Show HN: YourNote, a note-taking app that puts users' data first - <AUTHOR> https://yournote.app <comment><AUTHOR> Hi HN,

The founder of YourNote here. YourNote is a user-first note-taking app. By user-first, we mean that user's personal data (which are the notes) are guaranteed to be secure and private if you use YourNote. This is achieved by using Blockstack and Gaia for user authentication and user data storage. So, at any point in time, user and only the user has access to their notes. Even if their Gaia storage gets hijacked, their data is encrypted using the keys only the user holds so it's basically impossible to access a user's data for a third party. This establishes two things.

1\. Data Security

2\. Data Privacy

So with YourNote and Blockstack, we can be sure that we are good on those fronts. Another thing that makes YourNote interesting is that it uses open standard (markdown with frontmatter) for storing notes. So even if YourNote gets taken down, the user can still access their data using any text editor as the data is stored on their own storage. Also, if the user starts hating YourNote for some reason, they can export their data and either use a text editor for accessing them, or fork YourNote and make their own app. So basically, another thing that YourNote guarantees is -

3\. Data Accessibility

I believe these three things are very important for a note-taking app which stores data that is more "personal" and "valuable" to the user than photos, media, and other data.

HN, I would love to know what you think about the idea and the product. I know that it's a long way to go before this can become something that people will readily jump ship on, but I hope it's a valid start.

<comment><USER3>
        at any point in time, user and only
        the user has access to their notes

I don't think that is true.

When I use your app, you can do anything you want to my data. You might promise me that the Javascript you delivered to my browser is treating my data in a certain way. Storing it in encrypted form or whatnot. But that is just a promise. Reality is: you can ship me code that does whatever you like.

<comment><AUTHOR> That is true, and the only way to fix that is when users see the code and run it themselves (I plan to open source very soon). Apart from that, I don't think I can provide any other guarantees. No open source project can. If they are discovered doing something bad, they go rekt. That's how it usually is. So what's the point here? Should I not have a line like this in my copy?

Another thing that can be done is that I distribute my application in such a way that its code is directly linked to the open source GitHub repo. It can be done by having some script as the distributable that clones and runs the source code (it's a very bad way though). It would be interesting to know if any other open source project in the privacy space is already doing something extreme like that.

<comment><USER4> Word of advice: your usage of immature expressions very much lowers the professionalism of your product and how much I'd look to trust it. In the comments here, phrases such as 'user starts hating YourNote for some reason' and 'they go rekt' are two such examples.

<comment><USER5> Characterising the language you don't agree with as "immature" doesn't reflect well on you.

<comment><USER4> Please provide a more appropriate word to describe those phrases. They're definitely unprofessional- but unprofessional doesn't quite fit here. Also- nothing about disagreeing with here. There's language that is appropriate in some contexts and that isn't quite appropriate elsewhere. In essence, your comment is seemingly argumentative for the sake of it.

</comment></comment></comment></comment></comment></comment><comment><USER6> There are a few open source alternatives that let you store your notes locally.

In no particular order,

1\. QOwnNotes - [https://github.com/pbek/QOwnNotes](https://github.com/pbek/QOwnNotes)

2\. Joplin - [https://github.com/laurent22/joplin](https://github.com/laurent22/joplin)

3\. Zim Desktop Wiki - [https://github.com/jaap-karssenberg/zim-desktop- wiki](https://github.com/jaap-karssenberg/zim-desktop-wiki)

Boostnote was pretty good as well, but it seems like after the change in leadership, there has been some issues.

<comment><USER7> What issues does Boost have now? It seemed like one of the better options for code notes

<comment><USER8> It doesn't store its notes as markdown. It uses a format called cson. Still easy to parse, but cant open Boost notes in another editor easily.

</comment></comment></comment><comment><USER9> The landing page doesn't show me anything about this product, and just forces me to login with 'blockstack'.

Guess I'll close the tab ¯\\_(ツ)_/¯

<comment><AUTHOR> Oops, the info about the product is at the bottom. And I should have added a screenshot or illustration too. I added one in the background now. Here is how the app looks. [https://i.imgur.com/T3ZVj35.png](https://i.imgur.com/T3ZVj35.png)

<comment><USER10> That should be the first thing a visitor sees on the home page. Users don't owe you a click on 'learn more'. Explain the product, and maybe even allow them to use it without creating an account, and only ask them to sign up/sign- in when absolutely necessary (like, if they try to save a note, or if they are leaving with some unsaved work)

Also, why would your average user care about 'blockstack'? That's an implementation detail that might be cool to you, but it's an irrelevant thing to put front and center. Even most nerds would be unaware of what this is.

<comment><AUTHOR> You are right. I made this keeping Blockstack people in mind and didn't realize I should change that before launching publicly. I am working on a new homepage now.

</comment></comment></comment></comment><comment><USER11> The site is a little light on details, but I assume my notes will be stored in a distributed way? What are some key advantages of this over something like Standard Notes ([https://standardnotes.org](https://standardnotes.org)), which allows backing up notes to multiple different cloud storage providers.

<comment><AUTHOR> It's not distributed. Your data will be stored on a storage provider of your choice and it will only be accessible to you (or others with whom you share).

More here: [https://github.com/blockstack/gaia#user-control-how-is- gaia-...](https://github.com/blockstack/gaia#user-control-how-is-gaia- decentralized)

I haven't used Standard Notes before but from what I see now, it looks close to what we plan to make. I wonder how they store the data and what happens with data in case they disappear. I will look more into it.

</comment></comment><comment><USER12> Curious that nobody mentioned [https://standardnotes.org/](https://standardnotes.org/)

* already open-source

* client side encryption

* multi platform / multi device

* offline access, local backups

</comment><comment><USER13> I just switched to Standardnote recently and have been liking it so far - <USER2> are privacy centric as well, making all notes encrypted. What is the main benefit of this over Standardnote? I only have a few notes in there so if I do switch now is the time to do it...

</comment><comment><USER14> All the things this program claims to solve are problems it created by being something other than just an actual notepad application running on your local computer.

<comment><USER15> I think this is only true if (a) Your local computer is part of an existing secure, cloud-based personal solution for sharing generic files, and (b) You have note-taking capabilities to work on a common note-taking file format across the devices in (a).

I think you suggest a point, though, that it seems that it would be ideal to have a general secure and accessible file storage implementation, with specific apps where needed.

And personally, along the lines of what you're saying, I'm actually more concerned about finding a really good, local note-taking method than even involving the cloud or de-centralized Internet in some way.

</comment></comment><comment><USER16> Loading takes 15 seconds, Blockstack account is required, which is not what I would want to.

Maybe this app puts users' data first, but but the user.

<comment><AUTHOR> Haha, I am sure I can optimize the loading time. A blockstack account is required for reliably managing the auth. It's much better than relying on Google for it or coding one of our own IMHO.

<comment><USER17> why?

Googles pretty damn good at auth... why is this better?

</comment></comment></comment><comment><USER18> > Store your notes in the default gaia hub or use your own. > You are always > in control of where your data is stored.

What's Gaia? What's a hub? Should I now how to roll my own?

This is getting a little bit too common for projects to just shoot features that are completely opaque to the user.

Or, either, I'm just getting old.

But I tend to believe that's not the case.

</comment><comment><USER19> I read your Medium post and was curious what you would think about Memrey [https://www.memrey.com](https://www.memrey.com)

With Memrey we offer our users 256 bit AES encryption. If a user encrypts their notepad not even we can decrypt the users data.

Also we plan to integrate PDF backups emailed to you on a monthly basis. Right now you can download a PDF backup of any notepad, but automatically emailing it every month would be a nice way of having it be worry free.

If you get a chance I would be curious to know if you think Memrey would solve your issues? It is one of the most advanced notebook products on the market.

</comment><comment><AUTHOR> We are live on Product Hunt! :tada:

I have used the comments and feedback mentioned here to add an FAQ section on the landing page. Thank you, everyone. :pray:

</comment><comment><USER20> I think it is worth a mention that Simplenote ([https://simplenote.com](https://simplenote.com)) is a simple note taking application available, at no cost, on all of the platforms mentioned. I use it because it syncs better than notes on my iPhone.

<comment><USER19> Memrey sync way better than simplenote I kid you not. In fact no other application sync as fast as Memrey, its core technology is built for this stuff. And it is available for all platforms as well.

</comment></comment><comment><USER21> I usually need to see some reason for turning on google-analytics. I didn't at first ... empty page. After I did that, I have no idea what block-stack auth is (why should I trust that?), no idea what Gaia is. Guess I'm not the audience.

</comment><comment><USER22> This sounds like a great idea.

If this product is free and takes off, how do you plan to monetize the website?

<comment><AUTHOR> I can ask users for a one-time charge to sign up on the app. Also, maybe I can add some "pro" features which I am unsure of, at the moment. Not really sure to be honest, let's see.

<comment><USER15> Are you planning to take a shot at getting funding through this Blockstack "App Mining" program ([https://app.co/mining](https://app.co/mining))? If so:

My suggestion would be to put this in a FAQ somewhere. I'd imagine to the great majority of people this wouldn't be a big deal, but it would help explain the motivation and, for some people, evaluate trustworthiness.

<comment><AUTHOR> Yes, we plan to use that as a means to sustain ourselves till we can actually make some money from this. Thanks for pointing, I have mentioned it in the landing page's FAQ now.

<comment><USER23> Could you make it so we don't have to log out to see the link to that page.

</comment></comment></comment></comment></comment><comment><USER24> Taking back ownership of personal data!

<comment><USER25> Data is currency!</comment></comment>


Categories: Models of Models - <AUTHOR> https://www.lesswrong.com/posts/jPDSzqHJCz2drFKvA/categories-models-of-models <comment><USER2> A new convert joins the fold.

Category theory is indeed what we obtain when we try to seek minimal ontologies, minimal models, etc. but it is interesting that it originally evolved in the context of minimal explanations for natural transformations.

I wonder about the slogan "assume a 3-category" for unifying these desires for a minimal playground upon which we can discuss and relate all of these distinct mathematical concepts.

<comment><USER3> Why a 3-category in particular?

</comment></comment><comment><USER4> Great post. If you like it, consider Renzo Carbonara's work => [https://atypeofprogramming.com/](https://atypeofprogramming.com/)

</comment><comment><USER5> This is really interesting. Seems like everything could be modeled as a graph with nodes being nouns and edges being verbs.</comment>


Artificial intelligence Is radically changing muni risk assessments - <AUTHOR> https://www.bondbuyer.com/opinion/artificial-intelligence-is-radically-changing-muni-risk-assessments <comment><USER2> Changing for the better or worse?

A human still has to build the model but now if the prediction is wrong no one will lose their job because they can now blame the computer.</comment>


Being basic as a virtue - <AUTHOR> https://nadiaeghbal.com/basic <comment><USER2> This seems as good an opportunity as any to bring up another part of the "basic" concept which feels really unhealthy: the idea that "basic" is consuming commodity, mass-market goods, and that high status is distinguishing yourself through sophisticated taste in what you consume.

This mindset is problematic for at least a few reasons: \- Every choice of consumption becomes an opportunity to over-examine \- Devaluing goods because they're common lures us into a needless chain of "upgrades" as productivity improves. We can never have a post-scarcity economy if we're taught to shun whatever isn't scarce. \- All of this plays into the framing that we're first and foremost workers and consumers.

Would we not all be happier and healthier consuming decent but not spectacular mass-produced and inexpensive food, drink, clothing, housing, cars, etc, instead of coveting a rare beer, or looking down our noses at people buying starbucks?

<comment><USER3> I completely agree, but I can't help but note this only sounds like a radical concept in the context of West coast liberals pretending their snobbiness is erudition.

<comment><USER2> I don't think this is specifically a West Coast thing. My supermarket has dozens or perhaps hundreds of cheeses, and so do large supermarkets all over the US. Surely that's because someone's buying the niche varieties, and going to a party and saying "oh you're still buying brie? you have to try reblochon."

<comment><USER4> Or they just like to try new cheeses?

</comment></comment></comment></comment><comment><USER5> [https://workaway.info](https://workaway.info)

A site that lets you find hosts who will trade room and board in exchange for two to five hours of labor per weekday. Mostly located in beautiful/wild locations around the world.

I'm currently doing three months in Europe hopping from place to place using Workaway. For instance, right now I'm at a hobby farm on top of a mountain in central italy. Super laid back. And gorgeous. Imagine the most picturesque idyllic farm you can... I'm finding that the rewards in mental health are more than sufficient to justify the astronomical opportunity cost.

<comment><USER6> My browser is complaining about an expired or invalid cert

<comment><USER7> It's fine for [https://www.workaway.info](https://www.workaway.info)

</comment></comment></comment><comment><USER8> Is it common for knowledge workers to fantasize about more labor intensive work from time to time? Because I definitely found myself relating to that sentiment. Usually my mind goes to construction or carpentry in those moments.

My favorite part of this is the acknowledgement of the enjoyment to be found embracing the 'degenerate' as the author calls it. I can strongly relate to needing a good, stupid, socially-unacceptable laugh sometimes.

<comment><USER9> I often find myself romanticizing the hunter-gatherer lifestyle. I'm certainly not suggesting modern society be dismantled, but there's something intriguing, attractive even, about the simplicity of that life.

<comment><USER10> Rule 1: Always have a plan for the day.

Theorem 1: If you accomplish half of your plan for the day, you had a very unusual day.

Rule 2: Be ready, at a moment's notice, to drop your plan for the day to pursue an unusual opportunity.

Theorem 2: You might not always be rewarded for your enthusiasm, however. And, at first, you will see many "opportunities" that are actually distractions from the task you are avoiding. Time and seasoning will give you discernment.

Rule 3: Be aware, at a moment's notice, that you will have to drop your plans and focus on an unexpected emergency. Re-build what broke so that it won't break the same again next time.

Rule 4: You can start practicing now by skipping meals, or even skipping a day of eating on occasion. Also, sleep on the floor with a light blanket sometimes. Don't wear a coat to work sometimes. Take cold showers. Practice being uncomfortable. Practicing makes it easier to absorb being uncomfortable when you don't have a choice in the matter.

Rule 5: While you will be met by frequent surprises and challenges, you will also be bored at times. Practice being comfortable with being bored by walking more, with no headphones, no podcasts, no music. Just you and your thoughts.

Rule 6: You will always be building and re-building a plan for the day, but that plan should always be fitting into a context of the season that is coming next. What you do today makes the next season more comfortable, or at least, survivable.

Theorem 3: You can judge how well you are surviving and adapting to the challenges of your environment by how long out into the future your planning reaches.

Theorem 4: To romanticize this as "simplicity" is to grossly underestimate the mental fortitude and resilience required to focus on the matter at hand while continuing to rebuild a plan for the near future, all without losing your shit and giving up. Not to mention, grossly underestimating the creativity with which Nature can surprise you.

(The numbering doesn't really matter, but theorem 1 is related to rule 1, and theorem 2 is related to rule 2. Mostly, it was just a way of separating my thoughts.)

<comment><USER9> This is definitely not a response I was expecting, but it's a really good, thought-provoking one. Thanks for that.

I have no doubt I'm grossly underestimating things, but I do think your ideas fit the definition of "simplicity" as I intended--simple being the opposite of complex, rather than easy or effortless.

I find all of the ancillary functions we're forced to perform as part of modern life to be very complex and highly distracting. On any given day I might have to file a tax return, pay a phone bill, argue with a doctor's office over a bill I paid 18 months ago, have my car break down, deal with credit card fraud, receive a dozen spam calls, research and select a new insurance plan, find a new dentist, etc, etc.

I actively take steps to reduce these distractions, but many are pervasive and effectively required. I long for the opportunity to be bored. As another comment said, this is part of what I love about backpacking: it affords the change to be bored with my own thoughts.

And I'm back to romanticizing the ability to focus on a single, simple goal: survive to the next season, with all the uncertainty that brings and mental fortitude it demands.

</comment></comment></comment></comment><comment><USER11> I got to experience some unexpected culture shock earlier this year taking a vacation to SF from a medium-sized city in the midwest (to probably no surprise to you reading this comment). Having forgot my clothes on the trip I got to tour all of SF for a week in cheap business casual clothing I kept on after work, which was an experience. Lovely city but damn, I had a target on my back looking like a basic tourist so I bought some more appropriate clothing and tried my best to fit in. Got home after the trip made me want to take an extra vacation day just to drink cheap beer, stare at the cows, and listen to sports on the radio.

Sorry for the mostly irrelevant story, but what I'm trying to say is I think this is probably a pretty common thing even outside of white collar big city folk culture.

</comment><comment><USER12> I loved this part: Being mediocre is turning down the combat difficulty on Red Dead so you can play through the game. It's a resistance to hyper- optimization; the "courage to be ordinary".

I wholeheartedly agreed with this point as soon as I read it. I adapted this approach while building DarwinMail [1].

There have been countless email & Twitter suggestions for DarwinMail. I've always listened and asked questions until I understood what what the users core message was. However, I do not always implement what has been asked.

I believe in some 'truths' when it comes to building your product while following a basic approach;

1\. Users are the core of any business.

2\. The feedback you receive from users is the most valuable feedback you will receive on your product as they are the ones actually using your product.

3\. You do not have to implement everything your users ask for.

Even though you may not do everything your users ask for, that does not mean you are not listening.

I believe you need to keep your features simple and easy to understand.

Being basic reminds me of the saying 'Slow is smooth and smooth is fast'.

To me that is one of the most important truths when it comes to life and business.

[1] [https://www.DarwinMail.app](https://www.DarwinMail.app)

</comment><comment><USER13> "A person who thinks all the time has nothing to think about except thoughts. So he loses touch with Reality, and lives in a world of illusion." -Alan Watts

</comment><comment><USER14> Whenever I feel this way (and I do feel this way more than I care to admit), it's usually due to mental fatigue from extended periods of mental exertion. I've found that stepping away from high intensity thinking for a few weeks every six months or so helps me reset. A complete "information lobotomy" as the author suggests, may be overcompensation...

</comment><comment><USER15> This is so personal it's beyond reproach, for decency's sake. On the other hand, it could be overwrought romanticism that speaks to nothing but existential crisis.

Who doesn't want to be a farmer, rising at 3am to be alone with your thoughts and hot coffee, tending the fields that feed a nation, while the sun rises, signalling: this is creation; I'm driving the world! The answer is probably: farmers, who would happily say "fuck right off" to 3am starts day after day sucking dust and hoping you can keep your margins, the equipment doesn't break, and the weather holds.

I think the angst of the writing wants to push through to something more than analyzing the pedestrian, but have the ultimate enlightenment being cool with coming back to embrace the pedestrian. Ish.

I'm reminded of a couple story closings:

[1] Siddhartha listened. He was now nothing but a listener, completely concentrated on listening, completely empty, he felt, that he had now finished learning to listen. Often before, he had heard all this, these many voices in the river, today it sounded new. Already, he could no longer tell the many voices apart, not the happy ones from the weeping ones, not the ones of children from those of men, they all belonged together, the lamentation of yearning and the laughter of the knowledgeable one, the scream of rage and the moaning of the dying ones, everything was one, everything was intertwined and connected, entangled a thousand times. And everything together, all voices, all goals, all yearning, all suffering, all pleasure, all that was good and evil, all of this together was the world. All of it together was the flow of events, was the music of life. And when Siddhartha was listening attentively to this river, this song of a thousand voices, when he neither listened to the suffering nor the laughter, when he did not tie his soul to any particular voice and submerged his self into it, but when he heard them all, perceived the whole, the oneness, then the great song of the thousand voices consisted of a single word, which was Om: the perfection.

[2] [https://youtu.be/OsDnrFBpsBk](https://youtu.be/OsDnrFBpsBk)

—-

[1] Siddhartha, Hermann Hesse

[2] A River Runs Through It. Robert Redford/Norman Maclean

</comment><comment><USER16> I definitely see this. There's a brand of clothing for workers that has become fashionable among trendy young people. I see people walking around with a hammer loop who I doubt have ever used a hammer.

</comment><comment><USER17> I really liked this piece. I especially enjoyed the thinking<\--->tan analogy.

"Intellectualism as signal for (possibly ( _likely_!) contagious) unluck" is an unfortunate, but I think real, phenomenon.

</comment><comment><USER18> If this article resonated with me any more strongly, I'd shatter like a wine glass.

I love living on the West Coast and working in tech, and I fully appreciate the many levels of privilege it affords me. Likewise, I've learned a ton and gained countless hours of recreation from Reddit and the other social aggregators. At the same time, there is something unhealthy and unbalanced about it all.

Reddit's never-ending stream of upvoted videos is a machine for showing me the best and worst of humanity. That's enriching and often hilarious. But those best videos often leave me feeling like I can't compete. Why should I practice a little guitar if I'm never going to be as good as that guy playing "While My Guitar Gently Weeps" on a ukelele? The videos of mishaps aren't any better. Anytime a video of someone doing something foolish gets a million views, I get a little more self-conscious.

It reminds me of that traumatic transition in middle school when I first became really aware of social pressure and fitting in. Because I wasn't used to this signal, the gain was really high and I was constantly paralyzed by self-consciousness. The Internet is that times a million, forever.

I used to feel good about my even mediocre accomplishments because I lived in a world where I wasn't constantly surrounded by the world's best X for all possible X. I'd like to get back to that state, but it's really hard to turn off that level of self awareness. Deliberately _choosing_ to be unaware is not the same as actually _being_ unaware. It's another layer on top when the goal is to strip off the inteceding layer. I can't go back to before ironic- detachment post-modernism. The best I can hope for is a "New Sincerity" _post_ -post-modernism, which isn't the same.

The part about degeneracy touches a nerve too. I don't know if I've ever tried to articulate this properly, but today's progressive liberal culture is possibly the most _confining_ culture I've ever lived in. In many ways it feels like a neo-Victorian society where the expectation to follow the norms is high and the price for the slightest transgression is even higher.

The _values_ it adopts are strictly better than Victorian times and many of the places I grew up in the South. Equality for people of all genders, races, ability, orientations, etc. Care for the environment. Intolerance of sexual harrassment or violence of any kind. These are _good values._

But the way progressive culture _enforces_ those values socially is pretty intense. There seems to be little room for human error, personal growth, or misinterpretation. A slip of the tongue can easily summon a career-ending mob on Twitter. (Or, at least, it _seems_ that way.) If I tell a joke, is that a micro-aggression? If I _don 't_ tell a joke, is my seriousness itself another micro-aggression? While the laws are just, the penalties associated with breaking them are Draconian.

Maybe it's _supposed_ to feel this way for me now. I'm straight, male, white, able, and middle class. Perhaps I felt freer in my youth because I was in a position of implicit power where there were fewer consequences if I did or said some dumb shit that hurt someone else. And maybe I have to be more careful now because that power imbalance is being restored.

But as someone who has always strived to not be racist, sexist, homophobic, etc., someone who has always had been sensitive to the discomfort of others and tried to not hurt people, it's kind of a bummer being in a culture that makes me feel even more cautious than I already naturally did. Meanwhile, there's still apparently no shortage of actual fascist, racist, sexual predator asshats out there who clearly couldn't care less about liberal culture.

It feels like we're policing ourselves to the point of madness when we weren't the problem in the first place.

<comment><USER19> > These are good values. But the way progressive culture enforces those values > socially is pretty intense.

I hadn't drawn this delineation before, but I find it apt. I grew up Asian in the Midwest and while I like progressive values here, I do miss how people there tried to be _neighborly_, even if they held opposing values. I was a kid in the suburbs, so maybe I only saw the softer side, but that doesn't stop me from admiring it and hoping to emulate that particular virtue.

<comment><USER18> _> I do miss how people there tried to be _neighborly__

Yes, there's a certain presumption of goodwill that seems to be lacking. I think of it as "tolerance" in the engineering sense — the idea that we each need to give a little more than 50% in an interaction to account for some slippage and human error.

I do believe that micro-aggressions are a real thing, that small-magnitude interactions that are _consistently_ in a negative direction can add up to a large negative effect. But focusing on those makes it hard to gracefully accommodate the normal noise and random error in humanity. If we aren't also tracking the "micro-benefiencies", then it paints everyone who ever makes a mistake (which is all of us) as deliberately malicious.

</comment></comment></comment><comment><USER20> To me, saying someone is "basic" is another way of saying they're living the unexamined life. It's an epithet that probably doesn't apply to anyone 100% and probably everyone at least a little bit

</comment><comment><USER21> It is not the thinking that is the problem, it is the constant need to be productive and for thoughts to have value somehow. There are plenty of people who can think about stuff just for the pleasure of it. I guess living in a hyper competitive place like San Francisco would kill some of that "doing something purely for the joy of it" mentality.

</comment><comment><USER22> Remember, your capacity for innovation can be optimized, but will always be finite. Apply your capacity to where the cost/benefit is optimized.

</comment><comment><USER5> I mentioned this article to my friend Michael who is currently hosting me at his farm in Umbria, and this was his reply:

"Interesting yes, too much of anything dulls the mind, even the best things can jade and wane if overindulged in.

One hour outside tying up tomato vines, weeding or watering balances out 10 trading memes on FB or watching YouTube tutorials, reading about myriad things as long as they are well written.

We need and crave variety, novelty and balance, while the culture nudges us towards monomania, tunnel thinking and hyper-specialisation, narrow casting in the data stream, all trees, no forest. To zoom back out you need to let go of forward motion (or better, our notion of it) and be willing to stop using our will power for a few moments and see what's behind our ego's prideful play for perfection or power.

Basic thinking is a cool concept.

Unwinding complexity, seeking simpler, more elegantly energetic solutions to life's challenges, first to survive then to transform quantity into quality."

<comment> fbi-director Standing at a crossroad in my life right now, your friend Michael has some really insightful quotes. Thank you.

</comment></comment><comment> your-nanny It's this new fangled meaning of basic. I have to accept it as given, but I sort of find it aggravating, maybe because I think of basic as a synonym of foundational or elementary. In the context of mathematics, calling something basic, foundational, or elementary needn't mean simplistic, stupid, or something for young children. People can add and subtract without grasping number theory. But again, just me complaining about you people's neologisms, and how basic is that?

</comment><comment><USER23> I think what we as programmers or more largely knowledge workers miss is doing something which is physical and involves direct contact. Typing away on a computer in a room with dozens of others with the him of white noise is far off from that kind of experience. I like to cook, the experience of touching produce, cutting and cooking is a uniquely human experience. So, yeah get a hobby which allows you to do that. Disconnect and recharge.

</comment><comment><USER24> I equate "basic" as a label to someone I simply find so in-interesting or dull in their personal persists or interests that I'm uncomfortable being around them. Moreso, I'm acknowledging I'm incompatible with them, to me they are "basic" in that I don't seem to stretch my thought process around them. To others they might be interesting, but I'm not going to lie to myself or others.

</comment><comment><USER25> thankfully the shift he points out with tan/work/leisure is happening and everyone now "works" as influencer on social media being the most basic as possible. By the time the author archives his desired basicnes as a status symbol, basicnes will already be repurpose to mean that you toil all day with basic social media influencing.

</comment><comment><USER26> Listen to yourselves. Look at what you're upvoting. Is this community reaching peak arrogance?

It can be rephrased as "We're so fucking smart we need to take steps to dumb ourselves down".

I'm prepared for the downvotes. But come on. Really?

<comment><USER27> That's not what it is about, at all.

It is, perhaps, quite telling that you would reach that conclusion to a post that ponders whether striving to perform your very best every inch of your life really is the utopia.

Being "smart" wasn't even part of the equation yet you somehow ended up there.

<comment><USER28> I'll be honest, I interpreted it the same way.

>a post that ponders whether striving to perform your very best every inch of your life really is the utopia.

I can't read it that way because _it 's not how I operate_. I don't identify as a member of the "front row"[0] even though I am middle to upper middle class. All of the things identified as "mediocre" and implicitly compared against are _normal_ to me.

There's an entire caste of Americans that went to HYPSM+ and got 2300's on their SATs and feel stifled by Bay culture. I think they are supremely out of touch.

[0] [https://www.firstthings.com/article/2019/06/back-row- america](https://www.firstthings.com/article/2019/06/back-row-america)

</comment></comment></comment><comment><USER29> Instead of chasing the latest one-dimensional solution (or anti-solution) to The Good Life, just seek balance. Everyone needs creative space, and everyone needs something in their life that feels truly challenging. But everyone also needs meditative breaks from mental activity, and time spent in nature, and time building relationships, and time doing things that are dumb and fun and useless.

This seems to be a common theme in California (at least, SF and LA): take something good - creativity, progress, art - and fetishize it until it becomes a pathology. The problem is not with any of these things - they're good; great, even! - the problem is with seeing one single dimension of life as The End-All. That is always going to end up being unhealthy, no matter what it is.

<comment><USER30> An ironic trend among some of the Bay Area upper-middle class is taking _balance_ itself and fetishizing it. So instead of meditating for 20 minutes at home, we have 10-day silent Vipassana meditation retreats where you can't talk or touch anything. Instead of walking to the store once in a while to get some exercise, people bike 50 miles in and 50 miles back to work. Instead of having a pet, people raise a menagerie.

Sometimes I think Californians should just own it and admit that this is an extreme place. Even when we do balance, we do it by switching up the obsession weekly.

<comment><USER31> Walking to the store "once in a while" is basically zero exercise. That's an awful example of healthy moderation.

<comment><USER30> All you need is 30 minutes of getting your heart rate up, 5 days a week. If you walk to the store 2-3 times a week, take a hike on the weekends, and jog around the block a few times on the off days, you're there.

</comment></comment></comment></comment><comment><USER32> It seems as if this person is just discovering old fashioned American anti- intellectualism (unintentionally ironically presented in an intellectual wrapper).

There's a reason beyond laziness that many American's look down on typical urban, liberal arts thought and discussion, and it's close to what this post posits: tribalism and in/out group signalling. The difference is that the author sees being "basic" as a signal that one is wealthy enough not to have to work creatively for a living, and the historical practitioners of anti- intellectualism are signalling a disdain for productionless thought.

<comment><USER33> Eh, there's more to it than this. 'Basic' is also the perspective that we're really just animals working to survive. That we're all just dipshits cluttering up the world while we attempt to assemble some kind of respectable way of living. No cynicism here - I feel a real kinship to others when I'm in this mood, rather than caught up in high-mindedness - which can be fun, too, of course.

I think the fact that she terms it 'basic' rather than 'anti-intellectual' makes it less reactionary - a baseline humanity that joins all of us. I think even the term 'American anti-intellectualism' is a misnomer, considering that ancient figures such as Jesus or Buddha were in this vein - preferring terse wisdom to chains of detailed jargon. They spoke in 'basic', in a way.

</comment></comment><comment><USER34> In before there's a picture of a girl with one arm in the air with short pants on butt-facing-camera and a rake in the other arm.

<comment><USER35> Please don't do this here.

</comment></comment><comment><USER36> The desire to avoid the "tan back stigma" of having to think to make money has already been satisfied by snooty literature. Snooty thinking is thinking that requires a smart brain but has no economic value. If you want to show that you're smart, and you also want to show that you don't need to make money, you can produce opinions on 13th century literature or whatever else you like. So, in a sense the author's prophecy has already come to pass.

<comment><USER37> I suspect this take is as snooty as the caricature you are drawing.

<comment><USER38> Accusations of elitism from people who think they're better than everyone else are a weird feature of modern culture. I think it's somehow historically related to Calvinism (the best at being of service are the saved, not the best at being smart, or the best at asking questions.)

It's virtuous not to think too much, it means you aren't wasting time on things other than salvation (or making money.) Just do the obvious thing. Whatever everybody else is doing. Do it harder, though.

<comment><USER36> The worst existential accusation that anyone could levy against the intellectual elite would be that they're engaging in the conspicuous consumption of brain time, especially so given all the fun that's made of "McMansions" and other forms of conspicuous consumption. It's probably not true of everybody, but I wonder how many people would care about whether or not they were philistines if you took away any chance of getting recognized for having good culture.</comment></comment></comment></comment>


Node.js vs jRuby vs Java (Nobody cares about your technology) ... - <AUTHOR> https://github.com/nddrylliog/blog/blob/master/nodejs-vs-jruby.md <comment><USER3> The key piece for me is:

"If you could choose n where your language is n times as slow and you are n times as productive with this language were both true which value of n would you choose?"

It's absolutely true - For me, if I can build an app 5 times quicker than before, and the amount of time involved isn't trivial (i.e. a few hours) then then development time is vastly more important than the end speed of the code.

Execution speed issues can always be solved - it might need more hardware, better coding, or even a complete rewrite, but it's fundamentally something that can be fixed.

That's not to say that your choice of stack and architecture isn't important, it's just that the language itself is only a small part of that decision, and most architectures (and most performance requirements) can be achieved in most languages.

<comment><USER4> This is pretty good advice in an entrepreneurial forum where people are most interested in quickly prototyping an idea for the web, showing it to people and finding where to take it and how to change the idea, getting people to look at it who might throw some cash at it, and so on. You're not concerned about high performance or even really quality engineering yet, all the "soft" stuff is way more important.

I'd question its wisdom for engineering-heavy work.

 _Edit:_ Also, it makes a bit more sense to posit this:

 _If you could choose n where your language is n_ orders of magnitude slower _and you are n times as productive with this language were both true which value of n would you choose?_

<comment><USER3> For engineering-heavy work (I work in telecoms where a fair bit of work goes into reliability), the choice of language is still pretty low in the importance compared to other decisions.

The language can make things easier (and quicker) to do things the right way, but it'll always be possible to do the wrong thing.

</comment></comment></comment><comment><USER5> What exactly is he talking about? I've read it, but got confused...

I've been console game developer for quite some time, and async stuff has always been around for us (but not so network oriented for the stuff I was doing - streaming sound, file I/O, DMA from one cpu to another, etc.)

But If I have to direct it, then precooking your data, so data once loaded only pointer mixup is needed was the basic to get streaming stuff in a game (Spiderman-2, Ultimate Spiderman, Spiderman 3).

Then comes stuff like ability to cancel async jobs, and off course start several at the same time, giving some more info to the underlying code - <USER2> should be done first. I can go on technical details in few pages.

What exactly is he talking about?

<comment><USER6> The whole thing came from "someone responding to node.js fanboys who pretend Node.js is faster at everything". Turns out his response contained a small, but ultimately flawed benchmark, which in turn provoked the reaction of other Node.js people. Some of it happened on Google+ and various blogs.

However, your perspective as a console game developer is highly interesting to me - care to write a bit more about it?

<comment><USER7> Not quite sure I would call people who question trivial benchmarks "fanboys". I would call people who post trivial one-sided benchmarks the fanboys, regardless of the language promoted. IMHO.

</comment></comment></comment><comment><USER8> He should conclude with even more positive statements about developing and discussing good ideas in the context of use, not technology. I miss good discussions about ideas and more abstract concepts that go beyond technical terms and programming languages. Instead everybody is disrupting with his latest YA* that we had a thousand times.

*) KV stores, node.js hating or petting, the next big X, iPhools, Fezbook, little boyz anonymous - we are the rulerz of the world - hacking, "old tool" in a "new language" thing

(OK, I am enerved ...)

</comment><comment><USER9> This guy, it seems, still don't realize that there is no silver VM^Wbullet and never will be, and choosing appropriate tools for each particular task is still absolutely necessary. ^_^

And that clarity, readability and common idioms of a language matters more than its runtime, and that 100k of Java or Javascript code is not the same pile of crap as 100k of Python or Ruby code, assuming that it is not specially obfuscated. ^_^

Fast prototyping that some stacks (VM+frameworks) provide has no correlation with real production environments where you must consider a system in terms of data-flows, content types, separate storage for different types and flows of data, different levels of caching, and so on.

And, of course, in most cases, serving a content from a file on modern FS with help of a little C code is much faster end more efficient than serving the same content with some cool VM involved. ^_^

</comment><comment><USER10> I thunk his point is - he's wasting his breath talkin about it</comment>


Windows Server vulnerability requires immediate attention - <AUTHOR> https://www.cisa.gov/blog/2020/09/18/windows-server-vulnerability-requires-immediate-attention <comment><USER3> This has been posted on /r/sysadmin on Reddit:

[https://www.reddit.com/r/sysadmin/comments/i7yh5d/cve2020147...](https://www.reddit.com/r/sysadmin/comments/i7yh5d/cve20201472_netlogon_elevation_of_privilege/)

Twitter post explaining it:

[https://twitter.com/RyanLNewington/status/129344415164462694...](https://twitter.com/RyanLNewington/status/1293444151644626944)

Blog post explaining it:

[https://www.tenable.com/blog/cve-2020-1472-zerologon- vulnera...](https://www.tenable.com/blog/cve-2020-1472-zerologon- vulnerability-in-netlogon-could-allow-attackers-to-hijack-windows)

POC:

[https://infinitelogins.com/2020/09/15/abusing- cve-2020-1472-...](https://infinitelogins.com/2020/09/15/abusing- cve-2020-1472-zerologon/)

<comment><USER4> Whitepaper for CVE-2020-1472: [https://www.secura.com/pathtoimg.php?id=2055](https://www.secura.com/pathtoimg.php?id=2055) [PDF]

</comment></comment><comment><USER5> As this is a protocol level vulnerability, older versions of Samba were also affected.

Security release announcement is here:

[https://www.samba.org/samba/security/CVE-2020-1472.html](https://www.samba.org/samba/security/CVE-2020-1472.html)

After a previous vulnerability we changed our defaults to require schannel for release 4.8, which protects against the CVE-2020-1472 problem, but admins could turn off this protection to work with older/less secure products.

Further hardening of Samba is currently taking place to protect our users from the bug.

<comment><USER6> Does this mean that any server that uses Samba, windows or not, is vulnerable?

<comment><USER7> Looks like it, there is also a security issue released for Ubuntu: [https://usn.ubuntu.com/4510-1/](https://usn.ubuntu.com/4510-1/)

<comment><USER8> Only if you are running the Samba DC functionality, which is non-default. Also, you would have needed to specifically disable the protection that was added by Samba in 2018.

</comment></comment></comment></comment><comment><USER9> This refers to a vulnerability that was patched in August; any systems that are still unpatched are over a month behind. In general, most security patches (for any software that's in use) are urgent; once a patch is out, some adversaries are going to reverse-engineer the patch to find out what the bug was, and mass-exploit targets that haven't patched. Any server which is that far out of date on its patches is either in need of a sysadmin, or has a sysadmin who's being negligent. There is no excuse.

<comment><USER10> You're missing the biggest reason this is relevant: enterprise IT shops with strict change management processes amd, especially in government, years of austerity budgets cutting resources for both sysadmins and rigorous testing.

Either of the targets you mentioned are more the symptom than the root cause: management setting up bad incentives. If you have a charge management process which takes a month to approve updates, the problem is not the sysadmin. If years of skimping means that the operators are afraid to patch because they'll be punished if it breaks things and they don't have a robust testing process, the problem is not the sysadmin.

<comment><USER11> I feel these organizations that have a process that prevents critical fixes have a broken process... you either have to be ok with having your servers compromised eg data stolen or leaking user data or you have to be ok accepting that sometimes the engineer fixing a bug, adding a new feature might mess something up. I am inclined to believe a bit more to the side of move fast break things is bette than move so slow you get pwned... but sort of a delicate balancing act...

<comment><USER12> I studied IT security quite a lot, and implement Windows patches for dozens of companies. While you are technically right, Microsoft releases broken patches _constantly_. If we pushed out every single patch the moment they were released, we would constantly be down and fighting fires. Most small and mid- sized companies don't have hacking campaigns run against them most times. Given this, it just doesn't make sense to push out every single patch immediately. Microsoft's patches are a whole lot more stable when they're a couple months old.

<comment><USER13> This has been a real problem again in the Windows 10 era. By around 2008, Microsoft seemed to have finally gotten their patch process cleaned up to the point that if you were only taking security patches, they generally installed cleanly and mostly didn't break random things. By about 2016 this has backslid and now Windows 10 seems intent on large scale combined updates and constant servicing stack updates that with undocumented consequences.

It's been a giant pain having spent years trying to get organizations to accept the need and learn to do this stuff reliably only to have the primary source of misery (Microsoft) repeatedly start biting them in the ass again for what should be best practices.

Meanwhile in the same timeframe most BSD and Linux releases have not only gotten their core software updates down to a science, they've also managed to build workflows that can include huge swathes of 3rd party open source and commercial software, which is so hilariously awful on windows that multiple companies build businesses around doing it.

<comment><USER14> > " _This has been a real problem again in the Windows 10 era. By around 2008, > Microsoft seemed to have finally gotten their patch process cleaned up to > the point that if you were only taking security patches, they generally > installed cleanly and mostly didn 't break random things. By about 2016 this > has backslid and now Windows 10 seems intent on large scale combined updates > and constant servicing stack updates that with undocumented consequences._"

Microsoft laid off all their QA staff in 2014, so it's hardly surprising. If anything, it's a wonder that it's not much, much worse than it is now.

</comment></comment></comment></comment></comment></comment><comment><USER15> Here's the description for CVE-2020-1472: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.

[https://portal.msrc.microsoft.com/en-US/security- guidance/ad...](https://portal.msrc.microsoft.com/en-US/security- guidance/advisory/CVE-2020-1472)

<comment><USER16> This is an amazing bug.

So what happens is, you're supposed to fill out a bunch of bytes as proof of who you are, and then a bunch of bytes that represent stuff like seconds since the start of the Unix epoch. If you can't do this, NetLogon figures you aren't really who you say you are.

And the exploit is: Fill everything out with all zeroes. This will succeed one time in 256 on average.

The reason why is complicated and somewhat interesting, but this stupidest possible exploit is what you get at the end of that complicated rationale.

I've written previously on HN that it stands out how _terrible_ Microsoft is at cryptographic design. If there's an opportunity to roll your own and do it badly, in a Microsoft product that's what you should expect. Google has good people (it doesn't _always_ use them, but most often it does) for this stuff, and Apple most often seems to accept that it _doesn 't_ have good people so it'll not roll its own but just use things that already exist; but Microsoft does this over and over.

In this particular case they took AES (seems fine) and an inappropriate but in principle secure cipher mode (CFB8) and then they... fixed the IV as all zeroes even though the definition of CFB is clear that you need to use a random IV.

<comment><USER17> > _This is an amazing bug. They took AES (seems fine) and an inappropriate but > in principle secure cipher mode (CFB8) and then they fixed the IV as all > zeroes_

A bit more detail on what happens next: "So with an all-zero IV and plaintext plus a randomly chosen key, you will end up with an all-zero ciphertext 1 in 256 times on average. [In other words] roughly once in every 256 times the server would randomly concoct a session key for which the correctly-encrypted version of their all-zero ClientChallenge would itself be all zeros."[1] Quoted from a detailed and nicely illustrated article about the bug.

[1] [https://nakedsecurity.sophos.com/2020/09/17/zerologon- hackin...](https://nakedsecurity.sophos.com/2020/09/17/zerologon-hacking- windows-servers-with-a-bunch-of-zeros/)

<comment><USER18> An exploit plus 3 different poor security practices... insane.

</comment></comment></comment></comment><comment><USER19> Script to test vulnerable domain controllers here: [https://github.com/SecuraBV/CVE-2020-1472](https://github.com/SecuraBV/CVE-2020-1472)

</comment><comment><USER20> Microsoft Advisory: [https://portal.msrc.microsoft.com/en-US/security- guidance/ad...](https://portal.msrc.microsoft.com/en-US/security- guidance/advisory/CVE-2020-1472)

MITRE: [https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2020-1472](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2020-1472)

</comment><comment><USER21> There was a patch released last Tuesday, wasn't it?

Not so fun though for those who still are on Server 2008 though. (Yes, that is still a thing unfortunately.)

<comment><USER22> I'm trying to get off! It's not easy! These apps won't run on a later version of Windows Server, they're too old! Tell my boss to give me more budget to get things done properly! :(

<comment><USER23> > Tell my boss to give me more budget to get things done properly

How much would someone get for getting this done?

<comment><USER22> Getting the app upgraded or changed to not need 2008 is the hard part. If the app could run on a later version of Windows, this would be really easy. I'm sure you can appreciate how difficult that might be. For custom apps, it could be a lot of code to update. For vendor apps, that app would also probably need to be upgraded to a newer version because the app is also end of life for some years now. In our case, it's a vendor app. No time and money to fix this situation, so we just keep it running and pray.

</comment></comment></comment></comment><comment><USER24> Exploits for this have been floating on Github for at least a week already. The vulnerability game has become pretty fast paced nowerdays..

</comment><comment><USER25> It I see it correctly, it's about "August 2020 security update" which was published 11 Aug 2020, more than a month ago.

<comment><USER26> Correct. And "government-grade security" isn't a compliment. CISA definitely has some people who want to do the right thing, but they need budgetary control over other agencies to make it happen. (Speaking as someone who worked for the federal government for 15+ years, the most effective means of persuasion would be travel and reserved parking enforcement for Senior Executive Service members.)

CISA also doesn't have authority over DoD or IC systems, let alone the aforementioned budgetary authority to make them do it. No, it doesn't make any sense to apply a lesser standard to systems that are more sensitive. Like I said, government-grade security.

<comment><USER16> The financial sector is also terrible.

During SHA-1 deprecation for example, almost all the trouble was with the financial sector. The way the bogus issuance that led to discovering problem at StartCom / WoSign was detected begins with a financial services company that is desperately trying to get a SHA-1 certificate issued after it's too late and finds WoSign will back date the certificate for some undisclosed amount of money. Even some of the Symantec / Crosscert stuff comes back to the Korean banking and financial sector, (in the district south of the river in Seoul which we'd anglicize "Gangnam" yes that Gangnam...). And lots of "We must have RSA kex" was the financial sector too.

You've probably got a chip card as credit card or debit card, but even though that chip is relatively a technological heavyweight (compared to things like your employee badge that authorises access to the shared office printer, or a public transit card) the crypto in it is... not so hot, and the surrounding infrastructure built by financial companies is awful.

And the chip card doesn't actually secure the thing you care about - <USER2> money - it only secures the thing the issuer cares about, tying your transaction to you. Actual financial transfers are done entirely on a trust basis like it's still the 19th century, the card just presents authorization which is optional.

<comment><USER27> what I find most frustrating is that finance institution buy extremely overpriced and brittle software from renowned vendors not because of technical excellence but for risk management: they want a supplier to blame when something goes wrong.

the problem with this is that nowadays suppliers are stronger in defending themselves from such blames than they are in writing good software.

furthermore, the software being sold is very pricey and the cost of customising it often exceeds the cost of the software itself.

then, 9 times out of 10 the issues lie in the customisations, and that doesn't surprise, as the institution will be using most the custom parts as those are the ones they need most. here the vendors have even more grip in demonstrating that it's the customer requirements' fault, and not their crappy software, that confuses the concepts of "database" and "application server".

I try to counter this by writing solid, robust software using open source components, giving back when possible, perfectly filling the company's requirements, well integrated and reasonably cheap to maintain. slowly, this can help in abandoning vendors and building in-house know-how.

I find this crucial because the quality of software sold by some vendors is very very low, and getting worse.

</comment></comment></comment></comment><comment> gjsman-1000 I've used Linux so much, I initially read the title as "Window (singular) Server Vulnerability...", leading me to wonder what was wrong with Xorg this time...

<comment><USER28> Isn't Xorg technically the Xwindows client?

<comment><USER29> A certain Don Hopkins has written about this:

"We have tried to avoid paragraph-length footnotes in this book, but X has defeated us by switching the meaning of client and server. In all other client/server relationships, the server is the remote machine that runs the application (i.e., the server provides services, such as database service or computational service). For some perverse reason that's better left to the imagination, X insists on calling the program running on the remote machine "the client." "

From:

[http://www.art.net/~hopkins/Don/unix- haters/x-windows/disast...](http://www.art.net/~hopkins/Don/unix- haters/x-windows/disaster.html)

<comment><USER30> Things are complicated when the remote computer calls your desktop. But that's how X works.

That's also why once in a while somebody discover a completely unexpected vulnerability on it that, although simple nobody thought about it before. Things are so non-intuitive that it's hard even to talk about them.

Yet, somehow it works. And works quite well. I imagine the authors of that book are quite annoyed by how Unix evolve to work really well, and still avoided fixing any fundamental problem.

</comment></comment></comment></comment><comment><USER31> How long has this vulnerability been known but kept quiet for use in the NSA's library of exploits? EternalBlue was based on a Windows exploit they knew about but withheld from Microsoft so they could continue to exploit it. That deliberate withholding of information has cost many organizations a lot of money:

[https://www.forbes.com/sites/kalevleetaru/2019/05/25/as- eter...](https://www.forbes.com/sites/kalevleetaru/2019/05/25/as-eternalblue- racks-up-damages-it-reminds-us-there-is-no-such-thing-as-a-safe-cyber-weapon/)

[https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool- balti...](https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool- baltimore.html)

Is this another problem that could have been fixed a long time ago?

<comment><USER32> > Is this another problem that could have been fixed a long time ago?

Yes. The bug was documented in the public documentation, not even hidden in the closed source code.

</comment></comment><comment><USER33> In general, when your OS or system software (Database, Webserver, etc.) vendor releases a patch for an exploitable vulnerability, this requires immediate attention.

<comment><USER34> A patch is a global vulnerability alert.

</comment></comment><comment><USER35> > We have directed agencies to implement the patch across their infrastructure > by Monday, September 21

Actually, they have until Monday.

</comment><comment><USER36> 1472 patched here too [https://blog.0patch.com/](https://blog.0patch.com/) [https://0patch.com/](https://0patch.com/) Great for old systems where updating breaks stuff

</comment><comment><USER37> This is from a month ago, if you patched your DCs in August you are good.

</comment><comment><USER38> Sorry for my ignorance, but do Linux servers have critical vulnerabilities like this, and as frequently?

Edit: thanks for downvoting a serious question.

<comment><USER39> Generally no, for many reasons. I think the most important one here is that in a Windows server there's a lot of software bundled together (AD services, the SMB server, IIS, RPC stuff like this netlogon interface, WMI, RDP, many others) that you can generally expect to find on any Windows server, giving you a wealth of targets and potential ways to exploit how different components interact. A base Linux system has relatively few services (just SSH in simple distributions) so to begin targeting Linux the same way you'd have to decide to go after RHEL or something, narrowing an already tiny share of servers down even further. Other reasons include the dominance of Windows outside the tech industry (which makes it a more interesting and lucrative target for vulnerability researchers and exploit developers), lack of comparable functionality to AD for Linux servers, and probably higher standards for code quality and cryptography in highly scrutinized open source applications like MIT Kerberos.

<comment><USER40> _A base Linux system has relatively few services (just SSH in simple distributions) so to begin targeting Linux the same way you'd have to decide to go after RHEL or something_

Not sure why it shuold be REHL, there are linux counterparts for most bundled software you mention so a comparison against a base linux system + e.g. samba/vnc/nginx/... still seems fair. All of those have had (sometimes severe i.e. root escalation) vulnerabilities in the past, but answering the question whether it's 'as frequent' is pretty hard to answer. I would also guess towards 'no' though.

<comment><USER39> Yeah, there are applications that are very common, but still exploits against them won't be as universally applicable as Windows ones. You're likely to find a Linux server with either Samba or nginx or some VNC software but all at once is less common, and there's a lot of variety with web and VNC servers.

</comment></comment></comment></comment><comment><USER41> Wow, the hospital my wife works at was hit with a ransomware attack today, I wonder if this is the vector the attacker used.

<comment><USER39> If they had a domain controller with ports opened to the internet they would have been hit some other way already (not to mention suffering from constant account lockouts from random brute forcing), so this would probably not be the initial vector. Once the exploits are more polished this will make things easier for ransomware to escalate privileges but they already had effective ways to get to domain admin that work on most networks.

</comment></comment><comment><USER42> They are slow off the mark here

</comment><comment><USER43> Microsoft really can't catch a fucking break this year, can they?

<comment><USER44> Their stock has done mighty fine. Before anyone says if its down now check how much its gone through YTD. I still feel like their stocks highly undervalued considering where their competitors stock is at.</comment></comment>


Twitch will start streaming all of Mister Rogers' Neighborhood May 15 - <AUTHOR> https://www.twitch.tv/misterrogers <comment><AUTHOR> I realize this leans quite heavily on the charitable nature of HN's submission guidelines. However, when I heard about this, and then watched one of their intro videos where they played the iconic opening music I had a wellspring of emotions I wasn't prepared for. I then decided to watch the episode about divorce I was able to find on YouTube. As a child it really helped through my own parents' divorce. As an adult it was fascinating to watch the message play out over the entire episode.

Maybe you too might have some unexpected memories, or maybe you have children of your own you can build new memeories with. No matter what the whole thing should be an interesting experiment.</comment>


Is the SCJP worth taking? - <AUTHOR>

I'm a recent college graduate working a non-technical business job related to IT. I would like to switch careers to become a programmer instead because I enjoy programming more than my current job.<p>My company uses primarily Java + Spring, and pays for people to take the exam. I currently have some experience in writing Java (two programming courses in school). In my case, is the SCJP worth taking? Or am I better off doing something else to learn Java? <comment><USER2> If you use Java at work and your company will pay for the certification and study materials, I would say take it. The exam itself is not very difficult nor does it require a tremendous amount of preparation. It's a checkbox item on a Java resume, but one that can be useful if you find yourself in a tight situation and need a job to pay the bills.</comment>


Ask Peter Norvig Anything - <AUTHOR> http://www.reddit.com/r/programming/comments/auvxf/ask_peter_norvig_anything/ <comment><USER2> I'd be interested to hear his thoughts on Lisp today, considering he was a big Lisp advocate.

<comment><USER3> he answered a quite similar question here: "what do you feel the modern relevance of Lisp and Prolog are in AI".

<http://news.ycombinator.com/item?id=943633>

</comment></comment><comment><USER4> Little bit of a coincidence as I was just reading his Coders At Work interview today. Good read.

</comment><comment><USER5> Man Peter Norvig. When I cracked open his Intro. to AI ed. 2 I was floored. I had (and continue to have) so much fun with his book. Also, his website had this awesome article about implementing abstract classes in python in 0 lines of code.

I wish I could shake his hand.

</comment><comment><USER6> I hope he comments on this blog post: <http://scottaaronson.com/blog/?p=431>

</comment><comment><USER7> After search, what is the most exciting application for machine learning that has not yet been implemented well?

</comment><comment><USER8> I hope that good questions make it to the top; I'm very excited about this interview.

</comment><comment><USER9> This conversation would be much better if it were on this forum.

<comment><USER10> Hmm? The questions so far seem perfectly fine. What are you complaining about?

Plus, now that it's been advertised here, the HN-crowd can ask questions too.</comment></comment>


How Could a $2 Pair of Eyeglasses be Made? - <AUTHOR> http://www.quora.com/What-is-the-process-for-designing-and-finding-the-parts-for-a-physical-product-such-as-eye-glasses-Are-there-firms-that-do-this-or-can-you-crowdsource-the-process?__snids__=26964942

<comment><USER2> Plastic eyeglass frames and a standard lens blank, possibly integrated, should be very inexpensive to build in volume. The primary cost is likely to be in making and possibly in installing the prescription lenses. What is needed is a low cost, field customizable lens.

<comment><AUTHOR> I've found frames on alibaba.com that only cost $0.50. Like you said, the trick is finding prescription lenses that are very cheap, and that could be made to fit a certain frame. Thanks for the comment!</comment></comment>


The Play Framework at LinkedIn - <AUTHOR> http://engineering.linkedin.com/play/play-framework-linkedin <comment><USER4> I used Play! for more than one and half a year and I must say I have mixed feelings about Play! now. Before 3 or 4 years ago, your chances with getting a web application easily in JVM languages was using J2EE ecosystem or Spring framework. But now there are plenty of alternatives. When Play! came out, it has done really a good job, it was working just fine, it was magical and it totally nailed it. But then frameworks evolved around languages like Groovy and Clojure and they nailed it as well. Best move Play! made so far was supporting Scala, because all existing Scala web frameworks were crap (yes I'm talking about Lift).

I used Play in a startup backend and I won't be able to say I was satisfied with it. Play v2 is especially slower on your local development box, compilation takes some time and I actually still like Play 1.2.x family more. Its memory consumption was horrible on production (I made really a lot jvm adjustments and could not get it properly).

Personally, I now like Python frameworks (e.g Flask) and they are much easier, but I am not sure if you should rely your whole service infrastructure or enterprise software on a dynamically typed language stack. There are companies out there achieved this but I think Java or Scala will be just fine for LinkedIn, and by the way why the hack they don't allow comments on their engineering blog?

<comment><USER5> Care to expand on why Lift is crap? (I still have paltry experience with it, but I also still feel it has the best template mechanism out there.)

<comment><USER6> I spent quite a bit of time evaluating Lift for some fairly significant (2 man-year+) projects. My final conclusion is that while it is technically brilliant, and many of the concepts make a lot of sense, it's just very hard come up to speed on and be productive in, especially if you aren't already a Scala wizard. Any Lift project is likely to have a fairly low "bus factor" if you don't already have multiple strong in-house Scala folks.

I had some technical concerns as well - in particular the database connectivity stuff is a bit painful.

<comment><USER5> Hmm.. I'd never heard of the term bus factor. Amusing concept. How do you feel Lift compare with the likes of Play?

I can say that the few small things I pushed out with Lift greatly benefited from the fact that the views were strictly html. To the point that nobody else involved even had to learn scala. Even though they did make some changes to the scala code. Being able to let folks edit that to their hearts content was ridiculously nice. That is, the fact that I did not have to (a) educate everyone on the templating mechanisms or (b) split apart templates received from someone else was huge.

As for the database connectivity, I guess you didn't like the agnostic approach they took?

<comment><USER6> Re: Templating

I can see how that's a factor for some, but since around here I'm also the guy who writes all the HTML it isn't really a factor one way or the other.

Re: Databases

Yea, ActiveRecord tends to spoil one. I don't like any of the Java ORMs nearly as much as AR, or SQLAlchemy for that matter.

Re: Play

I like Play a lot less than Lift. Lift I could see using for a personal project. Play I could not. It's just like Rails but crappyier and with all the java headaches and baggage.

<comment><USER7> > Yea, ActiveRecord tends to spoil one. I don't like any of the Java ORMs > nearly as much as AR, or SQLAlchemy for that matter.

That's a funny thing to say considering the huge difference in philosophy between Active Record and SQLAlchemy.

</comment></comment></comment></comment></comment></comment><comment><USER8> Was excited to check out Linkedin using Play but then the reasons highlighted in the article almost let me down.

I am comparing to Python frameworks and Node and everything mentioned there has been available in the Python stack for a while and now Node (extra points for realtime websockets stuff).

As per the post Play boasts of:

Rapid iteration, Reactive (only for the server not the client), Open, Supported, Flexible, Java & Scala

Maybe I would consider Java & Scala just for the enterprise community scale but definitely not the only one for functional paradigms or rapid iterations.

Everything else is there in other modern web frameworks in Python, Javascript & even perhaps Ruby.

Probably a new thing for Java but why the choice? Is LinkedIn constrained to use the JVM?

<comment><USER9> LinkedIn is primarily a JVM shop. We believe that type-safe languages like Java and Scala are a good choice for building performant and reliable systems that scale to huge numbers of users as well as huge numbers of developers. We aren't constrained to the JVM - for example, we use node.js for our mobile server - but it has significant advantages and we have years of investment in it.

Unfortunately, we found developer productivity in the Java/Scala world to be a huge problem. We also found that most Java/Scala web stacks, based on servlets, were far behind other web frameworks (RoR, Django, etc) in terms of keeping up with the requirements of modern web development. Play helps on both fronts: it dramatically improves developer productivity and handles all the requirements of a modern web stack (MVC, web sockets, powerful routing, easy JSON handling, DRY form handling, etc).

Is it better than RoR, Django, Node? In some ways yes (e.g. Play's reactive programming model is dramatically better than JavaScript's callback mess), in some ways no (e.g. it's hard to compete with dynamic/interpreted languages for pure reload time). Is it better than everything else in the Java/Scala world? We think so.

<comment><USER10> Developer productivity is really broad. Can you elaborate? Most modern webapps I work on end up as json services and the backend are just java pojo services that can be unit and int tested - tdd with java is extremely fast in my experience.

the whole servlets/jsp/jsf thing is dead imo, is that where you guys were losing time?

<comment><USER9> We had Java services that produced JSON, some that used JSPs, and a variety of others. TDD works in some cases, but if you ever wanted to do manual testing - for example, actually _see_ the UI you were working on with real data - <USER2> meant redeploying the server after every change.

Play makes this dramatically faster/easier. TDD is better with Play as well: the plugin support, strong test tools, and sbt's ~test command are amazingly productive.

<comment><USER10> Personally I rarely test all ui because QUnit verifies all frontend code so long as it meets the json contract.

Regardless, thanks for your post, I'll give Play a go!

</comment></comment></comment></comment></comment><comment> j-m-o Awesome. I've been using (playing?) with this framework for a bit over a year now and absolutely love it, I'm glad it's catching on as much as it is. The fact that Heroku and the Cedar stack supported has probably helped user adoption a ton.

I'm actually using Play 2.0.x for my first independent venture, which I posted a Show HN about a few hours ago:

<http://news.ycombinator.com/item?id=5258059>

<http://www.tryringo.com>

</comment><comment><USER11> I like Play, currently using for a personal project. But ultimately looking forward to the day where frameworks are replaced by mixing and matching libraries where you get just what you need and wire it up exactly how you want to without any limitations.

On the JVM and especially since version 2.1 Play is one of the most lightweight/modular frameworks. At it's core it's just a fast/async http server. So why can't that just be a library you pull in and fire up in a main method?

You can have an IDE or somthing like sbt recompile your changes on the fly so you can get rapid feedback. Ultimately more rapid feedback comes for automated tests vs refreshing your browser and verifying something manually (unless it's UI/lookandfeel changes which are not generally limited by having to compile)

<comment><USER12> Those libraries exist. See netty, webbit.

<comment><USER11> Yup. Play is built on top of Netty and adds value so my point is why not build it as a re-usable library (or set of libs) vs a Framework, it's really not any more difficult.

<comment><USER13> I enjoyed the ideas on [http://johannesbrodwall.com/2010/03/08/why-and-how-to- use-je...](http://johannesbrodwall.com/2010/03/08/why-and-how-to-use-jetty-in- mission-critical-production/) for similar reasons.

</comment></comment></comment></comment><comment> brown9-2 How do you do DI with Play? It seems as if everything is oriented towards writing static methods:

\- controller methods are static

\- DB access using the framework seems to involve calling play.db.DB.getDatasource()

\- Play's Cache API involves calling Cache.get(), Cache.set()

Are Play applications easy to write unit tests for? Does it involve reconfiguring the framework to use some sort of stub services rather than the real DB/Cache implementation?

<comment><USER9> Play actually has a really nice plugin system, which we used extensively to integrate Play at LinkedIn. The plugin system offers lightweight support for DI. For example, to use a FooPlugin, you don't use it directly, but ask Play for an instance of it:

FooPlugin foo = Play.current.plugin(FooPlugin.class); foo.doSomething();

What instance you get depends on configuration (typically, a play.plugins file), which makes it easy to swap out implementations at test time. Much of Play's built-in functionality is implemented as a plugin too, including the DB code, so writing unit tests is pretty simple. There is strong support for "fake applications", integration tests, etc: <http://www.playframework.com/documentation/2.1.0/ScalaTest>

We'll blog more about Play plugins in the future.

</comment></comment><comment><USER14> At Pellucid Analytics we're using Play 2.1 with a similar success story to LinkedIn's. The undersold feature IMHO is the asynchronous responses: with the excellent new monadic scala.concurrent.Future interface, you can more easily put together non-blocking web apps with code that looks slick and concise

</comment><comment><USER15> This is definitely a big step towards making Java reputation suck less and increasing the popularity of Scala.

<comment><USER16> Java is a 2nd class citizen for Play and other Typesafe projects like Akka. I think this helps the jvm and scala, but I'm not so sure about java.

<comment><USER17> Java is a first class citizen for Play & Akka.

(I work for Typesafe.)

<comment><USER16> As a user of your stuff, it doesn't feel like it. It's been a few months, but I always felt the Java documentation and samples were lacking compared to Scala. Then again things may have changed.

<comment><USER17> Can you point me to some bugs or examples of this so we can get this fixed? Thanks!

<comment><USER18> Here's one example: ReactiveMongo, the only async db library ,is only for Scala.

<comment><USER19> Is reactivemongo actually tied to play in any way? It seems like it is a completely separate library.

<comment><USER18> It uses Play's iteratee feature. Also integrates seamlessly with play. My point is that, while the Play _team_ might develop for Java and Scala concurrently, the Play _community_ most definitely is Scala first.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Wow, this is actually great news. Play framework looks amazing.

</comment><comment><USER21> Does anyone else feel templating is outdated tech? I feel like these days you can just do this:

\- build json rest backend in whatever (java jaxrs/jersey, nodejs express, etc)

\- build UI with html css js

\- If initial page load is an issue due to lots of ajax calls, then use server side templating to ONLY insert a single variable which would contain a json object. This way the initial load is fast since the json is templated directly into the page. After load the UI calls rest services to get more data.

I've found that this enforces a clean separation of concerns.

</comment><comment><USER22> WE have written lot of code in Play 1.2.X all of a sudden they migrated to Play2.0 without any backward compatibility.This is sad.

WIth Play2.0 they introduced Scala Many folks has the opinion that Scala is complex, and i also lost trust in play because of no backward compatibility and i stuck up with huge code base which is not backward compatible

now iam looking build my other new applications on frameworks like Ruby on Rails , django leaving play.

</comment><comment><USER23> While I don't doubt Play is useful (I haven't personally tried it just yet) I've noticed big tech companies seem to be wasting their time building new frameworks instead of helping improve already existent frameworks in need of new ideas and fresh eyes. Why a new framework? Is it really not a straightforward process to contribute to an already established open source framework for your desired language?

<comment><USER9> Play is an open source project that has been around for a few years. In fact, that's one of the big selling points for us: we're not inventing something new, but using something the community is using, and contributing back to it.

</comment></comment><comment><USER24> What did they use before Play?

<comment><USER25> LinkedIn is scattered. They use a lot of different technologies. It looks like they will only be using Play in a few of the services that they offer.

</comment></comment><comment><USER26> I've embraced Play! on a few projects, and my experiences have been great. There's no need to expand on existing sentiments, but I will say: this tutorial is excellent. Wish I'd had this when I first got started!

<comment><USER27> There's actually a couple of books coming for Play v2.

Play for Java : <http://www.manning.com/leroux/> Play for Scala: <http://www.manning.com/hilton/>

</comment></comment><comment><USER28> Is it just me, or is Google's Play Store also having a greenish triangle (set at the same exact angle) sort of confusing? I've never heard of the Play Framework, is it related?

<comment><USER29> Play predates the Android store rebranding by several years. They're not related.

</comment></comment><comment><USER30> Reading people's comments here make me laugh a little bit. ASP.NET MVC been around a few years now and does that and a lot more in a very easy way and in a great platform. I find it really funny how people get commodity software and dress up as the next big thing.

It's pretty much the same as when Microsoft announced nuget after ruby gems and apt-get existed for so long. Why don't they just cut the bull out and call it for what it is?

<comment><USER31> What should they call it? And for that matter, what is "it"? I'm thinking you probably mean Play, but you might also mean Nugget.

<comment><USER30> Im talking about both. They should put it as a nice tech or whatever but not as something never done before.

"One of the favorite features in Play" is being able to show errors in the browser and not in a log? What year is this? 1995?

<comment><USER27> I work with ASP.Net MVC primarily (since v1), but I think Play framework have a lot to offer in the JVM web development space.

The biggest key selling point for me is the 'hot' reloading: make changes in your code, refresh your browser, and see the changes immediately. You don't need the whole project to be rebuilt. As far as I am aware, this is what makes Play unique. The 'hot' reloading is probably the reason why it's useful to show nicely formatted errors in the browser (during dev / debug mode), you can see immediately where you stuffed up soon after browser refresh. Errors are also pushed to the console.

However, I realise that ASP.Net MVC View templates can be updated during debugging session, I only wish to be able to do the same with the .Net classes without having to rebuild it.

Plus, being on the JVM you'll have plenty of PaaS deployment options for cloud hosting provider (e.g. Google App Engine, Heroku, OpenShift).

<comment><USER30> With ASP.NET if you are in a 32 bit machine (who still is?) you have edit and continue so you can do the same as in Play. AFAIK they are working to bring that to 64 bit machines too.

Don't understand me wrong. I see a lot of value in Play. My only beef is with the "this the awesomest thing you'll ever see" approach to selling it.

</comment></comment></comment></comment></comment><comment><USER32> I have to say I've been wondering for a while what happened to LinkedIn - <USER3> used to be a great service has lately taken to a great deal of UI misbehaviour and dysfunction - to the extent that I'm now relucant to go near it for fear of its hangs, jumping menus, and repeated reloads. Perhaps this has been teething trouble switching frameworks?

</comment><comment><USER33> Is there any support in Intellij or Eclipse for their templating language yet? This has been holding me back from using Play.

<comment><USER34> Yes; IntelliJ 12 has this.

</comment></comment><comment><USER35> I thought LinkedIn was using node? Or was that only ever in their mobile app?

<comment><USER36> That was just the mobile app. It mostly just acted as a gateway to the other backend systems.

</comment></comment><comment><USER37> For me, the good thing about Play is the platform support. Play 2.X is fully supported on Heroku which makes developers to hack something out really quickly.

<comment><USER27> Exactly, and let's not forget OpenShift and Google App Engine :)

</comment></comment><comment><USER38> >Rapid iteration: change the code, refresh the page, and see the change instantly.

I see the play people tout this all the time, and I assume it is in reaction to an assumption of dynamic language people that you have to manually compile every time you make a change. But it is really misleading. You make a change, refresh the page, and wait 10 seconds for it to compile and reload. Iteration speed was just as poor with play as it was with bloated J2EE monsters on jboss.

<comment><USER39> This is mostly due to the Scala compiler being a bit slow. The team at Typesafe is working on that, but if you don't want to wait just buy a decent recent machine with a SSD and you will get back the snappiness you had with Play 1.

<comment><USER40> > This is mostly due to the Scala compiler being a bit slow.

True. Reloading pages on Play 1 (Java) took less than a second. It's about ten seconds now on Play 2 because of Scala.

The move to Scala feels like a mixed bag to me: it added both features and bloat to Play. Play 1 feels so light and fast in comparison.

It seems to me the Play developers moved to Scala more for personal fun than for their users (nothing wrong with that, just making an observation).

<comment><USER41> I wish they had gone with Groovy. Groovy 2.x offers pretty much all the benefits of static compilation and dynamic language features together, it compiles on the fly instantly (being at its heart a dynamic language), and has meta programming features (intercepting it's own compilation and changing the AST, etc.) that would rival Scala's.

There's a project out there somewhere for integrating Groovy with Play but it looks quite immature.

<comment><USER42> When Groovy's author said he prefers Scala ([http://macstrac.blogspot.ro/2009/04/scala-as-long-term- repla...](http://macstrac.blogspot.ro/2009/04/scala-as-long-term-replacement- for.html)) it pretty much sealed the language's fate... though, in all seriousness, there really is _too much language diversity_ on the JVM (how tf would one choose between Groovy, JRuby or JPython? - yeah, you choose the framework not the language, but still, it means that all the good developers are split working on different projects).

<comment><USER43> That statement is misleading. James Strachan left Groovy a long time ago. Guillaume Laforge has lead the project from almost death to one of the most popular languages in use today.

<comment><USER44> Most of the _technical_ work has been done by Jochen Theodorou. Others who have helped _technically_ are Paul King, Cedric Champeau, Alex Tkachman, and Jeremy Rayner. James Strachan also did a lot of _technical_ work on Groovy in his day. I'd rather listen to what someone who's done _technical_ work has to say than someone who shows powerpoint slides.

You mentioned Guillaume Laforge as leading the Groovy project, but from my experience, Graeme Rocher, the Grails Project Manager, seems to have far more say over Groovy's direction.

As for calling Groovy "one of the most popular languages in use today", it figures fairly low in most popularity ratings (e.g. not in Tiobe's top 50), and only shows the occasional burst when it's been actively talked up, e.g. just before a conference when the project managers are selling conference seats.</comment></comment></comment></comment></comment></comment></comment>