.html <comment><USER2> [https://en.m.wikipedia.org/wiki/Banach_algebra](https://en.m.wikipedia.org/wiki/Banach_algebra)

this is a reason for you ;) greez n cheerz</comment>


Show HN: React+Framer Summer Challenge V2 - <AUTHOR> https://learnreact.design/challenge <comment><AUTHOR> I'm thrilled to launch React+Framer Challenge V2! It's a one-month workshop starting next Monday August 12th. The registration is open right now until the end of 11th.

If you missed Challenge V1, this is a great opportunity to catch up. By definition V2 is better than V1 -- more polished videos, better pace, better structure, a great timeframe that motivates you to learn more, and cool prizes. And you still have the chance to learn for free!

Here's what Kevin, a V1 challenger, has to say:

"I've seriously learned 10x more in the last 4 weeks than in the last 8 months trying to learn Framer on my own. " \- Kevin Cannon, Product Designer at Pitch

Also, you probably want to check out some prototypes built by V1 challengers: [https://learnreact.design/prototyping-with-react- framer/show...](https://learnreact.design/prototyping-with-react- framer/showcase)</comment>


ASK NH: For a startup, how many competitors is too many? - <AUTHOR>

For my B2C startup idea, which I will only be able to launch in about 6 months with an MVP, I have about 10-11 direct competitors right now, one of them has even been bought by Facebook already. I don't exactly want to make it huge and sell to Facebook for millions of dollars, I just want a lifestyle business.
I believe that my startup will be better in some ways than some of them, e.g. I will definitely have a better backend algorithm, since I design Machine Learning algorithms for a living, and I will have about three features, which these startups have individually, but none of them have all of them on one platform (I am not even sure if this is an advantage, but I like minimalism, so I will try not to make it too clustered and will be introducing them one after the other, not at once, and they are all related to each other).
On the other hand, I am not the best designer, so until I start having a revenue, the design will not be as nice as some of these VC backed startups, and of course, I won't have as much press as them, so I will have to do my own marketing and advertising.
I know that having competitors is not always a disadvantage, but this is scary for a few reasons, 1.) I didn't know Facebook had bought one of these startups, so I am sure they have plans to enter this area 2.) 10-11 competitors seems a bit too many 3.) I really love this idea, and I just want to keep on building it, but I am scared that it is going to fail due to these reasons, so I am finding it vey hard to be motivated right now, I am still at a phase where I could just quit this, before I put too much work into it for no reason and venture on to a new idea.
So, what do you think? Am I doomed to fail? <comment><USER2> > 1.) I didn't know Facebook had bought one of these startups, so I am sure > they have plans to enter this area

There are lots of reasons companies acquire other companies. More often than not it's for it's employee's and talent (then again, we don't know which market this is, so they may be considering entering the space, who knows?).

Number 2 depends on market size/saturation. How many CRM companies do you think there are out there? Thousands.

And finally number 3 - build your _minimum viable product_ , get it out there, get feedback, test the waters. That's the only way you'll know for sure and you obviously believe in your idea, so I say go for it!

</comment><comment><USER3> 11 competitors give you a little more than a search engine results page for the search terms you're all interested in, so don't panic yet - it's not like you had hundreds of competitors. Of course you should allow yourself he freedom to pivot at any time during your startup phase. Being scared is a good thing: only the paranoid survive.</comment>


Looking at how many sites use vulnerable JavaScript libraries - <AUTHOR> https://snyk.io/blog/77-percent-of-sites-still-vulnerable/ <comment><USER2> If it's an automated scan, I'd be skeptical. Currently dealing with some overzealous security folks who put adherence to their scan tool over common sense, and insist that we lock down Oracle PL/SQL vulnerabilities in an application that doesn't use any flavor of SQL...

<comment><USER3> I absolutely hate these kinds of "security" scans.

I once worked with a company that started using one of these. They said our "vulnerability scores" were significantly too high.

I looked at the report, turns out they were just looking at HTTP headers and throwing up every CVE that matched any version numbers they found. (One of the "worst offenders" on the system was a CVE about a vulnerability in PHP when using "magic quotes", a part of PHP that hadn't been used in many years, and our application never used)

We were officially instructed that the fix would be to hide the PHP and apache version numbers from the headers.

If I were the one running that scan, and someone "fixed" the problem by just hiding the version numbers, I'd be calling for that person to be fired for trying to hide the problem. But here they were instructing us to do just that. And once we did, the system was marked "secure"...

<comment><USER4> There was a fund raising website written 15 years ago that a team I was on was responsible for (I never actually worked on it).

There were fraudulent credit card donations for $1 which became really obvious when the zip code was garbage.

The "solution" was to disabled the credit card page until the month of the fund raising event when it was enabled again in hopes of the scammers would not try during that month.

<comment><USER5> I don't understand, what were the scammers trying to achieve?

<comment><USER6> Trying to validate stolen or generated credit card numbers.

<comment><USER7> That's not always what is going on. In some cases unscrupulous operators will run through large numbers of $1 transactions in order to lower their chargeback rate.

<comment><USER8> This sounds interesting - can you explain further?

<comment><USER7> Chargebacks have a cap, if you go over that cap you get fined or lose your merchant account. So in order to dilute the pool they'll make a lot of low $ amount charges usually masquerading as some charity, those will have very low charge back rates so the average charge back %age will drop.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Needs some significant clarification on what it means to be 'vulnerable'. As an example, many static sites (such as blogs) can use jQuery, that doesn't necessarily mean there is an attack vector for those blogs or their visitors.

</comment><comment><USER10> We run nsp on our production services in CI before merge. The number of false positives I have tracked down is infinitely higher than the number of vouln's found. I literally mean this, we have never seen one disclosure which resulted in a viable attack on our production services.

For example, recently a bunch of ReDOS voulns were reported in popular libraries. None of which were in code paths hit by our configurations.

So needless to say, I think this is a sensationalist headline.

<comment><USER11> I think it's an absolute statement about the lack of awareness to this risk.

Of course some of these site would not actually be vulnerable, but I would bet the vast majority of them don't even know they're using a library with a known vulnerability.

<comment><USER10> Agreed, but the tools (nsp) are there to make it simple to know. Devs who are not going to update/patch are not the target here, so making big claims like this does not strongly add to the conversation IMO.

Also, this is nothing new on the web, the amount of wordpress sites with known voulns is probably MUCH higher.

</comment></comment></comment><comment><USER12> Just because the library has a vulnerable code path doesn't mean the site itself is vulnerable. Especially with libs like jQuery, where there are many many functions.

</comment><comment><USER13> One might even say that 100% of 333,410 sites use vulnerable javascript libraries

<comment><USER14> Those means different things.

Their wording means "we checked X sites and 77% of them met some criteria", which can be extrapolated to higher values of X (assuming the proper statistical care is taken, etc).

Your wording implies the same, but that's not good because you can't extrapolate to a larger X. You chose the sites after knowing they already met the criteria, and that changes the meaning.

<comment><USER15> I get the sense OP was being a bit snide

<comment><USER16> The snide version would be "100% of 433,000". (Which is what I initially parsed it as, and nodded in agreement...)

</comment></comment></comment></comment><comment><USER17> This means nothing unless they mention what the vulnerabilities are. We do security scans on our front-end javascript code as well; most of the hits we get are for "log injection". Meaning, we have a console.log somewhere and someone _could_ fake our logs by overriding the output. Wow, such vulnerability!

</comment><comment><USER18> This boils down mostly to a lot of sites running jQuery at a version less than 3.0.0.

Which technically means "vulnerabilities", but depends on how it's used.

</comment><comment><USER19> I looked at what it would take to upgrade our Angular 1.5 to 1.6: weeks worth of trying to untangle dependency hell and testing. For a minor version number upgrade. Let's not pretend it's only the consumers of these libraries that are lagging. A lot of these libraries are maintained by teams who have no business maintaining software, open source or not. They can release all the security patches they want, it won't make a difference if their new version isn't backwards compatible (obviously Angular is egregious and by far the worst I know of where even their minor version numbers have huge incompatibilities, not to mention 3 major version releases in 11 months).

</comment><comment><USER20> Even if we have better tooling to make updating dependencies easy, there's still the fact that there's a lot of applications in production that are not maintained. If there are no maintainers there will be no updates..

</comment><comment><USER21> Of course this is click bait. But of course most companies don't invest what they should in website maintenance, code reviews, security audits, and upgrades. I'm OK with some clickbait if it helps raise awareness of the need for more recurring investment in technology.

</comment><comment><USER22> > One of the discoveries the report mentions is that an analysis of around > 433,000 sites found that 77% of them use at least one front-end JavaScript > library with a known security vulnerability.

Does that even matter? No Front-End JS Library should actually make your backend vulnerable.

<comment><USER23> An XSS issue could make your users' data vulnerable.

<comment><USER24> But cors[0] headers can mitigate some of the risk?

[0]: [https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)

<comment><USER25> You want CSP headers to mitigate XSS risks.

</comment></comment></comment></comment><comment><USER26> I'd like to hear how Snyk compares to GitHub's recently release vulnerability notification feature.

</comment><comment><USER27> Is it better for a website to roll its own insecurity? I'd a lot rather people use libraries with significant adoption — hopefully being aware of and avoiding any security problems they may include — than write their own version where the security problems will never be exposed, at least for good.

<comment><USER28> I'd rather devs stop using JavaScript in so many places where its not even needed. Pure html5 and CSS is where its at.

</comment></comment><comment><USER29> I still question why I need to execute remote code just to _read_ web content

<comment><USER30> You don't. The majority of websites behave acceptably if you disable JavaScript entirely.

</comment></comment><comment><USER4> Snyke posted "The State of Open Source Security" not long ago

[https://news.ycombinator.com/item?id=15729811](https://news.ycombinator.com/item?id=15729811)</comment>


Smalltalk and JetBrains Intellij - <AUTHOR> http://www.redline.st/blog/2011/12/20/road-to-intellij.html

<comment><USER2> ok, I upvoted this simply because it had Smalltalk in the title. However, I have to chastise the author for not really saying much except he wants people to throw their vote into some support with zero detail on why IntelliJ makes any sense as a Smalltalk IDE. IDE, in the traditional Smalltalk sense, doesn't have the same meaning as it does for IntelliJ's other languages.

<comment><USER3> We're working on an implementation of smalltalk that runs on the jvm and integrates into ecosystem. That context was assumed to be previous knowledge but I can see how it might not be.

I just updated the post before I head out to work with more background. Can you let me know if you think it addresses your general concerns?

<comment><USER2> Don't see your update yet. But telling me that redline is running on JVM bytecode, is on its own, only mildly interesting. What evidence/argument do you have that Smalltalk without a traditional Smalltalk dev environment is any more interesting than a scripting language like Ruby?

<comment><USER3> By traditional "Smalltalk dev environment", I assume you mean an image. If that isn't correct, then my entire response isn't going to be off base.

We are currently aiming for file based support with optional image support coming later down the road. Even in a file based system, we will have resumable exceptions and reloadable classes with the image.

The website is very much a work in progress, we do have a page up that attempts to answer some: 'Why the JVM' questions.. FAQ for things like 'Will you support an image' is still coming.

<http://www.redline.st/discover/why-the-jvm.html>

<comment><USER2> Your "Why the JVM" info is solid. Your argument starts with "Joining the number #1 virtual machine with the number #1 language for getting things done is an easy choice." I will assert that Smalltalk is the #1 lang for getting things done because of its toolset/image. I'm not sure you get much value until you get to this point.

<comment><USER3> There are plenty who feel as you do and plenty who don't. For people who feel as you do, we are going to be working on making sure that Pharo or another Smalltalk ( probably Pharo ) could be used as a development environment and Redline would be a deployment platform much like how many people develop for Gemstone's GLASS environment.

</comment></comment></comment></comment></comment></comment><comment><USER4> Why not write your own language plugin, and then let JetBrains take it over? That's what me and another group did for Clojure. The language plugin API for IntelliJ is very nice. It's not documented very well, but it's easy to get help from the IntelliJ language plugin community.</comment>


Show HN: Base24 binary-to-text encoding for humans - <AUTHOR> https://www.kuon.ch/post/2020-02-27-base24/ <comment><USER2> Microsoft product keys were base-24 with the following alphabet:

> B C D F G H J K M P Q R T V W X Y 2 3 4 6 7 8 9

they were 115 bits encoded in 24 characters

see also human-oriented base32 encoding:

[https://philzimmermann.com/docs/human-oriented- base-32-encod...](https://philzimmermann.com/docs/human-oriented- base-32-encoding.txt)

which includes this nice trick:

> We have permuted the alphabet to make the more commonly occuring characters > also be those that we think are easier to read, write, speak, and remember.

edit: to add, an interesting human-readable and memorable base52 alphabet that I've never found a use for is to use playing cards

<comment><USER3> Brings me back to the trusty old FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8

<comment><USER4> I wonder who owns that license. Some people allegedly used this as their password...

<comment><USER5> It was a special volume license key that didn't require online or phone activation, so presumably an OEM that got a release version couple weeks early

</comment></comment></comment></comment><comment><USER6> I'm fond us using a base100, made of up 2 letter syllables. It results in a vaguely pronounceable string.

For syllables, I use: syllables: %w[ ba be bi bo bu ca ce ci co cu da de di do du fa fe fi fo fu ga ge gi go gu ha he hi ho hu ja je ji jo ju ka ke ki ko ku la le li lo lu ma me mi mo mu na ne ni no nu pa pe pi po pu ra re ri ro ru sa se si so su ta te ti to tu va ve vi vo vu wa we wi wo wu xa xe xi xo xu ya ye yi yo yu za ze zi zo zu ],

I can dump an implementation somewhere if people are really curious

<comment><USER7> Be careful, wiser(??) people have tried the path, and their tale is told in...

[https://thedailywtf.com/articles/The-Automated-Curse- Generat...](https://thedailywtf.com/articles/The-Automated-Curse-Generator)

<comment><USER8> Vuluva, fuca, fucu and in my second language, German, also fiki, pipi, kaka, and countless more.

Not OP, but me, personally, I don't care about accidental obscenity. It is accidental, after all.

Then again, I live in Germany, and we don't censor swear words on TV either, so this is likely a cultural thing.

</comment></comment></comment><comment><USER9> Another interesting solution to this problem is that used by plus codes [1]:

> The characters that are used in Open Location Codes were chosen by computing > all possible 20 character combinations from 0-9A-Z and scoring them on how > well they spell 10,000 words from over 30 languages. This was to avoid, as > far as possible, Open Location Codes being generated that included > recognisable words. The selected 20 character set is made up of > "23456789CFGHJMPQRVWX". [2]

[1]: [https://plus.codes](https://plus.codes) [2]: [https://github.com/google/open-location- code/blob/master/doc...](https://github.com/google/open-location- code/blob/master/docs/olc_definition.adoc#open-location-code)

<comment><USER10> Does not help with the ambiguous character problem at all, though

<comment><USER11> No I,1,0, or O in their alphabet, though. So they did probably consider the problem at some point. Or got lucky.

</comment></comment></comment><comment><USER12> > The final alphabet I came up with is ZAC2B3EF4NH5TKL7P8RS9WXY. As I required > 24 characters, I kept G and 6 which are the least ambiguous in the list.

I've read this a dozen times. Isn't OP saying that their character list includes G and 6, which are _not_ present in that list?

Update: It appears to be a typo in the article. Here's the real alphabet (N replaced by G and L replaced by 6): ZAC2B3EF4GH5TK67P8RS9WXY

[https://github.com/kuon/java- base24/blob/0c25905414f1598a0ed...](https://github.com/kuon/java- base24/blob/0c25905414f1598a0ed245eb8d727d9d0b1427ed/src/main/kotlin/ch/kuon/commons/Library.kt#L5)

<comment><USER13> S 5 6 G

P R

2 Z

8 B

look similar, depending on the font

It would be better to include some lower case characters which have more visual variability than trying to obsess over an arbitrary, inflexible stylistic "design."

</comment></comment><comment><USER14> Though clearly there are some advantages with removing ambiguous chars... I feel like it's more of a UI / UX thing-to-polish than a _problem_. Lack of polish creates the problem, the ambiguous chars themselves are not inherently an issue.

If it's ambiguous, you could accept either and transform it to the correct value (implicitly, or as entered, or whenever makes sense. your users don't ever have to know). Or if you can't do that / the differences matter, do something like 1password does with chars and letters: show them differently [https://www.dropbox.com/s/a29g2uiggqujzjl/screen%20shot%2020...](https://www.dropbox.com/s/a29g2uiggqujzjl/screen%20shot%202020-02-26%20at%207.12.41%20pm.png?dl=0)

<comment><USER15> > do something like 1password does with chars and letters: show them > differently

That's missing the point. _You_ can show them differently, but the point of keys / recovery codes is that they'll be stored somewhere and later re- entered. Users could store them in any program (including writing them down or printing them out), you can't control how they are displayed over there. Then when they need to use them, there's a chance the ambiguous characters can't be easily discerned.

<comment><USER14> Since you can't control the display there, but you can control how it's interpreted, you make it a non-issue by mapping them to the same thing in whatever is consuming the input.

Or just try all combinations, unless they entered o0o0o0o0o0o0o0o0o0o0o0 you're probably only going to have to try a small handful.

</comment></comment></comment><comment><USER16> I really like the super high efficiency at the important multiple-of-4-byte increments. Using 7 base-24 characters to encode 32 bits is 99.7% efficient. However, I'd recommend using 7 base-24 digits followed by a blank as standard output format. This would allow for efficient 8 character <=> 32 bit conversions. Also, I think padding output to a multiple of 7 characters would be good, for similar reasons that it's good for base-64. Now you can concatenate encoded streams like you could byte streams, and recover on decode. As multiples of 32 bits are so common, padding would be used little in practice. On input, it would be fine to accept unpadded base-24 sequences, but valid base-24 output should always pad to a multiple of 7 chars (excluding the blanks that should be just for readability and not significant otherwise).

However, I strongly dislike the arbitrary mapping between character values and base-24 digits. There is a strong reason for using the order 2345679ABCEFGHKRSTWXYZ, which is that now encoded values compare the same as the original binary values. I did appreciate the 0x00000000 == ZZZZZZZ equivalence, but consistent ordering is just way more important IMO. Also 2222222 looks a lot like ZZZZZZZ. Just saying.

<comment><AUTHOR> I thought about the comparison bit, and I wanted to go against it.

Ordered, your snippet look like the alphabet with a few missing letters, and isn't searchable on google or anything. I really wanted the alphabet to stand out.

I don't think that it is important that it can be sorted, it is intended for randomly generated keys which by my experience, you won't be sorting.

</comment></comment><comment><USER17> I think proquints [0] are pretty good at encoding for humans as well. For example, when used to encode IP addresses, they result in pronouncible identifiers like this:

      127.0.0.1       lusab-babad
      18.104.22.168   gutih-tugad
      22.214.171.124     gutuk-bisog

[0] [https://arxiv.org/html/0901.4016](https://arxiv.org/html/0901.4016)

</comment><comment><USER18> Nice! I'd like to implement this in a key-recovery tool I have been working on, Passcrux [1]. I actually started fleshing out a base24 encoding of my own, but the padding/bit shuffling proved to be somewhat cumbersome, and I shifted focus to abc16, which is like hex, but purely alphabetic.

[1] [https://github.com/xkortex/passcrux](https://github.com/xkortex/passcrux)

<comment><USER19> Related; how to get Passcrux to compile? I couldn't find instructions on the repository, and would love to try it out. Thanks!

</comment></comment><comment><USER20> If you consider the scenario of dictating over the phone, letters can be confusing not just because of their written shape. For many non-English speakers, for example, E can be confused with I, and V can be confused with W, unless both sides use the same way of pronouncing them. Look how Microsoft's base24 alphabet (from the other comment) has neither E nor I.

<comment><USER21> That's what the NATO phonetic alphabet is for.

<comment><USER20> In this case the phonetic alphabet will do the job only for English-speaking countries (or at least those that are very well accustomed to Latin characters).

<comment><USER21> The point of the NATO alphabet is everyone in NATO uses it, even if it isn't their native alphabet, as in the case of Greece.

</comment></comment></comment></comment><comment><USER22> > decimal: 49894920630459842177293598641814316632

This 128-bits can also be represented in, let's say base-50K, by using five words chosen from a 50,000 word dictionary. If you also make "this", "This" and "THIS" separate, then you can get away with a 17K word dictionary. Depending on the language, if you use roots and then vary morphology based number, tense, etc., then the number of root words (and the choice you have in making them simple) can be reduced. Such "pass phrases" can be easier to remember, transcribe, etc. (Also you _will_ get random, humorous, offensive, etc., phrases...)

<comment><USER23> I recently needed to encode a 32-bit value into something easy for QA folks to remember and report. I opted for 3 words out of an 11-bit (2048 entry) dictionary of commonly used words.

How to build the dictionary? Well, in order to determine the most commonly used English words, I downloaded a bunch of free texts from Project Gutenberg, and did some simple filtering - nothing less than 5 letters, no duplication of singular + plural, etc...

A valuable lesson that I learned during this process is that when your corpus includes older english texts, you should always give your final list a visual once-over and apply some judicious manual filtering. I'm looking at you, "The Adventures of Tom Sawyer". (And, to a lesser extent, Moby Dick).

<comment><USER24> In most cases if you need a short list it's better to use something like the diceware or EFF lists than to make your own from scratch.

<comment><USER25> Or use the BIP39 lists since they also encode 2048 bits. If you just use BIP39 you also get a checksum. RFC 1751[1] is the "standardised" option but IMHO the wordlist they use is far too easy to misread (though this is because the words are all less than 4 characters).

[1]: [https://tools.ietf.org/html/rfc1751](https://tools.ietf.org/html/rfc1751)

</comment></comment></comment></comment><comment><USER26> Crockford Base-32 is already perfect. [https://www.crockford.com/base32.html](https://www.crockford.com/base32.html)

</comment><comment><USER27> Not bad, I mean, I'm not lining up to implement it in C tomorrow, but if it gets an RFC I could definitely see using it.

I have an application where I'm using a 32bit serial for the event someone has to read it to sales staff over the phone. I would have liked to use 64bit and encode some more details into the serial. This would satisfy that.

I like the idea of removing ambiguous chars. I have a Base64 system that prints where I and l use the same font (infuriating).

</comment><comment><USER28> Looks like this [2017] [https://github.com/tonsky/compact- uuids](https://github.com/tonsky/compact-uuids)

</comment><comment><USER29> What about Base10 emoji encoding? There is already more than 1024 of them ;)

128bit can be then represented by just 13 characters, or even much less with modifiers.

<comment><USER30> It's certainly a fun idea. If the goal is human readable, humans are surprisingly bad at differentiating emoji just by looking at them, especially all of the subtly different variation face ones. Describing them over something like a phone call could lead to all sorts of transcription mistakes. Not to mention that there's a variety of different emoji input systems/keyboards and the amount of user skill in finding/picking emoji for text entry are hugely variable.

</comment></comment><comment><USER31> > The data length must be multiple of 32 bits. There is no padding mechanism > in the encoder.

Such padding mechanism should not be necessary, and the padding from standard base64 is also not necessary. If you remove the ==='s you can still unambiguously decode it (despite the error some tools will give). URL-safe base64 (RFC 4648 §5) does not require padding and can represent any data length.

</comment><comment><USER32> I've implemented this encoding format in Python, [https://github.com/mildmelon/pybase24](https://github.com/mildmelon/pybase24)

</comment><comment><USER33> In a similar vein, this is an encoding I designed specifically for 256 bit keys; my design includes checksumming and some consideration to consistent verbalization:

[https://github.com/tomgibara/keycode](https://github.com/tomgibara/keycode)

</comment><comment><USER34> An important note to the author: please put test vectors right to the spec!

The classics like "", "f", "fo", "foo", ..., "foobar" would suffice. If the encoding specifically works on numbers, put test vectors for those too.

</comment><comment><USER35> The author mentioned it's confusing even when one of similar character is used (like base 10), the program can indeed automatically resolve typo (e.g. treat O as zero).

This doesn't require the user to be technical.

</comment><comment><USER36> Base24 is already the name of a pretty old payment processing standard: [https://en.m.wikipedia.org/wiki/BASE24](https://en.m.wikipedia.org/wiki/BASE24)

</comment><comment><USER37> Is the ambiguity of 1Ii a problem though? Can't your input routine just normalise those to I say? It is slightly confusing to enter though.

Also, any string like this should have at least a check digit and ideally some ECC digits.

</comment><comment><USER38> Similar idea to base 58, introduced with Bitcoin.

[https://en.wikipedia.org/wiki/Base58](https://en.wikipedia.org/wiki/Base58)

</comment><comment><USER39> mod 24 isn't a field, so it's not easy to add good error protection to base24 using a regular cyclic code.

You can add a single check digit with good performance using the Damm algorithm: [https://en.wikipedia.org/wiki/Damm_algorithm](https://en.wikipedia.org/wiki/Damm_algorithm) one of the external links on that article has a suitable quasigroup matrix for Z_24.

</comment><comment><USER40> I'm wondering maybe in the future, we will use these baseN methods to represent any numbers in everyday life? With the data explosion, I think we will have more opportunity to describe really big numbers than today, so we will abandon the usage of decimal eventually, speak and write in this base24 method or some upcoming base128, base1024?

I know there's Mega or Giga that can describe how big the number is in decimal, but they can do better (represent bigger numbers) in the baseN method where N > 10\. So will we shift to these methods?

</comment><comment><AUTHOR> I published the article a bit in a hurry before going to bed and I managed to put the wrong alphabet in the article.

I am sorry, and I updated it.</comment>


Ask HN: What is your favorite feature of an app/web that got cancelled/modified? - <AUTHOR> <comment><USER2> Google Wave is the first that comes to mind.

<comment><USER3> yup, this is what I was here to say

</comment></comment><comment><USER4> C++ Users Journal. This was a magazine, both online + offline. Was the best when it comes to C++. It was discontinued in 2006 :(</comment>


HN Weekly Top 50 - <AUTHOR> http://www.hn4d.com/fifty_top_posts Please upvote.  There would be a certain recursive delight in seeing this site itself in next week's results :). <comment><AUTHOR> There has been discussion from time to time about the time of posting affecting HN responsiveness... sometimes a good post will die for lack of interest during a down time. The hn4d.com site provides a bit of insight into when the activity level on news.ycombinator.com fluctuates.</comment>


Remote Elderly Home Care via Privacy Preserving Surveillance - <AUTHOR> https://devpost.com/software/remote-elderly-home-care-via-privacy-preserving-surveillance-dano89 <comment><AUTHOR> Hi there. I would like to share our new project with you and I would like to receive your feedback. You can post it to [https://twitter.com/ambianicai](https://twitter.com/ambianicai) or contact me at email@example.com. Since this is an open-source project, we will appreciate each contribution or new ideas: [https://github.com/ambianic/](https://github.com/ambianic/)</comment>


Cisco devices must regenerate self-signed certificates before 2020 - <AUTHOR> https://www.cisco.com/c/en/us/support/docs/field-notices/704/fn70489.html <comment><USER2> Ignoring for a moment the fact that they hard coded an expiration date:

This serves as a good reminder of why it's a bad idea to set expiration dates at the end of a year, where lots of people are on leave for the holidays (this notice came out only 2 days ago). Instead try sometime less complicated, like mid March or Sept.

<comment><USER3> x.509 certs all have a validity period. Of course they could have set them to 2099, but as far as I know you cannot change the validity without reissuing the cert.

<comment><USER4> It's called notAfter and since it's part of the signed document you cannot change it without invalidating the signature. In a custom system the issuer could (but probably shouldn't) sign a document which is identical save for the notAfter date, but in the Web PKI this would be a serious miss-issuance and have consequences.

By convention the notAfter field is filled out in Zulu timezone (ie UTC) and so these will expire simultaneously around the world.

</comment></comment></comment><comment><USER5> What I find bizarre is software that accepts a self-signed certificate only to then reject the cert because it has expired. What security problem are they trying to solve there?

<comment><USER6> The reason to expiration dates on certificates is so that a compromised private key has a limited lifetime of applicability, under an assumption that you will be actively rotating keys and issuing new certificates that expire at later points in time. As far as I would think this consideration has nothing at all to do with whether the certificate is self-signed.

<comment><USER5> The model in most software that allows self-signed certs is that you eiter disable checking all together, or that the user accepts a specific cert.

If you disable checking all together, then an attacker doesn't need to compromise a private key. Any impersonation attack will just work.

If you require the user to accept a specific cert (and store that information) then you can just as well let the user accept an expired cert.

The current situation just creates a lot of hassle for people without any security benefit.

Key rotation is completely separate from the lifetime of a cert. You can renew certs while keeping keys constant forever. In practice, if your key gets compromised and you have to wait for the cert to expire, then you have a very big problem. Even with letsencrypt it is likely more than a month before the cert expires.

<comment><USER7> > The current situation just creates a lot of hassle for people without any > security benefit.

In my experience, many "security" people see this as the purpose of their job.

</comment></comment></comment></comment><comment><USER8> Oh god. Thanks Cisco for dropping this 11 days before the end of the year. Wooo, glad I saw it here at least...

</comment><comment><AUTHOR> > Self-signed X.509 PKI certificates (SSC) that were generated on devices that > run affected Cisco IOS® or Cisco IOS XE software releases expire on > 2020-01-01 00:00:00 UTC. New self-signed certificates cannot be created on > affected devices after 2020-01-01 00:00:00 UTC. Any service that relies on > these self-signed certificates to establish or terminate a secure connection > might not work after the certificate expires.

</comment><comment><USER9> Certificate management is such a huge problem for big organizations. Does anyone have guidelines on how to do it properly? You really need a way to track who is using what and how they automatically get renewed a long time before expiry.

My view now is that certificates should be renewed very often - like every month, if you see something within 6 months of expiry there is a problem.

<comment><USER10> I'd like to know as well. At my work we had to partner with a major bank and they demanded a fully signed (sigh) client certificate for the integration. The way their API works means that we have to do a planned hard-cutover before the certificate expires. There's a 60% chance that we'll have trouble reaching out to the right people when the time comes.

Ugh.

<comment><USER11> This is a common problem in healthcare insurance. API connections will stop working for about 3 weeks every year as each side performs a complicated dance of noticing the expiration and updating the systems to accept a new public certificate.

<comment><USER12> Seems to be a thing that happens at big companies in general. I add —-no-ssl- verify to everything and it saves my ass every single year.

<comment><USER10> That's ok if you're not worried about man in the middle attacks, but it does make it a lot less secure.

</comment></comment></comment></comment></comment><comment><USER13> Just had to emergency deal with this issue within a large scale complex ISP env. Fun times!

Edit: And yes as others pointed out, right into the day or two before holiday moratorium.

</comment><comment><USER14> I'm surprised there's no workaround "set the clock back to 2019, generate a certificate, then fix the clock time". Would that not work?

<comment><USER15> The generated certificate would also expire in 2020, so it would be invalid immediately.

</comment></comment><comment><USER16> Correct me if I'm wrong, but is this just another measure by Cisco to block off the second hand market for the equipment?

<comment><USER17> Doubtful. Cisco software code quality isn't the best, even in their specialist fields (see the number of BGP related bugs that are patched every year, _still_ ). This looks like just another stupid bug that has already been fixed in a future release.

<comment><USER4> Yup. They have lots of smart people, but something has been badly wrong on the code quality front for decades. I remember not long after the turn of the century doing inter-continental live debug sessions with their team because the multicast IPv6 acceleration (MLD snooping, like IGMP snooping but for IPv6) they'd shipped was completely broken in our Catalyst 3750s. As usual the authorised workaround was to disable acceleration, destroying the value added by Cisco's incredibly expensive product so I was on Transatlantic conference calls after hours trying to get them to reproduce the issue so they could actually ship us a fix.

<comment><USER18> My theory is that the business is more focused on getting contracts and sales, and getting in some useless magic quadrant than they are on actually providing a quality product.

</comment></comment></comment></comment><comment><USER19> The certificates on the Cisco WLC only lasted 10 years, you have to upgrade the WLC and all the access points to a new version that includes a command to turn off the certificate check. If you want to upgrade an AP after that date you need to set back the clock first, so much fun

</comment><comment><USER20> They seem to be highlighting SIP/VOIP as the main issue. And downplaying ssh access into the router based on an assumption that most don't use x509 certs for ssh. Does that sound right?

<comment><USER4> Also, you aren't affected if you actually have a CA. This only blows up if you use the Cisco device's own self-signed certs which it always mints (in affected versions of IOS) with notAfter 2020-01-01.

For stuff like web tools that might happen by least effort, but for SSH it's a bunch of extra effort, 90% of the effort of doing it properly, yet with almost none of the security benefits. Anybody who cares will use their own CA and be unaffected, anybody who doesn't care never enabled certs for SSH on the Cisco boxes.

</comment></comment><comment><USER21> I still remember the time when 1st of January 2020 was so far in the future that it seemed it will never happen.

<comment><USER22> I did data recovery on an external drive in 2011. It was pretty bad but I only needed a dozen files or so, rest was backed up. One of the files restored had a borked creation time in May 2020. For some reason I never fixed that, so whenever I accessed that folder and sort by date, that file would be at the top. This is will stop happening soon. I grew so fond of this quirk that I'm almost sad.

<comment><USER23>
        touch -d 'Jan 01 2030'

I initially thought 2099 but 2030 lets you poke it again in ten years :></comment></comment></comment>


How to Make a Presentation in LaTeX - <AUTHOR> https://www.lucidchart.com/techblog/2016/12/07/how-to-make-a-presentation-in-latex/ <comment><USER2> I really like making slides and using beamer is a good choice BUT

Why not do everything in markdown (Or something similar) and use Pandoc to create the slides?

[https://github.com/agoldst/elsmd](https://github.com/agoldst/elsmd)

Personally I love this method of making slides.

</comment><comment><USER3> Thanks for this example. Always wanted to make use of Beamer but was put off by the default template. Your work made the theming look easy and the default color choice of yours is great as well.

Didn't find the theme available for use anywhere. I tried it out and put them in a repo.

[https://github.com/aravindhsampath/lucid_beamer](https://github.com/aravindhsampath/lucid_beamer)

</comment><comment><USER4> Cool but can it embed videos ?

<comment><USER5> You can use movie15 to embed video files that will play natively in the pdf, but it can be difficult to get it working--and you must store the video file separately.

</comment></comment><comment><USER6> is there a file with all the code used in the example? want to try it our</comment>


What I Learned from Watching Notch Code - <AUTHOR> http://gun.io/blog/what-i-learned-from-watching-notch-code/

<comment><USER2> "Here's the most important bit: Notch's testing is mind-bogglingly thorough."

For the record, this is completely contrary to his testing method for Minecraft. Every time there is a new version of Minecraft, there are more bugs than features. This is even true when a "bugfix" release comes out. More bugs are introduced in a "bugfix" release than are fixed. Seriously, check it out: <http://www.minecraftwiki.net/wiki/Version_history>

I say this as the owner of a library to provide bot API to Minecraft. <https://github.com/superjoe30/mineflayer>

All I'm saying is... "thoroughness" and "testing" are not two words I expected to be in the same sentence as Notch's methodology.

<comment><USER3> Maybe he's learnt.

<comment><USER4> The pre-1.8 release less than a week ago had an obvious and crippling bug. An experience system was added, and when you died you dropped your experience. But instead of doing so as a single object, it made thousands of objects each holding one single XP point. This made the game completely unplayable if you were in the same area, and even crippled multiplayer servers for people not in the area.

Also, while that is the most recent glaring bug, in the past there have been multiple occasions where a release broke trees so that the leaves didn't decay after the trunk was removed. Punching down a tree is something you do in the first 30 seconds of a normal minecraft game.

<comment><USER5> It was a pre-release. Also: leaves not decaying was the intended behavior at the time, it wasn't a bug.

But that's not really the point. There is no way to test Minecraft thoroughly if you are pretty much on your own. It has too many features. Minecraft is too complex for this method to work.

Not that it matters, really.

<comment><USER2> I disagree with this. Using my bot framework I actually began writing a test suite. I stopped because it wouldn't actually have been very helpful to what I was doing due to various reasons, but I progressed enough to know it was very doable.

</comment></comment></comment></comment></comment><comment><USER6> moved from the blog comments section:

Woah, man. Woah.

I think you're missing the primary benefit here, which is that he avoids regressions. By the time you are adding feature 256, you have 255 features which are going to possibly be affected by the code changes you introduce. This is a huge part of software engineering, and one that has gotten lots of attention over the years.

The process you describe for your development sounds extremely tedious, but probably won't break down until month 2 of development on a team of one. Once you reach a level of complexity beyond this, that's where automated testing proves it's salt.

The style of testing you're describing is commonly referred to as integration testing or acceptance testing, because it is designed to test the full stack in harmony. There are a number of great frameworks out there to help you do this. Cucumber is the one that's gotten the most love in the circles I am familiar with. You can write your steps in python or javascript, so don't worry that it's written in Ruby.

The typical thing to do once you've started doing automated testing is to actually _write your tests first_ , watch them fail, then write the code to make the test pass. This forces you to ensure you have good test coverage (every feature is tested) and has been shown to result in better designed systems.

You have tons of reading to do if you want to learn more about this, but hit me up if you want a basic rundown.

<comment><USER7> I think games are hard (if not impossible) to test with unit tests or codified tests like the ones you mentioned.

At the company I work for we rely mostly on manual testing for testing the games and applications we make. We do some automated testing in the form of Tinytask tasks that are left on overnight to hammer an application. In terms of release testing, especially with a custom game engine, there's no easy way to codify a test which actually plays through a game where there is some random mechanic, or checks for things like the visual accuracy, windows flashing up on the screen when they're not supposed to, etc.

Web development frameworks like Selenium are great for UI testing, but they require identifying interface elements by their IDs, or performing a 100% image recognition match for targeting. If anyone knows of a good UI testing framework that would work for games/DirectX apps, I'd definitely love to hear about it.

I'm not bagging automated testing, I think it's a great way to save time and avoid the boring bits. I just don't think it's very relevant to game design, but for the OP's enterprise app job it would definitely be suitable.

<comment><USER8> I think the #1 reason why games don't need a lot of automated testing is serialization, or rather the common lack of it in most game worlds. If the data gets corrupt, you can reset the game and all is well again. When the rare corner cases pop up, it's easy to play whack-a-mole with them, because they're all "shallow" in the sense of the game starting from a clean reset frequently, so you can usually reproduce the bug quickly.

Of course, if the game does need heavy-duty serialization of everything, all bugs are potentially deadly. And this is largely the case for the line-of- business, social, and productivity apps, because that data is considered mission-critical. Corruption is not OK, reverting to backups is to be avoided. When a game has that kind of requirement, things get a lot tougher - and so games have naturally evolved to favor minimizing the save data to nothing or a few stats.

And this is borne out by looking for contrapositives. There are two genres that have a history of tending to be buggy because of some form of long-term data corruption: Large-scope RPGs and turn-based strategy games. It's hard to reach the bugs in those games, so it's also hard to fix them.

<comment><USER7> This is the difficulty for the company I work for. We make a range of desktop applications including launchers, productivity apps, media apps, games, etc.

Because all of these apps are based on a game engine, we get the complex and hard to test bugs that games get (texture cache corruption, null pointers in the scene tree, etc.). There's much more serialization and pressure than with pure games (but still not as much as with enterprise applications) because we're dealing with transactions with 3rd party services, or because a screw up could corrupt a user's whole music collection, or because users don't expect their music player to crash every 4 hours.

The game engine adds a huge amount of extra variability to our applications; we have to not only watch out for obscure bugs in our custom script code (which the engine silently tries/fails to execute anyway), but also in the (C/C++ based) game engine it is driving. The upside to using an engine with a simple scripting language is the shorter development times to get things off the ground and the high-performance/shiny visuals, but I feel it costs us much more down the line in terms of stability and extensibility.

<comment><USER9> Wait, wait... "texture cache corruption", and "null pointers in the scene tree"?

Edit: It's both scary and awesome that you rigged a game engine to manage a music library a-la iTunes. Are you profitable?

<comment><USER7> I'm not sure I would be allowed/qualified to say much about our financials. From what I can gather we are profitable, with ongoing contracts for clients such as Dell.

[http://www.unlimitedrealities.com/blog/video-the-dell- stage-...](http://www.unlimitedrealities.com/blog/video-the-dell-stage-touch- ui-and-music-stage-apps/)

Those issues I mentioned are examples of things that we have actually run into.

edit: Our specialization in touchscreen development is really what drives the company, but hardware accelerated graphics are also a huge draw.

<comment><USER10> At the risk of going too far off topic and without intending to be too harsh: at least in the video, that interface looks nice, but there is too much lag between when a tap/gesture is made and when the interface reflects it. This breaks the direct manipulation metaphor and is, I think, a showstopper. The pinch to zoom example was particularly off-putting: how can I know how much I'm zooming when the interface doesn't track my gesture? I cannot imagine being happy with pinching, waiting a second to see what's happened, then pinching and waiting to adjust (repeat until I get it right or am too frustrated).

<comment><USER7> I don't think there's too much danger in going off-topic if the conversation is interesting and has some substance.

Yea I think lag in touchscreen interaction is a huge problem. I think this is largely a result of hardware. We've had to ship on atom-based hardware with 2003-era DX9 graphics. Even the latest Intel chips with DX10 are horridly slow when it comes to graphics.

The other side is actual touchscreen hardware. The machine used in the video is an HP Touchsmart, which uses an optical touchscreen panel. These panels have a latency of around 100-200ms, and that's before we even start processing the touch event information. Capacitive touch sensors are much better, but the're expensive to manufacture above about 10 inches.

In the end lag/accuracy is a reality of the low-cost hardware OEMs use, and there will always be some trade-off between hardware cost and performance.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I do something similar with my web-app code. I keep an iPad open next to me when I code. Anytime I hit Cmd+B in my text-editor, it rsyncs the site to the server and some JS code running on the iPad automatically refreshes the page. It works quite well for creating HTML layout and updating CSS nearly-on-the- fly. If I have 4-5 browsers open on my Mac, they all instantly update too. So all I have to do is Cmd+Tab through them to verify it all looks good.

<comment><USER12> Can you go into more detail about how you set everything up? This sounds immensely useful.

<comment><USER11> Editor: BBEdit. Cmd+B is hooked to the following AppleScript for my project:

        tell application "BBEdit"
            save front document
        end tell

        tell application "Terminal"
            if (count of windows) is 0 then
                do script "/path.to.my/make.command"
            else
                do script "/path.to.my/make.command" in window 1
            end if
        end tell

        tell application "Google Chrome"
            activate
        end tell

My make.command (simplified):

        #!/bin/sh
        coffee -c mycode.coffee
        lessc -x mycode.less > mycode.css
        rsync -avz --delete --force --exclude ".DS*"
              -e "ssh my.ppk" /localpath/www email@example.com:/remotepath/www

On my server, I run a changed.php file:

        function fileHash($fn) {
            echo sprintf("%u.", crc32(file_get_contents(dirname(__FILE__) . $fn)));
        }

        header('Access-Control-Allow-Origin: *');
        fileHash('mycode.js');
        fileHash('mycode.css');

On all my HTML pages, I run this piece of CoffeeScript (compiled above to JS):

        # defined elsewhhere:
        #   debugmode (bool)
        #   reloadIfChangedLast (empty string)
        #   getCurrentView() returns #pageHashURL

        reloadIfChanged = ->
            if not debugmode
                return false
            $.ajax
                type: 'GET'
                url: 'me.com/changed.php?rnd=' + Math.random()
                error: ->
                    setTimeout reloadIfChanged, 500
                    return
                success: (data) ->
                    if reloadIfChangedLast and data and
                       reloadIfChangedLast isnt data
                        reloadIfChangedLast = data
                        document.location.href = 'index.html?rnd=' +
                                                 Math.random() +
                                                 '#' + getCurrentView()
                    else
                        if data
                            reloadIfChangedLast = data
                        setTimeout reloadIfChanged, 500
                    return
            return

It may seem like a lot of hassle but for me it's just copy-paste and edit a few things per project. And the benefits are tremendous.

<comment><USER13> Brilliant. AppleScript is underrated as an automation language. Sure, it's a bit cumbersome to write, but nobody says you _have_ to use it for everything. It plays well enough with shell scripts that you can leave the heavy lifting to another language and use AppleScript as a bridge between the command line and the UI. Me and a friend once wrote a bot in Python to control various music players from IRC. The bot uses AppleScript to talk to iTunes on OS X, and GObject introspection (or whatever they use on GNOME these days; I have little experience with desktop Linux) to talk to Rhythmbox. See <http://github.com/GeneralMaximus/amazing-horse>

All of Apple's official applications support scripting, so do most good third party apps. You don't need extra JS on your page to autorefresh Safari. This little snipped reloads the front-most Safari tab:

      tell application "Safari"
        set sameURL to URL of tab 1 of front window
        set URL of tab 1 of front window to sameURL
      end tell

You can even send Safari a snippet of JS to run. It's possible to automate any UI interaction by sending mouse clicks or keyboard events to _tell application "System Events"_.

You can look at any app's AppleScript dictionary using the AppleScript Editor. Go File -> Open AppleScript Dictionary ... and then pick your app.

<comment><USER14> I do a similar thing in bash for more normal development - basically a script to run my unit tests, look for OK/Error in the output and print either a couple of bars in green or the error output in red. It runs over and over again in a separate monitor, so as soon as you have wrong code, you know about it.

</comment></comment></comment></comment></comment><comment><USER15>
        He began by building the engine, and to do this he used
        the 'HotSwap' functionality of the Java JVM 1.4.2, which
        continuously updates the running code when it detects
        that a class has changed.

        If anybody at Google is reading this, if you add this
        feature to the Android emulator and I will literally
        drive to your house and kiss you on the mouth.

Indeed, the fact that Android _doesn't_ already have this makes it hard for me to take it seriously as a platform. Immediate feedback is crucial to any development environment.

<comment><USER16> Use an actual device, not the emulator. The emulator is super slow, but with an actual device you can have 30s iteration times.

Edit: I know 30s is still nowhere near ideal. Hell, on Linux Chromium (a massive project) we have faster iterations than that. But it's good compared to the Android emulator.

I think you should be able to go even faster, but I need to dig into how Ant actually works. It seems to be redoing more work than necessary for each build.

<comment><USER17> Bit OT, but, what device would you recommend as a cheap 'testing' platform? I'm not looking for a new phone/tablet, just something for development.

<comment><USER16> Sorry, I don't know. I use a Nexus S as my primary phone so that's what I test on.

</comment></comment></comment></comment><comment><USER18> I learned some things too. However, even if you have a tiny piece of software, like a game that you can reliably complete manually in 20 minutes, completely playing it through after every change is way too slow for "live coding". You should see your results instantly. Just like your test suite should run in seconds. If you have to wait minutes to compile, deploy and test your productivity will fall. A full integration/acceptance test suite can take longer, but it should be as automatic as possible and you can't use it for rapid feedback like this, but more for regression/acceptance testing.

Notch was able to take advantage of immediate feedback for the most part of his coding. The first hours spent on the rendering was tested by watching the world being rendered live. I've been doing the same developing a game in Clojure. When he got as far as the gameplay, he slowed down considerably, since he had to wander around in the game world to test each new feature. He for example made temporary shortcut passages, so he was able to test the boss monsters, without actually having to pass through the levels.

He is a person who can concentrate on delivering results and hack away at code for long stretches. This is the kind of code he presumably has done again and again for years. Who professional web developer can't hack together a small site as quickly? Where most people fail is attention span and drive! I know my unfinished projects speak of that :)

Most interesting part to me, of watching Notch code, was to see how he used his tools. And it was inspiring and motivating to see the progress. The actual code was very hackish but quality code is not important in a throw-away project anyway :)

</comment><comment><USER19> The way the article describes Notch's testing methods sounds like a glaring anti-pattern. This reminds me of my first QA job... Thankfully another post in here suggests that he actually takes pains to mold the level design, etc, to make the game more easily testable.

For those who didn't RTFA, though because this isn't Slashdot there shouldn't be any, Notch is reputed to have given some segment of his game a complete replay every time he made a change though it isn't mentioned exactly how often this is or how big the change is. A note is made that his build scripts make this almost instantaneous.

This is a problem because manual testing takes forever and causes tester fatigue. You stop doing a good job.

It can be harder to test behavior in a 3D game than a text filtering app but imho a good design is a testable one. (This does not necessarily mean I'm that good of a designer yet...)

Automate, automate, automate.

</comment><comment><USER20> I'm convinced the moderator of this blog has actually fallen in love with Notch. They won't approve my comment because it's derogative to Notch's dev practises...

<comment><USER18> Especially in this Ludum Dare case, development practices or implementation details do not matter as much as results. And he did get results. That's why it was interesting. I'd like to hear of what you think was wrong and why? This was his show of productivity and results. Other people have other ways and other circumstances can be completely different. And should be different.</comment></comment>


Working Group assembling to discuss HTTP/2.0 - <AUTHOR> http://lists.w3.org/Archives/Public/ietf-http-wg/2012JanMar/0098.html

<comment><USER2> While it would be exciting to see something as progressive as SPDY become codified as a standard, keep in mind the deliberately conservative nature of standards development, as seen in the responses to that message:

      On 24/01/2012, at 3:50 PM, James Snell wrote:
      > +1... would love to see that work move forward within this group. I do
      > have concerns about keeping the scope focused, however. Even tho the
      > door would be opened to the possibility of new features being
      > introduced, there is obvious danger in opening those doors too wide. I
      > strongly feel that things such as the introduction of new request
      > methods and new header fields, unless there is clear and irrefutable
      > evidence of their general utility within the core of the spec, should
      > continue to be pursued as they are today -- within separate I-D's as
      > extensions to the core protocol. The charter should make it absolutely
      > clear that the goal is an incremental evolution of HTTP/1.1 rather
      > than an opportunity for radical changes.

      Thanks, James.
      Pretty much everyone I've spoken to about this has raised the same concern.
      I agree it's going to be a tightrope walk, but I think there's a healthy
      amount of concern about this in the community, which will help guide development.
      Cheers,
      Mark Nottingham

</comment><comment><USER3> Whilst SPDY is nice, the compression possible using SDCH is a game changer. Given the amount of disk space on machines it should be possible to send quite large dictionaries to browsers.

For example, I've been experimenting with the Bentley/McIlroy compression algorithm and I can easily (no effort at all) compress the BBC News web site by 90% (i.e. to 10% of its original size).

<comment><USER4> For some reason SDCH gets no respect. Somebody could become a hero by writing an auto-SDCHing reverse proxy.

<comment><USER5> The stuff that's big (rich media) already has its own native compression. The stuff that's relatively small (text) also already compresses pretty well without shared-dictonaries.

I think that's the reason: it's not that big a win over the total traffic of a modern browsing session. For example, I doubt jgrahamc's experiment yields a 90% savings over the entire browsing session with BBC News, when getting images, and if gzip is already enabled on the HTML/CSS/JS. I'd guess closer to 10%.

 _Updated after taking a quick look at BBC News homepage in Firebug's net panel:_

The BBC News homepage has about 150KB of HTML/CSS… but they haven't even bothered to turn on gzip, which might bring that down to 30KB. It has about 230KB of images, which wouldn't be helped by a shared dictionary.

If they turned on gzip, text would be about 30/230=13% of the bandwidth. Even 99.99% compression – a dictionary of exactly today's content already on the client! – could only shrink the homepage download by 13%.

</comment></comment></comment><comment><AUTHOR> I'm looking forward to the inevitable discussions about cross-origin requests, same-origin policy and all that jazz.

Having implemented SPDY/2, they could do a lot worse than just ratifying SPDY (v3 by now..) and perhaps clarify some of the CORS stuff.

<comment><USER6> I love the idea of SPDY, but I would really like to see an open source (transparent) proxy, then I could proxy all my internet traffic through the cloud.

<comment><USER7> Not quite what you want, but a good DefCon talk with code about making a 'real' session layer.

<http://www.youtube.com/watch?v=aakzkrl-34g>

</comment></comment></comment><comment><USER8> Why is it that every mailing list I read about updates to legacy design (even classic ones that have been successfully implemented and no one would change back) always that that guy (or guys) who say "no this is stupid, make your own widget if you want new stuff, floppy disks are a good enough standard"? Poul- Henning Kamp is that guy here.

The guy who coined the term "bikeshed color" is now arguing over the name of the next iteration of HTTP, and how since it can't be done in a year it shouldn't be done at all. I understand the need for conservatism, but outright pooh-poohing is never effective without _major_ concerns.

</comment><comment><USER9> I'd like HTTP over UDP for javascript applications.

<comment><USER10> Frankly, your sentence doesn't make much sense. HTTP is a way of sending text and data, so UDP would never be used. The data needs to arrive, be in order, and be correct (exactly what TCP does). Also, the fact that a new HTTP protocol is being used has no effect on javascript, since the protocol is essentially abstracted away.

As for your real question, when will javascript have UDP socket support, that is an interesting question. The feature would definitely be handy for multiplayer games and video/audio streaming. In light of this, I'm sure something will come down the pipe eventually. There could be security worries though, for example it could be used to build a webpage that performs a DDoS (not that they can't be built already).</comment></comment>


Ask HN: Does any good software exist for browsing / organizing digital photos? - <AUTHOR> These days with everyone having smartphones the number of photos accumulated over time is kind of mind-boggling. Does any software exist for easily browsing, categorizing, and deleting digital photos? It would be nice to just point the application to a directory and be able to browse the photos quickly one-by-one, marking each using predefined and/or custom-defined category buttons including 'mark for deletion'. Maybe I'm describing a program that doesn't exist yet but hopefully I'm not. Anyone know of anything like this? <comment><USER2> I've been using Picjoy:

[http://www.picjoyapp.com/](http://www.picjoyapp.com/)

It's pretty new, but it auto-tags your photos based on meta data and doesn't download your photos to their server (I hate the idea of Google photos and other apps having access to my photos). It's got a pretty cool story feature that lets you add captions to your photos too. From what I've read about them they've got some really cool stuff in the works that will release soon. Web app, Android version, etc. I've been using it for the last few weeks and am very happy with it.

</comment><comment><USER3> Google photos - [http://photos.google.com](http://photos.google.com) . Browsing via automatically tagged people and places is unbelievably good.

</comment><comment><USER4> XNView is good software for browsing, speedy. Kind of like Irfanview but in my opinion a bit better in the UI. I do like Irfanview a lot though. One fave feature of xnview for me is how you can export a text file from folders / subfolders you're in plain text or CSV. I've found it useful over the years. Also for image organization batch renaming is pretty essential, I use antrenamer on windows for years, love it. NameChanger for Mac. Linux I have a fave but i cant' recall the name.

</comment><comment><USER5> I use Adobe Bridge for this [0]. It comes bundled with Adobe Creative Cloud and I'm not sure if you can get it separately, but it does everything your asking about. Also, as someone who shoots in camera raw mode for photography, it's great to be able to see my photos without having to open them in an editor.

[0][https://creative.adobe.com/products/bridge](https://creative.adobe.com/products/bridge)

</comment><comment><USER6> We actually build excatly what you describe but failed to get any traction for it - I guess most people talks about sorting their image but few actually takes the time to do it!

The windows app is here: [http://tsr-soft.com/products/photo- manager/](http://tsr-soft.com/products/photo-manager/)

</comment><comment><USER7> Are you taking about a mobile app or a desktop one ?

On desktop (Windows) I'm partial to ACDsee but I didn't test many.

I think Adobe Lightroom could be a good fit too.

I can't say for mobile, I really prefer to use a desktop.

<comment><AUTHOR> Thanks for the recommendations! Either mobile or desktop is what I had in mind. The functionality required would be pretty simple ideally, just a few static buttons and a photo viewing area as a bare minimum. While I prefer desktop in general I could see myself using this type of program on mobile if it were the better option.

</comment></comment><comment><USER8> picasa by google fits your description. It can do all that you want, its old but still being updated.

It can publish photos to google photos but dont require you to upload anything or sign in with your google account:

[http://www.google.com/intl/da/picasa/](http://www.google.com/intl/da/picasa/)

</comment><comment><USER9> This is the one I use:

[http://www.irfanview.com/](http://www.irfanview.com/)

Its quirky but its the fastest way through a few thousand pics I've found yet. It doesn't quite categorize, but it lets you select and batch stuff.</comment>