Apple Is Blocking Linux User-Agent on appleid.apple.com - <AUTHOR> https://fosstodon.org/@alexbuzzbee/101633318704187857 <comment><USER2> The other day my friend lost his iPhone. He tried to use my Android to find it, but Apple's site just says it's unsupported. Really thoughtful of Apple to make that feature unavailable right when users need it the most.

<comment><USER3> Let's put an emphasis on the fact that this cannot be a technical limitation, as everyone else in the world manages to build websites that work on most devices, including android.

The appleid is a security nightmare anyway. I used to use an account, associated to an email I own, with a password I know, and still I can not log in, because it keeps asking the insecure "personal questions" that I never answer, because [generic privacy statement] and because I use a cryptagraphically secure password manager. As I did not save the personal questions I answered when signing up (tbh I probably just put garbage, as those are usually never asked when you know the password), and now I just cannot access it.

That's right, I own the email address and I know the password, and yet I cannot access my account. However, knowing who was my best friend when I was a teenager, or what was the name of my first pet are questions, in spite of being known by dozens of friends or acquaintances, that Apple requests as security measures needed to trust me as the owner of the acount. Having them on the phone provides zero help, 1 year later, I still cannot access it. It's definitively lost, and I feel happy I do not have any important information stored on the apple cloud.

<comment><USER4> Minor side note: do not put garbage into the answer boxes, use a completely random but plausible answer. One attack vector that is enabled by using random strings as response to "security" questions is telephone support: "I definitely did not answer that question, I just put garbage in!" Sadly, sometimes that works.

<comment><USER5> Very much this. I have made a point to give somewhat legitimate answers to these questions out of fear that a phone agent would ask them someday and that I could fall victim to exactly what you describe.

Phone agents don't always have to actually enter the security questions to access your account. sometimes they can simply see the answers on their screen and are able to make a judgement call. Don't trust humans, especially not humans who are incentivized to help you as quickly as possible.

Also its easier to say a word over the phone than it is to say a random string of letters numbers and symbols.

</comment></comment></comment></comment><comment><USER6> In case anyone, like me, doesn't know what appleid.apple.com is: It is Apple's single-sign-on portal for Apple IDs. Meaning if it errors out you cannot get an authentication token and use any Apple property (e.g. Apple Store, iCloud, developer portal, etc).

<comment><USER7> I just logged into [https://www.icloud.com/](https://www.icloud.com/) on my firefox/linux desktop -- had a popup on my iphone for the security number, but I'm logged in, can access find-my-iphone, etc.

<comment><USER8> Can you get the security number another way if you have lost the phone?

<comment><USER7> I have enough options set up in my iCloud account to cope with most failures

</comment></comment></comment></comment><comment><USER9> Apple ID is garbage, and I've been unable to reset my security questions due to Apple "not having sufficient information". Even calling Apple and having the agent try to reset the questions using a PIN did not work.

They escalated the ticket to some user department, where it promptly went nowhere. This was in October. When first dealing with this, I spent an hour on the phone with Apple. Clicking on my support ticket URL gives me the option to call them, but no way to email them back to inquire. It's a giant waste of time since Tier 1 agents go by script and cannot deviate without contacting a supervisor (whom I spoke to before).

So I guess I'm locked out of the system forever using my email address.

<comment><USER10> If you can login to your device then you should be able to reset by enabling 2FA in iCloud. See my reply above.

<comment><USER11> Apple ID 2FA uses one of your already logged in Apple hardware. For people using iPhone and didn't lose it that's fine. But for people don't carry an Apple hardware anywhere (for example I have an iMac at home), that's a lot of trouble.

<comment><USER10> That description is the issue I had, I do not have an iPhone.

</comment></comment></comment></comment><comment><USER12> Well this explains it. I was getting an HTTP 502 on appleid.apple.com while trying to add Apple Pay support to a product I am working on. I called apple support to tell them the site was down. The support agent told me, and I quote, "Our internet is Safari. We don't support Firefox."

I guess Apple doesn't want developers to support their products.

</comment><comment><USER13> Never attribute to malice that which is adequately explained by stupidity. Apple isn't exactly known for their ability to provide reliable internet services.

This is IMHO a badly misconfigured WAF or possibly application config bug and not some kind of grand conspiracy to exclude certain Linux users.

<comment><USER14> Right. Time and attention costs money, and why would Apple spend that time and attention on being jerks to 2.14% of the desktop market?

</comment></comment><comment><USER15> Not sure why people are claiming this as malicious. If Apple thought making life inconvenient for linux users was a good idea, this is about the least effective possible way to do that. And it's unclear why Apple would want to do that in the first place.

Seems far more likely that Apple was facing some sort of automated attacks on this particular subdomain (with linux UAs), and a beleaguered admin used this as a quick fix.

Or, even more probably, it's a misconfiguration.

<comment><USER16> Remember when the only way to watch an Apple event live on their site was if you were using an Apple device?

It's likely not malicious in the sense that they want to punish Linux users. And blocking Linux for this particular site may not have been something they even wanted to do. But in general Apple has been unnecessarily hostile towards non Apple devices, and it's not hard to believe this is a consequence of that.

</comment></comment><comment><USER17> Likely the WAF (web application firewall) responding to malicious use that happened to use that user agent.

<comment><USER18> I doubt that could that be it. Blocking by user agent would be a terrible idea. Way too broad a net and could easily be abuse to shut down major browsers. Also easily bypassed by changing the agent name.

Does anyone have first hand experience with a WAF that did that?

<comment><USER19> It's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux or something equally silly. In such cases it's easy to get a WAF to block the impossible combinations. The bots are usually simple enough that such simple measures block a large amount of the botnet traffic.

In our case, we block the impossible combos and rate-limit the ones commonly used by botnets.

Blocking based on whether the UA has "Linux" in it is just dumb, though.

</comment></comment></comment><comment><USER20> This has been going on for a while:

[https://mobile.twitter.com/xdaroj/status/1090319095134867459](https://mobile.twitter.com/xdaroj/status/1090319095134867459)

<comment><USER21> This has been going on for a while for a SaaS called "Browserling" that appears, from the thread, to emulate or host a browser of some sort in the cloud somehow.

Does this issue affect normal Linux desktop-hosted locally-operated "the standard way" browsers?

<comment><USER22> It doesn't work on Firefox 65.0.1 on Arch Linux, but it works perfectly with exactly the same browser version on FreeBSD. I guess they are filtering everything that specifically says "Linux"

<comment><USER21> Excellent, thank you for that.

</comment></comment></comment></comment><comment><USER23> Per the actual thread, they're not blocking "Linux", they're blocking "X11; Linux" (case-insensitive).

Remove any character from that string and it succeeds.

dang: are you able to update the title to reflect that it's not just 'linux' being blocked?

<comment><USER24> If that was true, then "Invoke-WebRequest -Uri [https://appleid.apple.com](https://appleid.apple.com) -UserAgent '(Linux)'" would return a 200 status, but it returns a 502 Bad Gateway

<comment><USER25> You're right, that's blocked. User-agent "(Linux)" is blocked, however User- agent "Linux" is not, while "X11; Linux" is blocked.

</comment></comment></comment><comment><USER26> More information on reddit:

[https://www.reddit.com/r/linux/comments/atc0av/apples_apple_...](https://www.reddit.com/r/linux/comments/atc0av/apples_apple_id_management_site_blocks_linux/)

</comment><comment><USER27> When the whole battery debacle was happening, I could only reach the battery replacement page on Safari. On Chrome and Firefox, the pages would give and error (I wanna say the same gateway errror)

</comment><comment><USER28> It is probably time for browsers to stop sending a user agent string.

<comment><USER29> That would just start an arms race where they would profile the browser to figure out what type it is.

Better to just leave it as a string you can spoof and let them pretend that it is good enough.

<comment><USER28> If intentional yes, but this is probably an accident. You can't accidentally take action on data you don't have.

</comment></comment></comment><comment><USER30> Just yesterday I came across this issue trying to set up my podcast with iTunes. I probably would have gone crazy if I hadn't seen this post.

<comment><USER31> When I wanted to submit my podcast to the iTunes directory, I had to install iTunes in Wine because iTunes for Windows is the only way to create an Apple ID that does not involve giving Apple a boatload of money.

And of course, iTunes in Wine did not allow me to paste passwords, so I had to type in the autogenerated password. And the autogenerated answers for the "security" questions. Fun.

</comment></comment><comment><USER32> Apple has a wall'ed-in garden

Google has a wall'ed-in garden

Facebook is trying to make a wall'ed-in garden

Does anyone else ever want to take out a flamethrower and just start from scratch...

Its so tiring

<comment><USER33> *Facebook is a walled garden

</comment></comment><comment><USER34> Apple is also sniffing UA (and doing some crazy heuristics with it) when delivering webpages to its apsptore. I think it's because they want to try to serve you a different webpage that opens up the appstore _application_ when you are clicking on a link, but it just doesn't work reliably. It's a pain for me, my users, and an other instance of Apple just failing at the web.

</comment><comment><USER35> user agent blocking is the most pointless kind - as you can set your string to whatever you want

       Services.prefs.setCharPref('general.useragent.override', 'apple spoof');

<comment><USER36> Exactly. Of all the groups that might know how to spoof UA, the linux community is the most likely.

Clearly they didn't think this through.

<comment><USER37> > Clearly they didn't think this through.

You're assuming this was a malicious move on Apple's part, as opposed to negligence or apathy.

</comment></comment></comment><comment><USER38> Wow, yes I ran into this issue the other day. Had to use my phone to access. I assumed it was the network and moved on.

Can't believe it was due to running Ubuntu. WTF!

</comment><comment><USER39> I sent them a support tweet and think you all should too.

</comment><comment><USER40> This doesn't surprise me at all. business.apple.com refuses me on Firefox. Tweak the UA to be Chrome and it works 100%.

</comment><comment><USER41> I spoofed my UA to "Linux", got page loading normally and my login worked

<comment><USER42> Try "X11; Linux"

</comment></comment><comment><USER43> That doesn't necessarily mean they are willingly blocking linux, I've seen inconspicuous user agent strings triggering 502 errors before. It's just badly written code.

<comment><USER44> It's curious though, that the thread narrows it down to "X11; Linux", with that specific casing (update: nope, not case sensitive). Changing or removing any single char in that string stops the error.

<comment><USER43> They most likely had a reason to threat those people differently and a bug came up under that special case ;) Watch them fix it.

<comment><USER45> I agree with the first sentence, but would advise against holding your breath until they have fixed it.

s/threat/treat/, though.

</comment></comment></comment></comment><comment><USER46> Set my user agent to ' ' (single space character) in latest Safari on a new Mac. Get a 403 Forbidden.

</comment><comment><USER47> Same thing for itunes billing, when clicking the link in your invoice email

</comment><comment><USER48> Maybe they were getting attacked, and blocked a particular user agent.

I've had to do that before.</comment>


Ask HN: What's the salary range for senior software engineers in Berlin? - <AUTHOR> I'm doing some market research on salaries in Berlin, and they seem very low. A lot of the forum posts are from years ago, and I imagine that the salaries have become more competitive recently. From your experience, what's the range for senior engineers in Berlin? <comment><USER2> Depends totally on the branch and company but 55k to 80k.

</comment><comment><USER3> Nope, nothing changed</comment>


YelpSquare - <AUTHOR> http://www.jonsteinberg.com/2010/01/yelpsquare/

<comment><USER2> Fred Wilson's comment on this post is really interesting:

 _"i think what is happening is a lot of the consumer facing services, facebook, twitter, yelp, etc, etc have shown no interest in getting bought. that is forcing the larger companies to rethink their "we'll just buy them when they get big" approach. and that leads to fiercer competition earlier.

what do you think of that theory?"_

</comment><comment><USER3> The name alone seems to be inviting a lawsuit that presumably Yelp thinks they will win.

<comment><USER4> What name? "YelpSquare" seems to be Jon Steinberg's coinage. It doesn't look like Yelp is using it.</comment></comment>


Two-factor authentication for Apple ID - <AUTHOR> https://support.apple.com/en-us/HT204915 <comment><USER2> Would be nice if they could use RFC 6238 TFA as well, it is a bit more convenient if you only have your Android device with you.

Edit: Reason for that being that I prefer having all TFA codes in my Google Auth app/Authy with requires no internet connection. Using SMS/text or other devices is a bit inconvenient when traveling and using a local SIM.

<comment><USER3> I'm not sure if you need to be online to generate these codes. On OS X, it's possible to go to System Preferences > iCloud > Account Details > Security > Get A Verification Code, which returns you a 6 digit verification code that looks like a TFA code.

<comment><AUTHOR> You certainly don't - I just tested it with my phone in Airplane mode and it worked fine.

Edit: to clarify, I originally tested it on my phone, but I've since tested on Mac and the result is the same.

If you happen to have the iCloud "Account" screen open before losing all connectivity (i.e. it's open, then you turn off wifi/etc), the regular "Get Verification Code" button will work.

In the more likely scenario that you just open up Settings/System Preferences > iCloud > Account, if you're offline it will tell you that you can't see your account details because you aren't online, but that you _can_ generate a verification code while offline.

<comment><USER4> Airplane mode on a Mac? As in, you turned off Wifi and Bluetooth (and obviously ensured that you didn't have a wired Internet connection)?

<comment><USER5> > my phone in Airplane mode

OP was referring to Google Auth working on phone regardless of current internet connection, the computer being disconnected in unrelated.

</comment></comment></comment></comment></comment><comment><USER6> Am I missing something? Why is this posted here and now?

Edit to clarify my confusion: is this new? What's the difference between this and two factor verification (which we've had for a while)?

<comment><USER7> I believe this is a new system. It's called _two-factor_ authentication as opposed to _two-step_ verification. To quote the FAQ:

> Is this different than Apple's current two-step verification feature?

> Yes. Two-factor authentication is a new service built directly into iOS 9 > and OS X El Capitan. It uses different methods to trust devices and deliver > verification codes, and offers a more streamlined user experience. The > current two-step verification feature will continue to work separately for > users who are already enrolled.

Since I was already using two-step verification, I had to turn it off for the new, two-factor authentication, option to appear. I turned it on and it looks like it's working now.

I have to agree that this was very confusing.

EDIT: looks like I can authenticate from OS X now, nice. Before I had to always unlock my phone.

<comment><USER8> > Since I was already using two-step verification, I had to turn it off for > the new, two-factor authentication, option to appear.

This can be very confusing and should be made more clear in Apple's documentation the iCloud Preferences UI on OS X.

</comment></comment></comment><comment><USER9> Annnnnd I'm locked out of adding this because I couldn't answer my security questions that I definitely never set up (I know this because I never use real information but random words that I save in 1Password if I am forced to make these.) So now I can't add 2 factor to a device that is and has been signed into my iCloud account for months.

Neat.

<comment><USER10> Are you suggesting that Apple invented security questions for your account? Because that sounds highly implausible. Are you sure you didn't set up actual security questions so long ago that you simply don't remember doing it anymore?

<comment> UVB-76 I think I had this happen to me as well.

Wasn't an issue until I wanted to change my Apple ID password, for which the security questions are required.

Phoned Apple Support, and they took me through a dazzling array of security steps, involving my Mac, iPhone, payment methods, and the Apple ID website, before they allowed me to create new questions.

</comment></comment></comment><comment><AUTHOR> This has apparently now been enabled for all iCloud users (previously it was not available to all users).

It appears that anyone using the older 2 step verification will need to disable that before you're able to enable the newer system.

<comment><USER11> Is there an easy way to switch to the new system? In order to disable the old 2-step verification, I have to set up new security questions, quite a hassle!

<comment><AUTHOR> I asked the @AppleSupport twitter account the same thing. You have to disable the old and enable the new - there is no automatic way to jump from one straight to the other.

On the plus side, I _believe_ the security questions become irrelevant again once you've setup the new 2FA.

</comment></comment></comment><comment><USER12> I hope this is more reliable than the previous system. I signed up for two step authentication... worked only once! The rest of the times the text message just never came through. I double checked my phone number, I even looked at their status page. nothing :(

just my experience.

</comment><comment><USER13> I enabled 2FA, logged out of iCloud on my iPhone, then logged back in. It asked me for the "password" on my Macbook Pro. What? How would Apple have access to a user password on my MBP? I have multiple users on my MBP... what would happen if I were logged into the same iCloud account with two different users?

<comment> UVB-76 Surely it's referring to the temporary pass code which is generated and presented to the relevant user on your Mac?

<comment><USER13> Out of curiosity, I tried (and then immediately changed) my main user account password, and it successfully authorized my iCloud login on my phone. I am really curious what's going on here. I expected it to ask for a numeric code like you mentioned, but it just gave me a plain UITextField to enter the password for $my_macbooks_hostname

I do not have keychain syncing enabled in iCloud, just contacts/calendars.

</comment></comment></comment><comment><USER14> Other than being more streamlined and offering offline access to codes, is there any additional benefit in terms of security for updating from the two- step method to two-factor?

I much prefer having the recovery key that is provided with two-step; I don't see that the two-factor method offers a recovery key.

Having any security feature associated with either my landline or mobile phone makes me feel uncomfortable for multiple reasons, some that have already been articulated by others here plus some more I can't really put my finger on, except to say that both landline and mobile phones seem inherently untrustworthy to me.

Am I just being paranoid?

</comment><comment><USER15> I recommend adding as many of your devices as trusted devices as well as other phone numbers in case you need to recover the account. Apple can not really assist in that when Two Factor is enabled.

<comment><USER16> That's no longer the case. With this new Two Factor authentication there are no security questions, no recovery key, and Apple can recover your account if you lose all of your trusted devices and forget your password.

Devices are automatically trusted the first time you login and enter a verification code.

When anyone tries to login to your account on the web or from an untrusted device, all of your trusted devices notify you with location of the login attempt. It's a pretty good setup.

<comment><USER15> It still is the case... Trust me

</comment></comment></comment><comment><USER17> It'd be nice to see support for U2F

</comment><comment><USER18> Does enabling two-factor authentication impact the ability to use "Find My iPhone" (when presumably the phone itself is your second factor)?

<comment><USER16> Find my iPhone, Apple Pay, and Apple Watch settings are available without Two Factor authentication. Links are available on the Two Factor verification screen.

</comment></comment><comment><USER19> Is it live? I checked both of my up-to-date macbook air and iphone, and there is no mention of this new "Two-factor authentication" in the settings. In fact, there is the "two-step verification" turned on already in the settings, which I assume is the old way.

Anybody seeing it in there devices?

<comment><USER20> I had to turn two-step off in order to enable two-factor

</comment></comment><comment><USER21> Call me an idiot, but how do I turn off two-step authentication in order to turn on two-factor authentication? Neither my iPhone nor my Mac allow me to turn it off. Where

<comment><AUTHOR> I assume you mean turn of 2 step verification.

See [https://support.apple.com/en-us/HT204152](https://support.apple.com/en- us/HT204152) and look near the bottom for "How do I turn off two-step verification?"

</comment></comment><comment><USER22> Just tried to enable this from my MBP, got a message saying it's not available for my apple ID at this time. So I guess the rollout's not complete yet.

</comment><comment><USER23> I can't imagine the pain of having to do 2FA when iOS and MacOS ask for iCloud passwords so frequently - the friction is atrocious.

<comment><USER24> Yeah the old system was a real pain to use. This one is much better, it just asks you to pick a device to get a code from, it'll pop up and you type the 4 digit code in.

<comment><AUTHOR> You are describing apple's old (although still working if you have it enabled) 2 Step Verification.

The new 2 Factor Verification doesn't require you to pick a device, and it doesn't use 4 digit codes.

</comment></comment></comment><comment><USER25> I hope Apple is secretly building its TouchID to totally replace passwords. God I dont want to remember Password anymore.

<comment> UVB-76 I hope the next Mac line-up includes Touch ID

</comment></comment><comment><USER26> I hate text messages. Prefer authentication can be used with 1Password or 'Google Auth App

<comment><AUTHOR> You would only need to use a text message if you have no access to any of your trusted devices.

</comment></comment><comment><USER27> why has this not been released for more sites, devices, and other stuff? what is keeping company's from adding similar features to protect there customers any ideas?

<comment><AUTHOR> Two factor auth is available for many sites, the only unique part (to the user, I'm not certain of the actual OTP generation process) is the prompting on devices with a area map shown.

<comment><USER27> yeah but what I am asking is why not more sites use either of two-step verification or two-factor authentication.

as I can not see any reason not to implement a system for it because it would probably only help the company to get more customer.

<comment><AUTHOR> There is technical effort involved, which means time, which means money.

There are a _lot_ of sites that don't even use TLS, which is a lot simpler & cheaper to implement than a secure 2FA solution.

</comment></comment></comment></comment><comment><USER28> PSA you can lose your Apple account this way. If a password reset is needed or the account get lock, you have to have your recovery key. No recovery key, no more account. Print it and keep it in a safe place.

<comment><USER29> I can find no mention of a recovery key for Apple's Two Factor Authentication (which is different than Two-Factor Verification). Where does one find this?

<comment><USER2> >Apple's Two Factor Authentication (which is different than Two-Factor Verification

Two factor auth: * Six-digit code sent to your device/via text

Two factor verification: * Four-digit code sent to your device/via text

Or what exactly is the difference? Surprised Apple would launch something like this.

<comment><AUTHOR> > what exactly is the difference

The old system pushed 4-digit OTP's from Apple to a trusted device of your choice using the Find-My-(iPhone|iPad|Mac) system or an SMS. Only iOS devices could be registered as "trusted" for this system.

The new system shows login attempts on all trusted devices (iOS9 or OS X 10.11 devices) automatically including basic GeoIP location, and will show a six- digit OTP if you want to allow the session. It also allows trusted devices to generate verification codes (a six digit OTP) when offline, e.g. if you need to login to iCloud.com from a public computer but your phone has no data/cell service. Or if for example you have your Macbook with you, but no Wifi access, and your phone battery is flat, and you need to access your account via another computer.

> Surprised Apple would launch something like this

Why is this surprising? They've had 2-step verification available for several years, this is an improvement over that.</comment></comment></comment></comment>


The slowest curl vendors of all time - <AUTHOR> https://daniel.haxx.se/blog/2019/08/01/the-slowest-curl-vendors-of-all-time/ <comment><USER2> I thought HP is still the leader in slowest updates. 1000 days could be them as well. Don't they do distros anymore?

</comment><comment><USER3> I hope that little name and shame will get the big boys to take notice.</comment>


Gmail lab feature 'Mouse Gestures' no more? - <AUTHOR>

I am not able to use the mouse gestures lab feature in gmail. When I looked into Settings -> Labs, It wasnt even there! Did Google just kill it? I have been using it for years now and cant imagine why they'd do so! Anyone else also facing this issue? <comment><USER2> Here is my chrome extension to replace old feature. Try it, first release is out. Any advice and comments are welcome!

[https://chrome.google.com/webstore/detail/aaokajckoheafemlmj...](https://chrome.google.com/webstore/detail/aaokajckoheafemlmjacklidohljgkgo)

<comment><USER3> ops sorry didn't see you already posted the link thanks a lot for making it :D

</comment></comment><comment><USER4> Google Labs: Bring back Gmail Mouse Gestures [http://www.change.org/petitions/google-labs-bring-back- gmail...](http://www.change.org/petitions/google-labs-bring-back-gmail-mouse- gestures?share_id=tXzbfvldvq&utm_source=share_petition&utm_medium=twitter)

</comment><comment><USER5> They did! Please sign the petition to get the ouse gestures back! [http://www.change.org/petitions/google-labs-bring-back- gmail...](http://www.change.org/petitions/google-labs-bring-back-gmail-mouse- gestures#)

</comment><comment><AUTHOR> just found out that gmail has retired the lab feature, along with many others. That's really sad. [http://gmailblog.blogspot.in/2012/05/say-hello-or-ola-or- hal...](http://gmailblog.blogspot.in/2012/05/say-hello-or-ola-or-halo-or- salam-to.html)

<comment><USER6> There appears to be a number of chrome extensions that support gestures, so perhaps you can find or configure one that works similarly ("Pig Toolbox," for example). Or learn the Gmail keyboard shortcuts.

</comment></comment><comment><USER3> mouse gestures is now a chrome add-on :D [https://chrome.google.com/webstore/detail/aaokajckoheafemlmj...](https://chrome.google.com/webstore/detail/aaokajckoheafemlmjacklidohljgkgo/)

</comment><comment><USER7> what a shame, i really loved mouse gestures in gmail :(</comment>


V8 release v6.8 - <AUTHOR> https://v8project.blogspot.com/2018/06/v8-release-68.html <comment><USER2> > The optimizing compiler did not generate ideal code for array destructuring. > For example, swapping variables using [a, b] = [b, a] used to be twice as > slow as const tmp = a; a = b; b = tmp. Once we unblocked escape analysis to > eliminate all temporary allocation, array destructuring with a temporary > array is as fast as a sequence of assignments.

I enjoy seeing updates like this to learn more about how the engine works, but: these changes are exactly the reason you _don't_ want to design your code around specific micro-optimizations, particularly when it comes to JS. They're at parity now and it is quite possible that 6 or 12 or 24 weeks from now, the cleaner destructuring approach will actually be faster than the tmp-var approach. Remember this the next time someone suggests in code review that you should design your code to meet the whims of the JS engine.

<comment><USER3> I'd have to be running that billions of times a day before I'd start to care about the extra nanoseconds. Clean-looking code makes me feel better than having my servers sit at 67.3% CPU instead of 67.4% CPU.

<comment><USER4> I'd take cleaner code for half the speed quite often!

<comment><USER5> I see that you too are a Python developer! /s

<comment><USER6> How is a language which doesn't have a type checker a synonym for clean code?

<comment><USER7> Python does a lot of type checking and complains loudly, very different from eg Javascript.

<comment><USER8> Besides, whether it complains or not about misused types, says nothing about the code being clean or not.

One can write totally unreadable code in Scala and a totally readable version of the same algorithm in Python if one so wishes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Very excited to see more improvements with V8. I am worried however about how good google chrome is and how it completely dominates in some markets. I hope that Firefox can continue to improve (Quamtum is great!) and stay relevant especially since Electron Apps are popular and it's not certain that some day they won't include Google telemetry.

<comment><USER3> Chakra seems decent too. And aren't V8 and Chakra both open source? Does Google improving V8 increase the size of their moat?

V8 improvements also benefit NodeJS, and they also contribute to it, I think.

I use both Chrome and NodeJS and will take any speed improvements they make.

<comment><USER10> It certainly increases the size of their influence.

</comment></comment></comment><comment><USER11> I want to see something like Flow integrated into the js specs. Types can help optimization just as they can help correctness!

<comment><USER12> Possibly! But trickier than it seems at first.

For types to help with optimization, those types have to be correct and reliable (i.e. sound). If every line of your app and all of its dependencies are sound, then you should expect a speedup. If there is any unsound code, then you'll have to generate runtime checks to preserve the soundness properties that your optimizer assumes, and those can actually result in _slower_ code.

Even Flow has made compromises that are good for a type checker, but likely unacceptable if an optimizer is relying on them. Quoting [https://flow.org/en/docs/lang/types-and- expressions/](https://flow.org/en/docs/lang/types-and-expressions/)

> Soundness is fine as long as Flow isn't being too noisy and preventing you > from being productive. Sometimes when soundness would get in your way too > much, Flow will favor completeness instead. There's only a handful of cases > where Flow does this.

</comment></comment><comment><USER13> i like the improvements made to typed array sorting

</comment><comment><USER14> I can't wait for web assembly to get direct access to dom. Javascript cannot be gone soon enough.

<comment><USER15> Wouldn't a UI in WebAssembly make it impossible to block ads? The recent QT announcement renders to Canvas doesn't it?

I thought the idea was to mostly use WebAssembly for parts that are performance critical, not replace all of it?

<comment><USER16> This has always been possible if you just write sufficiently obfuscated JavaScript. However a UI that is entirely rendered in a canvas element would basically be unusable by anyone with a disability, so that technique is useless for big orgs.

<comment><USER17> The cynic in me can't help but expect most web companies to care more about pushing unblockable ads down everyone's throats than about the disabled.

<comment><USER18> That's why decent countries have regulation to make them care about things other than short-term profit.</comment></comment></comment></comment></comment>


Lessons Learned while Raising Angel Investment - <AUTHOR> http://www.kartme.com/blog/raising-angel-funds-nyc-5-lessons-learned-part-1-2

<comment><USER2> I learned a lot of similar lessons. I like his point about how they're too busy because investing isn't their primary focus. I actually found this infuriating at first because they promised to be really helpful, but because they were so hard to reach they actually became really expensive.

He's dead on about the momentum. I had 4 angels lingering around, and it wasn't until I was like "ok, everyone else is investing, act now or you'll miss your chance" that I got 2 of them to close.

And for seeing measurable goals... they don't care at all about business metrics, they see your progress as being measured by bright and shiny objects. Just crank out code and get users, don't dither on marketing plans or building competencies because that's not something they see as valuable, nor as progress.

Hope that my testimonial adds something to the reading experience of the article. :-)

<comment><AUTHOR> Good to we you agree with the points about how angel investors are busy and like to ride on momentum.

I also agree with you that a bright, shiny object is very important. For web products, it's a requirement to get past the first meeting. See my earlier post: Pitching without PowerPoint: 8 Tips for a First Meeting at <http://www.kartme.com/node/31475>

I'll qualify my statement on metrics by saying that, if your target angel investors aren't in your target customer segment, then you'll need metrics around usage to convince them of (a) the value of your bright shiny object to your target customers and (b) your ability to make it shine brighter. And I agree it's not about goals and plans. It's metrics about your past achievements and lessons learned.

<comment><USER2> Cool, thanks for the followup. I guess I could have phrased it better myself.

My experience was, after investment, we brought in (as cofounders) a really experienced team of marketing professionals (one from a big name, like Oglivy, and another who ran online marketing for a major bank). We had business metrics, we measured progress of focus groups, interviews, surveys, etc. The kind of metrics corporations use to "save money by making cheap mistakes on paper during planning instead of making expensive mistakes in production".

If I had to do it all over again I would have just built the wrong thing, and delayed the cost of finding the product/market fit until I raised more money with that wrong thing. Because metrics against a bright and shiny object, even the wrong object, are perceived as more valuable than metrics that bring you closer to building the right object in the first place.

<comment><AUTHOR> i whole heartedly agree with your statement that "metrics against a bright and shiny object, even the wrong object, are perceived as more valuable than metrics that bring you closer to building the right object".

That was my experience with showing people "designs" that were moving us in the right direction. I got 0 credit for that. I had to show the designs live (i.e., shiny) and with user traffic data (i.e., metrics) as proof.

</comment></comment></comment></comment><comment><USER3> Nice article Phil. Keep up the good work!

#5 is a big one. A lot of the people I talk to who are raising or have raised money say that you need one investor to take the first dip. No one really wants to be the first guy in. But once you capture that first, the rest fall like domino's and can't wait to join the party. If one reputable investor likes you it's often enough to say there's something here, I don't want to miss out.

</comment><comment><USER4> I disagree with his point about various collectives overall increasing the sophistication of angel investors, because the existence of organizations like YC are likely to draw in newer, less experienced angel investors.

When you democratize a process and make it easier, you'll get some more sophisticated folks using it, and a lot of new people using it who otherwise wouldn't.</comment>


Sweden's Economy Is Doing Way Better Than the Rest of the EU - <AUTHOR> https://fee.org/articles/bbc-sweden-s-economy-is-doing-way-better-than-the-rest-of-the-eu-during-the-covid-19-pandemic <comment><USER2> [https://mediabiasfactcheck.com/foundation-for-economic- educa...](https://mediabiasfactcheck.com/foundation-for-economic-education)

also, see notes:

According to the left-leaning watchdog Sourcewatch, Fee has connections to the Koch Brothers. Further, the Least Biased Public Integrity also ties this organization to the Koch Bothers via funding.

<comment><USER3> Can you relate the bias you perceive to untrustworthy or disingenuous claims in the content of the article?

[https://en.wikipedia.org/wiki/Association_fallacy](https://en.wikipedia.org/wiki/Association_fallacy)

<comment><USER2> The Media Bias fast checker are tracking sites for disinformation. There's a bias. So read it taking that bias into account.

<comment><USER3> We should be able to digest information without epistemological hand holding.

I've found that most fact check sites have an agenda of their own. A common technique is to misattribute or deliberately misinterpret a claim and then debunk the strawman.

[https://www.factcheck.org/2016/09/trump-pence-acid-wash- fact...](https://www.factcheck.org/2016/09/trump-pence-acid-wash-facts/)

>"Donald Trump falsely claimed Clinton "acid washed" 33,000 personal emails ... Clinton's tech team used BleachBit, which is a free software program. It does not use chemicals."

<comment><USER2> You "found"? Stats, research notes, facts, data? ... opinions are not facts.

About your selective and misleading choice of fact checked, you know very well it's about the "acid wash" claim, and not about what the republicans did. You don't need a fact checker to know what Trump said about Hilary and the mail server, nor why it was used and perused so relentlessnesly.

<comment><USER3> Nor have you demonstrated that 'fact check' sites are without bias.

I've provided a quote and a link to one of the more memorable instances of what I found to be disingenuous fact checking. I'm not sure what else you can expect in this context?</comment></comment></comment></comment></comment></comment>


Visual Studio 2019 Launch Event [Live Stream] - <AUTHOR> https://visualstudio.microsoft.com/vs2019-launch/ <comment><USER2> Too bad data breakpoints are not available in .NET Framework.</comment>


Would blockchain completely replace cloud? - <AUTHOR> Just roughly thinking, as blockchain offers transparent and interconnected network, would it possibly replace backend server side completely in future?<p>Because theoretically blockchain will allow information to exchange between browsers and phones which can act as blockchain nodes <comment><USER2> This sounds like complete nonsense to me, so I guess my understanding of what "blockchain" is must be different from yours.

To help me understand your comment/submission, could you explain what you think "blockchain" is?

Thanks.

</comment><comment><USER3> Blockchain already replaced databases, money, software, fluorescent light, dolphins, and cheese. I can't think of any reason it can't replace everything.</comment>


Startup Accelerator: Should Your Startup Apply? - <AUTHOR> http://startupbloggers.com/startup-accelerators/

<comment><USER2> Idealabs was doing what ycombo is doing now back in 1996. Not a new idea... just better executed</comment>


Facebook Buys Divvyshot - <AUTHOR> http://techcrunch.com/2010/04/02/facebook-buys-up-divvyshot-to-make-facebook-photos-even-better/

<comment><USER2> Horse's mouth: <http://divvyshot.com/facebook>

HN discussion: <http://news.ycombinator.com/item?id=1237361>

</comment><comment><USER3> Even if the price was small, getting a good shower of FB stock could be really awesome down the line.</comment>


Show HN: libcodr7 – fundamental collections in the spirit of C - <AUTHOR> https://github.com/codr7/libcodr7 <comment><USER2> I didn't realize you could implement a red-black tree with this little code.

The code shown here seems to indicate that insert has at least four cases, and delete has six: [https://en.wikipedia.org/wiki/Red%E2%80%93black_tree](https://en.wikipedia.org/wiki/Red%E2%80%93black_tree)

But the code I see here is very small: [https://github.com/codr7/libcodr7/blob/master/source/codr7/r...](https://github.com/codr7/libcodr7/blob/master/source/codr7/rbnode.c)

I guess it's not handling delete, which probably accounts for a lot of the difference.

EDIT: I see that it's implementing a left-leaning red/black tree. I see some caution about that approach here? Would love to get the author's opinion about this: [http://read.seas.harvard.edu/~kohler/notes/llrb.html](http://read.seas.harvard.edu/~kohler/notes/llrb.html)

<comment><USER3> Red-black tree presentations are often more complicated than necessary, mostly because of (premature?) optimizations. A simple presentation can be found here: [https://www.cs.tufts.edu/~nr/cs257/archive/chris- okasaki/red...](https://www.cs.tufts.edu/~nr/cs257/archive/chris- okasaki/redblack99.pdf)

I haven't checked how this relates to the code in this library.

</comment></comment><comment><USER4> Anyone who does too much C would know that manually implementing associative array (dictionary) is not fun. I started to use two implementations for my work, both worked pretty well for the things they are good at (and all of them are as "generic" as you can get from C):

khash: [https://github.com/attractivechaos/klib/blob/master/khash.h](https://github.com/attractivechaos/klib/blob/master/khash.h)

The interface I really liked, and you can customize the hash equality functions.

rb from jemalloc: [https://github.com/jemalloc/jemalloc/blob/dev/include/jemall...](https://github.com/jemalloc/jemalloc/blob/dev/include/jemalloc/internal/rb.h)

The interface is a bit wacky, but it is flexible enough for my needs. rb shines when you need range queries (keys less than, more than etc.)

<comment><AUTHOR> I prefer ordered sets with value semantics (which allows using as maps without overhead) to hash tables since I find the performance easier to reason about and often want ordering anyway. The easiest one to implement would be a binary searched vector, but comes with the disadvantage of unstable pointers because of reallocations. rbtrees are definitely trickier, though this one is left leaning which reduces the complexity somewhat (see PDF linked from README).

<comment><USER4> The rbtree implementation from jemalloc allows you to maintain the value semantics (it is an intrusive design as well). I believe it is also a left- leaning 2-3 red-black tree to be exact. The API is a bit harder to understand but once you get use to it, can be pretty easy to use. It also implemented one trick that embeds the color bit into the right child node pointer, otherwise you are paying a full 8-byte size penalty.

<comment><AUTHOR> Yeah, that's usually where I draw the line, embedding data in pointers :) Bitfields and packed structs is another angle that I usually don't bother with. Too many details to keep in mind for my feeble brain.

</comment></comment></comment></comment><comment><USER5> If I were starting a new project in C, I would definitely rely on a solid foundation library like APR[0] or CoreFoundation[1] without reimplementing a bunch of fundamental data structure algorithms by myself. Glib is another alternative, but too bloated in my view.

[0] - [https://apr.apache.org](https://apr.apache.org) [1] - [https://github.com/opensource-apple/CF](https://github.com/opensource- apple/CF)

<comment><USER6> Note that the GitHub link you have there is an unofficial mirror and the git version history consists simply of the official source dumps.

To each their own but IMO repositories created in that manner are generally not very useful (though there are exceptions).

The official location of the CoreFoundation (actually CFLite) source dumps is [https://opensource.apple.com/tarballs/CF/](https://opensource.apple.com/tarballs/CF/)

The most recent CFLite tarball is [https://opensource.apple.com/tarballs/CF/CF-1153.18.tar.gz](https://opensource.apple.com/tarballs/CF/CF-1153.18.tar.gz)

You can browse the CFLite source online at the official location as well: [https://opensource.apple.com/source/CF/CF-1153.18/](https://opensource.apple.com/source/CF/CF-1153.18/)

The docs for CoreFoundation are at [https://developer.apple.com/documentation/corefoundation](https://developer.apple.com/documentation/corefoundation)

<comment><USER7> These days you're probably better off using the version of CoreFoundation that's maintained as part of the Swift project:

[https://github.com/apple/swift-corelibs- foundation/tree/mast...](https://github.com/apple/swift-corelibs- foundation/tree/master/CoreFoundation)

...as it's more up-to-date and developed in the open.

<comment><USER8> I wouldn't go as far as to say it's "developed in the open". It's significantly more opaque than Swift or WebKit, for example; I'd describe it as "accepting of patches".

</comment></comment></comment></comment><comment><USER9> I can't figure out how the linked list is used. Where is the per-element data?

I thought there would be a usage example in the tests, but there wasn't.

<comment><USER10> These structures are intended to be used like the Linux Kernel's data structures, via `container_of` (Though in the library the macro is called `c7_baseof`. But it does the exact same thing as `container_of`).

They have somewhat of an example usage of the list in the `deque.c` file: [https://github.com/codr7/libcodr7/blob/2b598e3d89d878ef53e05...](https://github.com/codr7/libcodr7/blob/2b598e3d89d878ef53e05161ef0fd83320e1e19f/source/codr7/deque.c#L20)

If you don't know about `container_of`, the idea is that it allows you to take a pointer to an inner field, and transform it into a pointer to an outer 'container'. For the linked-list, this means that if you want to make a list of `struct car` objects, you simply embed a `struct c7_list` into `struct car`, pass the address of that internal `struct c7_list` object to the list manipulation functions provided here, and then use `container_of` (Or `c7_baseof`) to transform the pointer to the `struct c7_list` into a pointer to the containing `struct car`.

In general, I think `container_of` is one of the best things for writing C code, and it provides a surprising amount of flexibility and nice patterns you can use. It does have the obvious issue of type checking (You could have a `struct wheel` that also has a `struct c7_list` on it, and accidentally add ti to the same `struct c7_list` that has `struct car`), and if your `struct car` needs to be on more than one list at a time it can get confusing knowing which `struct c7_list` entries belong to which list, but in general I'd call it a big net positive.

It's also possibly worth noting, you can use this to implement a non-intrusive list if you want, just simply make an object that wraps a `struct c7_list` and a void pointer (Or a typed pointer, if you want), and then write some extra logic around it for allocating nodes and such.

<comment><USER9> Okay, I'm getting it. Not a knock on the author, but looking at this macro'd, pointer-to-void'd stuff certainly makes me appreciate the STL.

Edit: aha, I see "intrusive" was the keyword I was missing to learn all about this different style.

<comment><USER11> Intrusive lists are very different beasts than lists by value.

There are less allocations involved (perf and points of failure), values can be inserted on different lists without new allocations, deletion is O(1), elements can be heterogeneous (different sizes and types), etc

etc

I seldomly use linked lists, but most of the time i prefer them to be intrusive. There of course are intrusive list implementations on C++.

<comment><USER12> > values can be inserted on different lists without new allocations

Not multiple lists at the same time, surely...?

<comment><USER10> They were talking about taking a value off of one list and adding it to a different one, which doesn't require an allocation, but the entity is never on more than one list at a time in that scenario.

That said, you can add an entity onto multiple lists if it contains multiple nodes embedded inside. You have to keep track of which nodes are attached to which lists though (Which generally just means being consistent on which you use where). If you give them decent names, then it's not usually a problem, but it can sometimes get a little confusing if you're not careful.

</comment></comment></comment></comment></comment></comment><comment><USER13> Why have comparison callbacks return this enum

      enum c7_order {C7_LT, C7_EQ, C7_GT};

instead of a signed int which seems to be the idiomatic way in C?

<comment><AUTHOR> Because I always end up switching on the return value, and switching on enums is a lot nicer than ints. Especially when there is no agreement on what values are returned, LT is mostly -1 but is often specified as simply less than zero.

When you have a finite set of cases, enum is just the right solution period. I have no idea why people still insist on using ints.

</comment></comment><comment><USER14> "in the spirit of C" is pretty ambiguous. What does this do better or differently from other libraries?

There's no working examples shown. There's a "real-world examples" link, but it seems to just point to another project of yours.

There's no documentation of the API. If I wanted to use this, I would need to manually read the header files and hope that I'm using them correctly.

And to top it all off, there's not a single comment in the entire project.

I don't mean to be harsh, but if you want other developers to use this, then you need to provide more resources.

<comment><AUTHOR> The descriptions of the containers contain more of the kind of information you're looking for, it's a bit much to expect the caption to explain it all.

It's as real world as it gets for now, the test suite should give you an idea.

I will typically add comments where I feel the code doesn't do a good enough job of explaining itself.

One step at a time.

It's ok, I don't expect anything.

</comment></comment><comment><USER15> I've only glanced at these; can someone more familiar explain how these are different from the BSD "queue" macros (and their offspring, like the tree headers)?

</comment><comment><USER16> "In the spirit of C". What exactly is meant by that?

<comment><USER17> The spirit of chainsaws with no hand guards haha.

But actually, to me that means a thin, light API with a couple of functions and some macros. Does what it needs to do, no more. Error handling is basic if even provided, usually via return of numerical error codes.

<comment><AUTHOR> That's correct, it does mostly what you tell it to and stays out of the way. If you want error checking beyond the test suite you have to do it yourself. The issues people have with C comes mostly from treating it like any other language. C is all about control and flexibility.

Further, special care is taken to reduce the number of allocations, often using pools/slab allocators. And value semantics, or rather byte array semantics, which means items are treated as blocks of N bytes rather than pointers/references.

</comment></comment></comment><comment><USER18> So what's the advantage of this over existing libraries?

<comment><AUTHOR> That would depend on which libraries we are discussing, I don't know them all.

This is simply how I would do it based on my experience.

</comment></comment><comment><USER19> So, like [http://troydhanson.github.io/uthash/](http://troydhanson.github.io/uthash/) but without the documentation?

(NetBSD has had an all-macro red/black tree implementation forever, plus the ancient and well-understood BSD queue.h)

<comment><AUTHOR> From a quick glance; it's hashed (as in not ordered), not pool allocated and intrusive as opposed to offering value semantics. Couldn't get more different.

There's nothing new under the sun, I never claimed novelty. This is simply how I would do it, take or leave.

</comment></comment><comment><USER20> Definitely cool, although the spirit of C is to be overly paranoid about portability and not link to a _library_ , God forbid. (Single pairs of h/c files like this are usually okay with people)

<comment><AUTHOR> Or you could link to a library written by someone equally paranoid about portability :)

</comment></comment><comment><USER21> This is exactly why you shouldn't code in C unless you absolutely have to. So many ugly boiler plates and macros.

<comment><USER22> There are myriad reasons why you might "absolutely have to" code in C. There are even a few reasons you might code in C even if you have a choice.

</comment></comment><comment><USER23> Is there a reason C libraries generally prefix with 'lib'? Or is it just historic?

<comment><USER22> If you pass -lcodr7 to the Unix C linker, it would typically go looking for a file called libcodr7.so. You could perhaps view this as mainly historic behaviour.

Some libraries like Cairo seem to be generally known as "Cairo", not "Libcairo". But there is also a trend for libraries to have very straight-to- the-point names. If the PNG parsing library is called libpng.so and the XML parsing library is called libxml.so, it would be confusing to call these libraries just "Png" and "Xml".

As an other example, the two C programs "systemd" and "libsystemd" live in the same repo, but are really two different beasts: libsystemd might be useful to you even on a system which doesn't use systemd.

<comment><AUTHOR> Besides this; codr7 is my alias, and I wouldn't want to be confused with a C library.</comment></comment></comment>


Ask HN: Tumblr alternative without pr0n? - <AUTHOR>

<comment><AUTHOR> I have to give a presentation to a group of middle school students, and the activity I have planned is to have them start their own blog. Ideally, I'd like to have them set up a Tumblr account because it is easy and straightforward.

However, the pr0n. I'd rather not be the one to introduce anyone to that ecosphere if I can help it.

Thoughts? Is there an alternative to Tumblr that has more stringent content requirements, but is as simple to use?

<comment><USER2> Ever thought about Medium? I haven't used it myself, but I've heard good things.

<comment><AUTHOR> I have, and right now it seems to have a very journalistic slant to it. It might work.

</comment></comment></comment><comment><USER3> I signed my son up with Jux.com. It looks great out of the box on desktop and mobile and is pretty straight forward,

<comment><AUTHOR> I was just looking at that. It does look pretty nice. I'll have to research it a bit more. Hate to have a hundred parents calling/emailing me because I overlooked something obvious.

How is it working for your son?

</comment></comment><comment><USER4> Blogger is a good option.</comment>


Anyone love the mybaihe.com - <AUTHOR> http://www.mybaihe.com it like a pinterest... <comment><USER2> Content contains some NSFW images.

The site clearly isn't aimed at me, I don't speak or read any asian languages, but the design seems cool. It's a bit cluttered but it's cluttered entirely with content (I think) so it works. I like the endless scrolling somewhat, although it makes deep linking problematic.

</comment><comment><USER3> ...So, Chinese Pinterest?

As best I can tell

</comment><comment><USER4> yes, I love it</comment>


What is Haberman? - <AUTHOR> https://regexking.info/2019/08/05/haberman.html <comment><USER2> Transcription error in the 1980s from a map from the 1960s leads to incorrect "populated place" being given to a "location" that was a factory with a train station.

Good 'ole Garbage In, Garbage Out at work.

<comment><USER3> I think this public-data sleuthing article is a piece of beauty, and I'm somewhat willing to accept the occasional transcription errors if this is the result.

</comment></comment><comment><USER4> I clicked expecting an article about the Cordwainer Smith story.

[https://en.wikipedia.org/wiki/Scanners_Live_in_Vain](https://en.wikipedia.org/wiki/Scanners_Live_in_Vain)

<comment><USER5> So did I!

I was half-expecting that HN would have greater appreciation of CS' writings than the general population...

</comment></comment><comment><USER6> or could it be [https://en.wikipedia.org/wiki/Trap_street](https://en.wikipedia.org/wiki/Trap_street) ?

</comment><comment><USER7> These location names seem to be sourced from _any_ where at all, without regard for verification. Around here, sometimes this surfaces ancient neighborhoods which haven't existed for a century, sometimes a marketing label which is referenced on the web a lot, and sometimes some non-Euclidean weirdness breaches the surface.

</comment><comment><USER8> Previous post (15 days):

[https://news.ycombinator.com/item?id=20624568](https://news.ycombinator.com/item?id=20624568)

</comment><comment><USER9> Reactivate the damn Lower Montauk!

</comment><comment><USER10> but _who_ is Haberman? and why has a train station been named after him/her

<comment><USER11> His 1927 obituary is here: [https://fultonhistory.com/highlighter/highlight- for-xml?altU...](https://fultonhistory.com/highlighter/highlight-for- xml?altUrl=https%3A%2F%2Ffultonhistory.com%2FNewspaper%252018%2FNew%2520York%2520NY%2520Sun%2FNew%2520York%2520NY%2520Sun%25201927%2FNew%2520York%2520NY%2520%25201927%2520-%25205974.pdf%23xml%3Dhttps%3A%2F%2Ffultonhistory.com%2FdtSearch%2Fdtisapi6.dll%3Fcmd%3Dgetpdfhits%26u%3D54cf6504%26DocId%3D2702860%26Index%3DZ%253a%255cIndex%2520I%252dE%252dV%26HitCount%3D8%26hits%3Da%2B23%2Bc7%2Bca%2Bd2%2Bf7%2B2a0%2B3fe%2B%26SearchForm%3D%252fFulton%255fform%252ehtml%26.pdf&uri=https%3A%2F%2Ffultonhistory.com%2FNewspaper%252018%2FNew%2520York%2520NY%2520Sun%2FNew%2520York%2520NY%2520Sun%25201927%2FNew%2520York%2520NY%2520%25201927%2520-%25205974.pdf&xml=https%3A%2F%2Ffultonhistory.com%2FdtSearch%2Fdtisapi6.dll%3Fcmd%3Dgetpdfhits%26u%3D54cf6504%26DocId%3D2702860%26Index%3DZ%253a%255cIndex%2520I%252dE%252dV%26HitCount%3D8%26hits%3Da%2B23%2Bc7%2Bca%2Bd2%2Bf7%2B2a0%2B3fe%2B%26SearchForm%3D%252fFulton%255fform%252ehtml%26.pdf&openFirstHlPage=false)</comment></comment>


The New Motorola Moto X (2nd Gen) Review - <AUTHOR> http://www.anandtech.com/show/8523/the-new-motorola-moto-x-2014-review <comment><USER2> This is by far the most critical review I've read. Several others (e.g. The Verge, CNN, ZDNet, BGR) have said the new Moto X is the best Android phone ever.

Ars Technica did a wifi battery rundown test, and the 2014 Moto X lasted 18% longer than last year's model. And the other reviews have said the screen was excellent. So this review seems like an outlier, but I'll find out for myself soon as I ordered mine yesterday.

Everything seems to have improved with this year's X, but the killer features for me are Motomaker and the extra software (the active display, voice control and assistant), and the leather back will I'm sure feel great when reading on the larger screen.

<comment><USER3> Anandtech has always given us much better and more quantitative information than Ars. Just to give my pet example, Anandtech sets displays to 200 nits for battery tests. Ars sets them to "50%" which is meaningless. According to Anandtech's measurement the 2014 Moto X has the same peak luminance as the old Nexus One that everybody hated, making it the dimmest phone you can buy today. The new Moto X at half brightness would be like an iPhone at minimum brightness.

<comment><USER2> Ars Technica: wifi browsing test, 200 nits, 526 minutes. [http://arstechnica.com/gadgets/2014/09/review-in-its- second-...](http://arstechnica.com/gadgets/2014/09/review-in-its-second- generation-the-moto-x-becomes-a-true-flagship/3/)

</comment></comment></comment><comment><USER4> I've stuck with Samsung, but my wife decided to get the Moto X, and I have to say, I'm impressed. And it's not the hardware, but the Moto software that is cool. Which is funny to me, because I've always been a giant hater of brand software (Dell,HP,Sprint).

It's little things like if you bump the phone, it displays the time. On my Samsung, I have to press the power button, and it takes a second or two before I can see the date/time, and then I have to remember to press power button again or risk butt-operating the phone as I put it back in my pocket. With MotoX it's basically as good as a watch.

It detects when you are driving in the car and it does a few really cool things. If you get a text message, it reads it out loud to you, and you can verbally respond back. If you get a call, you can verbally respond to take it or not. And it has an option in the drag down menu to turn it off in the case you are riding passenger, but my wife still uses the voice commands when she is riding passenger because it's so convenient/nice.

<comment><USER5> I'm glad you're enjoying your phone, but stuff like this sounds extremely gimmicky and just leads to phones being abandoned because there's such a great cost for the OEM to provide updated ROMs, support, etc for these custom OEM- only features. Many android users get maybe one update and, in a lot of cases for lower-tier phones, none. Buying a non-flagship phone more or less guarantees a dead end pretty quickly.

What android needs is an iOS-like system where everyone runs "stock" Android and these features are released as apps that are installed by default, instead of cooked into the ROM. Then OEM's should relinquish updates to Google, just like Google does with the Nexus line, its Play Store versions of certain phones, and now - all Android Wear devices. Funny how the "my god we need to differentiate our OEM devices" argument doesn't work for Android Wear devices. They all run the same software and everyone is happy. Now OEMs need to focus on looks, battery life, display, etc instead of putting in gimmicks and gaudy themes that are UI nightmares.

Meanwhile, you're suffering through Touchwiz on your Samsung, your wife's phone will never get another update after x date (especially with the recent Lenovo purchase), etc while iOS and Windows Phone keeps chugging along.

I switched from the Galaxy series to the Nexus series and am very happy. Its a totally different experience. Google has its "stock" Android product which reflects only a small bit of the Android market, but is vastly superior to the custom ROMs by the OEMs. Its a shame that Android has become such a fragmented mess of abandonware, especially with recent revelations about the AOSP browser's massive privacy bug which will literally never be patched. Even if google did a backport fix, no OEM or carrier is pushing it out to phones manufactured years ago or sold recently with a 3+ year old ROM.

edit: -4 downvotes? Reply to my comment if you disagree instead of abusing the downvote system.

<comment><USER6> _I 'm glad you're enjoying your phone, but stuff like this sounds extremely gimmicky and just leads to phones being abandoned because there's such a great cost for the OEM to provide updated ROMs, support, etc_

FYI: nearly all of Motorola's extensions are apps that are pushed through the Play store and thus separated from Android OTA updates. Besides that, they seem to have a good reputation for updates. The X is a year old now and will get Android L, which gives at least another year of mileage. That's at least two years. Isn't Google's guaranteed update window 18 months? (Although Nexus 4 seems to get Android L.)

<comment><USER7> There is no guaranteed upgrade window for Nexus phones/tablets.

<comment><USER6> _Devices may not receive the latest version of Android if they fall outside of the update window, traditionally around 18 months after a device release._

[https://support.google.com/nexus/answer/4457705?hl=en](https://support.google.com/nexus/answer/4457705?hl=en)

</comment></comment></comment></comment></comment><comment><USER6> I _really_ like my 1st gen Moto X. It really feels good. Active notifications are a big time saver and allow me to unlock my phone buttonless. Touchless control is just great, when we are having breakfast, I'll just ask the phone for weather or ask some fun factoid we were discussing. Updates are quickly released (I have an international edition).

The second gen looks great, but two things prevent making it an instant-buy for me: (1) the size, I like 4.7" and (2) the fact that the new generation Moto G has dual SIM and the Moto X doesn't (I am a Dutch person living in Germany, so I'd love dual SIM).

I'll wait a while to see if they are releasing an updated 4.7" at some point. If not, I might buy it at a lower price point (and after enough testing to see if I can live with the size) or look to alternatives (Z3 Compact etc.).

Of course, the 1st gen is still very snappy and will get Android L. So I am not in a rush ;).

<comment><USER8> really ? you talk to your phone during breakfast! I have siri and its not good enough to replace my cat as a breakfast companion.

Amazing, I need to check it out. Cannot believe we are discussing machine companionships in 2014.

<comment><USER6> I also talk to my wife and our baby :).

I am not sure if you have or had a baby, but sometimes you need to know what the weather will be that day, or how long it will take to get to XYZ. And with a baby, you always have too few hands, especially when they are having breakfast as well ;). So, yeah, it's handy if your phone can answer questions like 'what's the weather gonna be today' or 'how long will it take me to get to XYZ' without having to unlock it or pressing the power button...

I'll begin to worry if it starts talking by itself.

<comment><USER8> Fair enough. I was caught by the "fun factoid I was discussing" bit. Since it seemed you were talking to your phone before and was continuing some conversation you had with it prior.

</comment></comment></comment></comment><comment><USER9> The Moto X has been the best Android I've ever used.

I'm tempted to order the new Moto X right now now but I find it absurd that in a late 2014 flagship the only storage options are 16 and 32 gigs. I'll have to wait for a 64 gig one to be announced.

<comment><USER10> "Android phone", please :(

or "Android device". technically speaking, "Android" should be "Android-based" for all devices that aren't pure Android, which may or may not be the case for the Moto X, depending on which Moto X you get.

I also think that /slightly/ adulterated stock Android might be "close enough" to count as "Android" instead of "Android-based", but I'm not sure.

<comment><USER10> Nice downvotes. You guys might as well say "the iPhone 6 is the best iOS I've owned", "the Surface Pro is the best Windows I've owned", etc.

The level of shitty grammar/general incorrectness on tech sites for "savvy" individuals is quite embarrassing, IMO.

</comment></comment></comment><comment><USER11> The battery life is a little disappointing but not as disappointing as some early commentators made it out to be. It might also get better over time with updates (the Nexus 5 and LG G2 certainly did in my experience).

I love my LG G2's battery life. After some updates fixed AT&T specific software problems (wakelock issues) it is by far the best mobile device I've ever owned in terms of endurance, I can easily charge it just once over the weekend.

10 hrs of WiFi browsing (7 hrs of 4G) do, for many people, translate into easily two or even three days of average usage. Too bad the 2nd Gen Moto X only manages 7 hrs of WiFi browsing and 30 minutes less of 4G.

</comment><comment><USER12> This second gen is just an awesome phone but there are 2 things that really pushes me away from it.

It is sad because that is the only phone that I really like the design of.

\- It is just big, It really is. (for me)

\- Camera quality is nowhere near iPhone

</comment><comment><USER13> I'm mostly curious about the wooden and leather backs. Does it make a difference? Does it make sense?

<comment><USER14> I have a wooden back on my 1st gen Moto X. It's the "Teak" back. I also have the clear case over the whole thing, which adds some extra weight and bulk. I love the look of it and when I order the next gen Moto X I will probably get the same back. No real differences, it's really just a feel and aesthetic choice.

</comment></comment><comment><USER15> Damn it, I got the Moto X because it was the last of the sub 5.0 inch screen phones. Looks like it is time to switch to the samsung alpha.

<comment><USER16> Don't forget the Sony Z3 compact.</comment></comment>


Facebook, Inc Consumer Privacy Litigation - <AUTHOR> http://www.documentcloud.org/documents/6153329-05-29-2019-Facebook-Inc-Consumer-Privacy.html <comment><AUTHOR> As referenced from "Facebook Under Oath: You Have No Expectation of Privacy", [https://www.nytimes.com/2019/06/18/opinion/facebook-court- pr...](https://www.nytimes.com/2019/06/18/opinion/facebook-court-privacy.html)

A very interesting dialog between a US District court judge and a Facebook lawyer on how Facebook feels about privacy.

It seems that when pressed, Facebook says that as soon as you have shared anything to anyone, even if you have your sharing settings tightly controlled, you have no expectation of privacy with regard to that information.</comment>


Efficient and concise method for accumulating gradients in TensorFlow - <AUTHOR> https://stackoverflow.com/questions/50194651/efficient-and-concise-method-for-accumulating-gradients-in-tensorflow <comment><AUTHOR> I'm generally interested in benchmarks and/or good tutorials on different methods for accumulating gradients in TensorFlow.</comment>


When the Game Industry Thinks You're Too Old to Make Video Games - <AUTHOR> http://kotaku.com/when-the-game-industry-thinks-youre-too-old-1705240167

<comment><USER2> They're missing out on player trends - not every customer is a male teenager. Seniors play games too, but probably not _Death Killer 2000_ \-- more like _Words With Friends_. A little slower paced, more analytic. And they don't have to ask mom or dad if it's OK to spend money.</comment>


A Student's Guide to Preparing for Data Science Interviews - <AUTHOR> http://www.acheronanalytics.com/acheron-blog/how-to-prepare-for-a-data-science-interview <comment><USER2> Unfortunately there is very little here that isn't just general interview advice.

As a new grad that went through the hunt very recently - it was a messy process. Very few places will consider you without extensive experience, or a masters/Ph.D. Of course if you're hiring people to research machine learning algorithms that's justifiable, but plenty of the responsibilities people associate with data scientists don't require advanced degrees.

And the number of posts asking for 5, 7, even 10 years of experience... absolutely astounding.

As someone uninterested in going back to school, I've resigned myself to getting some work experience and doing personal projects for 1-2 yrs before trying again.

<comment><USER3> _spoopy01_ nailed it. Most of the people hiring data scientists don't really know what data science is, or probably even why they need it. So they inflate the hell out of the requirements to a. CYA and b. hopefully get somebody so experienced they can come in and make up for the lack of organizational understanding of data science. IOW, they want somebody who can "teach us what we don't know".

<comment><USER4> Teaching me what I don't know is what I want with all of my engineering hires. I want people better than me who will tell me why my architecture isn't ideal or whatever the case is.

<comment><USER3> Yes, but I'd argue that's on a different level from "teach us why we need an 'architecture'" or "teach us how to use this 'data science' stuff". Some people are trying to be buzzword compliant when they don't actually understand the buzzwords. Ya know?

Or maybe there's a better explanation for asking for a candidate with a Ph.D. in Statistics to create a linear regression model in Excel. Because truth is, for many companies that's all they need.

<comment><USER5> _a Ph.D. in Statistics to create a linear regression model in Excel_

Linear regression, logistic regression and k-means clustering, if you can get a project into actual real-money production on one of those, you are already well ahead of 90% of data scientists. And these techniques are decades old!

</comment></comment></comment></comment></comment><comment><USER6> So I've been interviewing for data analyst/science positions since leaving Apple in April.

I may do a postmortem on my search later, but speaking from my experience with many, many interviews over the past couple months, the TL;DR is that the conventional interview wisdom on Hacker News/the cscareerquestions subreddit/this article is _wrong and out of date_. Interviews for such positions require a different set of skills than just reading Cracking the Code Interview (and ones that you _can 't get at a data bootcamp_).

<comment><USER7> What kinds of technical questions do they ask in a data science interview?

<comment><USER6> On the stats side, often higher-level theory questions, such as "How does the k-means algorithm work?", "How do you select the best k for k-means?", "What is the curse of dimensionality?" which again would not be things covered at a data boot camp or data science thought pieces on Medium.

On the technical side, there is often more-advanced SQL (nested JOINs + PostgreSQL window functions). On the big data side, there is often discussion of distributed systems (e.g. Spark clusters) and practical algorithmic complexity at scale (i.e. instant fail if you suggest anything loglinear or slower).

<comment><USER8> I overheard some colleagues talking about a recent interview where a candidate with "stellar industry experience", i.e. Kaggle wins and previous ML experience at a valley company, who couldn't explain Bayes rule to them, let alone rederive Naive Bayes. While books like the one below are extremely theoretical, anyone interviewing for these kind of roles should spend at least a week or two just looking through this to see what kind of algorithms and properties are studied in theory.

Foundations of Data Science (Blum, Hopcroft, Kannan) [https://www.cs.cornell.edu/jeh/book2016June9.pdf](https://www.cs.cornell.edu/jeh/book2016June9.pdf)

<comment><USER9> This is like not hiring a [big name coding competition] winner because he didn't know radix sort.

<comment><USER10> I think it's more like not hiring a big name coding competition winner because they never bothered to learn how to use version control, or any coding best practice, or any language other than C.

Trying to do data science with zero knowledge of the fundamentals of probability is _dangerous_. Bayes rule isn't some kind of deep magic, it's covered within the first few lectures of an undergraduate probability course and it's absolutely necessary to understand the output of any machine learning model.

<comment><USER9> >I think it's more like not hiring a big name coding competition winner because they never bothered to learn how to use version control, or any coding best practice, or any language other than C.

Depends on what you're hiring for, but I'll take "competition winner with no version control" over "average programmer with expert VC capabilities".

>Bayes rule isn't some kind of deep magic

Yes, it's largely conceptually obsolete.

The people jamming out weekly SOTA machine learning models on arxiv aren't sitting around meditating on conditional probabilities. They're making little tweaks to giant models that are basically impossible for a human to comprehend.

<comment><USER11> > Yes, it's largely conceptually obsolete.

I'm sorry, what? How did you arrive at a point where you believe this is true? This is like calling compilers "obsolete."

Is it because you believe deep learning has "taken over" or something?

<comment><USER9> Try to derive e.g. a face detector from bayes theorem. You immediately arrive at computationally intractable sums/integrals. Yet, we have super-human image classifiers. Therefore, bayes theorem is obsolete. Sure, you can try to retrofit bayes theorem on top of a neural net, but who cares?

<comment><USER11> > You immediately arrive at computationally intractable sums/integrals.

So we instead sample from that posterior.

Unless you think MCMC is also obsolete, in which case I'll see myself out.

<comment><USER9> You're right, but a) you have comp efficiency issues with MCMC, and b) just empirically MCMC models don't work as well as gradient descent + NN for many tasks.

<comment><USER11> And you don't have computational efficiency issues with NNs?

We're also ignoring the benefits of a posterior distribution, which is useful for understanding the data-generating process.

<comment><USER9> Yeah of course. I can't explain to you why NNs outperform bayesian approaches, probably just NNs are capturing the correct type of prior for vision/language tasks. And yeah bayesian models are more interpretable but when you have millions of latent variables I'm not sure interpretability is a thing.

<comment><USER11> Yep, we arrived at my larger point: if you care about interpretability, NNs are horrible and Bayesian techniques are pretty damn great.

<comment><USER9> Well certainly, but interpretability is obsolete.

<comment><USER11> Now you're just trolling. :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Analyzing the Analyzers, free eBook. Assuming the student is sharp on technical skills, this look at the human side could be helpful to prepare. [https://www.amazon.com/Analyzing-Analyzers-Introspective- Sur...](https://www.amazon.com/Analyzing-Analyzers-Introspective-Survey- Scientists-ebook/dp/B00DBHTE56)

</comment><comment><USER13> How many data scientist jobs are actually out there? I can understand data scientist being a position at one of the big 5 tech companies, but are they really in demand elsewhere?

I've never actually met someone off the internet who calls themselves a data scientist.

<comment><USER9> Technically anybody who uses Excel is a "data scientist". Just got to get the right buzzwords.

<comment><USER11> This is absurd and false. This person is an analyst of some sort.

Maybe this holds in the consulting world? It definitely does not hold in the tech world, IME.

<comment><USER5> _This is absurd and false. This person is an analyst of some sort._

And what is a data scientist then, if their work does not involve analysing data and presenting their analysis?

99.9% of "data science" is exactly what people used to do in tools like Excel, MATLAB, even SQL, just in Jupyter instead. On a Mac while sipping a latte.

<comment><USER11> > And what is a data scientist then, if their work does not involve analysing > data and presenting their analysis?

This is a dead giveaway that you have no idea what you're talking about. You've captured about 5% of my work.

The rest of the time, I'm writing software (ETL pipelines or real-time services, including tests), debugging some distributed system, collecting or cleaning data, or gathering requirements and developing feature specs with other folks.

Fortunately for you, you nailed the Mac-using latte-drinking part!

EDIT: Reading your comment history on regression and k-means. you _do_ know what you're talking about. It _is_ hard to get models into production, so I'm surprised to see your snark here. What gives? Do you have experience with DS who don't deliver?

<comment><USER5> _What gives? Do you have experience with DS who don't deliver?_

I have experience of DS who define what they do by the tools they use, not the results they deliver, it's a pet peeve of mine :-)

Thanks for going back and making the edit!

</comment></comment></comment></comment></comment></comment><comment><USER14> The thing is : Data Science requires ... "scientific" rigor and thought process. A lot of people who hire often forget that science is integral to data science: it's right there in the name.

<comment><AUTHOR> I think this was posted earlier. But some companies really just want a statistician.

Very few companies are actually using their data scientists as scientists. From my experience.Except for when I worked at a large hospital. We had a research board, and had to be certified to study Humans CITI. But beyond that..

<comment><USER5> _But some companies really just want a statistician_

In what way is what statisticians do _not_ "scientific"? Setting up and rejecting (or not) the null hypothesis is the very definition of the scientific process...

</comment></comment></comment><comment><USER9> "Data science" is a field with so much conceptual churn and fads that interviewing for it is a completely ridiculous notion.</comment>


I almost forgot today was the Erlang Day! - <AUTHOR>

Happy Erlang Day to Joe Armstrong and to the Hacker news community! <comment><USER2> Why is it Erlang Day?

PG started a mini-meme, but that doesn't make this a canonized day. So unless it really _is_ Erlang Day, this thing stops now.

<comment><USER3> Yes, it is an amusing joke, but this is just silly. I dare day, it is now counter to what PG intended. Specifically the Thread Starting Post.</comment></comment>


Show HN: Ipfs-dropzone, a subclass of Dropzone.js that publishes to IPFS - <AUTHOR> https://github.com/fiatjaf/ipfs-dropzone <comment><USER2> > I don't know how to publish this package in a way all JS transpilers and > bundlers out there can understand. Please help me.

Don't do this:

        module.exports = IPFSDropzone

Do this (and change documentation accordingly)

        module.exports = {IPFSDropzone}

or to go full ES6 do this

        export {IPFSDropzone};

add the package babel-env and add this script to package.json:

        "scripts": {
          "prepublish": "node node_modules/babel-cli/bin/babel *.js -d build/"
        },

and change main to "build/index.js".

Run "npm run prepublish" to test.

Edit: Now that I think of it, compiling with babel is probably unnecessary. But it doesn't hurt and can help old setups.

<comment><USER3> Why not send a PR?

<comment><USER4> teach a man to fish

<comment><USER5> Give a man a fire, he's warm for a day. Set a man on fire, and he's warm for the rest of his life.

<comment><USER6> This is brilliant.

<comment><USER5> Terry Pratchett, RIP.

</comment></comment></comment></comment></comment></comment><comment><USER7> One thing I've failed to find out about IPFS: who pays for hosting? The user? Or is it donated by some peers?

<comment><USER8> This is the #1 thing I see people confused about with IPFS. Basically, there's 3 ways for content to become available:

1\. You add the files to your own node. This is how content gets added, but obviously it only lasts as long as your node is connected to the Internet, just like an ordinary HTTP server.

2\. Someone views your content using their node. This causes their node to cache the content temporarily (IIRC for 30 minutes by default) and publish it to other nodes. In theory, if your content got at least one view every half hour it could live on in the users' caches forever.

3\. Someone tells their node to _pin_ your content. The node will then keep it permanently (until they unpin it) and serve it whenever it's connected to the Internet. Generally they would do this if they believe it's valuable--either because they want to keep it themselves, or as a public service to make it available to others (for example, pinning the Turkish Wikipedia to help evade censorship).

There are also several _pinning services,_ which you can pay to have them pin your content on their node, in much the same way as you'd pay a hosting provider to serve your content.

<comment><USER9> In this case, it appears the node is in your browser, right? Does it go away when you close your tab? In which case your link will survive for 30 minutes, or is it just gone?

<comment><USER8> It looks like ipfs-dropzone is running an in-browser node, which would go away as soon as you close the tab (since it's just a web page like any other). Content on IPFS stays available for as long as there's at least one node which has it and is connected to the network, so how long the link would survive for depends on whether other nodes have it and how long they will keep it for. If nothing else has downloaded the content then it will go away; on the other hand, if someone has pinned it then it will stay forever (or until they unpin it or go away).

The 30 minute interval would apply to the IPFS gateway that someone else would use to download your content (generally a standalone process though I believe there are efforts to make a browser with an embedded gateway). IPFS nodes automatically publish their cache, effectively making an autoscaling distributed CDN. However they will only cache content that they have gotten on behalf of their user; they won't go out and pull random content from the network to host it.

<comment> roland-s Man, I typed a whole reply saying basically the same thing but you beat me to it! To expand a bit further, in this demo app, the "Save" button calls an API of a pinning service (Eternum), which pins the file on an external node so it will stay there as long as it's being paid for. Right now most pinning services require that you pay them to host your file, but the plan for IPFS is to use something like Filecoin to incentivize pinning. With Filecoin, instead of paying a single service to host your content, you would put out an order to the Filecoin network which says "anyone who hosts my file gets $x per GB per second", along with some settings (e.g. I want minimum 5x copies of my file on the network). Then, anyone hosting a Filecoin node will automatically fulfill requests by hosting content in exchange for a cryptocurrency payout. So, instead of a single hosting service, you are paying the entire network to automatically host your file in many places at once.

<comment><USER10> Wait, I thought IPFS was P2P. What's this with the payment stuff?

<comment><USER11> To compare it with torrenting: The only incentives to "seed" a torrent file is usually just good will, or to build a reputation to get into invite-only sites.

We lose the latter incentive with IPFS, and so Filecoin is replaced as the new incentive to give up storage space for the P2P network.

You can still put your content up on IPFS for free, it's just that only your IPFS node will be hosting the content, and thereby won't be truly decentralized. You're the only "seeder", so to speak.

<comment><USER10> Thanks. I went to the Filecoin site to see more but it said the same has ended and to not fall for scam sites. How do I obtain filecoin? When will I be able to earn filecoin from hosting content for others?

Is hosting content the way that it is mined? Or is mining it something else?

<comment><USER11> That, I'm not 100% sure about. Filecoin had their ICO, now it just needs to be implemented with IPFS.

Once implemented, you should be able to buy Filecoin from market exchanges. To earn it, Filecoin will use two "proofs-of-storage". One is "proof-of- replication" wherein your IPFS node proves to be replicating data, and "proof- of-spacetime" wherein your IPFS node proves to have stored said data for a certain amount of time.

You can read more about from their whitepaper: [https://filecoin.io/filecoin.pdf](https://filecoin.io/filecoin.pdf)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> There was someone (victorbjelkholm) talking about the zoom-out limits of [https://filemap.xyz/](https://filemap.xyz/) on IRC and I couldn't reply there:

I've arbitrarily imposed these limits because the purpose of the app is not for casual visitors to wander around the world browsing everybody's files, they're supposed to go to specific addresses and browse only their files there.

This measure will not protect anyone absolutely, since an "attacker" can easily read the entire database and figure out where are all the files, but it protects users from 99% of the casual visitors.

</comment><comment><USER12> I have to say that DropZone is supercool and this project makes a lot of sense. We also use Dropzone.js to store files and their Hash values at VisiFile. A demo is here:

[http://188.8.131.52/](http://22.214.171.124/)

The code is here: [https://github.com/zubairq/visifile/blob/master/public/index...](https://github.com/zubairq/visifile/blob/master/public/index.html)

</comment><comment><USER13> Really cool demo. One suggestion is to make the dropzone more obvious. I didn't realize you had to scroll down to find the dropzone.

<comment><AUTHOR> Thank you. I'll try to think in a better layout.

</comment></comment><comment><USER14> Wondering if anybody would be up for adding this to uppy.io

<comment><AUTHOR> The code is amazingly simple: [https://github.com/fiatjaf/ipfs- dropzone/blob/8d7d8808ba578a...](https://github.com/fiatjaf/ipfs- dropzone/blob/8d7d8808ba578a265aa92e14912959c712903cc4/index.js)

If someone knows where to plug into Uppy's upload function then it should be really easy.</comment></comment>


Ask HN: How do you protect your Javascript-powered WebApps? - <AUTHOR>

Let's say I have a web application like a drag-and-drop Website Builder or something like Google Docs. If someone chose to right click and save the page, obviously our code along with its logic gets saved too. So assume this is a paid service, if the user has the source code, then he could generate infinite number of websites with the offline copy he has. The website builder is just an example, but I'm just asking for similar applications. How do you implement protection for such scenarios?
Obviously, you can't stop the user from saving the source-code, but I was thinking maybe you can perform some "validation" or "tests" within the JS to see if the editor is live from the intended URL. But, I'm not sure, how would you do it, if you had a full-fledged JS powered application? Your thoughts?
Thanks <comment><USER2> It is not really a problem.

If someone saves out your source code, then they can. You can put a copyright notice on it.

If they use it on their web site without permission, they're violating copyright. However, that isn't why it's not a problem.

All of your:

* Version history (except for public versions) * Unit tests, test plans, test data, test results * Bug trackers * Developers notes; QA engineers notes * Code maintenance manuals * Developers brains; QA engineers brains etc.

Are private, and someone leeching your content cannot obtain them.

Not to mention the fact that, if there are any server-side components, they'd need to reimplement them.

The time it would take them to understand your code, reproduce all the missing parts, they could just as well develop it themselves.

In fact, if they hired engineers with the calibre required to do that, the engineers would probably WANT to implement it themselves, not rip yours off.

Do not consider that the .js files are all of your development information. They aren't.

Additionally, the version that they leech is always going to be "behind" the one you're developing, right?

So in the time they take to figure out how your code works and how to integrate it with their own back-end systems, you'll have released a better (At least hopefully better) version. So they're permanently behind you, with an inferior product.

<comment><AUTHOR> Thank you for the insightful comment :)

<comment><USER3> Just wanted to add to the insightful comment, so what if another person uses a function in that .js code to solve their problem, your ideas stay yours. Also you can close down your IP into the server programming environment and call that from your .js I personally think that the proper balance between close ideas and open solutions is what spurred the web world beyond any other programming environment.

</comment></comment></comment><comment><USER4> If it's a web app and it makes API requests it might be pretty hard to make cross-domain web requests. So if your app is naturally complicated enough this isn't an issue.

If it's like a javascript web game without much of a server component, you could try to hide a lot of the execution of the code within in a closure. dynamically loading the code with a script would add to this obfuscation.

in the end you are probably fine.

one final bit of obfuscation that i have always wanted to try was to load the JS via a web-socket on a worker process. that should even hide a lot of the js file being loaded.

if you needed to go farther some people have even done some degree of encryption. again all of this is probably way more than you need. I've never worried about this. if someone has the time to steal your code and work with it you should probably hire them or go have coffee with them and ask for feedback.

it's a great honor for someone to read and interact with your code.

</comment><comment><USER5> >Obviously, you can't stop the user from saving the source-code, but I was thinking maybe you can perform some "validation" or "tests" within the JS to see if the editor is live from the intended URL.

Anyone trying to steal your code would simply remove those tests. As MarkR42 said, your main protection is that your production code, by itself, just isn't worth that much.

<comment><AUTHOR> Yep, thanks matey!

</comment></comment><comment><USER6> Has anyone actually found really good javascript source that they actually liked and would rip off?

I'm sure it exists but 90% of it is a mess and it would be easier to reimplement. The other 10% is beautiful but only works if you have all the proper server side code.

<comment><USER7> I think it would be done fairly frequently with HTML5 games or stand alone tools like he was talking about. If it had zero back end then it would cost nothing for someone to just rip and host on their own site. People do it with flash games all of the time. Throw ads on the page and get some better SEO and you're golden.

</comment></comment><comment><USER8> If you're concerned about code theft, you can always just use a minimizer. That usually obfuscates your code beyond readability.</comment>


How data collection helped Pusher optimise its Javascript library - <AUTHOR> http://blog.pusher.com/how-we-built-pusher-js-2-0-part-3-metrics/

<comment><USER2> The thing that interests me most about this is the potential for changing configuration on-the-fly to deal internal or external network conditions, or simply from additional information extracted from the metrics.

I don't know of any other realtime web service that has this capability.</comment>


Esimate distances with your arm and this rule of thumb - <AUTHOR> http://lifehacker.com/5351728/estimate-distances-with-your-arm-and-this-rule-of-thumb

<comment><USER2> Nice!

And here's a little story for you. After reading this, I thought I'd try it out. How far am I from my screen? Hold out thumb, switch eyes. It moved about an inch. So I'm 10 inches from my screen? I'm holding my arm straight out, and it doesn't touch the screen. My arm is certainly longer than 10 inches. What's wrong? Ah, this rule gives the distance of the object _from_ _my_ _thumb_ , not from my eye. Sometimes the two are significantly different.

</comment><comment><USER3> In order for this to work, you have to accurately estimate the width of your target.

<comment><USER4> In many situations you'll be able to find something close by whose width can be estimated -- perhaps a door, a car, a tree...

</comment></comment><comment><USER5> Doh, another one of these binocular-visual-only tricks. Racism!</comment>