Test-Driving a $200 Coding Font: Operator Mono - <AUTHOR> https://www.kennethreitz.org/essays/test-driving-a-200-programming-font-operator-mono <comment><USER2> In case anyone else was looking to vet the entire character set[1].

{I, l, 1}, {Q, O, 0}, {S, 5}, {Z, 2}...if I have to pause even for a second to find confidence, it won't be in editor. Old school MIL-STD-100 and its modern ASME Y14 equivalent were spot on when they expressly prohibited the use of some of these characters as designators in technical drawings.

>> ...using this (beautiful) script typeface for code comments has improved both the quality of tone and frequency of my code annotations — something which I highly value.

Maybe it's just me, but I find it noticeably difficult to parse the italics...suspecting it may have something to do with discontinuity between script characters.

Anyone have an idea who the target market is based on their $200 price point?

[1] [http://www.typography.com/fonts/operator/characters/operator...](http://www.typography.com/fonts/operator/characters/operatormonobook)

</comment><comment><USER3> Interesting recommendation. I asked around here and turns out one of our designers actually owns the font! I'm going to give it a try for the next hour or so and see if it actually feels different enough for me to consider dropping the $200 on it. As first impression, the font feels "rounder" and I find it a bit harder to read.

Are there any other "non-usual" recommendations for writing code? I remember trying Nitti [0] for a while for, that's the font iA Writer uses.

/edit: After very short usage I already found one thing the author said to be true:

> While using Operator Mono, I found that I scan entire words as I read code > more easily; while in other typefaces, my parsing style is often more > letter-by-letter.

Not sure why this happens either. Maybe because the font feels more condensed? Single characters almost "merge" into blocks (words). Though it also feels a little bit harder on the eyes to read single characters.

[0]: [https://www.boldmonday.com/typeface/nitti/](https://www.boldmonday.com/typeface/nitti/)

<comment><USER4> On your question for other 'non-usual' recommendations for writing code, I've found myself predominantly using Everson Mono¹ simply because of the wide range of characters it supports in Unicode's BMP (and unbelievably, SMP as well!). I'm pretty sure it contains glyphs for more Unicode codepoints than any other monospaced font mentioned here. Not to mention that it was created by Michael Everson², who has made a sizeable number of contributions to the Unicode Standard himself.

――――――

¹ — [https://en.wikipedia.org/wiki/Everson_Mono](https://en.wikipedia.org/wiki/Everson_Mono)

² — [https://en.wikipedia.org/wiki/Michael_Everson](https://en.wikipedia.org/wiki/Michael_Everson)

</comment></comment><comment><USER5> Wow $200 for a font. I don't care how good it is I don't think I could ever justify spending that much.

<comment><USER6> That's a pretty common price. Most people just never have the need to purchase typefaces.

<comment><USER5> Yeah it makes sense if you are using publicly but for coding where only you see the font, it's a bit silly.

<comment><USER7> It takes hours and hours and hours to make a font from an expert designer -- a rare skill set. I do think they generally should be rewarded for good work. Luckily Apple already has in Monaco, which is what I use. Wish there was a way to try this font out for a week without dropping the $200

<comment><USER8> > It takes hours and hours and hours to make a font from an expert designer -- > a rare skill set. I do think they generally should be rewarded for good > work.

That's pretty much entirely irrelevant. The time anyone takes to put together something is immaterial to the price. The only thing that's relevant is the added value. Putting together a new font has a very marginal added value -- if any -- for end-users such as people using editors or IDEs.

If we're talking about publishing then that's a whole different thing: fonts are a major part of the end design, and they can play a major role in establishing a corporate identity. Playing a part in that does add value, just like incorporating the work of a professional photographer in the corporate image.

But that doesn't mean that any picture taken by anyone suddenly is worth small fortunes, particularly if the photographer wastes too much time taking useless pictures.

<comment><USER7> Fonts and design play a huge role in how we understand and relate to the world. Most of this happens with us being unaware. But if a specific font is easier to read, or more pleasant to look at, that will alter our mood, outlook, and productivity.

What your arguing is a bit like saying 8-bit non-antialiased fonts running CDE in Emacs has the same value prop as running Atom on a mac today. It's just not true, otherwise the market would look very different.

</comment></comment></comment></comment></comment></comment><comment><USER9> If you can't afford it, try following alternative

[https://medium.com/@docodemore/an-alternative-to-operator- mo...](https://medium.com/@docodemore/an-alternative-to-operator-mono- font-6e5d040e1c7e#.7pc1cgikl)

<comment><USER10> I looked at that, but there doesn't seem to be a way to get Sublime to support multiple fonts. That means you'd need to merge the two fonts into a single family, and I had zero luck getting that to happen.

I also think it's pretty important for the cursive font not only to be monospace, but to be the same width as the non-cursive font. You'll get neither of those if you follow those instructions. In fact, I was not able to find a single free monospace cursive font.

So here's hoping that somebody gets inspired by this and makes a free alternative. I get that fonts are a ton of work to make, but I don't think I can justify spending 200 bucks on a font that only I will look at.

</comment></comment><comment><USER11> I also purchased it back when Daring Fireball was recommending it... on a retina display it's nice, but it has its flaws, and the value in my mind for an individual developer for this kind of thing is like $10 if it was on Kickstarter... we don't even pay for our editors!

Real experts in font design, but trying to market to developers... probably a mistake.

<comment><USER12> > we don't even pay for our editors!

You really should!

<comment><USER13> Why (or how) should I pay for Atom?

</comment></comment></comment><comment><USER14> There are plenty of mono fonts with italic variants. What distinguishes this font? How easily are the characters distinguished? How does it look under different font engines? What is the optimal size for the font? How much Unicode does it support? How about common digraphs (e.g. Right arrow for =>)?

</comment><comment><USER15> There are other mono fonts with italic variants. An issue is getting an editor to italicize as part of a highlighting scheme. I've only seen this in Mac vim and intellij but ouldnt be interested to hear about others especially in terminal

<comment><USER16> VS Code has support for it on a per-theme basis. I am currently using the Atom One Dark theme on VS Code, and Operator Mono, it does work:

[https://puu.sh/sbUti/6022c0afb0.png](https://puu.sh/sbUti/6022c0afb0.png)

Above being a random screenshot from a project laying around.

<comment><USER17> I haven't found how to persist those italic settings. I can use the inspector and set them, but as soon as I close the app I loose them.

<comment><USER16> As I mentioned, it's on a per-theme basis.

Try installing 10-15 themes, and then trying them one by one. Some will have italic comments, some won't.

</comment></comment></comment></comment><comment><USER18> Have you tested PragmataPro¹?

¹: [http://www.fsd.it/shop/fonts/pragmatapro/](http://www.fsd.it/shop/fonts/pragmatapro/)

<comment><USER19> In fact, here is one person who owns PragmataPro, and loves it. I particularly love the _extensive_ unicode support, and the differently-shaped bold faces. I tried the programming ligatures for a while, but didn't like them. I have no problem with spending money on something I look at 8 hours per day.

<comment><USER18> So it makes two of us! I've kickstarted it back in 2011 and it so far it feels like one of the best $20 ever spent.

</comment></comment></comment><comment><USER20> Of course a lot of people mention the price immediately. I don't think I'm going to spend that much, but it's not out-of-line with what I'd expect for a font (I've probably never bought one). It's also quite affordable for a professional with disposable cash.

What I think is strange is licensing per-computer. Maybe that's normal for fonts. Seems very stingy to me that I should pay multiple times for laptop/work/home computer.

</comment><comment><USER21> Office Code Pro, Source Code Pro, Fira Code, Hermit

<comment><USER22> Fira Code is excellent. I find it hard to imagine I'll be using anything else in the next few years.

</comment></comment><comment><USER23> I don't think the italics match at all. It's like using another font for italics. At least the "s" and "r" just break the with the base-lines and make things weird, why? "l" and "f" to a lesser extend, too.

</comment><comment><USER24> Great to see praise for Ubuntu Mono font... Whilst it was developed (and funded) for Ubuntu, it is released under a free licence, available on google docs and google fonts.

I'll give Operator Mono a try... but i absolutely love Ubuntu Mono.

</comment><comment><USER25> I would be curious to know what's the % of users who actually bought the font.

</comment><comment><USER26> Very good sir! A fine choice to go with your $300 keyboard!

<comment><USER27> The keyboard is absolutely worth it and it's cheaper than that now.

The font though? I don't know about that.

<comment><USER28> Tried that keyboard, actually consider that it's a bit over-rated by people. Settled on the Topre clone (RC930) as my work and home keyboard.

<comment><USER27> That RC930 looks nice if they've managed to replicate the feel. Topre switches are expensive and for no real reason other than a lack of competition from what I can tell.

Besides the key switches, I really like the layout of the HHKB2. It is based on the old Sun workstation keyboards, which I began my professional career on. And I've learned to appreciate not having the numeric keypad, for ergonomic reasons (mouse hand stays much closer to my body, right shoulder benefits)

The arrow keys and others being replaced with a function key combo took getting used to, but now it's pure muscle memory. I like not moving my hands as much.

It's also a really ideal vi editor layout with its escape key location.

</comment></comment></comment></comment><comment><USER29> Sorry, but this person's hipster glasses are clouding their judgement. The author enjoys the idea of paying for and using a $200 font way more than he actually enjoys using the font itself. In case you weren't convinced, the whole "I wrote this blog post with a pen" and a picture of their quirky and messy work area with the antique mechanical keyboard....

You are just the worst kind of person, Kenneth.</comment>


Ask HN: Programmers, what does your development setup look like? - <AUTHOR> <comment><USER2> Computers: Lenovo X1 Extreme 1st Generation running windows 10 and a Lenovo X1 Carbon Generation 7 running Ubuntu.

Monitors: Dell U3818DW 38" curved monitor (3840x1600) and a Dell U2718Q 27" (3840x2160) monitor.

I generally develop in Visual Studio and the port it to Linux.</comment>


BBC+ "super app" curates content - <AUTHOR> http://www.bbc.com/news/technology-36834757 <comment><AUTHOR> Couldn't help but notice how neutral/balanced their coverage was.</comment>


If you don't talk to your kids about quantum mechanics, someone else will - <AUTHOR> http://smbc-comics.com/comic/the-talk-4 <comment><USER2> The best part for me was the button text: "Outnerd me now, Randall"

[https://xkcd.com/456/](https://xkcd.com/456/)

</comment><comment><USER3> Oh man, this is one of my new favourites</comment>


Ad Blockers and the Nuisance at the Heart of the Modern Web - <AUTHOR> http://www.nytimes.com/2015/08/20/technology/personaltech/ad-blockers-and-the-nuisance-at-the-heart-of-the-modern-web.html?ribbon-ad-idx=7&rref=homepage&module=Ribbon&version=origin&region=Header&action=click&contentCollection=Home%20Page&pgtype=article <comment><USER2> As is typical, this doesn't address my biggest concern, which is that I absolutely don't want any ads alongside my content, ever.

Now and forever, I reserve the right to read documents that I'm interested in, without any ads visible. If the web economy cannot exist without this, then I want to find another way. I don't have the answer.

Yes, I'll pay for subscriptions, but this obviously doesn't solve the whole problem. Until then, I'll use adblockers until I'm forced not to or they are out-maneuvered (presumably pretty soon).

We need to stop taking it for granted that the future of the internet is one in which ads are always visible.

<comment><USER3>
        Now and forever, I reserve the right to read documents that I'm
        interested in, without any ads visible. If the web economy
        cannot exist without this, then I want to find another way.

Out of curiosity - and as a software engineer who makes his living partially from the intellectual property he creates - why do you feel entitled to arbitrary content on your terms?

Do we all have a moral right to unencumbered and payment-less access to the new Britney Spears album?

Wouldn't it make more sense to only consume media that's _legitimately_ available in a way that you find acceptable? That's one way to steer content creators towards that world, right?

<comment><USER4> Because content requires attention, and the right to distribute your attention as desired coupled with the right to carefully investigate publicly available information imply it. We are entitled to our culture. And we are entitled to our attempts to control our thoughts and attentions.

It may not be compatible with our current economic system, but that system isn't a law of nature that can't be contradicted. Just because people make money producing culture doesn't mean they can lord over it and dictate how it is consumed and used with absolute authority.

>Wouldn't it make more sense to only consume media that's legitimately available in a way that you find acceptable? That's one way to steer content creators towards that world, right?

No, that's just voting on the issue. If a great majority disagrees with you, you won't get what you want. You could argue then that we have a responsibility to convince that majority, but that's pushing a responsibility onto someone who's already taken it.

In other words, by reserving this right, OP is taking a stand in a socially visible way with the intent of convincing more people to follow suit. That action will steer the world in that direction if it succeeds. So they are already doing what you're asking them to do.

\--- EDIT ---

Here's a better way of thinking about it:

You "earn a living" producing content. So you say "because other people want to see my content, I have a right _to my lifestyle_ (of getting paid.)"

And I say "because other people want my attention, I have a right to my lifestyle (of choosing exactly what to see.)"

And if you weren't being paid to take a side, or indoctrinated into a certain bias there, I don't see how you can reason that one is somehow more just than the other. Especially since the rewards are pretty much commensurate with the value produced.

<comment><USER3> (For people following this thread, the above response isn't from the person I originally replied to.)

        You "earn a living" producing content. So you say "because other
        people want to see my content, I have a right to my lifestyle (of
        getting paid.)"

Except I don't. I don't feel entitled to get paid in some arbitrary way that's convenient for me. I'm _happy_ that I can produce software and content and be paid for it - but I don't feel that I have a _right_ to that by virtue of being born. It just so happens that the IP laws in my country of residence allow me to do so.

Which perhaps is why I'm a bit puzzled as to why people would feel entitled to what I - and others - produce and make available under certain terms that they might not be happy with, simply because they were born and want the content. I just don't get the sense of entitlement.

But I acknowledge that this isn't something we're going to resolve in the HN comments section.

EDIT: Followup questions:

It seems like preventing someone from accessing something that they have a right to is immoral.

Consider that I have a website with content that I've created. If I work to hide that content from visitors who have an ad-blocker enabled, am I behaving in an immoral way?

If that site had its content behind a paywall and I actively disable accounts when I detect that they're being shared, am I behaving in an immoral way?

If the site has its content behind a paywall and I actively serve DMCA requests when I find that content published elsewhere without my consent, am I behaving in an immoral way?

If people are entitled to "culture", as you state, if the content from that site were instead a physical book, and I owned a book store that sold copies of the book, and I called the police when people were shoplifting the book, would I be behaving in an immoral way?

What if that was the only book that I carried at the store and I locked the door to the store at night. Is that immoral?

Is it not immoral for me to publish it in book form to begin with? If you're entitled to culture, shouldn't culture-creators make the culture available in the easiest form for you to get at it? Making the culture available as a physical object - with all that entails - probably isn't the easiest way for you to get access to it.

<comment><USER4> If you don't "feel entitled to get paid," then what do you really have to complain about when someone wants it for free? And don't you think it's a little unfair that you'd attribute to others a "sense of entitlement" and to you a "virtue of good fortune" for participating in comparable behavior?

I recommend you stop using the phrase "sense of entitlement" to describe how other people come to conclusions about what they would like the world to be. Because unless you are doing the exact same thing, you have no grounds to object. (I.e., it is your "sense of entitlement" that causes you to want things to work the way _you_ want them to.)

>It seems like preventing someone from accessing something that they have a right to is immoral.

No, it doesn't "seem" like it. That's what it means to have a right.

Everything else you're asking is a matter of social bargaining. You are entitled to payment for your work. Others are entitled to culture and attention management. You give some of yours, others give some of theirs. And everybody argues that they are giving more than the other, so as to get the best deal they can get for what they offer.

At the end of the day, what is _right_ is what benefits our collective ability to make decisions in the long run. And people are pretty fed up with ads that do nothing but offend their peace of mind. It doesn't benefit them, it only benefits those who sell the ads. Which means those who give their attention are not bargaining well enough to get what they want. Hence this whole discussion.

<comment><USER3>
       If you don't "feel entitled to get paid," then what do you really
       have to complain about when someone wants it for free?

I'm not complaining. I'm trying to understand a perspective that I'm having a hard time empathizing with.

       And don't you think it's a little unfair that you'd attribute to
       others a "sense of entitlement" and to you a "virtue of good fortune"
       for participating in comparable behavior?

Not in the slightest, since as I said above I don't feel entitled to payment for it. But I'm certainly happy that I can support myself via the creation of non-physical works.

       I recommend you stop using the phrase "sense of entitlement"

What would you prefer that I use? I'm not going to call it the "right" to the free, unfettered access to the non-physical creations of others, because I don't believe it _is_ a right.

       You are entitled to payment for your work. Others are entitled to
       culture and attention management. You give some of yours, others give
       some of theirs. And everybody argues that they are giving more than the
       other, so as to get the best deal they can get for what they offer.

That seems like a good summary of the perspective. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER5> Internet won't die without ads (or money), maybe big content providers will, and that's ok to me.

The point of internet advertising is that paradoxically we have to pay to make advertisers not work. If I pay, the adv gets removed, hence the adv is not displayed, hence the advertiser real job right now is to create something that make us think that paying to not to see that shit, is actually acceptable.

Ads are so terrible right now that people are gradually accepting the idea of paying for a - sometimes expensive - subscription because advertisers created the false dichotomy that the internet should be free and run by ads, or ads free but the users will have to pay for it.

It is the same model of the Italian mob: if you pay, I don't burn your shop to the ground. As Italian I know this model generate lots of revenues, but it's not exactly fair.

I think there is a better model, the content providers should reward with a small fee (a tiny percentage of their ads revenues) those users who are willing to watch the ads in exchange for some - small but real - money (it could even be something completely different from money, the idea is to reward who watch the ads).

This way we could put things back in balance: pay advertisers to actually do their job, not to scare people into buying subscriptions to services that once were free.

</comment><comment><USER6> A thing about ads is: I actually _like_ them. One of the reasons I used to buy magazines was to read the ads. It gave me a really good idea about the different types of tech that were available in whatever industry I was curious about at that time.

My problem with most web ads is that they just feel like scams. The barrier to entry for web ads is _so_ low, that anybody can take out any ad for any thing, and there really is no filter.

Sure there were always ads for penis pills (or a speaker that makes your car _sound_ like it has a turbo!) in the back of the magazine, but now those ads are showing up for me right in the metaphorical front.

Here's what I really wish existed: an opt-in ad network. You agree to have ads shown to you, and you _tell the advertisers what you are interested in_ , then they show you ads for things you care about.

For instance: I'm leaving for burning man this weekend. I would LOVE to see ads about headlamps, or cheap EL wire, or a deal on Cliff Bars; stuff like that.

Or usually: I would love to see [curated] ads for web hosting, new restaurants in Phoenix, or cheap airfair to SF.

Maybe that should be my next project: a curated ad network.

<comment><USER7> There's already a curated ad network in The Deck: [http://decknetwork.net/](http://decknetwork.net/)

Daring Fireball uses it, among others.

</comment></comment><comment><USER8> Wait, my use of an ad blocker costs the industry $11,000?! Maybe I should use 2...

And, frankly, I have no problem paying a reasonable price for content. And the New York Times sets that bar: $40/mo is a little to high. I think they'd make 10x as much with a $5 or $10 rate.

<comment><USER9> Presumably that means they've calculated that every non-adblocking person generates almost $1,000 in ad views every month. I find that number ludicrous, and I even work in advertising.

</comment></comment><comment><USER10> tl;dr The NYT distills the adblocking zeitgeist into layman's terms. Standard quotes from ABP parent company CEO. And from an Irish startup called PageFair that reports on AdBlock use.

Dig this quote: >In a report last week, Adobe and PageFair, an Irish start-up that tracks ad-blocking, estimated that blockers will cost publishers nearly $22 billion in revenue this year.

I can't even wrap my mind around that $22 billion comment. What does it even mean? It seems...vacuous. It reminds me of the RIAA/MPAA propaganda of the aughts, even though movie/music pirates would never have bought at full retail price to begin with.

<comment><USER11> > I can't even wrap my mind around that $22 billion comment. What does it even > mean?

It means that several thousand people will have to get real jobs.

<comment><USER12> Well, in the end that goes for advertisers and website makers both, I guess.

I think it is a pretty difficult conundrum, with stalking and annoying ads being unethical, but easy advertising services being a good thing for website producers.

I'm working on my first commercial site, but don't know how to go about funding it in a way that wouldn't bother me - not everyone is willing to pay for membership and I'd like to be able to use ads without being an douchebag.

I just don't know how yet.

</comment></comment></comment><comment><USER13> That was a really nicely done piece, and captures the ethos nicely with that closing line ("For better ads tomorrow, block ads today").

So much of adblocker usage is because ads are ugly, intrusive, creepy (or conversely, pointless), and great vectors for malware, and thus, are bad UX. I'm very much hoping that increased prevalence of adblocking will make the content industry either come up with a way to serve ads without wrecking UX, or monetize differently.

<comment><USER14> > "For better ads tomorrow, block ads today"

The problem with ads and ad blockers is that if a significantly large percentage of sites have bad ads, people will install and use ad blockers. Ad blockers will by default block ads on the well behaved sites as well as the bad sites, effectively punishing the good and bad alike. I believe there is a term for this -- the market for lemons.

<comment><USER15> Adblock Plus tried to address this but was given a ton of grief for it. I thought the idea of having an acceptable ads filter was smart.

<comment><USER14> Adblock could be off by default and if enough people 'vote' a site as bad by activating it for that site, then it will become 'on' by default.

<comment><USER16> And the whole thing can be funded by selling lists of users who did/didn't disable the ads in cluster X, Y, Z...

</comment></comment></comment></comment></comment><comment><USER17> The Internet is here to stay and somehow we need to figure out how to pay for it in a way that keeps good things available to the public. This means both finding a way to pay people providing good quality stuff and doing so in a way that doesn't shut folks not paying.

I have thought about this for a lot of years. When I was a homeschooling parent, there were a lot of good resources online that later disappeared for various reasons. One of those reasons was that the person publishing it took it offline to make it available to paying customers only.

People have decried the deterioration of the Internt for years. I think there is a lot of validity to those complaints, but there is no such thing as a free lunch. If you don't want ads, then you need to be willing to pay people some other way. Donate buttons seem to do poorly. I was glad to see Patreon come out. I hope we can make headway on this issue. To me, there is a clear connection between everyone wanting sites to remain free while they increasingly block ads and simultaneously decry the loss of so much good stuff.

<comment><USER8> Is there any way to impose a "progressive taxation" system? Presumably the wealthy are willing to cough up $40 per month for the New York Times. But if it's the poor and oppressed we want to take care of, how do you convince the wealthy to pitch in? Most studies I'm aware of indicate the wealthy are the least likely to be interested in progressive taxation schemes, even though they have historically created tides that lift all boats (rather than the current trend of financial schemes, which create tides that lift all yachts)

<comment><USER17> I am so tired of hearing this kind of framing. Good paradigms do not frame economic solutions in terms of rich vs poor. I am not interested in talking about how to soak the rich for the benefit of the poor. That framing only deepens the class divide.

We need a different mental model for this relatively new set of problems or the horrendous crisis we currently have will only get worse.

 _You cannot solve a problem with the same mindset that created it._

\-- Albert Einstein

<comment><USER8> I'm so tired of the frame too. So, how do you define the crisis?

<comment><USER17> People have inherent value. Their participation in the system has inherent value. Their ability to pay not only varies from person to person but also from time to time. We need to create paradigms that are inclusive of those who are less well off finanically not as charity but because their participation adds value.

HN actually does that. It is part of the YC business model. HN is noit directly monetized. There are no ads and there is no membership fee. But you cannot apply to YC without a handle on HN.

YC wants and needs HN members who are not currently wealthy. It invests in companies that are just starting out, that need seed money and other assistance. That is how YC makes money: by helping them grow and getting a cut of the action.

The more we exclude the have nots, the harder it gets for them to escape poverty and become one of the haves. Creating a permanent underclass hurts everyone.

I like the Patreon model and I am considering pursuing that for some of my projects. I also have tip jars on some sites. I need more traffic and some other pieces to come together. I am working on it.

I see no reason why we cannot have several different viable models that treat those who are not currently able to pay as valuable participants. Human society is deeply harmed by systems that boil everyone down to their current net worth. It actively undermines the creation of real value. We need to start actively discouraging that while grappling with how to pay the bills at the same time.

</comment></comment></comment></comment></comment><comment><USER18> I'm a bit tired of the AD blocking debate. There will always be two camps in this; the tech savvy, and the web consumers who think Facebook is the Internet. Lumping people into these two categories only ever worked for computers and the web, because remember; a computer is unforgiving, the programs that execute on it are unforgiving, and a computer is only as smart as its user. With very fine grained precision I can allow what traffic I want to see on my network, and I do not apologize for that. In the end AD blocking is about control structures trickling down into the consumer web. If it is the case where I am paid better than stupid people because I know how to serve them ADs better, then I suppose I win on a hermetic level; I have recast the purpose of a computer; which is something to do my bidding, and made it a mere device and gimmick for my users.

If on the other hand users are in control and I try to seize back that control, then I am in a silly game of cat and mouse, and this becomes a game of who can devise the smartest way to outsmart smart people. Not the game I want to play. Money is about keeping the channels open to receive an exchange, and if there are hangups by web publishers about whether they should disband AD networks because of AD blockers, then the game is lost.

Just open up more channels. Seek out other ways to monetize: [https://gist.github.com/ndarville/4295324](https://gist.github.com/ndarville/4295324)

Also similar: [http://news.ycombinator.com/item?id=4924647](http://news.ycombinator.com/item?id=4924647)

</comment><comment><USER19> I looked up the _Interactive Advertising Bureau_ cited towards the ends, and ended up on a document describing guidelines to detect _Click Fraud_ [0].

How the hell did we ended up to this level of insanity?

[0]: [http://www.iab.net/media/file/Click-measurement- guidelines20...](http://www.iab.net/media/file/Click-measurement- guidelines2009.pdf)

</comment><comment><USER20> People who are blocking your ads aren't people who would have purchased a product _because_ of your ad in the first place. So I find the act of "showing non-disruptive ads to ad blockers" to be strange.

 _> Some publishers and advertisers say ad blocking violates the implicit contract that girds the Internet — the idea that in return for free content, we all tolerate a constant barrage of ads._

There is no reason why the implicit contract can't be changed. That's why you get contracts in writing. :)

As far as any "moral" argument goes. Here's how I see it:

"Your neighbor asks if they can park in your driveway. You agree to it, you had space to spare for the neighbor's car anyway.

This went on fine for a few months, then your neighbor started parking _two_ cars in your driveway. You had only agreed to having _one_ car parked but you still had space to spare so you let them do it.

A few years later - your neighbor is now parking many cars in your driveway and even _blocking your garage_. To drive anywhere you need to move your neighbor's car out of the way. Being the nice guy he is, he gave you a spare key to move the car when needed."

Would it be "immoral" to ask your neighbor to stop parking cars in your driveway at this point? Is it immoral to ask your neighbor to stop parking cars in your driveway at _any_ point?

I've decided to no longer let ads be parked in my browser. I don't see how that is immoral.

 _> PageFair's canny strategy to mitigate users' outrage is that it will only show ads that aren't "intrusive," Mr. Blanchfield said._

Sean Blanchfield, if you ever get to read this, you can go fuck yourself. How's that for "mitigated outrage"? You don't get to decide what is and isn't "intrusive" for me.

<comment><USER21> >People who are blocking your ads aren't people who would have purchased a product because of your ad in the first place.

Most advertising is just brand awareness. The days of e-advertising being about clicking the ad and buying on some webstore are long over.

They are just like commercials on TV or billboards.

You don't even realize the effect they have on you.

>I've decided to no longer let ads be parked in my browser. I don't see how that is immoral.

I totally agree. But I think it would also be fine if the content providers refused me service if I didn't let the ads through.

I'm surprised more sites don't do that. I have a blocker on (and I don't even let through intrusive ads, I block it all) and I think I've only run into problems on hulu or some other video website.

<comment><USER20> _> They are just like commercials on TV or billboards. You don't even realize the effect they have on you._

I do. Which is why I haven't watched television/movies since I was 10 years old. Luckily I only see billboards when I'm on a freeway, which happens maybe once or twice a year at most.

I also keep an excel sheet where I blacklist companies whom I've seen advertisements from. So advertising to me has a net loss of -1 customer for life.

But I'll agree that _most people_ don't realize how much advertisements influence their behavior. I find it disgusting and not something that should be accepted at all in any amount - but most people don't seem to mind it. (Ignoring privacy issues with _online_ advertisements. I'm speaking more general here.)

 _> But I think it would also be fine if the content providers refused me service if I didn't let the ads through._

Oh, I agree. Of course - the provider will likely go out of business because that isn't a sustainable business model either - but I do agree. It also hurts their Google Ranking which is why Paywall sites let you read the article if you find it through Google.

Advertising is a broken business model. Once-upon-a-time it worked but it is breaking down. It's not the customer's job to keep watching advertisements. It's the providers job to find a better business model. Or go out of business.

<comment><USER22> I disagree that advertising itself is a broken model, but I like imagining that someone ruthlessly updates their excel spreadsheet of blacklisted companies every time they hear or see an advertisement for any company. You must only shop at flea markets!

<comment><USER20> I don't watch TV, rarely drive, don't watch movies, and use an ad blocker. It shouldn't be surprising that I see _very_ few advertisements. To the tune of single-digits per year.

If a company is _so intrusive_ that they still find a way to serve me an advertisement - they aren't a company I wish to support.

Billboards and bus stops are the worst offenders, but most of those I pass are advertising TV shows and movies. Which I already don't partake in.

I should be more specific: online advertising is a broken model. If it wasn't broken they wouldn't be trying to fix it. ;)

<comment><USER15> > I should be more specific: online advertising is a broken model. If it > wasn't broken they wouldn't be trying to fix it. ;)

By that definition everything is broken.

</comment></comment></comment></comment></comment></comment><comment><USER23> I remember back when I was younger I used to be active on a programming website (ok it was a game hacking website, but I was active in the programming sections mostly).

I wrote a number of tutorials, some of what I wrote was crap. I was 15/16 at the time, but other stuff was pretty useful.

The point being that all this content was shared for free, all the code was/is in the public domain, I know that some of my code made it into, ahem, _commercial_ products. Turns out it was pretty productive for content that was generated without any compensation at all. I wasn't the only person doing this, most content is still available from others. Naturally the internet, most companies, cannot possibly run on goodwill and motivation alone. But for me it does show that in certain niches money is not an issue. As long as there is a platform there will always be hidden gems to be found.

</comment><comment><USER24> I passed the threshold many years ago advertisers only have themselves to blame back in the late 90's early 00's the web used to be miserable popups everywhere ads disguised as content ads that served malware etc. Then they moved on to irritating flash ads - sometimes with sound...

Nowadays it's worse because they actively mine your personal information. I see things on Facebook like "31 years old and single? Meet women now." No thanks, talk about creepy and condescending.

</comment><comment><USER25> I like the article, but I feel like there's an unquestioned premise everyone uses in these debates:

> Advertising sustains pretty much all the content you enjoy on the web,

Is that true?

There is definitely a lot of great ad supported stuff. No question. But does that mean that all great stuff is ad supported, or ad support is necessary for the web to function?

I'm not getting paid through advertising for this comment. It's still content I created that you're reading. (I know, you're probably thinking it's not that great a comment either!)

A lot of webmail is ad supported, but email wasn't always that way. We had several decades with usenet, user-side email servers, dial-up BBS's, early MUDs... in the late 90s there were a lot of early online multiplayer games. Now when a single player game (with a social layer!) fails, the servers die and it's not playable.[1] Back then when a near-MMO failed, the community just took over and hosted servers for free.[2] You basically just paid for a pipe and everyone tried to pitch in, contribute something interesting, or pile in with a little of their bandwidth.[3]

I don't remember society scoffing and thinking, "nah, Internet doesn't have YouTube, it's a fad." Well, except Newsweek.[4]

I think that if there were no ads, we would lose a lot of the great stuff online. But we'd have different cool stuff too, because there's always been some incentive to share interesting things with other people. Even if that only motivates one in a thousand people, turns out there are a lot of people online, and it fills up pretty quick.[5,6]

The different cool stuff might be "obviously worse" in your imagination, but I'm not sure. Some days I feel nostalgia for the web of decades past. Then I usually fire up an ad-supported video on YouTube to reminisce, and try to ignore the irony.[7]

[1] [https://en.wikipedia.org/wiki/Age_of_Empires_Online](https://en.wikipedia.org/wiki/Age_of_Empires_Online)

[2] [https://en.wikipedia.org/wiki/SubSpace_(video_game)](https://en.wikipedia.org/wiki/SubSpace_\(video_game\))

[3] There's a paradoxical aside in Cryptonomicon about how the cost of bandwidth approaches zero over time, so, in theory, it can be treated as costless and abundant. Unfortunately this is a very asymptotic trend, and the needs for bandwidth increase proportionately, so in practice it's a significant and ever-present cost.

[4] [http://thenextweb.com/shareables/2010/02/27/newsweek-1995-bu...](http://thenextweb.com/shareables/2010/02/27/newsweek-1995-buy- books-newspapers-straight-intenet-uh/)

[5] [http://www.geek.com/news/youtube-hits-3-billion-views-per- da...](http://www.geek.com/news/youtube-hits-3-billion-views-per-day-48-hours- of-video-uploaded-per-minute-1383495/)

[6] Most the people uploading videos to youtube will never get paid. Just because they theoretically could be paid doesn't mean most of them will, or that's their driving motivation.

[7] [https://www.youtube.com/watch?v=bvch3eIoKQQ](https://www.youtube.com/watch?v=bvch3eIoKQQ)</comment>


Show HN: The SC4-HSM, a fully open USB hardware secure module - <AUTHOR> https://sc4.us/hsm/ <comment><USER3> Calling this an HSM is somewhat disingenuous, as it seems to contain none of the usual defenses found in a "real" hardware security module, like tamper self-destruction of key material, and likely no side-channel protection.

This is essentially just putting your keys on a dedicated computer, connected over USB. That does have value, mind you. Keeping your keys isolated definitely makes it harder for malware to exfiltrate them, and a "trusted UI" makes it clearer to the end user what's happening.

<comment><USER4> At least for me, this "HSM" makes the right trade-offs. I don't need tamper self-destruction, for example. My adversaries are either: 1) thieves of opportunity, or 2) the "world conspiracy" / nation state intelligence agencies who suddenly might decide to spy on me if the world takes a dystopian turn.

For 1) tamper-proofness is total overkill. For 2), I doubt that any civilian technology would withstand a hardware attack e.g. by the NSA. If I just look at the equipment we have at our lowly, underfunded physics laboratory - <USER2> stations, decapping facilities, wirebonders, an expert can already defeat many older hardware countermeasures with that. And I know there are much more sophisticated techniques out there, e.g. to image chips and extract secrets. Also, a variation of the "wrench" argument: Who says that the vendors of closed HSMs have not all been just forced to place backdoors?

The biggest realistic threat to me (by probability times possible damage) is by far that I might catch a Trojan. This device provides at least partial protection, in that it makes it hard for a remote attacker to sign messages or log on in my name.

<comment><USER5> > _I doubt that any civilian technology would withstand a hardware attack e.g. > by the NSA._

You'd probably be wrong. There are several consumer accessible chips (i.e. from Atmel that you can order on digikey) that use tamper-proof silicon where the very act of opening up the package to inspect the die destroys the private key data. Even civilian tamper-proof tech is extremely robust, using physical phenomena to protect the data instead of obfuscation.

That doesn't preclude someone with the resources of the NSA from figuring it out or backdooring the design but the resources needed to defeat tamper proof devices is orders of magnitude greater than those needed to use them and that gap is constantly growing.

<comment><USER4> Well, that's probably true, but my only source for that is what people wrote on the internet. OTOH, I know e.g. the NSA has basically infinite resources.

Anecdotally, I've heard that there are ways to destructively image complete chips, and not just the layout but also the internal charge state. I believe the technique used femtosecond lasers. Of course that is also hearsay and I can't validate it.

My point is, as an interested layman, I don't know enough to trust this technology with my life - but it would be exactly useful if my life depended on keeping my secrets. So that contradiction kind of reduces its value for me.

I'm sure people with the required knowledge can properly evaluate these products, and for those people they are probably immensely useful.

<comment><AUTHOR> I would not bet my life savings against the NSA's ability to compromise the SC4-HSM if they had physical possession. On the other hand, there is a simple defense against physical compromise that would probably hold up even against the NSA: encrypt the keys with a strong pass phrase. That wouldn't hold up against a monkey wrench attack ([https://xkcd.com/538/](https://xkcd.com/538/)), of course, but there are limits to what you can do for <$100.

</comment></comment></comment></comment></comment><comment><USER6> Awesome. One question... why STM/ARM? I'm not an expert in the available choices, but I'm generally curious about RiskV devices because they're fully open. Are the designs of this chip at least available, and audit-able, or could it contain something like Intel's HM?

<comment><USER7> Are RISCV devices actually _available_ at all?

I'm not too worried about backdoors in microcontrollers, they're too small to hide much.

 _Are the designs of this chip at least available, and audit-able_

I'm not aware of any processors you can buy from current production that meet this criterion (because it would involve complete exposure of that company's IP). I suppose the fully reverse-engineered 6502 meets it.

<comment><USER8> > I'm not too worried about backdoors in microcontrollers, they're too small > to hide much.

You can hide a LOT on a chip, though for embedded systems the attacks are not likely to be generic, or scale.

If I was a spook agency, I'd definitely try to compromise USB handling, at a low level. Most controllers I know of use DMA, so it's likely that sneaking in a few hundred gates would open up a whole SOC. The USB controllers are just libraries that people buy; I don't know how closely they are audited by customers.

Hook that up to a compromised PC (read about system management CPUs...) and that's the ball game.

Silicon is pretty opaque.

</comment></comment></comment><comment><USER9> >The display and user buttons protect against an attack launched from the host machine. Before the unit performs a cryptographic operation it can display information about what it is about to do on the display and wait for the user to confirm the operation by pushing one of the user input buttons on the unit.

As the author is here, I'd suggest adding a beeper as a way to alert about potentially unsolicited access to the module.

<comment><AUTHOR> There is a tri-color LED that is intended to be used for that purpose. Red means something bad has happened :-)

</comment></comment><comment><USER10> I've been watching this project since I saw it mentioned in an HN comment some time ago, it's nice to see stuff like this being worked on. Doubly so because I envisioned building something similar a few years ago using the Beaglebone Black as the platform, but this is _much_ better all around :)

</comment><comment><USER11> I am impressed and thankful for this as open-source. You learn a lot when you attempt to secure the hardware.

A good starting place.

</comment><comment><USER8> Hmmm, it has a display. This is going to last about two days in my pocket.

For the last year I've been carrying around a couple Yubikeys on my keychain. They've been through the wash at least once. They're well nigh indestructible.

I don't know how you make something capable of user interaction AND immune to keys, pocket fuzz and soapy water. It's a tall order.

<comment><USER12> >I don't know how you make something capable of user interaction AND immune to keys, pocket fuzz and soapy water. It's a tall order.

One consumer device that has consistently delivered that is the waterproof, rugged feature phone. In fact, taking an old Samsung B2100 and writing a Java app to serve as a Bluetooth HSM probably leads to a cheap, serviceable solution.

</comment></comment><comment><USER13> I've been looking for something like this in a while. It would be feasible to make something like this but with a Bluetooth interface instead (I'm concerned about MITM attacks)? I've been wondering about the possibility of writing a mobile app that uses a Bluetooth HSM to sign documents.

Great work and nice project by the way

<comment><USER14> Looking for a Bluetooth solution as well

<comment><AUTHOR> Why? That seems fraught with all manner of peril.

</comment></comment></comment><comment><USER15> Neat!

There's an interesting typo in the STM32415 link first in the bullet list, it has an attribute called "jref" which should very likely be href. In Firefox it's underlined, but not clickable. Very confusing.

<comment><AUTHOR> Fixed. Thanks!

</comment></comment><comment><USER16> Funny how this Open Source hardware screen uses half of it to display the copyright. I know they are not related, but it still feels _weird_.

<comment><AUTHOR> Heh, that didn't even occur to me. Bad optics. I'll fix it.

</comment></comment><comment><USER17> Where can I find the HW schematics and the PCB layout?

<comment><AUTHOR> Heh, you're the first person to ask. Let me see what I can do.

</comment></comment><comment><USER18> Security assessment is a bottom-up process. Most security in a HSM is in the hardware. This is clearly not using secure IC's as illustrated in the smartcard market. It's already going to hit a ceiling there. Let's look at the datasheet anyway to see what can be built on foundation of STM32F415. Keep in mind I rarely deal with MCU's or embedded stuff. Some questions or concerns will come from my memory loss or lack of experience.

[http://www.st.com/content/ccc/resource/technical/document/da...](http://www.st.com/content/ccc/resource/technical/document/datasheet/98/9f/89/73/01/b1/48/98/DM00035129.pdf/files/DM00035129.pdf/jcr:content/translations/en.DM00035129.pdf)

Embedded flash 512KB or 1MB for programs and data. Checked with a CRC unit. There's some kind of accelerator between flash memory and main bus. Effects on security or robustness unknown. The flash might be writeable to attacker, esp since it's flash not ROM. What protections are here to prevent that?

Embedded SRAM. Up to 192KB of system SRAM w/ up to 64KB of CCM data RAM. Has 4KB backup SRAM "only accessible from CPU... content protected against unwanted write accesses, and retained in Standby or VBAT mode." First, what does "protected against unwanted" mean specifically? Second, does HSM software properly overwrite new memory, check pointers, do periods processing, and so on to prevent leaks via requests from host or compromise of subsystem?

Memory protection unit. Simplified MMU splits memory into 8 areas with 8 sub- areas ranging from 32 bytes to 4GB addressable memory. Access control typically managed by RTOS. Does HSM properly use MPU to isolate keys, cryptographic functions, kernel, and non-security critical software? What's the TCB size and assurance activities that went into the component that manages this?

DMA controller. Two units do what DMA always does: bypass all checks for raw speed. Configured by software. Attacks on that code or anything that can reference it might lead to DMA attacks. Curious what effect attack on host, esp a driver, could have far as divulging the MCU's secrets to a malicious program on the host.

Interrupts. Can compromised host flood the device for DDOS or use them selectively to extract keys via glitch in interrupt handling? Doing just the flooding while otherwise doing nothing could also be used to trick users into thinking device is unreliable. They might use less confidential method as backup.

"The boot loader is located in system memory. It is used to reprogram the Flash memory by using USART1 (PA9/PA10), USART3 (PC10/PC11 or PB10/PB11), CAN2 (PB5/PB13), USB OTG FS in Device mode (PA11/PA12) through DFU (device firmware upgrade)." This is a pile of stuff embedded people probably recognize. All I know is it needs exploration to help determine exposure to boot- or flash- level attacks.

"The 4-Kbyte backup SRAM is an EEPROM-like memory area. It can be used to store data which need to be retained in VBAT and standby mode." This could be useful for long-term, key storage. The flash filesystems are harder to overwrite since they put data all over the place to reduce wear on individual components. Overwriting this is... with my limited memory... more straight- forward. It also preserves availability. To prevent thieves extracting, the keys might be encrypted before storage using a function that combines onboard- software, something entered through the host, and/or something done via buttons on drive. If host app deletes its secrest after use, then a simple snatch-and-grab won't work.

Watchdog timers. These are useful in high-security to deal with HW- & SW-level failures in the "known unknowns" and "unknown unknowns" categories. Maybe set a watchdog during important, cryptographic operations that should be done in certain timerange and/or for system operation in general. If it activates, any secrets are cleared immediately then user must recover device. Basically, "Fail Safe, Hard, and Noticeably" principle in action given who knows what led to watchdog activating. Catch all.

"Secure digital input/output interface" I got unnecessarily excited: it was just SDcard support. Oh well. :)

"USB controller... Internal USB DMA." The USB section doesn't tell me enough to know the risks it might have. Depends on what software directs it, what access it has to what memory, and so on. Then, we can at least see where the checks have to be put or what code has to be perfect. The DMA part was in "high-speed" section but not "full-speed." So, add DMA concerns above to USB subsystem and code if HSM uses high-speed. Possibly if full-speed if DMA stays on and accessible anyway where designers just assume people wouldn't try to use it rather than force that to be true.

"embed a cryptographic accelerator" This always concerns me as I have trust issues with these. Let's say we trust them. I'd apply all the tests available for these. Past that, do security at interface design-by-contract style plus extra code review to make sure they're used correctly. Guttman's security kernel in cryptlib is a nice example. Also mentions it supports DMA request generation. If it's always on, then add DMA considerations to the protocol engine that uses these.

"delivers 32-bit random numbers generated by an integrated analog circuit" Have at least one unit doing nothing but outputing analog noise all day for weeks. Run all randomness tests on the whole set plus subsets of it to see if statistical properties change significantly during specific periods of time. This is good practice in general to assess effectiveness. However, especially important with analog in case they chose shitty noise source that varies with environmental factors. I recall Bitbabbler lead says they keep a whole pile of them doing this since first prototypes to keep sample size statistically significant itself. That approach is even better if one has resources to do it.

JTAG and embedded trace macrocell. Well, these are always interesting from an attacker perspective. :) Maxim says there's no security once it's in their physical possession. Let's not make it easy, though. A basic mitigation here is requiring user to activate it with their password, PIN or some button presses. Lacking that, anything the software sees indicating unauthorized access can lead to nuking the secrets. Should stop majority of attackers who are casual or script kiddies. Part of that backup 4K SRAM might be used to keep track of anomolies that otherwise disappear with power turned on and off due to attacker experimenting.

So, that's the hardware. It has potential, as smartcards illustrate, to perform the job at hand with numerous risks that must be assessed and countered. Anything on host that configures, does requests through, or interrupts it is a security threat to be mitigated somehow. Protocol engines need sanity checks plus coded in a way to be amenable to any and all forms of static/dynamic analysis. MPU should compartmentalize secrets & kernel from the rest. Long-term keys can be stored in flash and/or backup SRAM with SRAM having some advantages. Other SRAM overwritten after use, including memory for intermediate steps. Any onboard registers overwritten during context switch (periods processing) to untrusted code. Ops take fixed time with careful attention to shared memory/resources to mitigate timing channels. Make damn sure they can't corrupt the boot code. I still don't know exactly how that's installed or protected from software attack. Need help from MCU or embedded people here.

The system level I'm unclear on as lisper hasn't given me full use-case list. The basic is to make sure keys are generated properly, used properly, never see host and trustworthy TRNG. These can be met with above methods if identified risks are knocked out or turn out not a concern. Security-oriented IC's, as found in EAL5+ or EAL6+ smartcards, are _much_ more suited to this stuff as they put in more effort into HW mitigations and assurance of TCB implementation. Ledger Blue wallet uses an EAL6+ IC as an example. Consider using one of them in future version of product. Additionally, pull up MCU errata page to look at any CPU errata in specific product causing crashes or weird execution. Especially on MPU. Malware & smart pentesters used those in the past.

Emanation or HW-level attacks will still work on this device due to no mitigations. That means one use-case, using it on untrustworthy computers in public, cannot be performed with this device in event person's secrets are high-value to Five Eyes, Israeli, or Russian intelligence services known to use those attacks plus any high-end contractors that can do the same. Security researchers are also publishing more over time, which means blackhats will eventually use them. An associate pointed out that one of the designs for card computer (Bitcoin?) used red-black separation in PCB itself to a degree to reduce cryptozone's ability to electrically effect untrusted zone. Physical Red-Black was used by military for decades to reduce leaks. Cheaper solutions like those might be used to reduce impact a bit but users should be warned this risk remains for high-value targets.

So, that's my brief review of this product at just the hardware and system levels. I haven't looked at the app level to determine if how it's used or implemented meets the criteria. There's risks there, too. Might look into them. For now, I think lisper has plenty to think about on the hardware & implementation side of things. He will be busy. :)

<comment><AUTHOR> Wow, thanks for that extensive review! I'll need some time to digest all that.

</comment></comment><comment><USER19> Totally unrelated, but I was looking through their repo and discovered tinyscheme:

[https://github.com/Spark- Innovations/sc4-hsm/blob/master/src...](https://github.com/Spark- Innovations/sc4-hsm/blob/master/src/tinyscheme/scheme.h)

[https://github.com/Spark- Innovations/sc4-hsm/blob/master/src...](https://github.com/Spark- Innovations/sc4-hsm/blob/master/src/tinyscheme/scheme.c)

Neat! Super-readable, self-contained, and from 1994. What's not to love?

<comment><AUTHOR> TinyScheme is indeed very cool, but it's a bit of a parlor trick to run it on the HSM. I don't think you'd actually want to use that in production. But it's awfully neat to run Scheme on a gadget the size of a lipstick case. :-)

Here's the original TinyScheme site:

[http://tinyscheme.sourceforge.net/home.html](http://tinyscheme.sourceforge.net/home.html)

<comment><USER19> _it 's a bit of a parlor trick to run it on the HSM. I don't think you'd actually want to use that in production._

Challenge accepted! I bet I could port Arc to it. Hmm...

It'd work. Eventually.

Thanks for the link. I'm intrigued by the idea of lisp-powered businesses. I wonder if there's a survey of the state of non-Clojure lisps circa 2016? Nothing against Clojure, of course. It powers many businesses. I'm just curious how the rest are faring.

I think I'd like to work somewhere that intentionally uses a less-popular language just because they feel like it. Or that makes Scheme-powered devices the size of a lipstick case.

<comment><AUTHOR> > It'd work. Eventually.

I have no doubt you could get it to run. Arc is just a thin layer on top of Scheme. The question is whether or not it's prudent to run any Lisp on a security device. I'm as big a Lisp fan as they come (look at my handle!) and running Lisp on an HSM makes me a little queasy.

> I'm intrigued by the idea of lisp-powered businesses.

My back-end server is using Clozure Common Lisp, and I certainly believe in using Lisp to cross-compile code for the HSM. There are a lot of ways to leverage Lisp besides actually running it on the device itself. But I have a lot of other Lispy tricks up my sleeve. Stay tuned!

<comment><USER19> Please write about this! It's awesome. Basically everything you're saying. If you could just put all of that into about 9300 words sometime, that'd be great. :)

<comment><AUTHOR> OK, watch my blog</comment></comment></comment></comment></comment></comment>


How cancer was created by evolution - <AUTHOR> http://www.bbc.com/earth/story/20160601-is-cancer-inevitable <comment><USER4> The most horrifying story I know of is canine transmissible venereal cancer. It used to be a dog, but was more evolutionarily successful evolving into a tumor.

[https://en.wikipedia.org/wiki/Canine_transmissible_venereal_...](https://en.wikipedia.org/wiki/Canine_transmissible_venereal_tumor)

<comment><USER5> Good thing it seems not too lethal?

<comment><USER6> It seems fairly debilitating in late stages. The Tasmanian devil's one seems to be threatening the species, which is rather serious.

<comment><USER5> Yeah I mean as horrifying as "std cancer" is, "species-threatening cancer" is objectively worse.

</comment></comment></comment></comment><comment><USER7> I wish we spent more time studying why elephants [1] and bowhead whales [2] don't get cancer more often than they do. If we knew exactly why their cells are so resistant to cancer we would have some ideas of what we need to do to make ours the same.

1\. [http://www.ncbi.nlm.nih.gov/pubmed/26447685](http://www.ncbi.nlm.nih.gov/pubmed/26447685)

2\. [http://www.ncbi.nlm.nih.gov/pubmed/25565328](http://www.ncbi.nlm.nih.gov/pubmed/25565328)

<comment><USER8> We do know. A gene called p53 detects anomalies during DNA replication and can "arrest" the growth or replication phase, or force apoptosis (cell death).

1\. [http://www.the- scientist.com/?articles.view/articleNo/44215/...](http://www.the- scientist.com/?articles.view/articleNo/44215/title/Explaining-Elephants-- Cancer-Resistance/) 2\. [https://en.wikipedia.org/wiki/P53](https://en.wikipedia.org/wiki/P53)

<comment><USER7> No we don't know. We know very little about the reasons for the relative absence of cancer in these organisms. The absence of cancer is not solely due to p53 differences, p53 just happens to be one of the few cancer preventing genes studied to date in these animals.

<comment><USER9> yeah but P53 redundancies are a pretty big deal in answering that question. We have one P53 gene and if it gets damaged the cell gets to run amok. Those other animals have like 12 p53 genes, and don't get cancer.

Correlation, meet causation.

What is the valid counterpoint?

<comment><USER7> The evidence that p53 duplication is an important mechanism is very interesting, but we know p53 is not the sole answer. A good example of this is both humans and mice have one copy of the p53 gene yet humans are vastly more resistant to developing cancer than mice.

<comment><USER10> Could that be because humans are more complex from a biochemical standpoint than mice?

<comment><USER7> It is because we have been selected for a much longer lifespan than mice. Basically during human evolution there has been a selection process for greater resistance to developing cancer - if we got cancer at the rate mice get it almost nobody would make it to be a teenager.

Humans are by animal standards very long lived and naturally quite resistant to developing cancer. We have many more anti-cancer biochemical and genetic systems (antioncogenes) that work much better than the same systems in mice.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> These two paragraphs don't follow:

"Figures like this show that cancer is not only extremely pervasive, but also becoming more and more common. But why will so many people develop the disease at some point in their lives?"

"The fact that tumours are constantly changing their genetic makeup is one of the reasons why cancers are so hard to "kill".

The article's faulty reasoning seems to imply that cancer is more and more common because of evolution. The scientist's work is examining the evolution of a cancer's cells since its initial genesis in the patient. Unless cancer is transmissible between individuals, there is no on-going evolution in cancer that is making it more efficient across the pathology of multiple patients. Thus, this doesn't add much to our knowledge of why cancer is more and more common.

<comment><USER12> some cancers are transmissible (HPV-induced, for instance, and those of the tasmanian devils, the list goes on and on, not kidding)

<comment><USER13> The cancer caused by HPV is not transmissible. The virus that causes it is.

Transmissible cancer is possible, but it's of almost negligible risk to humans [1, 2].

[1] [http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3228048/](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3228048/)

[2] [http://www.cdc.gov/media/releases/2015/p1104-parasite- tumors...](http://www.cdc.gov/media/releases/2015/p1104-parasite-tumors.html)

<comment><USER14> There are four known ones:

[https://en.wikipedia.org/wiki/Clonally_transmissible_cancer](https://en.wikipedia.org/wiki/Clonally_transmissible_cancer)

But we have started doing things like making stem-cell lines that have surface markers removed and are compatible with almost anyone..

<comment><USER15> Fortunately we tend not to angrily bite each other as a greeting.

<comment><USER14> They don't all require that:

> Canine transmissible venereal tumor (CTVT) is sexually transmitted cancer in > dogs. It was experimentally transplanted between dogs in 1876 by M. A. > Novinsky (1841–1914). A single malignant clone of CTVT cells has colonized > dogs worldwide, representing the oldest known malignant cell line in > continuous propagation.

</comment></comment></comment></comment></comment></comment><comment><USER16> > _" The figures are even worse in the UK. According to Cancer Research UK, > 54% of men and 48% of women will get cancer at some point in their lives."_

I am not sure if this is a good or a bad thing. If you accept that cancer is simply the disease you get when you live long enough and don't die because of anything else before (a view even supported by the article), a higher percentage could also mean that all other things are in control now, and only cancer and heart attacks are left.

<comment><USER17> So we hear about how eating healthy and exercise and yada yada help your cancer and heart attack risks. How much would each go down if we were perfect?

My gut feeling is we could fix 75% of current heart attacks with weight control + exercise + whatever, but only say 25% of cancer... i.e. that heart attacks are very much in the group of things we know how to fix, whereas cancer is still very much in the group of things we don't know how to fix.

But curious what the real numbers are...

<comment><USER18> Well, I suspect many things regarding health are outside of anyone's control. Ie. if you're a living organism in 2016 on planet Earth, then you probably are negatively affected due to pollution caused by humans, let individuals hope they're lucky. There's lot of nasty stuff out there that we've made and let loose on purpose or by accident. You can't have an ideally healthy lifestyle when all up and down the ecological chain our handiwork is present (people like to make money with the least amount of effort on their part).

</comment></comment></comment><comment><USER19> One has to wonder why we age in the first place. No doubt we have evolved to age because a species that does not die off cannot evolve. The advantages of living longer eventually are outweighed by the pressure to evolve more rapidly. So if we see age as an evolved trait, might cancer be part of that endgame? Or at least, our growing susceptibility to cancer and other diseases as we age evolved specifically to kill off the old so as to make room for new generations.

This of course would have evolved long long ago, back before we were mammals. As only a handful of the most primitive animals are essentially immortal (jellyfish and the like) this would seem a very successful evolutionary trait.

<comment><USER5> Why the downvotes? There are other articles (on HN recently!) that postulate that aging is evolved.

Now yes cancer itself, as mutation caused, can't really be a trait of the host (I go as far as to consider cancer cells a separate parasitic species). And since many cancers are immortal, and the aging relates to a secession of cell division in some sense they are opposite extremes with normal development in the middle. But in being opposites they are related---end games / limitation for multicellularity.

</comment></comment><comment><USER20> This reminds me of this culture of cancer cells from a woman who died from cancer in the 50s. The cancer is still alive in laboratories today and there were even proposals to classify it as a new species:

[https://en.wikipedia.org/wiki/HeLa](https://en.wikipedia.org/wiki/HeLa)

<comment> saiya-jin ex-gf was working with "her" cells some 6-8 years ago while researching some rare type of anemia, back in Prague. Didn't know it's actually used worldwide.

one way to become immortal in some sense :)

<comment><USER21> That is the name of Rebecca Skloot's excellent book on the subject: The Immortal Life of Henrietta Lacks ([https://en.wikipedia.org/wiki/The_Immortal_Life_of_Henrietta...](https://en.wikipedia.org/wiki/The_Immortal_Life_of_Henrietta_Lacks))

</comment></comment></comment><comment><USER22> From the article:

"In the US there has been a 25% decline in death rate in the last two decades. 'More than half of that decline is driven by cancer prevention activities," says Brawley.

"This points to the fact that some of the cancers that would previously have killed people had been prevented. Almost a third of death from cancer in the US has been attributed to cigarette smoking, for example. This makes tobacco "the single most preventable cause of death in the world", according to Cancer Research UK."

Never starting a smoking habit, or quitting a smoking habit if you have already started, is a great way to prevent a lot cancer risk. Being moderate (not excessive) in alcohol use helps a lot too.

[http://www.cancer.gov/about-cancer/causes- prevention](http://www.cancer.gov/about-cancer/causes-prevention)

</comment><comment><USER23> > But a more telling reason for the rise is that humans, on average, live a > lot longer than they used to. "If you live long enough you will get cancer," > says Biankin.

I keep hearing this, but do we have data that shows that cancer rates have not changed _within age groups_?

Average lifespan is skewed by much higher infant mortality rates of the past: an average lifespan of 45 doesn't mean everybody was dropping dead at 45; it means more people were dying during their infancy and youth.

<comment><USER15> A 20 year old roman could expect to live to ~50:

[http://www.richardcarrier.info/lifetbl.html](http://www.richardcarrier.info/lifetbl.html)

In the US in 1900, a 20 year old could expect to live to ~62:

[http://www.infoplease.com/ipa/A0005140.html](http://www.infoplease.com/ipa/A0005140.html)

Today, a 20 year old can expect to make it to about 80.

So the gains aren't really limited to infant and child mortality. A substantial portion of the gain has certainly come from improvements there though.

<comment><USER24> But the gains at age may come from other areas and not from medicine. In this talk

[http://www.gresham.ac.uk/lectures-and-events/return-of- the-m...](http://www.gresham.ac.uk/lectures-and-events/return-of-the-microbes- how-infections-are-once-more-taking-over)

the professor mentions as an aside (there is a transcript of the talk)

> _And what is interesting, if you take out the childhood mortality, the > Victorian person between 1850 and 1880 lived slightly longer, if he was a > male, than you do today._

Females had the risk if child birth, an area where medicine _did_ do a lot.

It shows that sanitation/hygiene and food seem to have done a lot for lower mortality outside the risk factors of being very young and/or giving birth.

And that was before antibiotics! Which is nice to know when we get another doom article about the end of antibiotics, because it seems that while sure individuals will suffer it by no means warrants predictions of doom for mankind.

</comment></comment></comment><comment><USER25> While Swanton's work is great in revealing how difficult it is to contain a tumor and how evolution allows escape from therapy and in exposing genetic diversity in tumors, the idea that you can "chop at the root of the tree" is (in my opinion) bunkum. First of all, even if you target trunk mutations you can evolve resistance. Second, you can't just keep loading up drugs into patients; they can often barely tolerate one of these therapies (which have off-target effects on normal cells), combination therapies compound the problem.

</comment><comment><USER26> All this talk about tobacco but nothing about alcohol, for which there is much stronger evidence of DNA damage? Does the BBC have a hidden conflict of interest?

<comment><USER27> Do you have a link supporting the DNA damage and alcohol relationship? That's interesting.

Lung cancers are particular in that they feature an incredible amount of somatic mutation. If I remember its at least 10x as much as the next high- mutation rate cancer. Probably more even. Smoking tobacco provides a melange of mutagens: complex aromatic DNA adducts that result from combustion, heavy oils, and radiation from potassium heavy fertilizer. These would be enough to cause problems alone, but to make things as bad as possible the active ingredient is a critical signaling molecule in the cell cycle, which after copious application is likely to induce the survival of cells unresponsive to it. These cells are less likely to play nice with others.

<comment><USER28> "Do you have a link supporting the DNA damage and alcohol relationship? That's interesting."

Not the op but alcoholics are likelier to develop e.g. pancreatic cancer. I believe the direct mechanism, though, is not explained. "About 7 out of 10 cases of chronic pancreatitis are due to long term heavy drinking":

[http://www.cancerresearchuk.org/about- cancer/type/pancreatic...](http://www.cancerresearchuk.org/about- cancer/type/pancreatic-cancer/about/pancreatic-cancer-risks-and-causes)

</comment></comment></comment><comment><USER29> _In the US, the lifetime risk of developing cancer is 42% in men and 38% in women_

Woah, this isn't far from saying living in the US isn't far from a coin toss for a death sentence.

<comment><USER30> There are lots of types of cancers. Some of the most common types (skin and prostate) aren't really much of a detriment to life expectancy.

<comment><USER29> This explains it. Thanks.

</comment></comment></comment><comment><USER31> What if cancer _is_ the evolution in action. Evolution has to go through a huge number of permutations to get a viable macro organism. By trying to cure cancer, we are trying to withhold the natural selection in some form and preventing the next stage of evolution.

<comment><USER32> There is no such thing as `next stage of evolution'. Evolution doesn't have stages.

Also, we are only interested in curing cancer in humans (and perhaps at most livestock). Wild animals will still get cancer.

(Do plants and funghi etc get cancer?)

<comment><USER31> Humans evolution can be characterised into major stages from ape to homosapien.

<comment><USER33> No it can't. There were only many small adaptions, not stages. Stages also suggests that there is a next stage to evolve to which is not correct.

<comment><USER31> You are conflating 'evolution is directionless' with 'no stages'. Stages can only be seen when looking back at the evolutionary history.

For example:

Study reveals human body has gone through four stages of evolution ([http://www.eurekalert.org/pub_releases/2015-08/bu- srh083115....](http://www.eurekalert.org/pub_releases/2015-08/bu- srh083115.php))

[http://www.pnas.org/content/112/37/11524.abstract](http://www.pnas.org/content/112/37/11524.abstract)

<comment><USER32> Stages are a human abstraction that help us understand and make sense.

<comment><USER31> You can say that for just about everything

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> The sad truth is above 80% of the food you can find in a U.S. supermarket is transgenic or otherwise called GMO. All sorts of carbohydrate sources - <USER2> comprise a huge part of the U.S. diet - from cereals, refined sugars and the base of the american diet: corn fructose. Vegetables and meat that's been grown with also GMO feed has been genetically modified and released to the public without enough testing. One of the consequences is cancer. Cancer grows because the quality of your food, the biotechnology embedded in it and american eating habits are incredibly unhealthy and unsuited for its lifestyle. Research the lobbying between FDA and Monsanto, research the correlation between meat consumption and risk of heart disease and cancer, research the recommended daily intake of fibre and compare it to the average american diet, see the correlation with cancer. There lies the answer. This article is a lie. Monopolies ALWAYS create complexity (Zero to One - <USER3> Thiel). Here are what your typical bullshitting articles say: \- Cancer is a living entity, like a virus. \- Cancer is way more complex than we thought! \- Cancer keeps growing and it's unstoppable \- We still don't know how cancer is created

Start here: [https://nutritionfacts.org](https://nutritionfacts.org)

I lived this on my own skin with my mum getting cancer. This article has been completely lobbied by the pharmaceutical industry. No doubt.

<comment><USER35> There is certainly no scientific consensus that GMO/transgenic food causes cancer; if anything the community believes it does not. Perhaps we currently have flaws in implementation (e.g., Roundup-ready crops could lead to increased human exposure to the herbicide), but why is GMO itself a problem? Adding genes from harmless cold water fish to harmless standard tomatoes in order to produce cold resistant tomatoes, for example, seems to be a safe procedure. I would love to be pointed to credible studies that contradict my way of thinking about this.

<comment><USER34> You are right about consensus. But I invite you to investigate how big the cancer industry is in worth/year and historically how it all has been created, and who owns it. Also to study the history of the American food industrialisation. Also to investigate who owns and influences the top media sources in the world. To be clear the point I was trying to make wasn't "GMO is the only cause of cancer" or "Genetical modifications on foods produce cancer". My point is "Current GMO products consumption is one of the contributors to cancer" \- I'm not stating how, I'm stating that it has an effect. I know far more about the effects of meat and dairy than I do about GMO. But somewhere to get started would be here: [http://nutritionfacts.org/video/are-gmos-safe-the-case-of- ro...](http://nutritionfacts.org/video/are-gmos-safe-the-case-of-roundup- ready-soy/) (The page has links to all the scientific sources cited)

<comment><USER36> This is pure quackery with no scientific basis.</comment></comment></comment></comment>


Early sketches from web designers - <AUTHOR> http://layervault.tumblr.com/post/35721297597/early-sketches-from-the-webs-finest <comment><USER2> I don't think sketching is only useful for designers. Before I solve complex coding problems I usually have a block where I can scribbled and sketch solutions. This method makes it much easier to brainstorm and think than using something rigid like a text editor (at least for me).

<comment><USER3> I used to draw out little graphs representing data and more exotic structures, but I found that trying to focus on the paper would ruin my train of thought. I try to visualize that stuff in my head now, and it's gotten easier with practice.

It's not intentional, but it seems like my method has turned into "stare at a wall for an hour, and then write function prototypes."

</comment></comment><comment><USER4> I'd love to see more sketches just to see how much detail a designer puts into a sketch on average, and how that varies across different areas of design. It's nice to see barebone sketches like Maykel's and Ian's. Even after reading bill buxton's book on sketching, i still catch myself trying to refine sketches just so they look nice even after an idea is explored.

Thanks for compiling these, looking forward to see more!

<comment><AUTHOR> One of my favorite parts of watching allang write this post was proof that there is some hope for us developers out there. :)

</comment></comment><comment><USER5> Submitted mine! =) [https://twitter.com/BootSnipp/status/267356437364240385/phot...](https://twitter.com/BootSnipp/status/267356437364240385/photo/1) And final result - <http://bootsnipp.com> !

<comment><USER6> Really cool idea! Love the header background-image ;).

</comment></comment><comment><USER7> Very nice sketches. But I want to point out that if you don't sketch you shouldn't feel like you're "doing it wrong".

Sketching is not a required step. Starting straight in Photoshop (or even in the browser) are both valid methods too.

<comment><USER8> It's definitely not required, but it can probably save you some time since it's a bit easier to erase some pencil than it is to start again in Photoshop.

<comment><USER9> _since it's a bit easier to erase some pencil than it is to start again in Photoshop._

Not for me. I use a Wacom (with Illustrator, not PS, but same diff) and flipping around the the pen to erase is really no different from using a regular pencil. Except way faster.

Since I can use layers and selective editing and save off versions I feel much more relaxed doodling and exploring this way. It's trivial to save the interesting ideas while obliterating the crap.

If I _really_ wanted to start fresh, select all -> delete is quite fast.

The big wins for pencil and paper are: ease of transport and accessibly (much simpler to carry around a sketch pad and some pencils); the tactile feedback; the resolution.

Much as with using a word processor vs. a typewriter and some Wite-Out there are interesting psychological differences at here, too.

</comment></comment></comment><comment><USER10> I suck at design and I think omitting the sketch step is part of the reason why.

Dick Tracy poster is great.

<comment><USER11> You may suck at design because you lack some artistic culture , it is has nothing to do with sketching or even the ability to draw. Get a generic art history book , study a ton of design from other designers and you'll be a better designer.

<comment><USER9> Get a generic art history book , study a ton of design from other designers, _make a shit-load of bad stuff but keep on going anyway_ , and you'll be a better designer.

You won't really know what you know until you apply it. You will likely suck at it. Doesn't matter. You'll suck a little less at it next time.

"The experienced illustrator subscribes to the principle of the application of the seat of the pants to the seat of the chair. Should inspiration whisk down your chimney, be at your table. The first ten thousand drawings are the hardest. Put another way, you have ten thousand bad drawings within and should expel them as quickly as possible."

<http://en.wikipedia.org/wiki/Wallace_Tripp>

</comment></comment></comment><comment><USER12> Great post and great sketches! Inspired by these, I published some sketches (within wireframes), too! You find them on my page: » <http://hofmannsven.com/2012/journal/wireframe-sketches/>

</comment><comment><USER13> These are really cool. I like seeing start and finish pictures from cool projects.

</comment><comment><USER14> love seeing intial sketches alongside finished products. I should use my notebook or dot grid book or whatever more often but alot of my designs have their very first iteration on POST-ITS. Could start a tumblr for initial post- it sketches hehe.</comment>


UnQLite – An Embeddable NoSQL Database Engine - <AUTHOR> https://unqlite.org/ <comment><USER2> Hey all. I worked on the UnQLite development team back into 2013 ~ 2014. It was designed to be the primary storage for a home targeting router manufactured by a French tech conglomerate.

The API is broken down into two independent layers plus one for various utility stuff like cross platform mmaped files, RC4 random numbers generation and so on. The first layer serve as a general purpose key/value store for the host application blobs (i.e binary or text data). You can store whole disk files inside a single database to generate a cross platform TAR archive for example.

The second one is the document store layer similar in concept to what MongoDB offer but without the networking layer since everything run in the same process of the host application. Both layers are transactional and are able to recover after some external failure thanks to the SQLite journaling mechanism from which UnQLite is based on.

Since its release in 2013, there was four major bugs including two critical that involves data loss under certain load. All known data corruption bugs were fixed in the last release and no major bugs were discovered a year or so.

The library enjoy particular success among Python and C/C++ developers especially Chinese that used to bombard the original developers with various internal aspect of the library.

</comment><comment><USER3> I authored a python binding and have some experience that may be relevant.

The library seems poorly maintained in my opinion and might be abandoned. There have been critical bugs leading to data loss. They have a similar project vedis which is like an embedded redis that I think is completely abandoned.

For the love of God just use SQLite if you want an embedded database for structured data, even if it's just eav. If you just need key/value there are battle-tested, well maintained options.

[https://github.com/symisc/unqlite/issues/41](https://github.com/symisc/unqlite/issues/41)

<comment><USER4> You've posted the same two-year-old closed issue twice on this thread. You're coming off as someone with an axe to grind.

<comment><USER5> People often get passionate about data corruption.

</comment></comment></comment><comment><USER6> The licensing is not altogether obvious. There seems to be a "one time fee" for downloading. The name sort of implies a connection with SQLite. No such connection exists. There is a parent company, name of "Symisc Systems". Which appears to be just one guy somewhere in France or Tunisia who likes to call himself "we". The code is not too kindly treated by several who have actually tried to use it.

I think I'll pass.

<comment><USER7> [https://github.com/symisc/unqlite/blob/master/LICENSE](https://github.com/symisc/unqlite/blob/master/LICENSE)

It does use a fair amount of sqlite source.

</comment></comment><comment><USER8> I think the FAQ needs another question: when should I prefer UnQLite over SQLite? When should I prefer SQLite over UnQLite?

<comment><USER9> That one seems straight forward: when you want SQL use SQLite, when you want NoSQL use UnQLite

<comment><USER10> From what I quickly gathered, it's just a Key-Value storage mechanism.

<comment><USER9> The title says NoSQL and the first paragraph on the page confirms that it's more than just a KV store:

> _UnQLite is a in-process software library which implements a self-contained, > serverless, zero-configuration, transactional NoSQL database engine. UnQLite > is a document store database similar to MongoDB, Redis, CouchDB etc. as well > a standard Key /Value store similar to BerkeleyDB, LevelDB, etc._

<comment><USER10> Ah, I didn't read it correctly then.

</comment></comment></comment></comment></comment><comment><USER11> > _UnQLite is a standard key /value store similar to BerkeleyDB, LevelDB, etc. > but, with a rich feature set including support for transactions (ACID), > concurrent reader, etc._

This is slightly interesting, since the big reason I personally prefer applications using SQLite over those using BerkeleyDB (which used to be _very_ common, btw) is that I've had _lots_ of problems in the past with corrupted BerkeleyDB files. Like, almost all the time; if it used BerkeleyDB, it would sooner or later get corrupted. If UnQLite can be a "non-corrupting BerkeleyDB" for those who don't actually need SQLite, it can serve an (admittedly niche) purpose.

<comment><USER3> Oh it corrupts... [https://github.com/symisc/unqlite/issues/41](https://github.com/symisc/unqlite/issues/41)

</comment></comment><comment><USER12> > This production-ready package is available for a one-time fee of $20.

Don't fault them for trying to make a bit of cash but going to have to pass since I'm too poor to spend $20 to see if it's a viable replacement for a little project I built on top of tinydb that's getting pretty slow since the db has grown past what a pure python db can comfortably handle.

Or...I suppose they could provide a link from their download page to their github repo for us somewhat lazy folks -> [https://github.com/symisc/unqlite](https://github.com/symisc/unqlite)

</comment><comment> evil-olive Is there any documentation of the testing/verification process used in UnQLite? One of the things that gives me confidence in SQLite is [https://www.sqlite.org/testing.html](https://www.sqlite.org/testing.html) and it'd be interesting to see what approach UnQLite takes to the same problem.

</comment><comment><USER8> From the FAQ:

"7\. Is UnQLite thread-safe

Threads are evil.[1] Avoid them.

UnQLite is threadsafe and full re-entrant. But in order to be thread-safe, UnQLite must be compiled with the UNQLITE_ENABLE_THREADS compile time directive defined. If you are unsure if the UnQLite library you are linking against is compiled to be threadsafe you can call the unqlite_lib_is_threadsafe() interface to find out."

[1] [http://www.eecs.berkeley.edu/Pubs/TechRpts/2006/EECS-2006-1....](http://www.eecs.berkeley.edu/Pubs/TechRpts/2006/EECS-2006-1.pdf) "The Problem with Threads"

"Threads are evil" is not a useful remark to make in response to the question "is this library thread-safe"

<comment><USER13> sqllite has the same warning in their FAQ's :D

[https://www.sqlite.org/faq.html#q6](https://www.sqlite.org/faq.html#q6)

<comment><USER14> SQLite can actually do grouping and sorting (iirc) in parallel, though it's disabled practically everywhere (Linux distros and other environments shipping SQLite seem to pick compile flags kinda arbitrarily, e.g. json1 and fts4/5 are fairly widespread on Linux, but not included in e.g. Python for Windows).

</comment></comment></comment><comment><USER15> this is great - in my opinion there's a shortage of key value type data storage engines and there needs to be more competition in this regard. There simply aren't enough free/open source data engines to meet the demand of today's software.

few quick thoughts - how does this compare to leveldb? How would it perform in something like geth or parity as an ethereum client back end data engine in compared to leveldb? do you have a python interface library?

<comment><USER16> Really? There seem to be a ton of key/value engines on the market, especially because it's such a simple model to implement.

<comment><USER17> There is plethora of embedded K/V stores, but most of them only solve the simple to implement parts. That means either no concept of concurrency control or global RW-lock, zero resiliency to power failures, no support for atomic transactions...

If you want on-disk K/V store for critical data you are pretty much stuck with BerkeleyDB.

<comment><USER18> BerkeleyDB still has corruption issues, and is quite slow. The only k/v store out there proven to be entirely corruption-free is LMDB.

[https://symas.com/lmdb/](https://symas.com/lmdb/)

</comment></comment></comment></comment><comment><USER19> Unqlite doesn't support in order traversal of data because the default (and only included storage engine) is based on hashing.

</comment><comment><USER20> Is there an "amalgamation file" like SQLite has for easy inclusion into other projects?

<comment><AUTHOR> Yes. unqlite.h/c in the root at [https://github.com/symisc/unqlite](https://github.com/symisc/unqlite)

</comment></comment><comment><USER21> Sounds pretty similar in target usage to LMDB.

<comment><USER13> thats log structured storage?

<comment><USER18> No, LMDB uses a copy-on-write B+tree.

[https://symas.com/lmdb/technical/](https://symas.com/lmdb/technical/)

</comment></comment></comment><comment><USER22> The name though — what is it supposed to mean? "Un" as in "One" in French with QL Lite or "Un" as in a prefix for an opposite in English with QL Lite (like "No QL Lite")?

<comment><USER23> Un SQL = no sql

And a pun on SQLite.

<comment><USER24> > a pun on SQLite.

And a bad one at that.

I normally don't chime in on HN, but this pun is a crime against humanity.

</comment></comment></comment><comment><USER25> > An Embeddable NoSQL Database Engine

So, std::unordered_map?

<comment><USER26> Looks more like an out of core unordered_map<string,string> with thread safety and persistence to me, if you really want to make that analogy.

</comment></comment><comment><USER27> So what are the advantages of this over say python dicts? Genuinely asking thanks.

<comment><USER28> The data in a python dict disappears when you turn your computer off. The data in UnQLite doesn't disappear.

<comment><USER27> I could pickle the dict to a file right?

<comment><USER28> If you have 1GB of data, and want to change a small portion of it, that would require you to read the whole thing, then modify it, then write the whole thing back to disk. A database only requires a small amount of reading and writing.

</comment></comment></comment></comment><comment><USER29> This is a good example of someone twisting the term "serverless" to capture attention:

> _Serverless Database Engine_

> _Most NoSQL database engines (i.e. MongoDB, Redis, CouchDB) are implemented > as a separate server process. Programs that want to access the database > communicate with the server using some kind of interprocess communication > (typically TCP /IP) to send requests to the server and to receive back > results. UnQLite like SQLite does not work this way. With UnQLite, the > process that wants to access the database reads and writes directly from the > database files on disk. There is no intermediary server process._

The fact that it's embedded doesn't actually have anything to do with what popular "serverless" architectures are designed to solve, i.e. writing code that does not need to run in a specific server process to be invoked on demand. By their definition of serverless, pretty much any library is "serverless"...

 _Edit: This is referring to "Classic Serverless" ([https://sqlite.org/serverless.html](https://sqlite.org/serverless.html)) not "Neo-Serverless" architecture (my definition is more like "Neo-Serverless"). Thanks parhamn for pointing out the distinction._

<comment><USER30> That doesn't seem fair. The word you quoted isn't even in the section you provided. The use of "server" is interchangeable with daemon/isolated-process here. That section seems like a decent explanation of daemon vs embedded for the junior dev.

<comment><USER29> Huh? It's literally in the "Serverless Database Engine" section. I can update the quote to include the header.

<comment><USER30> Even then, "twisting" is a stretch (especially the connoted maleficence). I think most people would realize these are unrelated and there seems to be a quite of precedence for talking about daemon-less as "serverless" [1].

[1] [https://sqlite.org/serverless.html](https://sqlite.org/serverless.html)

<comment><USER29> Fair enough, the "classic serverless" vs "neo-serverless" distinction directly addresses my point. I have added this clarification in my original point.</comment></comment></comment></comment></comment>


California's new DMV regulations may kill the state's robocar lead - <AUTHOR> http://robohub.org/california-dmv-regulations-may-kill-the-states-robocar-lead/ <comment><AUTHOR> California's new state driving laws effectively make it illegal to operate a vehicle without a licensed driver, making Google's plans for unmanned robocars (at least for now) impossible to pursue in the state, and giving an advantage to traditional car manufacturers, which are mostly pursuing co-pilot or auto- pilot versions of autonomous driving technology. Will this push robocar development to more autonomous-friendly states? Interesting article by robocar expert Brad Templeton.</comment>


Safe and Nested Subgame Solving for Imperfect-Information Games [pdf] - <AUTHOR> https://arxiv.org/abs/1705.02955 <comment><AUTHOR> A teaser video:

[https://www.youtube.com/watch?v=EbKmZLp5HvA](https://www.youtube.com/watch?v=EbKmZLp5HvA)</comment>