ActiveState's Perl and Python distributions go non-free - <AUTHOR> http://www.activestate.com/activepython/license-agreement

<comment><AUTHOR> Same for both ActivePerl and ActivePython: [http://www.activestate.com/activeperl/license- agreement](http://www.activestate.com/activeperl/license-agreement)

"To use the Software for internal-facing or external-facing production servers you require a Business Edition license"

Maybe only a problem for those who used their ports on Windows, as they were the easiest to install without a compile toolchain.

</comment><comment><USER2> Well, if & when people actually decide to stop developing on Windows and stick to something better like Linux, ActiveState's versions of the language will be obsolete and this won't be an issue. Python & Perl on Linux are free and not controlled by a proprietorially controlling corporation.</comment>


Tracking BlueKeep (CVE-2019-0708) RDP Remote Code Execution Vulnerability - <AUTHOR> https://www.reddit.com/r/BlueKeep/ <comment><AUTHOR> There's currently no known "public" exploit for this vulnerability, but when it arrives it's going to be a nightmare. This subreddit is tracking BlueKeep progress.

<comment><AUTHOR> You should also be aware that there are many fake BluKeep RCE's being distributed. Do not run them or you'll get pwned.</comment></comment>


Response to the request to remove CFRG co-chair - <AUTHOR> http://article.gmane.org/gmane.ietf.irtf.cfrg/2337 <comment><USER3> I wrote a short summary about what this was about a few weeks ago:

[https://news.ycombinator.com/item?id=6942145](https://news.ycombinator.com/item?id=6942145)

(Shorter: CFRG is the IETF's crypto review† board, and one of its co-chairs is an NSA employee).

This outcome was a near-certainty, for the simple reason that nobody came up with (or even nominated) a replacement for Igoe. IETF people have worked with Igoe, in person, for years. He is probably a very nice, very earnest person. Removing him from the CFRG without even having a replacement would have been demonstratively hostile without improving the quality of the research group.

Unfortunately, despite a few threads of very solid crypto discussion on CFRG during the Igoe debate, most of it was marked by shrill, repetitive, and often mistaken political commentary. The mailing list had the tenor of a Wikipedia "Articles for Deletion" debate that had been circulated on Reddit. IETF long- timers were visibly irritated. There was also an unhelpful strain of back-and- forth between Dan Harkins, the author of the (flawed) Dragonfly PAKE whose CFRG endorsement started this mess, and Harkins' detractors. At times, the whole thing looked a little petty, especially since Dragonfly is now a dead letter anyways.

It remains weird that IETF's crypto-review board is chaired by an NSA employee. But it doesn't have to stay that way. Igoe has been on the job for many years now, and, from my remove, that job seems pretty thankless. What needs to happen is for someone else to be floated as a new co-chair for the group. I wouldn't be surprised if Igoe voluntarily stepped aside for the right name.

† _(David McGrew, the group 's other co-chair, disputes this characterization, but the facts on the ground seem to argue that "review board" is the CFRG function that matters)_

<comment><USER4> I propose Dan Bernstein. Now let's do this.

<comment><USER3> You can't just do that. Bernstein has to want to do it, and agree, and if you don't want to look silly that has to happen before his nomination is posted to the mailing list.

<comment><USER4> Yes, on second thought, DJB would probably have much more impact working in a group that's _creating_ crypto standards rather than just reviewing other people's proposals.

<comment><USER3> For what it's worth: that's what he already does. For example, Bernstein is one of the coordinators for CAESAR, the competition for new authenticated bulk ciphers.

[http://competitions.cr.yp.to/caesar- committee.html](http://competitions.cr.yp.to/caesar-committee.html)

<comment><USER5> I think that was salient's point -- he's _already_ creating crypto standards and he's likely better suited to that than simply reviewing other's proposals.

</comment></comment></comment></comment></comment></comment><comment><USER6> > The IRTF and IETF have always welcomed participation by all, […]

As I wrote previously¹: " _We have a tacit assumption that all participants have realized that better standards (and strong crypto, more secure systems) will lead to the betterment of all. This is the default assumption.

However, now that the U.S. government, and the NSA and its collaborators in particular, have been _shown _to explicitly_ not _have this goal – in fact, their goal has been to strive for_ less _secure systems and_ more difficult _standards – what should be done? The logical thing to do is to exclude any person or organization revealed to have an agenda explicitly contrary to the group._ "

Having an all-inclusionist policy is "Geek Social Fallacy #1"². This case illustrates why you cannot let an inclusionist policy be all-overriding. Toxic people and representatives of _explicitly_ adversarial organizations _cannot_ be allowed to participate in, and thereby sabotage, both the work and goodwill of a committee.

1) [https://news.ycombinator.com/item?id=6945314](https://news.ycombinator.com/item?id=6945314)

2) [http://www.plausiblydeniable.com/opinion/gsf.html](http://www.plausiblydeniable.com/opinion/gsf.html)

<comment><USER7> There is a shadow of McCarthy's red scare in the suggestion that no NSA affiliated people be allowed to participate.

How would you determine if a participant had affiliation? How many degrees of separation must there be before a person is trustworthy in their neutrality?

As well, it would require an approval process for new participants, closing the working groups. Even should the folks decide to abandon the current model of participation, how would you determine someone new wasn't affiliated, and who has the right to decide who is trustworthy?

It's argued often here that extreme transparency is the cure for shadowy practices, and I don't think it gets much more transparent than group review of any changes to any specs.

To expect that excluding publicly aligned NSA folks would solve any problem is fool-hearty, given that it's an intelligence agency and I'm sure fully capable of installing clandestine participants.

Therefore, I would argue that exclusion is very much an illogical choice. The logical thing to do here would be to increase scrutiny on any changes.

(To note, this comment is not about removing the co-chair privileges from Igoe; if the position is really as powerful as some say, yeah let someone else do it. I'm just saying don't start suggesting people be banned from participating).

<comment><USER8> > There is a shadow of McCarthy's red scare in the suggestion that no NSA > affiliated people be allowed to participate.

The analogy is so stretched as to be meaningless. At least as it refers to the McCarthy portion of the Red Scare, the objectionable portion were: targeting participation in purely domestic political groups, and falsely accusing people of affiliations they didn't have.

It wouldn't be at all objectionable to exclude from employment with the State Department or Army people who were actively openly affiliated with organizations directly sponsored by the Soviet Union. (Though acting in movies presents a different question.)

Likewise, it makes no sense for a standards group to be chaired by a person openly and actively affiliated with an organization which has as a goal subverting those very standards.

<comment><USER7> This really isn't that hard to understand:

1\. Banning persons with open affiliations encourages people to hide their affiliation with those organizations. 2\. Then, banning persons with supposed affiliations encourages abuse of the banning process.

</comment></comment></comment></comment><comment><USER9> And Trevor Perrin's response: [http://thread.gmane.org/gmane.ietf.irtf.cfrg/2337](http://thread.gmane.org/gmane.ietf.irtf.cfrg/2337)

I concur: Kevin Igoe should resign, if nothing else then to remove the cloud of suspicion, given the revelations of NSA sabotage.

<comment><USER10> I have a feeling if Kevin Igoe truly has the best interests of the group in mind, he would.

On the other hand, if his mission is to sabotage their work I think that's much less likely to happen, particularly with Lars' support. I wonder if the resulting increased scrutiny will cripple the working group.

<comment><USER11> sorry lol, i just had a witchhunt moment. if she's a witch the place will be a better place without her, but if she isn't she will become a martyr in the name of god.

not exactly a fan of the nsa, and on top of that i think a lot of companies like to spy even without the help of the nsa, but come on guys is that really the level we're arguing on?

</comment></comment></comment><comment><USER4> Sometimes those in power can refuse to kick out others alongside them that are in power. Friendships could've been formed etc.

So the logical conclusion is to request the removal of the CFRG chair, too, and replace him him with someone who _will_ remove the NSA co-chair. Or just start boycotting and ignoring everything this group is proposing from now on in cryptography - whichever way works.

> Should we then eliminate all individuals affiliated with the NSA from > participating?

Um - hell yes?! After all that's happened and everything NSA has been trying to do to _undermine_ the security of the web and US infrastructure, too? Of course the answer to that is YES! Otherwise, I personally have no trust in everything this group or IETF on the whole, will be releasing from now on, if that's their attitude about this.

 _International_ security standards should be created without the involvement of spy agencies - especially when they've already been discovered to be trying to implement hardware backdoors on multiple occasions (even in the recent UAE satellite). NSA is _hostile_ to security and to security standards. They've proven it already. So treat them as being hostile.

</comment><comment><USER12> I have no ideas who Lars Eggert _really_ is, but the quality of the rebuttal is very good. In such a critical field where non expert cannot understand what is going on and where we can only _trust the experts_ , such a nice response on a very controversial and emotionally charged topic is very appreciable.

<comment><AUTHOR> I thought so too first but then I read Trevor Perrin's response to Lars Eggert: [http://www.ietf.org/mail- archive/web/cfrg/current/msg03778.h...](http://www.ietf.org/mail- archive/web/cfrg/current/msg03778.html) and it seems quite clear that Eggert failed to consider a number of important aspects, just one example from Perrin's mail:

> So unlike the title "co-chair" might imply, and unlike in many other > organizations, IRTF co-chairs are little more than group secretaries.

The chair is far more than a "group secretary". As RFC 2014 section 5.3 states:

""" The Research Group Chair is concerned with making forward progress in the areas under investigation, and has wide discretion in the conduct of Research Group business. [...] The Chair has ultimate responsibility for ensuring that a Research Group achieves forward progress. """

</comment></comment><comment><USER13> The message is easier to read it on Gmane:

[http://article.gmane.org/gmane.ietf.irtf.cfrg/2337](http://article.gmane.org/gmane.ietf.irtf.cfrg/2337)

<comment><AUTHOR> It's also very readable by displaying the source code of the page.

<comment><USER14> Or by giving the PRE element a "white-space: pre-wrap;" attribute via Firebug, Safari Web Inspector, or your favorite equivalent.

</comment></comment></comment><comment><USER15> It's astounding to me that they are allowing him to retain his position. If for no other reason than the message it sends. How disturbing.

</comment><comment><USER16> I'm just not sure how you can ignore the fact that his employer is NSA. By proxy, he's doing evil (at least imo).

He chooses to work for an agency that breaks the law. Do we just turn a blind eye?

If he was answering phones there, it'd be one thing, but he's a cryptography expert. I'd imagine he'd be only a degree or two removed from something nefarious.

Just following orders is not an excuse if you have a conscience.

e - <USER2>

<comment><USER17> What if he worked for local police, which help keep order around the NSA headquarters? Or chooses to operate a US based company, sending more tax money to fund the NSA?

At any rate, if the NSA wanted to continue to participate, they'd just hire people not officially associated with the NSA.

</comment></comment><comment><USER18> Previous discussion: [https://news.ycombinator.com/item?id=6942145](https://news.ycombinator.com/item?id=6942145)</comment>


Under the covers of the App Engine Datastore - <AUTHOR> http://snarfed.org/datastore_talk.html

<comment><USER2> Not loading</comment>


Repos.io Search and manage code repositories - <AUTHOR> http://repos.io/

<comment><USER2> cool concept, thought I need sth like this. waiting for bitbucket and it can be useful. keep up.

I hope you send an email when you add bitbucket.

criticism: font-sizes and line-heights are going crazy around there, needs some consequence and more whitespace. and the "Your account ( Z A L E W )" is just fugly. the logo <http://hackful.com/> :)

<comment><USER3> Hi

Thanks for your comment.

It's currently a work in progress, and yes you will know when repos.io will handle more providers like bitbucket and others.

About the design, i'm not a designer at all so if you have ideas :) Can you be more precise about font-sizes and line-heights (and tell me on which browser)

And the logo is not really a logo for now, it's just a character in the font i use... <USER3>
<comment><USER2> I actually have some ideas, I'll drop you an email.

</comment></comment></comment><comment><USER3> Thanks abki but i told you it was not ready yet :p</comment>


Man In The Moonbase (Part 1): Death and Life of the Best Game You Never Played - <AUTHOR> http://www.gamasutra.com/blogs/DarbyMcDevitt/20150223/234684/Man_In_The_Moonbase_Part_1.php

<comment><USER2> Moonbase Commander is a fantastic game that never got the attention it deserved. I highly recommend buying it from Steam or GOG.com. Despite being released in 2002, its graphics and gameplay have aged well. Playing a multiplayer game today is just as fun and deep as it was back then.

I would suggest using a fan-created third-party tool, Moonbase Console, to generate random maps and facilitate online games. Not sure if someone's hosting the file, but the source code for it is on my github [https://github.com/michaelbarlow7/moonbase- console](https://github.com/michaelbarlow7/moonbase-console)

</comment><comment><USER3> Lengthy reading that was well worth every second.

This comment is not very informative, aside perhaps to the skeptic reader who's wondering if the words are worth the time. They are.

<comment><USER4> It worked, I decided to skim the comments instead but this drew me back in. Great, illustrative, and engrossing read.

</comment></comment><comment><USER5> My brother and I gave this game a chance based on the positive Penny Arcade write-up mentioned in the article and ended up playing it for the next several years.

<comment><USER6> Games like that are the best. Hidden gems that your close circle of friends and family discover and play long past their heyday. For me it was Metal Warriors for SNES and 1998's Battlezone.</comment></comment>


Using ccrypt as a password manager - <AUTHOR> http://jonblack.org/posts/using-ccrypt-as-a-password-manager/

<comment><USER2> A lot of these tools on the front page today. I think a lot of them only contain 40-60% of what is required to be useful. Any password safe needs to:

\- somehow work on my phone, not just because I sign into things when I'm away from my desk but also because I'm not going to manually copy all the passwords into my phone

\- generate secure passwords for me when I need to enter one

\- record passwords I use to help me migrate if I'm not using a safe already

\- import passwords from other password safes

\- support filling the passwords into the page, so that I don't have to open a terminal, decrypt, copy, paste and possibly re-encrypt

\- support two factor authentication systems

This isn't a complete list, it's a minimum. It's also nice to support multiple forms of two factor auth, in case my phone gets stolen and it's nice to have a form filler too.

It's ok to be a "unix-style tool" that does one thing and one thing only, but you need to have other tools for doing every other feature that is required.

<comment><USER3> What's the point of having a second factor auth if both are stored on the same device ? If the phone is compromised electronically or physically then everything is lost.

<comment><USER2> Well, you don't store them on the same device :)

</comment></comment></comment><comment><USER4> Use pass[1] if you want to use the command line, it uses GPG to encrypt each password and git to version them. It's pretty nifty.

[1]: [http://www.zx2c4.com/projects/password- store/](http://www.zx2c4.com/projects/password-store/)

</comment><comment><USER5> ccrypt uses a single iteration of a hash function to derive the encryption key from your passphrase, which provides very weak protection against exhaustive searches for your passphrase.

For encrypting a single file with a passphrase, I just use GPG: `gpg -c` to encrypt, and `gpg -d` to decrypt.</comment>


Genes may control how tough it is to stop drinking - <AUTHOR> https://medicalxpress.com/news/2018-09-genes-tough.html <comment><USER2> and smoking......</comment>


Uber should be suspended in California and fined $7.3M, judge says - <AUTHOR> http://www.latimes.com/local/lanow/la-fi-uber-suspended-20150715-story.html <comment><USER2> Uber isn't complying with a law that they supported.

"California has always been on the cutting edge. The CPUC agreement further demonstrates how the Golden State welcomes and supports not only technological advancement, but a better future for drivers, riders, and our cities."

[http://newsroom.uber.com/la/2013/01/california-clears- uber-t...](http://newsroom.uber.com/la/2013/01/california-clears-uber-to- continue-and-expand-operations/)

</comment><comment><USER3> I think Uber is a great company and I love the product.

However, I can't remember a startup that received billions in funding and having such disregard for local laws around the globe. I just don't get it. They literally don't comply with any law in any country and give zero shits about the consequences.

<comment><USER4> Those laws should not be on the books anyway, the fact they disregard them is one of the main reasons I support uber.

<comment><USER5> If a regular person routinely disregards the law because they don't agree with it they go to prison.

But when a $40 billion tech startup does it, it's cool.

Got it.

<comment><USER6> Yes, organizations have more power and importance than individuals. This has been true everywhere throughout most of human history.

<comment><USER7> Which is why allowing them to undertake acts of civil disobedience is just letting in the Visigoths.

If money and power is allowed to buy a company greater ability to ignore the law than an individual human citizen... We all may as well call it a day, write the entire system off and start thinking about how the next one should work. Unless I see a counter example of say Google or Apple ignoring a stupid encryption must have back doors type law then we have zero examples of corporations ignoring the law for good... Vs hundreds of examples of them ignoring the law for evil, and a handful of examples where the good vs evil question is uncertain but should still be considered bad because they are breaking the law.

</comment></comment></comment></comment></comment><comment><USER8> I question the value of CPUC wanting detailed _historical_ operational data. It seems like an attempt by an outdated regulatory organization to shoehorn itself by flexing its authority, creating nothing but more bureaucratic inefficiency.

What purpose does it serve? How will it make California more safe? How are the legal costs, the administrative costs, and the overhead costs justified? I think these questions should be asked more often, instead of blindly respecting that authority is good, and regulation is a net positive.

<comment><USER9> This issue is not that CPUC wants this data, it's that state law requires operators to provide the data to CPUC. The article says:

 _" Uber's parent company has refused to provide data on operational data that is required under the 2013 law that legalized ride-hailing firms, the California Public Utilities Commission judge said in a decision issued Wednesday afternoon."_

<comment><USER8> That is a separate issue. While an unjust law is still law, it does not mean I will look down on a service that ignores unjust laws.

</comment></comment></comment><comment><USER10> This reminds me of Yishan Wong's comment about the law being "lazily evaluated" [1]. Whatever the legal merit of the ruling, the plain political reality is that Uber has establish an immense base of satisfied users and will therefore receive significant pushback on this. I personally can't imagine Uber shutting down in CA at this point: so many people are past the the "can't imagine how I did it before..." threshold.

While Uber's strategy was in a gray (if not black) area at the time of inception, by the time the law gets around to "evaluating" whether to act against Uber, the sands have shifted, vindicating Wong's point.

[1] [https://www.quora.com/Why-has-Airbnb-not-been-sued-or- regula...](https://www.quora.com/Why-has-Airbnb-not-been-sued-or-regulated- out-of-existence/answer/Yishan-Wong?share=1)

</comment><comment><USER11> The people of California can surely now breathe a sigh of relief that the government was able to protect them from this predatory company and the services it offered.

<comment><USER12> The rule of law is something that every US business relies on. Further, I doubt that Uber relies on vigilante justice to settle their disputes -- they (just like everyone else) rely on the law and the courts to get what's legally entitled to them.

<comment><USER11> Legitimate businesses rely mostly on the enforcement of contracts and protection of property.

Immoral businesses rely on government force to prevent other citizens freely engaging in otherwise harmless transactions for mutual benefit.

</comment></comment></comment><comment><USER13> Considering the massive backlash Uber has received around the world, i'm quite impressed how they can keep the show going, and investors keep funding them.

Doesn't this seem like a lost cause for VC's?

Edit:

I get that the service they provide is hugely beneficial to the customers, but if that is only possible from breaking the law, then it's doomed to fail.

E.g. If an airline company provided extremely cheap flights, by having people who just received a license to fly be the captain, then you are asking for trouble, legal and illegal.

Truth be told, if Uber pivoted to instead of cutting out the taxi companies, instead delivered the app as a service for the taxi companies, then they could probably optimize their respective companies to be able to provide taxi services cheaper and with better service.

<comment><USER14> Everywhere I've been people/customers love Uber. I live in Toronto and I think it's safe to say the people much prefer Uber over taxis.

The only significant entities who dislike Uber seem to be taxi companies and governments.

<comment><USER15> .. and the victims of accidents who find that the drivers are not properly insured, and the drivers who find that their insurance company drops them and they are liable .. and people who think that you should be able to get a fucking cab in the rain for less than $400. ;)

<comment><USER16> I can't speak to the insurance side, but I know that in Boston, the sort of times when a surge goes over 2x are the same sort of times that it's very difficult to hail a cab, let alone expect dispatch to send one if you call. If the weather is bad enough to be at a 2.5x surge, I'd never expect to be able to get a hackney cab here. Other cities may not have this problem.

</comment></comment></comment></comment><comment><USER17> I love uber and use it daily. I live in NYC where taxis have been getting worse and worse over the past few years.

I am very concerned about how much their "contractors" make though. Some of the drivers I speak to claim they can make 100k a year driving just Friday and Saturday nights... others say they aren't making much profit after insurance, TLC, and leasing costs.

<comment><USER18> Honestly, what would be nice to see, is the breakdown: who is making money, and how much, when one rides the taxicab, i.e. Uber vs Yellow Cab vs whatever- cab.

Also, whether the price is sustainable, or is it just price-dumping.

I want to give more money to the cabbie driver, and then less and less to the broker (Yellow Cab or Uber) (10% finders fee is what is common in other businesses), medallion owner (0% - provides no value), car owner (investor - 10% a year would be great investment), licensing board (fixed fee, say $300), insurance ($thousands per year for sure), and whoever else is trying to make money on this.

</comment></comment><comment><USER19> Details from [http://abcnews.go.com/Technology/wireStory/uber- fined-7m-kee...](http://abcnews.go.com/Technology/wireStory/uber- fined-7m-keeping-info-california-regulators-32479254)

> The judge agreed with utility commission staff who said Uber has not filed > all required reports, specifically about how often it provided disabled- > accessible vehicles when requested, places where drivers tend to turn down > ride requests, and the causes of accidents.

</comment><comment><USER20> This ruling is a (proposed) penalty for _failing to hand over private customer data including GPS logs of trips_. HN would normally _love_ to see a company stand up to such an order.

</comment><comment><USER21> Although I dislike the term "disruptive", this is a great case of just that. Uber aggressively disrupted the taxi industry without regard to rules or regulations and is now seeing the side of the law that appreciates those.

I personally think uber is a great service. The company's aggressive growth strategies can be questioned but given the offended industry is one that hasn't changed in ages, is controlled by a small few, and has lots of issues on its own, I think über is fine.

Another byproduct of their aggressive growth is the amount of money they've raised, which they have been and will continue to put to use on lawyer fees ;)

</comment><comment><USER22> The CPUC has kowtowed to incumbent providers for decades. The wrinkle in this case is that the "incumbents" are taxi companies rather than VZN and ATT.</comment>


Programming Interview Questions - <AUTHOR> http://singhkunal.com/website/techstuff/Interview.htm

<comment><USER2> Or you could just flat-out ask them if they memorised all of their introductory CS textbooks.

<comment><USER3> These are all pretty simple and fair questions. Nothing you should need a textbook for, unless you're faking something on your resume...

<comment><USER2> I'm not suggesting that these questions would require a textbook, but rather that they aren't particularly insightful interview questions as they test something that can come by rote out of a textbook.

</comment></comment></comment><comment><USER4> Did anyone else expect the "cpp" questions to be things like "describe the use and purpose of #include, #define, #line, .." ?

</comment><comment><USER5> """ what is difference between SD and MMC card? What is the difference between NAND Flash and NOR Flash? """

These questions blow, I could answer the above two supposed "Hardware Design and Interfacing" questions and I can tell you right now I don't know jack when it comes to actually designing hardware.

</comment><comment><USER6> These seem like pretty obvious questions. I'm pretty sure that if I just wanted to find out if a prospective employee had a basic understanding of the platform or technology I wanted to higher him for, I could think of a question or two myself.

Lisp: What is an s-expression?

Python: Why are tabs verboten?

I'm not sure what you'll prove with them; if he misses one, he is probably incompetent, but if he gets them all, you still don't know if he is any good.

</comment><comment><USER7> This should not have been posted. You can find better interview questions for each technology by searching the Web. For example, <http://google.com/search?q=java+interview+questions>.

</comment><comment><USER8> No answers? :-/

</comment><comment><USER9> or how not to hire someone.</comment>


From Ivory to Metal (Concatenative Programming) (2017) - <AUTHOR> https://www.youtube.com/watch?v=_IgqJr8jG8M <comment><USER2> I see LOGO also as a kind of (lispy, interactive, left to right!) concatenative langugage. Here is an example, an ASCII christmass tree we made with the kid recently:

        ?  tanne.print tanne.output tanne.shift tanne.split 19 3 3
                 x
                xxx
               xxxx*
              oOOOx
               OxO
              ~oxoOox
             ~~o*o**O
            *o~*~x*OO
           x~Ox*x~~xOx*
            *~ox*x*O*O
           xO~ox~~*~
          oxoxxox~~xx**
         *O*o~OOo~*o**
        ~xOxOx~x*o*x*O

just putting something in between:

        ? tanne.print butlast tanne.output tanne.shift tanne.split 19 3 3

             x*
            xxO*
           x*o*Oo
            oo*x
           o~ox~*x
          xOoOOOx*
         **o*xoo
        o***OO**x~</comment>


Cultivating a Tech Team Culture That Lasts – a Founder's POV - <AUTHOR> https://medium.com/app-partners-how-to-start-your-app-startup/cultivating-a-tech-team-culture-that-lasts-a-founders-pov-f4d1914123c4 <comment><AUTHOR> Any other tactics or mindsets have you guys used to create a great culture?</comment>


JIT-Less V8 - <AUTHOR> https://v8.dev/blog/jitless <comment><USER3> For very security sensitive embedded applications, this could be a huge boon, since it reduces attack area surface, both from the point of view of executable pages, to the simplicity of the interpreter vs full JIT. Granted, there are many JS interpreters already available, like Ducktape, that fulfill the same benefits, but the immediate upside of this is compatibility with the full Node/ES6+ ecosystem and Chrome Dev Tools.

I have to say, Ducktape looks like it might have superior resource usage for very low memory situations.

<comment><USER4> Definitely agree duktape is a decent attempt at low memory situation, but one additional point is that duktape is very slow compared to modern JavaScript engines.

Hence I wonder if we can split ignition off v8 to create a standalone fast JavaScript interpreter at the cost of (possibly) more memory consumptions than duktape, that could prove to be useful in many scenarios.

<comment><USER5> Ignition is _very_ tightly coupled to the rest of V8, starting with that fact that it uses inline caches and the object model to maintain performance, and finishing with it itself being written in "CSA", which is an assembler DSL that is passed through the TurboFan (optimizing compiler) backend to generate the machine code for the bytecode handlers (this has the interesting side- effect that porting V8 to a new platform requires porting the optimizing compiler). There's not really much that can be split off.

<comment><USER4> Thanks for the explanation! One follow-up question is: how can we still call ignition an interpreter with this flow where TurboFan is still used to generate machine code? Doesn't that defunct the idea of an interpreter in v8, which is to be used in platforms w/o write access to executable memory, such as iOS or PS4?

<comment><USER6> While bytecode handlers (and other builtins) _are_ generated by TurboFan, this happens at V8-compile-time, not at runtime. Their generated code is shipped embedded into the binary as embedded builtins.

<comment><USER7> This suggests that a specialized app (such as a set-top box, smart TV, or game console) could push more code through the pre-JIT process to further close the performance gap. (This is interesting to me, because I haven't seen much interest in pre-JIT compilation since the early days of Java, HotSpot, etc.)

</comment></comment></comment></comment></comment></comment><comment><USER8> The information I was looking for, what kind of interpreter they mean, was in an Ignition article linked from the main article: [https://v8.dev/blog/ignition-interpreter](https://v8.dev/blog/ignition- interpreter)

"With Ignition, V8 compiles JavaScript functions to a concise bytecode, which is between 50% to 25% the size of the equivalent baseline machine code. This bytecode is then executed by a high-performance interpreter which yields execution speeds on real-world websites close to those of code generated by V8's existing baseline compiler."

<comment><USER5> Note that the "existing" baseline compiler is now removed, and entirely replaced by the interpreter.

</comment></comment><comment><USER9> Apple requires browsers on iOS to use the same rendering engine as Safari, but would it allow a browser to use a different JavaScript engine? Or is this a loophole that Apple didn't forsee that they will be closing in the future? Are the rendering engine and JavaScript engine so separated that you could use the Safari rendering engine, but a different JS engine?

<comment><USER10> There's a software-level rule that forbids JIT engines by never allowing apps to mark pages as executable. According to this rule, you could run Chrome on iOS now. But there's also a policy level rule:

> 4.7 HTML5 Games, Bots, etc.

> Apps may contain or run code that is not embedded in the binary (e.g. > HTML5-based games, bots, etc.), as long as [...] the software [...] only > uses capabilities available in a standard WebKit view (e.g. it must open and > run natively in Safari without modifications or additional software); your > app must use WebKit and JavaScript Core to run third party software and > should not attempt to extend or expose native platform APIs to third party > software

[https://developer.apple.com/app- store/review/guidelines/](https://developer.apple.com/app- store/review/guidelines/)

<comment><USER11> You could use the XCode linker to embed your JS/WASM code in the binary as a read-only resource/section, and then run it using JIT-less V8. Interpreted code is generally more compact than a native ISA like ARM64, so this could be useful in order to reduce app size.

<comment><USER12> > You could use the XCode linker to embed your JS/WASM code in the binary as a > read-only resource/section, and then run it using JIT-less V8.

Or just read it from a file?

<comment><USER11> It needs to be embedded in the binary, because code that is _not_ so embedded has different rules applied to it. So, it has to be done either in the compiler (e.g. as compile-time const arrays, which will then be part of the rodata section) or in the linker; the latter is arguably a bit easier.

<comment><USER13> "The binary" in this context means the ipa (archive) that you send to Apple.

They are making a distinction between downloaded data and data included in the archive, but using sloppy terminology.

</comment></comment></comment></comment></comment></comment><comment><USER14> What about Proper Tail Calls?

Duktape and XS support them. JSC has had them for years now too. That's a big feature to accidentally miss. You switch and then inadvertently blow your stack every now and then because v8 decided to remove their already implemented tail calls for no good reason (Lest we go down the road again, the "alternative syntax" proposal was dropped, so there's zero excuses aside from a deliberate violation of the spec).

</comment><comment><USER15> For a team that has been pushing the cutting edge of Javascript VM performance for many years, it must feel pretty weird to ship a feature that allows one to willingly regress performance so much!

<comment><USER6> A fast V8 with jitting isn't going away. Jitless V8 is meant for embedders that either cannot or do not want to allocate executable memory at runtime.

(Also, in many common real-world workloads the performance regression is minimal.)

<comment><USER15> I was worried my original comment might be misunderstood, that's why I qualified it as "... allows one to >> _willingly_ << regress performance...". Looks like it still got misunderstood anyway ;)

</comment></comment></comment><comment><USER16> I'm curious if the runtime flag to enable JITless mode could also be enabled at compile time, removing the JIT compiler from the binary entirely. That could be really useful for projects where memory comes at a premium (and performance is not a major concern), like micropython but for JavaScript.

I assume this also doesn't support WASM when the JIT is disabled (or rather, when you can't write to executable memory), but if it did it could be a neat way to write decently performant software for tiny systems with just some JavaScript "glue".

<comment><USER6> > I'm curious if the runtime flag to enable JITless mode could also be enabled > at compile time, removing the JIT compiler from the binary entirely. That > could be really useful for projects where memory comes at a premium (and > performance is not a major concern), like micropython but for JavaScript.

Theoretically yes, but this is not implemented. It should not be too hard to drastically reduce binary size with a build-time flag.

> I assume this also doesn't support WASM when the JIT is disabled (or rather, > when you can't write to executable memory), but if it did it could be a neat > way to write decently performant software for tiny systems with just some > JavaScript "glue".

Correct, wasm is currently unsupported. Interpreted wasm is possible in the future, but would likely be very slow.

<comment><USER17> > It should not be too hard to drastically reduce binary size with a build- > time flag.

And then how portable would the code be? Would this be a path to running node on CPUs without JIT support? Or does it still have to mess with the calling convention at an assembly level?

<comment><USER18> According to another comment in this thread [1] the interpreter is actually generated by the JIT at compile time so no, this wouldn't let you run V8 on a CPU that isn't currently supported.

[1] [https://news.ycombinator.com/item?id=19379305](https://news.ycombinator.com/item?id=19379305)

</comment></comment></comment></comment><comment><USER19> JIT-less should really be the default on the web. The security implications of RWX memory are just so bad, and the amount of time that an exotic JIT meaningfully improves behavior of real world web browsing (as opposed to JavaScript benchmarks) is limited. For the rare web app where a JIT is critical, a simple "Do you really trust this web page to perform a lot of computation?" dialog would mitigate a lot of zero-click/one-click attacks.

<comment><USER20> V8 already employs W^X, i.e. memory pages allocated for V8's heap are either writable or executable, but not both at the same time.

<comment><USER21> By allowing JIT at all, a small ROP chain can call VirtualProtect to make a larger payload executable.

Sure you can do everything with ROP, but it is less convenient (and Intel CET might eventually make ROP attacks actually hard).

</comment></comment></comment><comment><USER22> As mentioned in the article, this is interesting for game developers that aren't allowed to run unsigned code (eg: JIT).

JavaScript is very popular the programming zietgiest and likely to be a language non-programmers are exposed to via the web. Part of me wonders if game engines would take to integrating it instead of Lua if designers might be more familiar with it.

</comment><comment><USER23> THIS is another reason to complain to EU regulators [1], regarding Apple's unfair trade practices. Never before in the history of computing, has a company so blatantly suppressed the competition and gotten away with murder. V8 should not be the one needing re-architecture to meet anti-competitive iOS App Store rules, the rules need to make common sense, and treat the competition fairly.

[1]: [https://techcrunch.com/2019/03/13/spotify-files-a- complaint-...](https://techcrunch.com/2019/03/13/spotify-files-a-complaint- against-apple-with-the-european-commission-over-apple-tax-and-restrictive- rules)

<comment><USER24> Wrong thread – this should have been posted on [https://news.ycombinator.com/item?id=19377322](https://news.ycombinator.com/item?id=19377322).

</comment></comment><comment><USER25> How bad of an idea would it be to create a ROP-based JIT engine for these platforms? You could hand-craft the gadgets and use the stack to reduce interpreter dispatch overhead.

<comment><USER26> That's called "Subroutine threading"! :-) [https://en.wikipedia.org/wiki/Threaded_code#Subroutine_threa...](https://en.wikipedia.org/wiki/Threaded_code#Subroutine_threading)

V8's Ignition interpreter is implemented with "Direct threading", which is quite similar but (probably?) faster on modern processors-- it does an indirect jump to the next bytecode handler instead of a return: [https://news.ycombinator.com/item?id=10034167](https://news.ycombinator.com/item?id=10034167)

"The bytecode handlers are not intended to be called directly, instead each bytecode handler dispatches to the next bytecode. Bytecode dispatch is implemented as a tail call operation in TurboFan. The interpreter loads the next bytecode, indexes into the dispatch table to get the code object of the target bytecode handler, and then tail calls the code object to dispatch to the next bytecode handler."

</comment></comment><comment><USER27> "V8 is Google's open source high-performance JavaScript and WebAssembly engine, written in C++." from its home page. I didn't immediately know

<comment><USER28> And?

<comment><USER29> A common (and, in my opinion, legitimate) complaint about blog posts that appear here often is that the company publishing the post doesn't say what it is they are or are doing, and as a result, why anyone should care about the about the blog post.

</comment></comment></comment><comment><USER30> Wow, this is pretty neat.

We might be able to finally run more safe cryptography in the browser with constant-time guarantees (there are other concerns with browser-based crypto though).

</comment><comment><USER31> This means react native can use V8 on iOS? Does this have any consequences on performance or similar?

<comment><USER32> I think JavascriptCore is more performant than V8. So, it is not necessary.

<comment><USER6> That is not yet clear. Early adopters have reported (jitless) V8 to be at least as fast as (jitless) JSC on Octane2 on a native iOS device.

</comment></comment></comment><comment><USER33> I'd like to try this on the desktop. The difference in memory usage is probably an order of magnitude. That could make my 2GB laptop usable again. I doubt I'll see the difference on any site I care about (no facebook for example). I remember when Java could make the browser totally unusable for several minutes. An interpreter would have avoided that.

<comment><USER34> From the article:

> Memory consumption only changed slightly, with a median of 1.7% decrease of > V8's heap size for loading a representative set of websites.

What makes you believe is should be anything significant? After all the JIT- compiled code cannot be that large.

<comment><USER35> JIT code for JS is /huge/ at the lower optimization levels, dramatically larger than an interpreter's byte code by something in the order of 10x - <USER2> megs of code are generated by relatively small amounts of JS code.

</comment></comment></comment><comment><USER36> Does this avoid some of the issues with Spectre et al?

<comment><USER35> nope - unrelated security concerns.

</comment></comment><comment> mark-r Just another indication of Google trying to take over the world. There's a class of machines where Chrome can't run? We need to fix that, stat!

<comment> mark-r The tone may be flippant, but I was serious. Google's M.O. is to expand their reach into as many corners of our lives as possible. Having devices that can't run Javascript on Chrome is an impediment to that goal, and so I'm sure the marching orders were to find a way to make it work. It is already acknowledged that some upcoming work will be done to improve areas that are still too slow.

</comment></comment><comment><USER37> I'm skeptical of the claim of improved security. Theoretically, if there were some horrible bugs in the JIT, one could craft malicious input data causing the JIT to insert arbitrary code in the code heap. In practice, it doesn't seem possible. At least HotSpot has been JIT:ing code for decades and no one has been able to find such an exploit.

<comment><USER12> > Theoretically, if there were some horrible bugs in the JIT, one could craft > malicious input data causing the JIT to insert arbitrary code in the code > heap. In practice, it doesn't seem possible.

This is very possible: just do a search for ${your favorite JIT} arbitrary code execution, and you'll almost certainly see a real-world vulnerability.

> At least HotSpot has been JIT:ing code for decades and no one has been able > to find such an exploit.

Yeah, no. See for example [https://www.syscan360.org/slides/2013_EN_ExploitYourJavaNati...](https://www.syscan360.org/slides/2013_EN_ExploitYourJavaNativeVulnerabilitiesOnWin7JRE7InOneMinute_YukiChen.pdf)

<comment><USER37> But the feature the exploit takes advantage of isn't _just in time_ compilation, it is compilation! An _ahead of time_ java compiler would have suffered from the exact same problem. In fact, any language compiling to machine code would be just as vulnerable.

<comment><USER38> Yes, but when pre-compiling, you implicitly trust the code. JITs like V8 are used to execute arbitrary code on your device, where such an exploit is much more harmful.

<comment><USER37> Untrue. Dart code for example is AOT compiled but untrusted. Various Javascript implementations are also AOT but also supposed to be used for untrusted code.

<comment><USER38> I have no idea what you're talking about. Under what circumstances is Dart AOT compiled and run untrusted? No browsers support Dart as a first-class citizen. If you're talking about compiling Dart into JS, that's obviously not what anyone is talking about.

There are no Ecmascript AOT compilers. By definition, Ecmascript must be run with an interpreter. AFAIK with the dynamic complexity of the language it's impossible to AOT compile even without things like `eval` and `new Function`.

A better example would be NaCl which as I understand it runs native machine code in a sandbox.

<comment><USER37> What I'm talking about? "Yes, but when pre-compiling, you implicitly trust the code." Citation needed. It's not true at all.

<comment><USER39> Can you give one example of a case where code is compiled AOT and not trusted during compile time? (Your example of Dart was challenged, and I agree that it is not an example, so a more detailed explanation of why it is an example would count.)

<comment><USER37> Why on earth wouldn't Dart count? It is AOT-compiled and meant to be run _untrusted_ inside a Dart VM inside a web browser. That was the intention of the project even if it was cancelled and the VM deprecated. For more examples, see ActionScript on iOS, TFA itself or any of the myriad of projects trying ti AOT-compile JavaScript. For example [https://link.springer.com/article/10.1134/S036176881701008X](https://link.springer.com/article/10.1134/S036176881701008X)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER40> I keep wondering what the deal is with JS on the backend? Why does everyone love it so much? Let's not forget the 10-day design, dynamic typing (and weakly typed, compared with python), slowness, null vs. undefined, etc. JS is a scripting language; they're supposed to be for controlling the behavior of applications (i.e. browsers), not writing applications in and of themselves. Not to mention the dependency hell, NPM insecurity, etc. I see the purpose for limited use in websites, but definitely not the PWA or backend stuff.

Can someone who uses it happily on the backend talk about why they like it and why it's good?

<comment><USER41> It sounds like you read a lot of articles about why JS is bad, but don't have a lot of experience with it.

* 10-day design? Nobody is using Javascript 1.0 anymore.

* Typing is available to various extents thanks to Flow and/or Typescript.

* Slowness... I don't know what you're referring to. Javascript isn't slow.

* null vs undefined. What about them? They are two different things with different meanings.

* Dependency hell. I assume you refer to the many small modules on NPM with dependencies on other modules. Not sure what the problem here is per se. Avoid them if you don't like dependencies.

* NPM insecurity - what?

I like JS on the backend because it's a nice, flexible language to work with, with a healthy and cheap (cost-wise) ecosystem. I get a lot of stuff done very quickly, and I can run my stuff pretty much everywhere.

<comment><USER42> > _NPM insecurity_

NPM packages can contain malicious code. There's no NPM review process, and you can't point to specific versions to lock in your own reviews (package administrators can change whatever files they'd like). There's no such thing as a verified-safe dependencies list because the file you reviewed last month might not be downloaded today.

<comment><USER41> You definitely can point to specific versions.

That being said, most package managers can contain malicious code and very few of them actually review their packages.

Besides, any company using NPM seriously probably has their own proxy in front of it, so there's no case of "the file might not be downloadable anymore" if that was already a problem with NPM itself.</comment></comment></comment></comment>


See with Ears: Auditory Display for Synthetic Vision (2018) - <AUTHOR> https://www.seeingwithsound.com/manual/The_vOICe_Training_Manual.htm <comment><USER2> Back in about 2000 I remember exchanging emails with a guy who had built a modified renderer for (I think) the Half-Life 1 engine. He was using audio rendering to enable blind players to play first person shooters. My recollection is he was using a series of horizontal scan lines across the display region with different octaves or similar indicating which scan line was being "rendered" and different tones indicating the brightness value along the sweep of each scan line. I think he was primarily using mono audio at the time, but it's been long enough that I can't entirely recall.

<comment><USER3> Sounds extremely interesting.

</comment></comment><comment><USER4> For serious users, The Android version of The vOICe also runs on smart glasses from Vuzix (Vuzix Blade, M300) [https://www.vuzix.com/appstore/app/the-voice- for-android](https://www.vuzix.com/appstore/app/the-voice-for-android), EPSON (Moverio BT-300) [https://moverio.epson.com/jsp/pc/pc_application_detail.jsp?p...](https://moverio.epson.com/jsp/pc/pc_application_detail.jsp?pack=vOICe.vOICe) as well as on sub-$200 VISION-800 smart glasses [https://www.seeingwithsound.com/android- glasses.htm](https://www.seeingwithsound.com/android-glasses.htm)

Also try the experimental visual object recognition under Options | Say object names.

</comment><comment><USER5> You can actually try this out in your browser with your webcam here: [https://www.seeingwithsound.com/webvoice/webvoice.htm](https://www.seeingwithsound.com/webvoice/webvoice.htm)

</comment><comment><USER6> Cool, that's an interesting scheme for translating vision to audio.

I have experimented a little with using 3D binaural audio for navigating environments and translating objects' location in 3D space into audio. Here's my blog post about my experiment [https://blog.syllablehq.com/project- sonorous-a-proposed-navi...](https://blog.syllablehq.com/project-sonorous-a- proposed-navigation-tool-for-the-visually-impaired/)

The blog post links to an app you can demo where you can practice navigating a maze with your eyes closed using only binaural audio to guide you. Anyone can do it with very little practice!

I would love to spend more time on this in the future and I'd love to consider adopting this vOICe scheme.

</comment><comment><USER7> Can you do phase offsets between the ears to get depth perception?

</comment><comment><USER8> This feels really groundbreaking to me. It's like echolocation. Although it also seems to be projecting 3d onto 2d, while true echolocation gives you a 3d picture(?)

<comment><USER9> There's stories of blind people using echolocation to get around, so why not do a synthetic version of that instead of this made up encoding scheme (as cool as it is).

I.e. model how sound would propagate in an environment and create the sound an echolocator would actually hear reflected back.

<comment><USER8> What I was getting at is that would be much more complex, because this uses a camera (2d), while echolocation/our ears is 3d when all is said and done. So to do what you're suggesting, you'd first need some way create a 3d model of the world from the camera's 2d image, and then encode into sound.

At which point, echolocation is probably better.

</comment></comment></comment><comment><USER10> Has some overlap with the wave scanner from Elite Dangerous.

[http://wavescanner.net/](http://wavescanner.net/)

</comment><comment><USER11> It would be lovely to have a smart phone app that does this in real time. Does it already exist?

<comment><USER12> It's mentioned early in the article, but easy to miss if you jump straight to the technical details: [https://play.google.com/store/apps/details?id=vOICe.vOICe](https://play.google.com/store/apps/details?id=vOICe.vOICe)</comment></comment>


CrunchBang - a nimble Openbox Linux Distro - <AUTHOR> http://crunchbang.org/ <comment><USER2> I love Chrunchbang. It lacks all the bloated crap that comes with Ubuntu by default, but it comes with everything I need in an OS. It is my go to OS for a quick and easy setup that almost anyone can use.

In short: Chrunchbang, fuck yea.</comment>


Show HN: Who's winning the game of Congress (Groups most satisfied with bills) - <AUTHOR> http://blog.westleyargentum.com/groups-most-satisfied-with-congress/

<comment><USER2> Great visualization. My guess is certain groups are more likely to be public about their opposition while other groups work in more clandestine ways. I noticed that more moralist groups (environment, human rights, conservative) tend to have higher opposition rates than economic groups. For example oil companies probably don't want to be public about their opposition to environmental protection.</comment>