Show HN: Watermark.js – Functional ES6 lib for watermarking in the browser - <AUTHOR> http://brianium.github.io/watermarkjs/

<comment><USER2> I thought the point of watermarking is to prevent people from using your images without your branding, but if it's done on the client side, it's easy to circumvent:

[http://brianium.github.io/watermarkjs/img/shepherd.jpg](http://brianium.github.io/watermarkjs/img/shepherd.jpg)

<comment><AUTHOR> You are correct. This would serve the purpose for many users who don't know how to go digging around for urls in JS, but more importantly its a tool for generating them on the client so a server doesn't have to - say for a CMS?

<comment><USER3> That's all fine until Googlebot-Image comes along, collects up all your unwatermarked images, and displays them in search results for the world to use.

I can see this being useful for running as a batch process in Node/IO.js and uploading to, say, S3.

<comment><AUTHOR> Well what if you batch it in the browser? It is quite possible to use file inputs to generate watermarked images without ever storing the image you are watermarking, and then upload the result.

<comment><USER3> Yep - that's totally possible. Actually, now you phrase it like that, I see what you mean about using it that way for a CMS, and it's an awesome idea.

<comment><USER4> You could also use the canvas element to display the image & watermark as a flat layer.

<comment><USER5> Still, the image would somehow have to be loaded in the browsers, at which point it's easy to circumvent.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Not only can this be circumvented with extreme ease[1], but it also:

(a) Make the website quite heavier. Especially for mobile devices, old computers, etc. (b) Stops breaking with noscript. (c) Search engines won't find your watermarked photos. In order to get credit for your stuff, people need to find it to re-use it first.

[1]: [https://news.ycombinator.com/item?id=9545044](https://news.ycombinator.com/item?id=9545044)

<comment><AUTHOR> I am seeing the same arguments made :) - Watermarking an on-page element does allow the original image to be access quite easily.

However, I will reiterate it is pretty useful to watermark from a user upload. You can watermark an image from the user's local machine - upload it, then display it. All from the client. I don't believe there is any easy in circumventing this method - if there is I would love to see it :)

</comment></comment><comment><USER7> Watermarking in the browser seems counter productive though.

<comment><AUTHOR> How so? Being able to generate watermarks in the browser is one less thing a server has to do right? Especially if that server is in a shared environment without image libraries or lacks tools for uploading things concurrently.

<comment><USER8> It defeats the point of watermarking since someone with the technical skills can just recover the non-watermarked image.

<comment><AUTHOR> Watermarking by urls or existing images would leave the non-watermarked image open - you are correct. This case is still fine for most users, but watermark.js also allows the use of file inputs. You can grab an image from a file input, then watermark, then upload it. This would leave the non- watermarked image closed off to anyone else. This would be handy if you need to generate watermarks in a CMS backend or some other administrative tool

</comment></comment></comment></comment><comment><USER9> The only real use case for this is as a watermarking tool that the end user uses to place his own watermark on his own images and as has been mentioned could provide a pre-composited file generated on the client to the server for later public consumption.

Of course, this doesn't prevent the user uploading an image that they don't have the rights to and watermarking it as if it was their own... that's a whole other subject.

But it's a good demonstration of the capabilities available in modern browsers :)

</comment><comment><USER10> Would be more useful on the server. I don't know how it is impplemented, I guess it uses canvas, fortunately there a few serverside canvas implementations available.

<comment><USER11> Uses canvas as per the documentation:

"Converts all resources into an Image object by applying the function draw. The draw function receives all resources as canvases..."

I went down the same thought process as you.. Would be useful on the server, coupled with node-canvas.

Wonder whether it would be faster / more scalable than calling out to ImageMagick to add gradients or text to an Image..

<comment><AUTHOR> I think this library could defer altering the window object until it is certain it is in a browser context. The original design goal was for a browser, but the issue has already come up on leveraging node-canvas to make it useful on the server as well:

[https://github.com/brianium/watermarkjs/issues/11](https://github.com/brianium/watermarkjs/issues/11)

</comment></comment></comment><comment><USER12> Very cool. I'm loving the ES6 source code.

</comment><comment><USER13> I like the idea as obfuscation, and it's at least a very simple implementation.

Good-looking batch watermarking is such a pain today.</comment>


Automated config tool for Apache2, NGINX etc. - <AUTHOR> Hello community.
As we all know spending time configuring apache2 for our favorite framework can be time consuming and tedious.
We are currently developing a basic web based configurator to speed up the set up of apache2 with mod_wsgi to serve python apps, apache2 with passenger for ruby on rails, and apache2 with mod_php for your favorite php framework.   Our configurator will also enable you to add SSL, or even make your dev environment SSL only.
I'd love any feedback on UI/X, tech, design, anything. We're actively developing the product and adding platforms, distributions, features etc. I'd be interested in hearing your problems and how Qonfigure could solve them. If you'd like to try Qonfigure, I'm happy to set up a trial.  Email me at firstname.lastname@example.com <comment><USER2> You might want to modify the title of this post. I saw you mention configuring NGINX and got very interested - but if it's Apache only I don't care nearly as much...

Having said that - will the configurator also handle optimisation of the Apache setup for your particular server? That'd be a great feature to save tedious manual optimisation.

</comment><comment><USER3> This exists already. [https://github.com/c0deTalk/flask- deploy](https://github.com/c0deTalk/flask-deploy)

<comment><AUTHOR> but that is for flask. Our service is for Apache2

<comment><USER3> Nope, it automates nginx too!

</comment></comment></comment><comment><USER4> What your pointing to is a flask deployment not apache2 + mod_wsgi which people use to serve python app on apache2. Two different things.

</comment><comment><AUTHOR> BTW - site is www.qonfigure.com

<comment><USER5> Your post shows up in [https://news.ycombinator.com/ask](https://news.ycombinator.com/ask) that's why some commenters understand the headline as question and try to point to other existing tools.

Try a [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html) style post.</comment></comment>


Nokia sells essential GSM patents to patent troll - <AUTHOR> http://www.intomobile.com/2012/01/16/nokia-sells-over-450-patents-some-them-deemed-essential-gsm-patent-troll/

<comment><USER2> Not really a patent troll. From The Register: <http://www.theregister.co.uk/2012/01/16/nokia_patents/>

"Sisvel is actually concerned with the creation of patent pools, dealing with fields where the myriad of patent-holders makes getting individual licences next to impossible. In such fields some sort of aggregator is not only necessary, but desirable."

<comment><USER3> That makes it sound like patents are a real hinderance to getting things done.

<comment><USER4> In other news, drywall isn't particularly nutritious, water is wet and ferrets engage in comical antics.

<comment><USER5> _ferrets engage in comical antics_ [Citation Needed]

</comment></comment></comment></comment><comment><USER6> Probably the main potential of the deal is not within the essential patents, as these have to be licensed under FRAND, limiting both the possible revenue and their tactical effect in court.

The question is however, which other, non-essential, patens have been sold by Nokia now, and of course why.

<comment><USER7> My guess would be to fund a reboot, and come up with a plan B that does not require Microsoft, just in case they pull another Sendo-type thing: <http://en.wikipedia.org/wiki/Sendo>

</comment></comment><comment><USER8> This is the very real danger with companies like Nokia failing. Although I'd love to see Nokia return to success, I would rather see them get bought out than have to sell of their valuable patent assets to troll companies.

It's the same reason that, despite all that's happened, I'm still OK with Palm being sold to HP.</comment>


Audiophiles can't tell the difference between a $200 receiver and a $12,000 one - <AUTHOR> http://www.hometheaterfocus.com/receivers/amplifier-sound-quality.aspx <comment><USER3> I worked at a high end audio shop for a few years. I saw everything from $80,000 audio /cables/ to $150,000 turntables. There is a lot of snake oil, but articles like this upset me for two reasons. Firstly, the lumping of "audiophiles". Most of the people who refer to themselves as such are nut balls (in my experience). There were a few that were great and heard amazing ears, but most of the time - nut balls. Guys that spent more time listening to tone recordings and day dreaming about their own perfect setup then they did actually listening to music. Secondly, there /is/ a difference in wire/speaker box/electrical source/whatever - but it doesn't mean that the more expensive one is better. It is about synergy. Quick example: I had a pair of small rega speakers with a set of $5,000 nordost speaker cables. Sounded awful - <USER2> than a car radio. I swapped it out for the set of the generic cables that came with it - blew away half the speakers in the shop that were two to ten times the price. There were also times when the /best/ sound really was a tube amp with separate power drop, acoustical treated wall, and the whole shebang. Every little change you make makes a difference, every solder joint counts. Do yourself a favor if you are at all interested in this, and stop by your local big city hi-fi shop (not best buy, magnolia or any other chain, something that has upwards of $10k speakers in stock preferably) and try out the different sets. You will be swayed.

</comment><comment><USER4> Not conclusive, but very suggestive. The fact that only 50% could tell the difference between high and and low end does not mean there is no difference. Example: in one experiment, only 49% could tell the difference between red and blue. Does that mean there is no difference? Not necessarily. Almost all of the participants could be red-blue colorblind.

I'd like to know how many of the participants could consistently distinguish between cheap/expensive in a large test of pairs--if any.

Either way, one can draw the confusion that most audiophiles are full of shit. I find the same ratio in most other professions.

</comment><comment><USER5> Engadget did a test of headphones (earbud) and it seemed to indicate for those, more expensive (at least for those they tested) did better:

[http://www.engadget.com/2011/08/09/big-box-earbuds-put- to-a-...](http://www.engadget.com/2011/08/09/big-box-earbuds-put-to-a-blind- taste-test-in-the-engadget-labs/)

<comment><USER6> Their methodology doesn't seem very rigorous. It's impossible to do a true double-blind test of earbud sound in isolation because they feel different in the ear and that's likely to affect sound perception.

<comment><USER7> That's not a problem, since to actually use the things you have to put them in your ears. Hence, if the feel of them affects sound perception, you want to include that.

<comment><USER6> Yeah, but everyone's ears are different. You'd have to characterize ear variations that are relevant to earbud sound and put people in different buckets to get consistent results, and then to interpret the results for a specific person you'd have to find out which bucket they're in.

</comment></comment></comment></comment><comment><USER8> Money and results are not linearly correlated.

This sort of thing gets posted occasionally. It's a coin toss whether they're trolling for hits or just don't get that you can't buy $12000 worth of amplifier and have it be 60x as amplifiery as a $200 amplifier. Electronics doesn't work that way.

</comment><comment><USER9> It's all about diminishing returns. Once you're spending more than a few hundred bucks per component you have to concentrate to tell any difference at all.

I'd say $12,000 spent on a whole SYSTEM would outside the bounds of reason - spend at most $5k on a system and then use the rest of the money on MUSIC to play on said system :)

</comment><comment><USER10> They also can't tell the difference between flac and V0.</comment>


Dotcom: "We've hit the jackpot" - <AUTHOR> http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10849627 <comment><USER2> This is wrong on so many levels:

* Why is the DHS tracking down copyright infringers?!

* The FBI shuts down a site with hundred of thousands of user because of 36(!) infringing files

* These files were ordered by the DHS not to be deleted

* (From other articles) megaupload's users still do not have access to _their_ data

* (From other articles) the ISP running megaupload's servers is not allowed to shut them down (or repurpose them) and has to foot the bill.

There's probably some other stuff going on that we do not know about, but this looks like a big clusterf*ck.

<comment><USER3> > Why is the DHS tracking down copyright infringers

When DHS was established, a bunch of existing government agencies were rolled into it. One of them was Immigration and Customs Enforcement (ICE), which is the federal agency with the most staff handling international IP law enforcement (traditionally, mostly counterfeiting). Copyright also falls under that category, so now DHS ends up being the one that investigates copyright infringement at the federal level.

<comment><USER4> I'd guess the GP's point was why are the DHS getting involved in what is primarily a civil action (tort) between a rights holder and an alleged infringer.

</comment></comment></comment><comment><USER5> > When the FBI applied to seize the Megaupload site in 2012, it said the > company had failed to delete pirated content and cited the earlier search > warrant against the continued existence of 36 of the same 39 files.

1\. It's been 3 years, I'm sure the warrant in reference did not impel MU to keep those files after the case against NinjaVideo was done and over with. This probably goes all the way back to "how" MU stored files... 1 copy for 1000s of uploads (as long as the hash/finger-print matches). And each of those videos was uploaded over and over, and MU kept them around / did not block transfers. And are now trying to make it seem like they had no choice but to keep sharing those videos FOREVER, letting everyone and anyone upload them, and letting everyone and anyone download them. I'm sure MU/KimDotCom has the original order to preserve the evidence in the NinjaVideo case, why not share it with us and let the media see the details of what was asked of them?

2\. Are those the ONLY files referenced in the indictment against MU? Probably not... All the FBI has to do is prove at least one of the files listed in the warrant is valid and was brought in good faith, and then show the judge/jury the other 97% of MU traffic revolved around sharing pirated content.

That article and KimDotCom's story seems to leave a lot out.

<comment><AUTHOR> I'm curious about all of this too. I submitted the article because I want to see what others think about the new information. The 1 copy for 1000s of uploads may have some interesting implications.

<comment><USER6> My guess is that they could succsefully argue that the 1 for 1000s is simply a technical optimization.

</comment></comment></comment><comment><USER7> I've seen many people bring up the fact that MegaUpload had the same file for multiple links and that they only took down links reported as infringing. Many people seem to come to the conclusion that this is automatically somehow representative of bad behavior, but I strongly disagree. Just because something is covered by copyright and is on MegaUpload, does not automatically make it infringing, even if some of the links to it might be.

Consider that someone legally backs up his own files to MU and never shares links to them with anyone. Then someone else uploads the same content in an infringing manner. Should the first guy with his completely legal backups have his stuff deleted just because someone else did something infringing with the same files? He most certainly should not. Assuming that all links of the same file that was uploaded are automatically infringing is basically "guilty until proven innocent", and is very much not the way they should be treated. Hell, I have music and other copyrighted content perfectly legally backed up in the cloud myself, and I sure as hell wouldn't want to see it deleted just because someone else might have used the same service for infringing sharing of the same files. (and what cloud provider _wouldn't_ want to optimize their service to only have one copy of each file in their back-end instead of wasting space with duplicates?)

And, of course, this is very different to something like child porn, which is _always_ illegal under US laws (where the stuff was hosted in case of MU). There can be no "non-infringing" use there, so it makes sense to delete all and every link to it. Not so much with just copyrighted content. And as we also know, deducing whether something is infringing or not isn't very clear cut either, like with Viacom issuing takedowns for Youtube videos its own employees had legitimately uploaded for marketing purposes.[1]

[1] [http://techcrunch.com/2010/03/18/youtube-viacom-secretly- upl...](http://techcrunch.com/2010/03/18/youtube-viacom-secretly-uploading- content/)

 _Viacom's efforts to disguise its promotional use of YouTube worked so well that even its own employees could not keep track of everything it was posting or leaving up on the site. As a result, on countless occasions Viacom demanded the removal of clips that it had uploaded to YouTube, only to return later to sheepishly ask for their reinstatement. In fact, some of the very clips that Viacom is suing us over were actually uploaded by Viacom itself._

<comment><USER8> > Consider that someone legally backs up his own files to MU and never shares > links to them with anyone. Then someone else uploads the same content in an > infringing manner. Should the first guy with his completely legal backups > have his stuff deleted just because someone else did something infringing > with the same files?

How likely is that though? I have no idea what hashing they used to compare files. But if I rip a CD track to MP3 and you rip a CD track to MP3 are we going to get files that have matching hashes? (Even if we use the same settings, and the same meta information.)

<comment><USER9> Devil's advocate: what if we've bought our MP3s from the same place?

<comment><USER8> That's an important point that I forgot about.

</comment></comment></comment></comment><comment><USER10> The FBI does whatever it wants. The US government bends the law how it wants. I'm sure they will fabricate some sort of evidence to ensure this set back is not a set back.

</comment><comment><USER11> Yeah? Well the FBI owns the casino. Good luck with that.

</comment><comment><USER12> It seems that the US government is illegally using the infringed copy of justice. I strongly believe that such organisation must delete itself and its illegal copies from the wetware of all abused customers.

</comment><comment><USER13> If this is all the FBI had as part of it's indictment, I wish Dotcom luck in getting damages...

</comment><comment><USER14> We are all Kim Dotcom now.

<comment><USER15> ..because he ate us.

I don't trust this guy and I never will. That is not the first time he becomes Super Kimble before he rips everybody off.

<comment><USER16> and the alternative is FBI/US, are you sure you want to trust them?

personally I don't cate if the guy gets rich, if he makes life unpleasant to FBI/US

<comment><USER15> As I said and history has shown, he will make money AND sell everybody out to FBI/US.</comment></comment></comment></comment>


Ask HN: do you think I should do this? - <AUTHOR> http://tzury.posterous.com/distributed-social-graph-and-content-0

<comment><USER2> Only if you know people at those other companies who would be willing to buy what you're trying to do. It's a good idea, engineering-wise, but there may not be a market for it.</comment>


TiDB 2.1 GA: Battle-Tested to Handle an Unpredictable World - <AUTHOR> https://pingcap.com/blog/tidb-2.1-ga-Battle-tested-to-handle-an-unpredictable-world/ <comment><USER2> This post inpsired a lot of great discussion about the Spanner family of distributed databases. Someone asked about TiDB there, but there was no follow up. Can someone answer that question?

[http://dbmsmusings.blogspot.com/2018/09/newsql-database- syst...](http://dbmsmusings.blogspot.com/2018/09/newsql-database-systems-are- failing-to.html)

<comment><USER3> I'll pass this onto the engineering team. Thanks!

For a quick answer, I believe Daniel Abadi's followup comment addresses it:

> This post did not discuss a central oracle. It discusses the difference > between partitioned vs global consensus.

In TiDB the pd leader is a central oracle.

</comment></comment><comment><USER4> Anyone here who is running TiDB in production that can speak to upsides and downsides? I find I only trust a database after a couple years of real usage, so it would be great to hear from someone who is currently using it.

Thanks!

<comment><USER3> To your point: I agree that it pays to be conservative with new filesystems and databases alike.

However, I want to mention mitigating circumstances which have helped TiDB stabilize:

\- We use RocksDB as the underlying storage library, which was developed by Facebook, and has been battle-tested by many others.

\- The architecture itself has been inspired (and proven) by Google Spanner

\- Correctness has been proven with TLA+ [https://github.com/pingcap/tla- plus](https://github.com/pingcap/tla-plus)

\- We have 300+ customers storing 15 PiB+

<comment><USER5> You can find some case studies here: [https://www.pingcap.com/success- stories/](https://www.pingcap.com/success-stories/)

Specifically full case studies: [https://www.pingcap.com/success-stories/tidb- in-iqiyi/](https://www.pingcap.com/success-stories/tidb-in-iqiyi/) [https://www.pingcap.com/success-stories/tidb-in- zhuanzhuan/](https://www.pingcap.com/success-stories/tidb-in-zhuanzhuan/) [https://www.pingcap.com/success-stories/tidb-in- eleme/](https://www.pingcap.com/success-stories/tidb-in-eleme/) [https://www.pingcap.com/success-stories/tidb-in- mobike/](https://www.pingcap.com/success-stories/tidb-in-mobike/) [https://www.pingcap.com/success-stories/tidb-in- yuanfudao/](https://www.pingcap.com/success-stories/tidb-in-yuanfudao/)

</comment></comment></comment><comment><USER6> Hey can someone from TiDB help me understand the benchmark results you posted comparing 2.0 with 2.1?

[https://github.com/pingcap/docs/blob/master/benchmark/sysben...](https://github.com/pingcap/docs/blob/master/benchmark/sysbench-v3.md)

The main question is this: how large is the dataset created in Sysbench? 16 tables with 10,000,000 pieces of data per table is interesting, but how big are those individual pieces? Morgan said "the expected data volume for TiDB is larger than memory," so does this benchmark actually test the underlying storage, or is it all in-memory?

Thanks for any help! Would like to try replicating this if possible in our lab.

<comment><USER3> Hi Rafuino, send me an email at [firstname]@pingcap.com and I'll connect you with the benchmark author.

Just to expand a little bit on this comment:

> The expected data volume for TiDB is larger than memory.

There is both total data volume, and working set (workload dependent). This point was in regards to some databases use data structures which require the total data to be memory resident.

The working set is a longer discussion - it could just be a few percent of the total volume, and some working sets have a "long tail" of cache misses vs. short tail. And it can vary for a B+tree vs. an LSM tree too. RocksDB uses compression which helps a lot.

It is not clear in this benchmark if the working set fits entirely in memory. Thanks for bringing it to my attention - I will follow up and make sure we do a better job of communicating what is being tested.

</comment></comment><comment><USER3> Morgan from the TiDB team here. Happy to answer any questions you have.

<comment><USER7> On [https://www.pingcap.com/docs/sql/mysql- compatibility/](https://www.pingcap.com/docs/sql/mysql-compatibility/) it mentions "FOREIGN KEY constraints" under unsupported features. Is that right? Isn't that a rather big problem for an OLTP DB? Or am I missing something?

<comment><USER8> Greg from the TiDB team here. I do share your sentiment, and at the moment you can probably best track or progress on this issue here: [https://github.com/pingcap/tidb/issues/8484](https://github.com/pingcap/tidb/issues/8484)

The explanation is just that TiDB is being developed with tight feedback from our customers that have many TB of data. The feedback from that scale of users is overwhelmingly that they do not want to take the performance hit of foreign keys. It is worth mentioning though that you can declare foreign keys and that on master we do properly check DDL statements (but there is no DML enforcement).

I am trying to figure out a design that will satisfy users with large and small data alike and even let users use foreign keys for documentation purposes when they are not enforced for performance reasons. It would be great to have more community input on this.</comment></comment></comment>


How Tetris Helped Game Boy Take Over the World - <AUTHOR> http://gizmodo.com/i-constantly-had-the-top-score-for-gameboy-tetris-in-th-1587201550

<comment><USER2> The Guardian had a feature on this a couple of days ago: [http://www.theguardian.com/culture/2014/jun/02/how-we- made-t...](http://www.theguardian.com/culture/2014/jun/02/how-we-made-tetris)

</comment><comment><USER3> Title is misleading but still pretty cool. It points to Steve Wozniak's comment about constantly being good at Tetris.

<comment><AUTHOR> I tried to link to the comment but that doesn't make the page scroll down, the link still goes to the top of the story.</comment></comment>


Ask HN: Pay for first few clients or hire a salesperson? Need freelance advice - <AUTHOR> I am working for a large corp as an analytics manager. I would like to do freelance work on the side and hopefully turn it into a full time gig.
I would like to know whether it's worthwhile to hire a salesperson to find my first few clients, or to instead do jobs for free (or at a discount) and build a portfolio to attract attention. Finding access to subcontractors to fill the demand won't be a problem.
My business will be focused on analytics and data visualization, ETL, etc. <comment><USER2> Can you describe more what you are asking?

It sounds like you have supply (subcontractors) but not enough demand (clients). Is that what you are asking?

<comment><AUTHOR> Basically. I haven't started the business yet. I am trying to figure out how to get my first few clients.</comment></comment>


Show HN: GoGITiT - GitHub Usage Statistics of JS Frameworks - <AUTHOR> http://gogitit.co <comment><USER2> So glad to finally have some data for the age-old debate over whether a JS framework is hot or past it's peak! I'll be curious to see how the team extends this, as it seems like there's so many new directions you can take this data over time.

</comment><comment><USER3> Nice. Good to see this data.</comment>


Show HN: Moonshot – a podcast exploring the biggest ideas in tech - <AUTHOR> http://moonshot.audio/ <comment><AUTHOR> Hi everyone,

I just wanted to show you all the podcast I've been working on.

It's called Moonshot - and explores the biggest ideas in tech and the people working to make them a reality.

Our first episode covered 'The Race to Mars' and our second episode dives into Artificial General Intelligence. We're really trying distill some of these really complex ideas and make them accessible for people who don't know that much about tech - but still interesting for those who do. It's similar to something like Reply All or Start-up - but much shorter. We're aiming for around 15-25minutes per episode.

In the first couple of episodes we've got some great interviews - <USER2> Black AI, Kara Swisher, Kevin Rose, even someone that was in a Mars simulation. We've also done interviews with other founders including Michael Pryor (Trello) and Moon Ribas (Cyborg Foundation) which will be coming up in future episodes. (I'm actually thinking of breaking these interviews out into bonus episodes as they're super interesting.)

It's still a work in progress and we're working on refining the format - <USER3> just wanted to share it with you and get your feedback. Also keen to get any recommendations you may have for guests or topics we should cover.

Many thanks, Kris</comment>


Lion's Mission Control: UX fail, especially for multiple displays - <AUTHOR> https://plus.google.com/u/0/106647697420529217400/posts/jKeN5UiKiJG

<comment><USER2> Ever since I switched from Ubuntu to OSX I've been missing how simple and useable Virtual Desktops are.

I used them all the time in Ubuntu, and I had a keyboard shortcut to move the currently active window to any adjacent virtual desktop (with loop around).

This was great when a context switch happened in a virtual desktop dedicated to project A. I would just realize I need to do this on a separate desktop, and use my shortcuts to fling to an empty one.

On OSX this involves clicking, dragging and aiming at the correct space, which completely stopped me from using spaces at all. I tried dedicated spaces for certain applications, but found that to be annoying when I want to run one of those apps in the context of my current space.

I was kinda hoping Lion would improve on this, but sadly it seems they went the opposite direction.

<comment><USER3> "Mission control, abort! abort!"

Well that's how I feel :)

Seriously, I too came from linux (ubuntu even) to osx having last owned a mac when it had a whopping 128k memory.

I heard someone say on a podcast recently that when Apple Computer became Apple (jan-07), that's when they started leaving power users behind.

Anyhow, my Lion/MC/Spaces gripes are along these lines:

1\. 1-D vs 2-D grids. This is terrible for me personally.

2\. Animations. If I'm typing ctrl->right/left, it means I'd like to get there more quickly than my mouse allows. The (for me) nauseating animation is just painfully slow and sickening (literally).

3\. I've read many people say, 'use ctrl-<desktop#>'. Well yea that's somewhat better and has a snappier animation (like ctrl-<arrow key> had with SL spaces) but I personally find this awkward. First, if I am going to go the trouble of that, I want to get to that desktop immediately so any animation seems silly. Second, it's still 1-D thinking. Having been able to ctrl-<arrow key> to my 3x3 grid in SL was a basic with my workflow.

Now I'm sure my mother will love Mission Control, and not tire of the eye candy animations, but for people working all day with them.... ugh!

I just don't understand why Apple can't bring it's stunning "Here's how to use a trackpad" gif-like spiffy animations to the System Preferences more broadly, and add more customization to the UI in general (like turn of animations!).

I know we're the 20% and not the 80% but it does suck, making me seriously consider going back to *nix now that I'm digging deeper into vim.

<comment><USER4> _I heard someone say on a podcast recently that when Apple Computer became Apple (jan-07), that's when they started leaving power users behind._

Basically they stopped being a computer company and became a consumer media company.

</comment></comment></comment><comment><USER5> Well, as far as multiple displays is concerned MacOS UX has been broken since day one. It is absolute lunacy to have the menu bar for an application pinned to the first display while the application opens in a second or third display.

Our Macs have two or three 24 inch monitors, which makes you realize just how dumb the whole thing is. If you are working on an application on the left monitor and need to access a menu item you have to mouse all the way over to the middle monitor and then back. Do this 200 times a day and you very quickly realize just how stupid the whole thing is.

Furthermore, the menu bar might not necessarily contain menu items for the application you are looking at because you happen to have clicked on the desktop or another application.

Yes, of course, you can mentally manage the concept. That does not mean that it is a good idea.

Linux, Irix, Solaris, Windows and other OS GUIs have gotten this right from the very start. The application is a self contained window and every instance travels with its own controls. No need to mouse across 72 inches of monitors to get to a menu.

<comment><USER6> [http://web.archive.org/web/20080530025541/http://pixelcentri...](http://web.archive.org/web/20080530025541/http://pixelcentric.net/x-shame/docs.html)

The menu bar is part of a hierarchy of application > window, rather than window = application instance. Because of this, the self-contained application window is a bitch to deal with when using different windows across different applications. I have to use Dreamweaver due a bunch of pre-written macros. I can't ever, ever, ever take a tab out of Dreamweaver and pair it with a specific preview firefox window (at least under Windows).

That's not to say that the Mac's window model is without fault. But, it is much easier to patch to one's liking: <http://manytricks.com/witch/>

<comment><USER5> Multiple monitors. Why try to cram it all into one? It makes no sense. It is not uncommon for me to have ten applications open and actively in use. In some cases (say, Excel) multiple files open. On our engineering workstations we have a minimum of three 24 inch monitors. Going back and forth between applications, dragging and dropping data and selecting which application instance you need to work with is fluid and fast. Your Dreamweaver and Firefox example has a trivial solution once you add a second screen.

</comment></comment></comment><comment><USER7> This article is basically the statment, "I dislike change."

Truth be told, Spaces and multiple monitors (and in general, Applications w.r.t. spaces) has been terribly broken to the point of near-unusability for quite some time now. Apple's taken an easy fix for the time being: divorce spaces into N discrete sets where N is the number of displays.

This actually ends up working out for the way I see most people use multiple monitors _with a mac_. Since very few people have mac desktops, usually the multi-monitor situation is one large display and a smaller integrated laptop display. Most people do the bulk of their work on the big display and use the secondary display for tasks like communication and reference.

As far as I can tell, Lion's Mission Control is a radical improvement across the board for the actual usability of Spaces in the Apple model. The prior implementation naively copied the Linux multiple-desktop model before (with it's preference for MDI and application-local menu bars) to disastrous ends. This is the first step I've seen Apple take to actually try actually adapt multiple desktops to the Spaces model and the unified menubar model, and I prefer it greatly so far.

The default of LRU Spaces ordering, on the other hand, makes me scowl. I'm going to _try_ it to see if I feel any better after a day or two of use, but I doubt I will end up happier.

</comment><comment><USER8> I personally think Mission Control is pretty excellent, but then, I am running Lion on an Air without an external display. For that use case, Mission Control and the iOS-style features are both significantly more useful than I had any expectation of them being.

You can replace Mission Control with Expose via the preferences, although I'm not sure if it has inherited any of these changes the linked post complains about or if it is in fact the old Expose.

<comment><AUTHOR> Expose doesn't provide spaces.

<comment><USER8> Indeed, but it is not Mission Control.

<comment><AUTHOR> The problems I outline are with management of windows across spaces and displays; nothing in the post refers to issues with exposé or "finding" windows inside a given space.

<comment><USER8> I just thought it would be useful to point out, in a conversation about Mission Control, that if you don't like it, you can disable it.

<comment><AUTHOR> That's exactly the point -- I _can't_ disable it, because then I'd lose spaces. If it wasn't clear from the initial post, I'm a fairly heavy user of spaces. :)

If I didn't care about spaces, I wouldn't have taken the time to write up a long post detailing how they are broken in MC. Broken spaces are bad, but no spaces are worse.

<comment><USER8> I understand. My main machine has a multimonitor setup with 30'' displays and I have not found anything that can manage the space effectively (pardon the pun) short of xmonad, which I unfortunately can't use for my day job.

I didn't post that comment to you, it was more of a general comment to anyone reading the thread who might think "hey, I hate this thing too, but for different reasons!" Like I said, I expected not to like it at all myself for unrelated reasons to yours.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I never use spaces, it always seemed backwards to switch to a whole new context just because I want to access a single app. What if I want to look back at some code I was writing while I'm IM'ing someone? What if I don't want a whole context switch, and I just want to send a quick message? What if I don't care what space an app is in, obviating the need for all this crazy Mission Control complexity?

All I do it bind my most frequently used app to hot keys (Cmd-F1, Cmd-F2, etc.). When I want to use an app, I pop it open with Cmd-F#. When I want to close it, I hit Cmd-H to hide it.

<comment><USER10> If you mainly work at the granularity of single apps, I could see that. I tend to use groups of apps, so without spaces I waste way too much time re- assembling my working contexts. With spaces I can just swap in a whole context, like "programming": my text editor, a terminal, and a browser open to a relevant doc all pop up as a group, arranged how I want them. And stuff not in the "programming" context disappears instead of cluttering my screen.

If I have to do this app-at-a-time, I need to bring to the foreground Terminal, MacVim, and Chrome, each with a separate hotkey press, then hide everything else. I admit this working pattern may be specific to a Unix style of "IDE" made up from multiple apps used together, though. If you just use XCode or Eclipse or something, it's already bundled into one app so maybe not an issue.

<comment><USER9> I use Terminal, Emacs, Firefox, etc., pretty much the standard setup.

The programming environment is the only bundle of apps that need to be specifically arranged for me. They pretty much always sit positioned where I want them, and I bring up other apps when I want to do other stuff, and hide them when I want to get back to programming. I never really hide my coding apps; I just bring other apps on top and hide them.

It's nice too to always know that Cmd-F1 will bring up Firefox, no matter what is going on.

But this is definitely a user preference thing, and specific to how I like working.

</comment></comment></comment><comment><USER11> An app I developed, Optimal Layout, lets you switch to a window by typing it's name: <http://most-advantageous.com/optimal-layout/>

It doesn't solve all the problems in this post, but if you are trying to find an open window I think it's the fastest way. Expose is chaos if you've got a lot of windows open.

</comment><comment><USER12> With the OS X menuying system that sticks to one monitor, I've always found using multiple monitors awkward on the Mac. I've never had a good solution to this other than learn shortened for every app. But there isn't always a shortcut for what you want. Has any HN fellows ever found a good way to make multiple monitors more usable on the Mac?

<comment><USER13> Secondbar (I'm not sure about Lion compatibility): <http://blog.boastr.net/?page_id=79> It puts another identical menubar on the second screen.

If you prefer a more "vanilla" option, I've found that putting the menubar on the right screen and the blank screen on the left reduces mouse travel (you can move the menu between monitors in Display Preferences). Since menu for an app is filled left to right, menu items are then closer to the center of your workspace.

<comment><USER14> Honestly, this has been my argument against the menubar. It made sense in MacOS 1.0 and similar, but nowadays, it's just an archaic element kept for unknown reasons.

It's one thing that it's incredibly inconvenient in a multiple-monitor setup, it's another that the menubar is context-sensitive. So even if you've got the right app selected, you may have the wrong window, and when you go to print, you get the wrong page. Worse than that is that depending which window is chosen, certain options will also be grayed out.

It's the least innovative feature in MacOS X, and personally, I think it should go. You'd think by now that we'd come up with something better than a crappy dropdown menu.

<comment><USER15> Adding to that: 'modern' apps are doing away with menubars completely. Chrome has a single button for options/settings, Office has the Ribbon, etc. OS X requiring a menubar for apps, even when they don't need one, is a huge barrier to UI innovation.

</comment></comment></comment></comment><comment><USER16> Hm, if you don't use Spaces (like me), Mission Control is, at least in my personal experience, just as competent as the old Exposé. I like that OS X no longer enforces a grid and that it proportionally resizes Windows (instead of making them all the same size).

I think I also like that windows of the same app are grouped together. One possible downside are the resulting overlapping windows, I think, though, it's wroth the tradeoff.

I do not like that single app Exposé still forces apps on a grid and still forces them all to the same size. That said, I rarely use single app Exposé.

The new implementation of Spaces might actually be able to entice me to use them from time to time, so it seems like an improvement for me personally. The problems he is talking about are certainly serious and should be fixed.

<comment><AUTHOR> Mission control is a perfectly comptent exposé. My beef is elsewhere.

<comment><USER17> Not really.

Exposé hasn't been good since Leopard. In Leopard, there were some simple rules.

\- Every window on the screen is fully visible.

\- Windows are sized proportionally.

\- Movement from the original position was as minimal as possible.

Snow Leopard removed the second two by arranging all of the windows in a grid (iTunes is the same size as a tiny Adium window). Lion removes the first one.

<comment><USER15> Well put. Lion doesn't have an "all windows entirely visible" Expose mode, which will change my workflow immensely.

P.S. There's a hack to change Snow Leopard Expose back to Leopard style. First thing to do on any SL install.

</comment></comment></comment></comment><comment><USER18> In snow leopard there used to be an option that forced Exposé's "Application Windows" shortcut to show only the active windows of an application's on the present desktop.

I can't find this option in Lion, and I desperately miss it.

Say I have two workspaces each with four terminal windows (each set of terminals connecting to a specific server) and a third workspace with one terminal window sitting around. Pressing the "Application windows" shortcut now shows me all nine windows, and just to add to the confusion OS X Lion switches away from the present workspace to the workspace most recently used!

In my view it contradicts the very purpose of "Spaces" since a workspace is used to unclutter all the active apps and windows.

</comment><comment><USER19> Spaces in prev OS X was almost terrible, it was just half-baked. I think they brought this feature to Lion with some nice tunes, but not sure they did great on showing multiple spaces on the _top_ of Mission Control.

Plus, Mission control itself doesn't really make user focusing on each window(app). even if we don't care about multiple displays environment, Apple did some good, and some wrong.

And I'm using this BIG cat right now.. :P

</comment><comment><USER20> Shouldn't this be solved by automatic saving apps' settings? In Lion, shouldn't I be supposed to put an application somewhere and it will stay there even after I quit it? I've installed Lion but had no time to play with it, will try this when I get home.

</comment><comment><USER21> Similarly, in Gnome 3:

I can't see any way of having a 2D array of virtual desktops any more, the only option I see is the 1D auto-expanding column of desktops. Anyone ?

</comment><comment><USER22> A UX article without pictures? For those of us without Lion, what does it look like?

<comment><USER23> <http://www.apple.com/macosx/whats-new/mission-control.html>

</comment></comment><comment><USER24> has anybody found a way to navigate windows using arrow keys once I pop into mission control using (ctrl+up)

<comment><USER25> crlt+alt+cmd+left/right moves you between desktops

</comment></comment><comment><USER26> This really speaks of Hacker New's segment. For non-techies it's perfect - yes, multi monitor support is corrupt, but I'm sure it'll come by in couple of months. The important thing is that working with fullscreen apps via mission contra doesn't feel like IQ puzzles.</comment>


Two-Factor Authentication Startup Duo Security Raises $12M from Benchmark - <AUTHOR> http://techcrunch.com/2014/09/22/duo-security-12m-benchmark/

<comment><USER2> We use Duo at work and it is awesome. Bravo.</comment>


IKEA Releases Free Design for Garden Sphere That Feeds Entire Neighborhood - <AUTHOR> https://earthwithoutpoverty.com/2020/04/24/ikea-releases-free-design-for-garden-sphere-that-feeds-entire-neighborhood <comment><USER2> (2017). Blogspam for [https://ikea.today/green-dreams- growroom/](https://ikea.today/green-dreams-growroom/)

I wonder how successful the Growroom has been, 3 years after release.

<comment><USER3> Are they missing all the lighting and irrigation in this plan? I don't see the LEDs or the power supply.

</comment></comment><comment><USER4> GitHub link for the design: [https://github.com/space10-community/the- growroom](https://github.com/space10-community/the-growroom)

</comment><comment><USER5> I think "feeds entire neighborhood" may be a bit of an exaggeration.

<comment><USER6> It's clickbait. They're grossly underestimating the size of a neighborhood, and grossly overestimating the frequency that you can harvest food that can sustain adults. There's also no sources on their claims, so it's just plain old clickbait.

<comment><USER7> I think it might be able to be an herb garden for a small neighborhood. But that's about it.

</comment></comment></comment><comment><USER8> Can such a design really be sustainable though? I would think that it is much harder to implement sustainable practices in such a small scale.

</comment><comment><USER9> For anyone that's curious:

\- It's released by SPACE10, which is IKEA's design lab (or one of?)

\- Actual plans on Github: [https://github.com/space10-community/the- growroom](https://github.com/space10-community/the-growroom)

\- This definitely came up a few years ago, with the same nonsense blogspam/clickbait strategy

</comment><comment><USER10> 1) 10m x 10m is enough to supplement a neighborhood, not 3m x 3m.

2) I can see a lot of ladder accidents in the future!

<comment><USER11> Where are those numbers coming from? I've always been interested in how much space you _really_ need to sustain X amount of people, but I can't find any real research. I'm probably not looking at the right combination of words, so I was wondering where you had gotten that number.

<comment><USER12> The best articles I've found on this topic were by preppers. Don't have a specific link to share but a quick google should yield some good results. Lots of preppers blogging about sustainable gardening, rabbit breeding populations, coffee substitutes, and more.

</comment></comment></comment><comment><USER13> This seems small and I'm not sure how much it will actually produce...let alone maintenance.

</comment><comment><USER14> Okay, who wants to build one? :)

<comment><USER15> You're totally right. I don't really want to build one on my own. I would however be SOOOOO WILLING to spend like 5-10k on a home grow operation. I don't think I have the experience to build something efficient on my own.

<comment><USER16> I'd buy one from Ikea and maybe a green house to erect around it. Pretty strange that a company with infinite amounts of particle board and plywood has left us holding the bag here.

My year of technical high school woodworking has unfortunately left me unable to build rounded planters like that.

Speaking of which, it's also not really clear to me why it's a sphere instead of a pyramid or a couple shelves. Doesn't look as cool I guess.

</comment></comment></comment><comment><USER17> We'll start over! Live in villages!

</comment><comment><USER18> sphere is about the worst design - cube, cylinder, cone or pyramid would be far superior

</comment><comment><USER19> This is great, thanks for sharing!</comment>


Soylent Manufacturing and Shipping Update - <AUTHOR> http://blog.soylent.me/post/72113257427/first-thank-you-so-much-for-your-patience-and <comment> jack-r-abbit I think this is the longest delay they have reported yet. I was really getting excited to get my order and start drinking it this month. It seems it'll be another 2 months before I get it. :(</comment>


IE's MIME Sniffing Allows Execution of Images - <AUTHOR> http://www.heise-online.co.uk/security/Risky-MIME-sniffing-in-Internet-Explorer--/features/112589

<comment><USER2> This problem is nothin'. You want a real problem in this vein? Check out Nate McFeters' GIFAR attack. The long/short of it:

GIF's have headers. Java JAR files, being ZIP archives, have trailers. To read a GIF, the image rendering code readers a header off the beginning of the file. To read a JAR, the unzip code seeks to the end of the file. It is therefore possible to have a perfectly valid, displayable GIF image that is simultaneously a perfectly valid, executable JAR file. Go ahead and upload it to your web app.

Why is this a problem? Because the Same Origin policy for Java applets is fucked up. Java applets have affinity for the site that delivered the bits for the applet itself; if you upload a GIFAR to Flickr, and Flickr doesn't catch it, you've now hosted a Java applet on Flickr that has Same Origin affinity to Flickr. Compose an "<object>" tag somewhere else on the Internet (pref. MySpace) and you've owned up the Flickr session for anyone who trips over it.

But wait! There's more! The Same Origin affinity for a GIFAR stored locally --- locally? how? an exercise for the reader! --- is localhost! A GIFAR that lands on your hard drive can, driven from an "<object>" tag anywhere on the Internet, make arbitrary TCP connections to services on your own host. Did you password your MySQL server?

Browsers are far and away the most difficult pieces of software we have to secure.

</comment><comment><USER3> I avoid IE almost entirely, so I don't know enough to evaluate his proposed solutions/safeguards, but I'd sure appreciate some evaluation of his proposed protections from someone who does so that I can advise clients about self- protection.

Especially I'd like some help regarding his suggestion that one set IE so that "Open files based on their content and not the filename extension". But he then hedges his bets by saying, "However, that could reopen some old holes!" It seems a weak solution merely to await the "better": "better if web service operators took security precautions".

What prophylaxis do Hackers that use IE plan to employ, if any?

<comment><USER4> I avoid IE too, but about 52% (and shrinking) visitors to sites I work with still do use IE so we still have to deal with it.

This is the first article I've read about this problem (thanks, HN.) Here's a quick summary of what I think I need to do about it: (corrections appreciated)

1) For any situations where you allow users to upload files which may be sent back to the browser as images, run some kind of check to ensure it's a valid image, e.g. ImageMagick "convert"

2) ensure you return content-type headers with the correct image type.

<comment><AUTHOR> In the case of sites that refer to user-specified images by just linking to the image (as with some forum software, at least a couple of years ago last I used such things), they need to change behavior, otherwise the upstream site can change content-type and content at the URL after validation and perform XSS on anyone that ends up seeing the "image."

I could be wrong about that, someone please correct me if so.

<comment><USER4> I think you're right. If you embed any image you don't have control over or allow users to do that then js embedded in the supposed image could gank your session cookies. Avoidance strategies(?): 1) Copy embedded images to your server, validate, and substitute link on your server for off-site link 2) To avoid cross-site scripting hacks anyway, store ip address along with session key on your server and validate that with every request. (Won't protect against attackers on the same side of a NAT though.)

This would also affect images embedded in emails, assuming user is using Outlook or IE to read mails?</comment></comment></comment></comment>


Ask Hacker News: Picking code for mainframe jobs - <AUTHOR>

I'm currently working as a mainframe operator, but my career aspirations lie in programming. I'm being granted an opportunity to learn more JCL, which is the language used to control jobs on z/OS mainframes.
I'm currently studying "z/OS JCL" by Gary DeWard Brown, and one of the first exercises has me programming a really simple job. However, none of the examples use straight JCL. Instead, they utilize (respectively) COBOL, PL/I, FORTRAN, and C/C++. I'm encouraged to use the language I'm most comfortable with, however, I have no practical experience with any of these languages.
This could be a defining moment for my early career. The code I choose to utilize will probably be the one I work with for the extent of my time with JCL. Therefore, I'd like to pick one that will make me a "better programmer" and more desirable to future employers. Please advise. <comment><USER2> C/C++ if you want to do what's best for future career. most modern operating systems, device drivers, desktop games, console games, etc. are written using them. The other languages you cited may give you edge if you want to stay in a special niche but they won't give you as much flexibility to work in a variety of other industries.

</comment><comment><USER3> COBOL: Too much overhead

PL/I: Not as much demand

FORTRAN: Too specialized

C/C++: Go for it. You will be doing stuff that you may never do again with other languages. But that's OK. You'll have a better understanding of what's going on "under the hood".</comment>


Senators Tell Kushner to Search His Email Again for These Keywords - <AUTHOR> https://www.fastcompany.com/40498174/senators-tell-kushner-to-search-his-email-again-for-these-hot-keywords <comment><USER2> I am sure the GRU could do it much more efficently</comment>


Coliving Revolution Is Beginning with the Success of OpenDoor.io - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tech-coliving-20160224-story.html <comment><USER2> So now being a low rent landlord is considered a tech startup?</comment>


CPU Cache Flushing Fallacy - <AUTHOR> http://mechanical-sympathy.blogspot.com/2013/02/cpu-cache-flushing-fallacy.html <comment><USER2> You learn something new every day: "The second major issue with ordering we have to be aware of is a thread could write a variable and then, if it reads it shortly after, could see the value in its store buffer which may be older than the latest value in the cache sub-system."

I was skeptical hippo about this because x86 has such a strongly ordered memory model, but lo and behold: "HOWEVER. If you do the sub-word write using a regular store, you are now invoking the _one_ non-coherent part of the x86 memory pipeline: the store buffer. Normal stores can (and will) be forwarded to subsequent loads from the store buffer, and they are not strongly ordered wrt cache coherency while they are buffered." (Linus, <http://yarchive.net/comp/linux/store_buffer.html>).

<comment><USER3> This is blowing my mind. I had no idea this was possible on x86.

<comment><USER4> Note that locking primitives include memory fences, that's why you are not confronted with re-ordering problems unless you do lockfree multicore programming.

From my experience, the fence is much costlier than the actual locking (at least on Linux, thanks to Futexes [1]). So unless you're going to put your hands in the dirt and remove the fence, it is useless and error prone to remove the locking, just because you believe it is not necessary.

[1] <http://en.wikipedia.org/wiki/Futex>

</comment></comment></comment><comment><USER5> Seems like a nice article, though I have 2 nits:

1) I'd have liked if you would have dived into those cases where you do actually flush the CPU cache. I've run into this maybe once or twice in my entire career, and this was while doing MIPS kernel drivers. I'm guessing it would be cool for the audience to understand what shenanigans are needed to actually require it, particularly as more people will be transitioning from x86 to ARM.

2) You are ascribing meaning to volatile which it absolutely does not have (in C/C++). You really should be going deeper into read/store memory barriers. Using volatile in the hope that this allows you to do some kind of synchronization is misguided.

<comment><USER6> The classic case where you need to do a cache flush is when you're a JIT writing out native code. Once you've written the instructions into memory you need to clean the data cache [ie ensure that your changes are made visible to anything 'below' you in the memory hierarchy] and invalidate the icache [ie throw away any info you have], so that when the CPU starts to execute instructions from the memory you've just written it doesn't get the stale old versions that might otherwise be in the icache. In fact you only need to clean data out to the point in the memory hierarchy where the icache and the dcache for all your cores come together, which is probably not the same as "write it all really back to system RAM" but is basically indistinguishable from such by the programmer.

NB that x86 maintains coherency between icache and dcache (unlike ARM, say), so you don't need to do this on that CPU architecture.

</comment></comment><comment><USER3> "Even from highly experienced technologists I often hear talk about how certain operations cause a CPU cache to "flush"."

Ok.

"This style of memory management is known as write-back whereby data in the cache is only written back to main-memory when the cache-line is evicted because a new line is taking its place."

That sounds like a flush to me. Modified data is written back (or flushed) to main memory.

"I think we can safely say that we never "flush" the CPU cache within our programs."

Maybe not explicitly, but a write-back is triggered by "certain operations," (see the first quotation above).

So it sounds like the real "fallacy" the article is discussing is the idea that a cache flush is something that a program explicitly does. That would indeed be a fallacy, but I have never heard anyone claim this.

On the upside, the article does give a lot of really nice details about the memory hierarchy of modern architectures (this stuff falls out of date quickly). I had no idea the Memory Order Buffers could hold 64 concurrent loads and 36 concurrent stores.

<comment><USER2> "Cache flush" usually refers to the idea that all of the lines in the cache are written back to memory or otherwise invalidated. Writing back a single line is usually called an eviction or writeback.

</comment></comment><comment><USER7> "When hyperthreading is enabled these registers are shared between the co- located hyperthreads."

How does that work? I thought each HT had its own registers - otherwise, wouldn't that add a lot of complication and overhead? And does that mean if I disable HT, a program can double the available registers? Wouldn't that need different machine code?

<comment><USER8> Renamed registers for OoOE, not architectural registers. These number over 100 (200-300 counting FP/SSE) for modern x86 CPUs.

Hyperthreading splits resources (including registers, branch prediction, TLB, etc.) between the threads. This split is static in Sandy Bridge and older and dynamic in Ivy Bridge and newer.

<comment><USER9> _Within each core are separate register files containing 160 entries for integers and 144 floating point numbers. These registers are accessible within a single cycle and constitute the fastest memory available to our execution cores. Compilers will allocate our local variables and function arguments to these registers. When hyperthreading is enabled these registers are shared between the co-located hyperthreads._

The article is oversimplified here to the point of being incorrect. The registers the compiler sees don't change (and there aren't 160 of them, I think there's a dozen or less), only the behind-the-scenes ones as the parent comment says.

<comment><USER10> Actually while the compiler will not explicitly output instructions to access these 160 registers, compilers can and do take advantage of the fact that under the hood there are 160 registers instead of a dozen or so. They do this with "instruction scheduling" which carefully orders the instructions in such a way that at the end when the hardware is done with it they can be executed in parallel and thus need more than the dozen or so architectural registers.

So in a way _"Compilers will allocate our local variables and function arguments to these registers"_ is correct.

<comment><USER8> Opposite actually - instruction scheduling is significantly more useful for in-order processors without renaming. Compilers take advantage of OoOE and register renaming by not caring too much about careful scheduling in favor of reducing register pressure.

For example, the compiler could order a sequence of load -> store copies as 4x load -> 4x store, or 4x (load -> store). They're equally fast on an OoOE CPU, so compilers might choose the latter so as to spill fewer registers elsewhere in the function.

<comment><USER10> It's true that the need for instruction scheduling is reduced in an OoO processor, but now you're comparing it to a processor that does not do OoO and hence needs to expose its entire register set as architectural registers. A compiler for an OoO processor still needs to be aware that under the hood there are 160 registers that can be used instead of 14 (at least if it wants to generate the most efficient code).

</comment></comment></comment></comment></comment></comment><comment><USER11> _I think we can safely say that we never "flush" the CPU cache within our programs._

Perhaps true, but not for lack of trying!

For benchmarking compression algorithms from a cold cache, I've been trying to intentionally flush the CPU caches using WBINVD (Write Back and Invalidate Cache) and CLFLUSH (Cache Line Flush). I'm finding this difficult to do, at least under Linux for Intel Core i7.

1) WBINVD needs to be called from Ring 0, which is the kernel. The only way I've found call this instruction from user space is with a custom kernel module and an ioctl(). This works, but feels overly complicated. Is there some built in way to do this?

2) CLFLUSH is straightforward to call, but I'm not sure it's working for me. I stride through the area I want uncached at 64 byte intervals calling __mm_clflush(), but I'm not getting consistent results. Is there more that I need to do? Do I need MFENCE both before and after, or in the loop?

<comment><USER12> You might be interested in system management mode (SMM) - SMM often gets entered by various ACPI and other platform functions, some of which can be triggered pretty easily from user space. To protect SMM the caches get trashed on each transition.

</comment></comment><comment><USER13> <http://linux.die.net/man/2/cacheflush>

There are other CPU architectures than the Nehalem.

The Nehalem's IO hub connects to the caches, not to memory, via the QPI. I/O sees the data as the caches see it. Most architectures, historically, have the IO systems talking to main memory or a memory controller independent of the CPU. Not waiting for memory to be consistent before firing off a DMA was a great way to get "interesting" visual effects.

We called that process "flushing the cache".

</comment><comment><USER14> "If our caches are always coherent then why do we worry about visibility when writing concurrent programs? This is because within our cores, in their quest for ever greater performance, data modifications can appear out-of-order to other threads"

I've read the opposite from various sources such as JCIP - a single unsynchronized-nonvolatile write could never be noticed by other threads (i.e. processors). I don't think that case falls into the "instruction reordering" category, does it?

<comment><USER15> x86 is a total store order memory model so any ASM MOV instruction that writes to a memory address will eventually be seen when the store buffer drains. In code we must ensure the write is not register allocated. This is achieved by the use of lazySet() as described in the article.

</comment></comment><comment><USER16> I think people do detect cache issues. Considering the fact that an access to DRAM is like ~150 or more cycles slower... your programs if written even normally may starve for RAM.

Also, people sometimes people confuse TLB flushing with overall cache flushing as mentioned at the end of your article. Also, tagged TLB flushing is still not commonly used (to my knowledge)

The reality is that there is a huge performance hit whenever these systems need to be used by a new process or context. Maybe people are equating this experience to 'flushing'.

</comment><comment><USER17> As if the Gbps vs GBps vs GiB/s obfuscation weren't obnoxious enough, now I learn about GT/s.</comment>


BQ and Canonical Launch the Second Ubuntu Phone - <AUTHOR> http://techcrunch.com/2015/06/02/bq-and-canonical-launch-their-second-underwhelming-ubuntu-phone/

<comment><USER2> I keep thinking it'd have to play well to Canonical's agenda if they'd release Touch on the Note 4. Can they not legally buy the devices, reflash them, and resell them?</comment>


Delaying Further Symantec TLS Certificate Distrust - <AUTHOR> https://blog.mozilla.org/security/2018/10/10/delaying-further-symantec-tls-certificate-distrust/ <comment><USER2> If you look at the de-facto vulnerability disclosure standards where a company is contacted with details of a vulnerability and a timeline in which to fix it privately before the security researcher goes public, you'll see that a hard stance gets things fixed properly. How many times has a company ignored the timeline, only to have the vulnerability fixed within hours of of it going public? These companies are capable of fixing this cert issue, and are being lazy. They have been warned, and have been given a generous deadline. Zero sympathy for missing it and suffering the consequences. Empty consequences will only teach them to ignore future problems.

<comment> move-on-by I don't think comparing this decision with a vulnerability timeline is very fair. But besides that, there are other motivations at work. I believe the core of this post is summed up by this one paragraph:

> we believe that delaying the release of this change until later this year > when more sites have replaced their Symantec TLS certificates is in the > overall best interest of our users.

They do not want to mess up the user experience. Which I can sympathize with, especially for a browser that does not have market share. Chrome on the other hand:

> Around the week of October 23, 2018, Chrome 70 will be released, which will > fully remove trust in Symantec's old infrastructure and all of the > certificates it has issued. [0]

From my point of view this boils down to "We're going to let websites fail for Chrome first, which will get greater visibility, and then we'll follows suit once things have calmed down". If this is the true motivation, then I believe this is a wise decision as Chrome failures will get far more attention and action vs. Firefox failures.

Edit: Just to add some numbers. Chrome is currently at 60% usage while Firefox is at 5%. That is a significant difference in error visibility.

[0] [https://security.googleblog.com/2017/09/chromes-plan-to- dist...](https://security.googleblog.com/2017/09/chromes-plan-to-distrust- symantec.html)

<comment><USER3> >while Firefox is at 5%

That is a real shame and I sincerely hope they are able to return to a health 25-33% mindshare.

<comment><USER4> For a long time Chrome was objectively the best choice, because it simply had better performance on almost everything. With the recent changes to Firefox (Quantum), that is no longer true. I have good hope this means that it'll climb back to a bigger percentage.

</comment></comment></comment></comment><comment><USER5> So these 1% sites make Mozilla's certificate revocation plan 'Too big to fail list'? Sounds like a bad security plan. You are only as strong as your weakest link.

Why is TLS 1.0 and 1.1 still enabled by default in Mozilla? More of the same. Big players don't want to tighten up.

<comment><USER6> Mozilla, as far as I know, isn't beholden to any consumer sites for revenue?

Instead of a generic "Something went wrong" TLS error message that's Greek to normal users and potentially causes blame to the browser, get aggressive.

At this point, it's laziness or incompetence.

\--

"Warning: [WHOIS_COMPANY_NAME] is using a vulnerable certificate from Symantec. Criminals may be able to read anything you do on this site.

Please email [WHO_ADMIN_CONTACT_EMAIL] about securing their site. Click [here] for more information about why Symantec certificates are no longer trusted."

<comment><USER7> The actual Firefox message for a site using a Symantec cert on today's nightly:

Warning: Potential Security Risk Ahead

Nightly detected a potential security threat and did not continue to [site].com. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details.

Websites prove their identity via certificates, which are issued by certificate authorities. Most browsers will no longer trust Symantec, the certificate authority for [site].com.

You may notify the website's administrator about this problem.

<comment><USER8> I'd much prefer the browser continue to the site, but clear all cookies, treat the domain as an untrusted origin (so all CORS requests fail), and as soon as the user tries to type anything, pop up a big security warning saying "This site isn't secure! You shouldn't put any private data, passwords, or credit card numbers in". Then disable the keyboard entirely.

<comment><USER6> Displaying the site but mangling functionality runs the risk of shifting blame to the browser, which I think is the primary tightrope in their mind.

"Firefox won't let me do this" vs "ING's page is broken"

</comment></comment></comment></comment></comment><comment><USER9> One can always go to about:config and set security.pki.distrust_ca_policy to "2" to distrust Symantec TLS certificates. Reference: [https://blog.mozilla.org/security/2018/07/30/update-on- the-d...](https://blog.mozilla.org/security/2018/07/30/update-on-the-distrust- of-symantec-tls-certificates/)

<comment><USER10> They are distrusted i. Nightly

</comment></comment><comment><USER11> _" our latest data shows well over 1% of the top 1-million websites are still using a Symantec certificate that will be distrusted"_

Is there a list somewhere? I'm curious to see which organizations missed what happened with Symantec.

Edit: Answering my own question. Found a list: [https://scotthelme.co.uk/the- final-symantec-distrust-is-comi...](https://scotthelme.co.uk/the-final- symantec-distrust-is-coming/) There are a few I recognize, like solidworks.com, ferrari.com, and quite a lot of _.gov._ sites.

<comment><USER12> None of these businesses take their PKI seriously. They ought to be taught a lesson the hard way.

<comment><USER13> It's not that simple: many don't have the technical preparation or still don't know about this in spite of everything.

Rather than "teaching a lesson the hard way", but also rather than just delaying the distrust passively, I would introduce a visual warning in the lock icon, rather than in the developer console.

<comment><USER14> <devil's advocate> Just because many people might not have "the technical preparation" or "they don't know about" driver's licenses, that doesn't mean society would give them a free pass for driving unlicensed and without the required training/testing... </devil's advocate>

While _some_ of those 1000+ sites may just be brochureware, I'd bet reasonable money that the majority of them are collecting user data of some sort (even if it's just email/password for site logins) - and the reality of website breaches and credential dumps in 2018 - those 1000 website owners are doing the Personally Identifying Information equivalent of unlicensed and uninsured driving.

I'd stop somewhat short of suggesting we should put the people responsible in jail, but if you run a top million website and have no clue your ssl cert is dodgy - I'd probably support calls to revoke your right to run a public website...

</comment></comment></comment></comment><comment><USER15> > However, given the current situation, we believe that delaying the release > of this change until later this year when more sites have replaced their > Symantec TLS certificates is in the overall best interest of our users.

If they haven't already, what reason is there to believe this delay will make them? Just curious if there is another catalyst that will push them beyond cert expiration.

<comment> move-on-by Chrome will be distrusting soon too, and they have 60% browser market share. That will get far greater visibility then Firefox's 5%

</comment></comment><comment><USER16> Brand impact: If you think you use SSL/TLS certificates from "Thawte", "GeoTrust" or "Verisign" those are all Symantec. You need to pay attention and go read instructions from your reseller or issuer to find out what you need to do. Do it today.

In a few cases your systems might desperately care about those magic brand names, and DigiCert (who now own all these brands) can sort you out if this is the case. In most cases you don't need to worry, just follow instructions.

<comment><USER17> I'd love to know what you mean by caring about the magic names and what DigiCert can do there?

My worst case hypothetical is clients in retail pinned to Symantec root, upgrade url is https (pinned) and hostname matches your consumer facing website.

<comment><USER16> Sure, so here's an example. You've got this cert for api.example.com that's got "Symantec" branding on it.

So it's issued by "Symantec Class 3 Secure Server CA - G4" and that cert chains back to a root named "VeriSign Class 3 Public Primary Certification Authority - G3"

Well all that stuff is tainted so it's going away, right? Yup. But maybe your client checks for a pin to that "VeriSign Class 3 PPCA - G3" stuff so you need that!

DigiCert have your back, since it's being distrusted anyway there's no problem having their "DigiCert Transition Root G3" signed by that VeriSign root and that can issue its own Intermediate which they can keep online to sign for you.

So now the certificates aren't issued by the tainted Symantec systems, but your client trusts them.

They also have a bunch of brand new intermediates with the old branding, for cases where you need the branding to match (Yes, I know, that's cosmetic, but eh...) but the cryptography is all fresh.

You definitely should talk to DigiCert people about the specifics of anything you need, rather than take advice from random people on Hacker News like me, but for most scenarios they will either be able to advise you on how to transition safely to something that stays trusted in the Web PKI, or how to transition to something that's maintainable off the Web PKI.

The scenario they can't help with is if you need stuff directly (not via an intermediate) signed by old Symantec roots. That wasn't even supposed to be happening when Symantec existed, and in fact one of the smaller items taken into consideration when deciding to distrust Symantec was that they weren't able to resist plaintive cries (doubtless accompanied by hard cash) by banking customers who asked for this to be done even though it was forbidden.

<comment><USER17> Oh I see --- these are new intermediates that were allowed to be issued. That makes sense but feels wonky because these intermediates were signed after the announced distrusting. I didn't realize that browsers were going to be ok with the old CA(s) signing a couple more intermediates.

<comment><USER18> I don't know the details of this specific situation, but it's possible to have two signatures on an intermediate CA. One by the old Symantec root, and the other by a trusted root. Up-to-date clients will ignore the Symantec chain and only follow the trusted chain.

For example, Let's Encrypt maintains compatibility with old browsers by having IdenTrust (a widely trusted root) cross-sign their intermediate CAs.

</comment></comment></comment></comment></comment><comment><USER19> >We prioritize the safety of our users

>However, given the current situation

"We march North!" says man marching South.

</comment><comment><USER20> Is Chrome delaying too? M70 is supposed to contain the distrust change, and last I heard it's scheduled for an October 16 release.

<comment><USER21> They are not. I'm using Beta and received a certificate warning so I contacted the webmaster. They claimed it must be my computer though I was descriptive of the issue and cause, they then said they would look into it as they hadn't heard about it. I forwarded them the article and I guess we'll see.

<comment><USER22> Maybe Mozilla is hoping to get some people to try Firefox when Chrome does not want to visit their favorite website.

<comment><USER23> The error message in Chrome is loud and clear that it's a problem with the site using Symantec certificates. I'm sure Firefox wants to make the sites more visible (with Chrome dropping Symantec first), so there is more push from users to the web site.

<comment><USER22> Even if it is clear, people will want to visit the site and if they don't find the button in Chrome or they don't want to bother with the nag screen (you can't "continue and remember" in Chrome)...

</comment></comment></comment></comment></comment><comment><USER24> Oh no. I was expecting Mozilla to follow through and then use the fallout as a way to bring attention to the issue and use it as a marketing item for Firefox as a "more secure" browser.

<comment><USER25> The problem is that when this happens, users are going to blame the browser, not the site, because it "used to work fine". Especially when switching browsers is easy.

I ran into this issue while trying to visit Paypal on my Pixelbook (on dev channel). There was no "simple" workaround (ie. click to ignore the warning) so I just used a different device.

</comment></comment><comment><USER26> To test Chrome with the new behavior, launch with the following command line flags:

      $ google-chrome --flag-switches-begin --enable-features=LegacySymantecPKI --flag-switches-end

Feature flags are global, so make sure that you are launching a new instance of chrome and not opening a new window in an existing instance. Note that a domain's certificate validation status is cached, so you may need to clear history or use incognito mode to test the new business logic.

If you need to re-enable the old behavior after version M70 is released, use the following command line flags:

      $ google-chrome --flag-switches-begin --disable-features=LegacySymantecPKI --flag-switches-end

These command line flags are undocumented and may change at any time.

</comment><comment><USER27> > We prioritize the safety of our users and recognize the additional risk > caused by a delay in the implementation of the distrust plan. However, given > the current situation, we believe that delaying the release of this change > until later this year when more sites have replaced their Symantec TLS > certificates is in the overall best interest of our users.

It would be nice if the sites were mentioned and contact information posted.

It would be nicer if that information was mentioned directly to the end-user to encourage end-user action toward the site.

And, is it not possible that the sites are fraudulent to begin with?

<comment><USER16> It is conceivable but unlikely, if you mean in the sense that the certificates should not have been issued.

The broad issue with Symantec was the lack of oversight delivered by its board and senior executives. People with the power to Make Shit Happen at Symantec either didn't know about, didn't care about, or actively permitted practices that were either forbidden, or which weren't specifically prohibited but a reasonable person should have known were unreasonable.

This is not like DigiNotar, where we knew actual bad guys had either the keys or something morally equivalent to the keys (e.g. root passwords to issuance systems).

It's not even like StartCom/ WoSign, where they were doing naughty things and trying to hide that so they wouldn't get discovered, but they fundamentally retained control of their systems, it's just that we didn't trust them.

But nevertheless this could not be allowed to continue.

Distrust was the mechanism by which it was made certain that it couldn't continue. However, Symantec decided to exit the business in 2017, and as a result their management practices are now largely irrelevant.

In theory we could imagine some James Bond style villain copying their old root keys and, before they can be finally distrusted, using them to enact some ludicrous over-the-top plan. Stealing a trillion dollars? Starting a war between the US and Russia? Something like that. But this is not a James Bond movie, most likely everything proceeded as intended and the final distrust is merely a precaution.

</comment></comment><comment><USER28> I've seen this issue in Firefox Nightly when trying to perform the HSBC UK credit card verification, so it makes sense not to roll it out to the wider public yet.

<comment><USER29> Or the opposite, that people will unknowingly transmit data over untrusted connections without this.

<comment><USER30> They can't. With most banks and even PayPal, their site is secured by HSTS which renders their site completely unusable with no way to get past the warning.

Your only option is to use a _different_ browser which trusts the old certificate.

<comment><USER31> Or to switch to a bank that actually cares about security?

</comment></comment></comment></comment><comment><USER32> link timing out for me, from archive.org:

[https://web.archive.org/web/20181010180016/https://blog.mozi...](https://web.archive.org/web/20181010180016/https://blog.mozilla.org/security/2018/10/10/delaying- further-symantec-tls-certificate-distrust/)

</comment><comment><USER10> Thameswater in the UK still hasn't rotated their certificates.

</comment><comment><USER33> This actually shouldn't be something that a company that is giving away a product should even be enforcing or deciding on their own. Reason? It makes the assumption that end users are not willing to accept that in rare cases their traffic can be intercepted and it further assumes that it matters at all if that traffic is even intercepted. And most importantly it fails to recognize the impact of making a unilateral decision like this has on those who are not impacted at all. Like some random small site (not a top 1m site) that is just providing info and now either has to pay someone to fix and/or can't have a visitor to view their site.

Even in the case of credit card information (or other sensitive data) I would love to know exactly what the probability is of info being stolen. Not hypothetically. But the actual risk.

This idea of 'security at all costs' without looking at the actual cost and/or implementation is not realistic at all and can do more harm (some site not being accessible) than good.

<comment><USER34> Let's Encrypt certs are free. Most companies that sold Symantec certs that are being distrusted are offering free replacements. Other trusted certs can be purchased at minimal cost from a variety of vendors. There may be a cost associated with replacing the cert on the server if nobody in your organization has the (very limited) technical skills needed to pull it off yourselves. If you can't deal with a minor IT expenditure with over 6 months' notice, your business has bigger problems.

<comment><USER33> Business? Not all websites are for business or run by business people. Yet they provide info on the web.

Also Let's Encrypt (I am familiar and we use that btw) is great for certain types of situations but not all situations and doesn't work with all control panels in certain cases. For example using the plesk control panel you can't map a domain to a directory or sub page on a site. You can of course add it as an alias to the main page but not say /thisdirectory/index.html at least not as of last week.

Also installing a cert is non-trivial for most users and takes time and work. My issue is not with the people that care to do that or feel it's necessary. It's with this idea that 'everyone should do it period' being decided by the browser vendors. And in particular the way an error message is displayed and shocks a typical user not every gently at all. That is the issue that stops people cold in their track. And scares them.</comment></comment></comment>


419 Eater – The largest scambaiting community on the planet - <AUTHOR> http://www.419eater.com/

<comment><AUTHOR> Posted as a response to "Scammed".

This site contains a lot of stories as well as a brief on ethics amd, -ahem, basic HSE info for people wanting to get involved.</comment>


Just 90 companies caused two-thirds of man-made global warming emissions - <AUTHOR> http://www.theguardian.com/environment/2013/nov/20/90-companies-man-made-global-warming-emissions-climate-change

<comment><USER2> So I'm not responsible for all the gasoline I burn while driving, I get to blame it all on companies saleing it?

Sweet deal.</comment>


Ask HN: How do you deal with unsolicited bug bounty hunters? - <AUTHOR> I was emailed yesterday by someone out of the blue claiming to be a security researcher who 'found' a security flaw in our SaaS app.
I was highly skeptical, and asked for details on the severity of the bug, plus any past references and work history regarding his bug bounty work, but he refused to give me much information until after I agreed to pay him a minimum $250 bounty.
I refused to do so, but then I noticed on our 'God mode' dashboard that he created an account on our SaaS and then tried to upload an image with a malicious header as his avatar.  Our system detected this, logged it an warned us, and stopped the activity.  Our hunter then simply logged off and disappeared, and we terminated his account in the system.
Just curious as to how other DevOps or developers out there deal with unsolicited bounty hunters like this? What is the best way to ascertain if their request is legitimate or not? How do you handle the 'chicken and egg' situation of agreeing to payment just in case they have found a valid security hole? <comment><USER2> There is a whole industry of people in India/Pakistan that do this. Their recommendations are pretty straight forward and usually based on basic vulnerability scanners and password best practices. It is very likely you can figure out your issue yourself, it is likely very obvious.

I believe that this user is likely correct that there is a vulnerability and I would suspect it is a fairly straight forward one and you'll think it wasn't worth even $250.

Here is a list of open source vulnerability scanners:

[https://resources.infosecinstitute.com/14-popular-web- applic...](https://resources.infosecinstitute.com/14-popular-web-application- vulnerability-scanners/)

And check your password practices, your headers to prevents XSS/iframing, and get your SSL certificate checked via an online tool. Also check the version numbers of your web server, jQuery, etc to ensure that you are not using one that has a security issue.

The guy you are dealing with is not sophisticated, just looking for a quick buck doing something simple you are not doing.

</comment><comment><USER3> Maybe by guiding oneself by the established reputation of the hacker in question, and by paying with escrow.

<comment><AUTHOR> Any good escrow services out there that can facilitate this sort of interaction that you could recommend?

<comment> jags-v [https://www.hackerone.com/](https://www.hackerone.com/) is a good place to start

</comment></comment></comment><comment><USER4> Create a standard bug bounty policy and post it. I presume you'd like to find high value bugs an that bounties may be an inexpensive way to find some. Plus it give big submitters a clear picture of what they can expect from you. Most that I've seen have some evaluation period before payment. If the big submitter doesn't agree to your terms, they are probably not for real. Unless you are a high profile company, they probably won't spend effort arguing.

Also your customers might like that you have a public big bounty program. That might give them more confidence in your security.

</comment><comment><USER5> $250 is not a lot of money. The risk/reward ratio works out in your favor.</comment>


Meet the newest Anybots robot today at Stanford - <AUTHOR> http://sam.bluwiki.com/blog/2009/04/anybots-at-stanford-cool-product-expo.php

<comment><USER2> Very interesting, could it go into a mine? I mean could the miners be safely above ground while the bots are in the actual mine. Or how about in deep water? I know there's a lot of very dangerous and important work for divers around oil platforms. Could that bot be use there?

Alternatively, what kind of autonomous functionality does it have?

A friend of mine broke is foot and we were both at party with him hoping around on crutches. He couldn't stand with his crutches and hold his drink at the same time. So my friends and I took turns being his butlers. We joked around that if we were stinking rich we could get a robot to follow my friend around at a short distance and hold his drink on a tray at just the right height the whole night.

This idea however probably doesn't have a very large market.

<comment><USER3> I also had the idea of robotic luggage or even a baby carriage that follows a person at a short distance... this should be easier to implement, I think.

<comment><USER2> That's a great idea. Airports could buy them and then people would only rent them while they are at the airport.

</comment></comment></comment><comment><USER4> If you are going to be at Stanford today, you can also attend Jensen Huang's talk at 4:30 PM. He is the cofounder and CEO of NVIDIA.

<http://etl.stanford.edu/>

</comment><comment><USER5> Aargh!! this is what i miss being stuck in Bangalore!! :-( Have fun anyone lucky enough to attend!

edit: grammar fix

</comment><comment><USER6> Monty, what a name for a robot, especially when it was programmed in Python.

</comment><comment><USER7> How easy is it to tip over?

This is pretty close to the terminator movie robots</comment>


Tearing Down an Urban Highway Can Give Rise to a Whole New City (2014) - <AUTHOR> https://www.citylab.com/transportation/2014/04/tearing-down-urban-highway-can-give-rise-whole-new-city/8924 <comment><USER2> Seattle is in the midst of doing this now, tearing down the multi-level freeway that ran along the waterfront. It's been replaced by a tunnel, and once the tear down is complete, we should have a nice waterfront area to enjoy.

<comment><USER3> Unfortunately, that double decker highway will be replaced by both the tunnel and a six lane highway in the same location as the current Viaduct.

It won't seal off the city from the waterfront as much as the Viaduct, but that's significant barrier.

<comment><USER4> Eh, the West Side Highway replacement in New York was a 6-8 lane surface road, which has been just fine; on the far side of the road from the city are very successful, busy parks and the busiest bike trail in the city.

</comment></comment></comment><comment><USER5> Look at the converted elevated mass transit line in new york, the "big dig' in Boston,Duluth ,Mn i-35 extension all with parks,bike/walking trails and open spaces that people actually use. Long overdue use of pragmatic technology....

</comment><comment><USER6> I remember biggest opposition came from store owners and street vendors who were located around the road. Having to relocate from a high traffic area would mean loss of income for the locsn vendors.</comment>


Intel's Safe String Library - <AUTHOR> https://github.com/intel/safestringlib/wiki <comment><USER2> This is based on Cisco's safeclib, and the latest uptodate version is here: [https://github.com/rurban/safeclib](https://github.com/rurban/safeclib)</comment>


Best Buy makes its idea-gathering application engine free and open source. - <AUTHOR> http://bbyidx.com/

<comment><USER2> It's a cool implementation, but I see one major flaw: unlike HN and other social news/submission sites, its popularity ranking doesn't seem to factor in when items were submitted.

Hence, if you take a look, the top three items there were submitted 3 months, 4 months, and one year ago, respectively. That might work for Best Buy's intentions, but generally that wouldn't make for a very sticky/relevant site. Would really like to see them incorporate date of submission into rankings.

<comment><USER3> There is a half-life decay algorithm built in, so ideas lose points over time if they are not voted for. We can always improve this, but it does look like the top ideas do indeed continually get votes.

<comment><USER4> Furthermore, once you've voted for an idea, you can't re-vote for it. You get one vote one time for one idea, and its value decays exponentially over time.

So to remain at the top, an idea has to keep getting new votes _from new users_.

The ideas at the top of the list have been there for a long time because they're good ideas, and they having staying power.

(Note that you can change the vote decay rate depending on whether your site is more interested in what's hot now, or what's popular over the long term.)

</comment></comment></comment><comment><USER5> ... Isn't this just a support ticket tracker?

<comment><AUTHOR> I guess to some degree... we just thought if it was worth it for us to build vs. buy we'd share what we made with others choosing that road to get them started. Our site is here: <http://bestbuyideax.com>

</comment></comment><comment><USER6> Affero :/

<comment><USER7> Eh, don't look a gift horse in the mouth.

<comment><USER6> I'm not. I have no use for this but I feel bad for the guys who coded it, having to release it under this. Its like killing it before it lives.

[http://teddziuba.com/2010/01/i-love-the-gpl-except-when- it.h...](http://teddziuba.com/2010/01/i-love-the-gpl-except-when-it.html)

</comment></comment></comment><comment><USER8> how do i download this?

<comment><USER9> <http://bitbucket.org/garykoelling/bbyidx/overview>

<comment><USER8> i caught that much. i'm just unfamiliar with "hg clone", i usually use "git clone" ... to google I go

<comment><AUTHOR> The team was going to publish this on github as well but never got around to it, I'll see what I can do.

<comment><USER8> awesome, thanks

</comment></comment></comment></comment></comment><comment><AUTHOR> From the site:

"BBYIDX is a free and open source idea-gathering application written in Ruby and distributed under the GNU Affero General Public License. It's the basis of the Best Buy IdeaX website and was created by and supported by Best Buy Enterprise Services Inc and Bust Out Solutions, Inc. The standard release is known as BBYIDX and features the ability for users to simply post, tag, comment and vote on ideas. It also features the ability for administrators to moderate incoming ideas and comments as well as assign work-flow to certain ideas for further exploration. It also offers the ability to group ideas by "current" or category to create new "currents" which serve as problems or issues to be solved by comments and moderation. It also features read and write APIs that can be used to make access to an instance of BBYIDX via another website or mobile application."

<comment><USER10> Forgive me for asking, but what was the point of reposting the first paragraph of the page?</comment></comment>