Ask HN: How do you pay for content with money (not privacy/attention/etc.)? - <AUTHOR> When I talk about ad and tracker blocking, I get accused a lot of not supporting content providers, which I find puzzling, because in all probability, I pay more for content, and more of it goes to the content producers.<p>Still, I sometimes find it difficult to find a way to ethically pay for the content I consume, so I'm interested in hearing what strategies other people use to pay for content with money rather than privacy/attention/etc.. <comment><AUTHOR> Here's what I do:

Music: This is probably what I consume the most of. I have a physical music collection which is about half vinyl and half CDs. I'm slowly selling off my vinyl and rebuying the albums on CD. I have a small collection of MP3s (small enough to fit in an unpaid Dropbox account) which were purchased from bands too small-time to have released physical media. If the music was released after ~2000, I probably bought the physical media new, to support the artist-- older stuff can be difficult to find new.

News: If I go directly to a news site, it's Mother Jones[1] or Pro Publica[2], and I donate $10 to each monthly. If I click through from an aggregator (such as HN) I view the content with browser-based ad-blocking. For sites that give a few free reads, I use the free reads, but don't make any attempt to get more. For sites that block me from reading with ad blocking, I just leave. I view this as fair use.

Books: If I had every paperback I've purchased, my collection would be huge. But after I read books, I only keep them if they're so good that I intend to re-read them (probably 20 titles in this category) or if they are reference books (probably another 40 titles in this category). Otherwise I give them away to friends, donate them to a library, or make the hard decision to trash them.

Academic papers: Many are free online. If not, writing to the author almost always procures a PDF or DOC file--academics receive little income from publishing, and are often surprised and happy to hear someone is interested in their work. Sometimes the author is dead, however. In general I have little objection to using SciHub, especially when research is government-funded.

TV Shows: I pay for a few streaming services (Netflix/Amazon).

Movies: Movies I tend to see at a local movie theater, or (less frequently) pay a one-time rental for on Amazon. I have some DVDs but don't own a DVD player, so I've only kept the DVDs that would be hard to obtain again.

Small independently produced video: The vast majority of video I consume is shorter videos (usually related to rock climbing). Where possible, I donate, usually through Patreon, but this is a spot where a lot of people don't actually give this ability. I've bought a few products (books, mostly) from video producers (where they produced the products themselves) but this is even less common than donations. So I don't have a perfect solution here.

Independent review sites (i.e. Consumer Reports): This one is a tough one. These sites are important to me (I see these as the user-serving, superior alternative to advertising for product discovery) but many depend on referrer links, and I tend to buy locally. I've made $1 donations a few times where that was possible, but it isn't always, and I don't use any one review site frequently enough to justify a subscription. So I'd be interested to hear strategies for this.

[1] [https://www.motherjones.com/](https://www.motherjones.com/)

[2] [https://www.propublica.org/](https://www.propublica.org/)</comment>


Show HN: Data-driven web service for filmmakers only - <AUTHOR>

http://beta.filmquotra.com/register
Would love your feedback for our open beta of filmquotra: an online software which acts as your personal studio business analyst while helping you create your custom business plan for your film project.
filmquotra provides you immediate, real value based on actual, proprietary film financial data.
If you are a film student or first-time filmmaker, filmquotra provides step-by-step guidance on creating a  film financing "business model."   Even a seasoned professional can run quick film comparables and film ultimates.  And for the select industry expert, we provide a way to
monetize industry knowledge in a controlled, organized way.  It is free to use during our beta phase. <comment><USER2> I was initially led to think I wouldn't be allowed in, being only an enthusiast and reading "filmmakers only". Loved the design and guiding interface, can't wait for features like the outline and more parts of the workflow.

Edit: The 'Learn More' link has no href?

<comment><AUTHOR> thanks for looking and commenting! good point on the "filmmakers only." The Learn More link should take you to the help page. /help.html</comment></comment>


Grokking Diesel, Rust's ORM - <AUTHOR> https://medium.com/@Buys/grokking-diesel-652cb8886a63 <comment><USER2> _The last major component, and 'secret weapon' or 'unofficial guide' (according to me) is the the test suite in the official repo ([https://github.com/diesel- rs/diesel/tree/master/diesel_tests](https://github.com/diesel- rs/diesel/tree/master/diesel_tests))._

The tests are indeed informative, and give a good idea of how it would be used in practice. I just looked at a few and I have a _much_ better idea of how Diesel looks to be used in practice.

What I didn't see, and don't know if it exists since I haven't read a lot of the docs, is whether Diesel has a built in way to deliver joined results as HashMaps with all fields, as that would be the simplest way I would use it in practice.

For example, if I'm doing the equivalent of:

        SELECT user.*, post.*, comment.* FROM user LEFT JOIN post ON user.id = post.user_id LEFT JOIN comment ON post.id = comment.post_id

Does it have a helper method to identify the three tables that are joined, and instead of returning individual rows, return a HashMap of the user_id to user, a HashMap of the user_id to a list of posts, and a HashMap of the post_id to a list of comments? I think that would be:

        vec![ HashMap<i32,User>, HashMap<i32,Vec<Post>>, HashMap<i32,Vec<Comment>> ]

This would approximate the actual "objectiness" or many ORMs, and would make it easier to loop over data in the desired way with a minimum of boilerplate.

Edit: Or perhaps the more performant way would be to allow registering of callbacks for each change of user, post and comment, and call the appropriate one if defined. That way there isn't time and memory spent on condensing the data into hashmaps? I'm new to thinking about how to deal with ORM results in a language like this.

<comment><USER3> Not a HashMap specifically, but there is a way to group them into `Vec<(User, Vec<(Post, Vec<Comment>)>)>`. (Which you can convert into a hashmap pretty easily) [http://docs.diesel.rs/diesel/associations/index.html](http://docs.diesel.rs/diesel/associations/index.html) for details.

<comment><USER2> That's actually what I was looking for. I'm was too out of practice in general with signatures in static languages and unfamiliar with Rust's syntax in specific to figure it out and express what I was looking for correctly. ;)

</comment></comment></comment><comment><USER4> I wish it was closer to Scala's Slick which is an FRM (Functional Relational Mapping), since Rust's syntax is so similar to Scala. Unlike ORMs, libraries like Slick or JOOQ (Java) have pretty much 1 to 1 DSL to SQL and Slick also provides compile time type safety which in my opinion is the main point of using it.

<comment><USER5> Hm, Diesel is also trying to do the "1-1" thing and is _certainly_ focused on compile-time type safety.

I haven't used Slick, I'd be interested, if you have the time, in an elaboration with examples on this stuff.

<comment><USER4> Well, like I said Slick is not an ORM whereas Diesel is. Slick is not as much about an ORM abstraction, but writing SQL queries in Scala by leveraging it's collections library, taking advantage of Scala's advanced features such as operator overloading, etc.

For instance this is an example from Diesel:

Post::belonging_to(user).load(&connection)

And this is how it would look like in Slick:

Post.filter(_.userID === 1).result

So both of the above would translate into SQL "SELECT * FROM posts WHERE user_id = 1", however Slick is more explicit whereas Diesel definitely feels like an ORM. The tripple equals in Slick example for instance is a nice touch and an example of operator overloading, because userID could be of type Integer or Option[Integer] (nullable field) and it would work both ways.

<comment><USER5> > like I said Slick is not an ORM whereas Diesel is.

I personally find "ORM" to be such a broad term as to be almost meaningless. This may be a personal problem :)

I see now. I am pretty sure that you could write

      posts.filter(user_id.eq(1)).load(&connection)

if you wanted; the belonging_to is just fancier and a bit shorter.

Anyway, thank you! I've mentally filed a "check out Slick sometime" bug for my infinite personal-to-do list :)

<comment><USER4> No problem, I guess what I'm trying to say is that just like Rust took inspiration from Scala syntax (at least I get this feeling), maybe so could Diesel from Slick.

<comment><USER3> Slick was definitely an influence on Diesel's design. I tried to have our query builder map more closely to SQL though, whereas Slick feels like it's trying to pretend it's just an Iterable.

</comment></comment></comment></comment></comment></comment><comment><USER6> Is the column limit still a problem for Diesel? The 16 columns max default is not enough and even the optional 26/52 can be too little for some odd legacy schemas. I'm curious: is this a limitation that will be overcome as the library matures or is it intrinsic to the codegen architecture?

<comment><USER7> It's currently dependent on implementing traits for very large tuples, so you could argue it's a language feature we are waiting for (cf. open RFC #1935 [1]). (There was a PR on Diesel to use HLists but it's no longer pursuit.)

[1]: [https://github.com/rust-lang/rfcs/pull/1935](https://github.com/rust- lang/rfcs/pull/1935)

<comment><USER4> What was the reason you guys dropped HList approach? I'm curious since I have to deal with tables with north of 200 hundred columns and because of forever annoying Scala's tuple parity limit (22) Slick falls back to HList which is really heavy on a compiler and IDE aside from other drawbacks.

<comment><USER3> We didn't want to commit to our own home-grown hlist type until we had some indicator of whether the language was going to go with variadics based on tuples or hlists.

</comment></comment></comment></comment><comment><USER5> Diesel's authors have been hard at work on docs, but there's only so many hours in the day. Love to see posts like this.

</comment><comment><USER8> Completely unrelated to the topic, but does anybody know why I'm getting a private gist link with the post's content when sharing it from MobileSafari (iOS 11 Beta)?

</comment><comment><USER9> I would have though that ORM's were an antipattern in Rust.

<comment><USER10> How come?

<comment><USER9> Maybe because of the language constructs that facilitate functional programming, you would think a data driven centric approach would be chose first over objects.

<comment><USER5> Rust doens't have objects. (Trait objects _kind of_ come close but are very rare and I've never used one with Diesel.)

I think if you read the post, you'll see that Diesel is very data-driven.

Personally, I tend to call it a "query builder" if I think someone might be ORM-phobic; I find it closer to that than other ORMs, even though it's authored by the maintainer of one of the most massively popular ORMs ever. They've sometimes joked that that experience has taught them what not to do ;)

<comment><USER11> > even though it's authored by the maintainer of one of the most massively > popular ORMs ever

Just curious, what ORM is that?

<comment><USER5> ActiveRecord. Referencing it is a double-edged sword; Diesel is very much _not_ ActiveRecord, so by saying it up front, people tend to get the wrong impression.

<comment><USER11> IThat's cool, didn't realise it was the same author.

I understand. The other side of that coin though I guess is that knowing this might give some more confidence in using diesel. ActiveRecord was the first ORM I used, and knowing now that diesel is "from the same stock" (for want of a better phrase) gives some extra confidence in what it can do / where it is going.

Not that I was not confident in it before...

<comment><USER5> Yup, absolutely, that's the other side of the sword :)

<comment><USER12> Indeed, the flood of Rails people who went over to Rust have definitely given some people pause to consider the direction it was taking.

I don't see this particular case of someone who spent a significant amount of time coding core Rails OSS library being seen as a negative though, quite the opposite. If anything it would be an excellent measure of the language for that particular use case assuming any competent developer would seek to operate in the constraints of the language rather than shoehorning an existing implementation into something that doesn't fit.

The bigger question is whether the ORM label itself is limiting or can be understood to fit into a broader scope of implementations.

<comment><USER3> I think people read way too much into the ORM label. Diesel is very much a query builder first, not an ORM. As a random data point, I've been fixing bugs in Rails lately by basically copying over code from Diesel and converting it to Ruby. That code has all been in Arel not Active Record.

I agree that the "I make Rails" thing is a double edged sword. I would hope people would see it as an indicator that I have a lot of experience and lessons to learn from, but I think many people see the opposite.

<comment><USER13> Thoughts on replacing Arel with Diesel + Helix[0]?

[0] [https://github.com/tildeio/helix](https://github.com/tildeio/helix) \- When Helix can handle that complexity (if it can't already)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> After the unfortunate news from NPM today, I'm hoping Diesel doesn't come with a built-in defeat device... /s</comment>


European Commission launches first ever bug bounty - <AUTHOR> https://joinup.ec.europa.eu/news/hackerone-vlc <comment><USER2> I know they have taken their time with this, but it must be seen as a positive for an international body to be recognising the importance of open source</comment>


Designing a Home Network for Hostile Devices - <AUTHOR> https://shkspr.mobi/blog/2016/03/designing-a-home-network-for-hostile-devices/ <comment><USER2> I guess we're beyond even considering that having an internet-connected smoke detector isn't necessary or desirable.

<comment><USER3> Or that automatic software updates are a security problem. "Software will eat the world," and every device around you will be controlled by software downloaded from somewhere on the internet.

<comment><USER4> They're the least bad alternative. Without automatic software updates, you instead have permanently-vulnerable devices (like most old home routers are today—they can _be_ updated, but it's a manual process so users don't bother.)

<comment><USER3> I think they're a wash. Without them, you don't get patches unless you explicitly check for them. With them, you might not get patches anyways (like many Android phones), and are forever vulnerable to server-side breaches, or the manufacturer going out of business. Worst of all, an attacker only has to compromise the update server to compromise every associated device, rather than having to hack said devices one at a time.

</comment></comment></comment></comment><comment><USER5> IP alias - multiple IP subnets on one physical interface

[http://www.openbsd.org/faq/faq6.html#Setup.aliases](http://www.openbsd.org/faq/faq6.html#Setup.aliases)

and a firewall to control them with

[http://www.openbsd.org/faq/faq6.html#PF](http://www.openbsd.org/faq/faq6.html#PF)

Not OpenBSD only, Linux with IP aliasing and IPtables will do the same.

btw. you have PHP misconfigured, it is spewing its error log

Warning: Missing argument 2 for polldaddy_show_rating_comments(), called in /var/sites/s/shkspr.mobi/public_html/blog/wp-includes/plugin.php on line 235 and defined in /var/sites/s/shkspr.mobi/public_html/blog/wp- content/plugins/polldaddy/rating.php on line 6

<comment><USER6> This is a good start, but since they are on the same wifi channel and encryption, a lightbulb could go promiscuous and listen to all the traffic on other subnets, and interrogate them in turn.

I don't know if we need _secure_ lightbulbs that only communicate with strong encryption..

As always, there is no use in just depending on "gateway" defense of networks, and you should always assume that any network is open to the internet in one way or another.

<comment><USER5> hmm, yeah, the wifi angle does confuse things. One wifi AP in a lead box with every device !

<comment><USER7> Lead is for ionizing radiation. Simple chicken wire, or tinfoil for 5GHz will suffice.

</comment></comment></comment></comment><comment><USER8> If you buy a business type router, a similar wireless AP, and some "smart" switches, you can actually segregate things pretty well.

Examples:

Ubiquiti EdgeRouter Lite [https://www.ubnt.com/edgemax/edgerouter- lite/](https://www.ubnt.com/edgemax/edgerouter-lite/)

Ubiquiti UniFi AP AC Lite [https://www.ubnt.com/unifi/unifi-ap-ac- lite/](https://www.ubnt.com/unifi/unifi-ap-ac-lite/)

Netgear Web Managed Plus switches [http://www.netgear.com/business/products/switches/unmanaged-...](http://www.netgear.com/business/products/switches/unmanaged- plus/gigabit-plus-switch.aspx#tab-models)

$238.98 on Amazon (before tax/shipping) for the ER Lite, UniFi AC Lite, and the GS108E 8-port switch.

The key here is to have network gear that supports VLANs and VLAN trunking (802.1q).

On the ER Lite, you setup separate VLANs (networks) for each class of device just as you said. You can control what traffic can go from one network to the others via firewall rules. So, just as you said, your laptop can access everything, while your wall switches can't get anywhere.

Each VLAN will have a number associated with it, I recommend starting at 100 or something and going up from there (the netgear switches treat vlans 1-3 as special). There are up to 4096 vlans available.

Tell each switch about which VLANs are coming and going on each port. For actual devices (eg. an IP camera hard-wired) you want to have the port Untagged with the PVID and Untagged vlan being the vlan for that class of device. For traffic between switches and the AP, mark every VLAN in use as Tagged on those ports.

Tagging puts an extra header on the Ethernet frames so that the devices on either end know the traffic is for a different network.

On the wireless AP, send all the VLANs into it as tagged. Then create separate SSIDs for each VLAN with separate credentials. I recommend hiding the SSIDs (disable SSID broadcast) for this, not for security, but for sanity.

With all that setup, you can set arbitrarily broad or specific rules on your router as to which traffic will be routed between vlans and the internet.

As said in another comment, you can use "dumb" switches still, but they won't understand VLAN traffic. So every device on the switch will have access to the same network(s).

One important caveat about separation like this is that devices normally discover each other via broadcast traffic. Since each VLAN is a separate broadcast domain, only devices on one VLAN with discover each other. This may or may not matter for your devices. For example, you probably connect to an IP camera directly rather than via discovery. However, for a Chromecast there would be discovery needed.

For many devices, they use mDNS for discovery. There is a mDNS reflector service on the Edgerouter that can be used to replicate discovery packets on another network. That way your laptop can discover devices on other VLANs.

All that said, while it isn't outrageously expensive to accomplish this, it will be time consuming to configure properly. ;-)

<comment><USER9> I tried this. I have a reasonable ap and a reasonable switch (don't remember brand ans type by heart) but getting vlans and wifi nets configured correctly and so that all devices work correctly, _and_ easy enough to use is very hard. I'm no networking expert but I like to think I know the basics, but I gave up on vlanning after several days of getting nowhere.

</comment></comment><comment><USER10> You can do it with a capable (read enterprise grade) router that does packet filtering. You can do it with a linux box and a lot of ethernet network cards as well, but your speed will suffer because every packet needs to be inspected before being forwarded. Hardware assist in packet inspection makes a major difference. See also Software Defined Networking[1].

You probably won't need "deep packet inspection" for a few years, until the IoT people get smarter about hiding their traffic. That was sarcasm. Maybe. The fact that they cannot do secure networking competently implies they won't be able to hide their traffic competently either, but the incentives are much stronger for the latter.

Anyway...

Step 1: _FORCE ALL THE TRAFFIC THROUGH THE ROUTER._ Shouting here because, if the traffic does not go through the router, you cannot control (block) it. Forcing the traffic through the router can be difficult. You need to "home- run" all ethernet (wired and wireless) to the router.

1a) Hard-wired ethernet is simple. Home run it to the router.

1b) Do not permit any small network switches on any of the ethernets (this principle is breakable if you understand that all units on the satellite switch will be unprotected from each other).

1c) Best: Do not allow _any_ wireless. This is unrealistic today. Better: have a _separate_ wireless access point (with WPA encryption and good passwords) for every group (class) of wireless devices that then gets home-runned to the filtering router. The filtering router can then prevent your light bulbs on the light bulb[2] WiFi AP from talking to the refrigerator on the kitchen appliance AP. "Better than nothing" is to have multiple SSIDs on one WiFi AP.

Step 2: Create a shitload of subnets by either using all of the Class C networks 192.168.0.0/16 or subnetting 10.0.0.0/8[3] Put each device or logical grouping (class) of devices on a separate subnetwork.

Step 3: Disallow all packet routing by default. Bask in the glory of a perfectly secured (albeit perfectly useless) network. Crack open a beer. Drink it fast... the local residents won't let you finish it because they will impress on you their pain of not being able to "facebook" because your network is too secure.

Step 4: Re-allow all packet routing to tamp down the mutiny.

Step 5: Write a shitload (more) routing rules defining which device (class of devices) can talk to which other device on which physical ethernet ports on which ethernet IP addresses (subnets) and IP ports (i.e. whitelist only the necessary traffic).

Step 6: Re-enable the packet filtering in the router. Crack open a beer, you deserve it.

Step 7: Goto step 4.

After a few iterations, you might be able to finish your beer in step 6. After a few weeks, you might even get enough time to enjoy your beer.

[1] [https://en.wikipedia.org/wiki/Software- defined_networking](https://en.wikipedia.org/wiki/Software-defined_networking)

[2] Most light bulbs are not directly on WiFi but are instead on a low power network like Zigbee or Z-Wave. They come with a ethernet-to-Z* gateway. This is actually pretty good, because you can plug the gateway into your filtering firewall and be in pretty good shape because you can treat all of your lightbulbs as a device class and filter them with their ethernet attachment to your router.

[3] Subnetting 10.0.0.0/8 can be a problem because your internet provider thinks that they need to use 10.0.0.0/8 for the two IP networks on your side of their internet attachment point. This is really stupid because their ToS probably specify that you can have only one computer on their precious network (that was sarcasm again. maybe.), so they are blocking 16777214 IP addresses so that they can have one for themselves (10.0.0.1) and provide 1 for you.

<comment><AUTHOR> Yes, but what _sort_ of beer? ;-)

Any suggestions for hardware which can accomplish this? Might scour eBay for some company discards.

Good point about the light bulbs, although the Lifx ones I have _are_ direct WiFi connections. Was wary of Hue after their compatibility shenanigans, but there's a certain simplicity in having them all hang off a central hub.

<comment> ryan-c I have an EnGenius EAP600 as my access point which allows for up to 8 SSIDs, each of which can be mapped to a different VLAN. It also supports a feature called client isolation, which prevents clients from talking directly to each other. These features make what gvb suggests a little easier. My router is simply a Linux box running Debian (currently a Supermicro SYS-5018A-TN4, previously I had a Soekris net4801, then a Dreamplug).

All of my ethernet switches are Netgear SOHO models that support most enterprise features (I use RSTP, VLANs and LACP). I have a couple GS108Ts, a GS716T and a S3300-28X. With these switches I can maintain isolation via VLANs even with multiple switches, and most of the VLANs go into my router via a cheap 10Gbe SFP+ card I got on eBay.

Currently, I've got the following "smart" devices:

WiFi Scale

Smart TV (ethernet)

Roku (ethernet)

PS3 (ethernet)

PS2 (ethernet)

Raspberry Pi 2 running OpenELEC (ethernet)

None of them are allowed to talk to each other.

</comment></comment></comment><comment><USER11> Can Tomato do this?</comment>


Ubuntu Phone flash sale 12.000 orders per minute - <AUTHOR> https://twitter.com/bqreaders/status/565528229734547456 <comment><USER2> I wouldn't say that the Ubuntu Phone is one of the nicer looking phones available to date, but I think there is something to be said about the demand of a product that already has a limited market. By that I mean that Ubuntu isn't a household name and subsequently they've capitalized on the smaller potential user base.

With the success of the OnePlus One, Xiaomi, Blu, Oppo, etc. and with this rise of the Ubuntu Phone, I think a major paradigm shift is underway in the mobile space.</comment>


Neuroscientists Reinvent Microphone Based On Mammalian Hearing System  - <AUTHOR> http://www.technologyreview.com/blog/arxiv/26666/?ref=rss <comment><USER2> On a semi-related note: I wonder if that development can be a good basis for improvement of current noise-canceling headphones. Right now, they don't perform too well with fast changing sounds -- like background noise of office etc.</comment>


Ask HN: Is it possible to synthesize chloroquine at home, if so – how? - <AUTHOR> With the ongoing corona virus crisis, ánd mounting evidence that chloroquine (and hydrochloroquine) functions as an effective suppressant/cure for COVID-19, I was wondering if it is possible at all to synthesize (safely!!) those compounds using widely available resources and raw materials.
Perhaps a list of needed raw materials, list of resources needed and a step wise recipe would be useful in the coming weeks.
If this is not possible to do safely, perhaps someone knowledgeable can shed light on why that is. <comment><USER2> See this

[https://www.beilstein- journals.org/bjoc/articles/14/45](https://www.beilstein- journals.org/bjoc/articles/14/45)

That kind of continuous flow chemistry is a revolution, something like 3D printing.

<comment><USER3> Thanks for the link, There are essential medicines that synthesis of which should be public domain.

<comment><USER2> Wikipedia says: "Hydroxychloroquine was approved for medical use in the United States in 1955.[1] It is on the World Health Organization's List of Essential Medicines, the safest and most effective medicines needed in a health system.[5] The wholesale cost in the developing world is about US$4.65 per month as of 2015, when used for rheumatoid arthritis or lupus.[6] In the United States the wholesale cost of a month of treatment is about US$25 as of 2020

That's old enough that there is no patent on the drug and I am sure many public domain synthesis paths: somebody might have a newer, better, cheaper way to make it which is patented, but there is no legal barrier to making it.

<comment><USER4> Wikipedia is misquoting WHO.

> The core list presents a list of minimum medicine needs for a basic health- > care system, listing the most efficacious, safe and cost–effective medicines > for priority conditions. Priority conditions are selected on the basis of > current and estimated future public health relevance, and potential for safe > and cost-effective treatment.

WHO is saying "this medication is the safest medication available to treat malaria". It's definitely not saying "this medication is safe".

For chloroquine they say "* For use only for the treatment of P.vivax infection", so they're not even saying "this is the safest med for malaria", they're saying "for this one type of malaria this is the safest med".

</comment></comment></comment></comment><comment><USER5> Sure dude, let's all make drugs at home... What could go wrong!?

<comment><USER2> The other day the cops in my town were chasing somebody who was suspected of shoplifting at Wal-Mart and they found that he abandoned a small suitcase that contained a mini meth lab.

</comment></comment><comment><USER6> Does plain old quinine work as well? If so, could you either a. extract it from tonic water, or b. just drink tonic water?

</comment><comment><USER7> Yeah this sounds like a really bad idea</comment>


The Mathematics of the Rubik's Cube (2009) [pdf] - <AUTHOR> https://web.mit.edu/sp.268/www/rubik.pdf <comment><USER3> I've been fascinated by the Rubik's cube for years after learning to solve one in 7th grade. I started to get back into it high school and dropped my solve times down below a minute. Then I continued in college and got down to 25 seconds average with a personal best of 15.15.

I created a 2x2 Rubik's cube in Java as my freshman final project for my second computer science class, but it was quite ugly.

Recently, I decided to take another look at implementing the cube - this time using Python. I also wanted a way to generate cubes and check if they were valid. The main representation of the cube is as a permutation group - <USER2> 48-tuple where each element in the tuple is unique. The solved cube is represented as (0, 1, ... , 46, 47).

Turns of the cube simply permute this tuple. To figure these all out I spent a lot of time with a cube covered in post it notes.

All of the stuff I implemented in the checking for valid cube comes from this stackoverflow post: [https://math.stackexchange.com/questions/127577/how-to- tell-...](https://math.stackexchange.com/questions/127577/how-to-tell-if-a- rubiks-cube-is-solvable/127627)

I've had a lot of fun working with this cube as my personal project. I recently created a Django website and a RESTful API to display randomly generated cubes. Soon I'll be working on a data pipeline to process these random cubes and display them nicely.

I've looked into working on a solution algorithm to implement Thistlethwaite's algorithm - [https://www.jaapsch.net/puzzles/thistle.htm](https://www.jaapsch.net/puzzles/thistle.htm). I think this will take me a while, but it should be doable. I haven't really though too much about implementing it, but I think the way to do it is to define what it is for each step to be completed and then BFS a graph of moves to end up in that state. If anyone has looked into this I'd love some advice!

You can find the code I've written on Github: [https://github.com/elliotmartin/RubikLite/blob/master/Rubik....](https://github.com/elliotmartin/RubikLite/blob/master/Rubik.py)

<comment><USER4> My only suggestion is trying to quickly validate a cube is solvable seems like a waste of time vs generating them via a large number of random rotations. Especially when no cube can be more than 20 rotations from a solution.

<comment><USER3> Some positions are far, far more common than others. So generating a cube by a random string of rotations biases towards these positions. Take a look at the count of positions table in the bottom right corner of this page: [http://www.cube20.org/](http://www.cube20.org/)

Plus figuring out how to implement the various ways of checking validity was a lot of fun.

<comment><USER4> That's a different problem. If you want to check every possibly you don't want a randomized cube. You want the full list.

<comment><USER3> I don't think generating every possibility of a cube is reasonably doable - it's over 43 quintillion - 10^16

Edit: I think you simply didn't understand what I was talking about. The distribution of states is not even. If you randomly perform moves on a cube then you're more likely to end up in certain states.

<comment><USER4> For scale, fastest supercomputer is over 1.8 x 10^17 operations a second. So generating 10^16 numbers is not that bad for a distributed project over a few weeks.

As to the distribution of states, I am not sure what you mean. Insufficient shuffling can introduce bias, but that gets reduced as you continue shuffling. You can trivially shuffle past the point where remaining bias is not detectable. Unless, you want a specific bias, then that's more easily achieved generating a random number with a specific format.

</comment></comment></comment></comment></comment></comment><comment><USER5> Is there a properly colorized version of this PDF floating around somewhere? In particular, I'm wondering about this line that lies above a grayscale image:

      For example, in the picture below, the red square is at FUR, yellow at RUF, blue at URF, and green at ULB

</comment><comment><USER6> Mathologer has a nice video explaining how to solve a cube, and they are really using group theory :),

[https://youtu.be/-NL76uQOpI0](https://youtu.be/-NL76uQOpI0).

The key take away is that all you need to do is find a few basic operations (swapping an edge/corner/center) that leaves the rest of the cube unchanged, and then your job is basically done, you apply these until you have a solved cube.

This might approach might not give you the optimal algorithm, which has been shown to be able to solve any Rubik's Cube in 20 turns or less [0].

[0] [http://www.cube20.org/](http://www.cube20.org/)

</comment><comment><USER7> [https://cube20.org/](https://cube20.org/)

</comment><comment><USER8> There are also these much older (1980) notes on the Rubik's cube: [https://maths-people.anu.edu.au/~burkej/cube/singmaster.pdf](https://maths- people.anu.edu.au/~burkej/cube/singmaster.pdf)

</comment><comment><USER9> I really wish I had the brains to do math to figure out things like the Rubik's cube. I find it fascinating how you can model something like this and express it with math.

<comment><USER10> Not sure if you're referring to cube theory or just the ability to solve... If it's the former, almost anyone can learn to solve a Rubik's cube in a few days (albeit in a non-optimal fashion). It's a matter of learning a handful of algorithms for each layer then executing. It can quite a fun way to keep the hands busy while thinking, like crocheting or knitting.

<comment><USER9> I am talking about cube theory. Solving it isn't that hard unless you want to be super efficient. But formalizing it in way you can then reason about seems very hard to me.

<comment><USER11> Is solving it not that hard?! I chipped away at it for a year before I figured out a (really inefficient) technique.

<comment><USER9> I remember after a few weeks I figured out a move that could swap two pieces without other changes or something like that (don't remember the details). It was horribly inefficient but it did the job.

</comment></comment></comment></comment></comment><comment><USER12> Nice introduction to group theory. I wish my math profs had used some of this material.

<comment><USER13> I was a second year undergraduate math major at Caltech when the Rubik's Cube came out in the United States, and they quickly seemed to be all over campus.

Second year was when we took the intro to abstract algebra course. One of the requirements my professor had was that we each had to do a term project involving material from the class. I couldn't think if anything interesting, so went to to see the professor to see if he had any suggestions for interesting project areas.

He simply said "The answer is in your hands". I looked at my hands, and realized I had been carrying my cube with me. Oops. I hadn't even figured out how to solve the stupid thing yet, let alone understand anything mathematical about it, and now my grade would depend on understanding it? DoH!

One of the first people at Caltech to figure out how to solve it was Peter Shor. Until there were a fair number of other people who had figured it out, Peter was nice enough to make a nightly circuit of the student houses solving people's cubes for them.

I remember one strange night when Peter came around right as several of us where wondering if some particular thing was reasonably do-able. The group wondering this also happened to be high on LSD at the time. (To be clear, Peter was not tripping. He just encountered the tripping group on his nightly cube solving circuit).

Both Peter and one of the tripping people started working on the problem. The strange thing was that the tripping person was not a theory guy. He was a strictly experimental cubist. But for some reason he was just staring at his cube thinking about the problem.

And Peter, who would usually figure out these things with theory instead was just furiously trying things.

Peter and the tripping guy both solved it at the same time, while the rest of us wondered if we had entered the Twilight Zone.

</comment></comment><comment><USER14> dogschool.tripod.com</comment>


Four interacting decisions break ssh access - <AUTHOR> http://rachelbythebay.com/w/2018/03/20/sshclock/ <comment><USER2> There are also other options that can break SSH access just as easily (AllowGroup being one prominent example). The whole thing is _too brittle_ to be used exclusively as user-facing service ("build server" where users log into and run build jobs), file server (scp/sftp), server debugging channel, and configuration distribution method.

For servers administration at least one more channel is a must, and CFEngine (and as a derivative, Puppet) got that right, while Ansible did the dumbest thing, because "agentless!" (though you still have an agent on the OS' side, it's just overloaded with other functions).</comment>


Bill Gates: the robot that takes your job should pay taxes - <AUTHOR> https://qz.com/911968/bill-gates-the-robot-that-takes-your-job-should-pay-taxes/ <comment><USER2> Your computer replaces many things that you used to have to pay others to do.... Should it be taxed like a person, too?

Software replaces many things that I used to have to pay others to do. If we follow the same logic, I should be paying taxes for every little thing that I use software for, too?

I'm filing my taxes for free instead of paying someone. I'm planning my vacations by myself instead of with a travel agent. I'm shopping for a house without a realtor. I even took photos without hiring a photographer! I record and edit videos without a videographer. I learned how to renovate my house without going to a contractor.

Robots are an improvement, and should not be impeded!

</comment><comment><USER3> I think the world will eventually reach an equilibrium where humans, and commerce, will simply (because of technology) be so much more efficient / effective than they are today, it will make it possible for governments to be as effective at fulfilling the needs of its people (if not more so) with orders of magnitude less tax.

In the meantime I think the human race will be in a sort of gray area. Maybe it'd be a good idea to implement some sort of "robot tax" for that duration.

</comment><comment><USER4> Why don't we spend efforts towards making EE/CS a blue collar job? Why tax people who are innovating?</comment>


Mind benders: List of paradoxes - <AUTHOR> http://en.wikipedia.org/wiki/List_of_paradoxes

<comment><USER2> What's an anagram for BANACH TARSKI ?

BANACH TARSKI BANACH TARSKI.</comment>


The Impossible Job: Inside Facebook's Struggle to Moderate Two Billion People - <AUTHOR> https://motherboard.vice.com/amp/en_us/article/xwk9zd/how-facebook-content-moderation-works <comment><USER3> Facebook didn't need much moderation until it started allowing strangers to enrage each other through public comments.

My experience on FB is that 100% of the value of the platform comes from parties I choose to engage with (friends, local businesses, groups), and almost all of that value is wiped out by having to see comments from trolls.

<comment><USER4> What do you mean by "trolls"? Someone who disagrees with you? Like half the country is "trolls"?

And what stops you from simply unfriending these trolls, if they are so toxic?

I'm not buying that narrative at all. What I think actually happened is that groups of people always had irreconcilable differences, but these groups were mostly physically separated, because people tend to form bubbles of like- minded people. But then FB came, and everyone's opinions became visible. Half of your coworkers that you went out drinking with turned out to be Trump supporters or antivaxxers, and that just makes you and them angry.

The solution is to stop demonizing the other side, and start having rational conversations. But good luck with that.

P.s. Calling them "trolls" will only drive them further away from your politics, you're helping Trump to get reelected.

<comment><USER5> I completely disagree. I grew up as the outsider in the south - <USER2> ideology, atheist, etc. Through the Clinton, Bush, and Obama eras it was No Big Deal. I'd have spats with friends and neighbors, and they'd end friendly. In South Carolina I went from being called the "n-lover whiteboy" to convincing my white friends that my black friends are just as cool, and have good BBQs. We'd all disagree with eachother, but it'd be respectful. Online and off. This is when Facebook/Myspace is just coming out, and "normies" are learning about interacting online, and about how easy it is to forget about the face on the other side of the screen. Even there it wouldn't flare out too horribly.

Something's different, these last few years. Sometime around the tail end of the Obama era is when I began noticing it, that it wasn't a "political disagreement," it was a fundamental inability to reconcile values. It was "freedom of speech vs political correctness," it was "nazis vs antifa," it was "black lives matter vs all lives matter." People getting mass-defriended on facebook, me being mocked by my southern friends for my liberal values (that are the same as they've always been). Things have gotten _far_ more divisive, and if I had to make a guess, I blame the political organizations paying trolls to disseminate divisive fake information across the internet, and prominent politicians engaging in disgusting divisive language (Duterte, Le Pen, Trump, Netanyahu, Erdoğan, ISIS high-production-videos).

<comment><USER6> Maybe you're right. I wonder how much of it is non-stop political articles in our faces if we consume social media combined with the fact that we rely so little on our neighbors and friends because we don't have to so understanding and sympathy skills have plummeted.

On the latter point I wonder if lower human social contact and ease of escape online means lower tolerance towards differing opinions, or even things we deem wrong. It feels more and more like typed opinions are people shouting into the sky, and when disagreed with they get offended and lash out or they say "you're not who I was referring to," almost like that racist grandma stereotype.

<comment><USER5> I'm not sure. I remember having the realization in ~2015 that you aren't allowed to be a moderate, in ANY discussion, on reddit (back when that was the only forum I used regularly). Be the discussion about racism, police brutality, or even whether or not sourdough should be steamed when baked. You are RED or you are BLUE. And if you're BLUE, you're FULL BLUE or you're a nazi.

So like I'd come in talking about being a 3rd party voter and get shit on. Or about how there may be middle ground, on, say, gun control, and get downvoted to obvlivion.

I don't know, polarization is powerful, I guess. I mean, it seems absurd to me that the 300 million people in this country are literally split black and white down the middle on all issues. Surely not. It defies logic that 150 million all perfectly support total access to guns while also opposing all forms of abortion while also hating all forms of welfare (this definitely can't be possible because shitloads of republican voters are on welfare). So, something's up. My guess is that it behooves those in power to keep the population divided? No idea.

</comment></comment></comment></comment></comment><comment> j-c-hewitt The risk with this is that eventually it will erode Facebook's legal argument that it isn't responsible for the content that its users post to the network or share through Facebook Groups.

As it is there are tens of thousands or even more Facebook groups dedicated to some kind of either illegal, rights-infringing, or grey market activity in the US alone. The more that Facebook holds itself responsible for moderating and controlling that content, the less weight that Facebook's arguments that it is just a dumb pipe will hold. This has been going under-remarked relating to this cluster of issues.

Strongly doubt that FB or any similar company will successfully navigate this issue in the long run.

<comment><USER7> They definitely screwed up how they handled the crises. Zuck & Sandberg's apology tour has made them responsible for any future liability or slip ups which are inevitable given the size of operation.

There were 4 separate issues

1\. People posting fake news

2\. Recommandation serving fake news due to similarity

3\. Apps stealing data

4\. Advertisers able to target vulnerable audience

They should have kept these issue absolutely separate and taking responsibility for all but #1. They should have stayed very firm on not accepting blame for what people decide to share on their platform. Instead they ended up accepting blame for everything and now they are screwed.

<comment> j-c-hewitt Right. This is a giant multi-billion dollar target that is increasingly portrayed as a machine for the mass production of liability. People seem to be under the impression that internet companies putting themselves under the cloak of free speech came purely from 'idealism.'

The real reason is to avoid being Napster'd. How can FB turn around to a copyright holder and say "Ha ha, this content is totally not something we take responsibility for -- you should take it up with the user" if it is actively policing content on the platform with an army of staffers and actively shaping what people can and cannot write on the platform? That looks a lot more like editorial behavior than 'moderation'.

It's different when it's just automated systems that are dinging people for potentially posting copyrighted material or a snuff film. The system doesn't exercise human judgment on an active, day-to-day basis. To the extent that services like FB took a hands-off approach had much more to do with avoiding liability than any iron moral commitment to allow people to share flat earth and lizardman related content.

</comment></comment></comment><comment><USER8> Why do social networks have to be so big and centralized?

Because we don't have good open source software like Wordpress for blogs that people can install and manage their own networks on their own servers. And why? Because a social network is far more complex than a blog, including contacts integration, permissions, realtime notifications and so on.

[https://m.youtube.com/watch?v=pZ1O_gmPneI](https://m.youtube.com/watch?v=pZ1O_gmPneI)

<comment><USER9> Notabug.io is doing good work in this area. It's a reddit-alike with a distributed architecture. It has federated nodes hosting the website but also the in-browser client distributes posts p2p between nodes in the federation. Additionally, voting is proof of work based.

It's the early days now and the lens/filter system for individual users hasn't rolled out yet but the idea and implementation are far ahead of anything else I know about.

</comment></comment><comment><USER10> > The Impossible Job

Leads me to two possible conclusions

1) Facebook gets a free pass to ignore the law because 2bn members requires x million moderaters and that doesn't make economic sense, is hard etc.

Or

2) Facebook has to abide by the law, and since it doesn't make economic sense...Facebook closes.

<comment><USER11> The question is whether Facebook is a communications company or a media company. Are they like GMail, where they aren't responsible for everything that goes through their pipes, or are they like Vice, where they clearly are?

Facebook obviously wants the publicity of a media company _and_ the legal protections of a communications company. Which is obviously stupid, but that's the weird situation we're in.

<comment><USER12> Facebook also obviously thinks of themselves as a tech company first and foremost, so the question of moderating and scaling moderating is considered almost solely from the standpoint of it being a technical problem.

The problem is a social and human one. Newspapers have traditionally handled it with editors and people and human policies. Facebook isn't inclined to explore editors and people and human policies, not because they don't scale or we don't know how to scale them (Wikipedia has scaled relatively okay, for what that is worth as an example; Newspapers have used editors and researchers for a long time), but that it's not an interesting technical problem to scale people.

Facebook even had people hired in some of these moderation roles for a while, but it was sexier for them to use essentially blackbox algorithms that turned out were easy to game by malevolent entities. Now they only seem to question "fixing" the blackboxes rather than finding solutions that use smart or trained people.

</comment></comment></comment><comment><USER13> >For example, its revenge porn policy and recently created software tool—which asks people to preemptively upload nude photos of themselves so that they can be used to block anyone from uploading that photo in the future—was widely mocked.

This is hilarious. I understand the logic, but to believe that users will willingly submit nudes as a preemptive measure seems to widely underestimate the ramification of the user's decision-making process, and the reliability of Facebook when it comes to user privacy protection. Hey, let me upload my nudes to a Facebook software, they've been handling privacy really well so far, said no one ever.

</comment><comment><USER14> Part of the problem is Facebook doesn't want anyone to have a negative experience because those people disconnect, at least temporarily.

I can go on Facebook, praise Hitler, and get likes. I think that skews peoples' perception of what's acceptable and what's not. Maybe Facebook needs a way to give negative feedback.

It's such a hard problem though. The quantity over quality friend groups everyone has now makes it difficult to trust others. When I was growing up, if one of my good friends disagreed with me it was a good indication I needed to reevaluate my opinion. I think that's been lost.

<comment><USER15> I'm not sure that is really facebooks problem. If I saw you praising Hitler, I'd unfriend you, so it's not like there isn't social consequences on Facebook.

I think the real issue is the users. I mean, Facebook makes it easier to find people who are like you and believe the things you do, but Facebook didn't make you believe the earth was flat.

The fact that people believe the earth is flat shouldn't be blamed on social media, because it's a much bigger problem than that. Those people have managed to grow up wrong, with terrible education and horrible life choices, and maybe they find each other in groups on Facebook but they sure weren't made this way by the internet alone.

<comment><USER14> I think Facebook has some responsibility because they're such a large platform. The problem is constant positive reinforcement of everything, even things that are unacceptable. Part of the reason those people grow up "wrong" is because they're growing up on social media where the feedback they get is unnaturally skewed to agreed with them.

I don't think it's intentional, but I think it's going to be impossible for Facebook to solve with watered down feedback like the "empathy" button. They need a way for people to express disagreement, but it's going to be difficult to do that without reducing engagement, so it probably won't happen.

</comment></comment></comment><comment><USER16> If Facebook's revenue was not tied to keeping people accessing the service enough to see ads to prop up the stock price, then they would have more options. Maybe they should consider charging instead of serving ads. But it would likely reduce their overall revenue.

</comment><comment><USER17> Think about the scale of 2.2B users. Imagine how difficult it would be to moderate just America. Now imagine handling 6.8 x America. Or 1.6 x China or India. That is a massive undertaking for any centralized entity. Probably bigger than many countries national security efforts to feasibly implement. Is it really worth it to Facebook when their primary concern as a corporation is their bottom line?

<comment><USER18> In which case the argument becomes

"If a platform/service provided by a corporation becomes large enough to credibly threaten the fabric of society and/or government, and said corporation won't tamp down on said problems, should they be allowed to exist?"

</comment></comment><comment><USER19> The impossibility is not just a problem of scale.

Even if Facebook does everything right, and moderates every single thing they aim to moderate, they will still be blamed by conservatives and/or the alt- right if they censor too much, and by liberals if they censor too little. There is no type of moderation that will make all sides happy.

<comment><USER20> Wait, so the _conservatives_ want less censorship and the _liberals_ want more censorship?

Is this one of those mirror universe things?

<comment><USER21> To be fair it has flipped considerably, if you consider the extremists in each group.

In the 2000s the extremist conservatives wanted to censor everything (mostly due to religion) and liberals wanted freedom of expression.

Now it seems that extreme liberals want to censor "hate speech" which is absolutely valid, however the lines are moving or getting blurry to the point where they want to censor conservative ideas altogether, and conservatives want "freedom of expression".

I've seen this shift and I'm sure many others have as well.

</comment></comment></comment><comment><USER22> Impossible only because they have underpriced the service. The notion that only good things will happen when you create a context and let humans interact is at best naive. In this case, I think it's willfully blind. I was talking recently with people who set up the first web-based chat; abuse was almost instant and they what we'd now call a doxxing within the first year. And they were hardly the first people to see abuse happen online.

In the real world, if you want to have something as anodyne as a parade, you have to provide for sufficient security to keep things safe. There's no reason that companies pocketing billions in profits should be exempt from this principle.

</comment><comment><USER23> The thing that makes it hard is differing cultural standards between parts of the world. You either acknowledge them and push moderation decisions down as far as possible to local authorities, users, and group moderators or (what they seem to be doing) build an authoritarian, culturally-imperialistic global AI censorship algorithm that makes people mad and (hopefully) causes them to leave.

</comment><comment><USER24> The smartest engineers in the world have been figuring out how to make people click on ads. If they have to figure out how to quell genocidal movements I think that's an improvement.

</comment><comment><USER25> Not impossible, impossible for hoards of humans.

This is going to be a major use-case for AI, which can scale to billions of people.

<comment><USER26> The real solution is probably hybrid (i.e. AI-assisted human moderation).

I've assisted with moderation for a bunch of communities over the years, and IMO the problem isn't that there's not enough humans — for every bad actor in a community there are _many_ good ones — but that Facebook doesn't provide good actors and moderators with anything beyond the most basic tools imaginable. Had Facebook invested even 1% of their resources into this, I don't believe that Facebook would be the raging culture infection that it currently is.

<comment><USER27> So I've never managed a subreddit or a Facebook page/group. I once managed a forum where my options were to Delete and Edit comments, but I only used Delete and would message the user why, it was a small forum though so if it were say, 3x or 5x larger I'm not entirely sure I could have moderated the entire thing by myself.

I'm explaining my ignorance on this subject matter because I want to ask you, and you seem like someone who might know, how do Reddit's and Facebook's tools compare? From my point of view, Reddit is pretty well moderated, each sub having its own rules that at least in the subs I frequent, are actually fairly well moderated. They have tools like automoderator and I've heard of subs I don't frequent preemptively banning users for having too much karma in subs they dislike. Probably overkill, but given the types of communities they are it seems to work for their purposes regardless of whether I agree with them or not.

If I look at a comment thread on Facebook, there doesn't really seem to be any kind of conversation happening, just "conversation". There's some basic threading now but even with that a Facebook "conversation" seems to just be one long string of human consciousness.

Now there is a difference in scale, Facebook has over a quarter of the Earth's population on its platform. That said, there is also a difference in scale between Facebook's resources and Reddit's, so is there some reason they choose not to develop new and better mod tools? Or are their mod tools cutting edge already and the percentage of humanity on their platform is just so large that even with cutting edge mod tools it just isn't enough and throwing more money at it doesn't make it any less _hard_?</comment></comment></comment>


We are the Zappos/Newegg of 3D Printing - <AUTHOR> https://FileNimbus.com

<comment><USER2> Zappos and Newegg are not similar enough for them to be slapped together like that, unless you just mean "successful specialty retailer"...

Otherwise, what makes you like them? Zappos has a bold, trusting, happiness- oriented company culture. Other than that, they're just a retailer. Is your culture like theirs?

Newegg became successful due to expert product reviews, great customer service, and a wide range of inexpensive products. Is that what you're emulating?

<comment><USER3> why not both? /s</comment></comment>


Launch Festival co-working space for startups in Los Angeles - <AUTHOR> http://festival.launch.co/cowork/ <comment><USER2> Was this the Mahalo office?</comment>


Ask HN: Recommendations for a SOLID laptop - <AUTHOR> I have an 8 year old Gateway laptop - a very unpretentious machine, that I bought at Walmart; it was cheap, slow (even for 2008) - and extremely solidly built! Now, as the machine is about to go to the Great Landfill in the Sky (the hard-disk is dying and the overall value of the computer is less than a new disk), I've started to look around for a similar replacement. Unfortunately, everything I could see and touch at Best Buy is either a) cheap, but extremely flimsy, compared to my old Gateway or b) nicely built, but way too expensive (for the replacement, I have a budget of just a FEW hundred dollars).
Do you have any suggestions for me?
Observations:
a) A chromebook is not a suitable replacement for this machine;
b) When I say "solid" I mean the complete opposite of "flimsy"; it could be heavy, I don't mind (at most, I'll move it from one room to another), so weight is not an issue (as aren't processing power - an i3 or equivalent would be sufficient - or sufficient RAM - 8GB would be great, but I'd be willing to go for 4).
Your insights in this matter are greatly appreciated! <comment><USER2> Dell sells refurbished/off-lease laptops which are solidly built, at: [http://dellrefurbished.com/laptops](http://dellrefurbished.com/laptops) (They also sell refurb'd desktops, servers and monitors).

The machines are a few (3?) years old, but they are solidly-built business- class machines. So you should be able to find something that suits you -- you can use checkboxes on the left to filter the results to include only machines with the features you are interested in.

Note that the regular prices there are high, but at least once a month they have a 40% - 50% off sale, often with discounted or free shipping, if you have a code. These deals are posted on fatwallet.com, in the hot deals forum, and no doubt elsewhere as well.

Here's an example of some machines that were available around the beginning of June, just a few weeks ago ( [https://www.fatwallet.com/deals/40-off-any-dell- laptop-28905...](https://www.fatwallet.com/deals/40-off-any-dell- laptop-2890577) ):

 _Dell Latitude E5520 4GB RAM 250GB HDD - Was: $329.00; Sale: $309.00; After Coupon: $185.40

Dell Latitude E6430S 8GB RAM 320GB HDD - Was: $479.00; Sale: $429.00; After Coupon: $257.40

Dell Precision M6600 4GB RAM 250GB HDD - Was: $1,319.00; Sale: $1,169.00; After Coupon: $701.40_

I'd expect another sale to come up around July 4th, so you might want to keep an eye on Fat Wallet (or the like).

</comment><comment><USER3> I've pretty satisfied with the Clevo laptop I got from Mythlogic--it's a pretty solid build. Not lightweight and flimsy. Survived a fall from the back of my bike onto the pavement (in a bit of padded slipcase). Of course, not being cheaply made means not being especially cheap to buy, either. I got mine a couple of years ago--not sure what the current offerings are.

</comment><comment><USER4> The 14" Thinkpads (T41?) sound like a fit, as well as the 15" MacBook Pros (though those may be too expensive). Also, you could look into the Dell XPS 15, or the Asus Zenbook UX501.

</comment><comment><USER5> Thinkpad, possibly a used/refurbished one. (powerful enough, cheaper, more robust)

<comment><USER6> Second this. Get a used T60/T61/X60; and put a SATA2 SSD in it. They're excellent build quality, albeit the CPU and GPU is dated (~2007-2009)

<comment><AUTHOR> Thanks, I hadn't considered that. Are those open-box computers or ex-lease ones? (big difference when it comes to wear and tear!)

<comment><USER6> I'd imagine they come from various sources, most ex-corporate, but some ex- personal. I'd expect them to be too old for true 'open box'.

</comment></comment></comment></comment><comment><USER7> ThinkPad T or W series, if Panasonic still makes Toughbooks you could consider those.

<comment><AUTHOR> Toughbooks - they used to be quite expensive - anyway, a Toughbook would be an overkill (as I don't plan on going Desert Storming or something).

Thinkpads: a 14" i3 with 4GB of RAM is $829.99 in my neck of the woods (yeah, the joys of buying computers in Canada...) Way too expensive.

<comment><USER7> Oh, I missed the "few hundred dollars" requirement. That's far more constraining than your toughness wish.</comment></comment></comment>


UTF-8 History - <AUTHOR> https://www.cl.cam.ac.uk/~mgk25/ucs/utf-8-history.txt <comment><USER2> Does Cambridge know about this open directory? [https://www.cl.cam.ac.uk/~mgk25/ucs/](https://www.cl.cam.ac.uk/~mgk25/ucs/)</comment>


Zomato security breach: 17M email addresses and hashed passwords leaked - <AUTHOR> http://blog.zomato.com/post/160791675411/security-notice <comment><USER2> It won't be appropriate to paint every Indian company with the same brush, but I knew one that was in a professional spamming business who slyly marketed themselves as an "email marketing company". The business model was to —

1) Lure employees of big companies (especially e-commerce ones) with cash and buy email dumps of their users. I don't think email security was something many companies were vigilant about. 2) Send email campaigns for their clients, which included other e-commerce companies, colleges, and travel agencies.

The business, as I remember, was quite profitable. I can't say if something like this is at work here but there's a healthy black market of buying email lists.

<comment><USER3> Someone who owned and operated a globally blacklisted spam company came to power in Delhi, ironically on an "anti-corruption" message. Ethics aren't part of contemporary social contracts in India.

See "Somnath (Spamnath ?) Bharati".

<comment><USER4> Come on, please don't single him out. Who will pay attention to the drama queen?

</comment></comment></comment><comment><USER5> I'm curious about how the hack occurred.

With the recent Hipchat hack, it is unclear if the login server was compromised or the database dump was obtained some other way.

If the Hipchat webserver that handles sign-in attempts was the one compromised, which is what I've been lead to believe, then it doesn't matter how the passwords were hashed. The plain-texts would be exposed in the majority of use cases. Sure, the DB data could also get stolen triggering reporting requirements in organizations with controls, but that may be less of a concern at that point.

</comment><comment><USER6> >The hashed password cannot be converted/decrypted back to plain text - so the sanctity of your password is intact in case you use the same password for other services.

What? Hashed passwords can definitely be cracked for a significant percent of users.

<comment><USER7> If they are simply hashed, rainbow tables can be used to crack them. Password must be salted preferably using bcrypt or something equivalent.

<comment><USER6> A rainbow table is not necessary to crack passwords, and is not able to crack all passwords (even if not salted).

And even if salted, a regular (non-rainbow table) attack will crack some passwords.

</comment></comment></comment><comment><USER8> Couple of things are pretty apparent from the post: 1\. Why would compromised developer account cause such a hack? Unless they don't have proper data control in place for production access.

2\. The line about how "payment" related information is under PCI DSS compliant shows how these guys are running their business. I frequently see people, who are confronted about not following some form of compliance or hack, argue back on "segregation" of compliance. They say - X data needs (or was) to be compliant while Y doesn't. Sure not everything needed to be PCI DSS compliant but why not have better practices?

3\. What about PII (Personally identifiable information) data they collect? Isn't that supposed to be rigorously protected? It seems they believe only payment and passwords are of use to hackers.

</comment><comment><USER9> _sigh_ I really wish these kind of notifications became a lot clearer about what actually happened and what the user is supposed to do.

Their message is: (Ignoring the update on top):

\- Para. 1: Marketing bullshit

\- Para. 2: Short blurb about what happened

\- Para. 3: Incomprehensible techno-babble for the average user of their service, ending with an important action point (however, I suspect most users' eyes would have glazed over by now)

\- Para. 4: A random note, again with important info in the tail.

\- Para. 5: Something about what they have done that will cause user impact, mixed with some more about their internal remediation, and the suspected cause.

It goes on, but I'm already bored.

Instead they should clarify their format:

\- There has been an incident that resulted in an unknown 3rd party getting hold of your email address for this site, and a scrambled version of your password. This may impact you in the following ways:

\-- There is a strong possibility that the thieves will be able to unscramble your password.

\--- _If you use the same password here as you do with other websites, you should change your password on all those websites immediately_ See the end of this notice for more assistance and information.

\-- We will automatically change your password for our site, and this means you will have to [insert process]

\- We are taking the following steps to ensure this isn't going to happen again:

\-- Step 1

\-- Step 2

\- We have reported this incident to the relevant authorities.

\- For the next x months we will contract with service y to track if any of the stolen data will surface, and will inform you if this happens.

\- We recommend that you use a password manager. please see [link] for a handy guide on how to choose and get started with a password manager.

\- You can always reach us via [channels] to discuss this issue further. If any part of this message isn't clear, please click [here] to chat with one of our support staff.

\- Apology.

\- More background details, etc.

</comment><comment><USER10> They should mention if the passwords were salted or not. Just saying the passwords were hashed isnt sufficient.

<comment><USER11> They do mention it:

"We hash passwords with a one-way hashing algorithm, with multiple hashing iterations and individual salt per password."

<comment><USER12> So is my password safe?

<comment><USER11> Maybe, if they are being truthful. Hopefully you don't share it with another account on another site.

<comment><USER13> > Hopefully you don't share it with another account on another site

Bluntly, for a user of a site like this in 2017 there is simply no excuse for sharing passwords. In ops we used to say "If it's not backed up, it doesn't exist" \- and I think a modern corollary could be "if your password isn't unique per site, then no, it's not safe". If you reuse passwords, your security is only as good as the weakest site you used it on, and you are playing with fire.

Just go and buy 1password (or similar) and use it.

</comment></comment></comment></comment></comment><comment><USER14> They used a 2 alpha character salt with md5 as the hash algorithm. Thats pretty bad

</comment><comment><USER15> Such notifications are becoming routine.

Seems to me that you need to design your systems around the question of "how can the problem be minimised when our systems get hacked".

<comment><USER16> Many people came to the same conclusion during the WannaCry malware attack. I'd suggest taking a look at those threads fpr related discussion.

<comment><USER17> "We really need to invest in technical security" \- Everyone after WannaCry

"We really need to invest in technical security" \- Everyone after Heartbleed

If the end-user doesn't notice it, it's barely budgeted for by the business bods.

We're condemned to repeat history, much to my own chagrin.

</comment></comment></comment><comment><USER18> Whenever a company says "one way hashing algorithm" without specifying the algorithm, we should all assume it's MD5.

<comment><USER19> They did say multiple iterations and individual salt. Of course, it's easy enough to do with md5 but that sounds like a good description of bcrypt out of the box.

<comment><USER20> If someone is using bcrypt, it will be declared early and often. This sounds like multi round salted MD5 or SHA1.

<comment><USER14> md5

</comment></comment></comment></comment><comment><USER21> One of the key issues with this type of leak is where people use the same password in multiple sites (check out the data in [https://haveibeenpwned.com](https://haveibeenpwned.com) as an example). They should recommend resetting the passwords they used at Zomato in any other apps/sites.

</comment><comment><USER22> "A layer of authorisation will be added for internal teams having access to this data to avoid the possibility of any human breach." \-- First of all it is not hacked. Data is just stolen by someone internally. Above statement proves that. And they are not a startup.

</comment><comment><USER23> We need password managers and use unique 20 digit password (or max allowed) for each login. If it's online, we need to assume that it will be hacked in time.

</comment><comment><USER24> Development environments with access to live data. Tasty!

</comment><comment><USER25> Are the hashed passwords salted? If not, then the claim that the "password cannot be converted/decrypted back to plain text" is not defensible. Either way, including such an unclear statement in a security notice is troubling.

<comment><USER26> Did you even read the post? It clearly says: "We hash passwords with a one-way hashing algorithm, with multiple hashing iterations and individual salt per password."

<comment><USER27> Why do they say this then:

> We however, strongly advise you to change your password for any other > services where you are using the same password.

<comment><USER28> It is standard practice to include such a statement. If they said you were safe based on their practices, then it turned out there was a bug in their code or a library that exposed you, that would be really really bad.

<comment><USER29> Salting is irrelevant to making such a statement. For instance, some users probably have their password set to "zomato1234" or "passw0rd" or (anything in the next 10000+ most common password patterns). Salted or not, it's very feasible to perform that kind of analysis on the leaked data, find weak passwords, then use them with that user's account on other sites.

</comment></comment></comment></comment></comment><comment><USER30> Lack of which security measures might lead to this?

<comment><USER31> In the post they mention the probable cause is a developer account which got compromised. One of the most important rules of most security frameworks (including PCI DSS) is segregating access between development and production: developers are not supposed to be able to access production data. I suppose this rule was not followed here - or an alternative mitigating control (which can be applied instead of the rule above) was not good enough to prevent this.

</comment></comment><comment><USER32> Frankly this is to be expected when "developers" working on these projects tend to be script kiddies more concerned with UX/design rather than solid architecture engineering. When backends are thrown together as an afterthought in node, piled in bunch of 3rd party services and things just hacked together ... well this is exactly results one would expect.

<comment><USER33> Is there a correlation between the size and experience of a company and it's engineering team or technology choices and the likelihood of it being hacked? Tiny startups get hacked, and billion dollar corporations get hacked, and businesses of every size and shape in between get hacked. 'solid architecture engineering' might be a defence (although even the best engineered backend has very human weakpoints), but whether or not a business has a pretty UI and a node based backend is hardly a signal of how good the engineering might be.

<comment><USER34> I agree that technology choices are not the best signal to use.

They're one of a variety of primitive proxies for engineering culture, depth of talent and "process maturity". IMHO there is a weak correlation with team size, but a strong small team with good culture can of course outperform a large team with worse organisational culture.

As you scale a team you get more capability, but there are more bases to cover and more value to protect. Some points along the appsec spectrum of practices and culture:

At very small team sizes, reviews of pull requests with some minimum number approvers, plus a culture of responding to comments and enough expertise on the team that _someone_ recognises basic issues like "we shouldn't store passwords like that" or "maybe we shouldnt chuck a url parameter straight into window.location here".

Small-medium, some level of technical leadership and design going into features with security as at least a consideration. Maybe a budget for limited code reviews / pentesting now and then or someone on the team with a constructive focus on security. Some automation with mostly free tools. Issue tracking for security defects and sane priorities.

Further along / large: employees who conduct security reviews (e.g, devs cc on prs and some spelunking), pentest and work with developers during the design phase. Plug tools like static analysers, scanners / runtime analyses into ci & test envs. Conduct threat modelling. Run regular training for developers. Have devs who work on code safety (like wrapping unsafe libs or fixing bugs in key dependencies). Use an artifact repository and stay on top of bugs in dependencies. Maintain internal checklists and a security knowledge base. Sane metrics and reporting (this is surprisingly hard). Conducting 360's where you track down the root cause of bugs and see where you can stop it happening again. Processes for dealing with bug reports (security@). Bug bounties. And more.

Although all sizes of company experience a variety of incidents, where you see problems is when engineering maturity isn't commensurate with the value of the data / transactions / assets / brand.

</comment></comment></comment><comment><USER35> I did not know that Zomato was Indian.. nor am I quite sure why it matters that they are? Breaches are common everywhere and at least these guys (apparently) salt, etc.

<comment><USER36> > at least these guys (apparently) salt, etc

It seems the salt was stored in the database itself.

[https://twitter.com/sajal_thomas/status/865134165288599553](https://twitter.com/sajal_thomas/status/865134165288599553)

<comment><USER37> I don't see anything in that Twitter thread indicating where the salt was stored, but salts are actually supposed to be stored next to the password hash. They purely try to prevent precomputation of password hashes by introducing a random value per password, and that works just fine by putting them next to the hash.

Today, of course you shouldn't be manually maintaining salts and instead use a proper PBKDF (which indeed uses a salt, which is stored alongside the hash).

</comment></comment></comment><comment><USER38> Zomato is almost 10 years old, hardly a "startup".

</comment><comment><USER39> That'll teach them to outsource development to Africans making a third the wage!

<comment><USER40> If you provided more information and facts (if it's really true) on this matter besides emotional accusation, you'd get upvotes instead of downvotes.

<comment><USER41> Irrelevant, since he's correct. I've actually known an ex-Zomato employee who's said the same thing, this is the first time I've heard strangers mention it though.

Upvotes do not determine if information is true or not, and there's plenty of people out there who aren't the least bit concerned with whether or not HN upvotes them.

Tangentially, I don't think outsourcing is really that big of a deal. LOTS of companies do it, and it's easy to get bitten by it, but it's also easy to check over what they bring back, as well. I'm not trying to make a case for excusing this incident, as they could have very easily dedicated some dev time to quality check the code (if it's the code that they outsourced in the first place, which we don't know for sure or not) so there's really no excuse for it. People in the states outsource to india, people in india outsource to africa or south america, people in africa probably have some place they outsource to, maybe china or something. It's an economical oddity, not a moral dilemma, imo.

<comment><USER42> _people in africa probably have some place they outsource to, maybe china or something_

Companies in South Africa outsource to India quite often. Africa is huge, and hard to generalise about.</comment></comment></comment></comment>


Standard Markdown is now CommonMark - <AUTHOR> http://commonmark.org// <comment><USER2> I kind of hope that Mark Pilgrim (of diveintomark.com fame of days past) now complains that this dilutes his brand.

</comment><comment><USER3> There seems to be a lot of hostility from both sides now.

" _Are the Yankees the best team in baseball? We used to think so._ "

<comment><USER4> I understand that hackers tend to be irascible often, especially online, but parting shots like these are in very poor form. Consideration and goodwill tend be diminished when you can't be graceful no matter what the other party said. Especially considering that other party was originally the impetus for this in the first place.

<comment><USER5> You also have to consider the other party was subtweeting all day and calling people dicknoses.

</comment></comment></comment><comment><USER6> Needs either "Markdown" in it or go away with something completely different. This is confusing and the worst of the name choices.

Edit: Suggestion: BetterGruber

<comment><USER7> They were denied (by Gruber) the choice to use anything with "Markdown" in the title.

EDIT: source: [http://blog.codinghorror.com/standard-markdown-is-now- common...](http://blog.codinghorror.com/standard-markdown-is-now-common- markdown/)

<comment><USER6> Fuck Gruber they should go with something totally different and Markdown will be forgotten. Win.

<comment><USER8> 1\. The guy invented it, like or not, he can do whatever he wants with it.

2\. He actually said that he would like them to go with some new name and see if it takes off, which I think is fair and I don't get the whole fucking drama. Just come up with a name.

<comment><USER6> 2\. How about "DeGrub", could even be used as a verb...

<comment><USER9> Or ReGrub - which has the awesome advantage(?) of being "burger" backwards ...

</comment></comment></comment></comment></comment></comment><comment><USER10> I think that it would be appropriate to simply forget the "Mark" parlance and Gruber all together.

Everyone understands there is a Markdown ecosystem, but quite frankly this is the start of something new.

End-users also need an easy to follow name and site to learn the syntax.

I like the names SmartText or SimpleFormat or even perhaps CommonMarkup.

<comment><USER11> It isn't something new, it is a strongly specified, highly compatible implementation of Markdown. As seen in "common" use on large websites. And any implementation that passes the current spec tests can also brand itself with CommonMark or "Markdown compatible".

<comment><USER10> Mr. Atwood, you may be too kind. I see this as a chance to bring Markdown to a larger audience by not only standardizing it, but also renaming it as well.

In this endeavor it would appear that you are giving too much credit to Gruber. It is unfortunate that he was not one to be more gracious in the matter.

</comment></comment></comment><comment><USER8> "naming things and cache invalidation"

</comment><comment><USER12> Is there anywhere to file a pull request for the commonmark.org website? The "Discuss" button still links to talk.standardmarkdown.com.

<comment><USER13> That's still the main discussion area for this project

<comment><USER7> Atwood said he'd shut it down (point 3, near the end):

[http://blog.codinghorror.com/standard-markdown-is-now- common...](http://blog.codinghorror.com/standard-markdown-is-now-common- markdown/)

<comment><USER11> This (discussion area) is the hardest bit to change, the rest of the domain is shut down. Will happen soon.

</comment></comment></comment></comment><comment><USER14> Was CommonMarkup considered?

<comment><USER4> This comment should be higher. CommonMarkup gets rid of the naming hiccup by having no direct ties to the original spec except syntax, which is arguably a dialect anyway. Atwood gets to have One Syntax to Rule Them All - I sincerely doubt Atwood wanted Yet Another Markdown as he said - and the community benefits from having the syntax ambiguity resolved by comprehensive reform.

<comment><USER15> 'Markright' (adopting another direction other than 'up' or 'down) or 'Markwrite' (implying natural-language composition) would have been other interesting choices. Or even 'Markround' (completed/balanced like a circle).

Each is closer in spirit to the original – a "mark-up" with a different spin for ease or correctness – and close enough in sound/rhythm for drop-in replacement use. And, each is still different enough to avoid any unearned implication of official Gruber-ness.

</comment></comment></comment><comment><USER15> How about Bharkdown, where ARK = "Apple Rumor King"?

(cf: [https://en.wikipedia.org/wiki/Apple_Inc._litigation#Libel_di...](https://en.wikipedia.org/wiki/Apple_Inc._litigation#Libel_dispute_with_Carl_Sagan))

</comment><comment><USER16> Are they no longer able to have "markdown" in the name? The name isn't rubygems-bad, but it's not exactly intuitive.

<comment><USER17> The original license says:

 _Neither the name "Markdown" nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission._

[http://daringfireball.net/projects/markdown/license](http://daringfireball.net/projects/markdown/license)

The name change may have been done as a courtesy rather than for legal reasons, but apparently Gruber doesn't wish to endorse any forks.

There was even a kerfuffle on Twitter.

<comment><USER18> This must have been done out of politeness and not out of legal reasons. I don't think Gruber has any legal foothold with respect to the name here.

The license you quote is essentially based on copyright. But copyright deals with creative works, not names; names are the domain of trademark. In the US at least, copyright is automatic; trademarks are not. You must explicitly register trademarks in order to have any legal enforcement power over a name.

Has Gruber registered for trademark in the US? I kind of doubt it.

I am not a lawyer, but this smells like something he just wrote in the contract because he could, not because it actually can be enforced as such.

(Note: This is separate from the discussion of whether it was polite for them to use the name Markdown. I generally agree that it is more polite for this project to distance themselves from the original markdown given that Gruber doesn't want to work with them.)

<comment><USER19> Incorrect -- there is a doctrine of common law trademark: [http://www.uspto.gov/faq/trademarks.jsp#_Toc275426712](http://www.uspto.gov/faq/trademarks.jsp#_Toc275426712)

<comment><USER18> Still, the level of protection for common law trademark is not the same as when registered. From [http://www.uspto.gov/trademarks/basics/BasicFacts.pdf](http://www.uspto.gov/trademarks/basics/BasicFacts.pdf)

1\. "Common law rights exist only for the specific area where the mark is used" (vs registering gives you "a legal presumption of your ownership of the mark and your exclusive right to use the mark nationwide").

2\. Registration grants you "the ability to bring an action concerning the mark in federal court". (It's not obvious to me how this differs from common law protections, but that's what the document says.)

Also mentioned in the document is that if you fail to defend you rights and the trademark enters common usage (e.g. "escalator" being the canonical example), then you lose protection under the law.

At any rate, the point is, this is trademark law, not copyright, so don't assume what you know of copyright law applies (or that your licenses which are written to protect copyrights will adequately address trademark issues).

</comment></comment></comment></comment></comment><comment><USER20> Intellectual property strikes again.

</comment><comment><USER21> I find this whole saga hilarious.

</comment><comment><USER22> wonder what new tantrum from gruber brought this on

<comment><USER23> An addendum to this post:

[http://blog.codinghorror.com/standard-markdown-is-now- common...](http://blog.codinghorror.com/standard-markdown-is-now-common- markdown/)

 _Edit: after a long and thoughtful email from John Gruber – which is greatly appreciated – he indicated that no form of the word "Markdown" is acceptable to him in this case. We are now using the name CommonMark._

It doesn't sound sarcastic to me.

<comment><USER22> how was I being sarcastic? Gruber could have skipped the butthurt party by replying to an email sent by the standard markdown team, instead of ignoring them for weeks. He refused communications, reading them to read tea leaves and guess what he might want. Like I said, tantrum. It's behavior expected from a child.

<comment><USER23> I wasn't talking about anything you wrote, Atwood's post does not sound sarcastic to me. He calls the email leading to the newest name "long and thoughtful". That doesn't sound like a tantrum.

<comment><USER24> The obvious suspicion is that Atwood was merely being diplomatic when he described Gruber's email in those words...</comment></comment></comment></comment></comment>


Xapian-haystack - A Xapian backend for Django Haystack - <AUTHOR> http://github.com/notanumber/xapian-haystack/

<comment><USER2> David, the project's creator, and Daniel, Haystack's creator/maintainer have managed a good dialogue back and forth, ensuring a decent integration. I know that Xapian-Haystack has gone through a couple of refactoring iterations since inception to provide quality code and project stability.

David welcomes constructive feedback, so try it out and contribute your input for improvement... or just say thank you to him. heh

I intend to use it for <http://www.snapact.com/> when I get to that point in Snapact's feature list. There need to be more hours in the day.

</comment><comment><USER3> Xapian is amazing - it's incredibly fast, and I much prefer it to Lucene and friends. I'm using Xapain with Django right now, but the framework I built to smush them together is hardly elegant.

Can't wait to try this out.

<comment><AUTHOR> Thanks for the encouragement. This is my first open source project, and I mainly wrote it because I was disappointed with Djapian's Xapian interface and was quite impressed with Haystack.

Originally, I was planning on using Whoosh for the backend, but quickly ran into issues with locked files when deploying to a live server.

Anyways, I'd love to hear any comments and feedback you may have after you've given the code a try.

<comment><USER4> I was using haystack with whoosh and running into the same problem. I was waiting for some updates on that, but I think I'll check this out first. Thanks for sharing the code.</comment></comment></comment>