Burrito-Delivering Drones–Seriously? - <AUTHOR> https://www.technologyreview.com/s/602356/burrito-delivering-drones-seriously/?set=602357 <comment><USER2> Publicity stunt, what else? Both Alphabet and Chipotle get to hit the top of the news again.</comment>


Libc++'s Implementation of std::string - <AUTHOR> https://joellaity.com/2020/01/31/string.html <comment><USER2> Reminds me of a talk a few years ago about Facebook's internal implementation of std::string. They do the same short string optimization, but Facebook manages to outperform this implementation by storing 24 bytes (vs 23) in "short string mode".

IIRC, Facebook achieves this by using the last byte as the flag byte. To signify short string mode, this flag is set 0. This allows it to also serve as the null terminator. Tricky!

<comment><USER3> It's a tradeoff. In libc++'s version you still have string size stored in the top 7 bits so you just need a bitshift to get size. It sounds like fb's implementation would require looping until null terminator to get the size.

<comment><USER4> To save those who, like me, were going to comment 'that would violate the standard because std::string::size is required to be O(1) complexity' a Google - the standard recommends but doesn't require that.

<comment><USER5> Facebook's implementation would still be constant time for short strings, because there's a constant which bounds the runtime.

Though I hear that the definition of big-O notation has shifted a bit in Silicon Valley these days so maybe that answer would get me in trouble in an interview.

<comment><USER6> It's true that big-O notation only concerns behavior with large N, but it's a bit disingenuous to say that the loop executes a constant number of times -- by that argument, you could say that if you implemented size() by strlen() it's O(1) because the string must be less than 2^64 bytes long on a 64-bit machine.

So I can see why someone would claim that implementing size() via strlen() "only" for small strings shouldn't be considered O(1), because strlen() is O(n) and within that class of strings the runtime is increasing as the length increases.

<comment><USER7> I think it's a bit more disingenuous to compare the magnitudes of 2^64 and 23 for the sake of argument, as if 2^64 isn't practically asymptotic.

</comment></comment></comment></comment></comment></comment><comment><USER8> Note that this implementation has undefined behavior according to the standard because union members are accessed that haven't been written to. The code that tests whether it the string is long or short, accesses members of the union unconditionally.

This is fine because std::string is provided by the standard library and the standard library is allowed to do stuff normal libraries are not allowed to do. This technique does work in practice, but it is technically undefined behavior.

<comment><USER9> > standard library is allowed to do stuff normal libraries are not allowed to > do.

How does this work, given that it's still written in C++? Is there special casing in the compiler to define the behavior?

<comment><USER10> It will only ever be compiled with clang, so as long as clang doesn't implement this behavior in a way that will cause it to be incorrect, that's fine.

If it were to be special-cased, it would probably require an attribute or a pragma or something. While it's not unheard of for compilers to automatically detect they are compiling the standard library, it's fairly rare.

<comment><USER11> libc++ is compiled by compilers other than clang. It's a completely invalid assumption that it will only ever be compiled by clang, because it's never only over been compiled by clang.

I say this as someone with a full time paid job supporting libc++ compiled by another compiler for a commercial organization in a safety context.

<comment><USER10> Oh, that's good to know. If obscure C++ compiler X were to cause incorrect behavior of this code, would it be easy to upstream the fix?

</comment></comment></comment></comment></comment><comment><USER12> _The short string mode uses the same 24 bytes to mean something completely different._

...and the reason short strings are that length is precisely because a long string needs that amount of space to store the pointer, capacity, and used variables anyway. On a 32-bit system, the short string limit is lower by half.

Also, as optimised as this implementation is, I have yet to see a compiler that's smart enough to do things like replace "dumb" uses of std::string with essentially the equivalent of what a smart C programmer using pointers would write (as the saying goes, "the fastest way to do something is to not do it at all.") Ditto for the other data structures in the library. In other words, optimising individual classes approaches a local minima.

<comment><USER13> And the smart assembly programmer laughs at the C programmer. There are a couple dozen string-oriented x86 instructions that I've never seen a C or C++ compiler produce. You could easily get a 2x speedup on strings by hand writing clever x86 with SSE. In fact I'm surprised no one has made an STL with lots of inline assembly.

<comment><USER14> Most of what I know predates SSE; does that have a long track record of being fast? I know REP MOVSB was originally fast, and then CPU vendors decided it was rarely used and did it in (slower) microcode, and then architectural changes made it fast again sometimes depending on alignment.

<comment><USER12> REP MOVS is still a microcode loop, but it will copy entire cachelines (usually 64 bytes) at once if it can. The fact that it is a tiny instruction (2 bytes) and runs in microcode means that it doesn't consume instruction fetch bandwidth while it's running, and occupies only a tiny amount of the instruction cache.

</comment></comment></comment></comment><comment><USER15> Here's something that once bit me. The libc++ implementation uses short string optimization. Which means no heap allocation for short strings. Unfortunately I didn't know this and naively thought when you std::move a string, the data() buffer would remain unchanged. This is then incorrect. You can manifest this by storing strings into any container that moves their elements around like std::vector or absl::flat_hash_map.

<comment><USER16> > when you std::move a string, the data() buffer would remain unchanged

You cannot assume anything about the state of a moved-from object. AFAIK, the only valid operations are destruction and assigning something else to it.

<comment><USER17> > You cannot assume anything about the state of a moved-from object.

This is the right default assuption, but classes are allowed to have (and document) more specific behaviour. For example, it is guaranteed that std::unique_ptr and std::shared_ptr are empty (nullptr) after they have been moved from, and std::vector is guaranteed to be empty after it is moved from so long as the destination allocator is the same.

> AFAIK, the only valid operations are destruction and assigning something > else to it.

Even for classes whose move constructors have no guarantees, there are often other methods that don't have any preconditions, such as calling clear() or resize(0). In fact is it allowed to call other operations and they should behave consistently, it's just not guaranteed what exact value the object should have (e.g. if size() > 0 then .at(0) should not throw and a second call to it should return the same value as the first call to it).

<comment><USER16> You're right. But I've given up "language lawyering" a long time ago: I have a set of "rules of thumb" (like the one I just wrote) that exclude some technically valid programs, (but so be it) and that let me write robust code quickly without spending time on digging through the documentation for special cases.

Even if I did know every single edge case in the language and library, the developers next to me might not. Then they decide to emulate me (many learn by example) and catastrophe ensues.

</comment></comment></comment></comment><comment><USER18> I always wondered why these string implementations have full 8 bytes for length. Many programs use millions of strings (or more), while very few would ever use a >2GB string. It would make sense to use, say, "not-too-long string optimization" where you only store 4-byte lengths for any string <2GB, and use the remaining one bit to mean "the length is in the data block".

But I guess these people have run the benchmarks. ...Or maybe not. I have to wonder.

<comment><USER19> It could be done as you say, in 16 bytes (assuming 64 bit pointers):

        struct not_too_long_string {
            char* data;
            uint32_t size;
            uint32_t capacity;
        };

Of course, if you do it that way then the longest string you can store with the small string optimization is probably ~15 bytes instead of ~23. So although you do save 1/3 on the size of each string, on average you're probably still going to end up doing a greater number of dynamic allocations because of the reduced small string capacity. Unless of course you know a priori that a sufficiently large portion of your strings will be > 15 bytes anyway, which of course the implementors of std::string almost certainly don't know.

Edit: I failed to notice the part about the length being in the data block (doh). I guess the disadvantage to putting the length there would be that an extra indirection is required to get the length, a rather common operation. And as others have pointed out, that only saves 4 bytes, which will be used anyway for alignment..

<comment><USER20> If you want to get really fancy, you can do it in 8 bytes. Pointers are only 48-bits on 64-bits, so you can squeeze a 16-bit size field. If size overflows that, then you can use a cookie before the data string to find the size. Capacity could be stored in such a cookie, or junked entirely and you rely on your memory allocator to get the size of the allocation (small-string optimization obviously not even being considered in this model).

</comment></comment></comment><comment><USER21> > I will assume that ... the char type is signed and 1 byte wide.

You don't really need to make an assumption about being 1 byte wide. That's guaranteed by the standard.

[https://en.cppreference.com/w/cpp/language/sizeof](https://en.cppreference.com/w/cpp/language/sizeof)

<comment><AUTHOR> Thanks! Fixed.

<comment><AUTHOR> Interesting, the page you linked also says this.

>Depending on the computer architecture, a byte may consist of 8 or more bits, the exact number being recorded in CHAR_BIT.

I'll add that as an assumption.

<comment><USER22> Does it make a difference? It doesn't seem like your article relies on CHAR_BIT being 8.

</comment></comment></comment></comment><comment><USER23> In situations when there might be a lot of _empty_ strings, the 'capacity' and 'size' can be taken out of the fixed part and bundled with the data instead.

This will bring sizeof(string) to a size of a single pointer and will still allow for short strings of 7 chars (in 64-bit builds).

Memory allocations are usually aligned by default, so the pointers will have at least one lower bit cleared and available to be used as a mode flag.

If in doubt, allocating through aligned_alloc(2,...) will guarantee an unused bit in a pointer.

<comment><USER24> Yes, sometimes it is worth to optimize for size, especially if the string is actually not used in any fast path and just need to be there.

I'll mention though that std::string (well, basic_string) takes an allocator parameter, so it could only enable this optimization for 'well known' allocators that provide aligned buffers.

</comment></comment><comment><USER25> Isn't the __cap__ field available also inside the malloc block header, so couldn't this field be optimized out of the std::string implementation?

<comment><USER22> No. You can't make assumptions about how global operator new works. Allocators like tcmalloc are allowed to override it. And string can be instantiated with any stl allocator, so it might never call ::new anyway.

</comment></comment><comment><USER26> Does anybody know why vector isn't allowed short buffer optimization or if it will be changed in the future?

<comment><USER24> You could say that while most string are small, vectors are all kind of sizes and the T size itself can be large, so the optimization is less of a win in for a general purpose container.

But it is mostly for historical reasons. I believe the original STL used the SSO optimiziation [1], so there was never any assumption about the stability of references to string elements, while there is a lot of code that assumes that references to vector elements do not change.

[1] The SGI STL, direclty derived from the original HP STL had extensive rationale on why it didn't implement COW; libstdc++, which I believe also traces its roots from it, decided to instead do COW. The rest is history.

</comment></comment><comment><USER27> Typo in title. That's std::string.

<comment><AUTHOR> Thanks! I don't think I can edit it now though :(

Does the edit button disappear after a certain amount of time?

<comment><USER28> I don't believe you can ever edit the title of a submission, but the mods can (and typically will).</comment></comment></comment>


Why cant you tickle yourself? - <AUTHOR> http://www.bbc.com/future/story/20150109-why-you-cant-tickle-yourself <comment><USER2> It is easy to tickle yourself: touch the top of your mouth lightly with a finger and stroke it forwards towards your teeth. Extremely ticklish! Do not try it on other people unless you want a bad involuntary bite...</comment>


SOMEONE is learning how to take down the internet - <AUTHOR> http://www.economist.com/news/science-and-technology/21709286-recent-attacks-internet-could-be-prelude-far-worse-ones-crash-testing?fsrc=scn/tw/te/pe/ed/crashtesting <comment><USER2> The article is confusing several data points into one:

      * Schneier's article[1] detailing what seem like "test attacks", to discover how to take the internet down,

      * The attack against Brian Krebs[2], using the Mirai botnet

      * The attack against Dyn[3], also using Mirai

The article implies that all three points are related into a single story. But Schneier himself suggested that his report and the attack on Dyn are not related, and that it was more of a coincidence [4]. Krebs suggested that Mirai may have been released intentionally to hide the creators among a sea of attacks [5].

Whoever is probing the internet is (probably) a state actor, while Mirai is used by "regular" users. These are three separated events, and not a growing campaign against the US elections.

[1] [https://www.schneier.com/blog/archives/2016/09/someone_is_le...](https://www.schneier.com/blog/archives/2016/09/someone_is_lear.html)

[2] [https://krebsonsecurity.com/2016/09/krebsonsecurity-hit- with...](https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record- ddos/)

[3] [https://www.schneier.com/blog/archives/2016/10/ddos_attacks_...](https://www.schneier.com/blog/archives/2016/10/ddos_attacks_ag.html)

[4] [https://www.schneier.com/blog/archives/2016/10/ddos_attacks_...](https://www.schneier.com/blog/archives/2016/10/ddos_attacks_ag.html)

[5] [https://krebsonsecurity.com/2016/10/source-code-for-iot- botn...](https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai- released/)</comment>


UAE to build first city on Mars by 2117 - <AUTHOR> http://gulfnews.com/news/uae/general/uae-to-build-first-city-on-mars-by-2117-1.1978549 <comment><USER2> Two things:

Will UAE have the money in 100 years when oil will presumably be depleted or not as valuable?

Will UAE still exist with global warming and all?</comment>


Struggling Towards Reliable Capybara JavaScript Testing - <AUTHOR> https://bibwild.wordpress.com/2016/02/18/struggling-towards-reliable-capybara-javascript-testing/ <comment><AUTHOR> I've been struggling with Capybara for some time now. I found this post and it was really helpful. I thought some other people might also appreciate it on here.

Slowly coming to the conclusion that it's a major waste of time trying to achieve 100% with Capybara, I decided to reduce the relative amount of feature/integration tests we have and increase the amount of unit and functional tests.

How are you guys handling this issue?</comment>


Court orders Germany to question US drone strikes - <AUTHOR> https://www.dw.com/en/court-orders-germany-to-question-us-drone-strikes/a-47979480 <comment><USER2> This concept of targeting civilians in a "continuous combat function" is pretty complex.

I started reading about it [1] and 20 minutes later feel like I've barely skimmed the surface of how hard it must be in modern combat modalities to actually enforce this.

My brother is a JAG and worked on authorization of force issues in Afghanistan. Part of his job was ensuring that rules of engagement were being followed, but I'm looking forward to a more in-depth conversation — if he's willing to have it — next time we see each other.

People that are not in a regular armed force, do not wear a uniform, hold rank, or report to a superior, may still be taking an active role in combat. Can someone be a farmer by day, and a combatant by night? (a questioned posed by the footnoted article) How long can they be directly targeted as a combatant after a hostile act? What is a hostile act?

 _Continuous combat function requires lasting integration into an organized armed group acting as the armed forces of a non-State party to an armed conflict. Thus, individuals whose continuous function involves the preparation, execution, or command of acts or operations amounting to direct participation in hostilities are assuming a continuous combat function._

Turns out there are fairly complex guidelines for all of this, and with the amount of intelligence that is collected in the modern battlefield, there's even a chance to track this down to the individual level.

The _continuous combat function_ designation seems quite narrowly tailored, for example it does not include military, political, or administrative personnel who do not directly participate in hostilities (how convenient for the politicians it is defined this way!). It does not include reservists who are not actively serving.

A civilian who is not serving a continuous combat function in theory can only be subject to direct attack while they are directly participating in hostilities, which seems to include the planning, lead-up, execution, and return from a hostile operation.

Apparently very little of this is explicitly defined under international law, but there is a history and case law which can be used to draw guidelines from.

[1] - [https://casebook.icrc.org/case-study/icrc-interpretive- guida...](https://casebook.icrc.org/case-study/icrc-interpretive-guidance- notion-direct-participation-hostilities)

<comment><USER3> Complexity is the fig leaf for the majority of modern evil- in the USA at least.

It's too complex to understand! too complex to make a judgement.

Let's think about your farmer that tries to fight against the soldiers of a government from the other hemisphere that are killing people within his country- when he isn't trying to get food to survive and feed his family.

Is that actually a complex situation? No. There is a force from a world away killing farmers in Afganistan for reasons that can not be explained except to say 'it's complex'

<comment><USER4> > can not be explained

Aren't they being killed for violent insurrection and terrorist activities?

<comment><USER5> Invading another country in a war of aggression is against international law. I don't buy the argument that the US has any moral high ground here.

If another country started launching drone strikes on your country, overthrew your government, and stationed troops in your cities to quell insurgence -- how would you react? Would you accept the status quo or would you fight? Do you think they would also classify you as a terrorist for protecting your home?

<comment><USER4> > for reasons that can not be explained except to say 'it's complex'

I explained it.

Are you saying it's more complex that?

<comment><USER5> The point made was almost certainly sarcastic -- that the government and media want to obfuscate the reasons why people are being killed. The point was that the reasons why people are fighting against US occupation are much less complicated than the media would have you believe.

I was pointing out that referring to retaliation against an illegal war of aggression as "violent insurrection" and "terrorist activities" is not an accurate portrayal (unless you'd also refer to US foreign policy as a terrorist activity).

</comment></comment></comment></comment></comment></comment><comment><USER6> I've often wondered where the voice of civilians in warzones is.

Surely at least some of them can get a Twitter/Facebook campaign going viral saying "Who bombed my grandma?" with photos of shrapnel etc which would implicate a US drone strike.

There seems to be some kind of information firewall - only official journalists embedded with allied forces ever seem to be able to put anything on the bit of the web I see.</comment>


Ask HN: Why Does Most Forum Software Have Flat Commenting? - <AUTHOR>

It seems like a lot of forum platforms make their commenting flat making it really hard to discern what is going on.<p>Why aren't there more packages where the comments/replies stagger like Reddit or HN? <comment><USER2> I like flat comments that are ordered by date in a forum. Nothing surpasses a vBulletin-style board in my opinion.

Forums are for a different style of discussion than what is done here on HN. I'm thinking of tech support or more general questions and answers where when a question has been answered the thread is over and it fall.

<comment><USER3> Yeah the stagger comments kind of bother me personally and make it hard for me to follow. I like flat comments. But I think that is because that is what I am used to on the forums I frequent.

<comment><AUTHOR> Ok, personally I really like the conversations that staggered comments allow - one group of people can go off on their own little tangent while the rest of the users attend thier own conversations within the topic thread without having to randomly create new conversations

<comment><USER3> I definitely see the benefit, because I can ignore all other posts. But when the topic or thread gets big, it just gets overwhelming for me. But I guess that can be the case either way.

</comment></comment></comment></comment><comment><USER4> Flat commenting structure allows you to reply to multiple comments at once. A flat structure also allows you to easily see the most recent posts.

Perhaps mailing lists are better overall, as the client software can sort messages hierarchically or chronologically.

</comment><comment><USER5> Jeff Atwood has two posts on the topic that support flat comments. Personally I prefer threaded.

[http://blog.codinghorror.com/discussions-flat-or- threaded/](http://blog.codinghorror.com/discussions-flat-or-threaded/)

[http://blog.codinghorror.com/web-discussions-flat-by- design/](http://blog.codinghorror.com/web-discussions-flat-by-design/)

</comment><comment><USER6> 4chan threads have a nice linear system where people refer back to previous posts in the thread without duplicating them over and over (as typically happens with BBcode style quoting). This works especially well with mouse- hover viewports to the backreferences.

</comment><comment><USER7> I like hierarchical if I can collapse threads I'm not interested in and comment volume is high. I've always wished HN would let me do that. Staggered comments can get difficult to follow if there are many levels of indentation.

With flat, you can always quote someone's post to make it clear what you are referring to and the time linearity can be compelling, especially if you want to go back and read comments that have arrived since your last visit.

</comment><comment><USER8> Three theories:

1\. Flat-commenting is easier to design, program, and moderate.

2\. Assuming popularity is a power-distribution, the vast majority of all "comment sections" contain so few comments that there's no benefit to threading. Crowded places that _need_ branching threads are less-common.

3\. Sometimes it serves a design goal, like in ticketing systems: You want to force all participants to be in a single conversation with a shared chronology.

</comment><comment><USER9> Other than the fact that flat comments are easier to scroll through (for most i guess), I think flat comments allow you to comment overall in the forum which could mean your response can be applied to One or more posts at the same time. Usually a forum is meant for that. If you focus too much on one-on-one conversation, then may be staggered comments make sense.</comment>


Why I Like Go - <AUTHOR> https://gist.github.com/freeformz/4746274 <comment><USER2> These points are all very true, and I admit I haven't done more with Go yet than play around. But there are a few reasons I feel I _don't_ like Go, or at least, there are warts that will probably limit how much I'm going to like it.

Nil pointers are #1 on that list. Tony Hoare called them a "billion dollar mistake"[1]. In Go, as in C, C++, or Java, any pointer can be `nil` (similar to `NULL`) at any point in time. You essentially always have to check; you're constantly just one pointer dereference away from blowing up the program. Since ways of solving this problem are known, I find this hard to swallow in a new language.

Compare Rust where, unless you have explicitly used the unsafe features of the language, all pointers are guaranteed non-nil and valid. Instead of a function returning a nil pointer, it returns an `Option` type which is either `Some ptr` or `None`. The type system guarantees you have considered both possibilities so there's no such thing as a runtime null pointer dereference. Scala has a similar `Option` type, as does Haskell, calling it `Maybe`. In 2013 I don't want to still constantly check for a nil pointer, or have my program blow up at runtime if I forget.

The second disappointment is that when I looked into it, it seemed there are ways to call C functions from Go code, but no working way to call Go from C code. Maybe that wasn't a goal at Google, but it seems like a missed opportunity. As a result, you can't use Go to write an Nginx module, or an audio plugin for a C/C++ host app, or a library that can be used from multiple languages.

I think there is a real unmet need for a higher-level, safer language you can use to write libraries. Imagine if zlib, or libpng, or the reference implementations of codecs (Vorbis, Opus, VP8) could be written in something like Go. Or spelling correction libraries. Currently we have two tiers of libraries: those written in C/C++, which can be used from any language under the sun (Python bindings, Ruby bindings, Perl bindings, PHP bindings...), and those written in high-level dynamic languages (Python, Ruby, Perl, PHP, ...) which can _only_ be used by the same language. We need a middle ground. C isn't expressive or safe enough to deserve to be the lingua franca like this. And Go is tantalizingly close to replacing it, but not quite.

[1]: [http://qconlondon.com/london-2009/presentation/Null+Referenc...](http://qconlondon.com/london-2009/presentation/Null+References:+The+Billion+Dollar+Mistake)

<comment><USER3> "Compare Rust where, unless you have explicitly used the unsafe features of the language, all pointers are guaranteed non-nil and valid. Instead of a function returning a nil pointer, it returns an `Option` type which is either `Some ptr` or `None`. The type system guarantees you have considered both possibilities so there's no such thing as a runtime null pointer dereference. Scala has a similar `Option` type, as does Haskell, calling it `Maybe`. In 2013 I don't want to still constantly check for a nil pointer, or have my program blow up at runtime if I forget."

So how is nil checking different from when I write a function that pattern matches against a Maybe in a way that I only match against the "Just" case?

<comment><USER4> We have been using Scala lately for a couple of web services that are now running in production at our startup.

The difference is huge, because Option[T] references are type-checked at compile-time. Whenever a reference can be either Some(value) or None, then you are made aware of it and you are also forced to either handle it (by giving a default value, or throwing a better documented exception) or you can simply pass the value along as is and make it somebody else's problem.

Option[T] in Scala is also a monadic type, as it implements filter(), map() and flatMap(). It's really easy and effective to work with Option[T]. In comparison with "null", which isn't a value that you can work with other than doing equality tests, None on the other hand is an empty container for which you know at compile-time the type of the value it should contain and in Scala it's also an object that knows how to do filter(), map() and flatMap().

My code is basically free of NullPointerExceptions. This doesn't mean that certain errors can't still be triggered by null pointers, but those errors are better documented. What's better? A NullPointerException or a ConfigSettingMissing("db.url")?

Of course, to tell you the truth, Option[T] (or Maybe as it is named in Haskell) is only really useful in a static language. In a dynamic language, such as Clojure, especially if you have multi-methods or something similar, well in such a case Option[T] is less useful. And before you ask, no, Go is not dynamic and people saying that Go feels like a dynamic language, don't really know what they are talking about.

<comment><USER5> >My code is basically free of NullPointerExceptions. This doesn't mean that certain errors can't still be triggered by null pointers, but those errors are better documented. What's better? A NullPointerException or a ConfigSettingMissing("db.url")?

Almost always it is a matter of 2 seconds to find the source of a nil pointer error. Given that I would almost never forward raw error messages to the user, I cannot really see a gain.

However having a language that combines this Scala feature with Go's exception-free error handling, would be awesome and a true solution that would make software run more reliable and with less crashes.

<comment><USER4> > _Almost always it is a matter of 2 seconds to find the source of a nil > pointer error_

Either you're some kind of a super-human, or your code bases are really tiny. Yes, you usually can figure out the trigger of a null pointer exception, but not the _source_ that made it happen and with complex software the stack-trace can get a mile long ;-)

The biggest problem with null pointer exceptions is precisely that (1) they get triggered too late in the lifecycle of an app, (2) such errors are unexpected, non-recoverable and sometimes completely untraceable and (3) you need all the help you can get in tracking and fixing it.

Either way, throwing better exceptions is just one of the side-effects of using Option[T], because in 99% of the cases you end up with code that functions properly without throwing or catching exceptions at all. And you completely missed my point focusing only on a small part of it that's also the most insignificant benefit of Option/Maybe.

> _However having a language that combines this Scala feature with Go's > exception-free error handling_

First of all it's not a Scala specific feature, as the Maybe/Option type has been used and is proven from other languages, such as Haskell and ML. That the Go language creators took no inspiration from these languages is unfortunate.

Also, people bitching about Exceptions have yet to give us a more reliable way of dealing with runtime errors. The only thing that comes closest to an alternative is Erlang and yet again, the Go language designers took no inspiration from it.

<comment><USER6> Lately, the biggest complaints about PL design seem to be that they didn't take enough inspiration from ML-family or Erlang.

<comment><USER7> For Go? The biggest complaints about PL design are and have always been that its designers ignored or discarded the previous 30 years of PL (theoretical and practical both) when creating it.

<comment><USER6> Not just Go. But in Go a lot of problems could be solved by doing things the Erlang or ML way... then there's the new problems they've invented, like enforcing things that don't matter instead of things that do.

<comment><USER5> >then there's the new problems they've invented, like enforcing things that don't matter instead of things that do.

Never heard such complaints from users that have used it for a few months. I assume you are talking about unused imports and variables. Actually it helps a lot because it keeps your code clean and clear.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I would like to add one other thing I like about go: There is a parser and an abstract syntax tree in the standard library.

Sometimes when I'm programming at work I need to add log messages to every method on a large interface (or several interfaces). It is obvious to me that there needs to be some tool or library that adds these very simple log messages to these methods for me (like "Entering method getUser(UserId=2701, SessionId='AABCF')").

The tool we have at work uses runtime generated code to add these messages to methods automatically. Besides the performance hit this is fine, except for one problem. Sometimes it doesn't work; and it is impossible to figure out why. You turn on the tool, add all the right metadata, and nothing happens. You could argue that it is a tool problem, but I think one of the big things is that runtime generated code is just vastly inferior to compile time generated code.

If I were using go, my tool would open the code, read the interfaces, and spit out a nice implementation of logging in a .generated.go file and if it doesn't work for some reason I can actually go look at the generated code and see why. Trying to figure out why an implementation isn't working by looking at it's dynamically generated bytecode or .net clr is not fun at all.

<comment><USER9> _runtime generated code is just vastly inferior to compile time generated code_

That's a big call. I think you should curtail it, eg. "runtime generate code can be harder to debug". This is often true but not always. Let's not get in to workmen and their tools.

<comment><USER10> I agree with the GP's statement, because "harder to debug" == "vastly inferior". In my last job we worked a huge amount with generated code, and having generated source that you can step through is essential. I've never seen runtime generated code that's easy to debug.

<comment><USER9> Your logic seems to be that because some runtime code can be harder to debug ( _This is often true but not always_ ), having personally encountered such, you therefore declare that all runtime code is vastly inferior. Sorry, but this is ridiculous. Can you contribute something more solid than an anecdote?

<comment><USER10> I'm sorry you think it's ridiculous but it's just my opinion, after all. Feel free to ignore it. Can you give us an example of runtime generated code that is easy to debug?

<comment><USER9> I can't. However, I do believe that software development _in general_ is headed away from monolithic compilation, and that future systems will be largely real time, parallel, multi-component, perhaps more heterogeneous, and almost certainly predominantly interpreted.

Our habits trap us in to seeing things one way.

</comment></comment></comment></comment></comment></comment><comment><USER11> I'm still of the opinion go messed up the error handling badly. As a simple example note how every tutorial doesn't bother looking for the error return of println calls and hence would silently ignore errors.

IMHO the ideal solution is that if you make no effort to look at the error return of a function, it is automatically returned to your parent. This is somewhat analogous to exceptions, but they require a lot more syntax. (Yes I know about panic/recover.)

<comment><USER12> I always find it _interesting_ that people repeat the example of println as if it's any different than any other time that you make a decision to ignore or check error codes. It's no different than most other languages that would be in Go's category.

Also, I presume you meant fmt.Println (println shouldn't be used and almost surely doesn't return an error).

>is that if you make no effort to look at the error return of a function, it is automatically returned to your parent

That would be... very, very, very strange for a huge number of reasons. Syntactically, function signature wise... You're basically just asking for exceptions in that case. And besides, that's how most functions that can error work, as I'm sure you know from any example code.

        function makeSomething() (Something, error) {
            something = new(Something)
            err = mightBreak(something)
            if err != nil {
                return nil, err
            } else {
                return something, nil
            }
        }

Yes, it's explicit error handling. Yes, it's griped about on _every_ , _single_ HN thread about Go. And the mailing list, extensively.

For a parallel example, do you call checkError() on your PrintStream (System.out) in Java after calling System.out.println? If not, you're not _really_ checking to make sure println worked: [http://docs.oracle.com/javase/6/docs/api/java/io/PrintStream...](http://docs.oracle.com/javase/6/docs/api/java/io/PrintStream.html)

<comment><USER13> Make a decision to or _forget to_ check error codes.

My gripe is fairly different from the OP's in this aspect. Go is inconsistent. For functions that return values I need to use, I will be warned by the compiler if I forget to handle the error. For those that don't, the compiler will happily let me accidentally ignore the error.

I'd rather require that all return values be handled whether I use them or not. For the rare case that a function returns a value I honestly don't care about, I can just use _. At least I'm not hiding the fact that I knowingly am ignoring stuff.

(Edit: despite the above, I still do enjoy using Go.)

<comment><USER12> I can understand why that inconsistency is frustrating. Similarly:

        typedObj, err = something.(type)
        typedObj = something.(type)
        obj = someMap[key]
        obj, ok = someMap[key]

<comment><USER14> It's

        typedObj, ok = something.(type)

just like it is with maps, or any other ", ok" thing.

<http://play.golang.org/p/I-5kD88knC>

<comment><USER12> Oi vey, mea culpa.

</comment></comment></comment></comment></comment></comment><comment><USER15> I've become aware of Go just a few months go, but I already like it so much that I'm planning to make my next/current project in it, after using C++ exclusively the last 8+ years.

It has a lot of good things going for it, as a modern language should, but IMO that only makes it a viable alternative.

What really pushes it over onto the "I wanna use it" side is how easy and natural it makes concurrent programming. See e.g. vimeo.com/53221560

</comment><comment><USER16> It's interesting how many people post about moving to Go from an interpreted or VM language background. The original presentation video pitched it as a C++ replacement, but that is clearly not the whole story. This author does not seem to have much experience in native development. I wonder if the Go designers predicted how many people they'd convert from python/ruby/java.

<comment><USER17> Frankly, I think a lot of the people currently working with C/C++ are avoiding Go because of the garbage collector. You can't trust a garbage collector; you don't know when it will run, how long it'll take, or how quickly it will free the memory you used. C/C++ programmers are used to having complete control over all of this. Sure, you could familiarize yourself with the internals of whichever GC you're working with, but at that point you might as well have invested the same amount of time writing the program in a language without a GC.

<comment><USER18> I'm going to make the argument that a lot, if not the majority, of C/C++ programmers don't _need_ complete control over memory management. I think in many cases (not OS, not real-time), saying "but I need absolute control over memory management so I can optimize!" is the equivalent of "I write everything in hand-coded assembly because it's more efficient". It's probably not, the machine can probably handle it better, and you're missing out on useful functionality. You know what happens when I allocate and free memory myself? I generally end up with either a leak or a double-free, and I doubt I'm such a terrible programmer that I'm the only one like that.

<comment><USER19> False dichotomy. If you use RAII, exceptions, and smart pointers in C++ there will be no leaks, no double-free, and not even a need for a GC. I know it is difficult to make a point on the Internet, but resource leaks really are a solved problem in C++.

<comment><USER18> Yes, but then you're stuck using C++, RAII, and exceptions. Let's not even get into which smart pointer you should use--a Googler I know has recounted stories of massive internal mailing list arguments over exactly which of the half-dozen smart pointer implementations they should be using.

<comment><USER19> So, because C++ has imaginary problems, we should all switch to a language that solve them, while being worse at all other things that matters (you know, like code generation)?

</comment></comment></comment></comment></comment></comment><comment><USER20> "Oh, and there isn't any pointer math, so you won't screw yourself with it."

It has been said before and I'll say it again here, but because you can mess stuff up because you don't know what your doing is a terrible reason to not have something in a language (or even a program).

<comment><USER21> Incidentally, I don't think it's entirely true that "there isn't any pointer math". I've never used it but I understand that you can do C-like pointer tricks by using the package called "unsafe": <http://golang.org/pkg/unsafe/> and <http://golang.org/ref/spec#Package_unsafe>

<comment><USER22> Yes, indeed. Here's the "canonical" C strlen translated to unsafe Go with pointer arithmetic:

      package main

      import (
      	"fmt"
      	"unsafe"
      )

      func strlen(b []byte) int {
      	str := uintptr(unsafe.Pointer(&b[0]))
      	s := str
      	for ; *(*byte)(unsafe.Pointer(s)) != 0; s++ {}
      	return int(s - str)
      }

      func main() {
      	fmt.Println(strlen([]byte("ho ho ho\000")))
      }

Not that anyone should use it :-)

The safe and readable variant of this, often used in Go code, is "slice arithmetic", like this: <http://golang.org/src/pkg/crypto/sha256/sha256.go#L105>

</comment></comment></comment><comment><USER23> It gets Damien Katz's approval so I'm learning it ASAP.

<https://twitter.com/damienkatz/status/289575389641179137>

</comment><comment><USER24> These posts make me feel like Go is some oddball quirky person we all know and we all feel like we have talk about how great he/she is at some drunken party. I mean, we all love Go and all ...

<comment><USER25> Some people need support from others to confirm they are making a good choice.

</comment></comment><comment><USER26> Another great thing:

gofmt - Go has no style guide, just this tool!

Committed code ends up looking cleaner and you don't have to adapt to other's wacky standards. No more tabs vs spaces arguments or where to place that brace... brilliant.

<http://golang.org/doc/effective_go.html#formatting>

<comment><USER18> It does have a style guide, it's just that gofmt will automatically make your code conform to that style guide :)

The Go style is close enough to my normal C style that I end up mostly conforming anyway, but gofmt is great for making code look a bit prettier.

</comment></comment><comment><USER27> Unrelated: I like the fact this person used Github as a "blog". I've been looking for some good blogging software & host for a while, but Github might just fit my needs :)

<comment><USER28> Checkout <http://substancehq.com> too, it is a very simple hosted blogging engine.

<comment><USER27> Thanks, it seems like a nice tool. Formats Objective-C as well! Great for my purposes :)

</comment></comment></comment><comment><USER29> Argh! I felt rage reading: Package System or lack there of. Since Go compiles everything statically, you don't have to worry about packages at runtime. But how do you include libraries into your code? Simply by importing them via url, like so: import "github.com/bmizerany/pq"

It was all good until that point.

<comment><USER30> Are you going to say why, or just let us guess?

<comment><USER31> My guess: Remote packages are useless because (afaik) you can't specify a revision. This means "go get" will get the latest HEAD, which could be anything.

Go needs something like Ruby's Bundler to let a package declare what versions are required and let you pin to specific versions.

<comment><USER30> If I desperately needed a specific version of a package, I'd fork the project and freeze it where appropriate.

Does the `go` tool _need_ to be aware of versions? IMO, no. Would it be a nice feature if it could be added without making the tool difficult to use? Yes.

But so far, it hasn't appeared to slow anyone down. I've worked quite a bit with distribution tools for both Python and Haskell, and Go's tool is a breath of fresh air.

</comment></comment></comment></comment><comment><USER32> Question re: only utilizing one CPU and GOMAXPROCS: would it be in bad taste to, by default, for a program which might be used by other people (and uses goroutines extensively) to include in initialization "runtime.GOMAXPROCS(runtime.NumCPU())"?

<comment><USER33> C or Java programs use all cores by default. I think it's reasonable for Go to have the same default.

<comment><USER34> C, previous to C11, didn't even have a concept of threading...

(And who the hell is using C11 like that anyway?)

<comment><USER33> OK, pthreads.

<comment><USER34> It is going to be a pretty hard sell that mimicking pthreads is ever a good idea...

Regardless, considering the casual nature of goroutines and the deliberate heavy-weight nature of pthreads, I find it hard to see pthreads as being _any_ sort of argument about what Go should do, regardless of pthreads' shortcomings. They are wildly different animals.

</comment></comment></comment></comment></comment><comment><USER35> I've been thinking of leaving Ruby for web applications. Both Go and Haskell are contenders because of the compilation step.

Been doing iOS so much lately (almost 3 years now) over the course, I've come to love compiled languages much more.

I still use Ruby for backend services and smaller scripts. But I want to leave it for larger backend software.

This was a nice list, thank you.

</comment><comment><USER36> Sounds like a list of C# benefits. In 2004.

<comment><USER37> Except for the goroutine and channel, and the type system, and the package system.

<comment><USER25> Ah you mean Task Parallel Library and NuGet?

<comment><USER37> I didn't realize NuGet let you do remote path import. Nor that it was around in 2004. Nor that it's part of the C# language spec.

Goroutine + Channels are vastly different than the TPL. The comparison is so far off that I can't even come up with a clever analogy. There's more to concurrency than threads, and more to communication than locks.

<comment><USER25> > I didn't realize NuGet let you do remote path import. Nor that it was around > in 2004. Nor that it's part of the C# language spec.

Fare enough if you want to limit yourself to 2004 and compiler specific support.

> Goroutine + Channels are vastly different than the TPL

If you take out your Go coloured glasses and read in what TPL does, you will see that what Goroutines and channels are indeed available as Tasks and Queues.

<comment><USER38> I don't know enough about Go, but Goroutines and Channels sound quite similar to F# agents and mailboxprocessor concepts, which as I understand is not quite the same as TPL. The former tackles concurrency, while the latter is about parallelism. C# 5 is getting there with async/await concepts I guess.

Here's a dining philosophers implementation in F# and Go (among other languages)

<http://rosettacode.org/wiki/Dining_philosophers>

</comment></comment></comment></comment></comment></comment><comment><USER39> But I like Haskell more.

</comment><comment><USER40> "Go compiles down to native code and it does it fast. Usually in just a few seconds."

Very strange statement. Most programming languages/runtimes do small operations very quickly.

<comment><USER41> What do you mean? He means that you can compile a pretty large program in seconds, most languages' compilers aren't that fast.

<comment><USER42> > most languages' compilers aren't that fast

All mainstream languages compile in about that ballpark, if not faster.

I've always found it odd that one of the driving design principles of Go was "fast compilation". It's always struck me as odd and short-sighted, obviously motivated by the Go authors' history with C++. If only they had spent some more time studying other languages, they would have realized that compilation times are really not a concern in languages these days, and they might also have designed Go with more modern features in mind, such as exceptions and generics.

<comment><USER43> Not really a concern? I don't agree. Look at large C++ projects, and let's not speak about GPU frameworks like CUDA, OpenCL and OpenACC. If it weren't be a concern, software companies wouldn't invest in clusters just for compilation.

<comment><USER25> Contrary to what many young developers may think, C and C++ aren't the only languages with compilation to native code.

Already in 1987 Turbo Pascal 4.0 was compiling quite fast, Borland states around 34,000 lines/minute for the 5.5 version in 1989.

Similar compilation speeds are possible for languages with modules, since the early 80's.

Go's compilation speed is only news for someone that never used a module based language for systems programming like Modula-2 or Turbo Pascal, just to name two.

<comment><USER44> It doesn't matter if somebody knows Turbo Pascal 4.0 or Modula 2 if you can't use it.

We are repeating history because the old ways were forgotten or replaced.

<comment><USER45> What he was trying to say is that you shouldn't "design for fast compilation". You should design the language to allow modularity and fast compilation will naturally follow.

</comment></comment></comment></comment></comment></comment></comment><comment><USER46> Another one in a long list :) The case for Go: <https://gist.github.com/ungerik/3731476>

</comment><comment><USER47> I remember that Go had some issues related to the garbage collector on 32-bit machines. Are they solved now?

<comment><USER48> Not fully... <http://code.google.com/p/go/issues/detail?id=909>

</comment></comment><comment><USER49> Is Go used any where else besides at Google?

<comment><USER48> yes

</comment></comment><comment><USER50> Google pr is doing a great job with the go language. Every day 2-3 stories is always highly rated on a language not many people outside google cares about. Time to hellban som accounts maybe?

<comment><USER51> Says an account called "nogo" created 5 minutes before posting?

<comment><USER12> Ironically there is someone creating new accounts and trolling each of the Go posts. Last time it was someone spewing inconsistent lies about the Go build system.

<comment><USER34> My money is on the 0xABADC0DA doing it. An obsession with Google's relationship with Go and thinking that google employees were gaming HN to push Go was kind of his MO. Really quite obnoxious, I don't know who he thought his audience was.

</comment></comment></comment></comment><comment><USER52> _Simple C Interface

By using build directives you can integrade with C libraries really easily._

And its a bunch of magic. I thought these people were serious about having a language for "systems programming".

What good is it if it can't properly interface with the systems programming language that people actually use, C?

It seems they wanted to add "C interop", but didn't understand what that means.. at all. You give it a header with function prototypes, because thats apparently the only way to tell it "I want to call this native function", and you get... undefined references for the native functions? What the hell is it even trying to do? You don't have source and you don't have linker stubs for _a lot_ of the libraries you want to interop with.

It's a complete non-starter. It's interop for awesome magic demos.

<comment><USER53> What?

CGO is pretty cool actually. It does have some irritating downsides (pkg- config for example, is used, and there's no other option to link to a specific library afaik)...

...but seriously, what are you even talking about?

All you need is a header, and a binary (library; .so or .dll). Done.

How would you even use a library that doesn't have a header?

Sounds like you've spent some time using COM objects and the . autocomplete function on them; that's just windows crazy-talk, if you want to use that kind of nonsense, go write powershell.</comment></comment>


Hipmunk Closes Hyper-Competitive Angel Round, Sans The Usual Suspects - <AUTHOR> http://techcrunch.com/2010/10/05/hipmunk-closes-hyper-competitive-angel-round-sans-the-usual-suspects/ <comment><USER2> It surprised me to see Sam Altman on this list. Where does that money come from? Maybe Loopt is very profitable and he takes a big salary? Or maybe he had cash before Loopt?

<comment><USER3> Most angel investors need to decide whether to put up the money based on a few one-hour pitches and what they read in the press. Those are pretty bad sources of information if the biggest challenge of early-stage investing is judging the founders, because the founder is in "pitch mode."

YC alums in a position to invest can interact with the founders for months in very social and relaxed settings as peers. That's orders of magnitude more data than what you get in normal angel investing.

<comment><USER2> I agree Sam may be in an especially good position to make guesses about the future of companies, but that doesn't explain where the investment money comes from.

<comment><USER4> Also, to be an accredited investor, don't you need a net worth of like $1 million? So having 50k lying around doesn't cut it. Although there might be exceptions to that rule... I'm definitely no expert on the subject.

<comment><USER5> Here are the rules for being an accredited investor: <http://www.sec.gov/answers/accred.htm>

_"income exceeding $200,000 in each of the two most recent years or joint income with a spouse exceeding $300,000 for those years and a reasonable expectation of the same income level in the current year"_

And it is not like you have to submit to an audit to the company before sending them a check -- all you have to do is sign something that says you are accredited. That way you will have a harder time suing the company claiming you were mis-led or whatever.

<comment><USER4> Thanks for looking that up. Looks like it's not terribly difficult to qualify.

</comment></comment></comment></comment></comment></comment><comment><USER6> Proven team + big market = competitive round of funding.

Interestingly, it seems like they went with a lot of investors with experience as a founder.

<comment><USER7> The team are proven entrepreneurs, but it's not like other travel start-ups like Kayak and Tripit where the founders all have proven domain expertise, Steve and Adam are hardly travel industry veterans.

<comment><USER8> > Steve and Adam are hardly travel industry veterans.

Not for long!

<comment><USER9> <http://news.ycombinator.com/item?id=1762521>

any thoughts? covered this elsewhere? --link?

</comment></comment></comment></comment><comment><USER10> Hipmunk has Paul Buchheit, Sam Altman, Ron Conaway, @aplusk as investors, Steve as a founder and @kn0thing as a marketing head.

Has a ton of revenue already, Doesn't really need more capital - Steve has enough from the Reddit sale.

Enough said.

<comment><AUTHOR> Hipmunk already has a ton of revenue? Source?

<comment><USER7> Affiliate booking revenue

<comment><USER9> ok... i'll play along.

what revenue? where are the customers? how much are they paying to acquire them? how much affiliate revenue do they actually receive per transaction? how do they retain customers? how are they planning to overcome the non-existent barriers to entry in that space?

scorpion032's comment: "Steve has enough from the Reddit sale." is dead on. think about it.. these guys could self-fund the project without breaking a sweat and yet they still sold 20 point equity stake. why? --diversifying risk or pr, really.

either steve realizes hipmunk's a longshot and isn't quite sure that he and his co-founder's street cred will actually play out in terms of long-term customer acquisitions and retention so he's cashing out now while the handful of early adopters (their "e-following") will still look like an aggressive growth curve), or he's trying to get some free press. basically.

edit: i say "longshot" in the sense that i feel it's unlikely that their competitors will do nothing to adapt to any serious hipmunk rise... so unless their competitors are clueless-- which i doubt they are-- and unless they develop some sort of non-replicable competitive advantage-- which i dont see happening-- i think they'll have a hell of a time gaining any ground.

</comment></comment></comment></comment><comment><USER11> Congrats to hipmunk! I will say that I've become an instant convert, and everyone I have showed the site to has LOVED it.

Good luck - this is a tough space, but hopefully you can succeed!

</comment><comment><USER12> Hipmunk is going places. Travel is one of the most user-hostile consumer spaces around. All they have to do is stick to their guns, continue evolving their product in a direction that puts the user first and they'll be on their way to printing money. Once you use Hipmunk, every other travel site looks like a stupid, ad-soaked bully with their constant upsells and bundles.

<comment><USER13> I am big fan of hipmunk as well. However as a product point of view I am afraid other folks(kayak/bing-travel) can easily copy/tweak their front end to match. I couldn't find stickiness in their business model.

<comment><USER12> They could, but they'll be playing catch-up. Hipmunk has the merit of, pro- actively, knowing the value of user focus. If they stick with that theme, there are innumerable places in the travel purchase experience that can be polished and made less miserable. You can copy ideas after the fact, but not the active brains that drive them. The brains are Hipmunk's greatest asset.

<comment><USER14> What makes you think the other sites don't know the value of user focus? I am not sure that the aggregator experience is as miserable as you make out.</comment></comment></comment></comment>


GitHub moves to SSL, but remains Firesheepable - <AUTHOR> http://news.netcraft.com/archives/2010/11/03/github-moves-to-ssl-but-remains-firesheepable.html

<comment><USER2> We fat fingered the config. The cookie is marked secure now but we found another issue where it's being sent back on redirected HTTP requests. It should be all plugged up in a bit.

<comment><USER2> Okay. The session cookie is marked secure and is sent only in response to HTTPS requests. That should cover everything.

<comment><USER3> Somebody get this guy some karma.

</comment></comment></comment><comment><USER4> I'm torn between the fact that Netcraft wrote a rather large blog post taking Github to task for a simple oversight --- against the fact that there is a pervasive misconception that the HTTP cookie "Secure" flag is not a big deal. The "Secure" flag is a very big deal. You might as well not be SSL without it.

<comment><USER5> Even if Github's implementation was misconfigured at first the right thing would be to inform them, wait for the fix and _then_ blog about how to do it successfully.

Posting zero day exploits is not big or clever. Github's public transition to SSL should have encouraged people to not use Firesheep to try and snoop on their users' traffic. While a false sense of security doesn't help anyone, this kind of blogging remains more actively destructive than helpful.

<comment><USER6> I don't know the Firesheep guys personally to determine their motivation behind not informing us prior to releasing the extension, but I'm very surprised Netcraft acted this way.

People seem to be jumping on this issue with zero regard for what I think is just common courtesy to site owners.

</comment></comment></comment><comment><USER7> It's nice to see GitHub jumping to show action in regards to FireSheep and SSL security, and being able to implement something quickly.

I wish other sites were able to follow suit.

<comment><USER8> They need users to be confident in their ability to run a secure service, especially when company secrets (source code, in this case) are on the line.

Also, their audience is much more likely to pay attention to things like FireSheep. I can just about guarantee that 9/10 Facebook users have never heard of FireSheep and wouldn't even notice if Facebook went 100% SSL tomorrow.

Edit: That said, I totally agree with your comment.

<comment><USER9> Probably more like 999/1000 Facebook users have never heard of FireSheep.

</comment></comment></comment><comment><USER10> Maybe I shouldn't be so naive, but this whole firesheep release is very shocking to me. Facebook is very insecure, and it is incredibly scary that so many people trust Facebook's privacy and give Facebook so much personal information.

<comment><USER11> Well part of the reason this is so exploitable is because with Wifi, packets are broadcast through the air for anyone to pick up. With modern switched networks, packets only get routed to the IP they're intended for.

<comment><USER12> ye dude, 'modern switched networks' can still be sniffed. see arp-flooding etc.

</comment></comment></comment><comment><USER13> Glad to see GitHub taking extra steps to secure users. Even though the recent scary news brought forth by Firesheep is nothing most relatively tech savy people know, it's definitely going to shake things up. Huge wake up call for many companies and I'm sure we'll start to see more online services provide end-to-end encryption with encrypted cookies as well.

</comment><comment><USER9> And yet all of his Twitter links are non SSL...</comment>


Nanoparticles awaken immune cells to fight cancer - <AUTHOR> http://www.sciencemag.org/news/2017/01/nanoparticles-awaken-immune-cells-fight-cancer <comment><USER2> This was written in Jan 2017 with a view that human trials would start in the second half... Any further developments?</comment>


The Great $50M African IP Address Heist - <AUTHOR> https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/ <comment><USER2> Silly criminal, you're supposed to resign from your regulatory job first, _then_ found a company to steal (er, efficiently allocate using the free market) public resources the next day!

<comment><USER3> Public-private partnerships allow this sort of vulture capitalism without resigning. Or, have your friends do it.

<comment><USER4> Public-private organizations, but capitalism takes all the blame naturally. It's the perfect material for selling people on pure state-run businesses to less informed citizens IMO.

Don't get me wrong though, the public/private trend of the last two decades really has been a cancer on society. I wish more market-leaning people realized this, since a ton of conservatives push it as some half-baked solution to "big government". We're all sold these benefits of "free" markets when the organization looks or operates nothing like a marketplace with legitimate competition nor with the transparency or responsibility towards externalities that public organizations bring.

It really is an opaque proxy for politicians and corrupt business leaders in the community whose only skill is working gov contract systems to have even less transparency and plunder public money. It's a worse-worse solution, gift wrapped as some more efficient pseudo-market.

We need a stronger divide between either private or public. These compromised middle grounds are a disaster. The US health market is the obvious example but there are a thousands of smaller ones in every municipality.

<comment><USER5> I wish more people would realize this _this_ is the crux of the problem. It's not Socialism or Capitalism, it's corruption.

<comment><USER6> And what drives this neither "socialism or capitalism" corruption? Not the hunt for extracting profit by any means?

<comment><USER7> One might argue that it is simple greed, which is enabled by the concentration of power, which happens both with economic power and regulatory power.

<comment><USER8> And on top of that, one might argue that humanity is highly self-interested by nature, and people with the greatest self-interest will be much more likely to obtain power.

<comment><USER7> While there is an aspect of self-interest in humans, I find that we are often a lot more altruistic than we are generally given credit for.

<comment><USER9> In this article dedicated to cooperation between drivers, it says that around half of them are quite cooperative: [https://arstechnica.com/science/2019/11/giving-autonomous- ca...](https://arstechnica.com/science/2019/11/giving-autonomous-cars-a- theory-of-mind-improves-their-integration/)

That behaviour split definitely sounds like an exploratory algorithm at work.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Why would these spam marketing companies want to buy IPv4 addresses? Would IPv6 not work? Or were they trying to assume the identity and reputation of the companies that owned the IPv4 addresses previously?

Edit: Sendgrid answered my question in this post quite well [https://sendgrid.com/blog/where-is-ipv6-in- email/](https://sendgrid.com/blog/where-is-ipv6-in-email/)

<comment><USER11> For spam purposes, IPv6 is just as rare as IPv4... you can generally assume that anyone in a /64 is the same owner.

... so really if you have 1000 IPv4 or 1000 /64 IPv6 it's about the same number of IPs that you can use to spam from.

<comment> proto-n I'm not sure how tolerated this is on HN, but I'm lazy to research background on this. Could you please explain what a /64 is and why it is significant in this regard?

<comment><USER12> A netblock. A "/n" means "a block of IP addresses where the first n bits are the same".

This comes from the CIDR notation 192.168.1.0/24 indicating the netblock from 192.168.1.0 - 192.168.1.255.

So the number after the slash corresponds to a network size. The smaller the number, the more bits are variable, i.e. the bigger the netblock.

An IPv4 /24 has 32 (address length) - 24 = 8 bits that are variable, i.e. 2^8 addresses. A /18 would have 32-18 = 14 variable bits, i.e. 2^14 addresses.

In IPv6, the address length is 128. A /64 (which happens to be the smallest routable network size in IPv6) is 2^64 addresses - but because it's easy to get large IPv6 netblocks (typical ISP allocations are /64, /56, and you can often get a /48 with relative ease), for abuse blocking purposes, you generally treat the entire /64 or even /56 as one entity (i.e. you ignore the rightmost 64 or 72 bits).

A /56 is 2^8 separate /64s. A /48 is 2^16 separate /64s.

<comment> proto-n That was very informative for me, thanks!

</comment></comment></comment></comment></comment><comment><USER13> > The global dearth of available IP addresses has turned them into a commodity > wherein each IP can fetch between $15-$25 on the open market.

So a whole class C is only $6,500? Or is there a bonus for a contiguous block?

Even so, my friend owns his own Class C (since 1994), and I doubt he would part with it for a mere $10,000.

<comment> CKN23-ARIN RIRs only handle transfers of /24s or larger. I suppose it might be possible for a "legacy" pre-RIR address holder to reassign ownership rights of a single address, but I've never seen it happen for anything smaller than a /24\. Even if it did happen, the addresses would be unusable on the Internet, since it's common practice to reject announcements of anything smaller than /24.

Your friend (correctly, IMO) values his address block more than the market does. They're regularly selling for $5000-6000 these days.

</comment></comment><comment><USER14> Insider jobs are unusually common in the non-private sector in developing markets. They also occur in the non-private sector in developed countries but not at the same scale.

The only "solution" in most of these developing countries is to have open and transparent auctions without onerous rules (another way of gaming the process) or to turn them into being private.

<comment><USER15> > the non-private sector

Aka the public sector. Or are there additional sectors that I am not aware of?

<comment><USER16> Weird NGOs that straddle the divide, think tanks, white collar unions aka "professional associations" that somehow acquired regulatory powers; see medicine, law, engineering, architecture etc. Corruption exists in all sorts of places.

<comment><USER14> You framed it perfectly! There are so many non-private sector institutions out there that I refrained from calling them even quasi public sector. In fact the example you mention of "professional associations" that have acquired regulatory powers is great as most of them are rife and riddled with corruption and act to either the benefit of their management or members and against the public interest.

</comment></comment></comment></comment><comment><USER17> I find this style of writing to be lazy and insulting.

"There are fewer than four billion so-called "Internet Protocol version 4" or IPv4 addresses..."

They aren't "so called". That's literally the terminology.

<comment><USER18> The usage aligns with definition 1 ("commonly named") but not definition 2 ("falsely or improperly so named") at [https://www.merriam- webster.com/dictionary/so-called](https://www.merriam- webster.com/dictionary/so-called)

<comment><USER19> I have never heard of the "commonly named" usage certainly in modern usage "so called" is always negative.

</comment></comment></comment><comment><USER3> Man, if only I kept a former employer's Class C who no longer exists.

It's 188.8.131.52/24 and needs to be culled and auctioned off.

<comment><USER20> I still have a Class C registered to me personally from way back in 1993.</comment></comment>


Do you read HN at work? - James-Foster

As a programmer, is it a fair use of company time to be keeping up with hacker news?  HN can be a great source of inspiration, and there is no doubt in my mind that keeping up with latest trends can make you a better programmer, but obviously a lot of the content isn't directly work-related.  Even if most of what you are reading is directly work-related, is it fair to be keeping up on company time? <comment><AUTHOR> Suggest title change, 'do you read HN instead of work' ;)

Even if lots of the content isn't work related, plenty of it definitely is, or at least it can help you to look at something that might jog your head in to gear again when you're stuck.

And countless times I've used 'Ask HN' style posts to help me to overcome some kind of problem or to ask for a recommendation about what tool to use.

It's really up to the user, which content you choose, and scanning the headlines and only picking out those items relevant for the work you're doing is something that is just a matter of discipline.

</comment><comment><USER2> Depends if you're being paid for your attendance or to perform a job. If you're paid for attendance (and if you test most bosses' expectations, that's where they sit) then any distraction is a no-no (and, not coincidentally, your long term desire to work there may also be a no-no).

If you're being paid to perform duties or hit milestones, then that's more important than whether you are focussed only on your work when you're at work. A needed break or relevant distraction like HN shouldn't be a problem.

I use the Alt-Tab rule when making this decision myself. If one of my team mates walked past, would I Alt-Tab away from this screen or would I be fine to let them see what I was doing?

</comment><comment><USER3> I find that I'm more productive if I take short breaks, and if I spend time staying informed on my industry. Hacker News fills both of these needs! I'm lucky enough to have managers who feel the same way.

</comment><comment><USER4> Sure, it's also fine to read facebook, the news, whatever. Everyone needs a break; just don't do it too much.

</comment><comment><USER5> Yep - it's lunch now. HN is related to my work anyway. I hope it's related to yours. :^)

</comment><comment><USER6> hell yeah

</comment><comment><USER7> On iPhone when teacher isn't looking ;)

</comment><comment><USER8> yes man... I'm somewhat addicted, but i am trying to filter out junk and spend more time on useful things

</comment><comment><USER9> I do. I'm my own boss anyways ;)</comment>


5 BEST TIMES TO START Your OWN BUSINESS - <AUTHOR> http://www.thefreshstartup.com/home/2014/6/30/5-best-times-to-start-your-own-business

<comment><USER2> [http://ycombinator.com/newsguidelines.html](http://ycombinator.com/newsguidelines.html)</comment>


A Primer on DarkNet Marketplaces - <AUTHOR> https://www.fbi.gov/news/stories/a-primer-on-darknet-marketplaces <comment><USER3> You'd think someone in the chain of command would say, "what would this look like as a legal market? How much could we generate in taxes? Do these people really belong behind bars?"

A few questions I have: * How many schools and hospitals could we fund from taxes? * Could we redirect these users to hospitals or treatment facilities, and if we can't, so what? * Could these agents be considered adrenaline junkies?

This cat and mouse game will have no end until they can tap into your brain stem and prevent you from committing these 'crimes' or modify your brain chemistry in a way that will make you not yearn for altering your conciousness. Either way, that's not a world I want to live in. How can we get the government to respect our right to put anything in our body that we want to? As long as it does not hurt others through the production or the consumption or harm the environment, I really don't understand the moral hard on people get from telling a group of people what they can and can't do.

I'm kind of rambling, but this is what comes to mind when I see these types of articles.

<comment><USER4> "This cat and mouse game will have no end until they can tap into your brain stem and prevent you from committing these 'crimes' or modify your brain chemistry in a way that will make you not yearn for altering your conciousness"

As someone that doesn't do any drugs, I'm all for drug legalization.

However, there needs to be limits. I should be able to fire someone that is high on the job, for instance. Driving a motor vehicle while under the influence should also be illegal.

'altering your conciousness' can directly harm the people around you and they have the right to not be harmed by your personal choices.

"How can we get the government to respect our right to put anything in our body that we want to?"

Another issue is health care: Should the government continue to pour tons of money into allowing you to kill yourself with drugs?

"I'm kind of rambling, but this is what comes to mind when I see these types of articles."

You never mention firearms, which is another primary business on the dark web. Are you also fine with anyone being able to buy a weapon at any time?

<comment><USER3> > 'altering your conciousness' can directly harm the people around you and > they have the right to not be harmed by your personal choices.

I stated clearly "As long as it(drug use) does not hurt others through the production or the consumption or harm the environment".

> However, there needs to be limits. I should be able to fire someone that is > high on the job, for instance. Driving a motor vehicle while under the > influence should also be illegal.

If you are the employer, you should absolutely have the right to fire someone for being under the influence during their hours of employment. Driving is the same -- you're putting other people at risk. Not acceptable.

> Should the government continue to pour tons of money into allowing you to > kill yourself with drugs?

The government pours tons of money into fighting the wrong fight at the moment, they're treating the symptom, not the problem. They're inflating law enforcement budgets and eroding our rights every which way to "fight" this battle. I say if they could take that exact same amount of money they're using to "fight" this battle and put it towards healthcare and treatment, then yeah, they should pour tons of money into it. Our current solution isn't working.

> You never mention firearms, which is another primary business on the dark > web. Are you also fine with anyone being able to buy a weapon at any time?

I'm not talking at all about firearms. I'm naive in the sense that I dream about a world without them but I recognize they can be useful tools in certain situations.

<comment><USER5> >I stated clearly "As long as it(drug use) does not hurt others through the production or the consumption or harm the environment

But... It does. We know that it does. There are classes of drugs which don't lend themselves to responsible use. That problem will remain, and you'll still have the junkies stealing to get high, regardless of where they spend that money. These drugs have a negative societal impact, of course exacerbated by the fact that using them turns you into a criminal.

I don't know that e.g. unfettered access to heroin is a good thing. I do know that treatment instead of jail is a good thing.

<comment><USER3> What if a junkie could go to a clinic and get their fix? I'd happily pay more taxes to get junkies their fix. I'd also be happy to pay taxes that would help them seek treatment as well.

I'm not at all qualified to propose real solutions to this problem but I know from watching this failed drug war that we should start talking about alternative solutions and the way we do that is start considering other options. I feel like our current solution is hurting us as a whole more than it's helping us.

<comment><USER6> Yes, but how do you stop people from becoming junkies in the first place? Opiate addicts already have access to methedone and some countries are looking into giving pharma grade heroin replacement, but these types of addicts are essential lost causes and will always be addicts.

I believe sentencing laws/guidelines needs to be reformed, but you have to see it from the governments perceptive. How do you stop people from becoming drug addicts? Legalize the drugs your trying people not to use?

<comment><USER7> > _Opiate addicts already have access to methedone and some countries are > looking into giving pharma grade heroin replacement, but these types of > addicts are essential lost causes and will always be addicts._

I'm a "lost cause"? Thanks. I was a heroin addict from 16 years of age until I was 24. I've been clean for four years now, due to my governments excellent opiate-replacement therapy program.

The dehumanisation that happens when people discuss "junkies" makes me sick, and _directly_ contributes to why a lot of us never ask for help.

<comment><USER8> Hear, hear.

Coming up to two years clean from an IV habbit. So, also a "lost cause."

I feel if people had the slightest idea just how many people around them are high on some kind of opiate, and how indiscriminate addiction really is that this type of language would be less prevalent.

Congrats on beating the gorilla.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I think the screenshot tells a much more accurate story than the text. 120,000 listings for drugs, 1,900 for weapons, no main category for child porn. Based on the listings, the kinds of activity that actually go on would seem to be in reverse order from what the press release suggests. I'm struggling to imagine anyone leaving feedback about how potent a poison was or chatting away about their last 'cache of guns'. I could be wrong.

<comment><USER10> The items are purposefully listed in order of concern rather than volume. The FBI is also in the business of selling its utility to the public, and its pitch should be treated with as much skepticism.

<comment><USER11> > Some of these individuals confessed to ordering a range of illegal drugs and > controlled substances online, including heroin, cocaine, morphine, and > ketamine.

And yet they don't do what they tell they care about. Such a waste...

</comment></comment></comment><comment><USER12> This talks a lot about drugs and weapons, but it says nothing about what I've heard is one of the most commonly-purchased dark-net commodities: fake over-21 American licenses. It's ridiculously easy to buy a fake ID online and have it shipped right to your door, from basically any state you want---even high security states like California and New York---and for relatively cheap too. I suppose that might be because several fake ID vendors will only sell ones that show an age between 21 and 25 and only sell to people in the US to deter law enforcement based on the idea they're only selling to teens for alcohol as opposed to allowing people to be smuggled into the country or other such things.

Though I have no personal experience with making purchases from darknet markets, I was curious about how easy it would actually be to get a fake ID after watching the movie Superbad. I was astounded at the wealth of information available to the benign Googler.

For more interesting info: [http://reddit.com/r/fakeid](http://reddit.com/r/fakeid)

<comment><USER13> This is interesting, needing a fake ID could be the gateway to get drugs as a young student in America. The common problem of getting alcohol when you're "under age" is leading you to learn how to get drugs online.

</comment></comment><comment><USER14>
      Five Eyes Law Enforcement Group (FELEG)

Sometimes I wonder is Snowden was an orchestrated provocateur, tasked with dropping things in the open so that the operations that were big enough to be hindered by covert practices could now operate freely, in the open, and accelerate their programs.

15 or 20 years ago, an INTERPOL style coalition of this sort would have raised eyebrows. Snowden blew the lid open, and nothing changed. In fact things are taking shape faster, if (we know about them) at all.

</comment><comment><USER15> (throw away). I am technical and recently tried Tor / AlphaBay for the first time to experiment and see what it would be like to buy MDMA online. I followed the excellent guide at [https://getsafedrugs.org](https://getsafedrugs.org), but ended up not purchasing. I have friends who have purchased successfully and surprising the entire process works.

<comment><USER16> Adding onto this, I prefer to research this kind of web content with a VPN or public internet that isn't associated with my ISP. Paranoid, sure. But the less personally identifying information involved in these transactions, the better.

</comment></comment><comment><USER13> Honestly Darknet marketplaces are doing a good thing for a lot of people.

Think of all these people who would buy their drugs in the street instead. They would probably get the worst quality, and even damage themselves just to try something.

<comment><USER17> I agree. One of the biggest problem with illegal drugs is adulterants/fillers, and drugs not being quite what you thought they were. For example, a lot of drugs sold as MDMA contain amphetamine or worse [1]

The reviews on DNMs don't eliminate this problem, but they certainly help.

[1] [https://www.ecstasydata.org](https://www.ecstasydata.org)

</comment></comment><comment><USER18> Wait till someone exposed that FBI itself is selling explosives, weapons and child porn on dark web.

[http://reason.com/blog/2016/08/31/the-fbi-distributes- child-...](http://reason.com/blog/2016/08/31/the-fbi-distributes-child- pornography-to)

<comment><USER3> Don't know why you're being down voted. I thought it was well known that they actively commit/participate in crimes in order to entrap people.

</comment></comment><comment><USER19> There's something really disturbing about this. The FBI is cheerily talking about attacking "darknet infrastructure".

In layman's terms, they're saying they want to wage war on TOR. It's kind of disturbing how pleased with themselves they are about it, though.

</comment><comment><USER20> > Payment for these goods and services is usually through virtual currency > like bitcoin, also designed to be anonymous.

Bitcoin is not, and was not designed to be, anonymous.

<comment><USER21> Actually, bitcoin is anonymous: no information links an account to his owner. However it's true that the owner of a specific account could be guessed with a good amount of precision going through all transactions history and pairing the data with those of bitcoin exchanges.

<comment><USER22> That's not anonymous, that's pseudonymous. You still have a name (an address), it just isn't your real name.

</comment></comment></comment><comment><USER23> As I posted further down in the comments:

"I don't understand something. Why is a compromise not an option?

Like safe spaces for such vices. State or city, or even privately owned venues with highly audited and regulated enviornments. Solid security, but also inviting enough to be an option for anyone.

Revenue and taxes generated from them ofcourse benefits society, while also putting a damper on crime lords income that could possibly end up being used to fund worse activities such as human trafficking.

Those who currently refuse to observe laws and still want that 'fix' have a legal option in a controlled enviornment. Reducing convictions to only those who do not utilize the safe space and put theirself and others at risk. They can cheaply and efficiently be monitored to know if they are well enough to be back in public. If not, sleep it off or have a verified driver pick them up.

Consumption can be monitored possibly greatly reducing accidental overdoses.

Increases availability which may lead to less 'its hard to get, I want it more' scenarios that strengthen addiction and habits. It may also help prevent people from getting in over their head by racking up debt with individuals who have no problem resorting to violence and sometimes also intentionally or unintentionaly hurting other innocent people.

I truly cannot think of any 'Cons' to having such a system other than the possible general public's opinion that 'we have accepted defeat and decided to join them' pinning involved organizations and business as effectively drug dealers and just as bad.

Let me summarize with an example:

Gambling other than lottery is not permitted in my state as far as I know. If I want to gamble I have to hit the casinos 1-2 states over. Knowing I have such an exquisite option available if I decide to do so allows me to appreciate that. I've never stepped foot inside a casino, nor done any type of serious gambling, but if I ever did I would like for it to be in a nice, fair, and engaging enviornment like those available. Just as if I decided to take a trip on shrooms, or hit a line of cocaine just for the experience with friends. I'd rather be in a place that I can relax and know everyone involved is exponentially safer than doing so in the neighborhood crack house.

I would love to hear others thoughts."

<comment><USER24> Mainly from the US perspective, "It's an affront to God to allow such debauchery, so no one is allowed to, except for those dirty natives, that we had to allow because of the Constitution."

I blame Christians, and their previous roots from the Puritans. I've seen enough other Christian-majority things shoved through as laws - it's no long stretch. And I come from the state that thinks, and funded, "electrocution to fix gayness". That was one of Mike Pence's doings in our state.

<comment><USER23> I politely dissagree. Puritan / christianity beliefs may have once been at the core of America's original founders visions but it has been a rather progressive 200+ years. We now can find and see things, rather common place at that, that a majority of the forefathers would be enraged over.

I think while morality issues play the largest role in such a decision, it is in reality a 'technically' hard problem that we still feel we can 'fight'. (War on drugs since early 60's and seventies). The majority is not ready to admit defeat by accomodating, no matter what benefit.

</comment></comment></comment><comment><USER25> I must not understand how Tor works because it seems pretty trivial to me for the FBI or a government agency to identify users. Where's the error in my thinking:

Tor works by routing a connection from your computer through a few hops in the network and then to the server. If the FBI operated the relay connected to your computer and also the server (say as a sting operation, or if they identified one and downloaded the logs), then wouldn't it be pretty easy to match the traffic through their relay (which has your naked IP address) to the traffic in the server logs?

<comment><USER26> It doesn't even need to be infiltrating TOR. They caught a kid who called in a fake bomb threat to get out of a college test because his connection to the TOR network coincided with the threat.

You could relay your traffic through one or more VPNs before connecting to the TOR network if you trust the companies not to keep logs or be beholden to the FBI/NSA.

But realistically your only friend in a worst-case scenario is the fairly reasonable hope that these agencies don't have the ability to parse all of their raw data, that they wouldn't waste time looking for you, and that you're not important enough for them to show their hand to everyone else and reveal exactly what they're capable of.

</comment></comment><comment><USER27> > Payment for these goods and services is usually through virtual currency > like bitcoin, also designed to be anonymous.

Not true. Bitcoin is pseudonymous at best.

</comment><comment><USER28> There's not really any information in this article, unfortunately. I know the FBI don't want to tip their hand, but I am genuinely curious to know more details about how they are investigating crimes online.

</comment><comment><USER29> Did the FBI really think it was a good idea to start with a huge picture of a "hacker" like that? Aren't they just romanticizing the DarkNet and possibly interesting new opponents?

</comment><comment><USER30> As an infosec fan, I'm curious what "network investigative technique" (ie 0day) they used against these servers to pop them. Criminal complaints will tell what FVEY LE hath wrought.

</comment><comment><USER31> I know people really buy drugs on these markets. Are people really able to buy weapons so easily?

<comment><USER32> A recent and high profile example is the Munich shooting from this summer: [https://www.deepdotweb.com/2016/08/25/german-dnm-vendor- arre...](https://www.deepdotweb.com/2016/08/25/german-dnm-vendor-arrested- selling-glock-munich-shooter/)

</comment></comment><comment><USER33> Though quite a long read, the feature WIRED did on the story of Silk Road [0] talks more in detail than this article about the FBI's infiltration and takedown of the site. Great read!

[0]: [https://www.wired.com/2015/04/silk- road-1/](https://www.wired.com/2015/04/silk-road-1/)

</comment><comment><USER34> I thought they did a decent job of explaining it, but by publicly exposing it in a high profile case (Silk Road) they did themselves a disservice.

The fact that it's referenced regularly in primetime TV means that thousands of people who never would have heard of it now check it out - <USER2> darknet sales well beyond what they would have been otherwise.

</comment><comment><USER35> Posting this story since people seem interested.

The Untold Story of Silk Road, Part 1 | WIRED [https://www.wired.com/2015/04/silk- road-1/](https://www.wired.com/2015/04/silk-road-1/)

</comment><comment><USER36> A man is a wolf for his fellow men. Ancient quote.

Now do something "good" and save all those bastard children because, we were taught we are different and not animals.

Law is a hipocrisy.

Disrupt banking and national bank monopoly, dont run after bank fraudsters.

Teach people to treat other people like humans, and disrupt the sex and mental health industries.

Always resolve the root cause.

But be aware, if all people were saints the pope would go bankrupt, so know who the pope is and be prepared to fight him.

</comment><comment><USER37> We're sorry...

The request has been blocked.

Anyone got a mirror?

</comment><comment><USER38> don't think I'll visit an FBI page on that topic. talk about the honeypot potential. esp given the potentials of a Pres Trump.</comment>


Ad Networks Are the New Dot-Coms - <AUTHOR> http://bits.blogs.nytimes.com/2007/11/07/ad-networks-are-the-new-dot-coms/index.html

<comment><USER2> I know the readership here does not represent the general population of the internet, but have any of you ever purchased a product/service from an ad served up in a non-search context?

<comment><USER3> No, but display advertising is more about brand awareness and opinion-- it's not a direct-response game measured by CTRs.

A better question is if anyone has been influenced or reminded of a brand or product as a result of an ad served in a non-search context. I know I have!</comment></comment>


Student loan stories from PBS's expose show _Now_ - <AUTHOR> http://www.pbs.org/now/shows/525/student-loan-stories.html

<comment><AUTHOR> The comments start off pretty good, but do get worse; it's not surprising they're closed now. That's an awful lot of student loan horror stories.</comment>


Russian team develops x86 emulator on ARM - <AUTHOR> http://cdn.eetimes.com/electronics-news/4397620/Russian-software-runs-x86-code-on-ARM <comment><USER2> Doesn't qemu already do this? Is the Russian's code faster?

<comment><USER3> I believe qemu's userspace mode doesn't work on an ARM host.

<comment><USER4> It does, assuming your ARM host is at least ARMv6 or v7 (v5 doesn't deal with unaligned accesses and QEMU userspace mode doesn't do anything special with guest binary unaligned accesses, so they appear as host unaligned accesses).

QEMU's i386 userspace mode emulation is a bigger problem -- most notably it doesn't handle multithreaded guest binaries (to an even bigger extent than QEMU's general issues with multithreaded guest binaries).

None of these are insurmountable problems; it's just that nobody so far has cared enough about them to put in the time to develop fixes and get them through code review on the mailing list. Patches welcome :-)

</comment></comment></comment><comment><USER5> Is this the same group that worked on the Elbrus VLIW computers? <http://en.wikipedia.org/wiki/Elbrus_%28computer%29>

<comment><USER6> Yes they are the same

They have already implemented a software dynamic binary translation virtual machine, similar to Transmeta Crusoe With real hardware booting window/linux

<http://en.wikipedia.org/wiki/Elbrus_2000>

I guess is that binary translation virtual machine could be tweaked for ARM instruction set

</comment></comment><comment><USER7> An x86 emulator optimized for ARM:

      http://www.aemula.net

</comment><comment><USER8> So this is a purely software solution? I wonder if we could see ARM SoCs with some hardware for decoding x86 instructions and have them executed by the ARM core.

After all since ARM7 most ARM cores support both ARM and THUMB instruction sets.

I'm not sure you could do that without permission from Intel though.

<comment><USER4> I don't think decode is really the hard part; if you're JITting at all it's pretty easy. The difficulties arise where the semantics of the target and the host don't match up. For instance, emulating a strong-memory-model architecture like x86 on a weak-memory-model architecture like ARM requires a pile of explicit memory barriers if you're going to handle multi-threaded binaries. Emulating atomic memory accesses might also be tricky. Differences in floating point semantics (like x86's 80-bit format or just different choices of IEEE implementation specifics) are also painful: QEMU takes the slow-but-safe option of doing all the floating point emulation in software (ie using integer arithmetic) to ensure bit-for-bit accuracy. None of these pain points is really related to the instruction decoding.

<comment><USER9> According to Herb Sutter at [1], ARMv8 will support a couple new ops to support sequentially consistent memory access.

1: [http://herbsutter.com/2012/08/02/strong-and-weak-hardware- me...](http://herbsutter.com/2012/08/02/strong-and-weak-hardware-memory- models/)

</comment></comment></comment><comment><USER10> What server applications that matter cannot be recompiled for ARM but will work effectively under emulation?

<comment><USER11> Anything with a JIT compiler? For example, the status of Java on ARM is getting better, but still rumoured to not be as fast as on x86.

And anything that is not open source? Proprietary software is still used heavily on servers running an open source stack. Having a performant emulation or translation option could help with odd pieces that vendors haven't recompiled. Although support would be an issue for this at enterprise level.

<comment><USER12> >Anything with a JIT compiler? For example, the status of Java on ARM is getting better, but still rumoured to not be as fast as on x86.

If performance is the worry I highly doubt running through an x86 emulator is going to be faster.

</comment></comment></comment><comment><USER13> Within a few years, Intel CPUs are soon going to compete with ARM.

<comment><USER14> We've been hearing that for the past few years.

<comment><USER15> They already compete. More and more markets will be affected over time.

</comment></comment></comment><comment><USER16> To run VMWare->Windows->JVM->Scala/Closure "state of the art" stuff, I suppose..

<comment><USER17> What is the state of the JVM on ARM, can you run enterprise stuff on top of Dalvik?

<comment><USER10> I don't think the state of enterprise JVM support on ARM is a reason run x86 JVM under software emulation on ARM.

Intel would eat that idea for breakfast.

There are real JVMs on ARM, plus Jazelle Java acceleration.</comment></comment></comment>