AP Not Amused By The Woot Story, Tries To Play The Oil Spill Card - <AUTHOR> http://techcrunch.com/2010/07/06/ap-woot-oil-spill/ <comment><USER2> This article reads like an annoying friend kept instant messaging me while I was away from my desk to narrate a petty internet social encounter as it was happening, then I come back with my Starbucks Frappathingie and furrow my brow because I have six pages of IMs filled with condescending "can-you-believe- this-guy-is-so-stupid-ha-ha-what-a-troll" drivel in the window's scrollback history.

<comment><USER3> Agreed completely. Not only is this not even news, it's not worth caring about... it's just a squabble with TC being the loudmouth, rallying it's readers against some target we're supposed to care about because they said so.

<comment><USER4> I think how AP deals with this situation is interesting regardless. I'd take it as a nice example of how NOT to do PR work for your company.

The best thing AP could've done, would be to pay the 17.50$ with a nice gift card, buy the headphones for all their CEOs or "come clean" in some other humorous way. Instead, they behave like a little child.

</comment></comment></comment><comment><USER5> The AP's position seems really silly at first, but the link they provide is actually worth reading. If what they say is true -- namely that 1) this isn't targeted at bloggers or anyone else using the content in a way that can be reasonably assumed to be fair use; and 2) this is a simple way to license content you have reason to believe may not qualify for fair-use protection -- then I think this seems fairly reasonable.

EDIT: Just want to make the logical fallacy explicit. The fact that the form _allows_ you to pay for 5 words does not imply that the AP _expects_ you to pay for 5 words.

<comment><USER6> Except that's disingenuous, because the AP _has_ suggested that bloggers and Google and basically anyone else who reprints AP text should pony up the fee. They don't explicitly say so in detail, but they've had a pretty consistent campaign of FUD about it.

For example, their document on the question "Do I even need to pay to excerpt your story?" prominently notes that "the safest course is always" to pay the fee, and suggests that if you're publishing the excerpt "on the Web," that "is cause for serious reflection before assuming 'fair use'" — particularly if you are "choosing not to exercise an affordable and accessible licensing mechanism."

Think I'm reading too much into a CYA legal document? Take a look at this story, where AP president says that they want to be paid for "any use of news articles," even as little as citing a headline: [http://www.nytimes.com/2009/07/24/business/media/24content.h...](http://www.nytimes.com/2009/07/24/business/media/24content.html?_r=1)

<comment><USER5> _..."the safest course is always" to pay the fee_

Well, this has got to be true, right, since there's no reliable way to tell if your usage is fair _a priori_?

<comment><USER6> It's definitely true, but in a document linked right from the payment page, it's rather self-serving. Taken in context with the rest of the document and the AP's utter silence on what might possibly count as "fair use" in its eyes, the message it sends is more than just cautious legal advice.

It's tantamount to someone running a protection racket pointing out that you're less likely to get hurt paying his fee than fighting it: He's right, but it doesn't legitimize his demands.

</comment></comment></comment></comment><comment><USER7> Were I Paul Colford, I'd have bought the headphones, sent Woot the receipt, and noted publicly that this is in no way a payment for the quote, but merely a very good deal on headphones.

<comment><USER8> And it only costed you $17.50 in damage control.

</comment></comment><comment><USER9> The AP may be clueless, and Woot may be funny, but TC is just lame. They're just trolling for pageviews.

<comment><USER10> TC is trolling for pageviews perhaps, but I did like copy-and-paste of an entire AP story at the end.

<comment><USER11> I thought the copy/paste was kinda childish. I was actually still amused up until that point.

</comment></comment></comment><comment><USER12> Shouldn't the title of this link be: "TechCrunch overturns two year moratorium on posting AP content to prove a moot point"?

AP's attempt to control their content sucked, but TC is being way snarky.

<comment><USER13> They don't have much else besides snark. When all you've got is a hammer, I guess you're gonna pound some nails into AP's face.

</comment></comment><comment><USER14> What the AP flack meant to say:

"We are the AP, we are a for-reals, big-timey news agency. Without us you wouldn't even know what was happening two towns over. Thus, re-using our content costs money, because our content is valuable. You, _you_ are just some guy who runs a multi-million dollar company or some a-hole with a blog. Your content is meaningless pablum slathered on the walls of the digital romper room that is "the internet". It is valueless and thus we are able to reproduce it in any way we choose."

<comment><USER15> Also:

"BAM! Look behind you, an oil spill!"

<comment><USER16> Who let the narwhals in?

</comment></comment></comment><comment><USER17> AP are dinosaurs, Woot are genuinely amusing and TC are trolling.

All is "right" in the world.

But why is it on hn :(

</comment><comment><USER18> It seems utterly bizarre that posters here apparently belive that the AP's copyright stance is no big deal. The last time I checked, the AP still considered using headlines to be a copyright violation and the only reason they weren't going after sites like Hacker News is because they haven't yet figured out how to deal with PR fallout they experienced last year when (simultaneous with other controversies surrounding their legal attacks on sites) their board actually voted to go after news aggregators. Do note, they have already sued at least 2 news aggregators.

</comment><comment><USER19> The lesson, of course:

Never get into email pissing matches with someone willing to be more shameless than you are.

</comment><comment><USER20> I read the AP article that was linked as follows:

Certain Parties (not HN, Groklaw, Daring Fireball, etc..) have requirements that they license all the content they display (NYT, CBS, CNBC, GM, etc...) - those parties now have a mechanism to license our content. NYT and many (thousands) are already a subscriber to AP. Other parties can pay by the article and _eliminate_ any downstream liability. All others can play the fair use card.

SqlLite will do the same thing for their software - it's freaking public Domain, but: <http://www.hwaci.com/cgi-bin/license-step1>

</comment><comment><USER21> I'm the only one to blame for clicking on that techcrunch.com link, knowing it's not worth it.

</comment><comment><USER22> hah! for once i'm amused by techcrunch's antics

</comment><comment><USER23> The TC article is a bit childish, but I laughed pretty hard when they reproduced the entire AP oil spill article.

</comment><comment><USER24> Even TC sometimes has a slow news day.

</comment><comment><USER25> By taking the high road of ,we cover real news, they set themselves up for ridicule from Bloggers who cover even more "important" news.

<comment><USER26> But "we cover real news" is just a distraction from the fact that their own policy for citing the works of others is vastly different than what they expect when others cite their works.</comment></comment>


Nurture Alone Can't Explain Male Aggression - <AUTHOR> http://nautil.us/blog/nurture-alone-cant-explain-male-aggression <comment><AUTHOR> Any ideology or policy prescription that does not accurately reflect the reality of human nature is bound to be ineffective or counterproductive.

A lot of the claims in this article are intuitive or common sense. However, there is a subset of people who wish to engineer society in such a way as to erase variation between different groups.

Men are more aggressive than women. Men will probably continue to be more aggressive than women. We should try to harness this variation for good outcomes rather than try to eliminate the variation altogether.</comment>


OSCON 2007 - Simon Peyton-Jones - A Taste of Haskell Part I [video] - <AUTHOR> http://blip.tv/file/324976

<comment><AUTHOR> Slides at [http://research.microsoft.com/~simonpj/papers/haskell- tutori...](http://research.microsoft.com/~simonpj/papers/haskell- tutorial/TasteOfHaskell.pdf)

<comment><USER2> Hmm. Doesn't load for me ... Any mirrors? I've looked but can't find one. The video is useless because you can't really ever see the screen/slides/code/etc.

<comment><AUTHOR> Strange, it loaded for me yesterday. Now it doesn't load for me either.</comment></comment></comment>


U.S, Israel developed Flame virus to slow Iranian nuclear efforts, officials say - <AUTHOR> http://www.washingtonpost.com/world/national-security/us-israel-developed-computer-virus-to-slow-iranian-nuclear-efforts-officials-say/2012/06/19/gJQA6xBPoV_story.html <comment><USER2> I find it quite ironic that both this article and the nsa one are on the front page at the same time. Something that is supposedly top-secret is leaking all over the place, while something that ought to be open is completely clamped down shut.

</comment><comment><USER3> Is there anything new in the article?*

* This is not a disparaging comment, it is a legitimate question.

<comment><USER4> I think this is the first high level source acknowledging authorship of Flame -- the recent big NYT piece on the Bush/Obama cyberwar only featured official acknowledgment of Stuxnet.

</comment></comment><comment><USER5> I guess China is now free to create their own shitware to slow American economic recovery no? The supremacist attitudes in our country are unbounded.

<comment><USER6> If USA had threatened China with destruction and had been known to actively work towards that goal, then yes, China would be right to resist. This is not the case, and therefore your question is invalid. (It also smells like the party line of anti-Americanism, which is sad to witness on HN.)

</comment></comment><comment><USER7> God forbid some _other_ country in the region acquire nuclear technology.

I find it exceedingly hypocritical and pathetic that Israel wants to stop the spread of nuclear arms in the Middle East when it's sitting on the only (massive) stockpile.

<comment><USER8> Going the extra mile to prevent a country which is your avowed enemy and an avid supporter of major international terrorist organizations is not "hypocritical" it's the very definition of sanity.

The Iranians are decent people on the whole. The Iranian regime is not the sort of organization you want having control of anything sharper than a crayon.

<comment><USER9> Russians are somewhat nice people too, but their regimes from 1900 until now, scares the sh*t out of me, more than any other regime, ever. I think we should take their nukes away from them as soon as possible.

</comment></comment></comment><comment><USER10> Sourcing unnamed 'western officials' doesn't lend this too much credibility, however this could have grave consequences for how governments deal with communication networks, and therefore the internet

</comment><comment><USER11> Wasn't that kind of obvious after the discovered similarities that suggested "cooperation" between Flame and Stux developers? Pandoras box is open, will be interesting to see what follows.

</comment><comment><USER12> Serious question: Why isn't this considered an act of war?

<comment><USER13> Because Iran would lose a war.

</comment></comment><comment><USER14> The "Israel April attacks" mentioned in the text:

<http://m.upi.com/story/UPI-85701335473868/>

</comment><comment> excuse-me In other news - "vatican inhabitant with big hat is a catholic shock"</comment>


Ask HN: What is the best Udemy course you took? - <AUTHOR> <comment><USER2> I've struggled to enjoy the Udemy courses that I have tried. So many of them are "i'm gong to do x" and they write the code and largely... just roll on. There's not much explaining of concepts, elaboration, and largely the presenters don't repeat themselves when they're reinforcing a concept.

When watch something that I already know I can catch what they are trying to say but so many things are mentioned in passing / not emphasized.

<comment><USER3> To be fair, this isn't just a Udemy problem. I paid $1000 for a udacity nanodegree, they too write some code and keep moving sometimes with no explanation.

At least with Udemy, it is just $10-$20 most of the time :)

<comment><USER2> True.

I wish I could find some reliable content where they stopped to explain or such. Granted I'm not sure people would buy it much as it would slow things down.

Ok here is how you ... there's the code... is of limited value, if any.

I should note that I've been trying out Frontend Masters content and so far been pleased.

</comment></comment></comment><comment><USER4> Somebody mentioned a Udemy course in this thread:

Ask HN: What are the best MOOCs you've taken? [https://news.ycombinator.com/item?id=16745042](https://news.ycombinator.com/item?id=16745042)

The course is Ethical hacking. [https://www.udemy.com/learn-ethical-hacking- from-scratch/](https://www.udemy.com/learn-ethical-hacking-from-scratch/)

</comment><comment><USER5> Anything front-end related by Maximilian Schwarzmüller. Or Stephen Grider.

<comment><USER6> I took Stephen Grider's Ethereum course. He is a great teacher but like another user posted above, Udemy doesn't get into depth I'd like to see when I want to learn something.

<comment><USER5> Yeah I was talking specifically about front-end related courses by those two guys. Don't know about the depth of their courses on other topics.

</comment></comment></comment><comment><USER7> Digital Marketing Masterclass is useful and great for an introduction.</comment>


Show HN: SimpleRT – reverse tethering utility for Android - <AUTHOR> https://github.com/vvviperrr/SimpleRT <comment><USER2> This would be helpful to cut power consumed by wifi broadcasting as well as reduce your RF aura. I wonder why it isn't baked into AOSP yet.

<comment><USER3> it isnt backported because all of android features are self-serving to google.

it is a linux computer where you have absolutely no control over network. You must root to get a basic firewall, only because people used the firewall previously to block ads.

heck you can't even disable referrer headers on the browser (hint, that's how google get their share on ad clicks).

<comment><USER4> There's no need to assume malice here. Disabling referrers is an extremely niche desire. Also how often does your laptop have an Internet connection that you can't just join as well from the android device? I'm not saying it doesn't happen, but omitting it from base Android is hardly malicious.

<comment><USER5> While the referral complaint is pretty silly, this networking thing is bit indicative about the "appliance"/"toy" nature of Android devices. Either there is an app for something or you can't do it.

In comparison for example webOS and Maemo did the analogous thing by using mainline usbnet driver from kernel and configuring routing with standard route command etc. This is possible because they did not flinch from exposing the full power of the underlying system for those who want it.

> Also how often does your laptop have an Internet connection that you can't > just join as well from the android device?

Corporate networks would be a common example. Or wired-only networks (yes, such things do exist still).

<comment><USER6> > While the referral complaint is pretty silly, this networking thing is bit > indicative about the "appliance"/"toy" nature of Android devices. Either > there is an app for something or you can't do it.

You can write an app to do something the designers of the system didn't anticipate. That's a mark of a versatile system.

> In comparison for example webOS and Maemo did the analogous thing by using > mainline usbnet driver from kernel and configuring routing with standard > route command etc. This is possible because they did not flinch from > exposing the full power of the underlying system for those who want it.

I believe that, with root, you can install/load/configure kernel modules (mainline or otherwise) on Android as well. Here's a stackoverflow article talking about creating loadable kernel modules: [http://stackoverflow.com/questions/6282669/how-do-you- create...](http://stackoverflow.com/questions/6282669/how-do-you-create-a- loadable-kernel-module-for-android)

</comment></comment></comment></comment></comment><comment><USER7> Looks really cool. I hope you don't mind (I see it's your first free software project), but I've opened a PR to add GPLv3 notices so that it's easier to find out what the license for your code is. I'd recommend doing this for all future projects, as it makes it much easier for people wanting to use your code or package your software what license they have to comply with.

Contrary to popular opinion, not specifying a license makes your code proprietary (though you did mention the license at the very end of your README, which is something).

[1]: [https://github.com/vvviperrr/SimpleRT/pull/2](https://github.com/vvviperrr/SimpleRT/pull/2)

<comment><USER8> Specifying license info in every single file is entirely unnecessary and done far too often.

Imagine a book including a copyright notice on very single page. The license was specified in the manner the author chose to specify it, and that is sufficient.

<comment><USER9> [https://www.gnu.org/licenses/gpl- howto.en.html](https://www.gnu.org/licenses/gpl-howto.en.html)

> the process involves adding two elements to each source file of your > program: a copyright notice (such as "Copyright 1999 Terry Jones"), and a > statement of copying permission, saying that the program is distributed > under the terms of the GNU General Public License (or the Lesser GPL).

Whatever you think about the GNU guys and the license, they do have good lawyers. If they say this is how you should apply GPL to your programs, they're most likely right.

</comment></comment></comment><comment><USER10> Thanks vvviperrr, great initiative :)

I may try it some day.

<comment><AUTHOR> Thanks a lot)

</comment></comment><comment><USER11> How about using a micro-usb-to-usb cable + usb-to-ethernet adapter? Nonetheless, impressive.

<comment><AUTHOR> Yes, it's possible. But! Android kernel should support your ethernet adapter plus device manufacturer should add eth support in android firmware itself. If you have rooted device no problem with it (you can configure eth from command line). With unrooted device it's impossible.

</comment></comment><comment><USER12> nice feature, very useful in some scenario</comment>


You're not changing the world - <AUTHOR> https://m.signalvnoise.com/youre-not-changing-the-world-dc5906819e49 <comment><USER2> _(And look, some of them do end up changing the world. The world is different now that, say, Twitter is here, and the president of the United States can threaten nuclear war from the comfort of his golden shitcan. Seriously, that is different!_

Yeah, change the world seems to be synonymous in practice with making it worse, when it's not espoused as a goal. When it is an explicit goal it's synonymous with pathetic ambition and a desperate need to feed the ego. If you want to change the world, VC funded tech is unlikely to do it. If you want to change the world in a positive sense, it's not as easy as throwing a metric ton of money me fragile ego at the problem.

If you want to play the lottery, then by all means, SV it up and don't apologize for your choice; it's your life. Just please, stop blowing smoke up our collective asses.</comment>


Why 0.1 + 0.2 == 0.3 is false? - <AUTHOR> http://stackoverflow.com/questions/6874357/why-0-1-0-2-0-3

<comment><USER2> This headline is backwards -- it's the opposite of the actual stackoverflow question. The question is why, in the D language, `0.1 + 0.2 == 0.3` is _true_ , when it should be false given the underlying floating point implementation.

(Spoiler alert: the answer is that the addition is done at compile time rather than run time.)

</comment><comment><USER3> Douglas Crockford (JavaScript: The Good Parts) has talked about this problem with binary floating point to do decimal (human) math, on many occasions.

Here is one such instance. [http://www.yuiblog.com/blog/2009/03/10/when-you- cant-count-o...](http://www.yuiblog.com/blog/2009/03/10/when-you-cant-count- on-your-numbers/)

He has been on a crusade to introduce a decimal based floating point standard because he believes it is finally time we revisit this decision to use binary floating point.

Edit: spelling

</comment><comment><USER4> On a side note, Excel is infuriatingly inconsistent: some operations work in a way that .1 + .2 == .3 (for example, try `=0.1+0.2=0.3`) but others fall apart (displayed as a fraction with one digit, 0.3 -> 2/7 but 0.1+0.2 -> 1/3)

<comment><USER5> floating point is hard. backwards compatibility is even harder

<comment><USER6> For a modern spreadsheet it would not be unreasonable for a user to expect symbolic arithmetic rather than floating point error soup.

</comment></comment></comment><comment><USER7> In guile[1]:

      % guile
      guile> (= (+ 0.1 0.2) 0.3)
      #f

[1] - [https://www.gnu.org/software/guile/](https://www.gnu.org/software/guile/)

<comment><USER8> Guile(and most Lisps such as Common Lisp) support rationals specifically to avoid this problem, why not just use them ?

      scheme@(guile-user)> (= (+ 1/10 2/10) 3/10)
      $1 = #t

<comment><USER9> perl6 also use rationals (by default)...

      $ perl6

      > 0.1 + 0.2 == 0.3
      True

      > (0.1 + 0.2).perl
      3/10

For perl5 you must use the _bigrat_ pragma:

      $ re.pl

      > 0.1 + 0.2 != 0.3
      1

      > use bigrat;
      > 0.1 + 0.2 == 0.3
      1

ref: [http://perldoc.perl.org/bigrat.html](http://perldoc.perl.org/bigrat.html)</comment></comment></comment>


AN AI READING LIST - <AUTHOR> https://www.theverge.com/2019/1/29/18200585/understand-ai-artificial-intelligence-reading-list-books-scifi <comment><USER2> Book links are Amazon affiliate links (tag vergeopt-20).</comment>


Show HN: First free open-source Telegram freelance market - <AUTHOR> https://github.com/ArbeitBot/ArbeitBot <comment><USER2> Thanks for sharing! Any plans on different platforms such as Facebook Messenger?

<comment><USER3> Thank you for your interest! We do plan to expand to Slack and Facebook Messenger indeed. You can follow our development roadmap on the official page: github.com/arbeitbot</comment></comment>


Ask HN: Enable a Linux firewall without locking yourself out? - <AUTHOR> I have a friend who has an ubuntu server at a remote datacenter (not cloud based unfortunately), the other day he set up the ufw firewall and even though he assures me he added his IP address to the rules, he was locked out when he enabled the firewall
sudo ufw allow from his-ip-address
sudo ufw allow
ssh sudo ufw enable
It ended up costing him over £200 to pay for out-of-hours support for an engineer to drive to the data centre and restart the server.
He still needs to enable the firewall, but is very worried about getting locked out again. How can he do this without locking himself out?
My initial ideas are :
1. have a crontab that runs every 10 minutes to disable the firewall. Then enable the firewall, test he can still gain access. If not, worst case he is locked out for 10 minutes
2. run a shell script that enables the firewall, sleeps for a few minutes, and then disables it This would need to run in something like tmux so that when the session is killed by the firewall the script will continue running
Is there a better way?
I have already suggested he take a look at moving to AWS - but that may take some time.
Thanks <comment><USER2> Yeah, option 1 is what I do for my own remote machine.

      0 * * * * /sbin/pfctl -f /etc/pf.conf.knowngood

If needed, copy then edit the known good file, load rules temporarily, make sure everything works. Make sure the tests have enough time to run (that is: don't reload every minute, but every <long enough duration here>). If all is OK, then backup the old known good file, move the new one in place.

</comment><comment><USER3> ufw is awesome and really shit at the same time... as long as you just need opened & closed ports its all fine, as soon as you do something with multiple networks (Docker, VM's) you have to fix quite alot manually into iptables directly and make sure it gets readded whenever ufw decides to overwrite iptables.

i can highly recommend to directly use iptables and take a look at the arch linux wiki and especially this site [https://wiki.archlinux.org/index.php/Simple_stateful_firewal...](https://wiki.archlinux.org/index.php/Simple_stateful_firewall)

<comment><AUTHOR> Might be a struggle to teach him iptables but the link was useful, even for me

Thanks

</comment></comment><comment><USER4> I mean, honestly the first idea to me seems smart for developing. Once it is set up you just remove that crontab and you're done.

</comment><comment><USER5> i used to get locked out on my early day learning to use ufw and ended reinstalling my vps many times. in the end i just set up a temporary reverse ssh tunnel (using autossh), so whenever i locked out i still able to get back using this tunnel

<comment><AUTHOR> autossh is a nice suggestion

</comment></comment><comment><USER6> iptables</comment>


Ask HN: Accepting crypto as a payment method, your stories? - <AUTHOR> Interested to hear your experiences in adopting crypto (which I personally feel is still very much in the wild west stage), and given the amount of energy in the crypto scene at the moment, whether you have noticed changes taking place in terms of easier acceptance of it as a payment method or simply better awareness of it and what the mood with consumers is like? <comment><USER2> This project accepts Bitcoin [1] and it even accepts 0 confirmation payments [2].

[1] [https://smsprivacy.org/](https://smsprivacy.org/) [2] [https://incoherency.co.uk/blog/stories/zeroconf- payments.htm...](https://incoherency.co.uk/blog/stories/zeroconf- payments.html)

</comment><comment><USER3> A crypto transaction implies a tax event in the USA, so intentionally not supporting. Plus the prices are too volatile to set prices on my own products and have any faith that the crypto will maintain it's value by the time it turns into something I can pay my own bills with.

I don't think people use cryptos as money, more as a "store of value" (read as speculation to get rich quick)

</comment><comment><USER4> We started supporting XLM on solokeys.com, mostly in relation to the keybase airdrop. We figured some people had lumens but didn't really know what to do with them.

We sold a few keys in lumens. The whole process is still a bit overly complex, but overall we learned a few things in the process so we're not unhappy. Let's say it was more fun than a real need.</comment>


A history of modern init systems (2015) - <AUTHOR> http://blog.darknedgy.net/technology/2015/09/05/0/ <comment><USER2> Just installed Ubuntu server on one of my mining rigs. I chose it because I wanted something with proprietary driver support out of the box. Then I spent the next 4 hours on the irc trying to figure out why on reboot my machine was hanging for two minutes complaining about my network. Google was no help, or the support channels. My /etc/interfaces file loooked fine.

In the end it was a missing ifupdown package, but systemd is complicated enough to make me want to pull my hair out.

Please when are we going to get a sane init system again?

<comment><USER3> In fairness, the services that provide Ubuntu's/Debian's /etc/network/interfaces mechanism are Debian-supplied things and not parts of systemd at all.</comment></comment>


Ask HN: Showing unread comments in Chrome - <AUTHOR> I've been using the "HN Unread Comments" plugin for years now but recently I've noticed it has stopped working on multiple machines. It's possible that it is operator error but I'm assuming it just doesn't work anymore.
Does anyone have suggestions for a plugin which will make it clear which comments I have/haven't read? I've seen a few but they all include a lot of other changes, I'd love something which only highlighted unread comments.
I'm curious what's out there and what other folks are using. <comment><USER2> " _HN Mark All Read_ " is a great option. I maintain a fork [1] of the original, as the author stopped supporting long time ago. Source code here [2].

[1] [https://chrome.google.com/webstore/detail/hacker-news- mark-a...](https://chrome.google.com/webstore/detail/hacker-news-mark-all- read/fghfahcbhpdeeaaofcefaoodmfejieok)

[2] [https://github.com/guiambros/HNMarkAllRead](https://github.com/guiambros/HNMarkAllRead)</comment>


Show HN: Christmafy – Spread the Holiday Joy - <AUTHOR> http://www.christmafy.com

<comment><USER2> I like this idea! Great name btw.

I'm having trouble dragging the objects onto there. The images don't seem to stay on there. When I let go of the image, it goes back to the menu area.

Also you should check out Canva which has drag and drop feature. Its more fully featured but i like the simplicity of yours. Its for quickly creating blog and social media graphics.

</comment><comment><USER3> Nice work!

Suggestion: include a way to delete objects that have been added. It might also be nice to be able to flip or rotate them.

Also, you have reindeer horns but no big red nose?! Maybe add that too?

[http://www.christmafy.com/designs/b9omjoPyqp](http://www.christmafy.com/designs/b9omjoPyqp)

<comment><AUTHOR> Hey thanks! Definitely features I'm going to include in the next version.

</comment></comment><comment><USER4> Saving the image seems to result in a blank PNG. Maybe add a button where the user can download the image?</comment>


Capstone: The ultimate disassembly framework - <AUTHOR> http://www.capstone-engine.org/index.html

<comment><USER2> nice work!

they are going to present this at Blackhat USA 2014: [https://www.blackhat.com/us-14/briefings.html#capstone- next-...](https://www.blackhat.com/us-14/briefings.html#capstone-next- generation-disassembly-framework)</comment>


Own Your Identity - <AUTHOR> http://www.marco.org/2011/07/11/own-your-identity

<comment><USER2> One of the most valuable parts of an online identity is the attention you receive from other people. Social networks make getting attention more efficient. In this way, proprietary tools do a lot to enrich your online identity.

For me, this is a great tradeoff. For example, I'm happy to put my pictures on Facebook because my family and friends see those pictures and leave comments that I enjoy. In comparison, my local copies feel like those dusty old photo albums in my parents' basement that nobody ever opens.

</comment><comment><USER3> As he mentions in the post, this is from one of the creators of Tumblr, who's elevator pitch at this point is "a social network that gives users control of their identity". It is one of the easiest ways for someone to practice what he's preaching.

Still, the people who are converting everything over to Google+ aren't crazy (well, they are a little bit, no search and no RSS is kinda a big deal). The design of G+, particularly the permalink pages, does a good job of making the first thing you see the actual content, not the fact that it is on G+.

<comment><USER4> Also worth noting, he's no longer using Tumblr for Marco.org: <http://www.marco.org/secondcrack>

<comment><USER5> And, as discussed in his podcast - _Build and Analyze_ <http://5by5.tv/buildanalyze/18> (ep. 18), this has nothing to do with Marco developing a sudden aversion to Tumblr and everything to do with his desire to be able to roll his own CMS as he has been doing since far before that CMS turned into Tumblr.

<comment><USER4> Ah, correct, this makes more sense now.

</comment></comment></comment></comment><comment><USER6> 'owning it' doesn't mean your own domain. you are only leasing that domain name until you either no longer pay for it or the government in control feels you no longer deserve access to it.

<comment><USER7> While you hit on a genuine problem, there are far fewer legal barriers to Google, Facebook, Twitter or Microsoft terminating your account than for US ICE to seize your .com and .org; ICE needs a warrant for seizure and more to retain indefinitely. Further, you can always get a non U.S. domain, e.g. .ch (Swiss) as used by Wikileaks.

<comment><USER8> That's unless you live in a country where it's becoming commonplace to filter out DNS. I'm honestly hesitant to have my online identity be obliterated at a whim by some reckless government of mine (France); they won't seize my dotsomething, but they will legally be able to block it out of existence, nationwide, _without even the order from a judge_. In that case, there are actually _more_ legal barriers to Google terminating my gmail account on my government behalf than being blacklisted.

</comment></comment></comment><comment><USER9> It's not just individuals that need to own their identity. I work with small businesses and have helped numerous clients move from @aol.com or @hotmail.com addresses to their own domains. And it's not just businesses, either. I have worked in third-world countries and seen governments print "email@example.com" on official documents.

The only reason I don't own my identity online is that I've been too cheap to pay for domain registration. And that's an ever less meaningful excuse.

<comment><USER10> unfortunately having a domain is not enough you have to be on twitter maybe youll have to be on g+ sometime soon too then you dont own it anymore

additionally, ive always worried about the fact that the dns registar generally own your dns and just let you use it for a fee.

<comment><USER11> Yes, for some reason we say we "own" our domains, but I always seem to have to renew my lease.

<comment><USER10> its funny that i get minus karma for this post lol. but yeah id prefer some decentralized dns system where i would own my domain somehow

well then again, dns depends also on static ips which we dont really own. with ipv6 we can be one step closer to owning the ip without being an isp however. can also setup rdns more easily.

<comment><USER12> >dns depends also on static ips.

Not really, there's dynamic DNS. My home connection has a dynamic (well, semi- static) IP, so I use a dynamic DNS provider and a small monitoring utility to auto-update the IP when it changes.

<comment><USER10> No, I'm talking about hosting the DNS, that is, the DNS server, not the IP the DNS record points to. When you buy a DNS record you need a nameserver with a static IP to handle the DNS record. Then you can assign this record to dynamic IPs if you like. Technically the nameserver could also work on a dynamic IP, but practically this doesnt work out in this order.

Even blah.com depends on com and com depends on . (aka dot)

DNS being hierarchical, you never actually own the thing =/

There are decentralized DNS attempts tho

</comment></comment></comment></comment></comment></comment><comment><USER13> Take his arguments farther and you reach Eben Moglen's (co-creator of free software licenses) goal of the FreedomBox, which would enable all to own all their data currently in the cloud.

The project is getting started. It's bold and far-reaching, but so was a free encyclopedia anyone could edit. This page <http://wiki.debian.org/FreedomBox> gives more background and the videos it links to are inspirational.

If you agree with owning your identity, you may like what you read.

</comment><comment><USER14> Interesting that he mentions Hotmail.

Hotmail addresses are indeed notorious for their lack of permanence. Last time I checked, if you do not log in for 270 days, your account is deleted, and your username is up for grabs. [1] If somebody else were to come along and take your username, they could easily gain access to your passwords that can be restored restored via e-mail, as well as your whole online identity.

\</comment><comment></comment><comment>---

1\. <http://www.redd.it/ej321>

<comment><USER15> Well, that's his point: if he had simply trusted the best webmail provider, he would have ended up trusting Hotmail.

</comment></comment><comment><USER16> Going on a tangent, but hotmail is really good nowadays. My non-serious-mail- from-friends account is on hotmail, and it's as good as gmail, a bit better in some stuff and a bit worse in others.

<comment><USER17> _Going on a tangent, but hotmail is really good nowadays._

I hope you're joking. Live Mail (which subsumed Hotmail) is atrocious, the interface sucks. Live Mail also doesn't do a good job of catching spam.

The only thing worse I've used interface-wise is Yahoo! Mail.

<comment><USER18> WHile part of Live mail the hotmail addresses are still valid. The interface while still not to my liking has improved to a usable level in the past year.

To give credit where it's due, the spam filtering has improved dramatically. I've used my hotmail account as a utility email account for at least ten years. I get several hundred spams a week. They are close to 100% in filtering accuracy for me but YMMV. The only problems I've had is that spammy things I've signed up for can be filtered the first time in.

</comment></comment></comment><comment><USER19> However, tumblr does not provide an easy way to export your content.

This makes it not viable as a blogging platform for me.

<comment><USER20> your content is in html, how is it not easy to export?

<comment><USER12> The problem is not the transport format - HTML is no worse than JSON or XML - it's the lack of a standard _schema_.

For e.g. Wordpress to import Tumblr blogs they need to write an importer just for Tumblr's format, whereas if Tumblr used a standard like RSS, WP could use a generalist importer.

Don't underestimate the value of standard formats; the transport mechanism (XML/JSON/HTML) is a small detail.

<comment><USER21> Yeah, writing that importer was certainly annoying. Tumblr's formats are nutty and weird.

<http://wordpress.org/extend/plugins/tumblr-importer/>

</comment></comment></comment></comment><comment><USER22> I wonder if TLD's will ever be perceived as government lock-in e.g. bit.ly, ow.ly, 3.ly are at the whims of Libya and yourname.com is subject to US legislation and enforcement. Great post and 100% agree.

<comment><USER23> Unfortuantely, we are all very vulnerable to malfeasance by governments, especially our own. Governments have done far worse things to their citizens than revoke their domains.

</comment></comment><comment><USER24> Going to post this here, since it seems relevant to tumblr discussion: [http://spinor.tumblr.com/post/7113243594/decentralized- tumbl...](http://spinor.tumblr.com/post/7113243594/decentralized-tumblr)

</comment><comment><USER25> My issue is not being able to decide which domain name to use. My surname is complicated for people unfamiliar with it.

<comment><USER26> Buy your name and the common misspellings?

</comment></comment><comment><USER27> <http://www.kevinrose.com/> should read this.

<comment><USER28> That is almost a counter example though, he has 32000 people in circles while g+ is still quiet limited. If g+ was to go away he could easily redirect the domain and build his core following back up fairly quickly.

This of course is a lot different for say a company that has worked very hard building up something like a Facebook following that while susceptible to marketing messages aren't likely to go out of their way to follow the company to whatever online presences they create.</comment></comment>


Millions of accounts compromised because there is no specialised user database - <AUTHOR> http://fourlightyears.blogspot.com/2015/04/millions-of-accounts-are-being.html <comment><USER2> There is such a beast, it's called LDAP. There are any number of directory and authorization services, and they have probably been around for decades.

There are dozens of directory server options, and probably a few dozen secure authorization solutions, from Kerberos and SAML to proprietary solutions like SiteMinder. Together, these solutions give you EIAM capability that does what you described.

<comment><AUTHOR> My uninformed perception of OpenLDAP is that it is a large, generalised enterprise class directory service that does alot of stuff. The post suggests a minimal, lightweight user database that does nothing at all else - is that the same thing as OpenLDAP?

<comment><USER2> Pretty much.

I wouldn't characterize the magical detection of uncommon access patterns as a minimalist feature (it can be done, but not out of the box in a meaningful way), but other than that, all of the stuff you mentioned is there.

Typically, you use LDAP as a directory store, and a dedicated authentication protocol like Kerberos or SAML for authentication. You can also use LDAP for auth if desired.

If you want to go deep on identity management, the NIST documents are pretty much the canonical source of information. [http://csrc.nist.gov/projects/iden_ac.html](http://csrc.nist.gov/projects/iden_ac.html)

In any case, don't reinvent the wheel. Just because bozos implement user auth in a MySQL table doesn't mean solutions don't exist. It just means that they are bozos. It's one of the reasons I disapprove use of SaaS apps that don't support federated identity at work.

<comment><AUTHOR> Does OpenLDAP meet the stated need for a minimal solution that does nothing else apart from the small set of required functions?

I get the impression that OpenLDAP is a big beast that does much, much more.

I'm wanting a fast motorbike and you're pointing at a 16 wheel heavy hauler saying "see, same thing, the hauler has at least two wheels and an engine".

<comment><USER2> Note I didn't endorse OpenLDAP at all. Not sure if that's the best solution -- I'd probably steer towards 389 server or something similar with Netscape heritage.

You also said:

"Another problem is that developers roll their own user and password management systems and get things like salting and hashing wrong, making the data vulnerable."

You're asking for a distributed, secure system for processing user data and credentials. The most common systems in production globally for doing this (Microsoft Active Directory) are based on technologies developed in the 80's and only being supplanted in recent years. There's a reason for that, and if it were a trivial problem, we wouldn't have pervasive solutions using 1980s RPC in 2015 still running most businesses!

</comment></comment></comment></comment></comment><comment><USER3> I disagree. I think millions of accounts are compromised because users are required give up too much information and can't verify that their user data is stored in a secure way. The solution to this is on the client side, in the browser, not in the server.

The core proposition of this article is that if we make it really easy to store user data correctly, people will do it. This proposition is simply not borne out by the data. Many parts of user security _are_ easy. Take password storage, for example: it's so easy a caveman could do it. Every major languge has a library that takes a password and a salt and a number of iterations and runs it through pbkdf2 or scrypt. Many have these functions builtin. But do people do it? No. It seems like once a month some company exposes X-thousand passwords because they stored it in plaintext or MD5. And I bet a significant portion of HN readers think SHA1 is a valid way of storing passwords, eager to sacrifice security as efficiently as possible. pbkdf2 and scrypt aren't hard to use, people are just idiots.

Making a specialized database just gives people another easy thing to not use.

Ultimately there's no reason to be giving your password to a service in the first place. You only should be giving them cryptographic proof that you have your password, not giving them your password. This is possible with zero- knowledge password proofs[1], but it would require browsers and other client- side software to implement a ZKPP algorithm. This would force servers to either implement a ZKPP algorithm correctly or expose their incompetence to their users. Similar algorithms can be hypothesized for many other user data needs, but passwords would be an excellent start.

[1] [https://en.wikipedia.org/wiki/Zero- knowledge_password_proof](https://en.wikipedia.org/wiki/Zero- knowledge_password_proof)

</comment><comment><USER4> The problem with this assertion is that this data still has to hit persistent storage somehow. Should that be in an arbitrary binary format? How should it be indexed for constant-time access? Essentially the problems that a specialized user database would need to solve would mean re-implementing exactly what generalized databases are built to do.

It's not a problem of _how_ it's being stored. It's a problem of _what_ is being stored.

I would suggest that the world doesn't need a specialized database for this, it needs killer libraries that make all necessary operations dead simple with any backend. And they should be dead simple to find and install.

More fundamentally, though, I'm not sure this problem is entirely solvable. Even with all the libraries and informational websites in the world, if developers don't go out and look for that information (and find the right stuff), they may never know they're doing anything wrong.

P.S. Hello again, alter ego.

<comment><USER5> I don't think the article is suggesting NIHing the stack all the way down. As I read the article I was imagining a layer on top of SQLite that exposes a very restricted API.

</comment></comment><comment><USER6> This entry really boils down to separating user data from other data. But some of the items I don't think work in real usage (or at least I would like some clarification if possible).

> It should be accessible only via its specialised API which is designed to > constrain the ways that it is accessed.

Constrained in what ways? Especially in management / support roles you may need to do bulk actions against users (full listing, bulk changes, etc) so I'm not sure what constraints would be compared to a normal database.

> Its API should have password salting and hashing built in.

I disagree; I think password hashing should happen before the data hits the database.

> Its API should throttle access with some sort of algorithm designed to > prevent downloads of large quantities of user data.

Does someone have an implementation idea for this? Depending on the type of user data we're talking the data could be very small. So the throttling may have to be quite significant but even then what's to prevent the attacker from bypassing it by using multiple connections? Multiple threads that each request a subset? I don't think you can get around those and still have a performant system.

> It should encrypt data internally.

How? Does it encrypt using a passcode specified by the system administrator (which means it exists somewhere on the system or nearby system making it decrypt-able anyway)? Or does this mean encryption using the user's password thus separating the data? If so how do you handle the cases when administrators need to modify the user's information for support or other reasons?

<comment><USER7> I'm working on an application where we have separated the Authentication concerns from the rest of the user data. When a user is registered, we generate a UID and communicate that with the other services. We're going to be using common role terminology across the services, but Authorization is up to each service in relation to those roles.

Our needs are a little different as well, because each service may need to reach out to a third-party service and we are holding a bearer token for the third-party service on behalf of the user. We provide that to the services behind an auth middleware through a header.

(We had considered changing this from an Auth Service to a general User Service, but I am strongly leaning toward having a separate User Service and leaving Auth tightly constrained.)

<comment><USER8> Right, there's a few classes of data that can see that would do well to separate from the database that a website may have unfettered access to.

1) Authentication data (login id?, password) 2) Personal data that is not used in an online manner (depends on the site of course) (full name, email address, etc.) 3) Data that shows up on the site

If this data is segregated in to separate silos with no 'read everything' apis exposed to the web servers, you might stand a chance of not leaking all of your users data when the web servers are compromised. This of course will not help you if the authentication servers are also compromised.

</comment></comment></comment><comment><USER9> Posted as a blog comment but I'd be interested in people's thoughts:

LDAP can be painful to work with, even when using such "industry standards" like Active Directory

I think a specialised server (or even Postgres extension) could be useful but couldn't you set up the following?

* Create a stored proc or similar that does this: SELECT COUNT(PasswordHash) WHERE Username = @Username AND PasswordHash = @PasswordHash

* Create a user account on the database that only has EXEC permissions, not SELECT or anything else

* Restrict the user account to only be able to log in from the app servers (or whatever)

* Restrict the DB admin to only login via a jump box / VPN.

</comment><comment><USER10> Welcome to the world of IAM (identity and access management). There are many solutions to the above stated problem. If you don't absolutely need to store it don't. That includes passwords, ssn, dob, or anything of the sort.

There are a ton of services you can federate with, it's easier for the user less passwords to remember.

If you really want users to authenticate natively. Take a look at one of the new-er players out there Storm Path. It's basically your IAM backend to-go. Don't write your own security if you don't have to :)

<comment><USER11> > If you really want users to authenticate natively. Take a look at one of the > new-er players out there Storm Path. It's basically your IAM backend to-go. > Don't write your own security if you don't have to :)

But depend on an NSA aware third party to store your client's credentials?

</comment></comment><comment><USER12> I wonder why is the call for a dedicated database, rather than for a simplified API instead? Many frameworks provide it already, but base it on the existing database which reduces the integration issues.

For example Symfony has FOSUserBundle [1] which provides nice support for most listed things. Django comes with its auth module [2]. There are more examples like that. They allow easy auth / user management without touching any of the underlying details. And once you actually want to go the direction of LDAP/kerberos/..., it's usually just a matter of switching the backend implementation for something that already exists.

[1] [https://github.com/FriendsOfSymfony/FOSUserBundle](https://github.com/FriendsOfSymfony/FOSUserBundle) [2] [https://docs.djangoproject.com/en/1.8/topics/auth/default/](https://docs.djangoproject.com/en/1.8/topics/auth/default/)

</comment><comment><USER13> I agree with OP that the user authentication data should be segregated, simple, and very well protected. It should act like a hardware security module: it will authenticate users, but never give up their keys.

I tried to find decent hashing in OpenLDAP and Apache DS but didn't. Perhaps I didn't look hard enough. Do they throttle by default?

Who's gonna make LDAP webscale and hipster friendly?

</comment><comment><USER14> Great post, and something I've been thinking about for quite some time. Would love to see an open source framework made available that simplifies many of the nuances necessary to maintain a "secure" user database.

Don't get me wrong, this won't solve everything, but in my opinion it's a pretty big step in the right direction.

</comment><comment><USER15>
      1. s/specialized/separate/
      2. Use SASL, or another authentication protocol to talk to your auth DB.
      3. Profit!

If you're trying to solve a fundamental problem like authentication, odds are someone else has already spent a lot of time thinking up a good solution.

Re: LDAP

This may not be as good as a specialized solution, but it's probably a step up from throwing all your data into the same MySQL DB. ;-)

It's not particularly hard, either, just different from what you may be used to.

</comment><comment><USER16> Wesabe is a good way to store sensitive user data

[https://github.com/wesabe/grendel](https://github.com/wesabe/grendel)

</comment><comment><USER17> Easier said than done. User data is needed in some way, shape, or form in almost any transaction the system performs. Yes you can separate the authentication credentials, and the sensitive attributes from the more routine stuff, and that's a good thing, but things often don't break that cleanly.

</comment><comment><USER18> Why is userdata any more important than the rest of the data in your database?

<comment><USER19> You can impersonate a user with their login data, and given that people frequently re-use passwords, also do this on other sites.

</comment></comment><comment><AUTHOR> OP here. It's a fairly simple concept - any wizards with a few spare hours willing to try to put a prototype together today?

From HN front page to solution within hours!

If it said "built with Golang" or "built with Rust" it would certainly hit the front page.

<comment><USER20> My beta-quality Golang version of this with pluggable backends, including S3: [https://github.com/nmcclain/glauth](https://github.com/nmcclain/glauth) I would love suggestions/help.

<comment><AUTHOR> Ned - would you mind replying to this with a list of the features specified in the blog post and a YES/NO to confirm which are supported by your code?

thanks

<comment><USER20> It should be accessible only via its specialised API which is designed to constrain the ways that it is accessed. YES - API is LDAPS.

It should not provide generalised database query functionality. YES - it only proivdes the subset of LDAP functionality necessary for authentication.

Its API should have password salting and hashing built in. NO - hashed but needs salting&scrypt.

Its API should throttle access with some sort of algorithm designed to prevent downloads of large quantities of user data. NO - todo.

It should encrypt data internally. YES (hashed not encrypted).

It should communicate only over encrypted connections. YES.

It should be distributed. YES.

It should not be run on any web server, should run "behind the scenes" and be accessible only via its API. YES.

It should include triggers and alerts based on uncommon access patterns or recognised nefarious access patterns. NO - todo.

It should have no other purpose. YES.

</comment></comment></comment></comment><comment><USER21> "What developers need is a minimal, single purpose database specifically designed for protecting user information and designed to move user data access away from the rest of the application data to minimise the impact of access by hackers." \- Yea this sort of homogenization of security worked great for OpenSSL

<comment><USER4> I'd argue that it worked exactly as expected. The bug was found, fixed, and patches released immediately. For most people that was just a package-manager update away.

If anybody imagined that openssl had no bugs, they've obviously been proven wrong several times already, and I'm sure they will be proven wrong again.

The point of a single library (or few libraries) is (at least) twofold. It's much less likely to have defects, and when those defects that remain are found, answering the "does this affect me" question is easier and prompts quick action.</comment></comment>


Why This Could Be the Best Cold Email You Have Ever Seen - <AUTHOR> https://saashacker.co/saas-cold-email <comment><USER2> I don't know that industry, but shouldn't "SEO professionals" be experienced with/sensible on any kind of advertisement, cold calls and well-done spam? For me these mails look totally as spam.

<comment><USER3> Me too, and they are. Anyone who receives garbage like this should report it to the sender's email hosting service.</comment></comment>


Cyber attack on UK parliament - <AUTHOR> https://www.theguardian.com/politics/2017/jun/24/cyber-attack-parliament-email-access <comment><AUTHOR> Could it be related to this story in The Register [https://www.theregister.co.uk/2017/06/23/russian_hackers_tra...](https://www.theregister.co.uk/2017/06/23/russian_hackers_trade_login_credentials/)

Would be interested in any more details

</comment><comment><AUTHOR> More here [https://twitter.com/NCA_UK/status/878637980101087232](https://twitter.com/NCA_UK/status/878637980101087232)</comment>


Academic Urban Legends - <AUTHOR> http://sss.sagepub.com/content/44/4/638.long <comment><USER2> There are an amazing number of scientific urban legends in the lab too that are passed down orally from senior to junior members. My personal favorite is that drinking MilliQ (ultra pure water) will cause the cells in your gut to explode [1]. How such a stupid idea ever got taken seriously by scientists who should know better has always amazed me.

[1] On the topic of drinking MilliQ water I have always encourage all the members of my lab to drink it. The reason why (apart from the taste which I quite like), is that it allows you to detect when you have bacterial contamination of your MilliQ carboy that will ruin your experiments.

<comment><USER3> Based on the fact that you didn't mention doing it, I am assuming you're missing out on a brilliant opportunity for hijinks here. Suggestion - take an alka-seltzer and some red food dye (I'm not sure if you can drip food coloring directly onto an alka-seltzer slowly enough that the dye is absorbed without causing the alka-seltzer to foam up, but probably you can experiment with something like this) and hide it in your mouth ahead of time. Loudly proclaim that it's harmless to drink MilliQ. Take a big beaker of MilliQ and drink it, allowing plenty of it to reach the alka-seltzer. Pause for half a second, start to look uneasy, grab your stomach, then start allowing blood-red foam to spill out of your mouth. Fall to the ground shaking and moaning.

Bonus points if it'a "demo" you do while teaching a lab class.

<comment><USER2> Sounds like fun :)

I has a colleague who used to like putting dry ice bombs in people's tip waste containers. You would be sitting there pipetting away and them boom - tips all over the bench.

</comment></comment></comment><comment><USER4> I guess the original publication which listed the high iron content of spinach was:

Bunge, G.. 'Weitere Untersuchungen über die Aufnahme des Eisens in den Organismus des Säuglings'. Zeitschrift für Physiologische Chemie, 16 (1892)

[http://echo.mpiwg- berlin.mpg.de/ECHOdocuView?url=/permanent/...](http://echo.mpiwg- berlin.mpg.de/ECHOdocuView?url=/permanent/vlp/lit16848/index.meta&pn=2)

If that's true, then indeed, it was not a misplaced decimal point. Instead, Bunge listed the iron contents of dried food.

<comment><USER2> It is interesting that the paper does not actually cite the original paper. I guess it is not critical to the paper, but it does complete the story.

This does bring up a important point in that is old scientific publications in languages other than english. I have many times run into references in German, French or Russian that are only available as low quality scanned pdfs. As a monolingual English speaker these are completely inaccessible to me. I would be great to have all of them OCRed so at least we can run them through Google Translate.

<comment><USER4> It seems more interesting to me that Rekdal doesn't cite this article:

[http://www.bestthinking.com/articles/science/chemistry/bioch...](http://www.bestthinking.com/articles/science/chemistry/biochemistry/the- spinach-popeye-iron-decimal-error-myth-is-finally-busted)

It's a 2012 followup by Mike Sutton to the two publications from 2010. It contains many new details, including a reference to Bunge (1892).

Perhaps, one should not only try to cite the original source, but also look for recent research on the same topic?

<comment><USER2> >Perhaps, one should not only try to cite the original source, but also look for recent research on the same topic?

This is (or should be) done standardly by all scientists. It is actually the best way to learn about a field. Find the key paper (or at least the paper the field thinks is key) and then read all the papers that cite that key paper.

I am sure this has been done by somebody, but it would be great to have this citation link structure as a graph where you could click on any node and read the paper.

<comment><USER5> The problem is that key papers are cited by a LOT of other papers, these with variable quality.

<comment><USER2> Yes they are, but there is no better way of finding those papers that can't be found using keyword searches. I have found hundreds of critical papers over the years by using this technique that I would never have found in a thousand years using any other search method.

</comment></comment></comment></comment></comment></comment><comment><USER6> It'd be interesting if we could break down academic papers into stand-alone facts, which could be cited more succinctly than the paragraphs of prose that we do now. Ideally, this would look more like academic proofs, and it'd be easier to argue and discuss components of a given paper. I'm sure that a good amount of beautiful subtext would be lost, but might it be worth it to have a more accurate way of linking knowledge?

<comment><USER7> > It'd be interesting if we could break down academic papers into stand-alone > facts, which could be cited more succinctly than the paragraphs of prose > that we do now.

Perhaps there could be some kind of semantic syntax that would group together the factual claim and supporting information (data and references). For example,

<"e=mc^2",cite1,cite2,data1,data2>

The claims still could be included in prose, but also easily extracted, analyzed, manipulated, etc.

With a little work the claims could form a semantic web, with all that entails, and the validity of cites could be checked automatically when the document is opened or on a regular basis, updating the claim appropriately. For example, the UI could display the claim differently based on whether the cited source has been withdrawn, partially invalidated, superseded, confirmed, rarely cited, heavily cited, based on impact factor, if the source's own citations have been invalidated (e.g., claimC cites claimB which cites claimA; if claimA is invalidated, there should be some sort of indication in claimC -- consider that the invalidation of a seminal claimA would set off a massive chain reaction, as it should), etc.

But that all seems obvious and I suspect I'm not the first to think of it.

<comment><USER8> It is indeed interesting, and as you suspect it has attracted some attention. Check out "nanopubs,"([http://nanopub.org](http://nanopub.org)), or Simon Buckingham Shum's very cool work on ScholOnto ([http://projects.kmi.open.ac.uk/scholonto/](http://projects.kmi.open.ac.uk/scholonto/)) among others.

</comment></comment></comment><comment><USER7> Be sure to read to the end, or, after you read enough to grasp the idea then skip down to the section "The narrow path has its temptations".

<comment><USER9> Yeah, my first thought was, "wow, I always thought that about spinach!" But, that wasn't the point of the article at all. This was an engagingly written article that kind of read like a mystery whodoneit?

<comment><USER10> And the most concerningly satisfying is that everybodydoneit, apparently. Including me, who didn't bother to read any one single paper cited.

</comment></comment></comment><comment><USER11> This article made me think of The Leprechauns of Software Engineering[1], a good book about the myths that are being passed as facts because of bad citations in Computer Science papers.

[1] [https://leanpub.com/leprechauns](https://leanpub.com/leprechauns)

</comment><comment><USER12> > The explanation for this phenomenon is usually that authors have lazily, > sloppily, or fraudulently employed sources, and peer reviewers and editors > have not discovered these weaknesses in the manuscripts during evaluation.

I've seen this sort of thing in the literature I'm familiar with (HF Radar). I don't think it's laziness or fraud, but a version of the telephone game played as a kid. A 'fact' will get stated, and then repeated over and over until some of the original meaning is lost and it becomes gospel. This can happen because the fact is not crucial to the science in the paper but always part of the introductions or statements about how the system works.

The statement I'm thinking about in particular is "if you have N receive antennas, you can only find (simultaneously) N-1 signals". This is true if you are using covariance-based methods such as Multiple Signal Classification (MUSIC). It got repeated and repeated until the caveats (simultaneous, and MUSIC) are longer included. Of course, if you have two orthogonal antennas you _can_ distinguish two directions, perhaps not in complex situations!

<comment><USER13> So that meams you can't get anything useful out of one antenna?

<comment><USER12> If it's directional, you can get one direction. Which disproves the N-1 meme that is in so many papers.</comment></comment></comment>


How I doubled the speed of my game by giving up on C++ - <AUTHOR> http://chrismdp.com/2015/04/how-i-doubled-the-speed-of-my-game-by-giving-up-on-c-plus-plus/ <comment><USER2> Thats the reason why assembly should be the first or the second language studied by beginner programmer. Thats the reason why Knuth use assembly in his TAOCP in code examples. Moreover if one wants to write fast programs he should be friend with -S compiler flag to know exactly what assembly compiler generates on this or that high-level code.

When you are familiar with asm you see that `obj->virt_func()` not just fancy and convenient but also there are some magic behind that which cannot be described by simple `call mangled_virt_func_addr`.

When you are familiar with asm you can see than calling function like

        int foo(int a, int b) {
            return a + b;
        }

is way slower than just do `a+b`, and not just because of call/ret instuctions and possible cache misses, but because of compiler lacks ability to make some optimisations. And you write `inline` functions for such small tasks.

When you are familiar with asm you inevitable see all this quirks. Sometimes you do not want to see them, but nevertheless you notice them every time, and you need to make a consious decision to leave some code inefficient, due to (for example) "i'm writing program that will be run one or two times, and time spent to make it fast would be greater than time saved on faster program runs".

<comment><USER3> If I write the foo function in assembler, it will also be slower than just a+b. The assembler won't be able to inline the function, which makes the C version possibly more efficient.

You are comparing apples and oranges.

<comment><USER2> Yes, I agree. But I'm not trying to persuade anyone to use assembly instead of C. I'm trying to say that experience with asm greatly helps to to see a difference between `foo`, `inline foo` and `virual foo`.

</comment></comment></comment><comment><USER4> Languages are tool-boxes, the whole point of the exercise is to use the best tools for the job. People who tell you otherwise, who insist on this language being written exactly like that; may be safely ignored. I would guess that my C++ style breaks most rules in most books by now, the thing to realize is that there are no rules.

</comment><comment><USER3> tl;dr: If you use C++ like Java and don't care about performance at all, it will be half as efficient as hand-optimized C.

Which is pretty remarkable actually. In favor of C++.

Why didn't the author rewrite it in C++? It's not like C can do anything that C++ can't.</comment>


Mapping Jimmy John's Non-Compete Sandwich Zones - <AUTHOR> http://blog.sigacts.com/2014/10/16/mapping-jimmy-johns-non-compete-sandwich-zones/

<comment><USER2> But if I boycott Jimmy Johns where else will I be able to get tough, cold, flavorless, white bread sandwiches?

<comment><USER3> Subway?</comment></comment>


There's Going To Be Many More Rails(es) - <AUTHOR> http://gilesbowkett.blogspot.com/2009/02/theres-going-to-be-many-more-railses.html

<comment><USER2> I read this as saying web applications allow individual developers to pick their programming language whereas desktop applications didn't. That doesn't sound right.

Yes, with web applications, the developer (read:company) gets to pick the language and tools used and not the users.

But this is the same with desktop software. I've shipped desktop software written in Dolphin Smalltalk. The users didn't stop me. They don't even care what it's written in as long as it worked.

And in either case, the decision maker is still the company, not the individual developer, though the company may delegate that decision to an individual developer, especially for smaller companies. The individual developer didn't have increased freedom to pick and choose because these are web applications.

So nothing has changed because those are web applications.

What has changed is more and more companies, especially smaller ones or those that has a deep software engineering culture recognises that using a different programming language matters in terms of productivity.

</comment><comment><USER3> Totally agree, and already on the bandwagon with the Nitrogen Web Framework for Erlang (<http://nitrogenproject.com>).

It's not a Rails clone, in fact it owes more to ASP.NET than anything else.

Created this because I wanted to use the most appropriate language for the problem I was trying to solve.</comment>