What's new in Unity 4.3 - <AUTHOR> http://unity3d.com/unity/whats-new <comment><USER2> Unity really desperately needs a Mono upgrade, as their version is years old. Unfortunately it seems to be a licensing issue with Xamarin, because of LGPL constraints on mobile platforms.

It's quite frustrating to work with C# without all the features of the last few versions, particularly if you want to use third party libraries.

<comment><USER3> I mostly program C# inside of Unity. What are some of the newer C# language features that it's missing that you think are pretty cool?

I have my game server as a C# MVC app as well (latest .NET running on Windows, not Mono/Linux) and the only things new that I seem to be using are the async and await keywords. But you don't need them inside of Unity since they have Coroutines and yield.

<comment><USER4> I can't speak directly to the differences with Unity, but comparing C# from .NET 2.0 to the latest you're missing: LINQ, dynamic data types, extension methods, optional and named method parameters, covariance and contravariance, async and await... and a whole bunch I'm probably forgetting. It's a lot more flexible now and lets you take advantage of dynamic/functional code. After coding in 4/4.5 for awhile, I certainly wouldn't want to go back to a 2.0 ecosystem.

<comment><USER3> Extension methods work (I use those all the time), and async and await are unnecessary because Unity gives you coroutines and yield.

The rest of that stuff seems cool though. Oh well =\

</comment></comment></comment></comment><comment><USER5> As someone who made games throughout my childhood, I'm looking forward to trying out the new built-in 2D functionality with my 9 year old. We've used Scratch, RPG Maker and a few other things but it would be nice to use a framework that has such wide publishing capabilities so he can show his friends his creations more easily. I didn't think he was ready to tackle 3D game creation so we haven't tried Unity yet but I was really waiting for 4.3 to come out - thanks for the heads up!

<comment><USER6> Unity seems a bit tricky for a 9 year old even with this update, you might want to check out something a bit simpler like Construct 2 to start with. Just an idea

<comment><USER5> Checked it out - looks awesome and will be downloading the free version to try it out first. Anyone else have other suggestions?

<comment><USER7> I prefer Gamemaker Studio ([http://yoyogames.com/](http://yoyogames.com/)) it's more code oriented but very easy to use. There's a free version too. Look up Hotline Miami if you want to see a commercial game made with it.

</comment></comment></comment></comment><comment><USER8> I'd be more happy if Unity goes toward being more programmer-friendly. Fully code-only projects support, no need to waste a lot of time tinkering in that complex UI, etc...

<comment><USER9> Source: me. I don't work for Unity. Software engineer and use Unity for a lot of 'traditional development'.

You'd be surprised... there isn't a ton of documentation about it, but most of the engine is pretty well exposed for programmers.

You can punch into the rendering pipeline (down to immediate OpenGL mode if you need to), the compilation pipeline (recompiling on the fly or setting up a custom preprocessor), hook into the assemblies (for, say, an interactive interpreter run in the game), and hook into native binaries in unmanaged code. Naturally you can use any language that can compile into IL, so, you don't even have to use C# or Boo if you don't like it (though you'll want to take a look at Boo... UnityScript interpreter was written in it for a reason! yay, LISP MACROS with dynamic recompilation and loading!)

The editor will, in turn, handle a lot of things for you that are a waste of time to do normally, like visualizing things without having the game running (tweak a shader on the fly), handle all of the recompiling for you in the background, dyanmically load and unload resource files, let you easily browse the scene graph, let you write custom editors (for example, I wrote a converter to convert files of different types so that it happens when those files are added to your resources, instead of converting them on the fly at run-time or with some external half-assed console script), etc. Naturally, you can use your own editor if you're more comfortable (for example, I use Emacs and git and the mono profiler and debugger, rather than Unity and Unity Source Server and Monodevelop, and it works just fine, and I don't spend much time at all in the actual Unity Editor)

And the library itself has all kinds of things that you'd expect to make your life easy: screen graph manipulation, transforms and other 3D math, physics basics like raycasts and bounding box intersections, input handling, camera manipulations, sound and audio handling, event handlers and hooks on all kinds of stuff, color management, network handling and resource streaming, etc.

The tool also comes with a number of pre-written scripts (plus store, of course) to help you out with things you really should never have to re-invent and that a programmer probably doesn't even want to be bothered with, like a first-person or third person controller (complete with physics, camera work, input control and movement, etc.). Or you could go to the Store and pick up, say, a Mini-Map tool for $30 and have it working in about 5 minutes, which, to me, is very programmer friendly (who wants to spend their time reinventing a mini-map?!).

On top of that, your game will be almost entirely cross-platform automatically across a wide array of devices, AND will have native code for those devices for performance-heavy sections. You don't have to waste much time tracking down errors on all kinds of different platforms, which is also very programmer-friendly.

Couple problems: the docs aren't as good as they could be, the Mono version is still a ways back (~2.10ish), compute shaders aren't built-in to OSX yet (though you could do this yourself if you really wanted to), the community is geared around "scripting and drag/drop/click" so getting detailed assistance for very technical matters is sometimes difficult, etc.

All in all though, it's pretty amazing. Now, it will take you awhile to learn all that, to find out where everything is exposed, what you need to hook into, etc., but, once you do, it is actually very programmer friendly.

<comment><USER10> You seem knowledgeable so I figure I'd reply here since I keep getting mixed messages on this point: Is it easy to commit your Unity code in a VCS and have teammates work on it with you simultaneously? Some people say yes, some say no.

<comment><USER11> I have been using git for source control with no issues (haven't tested in a team environment however).

Not sure if you were aware of this already but theres a non-default setting in the Unity preferences for enabling "Version control support" that basically makes Unity save metadata in a text format instead of its standard binary format: [http://docs.unity3d.com/Documentation/Manual/ExternalVersion...](http://docs.unity3d.com/Documentation/Manual/ExternalVersionControlSystemSupport.html)

</comment></comment></comment></comment><comment><USER12> Does it work on Linux?

<comment><USER13> Yes, as a build target: [http://unity3d.com/unity/multiplatform](http://unity3d.com/unity/multiplatform)

The IDE does not run on linux, just mac and windows.

<comment><USER14> which is ironic as it's Mono...

<comment><USER15> Mono has a good cross-platform GUI library? IDE is mostly very rich GUI I guess.

<comment><USER16> Monodevelop was primarily developed on Linux, so this is bit ironic indeed.

May be it is because 3D/2D modeling aspects of the IDE, not really because of Coding aspects.

<comment><USER17> Not any longer, Miguel lost interest.

[http://tirania.org/blog/archive/2012/Aug-29.html](http://tirania.org/blog/archive/2012/Aug-29.html)

</comment></comment></comment></comment></comment></comment><comment><USER18> has any small/indie game developer here had experience with their license? I'm curious how much it'll cost to publish to a console system. Their website says it's a per-case basis and I'm not actively developing anything now so calling them won't help. Just curious, thanks!

<comment><USER19> Deploying to console is very expensive. Wii license is something like 40k, PS3 is more. Not sure about Xbox 360.

I was told by someone familiar that the XBOX One license will be free.

<comment><USER17> > I was told by someone familiar that the XBOX One license will be free.

This was announced some time ago already, [http://blogs.unity3d.com/2013/11/05/big-xbox-one-news-for- un...](http://blogs.unity3d.com/2013/11/05/big-xbox-one-news-for-unity- developers/)

</comment></comment></comment><comment><USER20> Does it come with HTML5 browser support or is it still using this plugin?

<comment><USER21> Not yet, but don't be surprised if WebGL export is a big feature of the next major release.

<comment><USER20> Would be nice to have the tooling on the web :)

</comment></comment></comment><comment><USER22> Chrome is dropping NPAPI support, which includes the Unity browser plugin. Unity will be temporarily whitelisted probably through the end of 2014 but the goal is to remove support entirely.

[http://blog.chromium.org/2013/09/saying-goodbye-to-our- old-f...](http://blog.chromium.org/2013/09/saying-goodbye-to-our-old-friend- npapi.html)

So if they want to continue offering a browser plugin they have to switch to NaCl, I think.

</comment><comment><USER23> Anyone know how "mergeable" the project files are? Are they git friendly?

<comment><USER24> They are technically mergeable because they're text based, but they're not super easy to comprehend. I've found that .unity scene files seem to develop dramatic changes between check-ins that make it difficult to isolate problems (ie. giant blocks of text removed from one part of the file, then put in another part of the file untouched).

In general I feel like the best practice is to touch these .unity scenes as little as possible, and spend most of your time iterating on prefab files, which are easier to read.

Haven't tried git with unity so I dunno if there are any special case issues there.

</comment></comment><comment><USER19> Looks like the download link is no good. Getting a 404 (Windows).

<comment><USER25> It starts after 2 seconds or so.

Direct link: [http://netstorage.unity3d.com/unity/UnitySetup-4.3.0.exe](http://netstorage.unity3d.com/unity/UnitySetup-4.3.0.exe)

<comment><USER19> That worked. Thanks.

</comment></comment></comment><comment><USER26> Background image has some issues in safari when scrolling.

</comment><comment><USER27> Are there any good tutorials on using the 2D toolset?

<comment><USER28> Other than the official documentation, you'll probably have to wait a few days/weeks.

</comment></comment><comment><USER17> Now I know what I have to download tonight! :)

</comment><comment><USER29> I wonder how does this compare to Corona.

<comment><USER11> I've used Corona to develop a hobby project in the past and its great for 2D (easier to use and more programmer friendly than Unity) but completely unsuitable for any 3D work so its really just depends on what kind of game you're making. With Unity 4.3, the 2D experience should be much better (before 4.3, you needed ~$100 addons for decent 2D sprite support in Unity).

</comment></comment><comment><USER30> Am I the only person who opened the link expecting something about Canonical's desktop?

<comment><USER31> Yeah, the naming has always been unfortunate, but given that the URL after the headline says "unity3d.com" it's kinda clear which of the two was meant.

<comment><USER30> Unity used 3D acceleration to render its lenses.

If you are completely unaware of the gaming scene and an Ubuntu user (I am in the intersection of both), it's not obvious.

<comment><USER32> I've had the opposite problem, seeing in the past an article about Unity the compositor, being about 3D rendering of some sort and instantly thought Unity 3D the engine. This is likely due to my exposure to the gaming space.</comment></comment></comment></comment>


Elixir Web Console Is Launched - <AUTHOR> We are happy to announce the release of the Elixir Web Console!
This website is a place where people can try the Elixir language without the need to leave the browser or installing it on their computers. We hope this is a contribution to the effort to promote the language, providing a convenient way to assess the capabilities of this technology.
This is just the beginning of the journey. We are aware that only a portion of the language is available in this online console at the moment, but we plan to extend its capabilities.
In addition, we hope to keep adding more features to have a UI experience similar to `iex`. In particular, we are lacking a way to write multiline Elixir code, but we expect to address it shortly.
You can read more about this project and all the security concerns about it (I bet you are thinking about that, after all, running foreign Elixir code in a server is kind of crazy!) in the Readme of the project (https://github.com/wyeworks/elixir_console#elixir-web-console).
Here is the site: https://elixirconsole.wyeworks.com/ <comment><USER2> This should be a Show HN! see [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

</comment><comment><USER3> Is it meant to work on mobile as well?</comment>


Remove Richard Stallman (Thread) - <AUTHOR> https://twitter.com/sarahmei/status/1172283772428906496 <comment><USER2> this all incredibly reminds me of being an obnoxious 20yo forum poster who wanted to nitpick controversial topics to show off how deep and smart i was, with no regard for how it might affect other people

extremely embarrassing that rms hasn't grown out of that

</comment><comment><USER3> Also here:

[https://threadreaderapp.com/thread/1172283772428906496.html](https://threadreaderapp.com/thread/1172283772428906496.html)

<comment><USER4> Also here without ads and fake news rabbit holes:

[https://threader.app/thread/1172283772428906496](https://threader.app/thread/1172283772428906496)</comment></comment>


(reddit) YC applications are due, did you apply? If so, what are you building - <AUTHOR> http://www.reddit.com/r/startups/comments/l7mkz/y_combinators_applications_are_due_tonight_did/

<comment><USER2> We did — we're Blogic, and we're what you need when you have a great website but no blog yet. We turn your website into a blog theme, in a minute. <http://blogic.com/> (free until we throw Stripe at it!)

<comment><USER3> wow! this is really cool! I have to test it out some more - does it come with all of the social sharing, etc?

<comment><USER2> Thanks! Yes, at present we support Twitter, FB, G+, and commenting with Disqus or FB.

</comment></comment></comment><comment><USER4> We applied with SurfScore. It's designed as a universal achievement-reward system for the Internet, similar to videogame achievement systems(GamerScore, etc.) People are able to perform tasks (simple things like uploading a photo to facebook) and earn SurfScore for it, which can be redeemed for prizes. It's designed as a new form of advertising...companies can institute achievements for their own websites(it can be anything, as long as it doesn't cost money-- you don't pay to watch a commercial), and people will see a tangible reward for doing whatever task they specify.

This takes advantage of the interactivity of the Internet, while also revolutionizing advertising as something much more appealing than just beating you over the head with banner ads and commercials. Advertising wants you to do something, but does it in a way that usually just pisses you off. We hope to change that. <http://www.SurfScore.com>

<comment><USER5> Isn't this just a fancy derivative of "fill this form out and we'll send you a free iPod?". Because that's all it is..

If you tell me people want achievements, well.. Achievements in games feel good because there's actual skill involved, and it feels like you mastered something. You can't say the same for doing random tasks online. You can't just throw a word like 'achievement' or 'score' on top of what you're doing, and think the effect will be the same.

<comment><USER4> What's wrong with getting a free iPod for filling out a form? The problem with these types of companies is execution; they're usually really shady and have a lot "catches". If a company came along that could get rid of all that and do it right, wouldn't you be filling out forms too?

<comment><USER5> Nothing wrong, just that you're going to have difficulty finding advertisers that will agree to this type of advertising. You're not in any way solving the problem of finding relevant audiences for their ads. You're just throwing an incentive for random people to do things for prizes, and hope they will buy whatever the ad is about. But users just want the free goods.

The problem is not how to make users interested in an ad. The core problem is connecting an ad to a relevant audience. You can't fake interest in an ad that's not relevant to what you want at the point. People have tried that with FB ads, but the CTR are horrible, and people get pissed when they see the ad had nothing to do with the actual product.

<comment><USER4> You know, you're absolutely right. Any suggestions?

</comment></comment></comment></comment></comment><comment><USER6> I've been wandering around the internet for a few months now, unexpectedly surprised that there's no hate for YC. Inevitably, the very same internet proves me wrong.

Edit: A few months of being pleasantly surprised - not a few months of being on the internet. Gosh.

<comment><USER7> FWIW I think some people are just trying to troll. It seems like some of the comments have been downvoted into the negatives. (Maybe by HN'ers?)

</comment></comment><comment><USER8> we built Wanderplayer: <http://www.youtube.com/watch?v=9FmjEiNV08s>

turning your smartphone into a game controller for browser and pc games on any screen (iPad to Desktop to TV)

<comment><USER9> That looks really cool. Does this only work with Chrome? BTW - Next time, hide the hookah sitting in the background :)

<comment><USER8> thanks - will fix. Works with any browser on Mac/PC. Chrome is optimal though

</comment></comment></comment><comment><USER10> We applied with Glecto. Glecto (glecto.com) is a social news platform. We allow users to create stories and other users to come along and add their additions (what they know) to that story, therefore building up a full structured news story.

All stories are up/down voted to ensure that the the best and most important content are shown first (and of course the worst and inappropriate content is pushed off).

Users can also add video and photo to their stories or additions.

We aim to get our app fully accessible on both Mobile and Desktop (unlike others).

</comment><comment><USER11> oh wow, are any of these supposed to be profitable business? I see very little real pain being solved by most of these ideas. Most seem to be social media things, productivity clones or "The AirBnB of [whatever]".

<http://www.oyoglasses.com/> seems like the best of the bunch. At least there's an un-served need, a fashionable elite with money and an emerging technology (3D printers).

I hope it's just that all the good business haven't announced themselves.

<comment><USER12> I'm also intrigued by these web app + product combos - this would have been a perfect idea for Kickstarter as well, just because they could have sold some of their glasses upfront.

On the flip side, whenever you have physical production and products, you also have a lot more points to control in the customer experience to maintain a quality experience for your clients. I think this is a good idea, but could also go drastically wrong if they don't get the right resin, plastics durability, etc.

</comment></comment><comment><USER13> I saw at least two task manager/to-do list applications.

I don't get the attraction - firstly it seems to me to be a FNAC (feature not a company), secondly you are competing aginst big players (Google), larger startups (Evernote) and a thousand smaller players (RememberTheMilk etc). What is the attraction?

Is it simply that it is easy to build?

<comment><USER4> I think that the biggest positive of doing something like that is that execution is so crucial to success. Yeah, there are big players in the game, but nothing is stopping some hotshot engineer from coming up with a new, amazing way to keep track of your stuff. Yeah, its really hard, especially with everyone thinking the same thing, but it puts you on a more level playing field than other things might.

Are you going to take over the world with RememberTheMilk? probably not, but you can carve out a pretty nice niche for yourself, and if you're good enough be acquired by one of those big names.

</comment></comment><comment><USER14> <http://www.profileperfecter.com/> "Your Online Wingwoman"

</comment><comment><USER15> I didn't submit an application for this round, but I filled one out just to try it out and I found the process very useful. It made it clear to me what needed to be done to make my idea appealing to an outsider and it made me realize one or two big potential problems. In sum: killer app, man.

</comment><comment><USER16> A quick list of various YC applicants from the reddit thread and other places: [http://agog.posterous.com/yc-deadline-tonight-list-of- applic...](http://agog.posterous.com/yc-deadline-tonight-list-of-applicants- kinda)

<comment><USER17> I applied too! for a powerful local media player with html5/js, inside browser or any html5 platform. <http://projects.achshar.com/?id=6> \- Achshar Player

<comment><USER16> Thanks! and much luck :)

</comment></comment></comment><comment><USER17> I applied for a powerful local media player in the browser + social integration :D

</comment><comment><USER18> i like flock.fm's idea. but disliked the autoplaying audio.

<comment><USER19> Thanks! We'll probably disable the autoplaying soon... it's been pretty contentious :-)

</comment></comment><comment><USER20> i really like that ttagg.com startup. I think it's the best one out of the bunch listed so far

<comment><USER21> bizzaro - this is very similar to the business model behind mine. Yikes competition already!</comment></comment>


Bringing Google I/O direct to you with I/O Live - <AUTHOR> http://googleblog.blogspot.com/2011/04/bringing-google-io-direct-to-you-with.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+blogspot%2FMKuf+%28Official+Google+Blog%29&utm_content=Google+Reader <comment><USER2> > Read captions from the livestreamed sessions in real-time. Plus, to make > sure all our content is accessible, all remaining videos will also be > captioned. For international developers, captions will be machine translated > to all languages that are supported by Google Translate.

This looks like the most interesting announcement. I assume the English text will be provided by a human captioner, but even so, this shows a lot of confidence in their translation system. I wonder if they'll be buffering at the sentence level, or whether they can handle partial sentences on the fly.

</comment><comment><USER3> love the countdown on the actual website <http://www.google.com/events/io/2011/>. No one likes looking at a boring old countdown timer

<comment><USER4> It gets a little exciting when the time changes from 09 to 10.

<comment><USER3> Yup. Would love to see how it is done

<comment><USER5> Right Click ==> View Source, obviously :D <http://www.google.com/events/io/2011/static/js/io.js>

So, it looks to be built on the Box2DJS Javascript physics engine: <http://box2d-js.sourceforge.net/>

The author, Matt King, says he recently got into Javascript through Crockford's "JavaScript: The Good Parts," and seems to be knocking it out of the park: <http://mking.me/>

</comment></comment></comment></comment><comment><USER6> There's usually at least a couple of web development stuff that comes out of IO that blows me away, so I'm looking forward to it.

</comment><comment><USER4> The HD video recordings within 24 hours is pretty exciting.</comment>


Atlassian files for IPO - <AUTHOR> http://www.sec.gov/Archives/edgar/data/1650372/000155837015001685/filename1.htm <comment><USER2> Interesting

Slack and Github investors will be watching this closely! Will be interesting to see what the market thinks about a profitable company going public.

13 years from starting to going public, so those of you who join a startup going on its 4th year, something to keep in mind. You could have joined in year 5 and had your shares vest by year 9 and then be waiting for an additional 4 years for your liquidity event!

> > [https://www.sec.gov/Archives/edgar/data/1650372/000104746915...](https://www.sec.gov/Archives/edgar/data/1650372/000104746915008450/a2226437zf-1.htm#dy77101_principal_shareholders)

Kindof weird that their CFO resigned in October, just before they went public. That's probably something I'd want to know about in more depth if I was going to invest.

I wonder if they delayed the IPO so this could happen before they filled. Seeing as they brought him in to lead them through the IPO process, this seems a bit of a weird time to leave, this is probably the busiest time for a CFO.

> > [http://www.bloomberg.com/news/articles/2015-02-11/atlassian-...](http://www.bloomberg.com/news/articles/2015-02-11/atlassian- > appoints-erik-bardman-cfo-ahead-of-planned-ipo)

<comment><USER3> > 13 years from starting to going public, so those of you who join a startup > going on its 4th year, something to keep in mind

Atlassian started in Australia, a country where technology is generally considered a scam to separate idiots from their wallets. This significantly slowed down growth, and the founders have said they wished the company had left Australia sooner.

Edit: this went from +2 to -2 very quickly. For anyone unfamiliar with Australian technology industry, here's a reference for Atlassian CEO comments: [http://www.computerworld.com.au/article/557248/atlassian- ceo...](http://www.computerworld.com.au/article/557248/atlassian-ceo-gets-why- startups-want-leave-australia/)

The Australian government also taxes employee options in such a way to make them non-viable: [http://www.techworld.com.au/article/535906/what_atlassian_mo...](http://www.techworld.com.au/article/535906/what_atlassian_move_says_about_australia_startup_scene/)

My own experience working in Australia (as an Australian) in innovative technology was extreme wariness of tech: it's an expense, not an investment. Local companies were cynical of technologies, even mainstream technologies in the US and UK, until there was at least one other Australian company using them.

<comment><USER4> > Atlassian started in Australia, a country where technology is generally > considered a scam to separate idiots from their wallets.

Perhaps ironically, when I was in Australia a few weeks back, every merchant assumed my credit card supported NFC.

They got a kick out of my explanation that American credit cards just finally caught up with Smart Chips, and now Australia has moved on.

<comment><USER5> Been in NZ for just over 4 years. The AU/NZ banking system is way out ahead of the US in my experience. Instant acct-acct transfers even on weekends. Hourly posting for bank to bank transfers. Better online experiences. Most of the big banks, and kiwibank, offer good free expense tracking and budgeting software ala mint.. I really hate having to deal with my US accounts :|

<comment><USER6> Do you know a free way to transfer cash from aus bank to nz bank?

I want to buy from www.lastseason.co.nz without getting stung.

<comment><USER7> OzForex? CurrenciesDirect? There are many similar exchange agents: You transfer to their bank account of country 1, they transfer from their local bank account in country 2, avoiding international transfer fees. Few days, less than 1% away from the Google rate, unbeatable.

</comment></comment></comment></comment></comment></comment><comment><USER8> Two similar companies that I can think of that went public recently is Splunk (SPLK) and Hortonworks (HDP) - their stock is trading mostly sideways, nothing exciting.

Not sure what to attribute this to - having reliable business clients pay for your software seems like very solid business to me, after all isn't that how IBM's and Oracle's of this world came about.

I suspect it comes down to how competitive this space is. Campfire used to be the thing not long ago, and then everyone went to Slack - who's to say that another competitor will not emerge and everyone will ditch their Jira's for something better?

<comment><USER9> "Reliable business" is a double edged sword in this case because reliable also means predictable. A lot of blue chip companies get their high valuation because the public can see the potential but not completely so. Whereas companies like Splunk or Hortonworks it's pretty much predictable how they will keep making money (at least for the next couple of years assuming that nothing surprising will happen)

<comment><USER10> > Whereas companies like Splunk or Hortonworks it's pretty much predictable > how they will keep making money...

Huh? Neither Splunk nor Hortonworks are profitable.

<comment><USER9> I guess i should have been clear. I meant "making money" as in having a business model. Being profitable and having a business model are two different things. We can ask Amazon

<comment><USER11> Ok, so let's ask Amazon: they are both profitable and have a business model (further, for years running now, they've been able to demonstrate profitability whenever they feel like it to satisfy Wall Street worries). Their retail business has always had low margins, no different than Walmart by comparison.

</comment></comment></comment></comment></comment><comment><USER12> Wow, the founders still hold a combined 75% of equity.

<comment><USER13> It really helps to not need funding when you go to seek funding.

</comment></comment><comment><USER14> I'd short it technically because Confluence is Satan's wiki, but corps eat it up because WYSIWYG and because it costs money. (FOSS is bad, doncha know).

<comment><USER15> Yeah I'm also considering shorting this as well. Having worked at a company that ate Atlassian software day and night, every single piece of software they have in their portfolio is a complete ugly mess. For every piece of software they have there's a better alternative that is cheap or free.

<comment><USER16> Could you list the cheap and or free alternatives?

<comment><USER17> Well, for wikis it's obviously MediaWiki, and Bugzilla for JIRA.

Only thing that I don't know of free software replacement is the Agile Development tooling that JIRA provides. But tbh, "agile development" is a hellhole of buzzwords, expensive consultants and ridiculous bullshit rules anyway.

<comment><USER18> Or, you know, something a fortune 200 company uses to set its release dates for its flagship software. And is able to communicate how scope creep would affect sales to their internal team. And hits that release date.

</comment></comment></comment></comment></comment><comment><USER19> I hope bitbucket stays the same. Great service for private repos with git and mercurial support.

<comment><USER20> Except for the availability issues over the past few months that would happen almost every other day. Moved my team to Github and __poof __, issues gone.

</comment></comment><comment><USER21> Core values include "Don't #@!% the Customer" and it ended up on their SEC statement. Their stock went up in my book.

<comment><USER22> No one wanted to translate it to some mature phrase like, "do right by the customer"? Too much work?

</comment></comment><comment><USER23> I hope it works well for them. I've seen many companies go down the tubes after deciding to go public. Which makes me wonder why one would even want to go public in the first place? The allure of perhaps making more money?

<comment><USER24> You know all those employees that you gave equity to in order to lure them onboard? Well, you've got a few options at that point. You can go public so they can cash out. Or you can do some kind of revenue-sharing scheme so they can get cash. Or something. Point is, you have to make good on your promise to them (their equity) at some point or they're all going to quit.

<comment><USER23> There is that issue, but surely not all startups offer that?

<comment><USER25> Equity investors of all kinds will eventually want to liquidate.

</comment></comment></comment></comment><comment><USER26> Presumably this is why they completely repackaged JIRA a few weeks ago. [http://www.cio.com/article/2989783/atlassian-takes-jira- beyo...](http://www.cio.com/article/2989783/atlassian-takes-jira-beyond-the- development-world.html). Now they have the broad corporate-focused packages that will play well on Wall Street. They also have upside growth from the repackaging that can drive speculative pricing beyond what their current financial statements would justify.

</comment><comment><USER27> Revenue:

$148.5m (FY2013)

$215.1m (FY2014)

$319.5m (FY2015)

Net income:

$10.8m (FY2013)

$19.0m (FY2014)

$6.8m (FY2015)

<comment><USER28> why is it down for FY2015 net income? And Aren't those margins kinda thin?

<comment><USER29> Not at all. They are investing their profits into scaling and growing the business.

<comment><USER30> This. And no, software margins are not categorically thin (see SAP, Oracle, Microsoft, etc).

</comment></comment></comment></comment><comment><USER29> This will be a great litmus test for relatively new and growing technology companies to determine when it's right to IPO in this market.

There have been a number of recent IPO's from companies with great growth but no profits to show for it. The market has mainly rejected these companies and the companies are trading near IPO levels or below. Some of them after taking a down round to go public even, such as HDP.

Atlasssian is showing very good growth and profits, however modest (which they should be for them - reinvesting in the company is the best action right now), which I assume would end up with a pretty decent multiple.

My midline would be a 4 billion market cap based on current growth trajectory, current and potential earnings (and their reinvestment in the business) and cash on hand which should limit and sort of second round any time in the foreseeable future.

This isn't based on PE (it would be extremely high right now) but rather the revenue growth and cash stability to allow sustainable reinvestment in the companies marketing, R&D and sales departments. It's a bit over 10x forward revenue.

</comment><comment><USER31> I think very highly of JIRA and would use it again, but at a previous workplace ( over 1000 users) we required to have a JIRA/confluence admin who was spending over 50% of his time either keeping it running, adding connectors, or making modifications to suite various interest groups.

<comment><USER32> Is that a bad thing? Why the but?

<comment><USER33> Perhaps because he believes a good solution should take care of itself without human intervention most of the time?

</comment></comment></comment><comment><USER34> Interesting that this has happened so soon after relocating to the UK (2014) from Australia. I wonder if they plan to stay there or move the US as well?

<comment><USER35> I didn't realize that they weren't based in SF, since they have a large presence here. In fact, the Chief Legal Officer cited in that filing is based in SF.

According to statements made by the founder[1], the move to London was designed to make them more integrated into the global economy ahead of their IPO. That tells me that they aren't moving again any time soon.

[1] [http://www.afr.com/technology/atlassians-farquhar- justifies-...](http://www.afr.com/technology/atlassians-farquhar-justifies- london-switch-20140217-ixrqy)

<comment><USER7> According to the "foreign private issuer" paragraph, "more than 50% of our assets cannot be located in the United States", and ditto for the board members.

They are primarily based in Sydney, they might be the biggest importers of developers in Australia actually ;) but the SF office is large too, they hold a few usergroups in it, as well as the Atlassian Summit which just ended (3-5 Nov). [https://summit.atlassian.com](https://summit.atlassian.com) . No wonder you believed they were SF based.

</comment></comment></comment><comment><USER36> Their products are well designed but often sluggish which ruins the experience. I stopped using them because of that, unfortunately. It created a barrier in my head and made me hesitant every time I wanted to interact with their software.

</comment><comment><USER37> How can I buy shares?

<comment><USER38> I am not well versed in the stock exchange but I believe your options are: A. Work for Atlassian. B. Wait until they go public.

<comment><USER39> I believe the document these comments are linked to is a filing that states that Atlassian is, in fact, going public.

</comment></comment></comment><comment><USER40> With Goldman Sachs? That's disappointing. I don't trust anything they do anymore.

</comment><comment><USER7> The most awesome of the awesomest companies: " An application has been made to list our Class A ordinary shares on the NASDAQ Global Market under the symbol "TEAM"."

Only Atlassian could ask to be listen as "TEAM".

Is there a "quiet period"? I can't find the date of IPO on the document either.

Does an IPO introductory price usually match the last round of funding? It seems on page 10, they mention $2.23 for Class A shares and $0.51 for Class B shares, which makes a total valuation of $148m. Last round valuation was $3.15bn [1]. It means those shares have been bought 21 times higher at the last round than the price mentioned in this document. Did I read it correctly?

Page 62, chart: For $1 initial purchase, customers end up spending $8 in additional users, renewals and other products.

It's my first time reading an F-1/S-1, it's awesome, there's plenty of information! Sales per continent, page 71! Marketing expenses page 80! That's awesome!

[1] [https://www.crunchbase.com/organization/atlassian](https://www.crunchbase.com/organization/atlassian)

<comment><USER41> The prices on Page 10 (I actually see similar but slightly different numbers, the document may have been updated) are weighted-average _exercise prices_ for all outstanding options. Since many of those options would have been issued years ago (presumably with low strike prices) the average option price bears little relationship to the IPO price (which we won't know until the IPO is priced by the underwriters--note the blanks throughout).

</comment></comment><comment><USER42> That's a shame. I liked their products.

<comment><USER43> Why is this a shame? Do you think IPOing will affect their products & direction?

<comment><USER42> Yes. Going public has never done anything good for any company. Once going public, it's all about quarterly reports and pleasing a few hedge funds.

<comment><USER43> This seems overly broad. Red Hat has done a lot of very good things since going public and I'm sure if you sat down and looked at a lot of public companies shoes software you use it's likely they have done good things.

<comment><USER43> shoes -> whose :)

</comment></comment></comment></comment></comment><comment><USER44> You mean a S-1?

<comment><USER45> No, F-1, because they're a foreign company.

</comment></comment><comment><USER46> [http://media.tumblr.com/tumblr_m09a7gL67A1r79r7q.gif](http://media.tumblr.com/tumblr_m09a7gL67A1r79r7q.gif)

I even love saying the word "TEAM".</comment>


Ask HN: What will happen if Tarim Basin is turned into an artificial sea? - <AUTHOR> <comment><USER2> With what water? What happens to the people currently downstream?

Look at the Salton Sea in the US for one possibly similar example.

<comment><AUTHOR> >With what water?

Chinese assume that they can drill a colossal tunnel through Himalayas from Pakistan, and have it connected to Arabian sea by a canal going through whole Pakistan's lowlands in a distant future. The pilot project to test the feasibility is the 1000km pipeline for water diversion from Tiben to Yangtze

<comment><USER2> In the US West there's the saying that "water runs uphill towards money."

I know people dream big. There were grand plans to bring water from Alaska to California, in off-shore pipes. [https://www.wired.com/2015/02/california- pipe-water-alaska/](https://www.wired.com/2015/02/california-pipe-water- alaska/) . That doesn't mean the dreams will ever be realized.

I know nothing about the geography of the Tarim Basin. A search now says the lowest part of the Lop Desert is about 800 m ([https://en.wikipedia.org/wiki/Lop_Desert](https://en.wikipedia.org/wiki/Lop_Desert) ) which is in agreement with the color-coded topological map at [https://en.wikipedia.org/wiki/Tarim_Basin](https://en.wikipedia.org/wiki/Tarim_Basin) .

Bring water up 800 m from the Arabian Sea is very expensive.

<comment><AUTHOR> Indeed, nothing but nuclear power can make that feasible. Although, there are few small depressions in Lop Nur below the sea level.

One of the most crazy theories thrown on it is that the weight of the water will eventually make Lop Nur's plate to subduct a hundred meters or more, making the operation a little bit cheaper

<comment><USER2> Cheap nuclear power would enable many other changes. To start with, cheap desalinization and pumping means that more of California's Central Valley would be open to farming. The elevation difference there is only 10-20 meters.

As to depression of the crust, yes, the crust is elastic and will depress with enough weight. The density of water is about 1/3 that crustal rock, so as a rough estimate, you'll need 3m of water for every 1m of depression.

This topic has been well-studied because glaciers during the last Ice Age pushed down the crust.

I have a tough time thinking of how to provide the water needed to make an artificial lake that averages 300m of depth over a wide enough area to cause the crust to depress.

Lake Volta is the largest man-made dam by volume, at 148 km3. It's fed by rivers, and the outflow is 1,210 m3/s. Now replace those rivers with pumps and desalination plants, and scale it up for the Tarim Basin proposal.

No, it doesn't seem reasonable or even feasible. Other alternatives are cheaper.</comment></comment></comment></comment></comment>


What Do Angel Investors Actually Do? (Part 1) - <AUTHOR> http://leoexplor.es/angel-investing/2013/03/13/what-do-angel-investors-actually-do-part-1/

<comment><USER2> I'm not sure if it is a problem unique to India, but here Angel investors are extremely risk averse. Other than looking at the competition, objective, market opportunity and potential, they focus on current revenues A LOT! Their decision of whether to invest or not depends almost 80-90% on whether you are making steady income already, and that I think is the biggest dealmaker/breaker than all other criteria.

<comment><AUTHOR> I'm not sure about the situation in India, but I can say that startup investments are risky and angel investors are risk averse. It's always good to see indicators that lower the perceived risk: a strong founding team, traction, revenues, profitability, etc. In Silicon Valley, great traction with customers can often lead to profitability, so traction without current revenue is still considered a good sign. It's possible that traction is not as well correlated with profitability in other locales, and so traction alone would not be a strong enough indicator in those places.</comment></comment>


About the security content of iOS 7.0.6 - <AUTHOR> http://support.apple.com/kb/HT6147 <comment><USER2> Heh...

"congrats to the Apple iOS team on adding SSL/TLS hostname checking in their latest update! very cool feature."

[https://twitter.com/will_sargent/status/436985812878491648](https://twitter.com/will_sargent/status/436985812878491648)

<comment><USER3> Comedic derision appreciated :)

However this is a pretty damn serious oversight.

I've just shut down my MacBook and picked up my ThinkPad.

<comment><USER4> Mac os is not vulnerable

<comment><USER5> It appears to be, per [https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73](https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73) (and my own testing on OS X 10.9.1).

<comment><USER6> I'm able to reproduce your results with cURL. However, Safari on OS X correctly shows a warning. Can anybody explain that?

<comment><USER7> cURL uses OpenSSL, Safari uses Apple's Secure Transport.

<comment><USER6> That's not correct. The cURL version shipped with OS X uses SecureTransport.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> As it happens, Secure Transport (edit: on OS X) is open source. I just spent the last hour rummaging through source code ... It was later renamed to "libsecurity_ssl" when it landed on iOS. It's been around since OS X launched. They also have a folder with about four dozen regression tests and a test app, not that I've had the chance to inspect either that closely. The tarballs are spread across two folders in the tarballs index: Security (look for multi-MB file sizes) and libsecurity_ssl. The 5-digit numbers appear to be sequential revision IDs, any single-digit numbers seem historical. (E.g. libsecurity_ssl-6 is before libsecurity_ssl-10 rather than after libsecurity_ssl-55471.)

It appears they haven't posted newer source than this. The most recent timestamp I could find was Oct 11, 2013 in 55471, which corresponds to 7.0 and my 10.9 system has the same version number for Security.framework -- same bundle version of 55471 for 10.9.1 aka 13A581. Previous version numbers don't appear to be as well-maintained. I don't expect a newer release to be posted until the next OS X release, as the source was only published under 10.9, not iOS. Additionally, there's no mention of iOS 7 on [http://www.opensource.apple.com/](http://www.opensource.apple.com/)

I couldn't easily find the bug without more to go on, because the code is spread across a few components and really, I'm not an expert in TLS. It appears to have been largely unchanged from 2000-2006 or so. TLS 1.2 brought quite a few changes, but it was neat to browse through the lines of "FIXME" and "TODO" comments, as well as various diffs between releases. And neat to see how much code today still goes back to 1999-2001, sometimes all they did was add a 'k' in front of a few variable names or delete the line in the first README saying the server code wasn't tested against Windows ;-)

It sounds like when 10.9.2 is released, or at worst when 10.10 comes along, you'll see a new push of code to the opensource site. We can all diff 55471 against what comes next to see the changes. (If someone's already running 10.9.2 and its unaffected by the bug exhibited via curl, open /System/Library/Frameworks/Security.framework/Versions/Current/Resources/Info.plist and post the Bundle version.)

<comment><USER9> Take a look at [http://opensource.apple.com/source/Security/Security-55471/l...](http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c?txt)

specifically check the function SSLVerifySignedServerKeyExchange

I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).

<comment><USER10> Here's a diff of that file from OS X 10.8.5 (Security-55179.13) to 10.9 (Security-55471): [https://gist.github.com/alexyakoubian/9151610/revisions](https://gist.github.com/alexyakoubian/9151610/revisions)

Check line 631. Appears seemingly out of nowhere.

<comment><USER11> Goto considered harmful, indeed!

<comment><USER12> Not much a problem of `goto` per se. Rather a problem with if conditions used without code blocks.

Others might say it's a problem of whitespace insensitive languages ;)

<comment><USER13> Haha love the whitespace comment. This also makes you think of the static source-code analysis done at Apple. Surely static tools would have picked this up, no...?

<comment><USER14> Clang currently does not warn about this, but I'd wager that Xcode will boast a feature in the next version that detects dead code due to early returns/gotos.

<comment><USER15> Clang may not warn about white space issues, but it certainly does warn about unreachable code if -Wunreachable is on. This code would not compile in my project because the unconditional goto leaves the following code unreachable.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> This is so bad that it is hard to imagine how it could have escaped notice until now, Apple really need to beef up their security competence. Lets hope that malevolent hackers were similarly asleep.

<comment><USER17> Indeed. My first thought upon seeing this: "how in the FUCK did automated testing not catch this IMMEDIATELY!?"

Absolutely terrifying that crypto safety is such a low QA priority that something like this could ever leave the building.

<comment><USER18> Because it's not a blatant regression, it's a complicate bug that requires a custom-patched TLS stack on the server to be explocited. As Adam Langley put it:

> A test case could have caught this, but it's difficult because it's so deep > into the handshake. One needs to write a completely separate TLS stack, with > lots of options for sending invalid handshakes. In Chromium we have a > patched version of TLSLite to do this sort of thing but I cannot recall that > we have a test case for exactly this. (Sounds like I know what my Monday > morning involves if not.)

<comment><USER19> Except: ensuring that the server is signing with the right, certificate- certified private key is _the_ major thing that TLS is supposed to provide.

So no matter how strange or malicious the server-side stack would need to be... not having a test for such a deviation is a major oversight.

<comment><USER7> The really scary thing is that there is basically _no_ good testsuite for SSL/TLS in existence. I would not be surprised if other stupid bugs showed up in other implementations given one…

</comment></comment></comment></comment></comment><comment><USER8> Odd. Apple updated iOS 7 and iOS 6 but didn't update Secure Transport in iOS 5? I wonder if the bug was introduced between iOS 5 and 6.

Background on Secure Transport:

"At the bottom of the TLS stack on both iOS and Mac OS X is a component known as Secure Transport. Secure Transport maintains a per-process TLS session cache. When you connect via TLS, the cache stores information about the TLS negotiation so that subsequent connections can connect more quickly. The on- the-wire mechanism is described at the link below.

[http://en.wikipedia.org/wiki/Transport_Layer_Security#Resume...](http://en.wikipedia.org/wiki/Transport_Layer_Security#Resumed_TLS_handshake)

"This presents some interesting gotchas, especially while you're debugging." More at: [https://developer.apple.com/library/ios/samplecode/AdvancedU...](https://developer.apple.com/library/ios/samplecode/AdvancedURLConnections/Listings/Read_Me_About_AdvancedURLConnections_txt.html)

<comment><USER20> FWIW, the first time I went to [https://notinthecert.imperialviolet.org](https://notinthecert.imperialviolet.org) in Mobile Safari on iOS 5.1.1, I got a "Cannot Verify Server Identity" error with Cancel, Details, and Continue buttons. After pressing Continue, it remembered my choice and did not alert me the second time.

</comment></comment><comment><USER21> Looks like they weren't checking the hostname in the certificate. This would allow anyone with a certificate signed by a trusted CA to do a MITM attack on iOS devices. Very very bad vulnerability.

<comment><USER22> It seems to be a bit more than that, as I've verified that iOS 7.0.4 and Mac OS X 10.9.1 both refuse to connect to a server with a certificate for a different hostname. Sounds like verification is somehow different when connecting to a raw IP address. Safari treats that case differently, anyway: if I try to connect to a hostname that's different from what the certificate says, it simply refuses to establish the connection at all. If I try to connect to the raw IP address, it says the certificate is wrong, but gives me the choice to ignore the error and proceed anyway. Odd stuff.

<comment><USER23> Looking at the code, this bug probably doesn't happen on connections which use TLS 1.2, which any properly configured server should support these days. (There's a seperate codepath for TLS 1.2 connections.) Note that this doesn't provide any protection against an attacker exploiting the vulnerability, since they get to choose what TLS version is used.

</comment></comment></comment><comment><USER24> Adam Langley has written up the details of the issue here: [https://www.imperialviolet.org/2014/02/22/applebug.html](https://www.imperialviolet.org/2014/02/22/applebug.html)

</comment><comment><USER25> Just to be clear:

/usr/bin/curl on Mavericks suffers from this problem:

        ~ /usr/bin/curl https://imperialviolet.org:1266
        If you can see this message then[...]

Keep that in mind when you download an installer using curl and pipe it to bash.

<comment><USER26> Unless curl uses Secure Transport on OS X, then it's a separate bug in curl/libcurl.

Edit: apparently curl does use Secure Transport on OS X as of 7.27:

[http://curl.haxx.se/mail/lib-2012-06/0334.html](http://curl.haxx.se/mail/lib-2012-06/0334.html)

[http://daniel.haxx.se/blog/2012/06/28/darwin-native-ssl- for-...](http://daniel.haxx.se/blog/2012/06/28/darwin-native-ssl-for-curl/)

</comment></comment><comment><USER27> So, was this plus automatic updates over SSL one of the ways the NSA could access "any iOS device"?

<comment><USER28> Potentially. This exploit was known to apple for some period of time, if NSA has access to the internal apple bug tracker, then they could certainly exploit the bug.

<comment><USER29> They'd also need access to Apple's private keys.

<comment><USER19> Not at all: that's the bug. It's not properly verifying that the other-end of a TLS session is the entity able to sign with the certificate-declared private-key.

<comment><USER30> Most likely hrrsn was referring to code-signing keys. Even if you can successfully MITM a software update connection, iOS won't run your trojan unless it's got a valid signature.

Of course the jailbreaking community knows well that there have been many ways around that...

</comment></comment></comment></comment></comment><comment><USER31> If I believe [1], 4% of all the iOS devices are still on versions earlier than 6, and will not be patched to this specific issue. This is pretty severe. I wonder (but presume not) if Apple is going to issue patches for earlier versions.

[1] [http://appleinsider.com/articles/13/12/31/ios-7-now- installe...](http://appleinsider.com/articles/13/12/31/ios-7-now-installed- on-78-of-active-apple-handheld-devices)

<comment><USER32> If 96% of the installed base gets this patched more or less immediately, the situation is endlessly better than a similar situation would be for Android, given most manufacturers and operators' lack of interest in providing software updates.

</comment></comment><comment><USER33> Sounds like a classic Man-in-the-Middle (MITM) attack.

Just a guess, but from the short description I suspect if you have control over DHCP you can get iOS to use your proxy. From there you can use something like mitmproxy ( [http://mitmproxy.org/](http://mitmproxy.org/)) to forge SSL certificates on the fly and intercept and decrypt SSL traffic without any warnings showing up on the iOS device.

<comment><USER34> You can do that but you'll be throwing certificate errors everywhere if they're self signed. By the sounds of it this is a bypass or method of getting around the CA altogether.

<comment><USER35> Yes, normally certificate errors would be thrown.

In this case Apple is not performing the domain validity checks on the presented cert. This allows an attacker that is performing an mitm attack to present a valid cert for another domain and establish an SSL connection with the victim.

<comment><USER34> Ugh, that's unbelievably awful.

</comment></comment></comment></comment><comment><USER9> SSLVerifySignedServerKeyExchange in [http://opensource.apple.com/source/Security/Security-55471/l...](http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c?txt)

If you want to see my favorite SSL bug ever.

<comment><USER36> Oh god, that's horrifying. Get ready to check certificate validity, then report success before actually checking validity!

</comment></comment><comment><USER37> It's not just cURL. It's much bigger, and much worse.

[http://pastebin.com/Yb6pUvr6](http://pastebin.com/Yb6pUvr6)

<comment><USER38> So, I'm not sure about that one. Apparently s_client ignores the error and completes the connection because it's intended to be used for debugging.

> Currently the verify operation continues after errors so all the problems > with a certificate chain can be seen. As a side effect the connection will > never fail due to a server certificate verify failure.

[https://www.openssl.org/docs/apps/s_client.html](https://www.openssl.org/docs/apps/s_client.html)

[https://www.mail-archive.com/openssl- firstname.lastname@example.com/msg71...](https://www.mail-archive.com/openssl- firstname.lastname@example.com/msg71136.html)

<comment><USER37> The s_client connection continues but should still report a verify error. On Linux:

[http://pastebin.com/QWpSrR5p](http://pastebin.com/QWpSrR5p)

</comment></comment></comment><comment> shawn-butler Doesn't affect any app using SSL pinning.

I have been trying to work on an implementation of TACK to mitigate headaches involved in pinning. Wish I had more free time.

[http://tack.io/index.html](http://tack.io/index.html)

<comment><USER39> Yeah the biggest problem with mobile devices I see that desktop applications have less often is crypto problems..It will get better as the time goes on.

</comment></comment><comment><USER32> Bad as it may be, the fix Apple is pushing will reach roughly 95% of the installed base more or less immediately.

I can't help wonder how much worse a similar situation would be for the Android ecosystem, with the poor update track record of operators and OEMs.

<comment><USER40> Google would just push an updated Chrome app which soft fixes it for many use- cases.

</comment></comment><comment><USER41> Wow, this sounds bad. It sure would be nice if Apple gave us a little bit more information, like when the bug was introduced and what exactly was not being verified. Until we get more information, you should assume the worst that all your IOS TLS traffic might be compromised.

</comment><comment><USER42> Maybe Apple should stick to hardware.

Just sell me the beautiful hardware.

I'll manage installing an OS that's 1\. audited by a community of volunteers I generally trust and 2\. can be audited (read: modified) by me: I can compile it from scratch.

Apple's OS offerings provide neither 1 nor 2.

But, go figure, Apple's OS offerings are based off of OS code that is both 1 and 2.

Like a "Linux distro", Apple gives me a lot of stuff I do not want or need, and makes it very difficult if nt impossible to remove.

I want a very minimal BSD or Plan9 OS running on my Apple hardware.

And nothing more.

Hardware we purchase should come with full documentation for writing drivers.

If enough users demand this, maybe someday it will.

<comment><USER43> What's stopping you from installing FreeBSD or Apple's hardware?

Everything has bugs, community volunteers are not infallible. It's good to be able to audit the things you use, but most people can't or won't do it.

</comment></comment><comment><USER44> Since the source code is available, might it be possible to produce a hot patch to the binary so that those of us running Mavericks won't have to go through the next few days or weeks with our pants down? It would be a simple matter of finding the JMP instruction generated by the second GOTO and replacing it with no-ops. How hard could it be,at least for someone who actually knows their way around OS X binary file formats?

<comment><USER45> _" It would be a simple matter of finding the JMP instruction generated by the second GOTO and replacing it with no-ops."_

Only if they used a truly stupid compiler. Chances are the unreachable code behind it got optimized away.

<comment><USER44> Oh, right. (duh)

</comment></comment></comment><comment><USER46> Does anyone know if this is an issue at the Foundation API level (affecting any apps using NSURLConnection, for example) or if it's a Safari issue?

<comment><USER47> It's actually the reverse: Safari at least performs additional checks and does not appear to be affected, which would explain why this wasn't noticed faster. The big question is whether those checks are specific to Safari or to a higher-level API which most Cocoa apps would use.

</comment></comment><comment><USER48> How do you not notice this? Maybe a lot of SSL interception is done with self signed certs and not ones that are signed by a valid CA?

</comment><comment><USER34> Does this contain patches for the jailbreak?

<comment><USER49> No, apparently. See [https://twitter.com/winocm/status/436923366147375104](https://twitter.com/winocm/status/436923366147375104) and [https://twitter.com/winocm/status/436923608762695680](https://twitter.com/winocm/status/436923608762695680) for a jailbreak developer saying that it doesn't seem to fix any jailbreak bugs. He's not one of the developers of the iOS 7 jailbreak, but he knows what he's talking about.

</comment></comment><comment><USER50> Are there any known software updaters that rely only on Secure Transport hostname checking for update authenticiity?

If you use NSS-based browsers exclusively on OS X, can you have been pwned via fake updates due to this bug?

</comment><comment><USER51> lol oops</comment>


Overcoming the Fear of Failure - <AUTHOR> http://www.goal-setting-guide.com/overcoming-fear-of-failure.html

<comment><USER2> Step nine: Spend all the time you would of spent at goal-setting-guide.com doing something useful.

If you have some real obstacle to doing the shit you want, bite the bullet and go see a real shrink. There is no shame in it (for someone as crazy as you) no one thought you were sane anyway, and the people in your life will probably take up a collection.

Otherwise, get your work done. Bullet points telling you what to do to overcome fear are never going to be the thing that works. Never. I don't understand this self help crap. It's all bullshit. You don't need to overcome your fear of failure to get your shit done. All you need to do to get your shit done is get your shit done. To me, this self help shit is like spinning your tires when your stuck in mud, it just traps you more.

You think people who succeed have overcome their fear of failure? Fuck no. You don't need to be happy or self actualize or overcome your fear of failure or go on a vision quest to find your spirit platypus or deal with your repressed anger from childhood to start. You just start.

Also, for people who don't tend towards depression, twenty minutes of meditation a day is going to be more helpful then reading every self help blog.</comment>


How Hillary Clinton Adopted the Wonkiest Tech Policy Ever - <AUTHOR> https://backchannel.com/how-hillary-clinton-adopted-the-wonkiest-tech-policy-ever-116233462e42#.bnprt8w1k <comment><USER2> Beware, the return of the Clipper

[http://arstechnica.co.uk/information- technology/2015/12/what...](http://arstechnica.co.uk/information- technology/2015/12/what-the-government-shouldve-learned-about-backdoors-from- the-clipper-chip/)</comment>


Ask HN: How to Get Started with IBM Mainframe and Z/OS? - <AUTHOR> So, the whole mainframe thing is a black box for me. Mainly because it's not easy to go hands on a mainframe.<p>What's the best way to get into that whole world? <comment><USER2> SHARE is user group / association for people working with IBM mainframe type products. [http://www.share.org/about](http://www.share.org/about)

I taught CFEngine at one of their conferences (for managing Linux running on z/OS) and got exposed to more mainframe-y stuff than I ever had before in my career as a UNIX/Linux sysadmin.

What are you looking to do in the mainframe world?

You can also go to [https://www-03.ibm.com/systems/z/](https://www-03.ibm.com/systems/z/) and then ask for a quote and talk to a sales rep to price one out, you'll see what's involved and capabilities.

</comment><comment><USER3> I got into doing IBM mainframe stuff by becoming certified by IBM as a DB2 DBA on AIX/HPUX/Solaris OS, i.e. IBM, HP & Sun *nix systems. The block mode operations on mainframes quickly drove me away. After decades of experience with interactive systems, block mode was a rude step backwards. Mind you my experience was with "traditional" IBM mainframe OS, e.g. MVS. I did dabble with Linux on 370's and it was a pain doing Unix commands using block-mode.

Mind you, all of the above was quite a few years ago. Things may have changed since.</comment>


Google Coral Edge TPU - <AUTHOR> https://coral.withgoogle.com/ <comment><USER2> It is a small turnoff that you need to use their cloud model 'compiler' but I still think I might get the USB Dev device.

I am retiring in a couple off weeks from my job managing a machine learning team and I intend on being a 'gentleman scientist' studying things of interest, without worrying about immediate practicality. Of most interest is local ML using tensorflow.js and devices like the Edge TPU, and also hybrid symbolic AI and deep neural net systems.

Anyway, good to see competition for edge devices.

</comment><comment><USER3> > Upload your model

> It should take about one minute for compilation to complete.

...also, it should take about six months for Google to lose interest in this product, at which point the product you made when you integrated the Edge TPU -- is stuck without updates.

<comment><USER4> This kind of comment is getting really tired.

Can you show me statistically that Google is any more likely to discontinue something than any other startup? Or than Apple or Amazon?

A few people got upset about Google discontinuing Reader, but that was a looong time ago. And they've certainly discontinued other things to... but just like every other company.

<comment><USER5> [https://en.wikipedia.org/wiki/List_of_Google_products#Discon...](https://en.wikipedia.org/wiki/List_of_Google_products#Discontinued_products_and_services)

They seem to discontinue a _lot_ of products, including ones with fairly large user bases. It seems like a valid concern if you're going to try to build something on top of their stuff.

<comment><USER6> They seem to ship a lot of products too: [https://en.wikipedia.org/wiki/List_of_Google_products](https://en.wikipedia.org/wiki/List_of_Google_products)

Disclaimer: I work at Google.

</comment></comment></comment></comment><comment><USER7> Previous discussion: [https://news.ycombinator.com/item?id=19130896](https://news.ycombinator.com/item?id=19130896)

They mentioned previously that you had to compile your models on the cloud, and not locally on your computer. Not sure if they've changed this policy.

<comment><USER8> Doesn't look like it: [https://coral.withgoogle.com/web- compiler/](https://coral.withgoogle.com/web-compiler/)

The proprietary compiler thing sucks, but it is where a lot of the secret sauce is, unfortunately. But a binary wouldn't be too much to ask for...

<comment><USER7> Well then, its DoA. Not sure why any company would agree to these terms.

<comment><USER9> Agree it might be a dealbreaker for some. But right now there is not that much competition in the TPU for embedded space. NVidia Jetson and Intel Nervana are the only ones shipping? So if the TPU allows some company to do something not possible / much better than with Jetson, they will probably be willing to play that game.

<comment><USER10> It's starting to heat up. K210s are supposed to be pretty cool if you can put your hand on one.

</comment></comment></comment></comment></comment><comment><USER9> The baseboard and SOM module split looks very well done. The module includes CPU+RAM+EMMC in addition to the TPU, so a custom baseboard can be quite simple. A lot of audio input, ready for microphone arrays. Curious to see what role the M4F microcontroller will play, hopefully that is for some sleep/low- power usage where it can wake up the beefy CPU (and TPU).

</comment><comment><USER11> I wish Google created a development version of TPU for inference so that it's possible to debug models locally and then send them for training to the GCP.

<comment><USER12> Ya, I feel uneasy about this business model of creating hardware that you have to connect to a cloud service to actually use. Instead of vendor lock-in or proprietary drivers or whatever, it's a new form of locality-based lock-in.

Meaning, if I have an application that needs a big hot PCI-E card attached to a physical server I own somewhere, comparable to GPUs now, the TPU is not for me. But meanwhile, a bunch of NN research and frameworks on top of TensorFlow will treat these proprietary things as a first class citizen.

<comment><USER13> The lock-in, while bad, only affects the development of new models. These devices exist so that you can avoid the cloud for inference.

</comment></comment></comment><comment><USER14> The Edge TPU devices that Google has been promising since last year is now available under a new company called Coral. Would love to get one to compare to my Jetson TX2. The downside is that the unit can only use Tensorflow Lite.

E: Hah, seems like my topic got merged with this one. Interesting how I was short from OPs post by like a minute a two. Such a coincidence!

<comment><USER13> > a new company called Coral.

On that website, each page has the Google logo at the bottom and "Copyright 2019 Google LLC. All rights reserved.". Also, at [1], Google LLC is mentioned as manufacturer of the devices. At this point, Coral still seems to be a brand only, not a company. Maybe they just didn't want to harm/affect their "main" trademark with this. Or they actually do want to create a separate company and this is the first step.

[1]: [https://coral.withgoogle.com/legal/](https://coral.withgoogle.com/legal/)

<comment><USER15> Software Eng. with The Coral Project[0] here. Feeling a little odd with the same color (even the logo a bit) + name combo used for their TPU as we've used for The Coral Project for years now..

[0]: [https://coralproject.net/](https://coralproject.net/)

<comment><USER16> I'm sorry but isn't that the Coral color..?

</comment></comment></comment></comment><comment><USER17> Kinda surprised they went with the internal code name for this.

</comment><comment><USER18> The datasheet says it features a "Cortex M4 with 16 KB of instruction cache and 16 KB of data cache". As far as I know, M4 don't have L1 cache. Maybe they're using an M7? Or there's just simply no cache?

[https://coral.withgoogle.com/tutorials/devboard- datasheet/](https://coral.withgoogle.com/tutorials/devboard-datasheet/)

<comment><USER19> I don't think the M4 is a typo. Apparently it's based on the NXP i.MX 8M, who's block diagram definitley states Cortex-M4 w/ 16K L1 Cache: [https://www.nxp.com/products/processors-and- microcontrollers...](https://www.nxp.com/products/processors-and- microcontrollers/arm-based-processors-and-mcus/i.mx-applications- processors/i.mx-8-processors/i.mx-8m-family-armcortex-a53-cortex-m4-audio- voice-video:i.MX8M).

M4 application notes ([http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc....](http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dai0321a/BIHEADII.html)) says the M{-0..4} doesn't have any internal cache, but that it can be provided by the SoC. Presumably that's what's happening here -- although it seems weird that this can be called an L1 Cache (although I'm by no means an expert on this so can't really comment!).

</comment></comment><comment><USER20> Interesting that it's Debian Linux support only for the peripherals. I'd be interested to see if that support grows to other os's, especially if it's a restriction to adoption.

I'm not in the space per-say but what are the predominant OS choices for ML/AI Devs?

<comment><USER9> I think they just want to get things out quickly. Plenty of people will be willing to deal with limitations in an early phase. I'm sure that for the USB stick other Linux systems will follow, and probably Mac/Windows also. For the SOM they might stick with just Debian I guess. It is normal in embedded to just have one platform provided by the vendor, and everything else be "at your own risk".

</comment></comment><comment><USER21> They were handing the USB ones out today to attendees at the TensorFlow Dev Summit. I'll test mine later.

However I _really_ wish they would make something beefier, to compete with e.g. Nvidia's Xavier.

</comment><comment><USER22> Any details on how much this board costs? Also, how many TOPs the Edge TPU has?

<comment><USER23> Dev Board cost $149.99, says on the website.

<comment><USER22> Thanks. Somehow I missed that, even though it's in large print at the top. :)

How about the Edge TPU specifications? Did I overlook those too?</comment></comment></comment>


Project Babylon: Gerald Bull's Downfall (2006) - <AUTHOR> https://www.damninteresting.com/project-babylon-gerald-bulls-downfall/ <comment><USER2> This also plays a major role in Frederick Forsyths book "The Fist of Good". It pretty much mentions all the things in the article, I was actually surprised how accurate the book is.

</comment><comment><USER3> Ah brings back memories! Damn interesting.com was the site that hooked me onto evolutionary biology. The following article in particular: "Parasites of the brain" [https://www.damninteresting.com/nugget/parasites-on-the- brai...](https://www.damninteresting.com/nugget/parasites-on-the-brain/)

</comment><comment><USER4> I find the science and history of so-called "super guns" very interesting, and this article was no exception. Disappointed only slightly there wasn't more on the background of these weapons, such as the Nazi V-3 Cannon: [https://en.wikipedia.org/wiki/V-3_cannon](https://en.wikipedia.org/wiki/V-3_cannon)

If that's piqued your interest, you might also be interested in disappearing down the tangential rabbit hole that starts off with reading about Schwerer Gustav: [https://en.wikipedia.org/wiki/Schwerer_Gustav](https://en.wikipedia.org/wiki/Schwerer_Gustav)

<comment><USER5> Thanks for this, can't get crazier than Operation Upshot

[https://en.wikipedia.org/wiki/File:Operation_Upshot_test.ogv](https://en.wikipedia.org/wiki/File:Operation_Upshot_test.ogv)

</comment></comment><comment><USER6> Good novel: Frederick Forsyth — The Fist of God.

</comment><comment><USER7> There was a movie made about this guy back in the 90s. [https://www.imdb.com/title/tt0109650/](https://www.imdb.com/title/tt0109650/)

<comment><USER8> The movie is not very good sadly. It is a strange attempt to romanticize a man who ultimately just wants to make a really big gun because when he was a kid he wanted to build a really big gun.</comment></comment>


You Should Learn Regex - <AUTHOR> https://blog.patricktriest.com/you-should-learn-regex/ <comment><USER2> When I used to code in Perl (more than ten years ago) I tended to solve many many things using regexes. I tried to reduce many programming challenges into transformations that I could do via regexes. Why? Because regular expressions are first class citizens in Perl. And Perl made me learn and use them. (Reminds me of a an APL programmer that saw vectors everywhere.)

When I replaced Perl with Python in my toolbox I abandoned regexes altogether because I didn't know too many Python programmers using regexes.

Now a decade later I am realizing how often I do need regexes in my day to day tasks (using them in bash commands, in my editor, and even in Python sometimes).

<comment><USER3> Regex patterns might not be first class citizens in python, but they're easy enough to use, and I think they're ultimately more powerful than in Perl. I don't remember being able to use a callback to calculate my replace string as a function of the match results when doing substitution in Perl. It's super easy to do tokenization with python regexes. We lose first class patterns, but gain first class functions and classes :)

<comment><USER4> Not to mention that writing a composable first-class API to contruct regexes should be fairly elementary in Python.

<comment><USER3> oh what a good idea... wait, surely someone's already built this, right? like sqlalchemy's expression language, but for regex. If noone's built that yet, I'd build that.

</comment></comment></comment></comment><comment><USER5> One website I found extremely useful when initially learning regex was [http://regexr.com](http://regexr.com). It's got a great pattern builder, and hovering over each component explains what its actually doing.

</comment><comment><USER6> For those who prefer a more in-depth introduction than a blog post: Jeffrey Friedl's "Mastering Regular Expression"[1] covers the theory as well while still being very pleasant to read (I only know the first edition, apparently there are more recent ones).

[1] [http://shop.oreilly.com/product/9781565922570.do](http://shop.oreilly.com/product/9781565922570.do)

</comment><comment><USER7> haven't read/processed the article fully, some nitpicks:

* `\b([01]?[0-9]|2[0-3]):([0-5]\d)\b` you are using both [0-9] and \d, is that intentional?

* `cat test.txt | grep -E "^[0-9]+$"` UUoC and double quotes subjected to shell interpretation, should be `grep -E '^[0-9]+$' test.txt` or `grep -xE '[0-9]+' test.txt`

* `(?i)` won't work with `grep -E` (or at least not for me on GNU grep). features of BRE/ERE and PCRE like regex are very different - see [https://unix.stackexchange.com/questions/119905/why-does-my-...](https://unix.stackexchange.com/questions/119905/why-does-my-regular-expression-work-in-x-but-not-in-y)

* avoid parsing ls - [https://unix.stackexchange.com/questions/128985/why-not-pars...](https://unix.stackexchange.com/questions/128985/why-not-parse-ls) , use glob/find

* `.<star>?` again, this regex feature is not available with BRE/ERE, your example just happens to work. you can check it with `echo 'abc foo 123 bar 123' | perl -pe 's/foo.<star>?123//'` and `echo 'abc foo 123 bar 123' | sed -E 's/foo.<star>?123//'` (using <star> to avoid formatting issues)

<comment><AUTHOR> Thanks, that's all very useful feedback.

<comment><USER7> for the ls parsing example, you can do

shopt -s nocaseglob

ls ~/Downloads/*.{png,jpg,jpeg,gif,webp}

\----

for command line tools (grep/sed/awk/sort/etc), you can refer my ongoing project ([https://github.com/learnbyexample/Command-line-text- processi...](https://github.com/learnbyexample/Command-line-text-processing)) as resource :)

</comment></comment></comment><comment><USER8> A very extensive article, and it shows how powerful RXes are.

It makes a point, in "8.3 - For Problems That Don't Require Regex" that RXes should not be overused when a simpler solution exists.

But there are also problems that are better solved without RXes, but with a "parser" instead. The article mentions parsers, fails to mention that self- made parsers also provide solutions in the same problem space as RXes. Some communities (like the Haskell community) prefer parsers as they allow to be inspected, tested and typed. Parsers provide a more robust and hackable solution, that is possibly faster than the equivalent RX.

Here a short tutorial for a popular parser library in Haskell, to get an idea of what it's like:

[http://akashagrawal.me/beginners-guide-to- megaparsec](http://akashagrawal.me/beginners-guide-to-megaparsec)

</comment><comment><USER9> > From validating email addresses

Guys, no. Send an email. [https://davidcel.is/posts/stop-validating-email- addresses-wi...](https://davidcel.is/posts/stop-validating-email-addresses- with-regex/)

<comment><USER10> The article you link to addresses just the one use case where you are registering a new user. Email addresses in business applications are just as often NOT the address of your user. Sales contacts, managers, points of contact, customer support addresses, etc. -- none of these should ever be validated by sending an e-mail. So you still need to validate the hard way in plenty of scenarios.

<comment><USER4> ...but unless you actually send an email it is still just as unvalidated as it was before. Regexes aren't a tool to determine that a string refers to a mailbox capable of receiving mail.

If you use regexes (or any other method of that does not send emails) all you're saying is that you don't actually care whether or not the string points to a recipient (much less the correct recipient).

And don't get me wrong. It is absolutely okay to not care whether or not the string refers to a correct recipient. Most places that make me write my email have no business caring about it. But please also then make the field optional.

<comment><USER10> Regex validation cannot verify that an email address is functioning any more than it can verify that a phone number is functioning. But if an address or a number passes formatting checks, one can indeed consider that data "validated". That's what that term means in the business software development industry. We're verifying if the data entered COULD be correct, not double- checking that it IS correct.

You are correct to say that those emails may still bounce, and the phone calls may also not go through. We completely understand that. For this reason, in very specific situations (like registering a new user), we do take that extra step to make sure the communication channel actually works. But there are plenty of situations where that makes absolutely no sense, and/or adds very little value for the cost. Knowing the difference between these two very different use cases certainly does not indicate that these people "don't actually care" about the accuracy of their data.

<comment><USER4> And what I'm saying is that either the system _relies_ on functioning email addresses, in which case they need to be ensured to work anyway. ...or the system does not rely on working email addresses, in which case drop the pretense, make it an optional field and peoples' days will suck less.

Besides the practical issues mentioned, it's this no-brained "why the heck not" collection of personal data I'm turning against. Either you need the stuff and then you have to work for it, or you dont and then you have nothibg to do with it.

</comment></comment></comment></comment></comment><comment><USER11> I created a little web app to generate strings which match a given regex: [http://regexicon.com](http://regexicon.com)

It's useful to ensure you're not matching things that you don't mean to, which is a problem I often see when code reviewing regex.

</comment><comment><USER12> OP, your link to [http://regex101.com/](http://regex101.com/) is broken. It's my go-to web-app too.

<comment><AUTHOR> Thanks! It's fixed now.

<comment><USER13> Also the link in this paragraph:

> The source code for the examples in this tutorial can be found at the Github > repository here - [https://github.com/triestpa/You-Should-Learn- > Rege](https://github.com/triestpa/You-Should-Learn-Rege)

has a `href` of `""` which is making it point to the blog post itself.

</comment></comment></comment><comment><USER14> Regular expressions are super powerful and a great tool to have at your disposal. The best resource on the topic is the book "Mastering regular expressions" published by O'Reilly. Understanding the inner workings of a regular expression engine will improve your regular expressions. If you use regular expressions a lot, mastering them will be worth it.

</comment><comment><USER15> Yea learn regex, so you know when not to use it. For parsing non regular languages like XML...

</comment><comment><USER16> The OpenBSD re_format man page is a quick read and super clear and helpful: [https://man.openbsd.org/re_format](https://man.openbsd.org/re_format)

</comment><comment><USER17> This sounds like an article I would have written in college. In my experience, if you're using regex often enough to remember how to write patterns that are sufficiently complex to actually be useful beyond short 'pre-processing' snippets, you're overusing regex. (Or alternatively, your memory is significantly better and/or less divided than mine.)

</comment><comment><USER18> "Now you have two problems" . ;)

</comment><comment><USER19> The Sam language and editor may be of interest:

[http://sam.cat-v.org](http://sam.cat-v.org)

[http://doc.cat-v.org/plan_9/4th_edition/papers/sam](http://doc.cat-v.org/plan_9/4th_edition/papers/sam)

</comment><comment> le-mark Kleene Algebra, generalized regular expressions, for the adventurous [1].

[1] [https://en.wikipedia.org/wiki/Kleene_algebra](https://en.wikipedia.org/wiki/Kleene_algebra)

</comment><comment><USER20> I'm not a programmer, but I use Notepad++ and mp3splt, because I have uses for them. This might actually help me use the search functions more effectively.

</comment><comment><USER21> Some years ago I went through Regular Expressions Cookbook, By Steven Levithan, Jan Goyvaerts and can't recommend it enough.

</comment><comment><USER22> ...but..but.. then you'll have two problems!! right guys?

</comment><comment><USER23> Section 0:

`[0-9] - Matches any digit between 0 and -`

Mistype the `9` for a `-`. :-)

<comment><AUTHOR> Thanks, good catch!

</comment></comment><comment><USER24> Why the fuck on earth, people cat and pip stuff to grep ? grep cat take files from args !

<comment><USER25> I cat files into programs that can take their inputs both from stdin and a given file, although I know people call that "useless". I do it because it makes my pipelines more uniform, by keeping the direction of data flow from left to right. It also makes it easier to insert additional processing steps, or changing the input from a file to the output of a program. Maybe I'm a fool for writing Bash like Forth, but I prefer it that way.

<comment><USER7> you can still do `< test.txt grep ...`

see [https://en.wikipedia.org/wiki/Cat_(Unix)#UUOC_.28Useless_Use...](https://en.wikipedia.org/wiki/Cat_\(Unix\)#UUOC_.28Useless_Use_Of_Cat.29)

>Beyond other benefits, the input redirection forms allow command to perform random access on the file, whereas the cat examples do not. This is because the redirection form opens the file as the stdin file descriptor which command can fully access, while the cat form simply provides the data as a stream of bytes.

commands like `sort` are optimized to handle large input file

and how would you do `grep -l 'foo' *.txt` if you use `cat`?

or `awk 'NR==FNR{a[$1]; next} $1 in a' file1 file2`

or `grep -Fxf file1 file2` and so on....</comment></comment></comment>