Debian Buster will only be 54% reproducible, while we could be at 90% - <AUTHOR> https://lists.debian.org/debian-devel/2019/03/msg00017.html <comment><USER2> I find it fascinating that, from a security standpoint, it's best for the static representation of a program (the executable and the package) to be perfectly predictable, while the dynamic representation of a program (once it's loaded into memory and running) should be as unpredictable as possible while maintaining correctness (using ASLR and other methods to slow down attacks on vulnerable code). I guess running a program is like setting off an explosive: you need to know exactly what you're handling before you release its power.

Anyway, many kudos for this work!

<comment><USER3> What do you mean by "as unpredictable as possible"?

From the perspective of an application developer I want that dynamic representation to also be predictable.

<comment><USER4> You are probably talking about different kinds of representations.

hathawsh meant representation in the sense of memory layout and other low- level details of how application state is encoded. You seem to be talking about the programmer-visible abstractions built out of that layer. Behaviour at that level has to be predictable in order to "maintain correctness", but predictability at the lower level is mostly a help maintaining for the correctness of malware.

<comment><USER3> Interesting. Out of curiosity, is there any correlation between programming paradigms and the predictability of of low-level details? I would imagine that a "boring" C program with one big chunk of mutable state would be predictable in this sense. What about programs developed in functional languages with immutable data structures?

<comment><USER5> > I would imagine that a "boring" C program with one big chunk of mutable > state would be predictable in this sense.

It likely wouldn't. ASLR will choose a random load address for the module (.so or .exe), which means that main() wouldn't be at a predetermined address. The heap and stack would similarly have arbitrary offsets. Furthermore, any other modules that get loaded would be at arbitrary addresses. Ultimately, even "hello world" should become extremely randomized, provided ASLR is enabled for the process.

ASLR prevents attacks arusing due to known addresses in virtual memory because they are otherwise reliably predictable (just run the program, attach a debugger, and find the addresses that you care about).

</comment></comment></comment></comment></comment><comment><USER6> Wow, I'm impressed by the consistent progress.

There is so many things based on Debian and adding reproducibility in Debian is a massive security improvement.

I have a lot of respect for people working on this, it must be hard to respect release freezes when you've been working on this for years.

</comment><comment><AUTHOR> Slightly fluid numbers aside, half the packages for Buster still sounds like good progress to me.

<comment><USER7> It's certainly the right direction! I applaud them for pushing this.

From the article, it looks like many of the others are reproducible on a code level, but the release system is using older binaries, which haven't been rebuilt yet.

It's too bad it won't be fixed in time for this release, but bodes very well for future releases.

</comment></comment><comment><USER8> What's the importance of reproducible builds?

Edit: found this nice overview by clicking a few links from the original post [https://reproducible-builds.org/](https://reproducible-builds.org/)

<comment><USER9> one thing that I think got lost culturally in the move to linux was the emphasis on open source. yes, not open source in some abstract warm fuzzy way, but actual useful open source.

if I cant run the build process, and I dont really know which patch sets have been applied on my system, and which version of the source was used, and I dont really have a handle on the dependencies. doesn't make it substantially more difficult to debug and work with the resulting system?

its really quite odd that the dominant open source platform settled on opaque and unreproducible binaries as the distribution mechanism early on.

<comment><USER10> Assuming you're referring to Debian, you've missed the mark. Debian is more committed to open source, in the RMS 'free software' sense, than any other distro I'm aware of... it's the foundation of the distro. Any Debian user can absolutely rebuild from source any[1] part of the system.

The problem that reproducible builds is attempting to solve is that my build, while being 100% functional, might not be bit identical to yours or what shipped with the distro for any number of _valid_ reasons.[2] The problem this creates given the current world of increasingly sophisticated malware is that I can't _prove_ a given build is identical to what was intended based on the binaries. So it's an issue of 'we've always been giving you the source, now we're going to ensure that it's possible to create bit-identical binaries' rather than 'we were giving you free binaries, now we're giving you the source'.

If your argument is that one should always build from source, reproducible builds is part of getting to the same effective result without the overhead and headache that the vast majority of users are not willing to deal with.

[1] In the cases when this turned out not to be possible, holy hell tends to get raised... see things like the Chromium BLOB issues ([https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=786909](https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=786909)) etc. These issues tend to have a lot of noise made and get resolved very quickly since it goes against the very core of what Debian is intended to be. In cases where you have things that are binary-only such as proprietary GPU drivers, these get segregated into a separate repo with the general advice from Debian of 'you shouldn't use these'. This doesn't tend to be realistic advice for many users given the state of many of the open source drivers... but they've tried their best to steer people away while not making the distro unusable for those who insist on using them.

[2] A trivial example would be baking the build date/machine name into the binary... there's no expectation that one would ever reproduce that build again even on the same machine.

<comment><USER11> I think the gripe is that it's never been as easy as it could be to say "OK, I'm going to make a change in this here source file, then run the result on my machine while keeping everything else the same".

For example if I'm reporting a bug and I have a proposed patch, it would be nice to be able to say "I've been running with this patch for the last month and it's been fine".

Ideally there'd be a coherent way to download the source for a particular package, rebuild it, and have the system use the rebuilt result. Bonus marks if it did something useful when a newer version of the package came along.

I think [https://packages.debian.org/sid/dgit](https://packages.debian.org/sid/dgit) is an attempt to make the download-and-rebuild part look more uniform, but I think there's still work to be done to make it easy to substitute the result for the distro package.

<comment><USER12> What's missing from: "apt-get source the-package", add patches, "pbuilder build the-package.dsc" ? (I'm assuming that pbuilder was already configured to work)

<comment><USER13> FWIW As someone that touches debian package building once in a blue moon, it seems like there's wide variability into which is the "right way" to do the actual build step and that everyone has their own artisanal preference. pbuilder, debuild, debootstrap, dpkg-buildpackage, sbuild, fakeroot all leave me scratching my head.

<comment><USER12> If we're taking about the reproducible packages, then I believe only pbuilder is a valid answer here. (maybe sbuild, I haven't used that one) debootstrap / fakeroot / dpkg are part of the pbuilder system, not full solutions.

But yeah, I noticed that Debian is not going out of its way to advertise one blessed solution.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> BTW I was just looking at diffoscope - developed as part of the "reproducible builds" Debian project.

[https://try.diffoscope.org/](https://try.diffoscope.org/)

</comment><comment><USER15> We need a body/service that verifies that the code-binary combo being distributed by a developer is actually reproducible. Because, most users don't have the time or resources to verify each package they use. But its useful to society if distributed packages are reproducible. So a trusted third party should provide this service.

I would envisage it working in the following way. The developer submits links to their code and links to their package. The service builds from code and checks if the final package matches what is being distributed by the developer. If yes, it then publishes the hashes of the code and package, so users can quickly check that they are using a reproducibly built package from the correct source.

<comment><USER16> This is being actively worked on and already has had quite a bit of work. This project is also submitted to Google summer of code under the Debian project.

[https://ssl.engineering.nyu.edu/blog/2019-01-18-in-toto- pari...](https://ssl.engineering.nyu.edu/blog/2019-01-18-in-toto-paris)

[https://salsa.debian.org/reproducible-builds/debian- rebuilde...](https://salsa.debian.org/reproducible-builds/debian-rebuilder- setup)

[https://github.com/in-toto/apt-transport-in-toto](https://github.com/in- toto/apt-transport-in-toto)

[https://reproducible-builds.org/docs/sharing- certifications/](https://reproducible-builds.org/docs/sharing-certifications/)

</comment></comment><comment><USER17> For those of us unfamiliar with the term "reproducible", yet in the business of software - what does it mean and why is it desirable or needed?

<comment><USER18> Just wanted to add that besides the security gains there's a real performance gain. If you've got a slow-to-build codebase where you've made a small modification you can use a remote artifact cache so that all the parts that don't change just get downloaded from when someone built it. Then you have faster incremental compilation.

You can do this with Bazel and Buck and with a few assumptions and some configuration even with Gradle.

<comment><USER19> I think that's _slightly_ different: if a build is reproducible, it means that the build products I get from my own machine are identical to those on a remote machine or cache (e.g. they have the same SHA hash).

However, that doesn't speed anything up, since I don't know what the hash is unless I actually do the build or download the file (and then hash the result). If a cache used such hashes as IDs, I would only know which file to fetch once I've already got it!

For such a cache to work there needs to be another mechanism for obtaining the IDs. As an example, Nix caches using the hash of _build inputs_ (scripts, tarball URLs + hashes, etc.), not the build outputs. Since the build inputs are known before we do the build, we can combine these into a hash and query the cache.

Since the whole point of using a cache is to avoid building things ourselves, we also need a separate mechanism to trust/verify what the cache has sent us (we could build it ourselves and compare, but then we might as well throw away the cache entirely!). Nix allows certain GPG keys to be trusted, and checks whether cached builds are signed.

Since caching mechanisms don't make use of reproducibility, and verification mechanisms don't make use of reproducibility, such caches turn out not to require byte-for-byte reproducibility. All that's required is that plugging in the cached files gives a working result: in some cases that might be practically the same as byte-for-byte reproducibility (e.g. a C library compiled against certain ABIs at certain paths, etc.); others, like scripting languages, might work despite all sorts of shenanigans (e.g. a Python file might get converted into a different encoding; might get byte-compiled; might get optimised; might even get zipped!)

<comment><USER20> I think you missed something in the parent comment. Bazel can skip compiling an output file if the hashes for its source code files + BUILD files have an artifact in the remote (or local) cache. This requires reproducible builds or else you could introduce build errors when your build environment changes.

<comment><USER19> > Bazel can skip compiling an output file if the hashes for its source code > files + BUILD files have an artifact in the remote (or local) cache.

This is what I mentioned in a sibling comment: we need some way to identify binaries that doesn't rely on _their_ hash. Using the hash of their source code files and build instructions is one way to identify things (Nix also does this, as well as those of any dependencies (recursively)). A different approach is to assign each binary an arbitrary name and version, which is what Debian packages do; although this is less automatic and is more prone to conflicting IDs.

> This requires reproducible builds or else you could introduce build errors > when your build environment changes.

No, this only requires that builds are _robust_. For example, scripting languages are pretty robust, since their "build" mostly just copies text files around, and they look up most dependencies at run time rather than linking them (or a hard-coded path) into a binary. Languages like C are more fragile, but projects like autotools have been attempting to make their builds robust across different environments for decades. In this sense, reproducibility is just another approach to robustness.

Don't get me wrong, I'm a big fan of reproducibility; but caching build artefacts is somewhat tangential (although not completely orthogonal).

</comment></comment></comment></comment></comment><comment><USER21> This seems to be the issue [https://issues.apache.org/jira/browse/MNG-6276](https://issues.apache.org/jira/browse/MNG-6276) for reproducible builds with Maven. I'm not sure what the current status is given that all the issue links are closed.

Go in and vote for it anyway. I'm sure some of the Debian packages are written in Java. ;-)

</comment><comment><USER22> I definitely understand the merit of making it super easy to verify, by simply hashing the build ISO. But that also shifts the burden of forcing deterministic results to the build process. I wonder if for a little more complexity in verification, if a lot less complexity would be needed on the build side?

For example the ISO file system, typically ISO 9660 or UDF, will have a volume UUID from a random number. Sure you can code a flag for mkfs to specify a fixed number, that's easy. But then next that ISO typically contains a payload in the form of a squashfs file. And quite a bit of work on squashfs has happened to make sure file timestamps can be set to a known value. However, if one build process uses xz level 3 compression, and another build process uses xz level 7 compression - hashing will of course fail. The point is, be it inode UUIDs and timestamps and compression levels, there's a lot being measured that we don't really care about, just to have a simple verification method at the back end.

</comment><comment><USER23> Can anyone recommend a good way to install/maintain/remove new software on distros like Debian or Ubuntu LTS? (By 'new' I mean versions newer than the ones available through apt).

I never figured out a maintainable scheme. Some of my packages are in /opt, some are in ~, some in ~/local, and some under GNU stow. And other than GNU stow's half-assed uninstall method, it's always a pain in the neck when I have to remove or upgrade any of these packages.

<comment><USER24> One thing that works many times is to download the deb source package from a newer distro and rebuild it in the desired system.

If there's no newer package available you can try to reuse the debian directory from the older source package to build from the newer source.

Sometimes this works in the first attempt, but if you need this for a lot of packages, it'll be a lot of work.

</comment></comment><comment><USER25> Helps having Google as a client wanting reproducible builds.

</comment><comment><USER26> Eli5?

</comment><comment><USER27> One has to step back and ask: "What made you decide to introduce non- determinism into your compilation process in the first place?"

<comment><USER28> Nobody sat down and said "yes, I'll make this nondeterministic". If you look at the wiki page's sampling of different issues -- [https://wiki.debian.org/ReproducibleBuilds/Howto#Identified_...](https://wiki.debian.org/ReproducibleBuilds/Howto#Identified_problems.2C_and_possible_solutions) \-- you'll see it's a mix of various things:

* output is deterministic but dependent on some aspect of the build environment (locale, hostname, etc)

* output is accidentally non-deterministic (eg "we put all the .html files into a tarball with a shell glob pattern, which gets you an order dependent on your filesystem implementation and the phase of the moon")

* a wide array of "output contains a timestamp" issues

"Let's put the timestamp into our version string/a generated file so the user knows when it was built" is a really common thing, and it seemed like purely a nice convenience feature until the concept of 100% binary-reproducible builds became a current concern.

<comment><USER29> Curious: What's the usual fix for this class of problem? Is it possible to flag certain bits of data as known-to-change and evaluate the rest of the build in isolation?

Example: Say you have a version string that outputs a build time. Can you hash the program with just that bit of string data marked as unknown (or that string table entry replaced with a placeholder, as far as our verifier is concerned) and verify the rest of the program is unchanged across builds?

<comment><USER30> Typically you just stop including the build time. It's a deterministic build, so why would the build time matter?

<comment><USER31> I was going to say "because it's convenient", but I realized that you're right: if it's identical anyway, the release date is as good a timestamp of the code as you're going to get. If for some sysadmin reason the build time is relevant, file metadata can tell you.

</comment></comment></comment></comment></comment><comment><USER32> What software currently has 100% reproducible builds?

<comment> rvp-x NetBSD is 100% reproducible. [https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_...](https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_builds) [https://tests.reproducible- builds.org/netbsd/netbsd.html](https://tests.reproducible- builds.org/netbsd/netbsd.html)

<comment><USER33> To be fair:

> 56 (100.0%) out of 56 built NetBSD files were reproducible

That is not really comparable to debian's 26475/28522 for buster [https://tests.reproducible- builds.org/debian/reproducible.ht...](https://tests.reproducible- builds.org/debian/reproducible.html)

</comment></comment></comment><comment><USER34> My experience at Dave & Buster's is around 80% reproducible, so I think progress is possible.

<comment><USER35> FYI, Debian codenames are all based off Toy Story characters. See [https://unix.stackexchange.com/questions/222394/linux- debian...](https://unix.stackexchange.com/questions/222394/linux-debian- codenames)

</comment></comment><comment><USER36> Might be good progress but it still sounds very low to me as I didn't know anything below 100% was possible... it sounds crazy to me (almost like something that was introduced to be able to inject backdoors undetected).

<comment><USER37> Every significant project I've worked on embedded the build host and build time in the resulting executable or firmware image. This was along with other static build information, like version number, compiler version and build flags.

Once you make the sensible choice to include build time in the result you've broken reproducibility. Fixing this means tracking down every package that does this and removing the timestamp.

<comment><USER38> Why is including build time sensible?

If one has reproducible builds, wouldn't a commit/tag from the version control system also do the job of traceability and reproducibility ?

<comment><USER39> What I've moved to is splating that info into the binaries during the release process. Far as I can tell there aren't standard tools to do that though. At least last time I looked.

Would be nice if there was. I think this is the root of issues such as firmware with the same password/cryto keys across a whole product family instead of unique ones.</comment></comment></comment></comment>


LibreOffice is one - <AUTHOR> http://blogs.computerworlduk.com/simon-says/2011/10/libreoffice-is-one/index.htm <comment><USER2> I think my one issue with LibreOffice is, honestly, the name. I speak Spanish, so I get the meaning behind Libre meaning free (as in unencumbered, or available, not referring to price).

But for some reason the name still bugs me. OpenOffice was such a nice, clean name. LibreOffice just doesn't roll off the tongue in the same way.

<comment><USER3> > OpenOffice was such a nice, clean name.

Actually technically it was called OpenOffice.org, which is pretty silly.

<comment><USER2> True, but it was easy enough talking to non-techies to just drop the .org and no one was the wiser. I also agree the .org was a bit odd to include in the official name.

</comment></comment></comment><comment><USER4> I am an LibreOffice user since the StarDivision days - at those times on OS/2, before Internet became available for public in Germany. I am happy that this product survived all this and I am especially happy that LibreOffice gained success after one year and so is less under control of companies. Congrats to all the contributors!

By looking at the chart showing which companies contribute how much I am surprised that Canonical has such as small slice in contribution? How comes? It is the distribution that is focused on end users and pushes the desktop, innovates on the UI. Is Canonical putting higher priority on the app store? What do you think?

Another feature that I think is important for LibreOffice and to the OpenSource scene in general is to get some synchronization (and maybe collaboration) functionality, without a vendor lock-in. Mozilla is managed to do this - though the amount of data is surely not comparable. I understand that it costs money to keep all the servers running and adding hard disks, but I think people would be ready to pay a fee - if it is guaranteed to be free of advertisement, the code to stay open source and the data private.

</comment><comment><USER5> I always wanted to support OpenOffice and then LibreOffice, but it has never been as good as Word. Sadly, the corporate world uses MS Office and that forces me to use Office. The compatibility for complex files are lacking. Formatting would regularly be screwed up in one or the other. I tried LibreOffice again a couple months ago and it crashed 4 times while trying to create one document. I have given up and lost hope in LibreOffice.

<comment><USER6> Yep. In particular, "track changes". As soon as you have to collaborate on a document with a lawyer or a counterparty, track changes becomes a must-have.

I'm not quite as pessimistic. These are solvable problems. It's just taking a really long time.

<comment><USER7> Yes, it's a must-have, that's why it's been part of LibreOffice for quite a while: go to menu Edit > Changes > Record, or to review all the changes to the document use the "Accept or Reject" function. It's all there, isn't it? What is it with LibreOffice's change tracker that you don't like?

<comment><USER8> I think the issue is that it doesn't play well with Word's change tracker. But I could be wrong; my change tracker is diff(1).

<comment><USER6> Yes, exactly what ams6110 said. The change tracking just isn't compatible enough.

If you have a completely plain vanilla document -- no formatting, no line breaks, no headers, no footers, no tables, nothing -- then OpenOffice/LibreOffice's tracking is good enough. But documents are rarely that simple. And, unfortunately, your lawyer or VC or potential acquirer really isn't interested in discussions about document formats. They have better things to do, and they expect you to be able to communicate with them.

</comment></comment></comment></comment></comment><comment><USER9> I was sent a 50MB spreadsheet. OpenOffice couldn't open it, Google docs refused to even try, but LibreOffice did. Happy user.

<comment><USER10> Seconded - LibreOffice frequently opens large sheets that Numbers struggles with.

</comment></comment><comment><USER11> And Impress still sucks. :(

Trying to re-adapt after using Keynote for a year. It's rough. Even the simple things, like having to click half a dozen times to find the "edge" of a text box, because clicking in the middle either does nothing (if there is no text there) or clicks "through" to edit the text inside.

</comment><comment><USER12> This is a fine, fine product and community.</comment>


XPS Presentation Builder – Created with JavaFX - <AUTHOR> https://www.youtube.com/watch?v=UqhF6KvFx30&feature=youtu.be <comment><USER2> how do you know it? There's no quote</comment>


Ask HN: Best practices with elance? - <AUTHOR>

Can anyone share an anecdote or refer me to an online resource where I can learn about best practices when it comes to using elance to design and develop my website idea?
I am not a programmer, so I am just looking for a few tips.
Thanks in advance. <comment><USER2> I've used elance for 6-8 projects in the past. It helped me - I can't say I'd use it again today but, at the time (2004-2006) it was a good choice. Today I'd likely opt for local talent via referrals or craigslist. I'm not sure if it's because my budgets and needs are different today or whether it's because of my experiences on elance TBH.

Overall my experience was mixed - terrible all the way to excellent. I think there is a learning curve and I would suggest starting with as small of a project as you can first so that you can see how it works. I made many mistakes but by far my worst mistakes were made when I created a single post for multi-step tasks. Had I broken each of those into smaller components, I would've been able to control the quality (and budget) better.

<comment><AUTHOR> That's very good advice. Thanks.</comment></comment>


iOS Hat – Turn Photoshop Layers to Objective-C - <AUTHOR> http://ioshat.madebysource.com <comment><USER2> This is certainly very impressive, but I don't think I'd ever actually use it. Two things that I didn't really like:

1\. Tons of generated code in -drawRect:

2\. When the UIButton was created with the background image, it looked to me like the image was actually the size of the button. It's much more efficient and flexible to make a small stretchable button background.

That said, very cool! I wish there were a trial version I could at least try out.

</comment><comment><USER3> A good idea if you want to integrate your platform into an existing business workflow that uses PS, such as with a publisher. My team considered this on an enterprise mobile platform. We actually had parsers for InDesign and PS files that sliced the image assets and an XML-based UI language to translate what we could. This would be much much simpler and more straight forward.

Do you have plans to support other mobile platforms?

</comment><comment><USER4> This looks like a great replacement for PaintCode, as I was always just wanting to take stuff from Photoshop and put it in there anyway.

<comment><USER5> PaintCode 2 supports direct import of PSDs and adds a ton of additional features as well, like the ability to use variables and expressions to drive attributes of shapes.

</comment></comment><comment><USER6> Pretty cool.

I decided to port your constraints helper to the web today.

[http://constraints.icodeforlove.com/](http://constraints.icodeforlove.com/)

</comment><comment><USER7> Why not use interface builder?

<comment><USER4> Because Interface Builder does none of this, especially converting shapes / vectors into drawing code.

This only adds to the tools, not replaces.

</comment></comment><comment><USER8> So, is this what Sketch 3 is doing but inside Photoshop?

<comment><USER9> I don't think you can generate objective-c code from Sketch 3. Maybe you were thinking of Paint Code [http://www.paintcodeapp.com](http://www.paintcodeapp.com) ?</comment></comment>


NextSprocket: Marketplace for Open Source Development Bounties - <AUTHOR> http://nextsprocket.com/

<comment><USER2> Do people who add to a bounty after the fact get any say in the acceptance of it?

Do you manually accept all bounty completions on a site management level? I started a site like this but ran into all of these trust or moderator required processes. I'd be interested to know how you plan to combat them.

Other than that though I like the design/layout of the site and the flow seems pretty nice.

<comment><USER3> The task creator is the judge of accepting/rejecting the solution.

If the requirements listed isn't suitable, the other task rewarders can simply make a comment saying "i'll contribute $200 for this task if you add this requirement." Then the task creator can add it to the list of requirements.

</comment></comment><comment><USER4> This could be promising. Does anyone know if it might catch on? It love to submit bounties on persistent OSS bugs that irk me every day.

<comment><USER5> We won't know if it'll catch on or not until you (and others who are wondering the same thing) offer the bounties and see what happens.

</comment></comment><comment><USER6> This looks awesome. To me it seems as if they have perfect tasks already.

I think this is going to skyrocket.

</comment><comment><USER7> I remember a similar website from a few years ago, but I can't remember the name.

</comment><comment><USER3> thanks for the comments, we just got an email for a ycombinator interview :)</comment>


PayPal Demands That Seafile Monitors Customer Traffic - <AUTHOR> https://seafile.de/en/important-infos-about-app-seafile-de-and-licensing-purchases-through-our-web-shops/ <comment><AUTHOR> "From tomorrow, Sunday June 19th 2016 we are no longer allowed to accept payments via PayPal. PayPal has demanded that we monitor data traffic as well as all our customers' files for illegal content. They have also asked us to provide them with detailed statistics about the files types of our customers sync and share on [https://app.seafile.de](https://app.seafile.de)

Since complying with this demand would violate German / European data protection laws (and also be morally wrong in our opinion) we have declined to comply with this demand."

Interesting that they believe EU laws mean they couldn't legally comply with this demand even if they wanted to - is that right?</comment>


Ask HN: SaaS startup releasing an open-source version? - <AUTHOR> I would love to hear your thoughts about running a commercial SaaS enterprise with an open-source offering. For example, Instructure Inc. created the open-source Canvas LMS, but they charge for the enterprise hosted version. Are you aware of any big-name startups that did something similar?<p>I'm seriously considering releasing a free version of my software (for marketing purposes) as an open source product, in order to generate buzz and interest (apart from the goodwill), and then create an enterprise closed-source version of it with fully hosted/managed features that I can charge for. My first question is, what licence would I release the open source version under, in order to protect my commercial enterprise, while still making it useful to others? <comment><USER2> I can't recall any off the top of my head, but I've definitely heard of multiple SaaS companies doing this. Most customers are lazy and will just go with the hosted version. They don't have to host it themselves and it's less work to maintain/support, which is usually what you're paying for.

I think this marketing channel depends on who your customers are. If they're developers, then releasing something to developers would be valuable. If they're sales people, then probably less so.

Another thing I've heard of is releasing a less related project for free / open source. This way you build a good brand with your target customer segment. Then they're more likely to find out about your core product, and they already like you for your free tool. Front did this.</comment>


Mine3D: A Web 3D Minesweeper Game - <AUTHOR> http://egraether.com/mine3d/ <comment><USER2> I would love this even more if a lined or dotted grid remained in the dead space to differentiate the area of each clue.

In fact, a highlight of the 27 cells within the area of a clue on hover would be great as well.

Otherwise, fantastic work.

GitHub Issues ([https://github.com/egraether/mine3D/issues](https://github.com/egraether/mine3D/issues))

Feature Requests ([https://mine3d.uservoice.com/forums/136434-general](https://mine3d.uservoice.com/forums/136434-general))

<comment><USER3> Thanks for sharing the links to his github, that's very thoughtful.

Now I feel selfish for having the same thoughts as you about the grid and just quitting the game instead of telling OP.

</comment></comment><comment><USER4> Shameless plug time!

Someone says "minesweeper", I post my implementation. It's an established ritual.

Here go: [http://www.ronilan.com/bugsweeper/](http://www.ronilan.com/bugsweeper/)

Few notes:

1\. This is dated January 2014. It is a job interview homework.

2\. The HN community has detected a bug and indicated that it should be fixed. That was done March 2017.

3\. There are currently no known bugs.

4\. The goal of the game is to find the unknowns.

5\. No puns intended.

6\. Code: [http://www.ronilan.com/bugsweeper/js/bugsweeper.js](http://www.ronilan.com/bugsweeper/js/bugsweeper.js)

<comment><USER5> The best minesweeper implementation is Simon Tatham's, because it guarantees a board that can be solved without guessing.

[http://www.chiark.greenend.org.uk/~sgtatham/puzzles/js/mines...](http://www.chiark.greenend.org.uk/~sgtatham/puzzles/js/mines.html)

That guarantee allows for playing with high mine counts, which would ordinarily be impossible way too often. The high mine count boards sometimes contain interesting deductions.

<comment><USER6> How does he guarentee it?

<comment><USER7> The source code (mines.c) is here:

[https://git.tartarus.org/?p=simon/puzzles.git;a=blob;f=mines...](https://git.tartarus.org/?p=simon/puzzles.git;a=blob;f=mines.c;h=da4428c7eb400620cf3ea114e598935b4a82d4ab;hb=HEAD)

There is code for solving a grid using deductions in this section:

[https://git.tartarus.org/?p=simon/puzzles.git;a=blob;f=mines...](https://git.tartarus.org/?p=simon/puzzles.git;a=blob;f=mines.c;h=da4428c7eb400620cf3ea114e598935b4a82d4ab;hb=HEAD#l278)

And below that is the code that generates grids and checks that they are solvable without taking risks.

A similar approach is used to analyse the difficulty of Sudoku games here:

[http://hodoku.sourceforge.net/en/index.php](http://hodoku.sourceforge.net/en/index.php)

with different names for the different types of deduction.

<comment><USER6> Thank you so much! This helps so much.

</comment></comment></comment></comment></comment><comment><USER8> This is awesome! I was a pretty serious (classic) minesweeper player and was even ranked pretty highly internationally. Curious: did other people have their intuition translate "incorrectly" at first? I kept on blowing up cells because I hadn't yet fully internalized the changes that occur in 3D (I know the rules are the same, but the "pattern recognition rules" are not quite the same.) It was really interesting having to step back and rework out the implications of things in 3D. In some vague sense I feel like this is a bit like how some mathematical theorems hold in certain number of dimensions but not others (e.g. random walks). Cool game!

<comment><USER9> I consider myself like an advanced-intermediate player, though my clicking dexterity is not what it once was. Care to share some of your record times? :)

<comment><USER8> It's been a while, but I think my best time on expert was 63s.

</comment></comment></comment><comment><USER10> For interesting variants of minesweeper, I like one one the hyperbolic plane ("minefield", one zones in HyperRogue: [http://www.roguetemple.com/z/hyper/gallery.php](http://www.roguetemple.com/z/hyper/gallery.php)).

</comment><comment><USER11> This is a cool concept. The one problem that I had, is that it is difficult to tell which cubes the numbers are paired with. I think that it would be more intuitive if the numbers were printed/etched into each face of the cubes (like dice, but with normal numbers).

</comment><comment><USER12> Unplayable without the standard left+right-button combination:

[http://www.minesweeper.info/archive/MinesweeperStrategy/mine...](http://www.minesweeper.info/archive/MinesweeperStrategy/mine_general.html)

<comment><USER13> The ability to mark cubes as "maybe mines" (I think double-right-click in the original) would also be excellent.

</comment></comment><comment><USER14> Haha Awesome!

Reminds me of a 3D 2048 game I made some years back.

[https://kshitij-banerjee.github.io/Cubiks-2048/](https://kshitij- banerjee.github.io/Cubiks-2048/)

Check the dismember view I provided (space bar). That open up the cube to give a better spatial understanding of the board.

That is the problem with 3D games, I realized. Trying to visualize is a pain to most people and deviates them from the game. This was my attempt at solving that.

I think in your case, hovering over a cell and highlighting its adjacent numbers might help create better visual understanding of the state.

<comment><USER15> >Trying to visualize is a pain to most people and deviates them from the game.

But it's a built-in skill of everyone over the age of a few months old!

Isn't the real problem the inability of 3D interfaces to, ahem, interface, with an innate skill 100% of sighted users have? In other words I think the interfaces are wrong, not the users.

<comment><USER16> I don't think that's the problem. I think the problem is that "3D" versions have us effectively trying to manipulate the internal 3D state of a box - that's something we're terrible at - we usually interact with 3D objects in a sparse state.

<comment><USER15> >we usually interact with 3D objects in a sparse state.

I don't know that I can agree with this. There's nothing hard about spearing a meatball with your fork, and some spaghetti, even if it's dense 3D space... So it's not about visualization, more about UX/interaction or interface...

</comment></comment></comment></comment><comment><USER17> That's cool. I had the same idea (3d minesweeper with semi-transparent blocks) about 10 years ago, but never came around to actually realize it. Great to see how the gameplay is like.

One possible improvement: Add some keyboard mappings for map rotation. E.g. something like WSAD to rotate the cube and QE,RF to strafe vertically and horizontally. I guess it would need some experimentation to figure out what makes sense.

</comment><comment><USER18> This is fun!

Assuming the developer is listening... I think I ran into a bug related to resizing the window after starting the game. Clicking selected other blocks than I desired.

Also, I'd like to +1 the request to have a grid remain at least on the numbered cells. A partial transparency of numbered cells might be neat because you could see depth better from overlap of cells.

<comment> david-given I kept finding it wanted to clip the right hand edge of the puzzle off the right hand side of the browser window. I tend to use square browsers --- am I weird?

And left-dragging to pan wasn't an entirely happy experience; partly because it kept selecting bits of the HTML on the left, and partly because I felt there was something slightly strange about the way rotation worked. Is it traditional arcball or something else?

...but in general I thought it worked really well. I played sweep mode, and liked it a great deal (I did get an unfair puzzle, but guessed correctly and won it. On, um, easy mode).

 _Update_ : has something just changed? I can't delete mines in sweep mode any more --- they just blow up instead.

</comment></comment><comment><USER19> Great job! Really enjoyed playing it. The controls are a bit tough... maybe because i'm using a trackpad on a mac.

</comment><comment><USER20> What is the stack used?I`d love to read a blog about the making of.

<comment><USER21> It's hand written WebGL. You can find it on GitHub: [https://github.com/egraether/mine3D](https://github.com/egraether/mine3D)

</comment></comment><comment><USER22> This is surprisingly addictive. I'm loving the "bonus" links it sends when you complete a puzzle (although I did get one with near transparent blocks that was murder to attempt).

Example: [http://egraether.com/mine3d/?grid=30,16,1,99](http://egraether.com/mine3d/?grid=30,16,1,99)

Currently only at a 20% win rate, which is frustrating.

</comment><comment><USER23> Should it work on mobile? How do I rotate the cube? Awesome idea btw!

</comment><comment><USER24> Wow. Very nice job. Very intuitive. However, you should move the cube into the center of the screen, since that is the center of the players focus.

</comment><comment><USER25> This would probably be better if each cube had only 6 neighbors because the way it is the areas are pretty large and it gets quite difficult.

</comment><comment><USER26> I don't think "Space = new game" was a good keyboard control choice. Accidentally lost my game halfway through :/

</comment><comment><USER27> Note: Should have 2012 in the title

</comment><comment><USER28> My eset security blocked this url.

</comment><comment><USER29> cool but, I wish the entire cube scaled to fit inside the window instead of being clipped.

</comment><comment><USER30> Pretty good game, nice work.

</comment><comment><USER31> One of those things that are possible but still shouldn't be done.

<comment><USER9> As a game I agree that it ultimately doesn't work quite as well as the original minesweeper, but I definitely am glad it was made. It's awesome! Visually the cascading effect of boxes being revealed is done so well and it's fun to see familiar patterns from the 2D version show up here -- I'm sure there are many new patterns in this 3d version that I haven't found yet.

Without giving it any thought really, I wonder what modifications (if any) needed to be made to the flood fill algorithm in this version.

[https://en.wikipedia.org/wiki/Flood_fill](https://en.wikipedia.org/wiki/Flood_fill)

</comment></comment><comment><USER32> I love this!

</comment><comment><USER33> Hm, eset smart security is blocking the site for me..

<comment><USER34> Then don't use eset "smart" security?

<comment><USER33> Corporate policy for all work laptops...

</comment></comment></comment><comment><USER35> I think mine is better

<comment><USER35> [https://github.com/tim-hub/TiminesSweeper-3D-](https://github.com/tim- hub/TiminesSweeper-3D-)

</comment></comment><comment><USER35> I think mine is better

[https://github.com/tim-hub/TiminesSweeper-3D-](https://github.com/tim- hub/TiminesSweeper-3D-)

<comment><USER13> Yours displays in a subwindow that's too small for it and has scrollbars. You can click and drag to rotate the cube, but for some reason it doesn't start rotating until after you release the button, which makes rotation very difficult to judge. I spotted a mine, clicked on a "1" _next to_ the mine, and it exploded. If you're not using standard Minesweeper controls, that needs to be clearer. Also, Kongregate made me watch a 30-second ad first.

<comment><USER35> Sorry for that.

There are many bugs and bad things in the game I did not fix, because I have no time to do. I have to work and find work to make a living.

Maybe the word I say is not clearly, What I mean is I think my game's mechanic/idea is better.

Certainly, [http://egraether.com/mine3d/](http://egraether.com/mine3d/) this is more stable, more beautiful ui, and more light weight.</comment></comment></comment>


Retinal vascular biomarkers for Alzheimer's detection [pdf] - <AUTHOR> http://www.nature.com/tp/journal/v3/n2/pdf/tp2012150a.pdf

<comment><USER2> Interesting: "After FDR adjustment, significant differences in 13 of 19 RVPs were found between the AD and HC groups (Table 2 and Figure 2). Logistical models combining parameters were created for combined AD classification. A logistic model combining these 13 RVP's provided good classification performance (81.2% sensitivity, 75.7% specificity and 87.7% AUC), compared with the logistic model including only age and APOE E4 carrier status (68.0% sensitivity, 61.8% specificity and 63.7% AUC)."

Despite the impressive improvement in sensitivity and AUC, this is a small and presumably preliminary study. Additionally, the training and testing sets appear to be the same.

</comment><comment><USER3> Despite being on nature.com, the journal this is in ("Translational Psychiatry") is not a prestigious one; in fact, it's an online-only journal and you have to pay to get your article published in it. It is suspicious that they couldn't find a better journal to publish such an amazing result in, so the science is probably bad. The statistical significance of p=0.01 is unimpressive.

Honestly, as non-scientists we should just ignore new papers like these. If it's really important, first it'll be published in an excellent journal, then it'll be replicated successfully, then there'll be meta-analyses that confirm how reliable the technique is, and it'll get cited and built upon a bunch of times, and _then_ it'll actually be something that we should consider as anything other than "probably wrong". Which is what it is right now.</comment>


The Price of Life Is Death, but Sex Improves the Exchange Rate - <AUTHOR> http://nautil.us/issue/88/love--sex/the-price-of-life-is-death-but-sex-improves-the-exchange-rate <comment><USER2> Vague, unsupported claims that someone with better genes in a stable population requires someone else to die. How about, not be born? Or cause some other person not to reproduce at all by competing for mates more successfully?

This is what happens when philosophers try to do math etc.

<comment><USER3> From the article: "We ought to add some nuance. For each incremental increase in the frequency of the beneficial mutation, it's not technically a death that's called for, but only the failure of one individual to survive and reproduce. Maybe someone just doesn't get to have her allotted offspring. The point is only that the parent's genetic lineage must come to an end. But in nature, that usually means mortality for either the prospective parent or the offspring. A reasonable shorthand is, well, just death."

This is what happens when skimmers comment.

<comment><USER2> Nope. Saw that. That's where they glossed over the more likely outcome (fail to reproduce) and said well, probably somebody dies. Not supported, not necessarily the true mechanism. Which was my point - to make the title of the article seem correct, they whitewashed that entire mechanism. "The Price of Life Is Death" is clickbait in that sense.</comment></comment></comment>


Yahoo= Massive Destruction Of Shareholder Value, Employee Morale and The Health Of The Internet - <AUTHOR> http://www.techcrunch.com/2008/06/13/massive-destruction-of-shareholder-value-employee-morale-and-internet-health/

<comment><USER2> _It eventually climbed back a little, but by the end of the trading day, $3.6 billion had been removed from the pockets of Yahoo stockholders._

Much of that $3.6 billion had been put in their pockets in the first place by speculation of the MS/Yahoo deal.</comment>


Elon Musk, ask me anything about BFR - <AUTHOR> https://www.reddit.com/r/space/comments/76e79c/i_am_elon_musk_ask_me_anything_about_bfr/ <comment><USER2> Very cool that in the same IAmA Musk answers deeply complex questions as chief rocket engineer and, then, answering a side question offers up a potential low level architecture for how to make an internet feed work from earth to mars.

It would be interesting to know what the max capacity is for the human brain to store these kind of multi disciplinary low level details.

<comment><USER3> The internet response is very vague and not particularly insightful to anyone who has worked on any internet protocol. It's not evidence he's an interdisciplinary mastermind. (It's not evidence he _isn 't_, either.)

> Elon: But, yes, it would make sense to strip the headers out and do a UDP- > style feed with extreme compression and a CRC check to confirm the packet is > good, then do a batch resend of the CRC-failed packets. Something like that. > Earth to Mars is over 22 light-minutes at max distance.

<comment><USER4> There is a thing called delay tolerant networking, which is specialized in building interplanetary communication. Vint Cerf is one of the people who initiated that research. Though it fades away quickly now no one cares much about this DTN thing.

<comment><USER5> Infinipath and at least the first generation of Intel Omni-Path does delay- tolerant networking inside the datacenter. It's not rocket science.

<comment><USER4> I am not sure these are the same thing I am talking about. These are for data centers?

<comment><USER5> I was giving additional examples of the same concept (tolerating long delays) in a different domain (inside a datacenter). You are correct that I was not referring to Vint Cerf's work.

</comment></comment></comment></comment></comment></comment><comment><USER6> From Twitter: (2017) "elonmusk: Falcon Heavy maiden launch this November".

Is that still on? Or are they announcing the next model before shipping the current model?

<comment><USER7> /r/spaceX lists it as "December", and they cite some SpaceX report (more recent than Musk's July tweet) saying that Falcon Heavy is targeted for "no earlier than the end of 2017".

<comment><USER6> It was originally scheduled for late 2013. Sigh.

<comment><USER8> While that it is true it hides what is going on. Falcon Heavy was delayed because they managed to massively improve F9 and many of the Falcon Heavy contracts are actually now flown on the F9. The last couple flights that did not land were all FH contracts.

So the Falcon Heavy we are gone get now is way, way more powerful and all 3 boosters will land and be reusable. The side boosters are actually reused F9 boosters.

So its really not the same as 2013.

</comment></comment></comment></comment><comment><USER9> Is it possible to generate propellant for the Mars transit from Lunar ISRU? Are the right source materials available there?

<comment><USER10> I'm afraid not. The SpaceX ISRU plan is to extract water from ice and electrolytically split it into hydrogen and oxygen. The hydrogen is combined with CO2 from the Martian atmosphere to produce Methane fuel, while the oxygen is chilled for use in the rockets as well.

On the moon you have water (ice), but no carbon dioxide. You can split the water into hydrogen and oxygen to use as fuel, but the BFR requires methane fuel.

Why use methane? It has a lower ISP than hydrogen but higher energy density, to simplify somewhat, and is easier (possible even) to store on long flights.

<comment><USER8> Methane also avoids the hydrogen embitterment problems that long term use of hydrogen would cause your engine.

</comment></comment></comment><comment><USER11> Interesting timing... it coincides nicely with the bad press about the layoffs.

<comment><USER12> Thats Tesla, not SpaceX?

<comment><USER13> I believe you are right. But that is what you going to get from the general public if you use the same face to drive/promote a enterprise/brand.

</comment></comment></comment><comment><USER14> Ol' Musky

</comment><comment><USER15> The potential of what a human brain is able to achieve..

<comment><USER15> Don't be jealous guys

</comment></comment><comment><USER16> Well, if the moderators are enforcing "on-topic" questions in an __Ask Me _Anything_ __, then it seems reddit 's transformation into a marketing and brand promotion platform seems complete.

<comment><USER17> I don't feel that at all. If Musk is having an AMA on a topic, like the BFR, I feel that is better than an open ended AMA, since the signal to noise ratio will be better and I can go there to read about exactly the topic I'm interested in. I'm not particularly interested, for example, in questions about Musk's divorce or dating habits.

Perhaps they need to change the name of these on-topic AMAs, but Musk isn't selling BFR rockets to consumers, generally geeks are interested in SpaceX from a hobby interest point of view, and so the idea of marketing and brand promotion seems a little divorced from reality.

SpaceX isn't going to increase their launch contracts by entertaining AMA questions. My guess is, Musk likes engaging people and talking about the cool shit he's working on.

<comment><USER18> I think this has less to do about signal to noise and more to do with crowd control.

BFR as a project is out of touch with the current affairs at Tesla and SpaceX which means that there is basically no negative sentiment that can be generated from asking questions about the topic or their answers.

A general AMA however will likely touch about things like the failure to support Autopilot 2.0 hardware on schedule, Model 3 delivery delays, Falcon Heavy delays, and those are just the light stuff.

One does have to wonder why is there an AMA on the only detached and "universally rosie" subject just as Tesla announced layoffs.

While I don't think it was planned, I do have a strong suspicion that the AMA was intentionally focused and the mods were asked to enforce question rules (and looks like more strictly than usual even based on previous Musk AMAs).

<comment><USER19> How does it make the slightest bit of sense that an AMA on a space forum would be intended as a deflection from firings at a totally different company in a different field? A bunch of space enthusiasts asking about Mars isn't going to change public perception of Tesla in the slightest. Not everything is a vast PR conspiracy.

You say you have a strong suspicion that it was intentionally focused. Did the fact that it says "about BFR" in the title give it away? Of course it's focused.</comment></comment></comment></comment>


Speed Up with Wordpress and Gears - <AUTHOR> http://ajaxian.com/archives/speed-up-with-wordpress-and-gears

<comment><USER2> Note that you'll need to be running on WordPress trunk to get the Gears support. You can find the Subversion repository here:

<http://svn.automattic.com/wordpress/trunk/>

And the Trac ticket for adding Gears support to WordPress here:

<http://trac.wordpress.org/ticket/6965>

The subject was also discussed on the wp-hackers mailing list in March:

[http://comox.textdrive.com/pipermail/wp- hackers/2008-March/t...](http://comox.textdrive.com/pipermail/wp- hackers/2008-March/thread.html#18897)

</comment><comment><USER3> I'm over WordPress.

Drupal is my new love... however, they significantly need to improve their website to better service the growing community and module contributions.

<comment><USER4> I think drupal is awesome as well ... although its not a perfect fit for everything... it can be customized almost for all things!

</comment></comment><comment><USER5> Speed Up! by making fewer ridiculous database queries with ridiculous clauses like "select ... where 0=1".</comment>


Show HN: Dejavu – The missing web UI for Elasticsearch (1.0.0 release) - <AUTHOR> https://github.com/appbaseio/dejavu <comment><AUTHOR> We first did a Show HN ~1.5 years ago; this is a super major overhaul with active development since and close to 100 issue fixes.

Direct link to try it out - [https://opensource.appbase.io/dejavu/](https://opensource.appbase.io/dejavu/).

* The biggest change today is the ability to import data into Elasticsearch directly via JSON and CSV files. Their is a guided process for setting the mappings correctly.

* Filtered views and query views.

* Ability to export filtered data as JSON / CSV, apparently other web UIs don't support this.

* There is also a docker image option to run it as Elasticsearch removed website plugins starting v5.0.

We originally wrote it in React v0.14.0 and have made it compatible with the React v15.6. There is an ongoing refactoring effort to translate all the code to use ES6 idioms.

Would like to hear what improvements can be made, I am not perfectly happy with how we are supporting mappings in the import process.</comment>


JetBrains AppCode: an Objective-C IDE That Makes a Difference - <AUTHOR> http://www.jetbrains.com/objc/ <comment><USER2> I really, really love Jetbrains. Even though I'm not an iOS developer, it's still nice to see that they are working to add their own flavor to the mix with other languages.

I wish so much that they would create a Visual Studio replacement. I'm primarily a Ruby/PHP developer and use their PhpStorm and RubyMine products constantly, but whenever I am stuck doing something in .net and have to open up Visual Studio, I just get a gross vibe from the entire experience... And this is with Resharper installed as well!

I see Visual Studio get a lot of support on HN, so maybe I am just weird, but I've never enjoyed using Visual Studio as a whole.

<comment><USER3> "I see Visual Studio get a lot of support on HN, so maybe I am just weird, but I've never enjoyed using Visual Studio as a whole."

Me neither. I switched from Visual Studio (C#) to Emacs (Common Lisp) -- and a short stint on the AllegroCL IDE -- and I do not miss Visual Studio one bit. It always struck me as odd to see Visual Studio getting praised here. I can only assume it fares better than Netbeans or Eclipse?

<comment><USER4> I can't speak for everybody, but I always rated Visual Studio because of its zero-effort code navigation and code completion. (No setup required, and it's surprisingly good at seeing through common preprocessor tricks.) The debugger is pretty good, too, the text editing experience is fine, the whole thing is 99% operable via keyboard, and the scripting language is bearable.

This probably doesn't sound like a rousing endorsement, but I've yet to find anything that's as good for reading and writing C, C++ or C# code.

(People using Visual Studio for anything else should definitely consider shopping around, though as general-purpose text editors go it is far from the worst possible.)

<comment><USER5> > zero-effort code navigation

Try the ReSharper VS addon from JetBrains -- it makes navigation much much better. VS code navigation really is primitive in comparison.

</comment></comment></comment></comment><comment><USER6> I love JetBrains products. These guys are awesome. I don't write Apple Code (iOS or Mac OS), but I'm sure it is really cool.

They built my favorite Java IDE, IntelliJ.

<comment><USER7> This will probably be a great project for people who are used to JetBrains products. If you are developing iOS applications on the side you won't have to learn a whole new environment.

For 100% iOS development I doubt many people will switch. The integration between Xcode, Interface Builder and the various Apple frameworks is something that will be hard if not impossible to implement in another IDE.

<comment><USER8> Plus you can't beat free.

</comment></comment></comment><comment><USER9> I might be missing something, but was are the advantages of this over using Xcode?

I'm all for options, and $50 to $150 usd is not prohibitive for an IDE, but since Xcode is free and directly from Apple, there must be some really good features for me to switch IDEs.

<comment><USER10> Disclaimer: I do Java using Eclipse for my day job, and have used one of their Java IDEs in the past (IntelliJ IDEA). The code-editing side of XCode compared to these IDE is like a relic from the 90's.

Once you use a refactoring tool to rename a class and have it renamed everywhere in your project, you get a taste for what XCode is missing. There are several refactorings like this that shave a lot of time out of some of the more annoying tasks. Code generation allows you to define a method or property once and have it added to both .h and .m files, as well as have properties synthesized. If you want to add an argument to the method signature, that is done in one step, too. The SVN integration in IntelliJ IDEA was superb. I have had issues using SVN in XCode where the interface refuses to load history, and the interface for managing conflicts just isn't there (try having 2 devs change the project file). These are just a few things off the top of my head.

<comment><USER11> Off-topic: How would you compare Eclipse to IntelliJ IDEA and why did you choose Eclipse?

<comment><USER12> I've used both. I have a personally bought copy of IntelliJ, though I'm using Eclipse now.

For the most part, they're both comparable. Both have powerful refactoring and code-generation abilities.

For core Java development, there's no need to leave Eclipse. IntelliJ might provide some nice features, but overall it doesn't warrant purchasing a license.

When combined with web development, other languages, or non-core development, is where it easily pays off to switch to IntelliJ.

We were doing some Grails work, and Eclipe's support (via STS) was shady at best. We put off trying IntelliJ since it meant learning a new environment, new shortcuts, etc, but after about a day of playing with it, we were sold, and never looked back.

<comment><USER13> For the record, there's a free version of IntelliJ now. (Community Edition)

</comment></comment></comment></comment></comment><comment><USER14> The one feature I'd love from any tool with iOS development would be something that automates and facilitates certificate and profile creation and handling. Right now it seems I make a single mistake along the way and everything is messed up.

<comment><USER15> I renewed my developer account last week and due to an email snafu didn't get the renewal code before my developer account expired. When I finally got the renewal processed and launched Xcode 4.2 for the first time, I was treated as a new developer. In Xcode, everyone was done for me -- creating a certificate, making the team provisioning profile, etc. All I had to do was connect devices so Xcode could grab their UDIDs and add them to the profile.

If you're getting started today, it's pretty damn seamless. Most people find this stuff harder/more painful than the actual coding, so it's a big win for iOS developers.

</comment></comment><comment><USER16> I'm a longtime Jetbrains fan (ReSharper and TeamCity).

I looked into AppCode a bit earlier when it was still rough. Getting tight integration is the key for me. Refactorings would be nice (XCode has Rename already), but really what I want are snippets, or something to take some of the drudge code away.

For instance, to add a property I have to add 4 lines of code in 4 different places. This should be one action (which can be overrided later).

Also, code navigation. This was terrible in XCode 3, better in 4, but nowhere near ReSharper or IntelliJ.

<comment><USER17> Also, automatically add the #import statement when I allocated one of my classes, please.

The ideal, for me, would be the same as ReSharper: a plugin that adds functionality, but that won't happen with Xcode any time soon.

<comment><USER18> What happens if you delete the last class that #imported something? Do you remove the #import? What if the #import wasn't automatically added? Still automatically remove it?

How about if you don't need the #import for a class, but, instead for something else (say, it #imports a bunch of other classes for you instead, like UIKit.h)?

</comment></comment></comment><comment><USER10> Definitely worth checking out. Having refactoring support and non-broken SVN integration might be worth switching alone.

</comment><comment><USER19> A Mac-exclusive app not being Cocoa is perverse.

<comment><USER20> Why? What would Cocoa add to this project that would compensate for the additional work?

<comment><USER21> For one thing, the standard UI elements everyone expects from a top tier Mac app and which this sadly does not deliver.

<comment><USER20> That would be nice, but I'm not sure it's worth pushing 1.0 back a year or so, all other things being equal. I certainly wouldn't call trading a bit of prettiness for a lot of functionality "perverse."

<comment><USER22> If you mistake the call for Cocoafication for nothing more than a call for "prettiness", you're naturally going to end up missing why people care so much about it.

Java applications don't support a lot of deeper OS X features that make the platform so consistent. I have custom keybindings set up via the DefaultKeyBinding.dict mechanism that work pervasively throughout the OS, except in applications like AppCode that seem to think that their ease of coding trumps my consistency of platform and configuration. I think that kind of assumption is utterly broken and user-hostile, and it has nothing at all to do with "prettiness".

<comment><USER20> It was rgbrgb who brought up native GUI elements as the big reason for going Cocoa — I was just replying to his/her comment.

Anyway, like I told frou_dh, I do understand the benefits Cocoa offers. I've been a Mac user since 1985, Cocoa programmer since 2001, got the gold badge on Stack Overflow — believe me, I get it. But I also understand the benefits offered by JetBrains' existing IDE codebase. Engineering always involves tradeoffs. JetBrains' tradeoff may not align with your preference here, but the simple fact is, they now have a highly capable IDE shipping for OS X. Cocoa doesn't have anything particularly helpful to IDEs that would offset the cost of rewriting, so if they had gone with a total rewrite in Objective-C, it seems most likely that they would either not have _anything_ shipping or they would have a pretty but half-baked product (or both).

It's true that not using Cocoa does hurt the product. But there are a lot of ways Cocoa apps can be broken and user-hostile too. The initial release of Xcode 4 was so broken that a lot of people downgraded after trying it for a week. It's still worse than Xcode 3 in terms of stability and responsiveness on average hardware. TextMate has always been Cocoa, but early releases were missing a lot of standard features because so much of the UI was custom code (as the standard Cocoa controls did not offer the functionality TextMate wanted).

So yeah, if AppCode were Cocoa, it wouldn't have all the UI problems it does now. It would have different problems. My point is just that which set of problems you'd rather have is a matter of personal preference. If you disagree with JetBrains' choice, then this is not the app for you, and that's OK.

</comment></comment></comment></comment></comment></comment><comment><USER23> I find it interesting that so many folks whine about how an application looks instead of how much it helps you do your job. AppCode doesn't tout itself as a beautiful Mac application. It's written by developers for developers. We have a saying at my office: 'If you can't code, it's likely that you care about pixel perfection.' I care about getting stuff done. I don't care about how pretty my application is when I'm getting the job done. I like things that increase my velocity (in my case over 50%). I feel like Xcode just gets in the way many times. Simple things like not being able to have the cursor in the middle of a line and be able to simply add a line under the current line (vi lovers: think 'o' from the middle of a line). In Xcode you have to go to the end of the line and hit enter. That is one trivial example of a time saver that AppCode offers. (There are MANY).

Instead of whining about pixel perfection, try taking a look at the things it does and the audience it targets. You probably don't code enough to actually have an opinion that matters much anyway.

</comment><comment><USER24> Does it have vi plugin?

<comment><USER23> It appears that it supports most of the plugins that IntelliJ Idea have. I bought AppCode just yesterday and absolutely love it.

</comment></comment><comment><USER25> let's see if this can beat Apple at its own backyard</comment>


To Serve Man, with Software - <AUTHOR> https://blog.codinghorror.com/to-serve-man-with-software/ <comment><USER2> I watched a couple black mirrors. Couldn't get into it, wonder if it's like the first couple times I tried to watch Game of Thrones.</comment>


Podcast: Great take on the anti-vaccine movement and alarmist ideas that spread - <AUTHOR> http://cdn46.castfire.com/audio/522/3454/25338/2429604/penn-15-02-01-ss_2015-02-01-230104-7770-0-0-0.64k.mp3?cdn_id=46&uuid=2468881ed94cb194939b8a8d88cd490e

<comment><USER2> yea well you inject that transistor into your blood and then sleep on a metal spring matress - that if you lay on it bends into a natural satellite shape - once injected those will be subjective to any magnetic force, and can be pulled to your brain while you sleep with a magnet, with enough exposure to a magnet it could even be formed into an antenno or a satellite shape. so then try to fight the electric dragon gods and their emf/microwave weapons.

same reason they put aluminum in deodorant for 30 years or whatever. once you can have metal in your blood you can be captured in the magicnet (magnet)

so tired of this shit stop posting anti vaccine shit it irks me; you have no idea what your talking about nor the cultural histories of the earth. its the year 4000 in china and they all worship a dragon god. so idk why you post this fud.</comment>


Alien Invasion - Why Stephen Hawking Is Wrong - <AUTHOR> http://blogs.wsj.com/speakeasy/2010/04/27/war-of-the-worlds-why-stephen-hawking-is-wrong-about-aliens/

<comment><USER2> "Just because we go around wiping out our competitors doesn't mean aliens would do the same"

This is true, but this same statement /proves/ that aliens might do the same (we serve as an example) - imo that is good enough to justify a fear of alien invasion.

"A civilization that has endured for millions of years would have overcome any aggressive tendencies, and may well have genetically engineered its species for harmonious living. Any truly bellicose alien species would either have wiped itself out long ago, or already taken over the galaxy."

Stuff like this is pure speculation without justification - and arrogant speculation at that.

At least Stephen Hawking's reasoning is minimal with the assumptions, and the assumptions he does make are on the "safe" side, i.e. assuming the worst possible risk will actually happen. e.g. aliens exists, they will be as violent as possible, they will find us etc.

I'm not saying its a significant risk though...

</comment><comment><USER3> Funny that an economist[1] has an immeasurably more coherent and logically compelling model of the probability of alien spacefarers, and what that means for us, than Stephen Hawking and the WSJ put together.

[1]<http://hanson.gmu.edu/greatfilter.html>

<comment><USER4> That was an excellent read and probably the most convincing answer I've seen to the Fermi Paradox.

</comment></comment><comment><USER5> If someone thinks they are smarter than Stephen Hawking. That someone is wrong. Q.E.D.

(I know. Complete misuse, but funny.)</comment>


Do stars fall quietly into black holes, or crash into something utterly unknown? - <AUTHOR> https://phys.org/news/2017-05-stars-fall-quietly-black-holes.html <comment><AUTHOR> Paper @ [https://arxiv.org/pdf/1703.00023.pdf](https://arxiv.org/pdf/1703.00023.pdf)</comment>


Where people live - <AUTHOR> http://www.ibbly.com/Where-people-live.html

<comment><USER2> The entire site is actually quite interesting. Quirky in places, but worth the read.

</comment><comment><USER3> Puts into dots how much more people india and china have.</comment>


The Teradrive – A Sega Mega Drive and IBM PC Hybrid - <AUTHOR> http://segaretro.org/Teradrive <comment><USER2> JPN Sega 16-bit collector here; the Teradrive was an interesting piece of kit, but I've always been floored by just how many variants of the core system there were: from the beautiful Wondermega RG-M1 to the Laseractive, to a Megadrive and MegaCD shoved into a boombox, etc. There's a reason that generation from Sega spawned multiple books about its history.

And then there was this, which is perhaps even more impossible to get ahold of: [http://segaretro.org/Sega_Mega_Anser](http://segaretro.org/Sega_Mega_Anser) At least the Teradrive pops up on Japanese auction sites, some even in the original packaging; I've never actually seen a full Mega Anser out there, though a couple of the Ten Pad controllers show up every year or two.

In short, Sega attempted to provide the utility of the platform as a limited use-case computer, and then attempted to bring the functionality of the platform _to_ a computer.

<comment><USER3> Can you share your favorites of the "Sega history books"?

Thanks for your time!

<comment><USER2> This one is very approachable and thorough, and was the result of a Kickstarter last year. Really great book, and probably my favorite; these guys went over the top.

"Sega Mega Drive / Genesis: The Collected Works" [https://readonlymemory.vg/shop/book/sega-mega-drive- genesis-...](https://readonlymemory.vg/shop/book/sega-mega-drive-genesis- collected-works/)

The other one I have stored away is in 100% Japanese and was more a canonical catalog of every released game. Released, I want to say, maybe a 6-8 years ago? Hard as heck to find.

</comment></comment></comment><comment><USER4> A friend of mine owned one of the latter Amstrad MegaPC models, same sort of thing but based on the 80386SX processor. It was pretty cool - [http://www.segaretro.org/Amstrad_Mega_PC](http://www.segaretro.org/Amstrad_Mega_PC)

<comment><USER5> Hehe, I remember those things being advertised I think.

I wanted one. But wr already had a megadrive II and the MegaCD II, and a better PC...

</comment></comment><comment><USER6> It's funny how, in this page, MHz has a deep ring. Probably remains of the emotions of a younger self. At that time all these console/* hybrids were amazing to me. Console/PC, Console/TapeRecorder, anything..

ps: internal pics [http://nemesis.hacking- cult.org/MegaDrive/TeraDrive/Pictures...](http://nemesis.hacking- cult.org/MegaDrive/TeraDrive/Pictures/) (from [http://assemblergames.com/l/threads/sega-teradrive-pc-cpu- up...](http://assemblergames.com/l/threads/sega-teradrive-pc-cpu-upgrade-help- needed.56793/))

</comment><comment><USER7> Also the rarest IBM Model M, for keyboard weirdos.

<comment><USER8> I thought that keyboard had to be a rebranded Model M when I saw the screenshot, very cool.

</comment></comment><comment><USER9> > released to the Japanese market in early 1991

Japan in the 90's must have been awesome, it was like a version of the future from the past.

<comment><USER10> Even more fascinating when you realise that economically that era went down in history as "Japan's lost decade" (which turned out to be rather optimistic, because we now need to number them).</comment></comment>


When Profits Threaten Privacy – 5 Things You Need to Know about Apple in China - <AUTHOR> https://www.amnesty.org/en/latest/news/2018/02/5-things-you-need-to-know-about-apple-in-china/ <comment><USER2> Overall Amnesty has made a reasonable assessment of the issue. Apple is clearly in a difficult position and has to make compromises to keep doing business in China.

>> _The best way to protect your personal information from being accessed by the Chinese government is to avoid storing it on servers inside China._

Fair enough, but as anyone who has spent a fair amount of time working and living in China knows, access to services hosted outside of the country can be difficult, if not impossible, without a VPN. Beijing's current plan, is to block access to any non-approved VPN services by the end of March 2018. Assuming that ban goes into effect, it will effectively cut users off from services not approved for the China market. Whether or not this will include Apple services hosted abroad remains to be seen.</comment>