Covid-19 is becoming less deadly in Europe but we don't know why - <AUTHOR> https://www.newscientist.com/article/2252699-covid-19-is-becoming-less-deadly-in-europe-but-we-dont-know-why/ <comment><USER2> As the article mentions, it seems more likely that the decreasing death rate is due to higher rates of young people being infected vs older people. Also due to increased testing catching the less severe cases.

Back in April here in the U.K even healthcare workers weren't getting tested. Now you can get a test posted to your house for free if you show even the mildest symptoms, so much more of these mild cases are getting counted.

Also, anecdotally, older people are still taking precautions to minimise contact with others whereas younger people are basically going about life as normal. Hence, the virus is spreading around younger people much more than older people. For example, the U.K had a huge number of deaths in care homes earlier in the pandemic but I believe most care homes are still locked down to some extent while at the same time the pubs are open and kids are heading back to school next week.

</comment><comment><USER3> From what I can tell looking at friends and family, a lot of people are currently returning from vacation, and it's been on the news a couple times that those people are bringing back covid, presumably visiting bars and clubs depending on where they traveled, easing the spread.

That would explain why it's becoming less deadly. The old and vulnerable don't travel, so we have a disproportionate amount of young people getting infected which recover well. Let's see how many of those who return can't resist visiting their grandparents in the first two weeks after returning. Maybe we get a delayed deadly wave when it hits the retirement homes again.

</comment><comment><USER4> It's hard to compare to march: there were no testing numbers at that time, it's impossible to know how many cases there were back then when hospitals started to get full of very sick people. We'll probably know in a few weeks.

</comment><comment><AUTHOR> >Evaluating the effects of SARS-CoV-2 Spike mutation D614G on transmissibility and pathogenicity [https://www.medrxiv.org/content/10.1101/2020.07.31.20166082v...](https://www.medrxiv.org/content/10.1101/2020.07.31.20166082v1)

>Estimating the infection fatality ratio in England [https://www.cebm.net/covid-19/estimating-the-infection- fatal...](https://www.cebm.net/covid-19/estimating-the-infection-fatality- ratio-in-england/)

</comment><comment><USER5> It seems obvious to me that the more people isolate, the more there is evolutionary pressure on the virus to become more infectious and less virulent. Even if people didn't "social distance" there would be some pressure, but the better they do it, the more there is.

I think I remember people saying similar things months ago, and being called ignorant idiots by angry people on HN, but I was never sure exactly why.

</comment><comment><USER6> I've heard that vitamin D play a big part in successful recovery. Northern Hemisphere gets their vitamin D mostly in summer so this is the time when European immunity is the strongest?

<comment><USER7> As far as I can gather this claim stems from a single non-peer reviewed preliminary report from back in may:

[https://www.webmd.com/lung/news/20200518/more-vitamin-d- lowe...](https://www.webmd.com/lung/news/20200518/more-vitamin-d-lower-risk- of-severe-covid-19)

[https://www.yalemedicine.org/stories/vitamin-d- covid-19/](https://www.yalemedicine.org/stories/vitamin-d-covid-19/)

<comment><USER6> There are many. For example:

[https://link.springer.com/article/10.1007/s40618-020-01370-x](https://link.springer.com/article/10.1007/s40618-020-01370-x)

</comment></comment></comment><comment><USER8> probably because the most vulnerables are already phased out leaving the more resistant types</comment>


Noeqd - A fault-tolerant network service for meaningful GUID generation - <AUTHOR> https://github.com/bmizerany/noeqd

<comment><USER2> very cool, you can simplify your install instructions to

      goinstall github.com/bmizerany/noeq</comment>


One Reason Why Facebook Wins  - <AUTHOR> http://www.techcrunch.com/2009/10/27/one-reason-why-facebook-wins/ <comment><AUTHOR> Dan started on the same day I did. It's hilarious to see this kind of story in TechCrunch - on top of an already super funny vid.

</comment><comment><USER2> Zuck wearing a tie? What's going on...? I was led to believe he only wears t-shirts and sandals at all times.

<comment><AUTHOR> It was a thing for 2009, to get serious.

      This year people at the party noted his tie and he explained
      that he was wearing it to denote that this was Facebook's "intense" year.

[http://scobleizer.com/2009/01/29/zuckerberg-facebooks- intens...](http://scobleizer.com/2009/01/29/zuckerberg-facebooks-intense- year/)</comment></comment>


Humane.js 2.1 released - simple modern notification system - <AUTHOR> http://wavded.github.com/humane-js/

<comment><USER2> It looks cool but why are you popping up a giant box in front of my face?

That HAS to violate some sort of User Experience. If it doesn't I am going to say it violates _mine_.

<comment><USER3> I remember implementing the precursor to this idea by Aza Raskin (<http://code.google.com/p/humanmsg/>), and users _hated_ it. "Get that giant box out of my face" was by far the top complaint.

<comment><AUTHOR> Thanks for your implementation, served me many projects! Yeah I wonder what Aza had to say about that complaint, seems to be similar here :)

<comment><USER3> Sorry, my statement was misleading. I didn't implement that library, but rather integrated it into an existing project of mine.

</comment></comment></comment></comment><comment><USER4> I'm sure that this is a really well implemented piece of code. However, just as a personal preference (this is not a flame or attack, just some feedback), I think a site using this would be a site I'd stop using. I find the dialog really annoying because the effect of blocking user input in order to display some sort of message seems really inhumane to me. There are better ways to do notifications without pushing a big dialog, with some text, in the face of the user.

<comment><USER5> That's a theme, try the libnotify one instead.

<comment><USER6> You could argue though that first impressions matter, so the first example they have set up shouldn't be one that people find so distasteful.

Out of 12 comments on here, 2 are already about disliking the initial "big text box" example.

They should make lib notify the first one, and try to get some additional themes that showcase it. The 3 that are there are pretty simple and two are big annoying textboxes.

</comment></comment></comment><comment><USER7> Another one: gritter.js

<http://boedesign.com/demos/gritter/>

<comment><USER8> this actually stacks notifications too

</comment></comment><comment><USER9> I think you should change the default template to libnotify, so much nicer.

Also, the notifications behave strange when hovering over them with the mouse... they shrink onhover, then on the next hover they dismiss.

This is on Chromium 15.

<comment><AUTHOR> You probably just timed it right to get that behavior, bigbox for example, shrinks on hover, other themes will fade or whatever. If you are 'hovered' it will continue the animation at whatever point you were at when it goes to close the notification.

</comment></comment><comment><USER10> I think notifications must stack to be usable.

My experience with websites that queue up notifications (the old thesixtyone.com) is that you sort of pause, sit there, and wait for them to finish up so you see what they say. A better experience is for them to stack up in the corner so you can read them, then click them away once you're done.

<comment><AUTHOR> The idea of humane messages is that they require no user input to close. I do like stacking idea, maybe a future release. For now, setting the timeout to be shorter, or forcing new messages provides a workaround.

<comment><USER11> I find messages that close themselves very _in_ humane; I can easily miss them if I look away or switch tabs, or they can disappear while I'm trying to understand them, with no way to bring them back.

My top feature request would be a 'stays up until dismissed or navigated away from' option.

</comment></comment></comment><comment><USER12> I gotta admit I'm confused why these things are popular on hacker news. I've written several "growl" notification tools, usually I just re-write it on top of whatever ui toolkit the project is using rather than try to use a library. It takes less than 20 minutes to write one sufficient for whatever your use case is, and it works exactly how you need it to.

Not saying this or any other implementation is bad and you shouldn't use it, but why does hacker news get so excited every time one of these shows up?

<comment><USER13> Because hackers are lazy. Some say all inventors are.

</comment></comment><comment><USER5> Does it support stacking?

</comment><comment><USER14> Not to be inflammatory in anyway but how is this any better than some of the existing libraries, such as jGrowl etc?

I'm looking for some 'arguments' to seriously consider something like this - Thank you ;-)

<comment><USER15> This one doesn't have a dependency on jQuery if that's a selling point for you. There is also an option to wait for mouse / keyboard input before dismissing, which is kind of nice as well.

Otherwise it seems similar to most of the others.

<comment><AUTHOR> I would also add mobile webkit support, and ability to create themes with Stylus (which renders IE gradient fallbacks, easy vendor prefixing, etc). I'm not sure if the landscape has changed much but I haven't seen many that support CSS transitions. At the end of the day its just a fun experiment that some people may like and other may not :)

</comment></comment></comment><comment><USER16> "A simple, modern, framework-independent, well-tested, unobtrusive, notification system."

Design wise, the default is pretty _obtrusive_.

Nice library though. Thanks.

<comment><AUTHOR> Thanks, yeah the big box apparently isn't a big hit as something more subtle like libnotify, I hope more designers come in and share their ideas, I like the jackedup that was submitted. The idea of humane message (which wasn't mine) was somewhat like the bigbox, which I liked, I think the unobtrusive part comes in that the user doesn't have to click to remove it, and getting out of the way when you want to see what's behind it. Thanks for the comment.

</comment></comment><comment><USER17> Another library that has notifications, alerts, prompts without dependency on jQuery: <http://ssssnakes.com/smoke/></comment>


Show HN: Tarmak – toolkit for Kubernetes cluster provisioning and management - <AUTHOR> https://blog.jetstack.io/blog/introducing-tarmak/ <comment><USER2> Tarmak is also the name for Transitional Colemak, a method of switching from Qwerty to Colemak keyboard layout.

[https://forum.colemak.com/topic/1858-learn-colemak-in- steps-...](https://forum.colemak.com/topic/1858-learn-colemak-in-steps-with- the-tarmak-layouts/)

</comment><comment><USER3> Hi all, this is a toolkit people at my company (jetstack) have been working on for some time. It'd be great to get some feedback and comments on it!</comment>


Marpa will parse anything that can be written in BNF - <AUTHOR> http://savage.net.au/Marpa.html <comment><USER2> I've been aware of Marpa since about 2010. Every once in a while I read whatever Kegler has written, and I come away from it each time unconvinced that I should put in the effort to use it (which, for the most part, means first porting it to another language). On the plus side, he does acknowledge some of the prior art in the field. But on the flip side, he makes expansive claims, and there has been essentially zero uptake of Marpa or even its ideas, as far as I am aware.

Does Marpa live up to its advertising? Is it more generally useful than GLR or GLL (which, despite having some flurry of effort in the past decade, themselves have not set the parsing world on fire). It's frustrating, because the parsing world has gone around in circles for many years now (PEG being a great example). It would be nice to have algorithms with superior parsing power that are at least as fast as the less powerful ones used by virtually everyone today.

<comment><USER3> May I ask what kind of criteria you have in mind for being "more generally useful"? Parsers are something I know next to nothing about and hardly ever have to reach for. Is it mostly speed and power? Is the current crop not sufficient to parse any BNF, or is it that people want something to handle more permissive grammars?

The only parsing library I've played with recently is Instaparse in Clojure, which is apparently GLL. It was a delight to use. I found a PDF of the old version of Apache Expression Language that I needed to interpret, typed it almost verbatim into a quite readable text file, and Instaparse did the rest. It was an exciting experience to have unlocked this embedded DSL with about three lines of code, not counting the grammar definition.

[https://github.com/Engelberg/instaparse](https://github.com/Engelberg/instaparse)

</comment></comment><comment><USER4> Regrettably, I've not yet seen Marpa ported from Perl. The C core `libmarpa` is only part of it.

The most recent effort I've noticed is the Rust marpa and libmarpa-sys crates, but they've seemingly been inactive for a year.

It might be interesting to attempt a port to language like Julia, both dynamically expressive, and with a good C ffi. Just to get a feel for the level of difficulty. Though I've a many-years-old _very fuzzy_ recollection that the test coverage was worrisome.

Even by the "shoemaker's children have no shoes" standard of our profession, the state of parsing can disappoint.</comment>


Java on Playstation 2 - <AUTHOR> http://www.mikekohn.net/micro/playstation2_java.php <comment><USER2> > Java Grinder itself has some.. quirks and some things just missing, kind of > mostly due to the fact that I was originally targetting the MSP430 as more > of an experimental thing. One thing that was missing was the ability to do > memory allocation of objects. I added the ability to instantiate some > objects on Playstation 2, mostly with the Draw3D API. I didn't write any > kind of memory allocator or garbage collector, so all calls to "new" are > being done on the stack. I thought about doing some kind of heap memory > allocator thing, but decided in the end to just keep it simple.

!

> I also added more "float" support for Playstation 2 (there was already some > support in the Epiphany / Parallella code). Some other things such as "long" > and "double" types are still not supported.

!!

Bloody well works though, doesn't it!

</comment><comment><USER3> > _"it disassembles into assembly source code for real CPUs."_

Another way to describe this functionality is: "compiler".

<comment><USER4> more transpiler than compiler...but close enough!

</comment></comment><comment><USER5> Loved the demo, ended up headbanging to the music.

Java is truly a heavy metal language.

<comment><USER6> I always felt it was the "elevator musak" of languages.

</comment></comment><comment><USER7> This makes me want to boot up my PS2 which has an official Sony Linux install. Yep, they did that. They made a Redhat distrib that runs off of DVDs (with a bootable disc), hard disk, ethernet controller, and video that could connect to a monitor. Super fun. I'm not sure I ever accomplished much - you could program the EE, but not run any retail games. Still so neat though! I wish more platforms would have official linux support!

<comment><USER8> I have one of those as well. Haven't turned it on in almost forever.

</comment></comment><comment><USER9> I'm not particularly familiar with the Playstation 2, but what's stopping you from running the JVM on it directly?

<comment><USER10> [https://github.com/kaffe/kaffe/blob/master/FAQ/FAQ.ps2linux](https://github.com/kaffe/kaffe/blob/master/FAQ/FAQ.ps2linux)

Nothing really. It's basically a MIPS CPU with some custom additional SIMD hardware. There's at least one open source JVM implementation that works on PS2 Linux. Sun announced plans to release an official JVM for the PS2 but it never happened. The Dreamcast had a web browser that could run Java applets though.

<comment><USER11> Just going to throw out there that the Dreamcast didn't have a MIPS, but instead an SH4. You didn't really say that it was, but I just wanted people passing by to know that.

<comment><USER12> The SH3/4 were cool little chips and had a surprising number of JVMs. Aside from the planetweb implementation on the Dreamcast, IBM had one, there was a cleanroom implementation called Kaffe project, and I had an optimizing JIT in SH4 assembly. Sadly the architecture is little used anymore.

<comment><USER13> > Sadly the architecture is little used anymore.

It's headed for a resurgence though. See here: [https://www.vimore.org/watch/lZGHbMS882w/building-a-cpu- from...](https://www.vimore.org/watch/lZGHbMS882w/building-a-cpu-from-scratch- jcore-design-walkthrough-by-rob-landley-jeff-dionne/)

</comment></comment></comment></comment></comment><comment><USER14> It'd be neat if someone ported Minecraft

<comment><USER15> 300MHz CPU and 32MB RAM - it's not going to look great or have much draw distance.

<comment><USER16> Probably not using a Java VM, but a Minecraft-like game would be doable e.g. using GNU gcj (Java to native code). E.g. the PS2 (32MB RAM + 4MB VRAM, 294MHz R5900 2-way IoE w/ SIMD + 2 x VLIW VUs @294MHz, with massive fillrate capabilities) is more powerful than the PSP (32MB RAM -plus 32MB extra for disc cache in some models- + 2MB VRAM, 2 x R4000 1-way @133-333MHz 1-way IoE -main and aux-), and there is a Minecraft clone for it called "Lamecraft" [1] :-)

[1] [https://www.youtube.com/watch?v=J9zIb0zVFfQ&t=1m](https://www.youtube.com/watch?v=J9zIb0zVFfQ&t=1m)

<comment><USER17> gcj does not do what you think it does. It compiles ahead of time, so you get rid of the startup time and the warm-up time that plagues Java applications. But the code produced is just as GC-happy and memory-intensive as before. So the steady-state performance of gcj binaries vs JVM-run .class files are about the same (or somewhat worse for gcj binaries).

<comment><USER18> The performance of gcj would have to be equal or worse than the jvm almost by definition as it would lack the ability to do optimization at runtime in the way the HotSpot VM does.

<comment><USER8> Except for AFAIK there is no HotSpot VM port to MIPS, and gcj was well supported there.</comment></comment></comment></comment></comment></comment>


A Quest to Make a Toaster from Scratch (2011) - <AUTHOR> http://gizmodo.com/5794368/why-its-harder-than-you-think-to-make-a-simple-toaster <comment><USER2> Reminiscent of 'I, Pencil'.

[https://hn.algolia.com/?query=I,%20Pencil&sort=byDate&dateRa...](https://hn.algolia.com/?query=I,%20Pencil&sort=byDate&dateRange=all&type=story&storyText=false&prefix&page=0)

Consider all the tools he used from the modern age in order to make the materials, 'from scratch' means using nothing but your body, but I suspect that the project would have ran over several lifetimes.

It would have probably been better to start with something simpler, such as a hammer, but definitely points for trying.

</comment><comment><USER3> This is very cool, but I can't help but think that toasters are an incredibly impractical way to be toasting bread if you start from nothing. Just make a stick and a fire to hold it over and you're done in minutes!

<comment><USER4> I can't tell whether or not you realize that isn't the point.

<comment><USER3> You can't? So you suspect I may be thinking that his purpose was to toast bread in the most efficient manner possible?

Hint: He starts out buying a working toaster.

<comment><USER4> Hey man, it's the Internet, anything's possible.

</comment></comment></comment></comment><comment><USER5> Excellent! I wonder how many laws and regulations he (harmlessly) broke during the quest.</comment>


List of Fractals by Hausdorff Dimension - <AUTHOR> https://en.wikipedia.org/wiki/List_of_fractals_by_Hausdorff_dimension <comment><AUTHOR> Opinion: One of the best pages about fractals on the Internet...</comment>


Should you register as a business if you are creating a paid monthly newsletter? - <AUTHOR> Is it necessary to register for tax and legal reasons? Also, let's say a customer gets angry and isn't satisfied, how should you respond? And what if they decide to sue because you didn't deliver what they wanted? Is a terms of service related to this? How do I write a terms of service? <comment><USER2> This is assuming US.

You don't need to register for tax reasons. When doing taxes you report that income on, I believe, Schedule C form (which corresponds to a line in 1040 Form). Creating a company (LLC or S Corp) will cost you a bit of money and a bit of additional accounting/tax hassle.

As to people suing you.

A lawsuit would cost at least thousands of dollars in lawyer costs. No sane person will spend thousands of dollars to recover tens of dollars (or whatever your newsletter would cost).

Not to mention that unless you clearly defrauded them, they would not win. "I don't like what I bought" is not a winning legal argument.

The worst that can happen is that if they paid via credit card they can issue a chargeback through their bank. Which is why if you have angry customers that are not satisfied with your product, refund them quickly, no questions asked.

You don't need terms of service. In practice they'll not make any difference.

If you really want some meaningless text on your website, you can pay a lawyer, use a services that sells cookie cutter TOS or copy TOS of someone who does a very similar thing.</comment>


I Won't Hire People Who Use Poor Grammar. Here's Why. (2012) - <AUTHOR> https://hbr.org/2012/07/i-wont-hire-people-who-use-poo

<comment><USER2> I couldn't stop laughing at where the URL truncates.

I dock the author for their use of filler words that weaken their statements.

 _> All applicants say they're detail-oriented; I just make my employees prove it._

"All applicants say they're detail-orientated; I make my employees prove it."

 _> And just like good writing and good grammar, when it comes to programming, the devil's in the details._

"Like good writing and good grammar, when it comes to programming, the devil's in the details."

I disagree with Klems Rule [0]. It can lead to cannibalism. The devil is in the details.

 _" Brian's food."_

[0] [http://www.writersdigest.com/editor-blogs/questions-and- quan...](http://www.writersdigest.com/editor-blogs/questions-and- quandaries/grammar/contractions-with-proper-nouns-brians-a-baseball-fan)</comment>


Ask HN: Open-source license with special restriction from FAANG using it? - <AUTHOR> Ask HN: Open source license with special restriction from FAANG using it? Is it possible to use a standard license like apache 2 but adding restriction to specifically disallow FAANG companies to use it in any way, thus preventing from what happened to  some recent big open source projects? <comment><USER2> You can add any clause to a license. JSON's license is famous for adding "The Software shall be used for Good, not Evil."

It probably makes it non-open source and non-free according to OSD and FSF

[https://opensource.org/docs/osd](https://opensource.org/docs/osd) "The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research."

[https://tanguy.ortolo.eu/blog/article46/json- license](https://tanguy.ortolo.eu/blog/article46/json-license)

<comment><AUTHOR> Interesting, Thanks. Good and Evil is still a broad category, I assume having a named company in license to disallow them from using it would in some way cause more problem due to their name being used i guess?

<comment><USER3> What about countless service providers, consultants and contractors that [maybe] working on [SaaS] technologies potentially providing services to FAANG?

Hard to trace/track.

</comment></comment></comment><comment><USER4> You'd need to define what you mean by a FAANG company. Do you literally mean the aforementioned companies? In that case they can work around it if it's one of their smaller companies like Instagram or WhatsApp. If you forbid usage if the _parent company_ is FAANG then they can work around it by making a totally separate company whose only job is to provide a service (using your software) to FAANG at no markup. If you mean a company of certain size, then it could have collateral damage on big but not malicious companies, and can again be worked around by sharding usage of your software to smaller companies to stay under the size threshold.

</comment><comment><USER5> If you really want to, make it AGPL and most companies, especially large ones like FAANG, won't touch it due to the virality of the license.

</comment><comment><USER6> You can do that, but your project would no longer be Open Source by the commonly accepted standard definition[1].

Personally, while I understand and appreciate the sentiment behind this, I don't think doing this kind of thing accomplishes very much, and I'd recommend against it. YMMV, of course.

[1]: [https://opensource.org/docs/osd](https://opensource.org/docs/osd)

<comment><AUTHOR> Yep i understand it wouldn't be opensource per se, i think the question really is, should it be done, if yes why, if no why not and has someone else here on HN done it before or have seen a project with such a license before?

<comment><USER6> I think we've all seen lots of examples where somebody took an existing license and tacked some extra verbiage onto it. The recent controversy around the "Commons Clause" stuff is a good example.

My take is just this: if it's a deeply held ideological thing for you, then by all means, go for it. But if you want your project to be widely adopted / used, etc., then in pragmatic terms I think you'd be better served sticking with a straight-forward, conventional license. Not _everybody_ cares about this sort of thing, but a lot of people get uneasy using projects that use "non-standard" licenses.

</comment></comment></comment><comment><USER7> How will you know who's using your FOSS project?

<comment><AUTHOR> don't want to point fingers here but when they start yet another "FOSS project as service on their platform"? mainly i don't want to prevent other startups or mid size companies from using it, but the big platforms have a tendency to just change or tweak the project in small way to suit their platform which causes incompatibilities with upstream, secondly imho it is not fair for the project, since the project is trying to survive while these platforms get bigger and mint money off project contributors work without ever giving back or affecting it adversely sometimes by taking control of the project.

<comment><USER8> Startups and midsized companies do the same all the time. Are you drawing the line on profit? Number of employees?

As others have said, if you want to make a political statement go for it and name all the companies you don't want using your software explicitly (and keep updating that when they work around you).

Personally, I wouldn't bother. If this is for a business idea, rethink your revenue strategy... licensing alone is a nightmare to enforce.</comment></comment></comment>


Vertically Scaling PostgreSQL - <AUTHOR> http://pgdash.io/blog/scaling-postgres.html <comment><USER2> I administer a medium-sized postgres db, around (now) 110GB of data, and recently had the opportunity to revisit the old .conf file when I redeployed that database to a different server. What I quickly realized was that years of tweaks I had implemented as I learned postgres from various (now outdated) online sources were making it difficult to optimize my new instance.

I decided to start again from scratch. I discovered a handy little utility called pghero and set up it's internal monitoring:

[https://github.com/ankane/pghero](https://github.com/ankane/pghero)

I backed up my old .conf replaced it with a default and blew away all my old indices, and fired up the database. Of course, nothing worked well. But step by step, working with postgres' internal tools and pghero, I took a brand new look at every previous assumption and was much more strategic about where and when I created an index and which tuning parameter I tweaked.

Long story short, I was able to knock 30 GB off of the install disk size (based, in large part, on unnecessary duplicate indices), accelerate the most common queries, and everything worked a lot smoother. Plus my postgres installation was no longer fighting old postgres .conf tuning tweaks which were designed for much older versions of postgres.

Just adding my vote for revising your old tuning parameters after your database (and your programmer/administrator) has matured a bit.

<comment><USER3> This is a common operation for my team as well. In my old project, so many indexes that were added were just assumptions about the usage pattern of the data. Not only did they blow up the size of the table and INSERT time, they became the opposite of a red-herring where developers would stop and look elsewhere because the table "already has indexes".

Only adding indexes with good use of EXPLAIN/EXPLAIN ANALYZE on expected usage patterns yielded good results. Often we'd just blow the indexes away and fiddle until we added the correct one to enable an index scan / index only scan.

Other big boons for us have been using ENUM types where necessary (small known dataset for a column) -- now your column takes 4 bytes instead of N bytes for a string. I find them a bit easier to work in than foreign keys for this optimization because of their direct string mapping.

We've had really good mileage with Datadog's APM tools, RDS performance insights and pghero as you mentioned.

<comment><USER4> > Other big boons for us have been using ENUM types where necessary (small > known dataset for a column) -- now your column takes 4 bytes instead of N > bytes for a string. I find them a bit easier to work in than foreign keys > for this optimization because of their direct string mapping.

Can you give an example?

It sounds like normalising the schema would have similar (perhaps more) benefits.

<comment><USER3> Normalizing has similar size benefits. For our use case (big aggregate reporting tables), incoming external data is not normalized, meaning we'd have to have another process iterate over it with foreign table in memory and map it to the foreign key. Enum's can be transparently ingested without this normalization requirement, while taking equivalent space. There's also now one level of indirection between the column and its value. Both are fine.

</comment></comment></comment></comment><comment><USER5> _" In Linux, the most popular host for Postgres, the size of the OS disk cache cannot be set by the user."_

True, though you can tweak settings on when the cache writes dirty pages. Percona has a blog post specific to Postgres that covers it. There's also some other tuning there not mentioned in the HN linked story.

[https://www.percona.com/blog/2018/08/29/tune-linux-kernel- pa...](https://www.percona.com/blog/2018/08/29/tune-linux-kernel-parameters- for-postgresql-optimization/)

</comment><comment><USER6> There is an interesting tool called nancy that runs automated experiments with different postgres setups, allowing you to compare them against each other. It can run workloads derived from log files or pgbench (disclaimer, I wrote the pgbench support). The idea is, you run many experiments, tweaking different configurations and nancy automates the analysis of them, eventually allowing you to settle into a cost minimum/performance maximum you're comfortable with.

[https://github.com/postgres-ai/nancy](https://github.com/postgres-ai/nancy)

</comment><comment><USER7> Beware, effective_cache_size is NOT, as stated, "the amount of disk cache provided by the OS"

It is a combination of shared_buffers and kernel cache size See [https://www.postgresql.org/message- id/20181105120104.GA13769...](https://www.postgresql.org/message- id/20181105120104.GA13769%40momjian.us)

This important configuration parameter is a too-often badly understood. IMHO it should be, at least on a server non dedicated to PG, periodically dynamically calculated by the engine.

</comment><comment><USER8> Check out pgtune ([https://pgtune.leopard.in.ua/#/](https://pgtune.leopard.in.ua/#/)) if simple config tuning is what you are looking for. It is probably more valuable than this blog post.

<comment><USER9> > It is probably more valuable than this blog post.

Learning about what goes on under the hood before you blindly change settings some tool spits out doesn't seem like a bad idea I'd say.

<comment><USER8> The point is that the pgtune could and should force you to check the config options in documentation and it actually addresses your current setup. RTFM.

Values in the post are pretty arbitrary and useless as their comments in postgresql.conf used to be.

I am using PostgreSQL in production since 7.4 and the best source of performance tuning tips for me has been PostgreSQL 9.0 High Performance by Gregory Smith. These days PostgreSQL wiki is pretty good as well.

<comment><USER10> I'd second that book recommendation. I just went through it again on a long plane flight, and much (if not all) of the configuration advice applies to more recent releases as well.

</comment></comment></comment></comment><comment><USER11> Sounds like many of these should be automatic by now. One area where I'd like to see some progress in Postgres.

</comment><comment><USER12> Feel free to check [https://postgresqlco.nf](https://postgresqlco.nf) A humble effort to document all PostgreSQL configuration parameters and provide some guidance.</comment>


The end of social networks as we know them? - <AUTHOR> https://medium.com/@marc_atallah/we-messed-up-everything-and-its-great-adb482227faf <comment><USER2> I don't think Facebook can survive ten more years without deep changes. Facebook needs your data to survive but they don't bring much value to their users anymore, some people are leaving but many are just getting passive and don't post anymore. This is probably the end of an era and Facebook recent missteps are probably the nail in the coffin.</comment>


Zero Trust Networks - <AUTHOR> https://crawshaw.io/blog/zero-trust <comment><USER2> This post is partially plugging [https://tailscale.com](https://tailscale.com).

With everyone looking at remote work, tons of people must be questioning their VPN strategy right now. I know we are.

I was going to complain that that's a close source product (as I don't want to use something closed source for my network access controls) but it looks like the code is on Github, just not linked in an obvious way from the website. [https://github.com/tailscale/tailscale](https://github.com/tailscale/tailscale)

Has anyone used this or checked out the code? I may give it a spin.

<comment><USER3> A few solutions worth evaluating, especially w/ what is going on right now with the increased demand to securely support remote work:

1\. Zscaler ZPA - closed source but from a market leader

2\. Palo Alto - subjective if true zero trust but if you already have PA...

3\. Akamai - based on a SDP acquisition which had good tech - not sure what Akamai has done with it

4\. NetFoundry - both open source and SaaS options

5\. Nebula - strengths for east-west microservices. Open source from Slack.

6\. Tailscale - listed above. New but open source.

7\. Appgate - closed source but nice implementation of the use cases it targets.

8\. Illumio - a more mature version of Nebula; also targeted at east-west.

9\. Centrify - closed source but solid option for IAM focused use cases.

10\. Perimeter81 - not familiar with it but is well regarded.

11\. Cloudflare - relatively new solution but leverages their network nicely

12\. Duo - certainly was a nice solution - not sure what Cisco has done with it.

13\. ZeroTier - not familiar but adding per comments below

* Edits - added 11-13 per comments below in attempt to make this a more comprehensive list.

<comment><USER4> I typically don't shill around here, but why isn't ZeroTier on that list? I suppose we don't have a giant marketing budget (yet). We do have a product used by hundreds of thousands for years and it has microsegmentation and other nifty stuff like multicast.

[https://www.zerotier.com/](https://www.zerotier.com/)

Also not everything on that list is the same. Some of those are app-level gateways, IAM infrastructure, etc. That's a bag of stuff for different use cases.

Some of that stuff is also cloud proxy based, not mesh based. Maybe some people don't care but I'm heavily biased toward peer-to-peer mesh. I find it offensively stupid for packets to travel 1000 miles to reach a system next to me or in the same city. Of course I guess everything has a use case. I might opt for a cloud proxy if the bandwidth were low, the users and/or customer were non-technical, and it was all web stuff.

<comment><USER5> I've been using ZeroTier for a small collection of two devices plus two servers. Honestly, the main pain points I have are UX: Android and Dashboard. Other than that, I have no complaints.

<comment><USER4> Yep, UX is gonna get some love, especially desktop GUIs. The current ones are going to get led behind the barn for the Old Yeller treatment soon.

We have generally been focusing on behind the scenes tech more than GUIs so far.

<comment><USER6> Thank you 'api. I have been using zt at the university group of about 60 users. Must say it is very reliable. As for UI, we are OK with it. But one thing is firewall config is too complex. Not enough examples: Recently I saw that zt-laduke posted a simple bridge tutorial on reddit. Would be great if you made some examples in your wiki. 1\. Allow only samba traffic 2\. Allow only ssh traffic 3\. Allow only RDP

I am sure is kinda popular at r/datahoarder and related communities. May be you need to apply for a GSOC type project - so that academics start using it (will then later get used in corporate).

</comment></comment></comment></comment></comment></comment><comment><USER7> > I am leery of jargon. I am as guilty of using it as the next engineer, but > there comes a point where there are just too many precise, narrowly- > understood terms polluting your vocabulary. The circle of people you can > talk to shrinks until going to the store to buy milk feels like an exercise > in speaking a foreign language you took one intro course to in college. Less > jargon is better.

Before reading the paper, That beginning has hit me, That's a brilliant writing skill.

</comment><comment><USER8> > Zero Trust networking means treating the internal network just like an > external network: authenticate every connection, encrypt all traffic, log > everything. Plan as if every machine (virtual or otherwise) as if it is > sitting on a public IP address.

Everyone knows that's the ideal network, but in practice it takes a lot of resources, that's why people prioritize internet exposed things. I mean, outside of tech companies (even then..) Most companies don't even fix critical security vulns internally fast enough. Behold exemptions galore!

My problem is this term is used way beyond netwoking to mean so many different things. What the author describes is not what half security vendors think zero trust means.

I don't dislike the term because it's a jargon but because the ambiguity leaves too much room to turn it into another box people check to have a false sense of security.

Something like "AAA resource access" (Authentication,Authorization,Auditing is an very old networking concept from cisco land) might be a better term. You gotta be unambiguous so it's easier to say "No, you have not implemented that".

<comment><USER9> My feelings exactly. I just wrote a similar comment before seeing yours. I'll let mine stand because I cover some other points as well.

</comment></comment><comment><USER10> The entire "BeyondCorp" strategy from Google has probably done more harm then good. Tons of smaller companies and well known startup paid their prices with breaches left and right.

Removing or not deploying basic firewall controls to lock down traffic is ill advised. Tons of exposed s3 buckets and other assets keep showing that.

Zero Trust is correct strategy of course, but it doesn't mean you have to open up your network to the entire world- it's in addition to already established best practices. Better to continue those traditional practices and be more thorough via micro-segmenation for instance, and identity on top of it.

<comment><USER11> BeyondCorp does not imply opening up your network to the entire world! If anything, it means locking down your network tighter, because not even the office is privileged. Production is a black box that you touch by authenticating through the same reverse proxy tier, no matter where outside of it you are. In effect, _nginx_ is your "VPN" server and _everyone_ has to use it.

Plenty of companies paid dearly for trusting every device that merely needed internet access.

<comment><USER10> Internet exposed bastion hosts to production, that have no IP whitelisting are not the best idea, unfortunately not uncommon nowadays.

<comment><USER11> That's what a VPN server is.

<comment><USER10> Organizations that have high value assets would deploy multiple layers of these, not just one, basically depending on value of assets.

<comment><USER11> You're gonna get some pretty fun pathological networking behaviors tunneling VPNs on VPNs.

</comment></comment></comment></comment></comment></comment><comment><USER12> Zero Trust Network is now used by every other security vendor that want to rebrand themselves as hip.

</comment><comment><USER9> opening sentence:

> precise, narrowly-understood terms

ha! if only zero trust were precise! By narrowly-understood, the author means "well understood by those that speak jargon, but impenetrable to outsiders". In this case though, there's a nice irony in that statement.

</comment><comment><USER13> Aka common sense.

</comment><comment><USER14> This company has been exploiting HN for so long on a systematic basis. Really tells you how things work here.

</comment><comment><USER14> @dang please will you ever take action against this excessive and systematic exploitation of this company to market its products for free here?

</comment><comment><USER14> @dang please will you ever take action against this excessive and systematic exploitation of this company to market its products for free here?</comment>


Hold off on proposing solutions - <AUTHOR> http://lesswrong.com/lw/ka/hold_off_on_proposing_solutions/

<comment><USER2> This also holds true for user feedback. Users are great for identifying problems and pain points. They're absolutely terrible at recommending improvements, for a plethora of reasons. They can't see past their own issue, they can't see far beyond the present design, they have no idea of the internals, they don't realize or properly value unintended consequences of their suggestion, and they often quite simply don't have a good sense of design. Making the most of user feedback requires filtering out the feedback itself and identifying the underlying issue that's generating the feedback. Even if your solution ends up resembling one of the suggestions, it's most helpful to understand the issues driving that suggestion.

</comment><comment><USER3> This is only tenuously connected, but Less Wrong is, for me, much like tvtropes.com is for some people. I usually find I'm opening an exponentially increasing number of tabs, as every post has several interesting links.

Here is the point in this comment where I would usually throw out a "I resolve that" or "what I should do" kind of solution for this issue... but that would seem quite counter to the message of this entry. Hmm.

<comment><USER4> I have the same problem. Putting it in my RSS reader has helped to some extent.

I can think of several reasons why this might be, but in the spirit of the post I should probably not say them. :)

</comment></comment><comment><USER5> This is a standard technique in B2B sales. Instead of trying to sell a predefined product (aka a solution), have a conversation with the customer about the issues that they want to address. It's a reasonable approach for complex problems because you have no idea whether your product is the right fit until you're aware of all the little details.

</comment><comment><USER6> This attacks something that user researcher Steve Portigal calls "solutioneering" and the phrase has stuck in my head since I saw his ixdasf talk last year. He led the audience through an exercise to show a typical client project, where we went through several rounds of breaking down a consumer product and its uses. It was even harder than I thought it would be to stick to discussing the problem rather than jumping straight to possible fixes or improvements.

</comment><comment><USER7> This is also discussed in Methods of Rationality, chapter 25 (Yudkowsky's Harry Potter fanfic): [http://www.fanfiction.net/s/5782108/1/Harry_Potter_and_the_M...](http://www.fanfiction.net/s/5782108/1/Harry_Potter_and_the_Methods_of_Rationality)

</comment><comment><USER8> I wonder whether it really would help with just one person. I suspect part of the problem with groups is that the one who proposed a solution will take a social hit if it is rejected. So, with just you, that shouldn't come up.

</comment><comment><USER9> How does this relate to the TDD mindset?</comment>


Ask HN: How do you promote your side projects? - <AUTHOR>

I have been working on a side project that would be a database of people interested in carpooling. If people don't signup, the website is useless. I am trying to figure out how to promote this website so users would signup. Any suggestions / advice? <comment><USER2> I would focus on the people that could use it the most.

First focus on location,groups,individuals.

If you focus on a city, college campus, or town it could then be pinned down to a specific group of people - in a class, project, building. Then further it could be a few people who live near one another that could take advantage of such a service.

<comment><USER3> this sounds like a good idea to me.

you don't need a huge number of people, you just need enough people in one rough location.

you might be able to get in contact with local community groups in an area who could benefit from the service. if you are initially targeting a particular area, you could also advertise it the old fashioned way by physically distributing notices / flyers -- i have seen this done for car-sharing services in my city.

if you initially advertise / promote the website to a bunch of people who are scattered all over the world, perhaps you'll struggle to hit a critical threshold of density for the website to be useful to anyone in any particular location.

edit: if you promote your website via something like product hunt, reddit, etc, consider the audience that you are promoting it to. are they likely to all live in a similar location? are they likely to find a car-sharing service useful? why?

edit^2: some other ideas:

* perhaps to get the first few people to sign up, you could drive them places yourself! * you might be able to find per-city / per-town car-ownership statistics. this could possibly be useful in deciding which regions could most benefit * you might also be able to find car traffic statistics. these could also be useful for figuring out where there might be large flows of people driving roughly the same way (i've found these before as publicly available data for my city)

good luck!

</comment></comment><comment><USER4> I am making a tool that showcases 10 new ideas/early projects each day. Sort of a combination of Yahoo news digest with Product hunt. With the purpose of helping form these new ideas.

For each of the ideas/projects, the maker can get feedback by asking multiple choice questions for viewers to answer.

Is this something you might be interested in using to promote and shape your side projects?

<comment><AUTHOR> This sounds great! I am looking for some initial users that can give some critical feedback as well. I will get in touch with you soon. Thanks!

</comment></comment><comment><USER5> Focus on the demographic of the people who need this tool.

For example get in with colleges and universities particularly those in areas where public transit is not accessible.

<comment><AUTHOR> This makes sense. Thanks for the input.

</comment></comment><comment><USER6> Ah, the two sided marketplace problem. Who is the limiting factor, and how can you persuade people with those characteristics to join your site?

Is the limiting factor drivers or riders?

<comment><AUTHOR> Can you explain why you think this is a two sided marketplace problem?

In my case the subscribers of my site are the consumers. But I need a lot of subscribers to start with so that when they sign up, and start to consume, there is a potential match.

</comment></comment><comment><USER7> What I've done/will do on the next project:

\- Pre-release signup to be notified when it's available

\- Product Hunt

\- Create a "Show HN" post on Hacker News

\- Reddit

<comment><USER8> Question for all the redditors: Is there like a ShowHN on Reddit or you just post a story and hope for the best?

<comment><USER9> I have subscribed to two subreddits that sort of cover this. The first is /r/SideProject. It is a place that people post their side projects and occasionally blogs/articles about their side project. The pros of it is that people don't frown on self promotion but the con is that there doesn't seem to be many comments going on to help improve your offering. The second is /r/lookatmyprogram although that sub seems to be dead. The bigger (if not the biggest) software subreddit is /r/programming but they state that "App demos should include code and/or architecture discussion." so you wouldn't be able to flat out promote.

<comment><USER10> > but they state that "App demos should include code and/or architecture > discussion." so you wouldn't be able to flat out promote.

Unless architecture/code is a selling point, of course.

Also, /r/software and some of its ilk might be a good place to look at, though I don't know about promotion (it seems to be the other way around: people looking for software that does a particular task).

</comment></comment></comment></comment><comment><USER11> My first piece of advice is to post a link whenever you're talking (even tangentially) about your project.

Second, promote it within a community who needs it. Some ideas: Subreddits for large metro areas (or suburbs), Facebook groups. Hopefully this gave you the spark you need to come up with others.

<comment><AUTHOR> Thanks for the feedback. This makes sense.</comment></comment>


Show HN: I made a steganography program - <AUTHOR> https://github.com/JHurst97/SteganograhyProject.git <comment><USER2> As far as I know the state of the art in image stego is perturbed quantization with wet paper codes.

The essential idea with wet paper codes is that you can use error correcting codes so that even the recipient need not know which bits contain the data.

A simple analogy is that if you wanted to communicate only a single bit you could decide that the xor of all the data in the image decides the bit. Then the encoder can flip the single least distinguishable bit to encode their message.

The idea behind perturbed quantization is that when you quantize the data (e.g. while jpeg compressing it) some values will be maximally close to tied between rounding up and rounding down. If you embed your data in those values you'll minimize the embedding noise.

Unfortunately most of the work on approaches based on these ideas is academic and has no public implementation, but there is one that I'm aware of [https://sourceforge.net/projects/pqstego/](https://sourceforge.net/projects/pqstego/)

There is a lot that could be done both with respect to security (e.g. using better models to predict the image to hide the stego noise better, better error correcting codes, and list decoding) and basic engineering, e.g. handling content length encoding better.

<comment><USER3> Image steganography techniques have indeed reached a level of sophistication that requires significant expertise to implement correctly. A good parallel is compression--most CS undergrads can figure out how to implement Huffman or even LZW compression, but state-of-the-art ANS (asymmetric numeral systems) is pretty dense. I believe a special type of wet paper code called a syndrome- trellis code is at the forefront of image steganography: [http://dde.binghamton.edu/filler/pdf/Fill10tifs- stc.pdf](http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf). Good luck parsing that without a solid foundation in information theory.

Steganography is the current focus of my PhD research, and from my perspective the greatest security challenges are in systems engineering. Embedding secret messages into your vacation photos is one thing, but who are you sending these messages to? And why? How will they know when and where to go looking for the secret message?

Encryption entered its golden age with the advent of public-key cryptography and Diffie-Hellman key exchange, allowing two parties to share the secrets required for secure communication knowing only public information about one another. However, steganographic systems are still dependent upon lots of out- of-band secret sharing, since attempting to share the necessary secrets over public channels tends to reveal the existence of the system and opens up DoS attacks (e.g. Tor and the identity of relays). IMHO, figuring out better solutions to the system security of particular steganographic applications is a much more pressing research problem than improving statistical embedding profiles for image steganography.

<comment><USER2> You can use public key encryption which is indistinguishable from uniform. E.g. using ECDH w/ ellegator and ed25519 for the key agreement.

Then the recipient of the stego need only publish the public key. If the encoding software were part of standard linux distributions (even if just specialized security conscious distros), then the sender could obtain it without identifying themselves.

I don't think you can tackle the problems in isolation: There isn't much point in making uniform encryption if the embedding gives it away to anyone who's looking. :)

> but who are you sending these messages to?

One scheme I've been fond of is where the recipient announces their public key and that they'll accept messages in images posted to some moderately high traffic public picture board, like r/naturepics. Then then simply download and process all images submitted there.

The sender has an easy and obvious cover story for their posting and can produce as many images they need just by visiting a park with a camera.

<comment><USER4> "the recipient announces their public key"

A typical threat model is that there is a "warden" who can selectively block messages, so this would not really work since the warden would block the announcement (in theory the warden is not going to block all messages, although a formal security definition should only focus on whether or not the warden is more likely to block stegomessages than innocent messages, which is trivial if the warden blocks everything). Thus out of band communication is needed to distribute secrets; likewise, the stegosoftware itself has to be distributed out of band.

"indistinguishable from uniform"

Actually you need to be indistinguishable from the "background noise" (the thermal noise from the camera sensor) of the image, which is not uniform. In fact, the noise is correlated with the camera itself and can be used to identify which camera took a particular photo.

<comment><USER2> > Thus out of band communication is needed to distribute secrets; likewise, > the stegosoftware itself has to be distributed out of band.

This is why public key cryptography is so important. Because you can use a broadcast channel -- like a Linux distro to communicate the tools and required knowledge in a way that doesn't give a strong signal that you're using it.

> "indistinguishable from uniform" Actually you need to be indistinguishable > from the "background noise" (the thermal noise from the camera sensor) of > the image

This isn't the case for code based encoding. The encoded values are a pseudorandom linear combination of a huge number of bits from the image and end up being extremely uniform. Consider my silly xor example: the xor of all the bits in the image is going to be close to uniform, even if the bits in the image are fairly biased.

But also more generally: If you have a way to map encrypted messages onto the space of uniform strings, then you can also remap from them onto any other required distribution in a fairly straight forward way.

Having a good error metric is important though, and it's one of the areas that seems a bit under researched.

<comment><USER4> "you can use a broadcast channel"

That is not part of the threat model, and in any case is basically an out-of- band channel.

"like a Linux distro to communicate the tools and required knowledge in a way that doesn't give a strong signal that you're using it."

Again, the threat model is that the adversary controls the network and can block or modify messages at will. So unless all linux distros included the software, the adversary would simply block those that include the software. The threat model of steganography basically implies that some out of band distribution is needed.

"encoded values are a pseudorandom linear combination of a huge number of bits from the image and end up being extremely uniform"

That has nothing to do with what I was talking about. The "time domain" of the image is where the noise lies and where the bias exists in the bits. Even if it can be encoded in some way that looks uniform, that does not mean that an arbitrary change to the encoded image will have the correct bias when it is decoded.

"you can also remap from them onto any other required distribution in a fairly straight forward way."

In the forward direction, but the reverse direction is not so straightforward. This is a classic problem with doing ElGamal encryption on elliptic curves -- some curves do not have an easily invertable map from bit strings to the EC group. I do not know how hard this is to do with images, but when I last looked image stegosystems relied on heuristics and needed relatively short messages to remain secure.

<comment><USER2> > That is not part of the threat model, and in any case is basically an out- > of-band channel.

It may not be the threat model _you_ are interested in but it's part of the usage model of just about anyone capable of actually using a computer with arbitrary software, even in extremely restricted parts of the world. (users who can't run arbitrary software can't really be helped by steg stuff they can't use!)

Simplified threat models can be extremely helpful in formalizing security arguments, but taking them too and confusing them for actual usage can be devastating for the users security too.

> That has nothing to do with what I was talking about. The "time domain" of > the image is where the noise lies and where the bias exists in the bits. > Even if it can be encoded in some way that looks uniform, that does not mean > that an arbitrary change to the encoded image will have the correct bias > when it is decoded.

In fact it has everything to do with what you were talking about. One of the advantages of using wet paper codes is that you can _arbitrarily_ preserve the properties of the underlying data while encoding uniformly random information. Even better: only the encoder needs to know about the properties that are being preserved, so it can use information which is unavailable to the attacker or the receiver such as an unquantized or higher resolution original. This is what the PQstego program I linked above does.

The encoder has significant freedom to preserve whatever properties it needs to preserve while encoding uniform data.

> but the reverse direction is not so straightforward. This is a classic > problem with doing ElGamal encryption on elliptic curves

You would _very much_ not want to use ElGamal for this (or essentially any application which you didn't need its additive homomophism)-- doing so has terrible performance, terrible security properties, and terrible communications efficiency.

If you look back at my message I specifically brought up "elligator" for ECDH -- a bidirectional mapping between curve25519 points and bits. Similar approaches exist for many other curves.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Decrypted text from image:

> Not going to lie I'm surprised anyone can figure out how to decrypt this in > the current state of the program, well done! P.S. star my repo plz I'm > trying to look employable! :)

Project wasn't building correctly to start with, UI is bit clunky (missing window frames!?).

</comment><comment><AUTHOR> This is different to the other stego programs out there in that it allows the user to choose how many LSB (Least significant bits) they want to use. This is important because if you use 4LSB an image can store more data but it is more obvious in the output, with 1LSB it is less obvious but you can store 1/4 as much data. My program also allows you to input text OR image into a cover image. If you are unfamiliar with steganography - I have tried to explain it simply on the github readme. ANY feedback on the program or the repo would be greatly appreciated!

-J

<comment><USER6> I made one years ago ([https://www.planet-source- code.com/vb/scripts/ShowCode.asp?t...](https://www.planet-source- code.com/vb/scripts/ShowCode.asp?txtCodeId=28747&lngWId=1)). Had a quick look at your code and I could be mistaken, but it looks like you modify the pixels from top left to bottom right. You can make it harder to detect by selecting the pixels pseudorandomly, seeding your prng with the encryption key.

<comment><USER7> If the hidden data is encrypted anyways, then wouldn't it be indistinguishable from truely random data? What would then be the point of distributing it randomly or in order?

<comment><USER4> Actually, the thermal noise of a camera is biased so a uniform random distribution of low-order bits will be easy to detect. You need to preserve as much of the thermal noise as possible and try to choose pixels from high frequency regions of the image (where the thermal noise is harder to separate from the image itself).

<comment><USER8> So maybe the best approach would be to use a filter/transformation to exclude hard-lined regions (edges) and only embed data within variations/gradations?

<comment><USER4> Other way around: edges are a good place to try to hide stegotext because of the high frequency components (the edge effect, which is also why JPEG artifacts are worse along sharp edges).

</comment></comment></comment></comment></comment></comment><comment><USER9> Do you have an algorithm that will work with recompressed lossy images?

I experimented with steganography before, but simply sending a picture via Facebook and clicking Save To Camera Roll on an iPhone causes serious data loss pretty quickly, so I couldn't get meaningful data out.

In the end I found that PDF attachments worked for my use case, but I'd still rather have an image-based steganography program if possible.

<comment><USER10> If you want watermarks to survive jpeg compression, you have to do DCT block manipulation, not just individual pixel values.

<comment><USER11> Does this survive cropping by not-multiple-of-8?

<comment><USER10> When you decode, you can start from offsets (eg 4,4) rather than 0,0.

</comment></comment></comment></comment><comment><USER12> As a developer of 20 years who has avoided .Net, some build instructions and/or some releases would be nice, but looks like a fun project!

<comment><USER5> Open it in a recent VS (2017 worked), fix the compile error and run it.

<comment><USER12> We don't all use (or even have) Visual Studio.

<comment><USER12> Also, that assumes a platform, no? This wouldn't build on Mac/Linux/Unix machines, without a Mono setup, would it?</comment></comment></comment></comment>


Contribute to Open Source without Being a Programming Genius (2012) - <AUTHOR> http://blog.smartbear.com/programming/14-ways-to-contribute-to-open-source-without-being-a-programming-genius-or-a-rock-star/

<comment><USER2> > 7\. Fix a bug

Many open source projects (definitely those at Mozilla) even have specially- labeled bugs in their database that are good for beginners. For example, in Servo we mark those issues "E-easy" and provide support for them on our IRC channel:

[https://github.com/mozilla/servo/issues?labels=E-easy&page=1...](https://github.com/mozilla/servo/issues?labels=E-easy&page=1&state=open)

I know the Firefox team is even better than we are, with a split into Mentored bugs (with an identified owner you can contact for help!), Easy bugs, and Good Student Projects:

[https://developer.mozilla.org/en- US/docs/Introduction#Find_a...](https://developer.mozilla.org/en- US/docs/Introduction#Find_a_bug_we've_identified_as_being_good_for_newcomers)

<comment><USER3> Are those "E-easy" bugs a good start to get into Rust?

<comment><USER2> Those bugs will definitely get you started working with a larger Rust codebase. You might want to at least scan the Rust tutorials on [http://www.rust-lang.org/](http://www.rust-lang.org/) , though, as just reading Servo code is probably not a good way to initially learn the language. Servo has a lot of foreign function interface code and many parts of the architecture are optimized for performance, making some of the data structures and task communication patterns fairly advanced.

Rust itself also has its own E-easy bugs, many of which are in libraries that do not suffer from the same kind of heavy optimization that we've done in Servo:

[https://github.com/mozilla/rust/issues?direction=asc&labels=...](https://github.com/mozilla/rust/issues?direction=asc&labels=E-easy&sort=updated&state=open)

</comment></comment></comment><comment><USER4> This is a great writeup for would be contributors.

I recently ran a questionnaire for potential and new open source contributors, pretty unanimously the responses were split between

People who havent contributed: had maybe tried, were nervous about getting started, lacked good guidance from the project and in general

People who had: Found life a lot easier once they got over the initial hump, were extremely grateful of the help they got, were hugely positive about the impact OS had on them

Did a small writeup about it @ [http://arandomurl.com/2013/10/24/problems- getting-started-in...](http://arandomurl.com/2013/10/24/problems-getting- started-in-open-source.html)

I was originally planning to do a project to help first time contributors (goodfirstpatch.com), however realistically I dont have any time right now. I found openhatch.org to be a good place for people to get introduced, there was definitely improvements it can make but it was a real help for an open source workshop I ran.

<comment><USER5> Yeah openhatch is good. There was a bit of talk on it on the episode on Twisted (because Jessica is also involved in that) on the FLOSS weekly podcast, check out that episode if you're interested.

Edit: [http://twit.tv/show/floss-weekly/225](http://twit.tv/show/floss- weekly/225)

</comment></comment><comment><USER6> I wanted to contribute to my first OS project. I am an hobbist programmer, but I do have some good skills in python/flask. As I said I was still learning and once I pointed the project coordinator to my half-assed github, he did not answer me back anymore.

Point is: I can work on documentation and bugs, but if you behave like an asshole, how can I even do that? People are not contributing much to OS because many programmers reject the idea of mentoring. But think about it: it gives you more 1 hr of mentoring and then 10 hours of work of an hobbist programmer or 1 hr more of programming?

<comment><USER7> nobody should be an asshole agreed

but sometimes the net cost to the senior/mentor person is actually negative, if the other party, the newb is sufficiently junior or incompetent. there are plenty of cases where somebody delivers one "fix" or "improvement" which then itself introduces other problems. save 2 hours, cause other people an additional >2 hours of work afterward, sometimes multiple of that. (time to add a bug? a few seconds. time to discover/home-in/fix/test that bug later? hours/days/weeks.) that's... not good. and experienced folks try to minimize it. the nice thing about the Internet is how we can all talk and learn and collaborate together more easily now than ever before. the bad thing about the Internet is folks who are still but wee infants, skill-wise, who, say 20 years ago would have had a long gestational period working in private and relative isolation, on their boxes before they emerged into the larger ecosystem (at a job or university, etc.) are instead often almost immediately jumping into forums, channels and repos and trying to "contribute" while they're still in that gestational stage. It's like there's now an army of cute fuzzy wittle lion cubbies who now try to tag along with the adult lions when the latter slink off to hunt for prey -- it impairs both parties and does not actually "help" either.

<comment><USER6> Let's not get offensive, OK? I have been programming in University, learning on my own, both R and Python (and SQL, Javascript, HTML, CSS). I played in Python for 3 years. I am not a noob, I know what I am doing. My "problem" is a half assed github. And you know why is that? Not because of my bad programming, but because of lack of motivation. Really, we are not all ninjas here coming home from a 9-5 and then coding on side projects till 1am. Many people lack that kind of motivation and that is why we need people willing to mentor or at least being friendly.

Finally, if a push from a total stranger can mess up your code base, I wonder if you know what you are doing. We do test driven development for a reason.

P.s. I am giving you an up 1 so I make sure you read this.

<comment><USER7> I spoke in the general case based on decades of first-hand observations in RL. There are obviously always exceptions to any general pattern or effect.

Also, not all projects have automated tests. Not all those with automated tests have 100% perfect coverage of everything that could possibly break. If anything I'd argue that the rise of unit test culture and TDD culture has actually increased the incidence of allowed sloppiness in some cases by folks having the mindset of, "I can deliver any diff I want. If no existing test failed, or the project has no tests, I did nothing wrong." This mindset too I've seen evidence of repeatedly.

And there's nothing wrong with a person being new to programming. I can only reiterate the core point of my original comment to which you replied.

</comment></comment></comment></comment><comment><USER8> Yesterday I made my first pull request to an open source project.

Previously I'd always felt like I wouldn't know where to start or wouldn't be able to contribute in a meaningful way. In the end, I decided to just get over myself and do it.

I think everyone should try to aid open source projects in some way, especially when they use open source on a daily basis.

</comment><comment><USER9> I would love to see a few more people contribute to open source. I read article after article about people who want to make a switch from their Apple or Microsoft Desktop, but then say open source / floss desktops are not ready or not productive enough.

There is a huge disconnect in that these people don't feel empowered to jump in, fix those defects and make it the desktop they have always wanted. I think blogs like this will help point them in the right direction.

</comment><comment><USER10> I tried to work this year on contributing to open source, while looking for projects I ran into the KDE summer of code. I emailed the guy who was in charge of the project I wanted to work in. I messaged him in IRC. I never got any kind of reply.

And that sucks. I don't even use KDE I just wanted to help, to not even get a "hey sorry we're full" or something, that sucks.

</comment><comment><USER11> Artwork, design and translations are often needed aspects of open source software which don't require programming knowledge.

<comment><AUTHOR> That's true, those are all great additions. Someone actually just left a comment this morning pointing any designers to [http://open- karma.com/](http://open-karma.com/)

</comment></comment><comment><USER12> So what step is before this one? I'd love to contribute to an open source project, but I still don't think I have enough programming skill in Python. I've been following several MOOCs and been through codeacademy and LPTHW, and I still can't program any projects(small or big), or even contribute to any.

<comment><USER13> One way to contribute is by testing documentation - try following a project's instructions to set up a local dev environment, and then report anything confusing or outdated in the documentation. You can also write a blog post explaining your experience of trying to contribute to a project - being a thoughtful beginner can help you point out problems that a more experienced contributor might automatically compensate for and not even notice. I wrote this kind of post for OpenStreetMap once, and experienced contributors appreciated it: [http://www.openstreetmap.org/user/brittag/diary/19741](http://www.openstreetmap.org/user/brittag/diary/19741)

Like the article says, you can also answer support questions, report bugs, help manage bug reports (verifying reports, marking duplicates), write publicity blog posts, etc. These tasks are important and often understaffed on projects, and they help you become more familiar with a software project and more prepared to become a productive contributor to code.

I do non-code software work like that, and I've been happy to find a project that invited my kind of help: OpenHatch ([http://openhatch.org/](http://openhatch.org/)), conveniently relevant because it's about helping people who want to contribute to open source projects.

</comment></comment><comment><USER14> It's tremendously easy to contribute to open source. The problem is, everyone wants to get their name in the Linux kernel. It's just not happening. The technical bar is too high. Pick something less visible. There are literally thousands of projects that have bugs and are not even being maintained. Stop being a trendwhore.

<comment><USER13> "Trendwhore", seriously? Anyway, this article isn't talking about people aspiring to make major contributions to high-profile highly-complex projects, it's talking about people who want to contribute to projects in general, and saying that small less-technical contributions are great to start with.

And it's not that easy to find a project, especially not for inexperienced developers. You don't want to pick an unmaintained project - you need somebody around to help you when you get stuck, ideally at least a few people so that you don't burn them out on answering questions. Hopefully you manage to find a project that has reasonably friendly people, some way to talk to them, a language you're familiar with, relatively easy tasks to get started with, and is interesting to you in some way - not really a simple Github search.

</comment></comment><comment><USER15> Wonderful. My big goal for 2014 is to submit something to Rust, this might come in handy.

</comment><comment><USER16> Everyone's input is always a great tool

</comment><comment><USER17> High ability at a repetitive task is a skill, not a genius.

<comment><AUTHOR> I think that's the point of the article. It's how to help without being a genius.</comment></comment>


John Carmack, who said developing VR is a moral imperative, stops developing VR - <AUTHOR> https://nwn.blogs.com/nwn/2019/11/john-carmack-vr-oculus-cto-moral-imperative-ai.html <comment><USER2>
        One insider suggested to me that Oculus' development and
        launch of the Quest -- a greatly reduced (if relatively
        popular) vision of virtual reality -- might have been a
        touch too demoralizing for his aspirations

So pretty much "The Audacity of Zero" but for tech-hype.

[https://barrymorisse.com/blog/the-audacity-of- zero](https://barrymorisse.com/blog/the-audacity-of-zero)</comment>


Palo Alto to NYC...No Pit Stops - <AUTHOR> http://jordancooper.wordpress.com/2011/02/05/palo-alto-to-nyc-no-pit-stops/

<comment><USER2> "For me, traveling to New York City was like an immigrant going back to visit the old country. People there live in a dirty, dangerous environment, bound to the land by some misplaced sense of heritage or tradition, unaware that the key to a better life is simply to get the hell out of town."

\-- Jerry Kaplan Startup ISBN 0-14-025731-4

</comment><comment><USER3> Really, can people stop with the poetic job offers? I'm a human being, not a rockstar, a ninja, a monkey, or apparently Poe.

If you have a job opening, just state it. Say that it's in NYC and you are looking for someone from the Bay area. Post some requirements and you might get some more interested parties.

Unless you really are just looking for an emo engineer.

<comment><AUTHOR> really...it's a filter...meant to weed out people like you and surface people who we actually want to work with. go work at IBM

<comment><USER4> Many consider it a big warning sign if a job description contains the word "leverage" or any such marketing speak. And unfounded hyperbole like " _When you move here, you will be in the top 2% of engineers in New York City._ " doesn't instill much confidence either.

I believe the reason for this lies in the sad fact that as software developers we have all met a lot of business and marketing people who talk like that, and speaking from personal experiences none of them were trustworthy. As an engineer I don't want my managers to be cheerleaders; for many reasons, not the least of which is they tend to turn into megalomaniac taskmasters who exhibit a glaring disconnect from reality.

When you write stuff like " _really...it's a filter...meant to weed out people like you and surface people who we actually want to work with. go work at IBM_ ", you're essentially confirming these suspicions.

Now, Jordan, I didn't write this to diss you, I wanted to convey an explanation where negative feedback may be coming from. As a developer I would like to be impressed by ideas, not by enthusiastic type A personalities who are quick to lash out against others.

<comment><AUTHOR> dude, I'm a product person, don't have marketing bone in my body...</comment></comment></comment></comment>


EU loses $27B in corporate tax a year to UK Switzerland Luxembourg Netherlands - <AUTHOR> https://www.taxjustice.net/2020/04/27/eu-loses-over-27-billion-in-corporate-tax-a-year-to-uk-switzerland-luxembourg-and-netherlands/ <comment><USER2> What would a country like Luxembourg actually do if they no longer had the 'advantage' of providing tax avoidance?</comment>


Show HN: Web development – Self evaluation checklist - <AUTHOR> https://evaluate.underjord.io/web <comment><USER2> Once you get lower in the list, past the basics, you need another option - "Know when to use it"

<comment><USER3> Even in the first section, once you get past HTML, they need not be used all the time, and can easily be avoided in many cases.

</comment></comment><comment><USER4> That's a good survey, quick to reply and complete. However, I'd like to get a score (that's quite of a vanity metric, but would be cool to share it).</comment>


Is GitHub Search Down? - <AUTHOR> For the ladt couple of hours even the most basic queries show 0 results. This one shows 0 results https://github.com/search?q=int&type=Code <comment><USER2> Working when SEARCH all GITHUB is selected

[https://i.ibb.co/5Gkpg4J/git.jpg](https://i.ibb.co/5Gkpg4J/git.jpg)</comment>


All the goodness gone from tea (1688) - <AUTHOR> https://books.google.com/books?id=ux89AAAAIAAJ&lpg=PA93&ots=_0XDTIXhUw&dq=%22all%20the%20goodness%20gone%20from%20tea%22&pg=PA93#v=onepage&q&f=false <comment><USER2> Sounds like the beginning of a good story. I really want to know what happens with this guy.

Would be nice if Google didn't limit the visibility of a book published in the 17th century.

<comment><USER3> I was able to see it by scrolling up and down some.

[https://imgur.com/gallery/cMoV7](https://imgur.com/gallery/cMoV7)

<comment><USER4> "Life, after all, is a dream of little more than fifty years, and, whatever one does for a living, it is not difficult to stay so brief a course."

sublime

<comment><USER5> Would you mind describing what the last few words mean?

<comment><USER6> "Dude, can you just not be evil for like 50 years?"

</comment></comment></comment></comment></comment><comment><USER7> Reminds me of a quote from Citizen Kane.

"It's no trick to make a lot of money if all you want... is to make a lot of money"

</comment><comment><USER8> I like how this book reads. A quick google search yields no copies for sale; does anyone know where I might purchase a copy?

<comment><USER9> I suggest using the excellent BookFinder.com, not Google or Amazon, to search for books.

[https://www.bookfinder.com/search/?author=&title=Nippon+Eita...](https://www.bookfinder.com/search/?author=&title=Nippon+Eitai- gura&lang=en&isbn=&submitBtn=Search&new_used=*&destination=us&currency=USD&mode=basic&st=sr&ac=qr)

Shows a handful of copies from $50-100.

<comment><USER8> Awesome. Thanks so much.

</comment></comment></comment><comment><USER3> > But if we live by subhuman means we might as well never have had the good > fortune to be born human.

<comment><USER10> This is related to the Buddhist notion of the "opportunity of human form". (In the Fukazazengi, Dōgen renders this as 人身の機要, read "ninshin no kiyō".)

To be born a god is too easy -- it's hard to turn to the dharma when life is so good. To be born a demon or an animal is too difficult -- it's hard to practice the way when life is so tough. As a human, we recognize fairly early that life does not always go our way; but we are not without some control and capacity for disciplined practice. It's this combination that allows us to (a) want to practice and (b) be able to practice.

</comment></comment><comment><USER11> Gaku Gold Ichi-bu ban-kin ND (1599), JNDA 09-30, Struck in the Keicho era, year 4 (1599),

[https://coins.ha.com/itm/japan/japan-gaku-gold-ichi-bu- ban-k...](https://coins.ha.com/itm/japan/japan-gaku-gold-ichi-bu-ban-kin- nd-1599-/a/3015-24197.s#auction-description)

</comment><comment><USER12> You might be able to find it at a library:

[http://www.worldcat.org/title/japanese-family-storehouse- or-...](http://www.worldcat.org/title/japanese-family-storehouse-or-the- millionaires-gospel-modernised-nippon-eitai-gura-or-daifuku-shin-choja- kyo-1688/oclc/27169755)

</comment><comment><USER13> Looks like the original title is 茶の十徳も一度に皆, and it can be read (in modernized Japanese) here:

[http://saikakuihara.blogspot.jp/2016/10/blog- post_57.html](http://saikakuihara.blogspot.jp/2016/10/blog-post_57.html)

</comment><comment><USER14> If he made his money by honest means, he still wouldn't have been able to take it to the afterlife.

I make a honest living, but, having no wife or children, I know that all the money I save will ultimately be enjoyed by people who hate and despise me.

</comment><comment><USER15> For people who like this book, I would recommend the books by the haiku poets Issa and Basho (the books include Haiku here). And the Genji.

</comment><comment><USER16> TLDR moral - "[I]f we live by subhuman means we might as well never have had the good fortune to be born human."</comment>


GM Transforms Who Wins, Who Loses in the Future of Work - <AUTHOR> https://www.bloomberg.com/news/features/2019-10-18/gm-s-electric-and-autonomous-vehicles-are-leaving-workers-behind <comment><USER2> Electric vehicles are our future, if we want to curb climate change.

Unions are against this because the skills required to work on these new vehicles requires a higher education, which many members don't possess, and will put them out of a job.

This is just another example of the unions holding back much needed progress all in the name of money. It's sad some people won't have a job with the transition to electric vehicles, but the same thing happened with the horse and buggy.

Maybe they should spend some of the union dues on education/training for their members, instead of striking.</comment>


How to deal with Information Overload - <AUTHOR> http://infovegan.com/2010/06/30/dealing-with-information-overload/

<comment><USER2> This is good advice: "Practice attention fitness," especially if the kinds of brain changes that Nicholas Carr discusses in "The Shallows" are real—which they might not be: [http://jseliger.com/2010/06/28/the-shallows-what-the- interne...](http://jseliger.com/2010/06/28/the-shallows-what-the-internet-is- doing-to-our-brains-nicholar-carr/) .

</comment><comment><USER3> There are Chrome extensions to limit your tab usage:

[https://chrome.google.com/extensions/detail/kokmfemecmlekdnj...](https://chrome.google.com/extensions/detail/kokmfemecmlekdnjllgobeplngdfifie?hl=en)

[https://chrome.google.com/extensions/detail/nddlgphciklkobcj...](https://chrome.google.com/extensions/detail/nddlgphciklkobcjbfdabhehldgbkicm?hl=en)

<comment><AUTHOR> awesome. Thanks so much.

</comment></comment><comment><USER4> tl;dr

<comment><USER5> Seeing as how the article really wasn't that long, I think maybe ethan was pointing out that the best way to avoid information overload is to not read every post about information overload. Of course I could be giving him way more credit...</comment></comment>


Backbone.React.Component - <AUTHOR> https://github.com/magalhas/backbone-react-component

<comment><USER2> Awesome. I think pairing Backbone and React is a nice lightweight stack for building a rich client-side. I'll have to read through the code a bit more but at first glance this seems like a nice way to use them together. Previously I would create the React Components separately and then render them in a Backbone.View's render method.</comment>


Ask HN: Our MVP for an ecommerce site (kembrel.com) - <AUTHOR>

When we first started working on www.kembrel.com, we wanted to put out our MVP as fast as possible to get feedback from real users, iterate quickly and all that good stuff.
Our idea is to apply the successful flash sales model to a large market, US college students and to build a very focused community around it. Like other business applying this model (Gilt, RueLaLa, JackThreads, OneKingsLane, etc), you have to be a member to get access to the sales. Once you are a member, you get regular emails announcing new deals. Consumer brands give us VERY discounted merchandise to get rid of overstock (not defectives, just excess inventory) and to gain exposure/loyalty in a new market.
The challenge in building that MVP is that a flash sales site requires a minimum set of features by definition (e.g., limited access, access to inventory, a minimum member base). The Magento private sales module is only available in the Enterprise Edition ($13k). We couldn't find any SaaS options that satisfied the minimum requirements.
Now we wanted to build a real MVP, not do a dry test (http://yongfook.com/mvp-vs-dry-test). This means that we needed to actually build something that works, not just a landing page with an email collection form. To do this, we needed to work on 3 fronts at the same time:
IT: we built the site using the Magento community edition, bought a couple of cheap plugins and customized the rest inhouse. As you see, we are weak on the design side (working on that now with a pro) and we have a long way to go to make it a . But that's the point of a MVP.
Products to sell: we signed up over 50 brands and are in discussions with many more. This part requires getting on the phone and making calls all day long. There is no easy way around it. We called several hundreds brands to get to the 50 we have. It's hard work but it's worth it. We learned so much about the industry by doing this work (we are not industry insiders).
Customers: we invited all our friends, asked them to invite their friends and experimented with Facebook ads. We have content on the front page that is bringing us decent traffic.
The products and customers portions are a classic chicken-and-egg/marketplace problem. It is difficult to attract lots of customers to your site if you have nothing to sell. At the same time, how do you convince brands to give you significant discounts on the wholesale pricing if you don't have the user base to justify it? It's been a difficult process for us but we are starting to see the results now.
I would love to get feedback from you on our MVP.
If you are a student and are interested in getting deals (up to 80%) on apparel, ipod accessories, etc, please consider joining and telling your friends about us :) <comment><AUTHOR> link: <http://kembrel.com></comment>