SSDs lose data if left without power for just 7 days - <AUTHOR> http://www.ibtimes.co.uk/ssds-lose-data-if-left-without-power-just-7-days-1500402 <comment><USER2> The paper took something out of context, didn't really understand what it reads and published nonsense.

The original blog post linked from the article is [https://blog.korelogic.com/blog/2015/03/24#ssds-evidence- sto...](https://blog.korelogic.com/blog/2015/03/24#ssds-evidence-storage- issues)

It actually raises a point for a specific use-case, when a computer with an SSD is taken for analysis (f.ex. a court case as evidence by the police) the SSD is kept powered off and may lose its data and thus be worthless as evidence after some time if the system is not kept in a normal temperature (around 25C).

It's not a normal use-case and in fact it may be to the benefit of the user to use an SSD in that case in the hope that the data will self-destruct with complete plausible deniability.

</comment><comment><USER3> What a bunch of nonsense... Here is the presentation: [http://www.jedec.org/sites/default/files/Alvin_Cox%20%5BComp...](http://www.jedec.org/sites/default/files/Alvin_Cox%20%5BCompatibility%20Mode%5D_0.pdf)

All what they found is that there's a correlation between load, the operation temperature during which data was stored, and the ambient temperature in which the device is kept while switched off. This means that at an active operational temperature of about 40c (which is normal for most consumer drives) and a storage temperature of 30c (which is pretty much the upper maximum of storage temperatures under residential conditions) your drive will retain data for at least 52 weeks.

<comment><USER4> > and a storage temperature of 30c (which is pretty much the upper maximum of > storage temperatures under residential conditions)

That might be a normal storage temperature, but it certainly doesn't seem like a maximum. For instance, during the summer, an attic or similar unconditioned enclosed storage area can easily exceed 40C during the day.

> your drive will retain data for at least 52 weeks.

That seems far too short. I'd like to see similar data for mechanical drives and USB disks, but given the way flash storage works, I'm surprised that the powered-off lifetime is that short; I'd have expected decades. I'm curious what the actual failure mode is; what physically happens to the drive to make it lose data?

I also find the charts in that presentation interesting: data retention really _increases_ when storing data at a higher temperature? So for data retention, it's better for the drive to run _hot_?

<comment><USER2> The spec is for the worst performance possible at end-of-life time. So a new drive will retain the data far longer than 3 months or 1 year of the spec (enterprise vs consumer spec) but a drive after five years of full writes will retain for near-spec or it will be considered a failure and you can ask for a refund.

The failure mode is that there are only about 50 electrons in that charge trap of NAND flash these days and they can disappear on their own and they will disappear after enough time and when they do you don't have the voltage you should have and so can't read the bit value you stored in it. After enough such bits become incorrect you can no longer fix the block with the ECC and then you no longer have the ability to read the original data.

It should be noted that the more worn out the drive is the easier it is for the electrons to disappear from the cell. Which is why a new drive retains data perfectly well but an old drive can barely hold itself.

</comment></comment></comment><comment><USER5> Someone missed an important part of the standard (JEDEC JESD218, section 6.3): "This standard is based on a use scenario in which the SSDs are actively used for some period of time during which the SSDs are written to their endurance ratings, followed by a power-down time period in which data must be retained."

E.g. in Intel's product spec for the DC S3500 series, the data retention parameter is specified as: "3 months power-off retention once SSD reaches rated write endurance at 40 °C".

</comment><comment><USER6>
      According to a recent presentation by Seagate's Alvin
      Cox, who is also chairman of the Joint Electron Device
      Engineering Council (JEDEC), the period of time that data
      will be retained on an SSD is halved for every 5 degrees
      Celsius (9 degrees Fahrenheit) rise in temperature in the
      area where the SSD is stored.

"SSDs scary," says leading manufacturer of mechanical hard drives. "Mechanical drives good! SSDs baaaaaad! You like good, yes?" he added.

<comment><USER7> Seagate is also a manufacturer of SSDs…

<comment><USER3> Seagate only recently bought a NAND supplier, all the mechanical disk companies have major issues these days because they were too late for the SSD game. They thought that they could improve both the density of the storage and the performance before SSD's could catch up on the former and drastically surpass them on the latter.

In the "early" days of SSD's they didn't offered that much better performance especially in the enterprise storage arena than highend SAS/FC drives.

Both with improvements in controllers, the development of dedicated protocols for SSD drives and the usage of a cheaper alternatives to FC in the form of PCIexpress coupled with ever increasing storage density even in the enterprise market SSD's are pretty much setup to take the entire storage market.

In consumer grade computing you only see mechanical disks in entry level notebooks ("SSHD's usually with 16-32GB of SSD storage for OS and Cache"), for for home network attached storage. 1TB consumer SSD's already can be bought under the 400$ mark, and the closest mechanical drives with the same capacity in terms of performance (still quite below the SSD) which are the "professional grade" 10-15K RPM drives cost about the same. It's probably just a question of 2-3 years before mechanical drives will be almost completely written off the market, they already don't make much sense for enterprise storage since they provide a cheaper alternative to high performance storage even before you count the savings on electricity and cooling, and soon they wont make sense for everyday consumers either.

</comment></comment></comment><comment><USER8> Terrible article. The actual presentation in question is at [1]. The presentation has nothing to do with performance in the field. Instead the presentation is regarding JEDEC requirements, for which the relevant specification is that "enterprise" class SSDs must retain their data when powered off at 40C for 3 months.

1: [http://www.jedec.org/sites/default/files/Alvin_Cox%20%5BComp...](http://www.jedec.org/sites/default/files/Alvin_Cox%20%5BCompatibility%20Mode%5D_0.pdf)

</comment><comment><USER9> I assume 7 days is worst-case scenario, corporate-level drive quality (which is lower than consumer-grade) plus high temperature?

Is it becoming necessary to switch to a filesystem that ensures data integrity with redundancy and regular checksums?

<comment><USER3> most corporate level SSD's are actually better than entry level consumer ones.

<comment><USER9> Not according to the article :O

I presume it is assumed that corporate policy has better data integrity best practices than your average Joe Homeowner.

<comment><USER3> Read the presentation this was the load testing for the Enterprise test, it's pretty much a torture test with 100% load time.

With this I'm actually surprised that the SSD's lasted as much as they did, for about 6 years now I've been using SSD's and the longest one of them survived so far is less than 18 months, and at much lower loads than what they've tested in. Since late 2008 I've been always running 2 SSD's for my main system drive in raid 0 with no much load on them other than games, some work stuff and the OS. At any point in which the drive has no more spare blocks to relocate failed blocks too i toss it away and replace it (if read errors come close to critical i do the same). For the first couple of years the SSD's only lasted for about a year(my first Intel pair lasted something like 5 months, but those were shitty controllers), this time with the Samsung 840 EVO's i have a feeling that they might actually last the whole 2 year span of my desktop.

</comment></comment></comment></comment><comment><USER10> this is a joke right?

</comment><comment><USER11> This terrible article is actually a great example of a submarine. Note the mention of a completely irrelevant "security" company halfway down, and then a link to their blog post.

In any case, it's terrible because it takes testing criteria under extreme conditions (don't store your SSDs at 55C) and then fearmongers this as the norm.

<comment><USER12> submarine?

<comment><USER13> It's a reference to a PG essay where he talks about how PR agencies often give press releases and news stories that are little more than hidden adverts by reporting selective truths: [http://www.paulgraham.com/submarine.html](http://www.paulgraham.com/submarine.html)

<comment><USER14> Sounds similar to the 'churnalism' concept.

[https://en.m.wikipedia.org/wiki/Churnalism](https://en.m.wikipedia.org/wiki/Churnalism)</comment></comment></comment></comment>


Ask HN: Web App for Managing Collections of URLs - <AUTHOR> Hi HN, I am trying to find a web app, preferably open sourced, that helps managing and organizing collections of URLs. Ideally it should support tagging, commenting, and lightweight search by tag and keyword. I am considering building one for personal use but that's the last option if there's no existing apps with similar offerings. <comment><USER2> I have such a project I am working on. It hits most of your points.

It's foss, and designed to be durable and portable.

It's actually for managing text files, but you can put links inside text files.

Commenting is performed by referencing text file via its hash like so:

\--- >>abcdefghc0ffee this is comment #approve #vacationshots \---

The tags in reply actually apply to the parent, so this is how tagging is accomplished.

It could handle a collection of up to 50,000 textfiles at the moment on the average system, past that there will be performance issues, but I'm working on that.

Features planned coming soon:

Adding links for URLs (currently displayed as text)

</comment><comment><USER3> raindrop.io

Has many features for free, cross-platform (except linux, but has web app and extensions so runs in your browser). Collections, tagging, etc

Premium plan has archiving pages (in case they die or URL's break) and nested collections.</comment>


Justin.tv for iPhone Racks Up 355,000 Downloads in First Week - <AUTHOR> http://mashable.com/2010/03/31/justintv-iphone/

<comment><USER2> It's a free app? Seems like they could have charged $4.99 for it, and still sold about as many... Wonder what the decision went like to make it free.

<comment><AUTHOR> The difference between $0 and $5 is pretty huge. We would have sold some (maybe even lots) at $5, but about as many? I can't imagine that.

The decision to make it free was a result of the market (how much other apps cost) and our goals (revenue, usage, branding, growth, etc).

<comment><USER3> I would guess you wouldn't even sell 5% as many at $5. You're in a land-grab now, it would be nuts to even think about charging. Even if you did sell that many for $5, $1.5 million will end up small potatoes when the final chapter on the live online streaming video book is written.

<comment><USER4> While what justin.tv does is interesting, lets not get over our heads already. Youtube just needs to flick a switch to make most live video stream obsolete.

<comment><USER5> If by "flick a switch" you mean "re-architect their entire system to make low- latency highly-scaleable live video streaming cost effective", then I guess I agree with you. That's a pretty _big_ switch though.

<comment><USER4> In case you don't know youtube already provides live streaming for certain events in US politics. They also recently stated streaming live domestic cricket event with an estimated viewer ship of ~50 million people at any given time (<http://www.youtube.com/user/IPL> YouTube don't show view counts on live events).

About being cost effective. You highly underestimate Google/YouTube's ability to throw money around with no short-terms shavings or profit interest.

The only legitimate reason thats preventing YouTube from rolling out streaming (that I can think of) is having an effective way of preventing adult and copyright material streaming, which is quite common at justin.tv (I would argue that it is the main source of their traffic).

You can only do so much with software, you probably need manpower to continuously monitor and prevent illegal activity, which is happening live. The problem is not technical, the problem is legal and management.

I predict YouTube Live stream for all will happen sometime before the end of this year.

<comment><USER5> YouTube has relied on Akamai to provide the streaming infrastructure for all of its live events so far, and as far as we know it has no live streaming infrastructure of its own. Akamai costs a _lot_ of money - we actually overflow to them when our own infrastructure gets overloaded, but we try not to do that too often as it's prohibitively expensive.

<comment><USER4> "Live video is just something that we've always wanted to do, we've never had the resources to do it correctly, but now with Google, we hope to actually do it this year." - Steve Chen, co-founder of YouTube in 2008.

I think they are relying on Akamai till their own setup is ready to go. I think the argument that Youtube don't/can't have live streaming infrastructure is quite silly.</comment></comment></comment></comment></comment></comment></comment></comment>


Do Aliens Have Inalienable Rights? - <AUTHOR> http://nautil.us/issue/47/consciousness/do-aliens-have-inalienable-rights <comment><USER2> No. Not automatically.

Animals don't have rights. Not dolphins, not elephants, not chimpanzees, not bonobos, not octopus. Not even eusocial animals like ants or bees, which clearly form stratified societies, and live within complex structures of their own making.

There's no guarantee that aliens would enjoy anything beyond conservation status.

If no diplomatic channels can be established with human society, we'll see species from other worlds treated like animals.

</comment><comment><USER3> This all assumes that aliens aren't omnipotent compared to us human ants...we may be what's for supper...

</comment><comment><USER4> Yes, and so do sapient machines.</comment>


JS1k demo details: 2048 - <AUTHOR> http://js1k.com/2014-dragons/details/1813

<comment><USER2> Detection of the game-over state seems buggy: I had moves left on a full board then got the 'GG' modal.

</comment><comment><USER3> I got 4 x 16s first row, 4 x 8s second row, 4 x 4s 3rd row and 4 x 2s on last row just by pressing up.

Then it says game over.

This is wrong because I should be able to shift left / right and merge those same numbers that are matching in a row.

It seems it is game over if all 16 cells are filled in regardless if a move is still possible.

<comment><USER4> No, the problem is the it think it's over when you do a move and no numbers can merge. The board may be full, and you may have possibilities but you did a move where no numbers could merge.

Also; this version does not implement the random spawn (10% chance to spawn a 4 instead of a 2)

Still impressive for it's size though.

</comment></comment><comment><USER5> My original submission is here: [https://news.ycombinator.com/item?id=7406605](https://news.ycombinator.com/item?id=7406605)

Got nuked for some reason by HN's algorithm dropping it from nr 4 to the second page :(

<comment><USER6> More comments than votes?

<comment><USER5> Something like that. I think it had more comments than votes all the way up, it was when it hit 40 comments it got dropped.

Crappy algo, I would think that lots of comments indicates that people find it interesting... Next time I won't reply to peoples comments :/

</comment></comment></comment><comment><USER7> Wow, compressing the code further by doing find-replaces _on the code_. That is hardcore.

<comment><USER8> I still see a lot of redundancy there (e.g. "class", "Math", "font"). Maybe a real LZ packer could shrink it even more...

</comment></comment><comment><USER9> I wrote a <1k version of Threes, a similar game, for js1k:

[http://js1k.com/2014-dragons/demo/1667](http://js1k.com/2014-dragons/demo/1667)

<comment><USER10> Nice work, but unfortunately it doesn't seem to implement the card draw algorithm correctly, which leads to unplayable games pretty quickly (the card draw algorithm must pick the same number of 1s and 2s over a short time horizon for the game to be playable).

The actual algorithm used by Threes is as follows:

1\. At start, shuffle a deck containing 4 each of ones, twos, and threes.

2\. For each round, roll a 21-sided die. If it's a one and the largest value on the board V is >= 48, choose a tile that is randomly chosen from the range 3 to V/8 inclusive. Otherwise, take the next tile off the stack.

3\. If the stack is empty, refill it as above.

Here's a Scala implementation of this logic: [https://github.com/mwylde/Threes.scala/blob/master/src/main/...](https://github.com/mwylde/Threes.scala/blob/master/src/main/scala/com/micahw/threes/Game.scala#L176).

<comment><USER9> Yeah, I know- it's just drawing a random number. I didn't have space to improve on that.

</comment></comment></comment><comment><USER11> Good, but it's not the same game. Any move places a two. The original places a two or a four, and only if you can make a combo during that move.

Good code though! :)

</comment><comment><USER12> So, it places another block even if you don't move blocks, which vastly simplifies the game.

<comment><USER13> I noticed this too... it means you don't have to risk getting pieces on the wrong side of your pile just to keep moving things along.</comment></comment>


TextMateVim - The beauty of TextMate meets the power of Vim - <AUTHOR> https://github.com/philc/textmatevim

<comment><USER2> this is great. I've never been able to face plunging into Vim or Emacs because of the inevitable (if short term) loss in productivity... this looks like a nice way in.</comment>


Termbox-Go – A minimalistic Go curses library - <AUTHOR> https://github.com/nsf/termbox-go <comment><USER2> Another alternative to consider is [https://github.com/gdamore/tcell](https://github.com/gdamore/tcell)

termbox-go has a couple of pretty wicked global variables, and they caused me a surprising amount of issues last time I used it. By contrast, tcell has good interfaces, and it shows: tcell even has a SimulationScreen you can use for testing.

<comment><USER3> Interesting you should mention testing, since I use termbox (not termbox-go) in a teaching/exploratory project to come up with more testable OS primitives. Among other things, I implemented a fake screen for this project.

[https://github.com/akkartik/mu#readme](https://github.com/akkartik/mu#readme)

<comment><USER2> Wow, that's... just, wow.

> New, testable interfaces for the operating system.

So you implemented this at the _syscall_ level, and that just _happened_ to include a tty? Very neat.

<comment><USER3> Thanks! Though I don't want to overstate where we are at this point. I implemented all this at the "syscall" level for an extremely toy simulated computer. We don't really yet have the chops to implement syscalls in a real- world OS. But my collaborator and I have been slowly learning what we need. The first system we've been playing with is OpenBSD.

</comment></comment></comment></comment><comment><USER4> Last time I tried to use termbox (the C version), it required a build tool in python that I'd never heard of (waf), which then required me to do all kinds of yak-shaving to get up and running. All to compile a small C library.

I'm not saying waf is bad, I've never used it (obviously, since I failed to install it). But it was an annoying hoop to jump through.

I do think re-doing the old unix lib faithfuls is a Good Idea. A cleaner curses like library with a better interface would be great.

<comment><USER3> Once I got it running, I figured out what commands waf was running and then ripped it out. You can see my changes inlined at [https://github.com/akkartik/mu/tree/master/termbox](https://github.com/akkartik/mu/tree/master/termbox)

 _Edit_ : ack, sorry I momentarily forgot that I also recently ripped out my project's dependence on `make`. You can see my old makefile at an earlier commit: [https://github.com/akkartik/mu/blob/d9ee2076d9/termbox/makef...](https://github.com/akkartik/mu/blob/d9ee2076d9/termbox/makefile)

<comment><USER4> Wow, it was as simple as that. Legend!

</comment></comment></comment><comment><USER5> I'm a fan of this library -- I used it to build Hecate ([https://github.com/evanmiller/hecate](https://github.com/evanmiller/hecate)), a terminal hex editor. If you get creative with Unicode box and box-drawing characters, you can build some interesting interfaces (tabs, progress bars, etc).

</comment><comment><USER6> Speaking of Go and terminals, is there a library that doesn't take over the whole screen? For example, let's say I want to display a three-line progress bar. I want to update just that three-line area, and when done, remove all the lines and continue from there, and otherwise just integrate into the text flow of the terminal.

<comment><USER7> I don't know about Go, but there's quite a nice similar library for Haskell, [https://hackage.haskell.org/package/concurrent- output](https://hackage.haskell.org/package/concurrent-output)

<comment><USER6> Right, I'd love something like that for Go.

<comment><USER8> You might try this from my co-worker: [https://github.com/sethgrid/multibar](https://github.com/sethgrid/multibar)

<comment><USER9> Nice, thanks. I'd like something like that, but generalized for any output, not just progress bars.

</comment></comment></comment></comment></comment><comment><USER10> I was looking at termbox-go but then came across gocui[0], which uses termbox- go to do some really quite powerful things.

[0] [https://github.com/jroimartin/gocui](https://github.com/jroimartin/gocui)

</comment><comment><USER11> my stackover question from August 2016 [http://stackoverflow.com/questions/38728614/how-do-i- control...](http://stackoverflow.com/questions/38728614/how-do-i-control- where-text-is-printed-to-console-via-fmt) before i knew the term curses. Thank you photoionized, you changed my life.

</comment><comment><USER12> ...curses?

<comment><USER13> [https://en.wikipedia.org/wiki/Curses_(programming_library)](https://en.wikipedia.org/wiki/Curses_\(programming_library\))

The standard UNIX terminal UI library.

<comment><USER14> Link is to a Go lib for termbox, which is a Curses alternative. Title is inaccurate.

[https://code.google.com/archive/p/termbox/](https://code.google.com/archive/p/termbox/)

<comment><USER15> That site has the reason for Termbox. Simpler interface (good). No optimization of data sent because everything is fast now (really?) [https://code.google.com/archive/p/termbox/wikis/Rationale.wi...](https://code.google.com/archive/p/termbox/wikis/Rationale.wiki)

<comment><USER16> > No optimization of data sent because everything is fast now (really?)

As the link says it's a trade off between CPU and bandwidth. Most of us aren't using 9,600 baud terminals nowadays, so it seems like a fair trade-off.

I'd imagine these 'optimisations' include workarounds for the way certain hardware works as well:

"The terminal can operate at transmission speeds up to 19,200 baud. However, the terminal may not be able to keep up with incoming data. The terminal stores incoming characters in a 64-character buffer and processes them on a first-in/first-out basis. When the content of the buffer reaches 32 characters, the terminal will transmit 0238 (XOFF or DC3). On this signal the host should suspend its transmission to the terminal. Eventually, if the host stops transmitting, the terminal will deplete the buffer. When 16 characters remain in the buffer the terminal will transmit 0218 (XON or DC1) to signal the host that it may resume transmission."

[http://www.vt100.net/docs/vt100-ug/chapter3.html](http://www.vt100.net/docs/vt100-ug/chapter3.html)

<comment><USER15> My goodness that's a terrible thing to have to deal with. But the termbox page says "But nowadays we don't have terminals anymore! We have terminal emulators which reside on the same machine. Exchange rates are not a problem anymore." So it still sounds like its assuming you are going to localhost and not over the internet so there is no need to compact the VT100 codes that are sent.</comment></comment></comment></comment></comment></comment>


Researchers find critical vulnerabilities in Yahoo site, offered $12.50 per bug - <AUTHOR> http://www.geekwire.com/2013/researchers-find-critical-vulnerabilities-yahoos-site-offered-1250-bug/ <comment><USER2> I'm confused. If I put code out into the wild, as a website, as an application, as... whatever, I'm supposed to compensate people that take it upon themselves to poke holes in it?

I mean, I appreciate the effort and the time, but just because you run a large web service or any web service doesn't mean that I should pay you for vulns. You should receive my gratitude, anything more than that is being extra nice.

Now, is there value in posting that there is some bounty for these things? Will it result in better, more frequent disclosure and give me the ability to close holes before someone nefarious comes along? Absolutely. Until I do that, people shouldn't speculatively be doing research and then retroactively bitching about how little they got paid.

If you do work like that, please let me know, I've got some projects you can work on that I might decide to pay you for.

<comment><USER3> If you run a large web service, how much is it worth to you for vulnerabilities to be reported directly to you, versus being sold on the grey market to someone looking for an exploit?

<comment><USER4> That is a question you should be asking when you decide to post bounties. It is not a question you should be forced to ask after someone goes and finds vulnerabilities all on their own without your knowledge and then comes to you and asks for payment unbidden. That is called extortion.

<comment><USER5> You're right. As a result, white-hats should spend zero time with Yahoo (as the company in the article has indicated they will). The result of that is that only black-hats will be finding Yahoo vulnerabilities. Not a good end result.

What should happen is that Yahoo should have bounties in the first instance. They don't have to, but not having them leads to a bad outcome for everyone except black-hats.

</comment></comment></comment></comment><comment><USER6> There is something about offering a small amount of money that is worse than offering none. Like leaving a waiter a penny.

If cash is part of the equation, pay the going rate. If it's not, then acknowledge that someone did you a favor. Anything in between could be perceived as an insult/cheap.

<comment><USER7> Yep it says _I 'm a cheap fuck_. It was better for them not to pay and offer some other form of recognition if they weren't going to shell out some real money.

</comment></comment><comment><USER8> The comments [1] from a similar article [2] discussed the merits of this rather thoroughly.

[1] [https://news.ycombinator.com/item?id=6472965](https://news.ycombinator.com/item?id=6472965)

[2] [http://grahamcluley.com/2013/09/serious-yahoo- bug/](http://grahamcluley.com/2013/09/serious-yahoo-bug/)

</comment><comment><USER9> I'm sure there are other marketplaces that could offer a better price...

<comment><USER10> One day you walk outside and you notice your neighbor left his keys on top of his car.

You knock on his door and let him know, he says "wow thanks for the heads up, I'll buy you a beer sometime"

You think to yourself, "A beer?? I just saved his car from being stolen-- that's worth a lot more than a beer"

A week later you walk outside and see he did it again. Instead of knocking on his door, you walk into the alley and tell a local criminal about it in exchange for 500 dollars.

This is essentially what you're advocating.

<comment><USER11> _This is essentially what you 're advocating._

You have constructed an analogy so inapt that it threatens to suck all other dumb, unenlightening analogies on HN over its event horizon until it forms a sort of inapt hole from which dumb analogies could never escape.

Which would be a good thing, so good job!

</comment></comment></comment><comment><USER12> I don't understand what Yahoo did wrong. They didn't have to pay a cent but they did. I understand that it is nominal, but it is better than nothing. I guess just not in the case where the press can get a hold of it.

<comment><USER13> If they don't compensate security researchers enough, the incentive to find security holes goes away. People do this for a living.

<comment><USER14> On the flip side, HT Bridge have got way more than 12.50 USD publicity out of this.

<comment><USER15> This seems to be the entire point of the article - publicity for HT Bridge.

</comment></comment></comment></comment><comment><USER16> Since the article itself only linked to it:

"Each of the discovered vulnerabilities allowed any @yahoo.com email account to be compromised simply by sending a specially crafted link to a logged-in Yahoo user and making him/her clicking on it."[1]

[1] [https://www.htbridge.com/news/what_s_your_email_security_wor...](https://www.htbridge.com/news/what_s_your_email_security_worth_12_dollars_and_50_cents_according_to_yahoo.html)

</comment><comment><USER17> Christopher Soghoian tweeted about this and I thought it was a joke: [https://twitter.com/csoghoian/status/384799909917884416](https://twitter.com/csoghoian/status/384799909917884416)

</comment><comment><USER18> Does Yahoo have a public bounty program?

</comment><comment><USER19> Yahoo didn't do anything wrong. The researchers did by not selling vulnerabilities for more.</comment>


How do you manage your project? - <AUTHOR> I know GitHub functionalities such as Labels, Milestone, and Projects(Kanban).
However, I don't know how to manage issues dependencies (for instance, there are three issues A,B,C and they must be done in the order B->C->A) and detailed schedules like Gantt Chart.
So please give me your opinions.
Thank you. <comment><USER2> Team environment, or individual project?

The first rule of project management is to keep it as simple as you can get away with. Don't overcomplicate anything until absolutely necessary.

> I don't know how to manage issues dependencies (for instance, there are > three issues A,B,C and they must be done in the order B->C->A)

In the ticket for C, note that it depends on B. Link to B at the top of the description. Anyone reading the ticket should immediately see that B must be done first, and will click through to it. Repeat for A's dependency on C. Keep it simple.

> detailed schedules like Gantt Chart.

Unless you have perfect estimation skills and you can 100% scope your project from the start, you it's not realistic to put all of your tickets on to a Gantt chart. You'll find that the Gantt chart goes out of date within weeks or even days.

Gantt charts are best reserved for high-level goals and milestones. For example, you could plan to work on B on week 41, work on C on week 42, and then work on A on weeks 43-44 with a milestone for completion of this group at the end of week 44.

However, the Gantt chart isn't all that useful for dependencies within a single, contained project. It becomes more useful to view dependencies across teams and projects when you can allocate more people to tasks as necessary to unblock the critical path. If you're just working on a single project, the Gantt chart often simplifies to a basic estimation calendar, so use a base calendar instead.

<comment><AUTHOR> Thank you for your replying.

It is for team environment.

Yeah, I agree with you.

I have experienced mid~long period project and struggled with them so I asked this topic.

</comment></comment><comment><AUTHOR> And if you want tools for managing project, what is it?

</comment><comment><USER3> \- What's causing the most trouble for the users in terms of frequency and severity?

\- Which one could have the biggest impact and how much work to implement it (hard/long)?

\- Which one if done will unlock a graph of possibilities for features to come, or other issues becoming irrelevant once that's done?

\- Are these issues materializations of the same underlying problem?

Example: our users were _constantly_ competing for resources to train their models with notebooks in a tragedy of the commons way. GPU/RAM, etc. Notebook users are familiar with "OOM" errors. You start training using a notebook, someone else does the same, bam!.

The thing to do was clear: schedule notebooks[0]. It doesn't have to be fair queuing, even FIFO does the job. Just put the notebooks in a queue and execute them sequentially. No priority.

The issues might have said "Out of Memory" errors, and a naive approach would be to simply add resources but is that really the underlying problem? No.

Once you have notebooks running asynchronously, it opens a whole new graph of possibilities and makes it easier to do things properly, like leverage a proven workload manager. The limiting step was to de-couple the intent to execute, from the execution, and wrap it in a request. Now you can re-run it, delegate it to a more powerful node, etc.

One other issue it solves is something notebook users are familiar with, too: you can't access the results of a computation if you close your browser/tab/computer. If the connection between the kernel and the front is lost in Jupyter notebooks, the computation continues, but the results don't make it to the front. You could have a training job that takes hours, if the connection is lost, so is your result. Notebook users solve this by saving their model to disk, but notebook users aren't using notebooks just for that. They want graphs and visualizations in the notebook too, or else they would have just used a script. Also, that is possible but we do automatic model/parameter logging so our users don't bother with that, so they could always click on "Deploy" and their model is deployed.

Focusing on scheduling notebooks solves that. Now even if users closed their laptops, or the connection was lost, the result of the notebook would still be there.

Then we went further: displaying the results of the run outside of Jupyter, and now you can show a client the result of the work, and you can discuss it.

So that was an example of handling an issue that "fixes" a problem like crashes, and indirectly unlocking possibilities.

Now examples of handling issues/tickets implementing a "feature" where there are no crashes: users worked in tandem, and sometimes asked assistance and we helped them troubleshoot their code. One pattern is they shared "screenshots" of the code. We already had a sharing functionality with which they could simply share their notebook with another user, and the user could edit.

We added near realtime collaboration[1] to notebooks so several people could work together on the same notebook, see what everyone else was editing, following your cursor while you were doing so. Being able to work on the same document clearly simplified things for users who were not proficient with Git, which is also why we have added multiple checkpoints[2], as the default was one checkpoint.

So, a question to ask is "should we do this?", and then look at the tickets/issues that have high impact. Some of them will be harder to implement than others, and you have to balance your allocation, but at least you'll do it on something that matters to users.

[0]: [https://iko.ai/docs/notebook/#long-running- notebooks](https://iko.ai/docs/notebook/#long-running-notebooks)

[1]: [https://iko.ai/docs/notebook/#collaboration](https://iko.ai/docs/notebook/#collaboration)

[2]: [https://iko.ai/docs/notebook/#multiple- checkpoints](https://iko.ai/docs/notebook/#multiple-checkpoints)

<comment><AUTHOR> what are you talking about?

<comment><USER3> OP's question was about how to manage a project and and how to decide which order to do issues that are interdependent in.

The reply was whether the issues needed to be resolved, and gave a set of questions to ask to find out what to work on and what _not_ to work on, and gave examples from an actual real world project in both situations [fix a problem / add a feature].

In other words: how to manage a project and how to decide what to do and what not to do.

Which part is confusing?

<comment><AUTHOR> I got it. Thank you.

<comment><USER3> My pleasure.</comment></comment></comment></comment></comment>


YouTube: An open letter to our community - <AUTHOR> https://twitter.com/YouTube/status/950847377816113153 <comment><USER2> It's pretty sad when they won't mention LP by name, and take a over a week to come up with a half-assed statement.</comment>


What every founder fears - <AUTHOR> https://medium.com/p/2fe173c44215 <comment><USER2> I'm sorry to offend but she is incredibly full of herself and quite immature. Like she's on some sort of pulpit, spouting things she thinks people give a shit about. I mean, she _quotes_ herself numerous times in this post. She indirectly hints how her lifestyle is so similar to other rich CEOs. Also, from what everyone else says, she seems to be begging her "friends" to donate to her charity as to validate or eclipse her husband's success.

Honestly, this whole situation shows that all three of these people don't know how to interact socially, like for real, with other people. I'm saying "for real" because it seems their social perspectives are heavily skewed inward and towards themselves.

Also, it's super odd because towards the end of the post, the lines get blurred; she seems to be equating her husband's success with her own. She had literally _zero_ to do with the success of Github.

<comment><USER3> Part of me is nodding in agreement, but another part is wondering 1) am I (unfairly?) biased against the author due to the story from Horvath and 2) is this another example of a woman being criticised for having a voice? Are we unfairly expecting her to be polite, not powerful and proud? Her husband's post was very proud and he didn't get the same criticism, though I think he did a slightly better job apologizing and focusing his message.

Not criticizing. Just sharing my own mixed feelings.

<comment><USER4> Definitely agree that it's more socially encouraged to see a woman's egregious faults than a man's. And her husband and his buddies clearly had more power.

On the article though, the aristocrat-wannabee pseudo-fears of _" being misunderstood in their motivations as their companies grow"_, is ridiculous compared to the employees' fears: wasting their one life, humiliation, unemployment, impostor syndrome, abuse, etc.

</comment></comment></comment><comment><USER5> _After weeks of silence, we learned that, despite, being found not guilty of the harassment accusations, questions popped up regarding Tom's judgment in a separate area. We learned that unnamed employees felt pressured by Tom and me to work pro-bono for my nonprofit._

This appears to be the real reason for Tom's resignation.

<comment><USER6> With this post, I also think that Tom's wife has inadvertently incriminated herself of meddling in company affairs. Given that she was not an employee at all, I do find it highly inappropriate that she would interact at all with GitHub employees regarding her business. Strangely enough, I think that most of this situation could have been mitigated if she had even a $1/year figurehead role in the company.

<comment><USER7> ... and didn't harass the employee.

</comment></comment></comment><comment><USER8> I don't know the personalities of anyone involved in this ordeal and that makes the whole thing difficult to judge. If this is a case of the workplace sociopath, I pity all involved. In my own experiences working with manipulative people, they typically find a narrative to support their abusive behaviors and when these people are called on for those actions, they either act surprised or hurt and often both. This person is hurt by being called things like "naive" because it is reflective of their own incompetence. Certainly "optimistic" is a better way of putting it because it means all of the "good intentions" were squandered by everyone else who just didn't get it. The manipulator shouldn't have to suffer the consequences, since it is his/her trust that has been betrayed. You see, all along, the manipulator was trying to be the good guy. The one making the office better, "more fun", it was always good intentions but the other people either misunderstood or just want to spoil it for the rest of us.

I sincerely hope no one has to work with this personality type but I am willing to bet most everyone has seen this bad faith behavior in action. You know the office bully who, when called out for pushing a person around says in some form, "come on, can't you take a joke?" Isn't it odd how this same person never calls the thing a joke when he or she gets what is wanted out of the same behavior?

"I was totally joking when I said I needed you to work over the weekend or else. Seesch. Lighten up." I can assure you, I have never heard of a single person getting a monday apology email for putting in that weekend work from this sort of office "practical joker."

So it is not too surprising to see HR departments and lawyers finding themselves implementing "PC" policies and "buzz kill" practices as a means of mitigating these sorts of power abusive strategies since the bully is ultimately going to act the victim of misunderstood intentions when asked in any form to stop.

Isn't it odd how the biggest tragedy for this personality type is having to admit how their actions might have hurt others?

</comment><comment><USER9> Richard Branson had/has critics that accused him of all sorts of things. His advice, which is similar to Napoleon Hill's, would be to demonstrate actions that are discordant to the accusations.

(The bigger of a celeb / more successful you become, the bigger of a target you wear on your back for people to try to tear you down.)

<comment><USER10> Contrast this to Elon Musk, who is very direct and open in responding to criticism. To each his own?

<comment><USER9> Denying something doesn't carry the same weight and it seems like a PR move, whereas "actions speak louder than words."

</comment></comment></comment><comment><USER11> _" Naive, no. Optimistic, absolutely."_

Neither. Arrogant it the right word. Not maliciously so, but arrogance nevertheless.

An arrogance that is far from unique in the start-up world, the arrogance to think that in spite of _centuries_ of documented history you can create an organization that doesn't have clear formal structure and not have it end up as a cult-like snake pit.

As companies, they fail to provide the kind of safety and security people who are not entrepreneurs need, and call it "freedom". And it may feel like freedom for a while, when it's still a small group of close friends, but after that it's just a Darwinian social experiment.

And when the shit hits the fan, it doesn't matter who exactly did what. It's the arrogance and narcissism of the founders that is responsible. Founders who believe that everyone who works for them should be like them, and then everything will magically be good.

 _" Tom saw himself not as CEO, but as the architect of a unique business structure. He wanted to create a company where he, himself, would have loved to have been an employee."_

This isn't visionary. This isn't naivety. This isn't optimism. It's narcissism.

<comment><USER12> I dunno. I think it could be any of those things, or all of those things, and ultimately depends on who you're talking about.

Question though - isn't one of the points of starting your own business that you're having a hard time finding a perfect job working for someone else? Ergo, don't a lot of us "[want] to create a company where [we], [ourselves], would have loved to have been an employee."?

edit - I totally agree with the rest of your comment about arrogance.

</comment></comment><comment><USER13> > We learned that unnamed employees felt pressured by Tom and me to work pro- > bono for my nonprofit. We racked our brains trying to understand this new > allegation...I am so very sorry if anyone felt that I was pressuring him or > her for advice, labor, or to sign up. I truly never had that intention...my > idealistic belief in the status-free community of GitHub, I failed to > recognize that power structures cannot ever be obscured entirely.

> employees view them as disconnected and only trying to build empires of > gold. Tom saw himself not as CEO, but as the architect of a unique business > structure...He wanted to invest heavily in employees and to create a space > that gave each employee the autonomy, tools, and support to build great > things. In our home every night, he spoke passionately about how to build a > company that gave employees freedom.

Other than being a Github user and customer, I know nothing of the details of this case other than what I've read. She admits she was obtuse about "power structures" in the company, but this also is not a unique thing in Silicon Valley - she's not blind to these things in a unique way.

That said - it's like someone believing their own press releases. "A space that gave each employee the autonomy, tools, and support to build great things". To me that sounds like saying Platt from "Twelve Years a Slave" got an excellent bag to pick cotton from, and build up the glorious plantation he was working on. Preston-Warner can snap his fingers, and someone who was getting a check to put food on the table and a roof over their head is suddenly not going to have the rent check by the end of the month. Especially when the next employer is asking for references, why you left the last job, are there any gaps in employment etc. People on an H1-B visa are dependent upon the company so they can't be thrown out of the country, so their green card application can not be restarted etc.

This is in the default structure of a corporation, and the laws, and all the default papers that super-angels and VC's put forward. Ownership and control of a corporation is 80-90% in the hands of the angels, VC's and founders. Of the scraps left over, executives and top-level experienced techs get the lion's share. This is the reality, and everyone knows it. People believing their own press releases about people building great things are delusional. It's like the Tuskeegee or Dr. Mengele subjects happy about how they are helping contribute to science. No one is fooled by this other than naive, new to the workplace, socially maladjusted programmers in their early 20's. This is why there is such a feeding frenzy over this small pool of naive young men.

<comment><USER14> > _Preston-Warner can snap his fingers, and someone who was getting a check to > put food on the table and a roof over their head is suddenly not going to > have the rent check by the end of the month._

Very, very unlikely. Even though employment laws are very employer-friendly in the US, from the sound of it, Tom built an inclusive, open company culture. One of the side effects of that is that if you abuse your power as a leader, you cause irreparable damage to the culture - which is not something you want to do at practically any cost after spending so much effort building the culture and getting it to stand up on its own feet.

Ricardo Semler, major shareholder and CEO of Semco, explained it like this: "I have a handgun in my desk drawer with a single bullet in it."

If he really had built the kind of culture where he could just fire people by snapping his fingers, surely the easiest thing would have been to fire the troublemaker at the first sign of trouble instead of waiting for her to resign and make a fuss.

<comment><USER15> How is that unlikely? Unless Github has a very, very atypical employment contract, all employees are at-will[1]. Sure, it might damage Tom or Github's reputation if he just randomly fired people[2], but he _could_. Saying that it would also bring down the rest of the company doesn't really help.

[1] Of course, you still have to give two weeks notice if _you_ want to exercise that at-willness for _yourself_!

[2] I mean, unless he "randomly" fires all the people of race X, or something like that

<comment><USER14> I explained how it's unlikely, but here we go again.

Tom has spent considerable time (as I have, in my own company) getting people to a point where they think for themselves, make decisions as a group, and generally behave as independent adults rather than the kind of infantile employees who just do what they're told by their boss. Since the latter is the way most businesses operate, it's no mean feat to get this done with a company of a dozen, let alone with one of hundreds.

If Tom decides to arbitrarily fire someone, even just one person, without going through the group-oriented processes he's spent all this time building up, he immediately undermines all that, potentially fatally.

Since he clearly cares about the company's culture (enough to make it his priority for the last half-decade), it's very unlikely he would risk that to get rid of one person.

And finally, again, there's the evidence: if he really did want to get rid of this woman, and he could, why didn't he?

<comment><USER16> > And finally, again, there's the evidence: if he really did want to get rid > of this woman, and he could, why didn't he?

That's more speculation than evidence, surely?

</comment></comment></comment></comment></comment><comment><USER17> I don't understand why people in these situations feel compelled respond. Why defend yourself? Why say anything publicly at all? Curious if any PR- knowledgable folks around here know if there is any benefit to such statements.

<comment><USER18> Generally, it's best _not_ to say anything more than the minimal amount necessary; if you want to get a particular angle on the story out, you float it through friendly media, of which SiV has a preponderance. ("Sources close to the story say that ...".)

It appears that GitHub and the Preston-Werners aren't coordinating their messages (though no doubt all counsel involved have reviewed them): the GH release is appropriately terse, giving away the bare minimum of information in order to minimize both PR and legal exposure, while the P-Ws are working their angle to the story while still minimizing actual information. The P-Ws really don't have any legal exposure, so there's very little downside to their attempts to work the refs, while GH is operating under the continued threat of legal action (even if it's remote, their attorneys are obviously being appropriately cautious here, so kudos to them).

Of the two statements, Tom Preston-Werner's statement is far more effective and well-crafted than his wife's; he comes across as -- at least for public consumption -- sincere, open and genuinely remorseful while affirming his dedication to Good Things and avoiding admitting to actual culpability. It's a _very_ nicely-handled statement, and it's instructive to compare it to how MoCo and Eich handled _their_ crisis du jour. (The OP statement by Theresa P-W, however, is less artful, more defensive, and personalizes the criticism. Understandable from a personal point of view; not good PR.)

How much of this is true? Well, does it matter? Truth is for courtrooms and confessionals; what matters here is _spin_. Again, consider MoCo. In both cases, an executive was ousted but, in GH's case, the company looks stronger for it (investigation by outside counsel! No wrongdoing found! Action taken!) and the P-Ws don't look much worse (we support diversity! Created an open culture! Feel terrible that some people felt hurt!).

The ouster of Eich, however, just made moCo look opportunistic _and_ weak, and Eich personally came out looking pretty bad due to his inability to craft a solid message (he said the right things about diversity, but failed to connect it to his _personal_ narrative, so it rang hollow). The lesson, I think, is either move quickly and aggressively (as GitHub did), or else buckle down and stay the course (as Mozilla _should_ have -- though, as I've said previously, I have no issues whatsoever with the campaign to oust Eich). Anything else is going to make a problem into a crisis.

<comment><USER19> Excellent analysis. I'm also surprised why MoCo decided against staying the course and jettisoned Eich. The majority of the complaints would have blown over in several weeks as people got bored/distracted/found something else to be outraged about. The few remaining die-hard complainers could be safely ignored as all companies have some amount of detractors.

<comment><USER20> _jettisoned Eich_

You probably want to read the reply above yours, or the FAQ it links. The announcement from Brendan was that he had chosen to resign. No evidence has been presented that he was fired or in any way pressured by the board to leave; in fact, everybody in the know who's commented publicly says it was the other way around (and always was -- it really looks like he never wanted to be CEO but was talked into it, then wanted to resign and others tried to talk him into staying).

</comment></comment></comment></comment><comment><USER21> > I suspect that what founders really fear is being misunderstood in their > motivations as their companies grow. They fear that employees view them as > disconnected and only trying to build empires of gold.

These are the fears of a bad founder. Their job is to set the vision of the company. If the founder fears the employees feel they are disconnected, the founder probably _is_ disconnected. If a founder should fear anything, they should fear not creating a safe environment where the employees can feel comfortable bringing their concerns to superiors — about any aspect of the company — instead of that self-centered fear of being "misunderstood".

</comment><comment><USER22> The naive nature of this note is almost incredulous.

 _After weeks of silence, we learned that, despite, being found not guilty of the harassment accusations, questions popped up regarding Tom's judgment in a separate area. We learned that unnamed employees felt pressured by Tom and me to work pro-bono for my nonprofit. We racked our brains trying to understand this new allegation._

Ummm... Perhaps it's because you're the CEO's wife and you're asking them to do something. It comes with the power.

 _I was the wife of the CEO, but that never entered my mind when I hung out with any GitHubbers._

Ummmm.... ok....

 _I have never known anyone like Tom. When I was interviewed by the 3rd party investigator, she abruptly asked if I thought Tom was naive. I was dumbfounded, unable to answer until she offered a different word; "Perhaps, you would call him optimistic?" Naive, no. Optimistic, absolutely._

ok, so at least it's not her husband that was naive.

Apparently there are still threats of legal suits around all this fun too. [http://news.easybranches.com/news/1844059.html](http://news.easybranches.com/news/1844059.html)

</comment><comment><USER23> _Yawns_ In a few months, nobody will remember. I'm a HUGE Github fan, but the world doesn't revolve around you, not even the tech world. We all live in a bubble here.

</comment><comment><USER24> "Sign in to continue"

What is this, Quora? When did Medium start with that?

<comment><USER25> exactly, they will lose readers by doing that.

</comment></comment><comment><USER26> This is so NOT what every founder fears !

</comment><comment><USER27> This is quite some schmaltz

</comment><comment><USER7> Hmm, so, not a single comment about how absolutely none of the issues raised by @nrrrdcore are addressed by neither github (whitewashing it all) nor these folk (one of which threatened everyone who questions him with a lawsuit). And none of the comments even mention @nrrrdcore or what she raised.

We seem to be witnessing the convenient limits of discourse.

</comment><comment><USER28> It could be worse: it is not as if Github has a Hans Reiser on the books! Yet the way this story has been gone over you would think that something of that magnitude of catastrophivity had gone on.

</comment><comment><USER29> x

</comment><comment><USER29> #</comment>


'Star Trek' Lawsuit: The Debate Over Klingon Language Heats Up - <AUTHOR> http://www.hollywoodreporter.com/thr-esq/star-trek-lawsuit-debate-klingon-888419 <comment><USER2> I think suggesting Paramount doesn't have a viable copyright over the Klingon language is absurd. English-to-Klingon translators and such are fun, but no, it's not a real language really used by anyone.

As someone who has done a lot of fan fiction related content, hosted websites, etc. regarding Star Trek, I hope Axanar gives up quick, for the sake of everyone who wasn't trying to turn a profit off the fandom.

Paramount has granted us INCREDIBLE leeway to create things around their IP, and has give everyone a pretty wide berth on it. I'd go so far as to say I've never seen a company so generous with letting their IP be extended and used. But there was always one clear rule: Don't make a business off of it.

Axanar crossed the line, Axanar needs to be crossed off. It's that simple.

<comment><USER3> Haters got to hate.

<comment><USER2> I'm not "hating". The more Axanar fights this, the worse it will be for every other fan film project out there. This is a very gray area these films work in, and if Axanar pushes back on Paramount, the only likely result, is Paramount deciding to shut EVERYONE down.

The moment Axanar started paying people salary, it was no longer a fan film. We all need to realize that it's not one anymore.

</comment></comment></comment><comment><USER3> Paramount can win all the legal battles. It will be to no avail as they shed fans.</comment>


Introducing ThinkLab – A platform for massively collaborative open science - <AUTHOR> http://thinklab.com/blog/introducing-thinklab-a-platform-for-massively-collaborative-open-science/38

<comment><USER2> As an project leader on ThinkLab, I'd like to highlight the awesome [markdown citation engine]([http://thinklab.com/help/writing_in_markdown](http://thinklab.com/help/writing_in_markdown)). Provide only a doi and ThinkLab takes care of the rest.</comment>


Deep learning with convolutional neural networks for brain mapping from EEG - <AUTHOR> https://arxiv.org/abs/1703.05051 <comment><USER2> As a novice research-assistant I really appreciate the fact they included a _Software implementation and hardware_ section in the appendix.

They even wrote "We will make the code to reproduce these results publicly available". That should be the norm. Kudos.

<comment><USER3> > We will make the code to reproduce these results publicly available

I'm excited about this trend, it makes it easier for everyday software engineers to tinker around with cutting edge tools.

I think of innovation as a pipeline starting from scientific insights, to engineering advances, to improvements in the consumer experience. If research communities continue to borrow more ideas from open source culture, it could really improve the speed of that pipeline.

<comment><USER4> Imagine every CS paper coming out with executable code. That would definitely put humanity in an accelerated path to fictional future.

</comment></comment></comment><comment><USER5> They reported an accuracy of baseline FBCSP and ConvNets on the BCIC dataset around ~68%-70%, which is reminiscent of early WER for speech recognition (prior to the advent of specialized speech architectures). However, when you consider the datasets (BCIC 2a and 2b) are only using 22 scalp electrodes (for 2a) and 3 (for 2b) at 250 Hz, that's pretty amazing. That's analogous to using something like 8-bit audio for speech recognition.

Clearly there is lots of room for improvement here, both in neural net architectures, measurement technology, and preprocessing. One technique the authors didn't explore is source localization [1], which typically requires much higher density (somewhere on the order of 128-256 active electrodes), but offers much higher spatial resolution (up to ~5mm isotropic). Given that most of the EEG datasets are recorded on less than 32 channels, I wonder how much more signal can be detected from such low resolution methods, or if we're approaching the theoretical maximum channel capacity of 32 scalp electrodes.

It's like Feynman's analogy of measuring the height of corks in a swimming pool to determine the physics of an object that hit its surface. The more corks you have, the more information about the source (location, velocity, trajectory, geometry) you can reconstruct.

[1]: [http://www.scholarpedia.org/article/Source_localization#Elec...](http://www.scholarpedia.org/article/Source_localization#Electroencephalography_.28EEG.29)

</comment><comment><USER6> I don't see why this research couldn't be applied to empirical data from an arbitrary system of coupled oscillators.

I am interested in EEG and fNIRs, but there are drawbacks. Naively, people will try and study this data without first doing a necessary back-of-the- napkin.

EEG and fNIRs have hard physical limitations. EEG is limited to pick up only large-scale EM field activity, where the higher resolution perturbations and effects are averaged out. This is because of an increased measurement distance and noise that is acquired through the skull and other intermediary tissue. This is unacceptable since the current scientific consensus is high frequency phase and activity is fairly important for information coding.

On the bright side, a lot of information might also be encoded in larger scale synchronized oscillation that happens in the brain (the stuff that EEG picks up on). This space is obviously lower in dimension.

The only work-around for this hard information limit is to explore invasive BCI technology (e.g. tetrodes connected to your neurons).

Relatively speaking, this isn't difficult for scientific laboratory research because:

      1. We don't care about invasive surgery on rats.

      2. We don't care how comfortable rats are.

      3. We don't care how mobile rats are.

On the other hand, for commercial purposes, it is not feasible to stick a wired-tetrode array into a human brain yet. We can't afford to lose a human. Engineering on the invasive BCI frontier is incredibly primitive right now.

</comment><comment><USER7> There is something so deliciously meta about this. FMRI scans might also be a very interesting place to play with CNNs.

<comment><USER8> FMRI has very poor temporal resolution and moderately poor spatial resolution-- it's like trying to figure out the workings of your computer by using a meat thermometer.

<comment><USER9> Plus an fMRI machine is not easy to fit on your desk or carry with you.

<comment><USER10> A portable fMRI machine... that's the stuff of dreams. For sure that would change the world for the better but I really don't see how you would even begin to tackle that.

<comment><USER9> I suppose with a few years of weightlifting, it can become portable ...

<comment><USER11> I suppose, if you can also weightlift a magnetically & RF shielded room with you :P

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> I really enjoyed the elegant combination of Theano/Lasagne [1] and Wyrm [2].

[1] [https://github.com/Lasagne/Lasagne](https://github.com/Lasagne/Lasagne) [2] [https://github.com/bbci/wyrm](https://github.com/bbci/wyrm)</comment>


A letter to myself - <AUTHOR> http://alpblog.heroku.com/blog/a-letter-to-myself/ <comment><USER2> Good advice, but I can almost guarantee that your older self will have even more sage advice for your younger self.

Certainly stay hungry, stay foolish, stay passionate. But keep iterating in all things.

</comment><comment><USER3> umm really this is on the front page? i'll just leave this here: <http://en.wikipedia.org/wiki/Stuart_Smalley></comment>


The best open source tools for automating your crypto trading strategies - <AUTHOR> https://www.cryptotrader.tax/trading/the-best-open-source-free-crypto-trading-bots/ <comment><USER2> Should I ever get involved with automated trading, I don't want to use any software aimed at "beginners".

Anyway, this article is a trash "pros and cons" listicle for three arbitrary systems.

</comment><comment><USER3> How good is Gekko for an amateur like me? Should I spend some money playing around with it?

<comment><USER4> It's a fun tool to play around with. Install, download data and then run backtests on it. I haven't found much more use for it otherwise.</comment></comment>


Superoptimizing LLVM (2014) [video] - <AUTHOR> https://www.youtube.com/watch?v=Ux0YnVEaI6A <comment><USER2> _engineering fast, effective and correct optimizations for LLVM is challenging_

Indeed, just a few days ago I reported a miscompilation bug in the LLVM optimizer... [https://llvm.org/bugs/show_bug.cgi?id=27190](https://llvm.org/bugs/show_bug.cgi?id=27190)

</comment><comment><USER3> Seems like work has died down a bit on the Souper repo[0], last commit was in January.

Anyone know what the current state of super optimization compilers is?

[0] [https://github.com/google/souper](https://github.com/google/souper)

<comment><USER4> It's definitely still an active project, but I'm on sabbatical this academic year and have had much less time than usual for my regular research. I'll be getting back to it in June. Also, Raimondas Sasnauskas, who implemented the instruction synthesizer, finished his postdoc position and moved on.

In any case, there's been a lot of progress since I did that UW talk, for example here are some early synthesis results:

[http://blog.regehr.org/archives/1252](http://blog.regehr.org/archives/1252)

<comment><USER3> That's great to hear! It is a very interesting project

Can you explain why your goal is to implement these optimizations in llvm? Why not have Souper as one of the optimization passes?

<comment><USER4> It turns out it's harder than you'd think to decide whether or not an optimization is a good idea. Of course there are some relatively simple optimizations that are obviously good, but a lot of those have already been implemented. Also, I'm not sure how many people are going to want to add a solver into their compilation path.

On the other hand, if we simply contribute optimizations then all LLVM users benefit.

We're also using Souper to reveal imprecisions in LLVM dataflow analyses such as known bits -- this turns out to work really well.

<comment><USER3> Ahh, I see. I assumed that any and all optimizations are good, that makes sense.

Keep up the good work!

</comment></comment></comment></comment></comment><comment><USER5> I've used Souper a bunch of times on hand-written, performance-critical LLVM code, hoping for some magic superoptimal version of the function. Even saving a few instructions would help in these cases. Unfortunately, in my experience Souper is the identity function: it has literally not once changed my LLVM code in any way. If I'm doing something wrong, I'd love to know what. Perhaps it's not expected that hand-written LLVM will have much room for improvement? Is the intended target of optimization only expected to be fairly obviously redundant machine-generated code?

<comment><USER6> Working with llvm IR generally doesn't find as nice things compared to super optimizing assembly instructions. This is because there are lots of esoteric assembly instructions a human might not consider using that a machine can brute force.

That is probably one source of problems for souper.</comment></comment>


Digital Scrapbooking - <AUTHOR> http://www.300dpi.com/ 300dpi.com offers digital downloadable graphics and iPhone scrapbooking applications. Our products are differentiated by their design, quality, company philosophy, innovation, and our customer-respected brand name. 300dpi.com strives to have innovative and trend right designs with respect to branding and consumer values. <comment><USER2> They launched without a printing service??</comment>


OpenBSD Will Get Unique Kernels on Each Reboot - <AUTHOR> https://www.bleepingcomputer.com/news/security/openbsd-will-get-unique-kernels-on-each-reboot-do-you-hear-that-linux-windows/ <comment><USER2> In addition to a new kernel at boot, several libraries in base are also randomly re-linked, including libc and libcrypto, which are prime targets.

[https://marc.info/?l=openbsd- cvs&m=149605105003964&w=2](https://marc.info/?l=openbsd- cvs&m=149605105003964&w=2)

[https://marc.info/?l=openbsd- cvs&m=146168291000757&w=2](https://marc.info/?l=openbsd- cvs&m=146168291000757&w=2)

This means that in addition to the dynamic linker loading libraries at random addresses, in a random order, the offsets inside the library itself are different on each boot, and on each system.

Robert Peichaer (rpe@) added the kernel re-linking at install/upgrade: [https://marc.info/?l=openbsd- cvs&m=149884116824098](https://marc.info/?l=openbsd-cvs&m=149884116824098)

<comment><USER3> Any ideas how these are randomized? Just wondering if these are still vulnerable to a timing attack...

<comment><USER2> What part? At least for the library randomization, a special libc.so.X.Y.a is part of the base install, objects are extracted with ar(1), and then re-linked in a random order (sort -R/arc4random(3)) to create a working shared library.

The kernel has a similar reordering stage, best explained by Theo de Raadt: [https://marc.info/?l=openbsd- tech&m=149887978201230&w=2](https://marc.info/?l=openbsd- tech&m=149887978201230&w=2)

The full implementation is in the tree.

<comment><USER4> Isn't secure random number generation a problem immediately after boot? Curious what arc4random is using as an entropy source.

<comment><USER5> Many modern systems have hardware RNGs, but they may also be using stored seeds.

<comment><USER6> > Many

^[which?] ^[citation needed]

<comment><USER5> On desktops, Intel Ivy Bridge and newer and everything AMD since June 2015.

On mobile, most mobile SoCs include security stuff, Qualcomm seems to have had them since at least the Snapdragon 805. See here for the addition of the RNG to the linux kernel in 2013: [https://lwn.net/Articles/570158/](https://lwn.net/Articles/570158/)

Even common embedded SoCs like those used in the ESP8266 include hardware RNGs.

Really, there's no excuse for not using it as at least one factor. If you're concerned about possible backdoors, xor it with your own CSPRNG in software like the Linux kernel does.

<comment><USER7> TPM has one too.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> > Having KARL on other OS platforms would greatly improve the security of both > Windows and Linux users.

This is surely true, but at least on Windows the central security holes do not lie in Windows itself (these kinds of holes exist - but exploits are very expensive, which shows that they are typically rare and not easy to exploit), but in third-party applications.

For example the current 2017 version of the Petya ransomware was spreaded via a security hole in the software update mechanism in the Ukrainian tax preparation software M.E.Doc. Other well-known attack vectors that are commonly used to attack Windows PCs are Flash Player and the Java browser plugin.

<comment><USER9> This is so wrong that I have no idea why anyone would make such an assertion. Win32k.sys alone is a bottomless pit of EoP vulnerabilities. They are a dime a dozen and not particularly difficult to exploit. Also, in the context of _kernel_ security, tax software, flash, and java browser plugins have no relevance.

<comment><USER8> > They are a dime a dozen and not particularly difficult to exploit. Also, in > the context of _kernel_ security, tax software, flash, and java browser > plugins have no relevance.

Indeed, but I wanted to illustrate that while kernel security is important, there exist much more dangerous "open barn doors" (I don't know whether this English translation of the German phrase "offene Scheunentore" is proper English).

<comment><USER9> Oh, that is fair. Kernel security is indeed largely inconsequential in the real world. My initial read of that has it sounding like saying Windows (kernel) doesn't have exploitable vulnerabilities, third party software does.

I still disagree, but less strongly :) Flash has always been a weak point, and Java was (but has not really been hit for a few years). But not only have there been exploits hitting MSIE/Edge/Office, they deserve much of the fault for the poor security architecture that facilitates exploitation of plugins in my opinion. Like untrusted fonts in the kernel, they seem to agree in so far as Edge no longer supports ActiveX at all.

The number of exploits overall has gone way down, but there are still a ton of security patches rated as Critical RCE coming out monthly in all the usual Windows targets. And now that Tavis shone some light on their AV engine, it has been revealed that is a gaping hole both in design as well as in implementation.

Regardless, there are far more practical realities that make Windows a security liability. If you survey 100 random penetration testers, you might find one that uses RCE exploits regularly (before shadowbrokers gave everyone new toys anyway). The playbook for everybody else largely consists of spear phishing to get a "beachhead" and then moving laterally with Pass-the-hash and similar things that are technically possible to defend if you read the documentation and set the right group policies, but that nobody in the real world does.

</comment></comment></comment></comment><comment><USER10> If the kernel image is different each time, you can't verify its integrity through a checksum.

I'm curious to hear from people working in infosec: is that real problem? How do you see the tradeoff?

<comment><USER11> I haven't noticed any boot time checksum verification on Linux or OpenBSD in the past 15 years. If it's there, I've missed it. But it doesn't seem like this change introduces a new problem. Secure boot springs to mind, but that's something you probably have to disable anyway to run OpenBSD...

Think about this angle: if you're concerned about infosec, and there is a malicious actor with the capability to replace your kernel (which you don't do unless you're root), you _do_ have a real problem. Even if the kernel were verified at boot time, that same actor should have countless other attack vectors.

But it's something worth considering if a tursted chain from machine firmware all the way to the application level is established. It's not there yet.

What is the solution when you need to upgrade some kernel or program and the new version has a different cheksum? I don't see why that same solution, whatever it is, wouldn't work in the relinking case.

<comment><USER12> _I haven 't noticed any boot time checksum verification on Linux or OpenBSD in the past 15 years._

Some Linux distributions support kernel and kernel module signature verification in combination with secure boot. As far as I understand, RHEL does this automatically when secure boot is enabled:

[https://access.redhat.com/documentation/en- US/Red_Hat_Enterp...](https://access.redhat.com/documentation/en- US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/sect-signing- kernel-modules-for-secure-boot.html)

[https://wiki.gentoo.org/wiki/Signed_kernel_module_support](https://wiki.gentoo.org/wiki/Signed_kernel_module_support)

<comment><USER13> AFAIK _ANY_ distribution that supports secure boot does this, it's entirely pointless to sign the bootloader and kernel but then allow arbitrary kmod's to load in and harm your trusted system.

<comment><USER14> I disabled secure boot on ubuntu because I couldn't get the virtualbox kernel module... So pretty sure the modules have to be signed.

Anyways, with Lenovo who is to say they didn't leak their private key out shear incompetence :)

<comment><USER15> I faced the same issue. Though disabling secure boot just to get the vbox driver running isn't the best idea. There are quite many detailed tutorials that list how you can sign the vbox modules and it won't take that much time, I promise. If the kernel devs are providing us with a security mechanism, might as well use it. :)

</comment></comment></comment></comment></comment></comment><comment><USER16> What is the attack vector on KASLR that KARL prevents?

My best guess: A leaked kernel pointer could be used to find an offset for the KASLR kernel, and that offset could produce a working payload for some other unrelated kernel shell code exploit.

If that's correct, KARL seems like a pretty fringe improvement over KASLR. Can anyone educate me?

<comment><USER17> I don't think it's meant to be a massive improvement - just another one of the many barriers you want to put in front of an attacker. Assume they will get through, but make it as difficult as possible in the hopes that reduces the people who attempt it.

<comment><USER18> Or make it as difficult as possible so it will eat up the attacker's time.

</comment></comment></comment><comment><USER19> Previously: [https://news.ycombinator.com/item?id=14542874](https://news.ycombinator.com/item?id=14542874)

</comment><comment><USER20> And why would you ever reboot openbsd computer? :)

<comment><USER21> to quit Vim

<comment><USER22> I laughed and then remembered I did this once as a teen.

Then I laughed some more.

</comment></comment></comment><comment><USER23> Just curious - how would they deal with kernel crash dumps?

<comment><USER24> It was the first thing that popped into my mind at first too but then I started thinking about it and out of the top of my head the only issue I could think of would be if symbols are stripped (you can't "load them from another kernel"). But as long as they're in there I think there shouldn't be any problems? But please elaborate on what you mean with the "deal with" part.

<comment><USER25> Wouldn't the symbols being there defeat the purpose of the whole randomization thing?

<comment><USER26> The purpose is to defeat a generic exploit.

For example, with ASLR, it's easy to retrieve the current layout of the processus and therefore to debug it (if you have the appropriate symbols) despite the randomization. But an exploit has to be built for the specific instance of the application running. If you share the same privileges as the process, you can get the current mapping but an exploit is useless. If you don't, you don't have access to the mapping either and it's difficult to get it while you are executing code inside the process as you can't easily access the functions you would need for that.

</comment></comment></comment></comment><comment><USER27> What's the performance impact of this? Are OpenBSD reboots suddenly going to take 5-10 minutes because the kernel has to be re-linked?

<comment><USER11> The relinking is done in a background job fired off at the very end of the rc script.

</comment></comment><comment><USER28> I am grateful that OpenBSD exists, but I find it sad that the most novel advances employed in systems security are layers of security/obscurity over vulnerable systems, instead of advances in intrinsically secure systems. Type- safety would eliminate a large class of vulnerabilities in systems software. We enjoy such benefits at the application layer, but systems software is far behind.

</comment><comment><USER29> I have not followed these features - are they proposed in any way for adoption in FreeBSD ?

</comment><comment><USER30> Nice technique but it cannot be used in a secure boot chain. Maybe that's not an issue in most contexts OpenBSD is used into, but if I were to choose I wouldn't turn off secure boot to activate this feature.

<comment><USER31> why can't it be used in a secure boot? The image and checksum are created at the end of last boot, so it could be signed then. If the bootloader is signed it should be able check the kernel.

</comment></comment><comment><USER32> the more i hear about OpenBSD the more i like it, i really should do more with it as my current experience begins and ends at using pfsense (well and a PS4 which i believe runs a BSD based OS if you count that)

</comment><comment><USER33> Doesn't this prevent using UEFI secure boot mechanisms?

<comment><USER34> Yes.

</comment></comment><comment><USER35> is there any book/document about building embedded systems with openbsd/netbsd/freebsd ?

<comment><USER36> Embedded, not so sure.

Depending on your definition of 'embedded', you might look at the various wireless router repackagings and scripts that are available.. Also, the NetBSD 'rump' kernel might be an interesting thing to review.

Generally speaking, the projects overall have excellent documentation, including manual pages or HTML docs on kernel, c library interfaces, building the system and packages from source, etc. Also, the whole system is in the source tree, which can be downloaded as a set.

Otherwise:

OpenBSD in general: There's "Absolute OpenBSD', kind of more 'user/admin' level.

For lower-level stuff like API's, kernel organization, etc, the McCusick books (Design and implementation of the {4.3BSD,4.4BSD, FreeBSD} Operating System), though either dated, or more specific to FreeBSD, respectively, still cover quite a bit of stuff that still applies to OpenBSD (most changes have been incremental, and can be tracked through the source tree history back to the original USG sources if needed)

I'd suggest running an install 'from source' on a spare machine/vm/etc for a while and reading docs and the source tree this will get you familiar enough with the system to have an idea where to go next.

</comment></comment><comment><USER37> Distinct, not unique, I believe.

<comment><USER38> Random linking of at least 160 files will give more combinations than there are atoms on Earth. I counted 1206 *.o files in OpenBSD kernel. Unique enough?

<comment><USER37> Distinct enough, sure.

Unique means something else.

<comment><USER38> Oh, I'm sorry, unique in the current Universe from its birth many many trillions of trillions of years until after the death of all currently known galaxies. Still not unique?

No other OpenBSD installation had or will _ever_ have the same kernel, so each kernel is unique.

<comment><USER37> You seem to think that I'm arguing that collisions might be a problem. I'm not. I'm raising a point of English usage. "Unique" is not the right word to use in this context; "distinct" is correct.

If a set has a single member, that member is unique; e.g., 2 is the unique even prime number.

If a thing is different from all other things, it's distinct.

<comment><USER38> Huh? From the set of all possible linked OpenBSD kernels (2^number_of_dot_o_files), the kernel you re-link is unique. And distinct, too.

<comment><USER39> It's n!, which is much bigger than 2^n.

<comment><USER38> Thanks for correction.</comment></comment></comment></comment></comment></comment></comment></comment>


Update on Linksys WRT1900AC support - <AUTHOR> https://forum.openwrt.org/viewtopic.php?id=50173

<comment><USER2> Wow, they don't even release the gpl code they're distributing but announce that it supports openwrt? Linksys is really riding on those guys backs...

Btw, Asus has the best hackable access points nowadays, in my opinion.</comment>


Simple Apache Vhost templating with Ruby - <AUTHOR> http://tempe.st/2009/04/apache-vhost-templating/

<comment><USER2> Nothing amazing, but I'm sure a very useful script as sometimes if you need to add multiple domains vhosts would be a pain without some automation.

<comment><AUTHOR> You're right, it's quite simple, but it does its job :)</comment></comment>


How I made $12,000 with an ebook in 24 hours - <AUTHOR> http://blog.lessmilk.com/ebook-sales/

<comment><USER2> This is great! I've played around a bit with some tutorials online but it's great to have an all-in-one resource.</comment>


My close encounter with a pay-to-pitch investor - <AUTHOR>

You encounter lots of crazy people while fundraising for your startup. The results can be entertaining. Here's my favorite:<p>https://medium.com/p/872e3afdec9f <comment><USER2> Is there any particular reason why you didn't do the usual thing and submit the actual link, including your "descriptive" text in the actual article?

<comment><AUTHOR> No particular reason, just giving a 2-sentence context to why I posted the link.

<comment><USER2> Seems particularly obvious given this audience. You do know that submissions without URLs are punished in the rankings, making it less likely to reach the front page, and hence less likely to get much attention, yes?

It's also less likely to get readers, because it isn't a clickable link.

<comment><AUTHOR> ahh that would be because I"m an idiot. Thanks for the heads up.

</comment></comment></comment></comment><comment><USER3> Clickable:

[https://medium.com/p/872e3afdec9f](https://medium.com/p/872e3afdec9f)

<comment><AUTHOR> Thanks :)

</comment></comment><comment><USER4> Good job dodging these guys.

BTW, I'm an active client of yours and love what you have going.

</comment><comment><USER5> Why edit out their names? You should expose these morons so others don't waste time with them. Also your reply email was way too polite.

</comment><comment><USER6> Good post, just wish you'd name the "investor."

<comment><AUTHOR> Email me. bernie[at]bombfell[dot]com</comment></comment>


Show HN: Location based sound settings (weekend project) - <AUTHOR> http://itunes.apple.com/app/volumify/id491340142?ls=1&mt=12

<comment><AUTHOR> Hi folks,

a friend and I developed Volumify a few weekends ago and now finally its in the Mac App Store.

TL;DR: The app can do two things for you: Disable the startup sound of your mac and adjust your sound settings based on your current location.

Here are four promo codes that you can redeem in the Mac App Store (first come, first served): LA9RJXWKMWEK AFNJ4WLMNF3P FHPMHAYK6A3L 7NKEAN63JM4F</comment>


Apple Bans the Word 'Android' From App Store - <AUTHOR> http://www.pcworld.com/article/188696/apple_bans_the_word_android_from_app_store.html/ <comment><USER3> The application in question has not even been rejected, much less mass banning of apps that contain the word happened. They just suggested not to mention the competitor's platform:

 _While your application has not been rejected, it would be appropriate to remove 'Finalist in Google's Android Developer's Challenge!' from the Application Description_

I can understand why that would be appropriate. Most users would have no idea what Google's Android Developer's Challenge is: "How do I download the other finalist apps?" "I bought this application that says it's Android - how do I run it in my wife's Nexus One?".

Not to mention the courtesy of not promoting competitors products in one vendor's own turf.

This is a huge overreaction by the PCWorld editor to linkbait you all. Even the application author thought it was reasonable. I'm surprised no one had picked up on this yet.

<comment><USER4> While I agree that the article title was linkbait, I think the author had a valid point in noting that mentioning that the app was a finalist in a big competition does help in vouching for the app's usefulness. This isn't something that Apple should be discouraging, and the fact that they do does make them seem, well, petty.

<comment><USER5> The app wasn't a finalist. You can't enter an iPhone app in an Android competition. Logic like this is what makes people think Microsoft Office for Mac is as full featured as Microsoft Office on Windows. They're too very different products with different codebases and functionality that attempt to mimic some behaviour between each other. Have you seen the frustration of an Office:Mac user when they realize, for instance, that they can't do something simple like get Entourage to work with an Exchange server or get Office to connect to Sharepoint?

<comment><USER4> Is that relevant? The point I was making is that Apple should not be discouraging it regardless. Be that as it may, you make an interesting one. Are you saying that Microsoft should be discouraged from marketing Office for Mac as Microsoft Office? That does not seem like a reasonable position to take.

</comment></comment></comment></comment><comment><USER6> Currently deciding whether to buy an iPhone or an android phone. This has made the decision easy - android all the way.

<comment><USER7> App stores are generally broken because you can have the ability to ban things. We should have an open appstore.

<comment><USER8> The mechanism of banning apps is useful so that users can have a trusted place to get apps known to be free of malware.

The way to make sure that mechanism doesn't result in evil policy is to allow an alternate means of installing software. Google does this. Apple does not.

<comment><USER9> and mentioning android in the app description is in which way malware? i see the point in verifying apps that need security (banking mostly). but that doesnt account for 99.99% of apps. Plus, mostly what you hear about which apps where banned, it's not about security. It's about bookreaders that can show the kamasutra (which the browser can, too). It's about software that "replicates" apples functionality. You will never have alternative browsers or mail programs and be tied to apples mercy. I have the choice. Let's face it, the appstore is apples way to have control over its customers.

<comment><USER10> _i see the point in verifying apps that need security (banking mostly)._

I don't understand how you're using "security" in this sentence.

</comment></comment></comment></comment></comment><comment><USER11> It's hard to understand how an organization as savvy as Apple could do something like this. What do they really think they're going to get out of it, other than bad press? I'm not even saying that the tradeoffs aren't worth it, but that there's no upside at all. What possible benefit could this have?

<comment><USER5> Actually it's really simple to understand. Last time I checked, Google had a trademark on the word Android. An integral part of trying to assert a trademark is enforcing certain usages. Otherwise people start calling all similar products by your product's name (e.g., paper tissues become Kleenex) and you lose that trademark.

From Google themselves (<http://www.google.com/permissions/guidelines.html>):

"One of the conditions for all uses is that you can't mess around with our marks. Only we get to do that. Don't remove, distort or alter any element of a Google Brand Feature. That includes modifying a Google trademark, for example, through hyphenation, combination or abbreviation, such as: Googliscious, Googlyoogly, GaGooglemania. Do not shorten, abbreviate, or create acronyms out of Google trademarks"

...

"Don't incorporate Google Brand Features into your own product name, service names, trademarks, logos, or company names."

My money is on either Apple's lawyers or Google's lawyers coming up with this policy. I know it's en vogue to jump on Google as the knight in shining armour and Apple as the villain, but let's not jump to conclusions here.

<comment><USER12> Did you read the article though?

> _During our review of your application, we found that your application > contains inappropriate or irrelevant platform information in the Application > Description and/or Release Notes sections_

This seems to me more like a "Thou shalt not mention a competing platform" rule than a "We're covering our asses from lawsuits" rule. I mean the guy was only mentioning that he had been a finalist in Google's "Android Developer Challenge." Are you going to tell me that Google can sue someone for trademark infringement over that?

I could see if he was pimping another platform like, "Hey! This app is available for Android too!" Maybe in that case Apple wouldn't want him advertising another platform, but even that doesn't make sense. They only people that are viewing his App's description are people that have an iPhone, right? So why would they care about Android compatibility? It's not likely someone would drop their iPhone and rush out to buy an Android phone over a single App.

<comment><USER5> It seems the entire linked story was misleading. The dev mentioned the app was a finalist in a Google Android competition. Apple didn't reject it but suggested (whatever that means) the description be changed to remove mention of being in the competition and I agree <http://news.ycombinator.com/item?id=1106361>. The iPhone app port wasn't the competitor in that competition.

<comment><USER12> But presumably it was a 1:1 port, not a 'lite' version. In which case, the only major difference there might be would be would in the performance department, though I'm unsure if the competition weighed that heavily.

</comment></comment></comment></comment></comment><comment><USER13> Can't wait for Apple banning apps because their developers use GMail.

<comment><USER11> Apple does have something of a weird relationship with Google at the moment...Gmail is one of the email providers on the iPhone with "express" setup, and they have pre-installed apps for Google Maps and Youtube. On the other hand, Android. Seems like a perfect opportunity for MSFT.

<comment><USER14> To be fair, Gmail's express setup is somewhat unsanctioned. Gmail's documentation explicitly advises against the use of that express setup button:

        What if I tap 'Gmail' instead?
        Archiving and deleting messages will work differently. Our instructions ensure Gmail works as designed.

[http://mail.google.com/support/bin/answer.py?hl=en&answe...](http://mail.google.com/support/bin/answer.py?hl=en&answer=77702)

</comment></comment></comment><comment><USER15> The title of the article is misleading. It's not like they rejected a game named "Android Apocalypse." Why should they host any content that promotes another platform?

</comment><comment><USER16> The article makes use of straw-man argument by bring up VOIP apps. But the avoiding of mentioning a competing app seems reasonable. If there was a Zune store I don't think any would think it appropriate for apps to mention the iPod.

The developer can always encourage people to visit their website, and provide more company/product history there.

</comment><comment><USER17> Apple is being stupid, it makes them look bad and does Google's job for them.

</comment><comment><USER18> "I guess I'm just old-fashioned: I like to receive my content unfiltered and make my own decisions."

then, why are you using an apple product? Part of the iphone value proposition is that they do that filtering.

</comment><comment><USER19> Well can you blame Apple?.. they didn't want to have their infallible image tarnished by having an top ADC app advertising that it was designed for a competing platform. [/sarcasm]

Boo

</comment><comment><USER20> Flagged due to headline and sensationalist content.

<comment><USER21> This really contributes a lot to the discussion, thanks.

</comment></comment><comment><USER22> My gut feeling

Google vs Apple: Whoever wins, we lose.

But about android phones, it's more freer than iPhone anyway.

</comment><comment><USER23> Hey, it is their store ... whatever they want.

<comment><USER12> Does that mean that we have to approve of what they do? I don't think that anyone is claiming that they don't have the 'right' to do it.

</comment></comment><comment><USER24> evil

<comment><USER25> vs good!

</comment></comment><comment><USER26> i think steve jobs does these kinds of these things just to get press - <USER2> doesn't matter if they're percieved evil or good - poeple will love him and buy his products anyway</comment>


Show HN: Battleship game built with Elixir, Phoenix, React and Redux - <AUTHOR> https://github.com/bigardone/phoenix-battleship <comment><USER2> My coworker and I just tested this. It doesn't say when you've sunk a battleship. This took us to frown town.

Also, it doesn't show you the borders between _your_ battleships if they're touching. Makes using the honor system to supplement the first thing very difficult.

</comment><comment><USER3> Very cool demo of these technologies. I played around with Phoenix a few weeks ago and haven't had a chance to come back to it.

Are you using Phoenix channels for the real time communication?

<comment><USER4> Looks like the author is using a server side route and controller just to render the initial view - and then beyond that he has two channels: one for players to join a game and one for managing game mechanics.

I'm just learning Elixir and Phoenix myself. Looking at the source of this it is apparent even to me a newbie that a two player game where game state is managed as a supervised process - and the server manages many games is a nice example of the power of Elixir/Erlang to facilitate concurrent development.

</comment></comment><comment><USER5> I've long wondered how a Battleship MMO might work, a game with a huge world map and multiple factions/navies trying to bomb each other. :)

</comment><comment><USER6> As a frontend developer working who works with React and Redux, I keep seeing Elixir and Phoenix articles popping up nowadays.

What is the best reason to learn Elixir and the Phoenix for someone like me who just handles the client side part of a web application? Is it a better alternative to say, Django or RoR?

<comment><USER7> If you just handle the client side part, you don't really need to learn any of it. If you do need to get into the server-side, Elixir/Phoenix seems like a great fit if you are doing real-time/concurrent stuff (websockets are dirt- simple). If you just need a persistent storage backend, RoR or Django will get you up and running quickly, and both are adding their own websocket support as well.

</comment></comment><comment><USER8> I am waiting for an opponent.. [https://phoenix- battleship.herokuapp.com/game/DHT33GgB](https://phoenix- battleship.herokuapp.com/game/DHT33GgB)

<comment><USER8> Hrm, went back to tab and it said "Game over"...

<comment><USER9> Hi! That's because someone joined the game and then left. The game process listens for exit messages from the two player channels. In case a player leaves, the game ends and sets the remaining player as winner.

</comment></comment></comment><comment><USER10> Can not copy the url for a session using the iPad.</comment>