Ask HN: Fundamental texts for serious web engineers? - <AUTHOR> As someone who would like to be a one-man-army / technical co-founder in the world of web development, I've been recently trying to deepen my technical knowledge of the fundamentals. I realized my understanding of the basics was very simplistic and as far away from "hardcore" as imaginable. I spent years working in the industry, and made the giant early mistake of not asking "how does this actually work underneath?" for way too long, so now I'm embarking on the likely life-long journey to fix that.
I realize that it's impossible to gain truly deep knowledge into every aspect of web engineering, but I believe that given time one can still be proficient in most of its areas. More importantly, this knowledge should be abstracted from the "flavor of the month" technology, and it should enable one to quickly learn and adapt. Also I think this knowledge should be pragmatic, practical and highly relevant to the real world and business application.
For starters I began learning more about how programming languages work underneath, which so far Programming Language Pragmatics 3rd ed has been really good at explaining, at just the right level of detail.
I imagine that some of the other fundamental areas of understanding for a web developer would be:
- operating systems - networking
- databases - security - distributed systems - UX
For these areas, and more if you can identify them, would you folks be able to recommend modern and pragmatic texts that would give one a solid level of depth? I realize that there would be plenty of overlap with a standard CS curriculum, the difference would be in a higher focus on practical application, rather than theory. <comment><USER3> From my experience what people working as web developers most commonly lack theory-wise besides simply software engineering skills is in-depth knowledge of HTTP and it's guiding architectural principles (REST), so I would recommend:

<http://www.w3.org/Protocols/rfc2616/rfc2616.txt> (HTTP standard)

<http://en.wikipedia.org/wiki/Representational_state_transfer>

<http://www.ics.uci.edu/~fielding/pubs/dissertation/top.htm> (Original publication introducing REST)

Not knowing this stuff makes it hard to write applications that perform well and are search engine friendly, so contrary to what people may think, it's often very practical knowledge. Ultimately you should also strive to understand what happens from the moment you type in the URL to the moment the page is displayed on the screen, so some understanding of DNS, basic routing, etc. You should also know how to use all the classic tools: ping, traceroute, host, dig, netcat, ngrep, nmap and so on and so forth, it will make it easier to understand the theoretical things and will very often come handy in practice. It's also a step towards another important goal - knowing your infrastructure, so probably UNIX, your web server of choice, your database server etc. You can go a long way by just reading the manuals and the user guides for those things.

Another aspect is knowing the modern browser well. You should learn some JavaScript, learn to use FireBug or Chrome Developer Tools, learn about the DOM, the security issues that the browsers have to deal with etc. Douglas Crockfords videos are a good way to learn this:

<http://www.youtube.com/playlist?list=PL7664379246A246CB>

[http://www.youtube.com/playlist?list=PL5586336C26BDB324&...](http://www.youtube.com/playlist?list=PL5586336C26BDB324&feature=plcp)

There is a nice book about web security from Michal Zalewski, a well-respected security researcher currently at Google:

<http://lcamtuf.coredump.cx/tangled/>

<comment><USER4> The guy says he's worked in the industry for years; presumably he knows about REST and ping.

I read his plea in exactly the opposite way -- instead of learning more of (or about) these tools, he's after fundamentals.

In my opinion, the "fundamentals" are just decisions made by concrete people to address concrete concerns (at the time). Understanding them is understanding the motivations behind them. So it's as much a history lesson as it is technical.

Some of those people and decisions may be lost in time, like tears in the rain, but most have been documented. For a "networking" example, see this recent HN thread <https://news.ycombinator.com/item?id=3407777> and the discussion there.

<comment><USER3> In the first sentence I think you are nitpicking. After all I pointed to those tools as an aid for understanding how things work "under the hood", which is what the OP is after as far as I understand. Even if you take "ping", (which I could have as well not included in the list, as the other tools are less obvious but still tremendously useful) almost everyone knows what it's for, but fewer people know various options it has and yet fewer people know how it really works, what protocol it uses etc. In a similar way, lots of people have used MySQL or PostgreSQL for years, but never read the manuals and have little understanding of all the various capabilities they have and the ins and outs of how they work. It's a blend of theory and practice.

I agree with the rest of what you said, and while I did not state it explicitly, I share the sentiment, in fact the Douglas Crockford videos I linked to give a quite detailed account of the development of the Web, including browsers, JavaScript, AJAX etc.

<comment><USER4> Excellent, then our posts complement each other :)

And sorry, I didn't mean to nitpick and your links are certainly useful; god knows what "years in the industry" means anyway.

</comment></comment></comment></comment><comment><USER5> I'm probably atypical in that I came to the world of web engineering from the depths of low-level C++ systems development. But I can honestly say that once you've written a perf- and security- conscious file system driver, pretty much nothing in the web world will be confusing or surprising (except maybe design/UX).

Of course, this is terrible advice to take at face value and I won't suggest that you should go become a C++ master for great good.

But I stand by my theory that it really doesn't matter how you approach the learning. If you work on challenging problems in any area of computing, you'll realize that most of this stuff is just different people solving the same basic problems with different terminology.

</comment><comment><USER6> ok, looking at programming language pragmatics it seems like you want fairly serious (university level) theory. so i don't understand why people are talking about regexps - that should be covered in a subsection (regular grammars) of one chapter of that book.

anyway, for databases i would suggest date's "sql and relational theory" - <USER2> shows how sql is related to a more elegant, cleaner, underlying theoretical approach and will get you to think in more declarative terms.

for general programming, sicp is worth reading if you haven't read it already.

for algorithms, either (or both - they are very different) cormen et al (lots of tedious detail - you need to choose which bits to read) or the algorithm design manual <http://www.algorist.com/>

you don't ask about numerical work, but for anyone interested, gershenfeld's "nature of mathematical modelling" is concise, broad, and has some very deep insights (the few pages on wavelets are the best i have read anywhere).

for security, scheneier's applied crypto is a pretty good intro (again, skip some bits, and remember it's old). and anderson's "security engineering" is the other classic (which i should read...).

for ai (again, you didn't ask) both norvig's books are good (the more modern one is aimed at modern statistical approaches that work, but the older one has a lot of good basic programming and lisp).

<comment><USER7> Speaking of Structure and Interpretation of Computer Programs (SICP), there's a good UC Berkeley course based on it up at [http://www.academicearth.org/courses/the-structure-and- inter...](http://www.academicearth.org/courses/the-structure-and- interpretation-of-computer-programs). It's very long, but if lectures are more your learning style, you might find this very useful.

</comment></comment><comment><USER8> One book many engineers have cut their teeth on for OS would be Andrew Tanenbaum's _Modern Operating Systems_ , 3rd ed.

[http://www.amazon.com/Modern-Operating-Systems-Andrew- Tanenb...](http://www.amazon.com/Modern-Operating-Systems-Andrew- Tanenbaum/dp/0136006639/)

</comment><comment><USER9> You could try the HN archives: [http://www.hnsearch.com/search#request/submissions&q=eve...](http://www.hnsearch.com/search#request/submissions&q=every+programmer+should+read&start=0)

Most of these links to really good papers. You should also read this about memory: <http://lwn.net/Articles/250967/>

</comment><comment><USER10> I'd suggest reading this if you want to be a technical co founder. There's more to running a successful web app than building it.

[http://www.amazon.co.uk/Web-Operations-Keeping-Data- Time/dp/...](http://www.amazon.co.uk/Web-Operations-Keeping-Data- Time/dp/1449377440)

<comment><USER11> This book is fantastic.

</comment></comment><comment><USER12> One of the most often neglected areas of study is regular expressions, they are looked at as a kind of black art by many developers, even senior developers. The reality is though regular expressions can save volumes of code when applied to certain pattern matching problems. I cannot stress enough how powerful they are. If you master regular expressions you will be ahead of 90% of developers in your ability to process text for patterns, which comes up as a common need in the web many times. The mastering series has a book on regular expressions and it has high ratings, but I will stop short of recommending it because I personally have not read it. Someone else may chime in on whether or not the ratings are valid for it.

<comment><USER13> Yes, also a basic understanding of how regex works under the hood is really helpful in cementing the concept (and also understanding things like why you can't properly parse HTML with them alone).

So I'm talking about stuff like NFAs (nondeterministic finite state automata) DFAs (deterministic finite state automata).These concepts are nowhere near as complicated as their names make them sound they are in fact generally quite intuitive, a reasonable grounding in basic set theory will help you here.

It will also give you a much better understanding of how programming languages are interpreted 'under the hood', in fact one of the first things any compiler/interpreter does to your code is essentially run it through a fancy regex engine.

This leads you on to making realizations not only about the performance implications of pattern matching in text, but they are also keys to solving a variety of problems in a simple way.

In reference to a specific text, I learned the concept from the early chapters of 'the dragon book' but I'm sure gentler introductions are available.

<comment><USER14> Excellent suggestion. Any literature on automata that you'd recommend?

<comment><USER12> He did mention _the dragon book_ which is actually titled Compilers: Principles, Techniques, and Tools but is better known by the dragon title. It is a seminal work and still regarded today even though it is older. But it is by no means a light read, it will definitely give you a deep understanding of computing, but it's a little heavy if you just want to develop web apps.

</comment></comment></comment></comment><comment><USER15> <http://regex.learncodethehardway.org/> thats a good one on regular expressions. He also has a good one about SQL - it's incomplete, but what is done is very sweet. I'm also trying to go the same path as you. I know a bunch of java and python but when I look at the source code of just about anything I don't understand what anything is doing, and it's very frustrating, so I'm trying to build a very simple framework in python from scratch - but I've no idea how to go about it. I got a million texts but no idea how to connect them.

</comment><comment><USER16> Learn by doing.

Get involved in some open source projects and start contributing.

Doing that has taught me more than any book has.

<comment><USER7> Well, the OP specifically asked for texts on the fundamental subjects of CS as they relate to web development.

Since you bring up a good point though, what would be useful open source projects to contribute to if you're specifically interested in exploring deeper issues?

For myself, I remember learning about networking (and especially coding the network layer in C) and also a bit about crypto by tinkering with World of Warcraft unofficial open source servers two years ago. Wish I had the chance to contribute something back before real life took over again.

</comment></comment><comment><USER17> I have been keeping a list of books I used to augment my CS Masters Degree courses on various topics, here are the relevant ones I have found useful for the topics you have listed:

\--Computer Organization--:

Computer Systems: A Programmer's Perspective [http://www.amazon.com/Computer- Systems-Programmers-Randal-Br...](http://www.amazon.com/Computer-Systems- Programmers-Randal-Bryant/dp/013034074X)

I liked this much better than Computer Organization and Design by Patterson and Hennessy which everyone has encountered at some point. The developer- centric view was very cool.

\--Computer Security--:

Kernel Exploitation: Attacking the Core [http://www.amazon.com/Guide-Kernel- Exploitation-Attacking-Co...](http://www.amazon.com/Guide-Kernel-Exploitation- Attacking-Core/dp/1597494860)

Most 'hacking' books are goofy. This one is very good and doubles nicely as a hackers operating systems text.

Web Application Hackers Handbook [http://www.amazon.com/Web-Application- Hackers-Handbook-Disco...](http://www.amazon.com/Web-Application-Hackers- Handbook- Discovering/dp/0470170778/ref=sr_1_2?s=books&ie=UTF8&qid=1325359556&sr=1-2)

Very nice overview for web concerns.

\--Operating Systems-:

Operating System Design and Implementation [http://www.amazon.com/Operating- Systems-Design-Implementatio...](http://www.amazon.com/Operating-Systems- Design- Implementation-3rd/dp/0131429388/ref=sr_1_3?ie=UTF8&qid=1325359588&sr=8-3)

I don't agree with Tanenbaum's views on micro vs. monolithic kernels but this book is a great mix of theory and implementation.

Linux Kernel Devleopment [http://www.amazon.com/Linux-Kernel-Development- Robert-Love/d...](http://www.amazon.com/Linux-Kernel-Development-Robert- Love/dp/0672329468/ref=dp_ob_title_bk)

I used this to get a feel for the monolithic implementations of topics covered by Tanenbaum.

\--Networking--:

TCP/IP Illustrated Series. More than you would ever want to know.

</comment><comment><USER18> If you're serious about _fundamentals_ be sure to at least skim Fieldings's PhD thesis[1] which lays the ground work for HTTP, especially the chapter on REST. His ideas are powerful, clear and very influential, but have been misunderstood time and again.

[1] <http://www.ics.uci.edu/~fielding/pubs/dissertation/top.htm>

</comment><comment><USER19> You should read Richard Stevens Unix Network Programming for the networking part of that list.

</comment><comment><USER20> I'm not sure what other people will recommend, but I don't personally feel that you need such a deep knowledge of fundamentals to be a good technical co- founder. More important is your ability to pick things up when you need to.

You don't need to be a decent DBA, a pen tester and a network admin to get your startup off the ground. You need to be able to wear all the hats, but by the time you actually need a master of each skill you'll have the revenue to employ them.

That said, these two paths may actually converge. If you're interested in learning and read a wide range of authors and topics, you'll probably be good at JIT learning stuff when you need to change hats.

</comment><comment><USER21> Off the top of my head, an understanding of internet architecture is probably a fundamental thing to have. IP, TCP, HTTP, DNS, etc.

[http://www.amazon.com/TCP-Illustrated-Vol-Addison-Wesley- Pro...](http://www.amazon.com/TCP-Illustrated-Vol-Addison-Wesley- Professional/dp/0201633469)

<comment><USER22> Link to the 2nd Edition version of this book:

[http://www.amazon.com/TCP-Illustrated-Protocols-Addison- Wesl...](http://www.amazon.com/TCP-Illustrated-Protocols-Addison-Wesley- Professional/dp/0321336313)

(Didn't even realize it had been updated until I checked!)

<comment><USER22> BTW, if you decide you want the Kindle version, there's a $10 promo code. I'm not sure if you need to be signed up to Amazon Student for this, so YMMV:

[http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000...](http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000763191)

<comment><AUTHOR> Worked for me, thanks!</comment></comment></comment></comment>


Readers absorb less on Kindles than on paper, study finds - <AUTHOR> http://www.theguardian.com/books/2014/aug/19/readers-absorb-less-kindles-paper-study-plot-ereader-digitisation

<comment><USER2> There's no indication in the article whether it was conducted with e-paper Kindles or the Kindle Fire. It's already well known that reading on computer screens decreases retention, so it seems like that might factor into a test with tablets too.

<comment><AUTHOR> _" the haptic and tactile feedback of a Kindle does not provide the same support for mental reconstruction of a story as a print pocket book does"_

This suggests Kindle Fire or Paperwhite, I guess.

<comment><USER2> Why do you think it suggests that? (I'm not super familiar with the feature sets of Kindle models, but none of the above suggests LCD or backlighting.)

I'm mostly curious whether these results would be the same with an e-ink screen as with an LCD. I believe the paperwhite is front-lit e-ink, BTW.</comment></comment></comment>


Show HN: Trickle/tritty, a 600 baud pipe/terminal - <AUTHOR> https://asciinema.org/a/9ujH6KQcVMF1VJztzXrfCpJqI <comment><AUTHOR> What: a 600 baud (configurable) pipe and terminal

Why: to experience what it's like to do computing under such constraints, and to learn more about Unix programming.

I find it interesting to see how programs like pagers, web browsers and such deal with screen updates. I'm aware of the role of curses in general terms but it's fascinating to see it in action. For example, running from a PuTTY session scrolling up in less(1) is very efficient as it reuses the scrollback buffer, but not on macOS' Terminal.app (as in the video).

Any remarks or questions re. the concept or implementation are welcome. C programming is a hobby and a lot of this lower level Unix stuff was new territory for me.

Source: [https://github.com/sjmulder/trickle](https://github.com/sjmulder/trickle)

<comment><USER2> Why 600?

<comment><AUTHOR> I settled on that as the default because it's slow enough to clearly show it working from simple use (e.g. you don't need to open elinks to see it's slow) but fast enough to not discourage playing around with it.

Of course, there's a -b option that takes any rate between 50 and 57600 baud (the upper limit there because I'm not sure if it would keep up).

</comment></comment></comment><comment><USER3> The "tritty" program does not set the baud rate on the TTY (with for instance cfsetspeed()), so programs running still think the terminal is fast. This means that programs (like Emacs) that have many optimizations for slow terminals, won't use them, even though they would have been appropriate.

<comment><AUTHOR> Thanks! I had seen the attribute but wasn't aware of its use. I'll read up on it and try to implement it appropriately.

Interestingly vim does seem to disable syntax highlighting after a while, as can be seen in the video. Since the rest of the colours etc continue working I don't think it's a rendering artefact.

</comment></comment><comment><USER4> I don't know if I can deal with such a high speed terminal. It really is too fast for comfortable reading.

When I first saw a 300 baud Texas Instruments Silent 700 terminal, it was an eye-opener. Sure, the thermal paper printouts faded pretty quickly, but at 30 characters a second it was three times as fast as the Teletype machines I used before.

Even with all that speed, it wasn't too fast for the human mind to comprehend. Not like this 600 baud monstrosity.

[https://en.wikipedia.org/wiki/Silent_700](https://en.wikipedia.org/wiki/Silent_700)

<comment><USER5> Dialing in to the 1200 baud MODEM pool was both uneconomical and didn't even confer any great benefits. The 900 baud pool was only like a buck a minute and the 1200 baud pool was $4 per minute!

That said, I might actually have to get off your lawn. My first was a 900 baud cradle. Hayes, I think? Maybe Digital? That was a whole lot of years ago.

<comment><USER6> I feel like a young brat now starting directly from 1200 baud.

<comment><USER4> You young whippersnappers with your fast cars and fast modems!

<comment><USER5> If it helps, my first computer contact was an HP 9100 in '72\. I just hated it and would avoid them for years afterwards. ;-)

</comment></comment></comment></comment></comment><comment><USER7> Pedantic note: in this case baud and bits per second may be the same rate, but they technically denote different things. Baud denotes the symbol rate. If you're able to transmit more than one bit per symbol, then the baud and bps are different amounts. For example, 1200 bps modems transmitted 2 bits per symbol and thus were 600 baud. That said, the term "baud" was almost always misused as a synonym for bps.

Speaking of modems, the coolest one ever made was the Novation Apple-CAT II:

[https://en.wikipedia.org/wiki/Novation_CAT#The_Apple- CAT_II](https://en.wikipedia.org/wiki/Novation_CAT#The_Apple-CAT_II)

</comment><comment><USER8> My first modem was 600 baud. I used to like waiting a long time before source code would be in and I could check & run it. I would read the description of the game/program and in my mind I used to make up what it would be like. The reality was always nothing like it, but that was ok.

There was something fun about reading/typing in/very slowly downloading game/program listings. Later I had the same feeling with going to meetups and standing in line for ages to copy sources onto floppies.

</comment><comment><USER9> It doesn't address the TTY part, but for limiting a pipe's throughput there's also pv[0]. It's main purpose is visualising pipe transfers, but the throttling support is solid.

[0] [https://www.ivarch.com/programs/pv.shtml](https://www.ivarch.com/programs/pv.shtml)

</comment><comment><USER2> Why is that so soothing?

<comment><USER10> Because you can actually read the man page as it's being blitted to the screen...

</comment></comment><comment><USER11> My first acoustic coupler was 300 baud. When using a BBS, it was pretty much the speed at which i could read. 600 seems insane. ;-)

</comment><comment><USER12> Curiously I've experience using 63 baud PSK on amateur radio, setting this to that same speed feels slower than when receiving text over the air. I guess this must be some extra overheads somewhere

<comment><USER13> PSK31 and it's derivatives use a variable length encoding of the characters (for example, space is 1 bit and e is 2 bits). For English-like text that'll cause it to be faster than tritty.

</comment></comment><comment><USER14> Sweet.. was thinking about doing this myself but never got one of those elusive round-tuits that everyone talks about..

I shall look forward to the line-speed setting updates and combine with GlassTTY220 font for the ultimate in terminal bliss..

[http://sensi.org/~svo/glasstty/](http://sensi.org/~svo/glasstty/)

<comment><USER10> Wow... That font reminds me of the last time I visited the living computer museum.

</comment></comment><comment><USER15> Silly feature request: add a flag to enable sci-fi terminal sounds as the text appears. Something like: [https://www.youtube.com/watch?v=vWBpzveKvGA](https://www.youtube.com/watch?v=vWBpzveKvGA)

</comment><comment><USER16> Well, not a serial terminal, judging by that ^c in the video! Worst thing about a slow baud rate is if you cat a big file you're gonna sit there and wait until it finishes flushing down the pipe before your ^c makes it up.

<comment><USER17> I'd expect the ^C to immediately kill the connection. It sends a SIGHUP, which indicates the serial line has been disconnected. (Based on the DCD line, per Wikipedia.)

Btw, nice work on sway.

<comment><USER14> > I'd expect the ^C to immediately kill the connection. It sends a SIGHUP, > which indicates the serial line has been disconnected.

you're ignoring the actual line transfer of the control C up the wire from the keyboard, through various buffers and such..

not a serial guru by any means, so I could be wrong about the specifics, but if you've ever _used_ a serial terminal, you'll know OP is correct.

<comment><USER17> I'd think the ^C would be transmitted by a physical disconnect, i.e. changing the state of the DCD line. The DCD disconnect should immediately trigger an interrupt, which should trigger a SIGHUP.

To be fair, though, I can't say I've used a proper serial terminal.

</comment></comment></comment></comment><comment><USER18> > * It simulates the experience of using a terminal over a slow serial > connection.*

Not really, in old days we had telnet over TCP/IP. Now there is mosh which uses smart redraw and UDP.

<comment><USER19> Not sure what your point is.

Perhaps you are too young to have experienced only having access to the internet via a shared UNIX system which in turn was only accessible by serial terminal?

</comment></comment><comment><USER20> Add in some variable latency to better simulate a slow link.

<comment><USER14> yasss this would be awesome..

maybe some configurable tiny buffers on each 'end' would also be superb.

+1000 if they can overflow and generate garbage that causes your terminal to hose up..</comment></comment>


Ask HN: Why is crawling/indexing SPAs more difficult than server rendered sites - <AUTHOR> This is a slightly less touchy / controversial question than my last one. Also I am a mobile developer but sometimes I like to explore the web development scene so this might seem like a silly noob question.
Why can't web crawlers index websites as efficiently as a website that is the traditional server side rendered website?
Is it just a matter of inefficiency for the crawler to wait for JS to load the UI? Aside from doing some kind of hybrid approach of client-server rendering, what can web apps that are SPA do to increase visibility? <comment><USER2> Single page applications are mostly logic. Front end linked to back end programming. Regular web sites are content presentation - what the WWW was originally conceived for.

Search engines index content first and usually discard what javascript renders - that is why people are told never to use Document.Write() to render text, however tempting it may be.

Now there is a difference between using Document.Write() to output text to a HTML document and using something like JQuery which for most cases would only influence how text within elements is to be rendered. If javascript was disabled on a website properly using JQuery, a search engine would still see the content within the elements, whereas on a page using DOM manipulation like the Document.Write function the rendered content would still be hidden because the function can't be executed.

As search engines often take page loading speed into account to render their results pages and rank websites it is advised to put the JS at the end, when the content has already been loaded and transform its presentation later.</comment>


The Economist: Take back control of ownership in the digital age - <AUTHOR> https://www.economist.com/news/leaders/21729745-and-threaten-property-rights-digital-age-how-digital-devices-challenge-nature <comment><USER2> Silly The Economist: ownership is for "intellectual property" (which is only worthwhile or even possible for corporations) and for Our Betters, the very wealthy.</comment>


US Court issues order to seize funds from 155 BTC addresses linked to terrorist [pdf] - <AUTHOR> https://assets.documentcloud.org/documents/7035314/Complaint.pdf <comment><AUTHOR> The Defendant Properties are subject to forfeiture to the United States, pursuant to 18 U.S.C. § 981(a)(1)(G)(i), as assets of a foreign terrorist organization engaged in planning or perpetrating any federal crime of terrorism (as defined in section 2332b(g)(5)) against the United States, citizens or residents of the United States, or their property, and as assets affording any person a source of influence over any such entity or organization.

WHEREFORE, the United States prays that notice issue on the Defendant Properties as described above; that due notice be given to all parties to appear and show cause why the forfeiture should not be decreed; that judgment be entered declaring that the Defendant Properties be forfeited to the United States for disposition according to law; and that the United States be granted such other relief as this Court may deem just and proper, together with the costs and disbursements of this action.</comment>


...was granted a divorce because he was constantly working calculus problems - <AUTHOR> http://explore.noodle.org/post/73954140444/the-appointees-wife-was-granted-a-divorce-from <comment><USER2> This is a classic Internet daisy chain of the worst sort.

The article linked above ([http://explore.noodle.org/post/73954140444/the- appointees-wi...](http://explore.noodle.org/post/73954140444/the-appointees- wife-was-granted-a-divorce-from)) acquired its content from MetaFilter ([http://www.metafilter.com/116688/The-FBI-has-a-Do-Not- Contac...](http://www.metafilter.com/116688/The-FBI-has-a-Do-Not-Contact- List)), which in turn acquired its content from MuckRock ([https://www.muckrock.com/news/archives/2012/jun/06/feynman-f...](https://www.muckrock.com/news/archives/2012/jun/06/feynman- files-professors-invitation-past-iron-curt/)), which acquired its content from an FOI request from the FBI ([https://www.muckrock.com/foi/united-states-of- america-10/fbi...](https://www.muckrock.com/foi/united-states-of- america-10/fbi-files-on-richard-feynman-1165/)) which produced an historical 361-page archive ([https://www.muckrock.com/foi/united-states-of- america-10/fbi...](https://www.muckrock.com/foi/united-states-of- america-10/fbi-files-on-richard-feynman-1165/#366921-responsive-documents))

Surprising no one, the article linked above manages to locate the most tabloid-oriented part of the 361-page FBI archive, and omit the more interesting and politically educational parts.

Here's a link to a browsable version the source documents: [https://www.muckrock.com/foi/united-states-of- america-10/fbi...](https://www.muckrock.com/foi/united-states-of- america-10/fbi-files-on-richard-feynman-1165/#366921-responsive-documents)

Here's a direct link to the PDF archive: [https://muckrock.s3.amazonaws.com/foia_documents/Feynman_Mas...](https://muckrock.s3.amazonaws.com/foia_documents/Feynman_Master_of_Deception.pdf)

</comment><comment> fsck--off Keep in mind that there was no such thing as a no-fault divorce in the U.S until 1969. So the listed reasons for divorce — which in this case included violence — are not reliable because they were often invented out of necessity.

<comment><USER3> Interesting. I can only imagine how this discusson would take place on Jezebel.

Know your audience, I guess. I, like many here, would not be happy to read negative things about Feynman who is a hero to many in this community.

<comment><USER4> *shrug.

Reading between the lines from the various writings he put out, I think the odds were good that he was an asshole to a lot of people.

He had a lot of privilege from being, on average, the smartest dick in a given room, and being the right age and in the right place to enjoy the Greatest Period of Prosperity We've Ever Known.

He was probably a blast at parties and exhilarating to work alongside and shoot the shit with, but also probably really flakey and insufferable if you needed something from him.

For me, the most telling moment in the Feynman comic ([http://www.amazon.com/Feynman-Jim- Ottaviani/dp/1596438274](http://www.amazon.com/Feynman-Jim- Ottaviani/dp/1596438274)) was how little attention was paid to his kids.

You gotta take the good with the bad. Steve Jobs was a manipulative douchebag, but also conniving, ruthless and full of taste.

</comment></comment></comment><comment><USER5> Wow, I can completely see that happening.

His anger could have been more healthily displaced, but being interrupted while you're thinking is actually the most frustrating thing ever. From my own experience the biggest problem is that sometimes when you're thinking you don't even realize it, and it's not till you're interrupted that you do. And once you're self-aware, the flow of thoughts required with the hardest kinds of thinking comes to a stop.

And if this guy is thinking about the kind of insanely hard stuff he thought about, man, I can't imagine how much that would've sucked.

<comment><USER6> "But I just had a quick question! It will only take _two seconds_ of your time!"

To me, the real problem is that a lot of people don't understand that the duration of the interrupting event itself is often the lesser of the distractions. The fifteen minutes I have to spend getting my head back on- track afterward is the real pain-in-the-ass, and what are the chances that _those_ fifteen minutes go uninterrupted?

<comment><USER7> That's why you go into another room and lock the door.

<comment><USER6> That doesn't solve every problem, but it helps.

</comment></comment></comment></comment><comment><USER8>
      "...the FBI set out to out him as a "communist sympathizer" in a witch hunt
      characteristic of the Cold War era."

      "As for Feynman's bongo drums, well, that's true."

I'm not sure I understand the point of this article (if you can even call it that.) Is the author claiming that the wife's testimony is false, or perhaps that it was never even given and the entire paragraph is a fabrication of the FBI? I don't get it.

People fight, everyone has their own version, and nasty things come up in a divorce proceeding. I obviously have no idea if this account is 100% accurate, but it sounds like the author is claiming that it is not. Based upon what evidence I do not know.

<comment><USER9> I think the author is providing you some background information about why the files exist, and then saying that the story about the drums and calculus is probably true.

I don't see any claim in there that the wife was a lying tool of the FBI. These files would have been compiled after the divorce anyway.

<comment><USER8> The author certainly implies that those charges are false.

</comment></comment></comment><comment><USER10> I think I've read that people who are very intelligent are also very passionate, which I guess is why Fenyman wrote a touching love letter to his (dead) first wife and (allegedly) beat his second wife. Also keep in mind the notion of "emotional intelligence" is relatively new, so given the time period and the person, this really isn't a surprise.

<comment><USER11> Neither of those activities are the exclusive domain of the "very intelligent".

</comment></comment><comment><USER12> Well, he was crazy smart, loved life, strip clubs, and interesting things. It is pretty fucked up that he thought she was okay with that behavior towards her.

[http://www.openculture.com/2013/08/richard-feynmans- letter-t...](http://www.openculture.com/2013/08/richard-feynmans-letter-to- departed-wife.html)

</comment><comment><USER13> "he attacked her" \- is this true?

Richard Feynman is a personal hero of mine, but if he became violent towards his wife I might view him in a different light.

Also, what's "bric-a-brac?"

<comment><USER2> > "he attacked her" \- is this true?

We would first need to define "attacked". There are verbal attacks, chain-saw attacks, and much territory between them.

Also, during the divorce proceeding, his soon-to-be-ex-wife primarily complained about his tendency to be lost in thought, not his tendency to attack her if she interrupted him. My point is that if he actually physically attacked her, she would not have needed to mention his annoying preference for calculus.

<comment><USER13> That is what I initially thought as well, but since abuse was more socially/legally acceptable back then, I thought it was also possible that it wouldn't register as hugely important in the complaint.

</comment></comment></comment><comment><USER6> Interesting article. While the title of this submission hooked me and brought me here, it may need a little reworking as well.

</comment><comment><USER14> Before we start flamewar, please keep on mind this happened in 50ies.

</comment><comment><USER15> Spouses can be so sensitive.</comment>


Ask HN: what are the two best technical decisions you made for your startup? - <AUTHOR>

Looking back on your startup and its progress so far, what are the two best technical decisions you've made? Did you know they would have such a dramatic impact?
I'll start the ball rolling:
1. Linode - its flexibility has helped us keep costs seriously low without sacrificing power or scalability.
2. Memcached - using it various places instead of database access helped us turn a beast of a ~12second algorithm into a sub-400ms beauty.
I suspected they'd both be pretty cool but didn't realise quite how insanely fast memcache would be. <comment><USER2> For context I run pinboard.in, a bookmarking site.

1\. Using PHP rather than Rails or Django. It meant having to hand-code simple things like form handling, but resulted in a peppy site that can handle sudden spikes in traffic. The initial investment in writing boilerplate and laying out the code has really paid off now that I need to tune and add features.

2\. Sphinx. Made the site searchable with minimal configuration, and allowed me to move certain queries out of MySQL without having to set up caching. It's nice to have caching as a luxury to make the site even snappier, rather than an essential prerequisite for usability.

People have to pay to use our site, and the main thing that sets us apart from our many free competitors is speed, speed, speed. That fact has loomed large over our technical choices.

</comment><comment><USER3> Rails: Two years ago I switched from the standard shareware five-page-HTML- brochure site to the same site written in Rails, with the immediate goal of not having to do templating by hand anymore. It has grown organically since that, now boasting a CMS, a full-fledged web app, an API which interacts with my desktop application, copious reporting/administration/backend features, consumption of several web services for outsourced providers, and an A/B testing framework. You'd think it would be a staggering mess of spaghetti by now, but no, the MVC discipline makes it easy to maintain, easy to extend, and fairly easy to manage. Almost all time I spend in my IDE creates additional business value. This contrasts markedly with my experience with developing in Java, where frequently I have to mark off a week just to fight my tools.

Prawn: A maaaaaaaaaaaaaaajor pain point for me in developing my desktop version, and developing unrelated web apps for my day job, was laying out documents properly to be printed. Prawn makes it absurdly easy. For added goodness, throw in ImageMagick and you can turn the PDFs into GIFs for essentially no extra work.

</comment><comment><USER4> 1\. Puppet - being able to roll out a new server in a few minutes on either ec2, external networks connected to our vpn or locally is magic. Having our server definitions version controlled is seriously powerful.

2\. AWS - enough said.

</comment><comment><USER5> I get paid to make good technical decisions.

Used web-service based architecture; small independent modules, each with a light json-rpc based API.

</comment><comment><USER6> * Using Protocol Buffers

* Amazon Web Services</comment>


Apple Updates MacBook Air With Haswell CPU, Claims All-Day Battery Life  - <AUTHOR> http://techcrunch.com/2013/06/10/macbook-air-update/

<comment><USER2> So, no Haswell for Macbook Pro, and no Retina Display for Macbook Air. Seems like neither laptop is built to be everything for anybody.

</comment><comment><USER3> Too bad it doesn't support 16gb RAM yet :(

<comment><USER4> That's what I was waiting for too. 8GB of RAM in the Airs isn't enough.</comment></comment>


Show HN: X-Ray Debugging for HTTP - <AUTHOR> https://httptoolkit.tech/blog/xray-debugging-for-http/ <comment><AUTHOR> Hi HN!

This is the first freemium release of HTTP Toolkit: a suite of beautiful & open-source tools for debugging, testing and building with HTTP(S).

I've been working on the internals of all this as a free & open-source project for a year or two now. That came together as a standalone free app a few months back, and today's the day it goes freemium (but still 100% open- source), with a pile of massive new features and a move towards long-term sustainability.

Screenshots & explanations for all the new features inside. Let me know what you think :-)</comment>


Adobe is a Joke - <AUTHOR> http://www.postal-code.com/binarycode/2008/07/04/adobe-is-a-joke/ <comment><USER2> This article is about Acrobat, and I have to agree with its ridiculous transformation into bloatware.

It seems companies like to release major new versions of things that don't need to become "better", instead of focusing talent elsewhere.

I can't name a single feature I use in acroread that wasn't available and done less obnoxiously in 5.0.9. On Linux, I still run 5.0.9...it's ugly, but it works.

I also now tend to use "xpdf", because it is very quick and works fine for almost any PDF I come across.

</comment><comment><USER3> Acrobat Reader is probably useless to most people, but Acrobat Professional is pretty indispensable for print design.

And Adobe makes more than Acrobat, you know.</comment>


What is the fuss with Reactive Cocoa? - <AUTHOR> http://khanlou.com/2014/02/reactive-cocoa/ <comment><USER2> I've been meaning to write something along those lines, thanks for stepping up!

Virtually all the examples I've seen on the various sites/tutorials etc. seem to be more complicated, sometimes significantly, than their straightforward imperative counterparts.

In addition, FRP is required to bring reactiveness to the stateless world of pure functional programming. OO, on the other hand, already _is_ reactive. It's sort of the definition of an object, it reacts to messages. So I am not quite sure what FRP is bringing to the OO world, and again none of the explanations appear to make sense, because they tend to just lift the FP explanations, which aren't applicable.

I can see the appeal of just setting up certain relationships and then having the system maintain them, but we've had constraints since forever to handle that case: Lessons Learned About One-Way, Dataflow Constraints ([http://repository.cmu.edu/cgi/viewcontent.cgi?article=1761&c...](http://repository.cmu.edu/cgi/viewcontent.cgi?article=1761&context=isr)) [PDF]

<comment><USER3> It is only more complicated if you have no prior exposure to Functional or Reactive programming. Those of us who cut our teeth on Desktop GUI apps understand Reactive quite well. And combining Reactive with the most modern Functional paradigm is just icing on the cake. It means that building apps around event streams was the right model all those years ago, and that we really can use Functional style to tame those event streams in the same way that we used it to tame imperative looping.

<comment><USER2> This is pretty much exactly what I am talking about:

Your premise is that "building apps around event streams was the right model". Well, I don't buy that premise. I am open to it as a conclusion, but I don't buy it as a premise.

The examples don't support your premise, because they do not demonstrate that anything got simpler, at least not in any obvious ways. It's not less code, and the code isn't simpler in obvious ways. Saying that I would need prior exposure to F(R)P programming also does not help, it reinforces the point that this is more complicated.

The analogy to "imperative looping" also does not help, Smalltalk has had fancy higher-order loop constructs since the 70ies and is not FP and does not require FRP or "event streams".

Please don't think I am not open to cool things like stream programming, I did my own FilterStreams back in the 90ies. My initial version of Higher Order Messaging also lifted sequential message sends into streams of filters.

I thought this was _way_ cool when I came up with it, but a slightly more mature me realized that it was not nearly as useful as it was cool. To me, the FRP hype seems a lot like that: yes, I can see it's cool that you hook something up over here and then it just keeps going, but the seasoned programmer in me is wary and can't detect the useful as distinct from the cool.

And, just to repeat, I am open to seeing the useful, I just haven't seen it yet.

Finally, we've had constraint programming also since the late 70ies (and spreadsheets as a form of constraint programming is probably the most popular form of programming), and I don't see what FRP brings to the table relative to constraints, at least after you strip it of the FP baggage.

See ThingLab, 1978: [http://en.wikipedia.org/wiki/ThingLab](http://en.wikipedia.org/wiki/ThingLab)

</comment></comment></comment><comment><USER4> Reactive Cocoa, and functional reactive programming in general, is difficult to get your head around. I've tried several times to see why it's worth it, and each time come a little closer. After 3 attempts, I finally do think it is beneficial, but it's not immediately obvious. Here are a few reasons:

1\. It enables you to eliminate state. My view controllers always end up with various handles to objects on them so that I can access things during a complicated processing sequence. These things cause edge case bugs, and are generally not a nice thing to have lying around in code.

2\. The more I write data processing algorithms, the more I think about them in terms of map, reduce, filter and other similar operations. Reactive Cocoa allows those to be used to control the flow of execution even more, and it fits really nicely with how I'm thinking about algorithms.

3\. I've tried some development in QML for Ubuntu Touch, a language which is _very_ declarative, and it was wonderful. It's a very different way of working, but I can really imagine that being the norm in 20 years. Reactive Cocoa, allowing for more declarative coding, brings a small element of that to Objective-C, which is nice.

4\. Finally, I found it fits really nicely with the MVVM (Model, View, View- Model) architecture, which in turn feels like a nice and clean way of structuring applications, and appears to be really easy to test. I haven't got too far into testing Reactive Cocoa applications yet, but it looks like they should be very easy to test as the boundaries between each component are much better defined, and inherently more testable.

I highly recommend "Functional Reactive Programming on iOS" by Ash Furrow: [https://leanpub.com/iosfrp](https://leanpub.com/iosfrp) – I'm nearly at the end of it, and it's helped me understand more about Reactive Cocoa and make it seem a bit less 'magic', which was a feeling I got from the readme on the project's GitHub repo.

Also for some of the reasoning behind FRP, the paper "Out of the Tar Pit" is a good read: [http://shaffner.us/cs/papers/tarpit.pdf](http://shaffner.us/cs/papers/tarpit.pdf).

</comment><comment><USER5> The two really cool things about it is that it's declarative (you set up some rules in your -viewDidLoad: and you're done) and it's easy to reason about (e.g. how an output will vary based on inputs).

But at the same time it's just crying out for some sort interface-builder- style GUI that lets you wire everything up graphically.

My biggest gripe (beautifully illustrated by OP's post) is how un-Apple-like it is at a code level. If you're familiar with standard Cocoa patterns the second code block is quite a bit more understandable.

Finally, in defense of ReactiveCocoa, that code is probably a bit like writing "99 bottles of beer" recursively: it's useful because it's a (relatively) understandable example, not because it's a good use of that programming style. If you start having multiple interdependent network requests, then something like ReactiveCocoa probably starts to come into its own.

<comment><USER3> Interestingly, it is on OS/X that people are still working on the GUI builder idea, not just for the interface but to entirely replace (or automatically write) the code for an app. Google for Marten IDE to see what I mean. It's a free download but warning... Prograph is a deep subject and if you are mainly an iOS app developer it may be too much, too soon.

</comment></comment><comment><USER6> Sometimes I feel the same way. Other times I feel stupid 'not to get it'

I did sit down to make a comparison to their readme. [https://github.com/seivan/SHRACComparison](https://github.com/seivan/SHRACComparison)

Still not getting it.

</comment><comment><USER3> You showed two Reactive examples. One was written with Reactive Cocoa, and one was written with the normal Cocoa reactive API.

Simple examples like this are only the Reactivity 101 of Reactive Cocoa and do not fully showcase the power. Also, part of the power of using Reactive Cocoa on iPhone/iPad apps is that you can build them using the same Functional Reactive Programming style that you would use in Android, .NET, Javascript, Scala and so on. Reactive extensions is an API that is available in all those platforms, and it not only simplifies code overall, but it allows the use of the same powerful architectural style across all of the platforms that a typical company needs to support.

<comment><USER2> "You showed two Reactive examples. One was written with Reactive Cocoa, and one was written with the normal Cocoa reactive API."

Exactly. Cocoa already _is_ reactive.

</comment></comment><comment><USER7> Granted, to each their own, but the one thing I concern myself with is readability and learning curve, especially on projects where there's even the remotest possibility that somebody could be inheriting my code. If I toss in a library like ReactiveCocoa, that's an incredibly steep learning curve that a developer will have to master _in addition to_ any other curve presented by Cocoa Touch / Foundation / Core Data / whatever's already there.

The argument could be made for lots of other Objective-C libraries and frameworks, I suppose, but ReactiveCocoa doesn't seem to offer more in benefits than what it costs to learn it.

</comment><comment><USER8> [http://blog.maybeapps.com/post/42894317939/input-and- output](http://blog.maybeapps.com/post/42894317939/input-and-output)

</comment><comment><USER9> Big Nerd Ranch RAC sample is just a nonsense. Non-idiomatic RAC code, using nested callbacks completely defeats the purpose.</comment>


The State of Vue 2.0 - <AUTHOR> https://medium.com/the-vue-point/the-state-of-vue-1655e10a340a#.8wayhcmw8 <comment><USER2> I used AngularJS 1 a lot, but the second version felt overkill for my small to medium sized projects. I found vue.js and never looked back. Vue.js framework is everything I wished AngularJS 2 would be. Very happy with its progress as well.</comment>


Online CloudFront Invalidator - <AUTHOR> http://www.swook.net/p/cloudfront-invalidator.html

<comment><USER2> This is dangerous to use. The code sends my secret access key over an insecure HTTP connection to Yahoo Pipes servers. (God knows what they store.) I will never use that.</comment>


Clef Offers Two-Factor Authentication Without All the Codes - <AUTHOR> http://techcrunch.com/2015/02/19/clef-offers-two-factor-authentication-without-all-the-codes/ <comment><USER2> I used Clef to secure a personal blog that I run. Really nice, slick UI, and fun to show to people because it's so different. I had to uninstall it, though, when I had broken my iPhone and switched temporarily to an old Windows Phone I had laying around. I never reinstalled it, because an authentication method that relies on having a specific piece of expensive technology isn't all that attractive to me. Maybe it's great for someone who will always have an iPhone or Android phone, but in the last two years I've had five phones, and three of them were platforms that Clef doesn't support. This "iOS or Android" nonsense might work for games, but for any application I need to rely on for my workflow, it _has_ to work _anywhere_. FirefoxOS might be the next hot thing, and if people switch to it, they're going to switch away from Clef.

At least with Google Authenticator other people can write compatible applications for other platforms.

</comment><comment><USER3> If you remove the password, how is that a two factor? The day you loose your phone/get robbed could lead to your worst nightmares. Definitely would never opt-in. I loose my phone all the time (I know...), but I am pretty sure I am not the only one.

<comment><USER4> The factors are shifted to the phone. The Clef app on your phone is protected by a PIN (separate from your lock screen code) or TouchID on iOS. Each instance of the app is registered with Clef so you can revoke an individual device.

<comment><USER5> Yeah, well. "protected" by a PIN. You're implying that if someone gets hold of the phone/mirrors the storage, they can't get at the clef secret key because of the "pin". That's probably not true.

I think (pragmatically) phone's can be "something you have" \-- but except for a pin/passphrase that actually unlocks the full-device encryption on the phone -- nothing you do with the phone to access a secret key can be considered a second-factor "something you know".

Last I heard iphones have a decent storage for secrets, in the sense that you can't get at them except by _using the phone_ to bruteforce the pin (and get into the trusted storage/unlock the key). It's been a while -- maybe iphone 5/6 are better though. But I doubt it. Android devices in general have no such luxury -- on the other hand one can/should use a complex pass-phrase when enabling FDE, similar to other "soft" FDE-solutins, like cryptsetup for Linux. There's host of possible attack vectors, like subverting the BIOS/bootloader, getting at the juicy bits if the phone is booted up/the device decrypted, probably possible to do cold boot attacks etc...

At any rate, claiming that anything stored in an app is "secure" beyond the basic security of the phone -- is probably just wrong. That doesn't mean a pin is useless, it's just not really "two-factor".

</comment></comment></comment><comment><USER5> Seems like this could be simplified to simply extend standard OTP (with the caveat of requiring a camera on the laptop, probably invalidating one of the use-cases of OTP: logging in to low-security accounts on a kiosk pc):

1: Set up OTP as usual (pc/web-app shows qr code, scan code with phone. Server and phone now share a private secret for generating OTP tokens)

2: For login: phone displays QR-code, pc/web-app asks for image input (with 6-digit code fallback) -- user holds up phone to pc-camera.

I don't really see how Clef offers any benefit, except that you can't use standard OTP with Clef. Am I missing something?

<comment><USER6> Functionally that's what it sounds like they've done with their offline mode. They use "wave" style images instead of qr codes. They also use asymmetric crypto I think, like FIDO, but unlike OTP. It might not be feasible to offer a 6-digit code fallback, though, unless you can map RSA or ECDSA or whatever they're using into a problem with a 20-bit solution space _without allowing offline brute forcing_.

Their offline mode seems like FIDO but with a bidirectional wave image / camera requirement to get around lack of a better data channel (like u2f-hid support that FIDO requires).

<comment><USER5> > It might not be feasible to offer a 6-digit code fallback, though, unless > you can map RSA or ECDSA or whatever they're using into a problem with a > 20-bit solution space without allowing offline brute forcing.

Probably not. Supporting traditional (T)OTP is more about interop than anything else (the back-end just gets a one-time code to check against a list/counter or against a time-derived token, checking for drift etc. Main point is you can keep your auth-stack as-is, and your shared totp-secret in the same place[t]).

You could probably do assymetric crypto fine with qr-codes[1] they pack a lot of data.

If an ECDSA signature is ~48 bytes[2] -- that's going to be hard to compact down to a reasonable fallback... maybe. If the idea is to use asymmetric crypto as a backing for OTP, I suppose you'd do something like signing TIME+salt, and transmit the signature and the salt. Unless there is some trick one can do with checking partial asymmetric signatures, I don't see how you could get away with sending less than SIG+salt, or ~50 bytes. That's way too long for typing in, as a usable fall-back.

It might actually involve less typing to generate a shared secret -- but that'd completely break the UX -- so it doesn't sound like a sane fall-back to me.

[1] [http://en.wikipedia.org/wiki/QR_code](http://en.wikipedia.org/wiki/QR_code)

[2] [http://crypto.stackexchange.com/questions/3216/signatures- rs...](http://crypto.stackexchange.com/questions/3216/signatures-rsa-compared- to-ecdsa)

[t] [http://spod.cx/blog/two-factor-ssh-auth-with-pam_oath- google...](http://spod.cx/blog/two-factor-ssh-auth-with-pam_oath-google- authenticator.shtml)

</comment></comment></comment><comment><USER7> How is this different from the phone based 2-factor that Google once had for their own products? Honest question, not being sarcastic here.

Google used to have an authentication system that would display a QR code on the screen which you would use your phone to navigate to. That URL would then, assuming your phone was already authenticated to Google, log you in on the computer as well. I was trying to remember the name of the system, but can't come up with it.

The short version is that Google determined the system to be too insecure and vulnerable to exploit and canceled the system.

<comment><USER7> Found the Google product's name: Open Sesame

The site no longer exists, but some of the news about it at the time can still be found: [http://www.webpronews.com/open-sesame-googles-newest- securit...](http://www.webpronews.com/open-sesame-googles-newest-security-log- in-uses-qr-codes-2012-01)

</comment></comment><comment><USER8> Similarly, I've been impressed by Duo's mobile applications.[1]

They offer a push authentication capability, so you only have to click "accept" or "deny" in the app on your phone. They've also got code generation and a hardware token as backups. In practice, I can usually authenticate through the phone in 2ish seconds.

Clef does look like an awfully nice user experience, though.

[1] [https://www.duosecurity.com/product/methods/duo- mobile](https://www.duosecurity.com/product/methods/duo-mobile)

<comment><USER6> Duo, Clef, or SMS 2-factor all have the same caveat: they require internet or SMS availability on one of your devices, not just the computer/device you're logging in on.

I don't want my ability to use a system conditioned on whether my phone can connect to the internet, or whether I have a laptop with internet connectivity and a camera that can take a picture of my phone's screen. TOTP 2-factor and FIDO* are better for that reason.

Clef sounds almost exactly like a software (totally app-based) FIDO implementation without a separate password other than the PIN you'd enter into the FIDO app. FIDO needs browser support, though; Clef can't do it that way, so it requires a data back-channel to Clef servers.

* (once it catches on... tokens exist, and Chrome/chromium 39 and above supports it, but MS has only announced it for Win10, FF hasn't implemented it yet, and hardly any major sites support it other than Google)

<comment><USER9> Clef actually doesn't require internet on the secondary device. We just shipped offline mode a few weeks ago: it's not as seamless as the primary flow, but it works well and solves the problem. Turn on airplane mode, sync the wave and let me know what you think.

<comment><USER6> So in that mode it's a proprietary alternative to FIDO that requires a camera to image the phone's screen?

A lot of work has gone into the FIDO spec to make sure it can be used across a wide range of environments. I don't see the utility of buying into a proprietary 2-factor system that seems to be solving the same problem. If you added u2f-hid support to eliminate the hack of transmitting data via pictures and cameras, wouldn't your system behave exactly like FIDO?

Isn't the natural progression for a company like Duo or Clef to pivot to being a managed FIDO 2-factor service, for organizations that want central management of 2-factor auth without creating their own management system?

</comment></comment></comment></comment><comment><USER10> Previous: [https://news.ycombinator.com/item?id=7224882](https://news.ycombinator.com/item?id=7224882)

</comment><comment><USER11> Is the vertical movement actually part of the authentication, or is it just a fancy looking barcode?

</comment><comment><USER12> Simpler: [https://getprove.com](https://getprove.com)

<comment><USER13> Not free.

</comment></comment><comment><USER14> I was expecting the solution to involve humming a four note tune.

</comment><comment><USER15> I was impressed by how easy it was to integrate Clef into my existing auth system- by far the best two-factor authentication system I've used.

</comment><comment><USER16> I've always through Clef was really neat, at the very least it is great to see a company tackling security from a UX standpoint.</comment>


Ask HN: Personal AI Study Buddy? - <AUTHOR> Hey HN,<p>I've been building a really useful qa bot and search engine as part of my CS master's thesis, with the intention of helping you automatically extend your study and learning process to your laptop. The system answers questions, asks you about progress, and has a pretty good internal search across notes, files, emails. Would this be useful to folks if I open sourced it, or is it better left as just a research project <comment><USER2> sounds very helpful</comment>


Using Metromile data to determine a car's gear ratios - <AUTHOR> https://whatsyourpvalue.wordpress.com/2016/09/22/a-party-trick-with-metromile-data/ <comment><USER2> Great article! The gear ratio data would be useful to potentially derive more granular driver behavior model (acceleration) that is less mass dependent than accelerometer sensor. However, I do wonder if there is a way to determine the usage of the reverse gear itself. This data is currently not universally available via OBDII. The reverse gear data would be very useful since large amount of accidents are backing accidents.

<comment><USER3> From the data provided, it seems likely that OBD is reporting any speed while reversing as 0, so you could probably guess that when the engine speed is changing slowly (while above idle), and OBD reports vehicle speed as 0, the car is reversing.

<comment><AUTHOR> This may be true - but even if the sensor is reading zero vehicle speed and greater than idling engine speed, it's difficult to assume these are in fact reverse and aren't just "engine revving" moments. Looking into a time-series breakdown of each moment - seeing if the engine speed is 'changing slowly' as you mention - would be key in properly identifying Reversing vs. Revving.

<comment><USER3> This is why I specified engine revving slowly; engines which are disconnected from the drivetrain tend to rev up very quickly. In addition, cars with automatic transmissions are a majority of the US fleet, and spend very little time in neutral.

<comment><USER4> > engines which are disconnected from the drivetrain tend to rev up very > quickly

So do engines which are in reverse and being controlled by drivers who are imminently about to have an accident :)

</comment></comment></comment></comment></comment><comment><USER4> What does this look like for a car with continuous variable transmission, like a late model Nissan Altima?

<comment><USER5> Most cars with a CVT are configured from the factory to have "gears". Even though the transmission is continuously variable, it is made to quickly move between distinct ratios. This is mostly because with a true CVT acceleration is very smooth and difficult for the customer to perceive.

So the graph looks almost identical.

<comment><USER6> This is fascinating:

       This is mostly because with a true CVT acceleration is very smooth and difficult for the customer to perceive.

Can you provide any more insight or further reading? I am considering a CVT (Subaru XT), and smooth acceleration without jumps is precisely what I would be looking for (which I believe was provided by my Scooter with a CVT as well).

If companies are adding artificial jerks to a technology that is designer for smooth experience, I'm not sure whether i'd laugh or cry, but I feel I'd like to know more :-/

Thanks!

<comment><USER7> >> I'm not sure whether i'd laugh or cry

Exactly... for me it's the same with electric cars that make fake engine noises. But that one I grudgingly accept, in parking lots, for safety reasons.

<comment><USER8> I'm pretty OK with electric cars making fake engine noises. The Prius owner in my neighborhood would be semi regularly creaming people if they didn't have any auditory indication that he was about to come cruising out of the alley without slowing down to check for pedestrians.

It doesn't _have_ to be engine noises, it could be playing some sort of crazy "woop woop woop" sound for all I care, but I'm guessing the owner would prefer it be something a bit less embarrassing.

</comment></comment></comment></comment></comment><comment><USER9> 130 km/h is a pretty good clip. Does Metromile charge clients more for high speeds?

<comment><USER10> California prohibits pricing based on driving habits like speed. Other states do permit it and Progressive offers snapshot device which does what you describe - offer discounts for safe driving behavior.

<comment><USER9> Wow really, that is amazing and unsurprising at once. I can only imagine the debate that led to this regulation.

</comment></comment></comment><comment><USER11> Actually a pretty good way to understand manual transmission. Very cool.

</comment><comment><USER12> It would be neat if you could enter a tire size (e.g. 165-65R13) and estimate the overall diameter from that.

Extra credit: figure out a plausible count of gear teeth for each ratio.

</comment><comment><USER13> Neat</comment>


Prohibited Application Types on Windows Marketplace for Mobile [pdf] - <AUTHOR> http://developer.windowsmobile.com/resources/en-us/MarketplaceProhibitedApplicationTypes.pdf <comment><USER2> Seems reasonable to me?</comment>


RIM's Developer Bribery is Working - <AUTHOR> http://www.gizmodo.co.uk/2013/01/rims-developer-bribery-is-working/

<comment><USER2> I don't see what's bad about this - people want a platform with apps. If the platform is the most advanced and user friendly - but there aren't any apps for it - it will fail.

Everyone does this in one way or another. For example Microsoft's push in universities and all those hackatons and competitions which result with students filling the app store. There are a lot of app competitions for Android as well - though they are organized by manufacturers (e.g. Samsung) or by mobile operators.

</comment><comment><USER3> I think android devs should be careful! It's deperate to the point that people are illegally converting android apps to the blackberry format without the orignal dev's permission.I wonder how many of the so called 10,000 submissions were converted with the permission of the original devs.

There's probably lots! Here is one of many apps being ported illegally. Some of these pirates are selling free apps under their name! This app is a stolen port! [http://appworld.blackberry.com/webstore/content/20081493/?mo...](http://appworld.blackberry.com/webstore/content/20081493/?model=Dev%20Alpha&lang=en)

of this original android app which goes for free: [https://play.google.com/store/apps/details?id=com.bigduckgam...](https://play.google.com/store/apps/details?id=com.bigduckgames.flow&referrer=utm_campaign%3Dapp.net%26utm_medium%3Dapp.net%26utm_source%3Dapp.net)

It's one thing to port apps without permission, but then selling the free apps too and earning the profits! If you see the app world right now, there's many apps like these in similar situations!

</comment><comment><USER3> I think there might be a similar issue with illegal ports of iOS apps too!

[http://crackberry.com/developer-gets-ios-apps-running- blackb...](http://crackberry.com/developer-gets-ios-apps-running-blackberry- real)

</comment><comment><USER4> You mean incentive program?</comment>


One reason Gmail for iOS still sucks  - <AUTHOR> http://iamnotaprogrammer.com/One-reason-gmail-ios-still-sucks.html

<comment><USER3> Google, I have the solution.

Step 1: Checkout the Sparrow source code

Step 2: Find and Replace All on the word "Sparrow" and change it to "Gmail"

Step 3: Add push notifications.

Compile and send to the app store.

<comment><USER4> I dunno about that - I really wanted to like Sparrow for iOS (aside from a couple bugs dealing with insane volumes of email, I love it on the desktop) but it never felt quite right to me.

I've actually just now reinstalled it to check what bothered me so much, and it's the same issue I have with the new Gmail app: swipe-to-archive simply isn't there. Frequency of me archiving messages: extremely high. Frequency of changing between different folders: nearly zero. Yet the left-to-right swipe which gives you the "delete" button in Mail brings that weird Facebook-esque hierarchical navbar that's become so prevalent in the last couple years.

Swiping the other direction exposes five options, two of which (I assume "archive" and "delete") have rather ambiguous icons. Mental energy - do not like (see also: new Gmail web UI).

When viewing an individual message, it's two taps to do all of the stuff that takes one in Mail. The designers traded always-visible icons for extra message real estate; clearly a matter of personal preference, but the wrong one for me.

Just goes to show how oddly personal the email experience can be, especially when you consider everyone's various workflows.

<comment><USER5> >> swipe-to-archive simply isn't there

>> Swiping the other direction exposes five options, two of which (I assume "archive" and "delete") have rather ambiguous icons

Hyperbole, much?

<comment><USER4> No. Swipe-to-archive means working the same way as it works in every single other iOS app that implements that functionality: left-to-right.

edit - To clarify: widely-adopted shortcuts are only effective when they work the same everywhere. Imagine if some applications mapped "paste" to ^P instead of ^V. It might as well not be there.

</comment></comment></comment></comment><comment><USER6> I love the Gmail iPhone app.

In particular, I love that it lets me change the "from" address, similarly to how the gmail.com site lets me do that.

Neither Mail.app nor Sparrow made it easy to change the from.

I have a few different email addresses that all get forwarded to my gmail account. Finally my mobile mail problem -- being able to select my from -- is solved.

If anyone from Google is reading this, thank you!

<comment><USER7> In Mail.app on iOS you just have to tap the 'From' address and choose a different one. What am I missing?

<comment><USER6> Not exactly.

To send from a different 'From' in Mail.app, first you need to connect your iPhone to additional email accounts (Settings->Mail). Then these addresses will show up in your 'From' drop down.

But then you end up with multiple inboxes in your Mail.app. Which is messy, fills up storage, and hurts my brain -- since I never need to check my other inboxes (because all my email addresses forward to the same Gmail account).

With the Gmail iPhone app, I just need to prove once (in gmail.com) that I have access to whatever 'From' addresss I want. Then I can select them in the Gmail app.

Note: I admit that the viewport issues discussed in the blog post are indeed an annoyance that I hope Google fixes soon. But I prefer Gmail app to Mail.app nonetheless.

<comment><USER8> To send from different mail addresses in Mail.app for iOS with only one inbox, you can add your additional mail addresses to your default mail address in the mail configuration by separating them with commas:

email@example.com, firstname.lastname@example.com, firstname.lastname@example.com, etc.

The same trick works for the OS X version of Mail.app

<comment><USER9> Thanks! I upvoted you because this was really good news for me.

On the iPhone (but not the iPad) I think you have to write this somewhere else and paste it in because I can't find a comma on the keyboard when editing that text field!

<comment><USER8> You are right, I have never actually entered my additional mail addresses into that text field but prepared the string in a text editor and copied it afterwards.

</comment></comment></comment></comment></comment></comment><comment><USER10> Disagree. The reason that Gmail for iOS and Gmail in general suck is the total lack of support for cryptography within the application (S/MIME, PGP, or other solutions).

As a friend of mine said, "Gmail -- a private conversation between you, me, and 25,000 SREs."

<comment><USER11> Funny, but not necessarily true. Poking around in someone's personal data is a really, REALLY good way to get fired immediately.

<comment><USER4> _getting caught_ poking around in someone's personal data is a great way to get fired ;)

</comment></comment></comment><comment><USER12> Basically all of iOS has the tiny-text problem (on iPhone, at least) - <USER2> Safari and Chrome have zoom that doesn't reflow text, so you either have to read something tiny or frantically scroll left and right to read each line. It gives me a headache, and this is the first thing that's made me think about switching back to Android.

<comment><USER13> >both Safari and Chrome have zoom that doesn't reflow text

 _What?!_ (That doesn't seem right...?)

<comment><USER14> It's not right, but it's true. No reflow on zoom in the iOS browser or WebViews

</comment></comment></comment><comment><USER15> It mentions @media queries working in the iOS Mail app, but as best as I've been able to decipher, they're still fairly broken (whereas Android's Mail app and K-9 aren't).

Specifically, it always reports that the mail is in landscape mode (even in the default portrait) and doesn't set max-width to a larger value when in landscape mode, making it (again, as far as I've been able to figure out) impossible to create different HTML mail layouts for landscape and portrait modes.

</comment><comment><USER16> They should make it more like the Android version, that one is awesome.

<comment><USER17> i don't know about that. i often get html-emails from companies which don't fit the screen. sometimes i can align it by adjusting to the left... shouldn't have to.

<comment><USER13> The new Gmail update included Pinch-to-Zoom. Check it out in the Settings. Works perfectly, solves this problem quite nicely.

<comment><USER18> Tip: after zooming in, double-tap the text to reflow it.

<comment><USER19> aaahhhh thank you!

</comment></comment></comment></comment></comment><comment><USER20> Point of note: the pinch-to-zoom failure to wrap text to the viewport is _also_ a feature of some Apple apps -- notably Pages, which is very pretty on the iPhone but fundamentally Not Fit For Purpose as a word processor on those devices, unless you habitually write text in a column 5cm wide.

Pages is fine on the iPad's larger screen, which can scale to display a US letter or A4 page reasonably clearly.

I suspect the root of the problem is a misplaced prioritization of presentation over content. Probably the right thing to do with graphics, but a really bad idea when handling text-based documents.

</comment><comment><USER21> Gmail app, both iOS and Android is full of fail. Too much "clean design" - aka, flat featureless grey on white boxes with icons that mean very little. I hate this new 'minimal' design craze.

<comment><USER22> Google Apps on my Android always were always one of the worst.

Google Maps - resource hungry, always doing something in the background, slow .. replaced them with much better, unfortunately local, alternative

Google Play - two examples: doesn't prevent phone from losing network so I have to play with the phone in order to download updates; listing my applications always takes about half a minute.. even if I did the same task 5 seconds ago

Google+ - basically unusable, unbearably slow, doing stuff in background all the time, crashed whole system few times

The truth is I don't have the most modern phone, but it isn't the slowest either (it's single core 900MHz w/ 512MB ram). It's running on the latest available android for that device (the device was sold less then a year ago, it's from 2010). Can't imagine how those apps run on older/slower phones.

Side note: Another multi-billion dollar company that can't seem to produce working android application is facebook. That is the single worst application that I have ever used (some were worse (google+), but I can't really talk about "usage" with them). It's getting slowly better, but it's still a crap. Twitter on the other hand is great.

<comment><USER23> Not to be rude, but most apps on the Play Store are going to run slow with those specs, especially if it's running on a more current version of Android than it was designed for. My G2 used to be blazing fast when it came out two years ago. I wouldn't even dare attempt running anything on that thing now.

Personally, I've found Google's Apps to work the best and look the best...on modern devices.

<comment><USER22> I understand that general developer doesn't care about part of the users if it would require the extra mile of work. But Google?

</comment></comment></comment></comment><comment><USER24> It lasted until morning, before I deleted it. While I like the UI to look at, it's not conducive to getting things done.

And I made the mistake of enabling push notifications - only to find my phone covered in notifications when I woke up - I know Google don't really have a better way of doing this due to iOS... but it does beg the question why bother, when you can't better what is already available?

</comment><comment><USER25> I filter all my addresses to Gmail on my iPhone 5 and it is amazing. I can send from any address as well, which is nice b/c I have about 10 different ones for various businesses. It works well and is easy for me. The Gmail app is essential in my opinion.

</comment><comment><USER26> I love the app, but there is one thing I'd change to perfect it, because I'm a heavy label user:

When choosing a label, there's no immediate visual feedback to show which label you've selected. This might not sound critical, but using a finger on a moving train can lead to inaccurate pressing! Compare that to the web interface: select a label, and there's immediate feedback saying "this conversation has been moved to/labelled "whatever_the_label_is".

I'd like to either see my selection invert, or a confirmation similar to the web interface.

(And agree with the OP: taking up valuable screen space with a thick border is inefficient).

</comment><comment><USER27> The subject line and contact info also take up a lot of vertical space. The actual content of the email doesn't start until halfway down the screen. Compare this to iOS Mail where the content starts about 20% down (the contact details are hidden until you click Details).

If the author weren't using an iPhone 5 with the longer screen, the first paragraph of the email would barely be visible.

</comment><comment><USER28> Used it on my iPad yesterday, and did notice the less-than desirable viewport width. Google seems to have been inspired by webOS's Mail app, but has forgotten that the quick-view could be expanded by pushing the inbox view away so that only the message is in full view.

Also, the grey borders are just a case of prioritizing form over function.

<comment><USER29> Just testing on my phone, I get the feeling the newsletter this OP has screenshotted has set it's own padding/margins as well, exacerbating the problem. Still, it should have been quite clear when they were designing it that two margins for a 240px width screen is overkill.

However, the inbox screen isn't so spaced out, and relatively condensed. Thankfully

</comment></comment><comment><USER30> This just shows how you must always optimize the UI for the primary task. It is never acceptable to compromise usability to improve style.

On small devices screen real estate is premium, so don't waste it with margins like this. Though I have to say the design looks nice, too bad it wastes so much space.

</comment><comment><USER31> The problem with apps that have stock Apple alternatives is that they always feel second fiddle to the OS. Even apps with tons of better features (reminder apps come to mind) often don't offer the same seamless worry-free integration of relatively bare-bones apps like Reminders

</comment><comment><USER32> I've been pretty happy using Mail with GMail set up as an Exchange host in order to get push. I am glad that Google is putting effort into their client. I couldn't figure out how to get the new Gmail to do a real delete instead of an archive.

<comment><USER33> Head over to <http://m.google.com/sync> on your phone and you can change the settings to allow proper deletion.

<comment> brown9-2 Yup, this is the solution, as weird as it seems to have to go to a Google preferences page to control delete behavior in the iOS mail app.

</comment></comment></comment><comment><USER34> Totally agree on the text zoom. I like that the iOS app has text under the icons. On gmail web they don't and I have to think a bit before I click an icon. I feel the earlier versions of web gmail were much more intuitive.

</comment><comment><USER35> _The Verge_ had some criticisms about the app as well: [http://www.theverge.com/2012/12/4/3728548/gmail-2-0-ios- hand...](http://www.theverge.com/2012/12/4/3728548/gmail-2-0-ios-hands-on)

</comment><comment><USER36> Another thing that is annoying about it is the fuzzy text when you zoom in. They must be using web views in a non standard way because the built in HTML viewer usually re-renders text as you zoom.

</comment><comment><USER37> I think that the main problem in the Gmail for iOS is that I can't configure the refresh time. For people who receive lots of e-mails it drains the battery so bad that it last only half a day.

</comment><comment><USER38> Actually, after 20 mins of use I found it incredibly uncomfortable. I still don't know why they didn't just continue with the fabulous Sparrow client. I'm going back to Sparrow right now.

</comment><comment><USER39> Am I correct in saying that this is using the technology Google acquired from Sparrow? The swipe-left bar in particular looks very much like the swipe-left bar in Sparrow.

</comment><comment> cupcake-unicorn Hah, in my opinion, Gmail for _Android_ still sucks. This is on 2.3 though, so I may be lacking some of the features.

<comment><USER14> You are. Pinch to zoom was just launched in 4.2 which I believe is only available for ICS and above.

</comment></comment><comment><USER40> Still so pretty...

/me runs

</comment><comment><USER41> a second reason, because it's iOS.

</comment><comment><USER13> Jeez it is a smack in the face to scroll down and see the iOS Mail app after the beautiful Gmail app.

<comment><USER42> What is beautiful about the Gmail app? All the grey? I'm all for clean design but I don't exactly see how it's cleaner or nicer than Mail.app.

<comment><USER43> I use my nexus and the constant grey puts me off. Very little contrast, very little distinction between what is UI and what is scaffolding. If you're going to do a flat design, the elements have to separate themselves from one another -- things have to be distinct. This is a great example of a flat email interface with basically the same layout as Google's client: <http://www.vanschneider.com/work/mail/> everything being #cecece and shifted one direction or the other isn't.

</comment></comment></comment><comment><USER44> Because it is Gmail?</comment>


How the demands of a Stanley Kubrick led to two new cinematographic tools - <AUTHOR> http://www.visual-memory.co.uk/sk/ac/len/page1.htm <comment><USER2> While not built for his demand, Kubrick was also one of the first to use the Steadicam for full effect in The Shining.

I think he is a good example of someone who didn't want to settle with a "bigger horse".

I've seen his collection of film and foto equipment in the film museum in Berlin and it filled the complete main room of the museum. Kubrick was a true nerd for the technology he used, but usually used it for effect, not just for fun.

</comment><comment><USER3> This is one of the candlelit scenes Kubrik shot with those lenses.

<http://www.youtube.com/watch?v=3c_dOMVXRhw>

</comment><comment><USER4> F/0.7!!??!! Wow.

<comment><USER5> F/0.7 at 36mm, at that.

Probably wouldn't have worked terribly well in a 35mm still camera. (35mm stills have the long side aligned with the sprockets, (864mm^2 total usable area) 35 motion photography has the short side aligned with the sprockets, and the usable area is reduced still further by optical sound encoding. (352mm^2)

I, of course, haven't used the lens in question; (nor, uh, seen the movie) but it almost certainly doesn't cast a wide enough optical circle to be used with a 35mm still camera, and probably isn't enormously sharp when stopped wide open.

EDIT: Looking into the world of ultrafast lenses, something I hadn't previously investigated with any real rigour, due to not being a Microsoft stockholder; and it appears that a f/0.7 lens for a 35mm still camera is not a thing that can be purchased for love or money. References to such lenses tend to be of discontinued models, or for 35 motion cameras.

My wild guess is that the manufacturers got tired of people inhaling their drink when told the price, then bursting into laughter when they actually see the (lack) of sharpness.

For an example, the Leica Noctilux-M Normal ASPH 50 mm F/1.0 .[1] For a lens that's not anywhere as wide angle as the article's lens, and a full f/stop slower, you have the enormous privilege of paying US$7,700. Don't drop it! You'd be really, really sorry!

You can find plenty of ultrafast wide-angle lenses for C-mount or Micro four- thirds, because the flange focal distance is smaller,[2] the throat size is smaller, and the frame size is smaller, all of which make the engineering problem easier to solve. Here's a F/1.0 3-8mm zoom[3] that's positively affordable! That's because they solve two completely different problems, as you may have noticed by the $6,650 difference in price.

1: [http://cgi.ebay.com/Leica-Noctilux-M-Normal- ASPH-50-mm-F-1-0...](http://cgi.ebay.com/Leica-Noctilux-M-Normal- ASPH-50-mm-F-1-0-Lens-/140566942069?pt=Camera_Lenses&hash=item20ba715175#ht_626wt_1140)

2: This means the focal plane is physically closer, so it doesn't have to throw the image as far, and doesn't have to focus over as large of a range.

3: [http://cgi.ebay.com/3-0MM-8-MM-CCTV-IR-CS-Lens-manual- Iris-F...](http://cgi.ebay.com/3-0MM-8-MM-CCTV-IR-CS-Lens-manual- Iris-F1-0-/270595328963?pt=LH_DefaultDomain_0&hash=item3f00bd0bc3#ht_2090wt_906)

<comment><USER4> i really need to start working on lensdb again. blah!

</comment></comment></comment><comment><USER6> Which of several Stanley Kubricks made these demands?</comment>


Mistrust and Verify - <AUTHOR> http://phpadvent.org/2010/mistrust-and-verify-by-kitt-hodsden

<comment><USER2> _Most web hosting these days is still shared hosting, with hundreds of users on one server. ... So, attack your application as a malicious user would. Use skipfish to attack your app, and Nmap to scan your server._

This is slightly problematic advice. There's a significant chance your shared hosting provider won't appreciate this sort of behavior. At a minimum, it violates pretty much every AUP I've ever read. To make matters worse, certain kinds of attempts to gain access qualify as serious crimes in most jurisdictions, even if the intent is non-malicious.

Get permission before running penetration tests on shared servers. If security really matters to you, don't host on anything less than a VPS. Those are cheap these days.</comment>


The inventor of hypertext - <AUTHOR> http://en.wikipedia.org/wiki/Ted_Nelson

<comment><USER2> He named it hypertext, but Vannevar Bush described essentially hypertext as part of his hypothetical "memex" system in this 1945 article: [http://www.theatlantic.com/magazine/archive/1945/07/as-we- ma...](http://www.theatlantic.com/magazine/archive/1945/07/as-we-may- think/303881/?single_page=true)

The hypertext description starts in section 7, and continues in section 8.

</comment><comment><USER3> Long forgotten? I'm sure he reminds people all the time.

He does have some fascinating projects though. Xanadu[1], a sort of visual hypertext browser & editor, is something I'd like to see a "real" implementation of. Any decade now...

[1] <http://en.wikipedia.org/wiki/Project_Xanadu>

</comment><comment><USER4> Read these rules for the Xanadu project: [http://en.wikipedia.org/wiki/Project_Xanadu#Original_17_rule...](http://en.wikipedia.org/wiki/Project_Xanadu#Original_17_rules)

and to me, at least, it becomes very clear why the WWW won the race.

<comment><USER5> Yup, he was _very_ widely cited (along with Vannevar Bush) back in the '80s when people were playing a lot with this sort of thing, but almost everything he actually tried to create seemed hopelessly baroque and over-engineered.

"Simple" is a very important concept in the real world, and what he churned out was anything but.

[I recall his book "Computer Lib" as being almost completely unreadable too, and remember thinking that he _must_ have doing drugs when he wrote it...]

</comment></comment><comment><USER6> Paul Otlet is an interesting character, too.

<http://en.wikipedia.org/wiki/Paul_Otlet>

</comment><comment><USER7> I had never heard of teledildonics. Thanks for the link, I learned a new word / concept !

<comment><USER8> Someone should digitally archive all those old Mondo 2000 issues as a public service.

<comment><USER7> For sure ! Bringing real life hacking to the mass could help people understand hacking culture in general !

</comment></comment></comment><comment><USER9> this wired article on project xanadu is a fascinating read: <http://www.wired.com/wired/archive/3.06/xanadu.html>

<comment><USER10> I find that article scarier than any horror movie.</comment></comment>


ZangZing is shutting down - <AUTHOR>

Received attached email from ZangZing today. No news on their site though.
Looks like you have until Aug 31st to get your photos.
<comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=
Hi,
Unfortunately, we have some sad news to share.
On July 2nd, ZangZing will no longer accept new users to join or new photos to be uploaded.
On August 31st, we will be shutting down ZangZing and permanently deleting all photos, contact information, and account information.
To download your original photos, please follow these steps: Sign in at www.zangzing.com/signin Mouse-over the album you would like to download Click the "i" menu and choose Download. This will create a Zip file of all the original photos in that album. Once each album is completely downloaded, then begin the next album download as simultaneous downloads can become corrupted on some web browsers Repeat this for all your albums If you have any problems, please refer to this Help article, http://zan.gy/Gzv1Qd.
Thank you for sharing our same passion for design, privacy, and group photo sharing. You inspired us.
The ZangZing Team </comment><comment><AUTHOR> There is always a heaviness in your heart when you hear a company is shutting down.

Anybody know if there were any specific reasons for ZangZing?</comment>


The real conflict behind  and srcset - <AUTHOR> http://blog.cloudfour.com/the-real-conflict-behind-picture-and-srcset/

<comment><USER2> What I don't get is why the 2x image would ever have a different viewport size than the 1x. It seems like something no one would ever use, as the layout would change depending on the user agent's image resolution preference.

In any case, I think both of these solutions are woefully incomplete, and quite inefficient. Why do we have to maintain lists of file paths for each resolution of every image when we could take advantage of file naming conventions in a systematic way and avoid all that work and complexity? Sets of images invariably share almost exactly the same file name and the variations are largely standardized for any given web page (all 2x images have "_2x", "@2x", "@2", etc.); surely we can use that to our advantage.</comment>


Poll: Is backprop of SGD happening in neocortex? - <AUTHOR> https://twitter.com/rhyolight/status/1196533263059173376 <comment><USER2> As someone commented on twitter your question is about as useful as asking whether a brain uses torch.autograd to do credit assignment.</comment>


Last male northern white rhino is put down - <AUTHOR> https://www.theguardian.com/environment/2018/mar/20/last-male-white-rhino-is-put-down <comment><USER2> The conservation war has been lost, the humans have won, all that is left for us rebels is preventing and reducing the damage done by one species upon millions of others forever.

</comment><comment><USER3> Seems kinda crazy to me that you'd put down a rhino that is the last male of its kind. Even one in pain. Why not induce a coma, and keep those gametes alive?

</comment><comment><USER4> [https://news.ycombinator.com/item?id=16627060](https://news.ycombinator.com/item?id=16627060)</comment>


Show HN: Libemf2svg, a library/utility to convert Enhanced Metafile (EMF) to svg - <AUTHOR> https://github.com/kakwa/libemf2svg <comment><USER2> Does it vectorize bitmaps from the Enhanced Metafile?

<comment><AUTHOR> No, and it doesn't even handle bitmap blobs yet.

The other big missing parts are clipping and emf+ records as a whole.

However, I am not sure it's a good idea to vectorize a bitmap.

<comment><USER2> Whether it matters depends on the use case of course.

If the bitmap is not vectorized it can't be styled with CSS. It also means that the resulting SVG contains arbitrary data from the source or edited as text.

Anyway, years ago when I was dealing with WMF in a vector context, not SVG, embedded bitmaps made the imported objects mostly worthless. Years before that, I would use Corel Draw to vectorize bitmaps and it worked remarkably well for ordinary cases.

<comment><AUTHOR> The trick here is for "ordinary cases" ^^.

Vectorizing bitmap might not be trivial and results in crappy or huge (in size) outputs.

As far as I can, I would like to keep this conversion library as simple as possible. Ideally it should be a simple translation between EMF records and SVG with exceptions only where there is no direct mapping. Bitmap blobs, when supported, will be converted to png and embedded inside the svg.

However nothing forbids you from adding a post treatment on the generated svg to handle bitmap/png.

The day I will come back to my initial motivation for this lib (converting visio stencils to svg, including emf blobs), It's probably what I would do if I need to.

<comment><USER2> That makes sense. I have been curious about what would generate enough WMF files to justify writing a converter since I saw the post.

It might be useful to include why the software was written in the readme. It could improve discovery for people dealing with Visio.</comment></comment></comment></comment></comment>