X86 assembly doesn't have to be scary - <AUTHOR> https://blog.benjojo.co.uk/post/interactive-x86-bootloader-tutorial <comment><USER4> When I was about 14 I was enthralled with programming my new Commodore 64, first in BASIC, then 6510 assembly. I had the opportunity to accompany my mother to a one-day class on programming. Being just an intro on the subject, I was well ahead of what they would be discussing, but thought it would interesting to talk to some adults that were also into programming.

I was talking to a couple of guys about what I had been doing on my C=64, and when I mentioned the assembly stuff I was writing, one of them said, "How can you possibly write anything with only three registers?!" (just the accumulator and x/y registers). I was wondering what the big deal was since that was the only architecture I had known at that point. Every game and utility I had were only using three registers, so it was already proven to me that three were "enough".

It's funny how you can just adapt and work with whatever is available, and that becomes your norm. Especially when you don't even realize there are other options out there.

Those were the days!

<comment><USER5> >"How can you possibly write anything with only three registers?!"

AFAIK you can even go down to 1 register, which is how stack machines work. You might even say it's 0 registers because it's not something you can directly access.

<comment><USER6> There are many simple microcontroller architectures with only one register, usually called A (accumulator) or W (work register). You just need to constantly load memory to and from the register, nothing weird in that. Sometimes they will call their memory locations registers, in which case they have lots of registers - the terminology gets quite unclear when everything is on the same chip anyways.

A true stack machine does not have any registers, so that would be 0.

<comment><USER7> RPN calculators are simple stack machines.

</comment></comment></comment></comment><comment><USER8> If your intention is to avoid scaring newbies off, I'm not sure if 16bit real mode, PC boot process, BIOS services and all that arcana that follows is the best place to begin.

<comment><USER9> I agree with you to an extent: The IBM PC was not a very elegant design, and other computers certainly had less complexity to them. But there is a point I want to make which defends this choice somewhat:

Newbies like me are more frustrated by thinking there's no path from introductory material to something useful or realistic. Something that's more immediately friendly would be a simplified virtual machine with no or trivial peripheral hardware, like Redcode in Core War:

[http://vyznev.net/corewar/guide.html](http://vyznev.net/corewar/guide.html)

The death of education is "So What?": "OK, I've learned to play Core War and I know enough to write a warrior that can occasionally beat other warriors written by beginners. So far, so good... so what? I want to program computers in assembly, not play games using assembly programs, so where's the path from where I am now to where I want to be?"

In this case, the pathway from VM opcodes to native opcodes is hardware interface and, while the IBM PC has some funky hardware, it's heartening to know that your code could, in principle and barring emulation errors, run unmodified on real hardware and do something. Not something useful, but you can get to useful. You can ramp up to it, now that you have the pathway in front of you. It might be a long pathway, but it's there.

<comment><USER8> Well, I had in mind something _more_ useful and realistic, not less; namely teaching assembly in normal Linux environment. Sure, there are all sorts of complexities there too, but in general I feel like they are also more worthwhile.

<comment><USER9> > Well, I had in mind something more useful and realistic, not less; namely > teaching assembly in normal Linux environment.

This might sound odd, but as someone who's done some assembly programming under Linux, it usually isn't different enough from C to be worth the effort. Even if you eschew libc, the kernel APIs are still fairly high-level and, more to the point, there are no new concepts relative to C: You have pointers and pointer arithmetic, you have fixed-size buffers, you have ints and doubles, and the rest is just syntax.

The exception is doing something like a really tight high-performance kernel using SIMD opcodes, which necessarily involves learning a lot about the specific SIMD hardware and data organization to optimize cache use and other details C can't express.

</comment></comment></comment></comment><comment><USER10> I wonder if the history of x86 is holding us back in a big way. It started out being close to the metal but now it's an abstraction that can mislead you if you think processors are literally working the way x86 assembly describes.

And surely the whole spectre issue could be lessened if we could be less reliant on CPUs having to guess what to keep in cache, which code paths are most likely, etc?

<comment><USER7> > I wonder if the history of x86 is holding us back in a big way. It started > out being close to the metal but now it's an abstraction that can mislead > you if you think processors are literally working the way x86 assembly > describes.

But when you compare high-end cores, you always see the same picture, regardless of ISA. Large surface area (~1/3 of the core) used for insn fetch/decode/schedule; they look all the same, whether it's POWERn or the latest Sandy-Bridge/Haswell rehash... people claim that other ISAs would be a lot easier/faster/more efficient to decode, but that doesn't seem to be true in practice. It seems to me that any difference that might be there gets dwarfed by the sheer complexity of OoOE and speculative execution.

What we _do_ know is outside some niches (like DSPs, where VLIW reigns king) static techniques essentially _do not work_ for application code, because it's _impossible_ to predict statically.

<comment><USER11> Even 15 decoders are a pinprick on the core's area—at least when I saw die area for LRB. Fetch & schedule we're a bit larger. Most of the core area was register files & floating-vector logic.

<comment><USER12> In fairness, Larrabee was originally an in-order design.

<comment><USER13> It was also a simpler core, which means that for a complex OoO monster, the decoder would be an even smaller area. The OoO instruction scheduler would be a significant chunk, but that has nothing to do with being x86.

</comment></comment></comment></comment></comment><comment><USER14> I think to many programmers assembly is the "GOTO" of programming languanges: From the day you start learning to program, you are told that all this fancy high-level-language stuff is there so you do not have to deal with assembly. So most people never go there.

I _did_ go there, briefly, about ten years ago. It was wicked fun. But all in all, I may have written maybe 20 or 30 instructions of assembly in total. I did try to rewrite a few small, heavily-used functions from our code base in assembly only to discover that the code I came up with was practically identical to what the compiler emitted. At that point I figured that the people who told me that "you can't beat the compiler" were probably right and called it a day[0]. Alas, I never had the hardcore performance requirements that would make go back there. But it was fun to get a taste of it.

[0] At the same time, I was kind of proud that I did not get beat by the compiler. Then again, those functions were fairly trivial.

<comment><USER15> > At that point I figured that the people who told me that "you can't beat the > compiler" were probably right and called it a day

On that subject...my understanding [0] is:

These days, the best bet for beating the compiler is to use vendor intrinsics (for SIMD, encryption, bit-twiddling, etc). Shaving an instruction off the inner loop might give you a few percent; using SIMD lets you operate on 256 or 512 bits per instruction instead of 8, 16, 32, or 64. You might be able to show your inner loop is memory-bound (and thus prove further improvements have to come from algorithmic improvements / better cache locality, rather than continuing to fiddle with instructions).

The compiler automatically uses SIMD sometimes, but it can't do so reliably:

* The transformations require things the compiler isn't allowed to do, like increasing alignment of key variables or altering the larger algorithm.

* code that might run on older processor revisions needs multiple implementations selected at runtime. I think gcc has some magic extension ("target_clones"?) to do this relatively easily; otherwise you might need to write your own logic to decide which function pointer to use.

Note that each "vendor intrinsic" matches one assembly instruction, and it's valuable to understand assembly while writing them, but the actual code you check in can end in .cc (C++) or .rs (Rust) or whatever. Doing so means it can be inlined into functions written in the higher-level language, you don't have to encode knowledge about the platform's calling convention into your code, etc.

[0] Not from personal experience. Corrections welcome.

<comment><USER16> Your understanding is very good for someone without personal experience.

Automatic compiler use of SIMD is rarely that great unless you're in a nice big loop doing nice regular things. I've pretty much never seen it on the stuff I do.

Using intrinsics gets you 95% of the way there. I reach for asm only when I absolutely have to. It is a huge PITA. My irritation at the "bro, just write a .s file" people peaks when I'm trying to write a 200LOC function with 10 different variants based on (say) pipeline depth and unroll width. Yeah, because I'd like to spend the next year doing register allocation by hand.

The compiler is really good at doing routine stuff, and when I hand-edit the asm to do things that better fit my idea of regalloc and scheduling I usually make things worse. Where the compiler falls down is instruction selection and stuff that borders on algorithm design.

For example, I built a shift-or string matcher in SIMD where a first-stage was OK to have false positives (positives in shift-or are represented by zeros in the bit vector). I was able to get a big performance boost by tolerating these false positives when shifting SIMD bits and bringing in some zeros, but no compiler is going to know that a few false positives are OK in that circumstance.

IMO the best way to work is with intrinsics, a tiny bit of embedded asm for things that you can't get intrinsics for (I had to resort to gcc asm blocks to make a cmov happen) and close inspection of your object file (at least on the hotspots) to ensure that the code you're getting is what you think you're getting. It's possible to make minor screwups and suddenly see dozens of extra instructions pushing everything in and out of memory for no good reason.

The other place you can beat the compiler is by doing deeper/wider pipelining of branch free code. This is a dark art. Often going branch free is 10-20% worse than branchy when you have _1_ iteration happening at a time but it will scale better when you are going lots of stuff at once - if you have (say) 12 different copies of your loop body happening in one iteration, and there's a mildly unpredictable branch per loop body, the branch miss on one iteration stops all the others from progressing too!

I occasionally blog on these things at branchfree.org and have some more low- level stuff brewing shortly.

</comment></comment></comment><comment><USER17> Loved the article.

Then one can follow up with some MS-DOS classics.

[https://www.amazon.com/Peter-Nortons-Assembly-Language- Book/...](https://www.amazon.com/Peter-Nortons-Assembly-Language- Book/dp/0136619010)

[https://www.amazon.com/Advanced-S-DOS-Programming- Microsoft-...](https://www.amazon.com/Advanced-S-DOS-Programming-Microsoft- Programmers/dp/0914845772/ref=pd_lpo_sbs_14_t_2)

[https://www.amazon.com/Peter-Norton-Programmers-Bible- progra...](https://www.amazon.com/Peter-Norton-Programmers-Bible- programming/dp/1556155557/ref=pd_lpo_sbs_14_t_0)

[https://www.amazon.de/PC-Intern-Programming-Encyclopedia- Dev...](https://www.amazon.de/PC-Intern-Programming-Encyclopedia- Developers/dp/1557551456/ref=sr_1_2)

<comment><USER18> I see your Norton and raise you an Abrash:

[https://www.amazon.com/Zen-Assembly-Language-Knowledge- Progr...](https://www.amazon.com/Zen-Assembly-Language-Knowledge- Programming/dp/0673386023/)

[https://www.amazon.com/Zen-Graphics-Programming-2nd- Applicat...](https://www.amazon.com/Zen-Graphics-Programming-2nd- Applications/dp/1883577896/)

[https://www.amazon.com/Zen-Code-Optimization-Ultimate- Softwa...](https://www.amazon.com/Zen-Code-Optimization-Ultimate- Software/dp/1883577039/)

Zen of Asm is also online, I think a few of the other works, too.

[http://www.jagregory.com/abrash-zen-of-asm/](http://www.jagregory.com/abrash- zen-of-asm/)

<comment><USER19> Ahhh, Zen of Graphic Programming was my one of first graphics books, which led straight to Foley, vanDam, et. al., and I was hooked :)

It's safe to say Abrash's book had a big impact on me.

Norton's books also make me nostalgic, so thank you for that, GP.

</comment></comment></comment><comment><USER20> I started with 6502, then ARM in 1989 (thanks acorn!), then a little bit of x86. The latter was a culture shock. It's was like grooming the devil's genitals in comparison to ARM. It drove me to C and Unix where I've been happy ever since (occasionally a bit of PIC assembly as well).

It's not scary just nasty.

</comment><comment><USER21> The problem I keep running into is that everybody's asm is different looking, and not even internally consistent. Trying to parse all of this stuff:

        [BITS 16]  ;tell the assembler that its a 16 bit code

Okay, so this is an instruction to the assembler saying that we're only working with 16 bit registers and to emit 16 bit code. Straightforwards enough here.

        [ORG 0x7C00];Origin, tell the assembler that where the code will

                ;be in memory after it is been loaded

This means that the first instruction will be at physical address 0x7c00 when the code loads, right? What's the first instruction, the one below?

        mov ah, 0x0A ; Set the call type for the BIOS

        mov al, 66   ; Letter to display

        mov cx, 3    ; Times to print it

        mov bh, 0    ; Page number

Makes enough sense, just mov instructions al refers to the top 8 bits of register ax and al refers to the bottom 8 bits. I see that register bh is zeroed, but what about bl? Why not xor bx, bx or something like that? Don't instructions normally go in a section named .text? How does the BIOS know where to find this code and begin execution in the first place?

...

        TIMES 510 - ($ - $$) db 0    ;fill the rest of sector with 0

Wtf is that? What's a sector? What the syntax here? Are we repeating this 510 times, or 510 minus some value? The db command is for writing bytes, but where are the bytes written to?

        DW 0xAA55          ; add boot signature at the end of bootloader

Where are these bytes written? Why is DW capitalized here when db was left in lowercase before?

<comment><USER22> ORG shifts all addresses below it to given offset. That means that external loading code is supposed to put it there, otherwise all non-relative instructions will load/store at wrong locations.

BL is not set because it is irrelevant. How you clear/save a register was up to you. [https://en.wikipedia.org/wiki/INT_10H](https://en.wikipedia.org/wiki/INT_10H)

.text is a section of executable format, but what you got is a boot loader. It doesn't have sections, it's just a first 512-byte boot disk sector that is loaded at 7C00h by BIOS and directly jmp'd into.

I forgot what exactly $-$$ is, but one of those is "current" address and another should be ORG address, but I'm not sure, so this expression turns into e.g. TIMES 410 DB 0, if 100 bytes used by so far.

AA55 is a boot sector end marker, something like canary value. Never looked into that in detail.

Assemblers were mostly case-insensitive, like Pascal and BASIC. Case is up to you, if you have any preference.

</comment></comment><comment><USER23> Some free quality resources, ready to use:

\- Intel CPU programming guide [https://www.intel.com/content/dam/www/public/us/en/documents...](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures- software-developer-instruction-set-reference-manual-325383.pdf)

\- Calling conventions [https://en.wikipedia.org/wiki/X86_calling_conventions](https://en.wikipedia.org/wiki/X86_calling_conventions) [https://en.wikibooks.org/wiki/X86_Disassembly/Calling_Conven...](https://en.wikibooks.org/wiki/X86_Disassembly/Calling_Conventions)

\- Web compiler output viewer [https://godbolt.org/](https://godbolt.org/)

\- Operation code (opcode) reference [http://ref.x86asm.net/](http://ref.x86asm.net/)

\- Disassembler/debugger [https://github.com/eteran/edb- debugger](https://github.com/eteran/edb-debugger), [https://x64dbg.com](https://x64dbg.com)

\- Disassembler/Reverse engineering tools [http://hte.sourceforge.net/](http://hte.sourceforge.net/) [https://github.com/radareorg/cutter](https://github.com/radareorg/cutter)

And this: [https://github.com/codilime/veles](https://github.com/codilime/veles) (binary analysis tool)

<comment><USER24> Probably also need some syscall references: [https://fresh.flatassembler.net/lscr/](https://fresh.flatassembler.net/lscr/)

<comment><USER23> Neatly organized. The "man" command also has documentation on syscalls.

A good introduction to syscalls, with some explanation is "The Linux Programming Interface", [http://man7.org/tlpi/](http://man7.org/tlpi/) (book)

</comment></comment></comment><comment><USER16> Anyone who really wants to dig into this, and is willing to be a bit scared, should review the materials for the 15-410 operating systems course at Carnegie Mellon University. The fall edition of the page isn't up yet but there are probably some older versions kicking around.

If you are at CMU you should definitely take this course, as long as your pain tolerance is high.

This course teaches students to write a preemptive operating systems kernel from scratch. It is _quite_ an experience (I TA'd it after finishing my PhD while trying to figure out what to do next).

The kernels the students wrote used to be able to boot on standard (but old) PC hardware. Sadly the modern USB stack is so complex that a conformant thing to talk to a USB keyboard is pretty much as complex as the student's whole project (but less educational). So non-legacy hardware that lacks a PS/2 keyboard no longer has this nice easy path to read/write stuff to console without a lot of setup.

</comment><comment><USER25> What would be more interesting is the UEFI boot process. I don't think any new computer comes booting into 16bit real mode anymore. I would love to see a "Write your own UEFI bootable kernel" I'm sure going straight to a semi sane 32bit environment is much easier to deal with than starting at 16 and working your way up.

<comment><USER26> > I don't think any new computer comes booting into 16bit real mode anymore

It most certainly does. See the chapter on 8086 emulation in the Intel Software Developer's Manual, Volume 3.

</comment></comment><comment><USER27> Sometimes its necessary to return to the past to remember the things we've abandoned in the rush to modernity.

I'm speaking, of course, of the wonderful Prince of Persia and its delights. So many treasures to be discovered for anyone interested in even a little bit of assembly-language programming.. it definitely sharpens my chops, anyway:

[http://fabiensanglard.net/prince_of_persia/index.php](http://fabiensanglard.net/prince_of_persia/index.php)

PRINCE OF PERSIA CODE REVIEW.

</comment><comment><USER28> I love the built-in demos!

</comment><comment><USER29> The key to x86 assembler/machine code was avoiding the software interupts as they were painfully slow. Sure, when you are dealing with a 512byte boot sector you are better of offloading as much code as you can to software interupts, but for everything else the battle was to come up with something faster than the software interupts.

In many cases some basic routines used in qbasic was actually faster than their counterparty interupts in asm. A grand example of this would be using mode 13h (320x200) and interupt 10 to set all pixels on a screen to a single color, which could take up to 2 seconds using machine code and bios interupts (as it verifies vertical and horizontal refresh prior to setting the pixel). Using interupts however is relativly painfree as the author pointed out.

</comment><comment><USER30> It's hard to find a tutorial that really tells you what is going on. You have to start with whatever operating system you're on, then figure out what the heck you're reading. What is x86 and what is some reserved word peculiar to the assembler you're using?

Here's macOS Hello, world code I see floating around a lot, and I can't make heads or tails of it:

      global start

      section .text
      start:
          push    dword msg.len
          push    dword msg
          push    dword 1
          mov     eax, 4
          sub     esp, 4
          int     0x80
          add     esp, 16

          push    dword 0
          mov     eax, 1
          sub     esp, 12
          int     0x80

      section .data

      msg:    db      "Hello, world!", 10
      .len:   equ     $ - <USER3>

<comment><USER31> Basically everything left-aligned is for the assembler, and the indented material is the mnemonics for the x86 set.

The assembler breaks down as:

          push    dword msg.len
          push    dword msg
          push    dword 1

Place a pointer to the message, its length, and 1 on the stack. Each of these decrements esp by 4.

          mov     eax, 4

We'll be doing syscall 4 in a sec

          sub     esp, 4

Reserve 4 bytes for the return

          int     0x80

Do the syscall! See [https://opensource.apple.com/source/xnu/xnu-2782.20.48/bsd/k...](https://opensource.apple.com/source/xnu/xnu-2782.20.48/bsd/kern/syscalls.master) ; this is 'write'

          add     esp, 16

Discard the return value and arguments from the stack.

          push    dword 0
          mov     eax, 1
          sub     esp, 12
          int     0x80

Similarly setup and do syscall 1 to exit.

<comment><USER30> But then there's that "msg.len", which I assume is some sort of assembler shortcut for getting the length of an array and not part of the x86.

<comment><USER31> That's referring to the _label_ msg.len, which is a value computed at compile time in the 'data' section at the bottom.

      msg:    db      "Hello, world!", 10
      .len:   equ     $ - <USER3>

'msg' is a label, which will be assigned to an _address_ at compile time. 'db' short for 'declare bytes' puts some bytes at that address. '.len' is then defined as the current output address ($) minus the start of the string.

<comment><USER32> In addition to all these excellent comments, it can also be instructive to go "backwards" from C, here on Linux:

cat hello.c

      #include <unistd.h>

      char str[] = "Hello, World!\n";

      int main() {
        write(1, str, sizeof(str)-1);
        return 0;
      }

cat hello.s

      .file	"hello.c"
      	.intel_syntax noprefix
      	.globl	str
      	.data
      	.align 8
      	.type	str, @object
      	.size	str, 15
      str:
      	.string	"Hello, World!\n"
      	.text
      	.globl	main
      	.type	main, @function
      main:
      .LFB0:
      	.cfi_startproc
      	push	rbp
      	.cfi_def_cfa_offset 16
      	.cfi_offset 6, -16
      	mov	rbp, rsp
      	.cfi_def_cfa_register 6
      	mov	edx, 14
      	lea	rsi, str[rip]
      	mov	edi, 1
      	call	write@PLT
      	mov	eax, 0
      	pop	rbp
      	.cfi_def_cfa 7, 8
      	ret
      	.cfi_endproc
      .LFE0:
      	.size	main, .-main
      	.ident	"GCC: (Ubuntu 7.2.0-8ubuntu3.2) 7.2.0"
      	.section	.note.GNU-stack,"",@progbits

Note the line: lea rsi, str[rip] which I belive is something along the lines of load effective address (lea), into rsi register, of "str" symbol offset with relative instruction pointer (rip - to allow for relative addressing).

You can compile and run with:

gcc -std=c11 hello.c && ./a.out

Prouduce hello.s from hello.c with: gcc -std=c11 hello.c -S -masm=intel

<comment><USER33> "lea" is a fun instruction.

Going piece by piece: on x86, each register has several sizes. For instance, rax is a 64-bit register, with its lower 32-bit half being eax, its lower 16-bit half being ax, and its lower 8-bit half being al (for historical reasons). So when a register name starts with "r", it's the 64-bit variant. Therefore, "rip" is the 64-bit address of the next instruction.

The instruction "mov rsi, str[rip]" would get the 64-bit address of the next instruction, add to it a fixed offset (which the assembler and linker compute for you, as the exact offset you need to get to the data at the "str" label), load 64 bits from that address, and put the result in the "rsi" register. And that's not even the most complex addressing mode; you can get a register, add to it another register multiplied by 2, 4, or 8, add to it a constant, and use it as the memory address to load, store, or even modify in-place.

The "lea" instruction (load effective address) is a way to get directly at the power of that complex address calculation logic for your own uses. Instead of using the computed memory address to get at the memory, it's the memory address that's put in the register. Therefore, where "mov rsi, str[rip]" would read from memory, "lea rsi, str[rip]" would put in rsi the memory address the "mov" would have read from.

This also allows for a few tricks. For instance, you can use "lea" to multiply a number by five, without using the multiplier: just use a register and the same register scaled by 4 (and you can also add a constant to the result, still in a single complex instruction).

</comment></comment></comment></comment></comment></comment><comment><USER34> Back in the late 80's, when I was in University, we had second year course where we had to do x86 assembly on PC XT or AT clones. Assignment #1 was messing with keyboard interrupts...easy peasy. Assignment #2? Write a video game...basically we had to do the "snake game" with a never ending line you could steer as it grew. Anyhow, I have to admit pretty much the whole class figured it out...assembly was not nearly as insane as we thought. By the end of that course, I was almost as comfy writing x86 assembly as Pascal. Fun times.

</comment><comment><USER35> Thanks for the share this looks great!

It aligns quite well with the study (in diagrams and commented assembly) of x86 in POC || GTFO starting in pocorgtfo04.pdf chapter 3 provided by Shikhin Sethi.

</comment><comment><USER36> it seems to me that x86 assembly is the less readable kind of assembly. i always found powerpc set more thought through.

</comment><comment><USER37> Tangential question - does anyone know what model IBM that is?

<comment><USER38> It appears to be the original IBM-PC.

<comment><USER39> Yes, the IBM 5150 PC. In fact, the image is the one used on the Wikipedia page for "Desktop Computer".

<comment><USER37> Ah yes, the 5150. Thank you.

</comment></comment></comment></comment><comment><USER40> I wasn't really familiar with webassebly, but when I've seen this source for fibonacci I immediately recognized familiar features which can't be said of the rest of the assembly implementations:

[https://github.com/nebulet/nebulet/blob/master/wasm/fibonacc...](https://github.com/nebulet/nebulet/blob/master/wasm/fibonacci.wat)

[https://github.com/Hanks10100/wasm- examples/blob/master/simp...](https://github.com/Hanks10100/wasm- examples/blob/master/simple/math.wast)</comment>


Ask HN: How to best donate money to opensource/linux? - <AUTHOR> My company has a match program and I want to donate money to a good opensource cause and/or Linux itself.
It seems like the linux foundation would be a good cause, but my company program does not have a profile for that 503c and I cannot find details on their website on how to donate.
Anyone has any tips and/or can help me? <comment><USER2> [https://supporters.eff.org/donate](https://supporters.eff.org/donate)

<comment><USER3> +1 for the EFF.

</comment></comment><comment><USER4> [https://www.fsf.org/about/ways-to-donate/](https://www.fsf.org/about/ways-to- donate/)

</comment><comment> psy-q Consider seeing if the particular pieces of software you use have their own donation system, then donate there. A donation to a smaller project could have a very large impact on its future.

The Linux Foundation is carried by billion-dollar companies and that's also the interests it serves, from what Icm hearing. I wouldn't worry about its survival.

</comment><comment><USER5> The right name for "linux" is GNU/Linux. Initially Linux was just a kernel, with lots of free software from FSF. You can donate to FSF at [https://www.fsf.org/about/ways-to-donate/](https://www.fsf.org/about/ways-to- donate/)

<comment><USER6> How much do FSF employees do these days? I was under the impression that most of the pronto FSF projects (GCC, gnome) are worked on mostly by outsiders (redhat and others)

<comment><USER7> One of the more important roles of the FSF is to provide the technical and legal infrastructure for the GNU project, and all programs that live under it.

They are not focused on directly employing programmers.

<comment><USER8> They also provide the FSF "Respects Your Freedom" certification to hardware that meets their rigid standards.

This year they added a handful of new products. I feel like they're doing some truly good work for us all.

</comment></comment></comment></comment><comment><USER9> the linux foundation is not a 501(c)(3), it's a 501(c)(6). contributions to it are not deductible, so probably not eligible for your employer's matching program.

</comment><comment><USER10> If you're looking for more suggestions I'd say look into donating to your distribution of choice whether it be Debian, Ubuntu, Fedora, etc.</comment>


Show HN: Straight2Spam – Send your email right to someone's spam folder - <AUTHOR> https://straight2spam.com <comment><USER2> #1 $$$ 100% Act now Action Additional income Affordable All natural/new Amazed Apply now Avoid Be amazed/your own boss Beneficiary Billing Billion Bonus Boss Buy Call!!!!!! free/now Cancel Cash Casino Certified Cheap Click here Clearance Collect Compare rates Congratulations Credit card/check/offers Cures Deal Dear friend/somebody Debt Discount!!!!!! Direct email Don't delete/hesitate Double your income/cash Earn Extra Expire Fantastic Free!!!!! access/money/gift Freedom Friend Get it now/started/paid Great Guarantee Hello Income Increase sales/traffic Instant Investment Junk Limited Lose Lowest price Luxury Make $/money???? Medicine Money Name!!!!!!! No credit check/experience Now Obligation Offer Only Open Order now Please Presently Problem Promise Purchase Quote Rates Refinance Refund Remove Request Risk-free Sales Satisfaction!!!!!! Save Score Serious Spam Success Supplies Take action Terms Traffic Trial Unlimited Urgent!!!!! Weight While supplies last Win Winner XJS _C4JDBQADN1.NSBN3_ 2IDNEN _GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL_ C.34X

<comment><USER3> I know we're not supposed to comment on voting, but... this has got to be the spammiest-looking comment to ever gain this many legitimate upvotes without being removed.

...Well done.

<comment><USER4> It's just the content of the text you put into your email to get it flagged.

<comment><USER5> Yes, we know

<comment><USER6> no doi

</comment></comment></comment></comment></comment><comment><USER7> Or just set up your own SMTP server ;)

<comment><USER8> As some who has suffered through managing a qmail smtp cluster and dealing with DNSBLs, allow me to say just one thing: Very. Underrated. Comment.

<comment><USER9> What even is the best way (reliably and free) these days to set up a website that occasionally sends email? I have a hobby site on a linode for creative writers to follow up to each other's chapters, and it's very low volume, but I don't want to sent it all through my gmail account, either.

<comment><USER10> Mailgun reduced their free tier drastically recently, I think to 625/month. If that fits your needs it's a decent choice.

<comment><USER11> Hmm, I can't find a free plan: [https://www.mailgun.com/pricing](https://www.mailgun.com/pricing)

<comment><USER10> Looks like you're right, they abandoned the free plan altogether on March 1. The new deal is $0.80 per thousand messages with no minimum spend, which may be negligible for you, but there are likely free alternatives out there too.

HN discussion from when they downgraded the free tier, includes some discussion of alternatives: [https://news.ycombinator.com/item?id=22192543](https://news.ycombinator.com/item?id=22192543)

<comment><USER12> They eliminated the free tier, but as of June they won't be billing for <=1250 messages a month.

Link from the email they sent: [https://help.mailgun.com/hc/en- us/articles/360048661093-How-...](https://help.mailgun.com/hc/en- us/articles/360048661093-How-does-PAYG-billing-work-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Why do I feel like this is something Larry David's character in Curb would just love.

<comment><USER14> Susie Greene: You sick fuck, Larry David! What do you think you're doing, sending invites straight to spam folders?

<comment><USER15> I feel like it will be more like Jeff who would call him out on it.Susie will just get mad she did not receive it.

</comment></comment></comment><comment><USER16> Small print inspiration. I miss you Nathan!

[https://www.imdb.com/title/tt3844780/](https://www.imdb.com/title/tt3844780/)

<comment><USER17> Here's a video of the original system from the TV show Nathan for You: [https://www.youtube.com/watch?v=p9KeopXHcf8](https://www.youtube.com/watch?v=p9KeopXHcf8)

</comment></comment><comment><USER18> Would have appreciated a snail mail version of this for my wedding ...

<comment><USER19> Print wedding invitation on collection agency stationery.

</comment></comment><comment><USER20> I run loads of small business email systems and have done for decades, in the UK.

That thing has GTUBE at the end of it, which doesn't look quite as dodgy as EICAR to humans.

lol.

Without the GTUBE string, rspamd scores 10.50, which is flagable by default. With it, rspamd scores 15.0 (ie whatever REJECT is set to) and ignores the rest of the message.

rofl.

</comment><comment><USER21> Cute, but you could also just include the eicar text: [https://en.wikipedia.org/wiki/EICAR_test_file](https://en.wikipedia.org/wiki/EICAR_test_file)

<comment><USER21> Actually I got my test signatures mixed up for a second, what you want is GTUBE: [https://spamassassin.apache.org/gtube/](https://spamassassin.apache.org/gtube/)

<comment><USER22> I just sent an email from my gmail to my Gsuite backed mailbox with the gtube text, didn't work :(

the email landed in my inbox.

<comment><USER23> My selfhosted mailcow ([https://mailcow.email](https://mailcow.email)) instance blocked me from sending it (the SMTP server actually rejected it), and then blocked the one I sent from Gmail to it with 554 5.7.1 Gtube pattern. Didn't even show up in Spam.

</comment></comment></comment></comment><comment><USER24> Just so the uncertainty is out and you know for sure where your message is? "Hi, I sent the email. Check the spam folder, it's there".

Note also: dunno about webmail, but e.g. Thunderbird ignores most formatting when displaying a message marked as spam.

<comment><USER25> Gmail keeps basic CSS, I once received the famous "I recorded your webcam watching naughty stuff!" spam, and the particular attacker "hid" the compromised password (long since changed) in white text between each paragraph, making it essentially invisible.

<comment><USER26> Why would they send you a compromised password and disguise it?

<comment><USER25> I suspect to key the email to a particular user and prevent scambaiting? And possibly gather the tiniest bit more information in case someone replies from another email address. (Now they know that the sent email is _read_ and the received is _actively used_ )

</comment></comment></comment></comment><comment><USER27> Keep in mind that this has the possibility of creating an awkward situation if someone notices what you added to the email.

<comment><USER28> You can always claim your machine had malware that includes this to all emails. Would be nice if the order of the filler words was random so you couldn't search for all of it and end up on this page.

</comment></comment><comment><USER29> I suspect this would actually get through a lot of advanced spam filters. It would be easier to just send an email "from" you through a relay that has no dkim or spf configured, that will always land in spam.

<comment><USER30> Agreed, if spf/dkim of the email checks out, and they replied to your messages before, chances are that it will go through regardless of content.

</comment></comment><comment><USER31> It needs one inch penis, two inch penis -- all the way up to 10 or something.

<comment><USER32> "Unlike every other Penis which only go up to 10, our Penis goes up to 11."

</comment></comment><comment><USER33> Next big idea: Straight2Spam detection.

<comment><USER34> That's the monetization plan.

</comment></comment><comment><USER35> I love the Nathan for You reference in here. One of my all time favorite shows.

</comment><comment><USER36> Now, can somebody make a version that takes my normal email message, change a few characters, and turn it into spam in the eyes of the neural nets, similar to the one pixel attack?

</comment><comment><USER37> Since it has the GTUBE you are intentionally making an email that will get bounced almost everywhere so you may as well not send it.

</comment><comment><USER38> but "I check my spam folder every day" :)

</comment><comment><USER39> Holy emoji batman!

</comment><comment><USER40> doesn't work. lol

</comment><comment><USER41> sorta like Slydial

<comment><USER27> For those unaware of what Slydial is, it is an app that sends calls directly to a person's voicemail.

</comment></comment><comment><USER42> lol

</comment><comment><USER43> Spam folder is one of things that annoys me in email. It really doesn't make sense: if message is spam, then why store it at all? But legitimate messages silently going to spam folder is critical, unacceptable failure. You could regularly browse spam folder, but then.. what's the point? You would be skimming through all the junk anyway, that's defeating whole purpose of filtering.

Personally I don't have spam folder: either message is rejected immediately at SMTP time, or it goes straight to my inbox. (another thing that annoys me is greylisting, it just breaks instant messaging for no good reason)

<comment><USER44> You seem to be very convinced that there is an efficient way to filter 100% of spam without false positives. Which seems optimistic if you have ever dealt with email, text analysis or any aspect of spam detection.

<comment><USER10> Google is incredibly good at this. I see maybe 20 false negatives a year (they usually get corrected if I don't check my mail for a few hours) and 1-2 false positives. This out of thousands of good emails and 100,000+ spam mails.

That said, I think it's good to keep the "spam" folder. I normally only check it if I learn through another channel that I should have got a mail, I don't "browse it every few days" as some others suggest.

<comment><USER45> > google is incredibly good at this.

Interesting. My experience has been exactly the opposite. For me, using Gmail is like using Microsoft word in 2007. Slow interface, 34 different navigation menus, emails from friends appear in either promotions or updates at random, spam filter has a false positive once per week.

The only thing missing is the little animated paperclip guy.

<comment><USER44> Can't say I've ever had personal email end up in Promotions, but would have thought it would learn after you move a message that had landed there into your inbox...</comment></comment></comment></comment></comment>


Using Cloud Functions (Netlify) for URL Signing - <AUTHOR> https://mux.com/blog/using-netlify-functions-to-create-mux-signing-tokens/ <comment><AUTHOR> I thought this was a clever way to use Netlify Functions to sign URLs, set the <video> src to the Netlify function, sign the URL and respond with a 302 (also verify the request with CORS headers)</comment>


Snapdragon processors address mobile security with smartphone kill switch - <AUTHOR> https://www.qualcomm.com/news/snapdragon/2015/01/05/snapdragon-processors-address-mobile-security-smartphone-kill-switch

<comment><USER2> I feel that if the absence of a kill switch is a deciding factor for you when choosing a smartphone then you shouldn't be using a smartphone in the first place.

Also, interestingly enough Blackberry isn't a part of the Group which aligns pretty well with their image.

[http://www.cio.com/article/2370034/smartphones/blackberry- no...](http://www.cio.com/article/2370034/smartphones/blackberry-not-a-part- of-smartphone--kill-switch--group--updated-.html)

</comment><comment><USER3> What really scares is me is "combined with third party service provider support" part. That means it is not just you who has the capability to flip the switch.

Imagine someone breaking into service provider's database, acquiring all the keys. That couldn't surely happen, could it?

<comment><USER4> Depends if Sony is hosting them or not (this is only partially a joke)

</comment></comment><comment><USER5> My question is will this work even without a SIM card. My father recent had his iPhone stolen and within 10 minutes I had gone into iCloud and turned on remote wipe. Unfortunately the thief was smart enough to remove the sim and make sure it never saw Internet while breaking into the phone enough to the point that he got an email the next day that google had blocked someone nearby trying to log into his gmail. Who know what else was gleaned from the phone itself.

It's difficult to force a remote reset when you no longer have physical control over the device. Baseband support on a separate battery might be one of the few ways to help increase the probability of protection.

<comment><USER6> Doesn't that effectively become a "Two Generals' Problem" sort of thing? I mean, I guess links are reliable enough, but at what point do you decide when link severance is long enough to wipe the phone? What occurs if iCloud is down for that long?

</comment></comment><comment><USER7> Qualcomm is widely known to be cozy with certain clandestine agencies. I'm quite certain, nay, positive, that this kill switch can be abused by government agents and police forces. How long until this is used against dissenters? Against protesters in some Middle Eastern dictatorship?

Hell, how long until the NYPD rolls out a Stingray with kill-switch-tripping capability?

I'm betting not long.

The world needs an open baseband processor and accompanying OS/firmware.

<comment><USER8> If it is well known I suppose you can provide something to back that up?

<comment><USER9> From one of the leaked Snowden powerpoints, Qualcomm is listed as an 'NSA Strategic Partner':

[http://i.imgur.com/V211k8o.jpg](http://i.imgur.com/V211k8o.jpg)

The NSA defines these relationships as, "Unique key corporate partnerships to high-capacity international fiber-optic cables, switches and/or routers throughout the world"

It's worth noting that Qualcomm was founded 30 years ago specifically to provide communications equipment to the pentagon[1]. Also General Scowcroft, George HW Bush's Assistant for National Security Affairs, is a current board member.[2]

[1] - [https://www.qualcomm.com/company/about/history](https://www.qualcomm.com/company/about/history)

[2] - [http://investor.qualcomm.com/directors.cfm](http://investor.qualcomm.com/directors.cfm)

</comment></comment></comment><comment><USER10> Featuring a OnePlus One in the (hilarious) video.

I hope I'm not accidentally running around with this 'feature'?

</comment><comment><USER11> Also, I am wondering is this different from say, Apple iPhone Locator (apart from the fact that this is relevant to Android)? I think with the latest OS, unless you choose a weak password, your device pretty much could be made a brick if stolen?

</comment><comment><USER12> I give it a month before trolls are disabling people's phones for fun.

</comment><comment><USER13> A radio and network interface that comes up before the bootloader? Sounds like awesome fun!

</comment><comment><USER14> Turning three-letter-agency requests into consumer 'features' since 2001.

</comment><comment><USER15> So crackers use JavaScript to extract data from smartphones ?

</comment><comment><USER16> mother of god

</comment><comment><USER17> An interesting thought experiment is to consider how differently this would be perceived if they branded this as something like "remote disable" rather than using the politically charged term "kill switch."

I suspect a lot of the dissenters would disappear.</comment>


First Round Capital - Rebecca Black parody - very funny - <AUTHOR> http://www.youtube.com/watch?v=HP4HiZt3DFE&feature=youtu.be

<comment><USER2> Best. Ever. Corporate happy holidays card.</comment>


How Bayesian statistics convinced me to hit the gym - <AUTHOR> https://towardsdatascience.com/how-bayesian-statistics-convinced-me-to-hit-the-gym-fa737b0a7ac <comment><USER2> circular regression will convince him to get a girlfriend also</comment>


Holes in Bayesian Statistics - <AUTHOR> https://statmodeling.stat.columbia.edu/2020/02/23/holes-in-bayesian-statistics/ <comment><USER2> _...the inferential procedure of Bayesian statistics is to assume a prior distribution and a probability model for data and then use probability theory to determine the posterior. But if these steps, or something approximating them, are necessary, if you can't just look at your data and come up with a subjective posterior distribution, then how is it reasonable to suppose that you could able to come up with an unassailable subjective distribution before seeing the data?_

Is the point to end up with an "unassailable subjective distribution"? I believe the power of Bayesian thinking is that you can take a subjective prior, which is necessarily assailable in its subjectivity, and then combine it with data. The result is something that is better than either the subjective prior alone or the likelihood estimator gleaned from data alone.

<comment><USER3> Yes, it's a bit ironic that the likelihood principle ("all the evidence drawn from data is summarized by the likelihood function") is something that both frequentist and Bayesian statisticians like to claim as their own. Frequentist statistics is basically Bayesian statistics done with a "flat" prior distribution (where "flat" can depend on how the model is parameterized, however). Seen from this POV, it may be somewhat weird to claim that Bayesian stats has "holes" in it.

<comment><USER4> Yes, the only difference is that in Bayesian stats the biggest hole (priors) is explicit and in your face. In frequentist stat that "flat" prior you mention is implicit and flies under the radar.

</comment></comment></comment><comment><USER5> Every time I see an article like this, I eagerly read it hoping to find a cogent and coherent criticism of Bayesian stats, and it always ends up being a straw man or a very fair critique of somebody not correctly applying or interpreting an application of Bayes' theorem.

Bayesian stats is nothing more than a rigorous way to transform beliefs + data into a posterior. Yes, flat priors are not always the best choice. That's not a criticism of Bayesian stats. It's a statement about how actually formulating a prior is often times the hardest part of a problem. Is Bayesian stats useful for describing or understanding QM? Idk, again, not really it's job...

Use Bayesian stats, not with an air of suspicion, but a respect for the fact that it will give you the results implied by your data and prior, under your model assumptions. Nothing more, nothing less. By the way, what is the alternative if you find yourself in a situation where your result depends strongly on your prior and you aren't really sure how to choose your prior? Wave your hands and find an ad hoc frequentist approach? How about just admitting to yourself that your data isn't enough to make up for the fact that you can't really quantify your true prior belief?

If you read this and disagree, I sincerely implore you to comment — I just don't understand the "debate" aspect of Bayesian stats. Some people misunderstand what Bayesian stats is sometimes (very understandable) but I have yet to see a legitimate philosophical or mathematical critique of the Bayesian approach that really made any sense to me. I would like to know if I am wrong though...

<comment><USER4> > That's not a criticism of Bayesian stats. It's a statement about how > actually formulating a prior is often times the hardest part of a problem.

Bayesian statatistics doesn't give a satisfying answer/method for choosing priors. Choosing priors is part of statistics. Therefore Bayesian statistics has a "hole" in it.

<comment> 08-15 E. T. Jaynes gave some very good answers (symmetry groups and maximum entropy principle). You should read "Probability Theory: The Logic Of Science". In it, you will learn that the supposed "hole" has been closed pretty nicely.

<comment><USER6> My favorite book of all time. :)

</comment></comment></comment></comment><comment><USER7> Upvoted this mostly because I love seeing these debates here on HN about statistical methods. I don't do this kind of work in my day job, unfortunately, but studied it in college and always look back to a certain "fork in the road" moment that, had I adjusted my priors differently (heh), would've very likely led me to an academic life instead of in business.

</comment><comment><USER8> One of the comments at the site finally cracked a little bit of light for me on Bell's theorem. To quote from the comment: "What his theorem says is that the world can not simultaneously be _local_ and have hidden variables. His own position was that it seemed exceedingly likely that the world was non-local and that there were hidden variables (such as where is the photon at any given time)."

I don't know why, but I kept imagining non-local scenarios and thinking, "This seems like it should be OK, so I don't understand what's going on". Having it spelled out is tremendously helpful. I still don't understand what's going on, but at least I don't feel completely crazy ;-)

</comment><comment><USER9> From the the paper linked in the post: "A probability model is a tool for learning, not a suicide pact."

</comment><comment><USER10> I'm turned off by the invocation of quantum mechanics here. Most applications of Bayesian statistics have nothing to do with QM, so "it's not compatible with QM" doesn't seem like a strong argument.

QM is the number-one favorite topic of crank scientists and pseudoscience. When using it in the discussion of a seemingly-unrelated topic, authors should take extra care to motivate why QM is relevant.

(Of course probability theory and QM are not unrelated topics, but probability exists independently of QM.)

<comment><USER11> While reading the blog post/abstract I had the same thought, but the full paper makes it clear that the author intends something different:

> The second challenge that the uncertainty principle poses for Bayesian > statistics is that [...] we routinely treat the act of measurement as a > direct application of conditional probability.

Furthermore it states that this problem might also arise for other applications of Bayesian statistics:

> If classical probability theory needs to be generalizedto apply to quantum > mechanics, then it makes us wonder if it should be generalized for > applicationsin political science, economics, psychometrics, astronomy, and > so forth. It's not clear if there are any practical uses to this idea in > statistics, outside of quantum physics. For example, would it make sense to > use "two-slit-type" models in psychometrics, to capture the idea that asking > one question affects the response to others?

</comment></comment><comment><USER12> The linked paper is a very nice overview. Of course there problems are known and there are people trying to fix all of the issues (mostly in the relative obscurity of non-overhyped corners of academia), but the concise example- guided description of these problems is great.

Somehow I think the most fundamentally damning critique, and causality shares this problem, is also the most vague. That applied scientists/experimentalists look at the "automation" that these approaches are supposed to enable and say "that's either doing the trivial part of the job or giving you BS answers".

<comment><USER13> I've always felt bayesian statistics got more attention from researchers than was warranted (including today despite deterministic methods taking over the world) because it has a nice principled "theory of everything" starting point. But then of course you have to approximate the heck out of it to be able to solve it. Often far more than with other methods.

<comment><USER4> You have to approximate the heck out of the Schrödinger equation as well, otherwise we would be stuck describing the Hydrogen and maybe the Helium atoms and nothing more.

<comment><USER13> Yes, however as I said in the subsequent sentence, the approximation is "often far more than other methods". For the most obvious example, a point estimate like MAP doesn't need to compute the denominator in Bayes law. That's two (generally easier) terms to approximate rather than three. Those using Bayesian methods point out the value in providing a full distribution, but the necessary additional approximations to get it means the location of its maximum can now actually be less accurate than a simple MAP estimate. But what always bugged me is multivariate problems where the Bayesian paper presumes everything is independent and Gaussian. Great after getting all psyched by that intro talk about the value of getting a distribution, we get the simplest imaginable one, just a mean and variance for each variable.

</comment></comment></comment></comment><comment><USER14> Seems like a weak post, very short on evidence and reasoning for such a massive topic.

<comment><USER15> the first two words are a hyperlink to a much longer paper.

<comment><USER16> That definitely could have been made clearer. I looked all over the page for a link to an actual paper and missed it. I never would have guessed it was the link on what appeared to me to be an author's name.</comment></comment></comment>


Where the Startups Are, By Zip Code - <AUTHOR> http://www.readwriteweb.com/start/2010/08/where-the-startups-are-by-zip.php <comment><USER2> Crunchbase isn't only startups (my employer is there, and we're not a startup) and not all startups raise money (we were once a startup, but were bootstrapped).

I would characterize the companies in Crunchbase as just tech companies.

</comment><comment><USER3> It would be interesting to see how this fares per-city. States like Texas have much less population density and a ton of start-ups (looking at the list, Houston is very impressive).

A lot of these zips are right next to each other.

</comment><comment><USER4> Chicago... the Groupon effect?

<comment><USER5> Crunchbase says Groupon has raised $173 million (<http://www.crunchbase.com/company/groupon> ), so they alone account for a quarter of the money raised in 60606.

I was actually surprised that it was only 23%. I didn't realize how much other funding there was around here.

<comment><USER6> From their data (companydata.csv):

      name	founded_year	zip_code	 raised_amount
      Invenergy	2001	60606	 $459,000,000.00
      Groupon	2008	60654	 $172,800,000.00
      Hostway	1998	60606	 $110,000,000.00
      HighTower		60661	 $100,000,000.00
      Affinity.com	2006	60606	 $85,000,000.00
      NeuroTherapeutic2006	60631	 $43,000,000.00
      MediaBank		60654	 $40,500,000.00
      Initiate Systems1994	60606	 $31,000,000.00
      ACTIV Financial 2002	60606	 $25,000,000.00
      Firm58	2005	60661	 $22,680,000.00
      Echo Global Logi	60654	 $17,400,000.00
      Vibes Media	1998	60606	 $15,000,000.00
      Arroweye Solutio1999	60661	 $14,000,000.00
      BridgePort Netwo2002	60601	 $13,000,000.00
      Mirage Networks	60602	 $12,000,000.00
      SAVO		1999	60607	 $10,000,000.00
      Open Kernel Labs2006	60606	 $9,750,000.00
      InXpo			60642	 $9,000,000.00
      Manifest Digital2001	60654	 $9,000,000.00
      Info			60601	 $8,400,000.00
      FeedBurner	2004	60610	 $8,000,000.00
      Sittercity		60654	 $8,000,000.00
      The Point		60622	 $7,300,000.00
      Allen Brothers	60609	 $7,100,000.00
      TetraVitae Biosc	60606	 $6,300,000.00
      Compliance11	2005	60606	 $6,178,766.00
      tvCompass	2003	60631	 $5,100,000.00
      Cleversafe	2004	60661	 $5,000,000.00
      Viewpoints	2007	60610	 $5,000,000.00
      GrubHub	2004	60614	 $3,100,000.00

edit: There are a few more but I truncated the list for brevity ;)

<comment><USER4> Wow. Invenergy and HighTower _so_ shouldn't count.

</comment></comment></comment></comment><comment><USER7> link to the guy who did the work (and posted more interesting maps): [http://petewarden.typepad.com/searchbrowser/2010/08/the- top-...](http://petewarden.typepad.com/searchbrowser/2010/08/the-top-10-zip- codes-for-startups.html)

</comment><comment><USER8> The "two bay areas" still dominate, though Illinois was interesting.</comment>


Imzy, a social network based on kindness, opens its doors to the public - <AUTHOR> http://www.theverge.com/2016/10/27/13416716/imzy-social-network-ex-reddit-launch-funding <comment><USER2> It looks like you have to register and log in before you see any content. I don't think that's going to work long-term.</comment>


So you want to be a proof engineer? - <AUTHOR> http://proofcraft.org/blog/proof-engineer-reading.html <comment><USER2> Where are formal methods used in industry? To quote [http://research.microsoft.com/en- us/um/people/lamport/tla/am...](http://research.microsoft.com/en- us/um/people/lamport/tla/amazon.html) -

"We have found relatively little published literature on using high-level formal specification to verify the design of complex distributed systems in industry."

<comment><USER3> Here [https://www.facebook.com/](https://www.facebook.com/) Here [https://galois.com/](https://galois.com/) And Here [https://www.fpcomplete.com/](https://www.fpcomplete.com/)

To name a few.

<comment><USER2> Could you elaborate on the uses at Facebook?

<comment><USER4> [https://code.facebook.com/posts/302060973291128/open- sourcin...](https://code.facebook.com/posts/302060973291128/open-sourcing- haxl-a-library-for-haskell/)

<comment><USER5> While Haxl is great and is a good example of Haskell usage in the industry, it's not a good example of the usage of formal methods, since functional programming is only the first of the two steps mentioned in the article.

The title of this post made me hope they were looking to hire a "proof engineer", but alas, they're only explaining how to become one. It's already hard enough trying to find a Haskell job, finding one in Isabelle or Agda must be near impossible!

</comment></comment></comment></comment></comment><comment><USER6> It's a bad advice. You don't have to learn Haskell and functional programming for this.

IMO, you need: \- Learn math, i.e. what a proof is, basic algebra, etc \- Learn a dependently typed system like Agda or Coq. All these systems use functional programming but this kind of programming is very different from programming which leads to programs.

<comment><USER7> What kind of programming doesn't lead to programs? And before you say proofs, proofs are programs, that's the point.

<comment><USER6> Proofs are programs but of a very different kind. For example, you don't care about performance.</comment></comment></comment>


8 percent of human genetic material comes from a virus - <AUTHOR> http://www.uta.edu/ucomm/mediarelations/press/2010/01/genome-biologist-reports.php

<comment><USER2> The original article is here: [http://www.nature.com/nature/journal/v463/n7277/full/463039a...](http://www.nature.com/nature/journal/v463/n7277/full/463039a.html) (paywall). But this is basically a review. The actual research in this week's Nature is not by this UT Arlington lab, but instead by Horie, et al, from Tokyo ( [http://www.nature.com/nature/journal/v463/n7277/full/nature0...](http://www.nature.com/nature/journal/v463/n7277/full/nature08695.html) )

That 8% of human DNA comes from viruses is interesting, but not new; this has been known for at least a few years now. What is interesting about the new findings is that this is the first non-retrovirus found to insert DNA into the human genome.

</comment><comment><USER3> I read a Readers Digest article along these lines a while back and found it increadibly fascinating.

From what I remember, our DNA is riddled with bits of ancient virus DNA. Explanations as to why these have lasted so long were uncertain, but researchers have made some pretty impressive speculations.

For example, viruses, in order to survive as a species, must not only feed of their host (the human), but must ensure that the human survives in order for it to keep living. Furthermore, viruses compete with other viruses for food (the human), and so if another virus ourbreak occurs then the resident virus will, if you like, work with the human immune defence system to kill off the new intruding virus. So they may have even been crucial to human survival at some point.

There were further discussions about how these ancient viruses may have affected human development (ie - the larger, tumour like brain, etc), but I can't remember much of it.

I guess the only concrete point I can contribute here is that this is definately nothing new.

</comment><comment> daniel-cussen Macros in DNA?</comment>


Show HN: Get alerts for tweets containing IP addresses in your network - <AUTHOR> https://ipwatch.timberslide.com <comment><USER2> This sounds interesting, but it also sounds like something that requires the full firehose of all tweets unless Twitter's API lets you filter based on regexes. Does Twitter let you get that without some kind of paid plan? Particularly now as they try desperately to find a way to remain viable.

Edit: Looking at the options, you could put together a list of a few strings that would match (almost?) any IP address without too many false positives - just getting all 100 combinations of digit.digit would do the trick, and you could do better filtering once you had that smaller stream. The API limit is 400 strings.

<comment><USER3> How about all 256 (valid in an IPv4 address) combinations of \\.\d\d\d\\.?

<comment><USER2> I thought about that, but the docs don't mention anything about regexes and you may end up with some edge cases with leading 0s in each section. That would leave you with 256+100+20 (256 non-padded, 100 2-digit numbers with leading 0, 10 digits with leading 0, 10 digits with 2 leading 0) which would fit. My immediate thought was that you'd catch a lot of invalid numbers as well, but simply having the "." prefix and suffix would mean you'd catch all possible middle octets which would do the trick while missing most of the phone number collision space (some people separate phone #s wtih ., but most of those probably don't start with 0-2).

</comment></comment></comment><comment><USER4> I predict a soon to follow Show HN from the same author, "Why you should never build your product on twitter's API."

I've been frustrated on how poor the twitter API is. Just wait until those app keys start suddenly 'expiring'...

<comment><USER5> Build a product around twitter (too) and agree it sucks. I dont even manage to understand all the issues it seems to have with me

</comment></comment><comment><USER6> What do you mean by "ip addresses in your network"? Is it the IP address I use to sign up for the service? I can't seem to specify a range after login, only an email to send the notification to. (an aside: it appears that the notification email can be different than the email I signed up with -- could cause a spam issue)

Also, I'd love to specify just a domain to look for, not an ip range.

<comment><AUTHOR> Good feedback on both points. It doesn't accept a range of IPs, just CIDR prefixes. I'll make that more explicit.

</comment></comment><comment><USER7> Suggestion: Please give me a longer text box I can paste a list of CIDRs into. I was copy/paste/click-add/rinse/repeat-ing for a while.

<comment><AUTHOR> Good suggestion, that sounds tedious. Other related feedback I got included using IRR data from DBs like RADB or RIPE to automate populating the prefixes.

<comment><USER7> IRR would be cool, you can just ask for ASN.

</comment></comment></comment><comment><USER8> I've always wondered how promises like this are possible since twitters public API allows only partial access to the stream of tweets?

<comment><USER9> Twitter offers real-time streams that filter by limited numbers of keywords, userids, and locations.

[https://dev.twitter.com/streaming/reference/post/statuses/fi...](https://dev.twitter.com/streaming/reference/post/statuses/filter)

<comment><USER10> I have been using this "StreamAPI" for some time now, and I have been suffering of false positives all the time.

<comment><USER9> How so? I'll probably be testing it soon for a new project.

<comment><USER10> Sometimes it gives you data that is not relevant to your query.

Example: I want tweets from user: @XYZ You think that you wont need to check, but you'd be wrong.

</comment></comment></comment></comment></comment><comment><USER11> So you can monitor CIDR ranges? That's cool!

Can you tell us how it works on the back-end? What other kinds of streams could this be applied to?

<comment><AUTHOR> The core of the service is Kafka wrapped in a friendly gRPC API (that's Timberslide). It's a collection of microservices, e.g. Twitter service streaming into Timberslide, IP/Prefix matching service reading from Timberslide, email/webhook notification service, a websocket server for the live view in the app.

Adding other streams is possible, Twitter's API was just convenient while experimenting. RSS, Pubsubhubbub, Reddit, ...? It could be interesting to allow others to publish their own event streams into this app.

</comment></comment><comment><USER12> Neat. One feedback - when using uorigin adblock adding anything throws a 500

</comment><comment><USER13> For some reason it wouldn't let me add my IP?!?!

192.168.0.0/24

</comment><comment><USER14> I mis-read and thought this was a service showing you all the tweets coming from your IP range. This is cool too though!

</comment><comment><USER15> As a network operator, this might be kinda nifty.

I'll never know, though, because I'm not registering / signing up just to see what it looks like (and -- in case you're thinking of somehow monetizing it -- I'd certainly never pay for it).

For a "Show HN", there's really not much to see. I knew as much about it after reading the title as I did after clicking the link. Uh... good luck, I guess.

<comment><USER16> There are more constructive ways of providing this feedback. Either just by framing it differently or giving specific examples of improvements they could make (screenshots, use cases, etc).

<comment><USER17> I disagree; this is good feedback that the developers aren't communicating their value prop to a potentially obvious audience (ops teams).

<comment><USER16> Yes, useful feedback but the user had been downvoted to near-invisibility. Had their tone been different, that wouldn't have happened.

</comment></comment></comment></comment><comment><USER18> I'm sorry for being a total noob (this is my first post actually), but I'm not 100% sure what this does. I enter my IP range and it will alert me if it show up in a twitter post somewhere?

Sorry, I couldn't find any documentation that clarified it.</comment>


Web trackers exploit browser login managers - <AUTHOR> https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ <comment><USER2> I like to use separate email addresses for each service all sent through a common domain. I started out doing it just from simple curiousity to see how sites sell and reuse my address. But now it pays off in quite a few ways.

I think for privacy's sake, it's valuable to systemically behave in different ways.</comment>