Ten Challenges - b-man http://steve.yegge.googlepages.com/ten-challenges <comment><AUTHOR> I managed to get halfway through Godel Escher Bach. Glad I'm not alone in not having finished it.

<comment><USER2> Am I the only one who found GEB to be a _light read_? There are many books on computer science, math, and philosophy which I have to think hard and spend a great deal of time to absorb, but GEB was most definitely not one of them. I know Steve Yegge is probably smarter than me, and it baffles me to hear him describe how it is too rich and dense for him to finish. I found it fairly playful and easy to get through, and hard to put down until I was done.

<comment><USER3> No, you're not the only one. I, and at least three people I know, all found it to be an entertaining and fairly straight-forward read. Certainly not unfinishable.

I'd be interested to know what it is that people find makes them stop.

<comment><USER4> I found it light, and boring because of how light it was. I had studied Gödel's theorems, etc., so I really could not take the pace for explaining the logic stuff (most of the book) in GEB.

<comment><USER4> By the way, I would recommend any programmer interested in physics "The Road to Reality" by Penrose. I think that's a very challenging book, that can be interesting for programmers, even if it's not about programming. Compared to that kind of material, GEB is very, very light.

</comment></comment></comment></comment></comment><comment><USER5> Really for most programmers it is a list of 10 books I want to have on my bookshelf so I look important when someone comes over. A list of ten programing books programmers _wish_ they read.

Much more useful is the list of "... ten books that I really enjoyed, and that I'd recommend to anyone who's a computer programmer, regardless of their preferred language and platform."

<http://steve.yegge.googlepages.com/ten-great-books>

</comment><comment><USER6> "Challenges" is kind of subjective. GEB is really a bit fluffy (as I said in another comment here), and SICP is only challenging if you've never seen a functional language before. PLP is also not particularly challenging as such, but it is a satisfyingly informative treatment of the practicalities involved in implementing a conventional programming language from the ground up.

On the other hand, while I've not read all of _Types and Programming Languages_ , it definitely starts to get into some challenging (and very interesting!) material.

</comment><comment><USER7> _Types and Programming Languages_ was one of the books used for my (undergrad) programming languages course. This article made me feel much less guilty about not actually understanding most of the small amount that we did end up actually reading.

</comment><comment><USER8> I'd certainly replace one of those with AIMA, though I'm not sure which.

</comment><comment><USER9> Has anyone read functional data structures that can give a brief review on it?</comment>


Smart Power Strip- Control your appliances from anywhere - <AUTHOR> http://www.kickstarter.com/projects/337922278/smart-power-strip-control-your-appliances-from-any

<comment><USER2> I like that people are focusing more on the "internet of things" and developing products for it. In my recent researching and planning of my own home-automation design, I've found that there's a very limited selection of devices for controlling sources like this "smart bar" is. There are some products, but they are either badly documented, have limited or unportable APIs, very expensive, or simply not elegant. I expected a lot more than what I found. Sure, I can engineer or hack something that will work for me, but that doesn't work for everyone, or even most people.

I like the product in this Kickstarter, although I'd love for an pure socket replacement rather than just a power-bar.</comment>


Ad man behind '1984,' 'Think Different,' and 'I'm a Mac' stepping down - <AUTHOR> http://www.macworld.com/article/143588/2009/10/apple_clow.html

<comment><USER2> Boys and girls, he is a dying breed. No, I don't mean a dying breed of creative genius, rather the dying breed of individuals who are actually with a company for 30 years. How many of us last more than 4 years at a company now- a-days?

<comment><USER3> Ok, I'll bite. Why is staying at a company for 30 years so admirable?

If you enjoy your job and continue to for that long, great. There are plenty of people who don't want to be doing the same thing day after day for the next 30 years. I think the same can be applied to living in a city, sure plenty of people enjoy living in one place all their lives but I'd argue that they're missing out on opportunities to expand their horizons by staying put all that time.

That said, Lee Clow is in a league of his own - what he has done is simply awesome.

<comment><USER4> He didn't say it was admirable.

It's _notable_ that our culture is changing. I think, on the whole, it's a good change. But one nice thing about 30 years is you have the opportunity to get really good at the job. Many people don't do that, but here is someone who, it sounds like, did.

<comment><USER5> > But one nice thing about 30 years is you have the opportunity to get really > good at the job.

As someone who is early on in ther career, this is good food for thought. I am still employed at the first company I worked for after graduating from college 2 years ago. I was always told that the way you get a raise is to "job hop" every couple years.

<comment><USER4> I never really understood that. Why are other companies more willing to give you a raise? Is it just irrationality by your boss?

The way I see it, you're worth more to your current company. You already know their stuff, and don't have to get up to speed. And you know the stuff you made for them well. And to them you're not an untested new hire who could flop. So in a rational economy, on average and when you're a good fit where you are, you ought to get the best offer from your current company.

<comment><USER6> Why would your company want to pay you more than they are right now? What is their incentive? Retention?

Other companies are willing to pay you more because they need your expertise and you are offering a higher level of skill/experience than you offered the company you are with now.

<comment><USER7> Retention is a very good reason to do so; replacing someone good is always hard (and expensive) in terms of hiring and ramp-up times. If you don't adjust your employees' salaries to reduce the incentive to job-hop in order to get a raise, you're basically asking your best employees to leave.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm not a fan of the "I'm a Mac" ads but the "Think Different" ad is probably among the best commercials ever made.

<comment><USER9> I came here to post just that. I drift in and out of Mac fandom, but the text in that ad is inspirational every time.

Also, has any other ad anywhere ever done a better job of defining a culture (at least an aspirational one)?

</comment></comment><comment><USER10> If you clicked on this story, you might also enjoy "The Age of Persuasion" on CBC radio. No podcast yet unfortunately, but streaming audio is available. (See right margin.)

<http://www.cbc.ca/ageofpersuasion>

<comment><USER11> "The Age of Persuasion" is excellent. You can ferret MP3s out of the CBC pages with a bit of work.

</comment></comment><comment><USER12> most entertaining link from that article: <http://whatwoulddondraperdo.tumblr.com/></comment>


Ask PG: no-idea link directs me to normal app - <AUTHOR>

After timing out on updating the no-idea app, I found that subsequent clicks on the link directs me to the normal form. This happens even when I try a different browser. <comment><AUTHOR> Ok, I found the change status link. So I'm back at the no-idea app. But there seems to be a bug still.</comment>


Planet Money Makes a T-shirt - <AUTHOR> http://apps.npr.org/tshirt/#/title

<comment><USER2> I wish this were higher up on the list. I'd be eager to hear peoples' opinions on the experience NPR created

</comment><comment><USER3> Truly Incredible</comment>


Half of Instacart's drivers earn less than minimum wage, labor group claims - <AUTHOR> https://www.fastcompany.com/90337972/half-of-instacarts-drivers-earn-less-than-minimum-wage-labor-group-claims <comment><USER2> I believe these services will fail if employment laws are ever strengthened, or held up more rigorously.

The 'not so dirty secret' of the American economy is that it 'depends' (i.e. in it's current form) on tons of cheating, illegal migrant labour, de-fact sub-minimum wage, skimping on health benefits etc. etc..

It's 'sustainable' only to the extent that some workers, particularly undocumented - are willing and able to take the crap for the opportunity for a new life. Which is only _slightly_ fair (fair to the extent that were a foreign workers regime legalized, conditions would be ballpark where they are now, and it would legally be 'legit' and there'd be plenty of workers).

But in socialized countries, I just don't see it working, the numbers don't add up.

I see these services working in NY/SF/LA and 'parts' of Chicago, maybe Ft. Lauderdale, Boston i.e. wealthier areas - the rest - no way, at market wages. London of course, maybe Paris. Though probably most of Asia.

I just don't see this as mathematically viable in Scandinavian countries, or Canada, or most of the US.

The end-game will require more efficiency in delivery, for example like some kind of better pickup arrangements for buildings, maybe ownership by the grocery companies so there's fewer entities trying to take money from the pie, possibly some kind of 'weekly delivery/sign up' for longer term engagement etc..

<comment><USER3> > maybe ownership by the grocery companies

Big retailers deliver groceries in many countries already. In some places it's been the case for over 15 years! It's not rocket science really.

<comment><USER4> The main reason this hasn't become bigger in the US is because of the sprawling, inefficient layout of most US residential areas; unless you are doing major volume on the order of FedEx or UPS you are probably wasting tons of miles getting to customers in isolated cul-de-sacs.

</comment></comment></comment><comment><USER5> All of these gig economy companies seem pretty fragile, they are all risky investments. Most of them are only one court decision or legislation from being put into a difficult position.

</comment><comment><USER6> Instacart was straight up stealing tips until they were caught: [https://www.theverge.com/platform/amp/2019/2/6/18214335/inst...](https://www.theverge.com/platform/amp/2019/2/6/18214335/instacart- reverse-controversial-pay-policy-tip-stealing)

I wouldn't listen to anything they have to say on the matter of pay. They have zero credibility.

<comment><USER7> I quit using instacart and ended my subscription after this. It was seeming like a promising alternative to using a car to shop, but I'll just continue working on that in other ways.

<comment><USER8> I was outraged when I found out about this and made this clear to their support. They didn't even respond.

Switched to Prime Now and have never looked back:

\- Has an actual consistent service level, I've had some crazy Instacart people here in Arizona.

\- The tip has a default value, pre-calculated based on your order.

\- No more orders where half of my items get cancelled as out of stock.

<comment><USER9> Damn, I didn't know about the tipping schenanigans. However, it's weird how different my Instacart experiences are from yours. In Seattle everyone has been top notch, friendly, and like crazy helpful. I've been using it for, I dunno, a year? And I still get free shipping + waived delivery fees when I order. I have no idea how they make any money.

I've tried Prime in the past, but I'm not in the demographic they cater too. Whole Foods isn't my scene, and while I'm not too cheap to have something delivered, I am too cheap to pay $2.30 for an organic onion.

<comment><USER8> Oh, that doesn't surprise me at all. Instacart is fine service-quality-wise in SF/NYC/Seattle areas. It's just in any other major city in the US they seem to suck quite badly..

Also Amazon cut the prices on everything at Whole Foods by like 50% a few months after buying them. I completely agree their prices before (and still on non-whole-foods brand items) are crazy.

Everything I get from Prime Now is roughly the same price as my local grocery store, and I don't buy organic junk or anything.

</comment></comment></comment></comment></comment><comment><USER10> I hate their tip-stealing practice but I wish there'd been more concrete details of methodology for this. Car expenses are all tax deductable and yes paying 15.3% off the top in SSE employment taxes is a hit but it seems like these estimates may underestimate by a few dollars an hour. Not that that's saying much of course, it's still low. I just like hard data in these narrative-driven pieces.

</comment><comment><USER11> A minimum wage job is not that hard to get if you own a car so I'm curious how long these people are working at less than minimum wage before they find another opportunity. Maybe these people are only working a few hours a week to make a few extra bucks?

<comment><USER6> I think it's as simple as them not doing the math. Self employment taxes, gas, vehicle wear, etc. They just see the check is bigger than what their prior minimum wage job was. Probably true for Uber, Lyft, etc, also.

And, to be fair, it's more flexible, as you say. I suspect some drag their kids along, or work for Instacart after their day job (or other obligations) is done, etc.

<comment><USER12> As are all the "sharing economy" scams out there. They all hide the costs in the math and pass them on to their employees. Uber, airbnb, etc.

<comment><USER13> They aren't scams. They are just opportunities of low compensation. A scam is where someone is robbing you blind because they lie to you. A crappy "job" doesn't have to be a scam to be crappy.

<comment><USER6> Many of these "gig economy" companies have grossly misrepresented the earning potential[1]. That bit is scammy. As is stealing tips, which Instacart was caught doing.

[1] One example: [https://www.recode.net/2017/1/19/14330042/uber-20-million- se...](https://www.recode.net/2017/1/19/14330042/uber-20-million-settlement- ftc-driver-pay-false-advertising)

</comment></comment></comment></comment></comment><comment><USER14> I would like to highlight and submit the paradox at the heart of the gig economy. At one end, the gig economy relies on a critical mass of consumers willing to pay for additional value on top in the form of convenience and real-time demand networks, but at the same time the economic model also leads to a race to the bottom as it assumes and necessitates that every request is served with the least amount of friction possible (capital, labor or otherwise). Which creates a problem, if the future of work is an expansion of the economic trends behind the gig economy (cost reductions by passing the buck onto the employees and highly dynamic workforces), then that logically means the number of people who have the capability to afford it in the first place also decreases as the buying power of the populace decreases.

We are trapped in a strange loop. The excess buying power of consumers that has arisen from capitalism has also led the same system to incentivize services and practices that are reducing the buying power of consumers.

Our old way of looking at things in isolated subsets will bring us to ruin. We really should adopt a new perspective and a new way of doing things where we view our economies as ecosystems or networks might clarify why these changes are occurring (the gig economy is far from the only change that's happening). For example, we can look at excessive economic inequality and understand why it is bad by looking at natural ecosystems and how they are a closed loop.

For e.g. Consumers are like plankton. They are the injection of biomass (money) into the system that ensures money changes hands when they buy goods and services. A single entity, no matter how rich, cannot provide equivalent mass to the greater ecosystem than a large set of consumers. Or, in other words, a billionaire requires only so many pairs of sunglasses and Netflix subscriptions. Ergo, a broad base of wealth where people can afford the products around them is essential for a capitalistic ecosystem to function, as these plankton keep feeding entities higher up in the food chain through an accumulation effect.

For whatever reason, just like we have decimated our natural environment, we have also decimated our economic ecosystem. The number of entities with high purchasing power is rapidly decreasing, and this signals a significant problem for the future of the ecosystem. And it also suggests how automation can end up eating itself economically unless we institute measures - artificial or otherwise - that inject capital back into the building blocks of the economy.

I suspect that as computing gets better, we will eventually create models that will make the invisible transparent and make our debates about these topics quaint to people of this future. Maybe what we need more than just lobbying instacart is systems that allow us to see economies in real-time and simulate outcomes of individual, highly variable, irrational agents at unprecedented scales in order to give policymakers definitive answers about issues like this, for we are governing blind and I am afraid of what the future holds for us.

<comment><USER15> > I suspect that as computing gets better, we will eventually create models > that will make the invisible transparent and make our debates about these > topics quaint to people of this future. Maybe what we need more than just > lobbying instacart is systems that allow us to see economies in real-time > and simulate outcomes of individual, highly variable, irrational agents at > unprecedented scales in order to give policymakers definitive answers about > issues like this, for we are governing blind and I am afraid of what the > future holds for us.

We already have the compute power, just almost no interest in economic modeling besides ERPs. There are great projects such as ValueFlows ( [http://valueflo.ws/](http://valueflo.ws/) ) and ValueNetworks ( [https://github.com/FreedomCoop/valuenetwork](https://github.com/FreedomCoop/valuenetwork) ) that are taking a stab at this area.

</comment></comment><comment><USER16> If they regulate the gig economy, most of these people will be out of work. The reason is that a company like Instacart will need to make sure that these minimum wage employees are bringing enough value to the company, which means less people being hired.

We need to ask the question, is it better to have more people making less money or less people making more money?

If you interviewed them again, do you think they would rather get paid less than minimum wage for a contract gig or nothing?

These are also contract gigs that allow a certain amount of flexibility that you don't have with a regular job (no boss, work when you want, etc).

If you can't afford to pay your bills, you should get a different job (Minimum wage jobs aren't hard to come by). This isn't going to be solved through government regulation nor should it be the fault of the company offering work.

<comment><USER17> An alternative would be the company taking money from their profits and using it to pay people a living wage.

The argument against that I usually hear is that companies pay people based on what "the market" says their labor is worth and the employees should just get a better job if they don't like it.

However, my understanding is that such analysis is based on models which assume that the people involved are rational actors. That creates a contradiction: If the employees are not rational actors then the model's assumptions are not valid. However, if they are rational actors, then the argument that they should just get a better job isn't valid because a rational actor would have already done so.

<comment><USER18> > if they are rational actors, then the argument that they should just get a > better job isn't valid because a rational actor would have already done so.

If they are rational actors, why isn't the argument that their revealed preferences say that they like it "enough" to accept the bargain offered them? I tend towards the rational actor side of the debate and that they are satisfied that the bargain offered is their best option, so they (rationally) take it.

<comment><USER17> I agree that it is likely the best option available to them. My issue is with the argument that "if they don't like it they can get a different job" and therefore it is morally justified for people to be payed a sub-living wage.

I'm not saying that the parent post is necessarily making that argument, just that it seems like thats the usual justification for this sort of thing.</comment></comment></comment></comment>


Building a raspberry pi into a laptop - <AUTHOR>

Hey, I had this kinda crazy idea when I saw a friend log in remotely to his PI using X-server. Programs would run on the pi, and he would see them on his laptop.
I had this idea of, what if I build a raspberry pi 2 into my laptop. Not like any other pi-top project. I'll have a hybrid intel/pi laptop. I can use it to do Linux-stuff, have a portable gpio prototyping thing, I can host some local webservers, use it as a build server or
My laptop has a cd-drive that I've never used, people suggested me to put an SSD in there, no way, I'm getting a separate computer instead :D
What are your thoughts on this? What would you do with a second computer inside your laptop? Just wondering... <comment><USER2> I installed a Raspberry Pi and an LCD with a battery in inside of an old Mac Plus. That's kind of a laptop right? [http://i.imgur.com/ID7chQk.jpg](http://i.imgur.com/ID7chQk.jpg)

<comment><USER3> Counts! My Mac SE at least had a handle and optional carrying case (which I sadly didn't have). I think they were originally advertised as portable.

</comment></comment><comment><USER4> I have a couple of old laptops. So when I saw your post, I thought about pulling out the old motherboard, etc and installing a Raspberry Pi 2 in its place. Might be tricky to get the old LCD to work correctly.

Has anybody successfully got this sort of re-engineering working?

<comment><USER5> A number of people have been successful with the DSI connector on the Pi, but the monitors you can use are radically different that what you'd find in a laptop.

[http://elinux.org/RPi_Screens#Interfacing_to_non- monitor_LCD...](http://elinux.org/RPi_Screens#Interfacing_to_non- monitor_LCD_panels)

Oh and there is a HDMI to LVDS breakout board floating around somewhere.

</comment></comment><comment><USER6> Wouldn't it be more practical to just use a virtual machine in your main OS?</comment>


Web 3.0 = online markets that are the best hope for U.S. wage-earners vs. the Fed  - <AUTHOR> http://www.loveatmadisonandwall.com/2008/05/04/web-30-the-last-best-hope-for-us-wage-earners-vs-the-fed-online-markets-that-provide-new-and-improved-ways-to-develop-demonstrate-and-earn-money-from-expertise/

<comment><USER2> I wasn't aware that the web came with different version numbers.

$ sudo apt-get upgrade internet ...

:(

</comment><comment><USER3> that is the single worst url in history. Congrats!</comment>


Django on App Engine - <AUTHOR> http://www.comiker.com/.2Qnv

<comment><USER2> Analogy fail. I believe the point is that you are severely limited in what you can do with Django on App Engine. It used to be that you could not use the ORM on BigTable, which prevented the use of the Admin. Not anymore. See: <http://www.allbuttonspressed.com/projects/django-nonrel>

</comment><comment><USER3> Uh... I don't get it.</comment>


Automakers Prepare for an America That's Over the Whole Car Thing - <AUTHOR> http://www.nytimes.com/2016/12/22/business/automakers-prepare-america-fewer-cars.html <comment><AUTHOR> I live in NYC with extensive high-speed mass transit (in our case parallel lines of express which skip multiple stops as well as local) which is faster than car during much of the day.

Part of combatting greenhouse gasses and climate change is making quality mass transit -- high speed subway and rail that doesn't get stuck in traffic.

The NYC subways (not counting busses) have 6 million trips per business day, essentially providing 1% of the nation's population with round trips. Yet, despite providing a green solution the system is vastly underfunded. The same seems to be true of Wash DC subway and Boston subway.

Much (most?) of the electricity that runs the NYC subway is from hydroelectric from Quebec Province in Canada thus a really green solution.

<comment><USER2> According to this undated nuclear energy source [1] New York State gets 36% of its electricity from natural gas, 31% from nuclear, and about 20% from hydro. Meanwhile, recent data (from September 2016) from the US Energy Information Administration [2] reports 46% natural gas, 31.7 nuclear, and 20.4% "renewables" which includes hydro, solar, and wind.

Stats for NYC itself are much more difficult to find.

[1] [http://casenergy.org/nuclear-basics/energy-in-your- state/new...](http://casenergy.org/nuclear-basics/energy-in-your-state/new- york/) [2] [https://www.eia.gov/state/data.cfm?sid=NY](https://www.eia.gov/state/data.cfm?sid=NY)</comment></comment>


Byte Buffers and Non-Heap Memory - <AUTHOR> http://www.kdgregory.com/index.php?page=java.byteBuffer <comment><USER2> Right now, I'm dealing with a problem where, from an external system, we retrieve up to 1M rows of data -- about 30 columns each (short strings, numbers, etc.). Because the external system can never guarantee that it will provide the same answer to a query twice and because our users still expect to be able to sift through a particular query result without changes to the underlying data, we must store these query results "on our side."

Our app is Java. Even in "short pointer" mode, 30M references to the same string would eat up 4 bytes * 30M = 120M of memory! And, the garbage collector would be displeased because it frequently would have to sift through mature generation regions. So, we are left with disk-based options (a traditional RDBMS included in that mix) or some variation of structs in byte arrays/buffers. [I should mention that we only must provide access to these query results for an hour or so.] While I have found some reasonable flyweight pattern-based schemes for representing structured data in large byte arrays (Javolution has a nice one), I have not found any good data structure libraries which use byte arrays as backing stores. Because the data does not change once queried and inserted into our storage scheme, it seems reasonable to use some look-up schemes (hashes, etc.) which could be persisted in a manner similar to the raw data itself. An additional level of abstraction would be nice, but I'll settle for not writing my own hash implementations.

The route I'm taking now is to use the H2 embeddable, all-Java DB. It has pluggable backing stores, so I can make it pretend that direct byte buffers are disk-like. I don't really need write concurrency, transactionality, and all the other stuff "real" RDBMS systems provide, but this seems like a good trade-off compared to rolling my own in-memory sort-of DB. It may turn out to be fast enough to just run H2 in a disk-based mode.

Does anyone have any thoughts on this?

<comment><USER3> You might also look into Berkeley JE. It's an in-process KV store, which might be a minor crimp for you, but it's more mature than god and transparently handles paging to disk and shadowing. We used it as durable working memory for a high volume stream-processing application, bundling rows together into pages, compressing them, and then letting JE handle caching and GC. It does an excellent job.

[http://www.oracle.com/technetwork/database/berkeleydb/overvi...](http://www.oracle.com/technetwork/database/berkeleydb/overview/index-093405.html)

License for server usage is Sleepycat. <http://en.wikipedia.org/wiki/Sleepycat_License>

</comment></comment><comment><USER2> It seems that there are genres of problems for which much better performance and/or memory efficiency may be achieved by avoiding Java's object model and garbage collection. In my other comment in this thread, I mentioned my use case for in-memory database-y stuff. What else? Terracotta sells its "Big Memory" plug-in for EHCache which is basically a ByteBuffer-based in memory cache designed to reduce the number of objects visible to the garbage collector. Certainly manipulation of binary media formats qualifies (and the nearly-abandoned Sun/Oracle-provided libraries for doing so use such approaches, IIRC). What else?

</comment><comment><USER4> Actually, the rest of his articles are also of topnotch technical quality. Me like!

<http://www.kdgregory.com/index.php?page=programming>

</comment><comment><USER2> Thanks. We've also considered SQLite. One Java wrapper impl (all are 3rd party) makes it easy to pass a direct byte buffer in as a persistence store. So, one could keep a map of database blobs and apply the DB to them as necessary. If H2 is fast enough, I'll take the all-Java solution so that we don't have to worry about native code issues between environments.

I'll have to think about how much I need actual SQL support. It sure does make a couple of my use cases easy (data aggregation), but it may come at a performance/memory footprint cost.</comment>


Self-XSS to Site-Wide CSRF on Twitter - <AUTHOR> https://speakerdeck.com/filedescriptor/killing-with <comment><USER2> Cool, I liked it included blind alleys, too often people include just what worked to seem smarter.

<comment><AUTHOR> For sure. It definitely echoes the thrill of bug-hunting when you know you've found something interesting but need to dig a bit deeper.</comment></comment>


PostgreSQL 9.5.2 is now available on Amazon RDS - <AUTHOR> https://forums.aws.amazon.com/thread.jspa?threadID=222676&start=25&tstart=0 <comment><AUTHOR> ...and compared to the previous major upgrade, it's now finally possible to upgrade an instance instead of having to export/import all data!</comment>


Incredibly cheap shelter for those in need - <AUTHOR> http://hexayurt.com/

<comment><USER2> I'm really not getting what makes these special, compared to any other type of hut thrown together with available materials.</comment>


"There will be a [Senate] vote" to reinstate net neutrality, Schumer says - <AUTHOR> https://arstechnica.com/tech-policy/2017/12/there-will-be-a-senate-vote-to-reinstate-net-neutrality-schumer-says/ <comment><USER2> Which is exactly what Ajit Pai said should happen. Back when Wheeler first implemented Title II, he said that such a big decision should not be decided by unelected people like himself and that it should be up to Congress.

<comment><USER3> Ajit Pai was talking about legislation, not Congress using its power to review regulatory acts to veto his repeal of the Open Internet Order.

I meant, if he wanted the old order dealt with that way, he wouldn't have done a repeal, he would have just left it to Congresd to use it's review authority, which it could have and did not.</comment></comment>


Presidio: Customizable data protection and PII data anonymization service - <AUTHOR> https://github.com/microsoft/presidio <comment><USER2> The core of the product is a bunch of regex or something smarter?

Odd that a product that want you to base your legal safety is not more transparent about the actual implementation on the initial page, instead it reads like an advertisement for closed source SaaS.

<comment><USER2> answering myself, yes. It is a pile of regex

[https://github.com/microsoft/presidio/blob/master/presidio-a...](https://github.com/microsoft/presidio/blob/master/presidio- analyzer/analyzer/predefined_recognizers/credit_card_recognizer.py)

and i can't find the body of test data easily... that's not good.

<comment><USER3> They also have a NLP engine, the regexes are just predefined recognizers for known formats.

[https://github.com/microsoft/presidio/tree/master/presidio-a...](https://github.com/microsoft/presidio/tree/master/presidio- analyzer/analyzer/nlp_engine)

</comment></comment></comment><comment><USER4> Hey, I'm one of the maintainers of Presidio OSS. We built this tool mainly for Microsoft's strategic customers and decided to open-source it for others to use. No hidden agenda here.

The engine has two main advantages: It's easily expandable and customizable, and it works well at scale. We do know of organizations who are very close to production with it.

Every organization has their own requirements for PII entities, many of them specific to the org itself, so the engine allows a developer to easily add support for new PII entities using code, regex or black-lists.

See hree: [https://github.com/microsoft/presidio/blob/master/docs/custo...](https://github.com/microsoft/presidio/blob/master/docs/custom_fields.md)

As for the productization aspect, we did some performance tests and are confident with taking it to production. Single instance cluster with a medium size machine has a ~65ms response time for a 100 word sentence. Using better machines lowers the response time to ~24ms for 100 words and 150ms for a 1,000 words input.

The current service uses regex for known patterns and Spacy for named entity recognition (person names, places etc.). Users often built custom ML models to detect new types of entities.

Presidio is free, completely transparent, and fully customizable. Feel free to use it and let us know what you think.

</comment><comment><USER5> Still some work to do ; on their demo page [1]:

"Simply follow the instructions" -> "Simply follow the <US_DRIVER_LICENSE>" ; same for "contribution". So I'm guessing some overly eager regex is to blame, which doesn't make you super confident about using this for something sensitive.

[1] [https://presidio-demo.westeurope.cloudapp.azure.com](https://presidio- demo.westeurope.cloudapp.azure.com)

<comment><USER6> To be fair, there are different levels of detection [1], the demo is probably using the weakest one.

[1] [https://github.com/microsoft/presidio/blob/74ea983cc50ff76d7...](https://github.com/microsoft/presidio/blob/74ea983cc50ff76d7fc734683ca897ff01ceb9ba/presidio- analyzer/analyzer/predefined_recognizers/us_driver_license_recognizer.py#L17)

<comment><USER4> Thanks, this is indeed the case. the US_DRIVER_LICENSE confidence is 0.01 and the demo doesn't put any threshold on the response. We're working on fixing the demo.

</comment></comment></comment><comment><AUTHOR> License: MIT

Demo: [https://presidio-demo.westeurope.cloudapp.azure.com/](https://presidio- demo.westeurope.cloudapp.azure.com/)

Documentation: [https://github.com/microsoft/presidio/blob/master/docs/index...](https://github.com/microsoft/presidio/blob/master/docs/index.md)

</comment><comment><USER7> I can see this being used to detect accidentally leaked sensitive content (for example scanning repos, outgoing emails, shared folders).

However using this to redact material sounds a bit risky. Are there some use case where you could accept the potential mistakes (missing something that should have been redacted)?

</comment><comment><USER8> My first thought was it was related to the cloud security company Presidio not MS.

<comment><USER9> Although Presidio would like you to think they are cloud security (higher margins) they are really just a VAR/reseller. Weak services but they will sell you stuff. So will I!

More importantly, this is proximate enough that they may sue for the name, OP.

</comment></comment><comment><USER10> This is good.. just need a hashbytes formula for Excel to make anonymization accessible to the majority of MS customers who are fumbling around pii haphazardly.

</comment><comment><USER11> Is anyone using presidio in production?

</comment><comment><USER12> What a horrible name

<comment><USER13> I kind of agree with you.

From the README.md: Presidio (Origin from Latin praesidium 'protection, garrison')

In Spanish sounds like prison, or related to prison. An inmate can be called presidiario. Same root as the latin presidium.

</comment></comment><comment><USER14> Please everyone:

Before you brand your software, google the name! It's not difficult!

[https://www.presidio.com/](https://www.presidio.com/)</comment>


Show HN: Autovpn – easily connect to a VPN in a country of your choice - <AUTHOR> https://github.com/adtac/autovpn <comment><USER2> Even by typical standards this is grossly insecure.

The client downloads the contents of :

[http://www.vpngate.net/api/iphone/](http://www.vpngate.net/api/iphone/)

Then it looks for entries which match the selected countries, runs base64 decode on them, and writes out that decoded data to /tmp/openvpn.

The last step is to run "sudo openvpn /tmp/openvpn".

So pretty much, if the remote host wanted to, they could run arbitrary commands on your host, as root.

Personal bugbear: Assuming sudo is installed, and enabled. If you need root permissions make that clear and fail with an error.

</comment><comment><AUTHOR> You know, when you need a VPN for a few seconds to pretend like you're in another country :)

Goes without saying - please don't use this for anything data sensitive.</comment>


Apple's Decision To Make The New iMacs Super Thin Was A Mistake - <AUTHOR> http://www.businessinsider.com/apples-imac-is-too-thin--review-2012-12

<comment><USER2> Disagree!

I often travel with my iMac, precisely because it is so thin. I can fit it into my suitcase along with lots of clothes and bring it on trips with me. Sure, a laptop would work as well, but it's not nearly the same thing.

Over time as Moore's law does its thing, we'll probably see a convergence of form factors and an iMac will simply be a larger MacBook/MBA/iPad.

</comment><comment><USER3> "Most people aren't carrying a desktop computer around, so it doesn't matter if it's light."

My iMac is one heavy machine. We've nicknamed behemoth for a reason. I don't have to move it that often, but those memories of when I do are strong. Especially since we don't have a car and had to walk and/or use the bus with it a few times over the last two years.</comment>


Scribe: A document specification language and its compiler (1980) [pdf] - <AUTHOR> http://reports-archive.adm.cs.cmu.edu/anon/scan/CMU-CS-81-100.pdf <comment><USER2> The importance of Scribe was that it introduced _semantic markup_. Previously, formatters -- at least, all those I ever used or heard of -- had only _physical_ markup commands: change to this font, indent by this much, insert this much vertical space, etc. Semantic markup, in contrast, specifies the _intent_ rather than the details: emphasize this phrase, make a heading, make a numbered or bulleted list, etc.

While Scribe itself was never used very widely -- it ran on PDP-10s, as I recall, and was quite slow -- Reid's ideas influenced a number of other designs, most notably those of HTML and LaTeX. (Less notably, but I can't resist mentioning: there was a microcomputer re-implementation of much of Scribe that I did some work on in 1980-1983, that was initially called Scribble, then the FinalWord formatter, and eventually the Borland Sprint formatter [0] [1].)

[0] [https://en.wikipedia.org/wiki/Scribe_(markup_language)](https://en.wikipedia.org/wiki/Scribe_\(markup_language\))

[1] [https://en.wikipedia.org/wiki/Sprint_(word_processor)](https://en.wikipedia.org/wiki/Sprint_\(word_processor\))

<comment><USER3> The Symbolics Lisp Machine came with a Scribe implementation in Lisp.

Also the CMU CL documentation was written in Scribe, IIRC.

<comment><USER4> IIRC, the first edition of CLtL was written in Scribe as well, before being re-rendered in LaTeX for the second edition.

</comment></comment></comment><comment><USER5> Two interesting documents produced with Scribe were the 1985 editions of Adobe's red and blue books, the _PostScript Language Reference Manual_ and _PostScript Language Tutorial and Cookbook_ , published by Addison-Wesley. The colophon in the blue book explains the publishing workflow:

      Camera-ready copy for this book was created entirely with
      PostScript and printed on a Linotron 101 at Adobe Systems
      Incorporated. The book was created with the aid of the Scribe
      Document Production System (a product of Unilogic, Ltd.) as a
      Scribe document definition. The illustrations were PostScript
      program segments which Scribe integrated and placed on the
      pages along with the formatted text portions.

      Successive drafts of the book were processed with Scribe, each
      time generating a single PostScript print file. The book was
      proofed when needed by printing the file on an Apple
      LaserWriter PostScript printer. The final version was printed
      without modification on a Linotype Linotron 101 typesetter and
      delivered to Addison-Wesley. No manual paste-up of any kind
      was required.

</comment><comment><AUTHOR> Brian Reid won the Association for Computing Machinery's Grace Murray Hopper Award for this in 1982.

</comment><comment><USER6> I used Scribe extensively under Tops-20 and printed the results on a Diablo 630. Here is an excerpt from the top of one of my theses just for reference.

@make(report)

@style(paperwidth 8.5 inches, paperlength 9.5 inches)

@style(leftmargin 1.0 inches, rightmargin 1.0 inches)

@style(topmargin 0.5 inches, bottommargin 1.0 inches)

@pageheading(right "@ref(page)")

@style(spread 1, indentation 5)

@style(spacing 2)</comment>


The Cryptopocalypse - <AUTHOR> http://www.schneier.com/blog/archives/2013/08/the_cryptopocal.html <comment><USER2> I think the authors of the presentation† would agree with Schneier about the math, and I know Tom Ritter's working on a bit of a follow-up. But I don't think they'd agree on Schneier's message here, which is that people who use RSA have nothing to worry about. The Joux small-char DLP stuff isn't going to directly impact RSA, but RSA in its most commonly used key size (1024 bits) is not secure, and the next common size up (2048 bits) is ~5x slower. It's past time people started moving away from RSA.

† _My name is first listed among them but I did literally no work on it; I 'm as confused as you are, but flattered._

<comment><USER3> What do you use for your SSH key. RSA? Just curious. As far as I know RSA and DSA are the only options for SSH, or is that wrong?

<comment><USER4> Recent versions of SSH (6.1p1 on Ubuntu 13.04) support ECDSA, [http://en.wikipedia.org/wiki/Elliptic_Curve_DSA](http://en.wikipedia.org/wiki/Elliptic_Curve_DSA)

Unfortunately, gnome-keyring-daemon can't deal with those keys...grrr.

<comment><USER5> As of GnuPG 2.0.21, gpg-agent can deal with ECDSA keys, which is quite nice.

</comment></comment></comment></comment><comment><USER6> Remember folks: people may be capturing and storing your SSL traffic now. If there is a huge advance in factoring 5 or 10 years from now, they'll be able to decrypt all your traffic from today.

</comment><comment><USER2> Matthew Green breaks this down in considerably more detail here; highly recommended:

[https://news.ycombinator.com/item?id=6238305](https://news.ycombinator.com/item?id=6238305)

</comment><comment><USER7> If I read this correctly, Schneier is saying that "increasing key size will be enough to stay ahead of the advances in factorization for the foreseeable future." I hope this is true. But I think I'll stick to my guns, saying that RSA will be broken (with)in 5 years.

</comment><comment><USER8> Even if RSA is broken tomorrow, we already have many other algorithms for asymmetric encryption that do not depend on factoring and can't be broken even with a quantum computer, like the McEliece cryptosystem. We only would need to change the standard quickly like when MD5 was broken.

<comment><USER2> However true that is, it doesn't really respond to anyone's point (Schneier's or Ritter/Samuel's); nobody involved in this was saying something like "crypto is dead".

<comment><USER8> Indeed, but then he could go with a less scary title than "The Cryptopocalypse". "RSApocalypse" maybe.</comment></comment></comment>


GNU Wget - <AUTHOR> http://legalhackers.com/advisories/Wget-Arbitrary-File-Upload-Vulnerability-Exploit.txt <comment><AUTHOR> GNU Wget before 1.18 when supplied with a malicious URL (to a malicious or compromised web server) can be tricked into saving an arbitrary remote file supplied by an attacker, with arbitrary contents and filename under the current directory and possibly other directories by writing to .wgetrc. Depending on the context in which wget is used, this can lead to remote code execution and even root privilege escalation if wget is run via a root cronjob as is often the case in many web application deployments.

Full advisory and exploit at:

[http://legalhackers.com/advisories/Wget-Arbitrary-File- Uploa...](http://legalhackers.com/advisories/Wget-Arbitrary-File-Upload- Vulnerability-Exploit.txt)

Regards, Dawid Golunski</comment>


Movies where credits scroll down - <AUTHOR> https://www.imdb.com/search/keyword?keywords=credits-rolling-down&sort=release_date,asc&mode=detail&page=1 <comment><AUTHOR> See also [https://movies.stackexchange.com/questions/1478/which- movie-...](https://movies.stackexchange.com/questions/1478/which-movie-did- top-to-bottom-credits-first)</comment>


Ask HN: Best Way to implement Responsive Design - <AUTHOR>

Hey Hacker extraodinaires,
I'm looking for advice/input/critique from anyone on my following implentation for a fairly high trafficed site (50k + monthly), that's going responsive (ie. mobile design (images/videos/css) for Phones and Tablets )
Here's my current Responsive Design Implementation:
1. On a the HTTP request I get the device ( Tablet, Phone, or Desktop ). 2. Based on the device type I make general assumptions about a relative screen size. ( for instance, 320x480 for Phone) and send the HTTP response with a basic template for videos,images,css,js, etc. 3. Now inside my css using media queries I handle for divergences on screen size. 4. Also currently I have no really good way to optimize images - I'm especially interested in any ideas/links/articles related to this for responsive design.
Thanks! <comment><USER2> First, how are you getting the device? Second, don't assume screen size = low bandwidth, and DON'T assume that just because someone is using a small screen, that means they are only interested in 'mobile' content. You should be using one set of HTML markup for one URL. The Media Queries should determine the styling and layout differences.

Also, don't feel like you have to have media queries for every major screen width(320,480,768, etc...). Start out with a linear, 'mobile/small screen' first layout, and then increase width and see where the design or layout could use refinement, or breaks totally, and then add a media query and adjust for that resolution.

Good luck!

For articles/links, follow @RWD and read the book he wrote, if you haven't already.

For images, look at <picture> polyfills and keep an eye on what's going on with the Responsive Images community group. - <http://www.w3.org/community/respimg/>

(by the way, my web design app, Edit Room will handle all of this gracefully for you very soon, and gives you visual layout, design and content organization tools to build finished designs without initial coding. <http://www.edit-room.com> )

<comment><AUTHOR> I'm getting the device by the User-Agent Header with a regex, but I'm curious, why shouldn't we go with small screen == mobile, the largest mobile width I know of is 800px, and occording to most stats I've seen, that seems to account for less than 2% of all desktop users.

Thanks for the links - also good luck with edit-room.com!

<comment><USER2> Thanks :)

Basically, people use their phones/devices from home, not just on cell networks, and can have plenty of bandwidth on wifi. If a site is designed well and the type is readable, people use them lots more. With a small screen, you can only assume one thing - a small screen :)

</comment></comment></comment><comment><USER3> Have you looked at Twitter Bootstrap's Responsive scaffolding?

[http://twitter.github.com/bootstrap/scaffolding.html#respons...](http://twitter.github.com/bootstrap/scaffolding.html#responsive)

</comment><comment><USER4> I recently heard about picturefill, it looks pretty cool to me! <https://github.com/scottjehl/picturefill>

</comment><comment><USER5> splatcollision's answer is double-triple good, so I won't try to revisit any of what he said, except to say that having done it once (fairly painfully, though that was before Sass and Less were as pervasive), I've found 'Skeleton'[1] to be a great head start (if you're willing to use its grid system, which I like a ton more than any other grid system I've seen.)

[1] - <http://getskeleton.com/></comment>


Ask HN: I'm at AWS Reinvent. Which booths do you recommend to check out? - <AUTHOR> <comment><USER2> RedHatCloud is giving away caricatures > [https://twitter.com/anniep0206/status/935973905331712000](https://twitter.com/anniep0206/status/935973905331712000)

</comment><comment><USER3> My friend is at Weaveworks, and I hear they're giving away socks.

</comment><comment><USER4> Check out the selectstar.io booth.

</comment><comment><USER5> Checkout Cilium Booth</comment>


The Egg – A Short Story - <AUTHOR> https://www.youtube.com/watch?v=h6fcK_fRYaI <comment><USER2> You must be a philanthropist. I utterly agree to your opinion.

</comment><comment><USER2> Thanks for the a-ha fact.</comment>


The Class that built Apps, and Fortunes - <AUTHOR> http://www.nytimes.com/2011/05/08/technology/08class.html?pagewanted=all

<comment><USER2> As someone who knows a lot of the people written about here, I think this article says a lot more about the reporter than the people in it. Every now and then the Times publishes a story that completely lacks the kind of level- headedness that one would expect from an editorial process, and this is one of those stories.

Most of the people mentioned in the article are smart individuals--I have a lot of respect for Joachim's programming talent especially--but back in 2007, the amazing growth in their respective applications was due to Facebook's poorly-thought-out policies regarding application spam (and these apps all sent an unthinkable amount of spam, much of it misleading), not the Stanford class, and not some formula. It's possible to know this because once Facebook changed those policies (because of apps like the ones mentioned in the article), the growth immediately stopped. Most of the apps haven't existed in any meaningful form, if at all, for years.

Where are the articles about startups that have made great advances in tackling the enormous problems that plague the country? Those are the stories I'd rather read.

By way of full disclosure, I was Ed's co-founder at a startup he was also running in 2007 called Qubescape--not the one mentioned in the article. A lot of that venture's code became part of FaceCash, which I am currently working on. Ed started new with an app called PhoneBook and then friend.ly.

<comment><USER3> Thank you for posting this. I think you underestimate how common these sorts of stories are in the NYT. They stand out when the reader knows enough detail about the subject being written about to see that it's largely made up... a story concocted around a few quotes and a few facts.

This is the main reason why I've stopped reading the NY Times on a regular basis.

<comment><USER4> It's the main reason I've stopped reading most mainstream media at all. Professional journalists just can't compete in most domains with actual practitioners. From Engineering to Law, it's almost invariably better to seek news of the field from practitioners' blogs.

</comment></comment></comment><comment><USER5> In an article where many, I am sure, see clear indication of a social bubble, I choose to see unbridled enthusiasm of a young tech community who were quick to see the potential of a growing social network and was equally quick to capitalize on its growth.

Sure, many of these apps have no actual depth to talk about, but they stand for "build quick and cheap, perfect later" which resonates with me and many others. Also, what good is a business or technology education that costs you a couple of hundred grand, unless it gives you an opportunity to recoup some of that before you graduate.

I really wish there are more "Facebook classes" or just classes where tutors challenge you to build ideas to fruition regardless of whether it makes one a millionaire or not. I am trying to do this in Richmond, Virginia with a couple of others, and trying to signup some patron saints from the business and technology community in the region to help out in this effort. For a region that has three Universities in a 50 mile radius (UR, VCU and UVA), we sure dont have a startup ecosystem here and it seems we have squandered that opportunity so far.

</comment><comment><USER3> Major universities are not responsible for this sort of innovation.

It's usually people trying to get a break from the mainstream course selection and expected trajectory that end up doing something innovative to quell their boredom or do some mischief.

</comment><comment><USER6> I was very confused for a second while reading the title, for some reason my brain associated 'fortunes' with a very different kind of fortune: <http://fortunes.cat-v.org/></comment>


Google Accidentally Pushed Internal November 2018 Security Update to Pixel User - <AUTHOR> https://www.bleepingcomputer.com/news/google/google-accidentally-pushed-internal-november-2018-security-update-to-pixel-user/ <comment><USER2> Based on the scant details provided by TFA this sounds like a classic case of fat fingering a username or email.

<comment><USER3> That would mean that anyone could receive an "update" at any time?

<comment><USER4> Anyone does receive updates on modern phones at any times, what are you asking?

<comment><USER5> "Could Google be compelled to send a update to a user's phone that allowed a government agency remote access?"

I think most of us know the answer is yes.

<comment><USER4> I think you should substantiate what you said. Preferrably by the link to the relevant service / or source that would do that.

OTA installation is opt-in at this point, just like on Apple phones. It does download automatically if you have option set... just like on Apple phones.</comment></comment></comment></comment></comment>


The Hipster PDA (2004) - <AUTHOR> http://www.43folders.com/2004/09/03/introducing-the-hipster-pda <comment><USER2> I still use this method, except I lean towards very large binder clips and several stacks of cards (work, personal general, personal writing project). I keep piles of blank cards on my desks at home and work and I stock up when they are BOGO or on closeout. The key is to have so many on hand that you have absolutely no mental barrier to using them up or recycling them.

The main things I like about it: I generally have a pen around so it's very easy to add a note without fumbling around for any more window real estate on my computer. I can review/purge/recycle stuff in a diner or cafe over coffee without using a laptop. If I spill coffee on it, it doesn't matter. And it feels good when I can recycle a card because the work it represents is either finished or now unnecessary. Also, I don't have to worry about being unable to look something up or organize some tasks if a battery goes dead.</comment>