Google Chrome v15 Released - <AUTHOR> http://chrome.blogspot.com/2011/10/making-chrome-even-more-app-ealing.html

<comment><USER3> Out of curiosity;

Google Chrome was released about 37 months ago. 15 versions were released since then, so Google averaged about 15/37 versions per month, the "Chrome constant." Lynx was released in 1992, around 228 months ago. 228(15/37)=v92. So, were Lynx to have used an approximately similar version enumeration to Chrome, it would currently be at around version 92.

Similarly:

      Opera: 178 * (CC) = v72

      Konqueror: 180 * (CC) = v72

      Firefox: 83 * (CC) = v33

      Internet Explorer: 194 * (CC) = v78

      Safari: 105 * (CC) = v42

      Lynx: 228 * (CC) = v92

Another note of interest is that almost all of these browsers had their respective releases in September or October.

<comment><USER4> Interesting to see those numbers :)

What is also good is that the first few comments aren't "why is Chrome bumping the major version number so soon?" like we used to see with every Chrome and Firefox release. Maybe the internet is starting to move past that ;)

</comment></comment><comment><USER5> Chrome has a wee bug that is incredibly annoying once you notice it, and it's still not fixed in V15. To reproduce, go to any web page with a confirm dialog:

1\. Think of a secret number between one and ten (or higher if you are a patient person!)

2\. Trigger the dialog.

3\. Count up to your secret number.

4\. Click OK on the dialog.

5\. Count up until the page disappears.

6\. And that's your secret number!

Basically Chrome freezes after a confirm dialog for the same amount of time that you take to click the OK button. Most people assume it is just the following page is taking a while to load. I'd be interested in how widespread it is - it's affected every instance of Chrome I've come across, on Windows and Linux.

Oh, and please star the issue here if it affect you. <http://code.google.com/p/chromium/issues/detail?id=98275>

</comment><comment><USER6> Ugh they didn't take the left-right scrolling/history thing out in OSX Lion from the beta. Infuriating that I can't scroll left without going back one page.

Any setting discovered yet to turn this off?

<comment><USER7> Switch back to three finger gestures in System Preferences. I have no idea why Apple thought that was a good idea. It used to be:

\- Two fingers for scrolling

\- Three fingers for in-app navigation

\- Four fingers for window management (Exposé, show desktop)

Really easy to understand. Lion made "multitouch gestures" a major advertising point, but honestly... they were better in Snow Leopard. I've reverted with BetterTouchTool, as I could not even _do_ the new "show desktop" gesture.

<comment><USER8> I think the issue is that Apple has devoted plenty of resources to tweaking gestures so that two-finger swipes can be used for both scrolling and navigation. It's a hard problem to solve, but if it's done just right it works. Safari does it just fine.

Chrome is far too touchy about it, though. As soon as you hit the edge, you go back a page. Safari seems to take the velocity and acceleration into account in smarter ways.

<comment><USER9> I switched to Canary to fix this issue, which has a much less aggressive gesture. Now a slide switch (almost like iOS's unlock screen) transparently overlays the screen until you slide across your trackpad, _then_ it goes back a page. No need to touch OS X settings. :)

I was glad it was no longer sensitive, but I was still wondering why they didn't just implement Safari's page-reveal as you slide back. Then I tried using the Github website, which implements its own transitions using the History API, which worked splendidly on Chrome but was rather broken in Safari.

The best compromise would be to see what sites implement the history API and switch, but I'm satisfied with working side-scrolling for now.

<comment><USER10> About Canary: <http://techcrunch.com/2011/05/02/google-chrome-canary-os-x/>

</comment></comment></comment></comment></comment><comment><USER11> Does anyone here actually use Chrome apps? I personally don't really get the appeal, but maybe someone can explain it.

<comment><USER12> Some apps like Google Docs require you to install the app for offline usage.

I use apps to integrate them into Gnome Shell. I can press super+"gm"+enter to open up Gmail, or "cal" for the calendar, etc.

There's no reason that you couldn't use this for bookmarks, but I guess Chrome apps allow for larger icons...

Despite my usage, I'd agree that it's essentially just an ideological push by Google to convince consumers that the internet is a viable computing platform in its own right. This computing platform - would you believe it - <USER2> largely of Google's own apps (but it doesn't have to).

</comment></comment><comment><USER13> Best new feature: different colors for padding and margin in the inspector. Already super useful.

</comment><comment><USER14> I'm pretty excited about being able to sync open tabs and search engines. Still have to enable it in about:flags though.

</comment><comment><USER15> Anyone else noticing a big speed increase? Chrome 14 was actually much slower than the prior few versions on my 7 year old Windows XP system (1 GB RAM). I'm experiencing much faster page loads with Chrome 15.

<comment><USER16> you sure it wasn't related to the fact that you restarted your browser? Have you been running Chrome 14 in one instance for a long time?

<comment><USER15> I restart the computer and chrome each morning. And when Chrome gets to slow I restart it mid day sometimes. I also clear caches once every few weeks which seems to speed it up a little, but not like it did when going from Chrome 14 to Chrome 15.

</comment></comment></comment><comment><USER17> The canary build had a bottom tab for bookmarks. It seems they've taken it out, so I still have to install an app for every site I want a link on the new tab page for.

<comment><USER18> Check out "Enable NTP bookmark features" in chrome://flags/

</comment></comment><comment><USER19> Is there any way to change the New Tab page without the help of extensions? I prefered it blank which you can't do now.

<comment><USER20> Nor does there appear to be a way to toggle it from chrome://flags since it's not an experimental feature anymore. Is it worth opening an issue for this?

</comment></comment><comment><USER21> Why is Bing the default search when first Installed?</comment>


Iran bans women from universities - <AUTHOR> http://www.telegraph.co.uk/news/worldnews/middleeast/iran/9487761/Anger-as-Iran-bans-women-from-universities.html

<comment><USER2> And how many women were taking their expensive, useful degrees, working for perhaps a few years, and then essentially retiring to get married?</comment>


On Google's self-driving car acident rates - <AUTHOR> http://ideas.4brad.com/google-releases-detailed-intervention-rates-and-real-unsolved-problem-robocars <comment><USER2> Licensed pilot here (learned to fly in 1987). People need to look at self- driving cars in the way pilots use an auto-pilot.

Auto-pilot is most useful in two situations. 1) long cross country legs where there is not much flying to do (just maintain heading and altitude), so A/P frees the pilot up to manage other systems, enjoy the view, etc, and alleviates fatigue, 2) flying a precision instrument approach, reducing the risk that the pilot will succumb to spatial disorientation in the setup for (usually manual) landing.

With cars, auto-drive capability will be useful in reducing accidents in two modes: 1) long duration highway driving where fatigue is a big issue, 2) intervening to prevent a distracted driver from causing an accident (rear end collision etc).

I'd be perfectly happy with a car that can drive itself in cruise mode on the interstate, but requires an alert driver on local roads (with the added bonus that if I am about to slam into something, it will brake to avoid or lessen the impact).

Something for the liability crowd to consider, self driving cars won't be able to avoid every potential mishap, but they will be able to reduce their severity. A car that can automatically brake to reduce its speed by 25% just before impact, will reduce its kinetic energy by roughly half, and the potential for injury by more still.

<comment><USER3> Your comment made me think: Could driverless cars kill the domestic airline industry?

If I could get from NY to Florida in less than a day in my driverless car, and at sub-$2-gas, who would want to do the security check-in, luggage ripoff, flight delay thing when going less than 1000 miles?

<comment><USER4> Are you familiar with Amtrak.com?

<comment><USER5> at least on the west coast, amtrak routes are slower than driving and more expensive than flying

</comment></comment></comment></comment><comment><USER6> I think it's pretty clear that the bar for safety must be much higher (10x) than human-level for these to be accepted by consumers. Auto accidents are very common, and the first time someone has an accident with a car like this everyone they know will hear about it. It will be terrifying. If these are only as safe on average as a human driver then nearly everyone is going to have at the very least a 2nd-hand negative experience.

The emotional response to these accidents is not going to be entirely irrational either. If I have a minor accident with my traditional truck, I'm going to probably have a good understanding of what went wrong and how I can prevent future collisions. With an autonomous vehicle... software upgrade? I'd rather take responsibility for my own safety if that's the case.

<comment><USER7> The idea that humans learn well from accidents stands contrary to all available evidence.

<comment><USER8> What evidence? Certainly individual humans (anecdotally: like myself) do.

<comment><USER9> Look at insurance premiums. Premiums go up after an accident because it is more likely that you are a poor driver and likely to have another accident.

<comment><USER10> Insurance companies raise premiums after accidents because there is an excuse to do so. It has nothing do with your likelihood to have another accident, and everything to do with charging you more so that they can attract new customers with a lower price. Premiums go up even if the driver is found to be not at fault.

<comment><USER11> I've been involved in several reported accidents that were judged to be fully the fault of the other driver, and my rates have never increased.

<comment><USER12> They will drop you for being unlucky if they are too closely spaced together.

<comment><USER13> Relatedly, my home insurance company dropped me for being unlucky enough to get burglarized.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> What about manufacturer liability? That's the critical question here.

It can't just be 2X or even 10X safer than humans if the manufacturer is liable for the accident. That would EXPLODE the cost of these cars and bankrupt companies -- even if just a small fraction of today's fatal accidents due to driver error became Google's liability.

Consider that even single-vehicle accidents, which today might be the driver's fault, could result in a manufacturer lawsuit.

This is why I think _fully_ autonomous without any human to intervene is a pipe dream, because the safety level required for that is pretty close to perfectly bugfree in an almost infinitely complex world of roads and conditions. Just for liability reasons.

These test cars of course have human copilots. But it remains to be seen if that really will grant manufacturers immunity for accidents. If the car is perfect 99.999% of the time, wouldn't that train the human to trust it and not pay as close attention? And then miss that 0.001% of the time when it hurts someone? Would a judge find it reasonable for a human to stay vigilant and responsible for that fatal corner case bug that cropped up after two years of perfect autonomous driving?

Liability is The. Critical. Question.

<comment><USER15> There is no explosion. The cost of collisions today is reflected in the car insurance, so about $100/mo. If the manufacturer were to absorb this liability at current incident rates, it would make cars about 30% more expensive (assuming $300/mo loan payments). If Google reduces the (incidence * impact) of collision by 10x, the cost will come down to $10/mo, or about 3% of the total car cost.

And in return for the modest price increase you get a _self-driving car!_

<comment><USER14> You're forgetting about tort damages. Insurance does _not_ typically cover the cost of killing or seriously injuring someone. Those damages go into the millions, far exceeding the maximum coverage. Cases of serious injury and death often end up bankrupting the responsible individual.

Also consider that there are more people who can sue per accident, because humans aren't responsible anymore. Today if you're driving the car and get in a accident and it's your fault, you can't sue anyone. Now you can. That's one more party per accident, and a whole category of single-vehicle accidents than now result in lawsuits.

<comment><USER16> > You're forgetting about tort damages. Insurance does not typically cover the > cost of killing or seriously injuring someone. Those damages go into the > millions, far exceeding the maximum coverage. Cases of serious injury and > death often end up bankrupting the responsible individual.

And you're forgetting that, to the extent that such injuries can be laid at the food of manufacturers' defects, manufacturers are _already_ liable for them, and since plaintiffs are unlikely to be able to fully collect from drivers, will often be sued _now_ , so self-driving cars don't actually change things that much.

> Also consider that there are more people who can sue per accident, because > humans aren't responsible anymore.

Incorrect.

> Today if you're driving the car and get in a accident and it's your fault, > you can't sue anyone.

Incorrect. If you get in an accident and suffer damages and you allege that this is due to a manufacturer's defect, this is a basis for suit against the manufacturer. Now, you won't _win_ if the manufacturer can show by a preponderance of the evidence that the accident was your fault rather than theirs. [0]

Similarly, quite likely, in a self-driving car regime, if your car crashes you can sue the manufacturer and claim a defect was responsible, but if they can prove its the fault of something else (such as your own failure to properly maintain the vehicle), they won't be liable to you.

[0] [http://www.nolo.com/legal-encyclopedia/product-liability- cla...](http://www.nolo.com/legal-encyclopedia/product-liability-claims- defective-cars-29648.html)

<comment><USER17> I think your logic is correct, but your implied outcome is probably wrong.

>"If you get in an accident and suffer damages and you allege that this is due to a manufacturer's defect, this is a basis for suit against the manufacturer."

Right now, this is an edge case. The self driving car may cause it to become common.

<comment><USER16> > The self driving car may cause it to become common.

Yes, because _exactly_ those cases where the driver (as operator, as distinct from the -- often the same person's role as -- owner-as-maintainer) is responsible now become the manufacturer's responsibility. But, again, that's exactly what insurance covers.

But, again, we know the cost of that liability is -- its the cost of driver's insurance.

<comment><USER10> Driver's insurance is the cost of liability _to drivers_ , whose ability to pay damages is practically capped by their own insurance coverage.

A major corporation does not have the same practical ability to cap their damages. I am not convinced it's a straight comparable cost as you keep saying. The two risks are not exactly comparable, thus I would not expect the insurance costs to be the same.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Minor crashes are even more frequent than the article estimates. Thus, the real human accident rate is even higher. Probably between 1 in every 24000 and 87000 miles.

The VTI driving study[1] equipped 100 cars with sensors and was therefore able to measure all crashes experienced. It directly measured 1 crash per 24000 miles. If we extrapolate based on the 17.4% police report rate, that suggests 1 per 87000 miles.

[1][http://www.nhtsa.gov/DOT/NHTSA/NRD/Multimedia/PDFs/Crash%20A...](http://www.nhtsa.gov/DOT/NHTSA/NRD/Multimedia/PDFs/Crash%20Avoidance/Driver%20Distraction/100Car_ESV05summary.pdf)

<comment><USER11> That's an interesting study. I'd be cautious at trying to create a one-line conclusion from it. It is, however, a fascinating full read, and not very long and not very technical, so I'd encourage people to read the whole thing.

Note the narrow demographic data and geographic data.

</comment></comment><comment><USER19> I live in Mountain View and I see Google self-driving cars around all the time (day and night). My personal feel is that they look "different" and my attention will deliberately focus on them (which may or may not affect my driving when I'm around them).

Why not test with cars that look "normal" (think early 2000s Corolla). Wouldn't this further decrease the chance of possible accidents?

I guess what I'm saying is, who's decision was it to make it look like a toy car and not just an actual regular car that doesn't divert my attention off the road?

*edit for better readability

<comment><USER5> google is only capable of designing things that look they were made by and for 5 year olds

<comment><USER20> In this case the more non-threatening the cars are, the more likely people are to accept them.

</comment></comment></comment><comment><USER21> Google cache: [http://webcache.googleusercontent.com/search?q=cache:9UNd6-l...](http://webcache.googleusercontent.com/search?q=cache:9UNd6-lo4fwJ:ideas.4brad.com/google- releases-detailed-intervention-rates-and-real-unsolved-problem- robocars+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER22> I'm going to use this as a place to mention how ridiculous it seems to me that drupal displays the database details on the error page:

> the username is drupal and the database server is localhost

I'm sure this isn't a huge information leak, but it still seems kind of silly to me.

<comment><USER23> I used to use Drupal. At this point I never, ever recommend people use it.

Pregenerating most of your pages a-la Jeckyll is just so much better that I don't know why anyone ever thought generating all of their pages with PHP was a good idea.

I remember thinking it was a good idea, to be honest. But at this point I look back and see how mistaken I was.

<comment><USER24> To help people trying to Google/understand the parent comment, it is spelled Jekyll.

<comment><USER23> Foo. Too late to edit.

Thanks for the clarification.

</comment></comment></comment></comment></comment><comment><USER25> The CA dmv also publicly reports all accidents involving autonomous vehicles [1]. Most accidents are caused by drivers taking over control manually, or by other actors on the road driving erratically (or rear-ending the self-driving vehicles). The entries on the page report Google, Delphi, and Cruise automation as having incidents, though they're all minor damages, if there are any at all.

[1]([https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/auton...](https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/autonomousveh_ol316))

</comment><comment><USER26> >How does that number compare with humans? Well, regular people in the USA have about 6 million accidents per year _reported to the police_ , which means about once every 500,000 miles.

Aren't accidents only reported to police if there is a hit & run, or some other criminal activity?

Seems like the wrong metric for comparison, given the way they define the self-driving "accidents" and that the majority of human fender benders are not reported.

<comment><USER27> In some(most/all?) states, all accidents over a certain dollar amount or that caused injury to any party are required to be reported to the police.

But the lack of police reports is why the article mentions that insurance companies believe the accident rate is higher than the 'official' number.

Anecdotally, the number of times that someone has hit my car, and then asked me not to report it in exchange for cash is non-zero.

</comment></comment><comment><USER28> When it comes down to differentiation what do I care about if a robot is driving me around?

Safety. Period.

The equation to get to safety is sensors + computing + map / map geometry.

The sensor differentiation will matter for a while, some OEMs will do very well, but ultimately it will just boil down to the software.

So how is the future of this space not just "everybody licenses Google's platform"?

If life/death safety is the differentiator (and measurable) I feel like the writing is on the wall. Google is going to dominate this.

Maybe Musk sneaks in there with his brash approach of using his drivers as test subjects but his position as a competing auto manufacturer seems less compelling than supporting an "Android-like" effort from Google.

<comment><USER29> > The equation to get to safety is sensors + computing + map / map geometry.

The equation to get to safety is actually what you mentioned + roads where 100% of vehicles are tied in to a common network orchestrating each vehicle's movement in relation to the others and the environment. Without that, differentiation in software is likely to lead to unanticipated dangerous scenarios, just as the HFT market is susceptible to flash crashes... except on the road, they will be _real_ crashes with the potential to be more destructive than human-caused accidents.

Hopefully when that network becomes a reality, we can build it on top of some kind of open, distributed platform (perhaps related to blockchain technology) that no single entity can abuse.

<comment><USER30> That seems really brittle. The baseline for every vehicle should be safety in every situation. (Sometimes that might mean: pull over to the side of the road and stop.) Only once every vehicle is proved safe, can certain combinations of vehicles negotiate compromises to safety in pursuit of other goals like speed.

<comment><USER29> (responding to your comment and the other comment about a possibility of attackers)

I agree that the baseline should be independent, autonomous, safe operation of each vehicle without any network/cooperation, but in time it's going to go beyond that. I have no doubt that it will happen.

Once independent operation is proven to be reasonably safe and dependable for everyday use, it will have achieved a certain degree of safety and efficiency - significantly better (at least in safety) than humans, but still prone to occasional accidents (regardless of who/what is at fault), especially when human drivers are still allowed to drive on the same roads.

At that point, people will demand even higher levels of safety (similar to the nines of high availability), and greater efficiency (i.e., speed). Unfortunately, with human drivers sharing the same road, those two demands are at odds with each other; greater efficiency inherently reduces safety. At some point though, the demand will be great enough that we'll have to adopt something better - something with a higher level of coordination between vehicles, and where only computer-controlled vehicles can participate.

It certainly won't be pushed or adopted universally in one step, and it'll likely _never_ cover all road infrastructure. It will be adopted first on high throughput routes, much like you have private toll roads today. Instead of paying a toll (or perhaps in addition), your car will enter the roadway by joining the network. Without network compatibility, you'll be unable to use the road.

Once you've joined the network, however, your vehicle can literally drive at breakneck speeds, avoiding other traffic by incredibly small margins, and all with significantly higher safety than non-networked roads.

Of course having a single network controlling vehicles opens up a possibility for attacks, just as modern commercial aircraft can be vulnerable to attack. It will be an issue, but not one without reasonable mitigation strategies and best practices. The "network" in question may not even be centralized in nature, but rather a decentralized, local mesh network with safeguards in place for each vehicle to detect and respond appropriately to situations where the network seems to be guiding vehicles outside safe bounds. There are a lot of ways that it could be implemented, but it'll be important (at least to me) that it's not all controlled by one government/corporation/entity, but instead rolled out as a set of interoperable industry standards.

<comment><USER30> Why such confidence in the future adoption of this system that you stipulate will be both dangerous and inconvenient? This might work as a scifi plot device, but it's not predictive.

[EDIT:] What if a moose crosses the road?

</comment></comment></comment></comment></comment><comment><USER31> Next time you pull up to a stop light, look to the left and then right. I'm willing to be the drivers on the left and or right are looking at their phone.

It's getting worse... the phone, blue tooth, the dashboard computer, traffic, impatient drivers. etc...

I for one can't wait these self driving cars, they have got to better than distracted drivers we have now.

<comment><USER32> >Next time you pull up to a stop light, look to the left and then right. I'm willing to be the drivers on the left and or right are looking at their phone.

And the dude between them is busy staring at his neighboring drivers rather than the road!

</comment></comment><comment><USER33> Is Google only testing in California? It seems that the data for accidents was given for the whole of the US, but it should be compared to California only. I don't know if it's noticeably different or not, but I'd think that snow and ice would increase the accident rate in some states.

Snow and ice I think would provide a challenge for self-driving cars.

<comment><USER34> Turns out snow and ice provides challenges for cars driven by humans!

</comment></comment><comment><USER35> I am surprised that Google has not started having their software recording on cars that are driven by humans, to learn. They could increasingly have feedback to say "Our software would not drive that fast/that close to that curb" and progressively simulate a lot more dangerous situation and learn about tough situations than they currently can.

<comment><USER36> They have a vast number of human operated vehicles with extensive telemetry data: Street view cars.

</comment></comment><comment><USER37> [http://webcache.googleusercontent.com/search?q=cache:9UNd6-l...](http://webcache.googleusercontent.com/search?q=cache:9UNd6-lo4fwJ:ideas.4brad.com/google- releases-detailed-intervention-rates-and-real-unsolved-problem- robocars&num=1&hl=en&gl=us&strip=1&vwsrc=0)

Cache. Its down for me.

</comment><comment><USER38> How safe does a self-driving car have to be before it is allowed on the road?

I would say that's going to be a societal decision rather than an engineering decision.

An interesting point is that the introduction of the private automobile itself was an imposition on the social space of that time which basically was wildly unsafe with automobile accidents still being on of the leading causes of death in this country.

If it's determined that self-driving cars will be allowed, ordinary drivers will be forced to adjust to their presence and will have to learn their quirks.

Certainly, cellular phones realistically are being used by a significant fraction of drivers today and if the accident rate has gone up at worst only slightly due to that (not enough to counter-weight other safety measure), it's because non-cell users have adapted to the presence of the cell-user, however annoying that might be.

<comment><USER39> >How safe does a self-driving car have to be before it is allowed on the road?

I'd argue that self driving cars just don't have to be safer than average drivers. They should be safer than average drivers with computer driving assistance. It's already happening, but we can take the self driving programs and use them with human drivers. To get a best of both worlds scenario. Of course we'd have to mandate all new cars come with computer driving assistance.

The counter argument is that we accept the risk of cars now, why not let self driving cars have the same level of risk. My answer is that the risk of cars is so great we either shouldn't be accepting it or are only accepting it because there isn't an easy alternative. A lot of Americans die on the roads.

<comment><USER40> It depends on the distribution of drivers that cause incidents. If the average (mean) driver is involved in an average number of incidents, then fine, base the safety estimation on them. If the average driver is involved in a below average number of incidents, the safety standard should be tuned to the drivers that are involved in incidents.

<comment><USER41> When we calculate averages, are we including the number of drunk driving accidents, for example? 10,000 Americans are killed every year due to that. If we calculate equivalent accident rates that include impaired humans, I'm not sure that's good enough. Computer + human should be able to address this problem, right? Reduce speed, pull over and stop, if someone can't drive between the lines or they are driving the wrong direction on a road.

</comment></comment></comment></comment><comment><USER42> All of the brouhaha about self driving cars is moot until real user testing begins. I'm not talking about driving a google mobile around the streets of mountain view with an engineer in the driver's seat.

These vehicles (I would hope) are designed to drive around people in different circumstances. They're software for use by people and until we have realistic tests with different kinds of people, ages, driving experience levels, etc. it's all academic.

I'm somewhat wondering if all the self driving car stuff by Google and Tesla is primarily a vehicle (no pun intended) for marketing rather than actual tech that will yield a real product.

<comment><USER35> It seems, from previous reports by Google, that their ability to understand discrepancy between sensors relies on knowing the road very well, not just the map with nuances like "cars can go there, but it's mainly a pedestrian street" but more local undocumented habits. They mentioned details that prove that they would have to drive a lot in new cities to learn enough and make their car safe.

The one that I remember is that they have started driving in Austin and came across a very local species of vehicle with a unique habit: the hipster fixie rider with his stand-stop motion at red lights. Committed bikers do not have free wheels and stay standing in place not by putting their feet down but rocking back and forth; that motion was new and not interpreted clearly by the car, that hesitated to see it as a false start. It's since been fixed. The article didn't specify if the shirt pattern had any meaningful weight in the interpretation.

</comment></comment><comment><USER43> I can't wait for self driving cars. End of that discussion each time we eat out about who is going to drive us home...

</comment><comment><USER44> If the humans always take the wheel in dangerous situations, how do you know the cars are safe? The cases where they are most likely to get into trouble are the cases where the AI is not in operation!

</comment><comment><USER45> *accident

</comment><comment><USER46> >we have to figure out just how to test these vehicles so we can know when a safety goal has been met. We also have to figure out what the safety goal is.

Or you can just crack ahead and try them with users like Tesla.

</comment><comment><USER47> The average human driver is consciously forgoing the option of driving in the hyper-conservative manner that the google cars do...

</comment><comment><USER48> 250,000 miles on average between accidents? Does anybody think this is unbelievably high number?

</comment><comment><USER49> typo in the headline. we need one more 'c' in accident.

</comment><comment><USER50> Why bother?

In a world of massive un- and under- employment, mechanical turk and massive connectivity, increasing income inequality, and generationally declining standards of living, a handful of millionaires will sit in their unimaginably expensive self driving car, and five mechanical turk remote drivers will cooperate on a 3 of 5 vote basis to drive the millionaire.

Most brainpower is underutilized, the quantity is increasing, and its manufactured by unskilled labor. There eventually comes a peak-automation point where its better and cheaper for the economy and culture to just hire a dude to do it.

The world of the future is only ivy league grads will have real jobs and they'll have all the money, whats so inherently awful about someone in the favelas getting a job as a driver, especially if its cheaper and safer?

<comment><USER51> The world unemployment rate is 8% according to the CIA World Factbook. What's going to make this increase so dramatically? We've had industrial automation, computers, and the internet for decades now, and people still have jobs.

Also why would you want someone remote-controlling your car instead of sitting in the drivers seat? Wireless connectivity is way too flaky. Tunnels block the signal, rural areas have poor coverage, and equipment breaks and requires maintenance. It would be insanity to bet your life on a cellular signal.</comment></comment>


Job Description as runnable python UnitTest - <AUTHOR> http://github.com/praekelt/careers/blob/master/software_engineer.py

<comment><USER2> Heh, job teasers are getting simpler and simpler. I remember in the late 90s they were "compile with GNU/Sun/SGI/HP toolchain, call the phone number that gets printed when you build on a big/small-endian machine".

The early ones were funky C compiler weirdnesses that exploited word size, endianness, binary format and other machine quirks. This one is practically readable.

<comment><USER3>
        print "2. Fork out this code, suggest improvements and submit those" [L141]

So fork the code and suggest something funkier.

[L141] [http://github.com/praekelt/careers/blob/master/software_engi...](http://github.com/praekelt/careers/blob/master/software_engineer.py#L141)

<comment><USER4> print("2. Fork out this code, suggest improvements and submit those")

There fixed it for you :)

<comment><USER3> They might be using RHEL (Red Hat Enterprise Linux) which comes with Python 2.4 and in 2.4 you can't use print as a function.

LE: python 2.5 -> 2.4 (bconway was right)

<comment><USER5> Two corrections:

A.) RHEL 5.x (by default) comes with Python 2.4, not 2.5.

B.) Yes you can. It is required in 3.x, though.

<comment><USER6> Well you can't use it as a function. You can however combine the parsing of the "print" keyword, and the "(" and ")" taking precedence around the string to form KEYWORD STRING that looks a hell of a lot like a function call though.

</comment></comment></comment></comment></comment></comment><comment><USER7> 1) I'm annoyed I can't enjoy looking at clouds (which I really do) and pass their test.

2) I'm annoyed by companies who think working for them is some great gift to me. Various wordings in this test exuded that attitude.

<comment><AUTHOR> 2 - wasn't intentional, what wordings exude that attitude in your opinion?

<comment><USER7> I went back to find specific things for you and couldn't. The idea of "tricky" "test" is off putting. Making me jump through hoops just for the "honor" of being a possible candidate.

OTOH, I could have just been a bad mood that day.

</comment></comment></comment><comment><USER8> I appreciate the concept but it's too readable. If you're going to do something like this as an actual test, why not funkify it a little bit to challenge the candidates?

Still, great idea! Coming up next -- Job Description as an infographic!

<comment><AUTHOR> Yeah, truth in that. I'm needing to write a couple more like this, this is the first one. Next one will be an job description for a DB guy with interest in databases in the broadest sense. Not sure how to go about that one yet.

I like the infographic idea, any other suggestions?

<comment><USER2> I am sure eitally was being sarcastic.

Also, why are you attempting to recruit people who are interested in a subject "in the broadest sense", as opposed to people who live and breath the damn thing?

Recruiting people of marginal interest and passing familiarity sounds like a recipe for mediocrity, imo.

<comment><AUTHOR> Maybe my bad choice of words. In the "broadest sense" I meant that we're looking for a DB person who's interested in both relational DBs as well as the complete other side of the spectrum.

Still, I think a tongue in cheek infographic could be pretty cool as a job description. True, maybe not so much for databases.

</comment></comment></comment></comment><comment><USER9> (sorry, gut reaction). This feels like a company who wants to _seem like_ a company I want to work for.

</comment><comment><USER10> Some of these tests seem backwards:

"10 years software development experience." is translated as

       assert candidate.results['started_programming'] <= years_ago(10)

That reads like "10 years or less" rather than "10 years or more"; I'd be wary of applying to a place that can't even get that right (although maybe your first job can be fixing their ad).

Edit: Reading more closely, perhaps years_ago(10) returns the numeric year that was 10 years ago now, and 'started_programming' is an absolute year as well, in which case this test makes more sense. However, it's not intuitive to read this way...

</comment><comment><USER11> Python scope still freaks me out.

It's weird to me that the "candidate" referenced by FoundationEngineerTestCase is the same candidate instantiated at the bottom of the file, without ever being explicitly passed into an instance of that class. I would have expected:

        test_program = CandidateTestProgram(candidate)

Furthermore, how is CandidateTestProgram connected to FoundationEngineerTestCase? Does it do a global search for subclasses of unittest.TestCase, then instantiate and execute them?

<comment><USER12> Referencing the 'candidate' variable from within the test case is not a good approach as it's referencing a module global instead of an attribute. Additionally, it only exists when the module is executed directly, so if it's imported and run in a different manner a name error will result for every test that references.

As for the TestProgram, it's inheriting routines from the base class in the unittest module that do introspection to find all test fixtures.

</comment></comment><comment><USER13> It would be better if you just write the test, so the candidate in order to apply should fork, write a Candidate class and pull a request.

BTW the position is in Cape Town?

<comment><AUTHOR> not necessarily, but would be nice.</comment></comment>


How Much Would an iPhone Cost If Apple Were Forced to Make It in America? - <AUTHOR> https://www.forbes.com/sites/quora/2018/01/17/how-much-would-an-iphone-cost-if-apple-were-forced-to-make-it-in-america/ <comment><USER2> I find this hard to believe. I recently worked at a firm that is making top- of-the-line cell phones in the United States. Even if you took the LRIP BOM cost, quadrupled the cost of parts and then doubled it all for good measure you still wouldn't sniff $10000.

This looks like a writer trying to justify the abuse of workers and the environment overseas in the name of cheap stuff.

<comment><USER3> All we know is it would cost too much. These are great jobs for Chinese (far safer and better paying than rural Chinese's farm jobs), but terrible for Americans.

</comment></comment><comment><USER4> Pretty sure I commented on a similar article years ago that came up with a figure around $75 per phone additional cost. No idea how they got that figure, and perhaps it's a number that is only achieved if it were all phones being made in the states, and so scale is important to it.. However, if it is indeed possible to make half, or X amount of iphones in the states at only a $100 premium added to the price, I imagine a great deal of them would sell no problem.

First of all, I'd wager that most people are not paying $1,000 cash for a new phone, and if they were, making it $1100 instead to get one with a US emblem on it would be negligle... however aren't most people just getting a new phone for free with contract, or just "jumping" to a new phone and still paying the same $20 per month that they will likely be paying forever for each new phone they will be getting from their loan shark, I mean carrier.. so they will never see the price increase. That would make an average cell phone bill go from $95 per month to $96 or something right?

I personally believe the only thing holding them back from making them in the states has been holding a lot of cash over seas and over the heads to negotiate tax breaks with the fed and and discount deals with states.

No idea what's really happening, but it would seem prudent for companies to get more chips made in the states with the way things have been getting unstable with relations in other parts of the world.

Apple seems to be in a better position for these things compared to HP / Dell, etc imho.

</comment><comment><USER5> What market do they expect to sell these exclusive American made phones? And how do they compare to the already perfect Chinese made iPhones? They know the answer but it was a well written article.

</comment><comment><AUTHOR> _In the $30,000 to $100,000 range… and no this is not a typo._

Better tooling, more tooling engineers, and that's what it takes to scale.

 _In the U.S. you could have a meeting of tooling engineers and I'm not sure we could fill the room. In China you could fill multiple football fields._

</comment><comment><USER6> Which country of America?

</comment><comment><USER7> I wonder how much iPhone advertising is placed in Forbes media every year?</comment>


The 48 Laws of Power - <AUTHOR> http://www2.tech.purdue.edu/cg/Courses/cgt411/covey/48_laws_of_power.htm <comment><USER2> Call me shallow, but I just can't take seriously anything that reminds me of the Ferengi Rules of Acquisition.

<http://memory-alpha.org/en/wiki/Rules_of_Acquisition>

(Yes, Ferengi rules were recently mentioned in Jeff Atwood's blog, <http://www.codinghorror.com/blog/archives/001225.html>)

<comment><USER3> Granted some of them are silly, but a fair amout of the Ferengi Rules make sense.

</comment></comment><comment><USER4> Surprised everyone here seemed to miss the point. Like "The Prince" this is descriptive, not instructive. That is, "Here is how powerful people will attempt to control you..."

<comment><USER5> Well, this would mean that being powerful assumes lack of integrity. Disagreeing with this does not necessarily mean missing the point. I've been guilty of committing to some of these laws, consciously or not. So, another use of that list would be as a checkpoint of one's integrity. Kind of.

</comment></comment><comment><USER6> 49: In the long term, and for smarter audiences, doing good work beats these tricks.

<comment><USER7> I think thats an unfair assessment of a good book.

I was probably seventeen when I read the book, and have all but forgotten most of those laws, but I remembered many of the stories. Greene in the book carefully puts together an array of interesting stories of famous leaders, generals, businessman that makes the book enjoyable to read whether or not one agrees with his laws.

My favourite chapter was "Enter action with boldness" which had in it a story of a poor Korean man named Huh Saeng. <http://wisdomportal.com/Enlightenment/Huh-Saeng.html>

And I would add that "doing good work" gives you the confidence to "enter action with boldness".

<comment><USER6> It wasn't an assessment of a book, but of the link it was a comment on.

</comment></comment></comment><comment><USER8> _Learn to Keep People Dependent on You_

 _To maintain your independence you must always be needed and wanted. The more you are relied on, the more freedom you have. Make people depend on you for their happiness and prosperity and you have nothing to fear. Never teach them enough so that they can do without you._

This one is like death to the IT guy. At first, it seems like job security until you realize that the neophytes have clustered on your hull like so many barnacles. Being indispensable is great but it doesn't take many 2 AM "email emergencies" from the management types to make you want to become a goat herder.

<comment><USER9> Yeah, it actually seems like the more people need you, the _less_ freedom you have, as long as you have any sense of responsibility toward them at all.

</comment></comment><comment><USER10> "Even if you are saying something banal, it will seem original if you make it vague, open-ended, and sphinxlike"

Self-describing article?

<comment><USER11> It may be open-ended, and sphinxlike may be a matter of judgment, but for what it is, that is not a vague article.

<comment><USER12> And it is not banal.

</comment></comment></comment><comment><USER13> _> If you have no enemies, find a way to make them._

Such as by following these other 47 laws!

<comment><USER14> I find much of these rules terrible, at first I believed it was a joke, no wonder we live in a society in which people feel so miserable !

<comment><USER15> it has nothing to do with hacking & hackers, it's very oldschool.

however: " As much as they respect brains in Silicon Valley, the message the Valley sends is: you should be more powerful."

</comment></comment></comment><comment><USER16> I know a guy that plays by these rules. No one likes him.

<comment><USER17> Then it sounds like he's not following the rules very well.

</comment></comment><comment><USER18> Don't forget "The 50th Law", a book he co-authored with 50-cent, available at a fine bookseller near you. Why bother with Machiavelli when you can get it with a hip-hop twist.

<comment><USER19> Machiavelli is way better than his reputation suggests.

</comment></comment><comment><USER20> I always notice people seem to read this book and assume that it's an instructional manual on how to live. It's just making points about the fundamentals of power.

</comment><comment><USER21> After reading these "laws", it made me think of JK Rowling and how she used some of these with the Tom Riddle (Lord Voldemort) character in the Harry Potter books.

<comment><USER22> I'm thinking of Ayn Rand's Ellsworth Toohey.

</comment></comment><comment><USER23> Come on now guys. This book was written by a pop psychologist. He may have interesting theories, but he isn't exactly Genghis Khan.

This is one step too close to Opera's book club.

<comment><USER24> 48 Laws and 33 Strategies are excellent. Greene himself is in no way comparable to those he quotes in his books, but he synthesized an excellent compilation of knowledge nonetheless.

</comment></comment><comment><USER25> Do not outshine the master? Yeah, hiding your talent is a sure way to get people to recognize your talent, and thereby attain success. I stopped reading at #1.

</comment><comment><USER5> There is an obvious contradiction in these "laws". How can someone look stupid without damaging of reputation? If you read too much into them I think you'll find quite many contradictions. Not that I actually take them seriously or I would bother to read too much into them.

</comment><comment><USER26> Interesting. I'd just get rid of the "The".

Art of war is pretty good too.

<http://classics.mit.edu/Tzu/artwar.html>

</comment><comment><USER27> What's that they say again? Ultimate power ultimately corrupts.

"For what will it profit a man if he gains the whole world and forfeits his soul?"

<comment><USER28> Generally it's "Power corrupts. Absolute power corrupts absolutely."

</comment></comment><comment><USER29> I bought this book a few years ago (5 IIRC). I started skimming it and got pretty sad about the things one supposedly had to do to make it. Then I lost the book a few days later when I left it on a flight.

I took it as a sign; I didn't bother going to go to lost and found or buy another copy. I wonder if I did the right thing. :)

</comment><comment><USER30> Greene's books are interesting because they are Machiavellian: a mixture of amoral observation of what is, satirical recommendations and, vice versa, inexplicit instruction on what to watch out for other people doing to you.

And in A and C they are extremely valuable, and all worth owning and reading. And the advice does sometimes make sense -- it's written in the extreme to provoke, but sometimes life is so contradictory that doing "bad" things tempered with a good intention works out to positive in the final balance.

</comment><comment><USER31> That is a guide book for a politican or businessman in developing countries.

In Russia, for example, it could be a bestseller. It is the-way-how-it-works here.

Unfortunately, people in Russia do not read books anymore.

</comment><comment><USER32> This would be why I'm not that interested in power.</comment>


Vik Muniz Painstakingly Reconstructs the Backs of Famous Paintings - <AUTHOR> http://hyperallergic.com/309086/vik-muniz-painstakingly-reconstructs-the-backs-of-famous-paintings/ <comment><USER2> I was just at this exhibit a few hours ago, funny enough. This exhibit is the first contemporary art to ever be shown at the Mauritshuis in the Hague, which is a beautiful museum that has works by Rembrandt (including a great self- portrait), Vermeer (including Girl with a Pearl Earring) and many more old Dutch masters.

Here's a photo I took of my favorite work: [https://www.instagram.com/p/BIgFNpXA53Q/](https://www.instagram.com/p/BIgFNpXA53Q/)

The exhibit is amazing and I highly recommend it. Vic Muniz is a very talented artist and I think the Mauritshuis picked a fantastic first exhibition.

From the article: "When Muniz had the opportunity to bring his recreated frame [of the Mona Lisa] to the Louvre and placed it side-by-side with the authentic painting, technicians who have spent years caring for the original apparently thought his was the genuine one."

<comment><USER3> ok, I accept it may be technically accomplished.

But is it interesting beyond that ?

<comment><USER2> It was, at least for me. One of my biggest complaints with a lot of art museums with no contemporary pieces is that people just walk through, not actually looking at the art, just to say "I saw a (Vermeer|Rembrandt|Bosch) today! In this exhibit, people were really interacting with the art. They were trying to look behind the pieces to tell if there was art there; some people just thought the room was unfinished and they shouldn't be there; some tried to tell if the pieces were the actual backs or not. Others were more astute and read the description on the wall, and almost everyone that did was still intrigued by the art. Think of it as a 3D photograph of the actual artwork, not only very interesting to look at but also exceedingly well-done. And, while even professionals that worked with the Mona Lisa for years could not tell the real Mona Lisa back from its replica, there were certainly fine nuances in the work that made it more than just a pure photocopied version of the "original". At the very least, there was nobody doing the very common walk-through-the-room-spending-10-seconds-on-each-piece that fills traditional galleries, and it made me very happy to see.

<comment><USER4> If you enjoyed this, you might enjoy an exhibit currently on display at the Met Breuer, part of the Metropolitan Museum of Art here in New York called "Unfinished". It displays dozens of works of art that were never finished, for varying reasons. Some are classified as intentionally unfinished (would that make them finished?), but they are all fascinating to see and read about.

[http://www.metmuseum.org/exhibitions/listings/2016/unfinishe...](http://www.metmuseum.org/exhibitions/listings/2016/unfinished)

<comment><USER5> > intentionally unfinished (would that make them finished?)

If memory serves, someone quipped "art works are not finished, merely abandoned".

(I'll abandon this and omit searching ;-)

</comment></comment></comment></comment></comment><comment><USER6> I was hoping that it was going to be famous paintings from the reverse perspective. As if the painter had set up on the opposite side of the scene.

<comment><USER7> Tom Keating did this with a few of his forgeries -- took the location of a known painting and then mentally turned 90 or 180 degrees.

[https://www.youtube.com/watch?v=AyA8fkMJcDE](https://www.youtube.com/watch?v=AyA8fkMJcDE)

</comment></comment><comment><USER8> the current exhibitor (Mauritshuis in Den Haag) has produced a short "making of" video providing some more insights how the frames were made: [https://www.youtube.com/watch?v=nM5SVKsP- hg](https://www.youtube.com/watch?v=nM5SVKsP-hg)</comment>


YCLDN 29.09.11 Summary - <AUTHOR> http://www.matthewslight.com/2011/09/30/ycldn-29-09-11/

<comment><AUTHOR>
      * Scribbled entrance notices being thrashed out five minutes before first talker due to speak
      * Orderly British queue forming for mammoth order of pizza and beer (red stripe went down well)
      * Pre talk banter on why anybody still using PHP needs to exorcise the demon, install RVM and start using Ruby with HAML, SASS and Coffeescript.
      * @kzhu from Mint Digital when asked "What's your market size? Surely only everybody has one fridge", replying "everybody"
      * @giniji for hacking together SWYM.me, a buggy startup the day before and knowing that his search strings were chopping off the first characters. Uby on Rails.
      * @Harjeet for encouraging all hackers to apply well for YC and take the pilgrimage to Mountain View
      * Many a wannabe CEO on the prowl for the elusive CTO
      * Something special is happening in the East End of London right now. Where it will take us. Who knows.</comment>


Wind Turbines Inspired by Insect Wings Are 35% More Efficient - <AUTHOR> http://www.sciencemag.org/news/2017/02/wind-turbines-inspired-insect-wings-are-35-more-efficient <comment><USER2> Presumably each of the designs has an associated installation and manufacturing cost. Is efficiency here measuring power/cost, power/blade area, power/blade volume, power/land area...?

This does not seem like the kind of principle that would be overlooked by engineers in a technology that is as old as sailing until "just now".

<comment><USER3> Variable pitch is a well known technique. Flexible blades are used by some types of light aircraft propellers. In the case of the propellers the improvement is not as great as with full variable pitch but the cost/simplicity is better. So the same sort of thing probably applies here. Some technique would have to be found that was cheap/reliable enough to end up with a better result than boring old variable pitch done with bearings and gears.</comment></comment>


Show HN: MLonFHIR: Fusing Sklearn with the HL7 FHIR Standard - <AUTHOR> https://github.com/chrisby/ml-on-fhir <comment><USER2> "the HL7 FHIR standard"

Which one? R4? STU3? -> [http://hl7.org/fhir/directory.html](http://hl7.org/fhir/directory.html)

AFAIK, the different versions aren't compatible with each other. How will that affect this library?

<comment><AUTHOR> Good point. As of now, we only tested it with STU3. I think something we definitely miss is a test module that allows for version compatibility checks.

<comment><USER2> I'll be watching this project. I hope you can keep advancing it. Maybe put a note on the README about version compatibility and a call to action for testing new versions as they come out?

</comment></comment></comment><comment><USER3> This is an excellent idea. From unfortunate experience, I know this will struggle to be real in a hospital that's suffering with Epic. The company is strictly against open standards ([https://www.cnbc.com/amp/2020/01/22/epic- ceo-sends-letter-ur...](https://www.cnbc.com/amp/2020/01/22/epic-ceo-sends- letter-urging-hospitals-to-oppose-hhs-data-sharing-rule.html)). The Epic scam continues unabated, but I wonder if there's a way to add more explicit rejections (or constraints) for Epic environments?

<comment><USER4> They do support a fair number of FHIR resources (as required by meaningful use stage 3): [https://open.epic.com/Interface/FHIR](https://open.epic.com/Interface/FHIR) and even more within their curated marketplace: [https://apporchard.epic.com/](https://apporchard.epic.com/)</comment></comment>


Wishing for Blog Search Engines - <AUTHOR> http://inessential.com/2019/04/11/wishing_for_blog_search_engines <comment><USER2> Working on it :) Planning on making it a free service of readwrite.blog

Also added you to my RSS reader.</comment>


GE Sells Most of Stake in Pivotal Software - <AUTHOR> https://www.crn.com/news/internet-of-things/ge-sells-most-of-its-stake-in-pivotal-software <comment><AUTHOR> Interesting, I wonder if we'll see more of this as GE consolidates and if this means a further phase out of GE Digital under the new CEO</comment>


Abadoned Kola Superdeep Borehole - <AUTHOR> http://rusue.com/abandoned-kola-superdeep-borehole/ <comment><USER2> For the lazy - [https://en.wikipedia.org/wiki/Kola_Superdeep_Borehole](https://en.wikipedia.org/wiki/Kola_Superdeep_Borehole)

Edit: from the Russian version of the page -

A single drill bit lasted about 4 hours, which was enough to drill between 7 and 10 meters. In comparison, raising and lowering the drilling column took up to 18 hours.

It also mentions that due to the core samples being saturated with hydrogen, they turned to a fine dust unless they were raised very slowly to allow the gas to dissipate.

</comment><comment><USER3> Re the "cries and groans" \- [https://en.m.wikipedia.org/wiki/The_Well_to_Hell_hoax](https://en.m.wikipedia.org/wiki/The_Well_to_Hell_hoax)

</comment><comment><USER4> Getting some real Doom 3 vibes here:

"It is rumored that at some point the drilling rig began to vibrate unnaturally, as if someone were jerking for it from below. When the well reached a mark of about 12,000 meters, scientific equipment recorded sounds resembling the cries and groans of thousands of martyrs emanating from the depths."

<comment><USER5> Sadly, that is only an urban myth, there is some explanation on how it appeared on the wikipedia page of the site.

<comment><USER6> Personally, I'm quite happy that this supposed Hell turned out to be a myth.

<comment><USER5> Idunno, Hell could have been a potential source of geothermal energy.

Or maybe it could aid in the discovery in previously unknown energy production methods.

<comment><USER6> Now there's a fun moral dilemma. Is it ethical to generate electricity with the torment of the damned if it replaces polluting power plants and they'd be tormented anyway?

<comment><USER5> I mean, they're gonna be tormented either way so why not make that useful...

I was playing at the DOOM (2016) scenario though.

</comment></comment></comment></comment></comment></comment><comment><USER7> Maybe they've excavated Balrog... any Grey hat want to go down there to check what they found? And you know, maybe you'll turn into a white hat... ;)

</comment><comment><USER8> Seems like it curved as it went down, I did not expect to see that but, thinking about it, no reason it should just go straight down.

<comment><USER9> No boreholes are perfectly straight and vertical. In most cases, you're twisting the drillstring at the top, so it naturally "wants" to corkscrew. Furthermore, anisotropy in the rock causes things to deflect (deviate in drilling terminology). Usually you don't know exactly where the well went until you run a directional survey afterwards (basically, you lower a gyroscope down the hole).

At the scale of a well, the steel drillstring is more like cooked spaghetti. You don't "push" down, you use the weight of fluid (drilling mud) for pressure. The drillstring is only meant to transmit torque. It's easy for it to bend over long distances. (You can even turn things entirely around and use fluid pressure to turn the bit, in which case the drillstring is basically a steel hose that's stored coiled up.)

<comment><USER8> Thank you, really interesting.

Is the drilling mud pumped down to create that pressure then, or is it naturally present? Or one pumps water down to turn the grit into a slurry?

<comment><USER9> It is pumped, but the pumps are there to force circulation and keep things under control rather than to provide the pressure directly.

You need a steady gradient of pressure. The pressure you need at the bottom of the hole will fracture the rock in the shallow section. Pumps add a constant pressure, so there's no way to get the right pressures at each depth with a pump.

Instead, drilling exploits gravity to do the hard work. The drilling mud is very dense (almost as dense as the rock) so that the pressure at the bottom of the borehole from the weight of the mud is just a bit less than the pressure from the weight of the rocks.

</comment></comment></comment></comment><comment><USER10> Nice, there's so much material for level design of a new Fallout-like game on that website!

</comment><comment><USER11> how useful is hydrogen from such wells? is the quantity sufficient to warrant just drilling for it or simply burning it to power the drilling?

<comment><USER12> -I would guess (mind, guess, I don't know the first thing about gas drilling) that as they needed to take great care retrieving the core samples slowly to allow the hydrogen to evaporate without damaging the sample (as per @abcd_f's comment above), the rate of hydrogen release from the rocks is simply too low for it to make any sense to drill for it.

After all, if hydrogen is slow to escape from the core sample, it stands to reason it will be slow to escape from the surrounding rock, too.

(Given a bit of electricity, we can easily get lots and lots of hydrogen from water, anyway.)

</comment></comment><comment><USER13> No smiles in the 15km celebration photo.

<comment><AUTHOR> Good catch, may be the work was too exhaustive and the exhaustion led to depression once you realize that whatever you do it does not matter at the end, everyone is paid the same, even all the credits go to the "united workers of the world", not you.

<comment><USER14> They stopped because it was too hot, 180 Celsius.

The rock was more like plastic than rock.

</comment></comment></comment><comment><USER15> Boring.

<comment><USER16> Would you please start posting civilly and substantively?

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER17> It's a pun. These guys were boring holes.</comment></comment></comment>


Show HN: Open-sourced my Java chess AI high school project - <AUTHOR> https://github.com/pate/chessmate

<comment><USER2> I'm not sure I'd call "uploading code" to a website "open sourcing."

Where is your LICENSE file? Where are licensing terms discussed?

Open source isn't just code; the license you release under is equally, and perhaps even more, important than the code.

<comment><USER3> Fair enough criticism here, but this is a high schooler. Instead of coming on strong with HEY WHERE IS THIS AND THAT, understand that he "open-sourced" the project to learn stuff. So since I don't have the proper knowledge to explain the open-source license stuff, maybe you could explain a bit or point to a good read so he/she can continue to learn.

<comment><USER4> Did you even click the link? This was a 2005 high school project, so the author is 3 years out of college.

</comment></comment></comment><comment><USER5> Cool project! Anyone trying to run it on *nix will need to open Main.java and replace all instances of the windows-specific file separator "\\\" with "/".

<comment><USER6> It should be using the java.io.File.separator[0] constant for platform independence.

[0] [http://docs.oracle.com/javase/6/docs/api/java/io/File.html#s...](http://docs.oracle.com/javase/6/docs/api/java/io/File.html#separator)

<comment><USER7> For future reference, just using slash ("/") will work for both Windows and Unix systems (linux and OSX)

<comment><USER6> Yes, Windows treats both "/" and "\" as separators. Just make sure you handle the edge cases.

[http://stackoverflow.com/questions/4845866/java-on- windows-p...](http://stackoverflow.com/questions/4845866/java-on-windows- prevent-slash-in-file-name-from-acting-as-a-seperator)

</comment></comment></comment></comment><comment><AUTHOR> Will add an MIT licence tonight.

</comment><comment><USER8> src/build.bat seems to be missing.

<comment><USER9> Is this meant to be a joke? Anyway, I believe you mean Makefile is missing.</comment></comment>


Just open sourced the Apache QR module of lilqr.com and went with Python instead - <AUTHOR> http://siavashg.posterous.com/ Just switched the site over to a Python based version and decided to open source the Apache module that generated the QR-codes before. <comment><USER2> I would be curious to see what the performance is using PyPy instead of CPython. Seems right up its alley after reading [http://morepypy.blogspot.com/2011/07/realtime-image- processi...](http://morepypy.blogspot.com/2011/07/realtime-image-processing- in-python.html)

</comment><comment><USER3> I wonder what the performance difference would be between using the Python Apache plugin and running qrencode - the C executable ( <http://fukuchi.org/works/qrencode/index.en.html> ).

I know it's not clean to call shell commands from Apache - not to mention the obvious performance hit with swapping environments - but perhaps the ELF vs Python JIT might compensate for this.

Also, i'd be interested in a comparison of features between the two.

</comment><comment><USER4> Have you considered putting some of code back into a C extension? You could probably get back most of the lost performance with only a little bit of C.

</comment><comment><USER5> When are you planning on open sourcing the Python version?

</comment><comment><USER6> I can't seem to find under what license is this released?

<comment><USER7> Seems to be under a BSD-style license <https://github.com/siavashg/mod_qr/blob/master/COPYING>

<comment><USER6> Thanks. I saw the COPYING file, but since I'm not a legal expert (and since I am considering using this as part of a big project), I was looking for a declaration of a specific license rather than a few terms. Plus, I'm not that familiar with Github so I thought maybe I was simply not seeing a "license" section. Anyhow, thanks.

</comment></comment></comment><comment><USER8> Have you considered Cython?</comment>


Epoch Converter - <AUTHOR> http://www.epochconverter.com/

<comment><USER2> $ /bin/date +%s

1269411909

$ /bin/date --date=@1269411909

Tue Mar 23 23:25:09 PDT 2010

$

Easy, scriptable, omnipresent. Why would you bother with a web page?

</comment><comment><USER3> use this almost everyday at work.</comment>


Our Ambitious Plan to Make Insecure PHP Software a Thing of the Past - <AUTHOR> https://paragonie.com/blog/2018/01/our-ambitious-plan-make-insecure-php-software-thing-past <comment><USER3> Can you get StackOverflow to "sponser" this idea? Not just for crypto (which you've done) - but for all PHP related answers?

Because the problem is there are many "old" accepted answers, with high upvotes, that will always come up as number 1 or 2 in google searches.

Given PHP has changed so much, many of those answers are outdated, use incorrect and insecure methods, and some are now just wrong. This is not just security - but a whole host of answers.

The "meta" StackOverflow rules will tell you to downvote the old answer and post a new one - but that is not practical - and will take years to take effect. Plus, many people simply read the first large upvoted answer, copy + paste the code, and move on.

edit: I guess it would be nice to be able to "flag" an accepted answer (not a question) as outdated, get 5x people with gold badges for that tag to accept it - and then the answer is highlighed as wrong/out of date (or even deleted). Something like that.

<comment><AUTHOR> > Can you get StackOverflow to "sponser" this idea?

Possibly. I wouldn't even know where to begin.

> Because the problem is there are many "old" accepted answers, with high > upvotes, that will always come up as number 1 or 2 in google searches.

Yeah, that's my concern. I can definitely edit anything tagged [php], due to having a gold [php] badge, and I think I can edit anything because I have a reputation higher than 10,000.

The hardest problem for me, here, is _identifying_ these old accepted answers with high upvotes.

My general approach is something like this:

[https://stackoverflow.com/questions/tagged/php+encryption?so...](https://stackoverflow.com/questions/tagged/php+encryption?sort=votes&pageSize=50)

[https://www.google.com/search?q=site%3Astackoverflow.com+php...](https://www.google.com/search?q=site%3Astackoverflow.com+php+encryption)

<comment><USER3> IMO (as someone with 45k rep on StackOverflow, largely in PHP) - the best way is to modify the "flag" option on answers - and have an extra option called "out of date". If someone flags an answer as out of date, then anyone with a gold badge in that tag (i.e. PHP) - can review and accept or decline the flag.

If 5 gold people accept it - then the answer is formally highlighted as out of date, or even deleted.

You could raise this on Meta Stackoverflow as one possible way to start: [https://meta.stackoverflow.com/](https://meta.stackoverflow.com/)

edit: There probably should be another flag option - called "security" \- where even if an answer "works" and is "in date" \- people can flag it as insecure due to a better option. Think of all the stupid SQL injection answers. You can downvote it to hell - but sometimes they should just be flagged/deleted.

<comment><USER4> Please don't delete out of date information.

Signed, someone who's done a lot of legacy code maintenance (have you tried to find VB6 or .NET 1 doco these days?)

<comment><USER5> Ok, so it's not deleted but maybe it gets a banner with links on up to date stuff like in OP. Then, if they can't use that due to legacy software, they go forward with whatever the answer contains for what they're stuck with. That might help both types of users.

</comment></comment></comment></comment></comment><comment><USER6> I think it would be better to write a plugin for various PHP IDEs that contain fingerprints of bad code which is used to yell at the programmer if they are using these old, insecure code snippets. Heck, you could add a feature or note to the developer to down-vote the source of said code.

It would be a lot of work, but I think it's easier than trying to get authors of defunked blogs to take down 10 year old answers.

As a side-effect, this increases awareness among developers that you can't blindly accept what's on SO. If developers begin to lose trust in SO, then SO is going to be incentivized to do something about, or go the way of expertsexchange.

<comment><USER7> There's a plugin for IntelliJ IDEs called "PHP Inspections (EA Extended)" [0] that detects some of these compatibility and security problems.

[0]: [https://plugins.jetbrains.com/plugin/7622-php-inspections- ea...](https://plugins.jetbrains.com/plugin/7622-php-inspections-ea-extended-)

<comment><USER6> This could certainly be a starting off point for what I was imagining.

I was thinking that they could do analysis on code snippets that are copy- pasted into the editor. It should be straight-forward to compare the contents to a finger-print database and issue a warning when they find a match to online code examples that are marked as vulnerable.

</comment></comment></comment><comment><USER8> Reputation management companies struggle to wipe "bad content" off of 3rd party sites.

Your goal is laudable, just not sure it's practical. Did you consider focusing on publishing and promoting net new content instead? Get traction that way, and that content will move up the Google serps, effectively moving the old/bad content down.

<comment><AUTHOR> > Did you consider focusing on publishing and promoting net new content > instead?

We've been doing that for years. We've hit diminishing returns because:

1\. There is a lot of incumbent material in the same genre, most of which is 10+ years old, but people still link to it in droves.

2\. We don't support the at-best-sketchy SEO industry that's sometimes arm-in- arm with adware.

If you read the 2018 guide this post mentions a few times, you'll notice that it, in turn, links to relevant blog posts (and open source libraries) spanning back to early 2015.

<comment><USER8> I don't think that asking people to link to content that's clearly superior is "SEO".

Asking a 3rd party site to change a link seems easier than asking a different 3rd party site to rewrite content.

<comment><AUTHOR> That's sort of what I'm asking people for, except presented as a choice.

I'll update the article to try to make it clear that "link to clearly superior content" is a viable alternative to rewriting said content, as long as the same goal is achieved.

</comment></comment></comment></comment><comment><USER9> Well, PHP has finally come full circle in the lifecycle. It's fully following in the footsteps of Perl. There was a big push and a lot of talk in the Perl community around 2010-2012 to find and remove old and poor quality Perl tutorials so people searching didn't end up with bad information. Part of this push included writing new and better tutorials and trying to get them placed higher in results for old tutorials that could not or would not be removed.

Since we all saw and remember how Perl regained it's top spot as most popular programming language, I'm sure this will work out wonderfully. :/

<comment><USER10> I almost wrote a similar comment, but I figured I would be downvoted. I realize it sounds cynical, but why should this effort be made for PHP? I loved PHP back in the year 2000, and at that time it had advantages that no other language had, but those days are long gone. There are many better languages now. I wrote about this in my essay "PHP is obsolete" and there was a fairly good conversation about that essay on Hacker News:

[https://news.ycombinator.com/item?id=9598309](https://news.ycombinator.com/item?id=9598309)

<comment><USER8> It is still popular with newcomers, people that don't come from a structured CS background, etc. Because the barrier to entry is just so low. Meaning, it's a built in, working option on hosting providers, deceptively simple in the beginning, etc. Also, PHP still dominates the "host it yourself e-commerce" space, because of Magento, Opencart, and PrestaShop. Oh, and WordPress...it's some insane percentage of all sites. And lousy plugins are everywhere.

We could ignore that crowd, but guiding them down the right path is better for everyone.

Edit: I'm also not convinced that node.js, which is gaining ground with the same crowd, doesn't have similar issues. Footguns aren't unique to PHP.

<comment><USER11> The availability on hosting providers is a HUGE deal. Sure, you can write an application in Python, or Node, or Java, or whatever else is theoretically better... but good luck finding somewhere to host it that's cheap and doesn't require you to do all the sysadmin work yourself (i.e, not a VPS).

PHP may not be the best of all possible languages, but it's by far the most widely available.

<comment><USER8> I agree. And, as mentioned, these hosting providers will likely make node.js just as simple soon, and node will replace php as the whipping boy for flippant remarks. What's old is new again. This is more about providing newbies with good advice than it is about PHP.

<comment><USER11> Honestly, I don't see that happening soon, if ever. PHP was easy for hosting providers because it was easy to plug in to existing virtual hosting support in Apache and FTP servers. Node is more complicated; there's no obvious "right" way to handle many Node apps running on a single shared server.

<comment><USER8> There were several ways for PHP too, and still are, FWIW. The shared hosting providers eventually settled on the best compromise of price/performance/security.

What they provide now is better and more scalable than old school CGI. Most of the shared hosts are using LightSpeed[1] as it squeezes as much as possible out of PHP in a shared environment. That vendor, and their low end shared host customers, aren't dumb. They will respond to market changes and make node.js a 1st class support item when it is clear that's where the money is.

[1][https://www.litespeedtech.com](https://www.litespeedtech.com)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> > we can raze the mountains of collective technical debt that have accumulated > over the past decade.

Not likely when professionally written code is full of errors, many security- related (e.g. attempting to load and execute .gifs). I recently presented a compilation[1] of the errors produced by one widely-used commercial ad function. If this is how a professionals write commercial code, I don't want to imagine what amateurs have been doing.

[1] [https://www.reddit.com/r/web_programming/comments/7o8dzf/cop...](https://www.reddit.com/r/web_programming/comments/7o8dzf/copious_and_varied_errors_from/)

<comment><USER13> Sounds like an intentionally malicious function to me - just waiting for a proper payload.

</comment></comment><comment><USER14> An admirable goal. One of my pet peeves with lots of php code and extensions is the unending desire to make every bit of cold backwards compatible to some of the oldest versions of PHP.

There are some great, new cryptographic functions that have been implemented in PHP >= 5.5

Password_hash() and password_verify() are so simple, it's hard to mess up password hashing now. When I upgraded my projects to PHPa7, I replaced dozens of lines of code with those 2 functions alone.

But I have seen plenty of implementations of them that still fall back to old more convoluted and error prone methods when you are using some old version of PHP.

<comment><USER15> _> When I upgraded my projects to PHPa7 ..._

The universe of developers with PHP projects to maintain is filled with people who do not share the same goals and constraints that you might enjoy.

There _is_ an enormous amount of lousy PHP code, and more being made by clueless developers. But please do not dismiss the need to support old PHPs as being driven primarily by those reasons.

1\. The PHP project itself has EOLed 5.3.3, however distros continue to support it with backported security and bug patches of their own.

2\. PHP 5.3.3 (with backported security and bug patches) remains the default in CentOS 6.9, which is supported until 2020. More recent versions are not available via their repositories. Hosts would have to upgrade PHP outside of the CentOS packages and assume the maintenance burden from then on.

3\. About 50% of sites running PHP are at versions less than 5.5:

[https://w3techs.com/technologies/details/pl- php/5/all](https://w3techs.com/technologies/details/pl-php/5/all)

[https://w3techs.com/technologies/details/pl- php/all/all](https://w3techs.com/technologies/details/pl-php/all/all)

4\. Updating PHP is not like simply updating my Web browser. Real-world production hosts like mine are filled with various work by various developers over years. Bumping PHP further than a maintenance release would almost certainly mean unnecessarily breaking things that are hard to find, probably tricky to fix and written by people I've never met who are long gone.

<comment><USER16> What's the friction for upgrading from 5.3 to _at least_ 5.5?

<comment><USER17> register_global

<comment><AUTHOR> extract($_REQUEST);

Look, one-line register_globals polyfill.

<comment><USER15> This kind of breezy dismissal is really frustrating. Developers and admins in the field are dealing with this situation for the reasons I gave above, and not out of simple ignorance.

</comment></comment></comment></comment></comment></comment><comment><USER18> I want to recommend another technique these days:

1) Sign (HMAC) all the session ids that your server issues. This allows requests with bogus session ids to be rejected at the network borders without doing any I/O or hitting the database.

2) Use web crypto (now supported by all major browsers) to have clients generate a private key with which to sign all requests. Using session keys as bearer tokens opens users up to attacks.

3) Do NOT send passwords to the server! Use passwords to decrypt the private key, and do not expose the decrypted key to external Javascript. And make sure the key can't be exported.

4) Clients authenticate new devices using two-factor authentication. If the person is using a previously authorized device and knows their password this may be considered two factors already. Unless the password was saved, in which case they better have a password on their device. Ultimately you gotta trust the OS.

5) Authentication and authorization for data may be done automatically by a side-channel (QR code via camera, or bluetooth) with the proof submitted to the server by either device. Revocation ultimately needs a blockchain.

6) If you lost all your authorized devices, the backup should be: M of N public keys, plus a passphrase you know. This is only for rare cases and the passphrase can be weak.

No more passwords except for the above!!

<comment><AUTHOR> Please tell me you've seen this before? [https://www.nccgroup.trust/us/about- us/newsroom-and-events/b...](https://www.nccgroup.trust/us/about-us/newsroom- and-events/blog/2011/august/javascript-cryptography-considered-harmful/)

<comment><USER18> I haven't seen _this_ particular article, but having read it, I can tell you: there are different threat models. You can't be secure against them all on the Web. Of _course_ we have to trust the server to deliver the initial code. The same is true with apps delivered via the appstore etc. But that doesn't mean you should be send and storing password hashes to the server, even if generated by PHP. It doesn't mean you should be using the session cookie alone as a bearer token to access a session.

First of all, you have to agree that a security requirement in _addition_ to a cookie doesn't make things _less_ secure.

Secondly, with Web Crypto the Web has a way to mark keys "non exportable". If the website is sending you the wrong resources then of course anything can be sent, and web-based code isn't the ultimate way to protect the user. The same is true of other approaches. However _if_ the initial code download wasn't tampered with, then you are far more protected. Because the secret private key won't be exported from the browser website. And it won't be accessible to anyone outside the JS environment that asks for your password or finger to derive a key to decrypt the master key from the local database. And in that JS environment, you can make sure (via closures) that no one gets access to it in "userland".

OH AND YOU SHOULD ALSO BE USING A PRIVATE KEY PER USER TO ENCRYPT DATA AT REST ON YOUR DATABASE, AND STORE THIS KEY IN THE DB MULTIPLE TIMES - EACH ONE ENCRYPTED BY THE USER'S DEVICE KEY. You don't store these device keys. Successfully authentication requests from the device send this key. So once again you need to obtain this key in order to unlock user's info needed for the request. And users can send permissions to unlock their information to each other in sidechannels. You can take this security VERY far...

So it's strictly more secure than the server side database for passwords, even hashed and salted with key strengthening. BUT, don't advertise it because then it introduces security attacks where people over-rely on this to te detriment of the vectors mentioned in the article.

PS: Oh. This was written in 2011, before the Web Crypto standard _I am referring to_ was published and adopted by all web browsers. I do NOT recommend doing the crypto methods in JS! And yes it has a secure RNG now.

[https://developer.mozilla.org/en- US/docs/Web/API/Web_Crypto_...](https://developer.mozilla.org/en- US/docs/Web/API/Web_Crypto_API)

Also _Object.freeze()_ is a thing now.

<comment><AUTHOR> > But that doesn't mean you should be send and storing password hashes to the > server, even if generated by PHP.

There is prior work in this genre. Something like SPAKE2-EE might be worth looking into here. [https://github.com/jedisct1/spake2-ee](https://github.com/jedisct1/spake2-ee)

> It doesn't mean you should be using the session cookie alone as a bearer > token to access a session.

Well, maybe.

A random ID that just tells PHP where to look for the session data, with all the data persisted server-side, is secure as long as it's transferred over HTTPS. Most frameworks/libraries abstract the implementation details away, but generally:

      <?php
      use ParagonIE\ConstantTime\Base32;
      $random = Base32::encode(random_bytes(32));

This value will be unpredictable and doesn't require an HMAC to ensure this property. The only time the HMAC adds value is if you're using the user's computer as a data mule for the entirety of session state rather than "look up this identifier in a database".

In those use-cases, you enter the usual JWT abuse territory, as outlined here: [http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt- fo...](http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions- part-2-why-your-solution-doesnt-work/)

In this genre, we're working on PAST (although this is probably going to be renamed before it's finalized) to solve the cryptography flaws baked into the JWT standards (collectively, JOSE): [https://github.com/paragonie/past](https://github.com/paragonie/past)

That doesn't solve the "replay attack" issue (which may be what you were referring to with bearer tokens).

> OH AND YOU SHOULD ALSO BE USING A PRIVATE KEY PER USER TO ENCRYPT DATA AT > REST ON YOUR DATABASE, AND STORE THIS KEY IN THE DB MULTIPLE TIMES - <USER2> > ONE ENCRYPTED BY THE USER'S DEVICE KEY.

I'm not entirely sure what you're getting at here. If I needed to share a key across devices, I'd either use Diffie-Hellman or Shamir Secret Sharing to accomplish the task (depending on use-case and threat model).

Perhaps there's a lot of implementation detail that's not being discussed here that I'm missing and what you're saying is a conservative local maximum, but it stuck out a tad bit.

<comment><USER18> Perhaps. What I mean is, the session id as a bearer token for example can still be insecure even if sent via https. For example, if PHP scripts use $_REQUEST and session_start() uses the id sent in $_GET from GPC. So you can have session fixation attacks. However, if you additionally require devices to sign all requests with their private key (stored in IndexedDB for the domain and not exportable) then Web Crypto can help mitigate many classes of attacks, including session fixation and CSRF. (It can even increase security over http without https, even though it's an academic point.)

Today we wrote up an article about this, actually, referencing your guide:

[https://qbix.com/blog](https://qbix.com/blog)

It goes into more detail about all this.

<comment><AUTHOR> > Today we wrote up an article about this, actually, referencing your guide:

Neat. I'll have to give that a read in the morning.

Although, it looks like one of your links in the opening paragraph under the "Web Security in 2018" header is broken, and presumably that was the one meant to link to our guide.

<comment><USER18> We fixed it :) Lmk what you think.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> I disagree with their suggestion to comment out or remove old PHP code. People need to have a date and timestamp at their top of the articles AND state what version of PHP they are coding for.

Information on older version should not be pruned as there are legitimate reasons to keep them. Not everyone is using PHP 7; what do you do when you inherit an older code base; what do you do when you just need to modify a few things on an older code base; what if you are trying to learn security based programming; what if you are trying to learn how to break into systems (to then learn how to protect them); what if PHP7 is not available or feasible for your project; etc.

</comment><comment><USER20> Hi Scott, thanks for all the great efforts. This is a good start, and baseline but security is so much harder once you get past these basics. Once you get into the realm of timing attacks and all the ways to fuck up password recovery for example, it becomes a mine field.

What can we do about that, short of "use framework X or Y" as they are the only ones peer reviewed?

</comment><comment><USER21> I've been a PHP developer for over ten years. Paragon Initiative is amazing. Their Github repos are full of useful things: [https://github.com/paragonie](https://github.com/paragonie)

</comment><comment><USER22> It will never be secure unless you do it at the system / language level.

<comment><AUTHOR> And we've been working on that.

* [https://wiki.php.net/rfc/libsodium](https://wiki.php.net/rfc/libsodium) (PHP 7.2)

* [https://wiki.php.net/rfc/mcrypt-viking-funeral](https://wiki.php.net/rfc/mcrypt-viking-funeral) (PHP 7.1)

* [https://wiki.php.net/rfc/random-function-exceptions](https://wiki.php.net/rfc/random-function-exceptions) (PHP 7.0, largely the result of a mailing list discussion critiquing the original implementation of the new CSPRNG functions)

There is plenty more we want to work on in the coming months.

<comment><USER23> How about Noise?

[http://noiseprotocol.org/](http://noiseprotocol.org/)

<comment><AUTHOR> That's more of a "open source library" goal of mine: [https://github.com/paragonie-scott/public- projects/issues/6](https://github.com/paragonie-scott/public- projects/issues/6)

</comment></comment></comment></comment><comment><USER24> Golang community, please take the history of the PHP community as a series of models for 1) what to do and 2) what not to do! Also do this for Java, Ruby, Javascript, LISP, C++, and Smalltalk!

And if you think the history of PHP isn't applicable, then go and find the Golang library authors who are advocating _filtering_ as a defense against SQL injection!

</comment><comment><USER25> What's needed here is a "naming and shaming" effort. Make a public directory of bad PHP tutorials/references/etc., with the names of the people and companies who wrote and host them prominently attached. Maybe even give them a score, based on how frequently cited/linked to their bad advice has become, or how many pieces of it they've proffered. Then only take them off the list when the documents are cleaned up or removed.

If you're a professional PHP developer or a company that builds on PHP, it would be very embarrassing to find yourself prominently featured on such a list. Which would create an incentive for those people to clean up their work so they can get off it.

As things stand currently, publishing outdated and dangerous information costs the publisher nothing, so they see no reason to stop doing it. Create a cost by attaching reputational damage to the act, and you create a reason for them to stop.

<comment><USER26> If that list become popular search engines will use it as a validation that the linked articles are good, so the bad tutorials will get better SEO and even more newcomers will find and use them. The list can even be an incentive to write bad articles since you get free references from this site, which give scamy authors more visitors and more income from ads

<comment><USER27> Actually I think there are SEO ways to link but also to tell search engines that you're not endorsing the link, probably called no refer or something.</comment></comment></comment>


Aldi moves into Walmart's backyard - <AUTHOR> https://www.cnn.com/2019/06/08/business/aldi-walmart-bentonville/index.html <comment><USER2> "Aldi's "prices are usually better" than Walmart"

I find the local Aldi's prices to be generally and significantly higher than Walmart and Kroger, though if I travel to the capital city, Aldi is significantly cheaper than the local Aldi.

I'm not sure if it is the local Aldi, or Aldi company exploiting smaller markets.</comment>