Ask HN: How are you using the time between Christmas and New Year? - <AUTHOR>

I would like to know how you guys are using the time between Christmas and NewYear.
Do you spend it with your family? Or was Christmas already to much family overload?
Are you using the time to try out new technology/frameworks? Or are you working on side project? Or whatever? <comment><USER2> I already had a good 4 day weekend with family for Christmas. For New Year, I have another long weekend starting now and planning to do extensive coding on one of my ideas/ project.

<comment><USER3> For a second, I looked at your reply and thought I typed it! I've been practicing my node.js and MongoDB skills, so I'm working on a little weekend project as a showcase.

<comment><USER2> haha yea. I am going hard at python/flask and also brushing up my git skills.

</comment></comment></comment><comment><USER4> We got married last weekend and have been working loads over the last few months so this time is some well earned time off.

Will probably get back to work on Wednesday/Thursday.

<comment><AUTHOR> Congratulation! I wish you all the best.

</comment></comment><comment><USER5> Working (pretty much no family left...). It is highly annoying when no lawyers, consultants, other professionals are available these days. ;-)

<comment><AUTHOR> I am sorry that you don't have family left anymore. Yes that can be annoying. But you could use the time for activities where you don't need consultants. I am using the time to do SEO for my Start-Up. And I am pre writing blog posts and saving them as drafts. I will post them somewhere in January.

</comment></comment><comment><USER6> I'm building a blogging platform as well as refining my own web application framework as I go along.

<comment><AUTHOR> Cool! Is your blogging platform on GitHub? OpenSource? I am looking for blogging software in ruby, which I can customise for my own needs.

<comment><USER6> It is not on GitHub at this time it is still under construction and so not ready to be published just yet.

I am definitely considering publishing it open source though.

As for your project, I am currently writing this blogging platform in perl, though it could be ported to ruby.

</comment></comment></comment><comment><USER7> Visiting the other side of the family, but also contributing to a couple of open source projects.

<comment><AUTHOR> That sounds like a good mix. Keep it up.

</comment></comment><comment><USER8> Combination of exercise & creative projects. Determined to write up those blog posts I've had in draft form for quite a while.

</comment><comment><USER9> Eating, working on my side project and watching videos from talks throughout the year that I missed.

</comment><comment><USER10> Vacation!

<comment><AUTHOR> :-) Nothing wrong with that.

</comment></comment><comment><USER11> doing some coding (refactoring) on some of my open source projects, playing some of the starcraft 2 ^^ :) also learning to ...</comment>


High Fructose Corn Syrup: Tasty Toxin or Slandered Sweetener? - <AUTHOR> http://www.sciencebasedmedicine.org/?p=6501

<comment><USER2> The economics of HFCS is the key take away from this article.

The rest of the comparison is probably too reductive. just because two products (e.g. agave and HCFS) have similar fructose/sucrose/glucose proportions does not mean that they are similar once digestion comes into play.

e.g. Honey is ~50% fructose and so is HCFS 55 with the majority of the rest being water, but i bet anyone could tell the difference between these two substances by smell alone.

The article fails to take into account what these differences may be and therefore disrespects the 'science' part of its name by failing to inform us of possible missing pieces in the analysis.

<comment><USER3> Indeed. I read the article (the whole thing!) hoping to get some discussion on the biological effects of sugars and all we get is an analysis of how much sugar content is in natural sugars. It doesn't answer the question posed in the first few paragraphs at all.

</comment></comment><comment><USER4> For me, the takeaway is that replacing sugar with HFCS will significantly increase the amount of fructose in one's diet, which is a bad thing. The body obviously can tolerate a certain level of fructose without the serious consequences, but there is a tipping point. It just so happens that the economics of HFCS push many people over it.

</comment><comment><USER5> This is a good video on the subject on YouTube. <http://www.youtube.com/watch?v=dBnniua6-oM></comment>


Why There Are So Many Ties in Swimming - <AUTHOR> http://regressing.deadspin.com/this-is-why-there-are-so-many-ties-in-swimming-1785234795 <comment><USER2> The article says the tolerance is "3 centimeters in each lane," which feels surprisingly high. The longest race is the men's 1500m freestyle, which is 30 lengths of a 50m pool. That means that in the worst case, pool dimension errors can add 0.9m to someone's race -- about half a second of time in the 1500m. I bet there are races where 0.5 seconds makes a big difference.

<comment><USER3> You got me thinking about what other factors could affect the result at various degrees of precision. By my math [1], the time it takes for the sound of the starting buzzer to reach the ears of swimmers at opposite ends of the pool could actually affect the outcome measured in hundredths of a second. But it's an order of magnitude smaller effect than the lane lengths varying by 3cm. Of course, they could remedy this (and for all I know, maybe they do!) by having one starting buzzer speaker placed at the same distance behind each swimmer.

[1] Each lane is 2.13m wide, so the swimmers in lanes #1 and #8 are 14.91m apart. If the buzzer were placed right next to swimmer 1, it would take ~0.044s longer to reach swimmer 8's ear (using 340.29 m/s as the speed of sound). Or if it were right in the middle between swimmers 4 & 5, it would reach swimmers 4 & 5 ~0.019s before it reached 1 & 8.

<comment><USER4> For both swimming and track events, each starting block has a speaker to broadcast the gun sound. In the 2012 Olympics, the starting gun was replaced with a fully electronic device.[1]

1\. [http://www.theatlantic.com/technology/archive/2012/07/the- sp...](http://www.theatlantic.com/technology/archive/2012/07/the-speed-of- sound-is-too-slow-for-olympic-athletes/260413/)

<comment><USER3> Ah, cool, thanks for filling me in on that. The fact that the organizers indeed go to that length/expense to remove the ~0.02s advantage a swimmer would otherwise have due to the speed of sound makes it even stranger to me that they'd accept a 3cm difference between lanes, which seems to have an order of magnitude larger effect in long races (per OP's calculations).

I'd also wonder if there isn't some advantage/disadvantage to being one of the two swimmers on either end (#1 or #8) versus any of the others (#2-7) which each have two swimmers on either side of them. I have no idea which way the effect would go, but it would seem to me that there must be some effect at the level of hundredths or thousandths of seconds. Edit: seems there's indeed an advantage to being in the inner lanes, and they account for it by seeding [1]. (This was probably well known to anyone who pays any attention to or knows anything about competitive swimming at all. :)

[1] [https://www.quora.com/In-competitive-swimming-why-are-the- in...](https://www.quora.com/In-competitive-swimming-why-are-the-inner- lanes-3-4-and-5-usually-the-fastest-Do-better-swimmers-qualify-to-get-them-Is- there-an-advantage-And-if-so-how-is-that-fair)

</comment></comment></comment></comment><comment><USER5> The question to ask is why so many races end up so close that we need millisecond precision? For races that end so close, I suspect winner is determined by random chance instead of true differentiation. The length of pool precision is not real concern but rather the possibility that we are hitting human + tech ceiling in this particular sport.

<comment><USER6> Well yes, but Olympic athletes and audiences tend not to like it very much if we try to do 50 replicates of the same race.

</comment></comment><comment><USER7> No-one is concerned about all the water vortices created in the pool by your competitors ? I suspect these would also add quite a bit of unfairness.

<comment><USER8> It's not clear whether lane placement affects results, but it's true that the middle lanes are often favored, and qualification systems tend to place better-performing swimmers towards the middle. Here's two non-professional discussions on the matter:

[1] [https://www.quora.com/In-competitive-swimming-why-are-the- in...](https://www.quora.com/In-competitive-swimming-why-are-the-inner- lanes-3-4-and-5-usually-the-fastest-Do-better-swimmers-qualify-to-get-them-Is- there-an-advantage-And-if-so-how-is-that-fair)

[2] [http://sports.stackexchange.com/questions/1326/in- swimming-i...](http://sports.stackexchange.com/questions/1326/in-swimming-is- there-a-competitive-advantage-to-being-in-one-lane-or-another)

<comment><USER7> I was more thinking along the lines of random-currents-bad-luck though. Al tough the out most lanes might have a small effect.

</comment></comment></comment><comment><USER9> Its utterly mind-blowing that humans of different races, with vastly different life histories and training regimens, competing in a sport with tremendous physical complexity, can wind up with performance equal to each other, to the limits of our ability to measure it.

There's still _some_ important lesson in the Olympics, despite everything.

<comment><USER10> But we could fairly easily measure it; we just don't find it worth the trouble.

Also, as to the ties, that's almost purely a political choice made by the sporting body. In rowing, for example, the winner in the Olympic final was decided by looking at the finish photo ([http://www.telegraph.co.uk/news/2016/08/13/theres-only- one-g...](http://www.telegraph.co.uk/news/2016/08/13/theres-only-one-gold- after-5000ths-of-a-second-divides-dead-heat/)), with both rowers getting the same time in hundreds of a second.

I doubt they can align six boats to that precision at the start, even with equipment for holding the bows of the boats at the starting line.

</comment></comment><comment><USER11> > a thousandth-of-a-second constitutes 2.39 millimeters of travel. FINA pool > dimension regulations allow a tolerance of 3 centimeters in each lane, _more > than ten times_ that amount. [emphasis added]

So by the same argument, they should not measure hundredths either...

<comment><USER12> Eh, anything less than 0.0125s is 3cm and a tie. Pretty darn close to 0.01s and all you need to do is make sure the pool is accurate to within 2.3cm instead...

Much more interesting to think about the delta between the clock that's accurate to hundredths.

Someone could win with a time of 23.01s vs second places 23.00s... But is the delta really 0.01s, or was second place 23.00999999 with a delta of 0.00000001s?

</comment></comment><comment><USER13> Well, from my experience, back in my youth, you actually have to _hit_ the board or it wouldn't register touch in so many cases. Then you have to rely on whoever is making the manual measurements for corrections and that is messy.

Not every swimming competition can blow cash on slow motion photo finish cameras. I guess the rules are in place to make most for most swimmers.

</comment><comment><USER14> I think another thing worth mentioning is that ties don't really seem to have a negative perception in swimming.

None of the swimmers involved in the ties mentioned seemed to feel that their medals were delegitimized or somehow worth less because of the tie.

</comment><comment><USER15> Why don't they apply this same reasoning to rowing races in which the inter- lane variations can be much, much bigger than the margin between finishers?

</comment><comment><USER16> Will someone explain the below in simple terms?

"In a 50 meter Olympic pool, at the current men's world record 50m pace, a thousandth-of-a-second constitutes 2.39 millimeters of travel. FINA pool dimension regulations allow a tolerance of 3 centimeters in each lane, more than ten times that amount. Could you time swimmers to a thousandth-of-a- second? Sure, but you couldn't guarantee the winning swimmer didn't have a thousandth-of-a-second-shorter course to swim."

<comment><USER17> If you measure the time the swimmers take very precisely and thus can tell that one swimmer reached the target a few milliseconds earlier, that could be because they are a faster swimmer than the second-placed. Or they could just have had a shorter lane to swim and win despite being slightly slower than the other. They swim around 2.39 mm per ms, and lane differences are allowed to be up to 3 cm, so this can make ~12 ms difference where you don't know where it is from.

<comment><USER16> Technically a lane cant be shorter in a swimming pool.

<comment><USER17> why not? The regulation only allows them to be longer than the specified lane length, yes, but that still means that one lane can be shorter than another.</comment></comment></comment></comment>


"Watchmen" As a Primer on Mental Disorder - <AUTHOR> http://codinginmysleep.com/watchmen-as-a-primer-on-mental-disorder/ <comment><USER2> This is more an exercise in how conditions as described in the DSM IV can be applied to almost anyone as easily as a horoscope or fortune cookie.

A psychology prof once told us that the DSM isn't a diagnostic manual or any sort of medical text -- it's just a reference book so the insurance industry knows how to bill psychological conditions.

<comment><AUTHOR> Funny that the "Diagnostic and Statistical Manual of Mental Disorders" isn't considered a "Diagnostic Manual" given that a) those words are in the title and b) it's commonly and constantly used by professionals as a manual for diagnosis. It doesn't really matter what your one prof said, it matters how the profession as a whole uses it. I also cited the ICD-10 in the article for several of the disorders, and there absolutely is not any arguing that the ICD-10 is a valid diagnostic tool.

Also, while I agree the mis-dignosis is common and many of the elements read like a horoscope/fortune cookie, you can't say that Nite Owl II was a narcissist or that Ozymandius had avoidant personality disorder.

<comment><USER3> Just because something bears a title doesn't make it so.

Perhaps his professor _was_ accurately describing how the profession as a whole uses the manual.

You can diagnosis pretty much anyone with narcissism.

</comment></comment></comment><comment><USER4> So this is something I've always wondered about diagnosing mental disorders.

The thing is, how strongly do the traits listed have to be manifested before it's considered a disorder as opposed to just being that person's personality?

In the comic book, these distinct personalities are what make the characters interesting. The same is also true of people in real life; if you take away every trait mentioned, you end up with a pretty bland person.

So is it simply a matter of degree, and the "disorder" label just gets applied when the traits get strong enough for others to comment on? Or is there a qualitative difference?

<comment><USER5> > So is it simply a matter of degree, and the "disorder" label just gets > applied when the traits get strong enough for others to comment on?

Yes, it is the degree to which traits manifest, but it's not simply a matter of others commenting on them. Typically the degree to which these disorders manifest needs to interfere with living a normal, productive life. That can mean something different to different people, but it's safe to say that if your narcissistic rage prevents you from getting/keeping a job, that your case is likely a certifiable disorder.

The trouble with personality disorders (which are pretty interesting, btw) is that if you ask 10 mental health professionals you will probably get at least 8 differing opinions (these numbers are fabricated on the spot, the point is that there is a lot of variation). Combined with the fact that personality disorders are largely untreatable the whole thing becomes a spaghetti mess.

Studying personality disorders is really interesting and can offer a lot of insight into normal social interactions but I would caution people about second-year syndrome [0]. Keep in mind that, as someone else pointed out, these disorders are extreme cases of normal behavior. Don't get all freaked out when reading about mental disorders because you think you exhibit signs of schizophrenia, histrionic or narcissistic disorders. You do, we all do, it's normal - just not in the extremes that those with actual disorders exhibit.

Disclaimer: I am not a mental health professional, though I do work with them and their clients daily. I also minored in Psychology, which is valuable for a C.S. major when it comes to social interaction or marketing your skills/ideas internally.

[0] <http://en.wikipedia.org/wiki/Medical_students_disease>

<comment><USER6> If anyone's interested in this enough to buy a book on it, I highly recommend Millon's _Personality Disorders in Modern Life_. It touches on a lot of the issues that the GP asked about including how to distinguish personality disorders from traits.

[http://www.amazon.com/Personality-Disorders-Modern- Theodore-...](http://www.amazon.com/Personality-Disorders-Modern-Theodore- Millon/dp/0471237345)

</comment></comment></comment><comment><USER7> Wow! I really enjoyed the movie, but this analysis by the author and the seemingly cohesive picture he paints of each of the 'heroes' is quite astounding ...

<comment><USER8> You know that asshole guy who always chimes in uninvited and says that the book is better... I don't want to be that guy.

But I will say that it's absolutely worth reading if you enjoyed the movie at all, though I think the movie has a stronger ending than the original.

<comment><AUTHOR> I actually liked the original squid ending better, but that's another one of those personal opinions that some asshole guy always has to chime in with. There were definitely some good differences that made each a unique and worthwhile experience, but I would say that the differences more or less left the mental disorders untouched.

</comment></comment></comment><comment><USER9> Am I the only one that read/saw Rorschach as the only absolutely moral character? He refused to compromise on the truth and held everyone to the same code. His inability to accept the moral compromise offered by Ozymandius leads directly to his death, which he welcomes rather than pervert his own morality.

</comment><comment><USER10> I read this post with interest but, honestly speaking, if you consider that all the characters have mental disorders, then 100% of the population have mental disorders as well. I am not sure where you can draw a line between a mental disorder and a personality trait !

</comment><comment><USER11> Once again, I feel the need to point out that the term "psychopathy" is not used clinically (and neither is 'sociopathy'). Robert Hare et al. do have a rigorous definition that distinguishes psychopathy from ASPD, but this definition does not appear in the latest DSM.

Also, the line between ASPD and NPD is somewhat blurry in this article, possibly because in reality these disorders are often co-morbid. The main difference is that narcissists usually conform to social norms and laws, and do not generally pose a serious threat to society. A narcissist might verbally berate someone who stands in his way, but he is unlikely to resort to violence at the drop of a hat, for example. Confer "conduct disorder".

<comment><AUTHOR> I believe I did mention this in the article, but I agree that it's vitally important to understand that the one or two times I used those terms I was knowingly using the popular definitions, not the clinical definitions. Good catch!

<comment><USER11> It's been awhile since I've seen the movie, so maybe Ozymandius did show traits of Hare's definition of the psychopathy. However, the article seemed to imply that the only thing that separates a psychopath from a narcissist is empathy level:

>What makes Ozymandius the villain of the story is that, while many NPD sufferers have decreased empathy, Ozy's lack of empathy borders on full-blown psychopathy

In other words, a psychopath would just be a narcissist with even less empathy, which isn't really the case. In fact, aggressive narcissism is just one of two factors in Hare's checklist. On the second factor, socially deviant lifestyle (which includes traits like failure to plan ahead, poor self control, impulsiveness, etc.), he would probably score pretty low, and thus would be unlikely classified by Hare as a true psychopath.

The description of The Comedian as having ASPD was well-justified though, other than the term "sufferer". Most sociopaths actually consider themselves to be "free" of many of the emotional and social burdens that the people they prey on seem to carry (which ties in to their narcissism).

</comment></comment></comment><comment><USER12> I think these mental disorders were pretty strongly depicted in both the comic and the movie, and that was one of the points Moore was trying to make: having that kind of power corrupts and only the corrupt would want that kind of power.

Some of them had good intentions, which is not mutually exclusive with being mentally ill, but they were all horribly flawed.

</comment><comment><USER13> Very interesting read. Makes me wanna rewatch the movie, which by the way I though was great.

Just my two cents: I think pretty much everyone is "mentally ill" in his or her own way. Me, personally I've identified myself in quite a few bullet points listed there, yet I'm perfectly fine. I think it's whether those traits cause distress or not. Oh and I'm not wearing a costume, saving the world ;)

</comment><comment><USER14> >no one sprouts claws or shoots lasers from their eyes

oh yes, them mutants are the only real heroes

</comment><comment><USER15> > _While it's great to understand the psychology behind the characters, this > knowledge doesn't really make the movie or knowledge that much better._

Disagree with this so much. Knowing the depth and psychology of the characters is what makes the Watchman so much more interesting than say Superman or even my favorite superhero, Batman. Watchmen is very open and honest about the fact that people who would do this are probably riddled with psychological issues. I also like the subtle suggestion the book makes that most superheroes would fall onto the reactionary side of conservatism. I doubt there would be many incredibly liberal people out there taking the law into their own hands, but for some reazon the first time I noticed this mentioned was in Watchmen. Just a brilliantly written story with incredibly deep and realistic characters.

<comment><USER16> To me, the whole point of the movie is: "The end doesn't justify the means and when someones tells you so it certainly means you are heading for fascism".

Characters are "interesting" in the "comic book/fantasy storyline" but not realistic. There's not much to gain from analyzing them other than the stereotypes they stand for.

Nothing new under the sun, literary-wise.

<comment><USER17> " _To me, the whole point of the movie is: 'The end doesn't justify the means and when someones tells you so it certainly means you are heading for fascism'._ "

I don't recall it being very well played out in the movie, but I can make a pretty strong case that what Ozy does is _necessary_ and that he's hardly either a "villain" or a "fascist", at least in the novel.

<comment> loup-vaillant Having only watched the film, I believe he could have done much better. Assuming he didn't have a better alternative, he did make the right choice: better one billion deads than total extinction by nuclear holocaust. But he most probably _did_ have a better alternative.

First, he could have followed through on that cheap unlimited energy business. Second, he could have convinced Dr Manhattan to play the terrorist without killing so much people. Like, targeting most high-profile military installations and civilian symbols. Oh, and while we're at it, he should have financed a (Friendly) AI program as well.

I get that the guy wants to create a Bostromian Singleton. But come on, it's only level 3 on the Yudkowsky ambition scale[1]. No need for such massive killing, especially when the glowing blue ape right next to you is at least at level 5.

[1]: [http://lesswrong.com/r/discussion/lw/ehd/the_yudkowsky_ambit...](http://lesswrong.com/r/discussion/lw/ehd/the_yudkowsky_ambition_scale/)

<comment><USER17> " _I get that the guy wants to create a Bostromian Singleton._ "

I didn't get that, although it's been a long time since I read it (and I have a general rule against taking movies too seriously). The world in the graphic novels was hyper-'80's bleak: a high threat of nuclear holocaust and extreme stagnation in every other area. (I can't remember, did the extremely popular but hideously depressing pirate comic book make it into the movie?) My impression is that Ozy wanted to break the stalemate, altruistically. If he wanted to rule the world, he could have done that easily enough, and cheap energy, etc., would likely reinforce the status quo.

Instead, he comes up with a complete game change: He removes Doc Manhattan, who is very bad influence; who is going to want to _do_ anything with Manhattan standing around? (IIRC, that works out the same as in the movie.) And he arranges for humanity to discover an outside enemy, one which requires humanity to pull together and work like crazed gophers to advance science, technology, and likely general society in a way that hadn't happened since WWII. The outside enemy turns out to be giant, psychic, trans-dimensional aliens, which have the advantage of not actually existing.

The death toll involved is significantly less than the movie, since he only has one of the things and uses it to destroy New York. On the other hand, I have a friend who's favorite character is Rorschach, because he's the only one who is in on the story who doesn't go along with the murder of millions of people.

(By the way, I'm humming "Sympathy for the Devil" right now.)

</comment></comment></comment></comment></comment><comment><USER18> I really can't understand how so many people take this mental illness/disorder stuff for granted, DSM and mental disorders have 0 science in them, the "diagnosis" are based on bullet points and these are decided by a committee or something...

how about this mental illness here? <http://en.wikipedia.org/wiki/Drapetomania>

also, there's a mental disorder for any personality trait ever("oh but it's only considered a DISORDER if it's like, really really bad, you know?")

pure bullshit

<comment><USER19>
      >DSM and mental disorders have 0 science in them
      >pure bullshit

Line 1, meet line 4.</comment></comment>


Chinese restaurant process - <AUTHOR> http://en.wikipedia.org/wiki/Chinese_restaurant_process <comment><USER2> As a former philosophy student, who cared little for mathematics in university, can someone point me in the direction of a resource that would allow me to understand the notation in this article? I understand the problem as described, but unfortunately not the notation.

<comment><USER2> I've discovered this, for anyone else who might need similar help: [http://en.wikipedia.org/wiki/List_of_mathematical_symbols](http://en.wikipedia.org/wiki/List_of_mathematical_symbols)

</comment></comment><comment><USER3> Though I am glad to see nonparametric Bayes on HN, what is it that you want to point out?

</comment><comment><USER4> I can submit random wikipedia articles, too

[http://en.wikipedia.org/wiki/Upchuck](http://en.wikipedia.org/wiki/Upchuck)

</comment><comment><USER5> I've read it several times but I can't understand the problem from the description in this article. Does anyone know of a simpler explanation?</comment>


Rails 3.0: Release candidate 2 - <AUTHOR> http://weblog.rubyonrails.org/2010/8/24/rails-3-0-release-candidate-2

<comment><USER2> "Very few changes" = 356 commits! :-) <http://github.com/rails/rails/compare/v3.0.0_RC...v3.0.0_RC2>

Still, RC1 has been rock solid for me. 3.0 is gearing up to be an amazing release, been using it for all my web projects since the first beta (feb).

If you're still stuck on Rails2, seriously consider upgrading. Your life will be much happier (once you go through the pain of course ;-)

<comment><USER3> Give me the pitch for going from working 2.x code to code which may fail in unforeseen ways and will certainly take a week of dev time to release. I am not being sarcastic, I just do not see the win of being on the bleeding edge here. The huge win I see in 3.0 is the security feature for untrusted string escaping, which will save me time and pain but is also available as a back port. I am unaware of any other huge wins.

<comment><USER4> My pitch: If you plan to support your app for a long time, you will realistically have to upgrade to 3.x eventually. Better to do so at the same time as everyone else to benefit from the hivemind's concentrated power. Plus, given advances in SCM technology, branching should be easy, and you can abandon/return to your upgrade branch later if you have insurmountable problems.

<comment><USER5> To play the devil's advocate, maybe it's best to the let the pawn... er, early adapters, go first, find all the gotchas, blog about them, patch them, and then upgrade. ;)

Disclaimer - I'll happily be one of the pawns. :D

<comment><USER6> As a paw.. I mean, early adopter, I've been using Rails 3 for things-people- pay-me-for since beta3 and seen it really mature over the last few months.

</comment></comment></comment></comment></comment><comment><USER7> Moments after the release, deployed <http://rubygems.org/> on rc2. Didn't have any problems moving over from rc1 :)

</comment><comment><USER8> Holt sh1t, "unless any blockers are discovered with this release, we're targeting the final release of Rails 3.0 for this week(!!!)."

Here's hoping that'll be before the weekend and wish for a Heroku update of the Bamboo stack :-)

</comment><comment><USER9> Personally, I don't think it will be that big of a deal to upgrade to Rails 3 from a 2.x app. They have done a good job of deprecating stuff, so Rails 3 should naturally lead to a leaner Rails 3.1. While it might not be a standard app-maintenance upgrade, I think it's worth it if you have decent code with some tests.

Also, not sure how it will compare to the 1.x => 2.x upgrade, but I was able to get a very complex application with horrible code and no tests upgraded from 1.x Rails to 2.x Rails. It only took me 3 or 4 days to get 90% of the app working. The rest was just stuff that I didn't find was broken. Since the app didn't have any integration tests, none of those features even got tested. I had to rely on traditional QA to find the errors, and this process took just under a month.</comment>


Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give? - <AUTHOR>

My 13 year-old cousin hacked into his school's computer system. He didn't do any major damage, but I want to make sure he knows why what he did was wrong and show him ways in which he can use his talent to make a positive impact on the world. What is the best way to approach him? Are there any good articles / books I can recommend to him? <comment><USER2> When I was in high school, I guessed the administrator password of our computer lab (it was the administrator's daughter's first name) and basically maintained the computer lab for the rest of the semester. I never did any harm in the process. The administrator, upon finding out what I had done, recognized that I knew what I was doing, and supported my work. I fixed permissions that repaired apps that had been mysteriously broken for years, reset other students' passwords at their request, and lots of other helpful things..

Then one day my teacher switched places with the only other person who had the admin password, and she didn't know about what I had been doing. When she found out that I had administrator access, she was infuriated. She called me a "hacker" and reported me to the principal. The principal planned to give me a 0 in the class and possibly expel me from school. The only people who were allowed to be in the "hearing" which decided my fate was the pissed off teacher and the principal. The administrator, who vouched for me, was told that no one asked for his opinion and that it wasn't relevant. I almost failed to graduate because of this, and it was only through being persistent and involving every teacher I knew that I managed to not fail (the principal reduced my grade to 75/100 instead of failing me).

I would tell your son that most adults who have authority (including principals, teachers, judges and police officers) do not understand technology and computers very well, and therefore it's important to not only operate within the scope of the law and rules of his school, but to also not even _appear_ to operate outside those rules. Computers are cheap, and in 2009 there's not much more interesting in his school's network than what he can set up on a $200 netbook.

<comment><USER3> A long time ago my son did a similar thing. He didn't get into trouble because he told me first. We had a long adult talk about professionalism in programming. Essentially, professionals dont crack, but also about writing good code, testing, comments and such, so that it didn't come across as an adult smacking a kid. It worked, because he started taking a more mature approach to what he was doing.

<comment><USER4> To be fair, there are many professions in IT. Programming is just one of them. Computer security and system administration are two other very different ones. They don't necessary involve much "good code, testing, comments and such". On the contrary, they can involve in-depth, hands-on knowledge and experience of the kind of tools that other people will use, to be able to protect systems from them.

<comment><USER3> Agreed, but he was in 7th grade, 13 years old, so professionalism in that context was about programming.

</comment></comment></comment></comment><comment><USER5> The best reference I can recommend would be Eric Raymond's "How To Become A Hacker" : <http://www.catb.org/~esr/faqs/hacker-howto.html> The key point the article points out is that "The basic difference is this: hackers build things, crackers break them." The teenage thrill of breaking into computer systems is certainly exciting but perhaps he will be even more enthusiastic about learning to be curious about how things work under the hood, how to do clever things via programming and how to develop a true hacker mind set. Of course all this without the risk of getting into trouble like breaking into his school's computer system. I am glad to know that he did not choose to do any major damage but nevertheless I hope he grows up to become a fine hacker and understand the true meaning of being one. Good luck and great effort on your behalf to try to advise him in the correct path!

<comment><USER6> I have a problem with that essay. It makes good points, most of which I agree with, but Raymond states them as values to be learned without explaining why. He essentially states his own beliefs without giving reason for some of them or explaining why such mindsets are useful. (Or: he shows rather than tells.)

The phrase that stands out most upon first glance is this:

 _Similarly, to be a hacker you have to get a basic thrill from solving problems, sharpening your skills, and exercising your intelligence._

 _If you aren't the kind of person that feels this way naturally, you'll need to become one in order to make it as a hacker. Otherwise you'll find your hacking energy is sapped by distractions like sex, money, and social approval._

I've found this not to be the case. Wanting sex, money, and social approval is not necessarily detrimental. Similarly, I get no thrill from solving problems per se. I don't think that that thrill is a necessity for hackers. Raymond uses too broad a brush.

<comment><USER7> What is your connection to the hacker culture, if not problem solving?

<comment><USER6> From some lens, my approach could be seen as problem solving. I've always viewed it as more of a creative art: I view the things I create as concepts. "What would happen if a web site worked like _this_ , for instance, then I create every to revolve around that central theme. Some of the stuff I do is geared at problems, but I feel that viewing mistakes as bugs is a very sterile approach and I hate it.

I don't have a lot of the traits that go alongside hackers, either. Coding languages don't fascinate me, by-and-large. When I look at a language, I figure out exactly how to get things done and then I don't look at it again. As a result, I don't find much fascination in discussions about programming, which is rare among hackers.

</comment></comment></comment></comment><comment><USER8> Whatever you do, do _not_ punish him for this. While what he did was not right (though your use of "hacking" here is very broad), instead of telling him how wrong it was, simply try to push him in a more positive direction. My suggestion would be to ask him to work on some sort of project for or with you, perhaps even get him involved in something small and open source. Starting a website may even push him in the right direction.

An alternative would be to talk to the school and see if they could give him some sort of credit for helping administer the network, or work on a special project for the school.

To give you an anecdote: in high school (and this was only a few years ago), me and my friends consistently were cracking passwords and breaking into various parts of our school's network. We never did anything harmful, nor did we ever cheat, but we did it for the fun and the challenge. One day, we happened to find a file containing all the passwords to every user on the network -- teachers, guidance counselors, and principal included -- and we turned it into the principal. Instead of telling us we were wrong for "hacking the network" and questioning us, he thanked us profusely and got the file deleted from the network. No punishment.

In middle school, however, I got in minor trouble for "hacking" by using proxies to skirt around the school's filtering system. The "techs" in the computer lab quite literally pulled me out of class and angrily questioned me, telling me how I was wrong and what I did was bad. What happened? I continued doing it, and just made sure not to be caught.

My point is that telling him he is wrong will not stop him, and he will likely continue what he is doing because it stimulates him and he finds it exciting. By nurturing that excitement and funneling it into something constructive, such as an alternative project, he will learn what the better avenues are and likely forget about "hacking"/cracking almost (if not) completely.

</comment><comment><USER9> Just because you CAN screw around with someone else's property doesn't mean you SHOULD. Although it can be exciting (especially at that age) to do something forbidden, he can suffer the consequences if caught. He might inadvertently harm the system and could wind up in serious legal trouble. It's like walking up to someone's front door, twisting the knob and discovering that they forgot to lock it when they left. That doesn't give him the right to enter the house, even if all he wanted to do was "look around". Turn the situation around: would he want someone hacking into his home computer because he didn't have it properly secured? Would they have the right to do it to him?

</comment><comment><USER10> I'd try the "with great power comes great responsibility" angle. They did the best their muddled minds could do to secure their system. It was trivially easy to break into it using your l33t haxor skillz, but might does not make right. Have a little compassion.

Also, remember, embarrassing them in this way might cause them to use the great power they have over you to make your life miserable as well. It goes both ways. The luddites in charge of public schools are usually docile, slow moving creatures, but they can become suddenly fierce if poked in the eye with a sharp stick.

</comment><comment><USER11> Show him this:

<http://www.paulgraham.com/hs.html>

<comment><USER12> I think that piece makes some assumptions about the attention span of 13 year olds that are not present in the samples available to me :)

<comment><USER13> I knew a 13 year old, diagnosed with ADHD for not sitting quietly in class, who could concentrate on a chess game for 4+ hours straight. And then play another one after a short break.

I could do the same. I also read SICP when I was 13.

<comment><USER12> I have a son like that. He's great at the stuff that he is interested in, anything else and he's bored instantly.

ADHD to me is just a convenient label for kids that are different than that norm, so we trot out the medicine cabinet to make them conform instead of helping them to cope with the world around them we make it easier for the 'rest' to cope with them.

<comment><USER6> When I was in high school, a friend told me he had been diagnosed with ADD. His parents had him tested because his grades were suffering.

My friend and I have similar personalities, and my grades were similarly hit- and-miss. I went home and asked my mother if I had ADD. Her response: "Probably."

I'm grateful that I had parents who accepted my quirks as a part of my personality and not as problems to be fixed.

<comment><USER12> I guess I got lucky, or I would have been on ritalin or some other fashionable (or profitable) drug for sure.

I'm 43 now, 44 in March, when I was a kid ADD did not yet 'exist', and from my experience with my sons teachers the teachers in the schools that I went to were of a better grade than the teachers he has to content with (and that have to contend with him) today.

I think the latter is the biggest factor in the diagnosis of all these 'children that we can't handle', it is striking that the %age of these kids seems to go up with every generation. Hopefully soon there will be generation of teachers that is as fast and as smart as the kids they are trying to teach.

To some extent I think it is the influence of our media rich world, and next to that probably the enormous amount of technology and information available to kids from a very young age onwards that causes kids to be so tremendously fast at the stuff that these teachers can barely cope with.

Boredom is their lot, unless you can get them interested, and once you manage that better hold on to your hat.

One thing I have found to be universal in dealing with 'gifted' or 'fast' children (I prefer those terms), it is that once you have gained their respect it gets a lot easier to communicate with them and to get them interested in the stuff that they should know.

It's just that if you're a teacher and you get these knowledge seeking missiles that can run rings around you your visceral response is probably to want them to slow down to your level. I think that is the best way to lose their respect.

Congratulations to your parents, they seem to have done just fine :)

<comment><USER6> _Hopefully soon there will be generation of teachers that is as fast and as smart as the kids they are trying to teach._

As much as I would love to believe this, I'm at a college that's renowned for its teaching program, and teaching majors came to me for quite a lot of tech problems. (Two didn't understand basic algebra - worrysome.) The problem is that people who decide they want to become teachers very rarely work well as teachers. My favorite teachers were all passionate about their subject first and foremost: many of them, even in high school, committed to their work outside of just teaching. The people who say "I want to teach and I don't care what" are very often the most problematic teachers.

I agree with you entirely about how enormous the world of media has become. That's part of the problem. There are so many things to pay attention to that the slow pace of the average classroom doesn't have enough to appeal to students. With the exception of perhaps three teachers' classes, I learned more online than I ever did in a class. (The solution is to develop teachers who are more singularly fascinating than the Internet, which is a difficult challenge.)

<comment><USER12> > The solution is to develop teachers who are more singularly fascinating than > the Internet, which is a difficult challenge.

That had me chuckling out loud. I think we'll see a certain game program for sale before that will happen.

<comment><USER6> It's possible. My English teacher in junior year absolutely was. I went in the first day, tried to pick a snarky fight with him over James Joyce, and then stayed after class to talk to him about _Ulysses_ and Nabakov's _Lolita._ ( _Ulysses_ is one of my favorite novels.) By the end of the week, he'd recommended two bands to me that I fell in love with; before winter, he lent me his copy of _69 Love Songs_ , which profoundly affected how I looked at music.

Later, he was the reason I befriended a kid I'd been at odds with for years, an arrogant film buff. When we started to have extended discussions covering literature, cinema, and music, I started looking for some of the films they were mentioning, and in doing so became close friends with the film kid. It led to one of the best summers of my life, driving around the state in his Wrangler to get a copy of _Spaced_.

(Meanwhile, the class we met in was a half-year course filled with a ton of kids with short attention spans, and he managed to get us to read something like 7-8 books and a ton of short stories, and crammed us with 5 excellent films in between.)

How you isolate people like that and identify them, I don't know. They exist, though.

(Game program? What do you mean?)

<comment><USER12> Amazing story...

Identifying people like that really would be a mission worth undertaking, food for thought there.

The game reference is a /. meme reference about 'duke nukem forever', a game that has been in production since '97. The running gag is which will come first: hell freezes over, duke nukem forever is released or the Hurd is finished.

My money is on hell to freeze over :)

<comment><USER6> Rumor has it that the game'll be out by 2010. I saw the intro video myself. (And wasn't Chinese Democracy finally released?)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Don't get caught.

<comment><USER15> Seconded. I cannot imagine any good will come of his getting caught. He should keep his head down -- not tell ANYONE about what he did, even his friends -- and hope no one notices.

Whether he gets caught or not, this strikes me as a good lesson to learn before he's 18.

<comment><USER14> > _not tell ANYONE about what he did, even his friends_

Indeed -- I suspect the proportion of criminals who were caught because they bragged to their friends is quite high.

</comment></comment></comment><comment><USER12> Why was it wrong ?

He shouldn't have been able to do it anyway. Compare it to a kid kicking against a fence and finding out that it swings open.

Simply explain that if you have no business in a system that you should not try to gain access, that should be plenty.

<comment><USER12> Up/down up/down, if you disagree say so.

Do you take offense at my suggestion this kid did nothing wrong ? Why is that ? Enlighten me, for all I have read above the sysadmin is the person in the wrong, if a 13 year old can walk all over your system you ought to be looking for a job (and one that does not include system administration).

<comment><USER16> _He didn't do any major damage_

What do you mean he didn't do anything wrong? If all he did was find a way into their systems and report his findings of insecurity or something, certainly there would be nothing wrong with that (as long as he's following his terms of use for the school computers, also -- he's held to the rules of the school as a student). But it appears as if he's done something, maybe he didn't report what he discovered, that is indeed wrong.

And I agree, the sysadmin must be pretty incompetent, but that is still no reason to be doing that. It's like saying "the lock on this safe is weak and easily broken, so I will go ahead and break it to access the contents inside." It's still a safe, you're still not supposed to break it. If you do, you should immediately recommend to the owner that they get a stronger lock.

He's a typical (in a sense) 13 year old. This hardly warrants punishment. But he should indeed put his talents to better use, and that's what the author of this thread is asking. What would we recommend?

<comment><USER12> If the kid was properly instructed beforehand on what was acceptable and what was not then you have a point, but the story does not relate that, hence my question.

I'm assuming that this kid is just as curious as any other kid at that age, and the systems should be set up accordingly.

This is trying to close the gate after the horse has bolted, ok, so he looked, big deal. Now catch up on the educational bit about privacy and minding your own business, case closed.

No need to make an issue out of it. The overreaction in these cases does more damage than the event itself.

</comment></comment></comment></comment><comment><USER17> Do what my parents did when I got suspended for "hacking":

1) Get him a new computer (but with a crappy video card, if he's into gaming)

2) Find him programming internships and introduce him to programmers you know

I would also add:

Tell him that he isn't a real programmer unless he understands Prolog, Haskell, C, and a flavor of Lisp (Scheme/Arc), although Python might be a good first language to start with. Be prepared to spend lots of $ on books - all of these topics have books which work for different people. I would recommend:

The Little Schemer series: <http://www.ccs.neu.edu/home/matthias/BTLS/> and Programming in Haskell <http://www.cs.nott.ac.uk/~gmh/book.html>

These are solidly good books, there are others, but they really depend on personality.

</comment><comment><USER18> define "hacking", did he do anything complicated, or did he just guess a password?

<comment><USER19> indeed, this could mean anything, i got sent to the principal one time for having a windows dos command prompt open, no joke

Apparently it was actually a rule in the rulebook that you arent allowed to use the command line because you can do 'great damage'. On most computers it was disabled, but this was computer science class and we wrote console applications in c++ (through visual studio ide) so it had to be enabled.

They called my mom, who isn't very computer savvy, and told her that I was 'hacking'. She was so mad at me. I got 1 detention and had to write a handwritten note of apology. It was a pretty bad experience overall.

<comment><USER20> I'll see your DOS prompt and match you a "changed the desktop background and inverted the screen colors" trip to the principles office.

They wanted to suspend me for two days for that one. Happily, I was able to get another teacher to talk to the principal and explain that computers is "his thing" and that just because it was _possible_ that I knew how to do something doesn't mean that I _did_ do it.

</comment></comment></comment><comment><USER21> Tell him to stop before he gets caught. Even though he didn't do any damage, a school's administration will not take kindly to the potential threat that he is.

here's one example, a quick google search - 69 felonies for stealing tests and changing grades <http://www.tgdaily.com/content/view/38012/118/>

Also, even though he got in, I wouldn't attempt to notify them of their breach, because again the school will probably go ballistic on him, I think there was a news story about this, but what happened escapes me.

</comment><comment><USER22> Your approach depends on a lot of things really.

I often thing, personallly, that whilst reading books/articles is good it doesn't help instill a lot into a young hacker.

First I would buy him Kevin Mitnicks books. I recommend them to every new hacker because: a) some of the stories are unbelievably inspiring! b) it's all real life stuff c) he manages to tell the stories of these great hacks without glamourising the illegality. It does a lot to prove hacking can be great fun within legal bounds.

The next thing I would do is encourage him to get involved with a programming community. Get him to learn a language and start ot play with it. :)

in terms of cracking (as opposed to hacking) sometimes pushing the boundaries happens (either for personal reasons or professional). I would teach your cousin that breaking the law is wrong. Breaking into the schools system is (speaking technically) as bad as breaking into a microsoft server. But the impact of the 2 activities (assuming it was simply to look both times) is very different. Try to show him that experimenting with something like the school system is fairly harmless but still wrong and he should take it no further unless he has permission :) (offer the school a pen test :D)

Finally a lot of people are saying "teach him not to get caught" (essentially). This is a most important lesson. I crack for a living (White Hat I hasten to add) and one of the things that makes me good at that is paying attention to covering my actions :)

</comment><comment><USER23> If your cousin is interested in doing that kind of work, why not suggest him to volunteer with the school? All the other responses seem to romanticize the rogue hacker. Instead, I think he should come clean, and do his work in the public. He could offer to audit the school's network. For a 13 year old, this would be a great opportunity to teach him to be professional and helpful.

<comment><USER24> This is a fantastic way to get your cousin expelled from school, and to provide him with a shiny new juvenile criminal record.

<comment><USER25> from my experince at 16, you are correct. volenteering with te school will get you into trouble. get the kid a computer of his own with an open source operating system on it. this is a) harder to break than windows and b) a more friendly platform for exploration. I did this at 13, but my parrents are hacker literate.

I cannot comment on ethics though, or parrenting. Both of my parrents were computer scientists at one time in there carreer, and I still bounce Ideas off of my father. Personaly, I think this is the best way to grow up with such a skill set. my only regret is that I have not had much motivation to hack when I can have a rely interesting discussion with my father.

</comment></comment></comment><comment><USER26> Tell your cousin he gets about 3 more years of goofing around like that where he should use the "stupid kid" or "I dunno" defense and get off scott-free or with a slap on the wrist. Once he's an adult though, the kiddy stuff has to stop.

If he's messing with financial systems or other serious stuff, give him a _thwock_ on the skull and remind him that it would be unfair and immoral to screw with the systems more than the CEOs and bankers already have. =)

</comment><comment><USER27> I'd tell him to set himself up for success. His activity was innocent this time but by creating situations where he has the opportunity to do so not-so- innocent things, he'll give in to the temptation someday. It's like working at McDonalds or KFC: there is a big chance that you'll gain 2-3 lbs ever month you work there because sooner or later, you'll eat there. He shouldn't put himself into such situations where he can screw up. Bad decisions snow-ball.

</comment><comment><USER28> My only advice is to go for B's. A will be too suspicious.

</comment><comment><USER29> Just let him know what the potential consequences are, and your recommendation (which I'm assuming is to "not" continue).

See if there is any way you can spin this toward the "good", by possibly having a meeting with the schools principal and systems admin. This is obviously a crap shoot, but could possibly be beneficial to your son's education.

</comment><comment><USER30> World is full of hackers. Some hackers are good...some are bad. He needs to choice his site in this thing. If he is "good" hacker, i suggest continue, if he is "bad" hacker, he can hack into government networks without getting caught. But if he gets caught, he goes to jail for a long time, maybe less than 10 years.

</comment><comment><USER31> I'm guessing "war games" wouldn't help :-)

</comment><comment><USER32> Just don't let him blog about it... my dumb ass did that and got expelled. Best thing that ever happened to me, looking back, but it caused a whole lot of turmoil.

</comment><comment><USER33> Firstly make sure he realizes if he gets caught, the government is going to ground him from coming near another computer for 20 years.

</comment><comment><USER13> he didn't do anything wrong. congratulate him, and offer him links to some things you think he may enjoy to learn more.

if you fear he will make mistakes, the best way to combat that is with knowledge, not by taking the school's side against him and calling his great success immoral.

</comment><comment><USER34> Being smart is not an excuse to be lazy. Also, don't be stupid.

</comment><comment><USER35> Each man has a right to his own property, including his intellectual property. Therefore it is wrong to "hack" if this means breaking into somebody's system without their permission, because it is a violation of the right to property. A copy of 'Atlas Shrugged' could drive this point home I think. But there are great jobs in computer security, in which people can get payed to "break into" systems to smell out the security flaws. This might be a positive way of channeling this individual's skill set.</comment>


Latency – the sine qua non of AR and VR - <AUTHOR> http://blogs.valvesoftware.com/abrash/latency-the-sine-qua-non-of-ar-and-vr/

<comment><USER2> I wonder if some of the latency could be soaked up by a physical adaptation of the display panel. Imagine a display that adjusts position manually/mechanically in relation to the head movement, enough to give the latency time to catch up with the underlying movement. People won't just sit in a chair and spin 360 constantly. If the physical display could shift the angle of view or the pan/scan of viewable pixels perhaps the rendering could happen a bit slower and catch up when the user stops for a second to focus etc.?

You could render a 'latency' buffer past the edges of the panel's physically viewable viewport and then the panel could expose that zone along with head movement while the rendering continues to work on catching up with the actual shift. When the head comes to a stop for even a handful of milliseconds the display can recenter while the scene is rendered to "time current" position.

<comment><USER2> Hmm on second thought you could also just render the "overscan" and have the IMU work with the display to shift the pixels into view while the processor works to keep the overscan updated. On pause you can re-render everything (overscan included) and start all over again on the next movement.

         +</comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>+
         |   <<< "over scan area" >>>   |
         |   +</comment><comment></comment><comment></comment><comment>----+   |
         |   |   viewable by user   |   |
         |   |                      |   |
         |   |                      |   |
         |   |                      |   |
         |   |                      |   |
         |   +</comment><comment></comment><comment></comment><comment>----+   |
         |   <<< "over scan area" >>>   |
         +</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>+

This might leave enough "headroom" too keep up with potential movements at very low latencies.

<comment><USER3> Eye tracking would allow even more latitude. The eye picks up very little detail outside of the central area of focus. It is also very good at inventing information to fill in any gaps - for example during the periods when the eyeball shifts position we are essentially blind but the brain fools us that we see a continuous image.

<comment><USER4> <http://en.wikipedia.org/wiki/Saccadic_masking>

<comment><USER5> In Peter Watts' scifi novel "Blindsight"[1] there is a description of aliens which could program their bodies on the fly to move only during the saccades of one human observer in order to hide themselves[2].

[1] <https://en.wikipedia.org/wiki/Blindsight_(Watts_novel)>

[2] <http://www.rifters.com/real/shorts/PeterWatts_Blindsight.pdf> page 236

<comment><USER6> What an awesome concept! Thanks for the link, I think I'll be adding this to my reading list.

</comment></comment></comment></comment></comment><comment><USER7> Michael Abrash's wikipedia page, which predates the blog post, says:

"He frequently begins a technical discussion with an anecdote that draws parallels between a real-life experience he has had, and the article's subject matter. His prose encourages readers to think outside the box and to approach solving technical problems in an innovative way."

<http://en.wikipedia.org/wiki/Michael_Abrash>

</comment><comment><USER8> The section about "racing the beam" is interesting.

> But that means that rather than doing rendering work once every 16.6 ms, you > have to do it once per block. Suppose the screen is split into 16 blocks; > then one block has to be rendered per millisecond. While the same number of > pixels still need to be rendered overall, some data structure – possibly the > whole scene database, or maybe just a display list, if results are good > enough without stepping the internal simulation to the time of each block – > still has to be traversed once per block to determine what to draw.

You could do a pretty simple hack though, that might be good enough: Render the frame onto a buffer, as usual, but instead of displaying it, re-render it using beam-racing with the proper rotation around the viewer to counter the latency of the rendering and transfer time.

This would be a bit like how Google Streetview interpolates the panoramas when you move, but very much simplified, since you only correct for rotation.

Edit: Fixed the "ream-racing" typo.

<comment><USER9> Googling "ream-racing" doesn't give any useful results. Could you elaborate?

<comment><USER10> I think it's a typo for "beam-racing".

</comment></comment></comment><comment><USER11> So this guy responsible for Mode X. I remember implementing Mode X support on the first OS I ever wrote. Oh the fond, frustrating memories.

</comment><comment><USER3> I get the AR bit - but without a 'real' image in the same scene to compare with - isn't the bar potentially lower for VR?

<comment><USER12> Not necessarily. VR is, of course, free of visual misalignment, but there are other sensors whose readout may conflict with the rendered scene. Proprioception, balance, Helmholtz's efferent copies: unfortunately we're pretty good at integrating percepts and detecting state inconsistencies.

</comment></comment><comment><USER13> I think you could work with a laggy, semi-VR implementation. This would be fine at 30ms (or hell 300ms).

Once the demand existed for VR headsets for these applications, perhaps hardware vendors would/could start producing low-latency displays as a way to compete in this market.

Then, real VR applications could be made to take advantage of the newly available VR headsets.

Instead of tracking the head, the fake-VR could define slight translations and slight rotations corresponding to WSAD etc a bit like the Wii works with Red Steel.

I think that, without full VR, would already be an improvement for folks who want to play shooters today but get thwarted by the controls.</comment>


Require Congresspeople to issue a public statement justifying every vote - <AUTHOR> https://petitions.whitehouse.gov/petition/require-officials-elected-congress-issue-public-statement-justifying-each-and-every-vote-they-cast/tSrgZPpN

<comment><AUTHOR> (I am not the author of this petition.)</comment>


Is Your Favorite Open Source Technology in Growth or Decline? - <AUTHOR> https://stackoverflow.blog/2017/05/11/favorite-open-source-technology-growth-decline/?cb=1 <comment><USER2> StackOverflow data is not appropriate for drawing conclusions about popularity, growth, or decline.

For example, it's possible that a language is heavily discussed because it's difficult to use or often used by beginners. This effect would inflate PHP's or R's popularity (many R users aren't primarily programmers), and it would deflate C++'s popularity. I found the same effect on Google about 10 years ago: it was easy to find beginner tutorials for PHP, but very difficult to find ones for C++.

You'd also have fewer StackOverflow posts about languages with great error messages, helpful tooling, and static analysis.

The question this data really answers is, "Which programming languages are people getting stuck using?"

Formulated that way, it's a little bit too broad to be interesting, because "getting stuck" could mean a badly designed language, inexperienced user, or both.</comment>


Make My Day - <AUTHOR> http://www.makemydayblog.com/ <comment><USER2> If he is going to gain any traction with this, it needs to be some sort of web app where people can vote and collaborate on what the day is. Just having people email him suggestions probably isn't enough.</comment>


Ask HN: How to make sure that my explanation is being understood? - <AUTHOR> I feel like lot of times when I am explaining bit more complicated concept, the audience or the interviewer isn't grasping it.
I would either start explaining too much or start rambling. How do you make sure your explanation is concise and clear without being either too superficial or quite elaborate? Also what would be the way to have some kind of implicit feedback when I am explaining it to someone so that I feel like they are understanding what I am talking about? <comment><USER2> The right explanation is tailored to your conversation partner. Perhaps every third or fourth sentence, punctuate your speech with an open question. Does their response feel like they're close to what you're trying to communicate?

Writing is also a great way to practice and validate your own understanding of the concepts you want to discuss.</comment>


Universal React with Babel, Browserify - <AUTHOR> http://ponyfoo.com/articles/universal-react-babel

<comment><USER2> Thanks for taking this on and writing about it. I learned several things already.

One thing I've read in the past is that the React render method should always produce the same output given the same props and state. However, this line:

<button onClick={this.handleClick.bind(this)}>click me!</button>

breaks that, since it creates a new click handler each time. I've seen people creating the binding once in the constructor and using that in the render method.

</comment><comment><USER3> I'd like to know if you are considering to try riotjs.</comment>


Researching UK entrepreneurs that have secured a US Visa - <AUTHOR>

Writing an article that will profile UK entrepreneurs that have managed to secure a US visa.
It's a continuation from this article http://www.startups.co.uk/what-london-can-learn-from-silicon-valley.html
Looking to quote in the article.
Love to hear from you if this is you - email me: email@example.com
Or just suggest names of UK entrepreneurs in the US that I should get in contact with. <comment><USER2> William - i think you've tapped me for everything I know about this but happy to catch up again. You have my contact details.

Andy McLoughlin

<comment><AUTHOR> Check email :)</comment></comment>


The Ambiguity of Open and H.264 vs. VP8 - <AUTHOR> http://antimatter15.com/wp/2011/01/the-ambiguity-of-open-and-vp8-vs-h-264/

<comment><USER3> >H.264 is an open standard. It was developed by a committee, standardized, reviewed by many engineers and developers for multiple companies and has been standardized for use with a multitude of containers and devices.

>VP8 is not a standard. It was developed secretly by a single company, and until recently, had only a single working implementation. The public wasn't open to collaboration on the specification until the bitstream spec was frozen, including the bugs that existed within.

This is an interesting point. One I had never even realized.

<comment><USER4> This is an important point not just for ideological reasons, but it is one reason why the FUD argument is not symmetric.

Since H264 was implemented in the open with open and large membership to the body, it is more difficult for some company to come out of the woodwork and say, "Hey, we have a patent that H264 rides on, but we didn't know it until now" Note, QCOM tried this with H264 several years ago and got their butt handed to them by the courts (<http://www.broadcom.com/press/release.php?id=1037466>). People have had 10 years to examine this open specification. I think its reasonable to say that one would have found a violation by now. And almost all the majors are already either licensees or licensors. There's a slim chance that there's a patent floating around in some patent troll portfolio that hasn't been examined, but that's the only real vector I can see of a legitimate surprise H264 patent violation.

Whereas with WebM its been in the public domain less than a year. It could feasibly take a few years for it to be reaonable that anyone who would have done due diligence to have done so. It's completely reasonable that in a year from now Siemans comes out and says, "WebM infringes these three patents we have". A court is not likely to throw it out saying they've been sitting on them.

<comment><USER5> While what you're saying is true, the royalties side of things has been locked down by Google's legal team very effectively. If said patent holder makes a patent claim against WebM they automatically destroy all free royalty rights for themselves on the same codec (if I understand correctly). This means that while they could try to hold Google (or any other user of the codec) to some kind of patent royalties, Google could retaliate for any use that company or individual makes of the same codec (with as much leeway to set a price as the patent gives the original individual or company.

This is the true genious of the WebM license. It means even if this _does_ happen in the future, Google can destroy whoever has this patent through a massive counter. It also means that any challenge would have to be made extremely carefully.

edited for spelling :)

<comment><USER6> Doesn't matter if the patent holder is a troll with no viable products of its own.

<comment><USER7> But H.264 would not be immune to that either.

</comment></comment></comment></comment></comment><comment><USER8> Very good summary of the issue. I particularly like the point that <video> is, in and of itself, open and as such the establishment of a consistent baseline codec in VP8 could actually allow h.26x to flourish and innovate as the codec of choice for high-quality content.

</comment><comment><USER9> This is a great post and clarified quite a few confusing points of the discussion for me.

One area that unfortunately it didn't really cover was the impact of widely available hardware and GPU-accelerated decoding for H.264. Surely the millions of non-PC devices being sold with H.264 support (even baseline) will have some effect on the outcome of the new video format war.

<comment><USER10> Not really. The upcoming generation of mobile devices will have hardware support for VP8 and the users upgrade these devices very often.

<comment><USER11> Very often? Have you seen how many people are still using iPhone 3Gs (not 3GSs!) That's about two and a half years old.

<comment><USER12> I still am. I know a couple people who still are too (the 3G iOSv4 wouldn't have needed an update if the market share weren't significant).

</comment></comment></comment></comment><comment><USER13> > MPEG LA has a royalty cap so that companies selling high-volume products > know beforehand the maximum amount of royalties they'll have to pay to MPEG > LA in a given year. The current $5 million cap really isn't much for a big > player possibly generating many billions of annual revenues with products > that include an AVC/H.264 encoder and/or decoder.

[http://fosspatents.blogspot.com/2010/06/mpeg-las- avch264-lic...](http://fosspatents.blogspot.com/2010/06/mpeg-las- avch264-licensing-terms.html)

<comment><USER14> leaving google aside, I think it's pretty obvious that the "royalty-free codec" that entities like Mozilla are looking for is pretty incompatible with "but there's a cap on the royalties."

hence the <video> situation we were in even before last week and google's blog post.

</comment></comment><comment><USER15> The biggest part of the 'rage' towards Google over the drop of Chrome's native ability to use H.264 in the <video> tag, is that Google is trying to spin as its for the benefit of innovation. Which is not the case. Flash has been great, but it's not needed for the distribution of video content, and the fact that WebM is a lawsuit waiting to happen does not help either.

Great article though!

<comment><USER16> H.264 could also be considered a lawsuit waiting to happen. Who knows who out there has a patent it infringes? Maybe the webm folks have a few patents it violates?

<comment><USER17> _H.264 could also be considered a lawsuit waiting to happen_

It _could_ be and its been challenged at least once in the past (however Qualcomm lost that challenge), but though its not free, its patent restrictions are pretty clear and tested. It is 7 years old. While stranger things have happened, its very unlikely that as a licensee of H.264 you are going to be sued.

WebM's status is not as clear, sometimes you choose the devil you know.

</comment></comment></comment><comment><USER18> Could this be a move to get the H.264 patent holders to release their patent hold on the standard?

<comment><USER19> It's definitely putting pressure on them to provide a royalty-free version, which might include some of the less performant profiles. This was in the mix originally when H.264 was being developed, but major patent holders refused to go along with a 'royalty-free baseline' profile.

</comment></comment><comment><USER20> Why is it necessary for HTML5 to specify a codec for the <video> and <audio> tag when no format is specified for <img>?

(I'm not being rhetorical)

<comment><USER21> It's not really necessary, and so far the HTML5 spec hasn't done so. However, it would be useful if all browsers had at least one codec in common. GIF and JPEG became de facto standard image formats because all browsers supported them, even though there was no de jure requirement.

</comment></comment><comment><USER22> As the end user...I only care about which one gives me the best experience period.

<comment><USER23> I'll expand a bit on barrkel's comment:

Back in the day when IE dominated Netscape Navigator/Communicator, IE _was_ the best end-user experience. Flash-forward a few years and IE is languishing, with practically no new development happening on it. At this time (prior to Mozilla taking off), IE is still the best end-user experience _available_ , but not the best end-user experience _possible_. It to took the Mozilla Suite and it's spin-off, Firefox, to bring a better user-experience to market.

The same applies now. While h.264 might provide the best experience _right now_ , it's (possibly) at the cost of the experience in the future. What happens in the future when the MPEG-LA decides to start changing/enforcing royalties? What growing pains will the industry have to endure to change formats away from h.264 if that becomes an issue? What if h.264 is so entrenched that they can't migrate away from it? Why not just standardize on something now that won't have those problems later?

To fall back on the analogy, if IE hadn't pushed Netscape out of the market, what would the web ecosystem look like now?

</comment></comment><comment><USER24> Fantastic article. This is one of very few entries on this debacle that is actually informed and insightful.

<comment><USER25> I agree that it's a well written article and provides a very good overview. The tables are especially helpful.

However, there is one rather large oversight: _H.264 is an open standard_

This is not necessarily correct. As a citizen of the EU, I have to disagree. One of the EU pre-requisites[1] for something being qualified as an Open Standard is: The intellectual property - i.e. patents possibly present - <USER2> (parts of) the standard is made irrevocably available on a royalty-free basis.

[1]: [http://en.wikipedia.org/wiki/Open_standard#European_Union_de...](http://en.wikipedia.org/wiki/Open_standard#European_Union_definition)

<comment><USER26> I'd think that H.264 isn't subject to this definition - or, at worst, it falls in a gray area of sorts - as the H.264 technology is unencumbered by license fees if it's used non-commercially. No developer of _gratis_ software using MPEG-2 or MPEG-4 tech. has ever been subjected to a legal case initiated by the MPEG-LA.

<comment><USER27> > the H.264 technology is unencumbered by license fees if > it's used non- > commercially

That's not true, unfortunately.

There may have been no lawsuits (I can't comment on that, though I'd like to see your data). But that's just because the MPEG-LA hasn't felt like suing people. If you're shipping an H.264 encoder or decoder in binary form to people and not paying the relevant licensing fees, then you're infringing on the patents. There's no exception for "non-commercial" use there last I checked. If you think there is, please cite.

<comment><USER28> They probably won't do it.

Somebody will come up something similar to the hack/exploit that Mozilla did: set up a for-profit corporation to receive money and a non-profit foundation (which owns 100% of corp's shares) to do the development. Then they can claim that the non-profit foundation is the one that's really using the patents and hence should not have to pay royalties.

</comment></comment></comment></comment></comment><comment><USER26> I believe this is to date the sanest article related to the H.264/WebM debacle; it clearly, and with detail, brings out the fact that H.264 _is_ open. However, it fails to clarify a very important detail to this discussion, surrounding the royalty issue: H.264 coding/decoding is _free-of-charge to implement, distribute and use in non-commercial contexts_.

Google's, Mozilla's and Opera's actions and careless, uninformed (or possibly intentionally slanderous) responses in this discussion clearly show that their issue with H.264 isn't that H.264 isn't open enough, but rather that it isn't gratis enough.

</comment><comment><USER29> _> open standard_

 _> incompatible with open source_

Does this make sense to anyone? It seems to me the word open doesn't mean much now.

<comment><USER30> The term "Open standard" predates the term "open source". The latter term was born as recently as January 1998 - around the same moment when Netscape Navigator was open sourced. The semantics that the latter term's use of "open" imply cannot be forced on the former.

<comment><USER31> (disclosure: I work for Mozilla)

I've never found the argument you're making very compelling. It's "open" in the same way that golf course with a $500 greens fee is open.

What it really constitutes is a way for existing market players to collude, and thereby exclude future participants. Some of those future participants might be quite disruptive, and benefit consumers.

It's really pretty funny that some terribly corrupt standards organizations arrived at a totally unsatisfactory definition of "open", and then tried to claim that better definitons of "open" somehow infringed(!) on their early, bad definition.

<comment><USER4> Most public golf courses I know of charge fees. Anyone can play as long as they pay. Some people actually do complain the fees are too expensive, but it's better than some country clubs where you need to be invited, approved, and then upfront dues atart at $100k.

Now I know your point wasn't actually about golf, but a lot of "open" facilities do cost money to use. It's just that they're non-discrimanatory about their use and charge what they consider reasonable fees (enough to pay for staff, upkeep, improvements, etc...).

This is actually very similar to MPEG-LA, the big difference being that MPEG- LA is not non-profit. But then again neither is Google. What would be a nice move by Google is to actually give all On2 property to Mozilla or Xiph. Or ever better yet, Outercurve (to show that they don't really want to indirectly exert disproportionate influence).

<comment><USER19> As for non-discriminatory: I believe the MPEG-LA patent-holders are free to make side deals that bypass the supposedly non-discriminatory licensing fees. So if you are a major patent holder, you can in theory go to each of the other patent holders and negotiate 'cross-licensing' of your patents, agreeing to charge each other nothing for using each other's licenses.

So MPEG in this light can be seen as a collusive monopolistic oligarchy, where if you're in the club you get something for free that everyone else has to pay for. Not very competitive.

A bit of history: early on, On2 made a stink about the monopolistic nature of MPEG-LA:

[http://www.cedmagazine.com/Article.aspx?id=63386&LangTyp...](http://www.cedmagazine.com/Article.aspx?id=63386&LangType=1033)

<comment><USER4> They aren't really side deals. Its that pricing for members is a function of contributed patents. In otherwords, if you contribute 90% of the patents, you pay less.

And anyone can go to each patent holder and negotiate licensing of patents since the licensors still hold the patents. Part of the reason that MPEG-LA exists is to make it so that you don't have to negotiate with fifty companies in order to implement H264. MPEG-LA doesn't block you from doing this if you prefer that route, but it will take a LOT more time and likely be more expensive.</comment></comment></comment></comment></comment></comment>


The slow server flow chart - <AUTHOR> http://blog.scoutapp.com/articles/2014/07/31/the_slow_server_flow_chart

<comment><USER2> "If your a visual person" <\- Just a small mistake in your copy.

I think you should put a bigger Call to Action at the bottom. This post is good and the kind of person who reaches the bottom is going to be more likely to subscribe to your service. You may be losing out on conversions by only having a small link to your home page in the summary.

</comment><comment><USER3> Great article! Very helpful. Thank you Scout for posting this. I've bookmarked it for future server troubleshooting.

</comment><comment><USER4> Great post. As someone working in APM right now this is a fantastic way to explain to people how to understand web server metrics.</comment>


New TLS certificate for .herokuapp.com hostnames - <AUTHOR> https://devcenter.heroku.com/changelog-items/1813 We run a backend API app on Heroku and for simplicity our frontend calls it via the herokuapp.com subdomain `<our-app-name>.herokuapp.com`.
We haven't bothered with a custom domain SSL certificate as the herokuapp.com subdomain has been just fine.
Fortunately I was monitoring the endpoint as I started getting SSL expiry warnings a few weeks ago.
It seems heroku is serving an old certificate for <our-app-name>.herokuapp.com, issued April 2019 and expiring 22nd June:
``` $ curl -v --head https://<our-app-name>.herokuapp.com/ * Connected to <our-app-name>.herokuapp.com (22.214.171.124) port 443 (#0) [snip] * Server certificate: *  expire date: Jun 22 12:00:00 2020 GMT *  subjectAltName: host "<our-app-name>.herokuapp.com" matched cert's "<i>.herokuapp.com" </i>  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 High Assurance Server CA ```
It's a wildcard cert for .herokuapp.com but it's different from the current one I see if I curl the root domain:
``` $ curl -v --head https://herokuapp.com/ </i> Connected to herokuapp.com (184.108.40.206) port 443 (#0) * Server certificate: *  expire date: Aug  2 02:13:11 2020 GMT *  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3<p>```
It seems they've transitioned to Let's Encrypt for the wildcard domain, but it isn't being served for app subdomains. I've checked a few other subdomains and see the same thing:
* govuk-prototype-kit.herokuapp.com * heroku-status.herouapp.com * juice-shop.herokuapp.com
I've been raising this with support since T-30 and they just keep saying things like:
> Our concerned team is aware of it and they are actively working on the renewal process. We'll get the new cert in there well before the expiration, and there will be no disruption of service.
Now we're at 7 days I've lost confidence that support has even forwarded my ticket to the right team.
I suspect in 7 days we're gonna see a lot of things break... <comment><USER2> Something that's nice about Let's Encrypt is that it forces you to change something every few months. After the first couple months, you'll probably get your issues worked out. If you just change certs every few years, then every few years you have some sort of disaster because of the "well we fixed it, we don't have to worry for two years" effect.

A broader lesson is the importance of "trying out" rare events, even before that rare event actually happens. If depends on a service with a certain SLA, it's pretty dangerous when that service has 100% uptime. You never get to see what happens when it does go down, which it did promise you it will. Some people track their error budget, and at the end of the accounting period, break their service in accordance with the SLA. Then you get to see what happens when it does go down. (Ref: [https://queue.acm.org/detail.cfm?id=2371516](https://queue.acm.org/detail.cfm?id=2371516))

<comment><USER3> Although, speaking of Let's Encrypt, there will be a series of disruptive events over the next 18 months or so.

* Soon (although when exactly I'm not sure because it has been delayed at least once) the Let's Encrypt systems will tell compliant ACME clients that the "correct" intermediate is Let's Encrypt's ISRG-signed X3 intermediate. This is a different certificate for the same X3 private key you're used to but not signed by the same trust root. If you use a correct client and have done things properly, this may cut off TLS clients for your systems that don't trust ISRG (the charity which runs Let's Encrypt). Six year old Android phones, the Windows XP system you know should have been retired, a VoIP desk phone running out-of-date firmware, stuff like that.

* In March 2021 the X3 Intermediate expires. If your certificate software was not compliant with ACME, or you manually overrode it to use the old certificates to avoid the problem in the previous item, things break now. More things, and worse. Although...

* Maybe before March 2021 the Let's Encrypt systems stop issuing from those soon-to-be-obsolete Intermediates and use newer ones instead perhaps named Y3 and Y4. In this case if you've jury rigged things (in an ACME non-compliant way) to keep using the old X3 intermediate that'll break suddenly after your renewal. Common web browsers may not trust the nonsense you're emitting, exactly which browsers break may vary depending on exactly what stupid things you did, but chances are you haven't tested and don't know. If you are using a compliant client then modern browsers are all fine, but archaic stuff breaks suddenly.

* In September 2021 the DST Root X3 root expires. If you have somehow clung on to trust via this root, whether through your own effort or via trust path discovery code inside client systems, that goes away instantly. Any systems that don't trust ISRG will refuse to trust your certificates, no matter how often you re-issue them and reconfigure things, those clients themselves need updating urgently and you probably have no way to do that. Oops.

<comment><USER4> That sounds like just one maybe-disruptive event that manifests itself differently if you keep working around it instead of dealing with it properly. If you need to deal with it at all - I suspect most systems that still need to connect to the internet trust the ISRG root nowadays.

<comment><USER5> > I suspect most systems that still need to connect to the internet trust the > ISRG root nowadays.

There are tons of systems that do not -- particularly in the enterprise. I manage web servers for a mission-critical healthcare-related SaaS. We occasionally encounter TLS issues even with Globalsign root certificates -- far more distributed than ISRG.

We ended up switching to DigiCert last year and it helped reduce the number of TLS-related failures reported to us.

We could never switch to Let's Encrypt / ISRG for that reason. Even if ISRG has 95% distribution of their root certificate, that's not good enough for mission-critical enterprise.

I'm not at all surprised that Heroku had to roll back their TLS certificate back to DigiCert -- DigiCert is what you want if need compatibility with the highest number of clients.

</comment></comment></comment></comment><comment><USER6> Why would you pin a certificate that you did not generate for a domain that's not yours?

<comment><USER7> My guess is that it is some larger corporate client with a middleware app they pinned the cert into. An app they built on Heroku hurriedly because it was fast and cheap to get started and they didn't expect to need to scale. Then as can happen it became important and they scaled anyway. They probably lost the talent that built it so they don't even remember how it works.

All of this is assumption based on how they seem to buy enough compute at Heroku to have sway over rolling back this change of cert provider.

<comment> yjftsjthsd-h Ugh, yes, I assure you that some corporate clients will even try to pin the actual leaf certificate; pinning an intermediate or root is almost good behavior for them. (Honestly, the number of times I had to tell _our_ support people that no, we would _not_ support customers trying to pin our AWS-issued certificates, and no, I _couldn 't_ promise to notify them even if I wanted to since AWS could just rotate them at will...)

</comment></comment></comment><comment><USER8> Heroku also doesn't enforce any verification that you own a domain name. Another user can simply add any domain they like to their app if you haven't claimed it by adding it to your app first. Regardless of ownership and you will no longer be able to add your own domain to your app getting a generic "domain is already in use" error. Happened to me a few years ago, had to reach out to support and prove I owned the domain. They made me verify I owned it and fixed it but said theres nothing they can do going forward. Granted it's a total edge case but was still an unnexpected experience, maybe it's fixed now who knows.

Edit: Looks like this is fairly common on PAAS so my original comment isn't that relevant.

<comment><USER9> How does GitHub's gh pages handle this? I don't remember them doing anything either.

<comment><USER10> Pretty sure you have to set some DNS records for gh pages

<comment><USER9> Yes you have to point a record at the gh pages if you want to use dns with it, but I don't think their server checks for that.

<comment><USER11> Is it possible to subscribe to a firehose of .COM NS record updates through one of those fancy things like dnsdb? If so, perhaps there's an opportunity here for exploiting that race condition en-masse for services that support direct NS-style delegation, like netlify.

</comment></comment></comment></comment></comment><comment><USER12> It already broke a few days ago: [https://status.heroku.com/incidents/2045](https://status.heroku.com/incidents/2045)

<comment> tuna-piano Yep, we were down during that time. I don't know what Heroku is doing with this certificate thing, but seems like a mess.

<comment><USER13> If you're pinning the SSL cert then it's not something they can fix, it's something you need to change on your end.

<comment><USER12> We went down. We're not pinning the SSL cert. We're behind CloudFront, and CloudFront didn't trust the new cert and stopped forwarding traffic.

</comment></comment></comment></comment><comment><USER14> Wow. I really hope they'll get it done before the expiration date but I always thought they'd be renewing months in advance at minimum. Are they trying to negotiate something?

<comment><USER3> Get what done?

Heroku replaced their wildcard certificate in plenty of time but many customers do not anticipate anything changing ever and will fiercely resist this simple fact, so for those customers stuff blew up.

Remember the Y2K problem is the result of software written not in 1901 or even just 1981 but even well into the 1990s with the calm certainty that all years begin 19xx.

Heroku can try brown out policies, but this sort of customer intransigence is very difficult to defeat. The customer is quite certain they're right, who ever heard of "change" anyway? Everyone knows that the world is a flat plane, fixed in space, eternal and unchanging, this pinning rule I wrote in 2019 worked then, therefore it is still correct now.

<comment><USER15> This is called 'enterprise' and everyone in it will tell you a million excuses why it's the only way.

</comment></comment></comment><comment><USER16> There's more context in this Heroku Changelog [https://devcenter.heroku.com/changelog- items/1813](https://devcenter.heroku.com/changelog-items/1813)

"On Tuesday June 9th 2020 Heroku changed the certificate used for terminating TLS for built-in <appname>.herokuapp.com hostnames from a certificate issued by DigiCert to one issued by Starfield/AWS. This change was rolled back on June 10th because a small subset of Heroku customers had pinned apps to the DigiCert certificate or had apps that could not establish a chain of trust with the new certificate for other reasons.

A new DigiCert-signed certificate will replace the current one before June 22nd (when it expires)."</comment>


Serious Software SpecLisp for Sinclair ZX Spectrum - <AUTHOR> http://blog.funcall.org//lisp/2015/10/30/zx-spectrum-lisp/ <comment><USER2> It's definitely interesting to think about an alternative universe where LISP was a big hit on 1980's... In our world we got Microsoft BASIC instead.

<comment><USER3> Or Forth [https://en.m.wikipedia.org/wiki/Jupiter_Ace](https://en.m.wikipedia.org/wiki/Jupiter_Ace)</comment></comment>


GraphQL at Shopify with Evan Huus - <AUTHOR> https://graphqlme.com/2018/01/28/interview-graphql-at-shopify-with-evan-huus/ <comment><USER2> This sounds like a rather vague statement:

> React Native, you write kind of one app and it'll run on both iOS and > Android which was appealing to us for the same reason. GraphQL ended up kind > of solving that problem for us in the sense that it lets you put a lot more > business logic on the server. The business logic all lives in one place > behind the API. Now iOS, Android and our web interface can all share in that > so it only has to be implemented once instead of three times.</comment>