Seeking Truth in a Time of Misinformation - <AUTHOR> https://raphlinus.github.io/covid/2020/07/08/seeking-truth.html <comment><USER2> A significant part of the problem is social media technology and our relationship with it. The platforms encourage low effort hot takes and gamify narcissistic tendencies (likes, karma, rts, friends, followers). Nuanced discussion or having a deep engagement with a person is often impossible. It fosters divisiveness and tribalism at an amazing scale.

I'd wager in a world without Twitter, Facebook, et al we'd have a healthier & stronger society. Humans aren't meant to communicate this way and numerous studies show the physiological toll on the individual and we are all witnessing the societal toll play out in front of us.

<comment><USER3> > Nuanced discussion or having a deep engagement with a person is often > impossible.

Of course this is impossible if the other party is not interested, but the format doesn't prevent engagement. The problem is that this engagement takes work and is rewarded less than the "hot takes" you describe.

The literature on trust metrics that Raph has made a contribution to does suggest that the gamification can be tuned to reward constructive interactions. Given the recent advertiser boycott of Facebook, it is possible that there is now an incentive for applying these ideas in the context of popular social metrics.

<comment><USER4> Prevent might be too strong a description, but discourage deeper engagement while radically facilitating the opposite?

> can be tuned

Sure, maybe. But thus far they haven't been. I'm a bit dubious that intentional interventions wouldn't also have their own substantial negative effects.

Our online communications platforms have a much greater effect on many people than a great many drugs that we only make available by prescription do... yet we've tapped in most of the country to them on a 16-hour a day central line drip feed before we ever really began studying their effects.

<comment><USER3> > But thus far they haven't been.

They haven't been because the social media platforms have been chasing engagement as their only target and that favours toxicity. But many advertisers are allergic to toxicity: there may be space for a social media platform that tries to avoid the toxic forms of engagement.

> I'm a bit dubious that intentional interventions wouldn't also have their > own substantial negative effects.

The current system has been shaped by intentional interventions. The alternative regime should be judged relative to the status quo.

I recommend Richard Seymour's 'The Twittering Machine' on the nature of those intentional interventions; cf. review: [https://www.rs21.org.uk/2019/11/16/review-the-twittering- mac...](https://www.rs21.org.uk/2019/11/16/review-the-twittering-machine/)

</comment></comment></comment></comment><comment><USER5> Thank you, this is an important and timely article. If, however, you believe that only one faction is anti-truth, you are blind or willfully dissonant.

<comment><USER6> I probably could have worded that a bit more clearly. I was trying to make the argument that there is an anti-truth faction and that this faction is _currently_ in a much stronger alliance with the right. I'm under no illusions that it's exclusive to the right, though, and was thinking of adding a section on anti-vax to clarify this.

In any case, I wanted to stay away from reflexive both-siderism as I've most often seen it used as a bad faith argument.

<comment><USER7> As someone who agrees in sentiment with GP (but leans similarly to you), I thought you communicated that well enough in the article. For what little my opinion's worth.

</comment></comment></comment><comment><USER8> I would like some comments on this:

I have been grappling with how to discuss issues related to covid as truthfully as possible, and I'm wondering if anyone disagrees.

My intuition as a physicist says that any discussion or comparison of covid effects that look at total numbers, while true, is less meaningful than looking at these numbers normalized by population size.

Both sets of numbers are true, both lead the intuition to different conclusions. What conclusion should the intuition land on?

Isn't it strange that people can argue behind truthful data to lead people to completely different conclusions?

<comment><USER6> Both sets of numbers are meaningful, for understanding different parts of the problem. The spread of an infectious disease like Covid-19 is not a virus moving through a relatively homogeneous population, but rather the overlay of a lot of small outbreaks. Early on, when the total number of cases is small, absolute numbers are most meaningful as a basis for comparison. [1] is a thread from Mar 29 (from the brilliant visualization expert John Burn-Murdoch) arguing that absolute numbers are more predictive of "death toll one week after 10th death" and that normalizing by population only makes smaller countries look worse.

But as the spread continues (a process which takes time), per-capita numbers make sense. Mr. Burn-Murdoch revised his position (see [2] for a podcast with transcript where he talks about his thinking), and now the FT graphs have a normalized option (though their focus has moved on to other metrics such as excess mortality).

Carl Bergstrom also has a great thread [3] where he talks about the choice, concluding that both are valid as long as you're careful about context.

HTH

[1]: [https://twitter.com/jburnmurdoch/status/1244380095164420101](https://twitter.com/jburnmurdoch/status/1244380095164420101)

[2]: [https://voices.media/transcript-john-burn-murdoch-senior- dat...](https://voices.media/transcript-john-burn-murdoch-senior-data- visualisation-journalist-financial-times/)

[3]: [https://twitter.com/CT_Bergstrom/status/1249930293928030209](https://twitter.com/CT_Bergstrom/status/1249930293928030209)

<comment><USER8> It sounds like we would ideally have a geographical heat-map overlaid on to every county in America that was per-capita based.

Then, even small numbers in an initial outbreak are meaningful because you aren't dividing by the population of the world.

This would also let local policy makers and citizens gauge risk levels.

It seems to me that the media scared everyone in the country in March/April based on what was happening in NYC, and now people are numb to any recommendations.

This miscommunication cost us dearly.

</comment></comment></comment><comment><USER9> This author is mostly on to it. However, I'm hearing the dog that is not barking.

We hear about listening to the science when it comes to COVID-19 and climate change. I totally agree. Why not also listen to the science when it comes to police shootings? And about whether George Floyd protesters further spread the virus or magically spookily didn't? We hear about criticism of the CDC, and I concur. Why not also admit the WHO made a long series of dangerous misstatements to such a degree that it's gotten hard to believe they were just accidents?

IMHO the right-wing is leading the way in conspiracy theories and downright dangerous viewpoints. On this we agree. But the left-wing legacy media has its fair share of fake news as well, especially in continually to mischaracterize statements made by Trump, and in framing the narrative in extremely unhelpful ways. Why not report actual death statistics regarding race relations? Why is it never news when a black police officer shoots a white person? Our brains make inferences based on frequency of events, but the events we are bombarded with are biased in a way to lead us to wrong politically-motivated conclusions, time and time again.

I'd like to think I'm in the middle. At the very least, I try to heap criticism on everybody. I'd like to see reasonable people to converge in the middle, en masse, and break America out of this dangerous partisan death spiral. This author is clearly reasonable, and on the right track, but seems to still be too much living in the main left-wing bubble and/or too afraid to criticize the left.

<comment><USER9> I've dug further into this and have become less impressed. I'll leave just one example (I had many but I won't hog this space).

Apparently this is "high end science journalism". Kai Kupferschmidt tweets this "Some people in the US actually seem to think that rising #covid19 cases won't lead to rising deaths eventually. It's like they are watching lightning flash across the sky thinking the thunder won't come crashing."

Cases don't measure infections, they measure measured infections. Ramping up testing will ramp up cases even if infections do not ramp up. There is a credible theory that more cases are due to more testing, not due to more infections, and if that is true, the death rate will not follow. I don't personally accept that theory, but it's disingenuous and not "high end science journalism" when you fail to actually address the alternate theory.

<comment><USER6> This might be a good opportunity to make some distinctions. @kakape is a professional journalist, and his work product is the articles he publishes in Science. The Twitter feed is not the journalism, but is participating in a conversation. I find following Twitter feeds of journalists particularly useful, because they tend to have their ear to the ground about what is interesting, but of course it's no substitute for vetted, edited articles.

That particular tweet resonates poetically for me, and speaks to major themes in my essay. The belief that you can have rising cases and mortality will stay low is, as we speak, a major narrative in what I refer to as "idiot Twitter." What I get from the Tweet is that a basic theoretical understanding of the underlying processes should be enough to dispel the notion. Just as a child might not know that thunder follows lightning, the people espousing this theory do not understand basic epidemiology. It's not a scientific proof that thunder follows lightning, or that there might not be edge cases such as the flash being so far away that the sound dissipates.

Increased testing is absolutely a factor in explaining why we're seeing this puzzling pattern, but doesn't by itself explain what we're seeing. Part of the answer is lead time bias, which from what I can tell is a reasonably obscure epidemiological concept but relevant in this context. Dr. Ellie Murray explains it in this linked "tweetorial":

[https://twitter.com/EpiEllie/status/1280305393516904448](https://twitter.com/EpiEllie/status/1280305393516904448)

Simpson's Paradox is another major factor: to really gain an understanding of what's going on, you need to look at individual states or even finer regional divisions, and aggregating them can obscure important patterns. The effect is especially important these days because different states are _very_ different.

</comment></comment></comment><comment><USER10> The appeal is to "listen to these people." Unfortunately intellect doesn't imply integrity, and appeal to authority is what got America to where it is. I would've preferred a framework for critical thinking, or at least more emphasis on that aspect rather than saying "you can trust these people." That's what everyone is saying, PhDs everywhere. I have an unfinished PhD too, and I'm saying "find out what makes it tick" and "follow the money"

<comment><USER6> I had another section on "is this an echo chamber?" that didn't make it into the final version. It would have gone into internal consistency and evolution of thought in the face of evidence as reasonably objective yardsticks. I'm not sure how much I'd be able to accomplish trying to establish a framework for critical thinking in a blog post.

In any case, the message is much more, "I've been paying close attention and have found these people worth listening to," and I don't think "authority" is really the word I'd use to express my criteria. I mean, I had a whole section _against_ authority, and in my penultimate graf I implore readers to do their own critical thinking and not blindly follow.

</comment></comment><comment><USER6> Some reflections, having slept on it.

I am disappointed but not at all surprised that many of the reactions here are responses to my partisan position. I worked pretty hard to reduce that without compromising what I was trying to say. Certainly in the Twitter list I'm promoting I think I succeeded; it includes Scott Gottlieb, who was FDA commissioner under Trump and now advising two Republican governors on Covid-19, but doesn't have anybody (D or R) who uses their platform to push partisan political messages.

But I think the reduction of everything to partisanship is one of the ways in which we're broken. It's impossible to have a productive conversation under those circumstances. I think it's a kind of learned helplessness. We don't want to solve problems ourselves, we want our political party (and institutions in general) to do it. I'm sure many of us on this thread have fantasies of our party vanquishing the other one on the political stage and carrying out our wishes. Or if our party is in power, then we reflexively want to rationalize away whatever flaws they have. (For the record, I am equally upset by what's going on in blue states and red. Seeing the numbers go up in California, where I live, is at odds with any simplistic narrative that Democrats embrace science and Republicans deny it, with direct consequences for Covid response)

In any case, thanks for the responses, they're all respectful, and I appreciate that.

</comment><comment><USER11> Some more reading on this topic:

\- This Is Not Propaganda: Adventures in the War Against Reality -- Peter Pomerantsev

\- A Lot of People Are Saying: The New Conspiracism and the Assault on Democracy -- Nancy L. Rosenblum

\- Trust, Facts, And Democracy In A Polarized World [podcast ] [https://www.democracyworkspodcast.com/pew/](https://www.democracyworkspodcast.com/pew/)

\- darknetdiaries EP 65: PSYOP [podcast] [https://darknetdiaries.com/transcript/65/](https://darknetdiaries.com/transcript/65/) (interview with psychological operations worker)

\- Active Measures: The Secret History of Disinformation and Political Warfare -- Thomas Rid

</comment><comment><USER12> I've read that 40% of all deaths as of the first week of June were in elder care homes, a lot of them in NY and NJ where C19 patients were _sent to the nursing homes_. It's not so much a partisan issue as it is absolute shit state government issue. The decision to decimate the elderly was made at the state level, without exception. Governor Cuomo in particular needs to go to jail, in spite of granting himself immunity for this.

<comment><USER13> What a good example. I heard this claim recently from a family member and decided to look it up. It sounds unbelievable and deeply disturbing that Cuomo would knowingly send infected people to be admitted to nursing homes. The way the story is told, it sounds like he's actually trying to spread the disease and kill old people.

It turns out it's all spin. I'll admit it took quite a bit of digging to get beyond all the nypost/wsj/fox stories spreading misinformation. Yes, Cuomo said a COVID-19 diagnosis was not a reason to exclude patients from returning to a nursing home in March. But also, hospital bed space was absolutely critical during that time. While this was happening, about 25% of the nursing home workforce was infected anyway, and staff seems to have been the primary means of transmission. Also, after a week or so of showing symptoms, it was thought that the patients are no longer infectious to others.

The reason that you, my family, and the right-wing media are going crazy over Cuomo's decision is because Trump is making it a political issue and using this as a talking point. The reality is that Cuomo arguably made the best decision possible at the time, and there wasn't really an alternative. Other states made the same decision at the time, and based on the outbreak numbers we're seeing today, we'll see that decision again in the near future. The only other option was to let hospitals overflow their capacity. Maybe there should have been centers for COVID patients that are released from hospitals, but that's a massive logistical problem to be solved on short notice in the middle of a pandemic.

Cuomo's executive order happened in March. By May, once things were getting under control, Cuomo changed that order, presumably because hospitals now had more capacity to house patients. Take a look at the curve from NY and tell me you could have made a better decision at the time: [https://www.syracuse.com/coronavirus- ny/](https://www.syracuse.com/coronavirus-ny/)

If you want a reason to be outraged at Cuomo, the real scandal here is NY state providing immunity from lawsuits to nursing homes who mishandled the outbreak. The reason you're not hearing outrage about that from right-wing press is that it's also a republican strategy. States across the country are granting lawsuit immunity to protect insurance companies and care facilities.

This is the closest you're going to get to the real story, if you'd like to learn more: [https://www.nytimes.com/2020/07/08/nyregion/nursing-homes- de...](https://www.nytimes.com/2020/07/08/nyregion/nursing-homes-deaths- coronavirus.html)

<comment><USER12> What's "spin" here? 40% of all deaths being in nursing homes? That it's not a good idea to send C19 patients to nursing homes? That NY has three times the death rate of Italy? That states which locked down nursing homes have much lower fatalities? I don't see how you can even begin to argue that Cuomo's handling of the crisis was at least atrocious, if not outright malicious.

> about 25% of the nursing home workforce was infected anyway

The logical thing to do would be to _move them out_, not get that number to 100%.

<comment><USER13> If this wasn't HN, I'd dismiss you as a troll, but because I think you're legitimately trying to engage here, I'll bite:

> It's not so much a partisan issue as it is absolute shit state government > issue. The decision to decimate the elderly was made at the state level, > without exception. Governor Cuomo in particular needs to go to jail, in > spite of granting himself immunity for this.

This is the spin.

The fact that you're aware of this order being enacted in New York and unaware that the same guidelines existed in 12 other states, including New Jersey, should make it really clear that this is anti-Cuomo spin. Another indication is that searching for "cuomo covid nursing homes" yields almost exclusively right-wing publications of questionable veracity. Also he's a Democrat from New York, and the governor of New York is traditionally a high profile target. Also, at the time the story broke, Cuomo's daily press briefings were seen as competing with Trump's daily briefings. When you add all that together, it's pretty obvious to me that there's going to be some spin here, which doesn't mean the spin isn't true, but it's good to be aware that it's happening.

> 40% of all deaths being in nursing homes? That it's not a good idea to send > C19 patients to nursing homes? That NY has three times the death rate of > Italy?

I'm not disputing any of that. COVID disproportionately impacts the elderly. Sending patients to _any_ facility not specifically designed for it is a bad idea. I don't know enough about Italy to comment as to why they may have fared better.

> That states which locked down nursing homes have much lower fatalities?

I assume you're talking about places that stood up COVID-only facilities quickly. I think everyone, even Cuomo, knew that this was the best thing to do, but for whatever reasons it couldn't be executed in NY. But as we know, NY wasn't the only state that failed this test. I'm fairly certain Cuomo would have picked separate facilities if that was a possibility and the better option for public health.

> I don't see how you can even begin to argue that Cuomo's handling of the > crisis was at least atrocious, if not outright malicious.

Cuomo was a rational actor here, unfortunately.

The problem has at least two significant dimensions:

1) Elder care is for profit, and not having those patients causes a financial loss for the care facilities. This has always been a moral hazard and is why these facilities are known for their poor standards of care. If a facility can figure out a way to cut expense or accept more patients, the facility will make more money. Like many problems, it's always been there, but it's made much worse by the pandemic. I don't know if Cuomo was lobbied to make the decision for care facilities to accept discharged COVID patients, but it is a possibility.

2) There's been a lack of federal leadership on pandemic preparedness. Cuomo's decision was to free up hospital resources by releasing patients back to care facilities. It's hard to fault him for that given the predictions at the time and the very real threat of saturating the entire health care system. Pandemics cross state lines and the federal government should take charge of the situation and ensure a uniform response. The current administration has decided to leave the majority of the response for the states to figure out. Additionally, somewhat famously, the current administration disbanded their pandemic response team: [https://www.snopes.com/fact-check/trump-fire- pandemic-team/](https://www.snopes.com/fact-check/trump-fire-pandemic-team/)

I would be super happy if you read this whole comment and think "oh no, maybe i was deceived by disinformation" and take steps to make sure you're less vulnerable in the future. Unfortunately, truth is now partisan, and I don't think you and I will be able to reach a shared truth about what Cuomo did or why. It's particularly disappointing because this is such a clean textbook example of a disinformation campaign.

Also, for what it's worth, I don't even _like_ Cuomo. He just happens to be a legitimate victim of disinformation in this particular instance.

</comment></comment></comment></comment><comment><USER14> Just look at the difference in mask recommendations between governments over time will give people a feel on how difficult it is to ascertain truths in an evolving epidemic.

There is also the issue of whether the absence of evidence constitutes evidence for absence, notably surrounding the controversies regarding the effectiveness of masks and hydroxychloroquine

</comment><comment><USER15> Thank you for this excellent post! Out of curiosity, how much time do you spend sifting through COVID-related material every day? Or is it mostly passive (Twitter experts, etc.) at this point?

<comment><USER6> It goes up and down depending on how busy I am with other things, but aside from keeping on top of Twitter I try to read about a paper a day. I went pretty deep into a few topics, including HCQ and trying to understand the capabilities and limitations of isothermal PCR.

One interesting pattern I found from discussions on HN is that when people cite papers, they very often don't support what the poster seems to be claiming. That's maybe I something I could expand on, because it's similar to cherry-picking but still not quite the same. In any case, I still appreciate the references because often I learn something :)

<comment><USER7> >One interesting pattern I found from discussions on HN is that when people cite papers, they very often don't support what the poster seems to be claiming.

This is not unique to HN. Heck, often the _data_ in the paper doesn't support the _words_ in the paper! Science is hard.

</comment></comment></comment><comment><USER16> Presumably most of this applies to the issue of climate change, also.

<comment><USER6> Yes, and I refer to that at least in passing. I've observed that the political and informational environment around climate change and Covid-19 are basically identical, with the exception of about a couple orders of magnitude of time scale. That gives the opportunity to see how well arguments hold up in more or less real time, which is much less of a luxury with climate change.

</comment></comment><comment><USER17> I've read this article several times, each time trying to understand what the author want to say, but it's just impossible and the title is completely misleading. For months since all of this started there has been an extremely large division between not just ordinary people, but between people competent enough to discuss the issue like doctors and scientists. To be completely on one side is naive and telling people what the "truth" is is arrogant. Now there is tons of data to be working with and continuing with the narrative that we're in some serious and deadly pandemic is just ridiculous.

</comment><comment><USER18> Hint: "china" didn't appear in this article.

<comment><USER6> It did not, because there are many many threads of disinformation and I wasn't trying to catalog them all. I'm happy to engage a discussion of how to avoid misinformation specifically related to China, but not really clear what point you're trying to make here. I also think it's pretty far down on the list of threats we face right now, but understand others may feel differently about that.

<comment><USER18> You are talking about disinfomation and Covid19 without mentioning the state- of-the-art player: CCP, you won't get it right. This is an advice from a native Chinese.

<comment><USER6> I'm not knowledgeable enough about the CCP's disinformation efforts to do the topic justice. But if you'd be willing to write something in the same general spirit as my essay, I would be more than happy to link it.

<comment><USER19> well, they started off actually going to credible sources, telling them to portrait them positively. i don't know of any _proof_ for comment-style disinformation from them, but considering that its basically impossible to prove that.... i'm not sure someone could write a good article about that. its a sad reality we live in, imo.

its also telling that very few published that attempt. i doubt it was only done to germany... others likely went ahead.

[1] [https://www.reuters.com/article/us-health-coronavirus- german...](https://www.reuters.com/article/us-health-coronavirus-germany- china/germany-says-china-sought-to-encourage-positive-covid-19-comments- idUSKCN2280JW)

</comment></comment></comment></comment></comment><comment><USER20> This is a fantastic piece. I am going to share it with my students tomorrow.

<comment><USER21> I disagree strenuously and I believe the piece will be damaging to the intellectual future of your students.

The title is "Seeking Truth" but the author doesn't appear to be doing that. A more accurate title would be "Declaring Truth Without Supporting My Claims!"

\- Author makes an extraordinary, vague, unfalsifiable claim that "America is Broken," but does not provide extraordinary or rigorous evidence

\- Author makes the further claim that it's all the fault of Republicans, again providing little in the way of evidence

\- Author appeals to the authority of science, but doesn't apply the rigor of good science to his own arguments; we are ironically expected to take his own claims on faith

For the most part this article is just another piece of incendiary rhetoric with little compelling evidence of anything, all it adds to the debate is emotion.

The author should narrow the scope of his claims and address opposing viewpoints in good faith if he wishes to construct a credible argument.

If this shit passes for academic nowadays, no wonder a growing number of Americans feel we no longer need academia.

Teach your students a dialectical method instead, where opposing and specific viewpoints are presented with the requirement to make a rational, evidence- based defense of their positions:

[https://en.wikipedia.org/wiki/Dialectic](https://en.wikipedia.org/wiki/Dialectic)

<comment><USER3> "damaging to the intellectual future of your students"

This might be true, if the teaching environment suppresses criticism of material presented. This is not what is supposed to happen, though: materials should be presented as an opportunity for critical evaluation and the multiplicity of views presented by _students_ should provide the dialectical input needed, possibly supplemeted by interjections by the instructor if the students are showing groupthink. This is better that presenting two opposite claims and leaving it to the students to figure out on their own if one of them is correct. (Usually neither is entirely, and in real life, not every pirce of information comes helpfully accompanied by an appropriately matched opposing viewpoint).

You're quick to assume the worst. Why is that?

<comment><USER22> Not to disagree with your overall point, but Marcuse wrote about plurality as a poor substitute for critical thought in the 60s:

"Now in recalling John Stuart Mill's passage, I drew attention to the premise hidden in this assumption: free and equal discussion can fulfill the function attributed to it only if it is rational expression and development of independent thinking, free from indoctrination, manipulation, extraneous authority. The notion of pluralism and countervailing powers is no substitute for this requirement. One might in theory construct a state in which a multitude of different pressures, interests, and authorities balance each other out and result in a truly general and rational interest. However, such a construction badly fits a society in which powers are and remain unequal and even increase their unequal weight when they run their own course. It fits even worse when the variety of pressures unifies and coagulates into an overwhelming whole, integrating the particular countervailing powers by virtue of an increasing standard of living and an increasing concentration of power."

The instructor's interjections provide a look-in here, but the whole presupposition is that the students have learned and sufficiently refined the capacity for critical thought inside and outside the classroom setting.

<comment><USER3> It is, of course, not any kind of substitute for critical thought. But the GP referenced dialectic by way of arguing for contrary materials to be presented in class: my point was that a living argument among the students is better for teaching dialectic than a curated selection of contrary views. The responsibility of the instructor goes beyond this elementary requirement for ensuring multiple viewpoints are presented.</comment></comment></comment></comment></comment>


Qualcomm backtracks from Apple A7 marketing gimmick comments - <AUTHOR> http://www.techhive.com/article/2053200/qualcomm-backtracks-from-apple-a7-marketing-gimmick-comments.html <comment><USER2> Nobody seems to be saying this here so I'll just come out and say it...

Qualcomm's knee jerk reaction to press that praises Apple's platform is to point out the obviously premature move to 64 bit mobile chips, since Apple does not buy Qcomm SOCs and competes with Samsung, Qcomm's biggest customer. After a little critical thinking, Qualcomm realizes that it too will shortly be selling 64 bit mobile chips because now Samsung will want to match apple spec for spec, as most Android OEMs typically do.

\</comment><comment></comment><comment></comment><comment></comment><comment>--- As whether the move was a "gimmick" or not: The move to 64 bit would have been premature if Microsoft or an Android OEM had done it, but Apple made the right call for a few reasons:

(the obvious) - ARM v8 is a new ISA, and porting 32-bit ARM kernel code to the new ISA just to abandon it in a few years would be foolish

(musing)- Apple's OS people now only have to worry about one kernel code base when writing non-assembly, non performance critical code.

(speculation) - Apple may consider switching some of their traditionally x86 lineup to use lower power ARM chips in the intermediate future (2-4 years) and is giving itself that option by getting their kernel ready for ARM 64.

(way out there) - Apple may be planning to use their mobile chips in ultra low power server clusters, and they had to port the kernel to 64 bit before that was an option.

<comment><USER3> In "the obvious", note that the switch to ARM64 also allows a more efficient Obj-C runtime: there are more unused bits (due to alignment and effective pointer sizes) in AArch64 than in AArch32, and more in ARM64 than x86-64.

This allows the obj-c runtime to smuggle significantly more information inline in the `isa` pointer on ARM64 than on ARM32 or x86-64 (via pointer tagging): [http://www.sealiesoftware.com/blog/archive/2013/09/24/objc_e...](http://www.sealiesoftware.com/blog/archive/2013/09/24/objc_explain_Non- pointer_isa.html) [http://www.mikeash.com/pyblog/friday- qa-2013-09-27-arm64-and...](http://www.mikeash.com/pyblog/friday- qa-2013-09-27-arm64-and-you.html)

(amongst other things, _19_ bits of the pointer are now used to hold the object's reference count, for any object with less than half a million references an incref or decref is just an atomic increment or decrement of this field, instead of an indirection through a global refcount table with a bunch of locks involved)

<comment><USER4> > In "the obvious", note that the switch to ARM64 also allows a more efficient > Obj-C runtime […]

Why wouldn't inline reference counts (as an extra 32 bit word in the object struct) be just as effective on a 32 bit architecture?

Apple's tagged pointer tricks are just making the best of a bad situation.

<comment><USER5> How are extra 32bit words considered "inline"? Wouldn't this completely miss using the register for count evaluation?

</comment></comment></comment></comment><comment><USER6> That wasn't a very useful article in terms of explaining the potential benefits of 64-bit on mobile. I get that the reasons are a bit esoteric; "a larger address space makes ASLR more effective" is tough to explain to a non- programmer reader. But a writer's job is to get people who understand to explain and then write that explanation in a way that readers can roughly understand.

<comment><USER7> Agree. Going 64-bits in general can benefit that more instruction sets, more data sets per instruction, memory access at repeating process. What's in this article is just quote by CMO that is a claim without benchmark evidence or whatever.

</comment></comment><comment><USER8> Unnamed sources at the company said that Anand Chandrasekher would be receiving a well-deserved spanking.

<comment><USER9> As long as the spankings remain within the "Chandrasekher Limit" I don't think we are in danger of dwarfing the larger issues.

</comment></comment><comment><USER10> Gruber must be feeling pretty smug right now: [http://daringfireball.net/linked/2013/10/02/qualcomm-a7](http://daringfireball.net/linked/2013/10/02/qualcomm-a7)

<comment><USER11> Yep: [http://daringfireball.net/linked/2013/10/08/qualcomm](http://daringfireball.net/linked/2013/10/08/qualcomm)

</comment></comment><comment><USER12> "...for compatibility reasons, we still support the entire ARMv7 machine in the new ARMv8 architecture, but when running 64-bit software, this part of the machine is not being used, and the area of complex legacy it had built up does not need to be active when running in the 64-bit ISA, unlike other architectures where 64-bit extension was simply added to the historical complexity and legacy of their 32-bit mode. The new ISA drew upon the years of experience of building different micro architecture implementations, so again it was defined so that these new processors can be more easily optimized for low power operation — an opportunity not really offered since the first ARMv4 machine that resulted in the now legendary low power ARM7 processors."

[http://www.arm.com/files/downloads/ARMv8_white_paper_v5.pdf](http://www.arm.com/files/downloads/ARMv8_white_paper_v5.pdf)

</comment><comment><USER13> That was a terrible comment from Anand Chandrasekher and shows fundamental lack of understanding. How did he become the CMO?

</comment><comment><USER14> Qualcomm supplies the modem/baseband chips in iPhones (at least the iPhone 4 and 5), so I imagine they wouldn't want to upset a customer too much.

</comment><comment><USER15> > A benefit of 64-bit is the ability to put more than 4GB of memory in > smartphones

This is an annoying piece of misinformation that always rears its ugly head in 64-bit discussions. There are many ways to address more than 4GB of memory, going 64-bit is far from the only option.

<comment><USER16> True, but they're usually far from the most elegant or speedy option.

</comment></comment><comment><USER17> 64bit move comes along with ARM v8 move. It wouldn't make sense for apple to move to ARM v8 staying at 32bit. As far as I remember apple hasn't said that 2x performance improvement came from just 64bit. They included new ISA and 64bit compatible iOS 7 too.

<comment><USER18> Well, there _are_ actually some reasons to stay with 32 bit when using AArch64 in ARM v8. There are lots of goodies in the new, RISCier encodings and the benefits from the more traditional encoding are more relevant for lower-end chips. I'm sort of waiting for someone to make an ARM equivalent of the x32 ABI[1], using the new instructions but keeping 32-bit pointers to minimize cache pressure.

Still, 64-bit memory addressing does have advantages in terms of garbage collection, mmaping files, etc even if the phone has less than 1 GB of RAM.

[1][http://en.wikipedia.org/wiki/X32_ABI](http://en.wikipedia.org/wiki/X32_ABI)

</comment></comment><comment><USER19> Lessons from my father: _Shit_ is best eaten in small bites, as it is served.

</comment><comment><USER20> Zero credibility all around. I hope to see some proper details on how exactly this helps mobile applications.

<comment><USER21> [http://www.mikeash.com/pyblog/friday- qa-2013-09-27-arm64-and...](http://www.mikeash.com/pyblog/friday- qa-2013-09-27-arm64-and-you.html)

<comment><USER22> From the conclusion: The simple fact of moving to 64-bit does little. It makes for slightly faster computations in some cases, somewhat higher memory usage for most programs, and makes certain programming techniques more viable. Overall, it's not hugely significant.

So it isn't a huge deal. It's the overall package that adds up to a much faster SOC.

<comment><USER23> (I see the author of the piece you quoted has responded also.)

Really, it's not just the SOC.

As described in @mikeash's piece, the 64-bit address length has allowed Apple to inline some per-object information (like reference counts) with object pointers, which is a big win in some key operations (2x faster object creation/destruction), which could sometimes make a big difference at the application level.</comment></comment></comment></comment>


She Posted a Bad Yelp Review. Then Her Nightmare Began - <AUTHOR> https://www.thedailybeast.com/she-posted-a-bad-yelp-review-then-her-nightmare-began <comment><USER2> I only read the first two stories. Seems to be another case of people who don't take the internet seriously when they spew their bile into in, but then take it very seriously when bile comes back in their direction.

Here's a quote from a thing I once read that seems to be scratching around the core of the issue:

>ten years ago Steve 'Asshole' Jobs played a hilarious prank on all the digitally-illiterate 20th century luddites by pick-pocketing their ol' trust, reliable telephones and replaced them with computers instead. Tee-hee! Let's see if they notice the difference! And then he promptly died.

>The result, we see today, is a stratified understanding of "the internet".

>One level consists of everyone who really knows what the internet is. The internet's early adopters were a bunch of nerdy white males out of touch with society, guilty as charged. Annoying athiests and such. The thing is that this group (which I count myself among) knows how communities online function because they've been part of them for decades. [...]

>Another level, the social media level, is what Fruit Juice Jobs foisted onto the unsuspecting public who now think they understand current technology and the state of the art of digital communications. Of course, they don't. [...] This decade-young group has no experience in what the internet actually and take no personal responsibility for their own online safety. For instance, they assume or act like a) Twitter will be around forever and b)Twitter can just block the bad guys and create a peaceful, harmonious online community. They cede all personal responsibility to a corporate hiearchy, like they were customers in a fast-food joint demanding to speak to a manager or some shit.

<comment><USER3> I see this trend with online dating. About 90% of the women I meet online have a huge level of exposed information. After exchanging only a few messages with someone I typically know enough about them to find their LinkedIn, Facebook, Instagram, etc. This is useful since I can see if they look like their photos, seem to be a real person, etc. This is just the tip of the iceberg if someone wants to go down that path.

This led to me being careful about what I show the world. I have a public Instagram on which I only put select photos, photos which wouldn't interfere with employment, dating, etc. I occasionally search myself to look for exposure.

</comment></comment><comment><USER3> I find these things very hard to read since they're typically written from only one perspective and usually written to make a point. It always leaves me unsure which side to take.

<comment><USER4> > "Thanks for a sloppy drunken night, she snorts coke off my c*ck like a > champ," another anonymous user wrote.

What would be the other perspective you need in this context?

<comment><USER3> What did their behaviour actually look like at the bachelorette night? A bunch of drunk people acting horrible and then playing the victim isn't anything new. Bachelors and bachelorettes having one last night of sexual debauchery isn't anything new.

I worked in bars when I was younger and it showed me how horrible normal people can act.

</comment></comment></comment><comment><USER5> "I'll just drag a business through the mud on the internet using my real name on a service designed to efficiently track my activity - what could possibly go wrong?"

<comment><USER6> That doesn't making doxxing and general harassment appropriate in my opinion.</comment></comment>


Atwood forks Markdown  - <AUTHOR> http://blog.stackoverflow.com/2009/12/introducing-markdownsharp/

<comment><USER2> No he hasn't. He's improved an existing implementation of Markdown, and caused it to be open sourced.</comment>


Should Quadrotors All Look Like This? - <AUTHOR> http://spectrum.ieee.org/automaton/robotics/aerial-robots/iros-2013-should-quadrotors-all-look-like-this#.UoRAb7LvVFs.hackernews <comment><USER3> Wow, readers, please do yourselves a favor and watch the linked video in that article! [[https://www.youtube.com/watch?v=p8t41avFuCc](https://www.youtube.com/watch?v=p8t41avFuCc)] though it's slightly WTf-y, it's definitely cool. I'm just wondering - <USER2> heli's better at carrying my Canon DSLR or would the triquad work better for this?? Anyone with experience, please suggest, as I am SO gonna build this tri quad (and integrate it with my Raspberry Pi) :D

<comment><USER4> A heli carrying a DSLR is big, expensive, hard to fly, dangerous and maintenance intensive. It's good for lifting a DSLR but I would go with a multicopter, the more blades the better. A hexacopter or even an octocopter are very stable, easier to fly, possibly cheaper to build and have a fail- safe, if a motor fails you can land it safely because the other motors take over. You can find a nice video about the subject here:

[http://flitetest.com/articles/T_Rex_800E_DSLR_Camera_Gimbal](http://flitetest.com/articles/T_Rex_800E_DSLR_Camera_Gimbal)

It demo's a Heli carying a DSLR and afterwards (after the first 7 minutes of video) they talk about this compared to multi-rotors. For the best video results you should probably pick the stable octocopter, you can fly FPV as well with a multicopter, great for live previewing your video.

<comment><USER3> Thanks! That's pretty informative! :)

</comment></comment></comment><comment><USER5> Did anyone else watch the linked video of the RC helicopter? It was amazing! I had no idea that those things were so powerful. The only ones I've ever seen are the ones at the mall.

<comment><USER6> Link

[http://www.youtube.com/watch?v=p8t41avFuCc](http://www.youtube.com/watch?v=p8t41avFuCc)

The thought of a weaponized version of that is terrifying. A weaponized and _non-human controlled_ version is straight up Cyberdyne level stuff...

<comment><USER7> Is it possible to scale one of those up to Predator-size? Would the limiting factor be that the power requirements wouldn't scale linearly? Are there properties of the atmosphere that model-scale aircraft can take advantage of that larger-scale ones cannot?

<comment><USER8> Yes. It would be called a helicopter. Full sized ones can have fuel engines, which can carry more energy per weight and can go further. On the other hand, they are heavier and not as durable because of that weight. They cannot change directions like this mid flight.

<comment><USER9> Can you explain why?

Is it to do with the bulk properties of the materials not varying with scale? Or scaling with some power of length < 3?

If you tried to spec a full sized helicopter engine to make speed changes like those in the video would it tear itself apart?

<comment><USER10> Yes.

Mass increases with the cube of scale, while structural material cross-section area increases only with the square of scale. So insects can have miniscule legs, while elephants have tree trunks, proportionally.

<comment><USER11> Right, sometimes called "square-cube law" ([http://en.wikipedia.org/wiki/Square- cube_law](http://en.wikipedia.org/wiki/Square-cube_law)). Worth knowing about so you can explain to yourself the differences noted above.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> How does this perform cross wind compared to a traditional micro quad?

That main rotor will act like an umbrella does in a gust of wind. The micro quads don't suffer the same problem.

I'm not sure of the physics involved (and if anyone knows i'd love to learn more!) but just from hands-on piloting both micro quads and larger helis, the micro quads are some of the least susceptible to cross winds i've ever flown.

<comment> loup-vaillant Accelerometers are bound to detect such adverse effects. Correcting roll and pitch automatically shouldn't be hard. Also, I would guess that the higher the main rotor (compared to the centre of mass), the more susceptible the device. So, if you build the main rotor as close to possible as the centre of mass, you should have a more neutral design.

While we're at it, I've flown a little toy with _two_ main rotors, rotating in opposite directions, controlling power and yaw, while the tail rotor controlled pitch (the whole thing was auto-stable, so there was no need for roll control). It worked like a charm. So, if we're willing to suffer the complexity of an actual swashplate[1], we could try a design with 2 main rotors, one above, and one below, hereby getting a neutral, manoeuvrable, and (hopefully) efficient design.

[1]: [https://en.wikipedia.org/wiki/Swashplate_%28helicopter%29](https://en.wikipedia.org/wiki/Swashplate_%28helicopter%29)

<comment><USER12> AIUI there's all sorts of considerations & trade-offs. E.g. the motors have a limit to how quickly they can change output (up to around 400Hz today).

Because there's no swashplate on the upper rotor of those wee co-axial rotor designs, they're really ineffective in cross wind. You can't apply the required corrective input when the top rotor gets blown off axis.

<comment> loup-vaillant The design I was thinking about puts the lowest rotor below the gravity centre. First, it would lower the highest rotor, and second, crosswind would have the _opposite_ effect on the low rotor. I really expect such a design to be neutral.

</comment></comment></comment></comment><comment><USER13> I always wondered why there are no "real life" sized quadcopters in use for manned flight. From what I understand the design is simpler and requires less maintenance compared to "normal" helicopters.

Are there any reasons why we're not flying quadcopters around instead?

<comment><USER14> Lady Gaga flies with a hexacopter @ [http://www.dailymail.co.uk/sciencetech/article-2499954/How-L...](http://www.dailymail.co.uk/sciencetech/article-2499954/How- Lady-Gagas-flying-dress-works.html)

... what the world is coming to?

<comment><USER15> Morning coffee, this put a big smile on my face.

She (or, probably, her team) has been hacking the entertainment scene for a while.

Dubbing "a dress" what would otherwise be considered a nerd toy is genius. What's not a dress for her?

</comment></comment></comment><comment><USER16> I really like this, because it shows that quadrotor (and flying vessel in general) research is far from "done".

Most people would tell you that you'd be insane to try to design new types of aircraft, because we already know how to do that. This research proves otherwise.

<comment><USER17> One might almost say that anybody knowing basics of Newtonian mechanics would say maximizing your blade swept area reduces power needed to stay aloft. Then there's stuff like tip vortices etc. So just one big rotor is great.

The problem becomes control. With many small rotors you don't need to control blade pitch, as the electric motors have high torque and the blades are light, so you can control with quick engine thrust changes. And it's that what makes the quad rotor system much more attractive than a normal helo. The traditional helicopter pitch control system is complex and requires precise high stress components that are well built and maintained.

But it's a very inelegant brute force system in my opinion. The pitch control could be improved a lot as well if you have powerful electromagnetics with very precise control.

You still need a tail rotor though.

The real helicopter is seeing some real progress at the moment as well, all in the name of higher speeds. There's Sikorsky's X2 and AVX's modified Kiowa. They have coaxial main rotors with a pushing tail rotor and two pushing fans respectively. Then there's tilt rotors by Bell and Boeing, IIRC. These were, at least at some point, all part of a US scout helicopter competition. And then there's the Eurocopter X3, with no tail rotor but twin pulling rotors like a twin prop airplane. X2 and X3 have flown.

</comment></comment><comment><USER18> It takes (at least) six months to learn to fly a helicopter (or, in the case of the linked video from the article, probably a lifetime).

It takes ten minutes to learn to fly a quadcopter.

<comment><USER19> No. Try a cheap quadcopter without any auto stabilization. it takes more than 10 minutes. Maybe 8-12 hours of flying time to become proficient enough to, say, risk mounting something breakable (like a camera) onto it.

Less time than a normal helicopter though, so I get your point.

<comment><USER18> I have two quadcopters -- that both have auto stabilization: Parrot AR Drone and DJI Phantom, and it did take around 10 minutes to learn to fly them.

Is it even possible to fly quadcopters without stabilization? Would they not start spinning out of control as soon as they take off?

<comment><USER20> He probably means "stabilized using gyro _and_ accelerometer" (ie, release sticks = evens itself out) as opposed to "just stabilized by gyros" (ie, release sticks, copter stops any rotation but keeps pitched/rolled position).

Sure, learning to hover in one general spot is doable in 10 minutes. I wouldn't call that "learning to fly".

What about very basic maneuvers like landings (no bouncing around, no dropping from too high, and at the spot where you wanted to land) or circles/eights, dealing with ambiguous orientations when your copter is high enough (~ 6m ?), nose-in flying / dealing with control reversal and recovering from orientation loss?

</comment></comment></comment></comment><comment><USER21> "The researchers explained that the standard "control" quadrotor had an optimized design, while the triquad was not optimized at all (because its design was constrained to keep it as similar as possible to the control quadrotor). This gave the control aircraft an advantage in power of about 9 percent."

I wonder what the optimized "triquad" would have looked like?

</comment><comment><USER22> Is there a video of this thing in action? I didn't see a link in the article (skimmed it quickly though)

<comment><USER23> I can't find one, but these links may help:

Dr Paul Pounds, the project leader:

[http://www.itee.uq.edu.au/bme/pounds](http://www.itee.uq.edu.au/bme/pounds)

[http://www.eng.yale.edu/pep5/](http://www.eng.yale.edu/pep5/)

Scott Driessens, his student:

[http://www.youtube.com/user/sdriessens](http://www.youtube.com/user/sdriessens)

</comment></comment><comment><USER24> What software should I use to verify their claims? aerodynamics simulators or how they are called?

</comment><comment><USER25> This is really cool, and probably a better solution than quadcopters for many applications. However, what we would _ideally_ want in the end, would be a tilt-rotor of some sort which incorporates wings. Fixed wings are a lot more efficient than active lift, and is necessary if you want to squeeze more speed and range out of your UAV.

<comment><USER26> So, like, a remote-controlled Osprey?

</comment></comment><comment><USER27> I for one welcome our new...

</comment><comment><USER28> That's kinda stupid garage-scienticism to be honest.

\- TFA does not mention the stability issue. Guess why people and drones fly tri, quads, etc and not regular helis. Yeah. (a simplification: stand on one leg. Now stand on 2, and use your 2 hands as well. 4 legs. Stable heh?)

\- Yes single large prop is more efficient than many tiny props. But put many large props and the difference isn't so big. Let's take a $1000 ultra efficient quad: www.youtube.com/watch?v=t0SR5bzuFq4 yeah thats 100min of flight time for something smaller than the Align Trex of the video. And it's cheaper too.. The trex flies 5 to 10minutes (6S 5000mah). At equivalent batteries, the trex flies 25min (hint: the trex is not made for efficiency, it's made for 3D). An average camera-less quad flies 10 to 15min (3S 3000mah).

\- TFA compares a $5000 Align Trex 700 with a bunch of expensive upgrades - the top of the top - with one very good pilot with decades of training... to a $200 toy.

\- $200 toys made of wood and plastic flown by random people are actually pretty good at acro. Why? Because being more stable they're much easier to fly. Ex: [http://www.youtube.com/watch?v=qzu5eSZqKpY](http://www.youtube.com/watch?v=qzu5eSZqKpY) [http://www.youtube.com/watch?v=8QP0QjIsTTM](http://www.youtube.com/watch?v=8QP0QjIsTTM)

So yeah. Not exactly impressed when that's coming from a university. I expected much better.

<comment><USER29> \- Taking cheap shots about their measures of efficiency is hypocritical. TFA says that the researchers did investigate the efficiency and calculated a 25% gain. Presumably their calculations will be in their research paper. You on the other hand have just given a YouTube video and battery capacities as your 'proof'. Heck, the researchers went as far as constructing a device to test their efficiency claims.

\- The stability might be an issue for completely manual flight (but then, people fly ordinary helicopters just fine...) but with computer-assisted balancing, the problem can be much reduced. Even existing quad copters often have computer-aided stability.

<comment><USER28> I investigated and I say this is wrong. No backup either. = The point.

Now then again, I actually fly every of these so I pretty much know what the efficiency is.

YES they gain 25% efficiency with the tricopter that has a huge prop in the middle, I TRUST that. But the test is meaningless:

If you change the 3 props instead and put big props, with corresponding motors. Guess what. Efficiency is probably higher than the 25% difference. I actually design my own. In fact, I also design my own control boards (the software that is)

Quadcopters use accelerometers, barometers, gyroscopes and magnetometers (and GPS) to ensure stability. Guess what. Measurement from these devices isn't 0ms. Actuating the motor control isn't 0ms.

On regular 1 rotor head heli it isn't either. In fact, it's longer.

Result? it's more stable with 4 props than one prop. It has more inherent stability., even if it wasn't "computer assisted". Timecop did a fully gyro stabilized quad copter recently that shows exactly that, if any "actual proof" was needed. Gyro stabilized can be made with no computer whatsoever (like helicopters are/used to be - that's why they're very, very hard to pilot, real ones and RC ones).</comment></comment></comment>


Show HN: Quickly open and close the applications you use every day - <AUTHOR> https://github.com/JonathanWThom/opener <comment><AUTHOR> Hi there, I'm the author of this. This is obviously still a very young project. It works pretty well for my purposes, but I would love some help developing it into something more robust. I'm especially interested in help from more experienced gophers; I write Ruby/JS for work so have not had as much exposure to idiomatic Go.</comment>


A Kitchen That Cooks by Itself - <AUTHOR> http://www.wired.com/2015/11/innit-future-kitchen/ <comment><USER2> For the practical version of this type of technology that you can order today and can actually be sitting under your Christmas tree in a few weeks, take a look at [https://www.pantelligent.com/](https://www.pantelligent.com/) (full disclosure: I'm an engineer at Pantelligent).

The reason you're seeing lots and lots of new entrants in the "smart cooking" space is because engineers are trying it and _the results are really really delicious_. When you can use sensors to accurately cook the exterior of foods to the right properties, and use thermodynamics to accurately cook the interior to the right properties, it brings restaurant-quality food to the hands of a novice chef.

<comment><USER3> Seems awesome!

But how can it possibly work if it only has a surface temperature sensor and no way to know either internal temperature or both the weight of the food and area of the food-pan contact surface of the food? (or even better, a full 3D model of the food)

I mean, an extremely thin but large steak will likely need a different cooking time that a more "spherical" steak (even if they weight the same).

Otherwise it seems an amazing product.

<comment><USER2> Great question! The app asks you for thickness, so you say "I'm cooking a 1-inch thick ribeye steak", and the rest is pretty much math :) (And a lot of trial runs in our test kitchen to get everything working perfectly!)

The steak software also asks you for desired doneness. Then it adjusts the cooking time on-the-fly based on the real data coming back from the pan, so it knows that if the temperature is X degrees too low, it's going to extend the time a little bit to compensate. But that's all done behind-the-scenes in software.

<comment><USER4> I made a big response to someone else's comment. I just don't believe that final food temperature is function of temperature where the food touches the pan. However, where your product might shine is where water content determines one very, very important aspect of a finished product, the sear or crispiness.

Let's take the mushroom for example. If the pan's surface temperature is too low or their are too many mushrooms in the pan the water comes out of the mushroom and prevents it from being caramelized and browned. Yes, there is a lot more than just the negligible about of sugar in a mushroom when it browns and I would have been more accurate to use an onion to describe this but I'm sticking with the mushroom. What is caramelization? It is cooked sugars. Caramelization starts at 320 degrees F so if the pan doesn't get past 212 degrees F because water is being released from the mushroom.

There are two ways to brown a mushroom. One, start with very, very high heat, brown the mushroom's surface, then lower the heat so the inside cooks. Or, second, use low heat, let the mushroom release all its water, then after the water evaporates raise the heat. This is the same for caramelized onions. One way is to use high heat which even leaves the inside of the onion crispy[1], and the other is to use low heat for a long time until the water is evaporated[2]. Also, most recipes for ground beef in pasta sauce say to brown the meat on med-high before the moisture comes out, however, adding water initially, and then cook it until the water evaporates before browning it is a valid approach also.

I'm not sure the usefulness of this app in determining the proper final temperature. Plus, anyone can stick a $7 thermometer into a piece of meat. However, many people and professional chefs make the mistake of putting way too much food into a pan. Your app might be a ton more useful warning cooks that their pan is below or above the proper cooking heat. Sea scollaps are the worst for this. There is a huge difference between cooking 4 u-10s or 8 in the pan at the same time because the water being released cools down the cooking surface temp to the point that they are boiled instead of pan fried. However, with sea scallops raising the heat to the pan or changing the cooking duration isn't a solution. The solution is have the right amount of scallops, in a right sized pan, at the right cooking temp.

I think this app can be much more useful in helping cooks learn to maintain the proper surface temp of a pan for wilting spinach, cooking mushrooms, making fried rice, searing scallops, ect. than telling when the food is done. Perhaps, telling when food is done can easily be done with a cheap thermometer but using the right surface temperature is the hard part of cooking.

[1]: [http://www.lemonythyme.com/wp- content/uploads/2012/07/Carame...](http://www.lemonythyme.com/wp- content/uploads/2012/07/Caramelized-Onion31.jpg)

[2]: [https://corkandspoon.files.wordpress.com/2012/05/crock- pot-c...](https://corkandspoon.files.wordpress.com/2012/05/crock-pot- caramelized-onions-6-hours-and-done.jpg)

</comment></comment></comment></comment><comment><USER5> Food automation, like a lot of home automation, seems a questionable concept. You could buy a lot of ready meals (which are just food that's been prepared offsite in bulk) for the cost of a smart kitchen.

Low-hassle domestic stock control / inventory maangement though, that would be genuinely useful.

<comment><USER6>
       You could buy a lot of ready meals (which are just food that's been prepared offsite in bulk)

You can't buy a really good meal this way though, for love or money.

So, to the degree that technology can help average people do more in the kitchen it could be genuinely useful. I have no opinion on how likely the tech in the article is to actually do that.

</comment></comment><comment><USER7> They should try to combine this with Chef Watson, that would probably make some interesting results.

</comment><comment><USER8> Has anyone had success with slow-cooking? I've heard people say they can cook meat at low temps for 8 hours and it tastes better than usual.

<comment><USER9> Yes, it's amazing. Better than usual is an understatement. There are 3 main points to get right before you throw everything in the slow cooker.

1\. The liquid must be delicious (ie. not water) and almost covering or just barely covering your meat. It must also fill the crock pot at least half way. Think tomato sauce or stock.

2\. The meat must be browned well before throwing it in the slow cooker. Fry the outside edges at high temp first.

3\. Using well used muscles results in far better flavour -- rump, blade roast, flank, shank, and chicken thighs. Fat (but not toooo much) is your friend. It will dissolve over time and add flavour.

*. If you throw in a parmesan rind all your dreams will come true.

<comment><USER10> That's why I haven't won the lottery! I haven't been putting parmesan rinds in my slow cooker!

Slow cookers on top of being tasty are also super convenient. You don't really have to pay attention to it and it's a large batch so you can store it in the fridge and eat it through the week.

</comment></comment></comment><comment><USER11> Has anyone tried any automated vegetable/meat choppers they've liked? Chopping is my least favourite part of cooking.

</comment><comment><USER12> Yeah, I can't wait for food automation where I can get things sliced -> mixed -> cooked automatically.</comment>


Nintendo Fans Are Growing Up, But Nintendo Isn't - <AUTHOR> http://www.vice.com/en_uk/read/nintendo-fans-are-growing-up-but-nintendo-isnt-and-it-could-cost-them-234 <comment><USER2> Splatoon was a really successful new IP by Nintendo. I know my little cousins rave about it. They also love Pokemon just as much as I did in 1999. Which is hilarious because everyone was __certain __it was just a weird fad ala beanie babies. But nope, Nintendo knew how to roll with the inertia and the franchise is bigger than ever. I think Nintendo is doing just fine. They 're definitely a conservative company but they know what they're doing.

They've been in the gaming industry since the 19th Century.

</comment><comment><USER3> As a parent who has the old nintendo gamer nostalgia, let me just say that I'm quite happy that I can buy my son Mario Kart for the 3DS and not have to deal with him asking what a "faggot" is.

Yes, Nintendo dragged their feet with online play and hasn't been as adventurous as they could be, but I'm quite happy about how they've kept focus on the fun and made an effort to keep the horrifying sides of gamer culture out of their games.

<comment><USER4> This. I loved Nintendo back in the day but even as a current gamer, I find the fact that Nintendo stays focused on games just being "fun and beautiful" provides an escapism mechanism that is difficult to find on other platforms. I enjoy gaming on other platforms, but I find that doing so on a Nintendo system generally has a better effect on my mood/etc.

</comment></comment><comment><USER5> I can't comment on the marketing situation, but as a parent I'm very glad there is a platform that is focused on fun and playability rather than graphics performance.

I hope they are around for a very long time.

</comment><comment><USER6> I'm glad Nintendo still exists. It allows me to buy games for my kids. If all we had was Xbox and Playstation, the main source of kid friendly games would be on mobile.

Yes I know Skylanders and Disney Infinity are huge, but I don't want to pay more in plastic toys than I do for games and hardware.

<comment><USER3> The plastic toys were really just a way to sell DLC in toy stores since children don't have credit-cards.

</comment></comment><comment><USER7> Nintendo's is really the only platform worth buying anymore. Unless you want to play Boodbourne. Other than that, a PC'll do fine.

</comment><comment><USER8> I think the smartest thing Nintendo could do would be to release all the old games for IOS and Android...

For the majority of people who don't want to invest more than a few minutes in a game before it becomes fun, 2D side-scrollers are a fantastic approach to game design.

<comment><USER9> They'd have to do something like gate the games behind purchase of a phone- compatible game controller.

2D side-scrollers are great pick-up-and-play short-term experiences, but they are absolutely terrible to play on a touchscreen. Try the Sonic the Hedgehog demo and see if you can stand it.

</comment></comment><comment><USER10> the last thing anyone should do, especially nintendo is take advice from a writer of Vice.</comment>


Chrome for a Cause: Automating New Windows - <AUTHOR>

This is a really easy trick to increment your new tab count. Just paste this JavaScript into a new HTML file, disable Chrome's popup filter, and open the file in Chrome!
<comment>----
var newTab = function () {

    var newWindow = window.open('http://www.google.com', 'newWindow');

    newWindow.close(); // Closes window immediately
 };
var tabInterval = window.setInterval(newTab, 1000); </comment><comment><USER2> Sweet. I just uploaded a file so people can use this trick:

<http://fwdint.com/media/chrometabs/></comment>


Tesla's New York Gigafactory Kicks Off Solar Roof Production - <AUTHOR> https://www.bloomberg.com/news/articles/2018-01-09/tesla-powers-up-new-york-gigafactory-solar-roof-assembly-line <comment><USER2> I'm not a big fan of Elon Musk, but let's not get political.

I do however, want to point out Buffalo .. its troubles with Solar City .. and its troubles with Elon Musk.

Key (non-disputed / non-political points)

\- Tesla did not hire local workers, and did not hold up on its end for diversity of work-force \- SolarCity received 750$ million in the Billion to Buffalo at a time it hadn't operated at a profit in over 2 years (I believe) \- Ciminelli, Buffalo's prior largest construction company that built SolarCity was charged with bid rigging / bribery by the Federal Government and it has all but folded up shop. \- Panasonic / Tesla agreement / partnership existed in 2006, yet Cuomo said he brokered this deal (fabrication)

The Riverbend site that SolarCity started has all but been successful in Erie County. That's my 2c, and the above is factual, non-disputed points.

So .. my real question, is why is this not brought to the national level for discussion to what Elon is doing to communities like Buffalo, where I live? That's my question ...

<comment><USER3> > So .. my real question, is why is this not brought to the national level for > discussion to what Elon is doing to communities like Buffalo, where I live? > That's my question ...

Because Buffalo isn't a place that attracts much attention about anything outside of lake-effect snow and how terrible the Buffalo Bills are.

These silver-bullet projects that promise to bring large number of high-paying jobs rarely pan out. Remember when Yahoo put in that data center in Lockport (just outside of Buffalo for everyone not familiar with the area)? It was touted as a big win...as of two years ago they have a whopping 98 employees (most making less than 6 figures according to Glassdoor.)

[https://www.bizjournals.com/buffalo/blog/science-and- technol...](https://www.bizjournals.com/buffalo/blog/science-and- technology/2016/02/yahoo-job-count-pacing-well-in-lockport-as.html)

(I was born in Buffalo and lived there for 35 years before moving south.)

<comment><USER4> > These silver-bullet projects that promise to bring large number of high- > paying jobs rarely pan out. Remember when Yahoo put in that data center in > Lockport (just outside of Buffalo for everyone not familiar with the area)? > It was touted as a big win...as of two years ago they have a whopping 98 > employees (most making less than 6 figures according to Glassdoor.)

Meanwhile, Wisconsin is bending over backward to give somewhere near $4Billion to foxconn to build a new manufacturing facility in Wisconsin, and everytime someone asks if they should spend that much, they get "10,000 JOBS" shouted at them.. (even then, that seems like way too much per job, at $300,000 in direct state subsidy per employee, if they get to 10,000, but its an impressive sounding number). then they have local subsidies, promised freeway widening, etc..

<comment><USER5> Wait, Wisconsin wants to "give" $4Billion to foxconn? Is that in cash or tax breaks, in which case, are isn't Foxconn really just keeping their money?

<comment><USER6> Tax breaks are pretty much the same as cash-over-time, come on.

<comment><USER5> No, you come on. You are not giving me the money in my bank account just because you say I don't have to give it to you.

<comment><USER6> Dude I'm as libertarian as they come; taxation is theft. But you're doing stupid things with semantics here. The company has more money to operate with; we're just talking about this from a business-operation point of view.

<comment><USER7> I'm curious, as a libertarian, how do you come to the conclusion that private property, which is a political construct, is a good thing, while taxation, which is also a political construct, established by the same set of laws, is a bad thing (If judging by your description of one being "theft" of the other) ?

<comment><USER6> I think that private property can be easily derived from individual rights. The right to control my own life, the right to do what I want, the right not to be interfered with. Those set a pretty strong precedent for private property. If I create something out of nothing, shouldn't I be able to keep that?

I could be down with taxation if someone actually offered me a contract to join the USA with all the provisions. But they didn't, they just implicitly assumed it, without my consent.

<comment><USER8> Why would I care about individual rights if there is no government ?

I mean if I have enough power and there's no one to stop me, I may as well take your property AND your person and make you work for me.

It's just a matter of who has the most guns, and my willingness to cheat on the rules of the game.(you assume individual rights, I don't)

Do note this is more of a tongue in cheek question, than a serious one.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I really love the work that Tesla is doing in this area, and wish them all the luck in the world, but if the estimates in the article are even close ($57K for a Tesla roof, $41K for a tile roof with a small solar panel, $22K for a conventional asphalt roof) it's hard for me to see this being cost effective.

<comment><USER10> It's like any sort of tech: the first version is too expensive and then the price drops some % every year until we all have "supercomputers" in our pockets.

Plain Solar Panel (non roof) installation has gone from $52k to $20k in the last decade [1] which is craziness.

The other aspect of this is longevity. Setting all solar power generation aspects aside an asphalt roof will generally last 20-25 years. Tesla roof tiles appear to last much longer (infinite warranty, etc.) and are maybe more comparable to a slate roof which would be 10x the cost of an asphalt roof.

As a reference point, I grew up in a house built in the 1920s and just confirmed via Google Streetview that it still has it's original slate roof.

1 - [https://news.energysage.com/solar-panel-efficiency-cost- over...](https://news.energysage.com/solar-panel-efficiency-cost-over-time/)

<comment><USER11> 20-25 years is at the limit of what I could imagine staying in one house with any certainty. How does the extra longevity justify the cost unless I plan to never ever move again?

<comment><USER10> It goes to the home's value (aka you'd get more when you sell it). I kind of think of it like brick. Brick has a much longer maintenance cycle than vinyl or wood siding.

<comment><USER12> The is true in theory, but in practice the housing market isn't 100% efficient.

You'll no doubt recoup some of your value, but not all of it.

<comment><USER13> Part of our bubble is that at times it's been "more than 100% efficient", so to speak.

Witness dozens of TV shows, "You guys had $50K for your reno budget. Your original value was $250K, and you spent $50K and now your house is worth $350K!"

<comment><USER14> Your example doesn't show excessive value capture for the upgrades in the home. Rather, for the extra 50k in bank loaned money, the buyer is choosing not to engage in renovation for reasons typically related to: inconvenience, time restrictions, lack of vision, etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Every time Tesla talks about a "gigafactory" like this one, or the one in Reno, I'm reminded of the episode of The Simpsons, where a snake oil salesman comes to town and sells Springfield on the idea of building a monorail.

It's a factory. Yes, a big factory. But not bigger than a hundred that came before it. And even if it was, it doesn't warrant a new word.

<comment><USER16> So what? It's a clever and catchy name. Giga sounds ambitious and is also a common prefix when talking about energy.

Did you know that everyone who buys a Tesla is not, in fact, purchasing a dead Serbian-American guy?

<comment><USER15> In five years it's going to sound as dated and stupid as all the "cyber" branded things from the 90's.

</comment></comment></comment><comment><USER17> I like the idea of a solar roof, but the incentives just don't work out where I live. We have lots of sun, so I could plausibly produce quite a bit of excess power... but my electric company won't buy it from me. The most they'll do is let me offset my own consumption.

So my upside is capped at getting free electricity, which'll save me $100-150 a month. That's not nothing, but it'll take a LONG time to recoup the cost.

<comment><USER18> That's when you start using your excess power to mine crypto and get $0.50/kWh instead of the $0.03/kWh that your utility would give you.

<comment><USER17> That's... crazy talk. I like it.

</comment></comment></comment><comment><USER19> Okay, the tiles are made of glass. Does the carbon footprint of the fabrication different much from terracotta tiles?

</comment><comment><USER20> Looking forward to them being available in the UK, if I had't just re-roofed my house with recycled slates I'd have used these, I didn't use the option from Solar Century because they look terrible compared with the glass slates from Tesla: [https://www.solarcentury.com/homes-uk/our- offer/sunstation/](https://www.solarcentury.com/homes-uk/our- offer/sunstation/) \-- however I do have a lot of respect for the founder of the company [http://www.energylivenews.com/2015/01/12/solarcentury- founde...](http://www.energylivenews.com/2015/01/12/solarcentury-founder- steps-down/)

</comment><comment><USER21> OT: Is there a reliable Firefox to block these annoying Bloomberg auto-play videos?

<comment><USER22> Mine don't play in FF. I think you can disable this via: media.autoplay.enabled

type about:config in url and set value to false

<comment><USER21> Thanks, that worked, although YouTube affected, too. Well, better than unexpected auto-play.

<comment><USER21> Update: Does also not-auto-play gifs/gifv on imgur, thus it's not really a solution.

</comment></comment></comment></comment><comment><USER23> Why do they call them all a "gigafactory"? This is getting ridiculous since the subject "gigafactory" in the article is a million square feet and 500 employees.

<comment><USER24> > The name Gigafactory comes from the word "Giga," the unit of measurement > representing "billions." The factory's planned annual battery production > capacity is 35 gigawatt-hours (GWh), with one GWh being the equivalent of > generating (or consuming) 1 billion watts for one hour. This is nearly as > much as the entire world's current battery production combined.

via [https://www.tesla.com/gigafactory](https://www.tesla.com/gigafactory)

Doesn't explain why they call Buffalo's operation a "Gigafactory," but that's the origin of the name for the more well-known Nevada-based Gigafactory.

<comment><USER25> I wonder what their expected total produced solar capacity will be. I feel like it could be over a gigawatt, in line with the battery gigafactory.

</comment></comment></comment><comment><USER2> The postmortem comment to this thread, is kind of buried in the distressed communities report posted today from The Atlantic.

Page 35, pretty much sums it all up.

[http://eig.org/wp-content/uploads/2017/09/2017-Distressed- Co...](http://eig.org/wp-content/uploads/2017/09/2017-Distressed-Communities- Index.pdf)

</comment><comment><USER26> Just over two years ago solar panels were prohibitively expensive for me. I read a couple of Instructables showing how to make your own panel using solar cells. I ordered the solar cells. The plan was to cover the whole garage roof with solar cells.

The price of solar panels dropped. Now I have a box full of solar cells and it just isn't worth it to go the DIY route. The Solar Roof is out of my price range.

<comment><USER27> Frustrating to see prices change, but it sounds like you were up for doing the work at the old price, so it could be a learning opportunity...

Alternatively, you might be able to sell the cells (at a loss) to recoup some funds and still end up with solar power for cheaper than you were originally intending to pay!

<comment><USER26> Thanks for the encouraging response. I will use the solar cells as a learning opportunity. I am thinking that they will be a good way to teach kids the basics of solar power.

</comment></comment></comment><comment><USER28> ...Solar shingles will cost more than a conventional roof along with photovoltaic panels -- but not "wickedly so," said Hugh Bromley, a New York- based Bloomberg New Energy Finance analyst. He estimates a Tesla roof would cost about $57,000 for a 2,000-square-foot house

From where I sit that is wickedly more expensive. I had a new composite roof installed 2 years ago for $2,900

<comment><USER29> You need to add in 2000 sq ft of solar panels, mounted. As well.

</comment></comment><comment><USER30> Why not put the solar panels on the cars themselves?

Makes them charge somewhat when parked on the street or in an open parking lot :)

<comment><USER31> The area is way too small to generate any feasible amount. If I remember correctly you'd only be able to charge 15 miles per day in ideal conditions.

<comment><USER30> What about solar panels on the roof of a 30 foot RV?

To power computer microwave and water heater only.

<comment><USER32> Then you really don't want to ignore any maximum height signs.</comment></comment></comment></comment>


Instant.io: End to end browser based web torrent - <AUTHOR> http://instant.io

<comment><AUTHOR> A more explanatory tweet (if that isn't an oxymoron) from the author: [https://twitter.com/feross/status/510443904152653824](https://twitter.com/feross/status/510443904152653824)

</comment><comment><USER2> Some support for mobile use would be handy.</comment>


NPM lockfiles can be a security blindspot for injecting malicious modules in PRs - <AUTHOR> https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/ <comment><USER2> Note that with Rust's cargo, replacing a registry source with a source from github isn't possible without also changing the Cargo.toml. Cargo always consults both .toml and .lock files, and only uses the .lock file to the extent where it's consistent with the .toml. If it notices any inconsistencies, e.g. .lock pointing to github but .toml pointing to crates.io, its behaviour depends on the parameters passed. If you pass --locked or --frozen, it gives an error. If you don't pass any parameters, it tries to fix the issue by itself. It can't use the information from the .lock file to get the precise version, and thus just uses the latest version that's still consistent with the version requirement in the .toml file.

I don't think that cargo's decision to always consult the .toml was actually motivated with security in mind. Instead I think cargo's authors just wanted to avoid the hassle for developers of having to constantly invoke commands to update the .lock file (is this what "convention over configuration" means?). So I think this is an instance where a choice done for better ergonomics actually ended up improving security as well.

Note though that even with current cargo, any PR that claims to do a simple cargo update could very well not be such a PR. It could e.g. include an "update" to a yanked and possibly vulnerable/backdoored version. One malicious upload, even if yanked, could be milked for a long time. See repi's comment in this thread for a solution: [https://news.ycombinator.com/item?id=21887445](https://news.ycombinator.com/item?id=21887445)

</comment><comment><USER3> Added a verification step to prevent this in Rust code with our cargo-deny tool. [https://github.com/EmbarkStudios/cargo- deny/pull/80](https://github.com/EmbarkStudios/cargo-deny/pull/80)

We run this in GitHub Actions for all of our Rust repos, primarily to prevent banned or duplicate dependencies and approved licenses. But also works for verifying the sources of crates to prevent this specific issue now

</comment><comment><USER4> Wait, you're supposed to commit those? Genuinely curious.

I always set up an ignore rule for them and use package.json's dependency list instead. My projects are all on the small side though; is the idea to commit the .lock file and avoid breakage through things like minor version updates of your first level dependencies? Wouldn't that carry a bigger security risk for large numbers of packages that then aren't receiving patch updates as readily?

<comment><USER5> Without the package lock file, your build is not repeatable. In two years (or more likely, two weeks) someone new will check out your code, it will be broken out of the box, and the poor sod will have no idea why. More than likely they will blame you.

<comment><USER6> May be I'm missing something, but why dependency resolution cannot be deterministic? If you always choose a version specified in the config, or a highest version if few different versions of the same dependency are defined through some of intermediaries, you'd always end with the same set. AFAIK it's the strategy in Gradle for JVM projects, and a similar deterministic strategy is used by Maven.

<comment><USER7> NPM resolution is not deterministic because package dependencies may be specified using SemVer, e.g. "~1.0.0" which may result in pulling 1.0.0, 1.0.1, 1.0.2, and so on - anything that matches 1.0.x specifier.

The NPM ecosystem commonly uses these types of specifiers. Even if your own dependencies are all specified in "package.json" using exact versions, they almost certainly depend themselves on other versions (dependencies of dependencies, and so on) using the semver specifiers. That means whenever an author of that package publishes themselves, your resolved dependencies may change.

The package-lock.json is simply a record of the exact dependency resolution graph based on the registry state that existed at the moment you generated it, so that you can reliably reproduce that graph a month or a year later. Otherwise it's very common for NPM-based projects to have "NPM install" fail later on (or succeed, but create a bug or unit test failure) because some new version was added to the registry and created a compatibility issue or bug.

</comment></comment></comment></comment><comment><USER8> While the title of the page says "NPM lockfiles", the article actually talks about yarn lockfiles. In essence though, it applies to all lockfiles. An easy step for many organizations (especially with github actions) is to have it verified.

<comment><USER9> Better yet don't accept third party contributions to lockfiles... I don't know any reason I would approve an external PR that modifies the lockfile.

<comment><USER10> Perhaps you're misunderstanding what this article about.

The author is making a pr that updates the package.json, which also means the lockfile is updated.

If you don't accept any PR that touches the package.json file, then that means you're not accepting a PR that introduces any new dependency, tries to update a dependency for security reasons, or uses a feature available in a newer version of the dependency.

All of those reasons seem like valid reasons to accept a lockfile change -- that the author of the PR changed the package.json file for any of those reasons.

<comment><USER11> But since the lockfile can be generated from the package.json, I still don't see a reason that the lockfile needs to be committed by a third-party contributor instead of being generated automatically post-merge, or by the repository maintainers during the course of normal development.

<comment><USER12> If you use the lockfile like that then there is little point in having a lockfile. The lockfile specifies the exact versions of the whole dependency tree, and their hashes, at a given point in time. If you don't commit it then everyone will have different versions of the dependencies.

<comment><USER11> I see your point, but if a dependency package needs exact versions for its dependencies, I'd expect it to be specified in its package.json as well. If not, then I don't see why exact dependencies for the entire tree are needed.

Sure, if a package absolutely needs exact dependencies for its entire tree, it can check in the lock file, but I've not found this necessary in practice provided I use dependencies I trust , that follow semantic versioning.

<comment><USER13> > Sure, if a _package_ absolutely needs exact dependencies for its entire tree

Not sure you're talking about the same thing as everyone else.

There's a big difference if you're maintaining a package vs maintaining an app.

If you're a "package" maintainer, you don't want to pin dependencies. Because the package consumer (i.e. people building apps using your package) should not have their exact versions dictated to them.

If you're an "app" maintainer, you absolutely need to check in your lockfile, because you should care about repeatable builds.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> It certainly doesn't help that the NPM's and Yarn's lockfiles are hard to read. Compared them to Gemfile.lock which bundler generates.

NPM's package-lock.json [https://github.com/search?q=filename%3Apackage- lock.json&typ...](https://github.com/search?q=filename%3Apackage- lock.json&type=Code)

Yarn's yarn.lock [https://github.com/search?q=filename%3AGemfile.lock&type=Cod...](https://github.com/search?q=filename%3AGemfile.lock&type=Code)

Bundler's Gemfile.lock [https://github.com/search?q=filename%3AGemfile.lock&type=Cod...](https://github.com/search?q=filename%3AGemfile.lock&type=Code)

</comment><comment><USER15> Generate the lockfile (and any generated files) on a trusted machine instead. Generate it and merge it from a ci server.

<comment><USER13> But a lockfile is not like "any generated file", because for typical generated artifacts they should always be generated the same, for the same commit.

This is not true for a lockfile, where the whole point is to capture the specific versions at the point in time that the generation is done.

The benefit of the contributor committing the lockfile is that it encodes the exact combo of dependencies that worked at the time the related code changes were made (in the same PR).

This means other project maintainers aren't left scratching their heads trying to figure out why a PR worked on your machine but fails in CI.

<comment><USER15> Code smells if a change works with one lockfile but not another generated around the same time. The utility of a lockfile increases with the age of the file.

We expect lockfiles to change when we update it add dependencies. If a pull request cannot build with a lockfile generated when it is merged then that change should not be merged.

<comment><USER13> > Code smells if a change works with one lockfile but not another generated > around the same time.

This isn't true at all. You can't predict when a new, potentially breaking, version of a dependency might get published. It could happen a second after you generate your lockfile, or create your PR.

At time of PR creation we could have versions 1, 2, 3 and 4 of our transitive dependencies.

At time of merge we could have versions 1.1, 2.2, 3.3 and 4.x available.

Dependencies are outside of your control, so always "smell", that's why it's crazy to do anything other than pin the heck out of them.

</comment></comment></comment></comment><comment><USER16> To me this looks extremely frightening. Sure, you can create good routines etc to prevent this, but that's not really enough. As a user of any module you can't trust every package to have good routines. In any basic project there are tens and hundreds ++ dependencies, and we all know that some of them will be vounerable for this exploit. We need a MECHANISM that prevents this, routines and good practices are not enough

</comment><comment><USER17> There is something really weird and complex with the way dependency management works out in JS that I can't quite put my finger on, but seems to make things especially intractable somehow. While other platforms have pretty similar dependency management tools... I think that the ruby `Gemfile.lock` for instance would usually have much smaller and human-readable diffs for an analogous change.

</comment><comment><USER18> Instead of changing the module's URL to e.g. a private evil GitHub repository, how about registering a new package within the official npm registry, using homoglyphs/similar-looking characters.

For diff viewers that are highlighting entire lines for changed content, the difference in the package name wouldn't be spotted in reviews when also changing the version or some other part of the URL.

Or am I missing something?

<comment><USER19> At least when I review code, if I see a line changed that doesn't need to be, I leave a comment asking why and hold off on approving the code for merge until I figure out what's going on. This is more due to not having changes people made by mistake merged in rather than a strategy for dealing with malicious submitters, though.

<comment><USER9> Curious, would you ever approve a third party change to a lockfile? I maintain a very large OSS project and I don't know any reason I would accept a PR that changes the lockfile.

<comment><USER20> Would you accept a PR that changes the package.json file to add a new dependency?

<comment><USER9> Not likely, we try to minimize dependancies as much as possible. If a new feature were to absolutely necessitate a new dependency, it probably wouldn't be open for third party contributions in the first place (not least of all because maintenance of the dep now falls onto us if ever upstream falters).

</comment></comment></comment></comment></comment><comment><USER21> It looks like only validate the domain isn't enough.

NPM does not care about whether the package name in the tarball match to the name in lock or not.

So you can just point to tarball path to another package that has the similar name. and nobody with ever notice that.

And domain whitelist won't work in this situaltion either.

<comment><USER22> Does it care about casing? I doubt it does...so I could for example point ABCmagical to ABCmagicaI. (The last letter in the latter being an uppercase i) You would have to update the package too, or something else to red herring the colorized diff.

</comment></comment><comment><USER23> The irony of this article is that it recommends you to use npx.

</comment><comment><USER24> Great work, very creative vector!

On the other hand, looks like a big missed opportunity from snyk.io! Feels like they could have taken the extra step and time to come up with a counter to this in their product, and use that post as both a way to showcase their product and the discovery.

</comment><comment><USER25> In general I wonder about the ability to receive a root kit from any number of sources, sharing software projects is a major concern. What is best practice here? Only work inside a VM?

</comment><comment><USER26> Why would the lock file contain the url?

<comment><USER27> Different modules can come from different hosts. Whether that's a good idea is debatable.

<comment><USER28> so why isn't the host for the dependency specified in the package.json instead?

I think NPM is poorly designed. These lessons have all been learnt in the past by the maven ecosystem, and yet, it is repeated again in the javascript npm ecosystem.

<comment><USER29> Maven sidesteps the issue by not even having lockfiles and leaving everyone who checks out a repo free to have different versions of subdependencies, so I'm not sure it's a very stellar example.

<comment><USER28> only if you use snapshot dependencies (or your dependencies use that).

Maven pins down the version for you if you followed the "best pactise", or you can override sub-dependencies' versions if you should so choose (via dependencyManagement), and also lets you control the actual repo to download from as well. And as a bonus, you get to share the binary across different projects if they are on the same machine.

</comment></comment></comment></comment></comment><comment><USER30> Why does the article recommend requiring https, if the packages have sha512 integrity checks?</comment>


Google I/O 2011: Keynote Video - <AUTHOR> http://www.youtube.com/watch?v=uoHcfyoHaJc&feature=channel_video_title

<comment><USER2> private video</comment>