Ask HN: Which password manager do you recommend? - <AUTHOR> I've been putting off the move to a password manager for far too long now, instead using a base password with a pseudo hash function on the domain name that I evaluate in my head and which determines certain characters in the password. (This means someone would need at least 3 or 4 password leaks for different sites to figure out the hash function, or a hash collision). With today's LastPass news, I'm interested in what password manager you recommend.<p>I'm particularly interested in ones that work on Linux, and I want to be able to use my YubiKey to secure it (I have a Neo, and two U2F ones on the way from the GitHub special). Obviously, they should also be well-maintained. <comment><USER2> I've been using LastPass for a few years, even convincing $work to purchase/use the Enterprise version. This was my best option as, like you, my primary machine ran Linux and I wanted 2FA (also using a Yubikey).

With today's announcement, I'm not sure what I'll use going forward. In the past month, I've switched back to using a MacBook Pro as my primary machine (along with my iPad and iPhone). I'm not a big fan of LogMeIn, so I'll certainly be looking for alternatives.

</comment><comment><USER3> I use KeePass Password Safe ( [http://keepass.info/](http://keepass.info/) ) supports the Advanced Encryption Standard (AES, Rijndael) and the Twofish algorithm to encrypt its password databases. And it's free and you have full access to its source code. KeePass will also support YubinKey. Here is a link on setting up a YubiKey with KeePass ([http://keepass.info/help/kb/yubikey.html](http://keepass.info/help/kb/yubikey.html) ).

<comment><AUTHOR> The different versions of keepass have always confused me -- what's the difference between 1 and 2, and why are both around? What's KeePassX, which is linked on the Download page for Linux, and does it support YubiKeys as well? Other than all the confusion that surrounds it, keepass looks quite good to me.

<comment><USER3> This link may help clear up the confusion between KeePass 1 and 2. ([http://keepass.info/compare.html](http://keepass.info/compare.html)). As for the KeePassX, this was a port from the Windows KeePass 2 to mac OS X. But has now become its own program. I do not know if YubiKeys will work with it.

</comment></comment></comment><comment><USER4> I've recently started using enpass ([http://enpass.io/](http://enpass.io/)). It does what I need, and is simple enough for others to use. Their security model is based on open source even though the entire app is not open.

</comment><comment><USER5> [http://passwordmaker.org/](http://passwordmaker.org/) automates what you're doing in your head. On android the PasswordMaker X app is pretty reasonable too. On iOS the apps are not so good.</comment>


Why the future for work is NOT work from home - <AUTHOR> https://medium.com/@prahaladm/why-the-future-for-work-is-not-work-from-home-a3e6ea35018b <comment><USER2> This sounds more to me like, "I haven't figured out remote work yet."

It isn't for everyone. Maybe the author is someone for whom it just won't work. That's fine. It also isn't for every stage of a product - at the founding stages, remote is tough. But once you are established, it gets easier.

In any case, this article is a great anecdote of someone for whom it did not work, but I'd hardly jump from there to saying it cannot work for others.

<comment><USER3> I doubt many companies will stick to it. I'd venture an estimate that less than half of the population will be happy or successful in remote work. One factor is that significant portion is extrovert and will have psych issues if isolated for too long. At the other end you have people drinking while working, you can find tips about how to do this without getting caught.

Most companies and people have not figured it out and never will. We are social beings and there is no tech that can get around that

<comment><USER2> I've heard that take on it before. I question it, to be honest. Introvert/extrovert is more a spectrum than a binary value. Sure, the people on the far end of the extrovert side will struggle if they are isolated. But that isn't 50% of the population. And once the pandemic is over, they won't be isolated.

I believe people are conflating remote work during lockdown with a post- pandemic, healthier remote lifestyle. This pandemic will end at some point, even if longer from now than we would like. And at that point, people can freely walk away from their desk, see friends and family, go out for lunch, go out after work, etc.

When people talk about the future of work, I take it to mean where we are headed over the coming years and decades, not next month.

<comment><USER3> Yes, I am talking long term, our species is not designed for isolation. I don't think we (USA) will have a serious conversation about what lockdown has done to people's mental health until after the election. Too much money and power at stake to distract the public with real issues</comment></comment></comment></comment>


Ask HN: What could be the reason Amazon Chime did not pick? - <AUTHOR> As you know a lot of workforce is working from home these days. What could be the reason, despite having such a strong brand name behind, why Amazon Chime did not pick as compared with MS Teams, Zoom, and Slack? One of the reasons could be - Chime is not a well-marketed product. <comment><USER2> I was at a conference AWS put on at the Javits center where they were hyped about a product called Zocallo. The audience was conspicuously indifferent.

I think AWS was hoping for a c-suite audience but the people who came were technical people who like AWS the way it is. Many of the tech track sessions were full, so I went to the more business oriented sessions, which were pretty good.

I guess in theory AWS could sell the kind of services that Salesforce does, but they haven't connected.</comment>


Russian Government Cyber Activity Targeting Energy and Other Critical Sectors - <AUTHOR> https://www.us-cert.gov/ncas/alerts/TA18-074A <comment><USER2> Neocon Cyber BS :|</comment>


Real growth - <AUTHOR> http://paweljaniak.co.za/2013/11/13/real-growth/?utm_source=hn&utm_medium=link&utm_campaign=real_growth

<comment><USER2> I need a Saul Goodman to help me promote my game!</comment>


Facebook for Android and Why Zuckerberg now owns your ass - <AUTHOR> http://dannybrown.me/2014/04/04/facebook-for-android-and-why-zuckerberg-now-owns-your-ass <comment><USER3> Android needs to fix the way the permission system works. As it stands now, all permissions are asked upfront at installation time where the user has no data available to make an informed decision.

Also, the fact that apps only auto-update when the permissions required don't change produces all the incentive for app developers to just ask for everything. After all, most conscious users will find something they object to at install time anyways and thus might not install and most people don't read the dialog anyways, so not much to lose.

But even when android changes to ask for permissions as they are required (which could be done in a backwards compatible way by not throwing exceptions but just pretending that whatever API call you just made has succeeded, but then doing mothing or returning meaningless/no data), this still would not help with a malicious app asking nicely with a legitimate reason ("let me access your SMS to read the login token") and then using that permission for illegitimate uses ("let me upload all your SMS to my server").

Even with all these permissions, it still boils down to trust and where on the desktop world, this trust was rarely abused, in the mobile world between all the built-in adware and social integrations, that trust is badly hurt.

<comment><USER4> Auto-updating without asking if the user is okay with the new permissions? How should this work?

<comment><USER5> Ask Apple. They seem to have solved this problem quite a while ago.

The iOS implementation allows rejection of individual permissions, doesnt prevent install, and allows the developer the freedom to choose the best possible time to ask. See [https://medium.com/p/96fa4eb54f2c](https://medium.com/p/96fa4eb54f2c)

<comment><USER4> Well, you're right, but Apple's model is fundamentally different. I don't think Android will switch to such a model in the (near) future. That would mean a lot of things have to be changed, and hundreds of thousands of apps would break. So we can safely assume Android will stay with its current system. Thus there is only one possibility left: improve the current system. Rejection of individual permissions would definitely the most powerful improvement, while still being easy to implement.

</comment></comment></comment></comment><comment><USER6> > What honest and useful reason can Facebook have to get access to my texts? > Seemingly they're running with the "It will help us target better" message.

A Facebook engineer explained this permission on Reddit when the story first broke. They are using SMS access to speed up two-factor authentication. (They send an SMS to your phone, and then read it automatically.)

Full explanation here: [http://www.reddit.com/r/WTF/comments/1t5z45/facebook_why_the...](http://www.reddit.com/r/WTF/comments/1t5z45/facebook_why_the_hell_do_you_think_its_okay_to/ce4y6x2)

Should this information comfort you? It depends on if you trust Facebook.

<comment> Stealth- ALOT of apps are starting to do this. I believe Snapchat initially was the company that began doing it. When a site like Facebook uses your number to identify you, this feature actually makes sense.

I wonder if more fine-grained permissions would make more sense for this sort of feature. Perhaps it would be better if Android had support for "This app may read text messages from 1-800-XXX-XXXX" or something similar instead.

<comment><USER7> I use XPrivacy ([https://play.google.com/store/apps/details?id=biz.bokhorst.x...](https://play.google.com/store/apps/details?id=biz.bokhorst.xprivacy.installer)).

With it, I have extremely fine-grained access control to a wide variety of "system calls", including access to contacts, text messages and to the device phone number.

In this case, I can permit access temporarily during the 2FA, and then return garbage values the rest of the time. Easy. (Though obviously if they harvest my text messages for other purposes during 2FA, that is a problem - but one can that can be technically solved within XPrivacy imo.)

In other cases, such as running Skype, I deny access to everything always (phone number, my location, contacts, Google accounts are the things Skype makes system calls for) and Skype continue to works fine, so I think this is a viable strategy.

<comment><USER8> since first being introduced to XPrivacy, I absolutely can not use an android phone without it. It really opened my eyes to how invasive some apps are when running in the background or just inappropriately accessing info in general (especially location information!)

</comment></comment></comment></comment><comment><USER9> I mean, the permissions do have reasonable explanations - using your contact list to 'find friends'\- for instance, or writing to your call log because they're integrating VoIP calling (I assume). The wording is just a generic Android permission explanation and comes with any app which requests that permission. If you really can't cope with it, there are apps like Tinfoil which allow you to still use facebook without that added functionality and permission requirement.

A good improvement for Android would be the ability to only request permission when it's required for some key permissions (the way iOS does with contacts (I think)). Enable SMS integration in messages? Android pops up a thing saying 'Facebook wants to be able to read your SMS and MMS messages. Cool?'. UAC for Android.

<comment><USER10> You can block such permissions in CyanogenMod based roms via their 'Privacy Guard' feature. And I am sure there are other solutions but most likely would require a rooted device.

I think such functionality as you described should be included into Android as standard allowing the user to grant permissions to confidential information.

<comment><USER11> Privacy Guard is too limited. It's better than nothing, but doesn't block enough intrusive requests. Try XPrivacy instead.

</comment></comment></comment><comment><USER12> This article is an excellent case study of what happens when engineers communicate through lawyers and a coarse-grained permissions system.

The engineer at Facebook wants to be able to send the phone a message so as to authenticate the validity of a phone number. She writes an Android app to do this. To get the text messages, she has to request the READ_SMS permission, so she does.

Meanwhile, the lawyers at Facebook are paid to protect the company from unnecessary liability. They decide to write a ToS that says they can do anything; that way, if they do something you don't like, you can't sue them, thus protecting the company from liability.

Later, some other engineer comes along and puts these two pieces of information together. READ_SMS!? They can do anything they want!? They _must_ be up to something shady!

Turns out: nope! Just a miscommunication.

The real innovation in our field that I hope to see in the next few years is the right balance among the following concerns:

* Ease of use, even among non-technical users.

* Security from malicious applications / extensions / apps / etc.

* The service provider's desire to not be sued.

* The user's desire to not have his privacy violated.

If you give everything fine-grained permissions, you'll have to be a software engineer to understand how to use the application. If you don't have any permissions, every Flappy Bird clone will subscribe you to paid SMS services. If the service provider claims to be liable for privacy breaches that they didn't intend, then they'll have to prove, in court, at great cost, that they're not to blame, every time any of their billion users complains. If the service provider claims to be able to do anything, the user will assume that they're reading all of his email to pick stocks and get some good info for stealing his girlfriend.

So it's clear that the extremes don't work. What we need to find is what does work. This write-up shows how one non-extreme balance doesn't work. Let's find another one and try again!

<comment><USER13> > If you give everything fine-grained permissions, you'll have to be a > software engineer to understand how to use the application

No, that fine grained permission can be intelligent & automated to protect the non-tech user. That's where Android needs to innovate. Going forward with giving blanket permissions to anything being the only way to install an app is a bad idea, even if it's a reputed company like Facebook. I don't want 10 different apps accessing my SMS just to enable easy 2FA. I also don't trust many reputed companies into doing what's best for my privacy & security.

</comment></comment><comment><USER14> He doesn't own my ass, I don't have a Facebook/Instagram/whatsapp/(whatever Facebook owns or will own) account and never will. I'll never need to, just as people never needed to 10 years ago, Nor will I ever have any oculus rift thingy on my head. So there, he doesn't own my ass! And when Facebook starts buying people's asses for 10 billion bucks, I still won't sell mine :)

Edit: and if one day Facebook owns the internet, then I'll buy a farm, grow veggies and get off the "grid". I'll become a "nature growth hacker" ( remember you saw it here first!).

<comment><USER15> Ever heard of Dark Profiles? Sorry to say this but Facebook does own your ass. [http://tech.firstpost.com/news-analysis/facebook- developed-s...](http://tech.firstpost.com/news-analysis/facebook-developed- stalker-dark-profiles-says-ex-employee-in-new-book-29560.html)

<comment><USER13> No, creating dark profiles does not mean it'll suck data out of your device. It just means it'll gather existing data from web/pics etc.

<comment><USER15> And from your friends address book, SMS/chat/whatsapp...

</comment></comment></comment></comment><comment><USER16> Indeed. Facebook has a repeated pattern of going too far infringing people's privacy and then apologizing [1], so why would anybody trust them not to abuse the permissions once they've been granted?

I just got a new Android phone and it was an easy decision not to install the Facebook app.

[1] [http://allthingsd.com/20111129/the-apologies-of- zuckerberg-a...](http://allthingsd.com/20111129/the-apologies-of-zuckerberg-a- retrospective/)

<comment><USER13> Their classic 'break things fast' mode. Keep infringing on user's privacy until they shout.

</comment></comment><comment><USER17> There is a very simple solution: Don't use facebook. It sucks anyway. There is absolutely no need for you to own an account.

// Normal 20-something year old

<comment><USER18> For me, Facebook doesn't "suck". It helps me stay in touch with friends on other continents in a more user-friendly and convenient way than email/phone calls/letters. It makes it easier to organize events/get togethers with friends nearby because it allows n-to-n communication unlike SMS/phone calls and virtually everyone has it. I pay a price with my privacy but so far I'm fine with the tradeoff.

<comment><USER19> _I pay a price with my privacy but so far I 'm fine with the tradeoff_

Some people aren't alright with the tradeoff. I manage to stay in touch with family and friends without using it, but they happen to use it extensively. I suppose the "it sucks" opinion is just as polarising as the "I have no privacy but it's fine". Looks like the argument will never be settled!

I can imagine attempting to send letters to friends in other continents would be slow, but a nice touch if you received a letter.

<comment><USER18> Absolutely agree with you. It is most certainly possible to not use Facebook (and I commend you on doing so successfully). But stating "Facebook sucks" as fact, as opposed to opinion, is just wrong in my opinion (and it looks like you would agree).

And yes, sending letters is fun. Guess I'm just too lazy/used to the convenience of the internet.

</comment></comment></comment></comment><comment><USER20> This is a great reason why the iOS permissions model is miles better. It's not perfect, but it's a far more logical and friendly approach than the all-or- nothing approach that Android uses.

I hate the Android model. On my Android devices, I've declined many installs that I have happily made on my iOS devices because of overzealous permission requests made by the Android version. Being able to grant those permissions as needed and revoke them without removing the app entirely is awesome and why Google has avoided implementing it in Android to date is beyond me.

<comment><USER21> Say what ? holy war between of iOS vs Android ? irrelevant!

Smartphones are a huge privacy liability whether apple, google or other. facebook is another mega huge privacy liability.

Why google avoided implementing sane privacy control in android is obviously because google is even more of a über huge liability privacy.

Google basically has a head start of a decade and a reach not even facebook or apple can dream of.

Apple makes money by selling overpriced hardware, google makes money by collecting data about you and selling ads, facebook is a website where people give away their privacy who's happy to exist on devices built by apple and google and has no proven business model (robbing advertisers of money only works for so long says history).

</comment></comment><comment><USER22> If I recall correctly, the SMS permission is so that the app can read the code that facebook sends to your phone to confirm that you own the number that you're trying to link to your facebook account. Another app that I know of that does this is TextSecure, to register your number with their servers, but then again that's a text messaging app, so I'd expect it to be reading my text messages.

</comment><comment><USER23> I feel it is worth mentioning that if any app scrapes SMS messages they could also scrape messages sent that don't just contain personal information, but which also contain personal financial information (i.e. bank statements or transaction notifications). Many jurisdictions have harsh punishments for accessing / storing financial information (with requirements on where the information is stored, for how long, regulatory approvals, etc) far in excess of punishments for violating 'normal' personal information privacy laws.

I'm sure Facebook are aware of this. All app developers should be too.

</comment><comment><USER24> Here's facebooks response as to why the android app requires what it does. [https://www.facebook.com/help/210676372433246](https://www.facebook.com/help/210676372433246)

I think this article is sensationalist garbage with no proof of facebook mistreating user data.

<comment><USER13> Proof? What do you want them to say. Right in bold red that we WILL read all your SMS & sell that data to advertisers.

Will I agree that the article is sensationalizing, but if history is any indication, Facebook can & will use all this data against your wishes.

<comment><USER25> >Facebook can & will use all this data against your wishes

Facebook is limited to what its privacy policy and TOU allow. If Facebook goes beyond that, the FTC, state attorneys general, and a bevy of bottom-feeding class action lawyers will sue (and win).

Anyone who doesn't understand this -- this is directed at the author of the blog post that started this thread, not the parent post -- has no business writing about privacy.

<comment><USER13> > Facebook is limited to what its privacy policy and TOU allow

That's an utopian interpretation of how corporations work. Most of them have a motto : "It's easier to ask forgiveness than it is to get permission"

Proof : A lot of genuine lawsuits...

<comment><USER25> >Proof : A lot of genuine lawsuits...

Not quite. The "genuine lawsuits you mention are proof only that (a) bottom- feeding lawyers file meritless lawsuits in hopes of a fat $$$ settlement, or (b) that sometimes even well-intentioned companies make mistakes and do things beyond what their privacy policy and TOU permit.

</comment></comment></comment></comment></comment><comment><USER26> FB's mobile web interface has worked fine for me. No app, nor permission- granting, required.

<comment><USER27> And if you want to sync contacts, you can always use HaxSync.

[https://play.google.com/store/apps/details?id=org.mots.haxsy...](https://play.google.com/store/apps/details?id=org.mots.haxsync)

<comment><USER11> Or back them up normally with Titanium Backup. If you have Google Contacts Sync installed, you'll need to freeze or uninstall it first to make local contacts though.

</comment></comment></comment><comment><USER28> Does FB require similar permissions on iOS?

Also, the permissions they ask for seem like FB is angling to figure out a way to play a bigger role in your life and not just restricted to advertising such as sending out a text or placing calls to most frequently dialed numbers when they figure out that you've been in an accident.

But is seems more likely that the US govt. to do any of the following if they make new laws that are an iterated version of the FISA, etc. laws that give them unrestricted access without any need for disclosure:

> Someone is lost, kidnapped, in an accident, law enforcement can figure out > ways to subpoena this information.

> Send fake texts or calls on your behalf and then use that as grounds to > detain / question / imprison you.

> Data mine text information to figure out if a revolution is happening in a > dissident country and perpetuate this by sending texts to a wider network > (similar to starting a local twitter clone in Cuba). If this is a friendly > country, you can warn your allies and have these people held as political > prisoners in countries such as Saudi Arabia, etc.

> Lots of other scary scenarios.

<comment><USER22> Permissions on iOS are usually asked as the app needs them, whereas on Android, all permissions needed by the app have to be granted before the app is installed/updated.

</comment></comment><comment><USER11> This is exactly why I would never install facebook's app (or any other such bloatware crap that does nothing the website can't). Access SMS, camera and location? Fuck no. Android also deserves part of the blame though for not having a way to allow/deny permissions and prevent apps from running as background service when they don't need to.

</comment><comment><USER29> I often go to install an app but then abort when it asks for what I consider to be overreaching permissions for what the app is. I'm sure the majority of the apps need the permissions for a valid reason that isn't nefarious, however, the end result should be the user's decision. This all or nothing approach is maddening and ridiculous. Simply allow the end user to selectively accept and deny permissions and require app developers to handle the cases when the permission they are asking for are denied. I would feel much better and buy/install a lot more apps.

</comment><comment><USER30> One could say that required permissions there are just for reading the SMS confirmation codes and easing that friction, in which situation they're actually enabler of better security of your account.

<comment><USER31> Another one could say that it ultimately boils down to your trust in Facebook. Do you trust enough Facebook to give them a full access to your SMS? I don't.

</comment></comment><comment><USER32> It's important to note that this is not just a Facebook problem - <USER2> Facebook may have the largest install base of affected applications.

Many applications on Google Play ask for excessive rights - I always presumed this was being pushed by mobile advertising services.

I think it's an important issue for Android, as most users are unaware of or careless with these things, and it's just one high profile (perceived) abuse example away from seriously damaging Android's reputation as a platform.

</comment><comment><USER33> Anybody using Tinfoil for Facebook, s wrapper over the mobile FB website? It allows greater privacy and you never have to worry about your SMS or pictures.

</comment><comment><USER34> > _But check out the exact wording of the SMS /MMS Permission, and that of the > Contacts one._

It's impossible to word it in any different way, no matter what you want to do with messages - even if your code is written to read message from one specific number and not even do anything with it the permission text will stay the same. This is text that was set by google.

> _What honest and useful reason can Facebook have to get access to my texts?_

If the author googled it he would would have noticed official facebook page that explains the permission used. It's used _only_ to confirm your phone number - if you want to.

> _Yet as I say time and time again, this has to be opt-in_

Android permissions don't allow opt-in, or opt-out for that matter.

> _All it wants are numbers, pure and simple, and the data that comes with > these numbers to sell to the highest bidder._

Use something equivalent of privacy settings in CM, I think they're using the AppsOps (sp?) and you'll see that non of the data was even accessed let alone sold to highest bidder.

_____

This article is unresearched, paranoid, bullshit.

</comment><comment><USER35> I'd like to see optional permissions. I'd like to be able to deny facebook the ability to read my SMS. I would happily do 2-step authentication manually if it meant that they couldn't read my texts. I don't have a lot of experience developing with android but this seems like smaller change than other suggestions, like granular permissions.

</comment><comment><USER36> I have App Ops on my phone and Facebook app installed for a while. It says Facebook app read contacts recently. But it 'never used' other sensitive permissions, like read messages, call log etc. I agree that Facebook app probably should inform us why it actually needs these permissions.

</comment><comment><USER37> I don't use facebook :D

</comment><comment><USER4> Android just needs App Ops back -- all privacy issues solved. But it seems this won't happen. Pressure from Facebook etc.?

</comment><comment><USER38> In 20 years are our children's children going to ask us old people what privacy was when they see it in a book somewhere?

Sometimes I wonder what we're leaving the next generation. I'd love to change it if anyone has some realistic ideas.

</comment><comment><USER39> If only there was an easy way not to have a Facebook account. Oh wait.

EDIT: Why exactly am I getting downvoted?

<comment><USER40> > _Why exactly am I getting downvoted?_

Well, you're probably irritating people who like Facebook by implying that Facebook's actions are so bad that not having a Facebook account is a good idea. And you're probably irritating people who dislike Facebook by implying that their actions are justified because it's possible to opt out by not having a Facebook account.

In all seriousness, here at HN we're generally looking for posts that contribute to the discussion. Your post simply bashes Facebook and/or Facebook users without saying anything that isn't trite and hateful.

<comment><USER19> He said that you don't have to have a Facebook account.

I wouldn't call that hateful. That's just a fact. And it would solve the problem.</comment></comment></comment>


And Then There Was One: Red Hat - <AUTHOR> http://ostatic.com/blog/and-then-there-was-one-red-hat

<comment><USER2> _...Novell and Sun were both once-mighty commercial open source-focused companies..._

Rewrites history. Novell and Sun were both long past their brightest days when they embraced open source. In fact they embraced open source in desperate efforts to remain relevant in a world that had passed them by.

<comment><USER3> Right! Novell was already hemorrhaging cash before they bought SUSE, and Linux was replacing Solaris before Sun gave away the family jewels. Neither one of those companies were known for their open-source contributions before Red Hat started eating their lunch.

</comment></comment><comment><USER4> The big difference, I see, between Red Hat and Sun and Novell is Red Hat is younger as a company and has less emotional baggage. They have to compete which makes them less complacent than Sun or Novell.

I see the future of open source as a service and support industry. It's working for Red Hat also companies like Wordpress.

<comment><USER5> Sun was a hardware company. When hardware became a commodity their unique architectures could not find buyers, and there was not enough margin in x86 to sustain the company.

Novell sold proprietary LAN software, and their market evaporated when Windows starting having networking built-in, while at the same time Linux made open networking standards available at no cost (for the software, at least).

<comment><USER6> Exactly. Of the three, Red Hat was the only one that was formed around open source, and the only one whose open source business model wasn't born in the desperation of a previous, successful closed source business model collapsing.

<comment><USER4> Sun and Novell were in the process of a pivot whereby they would have set their business model around open source. They just didn't do it well enough.

<comment><USER6> Has anyone successfully made that particular pivot?

<comment><USER3> IBM, to some degree. They launched Global Services long before it was fashionable. Louis Gerstner explains in _Who Says Elephants Can't Dance?_ that there was tremendous doubt in the 1990's that consulting was the way to go, but he realized early on that the world "didn't need another hard drive maker" and decided that IBM could provide value best by acting as the integrator of smaller companies' components.

</comment></comment></comment></comment></comment></comment><comment><USER7> The other view of this is that it's the point at which OSS hit the mainstream and was adopted as part of the business model of major for profit corporations as part of their offerings.

Realistically the world wasn't going to divide neatly into OSS and closed software, but merge as companies picked the best model for each sector, product and market.

</comment><comment><USER8> I'd hardly count Novell and Sun as 'every US open source company'...

<comment><USER9> The article only considers public companies. Are they missing some?

<comment><USER6> Quite the opposite. Considering Sun and Novell to be "open source companies" obscures the fact that both of them had the bulk of their successes with their closed source products, and only came to a business model related to open source reluctantly. Red Hat is an outlier in that regard, and I suspect it is the main reason that they are still around.

</comment></comment></comment><comment><USER10> Wait... what about Ubuntu? <http://en.wikipedia.org/wiki/Ubuntu_(operating_system)>

<comment><USER11> You mean Canonical? Well, the article was about public US companies. Canonical is neither, it's private, and it's registered in the UK.

<comment><USER12> > [..] registered in the UK.

Actually, it's registered in the Isle of Man, which is a self-governing island that is not technically part of the UK.

<comment><USER11> My mistake, I didn't know that. I looked for the information on where they are registered on their legal page <http://www.canonical.com/legal>, and it simply states 'United Kingdom'. Anyway, the point stands - they're not a US company.</comment></comment></comment></comment>


China Proposes to Keep Online Payments in Check - <AUTHOR> http://www.wsj.com/articles/china-proposes-to-keep-online-payments-in-check-1438593958 <comment><AUTHOR> Relevant since this policy is in effect by tomorrow, see

[https://www.reddit.com/r/Bitcoin/comments/4qkzhp/china_centr...](https://www.reddit.com/r/Bitcoin/comments/4qkzhp/china_central_bank_new_fee_policy_for_online/d4tvnay)

(also click on 'web' to google the WSJ article first to bypass stupid paywall)

and

[https://twitter.com/cnLedger/status/748445824137342976](https://twitter.com/cnLedger/status/748445824137342976)</comment>


Building Fast Interpreters in Rust - <AUTHOR> https://blog.cloudflare.com/building-fast-interpreters-in-rust/ <comment><USER2> It should be noted that this implementation has been in production since last Summer and is powering the Firewall Rules ( [https://blog.cloudflare.com/how- we-made-firewall-rules/](https://blog.cloudflare.com/how-we-made-firewall- rules/) ) engine today.

This was one of the first major components to use Rust at our edge and we've been really happy with it.

The flexibility this approach (to matching traffic) has given us... whilst we also get the speed, memory safety... is just great. The speed at which we're iterating on the firewall and other systems that use this is a joy to behold. A lot of that speed derives from the confidence in this component.

We're also really pleased that whilst we have several proposals for optimisations, none have yet needed to be prioritised as the performance is great.

<comment><USER3> > . The speed at which we're iterating on the firewall and other systems that > use this is a joy to behold.

How much of this do you attribute directly to Rust versus other factors like seniority of engineering talent, clear communicated requirements, organizational empowerment, etc? If you swapped out Rust for C, what would be the impact on velocity? Is it a 1-4x multiplier, or larger?

<comment><USER2> Engineering resource is finite, the less time spent on working on the engine the more time we can spend working on new features and other systems.

Before making this in Rust we experimented with a Go and also a Lua implementation as we investigated the approach. The Rust code took the same time to initially produce and was production ready very early and has been rock solid and required virtually no maintenance since it was put into production.

That frees up that engineer to work on other things, whilst also reducing ongoing maintenance that was anticipated and so those engineers are also working on other stuff.

I'd attribute a chunk of that to Rust... though it helps if you have great engineers who are familiar with the concepts of parsers, etc working on these things. The same may not be true if someone new to Rust was also new to the concepts needed.

<comment><USER4> What were the differences between the Go and Rust versions that led you to choose the Rust version in the end?

<comment><USER2> Given that I wrote the Go version and RReverser wrote the Rust version, I'm going to go with: A better engineer wrote the Rust version.

But actually I was excited by Rust too. The memory safety, performance (the Rust was faster) and the degree of control over how we could present the FFI to the languages we needed to integrate with, in addition to how readable the Rust was by comparison to the Go code (readable, but so much of it), and then avoiding the GC... the Rust implementation was a convincing winner.

<comment><USER5> In terms of readability, how much is it due to Rust having ADTs and pattern matching over them?

<comment><USER6> You can kind of "fake" ADTs in Go with interface{} and switches, but it isn't all that nice.

Rust on the other hand with first-class ADT and pattern matching makes it a pleasure! You also have all the nice advantages of the compiler checking that all branches have been satisfied which catches a lot of bugs at compile time.

Go has it's place, and works great in those places, but I don't think this is one of them. I'm pleased we chose Rust and this feels like a great use for it!

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This discussion of interpreters dovetails rather nicely with Catherine West (kyren)'s new experimental Lua VM in Rust: [https://www.reddit.com/r/rust/comments/awx9cy/github_kyrenlu...](https://www.reddit.com/r/rust/comments/awx9cy/github_kyrenluster_an_experimental_lua_vm/)

</comment><comment><USER8> In C, a common way to get good performance without JIT is with bytecode and a giant switch statement. It would be interesting to see if that's viable in Rust. How does performance compare to an implementation using closures?

<comment><USER9> A _better_ way to get good performance is to thread your switch statement, which is hard to do explicitly in Rust last time I tried (maybe you could do this if you mark functions as inlinable?).

<comment><USER8> What do you mean by "thread your switch statement"?

<comment><USER10> The "big switch statement" approach is for each bytecode instruction to complete by jumping to a centralized dispatch location (i.e. the switch statement).

The "threaded" approach is for each bytecode instruction to complete by decoding and jumping to the handler for the next instruction.

Basically instead of "break" you have `goto handlers[nextIp->opcode].`

The advantages of threading are fewer jumps and better branch prediction (since branch prediction is tied to IP). The disadvantages are slightly larger code and compilers struggle to optimize it, since the control flow is not structured.

<comment><USER11> This method of design is called a Continuation Passing Style Interpreter. [1]

Here's a production version from OpenJ9's JVM ByteCode Interpreter. [2]

[1] [https://kseo.github.io/posts/2017-01-09-continuation- passing...](https://kseo.github.io/posts/2017-01-09-continuation-passing- style-interpreter.html)

[2] [https://github.com/eclipse/openj9/blob/01be53f659a8190959c16...](https://github.com/eclipse/openj9/blob/01be53f659a8190959c1641eac20b0488739e94c/runtime/vm/BytecodeInterpreter.hpp#L4872)

</comment></comment></comment></comment></comment><comment><USER12> Very nice article. It describes writing an interpreter in Rust for a DSL for Wireshark-like filters.

The source code: [https://github.com/cloudflare/wirefilter](https://github.com/cloudflare/wirefilter)

</comment><comment><USER11> I _highly_ recommend folks to view this talk by the venerable Cliff Click called "Bits of Advice For the VM Writer" [1]

Of particular interest are Continuation Style Passing Interpreters [2] and how much of a speedup you can get by going to raw assembly.

The talk has lessons Cliff learned from his years on the JVM but those can be adapted easily to other runtimes.

[1] [https://youtu.be/Hqw57GJSrac?t=341](https://youtu.be/Hqw57GJSrac?t=341)

[2] [https://kseo.github.io/posts/2017-01-09-continuation- passing...](https://kseo.github.io/posts/2017-01-09-continuation-passing- style-interpreter.html)

<comment><USER13> Rust doesn't use a runtime so how is this relevant?

</comment></comment><comment><USER14> I think C++ does closures a bit better than Rust, particularly when you have lots of Arcs and Rcs. The clone dance gets old fast. However, Rust does _everything else_ so much better, especially Cargo (here's hoping Buckaroo, vcpkg, etc. gain adoption).

<comment><USER15> I'm not very familiar with C++ closures, but I agree with rust closures having room for improvement for a different reason. Lack of fine grained control over copy/move.

        let settings = thing_it_wants_to_take_by_reference;
        let channel = thing_it_needs_to_take_ownership_of;

        let closure_that_takes_everything_by_reference =
            || { some_code(settings, channel) };

        let closure_that_takes_everything_by_move =
            move || { some_code(settings, channel) };

        let closure_that_does_what_I_want = {
           let ref_settings = &settings;
           move || { some_code(ref_settings, channel) }
        };

        let closure_with_hypothetical_syntax =
            || [move channel] { some_code(settings, channel) };

<comment><USER16> This was a fairly explicit design decision, because these cases come up so rarely. It's our opinion that it's not common enough to be worth increasing the complexity of the language.

You don't even need it in this case; this will compile, for example:

      fn main() {
          let settings = String::new();
          let channel = String::new();

          let closure_with_hypothetical_syntax =
              || { some_code(&settings, channel) };
      }

      fn some_code(settings: &String, channel: String) {

      }

The only difference is the & on settings in the closure. This moves channel but not settings.

<comment><USER15> Wait... hmm... now I'm going to have to track down some code where I did this trick and figure out why or if I was just being stupid.

<comment><USER16> It's cool! In general, the default is "rust tries to capture each thing the way it needs to be" and you can use move to override that. Sometimes, you _do_ have to do what you wrote, at least in theory. I've never actually had to.

<comment><USER17> If your closures need to be 'static, it's common in my experience to need to use `move`, and thus to need to clone types like Rc<T>. It depends on whether you're dealing with Fn, FnMut or FnOnce, too.

</comment></comment></comment></comment></comment></comment><comment><USER18> I am surprised ebpf wasn't mentioned. it's made for exactly that and you get bonus features like lite weight JIT and safety given that it supports a strict subset of asm commands that are deemed safe.

The arguments against JIT aren't backed by any prototypes or proofs. it felt like the author has a bias towards dynamic dispatch and walked backwards towards it.

There is no mention how frequently these filters change nor the possible perf advantage that you'd get from running compiled expressions that would compensate for the accumulated compile time of these filters over time.

Often you need 2 approaches together and you switch from interpretation to JIT after a condition. (in db case after the same query shows up multiple times for example). In their case it can be something as simple as if filter hasn't updated in x time then consider it stable and compile it.

On the other hand, PGs dynamic dispatch is a fun read just like any other code in PGs repo.

[https://github.com/postgres/postgres/blob/master/src/backend...](https://github.com/postgres/postgres/blob/master/src/backend/executor/execExprInterp.c)

<comment><USER2> In the other blog post (linked from the top of this blog post) I wrote about the motivation for using the Wireshark-like syntax and how we also have a few customers with a lot of rules (tens of thousands and greater).

That said, it seems obvious to us that now we have a Rust library that can parse a Wireshark-like syntax into an AST... that we don't have to just perform the matching in Rust. i.e. that we can ask the library to produce translations of the expression as SQL (for our ClickHouse), GraphQL (for our analytics API), or even eBPF.

We can't run everything in eBPF, but we could check the list of the fields within an expression to see whether it could be run in eBPF, and then look at heavy hitter rules and promote the ones doing the most work inside L7 to be eBPF and to run in XDP.

Even if we don't do this for customer configured rules, this might be something we do for handling denial of service attacks using the same Wireshark-like expression syntax throughout our system.

<comment><USER18> Got it. Just to clarify, I didn't mean to implement the filters using ebpf inside the kernel but rather use ebpf's engine as a lib at the application layer.

</comment></comment></comment><comment><USER19> Instead of a JIT being the next step, did you consider vectorizing the execution?

Amortizing the cost of dispatch over multiple packets means that under heavy load, the performance of the system should be fairly close to what you could JIT, but the system would be much more simple.

Of course, this only helps with the worst case where a backlog is starting to build, but it at least reduces the worst case.

<comment><USER20> This is not executed on packets (like it would be in Wireshark), but rather on requests defined in the application layer as a set of properties.

<comment><USER19> Ah, makes sense!

</comment></comment></comment><comment><USER21> I bet a JIT in LuaJIT would have been easy and fast: compile to Lua code in strings, call "eval" (actually load() in Lua, but the name eval is better known).

</comment><comment><USER22> > While (for a good reason) this might sound scary in unsafe languages like C > / C++, in Rust all strings are bounds checked by default.

What's the good reason, if I may ask?

<comment><USER23> I'm guessing because an off-by-one or an extra skip might mean you miss the end of the string and go off into la-la land feeding whatever garbage happens to be in memory to your parser? That would mostly be a C issue (as it has no string abstraction at all).

<comment><USER24> They can use str.at() in C++ to ensure boundary safety

<comment><USER20> Boundary safety is only one of many possible issues. For example, Rust makes it easier to work with arbitrary slices (not copied substrings) while statically verifying ownership of the original string.

<comment><USER24> With static analysis most misuse can also be detected: [https://godbolt.org/z/UE-Mb0](https://godbolt.org/z/UE-Mb0), which provides more flexibility than Rust even with NLL

<comment><USER25> I'm not aware of any evidence that C++ Lifetimes will detect "most misuse". It will detect some common lifetime errors. It will certainly fail to detect other common lifetime errors. [https://robert.ocallahan.org/2018/09/more- realistic-goals-fo...](https://robert.ocallahan.org/2018/09/more-realistic- goals-for-c-lifetimes-10.html)

Since it fails to detect common lifetime errors, it's not surprising it's more "flexible" than Rust NLL, which prevents all lifetime errors.

<comment><USER24> The true negative in the post has been fixed. Rust also doesn't prevent all dangling references as long as you depend on some unsafe third-party library/external library/libc calls and use them in an improper way.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> I wonder, how does this compare to an implementation in bpf. its great to see Rust getting traction in systems / networking world.

</comment><comment><USER27> I am surprised so few interpreters are written in garbage collected languages, which would give the interpreted language a GC for free. The main interpreter loop (or jitted code, for that matter) shouldn't allocate, so there is no inherent cost to the approach. And a tuned, mature GC is likely better than yet another MVP reimplementation.

<comment><USER28> > would give the interpreted language a GC for free

That's great if the language you're using has the same GC semantics as the language you're implementing, and a pretty major problem if it doesn't.

<comment><USER27> Yes, it would.

What languages have materially different GC semantics, other than Python on the cpython vm? (PyPy loses the fast collection at the end of scope for efficiency reasons)

<comment><USER29> Lua's got an annoying case of metatables directing whether a table's key/values are weak references or not (__mode & __gc)

<comment><USER30> Lua also has the nasty case that __gc can throw!</comment></comment></comment></comment></comment>


All your souvenirs are on a crashed HD, what do you do? - <AUTHOR>

A desperate mum's  hard disk loaded with her son's pictures  makes more noise than a faulty motherboard.
It sounds really bad : http://samueladam.net/_uploads/hdsound.ogg
To all HD recovery cracks, it would be nice to have your opinion and your general advices on what to do, where to go with an apparently dead HD to expect a miracle.
The first one who talks about backups will be downmodded. ;) <comment><USER2> <http://en.wikipedia.org/wiki/SpinRite>

</comment><comment><USER3> _The first one who talks about backups will be downmodded._

You're too lazy to solve the problem the obvious way, so you're going to downmod people that remind you to Never Let This Happen Again?

<comment><AUTHOR> The topic is about recovering from a crashed HD, and it was an humorous way to keep the comments focused. Relax, I won't down mod you (it's impossible).

Of course, a backup is the best solution, but it doesn't bring data back to tell someone "You should have ...".</comment></comment>


The Madness of King Musk - <AUTHOR> https://thebaffler.com/latest/musk-silverman <comment><USER2> Is it too paranoid to speculate that there might be an organised anti-Musk campaign afoot? One of the red flags for me was reading an anti-Musk article in the Spectator, a reasonably stuffy, right wing establishment magazine in the UK - my interpretation of it was a wail of fear from long entrenched interests, soon to be disrupted.</comment>


Ask HN: How do you deal with that feeling that you aren't doing enough? - compass-seeker

Often times when I'm not doing contracted work or working on my own startup, I feel like I'm not doing enough to be productive. How do you deal with that feeling?<p>Personally, I found that reading books or learning a new development stack makes me feel like I'm using my time wisely. <comment><AUTHOR> I can relate. I also live a dual work existence.

Contracted/consulting work pays the monthly bills. I am fortunate to currently have one main client that pays well and in a very timely/reliable manner. If careful on the spending side of the equation we can make it with me working about 12 to 16 hours a week.

Secondly, I have built a technology-platform to enable me to deliver premium structured services very efficiently. But now that I have done most of the technology build I am into trying to build the business connections. I have more trouble disciplining myself to do the sales and marketing tasks that this phase requires. And, even when I succeed at disciplining myself there is rarely the immediate feedback that you have been productive. With coding the feedback that says "productive" is almost immediate. At the end of the day I can point to a new feature that I created and tested and rest easy knowing that I have been productive.

With enterprise sales there are so many lags between what I do and the results. And, it is also a number game. Even if I am ultimately successful, I may well have faced 40 or 50 or even 100 rejections before the big break. While in the middle of a string of rejections, it feels more like "foolishness" than "productivity."

I like reading and learning like you mention. But those too can be distractions from what is really needed. Learning is fun and often productive but I find it can keep me from the business building activities that I know I need to engage in.

Back to Work!

<comment> compass-seeker Great reply! Being a developer, I completely understand.

"I may well have faced 40 or 50 or even 100 rejections before the big break. While in the middle of a string of rejections, it feels more like "foolishness" than "productivity."

I think to an extent, most entrepreneurs have to go through this. Don't get discouraged and keep at it :)

<comment><AUTHOR> Thanks for the encouragement. Yes, I read once that Ross Perot went through about 70 rejections when first starting EDS. But prior to that he had been one of the top salespeople at IBM. What if he had given up after 69 rejections and gone back to being an employee? Missed out on a billion or two.</comment></comment></comment>


Standard ML Family GitHub Project - <AUTHOR> http://sml-family.org/ <comment><USER2> Standard ML is my favorite language, bar none. It contains so many ideas that are obviously the Right Thing in retrospect, like parametric polymorphism, algebraic data types, pattern matching, Hindley-Milner type inference, etc. The ideas added by ML's successors, like OCaml and Haskell, seem much more iffy and debatable in comparison.

Maybe the page should also mention Concurrent ML? It's basically the right solution to the problem that Go is fumbling toward.

<comment><USER3> Why is Concurrent ML's solution to concurrency better than Alice ML's ?

<comment><USER2> I don't really know if CML style (rendezvous) is better or worse than Alice ML style (futures). If you have any good references on that, please let me know :-)

It just seems to me that Go went with the former style, but made some mistakes that CML managed to avoid, e.g. Go doesn't garbage-collect a thread that's blocked on a channel whose other end went out of scope.

</comment></comment></comment><comment><USER4> Interestingly enough, SML is taught in the intro class at my school. It's the first programming language I learned.

<comment><USER5> The Programming Languages course on Coursera ([https://www.coursera.org/course/proglang](https://www.coursera.org/course/proglang)) spends about a third of the course on SML before moving on to Racket and Ruby. It might be of interest to others who want a somewhat introductory course which uses ML.

<comment><USER6> Greatly suggest to try sml through this course. I'll never forget it.

</comment></comment></comment><comment><USER7> [https://github.com/SMLFamily/The-Definition-of-Standard- ML-R...](https://github.com/SMLFamily/The-Definition-of-Standard-ML-Revised) in case anyone else is hitting the GoDaddy landing page...

</comment><comment><USER8> The Web Archive gives this for the URL:

[http://web.archive.org/web/20140815065806/http://sml- family....](http://web.archive.org/web/20140815065806/http://sml-family.org/)

and from looking at github, it seems that the most recent intended content of the site can be seen at:

[http://rawgit.com/SMLFamily/SMLFamily.github.io/master/index...](http://rawgit.com/SMLFamily/SMLFamily.github.io/master/index.html)

</comment><comment><USER9> Do people still use ML? It has some historic significance as a programming language but seems completely irrelevant now (although still taught as part of the University of Cambridge CS course).

<comment><USER10> In interactive theorem proving HOL4 ([http://hol.sourceforge.net/](http://hol.sourceforge.net/)) and Isabelle ([http://isabelle.in.tum.de/](http://isabelle.in.tum.de/)) are written in SML and are actively developed.</comment></comment>


Encryption under fire in Europe as France and Germany call for decrypt law - <AUTHOR> https://techcrunch.com/2016/08/24/encryption-under-fire-in-europe-as-france-and-germany-call-for-decrypt-law/ <comment><USER2> > The context here is that France and Germany have suffered a spate of > terrorist attacks over the past year, including a co-ordinated attack in > Paris in November 2015 that killed 130; a July 2016 attack in Nice where a > truck driver ploughed into crowds celebrating Bastille Day; and a stabbing > in a church in Northern France that killed an elderly priest.

To put this in perspective, about 700 people would die from homicide in France in a normal year, and about 600,000 would die of all causes ([http://www.indexmundi.com/g/g.aspx?c=fr&v=26](http://www.indexmundi.com/g/g.aspx?c=fr&v=26)). The unusually high amount of terrorism in the last year, accounts for 0.03% of all deaths.

That terrorism is seen as an urgent problem just highlights the irrationality of decision-making in a democracy. It poses no significant mortality risk to Europeans.

<comment><USER3>
       no significant mortality risk to Europeans.

This is "Whataboutism".

The rational behind being wary about terrorism is as follows.

1\. Normal homicides are random individual actions, and they are under reasonable control by standard policing. In other words, if we continue policing as we do now, normal homicide rate will remain constant.

2\. Terrorism is not random individual action, but rather organised violence by large groups seeking power. If we continue policing as we do now, terrorism will increase, up to a point where the terrorists take over and are the new rulers.

(Compare for example with the reaction to the AIDS epidemics in the early 1980s. The lazy whatabout-ist could have said (and indeed did say): "Oh AIDS just affects a few gays and needle-sharing heroin addicts, whatabout the orders of magnitude more who die of the flu and cancer, no need to worry about AIDS".)

If you believe the two 'axioms' above, then it's perfectly reasonable to adapt policing in the light of the current wave of terrorism that's been spreading in Europe (and not only there).

Note that I'm not saying that encryption should or should not be banned, or that either way is/isn't a good way of fighting terrorism. I'm just pointing out the weakness of the "but whatabout XYZ" argument.

<comment><USER4> > If we continue policing as we do now, terrorism will increase, up to a point > where the terrorists take over and are the new rulers.

I hate to be this guy, but with enough knowledge about our ancestors going far into the past, how do we know similar acts did not take place?? Look at USA alone - they were asian tribes that got wiped by indians with arrows. Indians got wiped by whites with guns.. whoever comes for us now... I say... let it be! We will of course arm to teeth and defend, but if its written somewhere in stars that we are doomed to fail, no amount of policing will change that.

Whatever will happen today, it will happen and those living in year 2,500 would not see it any other way. Just as empires fell before, who says Isis or other ideology will not fail similarly one day?

> Oh AIDS just affects a few gays and needle-sharing heroin addicts

Correct me if I'm wrong but that's still the case today, no?

Unless I have unprotected sex with multitude of partners (stats shows homosexuals tens to spread AIDS more than hetero) and won't inject stuff with borrowed needles, my chances of getting AIDS are still super drastically slim.

I mean sure I can be a virgin and never even smoke a joint, and get affected by riding a subway with infected person who happened to touched a pole with their bloody finger and I happened to touch it after him/her with open wound in a short period of time before the virus dies given there was enough blood to get affected in the first place. But again chances are probably the same as walking in random park in a random European country at a random day and being blown up into peaces by a random person, who happens to randomly stand next to me and turn out to be a terrorist. I sure take my chances.

<comment><USER3>
       how do we know similar acts
       did not take place??

We are pretty sure that many pre-democratic changes of political power did come about in this way. Revolutions and other political power-struggles have been studied very carefully e.g. [1], the Marxist tradition is pretty full of such studies, e.g. [2, 3].

       but that's still the case today, no?

Yes, precisely because of the intense counter-measures taken to prevent AIDS from spreading further. Need-sharing has mostly disappeared, at least in western Europe, because taking Heroin has been effectively decriminalised. Moreover, free Methadon substitution for addicts, and the provision of free needles (and space to shoot up) are all reactions to the AIDS epidemic.

So the fact that "that's still the case today" is a great success of _not_ going whatabout-flu-and-traffic-deaths when AIDS arrived.

[1] E. N. Luttwak, Coup d'Etat: A Practical Handbook.

[2] Võ Nguyên Giáp: People's war, people's army.

[3] S. Alinsky, Rules for Radicals.

</comment></comment></comment></comment><comment><USER5> I don't think that it's possible to ban encryption. I can use gpg to encrypt anything and send it as a text via any channel. I can do anything in my computer.

They could ban encryption for wide audience, that's true. But those who need to hide something, they will have access to encryption.

<comment><USER6> Actually, banning something doesn't mean to make it impossible, but to declare it illegal.

Hypothetically, they (actually, _we_ , as governments are just representative of the voters) _can_ ban encryption. Which means that any communication with no signal naturally emerging from noise is suspicious, thus they/we can ask you to justify yourself and keep you locked until you demonstrate that what you were hiding doesn't represent a threat for the community. And then give you a fine you anyway, so next time you'll think twice before breaking the law.

PS: it's not "you" _you_ , it's "you" in general :-)

<comment><USER7> With steganography [0], you can send encrypted messages embedded in images. Sending normal looking pictures is not suspicious (at least currently, for some definition of normal).

[0] [https://en.wikipedia.org/wiki/Steganography](https://en.wikipedia.org/wiki/Steganography)

<comment><USER6> Yes, you can. But if encryption is illegal, than steganography is illegal, too. Which means that big companies looking for advertisement money will not struggle to offer you an out-of-the-box solution. And this will make a huge difference in itself - I'll let anyone judge whether she considers such a difference good and worth the hassle.

</comment></comment></comment></comment><comment><USER8> Here's a reminder why backdooring or otherwise weakening encryption is a bad idea (PDF): [https://www.schneier.com/academic/paperfiles/paper-keys- unde...](https://www.schneier.com/academic/paperfiles/paper-keys-under- doormats-CSAIL.pdf)

</comment><comment><USER9> I think its a losing battle. Let's say you ban end-to-end encryption. Maybe the next frontier is steganography, where I post some cat-meme on imgur, except one bit of the blue channel in each pixel is encoding my nefarious secret message. Do you ban posting images?

With the number of spam emails that look like the output from bad Markov Chain generators, you could send messages in clear-text, using a simple traditional code, and it would be drowned in the noise.

</comment><comment><USER10> You can't just ban encryption and expect it to magically go away. I don't think a suicide bomber will care too much if his encryption is illegal, while people with good intentions get to suffer the consequences.

Besides, how do they think this will play out with financial transactions? Government websites? Heck, any website that uses https? Stupid idea.

<comment><USER6> > how do they think this will play out with ... ?

It could be done the same as driving or carrying a gun: not banned, but controlled.

You want to use encryption? OK! Just register yourself with the authorities and sign a statement that you will provide the keys if a judge asks. Other than that, you are breaking the law.

</comment></comment><comment><USER11> It is easier to find something to blame then actually taking steps to avoid these attacks.

As far as I remember the Police already had the people behind the attacks on their radar, but they didn't do anything.

Being able to decrypt the messages wont help if they do it after the attacks happened. Like the FBI vs Apple? They knew the guy, they were following him. And did they do anything? Nope.

And what does it matter, if they go through with this? Criminals, terrorists will create their own encrypted channels.

It's a never ending battle and the only ones loosing will be the rights of the civilians.

And even if it will help to fight terrorism and save everyone without firing a gun, what's the promise that these tools, these backdoors wont fall into wrong hands? What's the promise when a dictatorship rises in one of these countries, they wont be able to use it for bad things?

Will they close these doors after they won the war on terrorism?

</comment><comment><USER12> I remember watching William Hague on the news using the fact that two girls had been radicalised via Twitter as justification for more snooping powers. All the tweets were public and they were even showing them on screen while he was saying it. Just demonstrates how little logic there can be behind the extension of snooping powers.

</comment><comment> guard-of-terra "Terrorists that we brought to country hurt you so we have to hurt you back to compensate"

That's how it goes with politicans for the last 15 years.

I used to be wanting interplanetary travel, now my bar is much lower, I'll be happy enough extracting my revenge.

</comment><comment><USER13> Previous discussion here:

[https://news.ycombinator.com/item?id=12353957](https://news.ycombinator.com/item?id=12353957)

</comment><comment><USER14> Anyone who knows if they are 2 "rogue" ministers, or if they have some backing ?

<comment><USER15> At least in Germany, coming from the leading party[1] and pushing the official party line, the minister is anything but rogue.

The leading party (CDU) even has a sister party (CSU in Bavaria) that is even more of a law and order type. They have way more extreme ideas on how a state should be able to control it's citizens. But even the moderate left SPD (in coalition with CDU as ruling parties in Germany) have their flavor of hawks.

Right now it seems there is no powerful reasonable voice for freedom in Germany - at least in the higher ranks of power. But maybe this last sentence is just my selection bias.

[1]: [https://en.wikipedia.org/wiki/Thomas_de_Maizi%C3%A8re](https://en.wikipedia.org/wiki/Thomas_de_Maizi%C3%A8re)

<comment><USER14> So ... enough reason to start worrying and set-up counter campaigns ?

</comment></comment></comment><comment><USER16> How does this help? If a criminal wants a gun, they can get a gun. Encryption is out of pandora's box - the methods have been published for years. It a terrorist uses encryption - how can this stop them?</comment>


Ask HN: What are the differences between a $485 and a $40.000 eye tracker? - <AUTHOR>

I am fairly new to eye-tracking and wonder if I should get my own equipment after some studies at the university. The main questions for me is: What are the main differences between a $485 (e.g. http://gazept.com/products/)and a $40.000 solution (e.g. tobii X2 - tobii.com)? <comment><AUTHOR> Links:

[1] [http://gazept.com/products/](http://gazept.com/products/)

[2] [http://www.tobii.com/en/eye-tracking- research/global/product...](http://www.tobii.com/en/eye-tracking- research/global/products/hardware/tobii-x2-60-eye-tracker/)</comment>


Ask HN: How to Run API Mashups - <AUTHOR> Hi HN,
i'm searching for infrastructure where i can run some API mash-ups without too much dev-ops hassle.
As a freelancer i log my time spent on projects using Clockify[1]. I also use web based finance management software for billing clients. As both offer a RESTful JSON API, with a few lines of code it's easy to extract time spent on a project from the clockify API and create a draft invoice in the finance software.
I'd like to run this and similar "API-Mashups" automatically every month or on demand (e.g. upon a webhook request), but for all sort of reasons, not on my local machine.
Some solutions i've looked at: Zappier[2] could offer what i'm looking for, especially their logging of tasks run is interesting but they do not support all features of the API and some easy to program logic only comes with plans that would be too expensive for me.
AWS Lambda should be able to do what i'm looking for but setting it up appears to require quite a bit of knowledge i don't want to spend the time on acquiring.
Netlify Functions[3] would absolutely cover what i'm looking for (taking the admin and setup requirements out of AWS, setting up env. vars for API secrets) but piggy-backing the deploy process of a website for the above task seems wrong.
RunKit[4] offers a nice prototype playground to create such a mash-up, allows for setting up API Secrets and using their endpoint functionality could allow for the on-demand triggering. Yet running something like a "once-a-month" cronjob there also seems wrong.
I would appreciate any suggestions on running "simple" API ETL tasks.
[1] https://clockify.me [2] https://zapier.com/home [3] https://functions.netlify.com [4] https://runkit.com/home <comment><USER2> This is exactly why we created deta.sh It's essentially powered by AWS Lambda but requires no setup at all. It also has a built-in DB, cron, etc.

Happy to give you access.

<comment><AUTHOR> That does indeed look a lot like what I'm looking for! Sent you a request via the website Thanks in advance!</comment></comment>


Cautionary Tales from Brexit, Grexit and U.S Budget Battles - <AUTHOR> http://www.wsj.com/articles/forecasts-of-brexit-gloom-may-be-overdone-1472406752?=e2fb&mod=e2fb <comment><USER2> The article is incredibly disingenuous.

For example, the FTSE 100 rose largely because of the fall of the pound (which has remained low): most of the FTSE 100 companies have income largely denominated in non-pound currencies but are themselves valued in pounds in the FTSE. So a fall of the pound immediately makes them more valuable, measured in pounds.

Other effects were ignored, for example last I checked commercial real estate was hit hard, and all of the commercial real estate funds closed down post brexit. The London private property market was also hit, with the market nearly stalled despite a retreat on prices.

And that's all before Brexist has actually happened, when most people didn't actually expect it to happen and therefore contingencies are only slowly coming online (and many won't until we know that the trigger will actually be pulled and what the consequences are).

Then there is the classic use of a non-zero y axis.

Or the use of Grexit, which _didn 't happen_. So maybe the dire consequences that were predicted didn't happen because the event that was thought to precipitate those consequences was averted??

Geez.

<comment><USER3> More than that - the FTSE 100 and FTSE 250 are both being pumped up with QE. The cost to the UK in borrowing costs is already far more than the total historical contribution made to the EU.

And so on. There's more, but the picture is clear enough.

This article is either shockingly and unprofessionally misinformed, or deliberately misleading.

</comment></comment><comment><USER4> The Greece bit of this article is strange:

 _Warnings abounded in 2015 that if Greece rejected an international bailout, it could spark a sovereign default or a banking crisis or Greece being cast off the euro. Greece's economy is far from a success story, but it hasn't gone bankrupt. Its banking system has been battered and drained of deposits, but hasn't collapsed. It remains in the euro._

But Greece _didn 't_ reject the international bailout; it accepted it (despite a referendum voting "no", Tsipras signed it anyway). So this article is arguing: Experts predicted ~A -> B, but since in reality both A and ~B came to pass, experts are wrong. That's... not valid reasoning. Presumably the experts would argue that to the extent Greece isn't (quite) bankrupt, it's precisely _because_ it heeded their dire warnings, and got cold feet about rejecting the bailout package.

</comment><comment><USER5> A quote I read once: "History works slowly at first, and then all at once."

I still think it's too early to tell what the impact of events like Brexit and Euro crisis will be. As humans, we're wired for immediate feedback loops, but that's not usually how the world works. We (and particularly the media) tend to look for immediate impact, but it's way too early to say that there will be no consequences from all the things that have been happening in 2016.

</comment><comment><USER6> It's true that the real ramifications of Brexit remain to be seen. But it's interesting to see how many people want Brexit to fail. What if we don't need a fledgling world government in the form of the EU? What if its okay for different groups of people to retain their autonomy and their sovereignty-- something people have fought and died for throughout history? Would that be such a disaster?

<comment><USER7> The whole reason the EU even exists is because Europeans kept fighting and dying to retain autonomy and sovereignty, and they finally got tired of it. People are afraid that without supernational institutions tying it all together, Europe will return to its old patterns. That would be a disaster almost beyond imagining if so. Modern weapons will make the Second World War look like a fun romp in the park by comparison.

Of course, maybe it won't happen that way. But pointing out that people have gone to war over this stuff throughout history is not really helping.

<comment><USER8> The question is: is the EU the symptom or the cause of peace in Europe? According to the Nobel price committee, the EU is the cause. But I have some doubts... a badly governed EU could even spark nationalist resentments instead of containing it.

<comment><USER9> The American/Allied victory in World War II is the responsible for most of the relatively peaceful world situation. A cooperating West Europe resulted from this.

<comment><USER10> And a cooperating West Europe existed for years before the EU. Ascribing the peace to the EU seems somewhat revisionist.

<comment><USER7> The various precursor institutions to the EU go back to 1952.

<comment><USER10> Sure, but nobody's crediting the six-member European Coal and Steel Community with being the source of European peace.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Quite literally nothing has happened with Brexit yet -- other than the vote itself. "Doomsayers Stumble[d]" is a far conclusion to draw from the aftermath of an event that hasn't yet come to pass.

<comment><USER12> Yes, this is really important. The markets have responded to the _potential_ of leaving (because the referendum isn't a guarantee, although it would make any party that contradicted it extremely unpopular), but nothing else has happened.

EU trade deals are still intact, free movement is still in place. How can the economists' post-Brexit predictions fall foul when we are still pre-Brexit?

</comment></comment><comment><USER13> The FTSE graph before and after Brexit is incredibly misleading. The reason equities rose is because the Pound depreciated to a historical low. The value of that stock in FTSE in other currencies of course declined.

<comment><USER14> Even if it wouldn't have declined, the non reaction could just mean that Mr. Market doesn't believe that Brexit will ever happen.

<comment><USER15> Doesn't believe or doesn't know how to price it, yet.

<comment><USER16> Then it would decline due to increased risk.

</comment></comment></comment></comment><comment><USER15> News just in: huge, economy level change that hasn't begun to unfold, yet, appears to have not impacted the market...again, yet. You can just stop reading after "It's early".

</comment><comment><USER14> So far there haven't been any kind of a Brexit. It is even completely unknown how a Brexit might look like. And if there ever will be a Brexit at all.

<comment><USER17> There has been a bit of a dip in rents, possibly due to Europeans wary of immigrating.

<comment><USER12> Also because the housing market is over-inflated and a steep recession seems likely; people are worried because the last recession caused housing prices to drop severely. Also the pound has crashed against the Euro, food prices are already starting to climb, so housing costs are simply not as affordable as they were a few months ago.

</comment></comment></comment><comment><USER18> You can have an accident if you drive while being drunk. The fact that most of the time there is no accident doesn't mean that it's not dangerous. Sometimes it looks like we take economic and political decisions similarly.

<comment><USER19> Agreed, though in this case it's more like smoking, or exposing yourself to a large dose of radiation, because there's a latency in between the event (Brexit vote) and the ultimate outcome.

Just because you don't develop cancer the very next day doesn't mean you won't suffer long-term health consequences[0]. Likewise, just because the outlook two months later doesn't look dire, that doesn't mean the UK won't suffer long-term economic consequences from the vote.

(The disease analogy breaks down when you also factor in the uncertainty around whether Article 50 would even be invoked after the vote, or the uncertainty around what the ultimate outcome of the exit negotiations will be.)

[0] Likewise, just because you develop cancer, that doesn't exactly mean that you got it _because_ of that exposure either.

<comment><USER20> > Likewise, just because the outlook two months later doesn't look dire, that > doesn't mean the UK won't suffer long-term economic consequences from the > vote.

Also, maybe if the economic consequences had been really bad after 2 months, people would be trying to avoid Brexit in the first place.

The Brexit is something that will be judged in a generation.

</comment></comment></comment><comment><USER21> Fundamentals are hard to argue against, but predictions of timing are hard to get right. The fundamentals may indicate one thing, and predictions based on them are reasonable, until the fundamentals change. Timing of predictions is a very different thing because despite the fundamentals there are external factors you simply cannot predict.

Predicing there would be a housing bubble in 2001 was merely a case of seeing the changes in the law under Clinton, the change in financial settings at the federal reserve under Bush due to the dotcom crash and 9/11, and looking at the way the incentives were set up with Fannie Mae and Freddie Mac. Many people said you can't predict such a thing and in 2006 it was common to see on TV the claim that there was no housing bubble, and that the economy was fundamentally sound and I heard this a great deal from people in day to day life who were buying houses and thought I was insane to think houses were overpriced. I'm not a genius, I just read the right article in 2001 from a "economic doomsayer" and between 2001 and 2008 as far as everyone was concerned, I was crazy, and then after 2008 instantaneously "it was obvious" there was a housing bubble and thus my insight was pointless.

The lesson here is to look at the fundamentals, but don't bet on the timing. I invested against the housing market in 2002-2007. I wish I had known about the existence of CDOs. I got out in 2007. I was a year early. You can't predict the timing.

But you can take fundamentals to the bank.

</comment><comment><USER22> Thing is, this is media phenomena, a journalists decides which quotes to use. There are of course a lot of people who could be called 'expert' and one of them will have a very quotable opinion.

</comment><comment><USER23> Globalists and economists are burning through what little remains of their credibility with each failed prognostication.

David Cameron suggested a Brexit might spark WW3. Economists claimed it would decimate the British economy in short order. These same naysayers are still prophesying, this time saying that the collapse is gradual but imminent.

Your average "Main Street" person is tired of being talked down to by ivory tower economists and globalists, and they're responding with support for populist movements.

I predict this will reach a boiling point in the US when Fed monetary policy results in the opposite intended reaction.

<comment><USER24> Since Brexit hasn't actually occurred, its a little early to call any of the prognostications as to what it might produce "failed".

<comment><USER23> Markets are made up of people who can read future events into current prices. The idea that the negative impact of Brexit won't take effect until the final papers are signed doesn't hold water with me

<comment><USER24> Its not a matter of "the final papers" being signed. The process by which negotiations to produce "the final papers" would _begin_ hasn't been started, and there is only loose speculation as to when it _would_ start.

The idea that the negative impact of Brexit would be fully realized while people are still actively discussing why despite the public, but not legally binding, commitments it still might _never happen at all_ , is, well, ludicrous in the extreme.

</comment></comment></comment></comment><comment><USER25> The great thing about being a doomsayer is that you only have to be right once.

<comment><USER26> Is this dismissive of the anti-Brexit claim? (I can't really tell.) It seems to me that it doesn't really demonstrate anything; I could equally well say "the great thing about predicting Utopia is that you only have to be right once." All predictions, of good or of ill effects, will, or at least can, be (by the predictor) loudly trumpeted if right and ignored if wrong.</comment></comment>


NSA leaks reporter Glenn Greenwald leaving Guardian to launch new site - <AUTHOR> http://www.theverge.com/2013/10/15/4842216/glenn-greenwald-nsa-scoops-leaving-guardian-start-own-site

<comment><USER2> So he is keeping the juicy stuff from the leaks for the new site? I could be interesting what more could be revealed. According to Schneier they have material to publish way into 2014.

It will be interesting if they try to influence the midterms.</comment>


Vertigo lives: Oculus Rift preview event suffers from VR tracking woes - <AUTHOR> http://arstechnica.com/gaming/2016/03/vertigo-lives-oculus-rift-preview-event-suffers-from-vr-tracking-woes/ <comment><USER2> these have been my complaints of this offering of digital stereoscopy

> I touched on some nausea issues, mostly in terms of particular examples of > comfort and discomfort alike

> I felt stuck in a dizziness spell

i felt this prologned discomfort, even one time, my last time, having my eyes cross for nearly an hour after removing the dk2 following a maybe 30 minute dev session

> The answer is hard to pinpoint because it didn't have anything to do with > the crisp screens or otherwise solid hardware.

> It took a developer fixing the issue on one demo for me to figure out one > possible reason: the headset may have occasionally lost webcam tracking. > Certainly, some tracking disconnect occurred

though tracking may have contributed i think the source lies in two key issues:

        0,the headset cuts off circulation to your eyes
        1,the stereoscopic divide, and lenses are one size fits all

> which, as an aside, left a "raccoon eyes" imprint on my face

yeah, but what that means, and what i wanted to express, was that you are cutting off circulation to your eyes, an organ that requires good blood flow for its health let alone function

that second point is based on the fact that all faces are different but the headset and software lacks any ability for compensating for this

the headset fails to account for interpupillary distance(o) and as such you brain is working overtime to compensate for the slight derivation in inputs

if you wear glasses, bend one lens slightly out of alignment and see how long it takes for your eyes to adjust both to the new orientation of your glasses, and then back again after you take them off

.. (o) [https://en.wikipedia.org/wiki/Interpupillary_distance](https://en.wikipedia.org/wiki/Interpupillary_distance)</comment>


Anonymous India strikes again against corruption - <AUTHOR> http://www.thehackernews.com/2011/06/anonymous-india-opindia-strikes-again.html

<comment><USER2> What has army website takedown got anything to do with the fight against corruption??

Can we please get beyond the script kiddie phase and actually start bringing to light some of the deeply corrupt politicians and bureaucrats ala Wikileaks style?

Even that I am not hopeful about. Corruption is so pervasive in India that Indians glaze over them except when something of the scale of 2G Scam hits. Accusations fly back and forth, and then its relegated to Page 10 and everyone moves on. Judiciary, Legislature, there is hardly any aspect that remains untarnished.

There is a moral tug of war today waged for the heart of India, a tug of war between Technology and Transparency against corruption. Once that is won, there still remains a task of punishing the offenders and ensuring the frameworks are in place to prevent it from happening. Neither the Legislature, nor the Judiciary is vested enough to ensure that.

<comment><USER3> There's currently a big thing going on in India with some anti-corruption protests led by some Yogi. I think they're trying to express solidarity.

<comment><USER2> Dont get me started on him. The guy has about 300 million in networth which are all charitable donations. Are you telling me that HE cares about corruption?

He is an opportunistic god peddler who wants to turn this circus in to an attempt at politics and further power play. Some people can see through his shell game, but in the end this wouldnt have solved anything for the country.

<comment><USER3> I'm not local and the depth of my knowledge on the situation is "some Yogi".

But I'm inclined to think some action is better than no action, when it comes to fixing things.

<comment><USER4> "some action is better than no action, when it comes to fixing things"

So, as a (presumably) professional coder, you believe this? I'm inclined to STRONGLY disagree. There's a time for decisiveness of action , sure, but it usually follows once you've established a strategy. "Some act is better than no act" is false without lots of caveats.

<comment><USER3> A) "inclined to think"

B) politics != programming

C) Think you could write out the caveats for me? If you do it quick I can still edit them into my original post. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER5> I can understand their passion, but I think it is misplaced. This is like ringing the doorbell of some prominent person and running away; yeah, you'll cause him some loss of sleep, but in the end, it changes nothing.

You know what could change things? Here's one idea. A lot of corruption happens in pushing files (as in, paper files) in the bureaucracy. What if you could come up with a secure, Wiki-like system where files were bits instead of atoms; each change, each access, each transfer, each signature was tracked (just like in Wikipedia); and using a web interface, a citizen could keep track of his/her file. Couple this with a secure biometric-based system which allowed fine-grained control on who has access to the file.

The scourge of corruption in India is nourished by the dark bureaucracy of UDCs, LDCs and myriad clerks whose sole purpose is to shuffle files around. Get rid of them and shine some light there.

Any "hackers" willing to take up this challenge?

</comment><comment><USER6> This is going too far . Out of control I think.Attacking Army website had nothing to do with corruption. This will be treated as war on cyber assets and will act as counter productive to support to wikileaks or sony victims</comment>


Increase Your Depth as a Programmer by Spelunking - <AUTHOR> http://catsonkeyboards.blogspot.com/2008/08/increase-your-depth-as-programmer-by.html

<comment><USER2> I really like the term "spelunking" for this.

Pick unexplored corners of toolkit you use, unfamiliar commands, try to learn a new language out in left field from what you already know, etc. Even if you don't use them directly, it's good exercise for your mind, and new ideas you encounter along the way will likely come in handy some day. You never know when a connection to something seemingly unrelated will click and lead to a breakthrough. (<http://achewood.com/index.php?date=06132002>)

</comment><comment><USER3> A former coworker would go into the bin directory and read through every command at least once a year, if I remember the exacts correctly. He was also the best system admin I remember ever seeing.

I believe I have 80% of the java spec read by the same strategy from when I was a full time java programmer.

</comment><comment><USER4> I agree with the author of this article, but I have to wonder if there are very many programmers who don't do this?

<comment><USER2> There most definitely are, but the lack of interest in exploration is not necessarily permanent -- it probably only takes stumbling across one or two cool things to reward and reinforce curiosity.

Some people in every field lack the skills or motivation to teach themselves, though programming probably amplifies this difference because there are so many _new_ things emerging and so many niches, and because with enough motivation you can often just download an interpreter, toolkit, or live boot cd and start experimenting with it.

<comment><USER4> I suppose that it's probably a lot different for programmers who didn't start programming on their own - those whose first exposure to coding some software was through classes in college or whatnot.

I know that for me, almost all of my knowledge of software development and knowledge about what tools are available on a linux system, and how they work (as well as about how the kernel works) came from this process of poking around, reading what was available to me, and then trying things out.

<comment><USER2> Same here. And MS-DOS before that, and a Commodore 64 before that. :)

The process never ends.</comment></comment></comment></comment>


Ask HN: CMS with automatic back end generation - <AUTHOR> Somewhen during the past year, a CMS was posted here where administrators could define the frontend templates using mustache syntax, and the CMS would automatically infer an admin UI. Sadly, I couldn't find it anymore. Some more pointers I seem to recall: - had a bit of a special name, possibly a single noun - written in Node - commenters asked whether it was only possible to create a single site per template or also collections, as in blog posts<p>Does anyone remember? <comment><USER2> directus.app maybe</comment>


Ask HN: Why do Apps use sound FX and websites don't? - <AUTHOR>

In it's Geocities heyday, web pages often had sound loops, WAV files and horrible flash files with sound effects.
Then we all got quite sensible and realised sound effects on websites are pretty annoying.
But with the advent of iPhone & Android apps - see this beatiful Pastebot example: http://vimeo.com/8157582 - coupled with a blurring of the lines between the UI of desktop and  mobile apps, are we going to start seeing (hearing!) tasteful yet complementary sound effects on websites?
If not, why not? What makes a website so different to an app in their appeal of sound effects? <comment><USER2> Probably the lack of a single sound format that is supported by all popular browsers on most platforms. And because animations can be easily done with JS/CSS, and that doesn't require all that much bandwidth or space, while good quality sound is considerably larger.

<comment><AUTHOR> Is it possible this might change with HTML5 in the future?

<comment><USER3> if html5 video is any indication, it has to fall back to flash for browsers that don't support it, as well as encode the video in various codecs to account for different codec support (per browser)

</comment></comment></comment><comment><USER4> a) Apps run on touchscreens. Your hands cover the screen so sometimes there is no visual cue.

b) When an app is slow to respond, the audible cue lets you know that the action was performed

c) iOS and android devices usually do 1 thing at a time, so you know the tap sound could only come from the current app. Imagine what it would sound like if a bell rang every time a web page in your tabs was updated. You 'd still need a visual aid to tell where it came from

d) because apps lack in content and try to make up with visual effects and sounds</comment>


Lexical vs dynamic scoping in Lisp ... - <AUTHOR>

The first Lisp I ever used was LispKit.  Over one weekend I implemented the SECD engine in BCPL, then by hand compiled the LispKit definitions of eval and apply into SECD code and typed them in.  Hey Presto!  Running Lsip.
But LispKit Lisp used dynamic scoping.  If you have an unbound variable in an expression it uses the definition that was in force at the time of the call, not the definition that's in scope from the text of the surrounding code.  This was incredibly useful at times, but made debugging and analysis difficult.
To the best of my (very limited) knowledge, modern Lisps use lexical scoping.  Are there any current Lisps that use Dynamic scoping?
I could find that out for myself with a lot of searching and reading, but what I really want to know is this:
Do any of you use a system with dynamic scoping? <comment><USER2> Emacs Lisp uses dynamic scoping. Common Lisp uses lexical scoping by default, but allows dynamic scoping.

<comment><AUTHOR> Thanks. Do you know of any detailed discussions of the pros and cons?

<comment><USER3> I don't off hand, but for a start search on the upward funarg problem.

Here's the history as I learned it in the '80s (mostly):

Original Formula LISP as done by McCarthy was dynamically scoped for any one of a number of reasons:

They didn't know better (this is 1958, when LISP was implemented as subroutines callable from FORTRAN running on a vacuum tube IBM 704 and a lot of it was based on a 1955-6 language).

They didn't know how to make it efficient, or I think especially interpreted LISP, statically scoped when the latter became recognized as a big and/or the right thing, largely due to Algol 60 (as in 1960). Among other things it's memory hungry (see the Wikipedia Funarg problem article) and there just wasn't much of that to go way back then. The 704 was IBM's first "core by default" machine....

Scheme in 1975 was the first statically scoped LISP although the first production quality version was T in the early '80s (and that was a necessary proof of concept).

By the time of Common Lisp in 1984 it had long been recognized that default dynamic scoping was ... not good, Common Lisp's change to default static was perhaps its biggest breaking change and it was years before many code bases were changed to it (by this time various LISP dialects were pretty mature and there were some seriously useful systems written in them like Macsyma and the Lisp Machine).

Since then, of all the Lisp dialects I consider to be "major", only Emacs Lisp (ask RMS) and AutoLisp (AutoCad's extension language of 1986 based on "a very early version of XLISP" the date of which I don't know, but XLISP proper started in 1983) are dynamic by default. Everyone else has followed the lead of Scheme and gone default static.</comment></comment></comment>