Reason React 0.8 - <AUTHOR> https://github.com/reasonml/reason-react/blob/master/HISTORY.md#080-042020 <comment><AUTHOR> The long awaited 0.8.0 release from Reason React is out of beta! This includes a lot of the niceties of writing React but in a very fast, type safe language.

If this is your first time hearing about Reason, watch a video from its creator (Jordan Walke, creator of React) to learn more:

[https://www.youtube.com/watch?v=5fG_lyNuEAw&t=11s](https://www.youtube.com/watch?v=5fG_lyNuEAw&t=11s)

Fun facts about Reason:

\- exports TypeScript! If you have a TS project and looking for some extra speed & stability, you don't have to sacrifice type safety interop

\- It powers all of Messenger.com. The team put out a case study where they went from ~10 bugs a week to less than 10 a quarter by switching to Reason

\- It uses the npm / yarn ecosystem so you can use your favorite / current packages without looking for something new.

<comment><USER2> Awesome! Question, say you use TypeScript already, what are the biggest tangible gains in terms of safety (measured by fewer bugs in production) you think can be achieved by using Reason?

<comment><USER3> \- Full-fledged support for pattern-matching exhaustiveness check, not something you have to bake together using a 'tag' field. This means if you match on i.e. integers, the compiler will warn you if you don't include a catch-all default case.

\- Simple module system where you don't need to deal with named vs default imports and all the weird bugs getting them mixed up can bring

\- TypeScript's inherent JS-like nature can pop up subtle bugs like forgetting to type a pair of parentheses:

        function isSupported(): boolean {
          return false;
        }

        function test() {
          console.log(true && isSupported); // true
        }

Or doing object/array indexing and forgetting to handle the case of 'undefined' because TypeScript doesn't enforce that. Or how any typings from before version 2 are suspect because they were written with the assumption that every type can be implicitly nullable. There are lots of these little footguns all over the place.

\- Higher-quality bindings: more stuff captured at the type level, you're not left to deal with bindings full of 'any', 'object', and 'function'

It's not even just about safety though. One of the biggest productivity drivers in Reason is its iteration speed–the compiler is so fast that you can try out changes basically as fast as you can save the file. And there are other things, like how all modules are implicitly available in scope, so you don't need to manage a 'wall of imports' at the top of every file before you can actually get to the code itself.

<comment><USER4> > TypeScript's inherent JS-like nature can pop up subtle bugs like forgetting > to type a pair of parentheses

FWIW this was just fixed in TypeScript 3.9.

<comment><USER3> Interesting, can you link me?

EDIT: I just tried in the TypeScript Playground (v3.9.2), it's actually rather worse than I thought, it prints not 'false' but the actual function itself as a value...

<comment><USER4> [https://devblogs.microsoft.com/typescript/announcing- typescr...](https://devblogs.microsoft.com/typescript/announcing- typescript-3-9/#uncalled-in-conditionals)

Edit: Apparently the functionality already exists as of 3.7. The update in 3.9 was to add it to ternary operations as well

<comment><USER3> Great. But looks like it doesn't work inside a boolean expression.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> For me a big strength is Reason's intolerance of null, this has eliminated a great number of bugs for me. Reason React ultimately forces you to think about every permutation of state your component might enter, and develop logic to handle that. JS/TS will never help you with that.

<comment> s-km What do you mean? Typescript by default assumes non-null, and if you specify that something _can_ be null it'll force you to check that it isn't before attempting to access it.

<comment><USER5> Sure. However the any type lets the nulls in. And the any type is very convenient, perhaps even necessary to use in some situations. So then you are back to plain old js check blocks and ternaries littered everywhere. If you miss one, well, I don't need to remind anyone of the ubiquitous js console error which every js developer has burned into the back of her/his brain.

<comment><USER6> I use the no-explicit-any Typescript ESLint check and tsconfig no-implicit- any, never turn them off unless absolutely necessary, making this is a non- issue. Not that I'm not interested in Reason for other reasons though!

<comment><USER5> That's fine if you can control this configuration I suppose. But the escape hatch is there, so in my opinion TS doesn't go far enough.

</comment></comment></comment></comment></comment><comment><USER7> ReasonML is awesome! I personally preferred the "reducer" state modeling mechanism from ReasonReact 0.6, but you can still use it as a library with [https://github.com/bloodyowl/reason-react- update](https://github.com/bloodyowl/reason-react-update)

<comment><USER8> I ended up just using redux with react-redux. I just wrote my own bindings (does not cover the entire api surface but the essentials): [https://gist.github.com/melbourne2991/b3093187505f2ee9e517bb...](https://gist.github.com/melbourne2991/b3093187505f2ee9e517bbcaa6d52580)

You get a lot of optimizations for free with react-redux. Given reason-react now supports hooks you can also just use `useReducer` but this lacks some optimizations.

</comment></comment><comment><USER9> Assuming most serious projects will depend on a lot of npm modules. Do the reason folk think that projects will add custom wrappers/typings Just like with TS (mind share chicken and egg problem) or is there a way for the compiler with its powerful type system to - handwave - deduce types in JavaScript npm modules

Edit The gap between [https://redex.github.io/](https://redex.github.io/) and type.d seems like a challenge

<comment><USER10> There is no way, currently, to deduce vanilla javascript types. You'll have to write your own bindings (types) or as you pointed out, use community bindings on redex.

Now? Writing a binding is barely a speed bump, but when I first started writing Reason code it definitely tripped me up a few times. I tried to make the road behind me a bit smoother [1], but that gap you observed is real.

But as someone who writes/reviews both Typescript and Reason, pretty much every day, there is space for both projects, so I don't see that gap as being relevant to the survival of Reason--rather, its something that with hard word will be improved over time.

</comment></comment><comment><USER11> I am very pleased to see the revitalized efforts on ReasonML. I hope soon it will be widespread enough I could use it professionally. Also, I love the new website design!

</comment><comment><USER12> ReasonReact & ReasonML seem like a much more practice Elm.

Can anyone recommend some up to date ReasonReact & ReasonML tutorials & books?

Also, what is the recommended architecture - are there any good starter projects?

<comment><USER13> Sure, I worked with Elm before and I feel like they share the basics like immutability and types. Which makes a lot of sense, since Elm got very inspired by Haskell and Reason it's a syntax and a few beauties of OCaml.

A good intro (at least for me, since I'm into videotutorials) is [https://egghead.io/courses/get-started-with- reason](https://egghead.io/courses/get-started-with-reason).

[https://egghead.io/courses/get-started-with- reason](https://egghead.io/courses/get-started-with-reason)

</comment></comment><comment><USER14> Hey there, is there a `styled-components` library for Reason?

I'm really considering ReasonML for my app, however I'm not a big fan of the styling in reason react.

<comment><USER15> Hey, I recommend sticking to bs-css ([https://github.com/reasonml-labs/bs- css](https://github.com/reasonml-labs/bs-css)). Not because I don't think styled-ppx is super cool or amazing, but because it's so cutting edge your 99% chance going to run into an edge case that isn't well accounted for yet (I had a number of issues when I tried it). bs-css is battle tested today, so if you're goal is stability, I recommend it first.

<comment><USER13> Hey JasoonS, I might agree with you, styled-ppx isn't feature complete, would you mind explaining which edge cases aren't accounted?

I'm doing great progress on it and don't want to miss something that is crucial for you.</comment></comment></comment>


A Parallel-Hierarchical Model for Machine Comprehension on Sparse Data - <AUTHOR> http://arxiv.org/abs/1603.08884 <comment><USER2> Strange. The paper says the "Parallel-Hierarchical model, using Keras framework, is available on Github" but the link in the footnote is [http://www.hiddenwebsite.com](http://www.hiddenwebsite.com)</comment>


Scientists Discovered the Egyptian Secret to Moving Huge Pyramid Stones - <AUTHOR> http://gizmodo.com/scientists-discovered-the-egyptian-secret-to-moving-hug-1569802879

<comment><USER2> Comments are here:

[https://news.ycombinator.com/item?id=7687391](https://news.ycombinator.com/item?id=7687391)

        Egyptians may have moved massive pyramid
        stones on wet sand
        (washingtonpost.com)

        </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>====

Other submissions:

[https://news.ycombinator.com/item?id=7678717](https://news.ycombinator.com/item?id=7678717)

        Ancient Egyptians transported pyramid stones
        over wet sand
        (phys.org)

[https://news.ycombinator.com/item?id=7682785](https://news.ycombinator.com/item?id=7682785)

        Ancient Egyptians transported pyramid stones
        over wet sand?
        (fom.nl)

[https://news.ycombinator.com/item?id=7682975](https://news.ycombinator.com/item?id=7682975)

        Solved: How Ancient Egyptians Moved Massive
        Pyramid Stones
        (livescience.com)

[https://news.ycombinator.com/item?id=7685013](https://news.ycombinator.com/item?id=7685013)

        How the Ancient Egyptians Really Built the Pyramids
        (discovery.com)

[https://news.ycombinator.com/item?id=7685464](https://news.ycombinator.com/item?id=7685464)

        How Egyptians moved massive pyramid stones
        without modern technology
        (washingtonpost.com)

[https://news.ycombinator.com/item?id=7689233](https://news.ycombinator.com/item?id=7689233)

        How did Egyptians move pyramid stones?
        Mystery may be solved
        (cnet.com)

</comment><comment><USER3> Nope. Pretty sure it was aliens.</comment>


Offering 1:1 office hours in return for charity donations - <AUTHOR> http://www.trendpreneur.com/free-stuff/fight-cancer-and-sign-up-for-office-hours/

<comment><AUTHOR> The link explains more - I'm raising money to fight cancer (the Leukemia and Lymphoma Society, <http://www.lls.org/>) and offering up 1:1 hangout office hours in return for charitable donations.

The office hours are primarily to focus on product questions or issues you might have, since I'm a fulltime PM and former startup founder, but I have a few other areas of expertise that I am happy to deploy in your direction if you wish (from teaching introductory programming to planning out Paleo meals for a month!).

</comment><comment><USER2> Great idea. I may steal it. I do office hours 'for free' now, but this might add a nice charitable twist... Thanks.</comment>


Open-source game development assets - <AUTHOR> http://opengameart.org/

<comment><USER2> Notice one of the featured entries:

[http://opengameart.org/content/recolor-all-the- items](http://opengameart.org/content/recolor-all-the-items)

Uses the Dawnbringer 16 palette. This is an awesome 16 color palette that can represent a lot of things and looks great.

[http://www.pixeljoint.com/forum/forum_posts.asp?TID=12795](http://www.pixeljoint.com/forum/forum_posts.asp?TID=12795)

There is also a 32 color variation:

[http://wayofthepixel.net/index.php?topic=16078.0](http://wayofthepixel.net/index.php?topic=16078.0)

<comment><AUTHOR> That's actually a really cool idea. Since I'm no artist, I thought this would be a great resource for game dev but then realised how out of whack everything would look if I put the parts I need to use. I could probably edit some too so that they are more consistent, if the license allows.

</comment></comment><comment><USER3> Not sure how useful this is, seems like it would be pretty limiting without spending a significant amount of time customizing assets.

If your in the market for low-end art, there are offshore studios that produce decent stuff incredibly cheaply. $15-$25 hr range. Mid to high end stuff is more difficult and expensive to procure for indies since most really good video game artists have full time jobs at the larger studios and not much spare attention for freelance projects.

Ideally as an indie you want to partner with a really good well rounded artist who devotes their full time attention to the project, when that happens you get unstoppable teams like 2d boy and team meat.

<comment><USER4> Can you name one of these studios?

<comment><USER5> Agreed. I'd like to investigate and possibly commission some art.

<comment><USER6> Well, my brother do the render of hundreds of 3D rendering of assets for one of the popular games in brazil at US90/h piece.

Is a matter of look for them.

</comment></comment></comment></comment><comment><USER7> Nice to have these. A bunch of good games used Oryx's lo-fi fantasy sprite set:

[http://forums.tigsource.com/index.php?topic=8970.0](http://forums.tigsource.com/index.php?topic=8970.0)

I thought it would get old but they ended up being more like archetypes than unoriginal assets.

<comment><USER8> Any good games in particular?

<comment><USER7> sorry, didn't see this until now. there are a few listed here: [http://www.tigsource.com/2010/02/07/assemblee-competition- re...](http://www.tigsource.com/2010/02/07/assemblee-competition-results/)

not sure if people are still playing realm of the mad god but that game was fun as hell.

</comment></comment></comment><comment><USER9> I have been using this site for about a year now. Some of the art on here is fantastic but you usually need to do a little bit of work to get it just right for your game.

Also, finding good art can be tough. The search function has gotten a lot better in the last couple months though. I suggest browsing relevant collections, so you can take advantage of the work people have already done to find good stuff.

</comment><comment><USER10> Love this site. I used it to make an iOS game. Finding free art is tough. I guess as a programmer we're spoiled with all the free software available.

<comment><USER11> Maybe it's because creating Art is a very individual experience, while programming can be very collaborative (a lá github)

</comment></comment><comment><USER12> Kenney has some very good content on here. You can make a fully fledged platformer with all his stuff and it'll look great, perfect for learning. [http://opengameart.org/users/kenney](http://opengameart.org/users/kenney)

<comment><USER13> Quite impressive and all public domain with an option to donate how ever much you want and get everything he ever made in a single zip.

<comment><USER14> Thanks for pointing that out - I donated and got the pack, its chock full of useful things for me to use. Great resource!

</comment></comment></comment><comment><USER15> Glitch: Art & Code from the Game Released into Public Domain

[http://www.glitchthegame.com/public-domain-game- art/](http://www.glitchthegame.com/public-domain-game-art/)

</comment><comment><USER16> IIRC this came out of the Liberated Pixel Cup. A contest to create games and artwork which is available under a permissive license, allowing you to use the artwork in your own games. Very cool.

[http://lpc.opengameart.org/](http://lpc.opengameart.org/)

<comment><USER17> OpenGameArt launched in 2009, several years before the Liberated Pixel Cup: [http://lpc.opengameart.org/content/lpc- about](http://lpc.opengameart.org/content/lpc-about)

</comment></comment><comment><USER18> Nitpick: non-software can't be "open source," as the "source" refers to source code. Neither does "open source" refer to libre usage terms, as it only means the source is available, not that it's licensed favorably.

<comment><USER19> "open source" definitely refers to libre usage terms:

[http://opensource.org/docs/definition.php](http://opensource.org/docs/definition.php)

The "source" for a bitmap image (PNG/BMP etc) can be a vector image (SVG, PostScript etc) or maybe a multi-layer bitmap image (Gimp, Photoshop etc). The "source" in "open source" refers to that the files that were transformed into the files in question are available under a libre license, not what kind of file format or language they are represented in.

</comment></comment><comment><USER20> Careful, this site is full of copyrighted material ripped from commercial games (sometimes edited) which is illegal to use.

<comment><USER21> Can you provide examples? I'm sure the site maintainers would like to hear about copyright violations.

<comment><USER22> Seconded.</comment></comment></comment>


Implementing mutations on a GraphQL server - <AUTHOR> https://medium.com/naresh-bhatia/graphql-concepts-i-wish-someone-explained-to-me-a-year-ago-572d47318e17 <comment><AUTHOR> OK–more than half way through! In Part 4 of my GraphQL series, let's create some authors out of thin air and publish a few books. Implementing mutations on the server will help us with our whimsical mission.

I'll be releasing one part a day for the next week (in case you'd like some holiday travel reading). Here's what you can look forward to.

Part 5: Mutations (client implementation)

Part 6: Subscriptions (server implementation)

Part 7: Subscriptions (client implementation)

Have you gotten stuck at any point so far? I would love to get your questions and comments.</comment>


Java 8 and the App Engine - <AUTHOR> https://groups.google.com/forum/#!topic/google-appengine/8y80sEhr7Rc

<comment><USER2> Think this really make sense. Rather than focus on individual runtimes everybody wins if they just make it managed docker. Run whatever you like. Like they do now they'll probably commit to super-managed VMs for some favoured stacks, but anything is possible on managed VMs.</comment>


How to weed out the non-programming programmer - <AUTHOR> http://www.scoopshot.com/hiring-developer/

<comment><USER2> Trivia is not a good way to find a programmer, Trivia is a good way to find someone good at Trivia. The best way to find a programmer is to sit down with them and have them walk you through a project that they built. Ask them what part are they most proud of and ask them what part they would change, why they would change it and how they would change it. Other than personality questions their is nothing more that you need to ask to gauge their ability to program.

<comment><USER3> The answer is not the point, the ability to find the answer is the point. That is not trivia, that is problem-solving.

<comment><USER2> If that is the case then that is fine (in my book), Googling to find info on a subject is a very relevant skill, even though it is frowned upon in interviews for some reason. In my perception, it does come off as if they are looking to hire people that have that kind of trivia in their head.</comment></comment></comment>


Ferroelectric RAM - <AUTHOR> https://en.wikipedia.org/wiki/Ferroelectric_RAM <comment><USER2> It's great stuff, but still low capacity and high cost in commercial chips. If you want to play with it, check out TI's MSP430FRxxxx microcontrollers. They have FRAM instead of Flash.

Also, there are 8-pin FRAM chips with the same pinouts as generic QSPI Flash/RAM/etc chips which you can buy today.

Again, it's still low-density and expensive, but that seems to be improving and it's fun to make applications which can re-write nonvolatile data by word rather than by page.

<comment><USER3> And destructive reads with limited life cycles, assures a steady recurring revenue for TI...

<comment><USER4> Trillions of cycles isn't that "limited", compared to e.g. Flash.

<comment><USER3> FRAM is far from trillions of cycles, more close to billions, which still kills it after ~5-7 years of intense use.

<comment><USER5> No, FRAM really is in the trillions of RW cycles.

[https://www.cypress.com/file/209146/download](https://www.cypress.com/file/209146/download)

<comment><USER3> TI spec for FRAM is 10^10, but in real life you do feel that it's noticeably lower.

<comment><USER5> TI micros are overpriced anyways. The NXP RTs are way better bang for the buck.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> One of the benefits of FRAM is that you can put it through extreme radiation and still have it work afterwards. So you can put it in a medical instrument that undergoes gamma ray sterilization, and it will still not only work but also retain the data.

<comment><USER7> > _One of the benefits of FRAM is that you can put it through extreme > radiation and still have it work afterwards._

There are no oxides in the supporting circuitry? [Do you have a link to rad- hard results?]

<comment><USER6> I only have access to the same public info you would. Here's a technical paper from TI:

[http://www.ti.com/lit/wp/sboa154/sboa154.pdf](http://www.ti.com/lit/wp/sboa154/sboa154.pdf)

BTW according to TI's support forum, the MSP430F chips with FRAM are not rated to withstand the high levels of gamma radiation used in medical sterilization.

However, Maxim does have many parts rated for that type of application, with "non-floating gate" NV memories. (Draw your own conclusions about what they are referring to.) [https://www.maximintegrated.com/en/app- notes/index.mvp/id/60...](https://www.maximintegrated.com/en/app- notes/index.mvp/id/6075)

Edit: And of course there are oxides, but you can margin around the assymetric Vt-shift that occurs in the transistors.

Edit 2: At least one part explicitly states in the data sheet that it uses FRAM. [https://datasheets.maximintegrated.com/en/ds/DS28E84.pdf](https://datasheets.maximintegrated.com/en/ds/DS28E84.pdf)

</comment></comment></comment><comment> mark-r Not too many days ago someone was complaining about how posts about promising new technology always attracts comments warning that lab results aren't the same as commercial products: [https://news.ycombinator.com/item?id=20753342](https://news.ycombinator.com/item?id=20753342). I responded that countless times in the past promising technologies had passed by without leaving a mark. Ferroelectric RAM could be the poster child for that effect - it's been around for decades but still hasn't made an impact.

</comment><comment><USER8> we make a lot of use of FRAM in our embedded systems. It's great stuff. With huge amount of write cycles it simplifies the data structures you need to store compared to page based / lowish write cycle memories.

</comment><comment><USER9> "FeRAM's advantages over Flash include: lower power usage, faster write performance and a much greater maximum read/write endurance (about 10^10 to 10^14 cycles)."

This sound impressive until you get to the part where reads are destructive, and reads heavily outweigh writes in most workloads. Sounds like a pretty significant disadvantage.

<comment><USER10> That's really not a problem just as it's not a problem in normal RAM. With increased speed and endurance it's a doddle to write back a value after reading with your memory controller even if you're not putting in dedicated refresh hardware. It's really all about density and cost.

<comment><USER11> Unless you lose power in the interim. Flash doesn't have that problem, and normal RAM has it so badly that we rely on Flash to store permanent data and only use DRAM as an ephemeral cache.

<comment><USER10> The first datasheet I found for a Cypress FRAM chip gives a required power down rate of at most 30us/V which allows it to continue to provide normal operation protecting data. It's a very easy limitation to live with and engineers often deal with far more difficult problems in unexpected power loss than this.

<comment><USER11> Yeah, that doesn't sound that bad. Sounds like the kind of thing that often has subtle bugs in the implementation, though.

</comment></comment></comment></comment></comment><comment><USER12> Fun fact: Sonic 3 for Sega Megadrive/Genesis used FeRAM as save RAM. Generally, a Ramtron FM1208S-200CC. I think a few other carts of theirs used it, I've seen 32X Virtua Racing carts with Ramtron FeRAM parts.</comment>


Erlang on Xen [without a traditional OS] - <AUTHOR> http://erlangonxen.org/

<comment><USER2> This looks very interesting, but I didn't see a download or source link the page. How do you obtain a copy?

<comment><AUTHOR> Does not look like it is possible yet: <https://twitter.com/erlang_on_xen/status/223762947204321280>

<comment><USER3> Watch twitter, free VM building service will be available soon</comment></comment></comment>


Google remembers all your passwords - <AUTHOR> http://tinypic.com/r/2uduzgl/5

<comment><USER2> Why is this an issue? This security check doesn't require Google to know any plaintext passwords, hash checking works just as well here. A fair amount of places keep historic password records to prevent password reuse if they have password expiration.

<comment><USER3> Error: The password "trustno1" is already in use by the account email@example.com.</comment></comment>


Cluud.in - Discover new places in your city in real time - <AUTHOR> http://cluud.in

<comment><AUTHOR> Something I built recently to scratch an itch - and would love feedback on. Cheers.</comment>


A great list of command-line tips - <AUTHOR> http://www.commandlinefu.com/commands/browse/sort-by-votes/

<comment><USER2> The #1 thing that'll improve most people's workflow is learning how to use readline effectively. I'm continually amazed by how many people who use shells daily use the arrow keys to navigate around, don't know about common things like C-r to reverse-search through history and other commands that make editing on the command-line a breeze.

<comment><USER3> In aid of helping others along this path, here's a crib sheet I've found for readline shortcuts. I've been meaning to become more efficient in using bash and this might just be the push I need. <http://www.bigsmoke.us/readline/shortcuts>

<comment><USER2> Thanks. That's an excellent reference. I've been pointing people towards the relevant section in the readline or bash manuals, but this is much better.

<comment><USER3> I've honestly tried to use the man pages for bash before, they are unarguably complete but unfortunately difficult to get started with. The chances of me knowing ahead of time to either search first for "readline" followed "Commands for Moving" or read the full man page until I get to line 2957 is slim.

</comment></comment></comment></comment><comment><USER4> _> Next time you are using your shell, try typing ctrl-x e [...]. The shell will take what you've written on the command line thus far and paste it into the editor specified by $EDITOR._

I'm astonished this works in bash but not in zsh.

<comment><USER5> And if you use set -o vi in .bashrc, or set editing-mode vi in .inputrc, then 'v' will do the same thing, e.g.

        $ blah blah[ESC]v

puts you in vim with the command line thus far.

<comment><USER6> I tried "set -o vi" and every v sent me into the editor. This was on the latest cygwin.

<comment><USER7> Well, you must have been command mode. Try pressing "i".

</comment></comment></comment></comment><comment><USER8> This is _almost_ a useful resource, but there are many bashisms on the list! Its utility is kind of limited for those of us who use a different shell when they don't have some sort of standardized "this only works in bash" warning.

<comment><USER9> I have the opposite complaint: I'm using bash, but thinks like mtr aren't part of coreutils, so I think of them as just separate programs that happen to work at the command-line. I could just as easily list ttyter as a command-line 'tool' for tweeting from the command line.

I don't really have a solution to this, because at the end of the day, the goal is to do more things at the command line, but it'd be nice to have a way to distinguish between features of the shell, features of the OS, and non-OS programs that have command-line interfaces. Even if I'm interested in all three, it's nice to know that 'sudo !!' can be expected to work machines than mtr, for example.

<comment><USER10> mtr is pretty awesome though, you should install it and give it a try.

</comment></comment></comment><comment><USER11> No love for autojump? (<https://github.com/joelthelion/autojump/wiki>)

<comment><USER12> Autojump rocks! Currently I am using [fasd](<https://github.com/clvv/fasd>), which is inspired by Autojump but works for stuff other than cd.

<comment><USER13> I'm using rupa/j. This looks way featureful. Thanks for the link!

</comment></comment></comment><comment><USER14> On win7 I found forfiles command the other day that allows me to do a dir with a date restriction. By using the > redirect to output to file I got a list of files that changed in a certain time.

[http://technet.microsoft.com/en- us/library/cc772390(v=ws.10)...](http://technet.microsoft.com/en- us/library/cc772390\(v=ws.10\).aspx)

</comment><comment><USER15> another great list [http://www.reddit.com/r/linux/comments/mi80x/give_me_that_on...](http://www.reddit.com/r/linux/comments/mi80x/give_me_that_one_command_you_wish_you_knew_years/)

</comment><comment><USER16> This is a related commandline script that allows you to search commandlinefu.com

<https://github.com/samirahmed/fu>

</comment><comment><USER17> Use this to help remember them: alias fu='curl -s [http://www.commandlinefu.com/commands/browse/sort-by- votes/p...](http://www.commandlinefu.com/commands/browse/sort-by- votes/plaintext) | grep -vE "^$|^#"'

Put it in your .bash_profile file in your home directory on OSX, or your .bashrc file on Linux.

Simply type 'fu' on the command line to jog your memory!

</comment><comment><USER18> loved all the commands...specially "python -m SimpleHTTPServer"

<comment><USER19> alias pyserv="python -m SimpleHTTPServer"

</comment></comment><comment><USER20> Yawn.</comment>


Pmarca Guide to Personal Productivity (2007) - <AUTHOR> https://pmarchive.com/guide_to_personal_productivity.html <comment><USER3> While I think that completely avoiding a calendar or any fixed appointments is a bit unrealistic (think of doctor's appointments), I agree and deeply sympathize with the gist of it. One of the main reasons I quit my previous job was that I was unable to get _any_ meaningful work done, because the day was very tightly organized around a central ticketing system. Oh, you had a nice idea to solve one of the problems in the long-term project the company is currently working on? Too bad, because there are already 4, oh wait, 5, high- priority tickets waiting for you, and by the time you have finished those, you will have forgotten the idea. This happened so frequently and was so frustrating that after a few months I just shut off my brain and was basically a robot finishing off tickets assigned to me. Needless to say, I felt miserable for 1.5 years.

After I quit, I lived off my savings for 6 months and literally had no schedule of any kind. I woke up and did whatever I was interested in. I got more work done in these 6 months than in the 2 years before.

<comment><USER4> wow i feel a lot like you describe. I've been thinking about taking a few months off just to reset and somehow figure out what I want to really be doing but... it's scary. I have the money saved up for it to not be a problem. But after the 6 months... then what?

What did you end up doing? Any advice?

<comment><USER3> If you aren't interested in freelance work, try to look for companies with a dedicated research team. You usually won't find that in smaller companies, as they cannot afford a few people trying to solve a problem for 2 years with only a 60% chance of success.

PS: if you are really unhappy with your job (to the point where it affects you physically), don't think it will magically get better if you stay. It won't. This hope wasted 1 year of my life.

</comment></comment></comment><comment><USER5> > When someone emails or calls to say, "Let's meet on Tuesday at 3", the > appropriate response is: "I'm not keeping a schedule for 2007, so I can't > commit to that, but give me a call on Tuesday at 2:45 and if I'm available, > I'll meet with you."

Is it just me, or does this come off as exceptionally arrogant? It's literally just telling people to plan their lives around yours. It just seems like time spent with this individual is a token of charitable _grace_. This is the opposite of what I'd expect professional behavior to look like.

<comment><USER6> _" It's literally just telling people to plan their lives around yours",_ I agree, but on the other hand why should people have the right to tell you to plan your life around theirs, isn't that arrogant of them?

Regarding this, and also not answering the phone, and turning off email, it depends on what sort of job you have.

For me this is all about: my best work comes from when I'm in the flow. So I'll do anything to avoid being taken out of it.

I am a software developer, freelance, mostly work from home. I have deadlines, and I mostly work in fixed-price projects so the longer it takes the less I earn per unit time. I can get high-quality work done the fastest when I'm in the flow.

Is it the right of the customer to call me and interrupt me from my flow? I've agreed to deliver the software by a certain time for a certain price, that's it. They might be my client, but I did not agree to be reachable at any time for any impromptu meeting on any topic of their choosing. I agreed to deliver software, not reachability.

It's literally a zero-sum game. They want help planning something, or they have a question, they're in the flow about that, they don't want to be taken out of that flow. On the other hand, I'm in the flow about my thing, and don't want to be taken out of it. It's perfect for the other people if I always do what they want, but sometimes you have to stick up for yourself and do what's best for you.

Calling them back a few hours later when I'm out of the flow, or emailing them back 6 hours later the same day, has always worked out well for me.

I understand that not all jobs are like that. What I mean to say, it's nevertheless wrong to assume that no jobs are like that. Mine is like that, and the approach to using the phone outlined in the article. is great advice.

<comment><USER5> The examples you have given aren't really a proper equivalent to what is being described in this article here.

Scheduling isn't meant to be some Randian, individualistic practice. It's a collaborative effort between people that should say something of the effect, "My time is valuable, as is yours. You seem to be interested in something I'm doing and I'm interested in telling you about it. Let's find a time that's agreeable to both of us where we are both unencumbered and can freely associate."

If you're not interested in meeting, then you have options: 1) Ghosting (controversial, but some requests deserve this response), or 2) Refusing to meet.

Instead this reads as, "I value my time far more than anyone else I associate with. If I so happen to be available, then I'll reward you with the charity of my time."

One of these is professional and makes other people you associate with feel valued, the other makes you look like an arrogant ass.

</comment></comment></comment><comment><USER7> Some of the points in this article I disagree with but others I like. Compared to my past self I am "super productive". I have a full-time career, a single parent to two young kids (approx 70% of the time I'm not at work I'm parenting) and I study nearly full time (3 units per semester) with a perfect GPA. I somehow still have time for "wasting", like commenting on online discussion boards, going on dates, etc.

* Keeping lists: This one is huge. I have lists all the time which track what I need to have completed and when. I have watch lists for tasks like "get birthday present for this kids party", etc. I have a job list at work.

 _Procrastination: I use this all the time. It 's currently 7:23pm here, I'm wasting time now and I have been since 6pm but my deadline is I wake at 4am tomorrow to work.

_Food: This article touches on food but I feel it's really important. I eat low carb because I find carbs make me far more tired. I also avoid large meals because they make me tired.

Something that isn't touched on in the article: Find ways to save yourself time. I get angry when I see an office worker earning 6 figures typing one finger looking at the keys. Touch typing doesn't take long to learn but it saves so much time and effort. Everyone has little quirks that take time/effort to fix but pay off in a big way once fixed. Do it, it's worth it.

<comment><AUTHOR> ymmv but often typing isn't the bottleneck, thinking is (typing faster != more nor better output)

<comment><USER8> But not having to think about typing reduces your cognitive load. Touch typing as a coder isn't about speed, it's about freeing your mind from having to think about your fingers.

<comment><USER9> Touch typing is somewhat overrated. I never learn to touch type and never had any regret over it, don't get me wrong, I do t peck for keys either but the speed of properly touch typing is no need for me, I'm not a professional typist. I on the other hand am great at remembering shortcuts and I think that's way more important to my work than touch typing, I feel that using the mouse to open a menu and click debug as a complete waste of resources and mental focus.

</comment></comment></comment></comment><comment><USER10> Um. "I don't keep a calendar" means "I consider my time more important than yours, so we'll meet at my sole convenience." I would love to do that, but everyone else in the world would rightly understand it that way and would treat it as a refusal to do core elements of my job.

A: "Let's schedule a committee meeting."

B: "I don't keep a calendar."

A: "So what you're saying is everyone else on the committee has to find time just for you? Fuck you, do your job."

Arnold Schwarzenegger could get away with that crap because he's a fabulously wealthy A-list movie star. The rest of us, not so much.

<comment><USER11> Fully agree. Also the rest of the article has questionable advice. I doubt the helpfulness of later lists and anti todo lists. Not answering the phone or pretending to be incompetent sounds like an idiotic idea too.

<comment><USER12> Nobody is promising that every suggestion will work for you. Try everything until you find something that does work.

</comment></comment></comment><comment><USER13> If there's anything I'd take from this article, it's techniques to avoid meeting cultures; there's far too many people that want to book an hour long block for a meeting about a thing that can be decided on in five. I think meeting culture is a form of decision anxiety - have we considered all the facts? What if I'm wrong? Is everyone aware that this is happening?

It was really quite bad at my previous assignment. I'm in a much smaller setting now and I'm really trying to avoid it from becoming a thing. If someone asks you for a meeting, always consider if you can discuss it right there and then.

For a lot of people, discussing it right there and then is already an issue because they're spending what little time they have in between meetings to coordinate other meetings. That is, they don't have five minutes to talk about a five minute thing because they have a meeting in five minutes.

<comment><USER14> See pg's article on maker vs manager schedule.

</comment></comment><comment><USER15> I dont think an anti to-do list makes me more productive. But I sure like to keep a log of things done in a text file so I can find what I did later. There is of course a limit to what I keep, but even one-liners etc can be stored in it. Especially when used seldomly, I dont remember all the bash tools invocations. And no, I wont "tear it up and throw it away".

<comment><USER16> I also keep a list of things I've done. Typically I just add those things to my to-do list and check them off.

There are other good ideas in this post and for me they're timely. I'm crunching on a business where I teach programming through art work. I'm definitely going to borrow some of these ideas for that. If that sounds interesting to you, checkout [https://splashofcode.com](https://splashofcode.com)

</comment></comment><comment><USER17> > \- Anyone who needs to reach you so urgently that it can't wait until later > in the day or tomorrow morning can call you [...] - Don't answer the phone

...great?

</comment><comment><USER18> >> work on whatever is most important or most interesting,

how often are these two the same thing? Which are you supposed to do when you've got all this open-ended, distraction free time?

And the whole "no schedule" thing comes off as cherry-picking data and situations. Even when Arnold was making blockbuster movies do you think they just filmed whenever he showed up, keeping an entire crew on standby?

Did you notice how all of his examples are individual activities? that's great, but it's tough to accomplish meaningful, revolutionary work without collaboration. Schedules are super-useful (and I'd argue required) for short/mid-term planning and prioritization across teams where everyone is important.

The approach here is for when there is huge asymmetry between parties - <USER2> an emergency room and patients. You show up with everyone else, then they triage (hopefully by importance, not interest) and process. Guess what? even the specialist still have schedules so they can work within a broader system.

The approach here sounds like the "schedule" of a lot of affluent retired people.

<comment><USER19> We tend to be interested in important things we're competent at. That's how we got competent at them in the first place. Shepherding interest - trying to figure out what's interesting about something important that you haven't tackled yet - can be useful to get competent at new things, of course.

In the emergency room, the pathologist will be interested in the sick kid instead of the guy with the broken leg, even if the latter is "more important". Unless the staff are getting overwhelmed by a mass-casualties incident, that's probably actually the right approach. (I'm no doctor though.)

I like email and other asynchronous/recorded communication for collaboration where possible, in lieu of synchronous meetings interrupting flow. But as you point out, there's a lot of cases where this doesn't work. And even a bunch of lone wolves working on solo projects can benefit from synchronizing lunch with their coworkers for some socialization and facetime. I schedule that. It's flexible and not super rigid, but it's still a schedule.

</comment></comment><comment><USER20> If you're interested in productivity tips from fellow Hacker News readers:

[https://blog.startopz.com/10-productivity-tips-from- hacker-n...](https://blog.startopz.com/10-productivity-tips-from-hacker-news/)

Some of my favorites that I compiled over time.

</comment><comment><USER21> I mean there are so many tips for being productive, book X says maintain a schedule pre-planned for 2 weeks, book Y says do not maintain a schedule at all. Book X says do a bit of everything daily, book Y says devote a day for a single task. Hmph..

The only thing that works is somehow doing getting work done, rest is irrelevant. And that's why I don't see a point on self-help book in general.</comment>


Mathematics of Deep Learning [pdf] - <AUTHOR> https://arxiv.org/abs/1712.04741 <comment><USER2> Newtons method and linear algebra. High school math, basically.

<comment><USER3> > Newtons method

Where are you seeing Newton's method? I didn't think second order information was available for typical systems in statistical machine learning.

<comment><USER4> my understanding is that the issue is that the full Hessian of the loss is too expensive to compute at each step for the relative size of the increase in learning speed

<comment><USER5> Yeah I think that's why quasi-Newton methods like BFGS have been developed.

</comment></comment></comment></comment><comment><USER6> I'm think this is a work in progress? Seems to be in ieee format, where pages are gold, and one would almost never waste an entire on references(surveys), and leave another mostly blank space. I'll wait for the peer reviewed version.

</comment><comment><USER7> This is a horribly titled paper and I don't even agree with the premise necessarily. Since when did we become convinced deep learning achieves "global optimality" as they put it.

<comment><USER8> When the network is deep or big enough, local minimums tend to have loss close to global optimum. There is theoretical and empirical evidence for this. Global minimum is usually overfitting so what is needed is getting close enough.

In practice algorithms like stochastic gradient descent have problems distinguishing between saddle points and local minima. There is hypothesis that in many/most cases local minima where algorithms get stuck are actually saddle points with long plateau.

<comment><USER9> This mathematical hand waving plagued the field of genetic algorithms and its variants in the 90's until the 'No free lunch theorem' was published from the Santa Fe institute. It essentially said (my take on it) that if you had no information about the landscape you were searching - then couldn't say much about the algorithm you were selling.

[https://en.wikipedia.org/wiki/No_free_lunch_in_search_and_op...](https://en.wikipedia.org/wiki/No_free_lunch_in_search_and_optimization)

<comment><USER8> You are using too general argument.

We are talking about continuous multidimensional optimization. We have already selected our bias and subset of problems we want to solve. Now we are figured out that in this domain there are some theoretical reasons that explain why gradient descent works so well over large number of problems.

<comment><USER9> Agreed. NFL is general and we need to discuss a specific landscape.

Deep learning is continuous <nonlinear> multidimensional optimization - yes.

What defines the subset of problems ? a general nonlinear mapping from R^n to R^m n>m ? or are you limiting to image classification ? speech recognition ? which would be a subset.

We have empirical evidence that deep-learning works but I'm not confident that we have the mathematical tools to understand why.

<comment><USER10> [https://arxiv.org/abs/1710.05468](https://arxiv.org/abs/1710.05468) was an interesting paper that came out recently.

It showed that large CNN models which have far greater capacity than the data they are shown (and _could_ have memorized it) still tend to learn very good generalizable minima.

See proposition 1:

(i) For any model class F whose model complexity is large enough to memorize any dataset and which includes f∗ possibly at an arbitrarily sharp minimum, there exists (A, Sm) such that the generalization gap is at most epsilon, and

(ii) For any dataset Sm, there exist arbitrarily unstable and arbitrarily non- robust algorithms A such that the generalization gap of f_A(Sm) is at most epsilon.</comment></comment></comment></comment></comment></comment>


Show HN: Try cool products, get paid by crypto - <AUTHOR> https://review.hunt.town/ <comment><USER2> Went through all the pages and still can't tell what this is, as a "review hunt" is never clearly defined.

It's cool to try to create a category, but you gotta make sure the user knows what it actually means.

<comment><AUTHOR> Hi, thanks for your feedback. Will think about changing the tagline. Yeah this is not much in a defined category, also it uses crypto that adds some complexity.</comment></comment>


Ask HN: Small town lots of FiOS infra. no residential FiOS keep pushing? - <AUTHOR> My small town has a lot of fiber infrastructure (conduit etc.), almost the entire city has conduit laid for a fiber based CCTV/Traffic monitoring system.
I contact the city council to see if anyone had contacted them about doing residential FiOS: they referred me to a systems administrator, he stated that the city was a missing piece of "link" between the two major piece of conduit and that he thought it would be another 2 years before it was complete.
This was the extent of his answers. He did not think anyone had "contacted them" about using the existing infra. for residential FiOS
I've been very interested in community-based FiOS initiatives and I'm wondering if I should keep pushing them (the city council)?
Perhaps there is a company/group that can do a feasibility study- but I don't know what to look for on the internet so I can contact them and find out the costs of doing a study like this to submit to city council? Or should I just drop it? A bridge too far? <comment><USER2> "FiOS" is a Verizon trademark, not a general term. Fiber to the home is an entirely different matter from commercial and municipal fiber optic links, mainly in that they do not have to reach almost every single address. They connect only businesses, government buildings such as town hall, schools and a community center, cellular base stations, etc. The most expensive portion of the physical manifestation of the Internet is the "last mile" between neighborhood hubs and residential modems. Hence why ISPs re-use existing cabling such as copper twisted pair and coaxial cable originally laid for telephony and television respectively. Large capital expenditures are required to get in the game and barriers to entry such as pole access regulations, customers expectation of a bundled TV service, telephone service regulations, customer support staffing, etc. make it hard for plucky startups to get a foothold. Some states have even banned publicly owned ISPs! Of course once an ISP is big enough and is one of the duopoly it can raise rates annually and cap, throttle and assess overage fees.

</comment><comment><USER3> As another commenter has noted, FiOS is Verizon's trademark for service delivered using what is known generically as a fiber-to-the-premises (FTTP) network.

A typical network of conduits and fiber optic cabling installed along major streets for traffic signal synchronization and similar municipal purposes is unlikely to reach or pass many homes directly. Extensive "last mile" construction may be required between the existing network and each location to be served, and the cost of this is often a major factor limiting broadband deployment, especially in suburban and rural areas.

Your city's network could be useful to businesses or telecommunications companies that need point-to-point dark fiber connections, and many local governments and electric utilities with fiber optic networks find it attractive to lease some of their excess capacity. The economics of this--a few sophisticated customers, willing to pay, in advance, the full cost of connecting their buildings to the nearest conduit--are completely different from those of mass-market consumer offerings, which generally need a very high take rate to keep the prices reasonable. Achieving this can be difficult, especially in overbuild situations with established competitors.

You might be interested in these two studies, both prepared by the same consulting firm, discussing the costs and opportunities of municipal FTTP development:

City of Palo Alto Fiber-to-the-Premises Master Plan

[https://www.cityofpaloalto.org/civicax/filebank/documents/48...](https://www.cityofpaloalto.org/civicax/filebank/documents/48723)

City of Seattle Fiber-to-the-Premises Feasibility Study

[http://www.seattle.gov/Documents/Departments/Broadband/2016-...](http://www.seattle.gov/Documents/Departments/Broadband/2016-6SeattleReport- Final.pdf)

</comment><comment><USER4> See I'd see if I could tease a local reporter into writing a story. A system administrator that said it would or at least could be complete in two years. The benefits of Google Fiber, etc.

Feasibility only matters if people are interested. Get people interested.

</comment><comment><USER5> There's been similar interest in my City and we've recently "got the ball rolling", just barely.

Here's an article that'll give you some background: [https://muninetworks.org/content/bloomington-indiana-may- blo...](https://muninetworks.org/content/bloomington-indiana-may-bloom-rfi)

</comment><comment><USER6> Sorry I can't help you, but I do have a question - how did you find out that your town has the existing fiber infrastructure?</comment>


Ask HN: What novels or other fictional works have Linux in a significant role? - <AUTHOR>

It's summer and time to put together a reading list.  My suggestion is Neal Stephenson's Cryptonomicon.  And thanks to dragonwriter for the assist in wording the question correctly. <comment><USER3> Neal Stephenson's _Cryptonomicon_ frequently references "Finix" ("Finux"? something like that), an obvious stand-in for Linux. IIRC, Stephenson chose the pseudonym to avoid geek rage if he mis-reported some tiny detail of Linux.

<comment><AUTHOR> I vaguely remember that. I also remember one of the characters recoding his camera on the fly to take pictures of people ogling his computer at a meeting. Not too realistic, but cool.

</comment></comment><comment><USER4> There are, IIRC, a few of the Laundry Files novels - by Charles Stross - <USER2> mention Linux, although I'm not sure if you'd say it is featured in a "significant role".

</comment><comment><USER5> I would recommend Digital Fortress by Dan Brown, I would not say Linux plays a significant role, but the whole cryptography background going on it's really fun and entertaining.

<comment><USER6> (Spoilers ahead)

Digital Fortress is probably the book with the most bullshit representation of computers and cryptography ever. Dan Brown goes out of his way to do as little research as possible on subjects he's talking about. In Angels and Demons, the Illuminati want to blow up Vatican using jars with antimatter they stole from CERN. Jesus Christ. The Da Vinci Code is similarly flawed.

It baffles me how he manages to be so full of shit as to say that the descriptions, historical events and whatnot are accurate in his novels. In Digital Fortress he describes how the Spanish healthcare system is subpar and hospitals are filthy, when in reality it's ranked way above the US by some satisfaction index or whatever. Not to mention the NSA's supercomputer ("made by soldering together millions of processors over 10 years") which gets fed some ciphertext and a virus infects it... BECAUSE IT WAS ACTUALLY NOT A CIPHERTEXT BUT MALICIOUS CODE!!!11!1

I hate Dan Brown, dammit

</comment></comment><comment><AUTHOR> Surely, there are more than these. I have to confess that Dan Brown would not be my "go to guy" on anything factual.</comment>


Track down your stolen laptop - <AUTHOR> http://preyproject.com/ <comment><USER2> I actually really kind of like this idea (which has been around forever). In particular, it turns a CS problem that has worked to the advantage of criminals against them: there is a practically unbounded number of variations on this scheme, some of which can survive reimaging.</comment>


Antibiotics Aren't Profitable Enough for Big Pharma to Make More - <AUTHOR> https://www.bloomberg.com/news/articles/2019-05-03/antibiotics-aren-t-profitable-enough-for-big-pharma-to-make-more <comment><USER2> I've read this for many years now but I've often wondered why The Orphan Drug Act is not used by Big Pharma. After all once a bacteria becomes resistant then that particular situation is similar to an orphan drug.

The Orphan Drug Act of 1983 is a law passed in the United States to facilitate the development of orphan drugs—drugs for rare diseases such as Huntington's disease, myoclonus, ALS, Tourette syndrome and muscular dystrophy which affect small numbers of individuals residing in the United States.</comment>


The Intel Xeon W-3175X Review: 28 Unlocked Cores, $2999 - <AUTHOR> https://www.anandtech.com/show/13748/the-intel-xeon-w-3175x-review-28-unlocked-cores-2999-usd <comment><USER2> and 1.2KW power draw if you are brave enough [https://www.youtube.com/watch?v=o-6Iwb2HihE](https://www.youtube.com/watch?v=o-6Iwb2HihE)</comment>


Why strace doesn't work in Docker - <AUTHOR> https://jvns.ca/blog/2020/04/29/why-strace-doesnt-work-in-docker/ <comment><USER2> strace/ptrace gives you huge amount of power.

I had a discussion once with admins at my company that wanted to convert servers to have AD accounts in a naive way. The discussion could be shortened to something like this:

Me: please, don't convert servers to AD because my password will be available to everybody as everybody has root on test environment.

Admins: no, this is perfectly safe.

Me: Guys, once you have root on machine you can do everything including accessing passwords as they are being typed.

Admins: No, not possible. Perfectly safe.

Me: Here, I ran the tool using ptrace from root account, here is a list of all accounts and passwords of all users using test env. This is actually read() call at some point, you just need to be able to filter it out from strace output.

Admins: Wtf! You are going to get fired!

<comment><USER3> I'm not sure what AD has to do with the fact as root, you have a huge amount of power on ANY box and abusing it will get you fired. strace/ptrace is just another tool in that toolbox that you can use maliciously.

Your company either runs in a model where it trusts the employees or it doesn't. If it doesn't trust the employees they shouldn't be giving ANY of them root on a shared system.

<comment><USER4> In my case, I'm using a different, easy password, for test servers that contain no important production data or are in a especially privileged network position. If they were connected to AD, I would be forced to present my "real" password.

On production servers on the other hand, the amount of people with root is probably much smaller, and there might be bigger wins by being able to centrally enforce password policies or whatever the sysadmins want to do.

<comment><USER3> So create a second AD account for the test environment like most shops do?

<comment><USER5> But then you don't get the joy of throwing the baby out with the bath water.

90% of the time someone insists AD is too insecure for them, it's because they're unwilling to maintain hygiene (logging into an untrusted machines with overscoped credentials 8 times a day), or unwilling to use the provided security features (what do you mean use kerberized services? ldap binds work just find and give me an anti-ad security straw man!)

</comment></comment></comment></comment></comment><comment><USER6> I find for Docker, the documentation is extremely sparse/omits details that have larger consequences.

I've gotten used to just going to read the source to see what an option does.

<comment><USER7> Imagine a situation what something is broken and you need to figure out how to strace in production while a service is down. This is my main argument against Docker, it is black box computing and you are going to figure this out the hard way. Of course you can prepare, yet, I do not necessarily have the bandwidth.

<comment><USER8> As the article points out, in any recent version of Docker and up to date kernel ptrace just works.

</comment></comment></comment><comment><USER9> > This hypothesis doesn't make much sense but I hadn't realized that the root > user in a Docker container is the same as the root user on the host, so I > thought that was interesting

Wait what? I didn't know that. This sounds terrible. Is the root in the container the same user who runs the container, or the same root who is root on the host machine?

<comment><USER10> You can enable user namespace isolation, but it comes with a significant number of tradeoffs.

[https://docs.docker.com/engine/security/userns- remap/](https://docs.docker.com/engine/security/userns-remap/)

Also, Kubernetes doesn't support it.

[https://github.com/kubernetes/enhancements/issues/127](https://github.com/kubernetes/enhancements/issues/127)

<comment><USER11> Docker, mongo, MySQL, JavaScript

Insane defaults, but easy to get started without knowledge

</comment></comment></comment><comment><USER12> If you think that fixed it, try stracing the container AND running strace inside the container at the same time.

</comment><comment><USER13> Wow this was way more interesting than I expected. Cool of her to share!

<comment><USER14> Yeah this was a great write up and an interesting example of how the reality of the implementation of something can be quite mismatched to expectations. I wouldn't necessarily call it surprising that the implementation is doing more than one would expect, but this is a good reminder of how to look around when things get weird.

</comment></comment><comment><USER15> This is interesting, but stops just short of explaining why ptrace wasn't whitelisted, and what changed that allows it to be whitelisted on recent kernel versions.

Here's what the linked commit to docker[0] says:

> 4.8+ kernels have fixed the ptrace security issues so we can allow ptrace(2) > on the default seccomp profile if we do the kernel version check.

This commit itself links a commit in the linux kernel[1], which says:

> x86/ptrace: run seccomp after ptrace

> This moves seccomp after ptrace on x86 to that seccomp can catch changes > made by ptrace. Emulation should skip the rest of processing too.

This doesn't give us much more information, and I'm not familiar enough with this code to understand the changeset. Thankfully, by looking up the changeset name, we can easily find the email that proposed the changeset[2], which explains the issue more in-depth:

> There has been a long-standing (and documented) issue with seccomp where > ptrace can be used to change a syscall out from under seccomp. This is a > problem for containers and other wider seccomp filtered environments where > ptrace needs to remain available, as it allows for an escape of the seccomp > filter.

So the basic idea is to use ptrace to swap an allowed syscall with a forbidden syscall. Seccomp used to run before ptrace, so it would see the allowed syscall and allow the code to continue, but then ptrace would swap the syscall to something forbidden! The details are a bit thin, however, they don't explain _how_ we can do that. After a bit more digging, I found this pdf[3] which contains a simple POC showing the issue, and explaining it.

The TLDR is to use ptrace with `PTRACE_SYSCALLS` to execute until a syscall is hit. When a syscall is hit, seccomp would first check the syscall is allowed, and then pass execution to the tracing system of the kernel, that would stop the process for ptrace to inspect. From ptrace you can then modify the registers with `PTRACE_SET_REGS` to change the syscall being called (the syscall number is in register RAX on amd64) and resume execution. The kernel will then happily execute the modified, unchecked syscall!

So what changed is that seccomp will be run after ptrace now, so there isn't a way to modify the registers before the syscall is run anymore.

[0]: [https://github.com/moby/moby/commit/1124543ca8071074a537a15d...](https://github.com/moby/moby/commit/1124543ca8071074a537a15db251af46a5189907)

[1]: [https://github.com/torvalds/linux/commit/93e35efb8de45393cf6...](https://github.com/torvalds/linux/commit/93e35efb8de45393cf61ed07f7b407629bf698ea)

[2]: [https://www.mail-archive.com/linuxppc- email@example.com/m...](https://www.mail-archive.com/linuxppc- email@example.com/msg104378.html)

[3]: [http://asm.rajiska.fr/misc/container_security.pdf](http://asm.rajiska.fr/misc/container_security.pdf) page 9 for the explanation, page 16 for the POC code

<comment><USER16> Huh. If I'm reading that correctly, that means it would be possible to build a paranoid_sudo command, where you run a command and use PTRACE_SYSCALLS on it, and for each of the syscalls it makes, try running it first as a non-root user, and if that fails prompt the user for whether they want to allow the base program to run whatever syscall requires the child process to be root.

I don't think the above would actually be all that useful, but still it's kind of cool that it's possible to do at all.

<comment><USER15> PTRACE_SYSCALL isn't what you want, since it will always run the syscall. What you can do is use PTRACE_SYSEMU, which allows you to emulate a syscall in userland. It will break on syscall enter, allow you to emulate your syscall (e.g. with your scheme of "run it without root, ask user for elevated privs if necessary"), and resume execution at the next instruction when you ptrace again, never really executing the syscall instruction.

For this to work you'd also need a way to share various namespaces (like file descriptors) which is doable via the clone2 syscall.

There's a ton of cool tricks you can do with linux, it's a really powerful kernel.

</comment></comment></comment><comment><USER17> I had a memory leak problem running a node service inside a docker container. I tried to use gcore, but got the precise problem in the article.

ptrace: Operation not permitted. You can't do that without a process to debug. The program is not being run. gcore: failed to create core.36

I found this SO answer and it worked out for me.

[https://stackoverflow.com/questions/42029834/gdb-in- docker-c...](https://stackoverflow.com/questions/42029834/gdb-in-docker- container-returns-ptrace-operation-not-permitted)

</comment><comment><USER18> That was fun but it pretty much reinforces my main reason for not using containers: it's reinventing the OS. I already have the OS, so...

(Change my mind?)

<comment><USER19> No need to change your mind. Containers improve orchestration of deploying scalable services. The Kubernetes ecosystem will continue to improve and one day your boss will tell you that you have to use containers to deploy your apps or find a different job.

<comment> ctrlc-root Not really. Let me prefix my reply with some context: I've used Puppet, Salt Stack, Ansible, and PowerShell DSC to manage infrastructure based on Windows, Linux, and macOS on top of bare metal servers, VMs, and containers. Any tool that promises to "make the complex simple" is really just hiding the complexity away from you behind default settings and their own implementation. Which is probably fine for simple use cases. If your application can be deployed to Heroku then deploying to a Kubernetes cluster you don't have to manage is probably analogous in terms of overhead and how much complexity you have to worry about. However this simply doesn't scale as your application increases in complexity.

In fact I recently completed a migration away from Docker/Kubernetes to an AWS stack that doesn't use anything higher level than autoscaling groups and it has been a positive experience. The same application is now faster (less layers necessary), easier to deploy (we own all the moving pieces), easier to debug in production (I can use strace and tcpdump without trying to install them in an already running Docker container), etc. All of the "complexity" that Docker and Kubernetes were handling for us has been replaced with a ~ 500 line Python script that's mostly comments (you can see an early prototype of this script in the repository below, named deploy_build.py, which omits some error handling but weighs in at ~ 150 LoC). Furthermore, now that we have to think about how to package and deploy our application to production, the incentives are there to follow proper Python best practices around packaging (i.e. use packages, don't make assumptions about paths, etc) which has been a nice bonus.

Containers (and Docker, Kubernetes, etc) are all tools that have their use cases and corresponding tradeoffs. Anyone who can't explain when or why you wouldn't want to use a tool is not prepared to explain when or why you should use it.

[https://github.com/CtrlC-Root/proto-aws-django](https://github.com/CtrlC- Root/proto-aws-django)

<comment><USER19> First, containers don't necessarily make complex simple. What they do is take an OS image, and allow you to run it on another OS (best performance is always going to be Linux on Linux, since containers were first built natively into the Linux kernel).

Obviously, Microsoft also saw your same vision of containers being so unnecessary that they also decided to build the concept into their OS as well.

This concept can't be done on bare metal. Additionally, because it is built into the kernel and they share the same kernel, they generally startup at over 10x performance of traditional VMs. There are solutions now of course to boot directly into the kernel from a hypervisor, but these are generally paired with container solutions as well due to the orchestration and ecosystem that exists to make container orchestration easy.

Most container solutions use a unified image solution that allows you to rapidly reiterate and test your changes in multiple environments. Doing this on bare-metal or VMs takes considerably more time and money for fixed infrastructure costs.

With container solutions such as Kind and Helm, you can rapidly deploy a local cluster to pre-test cloud rollouts on a single machine. The orchestration can also autoscale clusters horizontally and vertically, and is robust enough to directly compete with other bulkier VM orchestration solutions such as OpenStack.

With automatic certificate rotation, automated service discovery, etc there is no need to try to create tasks for every little thing you'd need to do with Ansible or another IaC component. It is all baked into the Kubernetes ecosystem.

Abstraction away from cloud-specific solutions can only be seen as a good thing. People that are invested in AWS generally can't be trusted to create holistic solutions.

</comment></comment></comment></comment><comment><USER20> I love this writing style where the scientific method is laid bare so explicitly.

<comment><USER21> Agree! Wish I had the mental capacity to stay focused like this person :-)

<comment><USER22> Me too. Also, the ability to explain things this way. It's remarkable.

</comment></comment></comment><comment><USER23> >strace actually does work in newer versions of Docker

Good to know, this should open up some troubleshooting

</comment><comment><USER24> Previously: [https://news.ycombinator.com/item?id=23021002](https://news.ycombinator.com/item?id=23021002)

</comment><comment><USER25> A great writeup. And they end up looking at the source in the article. Good stuff.

<comment><USER26> I also recommend:

[https://wizardzines.com/](https://wizardzines.com/)

by the same author. It looks "popular" but it's written much more thoughtfully and competently than most of the content found on the web. Like this article, it's the result of real personal research, it is never just rewording of some manual or already existing material. In short, really worth reading, and also worth using inside of the companies.

<comment><USER27> As a fan of zines, I've followed her for a while now. She does awesome work.

</comment></comment></comment><comment><USER28> Tl;dr: because docker is doing a bunch of undocumented junk you didn't ask for.

</comment><comment><USER29> Why strace didn't work in Docker.</comment>


The Skylab 4 Mutiny, 1973 (2012) - <AUTHOR> https://libcom.org/history/1973-skylab-4-mutiny <comment><USER3> The wikipedia article has a slightly different perspective:

 _in the years following the mission the mistakes and disagreements received added scrutiny. Several writers embellished the more dramatic aspects that led to the radio conference, introducing both "strike" and "mutiny" to the interpretation of events. These and other controversial terms continue to be used, even if inaccurately, to describe the hours leading up to the conference between astronauts and mission control._

[https://en.wikipedia.org/wiki/Skylab_4](https://en.wikipedia.org/wiki/Skylab_4)

<comment><USER4> Even if "strike" sounds dramatic, isn't it technically correct?

<comment><USER5> No, the commander of the space station _is_ management. He's the one who has ultimate authority to decide what his crew does, and is directed to act in the interest of their safety (which means mental as well as physical health) in order to ensure mission success. This is an inheritance of the role of a captain on a ship. If the commander/captain decides it is in the best interest of the crew to stop work, it is neither a mutiny nor a strike.

<comment><USER6> The commander is responsible for delivery, not the scope of that delivery.

A military NCO or junior officer are leaders, but not management, but is more of an agent of management. If you look at paramilitary uniformed services with unionization like the police or fire service, usually the civil service ranks, up to Captain, are union members who collectively bargain. Once you leave that Captain level (a Police or Fire Captain is usually aligned with an organization similar in scope to an Army Company), you are management.

The reality is that the people in space didn't do exactly what the people on the ground wanted, and suffered for it on the ground as a result. Whatever it is, it walks and quacks like a strike-like incident that was handled by the management as one would expect.

<comment><USER5> "Captain" in the Army/Police/Fire and the Navy are very different in terms of the allowed independent authority. The space agency inherited the naval model.

</comment></comment></comment></comment></comment><comment><USER7> Slightly off-topic... but here is a question that keeps popping in my head whenever I see a Space story...

Those astronauts (and cosmonauts and taikonauts) spend literally tens of thousands man hours performing scientific experiments. This is beyond cool... but... is there a place where we can see the actual results of all that work?

It seems to me that reading about the results of all those experiments would be FAR more interesting than reading about the day-to-day life in micro- gravity (which, arguably, is an experiment in itself... but just not the only one).

<comment><USER8> I have a nifty IFTTT thing set up that sends me a weekly summary from the ISS, most of which tends to be about their research: [https://goo.gl/qSjme7](https://goo.gl/qSjme7)

It pulls from these blog posts: [https://blogs.nasa.gov/stationreport/](https://blogs.nasa.gov/stationreport/)

It's so easy to forget that we (human kind) are actually up there doing solid research all the time. The attention paid in the media to launches, landings, and the work being done seems tragically low to me.

<comment><USER9> That blog is fantastic, thanks for the link.

</comment></comment></comment><comment><USER10> I thoroughly enjoyed the story, and side with the astronauts.

However:

> _After they returned, NASA became vindictive, and ensured that none of the > crew flew again._

That's not really vindictive. Mutiny is an extreme measure with normally severe consequences (and I'm sure that the astronauts took this into consideration before acting), and it's not like there was an astronaut shortage at the time.

<comment><USER11> My question is did NASA learn from this and improved the scheduling for future missions? Seems they have with ISS unless I'm wrong?

<comment><USER10> If NASA did indeed change anything, then I'd suspect it would have been the astronaut selection process. More precise: to select astronauts who can work 16 hours a day for 85 days.

Not that _I_ side with this view, but I can empathize with it. You're spending billions of dollars on these experiments, so given the choice of either (a) doing less experiments or (b) finding three people who can work Gulag-hours, I'd expect the decision to go (b).

These are extraordinary jobs in extraordinary circumstances. You can't just apply ordinary rules.

<comment><USER12> Suppose nobody can work the schedule these guys were expected to follow? Or nobody completely new to space travel, as they were? Or suppose other skills vital to the mission are on a different axis from the ability to work the extreme hours and a compromise needs to be made between them? What then?

<comment><USER13> _> Suppose nobody can work the schedule these guys were expected to follow?_

The article says "the all-rookie astronaut crew had problems adjusting to the same workload level as their predecessors". So apparently the previous Skylab crews had been able to work the schedule that this crew was expected to follow.

<comment><USER14> Wikipedia tells us that on Skylab 3 _a total of 1,084.7 astronaut-utilization hours were tallied by the Skylab 3 crew_ and that _a total of 6,051 astronaut- utilization hours were tallied by Skylab 4 astronauts._

So it's fair to say that either NASA completely changed the way they measured "astronaut utilization" between these missions, or the Skylab 4 guys were flying a very different mission. We're comparing a 60 day mission to an 80 day mission, but still.

</comment></comment></comment></comment></comment></comment><comment><USER15> The decisions made by the astronauts were made by their mission commander - <USER2> Marine Colonel.

Rather than a labor/capitalist take, this goes back to the old military traditions that a captain has the final authority for the safety of his ship and crew, and that at the end of the day, he only makes the call.

For example, the recent collision between the USS Fitzgerald, which happened while the captain was asleep. The officer in charge of the ship, and the officer in charge of the CiC spent that whole night leading up to the collision making one giant mistake after another, and still the commander is going to court martial. He's going to court martial because by naval tradition, he was responsible for knowing that his officers had insufficient training because of over scheduling and should have rather kept the ship in port than sail.

It's bad either way - not sailing your ship will make a lot of people unhappy with you, and may be career limiting, but that's what is expected.

In the end, official NASA histories admitted that ground control was indeed wrong, and had schedule too much each day, and made poorly thought out, last minute changes to the plan, and weren't listening to the astronaut concerns. (And that there were lots of astronaut affecting problems with Skylab itself)

The Skylab 4 situation was also the final round in the culture clash between mission control, who believed they had the final say, and the astronaut commanders carrying on the naval/aviation tradition that the captain onboard has the final say. After this mission, it was hashed out that mission control did have the final say, however mission control would respond if the astronauts said there was a problem.

</comment><comment><USER16> This reminds me of comments made by Apple's first head of engineering, who was also one of its self-described founders, Rod Holt. He was a communist activist who helped Woz build the first Apple II, and then went on to run engineering and was later involved in the Macintosh project. With the fortune he made on Apple stock, he founded the Holt Labor Library on Geary Boulevard, among other things. On folklore.org, how some of his communist ideas influenced the production at early Apple are described by the Mac team, such as that production should be from each according to ability, to each according to need ( [http://www.folklore.org/StoryView.py?story=Spoiled?.txt](http://www.folklore.org/StoryView.py?story=Spoiled?.txt) )

His comments ( [https://louisproyect.org/2015/08/28/steve- jobs/](https://louisproyect.org/2015/08/28/steve-jobs/) ) were on, among other things, how Apple really worked in the early days, putting aside business press (or non-business press) mythologies. One of his points of how Apple became one of the largest corporations in the world was that it did not follow the original path of capitalism - commodities for profit, alienated labor and such. He did not care about such things, nor did Jobs, initially, one of the reasons he surmises Jobs was fired from Apple. Holt states this explicitly "We were not producing commodities for the sake of profit. In many respects, even as the company grew beyond all expectations, inertia carried this extraordinary characteristic forward until the Scully era."

Of course, most people have no idea how changes in these precepts can affect production, or have any idea what alienation of labor during production is, and can disregard all this, and buy into the latecomer business press view of how one of the world's largest corporations was created, as opposed to listening to the view of one of the five leading people who were there from the beginning, whose ideas influenced (and which were to some extent intuitively parallel to Jobs's and Wozniak's ideas of) production at Apple, and who had a thoughtful account of how such a company came to become a leader in world production.

<comment><USER17> Jobs career was launched by a capitalistic exploitation of Woz's work -- subcontracting his work to Woz for a fraction of the pay. He was similarly ruthless in negotiating pay and IP ownership with his employees and colluding with competitors to suppress employee opportunities and wages. Apple is not a Communist love story.

<comment><USER16> Apparently Jobs was not ruthless enough - in 1985 he found himself exiled from his own company, by his hand-picked CEO.

</comment></comment></comment><comment><USER18> I don't remember details but there was also an Apollo flight where the crew was so cranky that none of them was allowed to ever fly again.

<comment><USER19> Apollo 7 -- the first crewed Apollo mission.

[https://en.wikipedia.org/wiki/Apollo_7#Crew_honors](https://en.wikipedia.org/wiki/Apollo_7#Crew_honors)

</comment></comment><comment><USER20> Maybe the one doing the scheduling of the astronauts was not allowed to do that again also.</comment>


Bank of Japan Refuses Trader Work from Home Due to Cybersecurity Risks - <AUTHOR> https://www.bloomberg.com/news/articles/2020-08-17/boj-refuses-trader-requests-to-work-from-home-breaking-with-fed <comment><USER2> Knowing how cybersecurity is handled in vast majority of japanese companies, I wonder why they even consider WFH as an option.</comment>


Schimmy's Hierarchy of Jobs and how to tell if a company is faking the mission - <AUTHOR> http://colinschimmelfing.com/blog/the-hierarchy-of-jobs/

<comment><USER2> For me mission is more important than perks. Catered lunches are great, until you've had the same thing 10x and really its a convenience factor. The kinds of things that make me excited to keep pushing, even when I'm tired, are more around making the world a better place. Sometimes its selfish, when the world is better, I get to enjoy it (so long as I'm alive).

Why do you put perks 2nd?

Re: science. I think knowledge is benign and humans are not. Its not what we know but how we use it.. Spideman quote and all.

<comment><AUTHOR> I put perks 2nd as I think about it myself as more a progression up the pyramid...

Ah well, at least the outcome of being selfish ends up with a good result!

</comment></comment><comment><AUTHOR> Does pure scientific discovery count, given that it can be used for evil? I think no, but on the other hand the internet that I'm typing this on was partially created with defense industry funds....

</comment><comment><USER3> mission, scale and perks go hand in hand now-a-days. Be it saving the world or serving the world, scale matters these days as much as mission & perks. In some sense, it is a testament to how much people use and love a product/service.

</comment><comment><AUTHOR> also the facebook mission - "to give people the power to share and make the world more open and connected". Is that enough?</comment>


Tell HN: Check out my new note taking app, ScribbleJot - <AUTHOR>

http://www.scribblejot.com
I've been playing around with Google App Engine for a few weeks and this is the result.  My goal was to design a really simple app for quickly jotting down notes.  It uses Markdown so that you can easily style/format your notes.
I've got several plans for version 2.0, most notably a dedicated mobile version.  Let me know what you guys/gals think. <comment><USER2> Hope this is helpful: your front page doesn't tell me why I shouldn't just use my desktop text editor. (Or 'Stickies' on the Mac.) Why is SJ a better choice?

</comment><comment><AUTHOR> Clickable Link:

<http://www.scribblejot.com>

</comment><comment><USER3> please put in a higher resolution screenshot/screenshot gallery.</comment>


500M of "Have I been Pwned" hashes broken - <AUTHOR> https://hashes.org/leaks.php?id=515 <comment><USER2> Just a reminder: HIBP password list only includes passwords from already cracked / plaintext sources.

[https://www.troyhunt.com/ive-just-launched-pwned- passwords-v...](https://www.troyhunt.com/ive-just-launched-pwned-passwords- version-2/#theresnow501636842pwnedpasswords)

<comment><USER3> But maybe not in one place.

<comment><USER4> If you think, even for a moment, that nobody has ever compiled and distributed a compilation of leaked credentials then I have a bridge to sell you.

<comment><USER3> So what? Now you have one more unnecessary compilation than before.

</comment></comment></comment></comment><comment><USER5> There is always this 1.4 billion plaintext email:password compilation magnet:?xt=urn:btih:7ffbcd8cee06aba2ce6561688cf68ce2addca0a3&dn=BreachCompilation&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80&tr=udp%3A%2F%2Ftracker.leechers- paradise.org%3A6969&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969&tr=udp%3A%2F%2Fglotorrents.pw%3A6969&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337

<comment><USER6> Totally unrelated, but something I've been wondering for a while. Isn't the whole point of magnet links that they use a distributed hash table (DHT)? Why do they need trackers appended to the URL? Is it strictly necessary, or does it just help in bootstrapping the DHT?

I always remove those when downloading torrents because I'm paranoid they're obvious markings of torrent traffic, more-so than DHT connections.

<comment><USER7> Nope, it isn't necessary. It just helps with peering, and the actual download will start faster.

<comment><USER8> Are you sure? I always thought that the peers have to be seeded by the trackers.

How would you as a peer connect to any other peers without some kind of seed?

What IPs do you connect to?

<comment><USER9> Clients usually have some public, harcoded nodes to bootstrap the search: [https://stackoverflow.com/questions/1181301](https://stackoverflow.com/questions/1181301)

</comment></comment></comment></comment></comment><comment><USER10> Troy Hunt said this doesn't really matter - [https://www.troyhunt.com/here- are-all-the-reasons-i-dont-mak...](https://www.troyhunt.com/here-are-all-the- reasons-i-dont-make-passwords-available-via-have-i-been-pwned/)

The hashes are about not storing or giving out the passwords freely, more as a way to verify if your password is in there.

</comment><comment><USER11> Someone should add a "Has my hashed password been broken?" and an opt-in notification when one's password is eventually revealed.

Last person standing gets a prize.

<comment><USER12> Everyone who uses a password manager would win

<comment><USER13> Using a password manager doesn't make you immune to having your credentials leaked if a sites database is breached...

<comment><USER14> It actually does, provided the passwords aren't stored in plaintext.

Even something ridiculously weak like a SHA-1 hash isn't going to be cracked if the password is 16 characters long and completely random.

<comment><USER15> provided:

\- the passwords aren't stored in plaintext or any other compromised hashing mechanism

\- you autogenerated your password

\- your password manager does not get compromised

saying "it actually does" is a bit of absolutist stretch...

<comment><USER16> Furthermore, none of this is a side-effect of using a password manager. It just makes doing so more convenient.

<comment><USER17> Within a margin of error, zero people can remember 20 16-character random alphanumeric passwords. Therefore it is only possible using some sort of password manager, whether it be something like 1password or an old-fashioned notebook.

<comment><USER18> > Within a margin of error, [the value of a measure is] zero.

Nitpick: Zero does not have a magnitude, so "a margin of error" is not remotely well-defined here.

<comment><USER17> Nitpick nitpick: margin of error can be either absolute or relative.

<comment><USER16> Nitpick nitpick nitpick: "margin of error" without any value effectively means "the following value has no meaning at all", as the margin of error is unspecified.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Having faith in the security of the hash that has been leaked was always a ticking clock. Better to just rotate any password you know to have been compromised.

<comment><USER20> Those hashes comes from leaked plain text passwords lists originally. They were already released in plain text. The hashing of Have I been Pwned are just a way to not release even further those passwords (to newcomers, hobbysts and general public), but the hacking community was already using them in dictionary attacks.

<comment><USER21> Seems like HIBP should be using a fixed salt on its hashes.

<comment><USER22> Because of the way HIPB works the salt would need to be both constant and known by the client which makes it rather useless as a salt. It only would stop rainbow tables, but that's not the issue here.

</comment></comment></comment></comment><comment><USER23> Oh, HIBP do not include the data from the MyFitnessPal breach. 150m users are affected!

> [https://content.myfitnesspal.com/security- > information/FAQ.ht...](https://content.myfitnesspal.com/security- > information/FAQ.html)

<comment><USER14> Breaches can only be added to HIBP if Troy gets his hands on a copy of the data that was stolen.

Most of the passwords probably won't get added to the HIBP password list either, since only plaintext passwords ever end up on that list, and MyFitnessPal claims that most of the passwords in their database were hashed with Bcrypt. (So probably difficult to crack.)

</comment></comment><comment><USER24> How would an attacker use this information? Brute force attack on an account with known email address?

<comment><USER25> > Brute force attack on an account with known email address

Yup. These days I get a ton of break-in attempts for random accounts. My Epic Games account is disabled weekly due to failed login attempts from random actors.

Use a password manager and 2fa folks!

<comment><USER26> > My Epic Games account is disabled weekly due to failed login attempts from > random actors.

Everyone has this (source: some thread on Reddit with a bunch of "me too" answers). It's a bug with their system and I don't think they know about it/care/(?)

<comment><USER25> > It's a bug with their system

Confident about that? It's certainly not the only service I get break in attempts on, fwiw

<comment><USER26> Well first of all, someone else knowing your username should not be able to lock you out of your account. So even if it isn't a bug it's bad design.

It looks like you can still sign in even if your account is "locked" which further adds to the theory that it is a bug.

Here are a few threads with a bunch of "me too"s. [0][1]

[0] [https://www.epicgames.com/fortnite/forums/battle- royale/roya...](https://www.epicgames.com/fortnite/forums/battle- royale/royale-with-cheese/232340-account-locked) [1] [https://www.epicgames.com/fortnite/forums/battle- royale/roya...](https://www.epicgames.com/fortnite/forums/battle- royale/royale-with-cheese/250598-account-locked)

</comment></comment></comment></comment></comment><comment><USER27> Don't put your email into this unless there is a way to download the database for offline use. The reason is, if HIBP is compromised, the hackers will know that even if your email is not pwned, it is likely important and will try to brute force it or use it to build a larger profile if you, such as for other services.

</comment><comment><USER28> First Torrent for just the plains from the list is available:

[https://hashes.org/torrent/hibp_plain.torrent](https://hashes.org/torrent/hibp_plain.torrent)</comment>


EFF Sues FBI For Access to Facial-Recognition Records - <AUTHOR> https://www.eff.org/press/releases/eff-sues-fbi-access-facial-recognition-records <comment><USER2> I think the trend is pretty clear: increasingly more surveillance of everything you do, biometric/DNA recognition systems implemented everywhere, and bringing back army troops and military technology (including drones) for "security" inside the country (and of course further militarization of the police, too).

Look what they're doing at the Mexican border. That's only a sample and a "test-run" of what they're planning for the whole country in the next 10 years.

Those sci-fi movies about an awful future where the civilians and the society is highly controlled by the government are becoming reality.

Now it depends whether the people actually want this to happen, or don't even care about what's happening. I think US has maybe _one_ more chance at the next presidential election and next 1-2 Congress elections to turn this around, if it's not already too late to stop this trend.

Once it's entrenched and hundreds of billions if not trillions of dollars are spent on this effort, it's going to be very hard to roll it all back. Just look what success Americans have had with rolling back the war on drugs or the military industrial complex (which is to say absolutely none, and that's been going on for decades).

<comment><USER3> (Opinion from someone north of the border): The good thing about being Canadian is we live mostly American-style lives but don't have to deal with stuff like this lol (or at least it doesn't look like it, but someone can correct me if we have secret PRISM projects too).

The bad thing is we have no say in what happens down there, and we are dependent on many services the US provides (not that I'm complaining, but PRISM stuff isn't comforting heh).

<comment><USER4> _On the basis of secret government directives, Canada's national security apparatus is conducting mass surveillance of Canadians parallel to, if not directly patterned after, the domestic spying operations of the U.S. National Security Agency (NSA)._

[http://www.globalresearch.ca/police-state-canada- communicati...](http://www.globalresearch.ca/police-state-canada- communications-security-establishment-canada-csec-runs-massive-domestic- spying-program/5339250)

[http://www.theglobeandmail.com/news/national/how-canadas- sha...](http://www.theglobeandmail.com/news/national/how-canadas-shadowy- metadata-gathering-program-went-awry/article12580225/?page=all)

[http://www.huffingtonpost.ca/2013/06/08/nsa-spying- canada_n_...](http://www.huffingtonpost.ca/2013/06/08/nsa-spying- canada_n_3408662.html)

<comment><USER3> There we go, I knew someone would find something. I guess ours just gets a lot less press, even in our own country :(

</comment></comment></comment></comment><comment><USER5> Suggestion: let's identify any elected officials who support this database, and then offer support / donations to their opponents who vocally oppose it.

<comment><USER6> Even if they vocally oppose it now, how do we know they will continue to oppose it once in office.

Remember that Obama was pretty vocally opposed to secret government surveillance prior to becoming president.

<comment><USER5> You make a good point. How can we hold politicians accountable? Perhaps we could vote to shorten terms.

<comment><USER6> I don't think shorter terms would work. Obama backpedaling on all his initial campaign promises didn't prevent him from getting re-elected. Representatives in the House only have 2 year terms but the highest incumbency rates. I think the main issue is the two-party system. It puts people into this "lesser of two evils" mentality which, surprise, results in some form of evil always persisting.</comment></comment></comment></comment>