Using Yubikeys Everywhere - <AUTHOR> http://www.tedunangst.com/flak/post/using-yubikeys-everywhere <comment><USER3> You can have a security key on Google without a phone number, but you have to enroll with a phone number and then remove it. Google won't allow you to remove the phone number unless you have some other backup 2FA method available.

The best Google (actually: everywhere) 2FA "stack" in Q1 2017 is:

1\. Hardware U2F

2\. Software TOTP (Authenticator app on your phone)

3\. Physically secured backup codes

4\. Disabled SMS

My experience with the Y4 hardware and, particularly, software has not been great. I'm using the Y4 for SSH access (through ssh-compat mode on gpg-agent) and it's mostly OK, but if I try to use PIV mode on the same token I run into all sorts of problems. I'm bullish on U2F, but bearish on Unix token applications.

<comment><USER4> I have a concern about software TOTP. As tptacek knows (but I'll mention as background for other readers), the various authenticator apps use the standardized TOTP algorithm [1]. This algorithm uses a private key that the server and the client (your phone) have in common.

The question is, where is the private key stored on your phone? According to some posts from 2012 or so [2], on Android, Google Authenticator stores the key unencrypted in an sqlite database, which you can look at if you have rooted your phone.

This seems insecure. Is this still an issue with Android? Are Apple products any better?

[1] [https://en.wikipedia.org/wiki/Time-based_One- time_Password_A...](https://en.wikipedia.org/wiki/Time-based_One- time_Password_Algorithm)

[2] [https://www.howtogeek.com/130755/how-to-move-your-google- aut...](https://www.howtogeek.com/130755/how-to-move-your-google- authenticator-credentials-to-a-new-android-phone-or-tablet/)

<comment><USER5> The story for security on Android is really, really sad. Google should be pressing really hard on the secure enclave button. Even game consoles have better security [here I wanted to add: "... than the most secure Android device", but that would be untrue, since I don't know all the Android devices out there. Let's just say the situation is sad, verging on terrible because it's Google, full of smart people who almost certainly know better].

Google probably can't get away with just trusting TrustZone, given the number of manufacturers of SOCs and the opportunity for the folks doing chip-level cut-and-paste of features to get things wrong.

I imagine there are patents in the way. Solve that with the realization that a united front against adversaries (crackers, state-level actors) is better than a fragmented one.

Solve the technical issues by getting the right 20 engineers in a room for a week or two, to set a proper direction. Android could have great security in a large set of phones inside of 18-24 months, with the right management.

Sigh.

<comment><USER6> While I agree with you, they do in fact have hardware-backed key storage these days; it's just only available (and reliably useful) in recent Android versions (namely those devices with fingerprint sensors).

Since we're on the subject, OP was talking about a perceived vulnerability with _rooted_ Android devices. I highly suspect that even a decent secure enclave solution would warrant some skepticism if the system around it is wide open. For example, timing attacks or even plotting voltage draw on an oscilloscope could leak some key information.

If you're rooting your device anyway, you should probably invest in a hardware security key.

<comment><USER7> Depends on where you live.

If you assume that the US government is not trustworthy, and a possible enemy of you (possible if you're a journalist in these days), then an unrooted phone might be less trustworthy than a rooted one with custom software (such as a custom build of CooperheadOS)

<comment><USER8> Or just use an iPhone. The amount of marketshare Apple would lose if there was even a hint of a US-intelligence backdoor in their systems keeps them with a very, very vested interest to actively fight that.

</comment></comment></comment></comment></comment></comment><comment><USER9> For Google 2FA, I'm pretty sure that it lets you remove the phone number once you've added a 2nd 2FA mechanism. Eg, once you've setup Google Authenticator _and_ a Yubikey. At least that's how it worked when I set it up a while ago.

Given that Ted uses OpenBSD, I'm surprised that he has not mentioned the dumpster fire that is U2F on Chromium for BSD. This bug details the issue: [https://bugs.chromium.org/p/chromium/issues/detail?id=451248](https://bugs.chromium.org/p/chromium/issues/detail?id=451248). The last I checked, (~2 months ago), it was still a problem on FreeBSD. In order to avoid the crashes, I needed to set a user-agent spoofer to Firefox, so that I would not get a u2f prompt (and would instead be prompted for a Google Authenticator code).

That became frustrating enough that I decided to try switching from Chrome to Firefox so that I could use my Yubikey. I had to setup a u2f plugin for firefox to use u2f on FreeBSD. And to even get u2f requests, I had to install a user agent spoofer, and spoof a chrome user agent. Argh! So now I was spoofing Firefox on Chromium, and spoofing Chrome on Firefox. My head was spinning, and (because the spoofer spoofed old agent strings), I was getting nastygrams from corp. sec. for running out of date, insecure browsers.

I finally just threw in the towel, and set up a Linux bhyve VM to run Chrome under linux. The performance sucks, but at least I can finally use my Yubikeys. On the plus side, I can use PCI-passthru to pass in a webcam, and actually do hangouts on my desktop now.

<comment><USER10> You can't have a U2F Key and a Mobile Phone Authentication at the same time with Google.

<comment><USER11> I believe you can have whatever auth mechanisms you explicitly allow. You will get prompted to use the key if you enable it, but you can also select alternative authentication methods when prompted for the key.

<comment><USER12> You can't have a security key as well as the new Prompt method.

</comment></comment></comment></comment><comment><USER13> I just recently started using my Yubikeys (in Challenge-Response mode) w/ LUKS to unlock my drives at boot -- it's pretty neat!

On my primary system (a workstation, at home), I use the Yubikey to house my GPG keys and I use the "derived" SSH key that lives inside of it for authenticating to everything at $work. It was a bit of a PITA to get working -- _points at gnome keyring_ \-- but it works great. I have a Nano I'm about to set up the same way and just leave it in my primary laptop permanently.

<comment><USER14> > I have a Nano I'm about to set up the same way and just leave it in my > primary laptop permanently.

Do I misunderstand the purpose of a Yubikey/U2F device here? Is not leaving it plugged in permanently effectively reducing the strength of the second factor?

With TOTP codes behind my iPhone lock screen I can be reasonably confident that stealing my laptop isn't enough to break into my accounts (buying time until I can contact our SIRT team), but with a device plugged in permanently I lose that. Obviously an attacker would have to know my password, but that assumption is a primary reason for multi-factor auth to begin with.

What am I missing?

<comment><USER13> Leaving it in permanently is mostly for convenience. The keys are still protected (by a "PIN") even if the laptop and/or Yubikey is stolen. There's also FDE on the laptop itself, protecting the data.

<comment><USER15> You can also turn on touch-to-use policy so that you have to touch the yubikey each time you want to use the key.

<comment><USER16> This is important. Physical action outside the computer should be required to access keys, otherwise a root access is enough to completely compromise the system.

<comment><USER17> Where by "completely compromise" you mean "an attacker can use your second factor while they have access to your computer and it's plugged in", which is pretty far from actual complete compromise (i.e. "an attacker can use your second factor at any time without needing to access anything of yours")

<comment><USER16> In the context of it always being plugged in, and just handing out keys when the system asks for it, I call it completly compromised.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Instead of using Yubikey through GPG to replace the SSH key one can also use the PKCS#11 module they provide: [https://developers.yubico.com/PIV/Guides/SSH_user_certificat...](https://developers.yubico.com/PIV/Guides/SSH_user_certificates.html) This requires replacing GNOME keyring with SSH agents, though.

One can also use one of the 20 additional slots (82-95) the Yubikey 4 provides over the Yubikey NEO by replacing the '9c' with '82'.

<comment><USER19> Using it through GPG already required you to replace Gnome Keyring with gpg- agent. At least it did in the past.

</comment></comment><comment><USER20> This article shows that U2F has LONG way to go before it is consumer ready.

Expanding on the 'key' metaphor, U2F (or MFA in general) needs to be as easy as unlocking a door. Everyone knows how to do that; insert key, turn key, open door.

Until things like Yubikey and their ilk are as simple as this (and I know it's mostly the software that has to catch up), it's never going to be wildly adopted on peoples personal logins.

I use Smart-card auth on my work laptop along with a 8 digit PIN to create 2FA, and although it's supposed to be universally supported across all the applications I use, it really isn't. When I first started working here, I spent several days very confused about where the smart-card did and didn't work - I dread to think how the layperson works this stuff out.

<comment><USER21> I absolutely agree that it is not consumer ready. I'm trying to fix sharp corners with Truefactor.io, any thoughts?

</comment></comment><comment><USER22> \- U2F is a standard

\- The FIDO Alliance is the body that maintains the U2F standard. U2F keys can be "FIDO Certified" if they comply to the standard and have been tested.

\- Yubico is a company and Yubikey is a brand. Yubikeys often support more than U2F so some Yubikeys are _much_ more expensive than a key supporting only U2F.

\- Prices start at ~$10 for a FIDO certified key

\- U2F Zero is an open source project, not FIDO certified.

\- I have three U2F keys of various brands and they all seem equivalent so far.

</comment><comment><USER23> Too much trust centralization. How do you know Yubikey key generation hasn't been compromised? They're an obvious target.

<comment><USER24> The logical end-state of this train of thinking is tamper-resistant key generation and storage, with fully published sources and audited assembly line production.

Except then they need to ensure that all the equipment on their line was produced by trusted suppliers with the same level of disclosure. Ditto all software which touches anything in the manufacturing process. It's turtles all the way down, see also "on trusting trust".

<comment><USER25> Or just do it with open code & hardware on an ASIC whose process node is verifiable by eye with a microscope against a reference image after samples of it are decapped. Either by the owner or numerous third parties. You make it sound _much_ harder than it is unless they're using unverifiable technology. In that case, it might be pretty hard. ;)

<comment><USER24> That's ridiculous. People can't reliably produce good implementations of crypto software, and you suggest they design and verify ASICs? My point was that security is about understanding and accepting, not foolishly trying to eliminate, risk.

Just a few of the mountains which need climbing: First, you'd need a (actually) random sampling not just one (keep in mind any ASIC you test is likely a write-off due to tamper-resistance). You'd also need a high assurance supply chain to ensure your verification isn't premature (as well as sufficient levels of tamper resistance/evidence). You'd further need to verify the software around this hypothetical ASIC is free of bugs. You're restricting yourself to software which can be performant on older slower process nodes. You (almost certainly not an ASIC company) need to have an in-house ASIC shop, or you need to vet an external one (sounds cheap and easy for the average business). In fact, you need vetting of your internal staff at all stages of this process.

You are making this seem _much_ easier than it is. There's a reason this product, which there is definitely a market for, doesn't exist (and that reason is much more mundane than the cryptolluminati not wanting it to "get out"). Consider that Google did something like what you're suggesting. It took them years (and they're Google), what chance does the average person/SMB have?

<comment><USER16> I suppose you could use an fpga, but you still need to audit the assembly line. It's not simple, and you will place trust somewhere.

<comment><USER26> So, more turtles waiting down there....

In the end, it is the attempt to create a positive proof in a system that is not a defined formal system (real world vs pure mathematics). Impossible - <USER2> you say, you need to place your trust somewhere. Even if it's your own abilities. But that trust can always turn out to be not justified.

<comment><USER25> You need to make a simple interpreter or processor that's verified by eye, brute force, or mathematically. An old example was FM9001 with newer ones being VAMP (open?) and AAMP7G (proprietary). You do that on a node you can verify by eye. You verify a random sample of the pile you ordered by eye. You use it with cheapest, simplest, oldest parts for input and display that you ordered in obfuscated way so they don't think source of order was important. Then, you have hardware you can trust to do the rest of the calculations for trustworthy hardware or software that's much better. Including image recognition software to semi-automate your job of spotting things that don't below in images of chips. ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> There is still one issue left with Yubikeys: backups. When I loose my Yubikey after I cautiously registered it with a hundred different sites and servers, I would like to restore its secrets onto a brand new (blank) Yubikey and go forward. The only official course of action given by Yubico today is to manually un-register and re-register on all sites and servers.

Of course the key backup should be correctly protected, but that problem is not hard to solve.

</comment><comment><USER28> I ran into the same problem with ed25519 :/. Hopefully they upgrade and offer this at some point!

<comment><USER29> neat. what are some use-cases for ed25519?

<comment><USER30> Ssh?

[https://lwn.net/Articles/590870/](https://lwn.net/Articles/590870/)

</comment></comment></comment><comment><USER31> >This doesn't have any effect on the phone, however. I have to tap back, return to the login screen, and enter my password again

I believe you can simply hit the login button (sans code) after validating the login attempt instead of closing the application.

</comment><comment><USER32> Tried my U2F yubikey on Chromium 48 on OpenBSD 5.9, but it crashed :(

</comment><comment><USER33> eiecccevfhqwhgadshgnsdhjsdbkhsdabkfabkveybvf</comment>


The Race to a Trillion - <AUTHOR> https://www.aboveavalon.com/notes/2018/7/11/the-race-to-a-trillion <comment><USER2> > _Apple is a design company selling tools that empower people. [...] > Microsoft is an enterprise-focused services company focused on helping > people get work done. [...]_

Oh dear, what drivel. By that logic, BP is not an oil and gas company, it's logistics company helping people and goods get to where they're needed the most. And Deutsche Bank isn't a bank, it's a charity focused on making people's and companies' dreams come true (for a small fee).

Please spare me this bullshit.

<comment><USER3> I think the sentiment is true, though, that the giant tech companies are a diverse set of businesses. There's overlap between them, but they focus on different things and are successful in (mostly) each their own market.

<comment><USER4> I agree that the broader point is true: each giant is using software (and hardware in some cases) to build massive infrastructure businesses (logistics, cloud, communications, advertising/search, etc.).

But I think this analysis overlooks the ways where these tech companies do sort of compete: search advertising is a duopoly between Google and Facebook; search has some (very weak) competition from Microsoft and Amazon; cloud services are competitive between Google and Amazon... I think the stronger pattern is Alphabet is in everything and in some way competing with every other giant.

<comment><USER5> Azure is by far the next biggest cloud provider after AWS. GCP is the lame duck playing catch up.

<comment><USER6> Is that really what you think? Google Cloud is far and away the best service for machine learning right now. There's a reason why basically every company that has ML training needs is switching from AWS to GCP. Not only is Tensorflow, which is the only production machine learning framework that anyone uses, basically 100% integrated with GCP, the Google Compute Engine is the only way you can get access to TPUs.

At my company, we use GCP almost exclusively with preembtible TPUs as our primary compute for training models. It's not cheap, but you can't beat the performance and quality. Plus when you compare it with how much the engineers here are getting paid, it's a drop in the bucket ultimately.

<comment><USER7> How much of the average compute work load for companies and startups is machine learning?

<comment><USER6> Not sure about others, but in my field, it's probably >99%.

<comment><USER7> Sounds like GCP is a great fit for you, then!

I have worked in a number of industries and rarely needed any ML (though it may be coming). Most folks need clean data and linear regressions in my experience.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Due to multiple QEs and low interest rates in developed economies across the globe, a Trillion won't be what it used to be by the time these companies reach that milestone.

(Just like a Million ain't what it was anymore at family level[1]).

[1] [https://www.statista.com/statistics/300451/us-millionaire- ho...](https://www.statista.com/statistics/300451/us-millionaire-households/)

<comment><USER9> > a Trillion won't be what it used to be by the time these companies reach > that milestone

That's a far fetched premise given several of those companies are likely to hit that line in the next few years. It's not like Apple is $800b away from the line. Their stock needs to merely move up 7%. Amazon needs to move 15%.

At a minimum Apple, Amazon, Google, and Microsoft look poised to easily hit a trillion dollars in the not very distant future, obviously barring a market crash (and nobody knows when that is coming). A trillion dollars will still be a trillion dollars, so to speak, in five years.

<comment><USER10> What GP means is presumably, $1 trillion may be say 0.00x% of the monetary supply back in 2007.

But today, $1 trillion may only be 0.000x% of the monetary supply today.

It's true that government measures of inflation has been fairly low. But those measures (since the 2000s) have been hedonstically adjusted; meaning say a laptop that's 10% faster is considered 10% cheaper even if the price is the same.

</comment></comment></comment><comment><USER11> Some expect a correction to happen soon. Isn't the fact that people focus on that trillion achievement an indication that (some) investors currently don't focus on the fundamentals? We've seen some very high volatility of Facebook and Twitter stocks last week, even when fundamentally the news triggering these drops in value was not dramatic. Is that another indication?

If there's a big correction, these stocks might get back to a point where the trillion goal is again very far.

Anyone knowledgeable willing to share further insights and opinion?

<comment><USER12> Personal wealth, globally, is nearing USD $300 trillion. See [https://www.credit- suisse.com/corporate/en/research/research...](https://www.credit- suisse.com/corporate/en/research/research-institute/global-wealth-report.html)

That's _personal_ wealth, not including assets held by corporations. The fundamentals are that there's a surfeit of cash to invest globally. The predominate driver of growing wealth is the emergence of the developing world, not QE and other monetary policies. A correction will come, but it won't be so dramatic as to take the bottom completely out from underneath existing assets prices (not unless there's some global financial calamity), especially strong ones like Facebook or Amazon (Twitter is a different story). There's just too much money and not alot of places to park it with stable markets and/or high rates of return. The U.S. offers both. I wouldn't be surprised if in the next downturn stocks like Facebook remain buoyant and its everybody else that suffers.

<comment><USER13> > That's personal wealth, not including assets held by corporations.

Are not all assets held by corporations also personal wealth in the form of shares?

I'm not well versed in corporate finance, so correct me if I'm wrong, thanks.

<comment><USER14> You're right. The $100B cash held by Apple is already priced into its market cap, which is turn included in the personal wealth of all its investors. If someone were to sum up both personal wealth and corporate assets, they would be double counting.

That said, I think wahern's general point is still sound.

<comment><USER12> I'm no financial expert, but AFAIU the mechanics of securitization mean that we can assume some multiplier greater than 1x.

You can borrow against your shares at the same time Apple can borrow against its cash holdings and, ceteris paribus, the end result will be more debt than Apple's cash reserves even after considering a reduction in Apple's stock value. And this debt can be used to buy more assets. (Basically, fractional reserve isn't just a banking thing. It's inherent to the mechanics of capitalist finance.)

In addition, the ability to do this enhances capital allocation efficiency, which adds independent value to the entire system.

So there's not a simple function mapping corporate wealth to personal wealth, though you certainly can't simply sum corporate-held assets to personal wealth. I'm happy to be corrected for the implication.

</comment></comment></comment></comment></comment><comment><USER15> If you're into this sort of higher-level tech. analysis, my opinion is that Ben Thompson ([https://stratechery.com](https://stratechery.com)) does a much better job.

<comment><USER16> He spews bullshit is all I've seen.

And from what I've heard myself, he says he worked in Windows and understands technical issues but his linkedin profile says he was a Business Development Rep ((who're always under the sales org and not a specific product org)).

</comment></comment><comment><USER17> its strange to Microsoft still in the race after loosing web, search, mobile and much of the developer mindshare

<comment><USER18> Windows is still the de-facto standard x86 and x64 OS, powering everything PC- like from home desktops and office desktops to industrial control PCs, kiosks, ATMs, cashier systems and so on. I don't see this changing in the next 20 years, unless Microsoft make a concentrated effort to completely break Windows.

<comment><USER19> They are a fairly close 2nd in cloud computing, and growing faster than AWS.

And remember that Oracle is an enormous company just by focusing on enterprise, but MS is way larger just in enterprise. Sharepoint, SQL Server, etc etc.

And even though they are a very distant second in search, that product alone produces more revenue than most companies can ever dream of. It is actually a huge financial success.

</comment></comment></comment><comment><USER20> I think the trillion dollar mark is actually a very important psychological barrier. I've long felt as long as this debate about which one will be the first to cross that the market is sort of waiting for permission to value a company at over a trillion. I think it will be Apple and pretty soon, but no matter which company does it, I think it's important because I think others will be quick to cross over as well and this will blow the ceiling off the equities market. A trillion is a lot of money, but it's only about 10% higher than where Apple trades now, so there's no reason why they can't carry that valuation and quite a bit higher, especially as inflation continues to rise.

<comment><USER21> Pretty soon indeed.

</comment></comment><comment><USER22> I wonder when these companies will start offering dividends? I believe only MSFT (edit: and Apple) have done so far.

<comment><USER23> Facebook needs a war chest to buy up potential competitors.

Amazon has shown that it can use its money to profitably invest in other verticals and its a capital intensive business.

Google probably should start paying dividends. They still haven't shown they can invest money to diversify from being an ad business into other profitable verticals.

<comment><USER24> I was watching a Peter Thiel/Eric Schmidt discussion wherein Peter Thiel essentially says, "Google can't dare pay a dividend because it would mean they admit they're done innovating."

Provocative, but sorta true. The company that pretends to be the most innovative in the world might not do so well if they have the image of paying out dividends.

<comment><USER25> Counter-example: AAPL pays dividends and is widely viewed as innovative.

<comment><USER26> I would disagree that Apple is viewed as innovative. Granted, this is anecdotal based around people I know, but Apple is widely considered as non- innovative and resting on its iPhone laurels -- at least since Jobs passed away.

<comment><USER23> I'm not going to be crazy enough to say that there will never be anything bigger than the phone, but can you see anything that any company can do in the next five years that is more ubiquitous than the smart phone?

75% of the world's population has a cell phone ([https://www.rferl.org/a/report-says-75-percent-of-worlds- pop...](https://www.rferl.org/a/report-says-75-percent-of-worlds-population- have-mobile-phones/24648234.html)). No matter what any consumer electronic company introduces in the next 5-10 years, I doubt that it will have more impact than the consumer smart phone trend the iPhone started.

What company has been innovative in the consumer electronic space in the past decade? No matter what Apple does, I don't realistically see Apple or any other company introducing a consumer electronic product that is as successful (revenue wise) in the next decade.

<comment><USER26> I'm extremely extremely biased, but I run a company called Pavlok [1], with a goal to be more ubiquitous than the phone by 2030 (not quite 5 years).

We build technology to help people change habits, with instantaneous positive and negative feedback, and a digital currency called Volts[2] that rewards and pays people to do good habits.

Our goal is to sell the product in the initial phases (next 5-7 years), and eventually give them away to everyone in the world. One of our core products (unreleased) attaches directly to iphones and android -- I can't give too many details, but it becomes part of your phone.

Again, I'm extremely biased. But they say the best way to predict the future is to create it, so ¯\\_(ツ)_/¯

[1] [https://pavlok.com](https://pavlok.com) [2] [https://pavlok.com/volts](https://pavlok.com/volts)

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> i wonder what did races to 1, 10 and 100 billion look like?

<comment><USER28> One way to think of it is that Bezos' personal wealth is still short of what Carnegie or Rockefeller accumulated when adjusted for inflation or viewed as a percentage of total personal wealth. The Gilded Age was still more excessive than what we see today -- but not by much.

<comment><USER29> By "or", do you mean that both options are true?

</comment></comment></comment><comment><USER30> I'm not sure I believe that S&P 500 chart proves his point that we are living in historically similar times to the 1960s. S&P looks at the top of part of the distribution, not the whole distribution. If for some reason, there were more or fewer companies, it would mean something different. I will note that we did in fact break up Bell Telephone and standard oil. If we act quickly, maybe we'll never get to 1T.

</comment><comment><USER31> Umm, wat. Alphabet has two classes of shares that trade under different ticker symbols, GOOG and GOOGL. Together they add up to $1.6t. The fact the author has overlooked this is astonishing.

[edit: sorry, my mistake: the market cap reported is not actually outstanding shares times price, pointed out below]

<comment><USER32> Uhh, what?

You are right that there are two public tickers for Alphabet, GOOG and GOOGL, however the market cap you see when you search for their ticker is for the whole company, not the class alone.

Also, Alphabet has 3 classes of shares. A (GOOGL), B (privately held), and C (GOOG)

I assure you, the market cap is roughly $870B as of this writing.</comment></comment>


Secret Service seizes artist's illicit Apple Store photo project - <AUTHOR> http://nyconvergence.com/2011/07/secret-service-confiscates-brooklyn-artists-apple-art-project.html

<comment><USER2> How could that guy think what he was doing was legal? Such a cool idea though, I know I make some odd faces in front of a computer.</comment>


Anybody know why 240.0.0.0/4 is not used? - <AUTHOR> We have figured out a scheme to use it in a newly created layer of cyberspace between the current public and private networks, thus avoiding the legacy issues. A proposal nicknamed EzIP (phonetic for Easy IPv4) has been submitted to IETF:
https://tools.ietf.org/html/draft-chen-ati-adaptive-ipv4-address-space-03
EzIP can establish stand-alone "sub-Internets", each from one IPv4 public address to serve a region with population up to Tokyo Metro or 75% of the countries on earth. The sub-Internet configuration can realize the CIR (Country-based Internet Registry) model proposed by ITU several years ago, without establishing the CIR organization. If a government is not interested, private enterprises can make use of it to provide "Local Internet" services. Either way, it will be an option for consumers may to choose from for an more open competitive environment.
Thoughts and comments will be much appreciated.
Abe (2018-09-17 12:12) <comment><USER2> 240/4 is not globally reachable, so you can certainly use it in your org if you are not already using it for any multicast applications. [1]

This could vary wildly from company to company so there is not a universally correct answer here.

[1] - [https://www.iana.org/assignments/iana-ipv4-special- registry/...](https://www.iana.org/assignments/iana-ipv4-special- registry/iana-ipv4-special-registry.xhtml)

<comment><USER3> Not necessarily. Some OSes will not allow you to assign unicast IPs in that space. You may not even be able to route it locally.

<comment><USER2> For sure, people may have to configure systems and routers to allow this. People would also have to ensure they don't accidentally leak routes for this. That happens from time to time. I'm just saying it would be fine to use this if you are not already using it internally for multicast applications.

An example of vpn's that already do this with routable IP space is the LogMeIn Hamachi gaming VPN [1]. It uses 220.127.116.11/8 (Ministry of Defense). Gamers don't need to talk to the MoD, so that VPN implements it locally on each PC. You can take over address space of anything you know for certain you won't need to talk to, ever.

[1] [https://en.wikipedia.org/wiki/LogMeIn_Hamachi](https://en.wikipedia.org/wiki/LogMeIn_Hamachi)

Avoid using that VPN btw, super insecure and dangerous. You bridge your PC with lots of potentially infected PC's. I am just linking as an example.

<comment><USER3> 240.0.0.0/4 is a bit different, however. It is "reserved" (class E) space, not multicast, and some OSes are hard coded to not even allow its use. My understanding is newer OSes have relaxed these restrictions.

<comment><USER2> I could imagine HPUX 10.x not allowing that. They followed all manor of optional RFC's, then later added options to disable the checks for some of them.

Somewhat related, I used to blackhole 169.254/16 (zeroconf) on our linux images. Then people started using that in AWS and could not reach their internal API's. They route that network internally.

<comment><USER3> Ah yes, EC2 uses 169.254 for the "metadata API." Basically, an internal network that allows a host to retrieve its own configuration data. I can see how that denying that would cause problems!</comment></comment></comment></comment></comment></comment>


Late-Night TV Show Ratings and Hosts - <AUTHOR> http://graphics.wsj.com/late-night-tv-show-ratings-and-hosts/ <comment><AUTHOR> Awesome dynamic chart. Simple concept but able to explore lots of information.</comment>


Orbvt - a Svbtle/Obtvse clone in Meteor - <AUTHOR> https://github.com/bmelton/Orbvt Made using the new Meteor JS framework @ http://meteor.com/ <comment><USER2> Really cool to show off some of Meteors stuff, but...

Within 10 seconds my page was flooded with links directing me to conspiracy websites about 9/11 and people of the Jewish faith.

We've got some class-acts here on HN

</comment><comment><USER3> I think the naming convention was lost on them - I'm pronouncing "Orbvt" as "Or-butt".

<comment><AUTHOR> That is correct. In the 32 seconds we took to think of names, couldn't come up with anything that worked with meteors that had a 'u' in it.

Or-butt is the correct pronunciation.

Suggestions welcomed.

<comment><USER4> Svperbolide, Meteordvst, Spacedvst, Bvrst, Sodivm, Spectrvm, Eqvinox, Tempel- tvttle, Altitvde, Baetylvs, Svrface, Chondrvle, Dvstbowl, Lvnar, Vrth, etc etc.

<comment><AUTHOR> I think Lvnar is a winner for me. I might have to change it.

<comment><USER5> No! Keep 'em guessing! I literally chuckled when I saw "Orbvt"

</comment></comment></comment></comment></comment><comment><USER6> Svbtle is the new hello world.

</comment><comment><USER7> That was fast! While not very usable it really shows how fast you can make prototypes with Meteor. Good stuff!

<comment><AUTHOR> There's maybe an hour's worth of coding there, and an hour trying to figure out why my Mustache templates weren't rendering. (Pro Tip: If you don't invoke the template, it won't render.)

But yeah, the real reason for the HN post was to show how fast it is. Somebody that knew what they were doing could probably have done it in about 10 minutes, including the install.

I should also point out that the dev team is amazingly helpful in #meteor on freenode.

</comment></comment><comment><USER8> It's nice to see a meteor hack so early on. Meteor seems really awesome. But why does everyone these days try to copy Svbtle? Besides being a sleek blog design I see nothing that special that everyone is trying to copy. Svbtle is the new Bootsrap :-)

<comment><USER9> Svbtle cloning is the HN version of the Barbara Streisand effect.

</comment></comment><comment><USER10> Nice as a demo, but javascript-based/one-page/rich-client apps seem quite the overkill for a blog. Does meteor have any provisions for more static pages, or would that conflict with the pub-sub architecture?

<comment><AUTHOR> It'll serve static media, if that's what you're asking.

Otherwise, it's only about 15 lines of Javascript and a couple of Mustache templates. Perhaps you and I have different ideas of 'overkill'.

<comment><USER10> I was talking about execution, not coding. Dynamically creating a page that's mostly static content doesn't really benefit from instant updates.

Consider that recently static site generators have been enjoying quite a popularity, as they enable you to have a _very_ simple server-side system (static web server only, or something like Amazon's S3) and work well under load (being "slashdotted/reddited/HN'd"), without extensive caching.

<comment><AUTHOR> Ah, my bad. I completely missed your point.

By that same token, we'd consider Wordpress overkill for a blog too, right?

From my understanding, Meteor's focus is in probably the opposite trajectory as you're suggesting, but I also don't see any reason you couldn't use it to generate a static blog.

There's no need for it to be coupled to Mongo, so uninstall that. Then just implement a JS markdown parser to build a static file.

Of course, there's no need to use Meteor for this at all, as you could do it in straight up Node -- the enhancements you get from Meteor don't make this process any easier.

<comment><USER10> _By that same token, we'd consider Wordpress overkill for a blog too, right?_

Well, a lot of the people using static site generators now came from Wordpress. Mostly because they fulfilled all the "requirements": Able to handle markup/scripting/deployment, no big need for all kinds of widgets and plugins, and the possibility of being subjected to overload (e.g. by posting here…).

One _major_ feature of Wordpress and similar platforms is the editing/admin section, of course. Not everyone wants/can do everything with git. So I wasn't saying that there's no need for something like this at all…

Still, whether this is any worse than wordpress depends on the architecture, of course. Loading everything in client-side JavaScript doesn't need to be less efficient then generating it server-side. Good caching is possible, too.

<comment><AUTHOR> In theory, you could build a site that functions entirely with just HTML and client-side Javascript. I've done it before and, so long as you can expose a directory listing on wherever you keep your 'blog posts', you can just consume it with JS, perhaps transform Markdown into HTML (or just save as HTML).

You won't get an editing/admin section though, naturally, as you won't be able to save a file to the server from client-side JS. Something like this or Node bridges that gap.

Have you seen <http://www.spintoapp.com/>? It just launched here the other day, and might be exactly what you're looking for. (Jekyll as a Service, basically)

</comment></comment></comment></comment></comment></comment><comment><USER11> Taken from the README: "It's a bit ridiculous at the time as there aren't any permissions at the time". I understand that Meteor is hot cake, but we've given up as programmers, right?

<comment><AUTHOR> I'm not affiliated with the Meteor dev team, but as I understand it, we're only a couple weeks away from having data security.

Other than that, Meteor looks like about the most awesome thing I've seen since Django, so I wanted to play with it.

Yes though, I have to concede that this demo is effectively useless in any meaningful sense of the word as, best case scenario is that users add anti- semitic remarks, and worst case is somewhere between inserting malicious JS and deleting all the posts.

</comment></comment><comment><USER12> Whats with all the weird antisemitic stuff on your test blog?

<comment><USER2> Someone from the HN community (or wherever else this has been put up) is flooding the blog with it.

I'd doubt this guy built the site to showoff Meteor AND his own agenda of hate, but you never know...

<comment><AUTHOR> No, you nailed it. My personal hate agenda would be targeted at traffic in DC.

<comment><USER2> Hah.

This does underscore the importance of them baking security into this framework properly, but I wouldn't let it detract from my overall excitement over Meteor itself

</comment></comment></comment></comment><comment><USER13> Is there anywhere you used {{{ in handlebars? This could be a real problem if people start inserting javascript.

<comment><AUTHOR> Good point. I just de-triplestached the site and redeployed.

</comment></comment><comment><USER14> Renders quite slow if you go back to previous page.

<comment><AUTHOR> Are you using Chrome on OSX by any chance?

I get the same behavior, but I also get it when I use Svbtle or Obtvse as well.

<comment><USER14> Chrome on win2k8. I have never tried the other two software,

</comment></comment></comment><comment><AUTHOR> Clickable links:

\- <http://github.com/bmelton/Orbvt>

\- <http://orbvt.meteor.com/></comment>


Hacker Say They Compromised ProtonMail. ProtonMail Says It's BS - <AUTHOR> https://www.bleepingcomputer.com/news/security/hacker-say-they-compromised-protonmail-protonmail-says-its-bs/ <comment><USER2> Someone really has it out for Protonmail. Was nearly a week of ddos not long ago.

And this just seems like a smear campaign, (paying $20 per tweet to raise awareness?) rather than a researcher simply trying to get paid.

They already have a bug bounty program:

[https://protonmail.com/blog/protonmail-bug-bounty- program/](https://protonmail.com/blog/protonmail-bug-bounty-program/)

</comment><comment><USER3> Love the "hacker's" moral stance and then three lines later they are offering the data to the highest bidder. This sounds to me like an angry kid got hired by the competition.

</comment><comment><USER4> Being in a security business, Protonmail has some incentive to demonstrate a capacity to repel attacks. In that sense, maybe it really is a hoax, in the sense that this is a PR stunt? The "hacker" is a staged personality?</comment>


Jasymca ported to the web - <AUTHOR> http://jasymca.holoklip.com

<comment><AUTHOR> Dev Here,

I have thought of creating an Amazon Paid AMI that could be sold to schools who want to make this available to students.

If you are a student, would you have a need for this?</comment>


Rotoscoped Animation of Filmed Parkour - <AUTHOR> https://moral.net.au/writing/2016/08/27/animation/ <comment><USER2> > I think this is an okay result, coming from a programmer with coarse drawing > ability and zero prior experience of animating things.

Very humble conclusion, I think its a great result and I'd be more than proud it that were my first work of any kind.

</comment><comment><USER3> The use of rotoscoping to deliver realistic 3D animation has been used extensively by Neill Blomkamp for his films: CG characters such as Christopher Johnson (insectoid alien) and Chappie (robot) were animated by rotoscoping an actor's on-set (or on-location) performance rather than suiting the actor up in one of those ping-pong-ball suits and having them gesticulate in an imaginary set in front of a green screen.

<comment><USER4> further down your tangent: one big disapointing suspensions of belief i had with... was it District 9? was where it shows one of the police robots flinching when the cement wall it's behind gets hit by small arms fire.

to me at the time it informed me that there was mocap going on, or a dumb cg artist/director deciding that the robot had to react in a more humanlike fashion.

of course now that i think about it, a military robot with auto-flinch- reflexes could actually help it avoid hits (similar to why our flinch reflex evolved i suppose) so that puts me in my place!

<comment><USER5> Hey, you seem like the kind of person who'd enjoy this: [http://99percentinvisible.org/episode/future-screens-are- mos...](http://99percentinvisible.org/episode/future-screens-are-mostly-blue/)

Basically, whenever some sort of "dumb" design decision in a movie annoy you, try to come up with a decent explanation for why it's actually an intelligent design decision. It's a lot of fun!

> The most interesting lessons from sci-fi come when you assume, for the sake > of argument, that everything is in sci-fi is there for a reason–even things > that look like mistakes. There's a word for this, apologetics, which usually > refers to the act of attempting to close logical loopholes in theology.

> Take Star Wars, for instance, in the scene when Luke and Han Solo are in the > Millennium Falcon blowing up TIE fighters.

> If they're fighting in the cold vacuum of space, why do we hear the ships > exploding? Sound doesn't exist without air.

> George Lucas probably figured that a silent gun fight would probably have > been way less dramatic. He wanted to make the scene feel real to the > audience, even if it was less true to reality. And if we move from the point > of view that what works for the audience will work for the user, we can ask > ourselves–could this make sense? Is there an explanation that can warrant > hearing ships exploding in space?

> Well, what if the sound is the interface? Audio is a much more efficient > gauge of surroundings, since it spans 360 degrees, whereas vision only > covers 120 degrees. It might be that there are sensors on the outside of the > Millennium Falcon that provide 3D sound inside the gunner seat. So when we > hear ships blow up, we're actually hearing an augmented reality interface > that Luke and Han hear. Maybe?

> With design thinking, there are logical excuses for every interface > discrepancy. And it makes sci-fi that much more fun to watch.

<comment><USER6> The space battle/trading game Terminus takes this approach to providing a "familiar" set of controls while still letting you exerience something closer to realism.

You get to see nebulae and moving starfields, explosions gives of sounds, and you can steer as if you're driving a plane, pretty much. But everything that isn't "real" is described in the manual as assistance provided by the in-ship computer to assist human navigation, and can be turned off if you prefer the more austere and genuine look and feel.

Even the way the ship handles - if you look at one of the outside views, while the ship is handling like a plane, you'll see directional boosters fire accordingly; turn it off, and you have full control and can e.g. rotate the ship and fire backwards at ships pursuing you, while continuing to coast away from them.

</comment></comment></comment></comment><comment><USER7> Also see [https://en.wikipedia.org/wiki/Prince_of_Persia_(1989_video_g...](https://en.wikipedia.org/wiki/Prince_of_Persia_\(1989_video_game\))

 _Much like Karateka, Mechner 's first game, Prince of Persia used rotoscoping for its fluid and realistic animation. For this process, Mechner used as reference for the characters' movements videos of his brother doing acrobatic stunts in white clothes and swashbuckler films such as The Adventures of Robin Hood_

<comment><USER8> That's in the article.

More interesting, IMO, is [http://www.jordanmechner.com/backstage/journals/](http://www.jordanmechner.com/backstage/journals/), which links to his journal which got published as "the Making of Prince of Persia" (preview at [http://www.jordanmechner.com/downloads/makpopsample.pdf](http://www.jordanmechner.com/downloads/makpopsample.pdf)) and to the Apple ][ source code for Prince of Persia ([http://github.com/jmechner/Prince-of-Persia-Apple- II](http://github.com/jmechner/Prince-of-Persia-Apple-II))

<comment><USER9> Making of Prince of Persia is one of the best books I've read, even if it's just a book version of his journals. It's really captivating as it records his journey as he perfects his game (along with some distractions) and finally gets it published by a major studio.

</comment></comment></comment><comment><USER10> I now see it as more crucial that this author succeeded in designing a workflow, than that the result is the best one possible.

In media, you're always challenged - implicitly - to discover a good workflow for doing something, to craft a structured approach so that the bulk of it is a matter of "coloring in the lines" or "filling in the blanks." Being considered a "professional" is mostly indicative of having some flexibility, and not staying stuck in a one-note style. For visuals like this, sometimes that means a very technology-driven approach like rotoscoping, mo-cap, 3D and procedural rendering, other times it means relying on basic conceptual drawing and animating skills.

And it's turtles all the way down. Before you can draw a character you have to design a character. And you need a process for designing the character so that they make sense in the context of the world or story. And then the world needs a design, and so on, and so forth, until you're looking at basic principles and philosophies driving the intent of the work. At least, that's how it would work if you built all of culture from scratch. In practice, creators start borrowing elements on whims or as they fall out of their comfort zone, hence why most of culture is remixed.

What you buy when you hire an artist is a "package of familiarity." Some artists are really great illustrators but are uncomfortable with designing original characters; some are good at comic book scenes with dynamic poses, others at portraits and fashion drawing. A Bob Ross landscape is defined by a process that is so straightforward that anyone could pick it up just by watching. And what defines "programmer art" is mostly that it has no particular workflow or structure in mind, it is entirely whimsy guided by pragmatic efficiency. Other media like music, storytelling, game design, and, of course, programming share these same qualities.

Here the author downplays technical drawing and drafting abilities, but those are as valid a form of presentation as any, and they help push the focus back towards the interesting part of the material, which is the realistic motion. A character cluttered with detail detracts from movement - this is true even if you look at the different versions of the first Prince of Persia and how they translate the same motions to higher fidelity platforms. Same frames, but they become more wobbly with colors, outlines and higher resolution. [0]

[0] [https://www.youtube.com/watch?v=bx1zDjDFSW4](https://www.youtube.com/watch?v=bx1zDjDFSW4)

</comment><comment><USER11> > Another similar use of rotoscoping was by Eric Chahi in his masterpiece > Another World

Aside: "Another World" (aka "Out of this World") is available on Steam.

<comment><USER12> It's on GOG, too (for the same price, when I checked just now). Also, there's a reimplementation of the game engine, which uses the original data/bytecode files: [https://github.com/joskid/Another-World-Bytecode- Interpreter](https://github.com/joskid/Another-World-Bytecode-Interpreter)

</comment></comment><comment><USER13> Does anyone know how the term rotoscoping was coined? I've never understood the etymology and have yet to get a good search result on it either.

<comment><USER14> it comes from rotoscope - the device used. It can project the (possibly rotated) frame of movie onto working area.

<comment><USER13> Maybe it is a rotation of the projected image. Again looks like we're still inconclusive on this in terms of the etymology.

</comment></comment></comment><comment><USER15> Is the link for the GenLock tag wrong? It takes me to parkourpedia, which I'm assuming is incorrect unless he's using the pictures in the wiki as a demonstration? It's not clear to me, am I missing something obvious?

</comment><comment><USER16> The greatest takeaway here is that, by using live action as reference for both character posing and timing, you're able to shortcut visual appeal.

Read The Illusion of Life, Animators Survival Kit and the Preston Blair book if you're serious about including animation in a project -- or befriend an animator. Animators don't let other animators rotoscope.

<comment><USER17> I'm not sure I'd go as far as that. Rotoscoping creates a unique visual style, I like the look.

Want to elaborate?

<comment><USER18> To make animation appealing you need to anticipate, exaggerate, and squash/stretch motion.

These do not appear on rotoscoped footage because they do not occur in real life. If you rely on rotoscoping the result is bland movements which lack a "spark of life".

In other words, rotoscoping creates an "uncanny valley" for motion.

</comment></comment></comment><comment><USER19> The author makes some interesting comments, view the page source.

</comment><comment><USER20> So what is the name of this (future?) 2D rotoscoped parkour game? I, for one, am very interested.

<comment><USER21> In case you haven't seen it, Mirrors Edge [1] is an excellent first-person parkour/action game.

[1] [https://www.youtube.com/watch?v=2N1TJP1cxmo](https://www.youtube.com/watch?v=2N1TJP1cxmo)

</comment></comment><comment><USER22> > And just look at it! Even on the Apple II with only 4 colours it's mind- > blowingly detailed and smooth!

It is amazingly smooth and so pleasant to watch, and this is the first time I've noticed that !

<comment><USER6> The realism of the animation was a big deal in pretty much all the reviews of it when it was released, as far as I can remember (I didn't pay much attention to the Apple II, as it was virtually unseen in Europe, but I remember reviews of the C64 and Amiga versions).

I never actually played the game, but saw the animations, and they certainly stood out.

</comment></comment><comment><USER23> Bravo! Wonderful post. Thanks for sharing! :)

</comment><comment><USER24> Seeing this, I imagine something like Pokémon Go, but for parkour; aka get the Lat/Lon for a location, record a parkour set, upload the video, create the animation, generate score, allow other users to see location and animated clips.

</comment><comment><USER25> What is up with the scrolling on this page? How'd they manage to break inertial scrolling on iOS Safari? Really annoying.

</comment><comment><USER26> You might want to put this on your projects page. Although I do enjoy the Fabio shopping gif.

</comment><comment><USER27> wow pretty cool stuff, yes Prince of Persia was probably the first one to use it

</comment><comment><USER28> Taking shortcuts on your hobby, and being afraid of parts of your hobby, defeats the point of having a hobby. Why not learn to draw and animate from imagination? That way you'll be limited only by imagination.

Not to belittle the technical achievement, of course.

<comment><USER29> Well, to each his own, I guess.

I spent several years learning to draw and paint, it was a great hobby. BUT, I didn't get to the point of being able to draw character-type art. That level of drawing is __hard __, due to the uncanny valley.

Also, I think it's also cool that he decided to try a different technique than hand-drawing, and went on to (A) get good results and (B) document it clearly. Doesn't feel to me like a "afraid of part of your hobby", more like "how do I get around my own limitations?" thing.

</comment></comment><comment><USER30> Great article, but why Python? I would have thought a proper functional language like Rust or Scala would have been more appropriate.

<comment><USER6> Why do you think the language matters for this, beyond picking one he's familiar with?</comment></comment>


Tagged pointers and fast-pathed CFNumber integers in Lion - <AUTHOR> http://objectivistc.tumblr.com/post/7872364181/tagged-pointers-and-fast-pathed-cfnumber-integers-in

<comment><AUTHOR> I don't usually think runtime hacks are the way to go (who am I kidding? I love runtime hacks), but this is damn clever on Apple's part.</comment>


Ask HN: Productivity tools- Useless, useful or incomplete? - <AUTHOR> I'm trying to gauge the zeitgeist around productivity tools- todo lists, mindmaps, time trackers, pomodoro timers, trello variants, habit builders, Omni-*, etc
This is because I am building an app, called "tymtu", in my spare time that would enter into that crowded arena. Tymtu is thus far without a clear category or well known description,  so I'll just describe it as a product management tool, where you, the user, are the product. But it aims to fill the same role as many pre-existing tools and it should be classified as a "productivity tool".
So my question is "Are these sorts of tools truly useful to you? Or are they just distracting noise? Do you believe that there is some undiscovered country left to conquer? Is it a fool's errand to attempt what so many other's have failed?" <comment><USER2> I think there's room IF it's done properly, just as Slack has proven. The question is what needs to be done for it to be done 'properly'. Maybe it's combining several types of productivity tools in one making it more convenient to use both because everything is all in one place and because of better ui/ux. Our maybe it's dropping all the nose from current tools by getting rid of the features that puerile don't really use. It could also be a combination of both those by combining the best features of the most useful tools and make them easy to use.

A few tools I would like (not sure if they exist or not):

* StayFocused type of app that blocks chrome apps * StayFocused type of app for Android/iOS * Desktop app that will keep focus on a chosen application for a certain amount of time (for instance if I'm writing a report on Word, I can't take my focus out of Word and use any other programs because of that) * Maybe an app that I connect my credit card to and at the beginning of every day, I'll start with $10 'in escro'. Then throughout the day it'll donate x amount to y charity for every z minutes I spend on sites I have banned. This concept can also be combined with any of the previous.</comment>


Every startup team should read this (in my opinion) - <AUTHOR> http://headrush.typepad.com/creating_passionate_users/ I got a lot of ideas from this blog, it's so bad Katty isn't posting anymore, but I keep reading old posts.<p>What do you think? <comment><USER2> I think I speak for everyone here apart from two people when I ask: what on Earth is this about?

<comment><USER3> The link is to Kathy Sierra's "people on the web are mean" (google can doubtless explain further) post, which is followed by a lot of her favorite pictures/graphs/bullet points about design/management/stuff. The latter are, presumably, the things every startup team should read. The story headline probably ought to have explained that, since the lead-in part is long, and its meaning obscure.</comment></comment>


A Robot for Timo – cheap telepresence for remote teams - <AUTHOR> http://blog.printf.net/articles/2014/03/18/a-robot-for-timo/

<comment><USER2> Hi HN -- I'm the blog post author and one of the people who built this, am happy to answer any questions about the hardware/software behind it!

<comment><USER3> Any plans on making one that can move around on wheels?

<comment><USER2> Haven't thought about it much -- my first thought would be that the solution in the blog post could be the right one for a small office where movement of the base isn't necessary, and for one on wheels you should just go buy from Double Robotics. Their product looks really nice.

If I had to build one that moves around, I'd start with investigating the Roomba API, with an aim to mount the iPad on a Roomba and expose remote control of the Roomba to the chatter. You wouldn't get as high off the ground as a Double robot without making the mount unstable, though!

</comment></comment></comment><comment><USER4> Any reason you went with the Bescor over just a servo motor?

<comment><USER2> Probably just inexperience! Do you have any particular parts in mind?

<comment><USER4> You could have rigged up something like this: [https://www.servocity.com/html/s3102_micro_mg.html#.Uyu11fna...](https://www.servocity.com/html/s3102_micro_mg.html#.Uyu11fnaKHM) to the PWM output of your Arduino.

This would have moved the iPad around, the same way as the pan tilt head.</comment></comment></comment>


Show HN: Isitfit: Measure an AWS account's EC2 total utilized capacity ratio - <AUTHOR> https://isitfit.autofitcloud.com/ <comment><USER2> Love that Google provides something like this for free within their cloud platform. Still don't get why people go to AWS... other than it's the popular kid.</comment>


Nokia boosts Qt commitment, changes Symbian strategy - <AUTHOR> http://arstechnica.com/open-source/news/2010/10/nokia-boosts-qt-commitment-changes-symbian-strategy.ars <comment><USER2> If you're interested in developing Qt mobile apps, there's the $10M app challenge for North America at <http://www.callingallinnovators.com/10m/>

</comment><comment><USER3> Another week, another software strategy at Nokia. :-)

<comment><USER4> I would have to disagree. Qt has been written on the wall for the past few years ever since Trolltech was acquired.

<comment><USER3> Yup... just writing on the wall (and little else) for a _long_ time now. Now that's a fast turnaround time for a strategic acquisition! Oh, and by the way, a final goodbye to Symbian. Surprise! :-)

Nokia's software division will manage to drown Qt, too.

</comment></comment></comment><comment><USER5> Thanks for the LGPL license option Nokia. It's made Qt an available option for my development work. Any chance you'd go the extra mile and add a license exception to allow static linking?

<comment><USER6> What's the advantage of static linking?

<comment><USER7> The QT libraries are gigantic -- easily as big as the JVM, but unlike the JVM you aren't going to need most of what is there, so your programs will take up a lot less space if you statically link them.

This won't matter if you ship 'em on DVD, but it makes a lot of difference if you provide downloads over the internet.

<comment><USER8> On Mac:

      QtCore    -  5.7 MB
      QtGui     - 24.4 MB
      QtNetwork -  2.6 MB
      QtSql     -  0.5 MB

Not so gigantic by today's standards: 33.2 MB, 12 MB zipped.

For comparison, MacRuby.framework takes 51 MB, 17.3 zipped.

PS But, of course, it would be nice to have a static linking-friendly [free of charge] license.

<comment><USER7> Do'h, I checked the size some months ago - but I must have had them compiled in debug mode. Still 30 MB is quite large to download over an average commercial internet link.

</comment></comment></comment></comment></comment><comment><USER9> A good example of the power of competition at work. They wouldn't have done this if they face no completion from other OSes.

In the end, we customers are the real winners! :)

<comment><USER10> I first heard of this when Nokia had well over 50% of the market. It's announced now, but known for a long time.</comment></comment>


Ask HN: Anyone know where Mark Pilgrim went? - <AUTHOR> I went back to diveintohtml5.org to find something today, and it's gone. Then I checked diveintomark.org, diveintopython3.org, twitter.com/diveintomark...
Is Mark Pilgrim pulling a disappearing act? <comment><USER2> So check this out: Google "http error code 410" and the second hit is from diveintomark.org circa 2003.

""" Let's all talk about HTTP error code 410. ... Error 410 means Resource gone, as in, a resource used to exist at this location, but now it's gone. Not only is it gone, but I don't know (or I don't want to tell you) where it went. ... Now, there is not a lot of information about error 410... I suppose because it addresses a condition that doesn't come up very often. Also, we've all been brainwashed into believing that all resources should be permanent, which simply isn't true. """ Google cache: <http://bit.ly/qxdBi5>

His servers are returning 410 errors but also the same very deliberate HTML:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">  <title>410 Gone</title>
Gone

The requested resource
/
 is no longer available on this server and there is no forwarding address. Please remove all references to this resource.

Clearly Mark's invocation of the 410 error is deliberate.

<comment><USER3> surprising how many people did not notice its 410 not another http code..

</comment></comment><comment><USER4> He's OK. I don't know how to link a tweet but see textfiles account(<https://twitter.com/#!/textfiles>)

Mark Pilgrim is alive/annoyed we called the police. Please stand down and give the man privacy and space, and thanks everyone for caring. ... The communication was specifically verified, it was him, and that's that. That was the single hardest decision I've had to make this year.

<comment><USER5> Mark is annoyed? How about Mark is goddamn lucky and should be both embarrassed and grateful that he's enough of a character that a chunk of the internet cares about him.

Mark is annoyed?

It is Mark Pilgrim's right to disappear, but to disappear in a puff of greasy black smoke and 4̶0̶4̶s̶ 410s is just attention whoring and begging people to look for him and call the police.

There is no reason for Mark to be annoyed that some caring people looked for him. There is every reason for him to count his blessings.

I sincerely wish him the best and hope he recovers from whatever ails him, but please don't tell me how annoyed he is.

<comment><USER6> He probably/hopefully/certainly also has friends and family that he interacts with on a day-to-day basis that, were he to actually-really-really disappear, would care about him and call the police. It is frankly kind of creepy/scary that a bunch of people he barely knows think it is their place to /call the police/ if he gets sick of the weird kind of attention you get from that kind of audience (and frankly reinforces the behavior of wanting to "go 410").

<comment><USER7> Jason Scott, the guy whose twitter account that is and the guy who called the police, evidently knows Mark Pilgrim well enough to verify that he was talking to Mark because they were discussing a matter "only the two of them knew about".

That doesn't sound like "creepy Internet people Mark barely knows" to me.

<comment><USER6> Firstly, let me point out that I am responding to jerrya, not Jason Scott (whom I have also interacted with on a few occasions, and is a friend-of-a- friend enough that when I heard about this mess I turned to someone else in the room and asked them about what was up).

"Mark is goddamn lucky and should be both embarrassed and grateful that he's enough of a character that a chunk of the internet cares about him"

I believe that statement belies a general mentality that I run into constantly: I myself have "disappeared" a few times, for less than 72 hours, because I decided to "take a weekend off" (attending a concert, for example), and I /did not appreciate/ that a ton of people on Twitter seemed to think that meant that I had "died", and insinuated calling the police to find me.

Regardless, to respond now to your comment regarding Jason: they apparently aren't close enough for Jason to a) call Mark directly, b) call someone in Mark's family, c) call any of Mark's friends, or d) have any clue what happened to Mark other than to "[call] his local PD for a welfare check", which to me indicates they aren't really close at all.

Seriously: having something "only the two of them knew about" isn't actually that rare: I've only talked with the man (Jason) a couple times, and yet I bet I could pass that test as well.

<comment><USER8> Well if you disappeared for a serious reason, maybe you would appreciate people caring. Other than that, just tweet "taking a weekend off".

<comment><USER9> oh right, because we're all married to the internet, and therefore should check in with them whenever we step out for a minute.

Seriously, take a step back and re-read what you just said.

<comment><USER8> It seems the person in question is married enough to the internet for others to notice if he goes silent for two days.

<comment><USER6> I think a key issue here is: it isn't any of their business. I did not promise I would be around 24 hours a day, and they have no introspection into my life to know when something is normal behavior or not.

There are tons of people who do, though: my girlfriend, the people I hang out with at my office every day, and even a few "long term allies" (as it were) I've come to know only online (and talk with on IRC). Some (in fact, many) of these people even have access to my exact location at all times via Latitude.

But the people I meet at conferences, the people who follow me on Twitter, or even the people who lurk in IRC channels I'm in? It is simply not any of their business where I am or what I am doing, and it is absolutely silly for them to expect me to tell them how long I'm going to be gone.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> This isn't totally unprecedented.

In October 2004, Mark stopped blogging after a post titled "Every Exit" which read: "It's time for me to find a new hobby. Preferably one that doesn't involve angle brackets. Or computers. Or electricity." [1] That post sat at the top of his previously very active weblog for 18 months until he returned in April 2006. Of course, that time he only stopped posting new material; he didn't delete all his existing resources. But he did disappear from online life for a while.

[1]: [http://webcache.googleusercontent.com/search?q=cache:Mqb93dp...](http://webcache.googleusercontent.com/search?q=cache:Mqb93dpyOtgJ:diveintomark.org/archives/2004/10/18/exit+mark+pilgrim+new+hobby&cd=1&hl=en&ct=clnk&gl=us&client=firefox-a)

</comment><comment><USER11> Looks like one of his last tweets:

 _Hey everybody! Adobe has acquired another batch of awesome products that they will slowly ruin through incompetence and mismanagement!_

From [http://topsy.com/twitter.com/diveintomark/status/12091889959...](http://topsy.com/twitter.com/diveintomark/status/120918899599474688)

<comment><USER12> The Adobe cartel has kidnapped him!

<comment><USER13> Oh no! Dude I'm scared... He taught me Python #sadface

</comment></comment></comment><comment><USER14> Apparently it has been verified he is alive.

<http://twitter.com/#!/textfiles/status/121436177298493440>

@textfiles (Jason Scott) Mark Pilgrim is alive/annoyed we called the police. Please stand down and give the man privacy and space, and thanks everyone for caring.

@textfiles (Jason Scott) The communication was specifically verified, it was him, and that's that. That was the single hardest decision I've had to make this year.

</comment><comment><USER15> Good question

[http://meyerweb.com/eric/thoughts/2011/10/04/searching- for-m...](http://meyerweb.com/eric/thoughts/2011/10/04/searching-for-mark- pilgrim/)

</comment><comment><USER16> His GitHub projects have been mirrored: <https://github.com/diveintomark/>

Dive Into Python 3: <http://diveintopython3.ep.io/> GitHub: <https://github.com/diveintomark/diveintopython3>

Dive Into HTML5: <http://diveintohtml5.ep.io/> GitHub: <https://github.com/diveintomark/diveintohtml5>

</comment><comment><USER17> I'd definitely like to know what happened to Mark Pilgrim and hope he is well. It's still reassuring to know that his websites are still archived by the Internet Archive. (e.g., [http://web.archive.org/web/20110726001953/http://diveintohtm...](http://web.archive.org/web/20110726001953/http://diveintohtml5.org/))

</comment><comment><USER18> His github account is gone as well (<http://github.com/diveintomark>).

This is troubling. I'm glad I downloaded Dive Into Python 3, at least.

<comment><USER19> His G+ account is gone too <https://plus.google.com/111966606387715428604/posts>

<comment><USER20> Reddit account deleted too: [http://www.reddit.com/r/IAmA/comments/f545e/i_am_a_fourtime_...](http://www.reddit.com/r/IAmA/comments/f545e/i_am_a_fourtime_published_author_i_write_free/)

<comment><USER21> His python RSS parser, <http://www.feedparser.org/> website is down, too.

</comment></comment></comment></comment><comment><USER22> "Stand down Mark Pilgrim alert. Google, his employer, is on it. Thank you all. Hoping for "he's just pissed off at Internet" as outcome."

Source: <http://twitter.com/#!/GlennF/status/121434638282530816>

</comment><comment><USER23> That's a really sad news.

He hasn't deleted his Hacker News Account yet. He last commented 27 days ago.

<http://news.ycombinator.com/user?id=MarkPilgrim>

[I loved his blog and I wish someone has archive for it. I did not archive it locally because Mark used to write articles about long term archival of his data and I didn't think he would ever delete all his public writings.]

<comment><USER24> _He hasn't deleted his Hacker News Account yet._

I don't believe you can delete an HN account.

<comment><USER25> I think you can email pg to delete your account.

<comment><USER26> PG does not typically delete accounts; he just disables the login. All of the comments and submissions are still there under the original name.

<comment><USER27> The poor man's HN account delete: change email, change pass to random gibberish, logout.

You're free.

Until the next account.

<comment><USER28> That's not necessarily the point. The most important use of a delete account functionality is to protect one's own privacy should you not want to be personally connected to statements you made anonymously.

<comment><USER27> That's the great thing about the internet and pseudonyms :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> Jason Scott of textfiles.org has called his local police department for a welfare check...

<https://twitter.com/textfiles/status/121430050930298880>

<comment><USER30> <https://twitter.com/textfiles/status/121436177298493440> : "Mark Pilgrim is alive/annoyed we called the police. Please stand down and give the man privacy and space, and thanks everyone for caring."

</comment></comment><comment><USER31> As pointed out by user mikelietz on Eric Meyer's site, <http://firehose.diveintomark.org/> is still up.

<comment><USER32> Mirrored!

<http://dl.dropbox.com/u/1213413/markpilgrim.htm>

<http://dl.dropbox.com/u/1213413/markpilgrim.xml>

</comment></comment><comment><USER33> I really hope Mark is okay, and I'm really going to miss Dive Into HTML5. That resource had a truly unique writing style, featured a great design, and was an a absolute treasure trove of valuable information. I was literally on the site just yesterday, reading up on local storage.

<comment><USER34> His contributions to the community were released under liberal licenses and will undoubtedly be widely available tomorrow. Heck, you can `apt-get install diveintopython` on an Ubuntu system. However, a lot of links just got broken across the internet - and his books are popular entry points for novices. Hopefully when whatever is going on in his life cools down, he can transfer the domain names to a responsible custodian.

</comment></comment><comment><USER22> "Mark Pilgrim is alive/annoyed we called the police. Please stand down and give the man privacy and space, and thanks everyone for caring."

Source: <http://twitter.com/#!/textfiles/status/121436177298493440>

</comment><comment><USER35> _why 2.0.

</comment><comment><USER36> Similar (though not as extreme) behavior has occurred in the past:

[http://web.archive.org/web/20110726001259/http://diveintomar...](http://web.archive.org/web/20110726001259/http://diveintomark.org/archives/2004/10/18/exit)

</comment><comment><USER37> Perhaps he read this

[http://www.freakonomics.com/2011/09/30/the-upside-of- quittin...](http://www.freakonomics.com/2011/09/30/the-upside-of-quitting- full-transcript/)

(discussion at: <https://news.ycombinator.com/item?id=3071854> )

</comment><comment><USER38> There's a precedent for this. He disappeared from his blog for a while in 2004. Check the Google cache: [http://webcache.googleusercontent.com/search?q=cache:diveint...](http://webcache.googleusercontent.com/search?q=cache:diveintomark.org/archives/2004/10/18/exit)

</comment><comment><USER39> <http://diveintohtml5.com/> seems to still be working

<comment><USER34> The domain for that site is owned by a Chinese university, and the IP address of the server it's hosted on looks like a shared server (there's over 200 sites hosted on that IP). I doubt Mark has anything to do with hosting that site.

<comment><USER40> Out of sheer curiosity - how do you tell how many sites (and which ones) are hosted on a shared server?

<comment><USER41> <http://spyonweb.com/>

      or

<http://w3who.net/>

They are not always 100% complete, but they are free and have good coverage.

For example, did you know that ycombinator.com also hosts workatastartup.org? <http://spyonweb.com/ycombinator.com>

</comment></comment></comment></comment><comment><USER42> Holy shit, I was just using "Dive Into HTML5" at a hackathon this weekend. It helped a ton, I loved the way that site was designed. This is eery.

</comment><comment><USER43> > Is Mark Pilgrim pulling a disappearing act?

Shouldn't we respect his wishes? If he wants to pull the plug on his online identity, he should be allowed to do so without HN sending out an internet search squad.

<comment><USER44> He expressed no wishes. I think that at this point, people just want to know what happened. That requires doing things like this.

</comment></comment><comment><USER45> 10/4 - never forget. the gayest day on the interwebs. everyone acting like old ladies towards a grown man. [eagle_cries]

</comment><comment><USER46> Maybe he and _why are in Galt's Gulch? (Any Atlas Shrugged fans?)

<comment> DanI-S I can't imagine _why being an objectivist...

<comment><USER47> Lol, seconded.

</comment></comment></comment><comment><USER3> Respect his wishes, even his google accounts/profiles gone..

As far as I know he is still working at Google

<comment><USER48> The problem is that there are no wishes to respect. I think everyone mainly just wants to know he is okay. If he is and he wants space, I'm sure he'll get it.

<comment><USER49> I think Zed lucky-stiff'd him.

Which is the proper punitive measure for anybody that actually teaches the usage of JDBC.

</comment></comment></comment><comment><USER49> He's making recompense for making JDBC part of the first exercise in a Python book.

He'll return from the self-flagellation in two years after some time spent at a monastery.

I fully expect his enlightenment will bring much into the world of programming.

<comment><USER50> You are being needlessly insulting to someone who could be in serious trouble.</comment></comment>


Study of sapiosexuality suggests some really are attracted to intelligence - <AUTHOR> http://www.psypost.org/2018/01/study-sapiosexuality-suggests-people-really-sexually-attracted-intelligence-50526 <comment><USER2> Is anyone really attracted to someone who isn't smart. Sure you don't need to be a PHd. but, at least for me, you need to be able to have an informed opinion on things to be able to hold an interesting conversation. I'm so glad my wife meets that for me, we have great back and forth on things.

<comment><USER3> Not too long ago on this forum someone mentioned a paper where they showed photographs of the male torso to women. The outcome was that the most muscular was considered most attractive.

Didn't look at the details, though.

<comment><USER4> Yea, but having a muscular torso doesn't preclude the male from being intelligent as well.

People look at attraction in too much of a binary way. I would think it's most likely that humans look for both physical and intellectual prowess in their mates. There might at times be a bit of a trade-off between the two, but likely we're trying to optimize for getting as best we can in both categories.</comment></comment></comment>


Ask YC (YC S14) Applicants: What is the size of your team? - <AUTHOR>

I'm considering applying as a single founder, and I was wondering whether there are any other applicants that are applying as solo-founders?<p>Also, do you know of people that have successfully applied as single founders (does this requirement change if the founder is filling out the non-profit application)? <comment><USER2> I'm a solo founder. Honestly, I was a little concerned with the question specifically outlining this fact, even though it assured us not to worry.

I'd prefer not to be a solo founder, I just haven't found anybody suitable yet. I'm hoping that changes in the future.

</comment><comment><USER3> Probably the most notable answer to your second question of successful single founder applications is Drew Houston with Dropbox.

<comment><AUTHOR> Didn't he get rejected and have to re-apply with Arash?

<comment><USER4> The first time he applied it was with an test prep idea, if I recall PG correctly, and he was rejected.

The second time he applied with Dropbox, he was accepted. After being accepted, he got Arash to join him.

It seems to me that about every batch there is a single founder. But they tend to find co-founders after acceptance.</comment></comment></comment>


Bitcoin with Heterogeneous Block Sizes: A Scaling Proposal - <AUTHOR> https://www.researchgate.net/publication/325142839_Bitcoin_With_Heterogeneous_Block_Sizes_A_Scaling_Proposa <comment><AUTHOR> What I found interesting about this is that it takes away power from developers and gives it to users. Typically the source code imposes some settings that affect security and usability. In crypto these are in opposition most of the time. Here each address has a permission-less setting for security vs throughput.

</comment><comment><USER2> dozens of networks already use variable block size caps

<comment><USER3> You're wrong. And the link isn't about changing the block cap.</comment></comment>


A Julia Interpreter and Debugger - one-more-minute https://julialang.org/blog/2019/03/debuggers <comment><AUTHOR> > JuliaInterpreter received numerous performance enhancements, and now can run > step-wise through code at roughly 50× its original speed. These > optimizations reduce—but come nowhere close to eliminating—the most serious > disadvantage of running all code in the interpreter: slow performance. It is > hoped that the performance gap between compiled and interpreted code, which > can be many orders of magnitude, will narrow in the coming months. However, > the interpreter will always be slower than compiled code.

> It's also worth noting that there are cases where the interpreter feels > faster, at least on initial execution. Julia's JIT compiler produces > excellent results, but all that code-analysis takes time; there is interest > in exploring whether running more code in the interpreter could reduce > latency, a.k.a. the "time to first plot" problem. JuliaInterpreter is a > potential tool for exploring that trade off, and it appears that not much > additional work would be needed.

Oh wow, this is great. I've really enjoyed what little toying around with Julia I've done, but it seemed just shy of feeling truly interactive to me. But I really do love the featureset of the language, so if this gets integrated into the language and it helps in time to interactivity, I'll absolutely be moving some parts of my work to Julia.

<comment><USER2> More importantly to me, Julias combination of features means code is not very self documenting and error messages are (often) terrible.

If I need to understand what subtle assumption of DifferentialEquations I violated stepping into the point of failure is God sent. And that's a well documented package.

More importantly, I now can usually reason my way around. But my students can use this to learn what goes wrong in their codes interaction.

This is a massively important step in the tooling and ecosystem. Congratulations to the developers.

</comment></comment><comment><USER3> That's a great news! I search for a new general use (for me) language. I come from C++ and C land. I don't like Python for bigger projects, because of it's typing regime, performance and white space significance. So far Julia seems nice and improvement in tooling is always welcome, because tooling is crucial for the language survival.

A side question: How is Julia for web development? I'm not really a web developer and my mindset is more in realms of C, shell and CGI or Go. I mean a small to mid scale operation so SQLite integration is probably enough and Julia has a package for that.

<comment><USER4> Julia's main focus is on scientific computing. Basically think of it as a Matlab or Python + Numpy or even a C++ replacement for numeric computing.

A lot of the libraries are focused on optimization, differential equations, statistics, matrix operations...those sorts of things. It doesn't have classes in the way you would probably think (not really an OO language).

<comment><USER3> Go and C do not have classes either. If it's a bit comparable it would be a plus for me. I'm mainly a C++ programmer by trade by I don't enjoy it and in my free time I use mainly C with some shell glue and some Go.

I read that their focus is on scientific computing, but I feel that there is a growing effort to expand Julia's use cases. Also I think that some end user applications could gain a bit from optimized statistics or matrix operations.

<comment><USER5> As far as the language goes, Julia is absolutely awesome for general purpose work, including web development, scripting, glue language, etc.

The associated libraries are, unfortunately but understandably, less well developed than counterparts in other languages. E.g. right now I'm happily using AWS[Core/SQS/S3], which are highly functional community developed AWS packages, but they're definitely less full featured than boto3. My impression is this situation is common for a variety of web and database packages.

</comment></comment></comment></comment><comment><USER6> This awesome! I just created a Julia Debugger playground on Repl.it: [https://repl.it/@amasad/julia-debug](https://repl.it/@amasad/julia-debug) (it's a bit slow to start but then runs smoothly)

Here is a quick screencast: [https://imgur.com/a/PXTRgHp](https://imgur.com/a/PXTRgHp)

<comment><USER7> It's really great to be able to just click a link and start playing with Julia without installing anything! While there are other platforms offering a similar experience, I'm glad Repl.it added Julia to its tool belt.

Just a quick note for the inattentive like me: you have to click the "Run" button before executing the `@enter foo(20)` command.

</comment></comment><comment><USER8> They are participating in Google Summer of Code and there are many interesting projects in the ideas[1] list.

[1] [https://julialang.org/soc/ideas-page](https://julialang.org/soc/ideas- page)

</comment><comment><USER9> Debuggers are one of those things that I almost never use, and have a completely unearned distaste for. Literally every single time I've used a debugger it's been useful, but it's never something I think about using off the cuff. Maybe I'm just an incompetent goober who spends too much time on IRC :)

I've been getting into Julia a bit for personal projects, since I like it better than Python, so maybe this will be a good excuse to learn how to use debuggers more effectively.

<comment><USER10> I have been using debuggers since Turbo Pascal 5.0.

My experience regarding people around me that don't use them is that they never actually bothered to learn how to use them.

Same applies to other development tools like profilers and static analysers.

I guess I was quite lucky with some of the teachers and professors that crossed my path.

<comment><USER9> I know how to use a debugger, at least how to set a breakpoint and step through stuff. I'm sure there are features I'm not familiar with, but I at least understand the fundamentals.

I think part of it is that for the last 5 years , every single language I've used with any kind of professional capacity (JavaScript, Haskell, Erlang, F#, Clojure, Scheme) has had a REPL, so I can quickly play with and reload code, making debuggers a bit less necessary than if I were to do a purely-compiled language.

I definitely would benefit from learning more about performance profilers though. You've given me an idea of reading material for the weekend.

</comment></comment></comment><comment><USER11> This should be a game changer. I had tried Julia before and was disappointed by the interactivity of the REPL because redefinition of code at runtime was anything but easy to achieve. If it works as stated Julia REPL now should be on par with CL's one. I'll give Julia another try!

<comment><USER12> > Revise.jl allows you to modify code and use the changes without restarting > Julia.

Might be helpful :) [https://timholy.github.io/Revise.jl/stable/](https://timholy.github.io/Revise.jl/stable/)

<comment><USER11> I tried Revise and the fact that it doesn't require you to restart Julia doesn't mean that it allows you to change code on the fly. It means that you don't have to close the REPL and restart it and that you don't have to explicitly reload code. To see the effects of a change to a function invoked in a loop you have to wait for the loop to complete and return back to the REPL. This is not really SO interactive. In CL you see the effect of any change immediatly at the next iteration of the loop. What Revise does is to automatically recompile updated code by detecting changes automatically. I hope that this interpreter brings the same level of interactivity as CL. I'll try it for sure.

<comment><USER13> >In CL you see the effect of any change immediatly at the next iteration of the loop.

This. I just did this today on CL, because I needed it. I was running a long process and can't afford to stop it.

And note that i'm using a CL compiler that compiles down to machine language, not an interpreter.

</comment></comment></comment></comment><comment><USER14> Don't know much about Julia, but it seems like this debugger works by running the code in an interpreter? Is there tooling around debugging compiled Julia code as well, or is this the only way to feasibly debug Julia? It any of this tooling standardized so it could work in say GDB or LLDB (taking advantage of their command syntax, Python API, etc.)?

<comment><USER15> Iirc the first attempt, Gallium, did that. I believe it was technically super ambitious and a bit brittle maybe. It worked with Julia version 0.5. Maybe one time Keno or someone else very capable has time to revive it, I don't know.

<comment><USER16> The history here is a bit as follows. Back about four years ago, I set out to write a debugger for Julia and while I was at it, I figured I might as well fix all of the other things that have always bothered me about debugging. As an example of that, it had the following features:

      - Being completely written from scratch in Julia
      - Mixed debugging between Julia and C/C++ code
      - Integration with https://github.com/mozilla/rr for time traveling debugging
      - Debugging windows programs running on a linux host under wine (and in particular even as an rr replay).
      - Zero overhead debugging by using mixed modes (DWARF based debugging generally, a much more accurate interpreter based one when possible).
      - Very precise location tracking, on an expression basis, not just a line-by-line basis
      - Multi-process debugging by riding along RPC calls, even across machine and even as separate rr recordings across machines

As you can tell from this feature list, that project was a bit over ambitious and in the end failed to be a particularly useful debugger for Julia. It was useable for a bunch of basic cases, but fairly brittle. Also, then 0.6 came around and all of Julia's internal APIs changed and porting over the entirety of Gallium would have been quite hard.

After 0.6 was released, I decided this wasn't working out for a Julia debugging story and pulled out just the interpreter and UI parts from Gallium (that package was called ASTInterpreter2.jl). This worked ok, but was lacking a bunch of features that I never got around to implementing, because the lead up to 1.0 required a whole bunch of compiler work that nobody else was available to do. This work now is based on that work from 0.6, but actually making it work nicely and paying a whole lot of attention to it that I was never able to. I'm very happy that Tim, Kristoffer and Sebastian decided to take this on, because I feel like my workload has only increased over the past year ;).

I still very much want all the ambitious features from above, and we do still have the code (and much of it is actually in use, just not for debugging) and I'm fully expecting them to make a recurrence. However, this time around, we'll start with a stable, usable system and gradually make it faster and add features, rather than building an unstable system with all the features and trying to fix it. The former approach is much better for getting usable tools out (though sometimes the latter can lead to more interesting results in a research setting). The other thing to note is that Julia is much more stable now, so it's easier to keep things running without breaking every few months.

<comment><USER17> The history of this makes me think of Gall's Law [1] which was on HN just the other day. It will be truly awesome when we do get all of these features you originally wanted into a standard, stable, usable Julia debugger—and I have no doubt that we will eventually :D

[1] [https://news.ycombinator.com/item?id=19430948](https://news.ycombinator.com/item?id=19430948)

</comment></comment></comment></comment><comment><USER18> I've been meaning to get into julia for quite some time, but I always feel like the community is always like, "this version still needs X, when that comes out, it'll be ready." Is this it? I guess if I had applied that logic to anything else I would never have started on those either. Meh, maybe it's just me.

<comment><USER17> Yes, after this, we're done, there are no more things to do! You should start using Julia now :)

Just kidding, there are many cool things that are in the works, including Go- style multithreading and effortless automatic differentiation of arbitrary code, allowing you to "machine learn" any algorithm without a complex framework.

But that's all stuff that's not even available in most languages—now is a great time to start using Julia:

1\. The latest stable release is 1.1—code you write now will keep working on all 1.x releases

2\. There's excellent editor and IDE support for Julia in pretty much every imaginable configuration

3\. There's a solid debugger with interfaces from the terminal and IDEs (and I'm sure soon there will be many more)

<comment><USER19> Just as a nudge for something not really of practical importance but something I'd like to see for other reasons: self-hosting.

<comment><USER20> Self-hosting leads to pain. Compiling Rust these days requires building 14 versions of Rust after building from OCAML.

I think that is worth it for Rust because I think it has good features for building compilers. And really low level runtime-y bits.

Julia has less good features for building compilers.

But still the vast majority of the language is in Julia. Including a lot of the code lowering.

<comment><USER19> Yeah, believe me, I understand the reasons for self-hosting in something like Rust versus not self-hosting in Julia. Also the fact that Julia is almost all Julia.

Still, the fact that it's _almost_ all Julia suggests to me it could be all Julia, although maybe that's changed with 1.0+ releases.

Trying to think about why it matters to me, I think what it is a sense that if you can get what Julia offers from another language that does more, it probably is better to use that other language. So I want to see it pushed to be more general-use. Not just for the principle, but because I think in general there are gains to languages in doing so. E.g., my guess is that getting Julia to be self-hosting would require certain efforts that might pay off in other ways, or set the stage for such things.

</comment></comment></comment></comment></comment><comment><USER21> The main problem with Juno is Atom . I really hope julia come up with better VSCode support. Atom editor is essentially broken. They should choose VSCode as their main editor.

<comment><USER22> There is no __main __editor, you chose your own. Some who like VSCode made [1], which you could use and contribute to.

[1] [https://github.com/JuliaEditorSupport/julia- vscode](https://github.com/JuliaEditorSupport/julia-vscode)

</comment></comment><comment><USER23> One thing that outsiders miss when considering MATLAB is the incredible debugging workflow. With this release and the Juno integration, we finally have the same experience for Julia! As a developer who used to use MATLAB and now uses Julia every day I am very excited to make use of this tool.

</comment><comment><USER24> This is super cool and I'm really looking forward to giving this a go, great work Julia team!

</comment><comment><USER25> Sweet. I have been slowly learning Julia - this should help!

</comment><comment><USER26> When can we expect integration with VScode. Atom is too slow on my computer.

</comment><comment><USER27> I tried julia three years ago, but version skew was a huge drag. Has the situtation improved on that front?

<comment><USER28> Yes, the language was (intentionally) stabilized with 1.0. So version 1.1 (the current one) is fully compatible with that, and this will remain so for the whole 1.x series. And I expect that even 2.x won't be as bad (if at all) as the major changes that were made during the early evolution of the language.

<comment><USER20> Amazingly, even packages have started to stablize. Even though a great many of them are on there own v0.x, they are both moving towards theire 1.0 releases, and being more careful about not breaking there v0.x releases.

</comment></comment></comment><comment><USER29> Does this mean for loops would now be slower than vectorized ops? Excuse me if that's a stupid question</comment>