Show HN: React for Beginners - <AUTHOR> https://reactforbeginners.com/ <comment><AUTHOR> Thanks everyone - this kind support means a ton to me.

Is it okay to post coupons on here?

<comment><AUTHOR> Ok! Use the code LAUNCHDAY for an extra $10 off today's price. Enjoy!

<comment><USER2> Hi Wes,

FYI, when I applied the coupon and it registered the reduction to $49 (Masters Package) in the field, but was charged $59 at checkout.

<comment><AUTHOR> Shoot me an email and I'll get it all fixed up - firstname.lastname@example.com

<comment><USER2> Thanks much for the quick reply Wes! You're the best!

</comment></comment></comment></comment></comment><comment><USER3> Interesting package but I'm curious about the choice of Firebase. Seems like Firebase's data binding model is antithetical to the patterns React encourages (unidirectional flow/Flux).

</comment><comment><USER4> Without being an ass or criticizing the course (which seems very cool) I find it very strange that an experienced Javascript programmer would have a hard time learning React. Not that I am some master in it, but I've learned the basics on the official tutorial and some bits here and there over the internet and tweaking with it.

Also I don't think a begginer course will make everybody a master on the topic.

<comment><USER5> The website is called React for Beginners, not React for Experienced Javascript programmers.

And aside from that, react is very different from what a lot of experienced javascript developers may have worked with. My team works with CanJs, it would be a big leap to go from that to React, experience be damned.

</comment></comment><comment><USER6> This looks great - producing a video course like this is very different from writing a book. Did you find the transition difficult?

Thanks for the additional discount!

<comment><AUTHOR> I much prefer video over writing - that said this videos series took about 200 hours of work start-to-finish. Lots of work, but I absolutely love it.

</comment></comment><comment><USER7> Thank you for making this. I've been bouncing between Udemy, random blog posts and official docs for over a month now. This looks perfect.

</comment><comment><USER8> Should probably use Webpack instead of Gulp + Browserify.

<comment><USER4> Webpack is awful.

<comment><USER9> Why?

</comment></comment></comment><comment><USER10> Anything like this involving redux?

<comment><USER11> [http://teropa.info/blog/2015/09/10/full-stack-redux- tutorial...](http://teropa.info/blog/2015/09/10/full-stack-redux- tutorial.html)

<comment><USER10> This is great. Thanks!

</comment></comment></comment><comment><USER12> Very cool... Happy to support this type of project, signed up for the master package. Will finally dip in and check out React.

</comment><comment><USER13> I didn't see anything about automated testing? Is that covered in the course?

</comment><comment><USER14> What does one actually build with this course?

I have some experience with building a small React app but I can't determine from your site whether or not this course will refine my skills at all.

<comment><USER5> Straight from the website:

"Together, we will build "Catch of the Day" — a real-time app for a trendy seafood market where price and quantity available are variable and can change at a moments notice. We will build a menu, an order form, and an inventory management area where authorized users can immediately update product details."

Did you even read it?

</comment></comment><comment><USER15> This looks great, I'll buy. +1 for Redux coverage (I'm sure it ridiculously difficult to keep any kind of React learning material up-to-date!)

<comment><USER16> I don't think there's any Redux coverage in this course

Here's the quote from the site:

 _Does this video series cover Flux? Redux? Fluxible? Reflux? Alt? Flummox? Marty.js? McFly? Lux? Material Flux? Nuclear.js? Fluxette? Flipity Flop? Fluppity Floop?

React is amazing in that there are many libraries that work really well with it. While those libraries are fantastic, they may add unnecessary abstractions when learning.

So, this course is focused on you absolutely nailing React and walking away feeling confident in your understanding, hungry to learn and build more._

</comment></comment><comment><USER17> Great. I've been working through the pluralsight react courses but I liked your Sublime stuff and am excited to give this course a look!

</comment><comment><USER18> I see a lot about reactjs. Am I able to built a multi state SPA with it? If so would this course be enough to get me started?

</comment><comment><USER19> I'm trying to buy the Master Package now.. but I can't find the buy link.

EDIT: Can't buy when using Safari so I used FF

</comment><comment><USER20> Thanks for making this! Just signed up for the master package, can't wait to start watching the videos. <3

</comment><comment><USER21> I thought the guy in the picture was Ewan McGregor! What is this course using for the backend?

<comment><AUTHOR> Ahah - everyone says that.

The backend for this course is Firebase. It's all done client side and Firebase handles the authentication and data handling!

<comment><USER21> Just bought the course, I'm pumped! I want to really grok React to use in my Meteor apps.

<comment><USER19> How did you buy it? No links on the page..

EDIT: Doesn't work in Safari on Mac

</comment></comment></comment></comment><comment><USER22> Sold! I have been looking for something like this for a long time. Thanks!

</comment><comment><USER23> Does it include React Native too?

<comment><USER24> Do you honestly think it would include React Native videos without mentioning it on the site?. If you sell something you squeeze all the features</comment></comment>


Which one will execute faster, if(flag==0) or if(0==flag)? - <AUTHOR> http://stackoverflow.com/questions/4624536/which-one-will-execute-faster-ifflag-0-or-if0-flag

<comment><USER2> The real correct answer: if it matters, you're already doing something wrong.

<comment><USER3> No. If it matters you have a job involving oses or control systems or game engines and shouldn't be asking on stackoverflow.

<comment><USER4> Even though most questions are about gluing GUI libraries to databases, that doesn't mean questions about OS or game engines are disallowed.

<comment><USER5> I think the implication was that if you are programming at that level then you shouldn't be asking beginner questions (instead of just testing yourself).

</comment></comment></comment></comment><comment><USER6> The first thing that comes to my mind when someone asks such questions (quite often seen in IRC channels), is: _"Well, why don't you time both versions and actually measure which is faster?"_

Also, premature optimisation is the root of all evil ;-)

There is also an aesthetical side to it. Personally I find constructs like 'if (6.28 < theta) {...}' unpleasant to read. They look like thoughts turned inside out.

<comment><USER7> I use them conventionally -- it helps me avoid bugs like 'if(foo = 3)' instead of 'if(foo == 3)'. 'if(3 = foo)' just will not compile. The 'if(6.28 < theta)' is just a logical consequence.

<comment><USER6> My C/C++ compiler will give a warning on 'if (foo=3)'.

Python will throw a SyntaxError on 'if foo = 3:'.

</comment></comment></comment><comment><USER8> Depends on the language, interpreter, vm, processor, and compiler and their relevant individual optimization settings.

</comment><comment><USER9> Code like Yoda, you must not.

<comment><USER10> The if(0==flag) is perfectly valid for avoiding if(flag=0) bugs.

Of course, I'd use if(!flag)

<comment><USER11> Any modern should not allow 'if(flag=0)'.

Any non-modern language should flag a warning on that. And this warning should be set to be an error by any reasonable developer.

<comment><USER4> What about while? while(flag = 0) looks like a similar error, but while(foo = read()) is a common idiom.

<comment><USER12> I think some compilers give a warning on while(foo = read()) but not on while((foo = read())).

<comment><USER13> That would be a broken compiler.

<comment><USER14> No, I'm pretty sure that's _intentional_ specifically to permit that idiom.

<comment><USER5> It's usually a warning that you have to turn on explicitly, or one that you can at least turn off (thank heavens).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> The correct answer is your debugger.

</comment><comment><USER16> Faster is not even the most relevant reason why one should (and would) choose 0 == flag.

 _edit_ <http://news.ycombinator.com/item?id=2082165> hit on it perfectly.

<comment><USER17> It's still hard to read.

<comment><USER18> Not when you get used to it.

<comment><USER17> That's what they said about Lisp and Perl.

<comment><USER19> I can't tell whether you're just being tongue-in-cheek, or perfectly serious. I hope the former.

<comment><USER17> Little of both, really. I actually think Lisp is beautiful, although it can be difficult to read. As for Perl...

<http://www.foo.be/docs/tpj/issues/vol3_2/tpj0302-0012.html>

No excuse.

<comment><USER20> I don't think you're supposed to be able to get used to obfuscated anything. By that metric, C is equally unreadable: <http://ioccc.org/>

I've seen very readable perl code, although I won't use that to make sweeping generalizations about the entire language.

<comment><USER17> To be fair, I never said C was pretty. I have no real problem with Perl aside from its overabundance of punctuation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> I would say pretty much they'll be the same, but as always it depends on what get the compiler ends up generating. Likely it'll be something like:

mov ax,0x####

mov bx,0000

cmp ax, bx

je equal

I say same cause the order of the data moves into the registers shouldn't matter in terms of perf. I 'guess' If you happen to see a minimal difference it would be because an interrupt happened in the middle of the execution,or there's some funky compiler optimization for one of the cases or if...

ALL GLORY TO THE HYPNOTOAD.

</comment><comment><USER22> I'll stick with my answer to a highly relevant related question on SO: [http://stackoverflow.com/questions/767821/is-else-if- faster-...](http://stackoverflow.com/questions/767821/is-else-if-faster-than- switch-case/#767877)

</comment><comment><USER23> depends on number of machine instructions they generate.

<comment><USER2> Not true in the general case. On some architectures, some instructions take longer than others.</comment></comment>


The Simple Essence of Automatic Differentiation [pdf] - <AUTHOR> http://conal.net/papers/essence-of-ad/essence-of-ad-icfp.pdf <comment><USER2> There's more information here:

[https://github.com/conal/talk-2018-essence-of- ad](https://github.com/conal/talk-2018-essence-of-ad)

That said, has anyone had a look at the paper? What I can't figure out is the assertion that, "In contrast to commonly used RAD implementations, the algorithms defined here involve no graphs, tapes, variables, partial derivatives, or mutation. They are inherently parallel-friendly, correct by construction, and usable directly from an existing programming language with no need for new data types or programming style, thanks to use of an AD- agnostic compiler plugin." That would be fantastic, but that's not immediately obvious to me. Generally, reverse mode is extremely non-parallel friendly because we're essentially traversing a computation graph. That traversal can be done in parallel, but figuring out how to partition that graph is probably more expensive that traversing it in serial. Now, the paper makes a big deal about not building that graph and passing along the derivative at the same time as the function. Fine. But does that method really produce a more parallel friendly code and is that as efficient as a more traditional graph or tape based method? Unless I'm missing something, I don't see any benchmarks of the method and what would be really helpful would be a ratio of the run time of a routine versus the run time of the routine with the AD method instrumented and the gradient calculated. The big question is how does this ratio hold as the method is scaled up in terms of variables. If the parallel claim holds true, then we should be able to also calculate the resulting parallel efficiencies.

Anyway, I'm genuinely curious if someone has additional information about the computational viability.

<comment><USER3> I can't tell because I don't speak category theory, but I've been told the essence is similar to how I've implemented the neural networks for spaCy: [https://github.com/explosion/thinc](https://github.com/explosion/thinc)

If so, then it definitely works fine. On the other hand I don't think parallelism is so easy to achieve, so maybe it's not the same thing after all.

<comment><USER4> My understanding is also that it is. Your implementation drove the point home for me that it can be practical.

The dictionary is rather simple

\- a lambda \x . f(x) is known as an "internal hom object"

\- you get a closure by using the partial application morphism (see [https://en.wikipedia.org/wiki/Cartesian_closed_category](https://en.wikipedia.org/wiki/Cartesian_closed_category))

\- copying a variable is known as Δ : x ↦ (x,x)

\- there is a contravariant functor T^\star: X → T^\star X between a manifold X and its cotangent space, which maps f: X → Y to its adjoint f^\star: T^\star Y → T^\star X

\- you can then consider the product of the category of smooth manifolds Man × Man^{op} and define a functor Man → Man × Man^{op}, which maps a manifold X to the product of manifolds (X,T^\star X) and a morphism f : X → Y to the morphism (f,f^\star).

\- All you have to do to get from your implementation to the notions in the paper is to convert the prescription you give into a point free style and apply some jargon (You need things like the partial application map and evaluation map, which are defined in any closed cartesian category, but easily translate to programming languages as well)

</comment></comment></comment><comment><AUTHOR> This paper won a best paper award at ICFP 2018. Conal Elliott recently gave a longer talk about it at Microsoft Research: [https://www.youtube.com/watch?v=ne99laPUxN4](https://www.youtube.com/watch?v=ne99laPUxN4)

<comment><USER5> Someone introduced me to Conal's work a few days ago and recommended I watch his "Compiling to Categories" talk which I hadn't seen, and it just so happened that I watched it earlier today before this talk/paper posted. After viewing both for the first time today and reviewing the corresponding papers, one thing jumps out that's certain, and you can see it crystal clear. Conal is brilliant. And I don't say that lightly. The clarity of his work and his perspective on the problems is pristine. It's rare when someone is able to cut through the noise and peer into to the essence because there's no map and it's so hard to achieve the level of clarity that allows you to see the path that breaks through, but somehow he found the insight and nailed it. Damn, well done!

</comment></comment><comment><USER6> To state it more clearly than some of the other comments, part of the code insight this paper provides is the following:

Subject to transformation of your program into the first order / categorical representation, reverse mode auto differentiation is simply about

1) transforming the program into the continuation passing style category (this "flips" the shape of the compose operation in the category of our program)

2) do the same calculation / transform as you'd do for forward mode. Aka the really simple derivative calc we learn in high school.

There's an extra trick to be done to make things even better, but that's the meat of it. That reverse mode becomes (almost) as simple as forward mode to implement. Subject to your language being in this sort of categorical first order representation :)

Reverse mode being simple by any name to explain is a huge innovation alone.

<comment><USER7> Does this mean that any research into optimizing the performance of languages supporting continuations could improve RAD performance in other systems like PyTorch?

(Sorry if naive question, but your comment was very helpful to see the connection)

<comment><USER6> Compiling with continuations is a very well understood topic. ("Compiling with continuations" is also a book on the very same topic, that's 25 years old now? )

It's a compiler technique. So it can be used anywhere compilers are.

</comment></comment></comment><comment><USER8> The title seems pretty cool!

Could anyone care to tell me if there is a motivation to learn this topic for ordinary ML enginneer such as myself. It seems these ideas presented in this paper are really helpful for those who develop DL frameworks like pytorch, but what about for those who only use frameworks?

However, regardless of how useful these ideas for me, I really respect researchers who publish excellent papers.

<comment><AUTHOR> AD is important to understand for ML practitioners in the same way as compilers are important to understand for programmers. You can get away without knowing all the details, but it helps to understand where your gradients come from. However this paper is probably not be a good place to start if you're new to AD. If you want a better introduction, here are a few good resources:

Autodidact is a pedagogical implementation of AD: [https://github.com/mattjj/autodidact](https://github.com/mattjj/autodidact)

A nice literature review from JMLR: [http://www.jmlr.org/papers/volume18/17-468/17-468.pdf](http://www.jmlr.org/papers/volume18/17-468/17-468.pdf)

This paper reinterprets AD through the lens of category theory, an abstraction for modeling a wide class of problems in math and CS. It provides a language to describe these problems in a simple and powerful way, and is the foundation for a lot of work in functional programming (if you're interested in that kind of stuff). There was a thread on HN recently that discusses why category theory is useful: [https://news.ycombinator.com/item?id=18267536](https://news.ycombinator.com/item?id=18267536)

"Category Theory for the Working Hacker" by Philip Wadler is a great talk if you're interested in learning more: [https://www.youtube.com/watch?v=gui_SE8rJUM](https://www.youtube.com/watch?v=gui_SE8rJUM)

Also recommend checking out Bartosz Milewski's "Category Theory for Programmers": [https://github.com/hmemcpy/milewski-ctfp- pdf](https://github.com/hmemcpy/milewski-ctfp-pdf)

</comment></comment><comment><USER9> Cf. "Compiling to categories" [http://conal.net/papers/compiling-to- categories/](http://conal.net/papers/compiling-to-categories/)

Also [http://www.autodiff.org/](http://www.autodiff.org/)

</comment><comment><USER10> To see automatic differentiation in use in an entirely different field, check out page 81 (PDF page 95) of Stephan Schlamminger's dissertation.

[http://www.schlammi.com/pdf/diss.pdf](http://www.schlammi.com/pdf/diss.pdf)

This radically simplified an extremely difficult calculation necessary for a measurement of Newton's gravitational constant. It is the only time I've ever seen automatic differentiation in use in physics.

</comment><comment><USER11> >> Machine learning and other gradient-based optimization problems

Machihe learning is not a "gradient-based optimisation problem". Gradient optimisation is a machine learning technique. There are many others that involve no differentiation whatsoever.

What is going on here? Every few weeks I hear someone talking about machine learning, or AI, etc, who clearly has no idea what they're talking about, even if they do undestand maths and computer science, like the paper above. Where do people get this confidence from, that they know all they need to know about a field that is probably older than themselves?</comment>


Study reveals that 1 in 10 Americans think that HTML is an STD - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tn-1-10-americans-html-std-study-finds-20140304,0,1188415.story#ixzz2v4HRdE4Y

<comment><AUTHOR> \- The study involved 2,392 men and women 18 years of age or older. The participants were not told that the study was specifically looking into their knowledge of tech terms.

\- The study was conducted by Vouchercloud.net, a coupons website, as a way to determine how knowledgeable users are when it comes to tech terms.

</comment><comment><USER2> It's the lingua franca of the Web.</comment>


0x00: What are you learning this week? - <AUTHOR> Dear Hacker News,
Put up things you are learning this week and help the community grow. <comment><USER2> Data warehousing. Never did anything like it before so I'm curious to how this will play out.

</comment><comment><USER3> Pagination with Vue and Laravel. I vaguely know how it works, but I've never implemented it before. I'm a front end dev so I'll have to coordinate with the backend folks.

</comment><comment><USER4> Automatic Lamdba rotation of RDS creds stored in aws secret manager. And then terraforming it.

</comment><comment><USER5> Strengthening my very basic C# skills

</comment><comment><USER6> I heard good things about Flutter from a couple of friends so I'm going to take it for a spin.

</comment><comment><USER7> Haskell, mainly to work on GUIs.

Also, continuing to learn Ansible.

</comment><comment><USER8> Learning about gnu taler and gnunet.

</comment><comment><USER9> Marketing. In general!

</comment><comment><USER10> Godot tutorials.</comment>


Ask HN: Why does my game suck? Why will it fail, and is there anything I can do? - <AUTHOR> I'm a programmer, recently I have been working on implementing video and audio streaming algorithms which inspired a potential idea for a new game. A live EDM music festival simulator.
Basically what you have is a screen with hundreds of people all connected with their webcams, at the same time. You can move anywhere on the screen, and chat with other people.
There are three music stages playing at the same time in the game.
You can see hundreds of people simultaneously dance on their webcams live and chat and meet new people. Which sounds fun to me.
DJ stage sets can be pre-recorded, or I can even map live DJ sets.
In the app, you can create a friendship bracelet (called Kandi) and give the bracelet to other players. There is a Kandi editor. You can only give 1 Kandi bracelet to each other player, and the goal of the game (or score) is to collect Kandi bracelets.
However I have proposed the idea with different groups, and all three groups don't really like the idea. They don't see it as a game they would use, and do not seem to have any interest.
I have already found that because the streamed webcam is small (only 64 by 64 pixels) I can successfully stream 200 webcams simultaneously with no issues in any modern web browser. There are no technical issues, I have successfully implemented using getUserMedia a library which encodes streaming information via WebSocket to my own server which can mix the multi-source camera steam into a multi-destination stream.
I'm wondering is there something I'm missing why this game idea will fail? Do you have any words of advice or suggestions on what would make this game successful? <comment><USER2> Interesting idea. Maybe there are upper limits on how many of those 200 dancing figures anyone can keep track off before they feel there is too much going on on screen - you will have to do some research - [http://jov.arvojournals.org/article.aspx?articleid=2121950](http://jov.arvojournals.org/article.aspx?articleid=2121950)

You can retry where "players" just see a smaller group say 4,8 etc and see if the feedback is better.

</comment><comment><AUTHOR> The app would look similar to [https://imgur.com/a/41oAc60](https://imgur.com/a/41oAc60) :)</comment>


Show HN: DeathSwitch - <AUTHOR> http://deathswitch.com/ <comment><USER2> You've got to be kidding me.

Despite the policy difficulties of running a site like this (when is someone dead?, how long until release of secrets?, how to deal with lack of access to emails? etc), This site is completely insecure.

[https://www.deathswitch.com/members/myaccount.php](https://www.deathswitch.com/members/myaccount.php) is vulnerable to a CSRF hijack through the update email page. This literally took 20 seconds to find...who knows what would happen if I dedicated an entire minute.

In fact, there are no CSRF tokens on the entire site at all. There are big problems in these services and the policies that run them. Technical solutions might not be the best to use here. Perhaps a legal solution is the best route...

edit: I gave it 20 more seconds. Stored XSS. If I paid the money for premium service which allows file upload I'll bet I can RCE too. This is just not the type of person I want protecting my secrets.

<comment><USER3> Can I ask how you identify issues like this so quickly? I'm an infosec student, and I'd love to hear what your thought process is when briefly looking over the security of a certain website.

<comment><USER2> I've got a lot of practice breaking things. CSRF can be identified really fast by checking for unique tokens. Some unguessable token should be submitted with each state changing request. If not, attackers can steal authenticated accounts by making a request to the "change PW" or "change email" URLs. It's a little confusing at first.

XSS I just set JavaScript as something that shows up in a field on a different page. The RCE I mentioned is just uploading a PHP file for the "file upload" feature associated with messages. If he puts the uploaded file within the webroot (and the file is php since his whole site is php) then the file will be executed when you go to its URL

Web app security is something that infosec professors don't talk about at all (in my experience). I had to teach myself but OWASP is very good to get started. It also helps to write a lot of software as well since you'll tend to find pitfalls of doing things wrong

edit: If you would like to see more of the technical how-tos behind CSRF check this link out. It is a blog I wrote about CSRF and how one would actually attack someone with it. [http://ejj.io/csrf-password- bruteforce/](http://ejj.io/csrf-password-bruteforce/)

<comment><USER3> Hey, I appreciate the response. BTW, I tried to follow you on Twitter via your website link but it said user doesn't exist anymore. :-/

<comment><USER2> It's actually twitter.com/steakejjs. I just changed it last night actually independent of reading this.

Cheers

</comment></comment></comment></comment></comment><comment><USER4> Hey, just as a funny side note, I implemented this on this very domain back in the early 2000s. Gald to see someone else is using the domain this way :-)

<comment><USER5> This is of course the main problem with this type of idea. It is very likely that I will live longer than this site will, therefore it doesn't make sense to use it.

What did you do with the people who had signed up for you site?

<comment><USER6> I share your fears about its longevity.

What company would you trust to launch and maintain this kind of service?

I feel like WordPress.org or Wikipedia Foundation would be two companies with the right moral compass, funding and longevity who would be great backers of something like this.

<comment><USER7> The Internet Archive.

<comment><USER6> Boom. Perfect example.

</comment></comment></comment></comment></comment><comment><USER8> The big issue - as has been mentioned - is how do we know this service will be there when we need it.

The answer is it needs to be tied to some infrastructure that's reliable and already has access to this data.

And yes, paying $2/mo for this is nonsensical for someone relatively young. This is a problem without a solution, but this is also not a solution. To be frank, the odds that this domain even resolves this time in 2015 are pretty low.

This alone does not warrant a service. This should be a piece in a bigger puzzle - a small part of a bigger suite of life contingency services.

<comment><USER9> Check this out: [http://web.archive.org/web/20070823004521/http://www.deathsw...](http://web.archive.org/web/20070823004521/http://www.deathswitch.com/)

Surprised me too.

</comment></comment><comment><USER10> Meh. Do what I did; write your 1Password down on a bit of paper, hand-make a wax seal, put the paper in an envelope, seal with wax, give envelope to friend. :-)

(If a critical password changes - e.g. Dropbox, which actually contains my 1Password file - that password is encrypted, sent via email, I tell him the password via some other means (usually involving some sort of puzzle just to keep life interesting), he decrypts it and writes it on the envelope.)

And yes, suffice to say I trust my friend absolutely.

</comment><comment><USER11> I think it's an interesting view into how we think about our lives that the first scenario listed is about work data and coworkers, not loved ones or personal data:

"Imagine that you die with computer passwords in your head, leaving coworkers without access to critical files."

I enjoy my job, and my coworkers are great people, but when thinking about things as serious as planning for post-mortem, I'll admit that thinking about how it would affect my employer ranks much lower on the list.

<comment><USER12> I kinda agree, on my deathbed I doubt I'll be thinking about work passwords!

I can't really think of much of anything work-related that should be a secret known by only one person and released upon death. I feel like part of my job is ensuring that at least one other person knows how to access our accounts. We actually use an encrypted password manager to which at least two of us have access.

</comment></comment><comment><USER13> Anyone who's interested in an idea like this might want to see if Google's Inactive Account Manager is right for them. (Disclaimer: I work for YouTube, which is part of Google.)

It triggers if you don't sign in to a Google Account for X months, where you choose X from 3, 6, 9, 12, 15, or 18.

You can provide up to 10 contacts (email addresses, phone numbers, and custom messages) for people whom you want to be notified once the timer expires. You can also grant them access to the data from your Google Account; they'll need both the link in the email as well as a code from an SMS sent to the phone number you provided for them.

You can also choose whether you want your account to be deleted if the Inactive Account Manager triggers.

</comment><comment><USER6> Posted this in another thread but what company would you trust to launch and maintain this kind of service?

You need to know that when you kick the bucket in 10, 20, 30, 40, 50 years etc that the switch is actually going to work.

You need a company with the right moral compass; funding to pay for hosting, maintenance etc; and the longevity to keep going for the next 100 years.

Companies on the "maybe" list for me include Wikipedia, WordPress and maybe Evernote...

Internet Archive might be the best option if they can sustain their funding / longevity.

<comment><USER14> > Posted this in another thread but what company would you trust to launch and > maintain this kind of service?

A law firm. That is the "correct" answer to this problem and is what people actually use.

<comment><USER15> What about life insurance companies? It could be offered as an "addon" service.

<comment><USER14> That's a pretty good idea.

But in reality, they probably wouldn't make enough money from this for it to be worth the trouble to them.

</comment></comment></comment></comment><comment><USER11> I'm a bit concerned how little they talk about security of this data. At one point they suggest using "codes" to obscure messages:

"For example, you can design your message to contain privately shared codes ("my password is a combination of the street where we grew up and the first name of your mother-in-law")"

This would only really add security against a very small threat, if they were properly encrypting data at rest: attackers taking over one of the email addresses on the recipient list. And I'll not even dive into how bad it is to base passwords on this kind of personal info.

Is anyone aware of more details on what they're doing to secure this data?

</comment><comment><USER16> Feedback:

> from your after you're gone

from you after you're gone

Create a favicon. It's still showing the BlueHost icon.

</comment><comment><USER17> Interesting idea. I think my father might be interested. Every time he flies on a plane (not often), he lets me know where various financial information is and the passwords to get at it.

The pricing seems really strange to me. Wouldn't only messages be sent when someone is dead or severly disabled? A model similar to life insurance makes more sense to me where the customer pays a small amount of money on a yearly basis. And there wouldn't be a free tier except for maybe a trial.

<comment><USER18> So your father and also I would be interested. But I really doubt a service like that would last given the current startups scene we have now. It must be rock solid. Fully dependable. It's life-and-death business here. I'd pay a good amount for this kind of solution.

<comment><USER19> It would need to operate much like "perpetual care" at cemeteries. Fees for the services go into an irrevocable trust that runs much like an endowment -- costs are kept below the ongoing interest income of the account.

As I understand it, these are rather tightly regulated in many states for the same reason you're asking this service to be dependable.

</comment></comment></comment><comment><USER20> Without debating the merits or otherwise of this service, it's worth using it as a reminder to spend a little bit of time and not much money and ensure you and your loved ones have a legal Will.

Your wishes are important after you die (and statistically, we're all likely to die). It's well worth recording them, even if you feel you don't have much in the way of assets to pass on.

<comment><USER21> Agreed. I'm unclear what this service provides that a Will doesn't, and in addition a Will both more reliable and legally binding.

</comment></comment><comment><USER22> Kinda weird you've implemented SSL/TLS everywhere except the home page. Surely that's not a deliberate omission?

Also, as much as I hate to be a pedant, spelling mistakes/missing words on the homepage look sloppy:

"The people in your life will feel better knowing they can expect an email from your after you're gone."

"you canlog back"

</comment><comment><USER23> TYPO under the heading, 'Information Insurance:'

With no reply, the computer deduces you are dead or critically ___diabled,_ __and your pre-scripted messages are automatically emailed to the individuals you designated.

Change 'diabled' to 'disabled'

</comment><comment><USER24> Wonder if their private plans for monetization involve blackmailing the bereaved relatives of the recently deceased. Roald Dahl wrote a story about this (one of his short stories for adults, not his children's stories), "the Bookseller".

</comment><comment><USER25> How long does the system send out: "Are you alive?" messages before it sends out the logged message? What if a family needs more immediate access to the data?

</comment><comment><USER26> Props for hosting Eagleman's shortstory [http://deathswitch.com/deathswitch.pdf](http://deathswitch.com/deathswitch.pdf)

</comment><comment><USER27> There was also this site from 6 years ago: [http://www.deadmansswitch.net/](http://www.deadmansswitch.net/)

</comment><comment><USER28> How do I ensure that they'll remain when I expire?

</comment><comment><USER29> Hello,

I think there is a need for this type of service. Two comments:

* People might be concerned that this website will shut down long before they pass away. On the homepage I suggest you GUARANTEE that emails will be sent.

* I am 34. I don't want to pay $1.67 every month for the rest of my life. Make it an easy purchase decision: one time fee of $40. For example.

<comment><USER30> I think everyone else's criticism of this idea is that it can't really be guaranteed, can it?

</comment></comment><comment><USER31> So this is the new cloud based service that should be trusted with all our secrets?

</comment><comment><USER32> sidenote, i just showed this to a friend and his response was

"Be a great way to ensure you can tell heaps of ----s to go ---- themselves after you're dead"

maybe you could pivot and focus on that. ;)

</comment><comment><USER33> Feedback: >you canlog back in to the site

you can log back into the site

</comment><comment><USER34> It would be cool to see a similar service encrypt the data in the Bitcoin blockchain and have an automated way of decrypting the data. This way no company or people were involved.

Does the blockchain support something like this?

</comment><comment><USER35> The devices animation forces a scroll-up on Opera 12.

</comment><comment><USER36> while the idea has merits, i would not trust you with my most sensitive data (especially if it is reversibly encrypted or plaintext), i would feel like i was paying for an added secuirty risk, of which there are too many already. also it doesnt seem like there are assurances against you abusing my data like there would be if you were a lawyer i had entrusted to execute my will. there's no personal relationship there, so i don't feel comfortable.

<comment><USER37> They should implement some shared key encryption for you. But I'm not sure if any systems provide building blocks. For instance, does FB login have any API for encrypting data?

The secrets they store should be offline and require manual intervention to retrieve.

Also, what's to stop a false triggering? It should require confirmation from m of n sources you specify. If I had some serious life secrets, I'd want to be very sure they don't get sent out just because I'm in a coma for a month.

</comment></comment><comment><USER38> Ghostmemo is another alternative (I use it): [http://ghostmemo.com](http://ghostmemo.com)</comment>


Twitter's new prototype app 'twttr' launches today - <AUTHOR> https://techcrunch.com/2019/03/11/twitters-new-prototype-app-twttr-launches-today/ <comment><USER2> the name is a reference to the original name, cute

Also @jack's first tweet said something along the lines of "just setting up my twttr"

edit: the truth</comment>


Imperative Loop or Functional Stream Pipeline? Beware of the Performance Impact - <AUTHOR> https://blog.jooq.org/2018/10/29/imperative-loop-or-functional-stream-pipeline-beware-of-the-performance-impact/ <comment><USER2> In the case of Lua language and using LuaJIT to tun the code, it is possible to inline the code across the functional chain transformations of data.

[https://github.com/luafun/luafun](https://github.com/luafun/luafun)</comment>


Show HN: Top 300 books were counted from hn in 2018 - <AUTHOR> https://live.godiscourse.com/topics/bfe42101-a1df-4ac8-b656-c287a9c434cb <comment><USER2> I computed a list of more than 500 PDFs on Hacker News in 2018 which you might also like:

[https://getpolarized.io/2019/01/08/top-pdfs- of-2018-hackerne...](https://getpolarized.io/2019/01/08/top-pdfs- of-2018-hackernews.html)

<comment><AUTHOR> Yeah it's pretty cool

</comment></comment><comment><AUTHOR> Top is according to the number of times mentioned and the post score.</comment>


Google Chrome's next update will finally block autoplay videos that have sound - <AUTHOR> https://www.theverge.com/2018/3/22/17150870/google-chrome-autoplay-videos-sound-mute-update <comment><USER2> I don't want _any_ auto-playing videos, sound or not. They always seem to pop up next to the text I came there to read. I can't focus with that.

<comment><USER3> Then use Firefox :)

<comment><USER4> Firefox also lets you mute a tab without switching to the tab.

<comment><USER5> Chrome does too. Just right click on it and "Mute site" will mute the domain. Forever I think.

</comment></comment></comment></comment><comment><USER6> I don't see them turning off auto-playing videos on YouTube (after finishing watching one) -- seems a little hypocritical.

Netflix is now in this game too, auto-playing trailers as you scroll titles with no way to turn the feature off.

Clearly force-feeding users videos boosts traffic (or they wouldn't do it) but it annoys, what? At least 50% of users?

<comment><USER7> They have a reasonably coherent generalization planned for this[0].

Chrome will track a user's actual video consumption habits per origin, and compare it to the user's total visits to that origin. Video consumption is judged to be intentional if play is longer than 7 seconds, audio is unmuted, the tab is active, and the video is bigger than 200x140 px.

Then, if the ratio of actual video consumption to visits is high enough, Chrome desktop will allow autoplay. (My read is that Chrome mobile will wholly disable autoplay.)

If you always pause / mute playback on news sites but let Youtube autoplay, Chrome will learn to allow Youtube to autoplay.

If you always pause/mute playback on Youtube, Chrome will learn not to autoplay Youtube.

You can see what inferences Chrome has made at chrome://media-engagement .

(I'm not a Google employee nor a Chrome developer and may be accidentally misrepresenting this policy, but I've attempted to describe it accurately.)

[0]: [https://developers.google.com/web/updates/2017/09/autoplay-p...](https://developers.google.com/web/updates/2017/09/autoplay- policy-changes)

<comment><USER6> How about just off by default? Seems pretty basic.

There are Chrome plugins that purport to do this but I still get auto-playing videos.

I don't want to train Chrome. I don't even bother turning off auto-playing videos b/c it's a hassle, I just stay on mute.

Don't ad buyers complain about all these fake views from auto-playing videos? I guess not, or if they do Google doesn't care.

<comment><USER7> Off-by-default is an option now for advanced users (such as might be reading HN). On the same page I linked in my earlier comment you are responding to, see:

> You can try out these new policies by setting the experimental flag > chrome://flags/#autoplay-policy to "Document user activation is required." > in Chrome 64.

Like you, that is my preference as well, and I have set the flag.

<comment><USER6> Doesn't work. Have you tried it?

1\. Go to chrome://flags/#autoplay-policy

2\. The options in the drop down are:

A. Default

B. No User Gesture is Required

C. User gesture is required for cross-origin frames

D. Document user activation is required

Select D. Relaunch. Go to ABC News. Autoplays videos.

</comment></comment></comment></comment></comment><comment><USER8> And you just know someone will find a workaround because annoying site visitors is SO in right now.

<comment><USER9> Maybe have a separate autoplaying <audio> element, if it won't be blocked too

<comment><USER8> Worst case put it on click after a full screen signup modal that the same sites usually show anyways.

</comment></comment></comment><comment><USER10> Higher priority should be to mute websites that don't have media content.

Two ideas: Either make it permission based like location, or have a master volume setting for sounds like rely on javascript (excluding html5, flash, etc.). I'm not 100% sure about the details for the latter, but that'd be very convenient.

I'm almost always caught off guard when a customer service widget pops up on the bottom right corner of the screen with an annoying bell sound.

</comment><comment><USER11> Perhaps browsers just need to ask users if they want audio before letting sites play it. Like a permission.

<comment><USER12> Doesn't scale. Firefox is already introducing option to block "notification permission" requests as all sites spam with it, even when it makes little to none sense.</comment></comment>


LibreOffice 4.2 released - <AUTHOR> https://www.libreoffice.org/download/4-2-new-features-and-fixes/

<comment><USER2> I know that the LibreOffice team is short on manpower, but I still find it puzzling that they do not treat reproducible crashes as release-blocking bugs. Instead, there are a lot of such bug reports untouched, potentially waiting to be exploited by bad people. (I reported 2 such bugs myself, neither has been fixed yet I think)

<comment><USER3> Not all crashes are exploitable.

<comment><USER4> Still not exactly ready for production environments. The lack of a decent and reliable word processor is a big argument against Linux in non-programming offices. That's too bad, because there's a lot of money and influence there and the privacy argument would otherwise be a strong advantage for Linux.

</comment></comment></comment><comment><USER5> This being a more major update, I won't touch my LibreOffice install until 4.2.1 is released at the earliest.

<comment><USER6> I hope you mean 4.2.1. There might be a long wait for 4.21. <wink/>

<comment><USER5> Oops... I updated my comment and up voted yours.

</comment></comment></comment><comment><USER7> Also of interest: the developer-focused improvements in the LO codebase up to 4.2, by Michael Meeks.

[https://people.gnome.org/~michael/blog/2014-01-30-under- the-...](https://people.gnome.org/~michael/blog/2014-01-30-under-the- hood.html)

</comment><comment><USER8> Great release from the Libreoffice team, as usual!

LibreOffice might not be the "Snazziest" or whatever, but it's perfect for folks like me who need to use MS office but don't use Windows and can't stand Google's web UI.

</comment><comment><USER9> I applaud LibreOffice's intent, but the interface reminds me too much of Office 2003 and older.

What happened that Microsoft has the most modern-looking office software?

<comment><USER10> Word 2002 is still the standard where I work mainly because of the insane UI change of Microsoft.

Why would LibreOffice copy Microsoft when its main compelling advantage over Microsoft is to avoid this mess ?

<comment><USER11> I use OO/Libre Office in part just because they did not follow MS' lead on the ribbon. I have never found the ribbon intuitive personally.

</comment></comment></comment><comment><USER12> > Added a new formula interpreter to enable massive parallel calculations of > formula cells using GPU via OpenCL.

I'm genuinely interested in what kind of spreadsheets have a noticeably faster response when getting processed on a GPU instead of CPU. ... actually it's the same kind of interest as "what does a train wreck in slow motion look like".

<comment><AUTHOR> OpenCL is actually a framework that allows a program to execute across heterogeneous platforms. That includes CPU and GPUs. It will improve spreadsheet tasks (which often use a lot of calculations that can be offloaded to a GPU) for those who don't even have a GPU.

</comment></comment><comment><USER13> I think the most interesting thing about this release is the use of OpenCL.

With more and more popular applications using GPGPU techniques it's possible that normal users will start noticing the difference soon.

<comment><USER7> What I'd really like to see is benchmarks between LO 4.2, MSO 2013 and Office 365. Maybe AOO 4.0.1 as well. Benchmark some serious spreadsheets, the sort that take hours to run. I don't expect LO to win, but I do expect the results will be interesting and give areas to improve upon now they've got the Calc data structures sorted out.

</comment></comment><comment><USER14> One of the preview feature in 4.2 contributed by Andrzej Hunt is Firebird SQL C++ backend for Base [http://www.firebirdnews.org/?p=9109](http://www.firebirdnews.org/?p=9109)

</comment><comment><USER15> Wow... the docx support has really seemed to improve with this release.

<comment><USER16> I don't know much about Libreoffice, but I created Python DocX and am familiar with the spec.

The Office Open XML spec refers to the behaviour of old versions of MS office as the correct way to render certain options. Without access to the source code of say, MS Office 97, alternate renderers need to reverse engineer the correct behaviour.

<comment><USER17> (Pasted from an earlier discussion)

That's not correct. What it actually does is reserve some markup for use by third parties that have reverse engineered various old programs (including programs that competed with Microsoft programs), so that if those people have workflows that depend on features of those old programs that cannot be represented in OOXML, they can still use OOXML as a storage format but add in the extra information they need.

Here's the use case this is aimed at. Suppose I run, say, a law office, and we've got an internal document management system that does things like index and cross reference documents, manage citation lists, and stuff like that. The workflow is based on WordPerfect format (WordPerfect was for a long time the de facto standard for lawyers).

Now suppose I want to start moving to a newer format for storage. Say I pick ODF, and start using that for new documents, and make my tools understand it. I'd like to convert my existing WordPerfect documents to ODF. However, there are things in WordPerfect that cannot be reproduced exactly in ODF, and this is a problem. If my tools need to figure out what page something is on, in order to generate a proper citation to that thing, and I've lost some formatting information converting to ODF, I may not get the right cite.

So what am I going to do? I'm going to add some extra, proprietary markup of my own to ODF that lets me include my reverse engineered WordPerfect knowledge when I convert my old documents to ODF, and my new tools will be modified to understand this. Now my ODF workflow can generate correct cites for old documents. Note that LibreOffice won't understand my additional markup, and will presumably lose it if I edit a document, but that's OK. The old documents I converted should be read-only.

Of course, I'm not the only person doing this. Suppose you also run a law office, with a WordPerfect work flow, and are converting to an ODF work flow. You are likely going to add some proprietary markup, just like I did. We'll both end up embedding the same WordPerfect information in our converted legacy documents, but we'll probably pick different markup for it. It would be nice if we could get together, make a list of things we've reverse engineered, and agree to use the same markup when embedding that stuff in ODF.

And that's essentially what they did in OOXML. They realized there would be people like us with our law offices, who have reverse engineered legacy data, that will be extending the markup. So they made a list of a bunch of things from assorted past proprietary programs that were likely to have been reverse engineered by various third parties, and reserved some markup for each.

</comment></comment></comment><comment><USER18> Lets hear it for better RTF support!

</comment><comment><USER19> I really like LibreOffice, which I switched to from open office a few years ago (and Star Office before that). My main issue is that I would love to transition users over to it, but they complain that it messes up formatting (lots of spreadsheets), so while just about everything else my users do could be done on GNU/linux, most of the end-user workstations still wallow in windows land, due to office alone. This release seems to have some massive improvements for businesses as well.

I will probably send MS a gift once they finally release Office for *nix.</comment>


A sassy chatbot named Rose just won a big test of artificial intelligence - <AUTHOR> https://nakedsecurity.sophos.com/2015/09/22/a-sassy-chatbot-named-rose-just-won-a-big-test-of-artificial-intelligence/ <comment><USER2> I gave Rose a try for a few minutes. There were some non-sequiturs... like when I brought up the humanitarian crisis in Syria, it responded with a criticism of how "generals are always playing the humanitarian crisis card". But I was just talking about it in the broader sense, and not talking about what specific people were saying about the crisis.</comment>


Do users understand the browser back button? - <AUTHOR> http://ux.stackexchange.com/questions/7909/do-users-understand-the-browser-back-button

<comment><USER2> On a related note, I've noticed I actually never use the actual back button anymore via click or keyboard. Instead I do Chrome's two-finger back swipe on my Mac trackpad. It's the easiest motion to use since my fingers are already on the trackpad. I imagine this is a growing trend and therefore developers should also worry about overriding this feature via horizontal scroll commands.

</comment><comment><USER3> > untouchable" 12 years ago, it would be even more so today in 2011.

You might also say that there are many more naive users today, and that bad designers have been breKin the back button a lot more often, which means that fewer people know what should happen and people have less expectation that what should happen is what's going to happen.</comment>


Effort Neglect and the Second Textbook - <AUTHOR> https://medium.com/@kevinconnolly/effort-neglect-and-the-second-textbook-434a3400be2f <comment><AUTHOR> Author here - just thought I'd share this personal story on the topic of learning, as there's a lot of reference and resource sharing here (which I love!). I think it's important to reflect on the long slog of continued effort. Hope you enjoy. I am trying to improve my writing, so any feedback or comments welcome.</comment>


The MIT Guide to Hacking - <AUTHOR> http://stuff.mit.edu/afs/athena/activity/h/htgamit/text/2005/HackingSection.txt

<comment><USER2> >> A dean, who had been informed about the hack after the arrest, went down to bail the students out. He pointed out to the detective that the battery-lined coats were only circumstantial evidence. At this point the dean opened his own battery-lined coat and declared that "all Tech men carry batteries."

Unfortunately, these times where MIT officials will protect students seem to be gone by now.

<comment><USER3> You don't think if an MIT frat was planning a harmless(ish) prank of the Harvard–Yale game today, and some Harvard students learned of it and tried to get the MIT students arrested, that the MIT deans would be looking to help their students out of trouble?

<comment><USER2> Definitely. There was a case a couple of years ago. Search "Star Simpson" for more info.

Edit: the case was not about hacking "oficially"

</comment></comment></comment><comment><USER4> HTML version: <http://jottit.com/qd874/>

</comment><comment><USER5> "View source" renders it with wraparound.

<comment><USER6> this is the final precept, obfuscate your knowledge...

</comment></comment><comment><USER7> It would be neat to see some of these places (tomb of the forbidden ladder, bricked in showers at the library, etc), if anyone knows where to find pictures.

<comment><USER8> I can't help with pictures of MIT, but there are a few pictures of some interesting places in the Caltech steam tunnels in this essay:

<http://pandora.caltech.edu/~antognini/tunnels.pdf>

<comment><USER3> As a final project for a photography class a year ago, I wandered across town and took many photos of the MIT tunnels. None are online (maybe I'll put some up someday, but since these pictures worked much better as 16"x16" prints, I'm not sure how well they'd work at a few hundred pixels on a side on a screen), unfortunately. In any case, I recommend everyone who spends any substantial amount of time in the area wander around down there sometime. It's an interesting eerie mood (especially at 3 AM) found in few other places.

<comment><USER7> My school has 5km of (heated!) tunnels connecting all the buildings on campus, but since they're open to the public they don't feel eerie at all.

I'd like to see your pictures if you ever put them online. =)

</comment></comment></comment></comment><comment><USER9> I like this one <http://hacks.mit.edu/Hacks/by_year/2010/upside_down_lounge/>

</comment><comment><USER10> Great piece! I love the hacking ethos of the MIT hacks / hackers. One of my recent favorites was their Harvard Master Chief / Halo 3 hack: [http://www.joystiq.com/2007/09/25/the-best-thing-youll- see-t...](http://www.joystiq.com/2007/09/25/the-best-thing-youll-see-today- john-p-harvard-goes-halo/)

</comment><comment><USER11> One of my favorite google easter eggs is support for smoots (the unit mentioned in the article, equivalent to the length of a Mr. Oliver Smoot when lying down).

[http://www.google.com/#hl=en&q=convert+1+smoot+to+feet](http://www.google.com/#hl=en&q=convert+1+smoot+to+feet)

</comment><comment><USER12> This brings back many happy memories of crawling through filthy ductwork in search of hidden spaces. I still have a box with rolls and rolls of B/W negatives that I shot in '83 to document some of the secret places at MIT. All I need is about 40 hours of free time and I'll scan them all...

</comment><comment><USER13> For more on urban exploration check out <http://www.infiltration.org/> and the handy dandy companion book "Access All Areas" ( <http://www.infiltration.org/aaa.html> )

</comment><comment><USER14> For a guide to hacking, the author knows surprisingly little about HTML formatting.

<comment><USER15> Hint: Not everything on the world wide web is a HTML page.</comment></comment>


Some thoughts on Elm Development - <AUTHOR> https://medium.com/@NewMountain/some-thoughts-on-elm-development-39a0f8a9002a <comment><USER2> I actually think Elm is quite cool and am working in it right now. But I disagree with almost anything the author says.

He starts with some sort of rant against HTML because "It's 2016". As if:

      div []
        [ button [ onClick Decrement ] [ text "-" ]
        , div [] [ text (toString model) ]
        , button [ onClick Increment ] [ text "+" ]
        ]

were more readable than

        <button onClick="decrement()">–</button>

        <button onClick="increment()">+</button>

Iit's obviously not. The Elm formatter even gets the indentation wrong: the divs are on the same level, yet indented differently (and I know why, but it's wrong nonetheless).

So I have no idea what problem anyone could have with writing HTML. It's actually one of the nicer markup languages around.

I also don't buy this legend that Elm is so easy to read, non -programmers could understand it. The update function given as an example is a nested 50-line switch statement that any sane linter would drown in wiggly red. When we take away the comments, this is what is left:

       update : Msg -> Model -> Model
       update msg model =
           case msg of
               Input name ->
                   { model | name = name }
               Save ->
                   case (model.playerId) of
                       Just playerId ->
                           model
                               |> updatePlayerNames playerId
                               |> updateNameInPlays playerId
                               |> clearInputBox

...and so on. It uses a lot of English words, too many actually, because people seem to think that makes it as easy to parse as a sentence.

Let's try: "Case model playerId of Just playerId? Model updatePlayerNames playerID! Nope, that's gibberish.

Don't get me wrong – Elm is really exciting, especially against the sweltering heap of Javascript in the background. But not for those reasons.

(He does get to the core "yadda yadda state" argument later on)

<comment><USER3> I completely agree with you. I'm really excited about Elm, specially because of the quality of everything in the community and ecosystem, but to say that the syntax is better than HTML or that it is readable by non-programmers is a bit of a stretch.

When I first ran into Elm the first thing I looked for was an alternate syntax of some sort.

The tech is amazing and I truly believe we got something here that will last, but not because of the syntax.

</comment></comment><comment><USER4> The obvious jab against OOP via TypeScript is interesting considering RxJS 5 and Cycle—both functional tools—make use of it.</comment>


Apple could kill almost 200,000 apps with iOS 11 - <AUTHOR> http://mashable.com/2017/03/14/ios-11-could-kill-200000-32-bit-apps/#A8wcfc2VCqqm <comment><USER2> Or they just recompile with 64bit support?

<comment><USER3> "They" refer to Apple or Developers?

<comment><USER2> The App developers -- assuming they aren't doing anything bizarre that should be trivial for the vast majority of applications. That said i'm unsure what would happen if they're using now-deprecated API -- i /suspect/ that would not effect the majority of these Apps, but I would not be surprised if some apps required a degree of work to update/move of old APIs.</comment></comment></comment>


FamilyTreeDNA: It's Our 'Moral Responsibility' to Give FBI Access to Your DNA - <AUTHOR> https://gizmodo.com/ancestry-testing-company-it-s-our-moral-responsibilit-1833774781 <comment><USER2> I will be waiting until I can analyze my DNA myself, without handing it over to a company that is going to do whatever it wants to with it. We are not yet able to fully appreciate how valuable DNA is, and yet everyone seems delighted to pay companies to take it from them.

Perhaps they will be less delighted when they are convicted of a crime based off of a false positive, have their DNA shared with Facebook to Improve Their User Experience ™, or have their DNA made public after yet another security breach where it is left on an unsecured server.

Remember that your DNA is very valuable, literally. Those who have noticed recent progress in genomics should realize how valuable it would be to a competent advertising company, allowing them to profile and predict users with significantly higher personal accuracy, even if all they are doing is performing basic GWASs ([https://en.wikipedia.org/wiki/Genome- wide_association_study](https://en.wikipedia.org/wiki/Genome- wide_association_study)).

<comment><USER3> People can get your DNA without your consent already, as your DNA gets onto every object you touch. The most valuable part about sending stuff to a DNA company is your consent, especially considering that sequencing costs have a super-moore's law like cost reduction. Once they have your consent they can share it, sell it, rent it, to recruiters for ad targeting, insurances, etc etc. Without consent they'd get onto dubious legal territory, if e.g. Amazon took gene samples from refunds. But maybe it'll just become part of their TOS, you not being able to opt out unless you don't want to refund your stuff to Amazon.

Not sure if the ability to sequence DNA yourself is really beneficial to privacy, after all that allows people to sequence the DNA of many people around them.

<comment><USER2> It would be nice to have better special regulations specifically concerned with DNA usage and collection, just as we do for health information like HIPAA, just as we should for facial recognition as well.

<comment><USER4> So DNA-data is not HIPAA yet?

<comment><USER5> HIPAA does not explicitly call out genetic/genomic information as one of the oft-cited 18 elements of protected information [1]. However, genetic/genomic information is considered to fall under the 18th element, and HHS states that it must be treated as PHI [2,3]. In fact, HIPAA is very broad in its definition of PHI:

"The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." [4]

Finally, it's worth pointing out that some states (e.g, WA) have enacted their own legislation that specifically calls out genetic testing and data as PHI [5]. In addition, there is the GINA act, which provides some protections as well [6]

      [1]: https://cphs.berkeley.edu/hipaa/hipaa18.html
      [2]: https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html
      [3]: https://www.law.cornell.edu/cfr/text/45/160.103
      [4]: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
      [5]: https://app.leg.wa.gov/billsummary?BillNumber=6284&Initiative=false&Year=1999
      [6]: https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act

</comment></comment></comment></comment></comment><comment><USER6> Compare with 23andme:

> 23andMe chooses to use all practical legal and administrative resources to > resist requests from law enforcement, and we do not share customer data with > any public databases, or with entities that may increase the risk of law > enforcement access.

[https://www.23andme.com/law-enforcement-guide/](https://www.23andme.com/law- enforcement-guide/)

And AncestryDNA:

> Contents of communications and any data relating to the DNA of an Ancestry > user will be released only pursuant to a valid search warrant from a > government agency with proper jurisdiction.

[https://www.ancestry.ca/cs/legal/lawenforcement](https://www.ancestry.ca/cs/legal/lawenforcement)

<comment><USER7> The purpose of Ancestry (and FamilyTreeDNA) is ancestry research. You don't go to Ancestry to get your DNA tested for diseases. You go there for ancestry research.

The entire purpose is sharing.

<comment><USER6> Yes, one purpose of the service is sharing with people who _have similar DNA to you_ (not just police officers conducting dragnet searches). And it's not the "entire purpose" either, much of the ancestry data is available for you to view even if you don't use the sharing features.

<comment><USER7> Sure, you can find the records others have shared and not share your own.

But the purpose of these sites is finding family members. Let's stop being shocked that this means the DNA info voluntarily submitted is public.

</comment></comment></comment></comment><comment><USER8> Some things require an eloquent rebuttal to be taken seriously. To others, just saying "Fsck that" should be enough.

</comment><comment><USER9> > As specified in FamilyTreeDNA's Terms of Service, law enforcement can only > receive information not already accessible to the standard user by providing > FamilyTreeDNA with valid legal process such as a subpoena or a search > warrant.

> Additionally, FamilyTreeDNA customers have the option to opt out of law > enforcement matching entirely. If customers do opt out, they can still see > their family matches but are excluded from being seen by law enforcement.

This does not make sense to me. I know that DNA can be taken physically from an individual with a warrant, so ostensibly that would hold with FamilyTree as well.

So: if one opts out, what is one opting out of? FamilyTree can't be suggesting that they'll withhold evidence because a customer opted out, can they?

<comment><USER10> Sounds like they're opting out of the warrantless variety of police searches. I'd imagine you can't opt out of a subpoena.

<comment><USER11> The opt out _could_ be and opt in to have them delete your data after they give you the results. No-one is forcing them to keep it.

<comment><USER12> Are you suggesting they'd voluntarily delete your data?

Opt out, to me, just means that they'll share your data if issued a subpoena. However, I don't know if you could get a subpoena to search the entire DNA database of a company.

<comment><USER11> I'm suggesting they _could_ delete your data (as well as many other companies), and the possibility is deliberately not mentioned, so they can pretend to respect your privacy by requiring a warrant.

</comment></comment></comment></comment></comment><comment><USER13> I personally feel that the next great privacy scandal is going to come from one of these DNA companies being hacked, or abused by law enforcement, etc. And we all will have seen it coming.

The issue, of course, is that unlike Facebook you can't just delete your DNA.

<comment><USER14> Not only that, but I can't stop anyone I'm related to from creating a shadow profile of me.

<comment><USER15> So, just like Facebook after all?

</comment></comment></comment><comment><USER16> This is my favorite argument against sharing DNA information (from Defcon 25):

[https://m.youtube.com/watch?v=HKQDSgBHPfY](https://m.youtube.com/watch?v=HKQDSgBHPfY)

<comment><USER3> Oh, I've seen it but forgot about the name. Thanks for putting it here!

</comment></comment><comment><USER17> > "If FamilyTreeDNA can help prevent violent crimes, save lives, or bring > closure to families, then we feel the company has a moral responsibility to > do so."

The FBI (and a variety of other organizations) can and will use the information for any and all purposes imaginable, and a number that are unimaginable.

As a family member of someone who sends in a FamilyTreeDNA kit, you're powerless to opt out. An implicit, traceable link to your own DNA suddenly enters the system against your will, and you have no recourse. Suddenly you become part of this this experiment in mass surveillance.

The people of rich democracies are way too trusting of their governments and don't read enough history. Saying that this service will be used to " help prevent violent crimes, save lives, or bring closure to families" is naive at best and something monstrous at worst.

Some uses are easy to predict. Genocide, for example. Others, no so much.

\- Imagine a Bird-type gig economy in which thousands of cash-strapped people are hired (possibly by FamilyTreeDNA under contract from the FBI) to swab public places and objects for DNA, while the company compiles the results into a massive internet of DNA things. Now imagine that database being linked to a face-recognition system using public cameras.

\- Imagine being turned down for a job because someone happened to get a peek at your FamilyTReeDNA profile and noticed a marker for mental illness.

\- Imagine being sent to prison because some jackass politician starts believing in criminal DNA markers and you fit the bill.

I'll give credit to Bennett Greenspan for this. He knows how to wrap a massive invasion of privacy in the sweet-smelling blanket of saving us all from the criminal boogeyman.

<comment><USER18> Gattaca was prescient. It was a glimpse of what our future will look like if things continue this way unchecked. While those of us paying attention will find it terrifying, the majority won't notice or be bothered by it I fear.

<comment><USER19> The vast majority have been convinced that the "I've got nothing to hide" defense protects them. It works with surveillance, and it'll work with this too. They've already given up liberty to purchase some temporary security; Franklin would be upset.

<comment><USER20> Is it temporary safety though? A large enough DNA database might nearly eliminate serial rapists. That's one hell of an immediate (and permanent) benefit to trade off against some theoretical downside.

I'm not so sure Franklin would be upset.

<comment><USER21> Well, the data might not eliminate them, rather quickly identify them for "special tasks", like when machiavellian directors intentionally seek bully managers to control their unit with fear. Identifying someone who has certain negative traits might fast-track them to positions of power.

</comment></comment></comment></comment></comment><comment><USER7> The _purpose_ of FamilyTreeDNA is to compare your DNA with all of the people already in their database to find distant relatives.

There should be NO surprise that going to FamilyTreeDNA (or Ancestry.com) results in your records being public to other members.

</comment><comment><USER22> I wonder what is the minimum % of people that need to have their DNA sequenced in order for any human to be able to be identified. The police cases mentioned in the past hint that we are already.

<comment><USER23> [https://www.biorxiv.org/content/10.1101/145599v3](https://www.biorxiv.org/content/10.1101/145599v3) [https://www.biorxiv.org/content/biorxiv/early/2019/01/29/531...](https://www.biorxiv.org/content/biorxiv/early/2019/01/29/531384.full.pdf)

<comment><USER22> thanks. it seems that already (considering only GEDMatch's 850000 samples):

> Its also striking that were already in an era in which familial searches > against publicly accessible SNP databases are feasible for a lot of cases, > probably the majority of cases where the suspect has substantial recent > ancestry in the US

</comment></comment></comment><comment><USER24> As a person who worked in a genetics lab for a while, those who are concerned about privacy should do the following: find a smaller lab and tell them from the get go you want all the data, and for them to delete it after sequencing, then find a third party to do the data analysis.

With sequencing at less than 1k these days, you should be able to do it for sub 3k with the analysis while protecting your privacy.

</comment><comment><USER25> This is the reason not to ever use any of these scummy companies. What next? Should I sign over the rights to my DNA to them too so they can charge me for cell division and reproduction? Monsanto already does this. Fuck these people and their moralistic bullshit. It is our moral responsibility to not use such services if we at all care about privacy, security, and our own well being. Even DNA isn't 100% accurate. Do they think it's our responsibility to go to prison when our DNA is mistakenly matched to a crime scene too? Seriously, fuck these companies.

<comment><USER26> > Fuck these people and their moralistic bullshit. It is our moral > responsibility to...

I admit I chuckled, as someone who finds moral arguments pretty shallow because they tend to depend on what each person thinks is the right thing.

</comment></comment><comment><USER27> > Several weeks later, FamilyTreeDNA changed their rules to allow customers to > block the FBI from accessing their information.

All that's gonna do is flag you for priority analysis!

</comment><comment><USER28> This isn't really necessary. Make a DNA database of crimnals. That guy who killed a child and left his sperm behind? He is bound to slip up and get arrested for something sooner or later.

No need for the FBI to start fishing for everyone's DNA.

<comment><USER29> England shows that "criminal" DNA databases expand as much as they can.

Now if you're arrested, not necessarily convicted, you'll have your DNA taken and kept on file for a few years. Note that someone had to take England to the EU court of human rights to get this changed so that people found not guilty, or people not charged, won't have their DNA kept indefinitely.

[https://www.gov.uk/government/publications/protection-of- fre...](https://www.gov.uk/government/publications/protection-of-freedoms- act-2012-dna-and-fingerprint-provisions/protection-of-freedoms-act-2012-how- dna-and-fingerprint-evidence-is-protected-in-law)

<comment><USER30> Suppose that's the one of the real reasons of Brexit :)

</comment></comment></comment><comment><USER31> 'Moral responsibility' is a very interesting choice of words given the history of this institution. But, feels like history isn't used for forecasting doom if it causes short-term inconvenience.

</comment><comment><USER32> I wonder how many men are worried that this sort of matching is going to turn up children they didn't know they had fathered. That situation is a lot more common than cold case serial killers.

<comment><USER33> Those sort of errors cause all sorts of more serious trouble in another way:

Men finding out they didn't father children they thought they did.

I worked at a genetics lab, and day one training was that this happened all the time, and that we absolutely must not let people in medical studies know we'd found a mismatch. (In fact, we actively avoided noticing such things.)

<comment><USER32> Yes, but in this case what would happen would be mothers (or the children) actively searching for the dads, using those forensic genealogy techniques. The key of course is that the dad's DNA is not required to perform the search.

</comment></comment></comment><comment><USER34> If only law enforcement agencies were strictly benevolent...

</comment><comment><USER35> I'll sign up for this. I'd gladly see a cousin, father, or brother go to jail if they are a murderer, or rapist, or whatever.

<comment><USER36> Same. Law enforcement already has plenty of tools to implement totalitarianism, should that be the goal of the political class. If we are in the dark universe where this eventually comes to pass, a DNA database is not going to make much of a difference in one way or another. On the other hand, in the world where we have good leaders, this tool offers a material delta in the finding and convicting of dangerous criminals.

<comment><USER37> > in the world where we have good leaders

This seems to be the faulty axiom in your logic.

<comment><USER36> It's not an axiom. It's a variable. It was meant to be parallel to the sentence, "If we are in the dark universe . . ."

</comment></comment></comment></comment><comment><USER38> Guess I'm not using that then

<comment> purple-again Sadly it's not that simple. You don't have to use it, but unless you can stop your family as well they will have most of what they need from you that way.</comment></comment>


Advice, like youth, probably just wasted on the young - <AUTHOR> http://www.chicagotribune.com/news/columnists/chi-schmich-sunscreen-column,0,4054576.column <comment><USER2> Instantes

If I were able to live my life anew, In the next I would try to commit more errors. I would not try to be so perfect, I would relax more. I would be more foolish than I've been, In fact, I would take few things seriously. I would be less hygienic. I would run more risks, take more vacations , contemplate more sunsets, climb more mountains, swim more rivers. I would go to more places where I've never been, I would eat more ice cream and fewer beans, I would have more real problems and less imaginary ones.

I was one of those people that lived sensibly and prolifically each minute of his life; Of course I had moments of happiness. If I could go back I would try to have only good moments.

Because if you didn't know, of that is life made: only of moments; Don't lose the now.

I was one of those that never went anywhere without a thermometer, a hot-water bottle, an umbrella, and a parachute; If I could live again, I would travel lighter.

If I could live again, I would begin to walk barefoot from the beginning of spring and I would continue barefoot until autumn ends. I would take more cart rides, contemplate more dawns, and play with more children, If I had another life ahead of me.

But already you see, I am 85, and I know that I am dying.

Jorge Luis Borges

<comment><USER3> The attribution of this poem to Borges is controversial. At least one Wikipedia article states that the original author is one Don Herold: <http://en.wikipedia.org/wiki/Don_Herold>

EDIT: Curiously, the original article is often misattributed to Vonnegut: <http://www.google.com/search?q=sunscreen+vonnegut>

</comment></comment><comment><USER4>
        WHEN I was one-and-twenty
          I heard a wise man say,
        'Give crowns and pounds and guineas
          But not your heart away;

        Give pearls away and rubies	        5
          But keep your fancy free.'
        But I was one-and-twenty,
          No use to talk to me.

        When I was one-and-twenty
          I heard him say again,	        10
        'The heart out of the bosom
          Was never given in vain;
        'Tis paid with sighs a plenty
          And sold for endless rue.'
        And I am two-and-twenty,	        15
          And oh, 'tis true, 'tis true.

(A.E. Housman _A Shropshire Lad_ , XIII)

</comment><comment><USER5> I have an old HN thread bookmarked, "Ask YC: What would you tell your younger self?"[1]. I read it over a few times a year and I think that on some level, it has affected my perspective. The thing is, the advice given is nothing new, especially the message of "do what you love".

[1] <http://news.ycombinator.com/item?id=372573>

<comment><USER6> Thanks for that Ask YC link. Since I had to upvote it, I must have missed it! Feeling wistful because it's EOY and nearly EOD. There have been some wise Metafilter threads.

"My son is graduating from high school in a week. I want to make him a Best of Ask Metafilter book with all the best advice from the hive mind."

[http://ask.metafilter.com/122353/Whats-the-Best-Thing- Youve-...](http://ask.metafilter.com/122353/Whats-the-Best-Thing-Youve-Ever- Seen-Here)

[http://ask.metafilter.com/27160/What-would-you- tell-20yearol...](http://ask.metafilter.com/27160/What-would-you- tell-20yearold-you)

I sometimes think we old people (old as in relative) like to give advice because we have regrets or want to pay-it-forward or just want to get on our soapbox?

</comment></comment><comment><USER7> Sunscreen is harmful. The threat of skin cancer is much less than the dangers of the diseases related to lack of sunlight which is blocked by sunscreen. The diseases include osteoporosis, prostate cancer, breast cancer, ovarian cancer, depression, colon cancer, schizophrenia, rickets, psoriasis, SAD, chronic vitamin D deficiency, diabetes and even obesity.

Much better advice: Get out in the sun, lose the sunscreen!

<comment><USER7> WTF? Could people at least give a reason why they're downvoting this. The info about the dangers of sunscreen is true.

"Vitamin D deficiency is an unrecognized epidemic among both children and adults in the United States" <http://www.ncbi.nlm.nih.gov/pubmed/15585788>

<comment><USER8> Your comment implies that sunscreen can cause any of several conditions whose causes are actually completely unknown. The excessive use of sunscreen can merely exacerbate those conditions by further reducing vitamin D levels.

For those of us who are healthy and drink plenty of milk, wearing sunscreen when we're out in the sun for a long time is a great way to stay healthy.

<comment><USER9> Agreed. In addition, you don't need much sun exposure to get satisfactory vitamin D levels.

From the article:

""" Sensible sun exposure (usually 5-10 min of exposure of the arms and legs or the hands, arms, and face, 2 or 3 times per week) and increased dietary and supplemental vitamin D intakes are reasonable approaches to guarantee vitamin D sufficiency. """

</comment></comment></comment></comment><comment><USER6> Just watched the surprisingly good "The Curious Case of Benjamin Button"

"Your life is defined by its opportunities... even the ones you miss.

It's a funny thing about comin' home. Looks the same, smells the same, feels the same. You'll realize what's changed is you.

Sometimes we're on a collision course, and we just don't know it. Whether it's by accident or by design, there's not a thing we can do about it.

For what it's worth: it's never too late or, in my case, too early to be whoever you want to be. There's no time limit, stop whenever you want. You can change or stay the same, there are no rules to this thing. We can make the best or the worst of it. I hope you make the best of it. And I hope you see things that startle you. I hope you feel things you never felt before. I hope you meet people with a different point of view. I hope you live a life you're proud of. If you find that you're not, I hope you have the strength to start all over again. "

</comment><comment><USER10> I would remind my younger self to dare more and more boldly as the resulting gains can be great and the resulting losses are usually indifferent.

In general I wouldn't want to change anything for there is really no experience in my life that I wouldn't have needed for growing, that wouldn't have tried to teach me something.

However, the outcome of this teaching is gradually learning life. But you can't learn any quicker than you want to, and you will want to learn no more than you dare to receive.

Thus, dare more and take whatever lesson that comes out of it.

</comment><comment><USER11> One could go on and on giving examples; as good as any is near the end of T.S. Eliot's "The Waste Land":

Datta: what have we given? My friend, blood shaking my heart The awful daring of a moment's surrender Which an age of prudence can never retract By this, and this only, we have existed Which is not to be found in our obituaries Or in memories draped by the beneficent spider Or under seals broken by the lean solicitor In our empty rooms.

</comment><comment><USER12> Didn't this get turned into a popular song?

<comment><USER12> Aha! It did. From <http://en.wikipedia.org/wiki/Wear_Sunscreen>, "The most popular and well-known form of the essay is the successful music single Everybody's Free (To Wear Sunscreen), released in 1998, by Baz Luhrmann."

<comment><USER13> Yes I am not sure why we're posting song lyrics on HN now.

</comment></comment></comment><comment><USER14> humanity's greatest asset, by far, is our ability to learn from others' mistakes as well as our own.

</comment><comment><USER15> Always remember: There is no sex in the champagne room. None.</comment>


The Art of Metaprogramming (2005) - <AUTHOR> https://www.ibm.com/developerworks/library/l-metaprog1/index.html <comment><USER2> I'm involved in a couple of projects which do a lot of metaprogramming to generate boilerplate. The generated code is usually C. For the generator I wouldn't recommend using CPP or M4, use a real programming language instead. I'm using OCaml since ML discriminated unions are a good fit for generating code, but other languages would work too. It's a fantastic technique which greatly reduces bugs, speeds development and eases maintenance.

Here are links to the generators for those projects:

[https://github.com/libguestfs/libnbd/blob/master/generator/g...](https://github.com/libguestfs/libnbd/blob/master/generator/generator)

\- This is a small C library. It uses a small-ish generator to generate a state machine, Python bindings, OCaml bindings and (patch coming soon) Rust bindings.

[https://github.com/libguestfs/libguestfs/tree/master/generat...](https://github.com/libguestfs/libguestfs/tree/master/generator)

\- This is a very large project mostly written in C, using a generator to generate bindings in multiple programming languages, also RPC boilerplate, structures, configuration code and much more. This generator is very large having evolved with the project over 10+ years.

 _Edit:_ Some rules for effectively generating code:

(1) The generated code must look as far as is reasonable like it was hand written. This is because you'll be debugging it. We also use #line directives where possible.

(2) chmod -r the generated files so they cannot be edited by accident. Also add a comment at the top pointing to the generator so that developers who have no idea how it works can immediately find the right place.

(3) We add the generated files to the tarball (to allow end users to build without needing OCaml) but keep them out of git (to avoid duplication in commits).

(4) Maximum generation! If some piece of information is written twice, it should probably be written once (in the generator) and the output should go to those two places. Similarly we only have one generator in the project so no one needs to read the Makefiles to find out how a file is generated.

</comment><comment><USER3> In today's C++ you can precompute data structures at compile time with constexpr.

Also slightly off-topic, but in SQL you can insert many tuples in one statement like this

      insert into people (name) values ('Tony'), ('Bob'), ('Mary');

<comment><USER4> Nice. Works in sqlite3 - but it doesn't like the parens around the tablename.

      $ cat multiple-insert.sql
      create table users (first, last);
      insert into users values ('fred','bloggs'), ('mary', 'contrary');
      select * from users;
      $ sqlite3 < multiple-insert.sql
      fred|bloggs
      mary|contrary

</comment></comment><comment><USER5> For me in 2006, when i moved from Java to Ruby, the videos by Dave Thomas (pragprog) changed the dimension of thinking at code level - I did do java reflection, but the whole method_missing to object specific methods etc., explained in a neat fashion by Dave Thomas were amazing !

<comment><USER6> These ones?

[https://pragprog.com/screencast/v-dtrubyom/the-ruby- object-m...](https://pragprog.com/screencast/v-dtrubyom/the-ruby-object-model- and-metaprogramming)

Sample: [https://youtu.be/io34q2G4eOU](https://youtu.be/io34q2G4eOU)

</comment></comment><comment><USER7> Art. SQL embedded in C using gotos. I don't want to meet whoever juxtaposed those two.

<comment><USER8> I can't be certain that they were the first, but Oracle's Pro*C/C++ tooling does the same thing as the example in this article, and with virtually the same syntax.

[https://docs.oracle.com/cd/E11882_01/appdev.112/e10825/toc.h...](https://docs.oracle.com/cd/E11882_01/appdev.112/e10825/toc.htm)

I've worked on a legacy app written with these tools. It's not the most awful thing I've ever had to use. But there's a lot of magic in those macros, and you have to code carefully to avoid introducing action-at-a-distance bugs, esp. w.r.t. error handling.

<comment><USER9> It's called Embedded SQL, and is part of an ISO standard [1]. At one point an embedded version of Informix translated ESQL/C to ISAM calls, without any SQL parsing and query compilation at runtime. Though I don't know what this has to do with metaprogramming as we know it today.

[1]: [https://en.m.wikipedia.org/wiki/Embedded_SQL](https://en.m.wikipedia.org/wiki/Embedded_SQL)

<comment><USER8> I had no idea that it was standardized. Thanks for sharing this!

</comment></comment></comment></comment><comment><USER10> The first reason (performance) given does not feel very compelling. Metaprogramming is generally complicated, and performance is less important in most cases than it once was, so making that tradeoff doesn't make as much sense now as it might have when such systems were popular, or even in 2005.

<comment><USER11> Metaprogramming is about making design more formal. A "constant fraction" of anything written by hand should be automated, ideally. Metaprogramming is not complicated, it is an essential skill, design may be complicated.

</comment></comment><comment><USER12> Are there any tools (which are not part of the language itself) that can work with IDEs? Using custom pre-build steps feels like something that's very hard for tooling to introspect.

<comment><USER13> Editor integrations that aren't aware of build systems are a huge issue. Without awareness into the build system, its basically all just guesswork.

For languages like Go and Rust, this is partly solved by putting tooling into the language and standardizing the build system. But even for languages that have build systems, there's reasons to use other build systems.

As far as I know, very few build systems used in the open world have readily available integration with tooling. However, I think this is temporary. As an example, Bazel and Go should play well together in the near future:

[https://github.com/bazelbuild/rules_go/issues/512](https://github.com/bazelbuild/rules_go/issues/512)

Hopefully, other languages will make mechanisms for code intelligence to integrate with build systems. This is especially important if you want a good developer experience across multiple programming languages.

Perhaps the more scalable (in terms of supporting many languages x many build tools) alternative would actually be an inverse relation, a future language server architecture where the build tool orchestrates the language servers. Who knows.

</comment></comment><comment><USER14> Hmm...where is Part 2 of the series?</comment>


Cripes does anybody remember Google People - <AUTHOR> https://twitter.com/qntm/status/1164301933949128709 <comment><USER2> [https://qntm.org/person](https://qntm.org/person) is filed under 'fiction'. Recent comment by the author way down on the page

" 2020-01-02 13:30:51 by qntm: Many thanks to everybody who participated, and extra special thanks to everybody who bought it. "</comment>


AES on iOS isn't broken - <AUTHOR> http://beechplane.wordpress.com/2011/12/14/aes-on-the-iphone-isnt-broken-by-default/

<comment><USER2> This article is wrong. There are serious attacks against CBC with a zero IV. A zero or re-used IV should not be used with CBC under any circumstances.

The author is correct that ECB is weaker than CBC with a zero IV. This is because there are serious attacks against ECB, and ECB should not be used under any circumstances.

(EDIT: I am not passing any judgement on Apple's choice of API defaults; that's something people should feel free to argue about, and they will. I am only pointing out that the author is mistaken to imply that using CBC with a zero IV is safe or advised under any circumstances, which it is most assuredly not.)

<comment><USER3> I saw the post as more of an attack against all those people saying that IVs must not ever be made public.

You'd be surprised at who I've heard perpetuating these claims, ranging from developers to cryptography professors at 2nd-tier universities. On that point, the OP is spot on as _IVs are not meant to be secret_ their job is just to prevent detection of patterns, i.e. seed randomizers in many ways.

And, yes, they shouldn't be reused. If they're being reused, they may as well not be there.

<comment><USER4> Agreed. I'd also note that ECB, CBC, etc, have basically nothing to do with the _algorithm_ being used (in this case, AES).

The idea of an IV, ECB, CBC, etc are just techniques to be used to make the results of block ciphers more secure, regardless of what algorithm they use.

That's my bigger problem with the "AES is broken on iOS" claim based on IVs. The two things are only loosely related.

</comment></comment></comment><comment><USER5> Question about IVs: is it enough that the IV is unique, or does it have to be random? If I used a sequence that starts at 1 and is guaranteed to increment for each message and never be reused, is that a good IV?

<comment><USER6> It absolutely needs to be random. If not, the adversary can predict the IV and use that to conduct either a chosen plaintext or ciphertext attack. This is what happened to SSL a few months ago. See [http://crypto.stackexchange.com/questions/1078/how-does-a- ci...](http://crypto.stackexchange.com/questions/1078/how-does-a-cipher-block- chaining-cbc-attack-work-against-ssl/1082#1082) for an explanation.

<comment><USER4> In a way, an IV is similar to the idea of the salt used in Hashes. It's supposed to make it harder to find patterns in your ciphertext (or with a hash, harder to generate the hash for every known character range you care about).

So in that sense, just like it's good to have a different or random salt with each hash, you'd want a differend (random) IV for each session.

<comment><USER7> A salt is really just a nonce: It doesn't have to be random or unpredictable; it just has to be globally unique so that attackers can't work to crack more than one password at once (or pick out identical passwords given a list of password hashes). We make it random because that's the only way we know how to create globally-unique numbers in our decentralized network.

CBC-mode's IV really does need to be unpredictable by anyone who can influence the plaintext. Otherwise, you get things like this: <http://www.youtube.com/watch?v=BTqAIDVUvrU>

</comment></comment></comment></comment><comment><USER8> It's not _broken_ , but it is a poor default that is easily remedied.</comment>


EnGrip - <AUTHOR> https://www.engrip.com <comment><USER2> This landing page is pretty bad. No real information what so ever, but just an attempt at email harvesting.</comment>


Whilst I Was Sleeping: Instagram photos delivered like a newspaper - <AUTHOR> http://www.brendandawes.com/project/whilst-i-was-sleeping/

<comment><USER2> Pretty neat. How have you set it up to print from your feed?</comment>