Publishers sue Internet Archive over scanning of books - <AUTHOR> https://www.detroitnews.com/story/tech/2020/06/01/publishers-sue-internet-archive-over-scanning-books/5307678002/ <comment><USER2> My understanding is archive.org makes a scan of a copy they possess, and implement a checkout system. Only one person can view a scan at a time.

When the plaintiffs state:

> "Without any license or any payment to authors or publishers, Internet > Archive scans print books, uploads these illegally scanned books to its > servers, and distributes verbatim digital copies of the books in whole via > public-facing websites," according to papers filed Monday in federal court > Monday in New York. "With just a few clicks, any Internet-connected user can > download complete digital copies of in-copyright books."

that can be re-stated with respect to a public library which only has second- hand books. In that case, the library paid nothing to the authors or publisher, and they redistribute physical copies of the books in whole via public-accessible buildings. With just a few pen strokes, anyone in the district can obtain a complete copy of in-copyright books.

Which means I have little sympathy for the quoted complaint.

What archive.org does sounds like time-shifting. I wonder if that will be part of their defense.</comment>


Windows Task Scheduler Zero Day Exploited by Malware - <AUTHOR> https://www.bleepingcomputer.com/news/security/windows-task-scheduler-zero-day-exploited-by-malware/ <comment> FLUX-YOU >Malware developers have started to use the zero-day exploit for Task Scheduler component in Windows, two days after proof-of-concept code for the vulnerability appeared online.

That's not a zero-day.

It literally stops being a zero-day after the initial day.

<comment><USER2> I don't know what communities you hang around, but there has never been some strict definition of 0day in infosec. 0day colloquially applies to anything circulating that didn't follow reasonable vendor disclosure, as was the case here

<comment><USER3> What? First time I hear of it. Not infosec, and yet I was under impression _for years_ now that in colloquial usage, "0day" means "exploited before the problem was known publicly". It stops being a 0day after any info about it hits the press/social media.

<comment><USER4> Once a zero-day, always a zero-day IMO.

<comment><USER5> What is it called the day after you are aware of it. Zero day still? That makes no sense.

<comment><USER6> It makes sense if you think of the identifier "zero day" as a sort of birth- identity.

As far as I'm aware 0day refers to having zero days of notice to fix the bug. That doesn't change the day after it comes out, it's still zero days of notice.

</comment></comment></comment></comment></comment></comment><comment><USER7> Previous discussion about the exploit when it was first tweeted: [https://news.ycombinator.com/item?id=17859589](https://news.ycombinator.com/item?id=17859589)

</comment><comment><USER8> Interesting, with all of the money that Microsoft has, why can't they fix these backdoors and exploits? For many years now, MS Windows has been the "most" exploited OS in our history.

Maybe they're under an NDA with our, USA government thus allowing all these issues to exist.

I know they can fix these issues. They have the manpower and money to do so.

The community should start pressuring them to fix their OS and plug those back door holes and exploits.

Peace

<comment><USER9> > MS Windows has been the "most" exploited OS in our history.

Doesn't look that way

Top 50 Products By Total Number Of "Distinct" Vulnerabilities [https://www.cvedetails.com/top-50-products.php](https://www.cvedetails.com/top-50-products.php)

      Vulns  Product

1\. 2124 Linux Kernel Linux OS

2\. 2084 Mac Os X Apple OS

3\. 1924 Android Google OS

4\. 1741 Firefox Mozilla App

5\. 1664 Debian Linux Debian OS

6\. 1546 Chrome Google App

7\. 1495 Iphone Os Apple OS

8\. 1123 Ubuntu Linux Canonical OS

9\. 1103 Windows Server 2008 Microsoft OS

10\. 1057 Flash Player Adobe App

11\. 984 Safari Apple App

12\. 961 Windows 7 Microsoft OS

13\. 951 Internet Explorer Microsoft App

14\. 951 Acrobat Adobe App

15\. 856 Thunderbird Mozilla App

16\. 818 Windows Vista Microsoft OS

17\. 784 Opensuse Novell OS

18\. 731 Windows Server 2012 Microsoft OS

19\. 731 Windows Xp Microsoft OS

20\. 698 Seamonkey Mozilla App

21\. 685 Acrobat Reader Adobe App

22\. 665 Windows 8.1 Microsoft OS

23\. 641 Mac Os X Server Apple OS

24\. 636 Windows 10 Microsoft OS

<comment><USER10> That list inconsistently splits some things by version (windows), and groups others (Debian, android, etc).

What it says is that a _single_ version of Windows had more than half as many CVEs as the entire Linux kernel has ever had. That doesn't exactly support what you are trying to convey. If you add up all windows versions, it would top the list.

<comment><USER9> That's because the vulns are repeated across the Windows versions, adding the versions together counts the same vuln multiple times

<comment><USER11> I'm not sure if it's worse to have the same vulnerability across two versions, or to have two distinct vulnerabilities.

<comment><USER10> It's almost like saying "vulnerabilities in our code exist for decades before they are noticed by anyone (with a whitehat)".

Sure, that happens in open source projects too (openssl anyone?), but it seems like an exception rather than a rule. If there are so many of these multiple- version vulnerabilities in Windows that the author of the list had to specifically break Windows into individual versions, then that speaks for itself.</comment></comment></comment></comment></comment></comment>


Congratulations Crunchies, Winners. GitHub Wins Best Overall Startup - <AUTHOR> http://techcrunch.com/2013/01/31/congratulations-crunchies-winners-github-wins-best-overall-startup/

<comment><USER2> Very surprised that Elon Musk was runner-up for founder. The guy is tackling some of the toughest, most important problems in the world that most fear of even thinking about. Not to diminish Kevin Systrom's accomplishments, but I just think that the amount Musk has accomplished with his (three?) companies is tremendous.

<comment><USER3> If you're counting total companies he's involved with:

1\. Zip2

2\. X.com -> PayPal

3\. SpaceX

4\. Tesla Motors

5\. SolarCity (albeit his idea, he doesn't take cofounder title here)

But currently, yes, three. However I believe majority of time is spent mostly with SpaceX. I do agree he should have won Founder of the Year.

</comment></comment><comment><USER4> This is why I have zero respect for Techcrunch and any of its events/contests.

What the fuck! Kevin Systrom over Elon Musk? Seriously??

So, a guy who made a bunch of photo filters for a virtual world is better than a guy who worked REALLY HARD to take REAL WORLD travel to the next level? Seriously??

<comment><USER5> Does it makes sense to idolize either of them? There are hundreds of people involved in the success of SpaceX.

<comment><USER4> Nope. I don't idolize one over the other. But I'm genuinely angry that someone who has worked hard to improve the quality of our daily life hasn't got the attention/credit he deserves. And it's frustrating that someone who actually made something useless (a LOT of people take instagram photos of their pancakes than just eat it) and someone who intended to claim ownership of your content got something more than the genuine contributor to our living standards, which in this context is Elon Musk.

</comment></comment></comment><comment><USER6> The concept of Oscar-style awards for startups makes as much sense as Toddlers and Tiaras. No, make that Embryos and Tiaras.

I am appalled to see this on the front page of HN.

<comment><USER7> Lighten up a tad? Its on the homepage because people voted it there.

<comment><USER8> Which makes it a criticism of the community rather than some curator. It's a valid, if not entirely productive, criticism.

</comment></comment></comment><comment><USER9> How does Google glass win runner-up for best tech achievement? Very few people have actually seen what it is capable of and what it actually looks like.

<comment><USER10> Exactly. So far they've demonstrated nothing more than a camera.

<comment><USER11> The blimp stunt was pretty nice.

</comment></comment></comment><comment><USER11> Instagram was bought in April. Does it really qualify as startup?

</comment><comment><USER12> Do they have the _reasons_ for the decisions anywhere? For the "Biggest Social Impact" category it's definitely the case that reddit has had a quantifiable social impact, but more so than Kiva, or Kickstarter? Also, why was Indiegogo a runner up and not Kickstarter? isn't indiegogo just kickstarter but less stringent on the project approval, kickstarter has become synonymous with crowdfunding.

</comment><comment><USER13> I'm not understanding how this techcrunch post was posted two hours ago, and has only one comment (and rather spammy)?

I haven't been there for ages, so if someone could enlighten me to whatever happened there?

<comment><USER14> Techcrunch has declined a LOT over the last few years.

That, along with a lot of better blogs and sources of tech information mean that they have a big readership but it is quite shallow as far as engagement

</comment></comment><comment><USER15> It would have been hilarious if grindr had won best mobile app...

Oh well, next year!</comment>


New Amazon Linux Container Image for Cloud and On-Premises Workloads - <AUTHOR> https://aws.amazon.com/blogs/aws/new-amazon-linux-container-image-for-cloud-and-on-premises-workloads/ <comment><AUTHOR> Anyone looking to use this outside AWS?</comment>


'Groupon Should Have Been Built as a Technology Company' - <AUTHOR> http://statspotting.com/groupon-should-have-been-built-as-a-technology-company/ <comment><USER2> I don't think groupon's demise has anything to do with investment in technology or otherwise. More, they sold local businesses on the idea of giving away deals on the basis that deal takers would become repeat customers. Small businesses soon learnt that deal takers never come back.

Althought a small sample size, I learnt this by talking to small businesses who used groupon. All of the them talked about entitled deal takers coming in and upsetting their business.</comment>


Readability can mislead - <AUTHOR> http://www.cs.uni.edu/~wallingf/blog/archives/monthly/2013-03.html#e2013-03-11T16_25_31.htm

<comment><USER2> Wow. The code mentioned (J compiler source) has to be seen to be believed. Here is a snippet:

        static F1(jtthn){A d,t,z;C*tv,*x,*y,*zv;I c,*dv,k,m,n,p,r,*s,wd;VF fmt;
         n=AN(w); r=AR(w); s=AS(w);
         thcase(AT(w),&wd,&fmt);
         GA(t,LIT,wd*(1+n),1,0); tv=CAV(t);
         if(1>=r){p=thv(w,AN(t),tv); ASSERTSYS(p,"thn"); AN(t)=*AS(t)=p; z=t;}
         else{
          c=s[r-1]; m=n/c; k=bp(AT(w));
          y=tv-wd; x=CAV(w)-k;

The function is in a file conveniently called "f.c", and I cannot find any explanation for the abbreviation "jtthn" nearby. It seems to be a prefix to "thn". "thn" does not appear to be defined anywhere in the J documentation. Maybe it's a combination of letters that would make sense to a J expert?

Now, if the reason for this is to save typing, fine. If it's the best way for the people who are working on the compiler to work (no pesky time spent writing comments), and they don't care whether anyone else understands, fine. I don't think that code authors have any particular responsibility to make their work understandable or modifiable by others, if they don't want to.

But the idea that this provides a reasonable barrier to entry, as suggested in the article, that learning how the code works is a reasonable rite of initiation because only the initiated need bother modifying the code, is simply arrogant. Yes, once code gets very verbose, adding further verbosity and explanation is putting lipstick on a pig - it won't help someone who doesn't understand understand, and it's no use to someone who does. But this code is nowhere near that point, I suspect even for someone who knows J. I am capable of understanding how a compiler works, but if I were ever called upon to debug this one, the code would make me waste my time understanding its idiosyncrasies before I could get to the meat of things.

The format is at best a necessary (useful?) evil, not something to celebrate. A few longer names or comments would go a long way.

<comment><USER3> That looks like typical code written by a mathematician. Look online for implementations of various mathematical algorithms and you'll get more code like this than you'll ever wanted to ever see.

<comment><USER2> That's an interesting thing to say, because from my unskilled perspective, a set of equations in a math paper really does often require enough background knowledge and deep understanding that there's not much point giving variables long names - you'll have to study it for a while anyway. Code is not like that; it's fluffier, and can usually be understood on a first read (and there's more of it), so long names are useful.

But maybe I'm just saying that because I'm better at code than mathematics?

<comment><USER3> I think it has more to with mathematicians seeing programming as nothing more than an implementation detail. They spend their time designing an algorithm on paper, writing a paper on it and probably has a whole pile of versions sitting on his desk. They see no value in the program itself and thus they simply translate the formulas to source workout any thought of it being maintainable or even understandable.

That said, I do remember seeing mathematicians calling for a better math notation that emphasises readability and longer variable names. I'm not so sure it'll happen though. I prefer to simply avoid having them write code others have to maintain.

<comment><USER4> I think there is a lot more to this. Yes, better naming can help at times but when a mathematician is looking at math they are seeing structure. It is a different mode of perception than reading a program as a narrative.

It's not better or worse, it's just different.

</comment></comment></comment></comment></comment><comment><USER5> One difficulty with these discussions it that there is no standard, objective definition of readability. Without one, it's hard to debate statements like the title of this thread, "Readability can mislead".

After thinking about this a lot, I settled on a personal definition of "ease of extracting useful information from the code". This recognises some principles I've found to be important when discussing readability and how to improve it. For example, different knowledge will be useful depending on what you're trying to achieve and what you already know, so code may be more readable for some purposes than others. Similarly, information may be relatively easy to extract for someone with one background or set of tools but harder for someone else to obtain under different circumstances. This means readability is always a balancing act, and something that makes code more readable for one purpose or reader may actually harm the readability in another context.

This explains a lot of subjective preferences based on the reader's background. For example, in the _Good for Whom?_ article by Daniel Lyons[1] that was cited by the article we're discussing, there is a question of whether a one-line regular expression does anything to aid readability, and whether a much more verbose Smalltalk-style implementation of the same logic is more readable. I believe the most important thing to recognise in that debate is that the readability of the regex version is dramatically different depending on whether the reader understands regex syntax. If so, it is probably much easier to read than the long form version, but if not, it's just executable line noise. Therefore whether it is helpful to employ a regex for that task depends a lot on who you expect to be reading the code later and what assumptions you are willing to make about their skills and knowledge. A similar dilemma is almost inevitable when choosing almost any significant coding standard.

[1] <http://www.storytotell.org/essays/good-for-whom.html>

<comment><USER6> I think that Marick's comment in the article expresses this well.

</comment></comment><comment><USER7> > Lyons is skeptical about claims that readability increases the chances that > a language will attract a large audience.

The article makes an important point but I've always interpreted readability in terms of expressiveness: To what (admittedly qualitative) extent does the language help a fluent developer write readable code (where each line flows naturally from the next)?

Rather than attracting people to the language, it's about hitting that sweet spot where the code is highly "compressed" yet still has a natural syntax without being opaque. I find that the syntactic overhead imposed by some languages (i.e. those that don't require indentation or which lack array literals, for instance) has less of an effect on readability than the author's skill. PHP has these flaws but can still be quite readable, and in that sense readability should be attractive.

<comment><USER8> Which language has "natural syntax"? Answer: the one with the most similar syntax to the one you know best.

<comment><USER9> Maybe it's because I was introduced to both Ruby and Python early on in my career but I disagree. There are languages that encourage writing semantic code and thus making readability a function of how close the code is to an english description of how to implement the task at hand.

<comment><USER10> So, because you're most familiar with English syntax, the most readable programming languages are the ones which most closely approximate it? Doesn't sound like a disagreement with Evbn's point.

<comment><USER9> Do you use any programming languages that don't use English syntax?

<comment><USER10> I don't use any programming languages that _do_ use English syntax - I'm not even aware of any such programming languages - and I don't really understand the position that the optimal language for issuing instructions to a computer is the one that looks most like a language meant to facilitate dialogue among human beings.</comment></comment></comment></comment></comment></comment>


Examining Pointer Authentication on the iPhone XS - <AUTHOR> https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html?m=1 <comment><USER2> I love project zeros write-ups, but I wish they published more about Android.

<comment><USER3> I remember seeing more Google product related articles on their blog up until a couple of years ago. Then they stopped or slowed down, or at least they seem to concentrate a lot more on Apple and Microsoft. I guess some bugs are disclosed internally and fixed before they go public and some may not warrant blog posts.

I am sure they're working on finding bugs in Google code but just like any other company they're not going to shoot themselves in the foot by advertising these internal findings more than needed.

<comment><USER4> Just to take a look I opened the Project Zero main blog page and the newest article was on a bug in [https://github.com/google/skia/](https://github.com/google/skia/) so I'm not sure I can take your comment with any ounce of credibility.

</comment></comment></comment><comment><USER5> So Apple publishes some kernel source code under a license that basically only permits you to look at it, presumably for security researchers. Apple then also redacts security related code from the published code, going so far as to partially redact functions, only making them appear complete. Weaknesses are then found, of course, in code they redacted.

Feeling a bit schizophrenic here.

<comment><USER6> I didn't see the article say anything about redacting code? The XNU kernel (used in macOS and iOS) is open-source and has been for some time: [https://github.com/apple/darwin-xnu](https://github.com/apple/darwin-xnu)

My reading of the article was that Apple has some custom logic in the A12 (for the implementation of the pointer authentication extensions) and have made some (unreleased) modifications to the XNU code to utilize that custom logic. The article is the author reverse-engineering the unreleased modifications and working out how they interact with the A12, to try to discover exploitable weaknesses in the implementation.

<comment><USER7> From the article:

> The part [of the comments in the released source] about the "pointer" > containing authenticated, hasBKey, and hasDKey bits suggests that this code > is dealing with authenticated pointers, although all the code that actually > performs PAC operations has been removed from the public sources.

The researcher suspects Apple started with a version of the XNU code that supported the A12 logic, then removed the lines of code that actually performed the operations before publicly releasing it. In other words, Apple redacted security-related parts of the XNU source.

To me, at least, that's different from Apple creating a new XNU version that supports pointer authentication and not releasing it at all.</comment></comment></comment>


Hidden features of Python - Stack Overflow - <AUTHOR> http://stackoverflow.com/questions/101268/hidden-features-of-python/102062 <comment><USER2> Dupe of:

\- <http://news.ycombinator.com/item?id=1512930>

\- <http://news.ycombinator.com/item?id=594210>

I don't mind being reminded to see if there's anything new, though.

<comment><AUTHOR> I've seen it here before, but yesterday I happened to stumble across it again, learned something new, and figured maybe other people on HN would benefit from it too.

</comment></comment><comment><USER3> Hidden features in a programming language? Granted, most of these aren't "hidden", but they're nonobvious because the language is incredibly complex and it's difficult to predict from first principles that any of these things would actually work.

Long ago, a rule of programming language design was handed down by the great old hackers, but it has been forgotten and much needless effort has been spent as a result. It's time to remind language designers of the rule again:

"Programming languages should be designed not by piling feature on top of feature, but by removing the weaknesses and restrictions that make additional features appear necessary."

<comment><USER4> Can you go into specifics about how any of these examples are non-obvious because the language is incredibly complex?

In the context of higher level and or dynamic languages, I'd argue that Python is rather low on the complexity scale

<comment><USER5> Yes, and some of those `hidden features' are just nice library functions that avoid adding features to the core language. Look at `enumerate' and `zip' for example, which allow Python to get away with one very simple for-loop.

</comment></comment></comment><comment><USER6> Obligatory XKCD: <http://xkcd.com/353/>

<comment><USER7> XKCD is _never_ obligatory.

Seriously, why is anyone "obligated" to post a comic that mentions Python, but adds nothing of substance, and isn't even funny? ([http://www.google.com/search?q=site%3Anews.ycombinator.com+%...](http://www.google.com/search?q=site%3Anews.ycombinator.com+%22obligatory+xkcd%22))

<comment><USER8> Let's be fair. It was funny the _first_ time I saw it.

<comment><USER7> Damning with faint, faint, faint praise.

ObPython: Learn Smalltalk too!</comment></comment></comment></comment>


Angular6 UI kit NG-SQ-UI - <AUTHOR> https://github.com/SQ-UI/ng-sq-ui <comment><AUTHOR> Please try out our UI kit and send us feedback (bug reports) or feature requests. [https://github.com/SQ-UI/ng-sq-ui/issues](https://github.com/SQ- UI/ng-sq-ui/issues)

</comment><comment><USER2> Or, alternatively, you can join our slack and drop us a line: [https://goo.gl/jJvsaf](https://goo.gl/jJvsaf)</comment>


A Proper Server Naming Scheme - <AUTHOR> https://www.mnxsolutions.com/devops/a-proper-server-naming-scheme.html <comment><USER2> What are the advantages over treating servers as cattle?

[http://www.tomsitpro.com/articles/openstack-pets-and- cattle,...](http://www.tomsitpro.com/articles/openstack-pets-and- cattle,1-1759.html)</comment>


Cards Stolen in Target Breach Flood Underground Markets - <AUTHOR> https://krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/ <comment><USER2> I was just thinking whether I had ever bought anything at Target, and then remembered, yes, but that's 7 years ago, and I've gotten new credit cards since. But then I wondered which other online services I had used with my credit card, and it occurred to me how awesome it would be if I had one-time throw-away credit cards, that I could use for only one purchase at one retailer and then throw it away. Now, I know that gift cards work this way, and could theoretically be used in such a way, but they're usually locked to a specific retailer or one can't use them for online purchasing.

Then I realised that, really with all the flack it is getting, Bitcoin is such a solution. Once the conversion from $ to BTC is done, there's no way to get your credit card data or anything. You're practically immune against any data theft at the place where you're purchasing. Now, of course the problem only shifted as you have to guard your private keys now, but that's more or less a question of tooling and usability of proper BTC clients (which hopefully come up in the future). I'd rather have the valuable information stored in an open source application used by millions with strong code review, than in a closed source web app where an intern wrote the code in php and forgot the salt or stored everything plaintext.

This alone sounds to me like a pretty strong incentive.

<comment><USER3> BofA has a feature called ShopSafe that lets you generate virtual credit card numbers tied to your main card. They got it when they acquired MBNA/FIA Card Services. According to the Wikipedia article[1] a couple of other banks have offered similar services over the years as well (though looks like a couple have been canceled).

With ShopSafe, each virtual card has a custom expiration of 2-12 months, a max spending limit (ex: $100), and only a single merchant can bill to it. That last feature is important as it means that even if it's leaked before the shorter expiration period nothing should be able to be charged to it. Recurring charges _are_ possible though (ie the same initial merchant can charge you again) so you can use it for situations that require recurring billing. Either way the spending limit still applies.

Anonymity aside, I'd argue that virtual credit cards are even better than BTC from a consumer's perspective as you still have the power of charge backs. Each one has the same rights as your original card including the right to declare a purchase as fraudulent ( _ex: the merchant didn 't ship the goods_).

Would be cool if someone would create a physical version of these virtual cards that gets created on the fly for each transaction. I was hoping that Coin or one of the other "virtual physical cards" would do that but I guess that'll come later.

[1]: [http://en.wikipedia.org/wiki/ShopSafe](http://en.wikipedia.org/wiki/ShopSafe)

<comment><USER4> Central Europe has good security tools for this. For example whitelist for transaction. Or approval for each transaction via SMS. Or temporary unlocking card while shopping

</comment></comment></comment><comment><USER5> Recent stolen credit card number story:

Last week I got an email saying I made a $1,000 payment on my credit card. Except, I didn't. It wasn't bill pay time of the month. I brushed it off as a well formatted spam.

An hour later, it still bothered me. I logged in to check. Yup, there was a $1,000 payment recorded as of 4am my local time the same day. WTF? Oh, look, there's also fraudulent charges showing up now. How odd.

It turns out: my card didn't have enough free on the credit line for the losers to buy their xbox, so they _called in_ and requested a $1,000 payment from my bank account on file. The credit card company happily issued it, my credit limit increased by $1,000, then the guy went out and bought his xbox.

While I was on the phone explaining this to the credit card company, three more fraudulent charges showed up in pre-auth.

Incompetents all around (except for whoever stole my credit card number).

The whole "stolen credit card number" doesn't hurt very much (since all bad charges are covered), but what _really_ is annoying is someone getting away with purchasing things fraudulently.

<comment><USER6> Then pile on the fact that I've tried to use my AX legitimately to buy hardware over the last month and was denied 2 separate times because it 'seemed suspicious'. Really makes you wish for a more secure payment system which can be used for such transactions.

<comment><USER7> I'm curious, my purchase history with my CC was generally local stores, groceries, gas, restaurants. Large purchases were rare, and then I finally bought some computer hardware (~1k purchase for the whole kit, all at once). BoA called me and confirmed it wasn't fraudulent, things went on. Then I moved and hadn't spent much in the new area (I use cash most of the time), when I finally decided to upgrade from my 13" CRT. Go into Best Buy, pay with the CC, again BoA called me and once the call was through the transaction cleared and I had my new TV.

Does your CC company not call to confirm things? Were the purchases clearly out of line with your previous purchase history (by location, type or amount)?

</comment></comment></comment><comment><USER8> Personal anecdote and tips:

I had my debit card skimmed at a local gas station in October. Within a couple hours, it was being used at stores in Los Angeles. I live a 3+ hour drive from LA so there's no way the skimmer/data was physically taken down there–the data had to have been transferred (cell?) to someone down there pretty quickly.

My card was used at a restaurant and a few different stores, but several times per store. Total amount charged was about $2K. All purchases were < $100 and most purchases were for very even amounts at drug stores. Based on research, this is because buying gift cards is a favorite use of stolen cards. Gift cards can be turned into cash online for about 75-85 cents on the dollar.

Chase was very good about freezing the card and crediting back all the fraudulent charges.

TIPS:

\- Use cash or a gas card for gas OR at the very least, use a pump close to the cashier

\- Debit cards have a reputation for having less protection than credit cards. At least at Chase, this is no longer true. Chase has zero-liability for unauthorized debit card purchases [1]

\- Check your online banking often

\- Don't rely on your bank's automated fraud detection. Most alerts I've received from Chase have been false positives (legitimate purchases while traveling).

[1] [https://www.chase.com/checking/debit- cards](https://www.chase.com/checking/debit-cards)

<comment><USER9> I've also had plenty of false positives, but my bank (Bank Of America) has caught multiple actual fraudulent charges. It's easy to hate on big banks and big data and the loss of privacy, but it's pretty cool when your bank calls you up and says "We don't think that was you buying skateboards and polo shirts in Eastern Europe."

<comment><USER10> I live in a sort of love/hate relationship with BoA's fraud-detection system.

On the one hand, I had a number genuinely stolen a while back in the PSN hack, and a case where someone tried to use my debit card in a hotel in Tennessee. In both cases, I got a phone call almost immediately, was out zero dollars and had a new debit card number within 24 hours.

On the other hand, I travel a lot. Emphasis on _a lot_. And I have begun simply planning trips around the expectation that at least one of my BoA cards will be frozen every time I do so, because their systems don't seem to actually work off usage patterns. Instead, use of the card beyond a certain mileage radius from home address triggers a fraud alert. So even though quite a bit of my travel is to a small number of cities, I still have to deal with occasional random fraud alerts freezing my cards (example: I've been to Washington, DC around six times in the past year. Despite that -- and despite making the booking in advance, including the card number -- I still had one of my cards frozen when trying to check into a hotel there a while back).

Their customer service people have confirmed that it's just mileage radius, and anecdotally it seems that the radius is around 600 miles (I am based near Kansas City, and can safely use BoA cards in Denver and Chicago, but has a problem once in Austin, IIRC). Which probably makes sense for most people, but I am more than 600 miles from home at least a couple times every month. And there seems to be nothing for it aside from calling their fraud-prevention department every time I'm about to go somewhere, which is equally impractical.

<comment><USER9> For what it's worth, I found out that you can inform BofA about your travel plans via online banking. A lot faster than calling the fraud prevention line.

</comment></comment></comment></comment><comment><USER11> I bought something from Target in this window with a credit card (Wells Fargo).

I called them up to proactively report it stolen - the problem is they will immediately deactivate your current card and it takes 7-10 business days for the new one to show up. It is not possible to get a 2nd card number without deactivating the first (to avoid a no-card for 2 weeks situation). Or you can have them overnight it to you for $16.

Kind of annoying to pay $16 for a merchant error, or to not have your primary card for 2 weeks during the holiday season (and also the card you use to pay all service bills like cable tv, internet, city/trash/water etc).

Ultimately I decided to do nothing and just keep a close eye on account activity until January when it is less inconvenient to wait for the new one.

<comment><USER12> Very inconvenient. I wish more banks had the feature of Simple[1][2] where from the mobile app, you can lock and unlock your card at will. They emailed customers proactively regarding the Target breach and suggested that if you are really worried, you can leave your card in a locked state and then unlock it only when you need to swipe it.

Since they by default send a push notification on every transaction, it'd be overkill as long as you respond quickly in the even of an unauthorized one.

[1][http://www.simple.com](http://www.simple.com) [2]simple is fantastic for a whole host of reasons. Check them out. I'm not affiliated in any way, but have been using them as my primary bank since early on in their beta.

</comment></comment><comment><USER13> My wife shopped at Target twice, both times outside of the period given for the breach. I think we are still going to get the cards replaced just to err on the side of prudence.

I find myself wondering how this might affect Target. I almost never shop there myself. My wife, on the other hand, might have shopped there once a month or once every couple of months. Yesterday she told me she is not going back. Ever. There have to be other people on the same boat.

It'll be interesting if they ever release information on how exactly the breach was orchestrated. My biggest question is about all of that data moving about Target's distributed system without any encryption whatsoever. At least that's what it sounds like. The data capture had to be done at some central point in their infrastructure in order to affect some 1,800 stores.

Again, all of that data from 1,800 stores got to a central repository of some sort completely unprotected? Why isn't that information stored and limited to the within the walls of each store? It'd sure limit the exposure, well, a factor of 2,000. Anything leaving the walls of a store needs to be encrypted.

Perhaps someone with more experience in brick-and-mortar payment infrastructures of this kind can comment on this?

<comment><USER14> My guess is that they run all the stores through a centralized payment system. Encrypted in transit or not, the payment system needs the details in plain text to send to the payment processor. At or near the payment processing is where the information was likely copied.

The information can't only stay within the store, because purchases from one Target may be returned at any Target, and they may look up receipts by credit card used. At Target's scale, it makes more sense to do a centralized lookup (or local + centralized), rather than a query to every store.

</comment></comment><comment><USER15> I had an interesting thing happen a few months ago. I kept having my credit card used for fraudulent charges, but they weren't buying TVs or electronics, just small purchases at Dollar General and gas stations in Texas. I was really confused. So I had the card cancelled and another issued, and there again it was being used in another state. This happened three times within a couple months. I have no idea how or why as I'm very careful purchasing things online and in person. I finally changed my PIN and it stopped. I don't know why or how they were using my card with my pin, but either by coincidence or luck that fixed it.

</comment><comment><USER16> From the screenshot in that article, it looks like Target stored not just the credit card number, but also expiration date and full magnetic track information, including CVV1.

Why in the world would they do that? I would lose a lot of sleep over if I had to store just name and card number, but at least I could see some use for that. For example, you could look up a customer's past purchases for returns or warranty claims.

Why did Target want to store the expiration date, so the card could be used on online stores that don't check CVV2, and the magnetic track info with CVV1 so the cards can be cloned?

<comment><USER17> You don't need the CVV unless you're in the UK (or somewhere that requires it). I've made plenty of online cc forms for US based companies that did not have include it (that doesn't sound very good now that I write it out).

<comment><USER16> CVV1 is the code that is embedded in the magnetic track and allows you to swipe the card. CVV2 is printed on the back and used in many, but as you correctly point out not all, online stores.

</comment></comment></comment><comment><USER18> I got a notification from simple last night that said they would be sending me a new card because I shopped at Target, but that my old would still work until the new one was activated.

Great service and I didn't even have to do anything.

Cheers simple!

</comment><comment><USER19> So is it worth replacing my debit card and updating numerous automated payments that bill it, or just closely monitor my banking activity (like I already do)?

<comment><USER20> I just checked my CC account, and found a transaction at Target in that time period. I checked my other transactions, and everything was OK. However, I decided to cancel the card anyway and get it re-issued, just to be safe.

I have other cards I can use, so it is not inconvenience. I feel I dodged some trouble.

</comment></comment><comment><USER21> So... What's the best way to find out if your card was caught up in the breach?

<comment><USER22> Here: [http://paulsparrows.files.wordpress.com/2011/06/ismycreditca...](http://paulsparrows.files.wordpress.com/2011/06/ismycreditcardstolen4.png)

Your question reminded me of this and I see someone already responded. In any case you should get a new card if there was a chance you were affected.

</comment></comment><comment><USER23> _Credit and debit card accounts stolen in a recent data breach at retail giant Target have been flooding underground black markets in recent weeks, selling in batches of one million cards and going for anywhere from $20 to more than $100 per card, KrebsOnSecurity has learned._

No fucking way (pardon my French)!

I haven't seen anyone comment on this yet, but doesn't this seem _incredible_? I.e. I don't believe it.

Am I to accept that transfers of $20,000,000 to $100,000,000 ($20 to $100 times a batch of 1 million) are occuring in payment for these cards.

Bullshit. I just don't believe it. This theft is now widely known. So no way that someone is going to plunk down $100,000,000 just to get a small portion of this info.

Again, bullshit. IMO. It just doesn't make sense.

<comment><USER24> I think what they mean is that you can buy 100 stolen cards for $2000. And they guarantee that those 100 are still good numbers because they check them right after selling them.

No one is buying them in the millions. But plenty would buy 10, 20, 50 good stolen card numbers.

</comment></comment><comment><USER25> Ironically we only used Targets Red debit card. Can only be used at target and has a pin. Of all our cards that was the 'best' one we could have used in this case. We just changed the pin, even though no pins were taken.

<comment><USER26> We use that exclusively there, too. 5% off is a no brainer for how much we shop there.

</comment></comment><comment><USER27> As I mentioned in a pair of comments in an earlier thread,[1][2] I live so close to the local Super Target (walking distance), that we end up shopping there even though we like other stores better. But from now on, we will pay only in cash, and if that limits our purchases at Target, well that's too bad for Target.

[1] [https://news.ycombinator.com/item?id=6934787](https://news.ycombinator.com/item?id=6934787)

[2] [https://news.ycombinator.com/item?id=6936175](https://news.ycombinator.com/item?id=6936175)</comment>


The Nobel Peace Prize 2016: Juan Manuel Santos - <AUTHOR> http://www.nobelprize.org/nobel_prizes/peace/laureates/2016/press.html <comment><USER2> I was in Colombia two weeks ago. I am Spanish so I could talk with the people. Not everybody supports the "peace process" like any Western media displays.

In Colombia lots of terrible things have happened. There is people that had made a fortune simply murdering and stealing entire families, and of course drugs.

Peace process means legalization of all this crimes, and laundering all the money and power gotten mainly by extortion. There are thousands of victim's families that are angry because it means no justice for them, the people that killed their family members will not go to jail and the properties that were stolen will not go back to the families.

Uribe put the guerrilla on his knees by force, making it to want to make a deal in the same way the Germans or Japanese wanted a honorable peace deal when everything was lost. Now Santos gets all the Glory basically capitulating against the Guerrilla.

The deal is a very bad deal, for example it makes Guerrilla a "democratic" party, but if the people do not vote them, it does not matter because representation is warranted by law, basically giving them the territories that they already controlled by force.

<comment><USER3> You are not well informed. In Colombia the majority of the victims of the conflict support the peace process. You can easily see it in the map of how the people voted and you'll notice that those territories where the war was actually fought got the big majority of the votes supporting the peace treaty.

The process didn't legalize the crimes nor allow the guerrilla to keep their drug dealing money. That's just FUD. The kind of FUD that made uninformed people vote no.

Uribe fought the guerrilla fiercely, but he did it by getting alliances with paramilitary groups that were even worse than the guerrilla.

The peace treaty is not perfect, and yes, there were some concessions made to the guerrilla. Like the possibility to have 10 out of 270 positions in the congress even if they didn't get the votes, but only for two periods. It's not easy to negotiate after 50 years of crude war, but all the lives saved with it are completely worth it.

<comment><USER4> What about the monthly alimony every FARC combatant was to receive?

I would probably still have voted 'yes' but I have a hard time to denunciate people for thinking otherwise: that paying someone to not terrorize you anymore amounts to "extortion money".

<comment><USER5> For how long would they receive the money?

Economically it makes sense. You will have thousands of people which only work skill is to combat. With the end of the guerrilla, they won't immediately find jobs. If they don't have money, they will become thugs.

<comment><USER6> 2 years. It's cheaper to do that than to continue the war.

<comment><USER4> Well if that's true I give up. It's indeed a cheap price. Instead of alimony the term "grant" or "transition backing" would be the better fitting word.

Still. Morality is often on bad terms with money. If you want to talk with people about principles they often become fundamental money-wise.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR>
      The Norwegian Nobel Committee has decided to award the
      Nobel Peace Prize for 2016 to Colombian President Juan
      Manuel Santos for his resolute efforts to bring the
      country's more than 50-year-long civil war to an end, a war
      that has cost the lives of at least 220 000 Colombians and
      displaced close to six million people.

      The award should also be seen as a tribute to the Colombian
      people who, despite great hardships and abuses, have not
      given up hope of a just peace, and to all the parties who
      have contributed to the peace process. This tribute is
      paid, not least, to the representatives of the countless
      victims of the civil war.

See also the answer to the question: "Does this year's prize encourage a process more than a result, since a slim majority of Colombians voted no?"

[https://twitter.com/NobelPrize/status/784323887374831617](https://twitter.com/NobelPrize/status/784323887374831617)

</comment><comment><USER7> Interesting choice, especially since the referendum itself fell through. But it is a strong signal for Santos and the FARC to work out a new deal.

Ending a 50 year civil war would be amazing for Colombia. Kudos to the comittee for taking such an "old" conflict and not picking up a (for lack of a better word) "hip" topic _.

_ I do not mean that the White Helmets or every other Organisation on the short list would not have earned the price, however I think it is a good thing that they try to strengthen a peace process that would put an end to such a long-lasting conflict.

<comment><USER8> Arent White Helmets a subversive CIA group?

There has been pictures of "rebels" with guns for a day, then a White Helmet the next day switching back and forth.

<comment><USER9> Digging out the wounded and dying is a subversive act?

<comment><USER10> It probably is -- from the viewpoint of those that bombs civilians with barrel bombs.

(That said, for all I know the white helmets is a front for ISIS. But either way, the Assad junta and the Russians have an obvious interest in tarring them black.)

<comment><USER8> > of those that bombs civilians with barrel bombs.

Of course, who wouldnt choose to be melted to pieces by an expensive explosive device with advanced guidance and autonomous systems rather than a cheap ones?

<comment><USER10> You are knowingly dishonest by ignoring the word "civilian".

Here you have my standard reference, quite critical of the US, regarding the laws of war. Please compare the US behavior with the Syrian/Russian Rules Of Engagement.

[http://www.lrb.co.uk/v25/n04/michael-byers/the-laws-of- war-u...](http://www.lrb.co.uk/v25/n04/michael-byers/the-laws-of-war-us-style)

</comment></comment></comment></comment></comment></comment><comment><USER11> This is just another version of the white savior complex. Developed countries support 'peace' processes that make them feel good about themselves, with little regard for the root causes of the conflict to begin with. Apparently they think us colombians are too backwards to deserve first-world justice, so they applaud compromises that they would NEVER accept themselves.

<comment><USER12> Except they had. First world countries had the worst war on history and they rebuilt their societies making big concessions. Europe and Japan know a lot about accepting had agreements exactly as our peace process suggests. This is a great way of supporting the work a great president truly committed to changing our country because he was born rich and it's extremely obvious that the peace agreement with FARC and possibly ELN it his way to transcend. I applaud this price and the support of developed countries to the process.

<comment><USER11> Name ONE developed country that would accept zero jail time and political eligibility for someone convicted of multiple war crimes, with hundreds of years in cumulative prison sentences.

That is precisely my point. You are just one of many colombians who can't seem to make the connection between repeatedly helping criminals dodge justice and Colombia's current situation.

<comment><USER13> What about this in general: [https://en.wikipedia.org/wiki/Northern_Ireland_peace_process](https://en.wikipedia.org/wiki/Northern_Ireland_peace_process)

And this particular case: [https://en.wikipedia.org/wiki/Martin_McGuinness](https://en.wikipedia.org/wiki/Martin_McGuinness)

<comment><USER11> Not directly comparable for two important reasons:

The Good Friday Agreement was signed before the Rome Statutes on War Crimes came into effect (in no small part as a response to similar "blank-slate" deals in the 80's and early 90's). That means that signatory countries are bound by international law to prosecute and punish war crimes and crimes against humanity committed after their signing, proportionally to the severity of the crime. That's what I mean by first-world justice. Even in Ireland, no crimes under the Rome statute after 2002 can be met with the level of impunity the FARC-Santos deal guarantees.

And with respect to McGuinness, even if the Rome statute had been in effect during his participation in the IRA, he was never charged with anything resembling a war crime, even after the Saville Inquiry. He would be more akin to a member of the shady, FARC-friendly political party "Marcha Patriotica". The crimes of the FARC leadership, on the other hand, are fully documented, and sentenced in-absentia. Most of them have over 400 years of cumulative sentences, including murder, extortion, torture, kidnapping, child recruitment etc. All constituting war crimes and crimes against humanity.

<comment><USER13> Stop overfitting.

You asked for an example and I gave it to you a valid one. McGuinness was an IRA leader and IRA committed many kind of crimes; there are more ex-IRA leaders that are now in the civil life.

If I give you another example you will discard it for some random reason, so this discussion makes no sense.

On the other hand, if you see the signed peace treaties in the region, and in the world, you'll notice that these have generally gone well.

Bye.

</comment></comment></comment></comment></comment></comment><comment><USER14> After Obama got a peace prize, it's really hard to take any of this seriously.

<comment><USER15> Okay, this whole theme is getting a bit annoying: Only if you expect the peace prize to be awarded in the same way as physics prize.

The people awarding the physics prize seem to be waiting until they are absolutely certain the discoveries are important. So correct me if I'm wrong, but it's mostly given to old men for things they've done decades ago, not for outstanding accomplishments in the past year.

Unlike the peace prize works. Which is by the way awarded by politicians.

Regarding Obama's prize, Wikipedia has this quote:

Jagland said the committee was influenced by a speech Obama gave about Islam in Cairo in June 2009, the president's efforts to prevent nuclear proliferation and climate change, and Obama's support for using established international bodies such as the United Nations to pursue foreign policy goals.[11] The New York Times reported that Jagland shrugged off the question of whether "the committee feared being labeled naïve for accepting a young politician's promises at face value", stating that "no one could deny that 'the international climate' had suddenly improved, and that Mr. Obama was the main reason...'We want to embrace the message that he stands for.'

I think it's hard to quite grasp how much Bush and his war rhetoric was despised in intellectual circles in Europe. Then he was re-elected, and it was really as if Americans were hellbent on the us-vs-them attitude.

It's too bad that Obama later started executing people remotely, but that's the problem with giving out awards for something done in the past year, it may be a better motivator and much more relevant, but you might end up handing out a prize to someone who later doesn't look like he or she still deserves it.

<comment><USER14> > Okay, this whole theme is getting a bit annoying

> It's too bad that Obama later started executing people remotely,

Civil war in Syria. hundreds of civilian drone killings. Failed to close Guantanamo.

'It's too bad' is a huge fucking understatement. If a selection process yields peace prize to these kinds of people that is _in fact_ , 100% worthless.

</comment></comment></comment><comment><USER16> I think he deserves it. It took years to set up the peace process. Had it not been down to the fact that democracy is the tyranny of the stupid, Colombia would finally see peace.

I hope this helps restart the process, and change public opinion.

</comment><comment><USER17> Related: [http://edition.cnn.com/2016/10/05/americas/colombia- ceasefir...](http://edition.cnn.com/2016/10/05/americas/colombia-ceasefire- farc/)

This is quite unfortunate timing. But I guess they couldn't find somebody else on short notice after the referendum on the peace deal failed. (also, it's not the first time this prize has been awarded for intentions instead of results)

</comment><comment><USER18> Well, what did you expect from the people who have given a prize to Kissinger, Arafat, Obama?

<comment><USER19> Well, they had to avoid Snowden at all costs.

<comment><USER18> Whatever you think of Snowden, you can hardly claim that what he's done has directly affected any conflicts for the better

<comment><USER20> Peace is about far more than conflict.

To suggest otherwise is in my opinion, utterly naive, but in the very least shortsighted.

<comment><USER21> Yup. The sun engulfing the earth instantly today ending life would end all conflicts in one sweep.

Conflicts aren't always bad. We just need conflict resolution.

</comment></comment></comment></comment></comment><comment><USER22> I am Colombian.

This is a really difficult situation, and this Nobel prize was really unexpected. When the plebiscite results where announced last Sunday, the whole country was astonished, even those who where for the No vote, as polls predicted and overwhelming support for Sí. I was very dissapointed with the result, even ashamed, as it was barely a win for No, but shown mostly an abstention level not seen in two decades. I cannot understand that a majority of Colombians didn't want to take part in one of them is important decisions in a century. Unbelievable.

Regarding the No: I can understand that people feels this peace deal brings impunity to the victims, that will be difficult to support financially, and puts a handful of insurgents directly on the congress. It does, and I believe basically no one is happy with that. But we are negotiating with a 50-year old billionaire militar criminal enterprise with strong Marxist roots and an original mission to take the power by force. And maybe it's own existence is due to the government actions in what was called Operation Marquetalia, which doesn't help with trust. It is worth remembering that Colombia is one of the most unequal countries in the world, with a top ten Gini coefficient.

Regarding Alvaro Uribe: even if successful in weakening the guerrillas, has a complicated history with the paramilitary, which have been at least as vicious as the guerrillas itself. His brother has been convicted due to ties with this groups, and his government and way of thought is from the hard right, and his way of talk is based on populism and loaded language. He is the major proponent of the No, and as a I see it, only to get his name on the deal, and even more, to push for a constitutional reform so that he is able to become president, for a third time. I feel that's sabotage.

Regarding Juan Manuel Santos: I did not vote for Santos in 2010, but for Mockus. He is not without scandals, mainly due to his actions under Uribe, who is know his strongest opposition. But I did vote for him in 2014, because he is a outstanding negotiator: and I was right, he got the peace deal signed, which no one was ever able to do before. Sadly he is a very bad political leader for the people, lacking good rhetoric and sympathy, and was not ably to rally the masses for the Sí. I'm simply unable to judge at this point if this Nobel prize should have been given to him.

Regarding the Sí: This is not the best deal we could have dreamed, maybe not even the best we expected, but was what could be achieved at that table at that time. I don't think we can get a peace deal without high sacrifice, and coming out smiling from the negotiation. This is a matter of opportunity cost: what reality did you prefer, the one where we painfully finish this conflict throughout the next decade, or the one where we perpetuate the longest lasting conflict in the Americas. Those most affected by it chose the Sí. I did too.

I just hope that we find a way out of this, with peace as a final outcome.

<comment><USER23> I was in Colombia in 2010 (what a beatiful country and people - I loved it). There were elections and I saw "De la U" posters all over. So I asked a few people what the U stood for. Nobody seemed to know. This is the party that won the presidency.

Did I just happen to ask the wrong people or is political awareness that low in Colombia?

<comment><USER13> This was one of the parties that supported former president Uribe back then, so many people think that the "U" is for him. But in fact "De la U" is for "De la Unidad Nacional" (National Unity).

And yes, political awareness in Colombia is low. The abstention for this plebiscite was greater than 60%.

<comment><USER23> > The abstention for this plebiscite was greater than 60%.

That surprises me as people weren't at all shy about how much they disliked the FARC.

</comment></comment></comment></comment><comment><USER24> <conspiracy-theory> What if...the idea for the award of this nobel prize was purposefully implemented by the world's secret/shady powers-that-be...in an effort to generate more social/political pressure to all but ensure that some resolution (perhaps ANY resolution, good or bad) gets completed before Santos' time as president finishes...? </conspiracy-theory>

I don't mean to make light of this...I (like many others) just question the timing of this awarding of the prize. While I'm extremely happy that the world has taken notice of this very important challenge that Colombia has been facing, I would have expected the committee would have waited until a plan is actually implemented, etc. Nevertheless, the very fact of this award is a clear, positive signal of the collective world's desire for peace for Colombians.

Disclaimer: I'm born, raised in the U.S. with Colombian parents (themselves naturalized U.S. citizens from years ago).

<comment><USER12> As they claim in the Q&A posted on Twitter, this encourages the process and celebrates the effort of president Santos to reach this far. If we do not reach an agreement to end this war it's a problem of other forces in the country and the ignorance of our people but for sure not by Santos failure. If we don't solve this for good, his brutal shift of the conflict from war to negotiation is already a great result.

</comment></comment><comment><USER25> The nobel peace prize award decision making process continues to boggle the mind.

</comment><comment><USER26> I thought the White Helmets would win.

</comment><comment><USER27> The Nobel Peace Prize lost all credibility when it was given to Obama in 2009.

<comment><USER28> He was awarded the price for his use of diplomacy instead of provoking more new wars. There was a lot of controversy regarding the decision, but to say that it lost all credibility is simply not true.

<comment><USER29> Cough. According to Wikipedia[1] - "Nominations for the 2009 Nobel Peace Prize closed just 11 days after Obama took office." That must have been a busy 11 days doing diplomacy...

[1] [https://en.wikipedia.org/wiki/2009_Nobel_Peace_Prize](https://en.wikipedia.org/wiki/2009_Nobel_Peace_Prize)

</comment></comment></comment><comment><USER30> Kudos

</comment><comment><USER31> Isn't the Nobel Peace Prize widely considered a joke to begin with?

<comment><USER32> At least since 2009 when Obama Receiver it.

<comment><USER33> Kissinger was before that and much worse than Obama.

<comment><USER28> What was the problem with awarding it to Kissinger? Generally curious? I don't recall the details, but as far as I understood he pretty much laid down the foundation to end the Vietnam war.

<comment><USER34> Carpet bombings of Laos, helping Nixon interfere with negotiations in Paris to end the war, looking the other way while Pakistan massacred people in Bangladesh, supporting Pinochet, etc.

<comment><USER35> That was past; then came the deal to an armistice to end the Vietnam War (though then after the armistice NVA and VC continued the war and South Vietnam collapsed). The point of that prize was not that there had been war, it was that the parties had signed to end hostilities.

In 2009, the peace prize really was quite strange in my opinion: Obama had achieved rather little except winning an election campaign (becoming the U.S. president the same year) on promises that undoubtedly sounded good to the Committee (but which later on were not kept very well or quickly).

<comment><USER34> Kissinger was directly and personally responsible for lengthening and intensifying the conflict. Giving him credit for ending it later on seems odd.

I'm a big Obama fan, but I'm with you on the 2009 prize.

<comment><USER35> There are other examples where the Nobel prize has been given to someone who previously intensified the conflict, but then worked for peace. Menachem Begin and Anwar Sadat in 1978, for instance.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> "During his time as Defence Minister, notable controversial events included a military raid inside Ecuador's territory that killed FARC leader Raúl Reyes on 1 March 2008.

In 2008 the 'false positives' scandal was uncovered,referring to revelations concerning extrajudicial executions carried out by members of the military in order to artificially increase the number of guerrillas killed by the Army and claim rewards from the government. On 4 November 2008, Santos admitted that the military had carried out extrajudicial executions

There was a misuse of an International Committee of the Red Cross symbol during Operation Jaque used to safely rescue hostages from FARC."

Now extra-judicial killings are no bar to being given the Nobel "Peace" Prize. The least credible of the Nobel Prizes continues to deliver....

<comment><USER37> This is a very complicated issue. There have been many crimes committed by both sides. The FARC themselves came out with an apology on all the victims they have kidnapped over the years. I think the point of the prize is not to delete his older actions but rather to congratulate him for his attempts to finally bring an end to a civil war that has costed hundreds of thousands of lives over the years. Just like the rest of the prizes are given for specific discoveries by scientists, and not for their every discovery during their life's work, similarly his action on trying to end the civil war was deemed worthy. Additionally actions are judged relative to one another and 2016 has not a good year for peace actions.

</comment></comment><comment><USER38> I am far from an expert on Colombia but there are many reasons to be skeptical of this peace deal, and the failure of the yes vote is a sign that many people did not support it for reasons related to immunity deals for guerrillas and political representation as well. The peace deal is full of unfunded promises that the GOC lacks the capacity to fulfill. For example, my understanding is that the GOC has agreed to add police forces to the 40 percent of the land that they do not control, but they lack trained officers and funds to pay them. Land reform has been at a standstill, this is a very significant issue that has not been resolved. Lastly, coca production is at an all time high in Colombia. This is after years of reductions under Plan Colombia. Coca fuels the FARC and corruption in Colombia. The perception is that the GOC was going to target development aid under the peace agreement towards areas of high coca development, they cut off aerial spraying and the result is massive increases in coca. I don't see any way you can have peace in Colombia without addressing the coca issue.</comment>


Ask HN: What was the turning point of your career? - <AUTHOR> <comment><USER2> Being asked to join a startup as co-founder. The startup itself totally flopped. But I learned a ton and was subsequently recruited for an entirely new class of opportunities.

</comment><comment><USER3> Getting scouted on LinkedIn for a really good role.

</comment><comment><USER4> Going contracting.</comment>


Two lawyers, a summer of unrest, and a Molotov cocktail - <AUTHOR> https://nymag.com/intelligencer/article/lawyers-arrested-molotov-cocktail-nyc-protest.html <comment><USER2> Life hack: don't throw Molotov cocktails at police cars.

<comment><AUTHOR> Agreed. I'm shocked at how sympathetic the New York author was to these terrorists. And these people don't give a whit about "Black Lives Matter" either. They were Hamas terrorist sympathizers latching on to the BLM movement.</comment></comment>


Hacker News - <AUTHOR> http://hackerne.ws/ <comment><AUTHOR> Ask PG: Is HackerNe.ws an official domain?

15 points by nreece 1022 days ago | 8 comments

<http://news.ycombinator.com/item?id=524470>

pg 1022 days ago | link

No, someone else created that</comment>


The Med Student That Cured Castleman Disease - <AUTHOR> http://lite.cnn.io/en/article/h_4b9b19218c006a8d4a249e5a25fb8d6b <comment><USER2> I used everolimus, which works the same way as sirolomus, for a few years. Like a fair proportion of people taking this class of drug, I developed severe proteiuria. Large protein molecules making their way through the kidney are considered likely to cause kidney damage.</comment>


A magic bullet for hiring quality devs - <AUTHOR> http://hiremyfriend.io/hire-someone

<comment><USER2> Of course there had to be another one of these posts...

Everyone recite the industry mantra: the only good developers are in the Old Boys' Network. It shouldn't matter what they know, it matters who they know. Recite it before supper and you will be blessed with successful projects. Refuse to follow it and try to evaluate your candidates objectively and you will burn in the cauldron of spaghetti code.

</comment><comment><USER3> This is basically a popularity contest. Nothing to do with technical skills, just social skills. Good if you're wanting a sales person. Not so good if you're wanting someone who choose to sit in front of a computer all day doing a job which doesn't require that much social interaction.

</comment><comment><USER4> I like the concept because it is only a means to a conversation. The only issue I can see is people abusing the friends aspect. Is there a way to qualify their friends to make sure they know what they are talking about and can be trusted?

</comment><comment><USER5> Interesting new failure mode. I don't even want to start thinking about how this model can be manipulated. And even if it's not being manipulated, whose definition of the "right" people will prevail?

</comment><comment><USER6> Tried to create a profile out of curiosity and it 404s. [http://hiremyfriend.io/profiles](http://hiremyfriend.io/profiles)

<comment><USER7> Hmm, I think I'd rather read a 404 error message than "Amazing person is looking for amazing company to pay them for being amazing"... I really hope a friend can lend a thesaurus and/or a delete key. Put positively, this has room for improvement.</comment></comment>


PyBrain: modular Machine Learning Library for Python - <AUTHOR> http://pybrain.org/# <comment><USER2> Python v. Ruby. The eternal question. The languages might not be different, but the communities definitely are.

This just convinced me I need to switch my efforts from Ruby to Python.

<comment><USER3> SciPy, OpenCV bindings, PyML, et al. I've worked more with Ruby than Python (and like the language itself better), but there's no question Python has the more momentum in this space.

<comment><USER2> Agreed, I think Ruby > Python, both in syntax and semantics. It's a shame I'm going to have to learn such a close language to take advantage of Python's momentum.

</comment></comment></comment><comment><USER4> It seems like this would be a reasonable introduction to neural network programming (while PyBrain contains code for other classifiers, the site also suggests that this is mainly for comparative purposes). If you were more concerned about performance, it seems like it might be better to check out libfann.

I couldn't easily find comparative benchmarks, so this opinion is just based on the documentation of the two libraries and what they say about themselves. If I have some free time this week (hah!) I'll throw together a quick and dirty performance comparison.

</comment><comment><USER5> I wish I had that 2 years ago in university :) It seems well coded, the documentation is clear and concise and it's in python! Overall, a cute library that I will certainly add to my bag.

I have two small concerns thought:

1- "Only forward"

2- Possibility to expend it.. For instance, what if I want to evolve my neural network with a genetic algorithm, is this possible? And if so, how easy it is?

</comment><comment><USER6> I tried this out about a year ago while at college. The dependencies were very painful and I was never able to install it.

I would love to know if anyone has this running on Mac OS X successfully now. I'd love to check it out, but had a terrible experience last time I tried it.

</comment><comment><USER7> It would be nice to see a neural network learning how to land a plane safely... even with crosswind. I think it'd be able to pull that off.

</comment><comment><USER8> Does it work on Google App Engine?

</comment><comment><USER9> One step closer to being able to simply put "import soul" at the top of my scripts.</comment>


Anatomy of a Kernel Hack - <AUTHOR> http://www.linuxchix.org/content/courses/kernel_hacking/Akk_hack

<comment><USER2> Rather than doing recursive greps, I think that LXR (The Linux Cross Reference) is a much better way of exploring the kernel: <http://lxr.linux.no/>

<comment><USER3> More generally, Ack is great for doing "recursive grep's" on source code. By default it does a pretty good job of only listing matches from filetypes you're likely to care about.

<comment><USER4> Wow I just learned about Ack as a result of your comment. This is a scale of magnitude better than grep -R [pattern] [directory] for searching through large codebases

Thanks!

<comment><USER5> Don't forget RAK, the ruby gem (works the same). gem install rak.

<comment><USER4> I've been using both RAK and ack for the past two days, and for some reason RAK misses things that ack catches. Probably a Cygwin issue.

</comment></comment></comment></comment></comment><comment><USER6> For what it's worth, it's usually not necessary to recalculate the bogomips value - it's only really used for usleep(), a routine used to sleep for short intervals (on the order of microseconds) to wait for hardware to stabilize. Overestimating slightly is not a problem - but even then, the cpufreq driver actually does scale this up and down as the CPU speed changes.

<comment><USER7> These days. In the (pre-ACPI) past some machines would change CPU frequency on AC events in system management mode, without any real way for Linux to know that it had happened. If you booted on AC and then went to battery then you'd probably be ok because kernel delays would just get longer, but booting on battery and then going to AC could result in these timeouts being significantly shorter than the hardware required. Once Intel actually documented their Speedstep implementation, and once ACPI gained support for expressing CPU performance states and notifying the OS, this mostly went away. But it was a real issue in the past.

(Nowadays we just have to deal with vendors who've decided that their firmware can do a better job of CPU power management than the OS and change frequency without telling us, but that's Enterprise so it's ok)</comment></comment>


The brothers behind Psystar - detailed article - <AUTHOR> http://www.miaminewtimes.com/2009-11-12/news/miami-boyz-versus-apple-computer/1 <comment><USER2> "Robert says he found his own way around Apple's built-in security devices. The breakthrough meant that, among other things, the cheap machines were virtually immune to viruses and hackers."

what a bizarre article.

<comment><USER3> Just a guess: he may be referring to the belief that Mac OS X is more safe than Windows on the same PC for ordinary users.

</comment></comment><comment><USER4> Random thought: if Psystar prevails, couldn't Apple just stop selling standalone OS X licenses? Force everyone to come in to the genius bar when they want an upgrade?

<comment><USER5> At the cost of making the process much more painful for legitimate customers, while recovering only a very small number of lost hardware sales.

(And that's before you consider that people will just find a way to lift the OS image off an installed Mac and share it on the Internet, whereas today at least a lot pay for their copies.)

<comment><USER4> Just thinking out loud. It's not like Apple is above imposing some inconvenient DRM to further their goals

(And sure people can still copy the OS, but then it's pretty indefensible copyright infringement)

</comment></comment></comment><comment><USER4> _Rudy scoffs at the idea he borrowed from the Hackintosh scene. "The first thing you have to do is unlearn everything you've read online about how to make this work," Rudy says, "because it's all wrong."_

For something so wrong, it seems to be working fine for lots of people...

</comment><comment><USER6> I love the fact one of the brothers complains about other clone makers ripping them off, letting them do all the legal hard work.

Sucks when people sell _your_ efforts as their own, huh?

<comment><USER7> Slightly different... Apple still get the cost of the licence for OS X, so they still get revenue from every PsyStar sold. PsyStar are not imitating the Apple hardware design, they are not copying the Apple look and feel and cloning everything - they are simply shipping a PC with OS X installed.

<comment><USER8> Saying that you paid Apple for the Mac OS license is laughable. Mac OS license is not a separate product. The price for the license is 29$ only because Apple considers it an upgrade for the Mac computer you have already bought from Apple. Mac OS upgrade is a bonus and only Mac owners are qualified.

<comment><USER9> Yes, you can buy a $29 upgrade to 10.6 if you already have 10.5. But there's also a full version of 10.6 for $129 for users that have 10.4.

<comment><USER8> The question is not about the price, 29$ or 129$ it is still a bonus. Apple's business is about Macs, not Mac OS licences.

</comment></comment></comment></comment></comment><comment><USER10> I like this article. It frames it as David vs. Goliath and looks very good for Psystar.

</comment><comment><USER11> rebuttal:

[http://www.engadget.com/2009/11/11/psystar-founders-claim- th...](http://www.engadget.com/2009/11/11/psystar-founders-claim-they-cracked- os-x-hackintosh-scene-is-a/)</comment>


New Word – describes amount over-complexity of systems - <AUTHOR> https://docs.google.com/document/d/1YvQbzPy-Likzwpoq6mU9biWWWAsj794xqiZyoIG3WHk/edit?usp=sharing

<comment><AUTHOR> rubeosity verb

Describes the magnitude of excess complexity or "Rube Goldberg-ness" of a device or system. Can be applied to machine or software system.

Rubeosity is measured in the logarithmic (base 2) unit of Goldbergs symbolized by the letter gamma Ɣ.

The most direct and simple solution that effectively solves a problem, by definition, has a rubeosity of 0Ɣ. A system that has twice the necessary complexity to perform a task has rubeosity of 1Ɣ.

rubeosity 0Ɣ The most efficient solution 1Ɣ 2 times as complex as needed 2Ɣ 4 times 3Ɣ 8 times 4Ɣ 16 times 5Ɣ 32 times

</comment><comment><AUTHOR> Complexity can be very subjective. Rubeosity measure the amount of over- complexity. Something that is over-complex can be simplified and still retain efficiency.

</comment><comment><USER2> efficiency is such a tricky subject. What is an efficient system, take for instance engines, some might say a very complex engine that gets the best output per unit input is very "efficient" however others would claim a simple two stroke engine is more "efficient" from a design perspective.

In that sense "efficient" and this metric are at odds as the more complex the thing gets the more "efficient" it is.</comment>


Enfield: a programming language designed for pedagogy - <AUTHOR> http://blog.fogus.me/2013/01/21/enfield-a-programming-language-designed-for-pedagogy/

<comment><USER2> OT

when would one use the word pedagogy, instead of just education?</comment>


Your Traffic Sources Have a Half-Life - <AUTHOR> http://www.softwarebyrob.com/2011/02/02/your-traffic-sources-have-a-half-life/

<comment><AUTHOR> I wonder though: Why do email lists not have the same half-life as Twitter? Is it that people take longer to get through their inboxes and so the traffic is spread out over time or are they storing emails for reference and returning to it later?

<comment><USER2> Because an email list is far more valuable than Twitter.

If you have 10k followers vs. 10k email subscribers, your response rate is like night and day. Hands down, email wins.

Now there's another side to Twitter, which involves the virality of it and has nothing to do with your followers, but simply people re-tweeting your link. In this case it's a decent ally since it provides that quick-spike viral traffic, but it has a very short half-life.

<comment><AUTHOR> Hey Rob, thanks for replying. I'm sure you're right that email lists are more valuable although I was wondering more about the difference in half-life rather than response rate.

I guess it's obvious that tweets quickly pass by leading to a short half-life. I'm still slightly confused why people would clickthrough from an email days (weeks?) after it was sent. Are they storing the emails to think about it and return later? I suppose the reason doesn't matter, it was just idle curiosity.

Also, I've learnt a very valuable lesson about HN. I submitted this article when I read it before lunch Irish time. Unfortunately, most of the U.S. and the HN audience hadn't woken up so the link fell off the radar. Sorry for inadvertently burying a very interesting article. Keep them coming (and the great Startups for the Rest of us podcast)</comment></comment></comment>


I am new to Hacker News - <AUTHOR> i am new to hacker news, please guide me any one. Thank you! <comment><USER2> [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

[https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

support: firstname.lastname@example.com

[https://news.ycombinator.com/user?id=dang](https://news.ycombinator.com/user?id=dang) is a moderator

and there's also a few more mods but I forget them.

<comment><USER3> [https://news.ycombinator.com/user?id=sctb](https://news.ycombinator.com/user?id=sctb)

Best to read [https://news.ycombinator.com/newswelcome.html](https://news.ycombinator.com/newswelcome.html) also.

</comment></comment><comment><USER4> The first order of business is to read the Guidelines and FAQ links at the bottom of the page...

</comment><comment><USER5> i am also new to hacker news, so i can't help you, Sorry!!!</comment>


Apply HN: SimShark 2.0 pays you cash for sharing your SIM card - <AUTHOR> SimShark campaign
Worldwide mobile phones grow and grow last years. 70% of mobile customers using pay-as-you-go (expensive) and 30% using monthly subscription contract with included free minutes inside a network. But 80% added minutes burned when month finished.
Why we can't sell rest minutes to pay-as-you-go customers and get charges back? The purchased package is your ownership, which u can't sell to other people.
How we can do impossible things
SimShark is a solution to do it. But how we can do it without interrupt ur current service? Let's describe. Now you are using current model: SIM card inside phone and phone connected to ur mobile operator's network:
http://www.simshark.net <comment><USER2> Are you aware that this is already being done throughout the developing world? Ecuador, Colombia, Perú, Mexico, Costa Rica and many other places I visit already have some variation of this. There's no website or app per se, but you'll see peeps in the streets selling you their "minutos" for very reasonable rates.

</comment><comment><USER3> Interesting idea, but your description on kickstarter makes it seem like you have some big security problems. How will you ensure privacy?

How will you build a network of users?

</comment><comment><USER4> Sounds interesting! Do you think my carrier would lock my card for violation of service? I am not sure if reselling minutes/data is allowed with standard SIM contracts.

</comment><comment><USER5> If you talk to many MVNOs a few offer segmented plans like these for developing countries.

Look at Bharti Airtel in India and Wataniya in the middle east.</comment>


Microjs: an index of javascript micro frameworks - <AUTHOR> http://microjs.com/

<comment><USER2> It has now become a norm that everyone just drops in jQuery and bootstrap css for most of their projects while they might just be needing a DOM handler and a few utility functions. I have nothing against jQuery or Bootstrap. They are awesome to get things rolling but in most cases there is no necessity to load huge JS libraries with lots of utility functions which one might not be using. Not to leave aside the fact that a few third party analytics, tracking, help desk tools also load/include jQuery in their bloated script.

MicroJS is a good resource. I am wondering how many of the frameworks listed there are actively developed/maintained. Adding the last commit date information might be super useful.

<comment><USER3> > there is no necessity to load huge JS libraries with lots of utility > functions which one might not be using.

I think we really need to see a tracing link-time-optimizer for Javascript code that can be run as part of an asset pipeline. Dump in your huge JS library, run your client scripts (with a thorough test suite) to detect what functions of the big library are or aren't called, then cull off the functions that aren't when writing out the final "compiled-and-linked" client library.

<comment><USER4> Unless the optimizer made sure that it didn't inadvertently break any cross- browser compatibility, you would lose one of the biggest benefits of libraries like jQuery.

<comment><USER3> Right; I imagine library authors would have to adopt some sort of conventional annotation on functions declaring something like "if you execute any function in the set {X,Y,Z}, you have to include _all_ of {X,Y,Z}, because they're cross-platform equivalents for one-another."

</comment></comment></comment></comment><comment><USER5> I started using zepto recently, it's at 7.4k min+gziped, not the 3.3 listed on this site. Still a super useful site, it might just be slightly out of date.

<comment><USER6> I'm the author of both MicroJS and Zepto. The sizes are automatically generated from GitHub when I deploy, usually a couple times per week.

Zepto's size includes only the core library, not additions like Ajax, Touch and so on, that's where the 3.3k number is coming from.

</comment></comment><comment><USER7> Very cool! I'd very much like to be able to sort by popularity, so when I'm trying to find an off-the-shelf library for something I have a general sense of what has support in the community.

I've put together a pull request which aims to accomplish this goal at <https://github.com/madrobby/microjs.com/pull/232>.

</comment><comment><USER8> Since the list is so long, an "about" link on top of the page to link to the bottom would be helpful (eg. I want to find out what constitues as a "micro" framework - currently it's 5k).

</comment><comment><USER9> It would be nice if I could use a minifying compiler that would strip what I don't use from JQuery, without having to also organize my JS source in a compileable form.

</comment><comment><USER10> Thanks for this. Bookmarked so that I can use it for future reference. I am going to try out some of those one page .js frameworks soon.

</comment><comment><USER11> Does Dojo count now with their latest release? They're supposed to have a "micro kernel" that's something like 3kb now.

<comment><USER12> Your HTTP headers alone per requested file is probably 1KB - 3KB is still tiny.

</comment></comment><comment><USER13> Is the purpose of this site to highlight how easy it is to build your own framework to suit your needs?

</comment><comment><USER14> I wonder if it's faster to learn 400 new APIs, or just use ExtJS or Dojo?

</comment><comment><USER15> Great. Some kind of categorization or tagging would be really useful too.

</comment><comment><USER16> Wow this is cool. I will definitely use some of those at work ;) thanks!</comment>


New Apple TV Will Push 99 Cent Streaming TV Rentals - <AUTHOR> http://newteevee.com/2010/07/08/new-apple-tv-will-push-99-cent-streaming-tv-rentals/ <comment><USER2> I can't help but feel that this would be a really beneficial innovation in the way content is provided on the Internet. Every other video distribution site (except Netflix, whose online business model I still can't comprehend) has gone back to ads. Hulu+ is essentially Cable: the Revenge, but with more commercials than on-demand.

Being able to "subscribe" to a favorite show for $4 a month, in HD, without commercials, would be fantastic. I hope there's something to this rumor.

</comment><comment><USER3> If it's based on iOS, it will probably have an App Store. People will want to make games for it, but infrared remote control input will make for frustrating controls. Is that what this thing is for? [http://www.engadget.com/2010/06/07/apples-magic-trackpad- rev...](http://www.engadget.com/2010/06/07/apples-magic-trackpad-revealed/)

</comment><comment><USER4> 99 cents seems like a fair price to watch an ad-free episode of something. The old $1.99 price always seemed excessive, and I've never paid it for anything except Mad Men (I buy a season pass for thirty bucks and it saves me an entire year's cable subscription...)

</comment><comment><USER5> This will drive casual viewing in the same way as 99p apps drove casual app purchases. DRM and various licensing issues have made this very difficult to achieve so far.</comment>


Data In, Garbage Out (2008) - <AUTHOR> http://glyph.twistedmatrix.com/2008/06/data-in-garbage-out.html

<comment><AUTHOR> A recent post about the problems with RJS (in Rails) and similar techniques got me thinking about this again. The post is old, but web development still relies a lot on string concatenation.</comment>


Go Micro – A Go microservices development framework - <AUTHOR> https://go-micro.dev <comment><USER2> mDNS is an interesting choice for service discovery. Neat idea for local development, but probably not great in production.

I believe most cloud providers don't support multicast, meaning mDNS would not work there. It's also quite slow and/or very chatty in large networks.

Looks there is support for other service discovery mechanisms via plugins, though.

<comment><USER3> Oh, yeah...that is probably limiting. A quick scan seems to show Digital Ocean specifically drops multicast, and AWS/GCP/Azure have varying levels of "unsupported".

Would it work with Flannel/Calico, etc? Inefficient, but probably okay since it would be just service resolution.

Edit: Looks like no for Calico, Yes for recent Flannel, but Weave Works is probably a better choice, designed to support it from the start.

<comment><USER4> mDNS is only for local development. You can use a variety of tools such as Consul. Check out micro.mu for more info :)

<comment><USER3> Ahh. Might be a good update for the linked page.

</comment></comment></comment></comment><comment><USER5> This looks pretty new and under developed. In a world of service mesh proliferation not sure where this fits as there is some feature overlap.

> PubSub is built in as a first class citizen for asynchronous communication > and event driven architectures.

Would be interested to see how this is implemented and what it's consistency and reliability dynamics are.

<comment><USER4> I think the largest issue is a lack of documentation. Go-Micro is ~5 years old, so definitely not new. Pub Sub works pretty well; check out the PubSub example in micro/examples.

<comment><USER6> > Event notifications are a core pattern in micro service development.

I might agree, but it's not __the __only core pattern.

What if one needs (distributed) transactions? The fact that pub/sub is advertised as a prominent feature makes me think that asynchronous models are preferred, at least in design and philosophy of the framework.

</comment></comment></comment><comment><USER7> Have care with using this. We were using it and repos were renamed and moved causing all sorts of issues.

</comment><comment><USER3> Seems like a sort of light service mesh, but delivered from within the app, and very straightforward. I'll have to look at mDNS, had heard of it, but never read into it.

<comment><USER8> mDNS has been around _forever_ (2002/macOS 10.2) but probably best known in the Apple ecosystem as Bonjour [1,2]. Much of Apple's big software and hardware products integrate it in some way.

[1] [https://developer.apple.com/bonjour/](https://developer.apple.com/bonjour/)

[2] [https://en.wikipedia.org/wiki/Bonjour_(software)](https://en.wikipedia.org/wiki/Bonjour_\(software\))

<comment><USER3> Sure. The last Apple product I owned was an Apple II, so Bonjour is similarly something I've heard in passing, but never looked closer at.

</comment></comment></comment><comment> ainar-g Probably mostly off-topic, but every time I see the words "Go" and "framework" together in a sentence, I can't help but chuckle. Go is, idiomatically, a very anti-framework and pro-library language. And I think that that's a good thing. The closest thing idiomatic Go has to frameworks are the stdlib's "interface packages" like package image or package database/sql/driver, which are amazing because they make it easier to create an actual ecosystem instead of a network of incompatible frameworks. Anyone who wants to create a "framework" for go should instead learn from those packages and try to define a set of interfaces which work together to achieve a goal.

<comment><USER9> I think that is better explained as

"the Go _community_ is very anti-framework and pro-library"

There is nothing about the language, which is general purpose, that makes it anti-anything really.

<comment><USER10> I would argue that the lack of features like generics and meta programming (annotations/decorators) push Go the language away from frameworks.

(I know that the absence of generics is temporary)

<comment><USER9> This is nonsense. There are plenty frameworks, like the one discussed in this post. The lack of any kind of language feature has never stopped people from writing solid libraries, frameworks and applications in Go. Lots of examples out there.

<comment><USER10> I didn't say there aren't frameworks, I said there is a reasonable argument that the language's feature set tends away from frameworks.</comment></comment></comment></comment></comment>


Peer Dependencies - <AUTHOR> http://domenic.me/2013/02/08/peer-dependencies/

<comment><USER2> This is a great feature. The more I use node, the more I wish that python dependencies worked similarly. If I were going to create a new programming language, the very first thing I'd start with would be the package manager.</comment>