Building JavaScript Tools You Didn't Think Were Possible - <AUTHOR> http://gregfranko.com/building-javascript-tools-talk/

<comment><USER2> Greg is being modest by not mentioning his [AMDClean]([https://github.com/gfranko/amdclean](https://github.com/gfranko/amdclean)) library more prominently - it's a superb example of what he's talking about in this presentation.

It makes it possible to use AMD modules while building a library or web app (which is utter bliss when it comes to testing and debugging - no build lag or source map nonsense), but to convert it to non-AMD JavaScript in the final step. I use it on a fairly large (~10,000 LOC) library, [Ractive.js]([https://github.com/RactiveJS/Ractive](https://github.com/RactiveJS/Ractive)), and it's transformed the way I work.

<comment><AUTHOR> If only everyone on Hacker News was as nice as you Rich

</comment></comment><comment><USER3> It should be mentioned that this is a slideshow. Just in case anyone just sees the initial page and thinks that's it.

</comment><comment><USER4> I've had to do a lot of this recently for CodeCombat's transpiler, Aether: [https://github.com/codecombat/aether](https://github.com/codecombat/aether) – it uses Esprima, Acorn, JSHint, and a bunch of other JS tools. There's a ton of great stuff out there, and it's easy to put them together since they all operate on the Mozilla SpiderMonkey Parser API abstract syntax tree format.

I like node-falafel better than estraverse, which is more concise to use: [https://github.com/substack/node-falafel](https://github.com/substack/node- falafel)

If anyone likes this stuff and wants to write an open-source, in-browser parser from another language like Python, Haskell, or Ruby to the Mozilla AST format, we'd love to make it worth your while. See [https://github.com/codecombat/codecombat/issues/72](https://github.com/codecombat/codecombat/issues/72) and then email me to work out an arrangement.

<comment><USER5> I just want to point out that parsing is the easy part of writing a language implementation. E.g. for Python all of the interesting stuff is in the VM and bytecode generator, the parser is just one page of a grammar that gets fed into a parser generator (for CPython). You will have a much harder time with Haskell since even more of the interesting stuff is done to the intermediate representation (ghcjs is the only thing I know of trying to run it in javascript).

</comment></comment><comment><USER6> Looks like it could be a cool presentation but mid-hangover-me can't deal with the cube effect. ;) Is there a boring slide version available?

<comment><AUTHOR> Yep, exported it to Speaker Deck =) [http://gregfranko.com/blog/building- javascript-tools/](http://gregfranko.com/blog/building-javascript-tools/)

<comment><USER6> Cool! Thanks!

</comment></comment></comment><comment><USER7> I am doing serious transpiler stuff at the moment and I think its easier to do in JS than any other language.

It look me about 2 hours to design and write this little utility for finding and removing redundant braces in expressions using node-falafel:- [http://edinburghhacklab.com/2014/02/remove-redundant- bracket...](http://edinburghhacklab.com/2014/02/remove-redundant-brackets- from-expressions-with-falafel/)

The larger problem I am doing is static code analysis for Firebase and the JS tools for doing such stuff are delightful compared to yacc and lex and javacc etc.

Functional programming really shines in this domain. You can populate your symbol table with functions that get "called" when "CallExpressions" are encountered during parsing, or functions that expand to function declarations on "MemberExpression" are encounter during parsing (the <dot> operator). Its very easy to mirror the true structure of JS using JS if that makes sense.

<comment><AUTHOR> I agree with you that functional programming really shines. I love using the lodash where() method when analyzing ASTs.

</comment></comment><comment><USER8> How is anybody suppose to know that this is a slideshow?

I'm starting to think people just click the up arrow because they like the title.

I'm not reading these slides, this information would be presented much better as a simple webpage.

Also, to prevent the initial collage of text set everything to hidden then fade in or show after the document is ready.

<comment><AUTHOR> You can also view the presentation here: [http://gregfranko.com/blog/building- javascript-tools/](http://gregfranko.com/blog/building-javascript-tools/) It has been exported to speaker deck

</comment></comment><comment><USER9> What a bad UX. It took my a while to figure out that I need to use arrows.

<comment><USER7> thanks! I did not work it out myself. It presented a load of jumble for a flash and did nothing. Clicking it just opened another window with the same initial jumble (Chrome linux something)

</comment></comment><comment><USER10> I stared at the page for 10 seconds before realising that i have to use arrows. I'd suggest adding simple instructions like "Press arrow keys to navigate".

</comment><comment><USER11> On my iOS6 4s, the slideshow looks like all of the text jumbled in a pile for just an instant. Then mobile safari crashes...

<comment><USER12> Linux Opera 12.16, the page is a jumble for an instant, too, then just the title, author and what looks like a link you can't click.

edit: didn't realize you had to use the arrow keys. In which case it appears to work fine, except the second slide where the image is squished.

</comment></comment><comment><USER13> Ok that is static code analysis for JS. What is static code analysis good for? Seriously, can someone please explain or post a link better than Wikipedia? I live under the impression that I write beautiful (understand sufficiently optimal) OO JS using TypeScript, what has SSA to offer to me? PS: of course I a noob.

<comment><AUTHOR> My presentation focused on creating new tools, but it is important to understand the concepts so that you can contribute to existing tools. Maybe in the future you will contribute to TypeScript.

<comment><USER13> Thanks, that makes sense.

</comment></comment></comment><comment><USER14> I just get a title page, the link goes nowhere. Edit: use arrow keys

</comment><comment><USER15> There's no need to make the text rotate in every single slide and why can't I just use the mouse to navigate? This UX is terrible.

<comment><AUTHOR> Now now, don't be mean. You can also view the presentation here: [http://gregfranko.com/blog/building-javascript- tools/](http://gregfranko.com/blog/building-javascript-tools/)

<comment><USER16> I like the slideshow. Did you use a library for that? And is there a slideshow -> single page converter JS tool?

<comment><AUTHOR> Yea, I used Bespoke.js ([http://markdalgleish.com/projects/bespoke.js/](http://markdalgleish.com/projects/bespoke.js/)). Bespoke has a really nice Yeoman generator ([https://github.com/markdalgleish/generator- bespoke](https://github.com/markdalgleish/generator-bespoke)) that makes it easy to get started and to deploy to Github Pages.

In terms of the converting to PDF (to upload to Speaker Deck), it is recommended to just save the webpage to PDF in chrome or another browser that supports this feature (you can do this by beginning the print process and then changing to 'Save as PDF')

Bespoke has a print stylesheet, which is why the styles are still kept.

</comment></comment></comment></comment><comment><USER17> Looks interesting. Any links to the actual talk?

<comment><AUTHOR> I presented this talk at jQuery San Diego last week ([http://events.jquery.org/2014/san-diego/](http://events.jquery.org/2014/san- diego/)), so I'll link to the video when it is up!</comment></comment>


Lojban The Logical Language - <AUTHOR> http://www.lojban.org/tiki/la+lojban.+mo

<comment><USER2> The problem with Lojban, according to Munroe: <http://xkcd.com/191/>

<comment><USER2> Never mind, the other item has more traffic: <http://news.ycombinator.com/item?id=2634821></comment></comment>


Ask HN: Anyone of you using a virtual physical office address? - <AUTHOR>

<comment><AUTHOR> Context: I mainly ask for distributed companies that don't have a 'real' office but still want to receive physical mail occasionally.

I'm thinking of something like Google Voice. An address that you can always use, no matter how may times you relocate.

<comment><USER2> The only one I can think of is Earth Class Mail [https://www.earthclassmail.com/](https://www.earthclassmail.com/) but really, you can just set up forwarding with USPS.

<comment><AUTHOR> Thanks for the USPS tip, didn't know about that.

</comment></comment></comment><comment><USER3> I have been using earthclassmail.com as my official office address since 2007 and am very happy with their service. I run a multi-million dollar internet business from home.</comment>


Show HN: Certainty-JS: Automated CACert.pem Management for Node.js Software - <AUTHOR> https://github.com/paragonie/certainty-js <comment><AUTHOR> Hi HN,

A couple years ago I started developing an open source PHP library called Certainty. You can read about it here: [https://paragonie.com/blog/2017/10/certainty-automated- cacer...](https://paragonie.com/blog/2017/10/certainty-automated-cacert-pem- management-for-php-software)

Essentially, I wanted to ensure that server-to-server HTTP requests use TLS securely in open source projects, but unfortunately a lot of code disabled TLS verification in PHP software.

Including eCommerce plugins.

Including eCommerce plugins that connect to Authorize.net payment gateways.

 _grimace_

However, no equivalent JavaScript solution exists for solving this problem.

I was concerned that a lot of the developers who used to write vulnerable PHP code might also be working in the Electron/Cordova/etc. ecosystem today, and if they retained any of their bad habits from their PHP + ext/curl days, their products would be at risk.

So I decided to port this library to Node.js. Let me know what you think.</comment>


Proof of Stake - <AUTHOR> http://avc.com/2016/11/proof-of-stake/ <comment><USER2> Is it just me or does all this "Blockchain doesn't have to be Bitcoin" ideology sound like "Uber is worth billion dollars. Let's build an Uber for X"?

Even before Bitcoin there were tons of attempts at implementing cryptocurrency, and none of them worked. It was Bitcoin that hit the jackpot for some reason, just like how human beings beat all the odds to become the top of the food chain on earth.

I am not saying it's impossible, I just don't like how all this movement is driven by VCs, just like how all the "Uber for X" companies were driven by VCs, powered by naive entrepreneurs who thought just copycatting a successful model to a different domain would make them rich.

I just think in most cases these copycat projects have no soul and that's why they fail, just like Uber for X companies never become Uber.

<comment><USER3> It think one of the issues at the core is that all these copy cats have a company or group of people behind them who stand to benefit if their block- chain gets traction. Because there is a lot of value if someone can control the block chain you see all these people trying. Bitcoin's creator on the other hand released their idea into the world and then disappeared. If it is eventually successful they don't stand to benefit any more than any other early adopter.

It kind of reminds me of the early days of the Internet when you didn't get "Internet" you got AOL, or CompuServe, or whatever. All these companies wanted to control the network you connected into with their own branding. Eventually those companies all died and everyone realized that an open Internet with no one company controlling it at the core was the way things would go.

<comment><USER4> >It kind of reminds me of the early days of the Internet when you didn't get "Internet" you got AOL, or CompuServe, or whatever. All these companies wanted to control the network you connected into with their own branding. Eventually those companies all died and everyone realized that an open Internet with no one company controlling it at the core was the way things would go.

But aren't we moving back that direction? Now your local business doesn't have a website, they have a facebook.

Turns out? people like walled gardens just fine, it's just that it's not as easy as it looks to build a walled garden _and_ a last mile transport network.

<comment><USER2> I think there's a distinction. Facebook/Google/etc are built on top of the Internet, which is an open platform.

These companies we're talking about are basically trying to "become the Internet" (not something that builds on top of the Internet)

<comment><USER5> AOL, Compuserve &c. were built on top of the CCITT standards (V.21 &c.), and the PSTN, which was a fairly open platform post 1968.

<comment><USER2> I think you misunderstood what i said.

<comment><USER5> Possibly. Where you trying to indicate a difference between AOL/Compuserve/etc and Facebook/Google/etc? If so, what was it?

<comment><USER4> I think that most people think that starting a walled garden is easier when it's connected to an internet that everyone is always connected to.

The internet is different from the PSTN network that connected you to CompuServe because if Facebook controlled your last mile the way AOL did, you'd need to coordinate with Facebook when you wanted to upgrade to the latest DSL or cable or what have you. The idea here is that once we got DSL and other "run gigabit ethernet over a series of rusty coat hangers that we have twisted together" level technologies, (I think it's fucking amazing that DSL works at all) in one location, one technology is going to work way better than others, and those other technologies might work way better in other locations. In walla walla you might get twice the speed on compuserve, while in San Jose, AOL might give you 4x the speed, if AOL and CompuServe ran their own networks. (to torture the metaphor)

Of course, if you made the last mile technologies like DSL and Cable switch the endpoints of their connections as quickly as you can switch endpoints on a PSTN, sure, that would have solved the problem, too. But... really, that's kind of what the internet does.

I think this is why walled gardens that include the last mile keep failing; the last mile is largely hard based on physical geography, and the walled gardens are hard based on your preferences, which often don't match up with your geography.

I think that's why walled gardens are doing so much better now than they were in the '90s; these days, one set of companies focuses on the last mile, (and everyone has, comparatively speaking, astoundingly good last-mile access) and then a completely different set of companies can set up walled gardens to cater to various preferences, and the people that like that walled garden don't have to share a geography.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> TD-Linux Sadly, this article is mostly just a link to the Ethereum FAQ.

It should be noted that every Proof of Stake altcoin has eventually collapsed, and there are arguments that this is inevitable: [https://download.wpsoftware.net/bitcoin/pos.pdf](https://download.wpsoftware.net/bitcoin/pos.pdf)

<comment><USER6> It's not that distributed consensus is hard. It's that _anonymous_ consensus is hard. Common stock has distributed consensus via voting based on share ownership. That's proof-of-stake.

The real problem here, as with spam, is the ability to generate large numbers of anonymous identities cheaply. Zuckerberg figured this out a long time ago; hence Facebook's "real names" policy.

<comment> TD-Linux That's partly the case, though note that in terms of Bitcoin, stock would be considered to be centralized, not distributed, as the exchange determines ordering of transactions. It's not really proof of stake because it doesn't have the problem that proof of stake is trying to solve in the first place.

<comment><USER7> Stock is centralized, but not in that way.

There is no single ordering of transactions. Exchanges (which are distinct entities, i.e. decentralized) are legally required to report their trades, but the order actually happens at independent places.

What is centralized is the record of ownership of the shares. All publicly tradable shares in the US are in a technical sense owned by Cede & Co., a partnership related to the DTCC. When shares change hands, all that happens is an entry in the database at the DTC.

Since we're talking about the blockchain, it's interesting to know how this system is secured. The mechanism is that both parties report the expected transactions to DTCC, which ensures they match before the money changes hands. The trade that happens during market hours is only the agreement to trade, and the actual delivery happens three days later.

</comment></comment></comment></comment><comment><USER8> My gut tells me the opposite. Here are some unscientific reasons why.

Proof of stake: the mechanism to secure the coins, uses the coins it's trying to secure. Circular.

Proof of work is simpler to describe and implement, which is attractive. Joining, then leaving, then joining and catching up is easy. Blockchain reorgs are easy.

Compare the length of Bitcoin's whitepaper and any PoS whitepaper, or the cited link even.

It'd be interesting for the author to share his intuitions for why it might be better.

<comment><USER9> >Proof of stake: the mechanism to secure the coins, uses the coins it's trying to secure. Circular.

I think the term you're looking for is 'bootstrapping'. Once we have enough cryptocurrency via PoW, we can (and only then) implement PoS.

<comment><USER10> No, it's not that simple. After you switch to a PoS system you still have all the problems. For example, who is allowed to vote is decided by who is currently voting.

For example, PoS is typically signature based. What's to stop me from making more signatures after the fact? And how can a newbie tell which signatures I made first?

These are hard problems, and they aren't the only ones, and solving the bootstrapping issue alone is not sufficient.

</comment></comment></comment><comment><USER11> Are there any "Proof of storage" blockchains?

This would force people to have physical objects (RAM or HDD) to mine, but doesn't consume the massive amounts of energy that POW mining consumes.

(i.e. you only need the storage to mine a block, not longterm)

The way I'm envisioning it each "tick" randomly X blocks are picked, and the more storage you have the more likely it is you will be picked (potentially more than once).

<comment><USER12> How would you prove having storage?

Seems it would use a lot of bandwidth or computation when calculating hashes.

<comment><USER11> I don't know.

I was thinking something like write a bunch of random numbers to disk, and prove that you have the ability to retrieve any of them at will.

This is obviously not a complete solution. I was asking if anyone knew of any such system.

A positive, not negative, feature of the system is you must be able to rewrite all the storage each time. So the faster your can write the more blocks you win, but also the more storage you have the more blocks you win (and it's a tradeoff between them).

<comment><USER12> I'm not aware of any Proof-of-Storage systems but Storj and similar projects are combining blockchain cryptocurrency with p2p storage.

It's an interesting idea.

<comment><USER10> Happy to jump in as the founder of one of these, Sia. We build consensus using proof of work, and then we throw some smart contracts on top of the consensus system to build a secure marketplace for cloud storage.

The result so far has been really potent. On the Sia network today, raw storage (pre-redundancy) costs about $0.30 per TB. Performed intelligently, you only need about 2x redundancy, putting the total cost at less than 1/10th of Amazon glacier.

I project that as the network grows, demand will catch up to supply more and the price will settle closer to $2 / TB / Mo for raw storage.

I can answer any questions.

</comment></comment></comment></comment></comment><comment><USER13> Actually proof of stake can by hybrid one: You will need both mining power and staking. By having 2x coins you will have 4x voting power.

That way you will reduce waste on mining while still having security coming from it.

<comment><USER10> That's a naive solution that has dramatic centralizing effects. By owning more coins, you are stronger than the competition. The miner with the most coins will out compete the rest, and you will be left with one miner.

This problem has been very well studied and there are not any simple solutions available. Many academics believe that it's fundamentally impossible.

</comment></comment><comment><USER14> Open for critique, but just by going off of this article:

With "Proof of <wildcard>" you're essentially abstracting out how a community participates.

Proof of Work exists to demonstrate good will by saying "This person works to participate and add value in the community" There is a buy-in a degree removed from the coin.

Proof of Stake sounds like it just removes the work someone must do from the system and says "If they have money, they can buy in to the community without work".

It's like saying: Instead of people putting in the work to contribute to the community through effort the community finds valuable (i.e. Proof of Work, e.g. Karma), we're going to let people just buy karma and trust that they have the community's best interest in mind.

While this gives _anyone_ the ability to buy into the community and participate in the consensus, this sounds like the opposite of what I want in a community, because these people don't have to work to demonstrate their value to the community that exists.

Another issue is this doesn't encourage liquidity, it encourages people to hoard their coins/currency to participate. This might drive the price of the coin up I guess.

Ethereum doesn't have a 'set amount' that will ever be released like bitcoin. They'll release coins indefinitely. Does this mean you'll have to participate in purchasing coins indefinitely to continue to participate to have a larger voice as the value of your coins gets diluted?

There might also be the problem of who controls the coins might always maintain a majority, since the tokens/coins are just issued, there is no real work required to obtain them. That's a little weird and totalitarian and not utilitarian.

<comment><USER15> Proof of work demonstrates that a certain amount of work was done, which cost a certain amount of money to produce. It's burning money to get currency, nothing more.

<comment><USER16> It also helps facilitate transactions, ensures the security and integrity of a network of mutually distrustful agents, and establishes a price floor for the currency loosely based on the price of electricity.

<comment><USER15> "establishes a price floor for the currency loosely based on the price of electricity."

You have causality backwards: the difficult changes based on the price of the currency. If the price goes down, people will simply mine less.

</comment></comment></comment></comment><comment><USER17> As I attempt to understand the block chain as a tool I'm struggling to see an application useful other than bitcoin. Anyone have a example?

<comment><USER10> Sure. For Sia we've used smart contracts to build a secure marketplace for cloud storage. Basically, we use the blockchain to create a contract between a host and a renter saying that the host will store X data for Y amount of time. The renter pays immediately, but the host only received the payment after Y time and only if the host can prove cryptographically that they still have the data.

You can combine this with encryption and erasure coding to create a near- perfect marketplace for cloud storage that's very competitive, private and secure, and extremely reliable.

Here's a good place to get started for more technical information:

[http://forum.sia.tech/topic/107/interesting- threads](http://forum.sia.tech/topic/107/interesting-threads)

Our network today sells storage for less than 1/10th the cost of Amazon S3.

</comment></comment><comment><USER18> Proof of Stake is not free of fault. First and foremost it gives an inherent incentive for hoarding, which is the death of every currency.

</comment><comment><USER19> I'd like to point out Peercoin, which has been running since 2012. It's a hybrid POS/POW currency.

[http://www.coindesk.com/how-peercoin-got-a-boost-from- bitcoi...](http://www.coindesk.com/how-peercoin-got-a-boost-from-bitcoins- halving/)

</comment><comment><USER20> There are many questions yet to be answered wrt PoS, but one that I have yet to hear a good explanation for is the initial coin distribution. A blockchain would be mined for a set period of time, and then PoS turned on. A great advantage of PoW is its simplicity. Want some coins? Work.

</comment><comment><USER21> _> Mining works. It has validated blockchain technology and allowed it to be commercialized._

Well, it works at small scale, hasn't been validated at large scale yet. The entire Bitcoin community is undergoing a schism right now over a disagreement related to mining.

<comment><USER22> No it isn't, its undergoing a schism related to protocol.

The mining part has worked fine.

<comment><USER10> Well, you are not wrong about the schism, the schism is indeed about the protocol and not about the mining.

But I don't think you'll find many of the developers agreeing with the idea that the mining has worked just fine. It's horribly centralized, and while it gets better and gets worse, at its best it's "jeez this is really centralized and I don't feel comfortable at all" and at it's worst it's "only two entities who happen to be in the same legal jurisdiction need to collaborate to do a 51% attack on the network, oh yeah and they are already collaborating in other nontrivial ways".

Miner centralization is still a huge issue for Bitcoin.

<comment><USER22> >Miner centralization is still a huge issue for Bitcoin.

That's a fair call, there is a little too much faith in the large pools being "rational" participants.

</comment></comment></comment></comment><comment><USER23> Proof Of Stake tackles scale and cost. Perhaps Lightning Network or Open Transactions are better approaches?

</comment><comment><USER24> There is nothing at stake. That's the problem.</comment>


Rampant wealth inequality in Silicon Valley could make San Fran a ghost town - <AUTHOR> http://qz.com/641223/rampant-wealth-inequality-in-silicon-valley-could-make-san-francisco-a-ghost-town/ <comment><USER2> "Nobody goes there anymore. It's too crowded." \- Yogi Berra

</comment><comment><USER3> Rent capping is the clearest answer for this kind of situation.</comment>


Ask HN: Did you start your internet business (startup) without incorporating? - <AUTHOR> When did you and why did you decide to incorporate? <comment><USER2> I haven't incorporated, but when I start to charge users, I will have to, because when I get sued (for example, my server gets hacked), the company will be my protection.

<comment><AUTHOR> Thanks Bill :)</comment></comment>


Introducing Postman Pro - <AUTHOR> http://blog.getpostman.com/2016/12/15/introducing-postman-pro/ <comment><USER2> Seems like some nice stuff! Would be cool to be able to self-host the software though for places that cannot rely on stuff hosted outside country borders for example.

Or for organizations which apis is not displayed for anyone outside the network.</comment>


The Quadrennial iPhone SE Schedule - <AUTHOR> https://daringfireball.net/2020/04/the_quadrennial_iphone_se_schedule <comment><USER2> Now that they got rid of the Plus moniker, I hope they drop the "Max" from the Pro Naming.

So we end up with a Line up looking like,

iPhone 12 Pro 6.1" / 6.7" iPhone 11s / 12 5.4" / 6.1" iPhone SE 4.7" / ( I think there is a 5.4" coming in 2021 )

I mean the whole iPhone 11 Pro Max is getting very "Microsoft" naming alike and un-Apple.

<comment><USER3> How about "The 2020 iPhone 6"? Just year-product-size.

<comment><USER4> It seems to work for their computers, however I suspect that's only an artefact known to the enthusiasts.

I have noticed that with this convention you then run into people conflating the year of purchase with the model year, especially when these devices are sold for multiple years.

This is potentially confusing to people.</comment></comment></comment>


Last Bohemian Turns Out the Lights - <AUTHOR> http://www.nytimes.com/2014/04/06/nyregion/clayton-patterson-rebel-and-photographer-plans-to-leave-the-lower-east-side-for-europe.html

<comment><USER2> tl;dr: Old man hangs on to antique sense of his neighborhood and memories from youth, decades after gentrification; is complaining about the rent.

<comment><AUTHOR> "[In 1983] the couple bought the building where they live today."

"<Moving to a chalet in the Alps> struck some in his circle as unfathomably strange"

== Sounds like the rent is covered. But YMMV.</comment></comment>


Jackson-databind – remote code execution vulnerability - <AUTHOR> https://lists.debian.org/debian-security-announce/2019/msg00191.html <comment><USER2> These reports are a a waste of everyone's time. There are 10s of completely meaningless CVEs being issued for each new deserialization gadget that someone finds and gets added to a blacklist designed to protect a known-unsafe use- case (deserializing user input whilst defaultTyping is enabled).

They're not general vulnerabilities in the library. They surface when people use a documented-dangerous function in a stupid way.

<comment><USER3> Its aggravating because then internal security flags pick it up and create "upgrade this lib" busywork for every team.

Obviously this stuff (security disclosure) isn't easy but with such a pervasive library near monthly findings is a growing chore.

<comment><USER4> The correct response is to audit how you use it, especially what other libraries you have on the classpath. Per another comment on this submission [0], its unlikely that you've satisfied all the requirements for exploiting these CVEs. If you don't satisfy those preconditions, there's not much benefit in upgrading.

Additionally, 2.10 deprecates the unsafe behavior and introduces a new, safer alternative. See the blog post for more information there. [1] That might be a valid reason to spend time upgrading.

Obviously, if you're actually affected, then yes, upgrading or backporting patches is a good idea.

[0]: [https://news.ycombinator.com/item?id=21171746](https://news.ycombinator.com/item?id=21171746)

[1]: [https://medium.com/@cowtowncoder/on-jackson-cves-dont- panic-...](https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here- is-what-you-need-to-know-54cd0d6e8062)

<comment><USER5> The problem is when you have customers who have internal no-CVE policies and a business-person looking at fortify instead of an engineer looking at the technology. Then they insist on special releases every month because Jackson has another CVE, and if you don't do it, their manager talks to your manager.

<comment><USER6> Have to agree with above comment - this is where snyk and whitesource are trying to stand out with usage analysis to tell you if you are truly vulnerable. The load is too high on both sides for humans.

<comment><USER3> My experience is that whitesource still has some way to go...

Someone who can solve this problem effectively could make some real money.

<comment><USER6> You tried eua and still got false positives?

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Those 6 vulnerabilities occur in a very specific situation (all of those must be true):

1\. JSON content is sent by an untrusted client

2\. Must have one of those libraries in classpath: Logback, HikariCP, commons- dbcp, P6Spy

3\. Default typing must be enabled with enableDefaultTyping (very insecure, if your program has this, it's insecure even after this patch)

4\. There must be a property with permissive type (such as Object, Serializable, Comparable, Cloneable, and so on)

<comment><USER8> See their blogpost [1] for a detailed explanation and why this is required

[1] [https://medium.com/@cowtowncoder/on-jackson-cves-dont- panic-...](https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here- is-what-you-need-to-know-54cd0d6e8062)

</comment></comment><comment><USER9> This seems to be a yet another manifestation of the same underlying issue that has marred this library since 2013:

[https://blog.sonatype.com/jackson-databind-remote-code- execu...](https://blog.sonatype.com/jackson-databind-remote-code-execution)

The only reliable fix is surely stopping serialization of arbitrary classes by not using or auditting any use of the DefaultTyping feature.

<comment><USER2> >it is apparently on by default

Curious as to what makes you think this - I was under the impression you needed to explicitly call `enableDefaultTyping` to get this unsafe behaviour. The wiki page explicitly tells you not to do this with untrusted input and the method is deprecated in the latest versions of the library.

[https://github.com/FasterXML/jackson- databind/issues/2195](https://github.com/FasterXML/jackson- databind/issues/2195)

[https://github.com/FasterXML/jackson- docs/wiki/JacksonPolymo...](https://github.com/FasterXML/jackson- docs/wiki/JacksonPolymorphicDeserialization)

<comment><USER9> From the blog I linked. They might have meant the feature was on by default _in 2013_. I edited that part away.

Here is a much better blog by the library author themself: [https://medium.com/@cowtowncoder/on-jackson-cves-dont- panic-...](https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here- is-what-you-need-to-know-54cd0d6e8062)

</comment></comment></comment><comment><USER10> This is one of the fixes: [https://github.com/FasterXML/jackson- databind/commit/9593e16...](https://github.com/FasterXML/jackson- databind/commit/9593e16cf5a3d289a9c584f7123639655de9ddac)

It seems like it's a blacklist of types to not automatically de-serialize? If so, that's.... not good.

<comment><USER8> It's not. Jackson has been aware of that for some time. Initially it was hoped a blacklist would be good enough, but it wasn't. In the latest 2.10 version, the unsafe way is deprecated and an alternative.

It must be noted that the vast majority of Jackson use cases is not affected, you need to enable an optional feature that has been known to be unsafe for years [1]

[1] [https://medium.com/@cowtowncoder/on-jackson-cves-dont- panic-...](https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here- is-what-you-need-to-know-54cd0d6e8062)

</comment></comment><comment><USER11> The email has a list of CVEs. Some are related to quite old bugs, as described here:

[https://medium.com/@cowtowncoder/on-jackson-cves-dont- panic-...](https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here- is-what-you-need-to-know-54cd0d6e8062)

The most recent relates to blocking yet another gadget:

[https://github.com/FasterXML/jackson- databind/issues/2478](https://github.com/FasterXML/jackson- databind/issues/2478)

As another commenter mentions, this whole set of issues is only a problem if you call enableDefaultTyping during setup, and then deserialise data from untrusted sources. Doubtless, there are people doing this. But don't.

</comment><comment><USER12> [https://github.com/FasterXML/jackson- databind/issues/2410](https://github.com/FasterXML/jackson- databind/issues/2410) Block one more gadget type (HikariCP, CVE-2019-14540)

[https://github.com/FasterXML/jackson- databind/issues/2478](https://github.com/FasterXML/jackson- databind/issues/2478) Block two more gadget types (commons-dbcp, p6spy, CVE-2019-16942 / CVE-2019-16943)

[https://medium.com/@cowtowncoder/on-jackson-cves-dont- panic-...](https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here- is-what-you-need-to-know-54cd0d6e8062)

# Safe Default Typing (safe Polymorphic Deserialization) [https://medium.com/@cowtowncoder/jackson-2-10-features- cd880...](https://medium.com/@cowtowncoder/jackson-2-10-features-cd880674d8a2)

</comment><comment><USER13> How do you check if a machine is using jackson-databind?

<comment><USER14> You can unzip and look inside war files web-inf/lib (assuming it was packed with version number in file name) or you'd need to compare signatures of compiled classes packed into a jar file.

In other words, it's quite difficult to do without running some scanning process designed to look for this library, and for specific versions of it that are vulnerable.

<comment><USER15> Not arguing, but since this news article is a specific link to the Debian Security tracker - the package is `libjackson2-databind-java` on Debian, presumably similar on others. If it was installed via package manager, `dpkg -l | grep jackson`, `rpm -qa | grep jackson` or similar on most Linux to possibly find it. I agree though that it's common for libraries like this to end up inside warballs.

<comment><USER4> jackson-databind is the name of the package on Fedora and on RHEL. We addressed this issue last week by updating to 2.10, though I think F30 and F31 updates still needs karma [0].

The other jackson packages are mostly Java package hierarchy that don't affect this CVE (jackson-core, jackson-bom, jackson-parent, and jackson-annotations -- but we've also updated all of these to 2.10 on F30+).

So:

        rpm -qa | grep jackson-databind

To the GGP:

As noted by other commenters just having the package isn't sufficient. You need a number of other libraries (most of which aren't shipped with Fedora, none of which are shipped on RHEL) on the classpath of the running JVM.

If you're not running any Java code, you're definitely not affected. If you're using any code distributed through the official channels, it is very unlikely that you're affected. You'll probably only be affected if you're using third- party projects. Which as always, are run at your own risk. :)

[0]: Source: co-maintainer of the package via the Fedora Stewardship SIG.

F30 Bodhi: [https://bodhi.fedoraproject.org/updates/FEDORA-2019-b1715548...](https://bodhi.fedoraproject.org/updates/FEDORA-2019-b171554877) F31 Bodhi: [https://bodhi.fedoraproject.org/updates/FEDORA-2019-cf87377f...](https://bodhi.fedoraproject.org/updates/FEDORA-2019-cf87377f5f)

</comment></comment></comment></comment><comment><USER16> Jackson-databind is an enterprise virsus ...</comment>


Cornell Chronicle: Computer derives natural laws - <AUTHOR> http://www.news.cornell.edu/stories/April09/NaturalLaws.ws.html <comment><USER2> _"Their process begins by taking the derivatives of every variable observed with respect to every other -- a mathematical way of measuring how one quantity changes as another changes._ "

In an ideal world, that could be done. But am I the only one who is wondering where noise comes in? All measurements are noisy, and computing derivatives from noisy data sounds sketchy.

 _"Then the computer creates equations at random using various constants and variables from the data. It tests these against the known derivatives, keeps the equations that come closest to predicting correctly, modifies them at random and tests again, repeating until it literally evolves a set of equations that accurately describe the behavior of the real system. Technically, the computer does not output equations, but finds "invariants" -- mathematical expressions that remain true all the time, from which human insights can derive equations."_

Once again, if the data is noisy, then the program can't find true invariants. Perhaps it can "guess" them. I would like to see that source code and the data sets these guys have used.</comment>


Let's Build NSMutableArray - <AUTHOR> http://www.mikeash.com/pyblog/friday-qa-2012-03-09-lets-build-nsmutablearray.html <comment><USER2> "This code omits error checking in the interest of brevity and simplicity."

In the interest of brevity and simplicity, and at the cost of correctness and reliability - I understand the intent, but I believe that there is a balance to be struck on this for all code, whether example, prototype, or production.

Because sample code so very often chooses an extreme of that spectrum, it is easy for neophyte coders to end up thinking that is how all code should be written.

<comment><USER3> I'd love to see a widget that would let you display and toggle between two versions of the code on a webpage:

* a first version illustrating the core concepts

* a second more complex version aimed at showing proper coding practices including comments showing where you can have performance or security issues.

It would be a nice addition to the many source code beautifiers/formatters out there.

<comment><USER4> Unfortunately if it's the first semi-working code sample in a Google result, it will still end up in production _somewhere_ no matter how crappy it is and how many warning labels are put on it.

</comment></comment></comment><comment><USER5> >For the unfamiliar, memmove is a potentially slower variant of memcpy

It's worth pointing out that the performance hit of memmove vs. memcpy is a single check in memmove which decides, based on if the source or destination address is higher, whether to copy front to back or back to front. You're never going to win any measurable performance gains by replacing a memmove call with a memcpy.

<comment><USER6> That single check could potentially be a branch mis-predict.

<comment><USER5> The only time it would make a big difference would be if you were doing a lot of small memmoves in a tight loop. In that scenario, you mispredict at the end of the loop within memmove/memcpy anyway. So when the outer loop comes back around, the pipe is already empty and any mis-predict on the pointer comparison is basically harmless.

</comment></comment></comment><comment><USER7> I think this is a great article to refresh your knowledge as to how the underlying data structures actually work.

My only nitpick is ignoring the _capacity_ variable in _initWithCapacity_. Really, a simple allocation of memory here and setting the __capacity_ variable is all that's needed. It IS an important implementation to write - especially if you know you're going to be working with a large array size right from the get go to avoid the memory copies.

But otherwise - I enjoyed that. I think I may just start following his blog to refresh my knowledge with other data structures!

<comment><USER8> Underlining the fact that NSMutableArray may ignore your capacity hint is also important, though. Many people make false assumptions about how NSMutableArray manages memory.

<comment><USER9> The Cocoa documentation does not seem to suggest that the numItems parameter of the initWithCapacity message is in any way optionally handled by the runtime. It repeatedly states that the array _will_ be initialised "with enough memory to hold numItems objects" in no uncertain language. It does not imply in any way that it is merely a hint. If the implementation behaves differently, that's either a problem with the documentation or the implementation, not with people's assumptions.

<comment><USER8> Interesting! You're right that it says that now. Thanks for the correction.

I'm nearly positive that the wording used to be much more vague on that point, as I remember thinking in my early days that it was so fuzzy as to be nearly pointless to go out of your way to give an accurate capacity. Mike is an old- time Cocoa guy, so if my memory is serving me well, he was probably thinking of the same old wording.

<comment><USER6> I too thought it was fuzzy. In fact, I'm still reasonably sure that the implementation still doesn't actually guarantee it reserves that space, despite how the documentation is now worded, although I am not an authority on this subject. It might be interesting to check out the CFArray implementation on opensource.apple.com and see what that does (although CFMutableArray treats capacity a bit differently than NSMutableArray to begin with).

</comment></comment></comment></comment></comment><comment><USER10> Nice one Mike! My one improvement would be using realloc in the out-of-space case vs. malloc+memcpy+free.

<http://www.cplusplus.com/reference/cstdlib/realloc/>

<comment><USER11> Although I had the same initial reaction, in the comments he explains he willfully used malloc/memcpy/free to demonstrate the underlying behavior.

<comment><USER12> Right. The reallocation behavior is so fundamental to the implementation of NSMutableArray that there seemed no point in calling realloc directly. If I did that, might as well just use NSMutableArray instead of writing my own, and then there wouldn't be anything to write about.

</comment></comment></comment><comment><USER13> Brings me back to my Data Structures class. Funny how often we use these features yet take for granted the underlying implementation. Classic first year CS student classwork (although we did Java not ObjC).</comment>


Scott Rafer: Couldery Shouldery - Lookery Postmortem  - <AUTHOR> http://rafer.tumblr.com/post/168541483/lookeryupdate

<comment><USER2> I saw Scott Rafer talk a few times around the height of Bubble 2.0, and was impressed with what he describes as "low-cap" - a real focus on keeping costs down and growing revenue from day 1. Another sad story.

</comment><comment><USER3> I was an investor in Lookery.

Some interesting lessons from that story. I'm glad Scott decided to share some of the details. Too many startups simply fade away and don't pass any of their insights with other entrepreneurs. We need more stories from startups that didn't work out.</comment>


The gimp.org domain has expired - <AUTHOR> http://www.gimp.org/ <comment><USER3> [https://www.icann.org/resources/pages/expired-2013-05-03-en](https://www.icann.org/resources/pages/expired-2013-05-03-en)

Domains have a renewal grace period. Since it expired recently, they'll be fine.

</comment><comment><USER4> Can the headline be changed to reflect the fact that it expired and wasn't "poached"?

<comment><USER5> Seconded, since the registrar has to provide a grace period, but can still redirect the expired domain to any place they like.

<comment><USER6> Edit: Not any place you want actually...

Per ICANN if domain is made innactive the page that it points to if it points to a page (it doesn't have to you can just put the name on hold) needs to describe how to get the domain back. Once again that's only if a page is displayed displaying a page is not required.

[https://www.icann.org/resources/pages/errp-2013-02-28-en](https://www.icann.org/resources/pages/errp-2013-02-28-en)

"2.2.4. In interrupting the DNS resolution path of the registration, if the registrar directs web traffic to the domain name to a web page while the registration is still renewable by the RAE, that web page must conspicuously indicate that the domain name registration is expired and provide renewal instructions."

<comment><USER5> And how often is this enforced? Does the registrar actually face anything punitive for doing what's been done here?

<comment><USER6> Good question. ICANN does audits where they cherry pick some domains and say "show me what the fuck happened in logs and prove you did the right things". However the audits are every 3 years or so and the domains are just random pickings. So it's up to a registrant that is wronged to file a complaint and then ICANN says something to the registrar and the registrar says something back and they close the case kind of like a residential noise complaint where the cops come out when called. There really aren't any minor punitive actions per se other than revoking accreditation which is major. And you would be correct in assuming that would be rare and ICANN first gives every chance for a registrar to correct the wrong doing. So you could in theory get away for this for years and if and when caught you would just get your act together and fix things up.

Note: I have been dealing with ICANN since the start and they tend to be pretty cool and fair with registrars but they do take complaints seriously and do follow up on them. Creates a ton and a pain of paperwork for registrars so that really is the negative to not complying in a way.

</comment></comment></comment></comment></comment><comment><USER7> This is exactly why we created a domain name/ssl reminder tool: [http://www.expirify.com](http://www.expirify.com). A really easy mistake to make and very costly, I hope they get it back

<comment><USER8> How is this necessary if there is a grace period after a domain expires?

<comment><USER9> You can't use your domain in grace period until you pay. It gets redirected.

<comment><USER10> With ICANN registrars, that is true.

DENIC, for example, (which operates seperately and has their own, incompatible WHOIS system), operates .de differently:

After your domain ran out, it will get "locked", all DNS settings will be locked they were before, and you get a letter or an SMS. The domain will stay locked for 2 weeks, during that you can enter the code from the SMS or letter on a website to move the domain to another registrar or delete the domain.

If you don't react at all, after 2 weeks, the domain goes into TRANSIT. It still stays locked, but now you get actually billed for it, until you enter the code or delete the domain.

Essentially, with DENIC, the domain stays locked until you decide to delete it or move it to another registrar.

You can also disable the TRANSIT, in that case, if the domain runs out, after 2 weeks grace period of being locked it actually runs out.

Remember: Not all NICs operate like ICANN.

</comment></comment></comment></comment><comment><USER11> Not poached, but definitely now in the 30-day grace period[1].

[1] [https://www.dotster.com/domains/faq.bml](https://www.dotster.com/domains/faq.bml)

</comment><comment><USER12> We should stop using the domain name system to name web pages and email addresses. It is too vulnerable to legal attacks, extralegal attacks, and simple human error.

There are a bunch of decentralized possibilities out there: IPFS, Tahoe-LAFS, MaidSafe, and so on. None of them are ready yet, except (for some purposes) FreeNet and Tor Onion Services, and it's going to be a lot of work to get them to work, and probably some of them are simply unworkable. But this is a really, really important problem to solve, and it's solvable.

<comment><USER13> Excellent plan.

Now we only need to worry about the small matters designing an alternative system that acheives what the domain name system does without those draw- backs, and convincing people to use the new system...

<comment><USER14> There is one, and its called search. People are getting used to ask the search engine on their phones and tablets for finding websites, so the big engineer problem is remaking the service into private instances which isn't controlled by google or apple.

<comment><USER15> How would hyperlinks work in this model? If I have a hyperlink "This is an awesome program" that links to gimp.org, how is search going to help if gimp.org goes away?

<comment><USER12> The hyperlink URL text could contain a secure hash of the gimp.org home page. Or a revision number and the hash of a public key used to sign gimp.org home page revisions. Or of a document containing three public keys, the majority of which need to sign a home page revision for it to be considered a valid value for the link. Or, as in onion services, the hash of the public key of the server hosting the document, along with a document path to send to that server when you manage to reach them. Or a name unique within a certain namespace, and a public key used to sign new versions of the document listing the name- hash mappings for the latest version of the namespace. And maybe a list of IPv4:port pairs to contact to ask for the document. Or the name of a decentralized pub-sub channel where versions of the page are periodically announced — maybe the Bitcoin blockchain. There are lots of possibilities.

<comment><USER15> "The hyperlink URL text could contain a secure hash of the gimp.org home page. Or a revision number and the hash of a public key used to sign gimp.org home page revisions."

That would help to make sure you got the right page, but wouldn't help you _find_ it.

Your other suggestions (e.g. a list of IP addresses/ports) are basically just reimplementing DNS, but with more complexity. :-)

<comment><USER12> With more or less complexity (although that statement makes me suspect you've never administered BIND) — but with different failure characteristics! And hopefully better ones.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Updated Date: 2015-08-06T08:16:07Z

Name Server:NS1.DOTSTER-EXPIRED.DOMAINPARKINGSERVER.NET Name Server:NS2.DOTSTER-EXPIRED.DOMAINPARKINGSERVER.NET

</comment><comment><USER17> Gimp.org domain: Created 1997-08-04 Expires 2015-08-03. So expired 3 days ago.

<comment><USER5> If it expired three days ago, isn't there a 30 day window whithin which they can still renew?

<comment> at-fates-hands Yeah, it gets put on hold for 45 days at which time it can be renewed. If it isn't renewed with that 45 day window, then it gets listed as "expired" and the owner still has another 30 days to renew it.

Once it goes beyond these two phases, it enters into the "pending delete" phase at the end of which, it's released and open to get hijacked by someone else.

They still have plenty of time to renew it without issue.

</comment></comment></comment><comment><USER18> Looks more like someone forgot to pay the domain fee

<comment><USER19> Poaching is registering a recently expired domain, usually so that you can (effectively) extort the original owner to buy it back from you.

</comment></comment><comment><USER20> When I go there now, I see the same site that's been there for a while: [https://web.archive.org/web/*/gimp.org](https://web.archive.org/web/*/gimp.org)

So maybe it was returned to its owner?

<comment><USER21> Or maybe you are using the old IP from your DNS cache?

<comment><USER22> I don't understand registrars that don't alert you to the fact that it is going to expire. I have that registrar that everyone loves to hate and they are damn good at reminding me when to renew and not annoying me in between such times.

(as in, I have godaddy)

<comment><USER13> I'm pretty sure _every_ registrar does this. It is in their interest: they remind you to pay so they get your money instead of some other registra getting a poacher's money.

A key problem is people not seeing the reminders. Perhaps they get lost in a sea of spam. Perhaps they get accidently calssifed as spem themselves. Perhaps the contact information for the domain isn't kept up-to-date and the reminders end up in an email account that is no longer monitored.

</comment></comment></comment></comment><comment><USER23> They're probably just moving to Sourceforge.

</comment><comment><USER24> It looks fine to me? What are you talking about?

<comment><USER25> I get the correct gimp.org site too. whois seems to indicate Shawn Amundson as the owner, which sounds about right.

I wonder if we're part way through DNS propogation

</comment></comment><comment><USER26> Note to self: check gimp.org on September 3rd to see if it was renewed or not.

In all seriousness I'm pretty surprised they would let it lapse. Hopefully they pick it up within the grace period. It would suck for a bad actor to get ahold of it and offer up the gimp for download with, say, malware in it.

<comment><USER27> Well, Shawn has already renewed gimp.org.

This wasn't really surprising to me* - some months ago, when we discovered that gimpguru.org (no one from GIMP is connected to that site, btw) had expired and taken over by a third-party, we checked and discovered that gimp.org expires on 2015-08-03.

Personally, I firmly believe that useful change only happens when survivable incidents happen, so my only concern was whether gimp.org would be lost immediately it wasn't renewed before that date. But when someone pointed out the grace period, I thought "well, either it is renewed in time, or we will have discussions similar to those that happen right now, might be a good wakeup call" _.

_ * but yes, of course I was surprised when I couldn't connect to www.gimp.org anymore, in particular because I had some updates planned for the downloads pages, because I had simply forgotten about it. Dismissing it as a non-issue until something actually happens tneds to cuase this, apparently.

</comment></comment><comment><USER28> I get "Domain not active" so what people get may vary depending on their location.

</comment><comment><USER29> They should have at least had a monitoring service like [https://www.dotcom- monitor.com](https://www.dotcom-monitor.com) monitoring their site so they knew about the issue right away.

</comment><comment><USER30> URL poaching is messed up.

don't be a jerk.

<comment><USER31> As others have said, I don't think it was poached, more likely it's in the 30 day grace period for a missed renewal. Hopefully they'll get it sorted soon.

And yes, domain poaching is very douche-y, and is basically extortion.

</comment></comment><comment><USER32> Question: Alternative download links for Mac and Windows? (No Sourcforge)

<comment><USER33> Looks like Fosshub has it: [http://www.fosshub.com/GIMP.html](http://www.fosshub.com/GIMP.html)

(to anyone who knows this: it looks to me like fosshub wants to be the anti- sourceforge, the new home for binary opensource downloads, and that they're non-evil. is this true?)

<comment><USER31> It seems legitimate, and I agree with their stance (if not their tone) in the "Controversy" section of their FAQ.

I'd love to see them put out a tool similar to Ninite, though I don't know if they have the resources to allocate for that.

<comment><USER34> Thank you for the confidence! We can assure you that our intentions are "good". As for the Ninite suggestion, unfortunately (since FossHub is NOT after the money) we don't have the financial resources to add such a tool. Maybe later. Thanks again!

<comment><USER33> May I ask why you're running the site anonymously?

<comment><USER34> Sure! We run the site anonymously for the same reason as others - <USER2> phishing attempts away, minimize spam, increase the security by eliminating social hacking attempts and a few other reasons that are well-known by law enforcement agencies. We did tried to run without the "privacy" option enabled and we were forced to activate it. We acknowledge that this might raise some questions but as long as we deliver a trustworthy service this shouldn't matter too much for our users.

</comment></comment></comment></comment></comment></comment><comment><USER35> still says domain not active for me. I tried doing a control refresh but still no.

</comment><comment><USER36> BTW, it is back up.

</comment><comment><USER37> Great ! Now the GIMP team will use this opportunity to create their own version of a "domain". I will look & work mostly like all other domains, but just mostly. Like you will not be allowed to directy save a change to its structure...</comment>


Bitcoin vs. Wall Street: A Love-Hate Story - <AUTHOR> http://techcrunch.com/2015/04/20/bitcoin-vs-wall-street-a-love-hate-story

<comment><USER2> Yeah the 2015 will be the year when those $500MM of venture capital invested into Bitcoin would come to fruition with mainstream-friendly secure wallets, killer social apps (like Bitcoin Tipping Economy, BitExperts.com, etc)

Here is today's news where XAPO's CEO estimates that about 12 million people use Bitcoin today [https://twitter.com/allexkonov/status/590257211789611009/pho...](https://twitter.com/allexkonov/status/590257211789611009/photo/1)

Another data point - at the beginning of 2013, Blockchain.info only had 70,000 wallets, after 9 months they had reached 1,000,000 wallets

It all looks like 2015 will be the year of Bitcoin again, like it was in 2013</comment>


34 digits, the most precise standalone hand-held calculator on earth - <AUTHOR> https://www.swissmicros.com/?intro=prototype_dm42 <comment><USER2> does this mean the code will be open source and we can hack it around. i like the idea of adding my own functions to the ROM.

<comment><AUTHOR> yes, we're planning to release some sort of an SDK for it

<comment><USER2> That would certainly be excellent and well received. thanks.</comment></comment></comment>


Ask HN: CodeMentor for digital marketing? - <AUTHOR> I recently had my first session on CodeMentor and got some good feedback on design/UI/UX of our web app.
I am also looking for some guidance/feedback on our digital marketing strategy and was wondering if there is something similar in that space. <comment><USER2> You can try: [https://www.getcredo.com/](https://www.getcredo.com/)</comment>


IQ Test Puzzle - <AUTHOR> http://www.robmathiowetz.com/

<comment><USER3> Wolf, corn, chicken, boat, farmer... usual shenanigans. The usual solution is to drown the wolf, eat the chicken, and get a damned bag for the corn. In this scenario, the correct solution is divorce and a viable criminal justice system that doesn't require prisoners to be kept in boats with families.

<comment><USER4> Best solution ever.

</comment></comment><comment><USER5> I'm confused. If it's a Japanese IQ test, why is the swf intro written in traditional Chinese?

EDIT: A less lazy comment--SmallCampus.net that the game links to is a Hong Kong website, which has a collection of puzzles. I still can't find a reference to this being a Japanese job test though.

EDIT2: And, here's the real source. [http://www.smallcampus.net/htmlcontent.php?channel=maths_gam...](http://www.smallcampus.net/htmlcontent.php?channel=maths_games&show_date=2001-05-03) It's a brain teaser for elementary school children.

<comment><USER6> Perhaps simply because the article's author doesn't know or can't tell the difference and just therefore assumed it to be Japanese. There's also a link in the game to smallcampus.net, which appears to be based in Hong Kong.

EDIT: Just saw your edit. Ignore my repetition!

</comment></comment><comment><USER7> The link to the flash game didn't work for me so playing it in my head and not succeeding irked me enough to look at the solution video. I wrote it up, a spoiler follows.

When there is a free shore or one person on a shore the cop can serve as an agent of motion as he's only inhibited by the crim, who can be put in that free space. A free cop will let you deal with one of the kids in the problem, the parent can then deal with the remaining kid themselves or the cop can. A mother/father boat shuttle on either side of a cop/crim transport shifts the criminal problem over and allows the cop's magic to be used again, but from the opposite shore.

The cop ferries criminal over to opposite side. He then returns and ferries a boy over and bringing the criminal back. This exploits cop/crim rule by putting the crim alone on a bank and thus "freeing" up the cop's capacity as a coxswain to get the boy over.

Father goes over with next boy. Both boys on the other shore now, but nobody else is there so the father is thus freed up.

They use this freedom to get the boat back by the father returning, and then the mother ferrying him back, and returning with the boat alone.

The cop goes over with the criminal, both stay.

The father returns the boat, goes back with the mother and she comes back alone. This is the same as the previous mother/father move, but it's enabled the cop and crim to come over.

The mother then takes a girl over and stays there with her. Exploiting the fact that there is only one girl left on the original shore and thus she is alone and no rules are violated.

The cop and the criminal come back.

The cop takes the remaining girl over, leaving the criminal alone.

The cop fetches the criminal in a final move.

Like many word problems it is beset with confusions via hidden assumptions. The assumption that children can't be trusted with their parents and a cop is to be trusted with children more than the parents is weird. Unsupervised children are apparently safer than with their parents too. The assumption that the criminal is dangerous to unprotected family members, through theft or violence, but won't run away when left alone clouds the solution as you intuitively don't want to leave the criminal alone even though the rule is stated only in relation to family members.

</comment><comment><USER8> I recommend family counseling. Both Mom and Dad should be able to spend time with their children without supervision from each other...

<comment><USER9> Not to mention the knock-out punches if you make a wrong move.

<comment><USER9> ok.

<comment><USER9> Well, then.

</comment></comment></comment></comment><comment><USER10> No. I have had numerous interviews in Japan and never had a kind of test like this. Maybe be one company has used this, but it is far from the norm and as the z2 mentions, the intro is Chinese.

</comment><comment><USER11> I think there may be several solutions to this, one is:

P+T > P > P+S > P+T > F+S > F > F+M > M > P+T > F > F+M > M > M+D > P+T > P+D > P > P+T

Where P=policeman T=thief S=son F=father M=mother D=daughter.

It helped me to approach this as some kind of machine, or a universe with weird physics - from there you can establish some basic operations which are then easy to combine into the whole solution.

</comment><comment><USER12> Blogspam for something the author plainly didn't investigate thoroughly enough. (It's not really a job application test, it's not at all an "IQ test," and it's not from Japan.) I'm glad other comments here are looking at whether the blog post is even accurate (it is not) and not reflexively responding to headline terms like "IQ test" and "Japan," which often generate knee-jerk responses in online discussion. Hacker News deserves better submissions than this.

<comment><USER11> I think everybody here already arrived at that conclusion but then they got interested in the actual puzzle.

</comment></comment><comment><USER13> The only solution I found involved leaving the thief alone several times - <USER2> that not worse than leaving the thief with a family whose parents are apparently dangerous?

</comment><comment><USER14> _Pruning the search tree_ , E.W. Dijkstra:

[http://www.cs.utexas.edu/users/EWD/transcriptions/EWD12xx/EW...](http://www.cs.utexas.edu/users/EWD/transcriptions/EWD12xx/EWD1255.html)

</comment><comment><USER15> One of the daughters has to bring the boat back, then the father and son cross the river, sell the boat, then they use the proceeds to start a company selling IQ testing services to lazy HR departments. Did I get the job?

</comment><comment><USER16> > The Father cannot stay with any of the daughters, without their Mother's > presence.

> The Mother cannot stay with any of the sons, without their Father's presence

This is a bit disturbing.

</comment><comment><USER17> My prolog sense is tingling!

</comment><comment><USER18> this is unsolvable. the 2 sets of children that can't travel with the adults and the police criminal pair that must be together make too many dependencies. is this a joke?

<comment><USER11> The criminal people don't need to stay together, the thief can stay behind as long as she is alone. You can hence use the policeman to ferry a son/daughter. The next challenge is if you go from there and ferry one side of the family across, eventually the boat will be on the wrong side - so you need to make a little tedious shuttling/shuffling session to make sure the policeman/thief duo actually waits on the opposite side. From there, it's pretty straight forward again.

I'd say those are the only two critical sections, the rest should follow automatically.

<comment><USER18> oh I see. it seems obvious now. odd. Thanks

</comment></comment></comment><comment><USER19> I hope the description is better in Japanese: there's a difference between 'stay' and 'be'.</comment>


New .BOT GTLD from Amazon - <AUTHOR> https://aws.amazon.com/blogs/aws/new-bot-gtld-from-amazon/ <comment><USER2> This is really cool, I just hope that they don't wait too long to open the domain to those of us who use an unconventional or custom toolset for our bots.

</comment><comment> core-questions Oh man, `russian.bot` is available, but I'd have to already have a bot set up to register it. Damn.

<comment><AUTHOR> It's easy to set one up using Lex, but it's $750 for this domain ($75 otherwise).</comment></comment>


Ask HN: How would you build a prototype in 2020? - <AUTHOR> I have a few ideas, and I want to build a few working prototypes. I've been looking around, and trying to figure out how to get there fastest.<p>What technologies would you use to slap together a working prototype? <comment><USER2> Consider create-react-app and Prisma for a basic CRUD application. If you need advanced or enterprise-y features, you will outgrow Prisma quickly.

If you have used VTL before and are comfortable with it, AWS AppSync is also worth a look. Particularly if you can make use of AWS' auth solution.

Those will get you to something basic fast.

</comment><comment><USER3> is it a hardware of a software prototype?

<comment><AUTHOR> Software primarily, but I am interested in an answer for both</comment></comment>


170m passwords stolen in Zynga hack, monitor says - <AUTHOR> https://www.theguardian.com/games/2019/dec/19/170m-passwords-stolen-in-zynga-words-with-friends-hack-monitor-says <comment><AUTHOR> "The dump also included some Facebook IDs and phone numbers for users who had provided that information to the company."

Why on earth would you provide a phone number to Zynga?

<comment><USER2> Words with Friends was a popular cellphone game during the time when phone permissions were still fairly generous, so the phone numbers were harvested from there</comment></comment>


No team gets rich without trust because "no man is an island" - <AUTHOR> https://sketchboard.io/blog/why-your-process-may-be-harming-your-team-and-customers <comment><USER2> Trust isn't just the flavor of the month. It's the only tried and tested currency of the future. How does your company cultivate it?

<comment><USER3> There is an old related quote: "The Main Thing Is Honesty. If You Can Fake That, You've Got It Made"</comment></comment>


Ask HN: Quit my job for a year to write open source code, what should I work on? - <AUTHOR> I've saved up some money and am interested in doing something different for a bit. If I quit my job to work on some open source projects (probably mostly existing, but open to new projects too) what should they be? <comment><USER2> Would you be interested in making more people contribute to open source code?

Gittip lets people give money to their favorite open source contributors.

[https://github.com/gittip/www.gittip.com](https://github.com/gittip/www.gittip.com)

CodeDoor is a way for programmers to leverage their open source contributions to freelance work. (Note: I'm the founder of CodeDoor)

[https://github.com/CodeDoor/codedoor](https://github.com/CodeDoor/codedoor)

</comment><comment><USER3> I would like to sort of copy Weebly but make the core and all or most of the components totally open source and have a strong index/rating system for sharing and loading components etc. I would write it in ToffeeScript([https://github.com/jiangmiao/toffee- script](https://github.com/jiangmiao/toffee-script)) using Node.js.

I would also like to make something sort of like a web browser, except its based on a distributed hash table or something so that it is totally data- oriented rather than server-oriented, and instead of HTML and CSS its markdown (with embedded SVG) and optionally RDF (using N3) and optionally a sandboxed Go application that is compiled on the fly. Also the applications aren't restricted to a browser window but have a security system and access similar to that available on mobile.

Or a mesh of user-defined 3d worlds built on WebRTC and WebGL with portals and multidimensional overlays.

</comment><comment><USER4> Open-source social networking/personal data storage with Tent: [https://tent.io/](https://tent.io/)

You can build any type of app you want on top of Tent.

See the hosting provider Cupcake.io to get a working Tent account: [https://cupcake.io](https://cupcake.io) (say ^bnb.cupcake.is sent you!)

<comment><USER5> This is what I was looking for, data producers control their own data and manage the app providers to use the data..

</comment></comment><comment><USER6> I think you should work on Factor: [http://factorcode.org/](http://factorcode.org/) It's a new and very different programming language that takes about a month of study to learn. After that it will totally blow your mind showing you new and better ways to write software. So embrace Factor and spread the message! :)

<comment><USER7> Does anyone actually like postfix notation?

</comment></comment><comment><USER8> I just saw a post on here about TextBlob - a python natural language processing library. It occurs to me that we need an open source alternative to Google's language processing (as seen on Android and in Google Now). We already have good speech recognition... If I had the chance I'd do that, maybe it'd interest you.

</comment><comment><USER9> Blender: [http://www.blender.org/](http://www.blender.org/)

Just because it seems like a cool project in need of more help. It really does depend on your interests, of course.

<comment><USER10> If you're going to do Blender stuff, my vote would be to focus on interoperability with other applications. In particular, Blender needs a working Alembic import/export function, IMO.

</comment></comment><comment><USER11> Play Framework. A very promising framework on the JVM which could supplant Rails/Django at some point with far better performance and robust enterprise features.

</comment><comment><USER12> Ol' Dirty Bashnerds are looking for some help: [https://github.com/odb](https://github.com/odb)

</comment><comment><USER5> Self hosting real time "Commenting" web application with text mining/taming functionality. (A replacement for Disque)

</comment><comment><USER13> You should help out on Skyline! github.com/etsy/skyline It's a real time anomaly detection system.

</comment><comment><USER14> That depends. Why are you going to work on open-source code. Do you have a way of getting paid to do this?

</comment><comment><USER15> I would recommend Linux / Ubuntu / OpenOffice / LibreOffice. :)

</comment><comment><USER16> OpenWhisperSystems is pretty topical with all the NSA stuff going around

</comment><comment><USER17> Would you like to work on The Web Platform?

</comment><comment><USER18> Whatever you want! :)

</comment><comment><USER19> What are you good at?

</comment><comment><USER20> Bitcoin. That is all.</comment>


Could really use your opinion - <AUTHOR>

My sister and I are launching our MacBook rental service, Livyy, in Atlanta, GA this November.
We're currently in the process of some lovely, from-scratch market research and would really enjoy hearing your thoughts.
Doesn't matter where you're from. Livyy will reside in ATL, however, we'll ship MacBooks across the US to customers.
We've set up a Typeform at: https://livyy.typeform.com/to/SPJpeJ
If you have just two minutes to spare, check it out and give us your feedback. As incentives make the world go 'round :), we are choosing one person to try out our service for free, just for chatting with us for a bit.
Thanks guys. <comment><USER2> I am in the UK so probably not your target market, sounds like a good idea, I assuem there is a market for people who may temporarily need a macbook for testing or something. Who do you see as your market? Also whats ort of costs are you looking at? I cant imagine most people only needing a macbook for a week, and renting one out for 3 or 4 months must get you close to purchase price or a second hand model. Does it come with support for people who have not used a mac before? Do you see it as a try before you buy? How do you ensure secuirty of data, i assume you advise customers to undertake a hard reset before returning the product to you?

<comment><AUTHOR> celticninja,

Thanks a bunch for the feedback.

We consider business professionals, freelancers and college students our target market.

However, Livyy is very much a convenience based business. Essentially, anyone could find themselves utilizing our service depending on their situation.

As for costs, inventory (MacBooks) and software would represent the bulk of our initial expenses. Followed by a POS system and furnishings for the space. Operating costs would be minimal including the lease amount of our space, insurance, any subscription-based software and marketing.

There is the possibility of offering support via an Apple expert, it isn't concrete just yet.

As opposed to making it the responsibility of the customer, we will perform a reset upon the return of each MacBook.

</comment></comment><comment><USER3> I can't imagine renting a computer that I'm going to be working on myself. I just wouldn't trust that it hadn't been tampered with or is recording my keystrokes, etc. I have multiple computers, so if I had to send one in for repair, I wouldn't really need a rental. I do work for a company that does electronic testing and we often rent computers for testing events. (Cisco Live, TechED, etc...) Our software only runs on Windows, so we don't need macs, however they do have those available as well. I could see people renting them in quantity for events, training, etc.. but I don't see where someone would rent one for personal use. Good luck with your venture. I tried your survey, but it kept getting stuck. The progress bar was all over the place too.

</comment><comment><USER4> Why would I rent a Macbook? Or who is the target market?

What makes renting a Macbook more attractive than renting a Windows, Linux, or Android device?

What kind of rates need to be charged to cover the downtime involved in shipping a Macbook across the US, the cost of the shipping, and the difficulties if it is not returned in working order?

How can a business shipping MacBooks from ATL compete in Los Angeles with a business located at LAX?

How many renters of MacBooks are currently in ATL today?

What problem does this solve and who has it?

<comment><AUTHOR> Hi brudgers,

Livyy was predominantly conceptualized for business professionals, freelancers and students. However, as stated before, we are a convenience based business and anyone could find themselves utilizing our service depending on their situation.

Apple offers a well-known, simple product line-up. More than half of our survey participants stated they own a MacBook. Out of the ones who don't, 46% said they found themselves in need of one during this year. The best part? 87% voted they would have rented one during those times.

Shipping to LA would be around $36. The issue of a MacBook not being returned in working order would be handled at that time and is a procedure thoroughly spelled out in our Rental Agreement.

It all depends. Until Livyy has a physical presence in LA, we may not be able to. However, for a person looking to rent sans credit check and a hefty deposit, we would be the 2,100-mile-away better option for them.

This is a fairly fresh concept. None of our survey participants have rented a MacBook before. However, there are thousands of business professionals, freelancers and students in Atlanta that could be presented with the need to rent one. All we have to do is be available to them.

Again, no other company offers access to a MacBook (or any other laptop computer) as fast and simply as Livyy would. If such a service exists in your area, the process is most likely lengthy and costly. Anyone with a MacBook can experience the problem of being without it.

<comment><USER4> Good luck.

</comment></comment></comment><comment><USER5> I think this is a very interesting service because I usually buy laptops, but I only actually use it as a laptop 10 days a year while traveling. If the cost on the order of $10-20/day I would consider buying an iMac, and renting the laptop for conferences.

No mention of what software will be included. I consider MS Office to be mandatory, but that is probably it for a short term loan.

About the survey:

"Go Again"? Do I get entered multiple times if I fill out the survey again?

I am also not sure I agree that more cats is better.

<comment><AUTHOR> chrisBob,

The convenience of renting for business needs is one of the many reasons why we wanted to start Livyy. We think it would be great for people like you.

The idea (or hope) for the Go Again button was for people to share the survey with someone near them. However, we've found a better solution for this. Thanks! Only one entry will count. :)

We aren't secret cat worshipers, we just liked cats over stars or thumbs. Too mainstream, you know?

</comment></comment><comment><USER6> HNer's are probably not the target demographic for MacBook rentals, mostly folks who can either afford to buy or get a loaner in a pinch.

As a rental business benchmark--here's a good podcast interview by Scott Britton with Noah Lehmann, who started an exotic car rental operation> [http://life-longlearner.com/noah-lehmann-haupt-interview/](http://life- longlearner.com/noah-lehmann-haupt-interview/)

<comment><AUTHOR> We believe a service like Livyy could still be of value to the type of people you speak of. :)

Can't thank you enough for that interview. Really great insight.

</comment></comment><comment><USER7> I tried to fill out the survey, but I left blank my frequent programs and my email address. Consequently I can't submit the rest of my answers. It may be beneficial to not require all answers for feedback to be submitted.

Also questions 1-3 make the progress meter jump all over. 50% after the first question, eventually down to 25% at question 4 where it steadily goes up and appears to work correctly.

</comment><comment><USER8> Interesting idea but what is the purpose of having a laptop for one hour? if I know I need a laptop I will bring mine that's the point of a laptop. If I don't have a laptop I probably don't need one. Also probably you don't have most of the software I might need. I could see a use for long time rental but the overall price should not exceeed the price of a new one every couple of years.

<comment><USER5> The only way I could see an hourly service working is at a coffee shop, library, or airport. Airport service would be almost perfect if I just wanted to pick one up for a 1-2 day trip.

<comment><USER9> Agree. I would potentially rent a laptop at an airport.

</comment></comment></comment><comment><USER10> Your lowest price was $5 per hour, so that's what I selected on the survey, but frankly I was thinking this would be for weekly or monthly rental. I wouldn't pay per hour at all. Good luck with your service, but I don't think I'm your target.</comment>


The Master Opt-Out List [pdf] - <AUTHOR> https://a.pomf.cat/cndxuk.pdf <comment><AUTHOR> More interesting stuff is here (but the PDF was worth posting by itself):

[https://paranoidsbible.tumblr.com/cybersec](https://paranoidsbible.tumblr.com/cybersec)</comment>


Ask HN: When the hosting company is Sorry for the inconvenience - <AUTHOR>

When the sites are down for more than 1 hour and the hosting support has nothing but to say "Sorry for the inconvenience but we are looking into it"<p>I've encountered this problem over and over again. Currently facing the problem with ServInt. Is there any thing we can do about this? <comment><USER2> If you don't have an SLA, probably the best you can do is ask for your time to be pro-rated. So each hour of downtime should be refunded 1/720 of your monthly cost. So the real answer is: don't depend on one host. At least keep a second host as a backup for when the first one fails.</comment>


Ask HN: Any Good code review or security testing services? - <AUTHOR> Looking for any recommendations for a service (or consultant recommendation) that allows submitting code for review or security (hacker/vulnerability) testing?
The code could be a basic function, or part of a more complete product. Ideally more at the snippet/small library level to reduce review complexity. Less of a bug bounty program, more of a direct review service.
I have a current need related to js/node.js, rust, and various html/http best practices (content security policies, etc). <comment><USER2> If you're just looking at a basic function, and are ok with your code being public, consider [https://codereview.stackexchange.com/](https://codereview.stackexchange.com/) or the code review subreddits.

If you're looking for more professional code review from experienced devs check us out at [https://www.pullrequest.com](https://www.pullrequest.com). PullRequest does code review as a service for every popular language, definitely the ones you listed.</comment>