Delta told me I "didn't look disabled enough" to need a service animal - <AUTHOR> http://www.annalisekaylor.com/2013/09/delta-told-didnt-look-disabled-enough-need-service-animal/

<comment><USER2> So, if something ever happens to any of y'all at the hands of the agent of a multi-billion dollar company and for whatever reason you really, really want someone to apologize in such a way that you're sure an actual human is involved, I would not suggest blogging or tweeting about it. (Desiderata may be different if you are a social media consultant.)

Instead, write a short, professional letter the CEO. Briefly outline the facts and ask for exactly your desired resolution. Send it to the Office of the President or Investor Relations [+]. You can generally find their exact title and postal address in a few minutes of Googling.

You have a really good chance of getting that paper letter opened and read by an executive's secretary, then forwarded to the VP of $RELEVANT_DEPARTMENT with the note "Bob would appreciate if you resolved this."

I used to draft these letters for folks (weird hobby, I know), and they were routinely effective at Fortune 500 banks, insurance companies, airlines, etc.

[+ The words "I am a shareholder of $COMPANY and ..." excuse almost any communication to Investor Relations. IR are typically fairly high up on the org chart, have few day-to-day responsibilities, and are institutionally biased to making investors ecstatically happy as opposed to e.g. prioritizing calls-handled-per-hour. If you feel you're not actually a shareholder of $COMPANY, consider whether you beneficially own any of it through e.g. a mutual fund or ETF in your IRA. The answer is "probably" (and you certainly should, but that's another post), and yep, that counts in every way that matters.]

</comment><comment><USER3> This is a quote from the comments section:

 _" I travel with my emotional support dog, Lola, everywhere I go. She has all her documentation and is allowed to sit on my lap during flight."_

..."Emotional support dog?" Really? Yeesh.

I don't know, maybe I'm just a jerk, but I have a hard time feeling sorry for either of them. This person rants on and on because of a misunderstanding between her and a Delta employee. She got on the plane, right? Who cares?

My gut feeling is that this woman enjoys playing the victim. My initial reaction would probably be the same; why does this woman who can seemingly get around just fine require a service animal? Is she playing the system?

Perhaps the delta employee was rude. People are often rude. It happens. I think the writer gets off on feeling victimized, which is annoying.

<comment><USER4> She didn't have a problem with one Delta employee, she had a problem with multiple Delta employees who harassed her, ridiculed her, and questioned her disability. If I had been treated that way by employees of any organization I'd be livid, and must less restrained than she was.

By your logic, Rosa Parks still got on the bus right, so who cares?

If people don't stand up for their right to be treated equally, then we all lose.

<comment><USER3> You lost me when you compared the civil rights movement to a couple of rude airline employees questioning this woman's right to carry her dog onto the plane. False analogy much?

Also, you're setting up a straw man here. I need once excused the behavior of the employees past their initial skepticism. I was commenting on the way in which this woman presented the interaction.

<comment><USER4> They are both examples of discrimination, and I compared one specific incident to another, not the entire civil rights movement to this (and I'M the one setting up a straw man?). Not sure what you meant by "I need once excused the behavior"...I typo a lot too so I get it (see my first post). What was that point you were trying to make?

<comment><USER3> Yeah... That's what I get for typing responses on my phone.

My point was simply that I left that article with the feeling that the author gets off on feeling victimized. I could be wrong, and I said as much, but that was my gut reaction

I tried to preface what I said because I'm not the most empathetic person in the world and sometimes I judge prematurely. My girlfriend reminds me of this fact often.

The rosa parks analogy is a false one because of both severity and circumstance. Discriminating against a person solely because of their race is far worse than questioning the reason for which a person is trying to bring a dog onto a plane.

People can be jerks, but I am not convinced this was an act of discrimination. To suggest that I am fine with racism because I suggested that the author enjoys feeling victimized is ridiculous.

</comment></comment></comment></comment></comment><comment><USER5> So now all large corporations must handle customer problems through "social media" even faster than calling them? How is this supposed to work? Legions of CSRs manning a dozen different streams looking for trouble?

I sympathize with this woman's treatment, but I really really would not expect to get relief by making a tweet at the gate while the problem is still happening. That's something a local manager should be handling.

</comment><comment><USER6> Sorry, but I don't think you should be allowed a fucking pet on a flight, unless you are blind.

<comment><USER7> Let's assume, for the second, that both the law and Delta rules state that you can't have animals on board the plane. Then, is it okay to treat this person as she says she was treated? You can tell someone something they don't want to hear while still treating them as a person.

Then realize that both the law and Delta rules state that she is allowed to bring her service animal on board. So she was treated incredibly badly, while trying to do something she was legally allowed to do, and within the airline's rules. An awful experience.</comment></comment>


Ask HN: How do you know if you're burnt out? - <AUTHOR> It was clear to me that, by the start of December, I was burnt. Yet I felt that I didn't deserve the status of Burnt Out because it was a 5 month period, averaging 45 hours a week. The difference is that the pressure was higher than usual.
How do you define burnout and how do you know if you're there?
And then what steps do you take to recover? <comment><USER2> The diagnostic criteria for occupational burnout are pretty well standardized and can easily be found online (e.g. [https://www.thoracic.org/patients/patient- resources/resource...](https://www.thoracic.org/patients/patient- resources/resources/burnout-syndrome.pdf)) and, based on my personal experience, are pretty accurate. What about these common lists of symptoms do you disagree with?

You mention average hours worked per week being not unreasonable and not feeling you "deserve" to be labeled as burnt out, so I'll also note that, although severe overwork is a risk factor for burnout, it's only one of a variety of risk factors.

</comment><comment><USER3> Burnout isn't defined by a certain number of hours. It's defined by how you feel. The difficult thing to disentangle it from (especially because they feed off one another) is depression.</comment>


Harvard's newest student startups - <AUTHOR> https://www.linkedin.com/pulse/here-14-startups-launched-harvards-startup-rad-demo-day-jenny-wang?trk=pulse_spock-articles <comment><AUTHOR> What's the Harvard student startup landscape like? Do you think student founders can actually be valuable assets and bring unique viewpoints to the table?</comment>


Changing Employers (Tom Lane Leaving Salesforce) - <AUTHOR> http://firstname.lastname@example.com <comment><USER2> Salesforce is a company that survives on non-technical business folk. It's schemy and underhanded. They even awarded their own contest to their own employee who submitted a pre-built app. Because they got so much flak and bad publicity, they bent the knee and gave the 2nd place team the prize as well. [1] I worked for a startup once that wanted a "managed" solution for everything because they were trying to hire as few people as possible, pay as little as possible yet have their fears quenched. Salesforce feeds off this ignorance of bizdev nubs and then uses their church of marketing to get people to preach their locked api-space. You could say the same for AWS but at least AWS does not try to take tech and make it seem more managed for bizdev idiots. Salesforce thrives on that. They thrive on it and try to get people to specialize in their offerings, it's almost like converting people to Microsoft devs who only do .NET and Visual Studio, MS SQL, etc.. but 10x worse because Salesforce sucks.

[1] [http://valleywag.gawker.com/salesforce-gives-2nd-place- team-...](http://valleywag.gawker.com/salesforce-gives-2nd-place- team-1-million-after-cheate-1475136879)</comment>


Stigler Diet - <AUTHOR> https://en.wikipedia.org/wiki/Stigler_diet <comment><USER2> Here's a story of a guy who used the same method to come up with the optimal diet for himself: [https://www.gwern.net/docs/statistics/decision/1990-dantzig....](https://www.gwern.net/docs/statistics/decision/1990-dantzig.pdf)

The first try he ended up with a diet that required 500 gallons of vinegar a day. There was a mistake in the data that give vinegar 0 weight.

The second try ended up with 200 bouillon cubes per day. He didn't put a limit on salt content.

Then it gave him 2 pounds of bran per day. And when he put a limit on that, it changed to two pounds of black molasses. His wife put a stop to it after that.

Optimization is very dangerous when applied in large quantities. The vast majority of good solutions of any high dimensional problem will end up in weird edge cases.

<comment><USER3> And for those who don't know anything else about George Dantzig, the author of that article:

There's an urban legend about a college student who shows up late for a math class, sees some problems written on the board, assumes they're homework, and solves them over the weekend, but it turns out the professor wrote the problems on the board as examples of open problems in the field.

This urban legend is true, and George Dantzig was the student.

[https://www.snopes.com/college/homework/unsolvable.asp](https://www.snopes.com/college/homework/unsolvable.asp)

</comment></comment><comment><USER4> Ironically, this diet isn't too far off the diet I've formulated for optimal nutrition, which is based on substantial literature review.

In terms of optimal nutrition, the core of the diet I've come upon is:

* Lentils/split peas - the core of the diet, high in fermentable fiber, protein, vitamins and minerals

* Yogurt - inexpensive source of high quality protein, vitamin d and calcium, the basis for smoothies

* Sauerkraut - cheap, filling, acts as a probiotic which when paired with lentils ensures a lactobacillus dominant microbiome.

* Eggs - cheap source of high quality protein, omega-6 essential fatty acids, vitamin d & e.

* Seeds - mostly chia and hemp, but sunflower and pumpkin are really good as well. These satisfy your omega-3 and omega-6 essential fatty acid requirements and are loaded with minerals. If you skip out on spinach and buy cheap eggs with low vitamin E content then sunflower seeds are excellent.

I also eat a lot of berries (frozen, in smoothies), whey protein and lean pork/chicken, though these are less important in my opinion.

An additional health hack that I highly recommend is to consume a lot of vinegar. The putative health benefits of alcohol are almost certainly due to its metabolism into acetate. By consuming vinegar directly, you skip the production of acetaldehyde (which has been linked to DNA damage). My favorite way to consume vinegar is by pickling vegetables in a vinegar solution, then using them as garnishes to add flavor to meals.

While I understand many people don't put a lot of stock in anecdotal reports, this diet paired with a bodybuilder lifestyle keeps me around 220lbs @ ~12% bodyfat which is quite exceptional considering I'm 6' tall, and naturally obese if I don't watch my diet.

<comment><USER5> Very cool. I just did a similar exercise also based on a lot of research (posted it on this thread). Interested in your thoughts.

</comment></comment><comment><USER6> Becoming 'fat adapted' reduces this cost significantly as you can get approximately 120 fat calories in a tablespoon of high quality coconut or olive oil for about 10 cents in bulk based on my last trip to costco, and as long as you supplement that with an inexpensive protein source you can get by on a very cheap diet. I splurge on high quality veggies simply because we don't know enough about phytonutrients' effect on health to rule them out. This in combination with skipping meals (intermittent fasting) causes the food bill to drop significantly and has some potential health benefits.

</comment><comment><USER7> If you were to blend the benefits of services like Soylent (nutritionally balanced meals) and BlueApron (delicious delivered recipes), you arrive at a service where you pick from a list of healthy ingredients and the service uses linear programming to build "solutions" aka recipes for meals that balance the ingredients such that they provide proper nutrition and then provide you with the list of ingredients to purchase (or ship them directly to you).

Also related: [https://discourse.soylent.com/t/genetic-algorithms- automatic...](https://discourse.soylent.com/t/genetic-algorithms-automatic- diy-soylent/5212)

<comment><USER8> We'll have IBM use Watson to provide the solutions -- call it "Big Iron Chef".

</comment></comment><comment><USER5> I just did my own version of this diet with a nutrient-dense low-carb approach.

Ground beef: $3.50/lb = $2.19/day

Sardines: $9.99 for 6 - 4.375 oz = $1.67/can = $1.67/day

Fresh spinach: $3.99/2.5 lb (.35 cents/g) = $.84/day

Eggs: $7.99/ 5 dozen (13.3 cents/egg) = $.40/day

Sunflower seeds: $2.49/lb = $.36/day

Butter: $9.99 for 4lbs = $2.50/lb = $.12 cents/day

Total cost: $5.58/day

This is 1800 calories and is 65% fat, 30% protein, and 5% carbohydrate. I used [http://nutritiondata.self.com](http://nutritiondata.self.com) to formulate it and it meets or (far) exceeds every vitamin and mineral requirement except for only 50% DV of Thiamin (not worried about this).

I basically do a version of this but with more expensive boneless short rib (very marbled and delicious) and am in perfect shape (you can find evidence here if you scroll down a bit [https://twitter.com/FoodLiesOrg](https://twitter.com/FoodLiesOrg) )

Spreading this menu over 2 meals (one at noon and one at 7:30pm) will give you a nice intermittent fast. It will also train your body to burn fat instead of sugar. You will be very full off of only 1800 calories and should lose a lot of weight.

Disclaimer: I'm not dispensing nutritional advice as I am not a doctor or dietician. I've just researched this stuff for years and am making the documentary [http://foodlies.org](http://foodlies.org)

<comment><USER9> "Eggs: $7.99/ 5 dozen (13.3 cents/egg) = $.40/day"

Wait, does that mean 3 eggs/day? That would be asking for troubles (cholesterol).

<comment><USER5> Dietary cholesterol is actually not bad - check out this article for a good overview [https://chriskresser.com/the-diet-heart-myth-cholesterol- and...](https://chriskresser.com/the-diet-heart-myth-cholesterol-and- saturated-fat-are-not-the-enemy/)

Have been researching this for a long time. It was hard for me to believe at first, but the science is sound.

<comment><USER10> _> It was hard for me to believe at first_

Nina Teicholz has a lot to say about the garbage state of nutritional science, the AHA and just how much expensive taxpayer-funded research has been buried over the past 50 years.

[0] [https://www.youtube.com/watch?v=2_kEmYTiHtc](https://www.youtube.com/watch?v=2_kEmYTiHtc)

<comment><USER5> I was being coy. I've read Nina's book and heavily researched all of this. I'm glad you and other people know about this stuff. Let's make this common knowledge!

</comment></comment></comment></comment></comment><comment><USER11> FWIW, when adjusted for inflation, $39.93 (the total annual cost of Stigler's 1939 diet) is approximately equivalent to $712 in 2018 US dollars(1). Still a paltry sum, though, for a year's worth of food for most people in the US, I think.

1\. [http://www.usinflationcalculator.com/](http://www.usinflationcalculator.com/)

<comment><USER12> Or delivered on a pallet for about $1000/person-year: [https://www.costco.com/THRIVE-1-Year-Food- Storage-31%2C500-S...](https://www.costco.com/THRIVE-1-Year-Food- Storage-31%2C500-Servings.product.11763436.html)

<comment><USER13> Note that that's $1000/person-year for 1300 calories per day, vs. 3000 calories on the Stigler Diet!

<comment><USER5> The diet I created and posted here is only $2,000 per year and includes fresh, nutritious foods that don't detract from your health like most of those foods loaded with carbohydrate and sugar would in your example.

Obviously they aren't comparable, I just think it's cool you could live in perfect health for a year for $2,000

</comment></comment></comment></comment><comment><USER14> For boring but optimized meals for nutrition and cost more people should really look at what bodybuilders eat. When you're a competitive bodybuilder every calorie counts and every meal is planned and carefully calculated. Now, most of you don't need the same volume of food and the protein amount is going to be higher than what your average sedentary person needs but still provides a great baseline for getting in the right nutrients and balanced amounts of fats/carbs/proteins.

</comment><comment><USER15> > a moderately active man weighing 154 pounds

> 3,000 Calories

It's really striking how much heavier and how much less active Americans have become.

<comment><USER16> This bit stuck out to me too:

      I called my doctor and asked him how come the nutritional requirements didn't
      show a limit on the amount of salt? "Isn't too much salt dangerous?" He
      replied that it wasn't necessary; most people had enough sense not to consume
      too much.

</comment></comment><comment><USER17> As I started preparing home-made kefir, I realized that full-fat milk has a balanced protein-fat content, and is rich in some other nutrients. Fermentation to kefir reduces the lactose content while increasing some of the good things (vitamins, amino-acids).

In my calculations, about 3L of kefir per day should satisfy the energy and protein needs of an adult; for under $3/day.

If that'd work, it would be the first complete diet made from only _one_ ingredient!

<comment><USER18> fun fact kefir is like 0.5% alcohol so that amounts to 15 mL of alcohol for 3 L of kefir! Not much at all, but probably adds up combined with other drinks

<comment><USER17> Now that's what I call a complete meal, the drink included :)

</comment></comment></comment><comment><USER19> Here is a meal from these ingredients by a Google chef: [https://gsuite- developers.googleblog.com/2014/09/sudoku-line...](https://gsuite- developers.googleblog.com/2014/09/sudoku-linear-optimization-and-ten- cent.html?m=1)

> Google Chef Anthony Marco took it as a challenge, and we're calling the > result Foie Linéaire à la Stigler

</comment><comment><USER20> Extremely cool until even the smell of navy beans makes you wretch.

Also, given the generally poor state of even contemporary nutritional science this strikes me as something akin to a particularly beautiful set of solutions for a universe in which the luminiferous aether is real.

BUT it is still a really neat optimization problem, and that is likely the spirit under which it was submitted.

</comment><comment><USER21> Bookmarking this for later use. I've always wanted to find a recipe somewhere between Soylent and Lembas Bread that can be used for long hiking or canoe trips.

Unfortunately the beans and cabbage hardly sound appetizing for a bread. The obvious ideas are wheat, nuts, and dried fruits.

Any good resources for this?

<comment><USER22> There's a difference between food good for survival and food that is good for you.

You can buy modern high calorie food bars that will last ten years and contain 3000 cals in a tiny package, but they're mostly carbs. Again, great for survival but not something to live off of while on a fun trip in the backcountry.

I usually pack precooked meats (frozen if needed), dried meats, firm biscuits or crackers, and some nuts and fruit. Granola and oats are good too of course.

If you have conveyance (a canoe or kayak, an atv, etc) then you can afford to bring much less dense (and usually better tasting) food.

<comment><USER23> > If you have conveyance (a canoe or kayak, an atv, etc) then you can afford > to bring much less dense (and usually better tasting) food.

Can confirm, many years ago went on a canoe trip on the Shenandoah for a week and we brought about 400lbs total food and equipment per 2 man canoe. We ate like kings, and mine and my boat-mate's canoe was the only one that didn't capsize on the trip (everyone had fully waterproof bags, so no one lost anything, it was just a matter of pride).

</comment></comment></comment><comment> racer-v I created a diet optimized for maximum dietary fiber and protein with minimum calories (optimized separately). Highest fiber/calorie ratio is generally cruciferous vegetables; highest protein/calorie is fish and chicken (skinless boneless breast meat). Using these two food groups I can satisfy my macronutritional requirements on 600 calories/day. I add a multivitamin in case I missed anything.

Based on these parameters I can judge any food based on whether its fiber and protein can match (or beat) a linear combination of chicken and broccoli. Basically if (2F + P) * 20/3 <= C then it's on the diet. This includes non-fat yogurt, wheat bran, eggplant, and some types of beans.

<comment><USER4> Not all fiber is equivalent. The fiber in legumes tends to be highly fermentable, and provide far more in the way of health benefits than the fiber in vegetables such as broccoli.

Lentils are pretty much nature's perfect food when considering cost, protein and fiber content. Additionally, lentils are low in methionine. I don't put much stock in methionine restriction for human longevity, it does work in rodents, so if you want to be a guinea pig (couldn't resist) they're good in that respect too.

Eggs are also excellent for their high essential fatty acid content, and this may sound counter-intuitive but if you eat a lot of beans dietary cholesterol is actually beneficial. High quality eggs are also a really good source of vitamins E and D.

Finally, though they're unfortunately not so cheap, hemp seeds provide you with both omega-3 and omega-6 fatty acids and minerals. A mix of sunflower or pumpkin seeds and chia seeds works well and is cheaper if you're optimizing for cost.

The only vitamin that I think is worth supplementing is niacin. Niacin has been shown to increase BDNF levels in animals which can help with mood and memory formation, and it has also been shown to increase lifespan by 10-15%. For people who don't go outside and don't consume much milk vitamin D might also be a good idea.

<comment> racer-v > if you eat a lot of beans dietary cholesterol is actually beneficial

Interesting, I have found some references to beans lowering cholesterol but not this stronger statement?

I've read that the link from dietary cholesterol to body cholesterol levels is genetically variable, but that there's no test at present for determining individual risk factors.

<comment><USER4> An extremely high fiber diet has been shown to negatively impact testosterone production. Cholesterol is also important for nerve myelination, and high cholsterol intake has been show to magnify strength gains from resistance training.

</comment></comment></comment></comment><comment><USER24> it would be interesting to try to constrain / regularize this problem such that the solution is palatable. User could answer some questions about ingredient preferences to build approximate set of weights for the LP objective. Also easy to add some constraints that prevent huge amounts of one food. Tools to allow the user to "critique" the solution which generate new constraints or modify the objective.

Also would be interesting to run the same LP over historical ingredient price datasets and see how the optimal diet changes as ingredient prices fluctuate.

</comment><comment><USER25> "No one recommends these diets for anyone, let alone everyone."

But surely there must be some hacker out there who has decided to try it.

<comment><USER26> Yes, I did :D

</comment></comment><comment><USER27> Huh, I did a similar thing a few years ago with much fewer ingredients to come up with a low budget diet (I also used multivitamins to fill in the gaps). I just threw a simple evolutionary approach at the problem, because modern computers reward laziness.

</comment><comment><USER28> I'm sure we could attempt this today with a larger dataset of foods and nutrients. I know that there's nutritiondata.self.com and the usda's nutrition database, anyone know of an average price dataset for food?

<comment><USER5> [http://nutritiondata.self.com](http://nutritiondata.self.com) uses the USDA database.

I made a diet with only 5 foods (plus butter) that is ideal for human health and weight loss (posted on this thread).

</comment></comment><comment><USER29> [https://www.completefoods.co/diy/recipes](https://www.completefoods.co/diy/recipes)

</comment><comment><USER30> > a 154-pound male

That's so XX century it hurts.</comment>


Why LivingSocial's 50 million password breach is graver than you may think - <AUTHOR> http://arstechnica.com/security/2013/04/why-livingsocials-50-million-password-breach-is-graver-than-you-may-think/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29 <comment><USER2> >LivingSocial engineers should be applauded for adding cryptographic salt

Should they? Should they really? Should we also give them a cookie for properly dressing themselves in the morning?

Uniquely salting and hashing passwords is the bare minimum for acceptable security practices. It is not a sign of expertise, but of competence.

</comment><comment><USER3> I don't get why they used SHA-1. I mean, LivingSocial has been sending people to speak and attend a lot of developer conferences. They hire a lot of bright people. Did none of the Rails devs raise an alert of like "Uhh hey guys, why don't we use Rails-community standard bcrypt?".

I suppose it could be corporate bureaucracy or something, but it seems weird that a company with at least 30+ developers (based on public members on the github org) no one would point out that this is a Bad Idea.

<comment><USER4> I could think of a few reasons:

1\. user management is a pretty trivial thing to code and one of the first things you do when you set up any site. It could have been a simple oversight before a rushed launch.

2\. Playing off of 1), once you have any users in a database using a particular system, you have to go through a bit of a process to convert people over (you can't convert from one hashing algo to another yourself since you don't have the original passwords). That involves creating a concurrent password table, creating login hooks that force the user to upgrade their password on login (especially a pain if they're using native apps -- i'm not sure if they are), etc. Making sure that 50 million users migrate over without a hitch is a potentially site-breaking undertaking that could have serious impact on the site's success. Given the rocky climate LS currently faces, you'd have to have nerves of steel to lead a n initiative like that.

3\. Depending on how LivingSocial has their code management structure set up, there may only be a few devs who actually have access to the user login system (you really don't want an intern or freelancer to be able to modify those). Given that the same devs who have that access probably have more immediate issues to deal with day-to-day, something like the current hashing algorithm might not be on the top of their priority list.

Not that any of these are very good excuses, but I could see how it could happen.

<comment><USER5> I do not agree with your #2 regarding making users re-create their password.

Assuming you haven't been hacked yet the old password is still secret. Therefore you modify your login system so that when the user next logs in:

* Check password against old hash

* If old hash exists and matches user's password then re-hash the password using new hash and save new hash in new field

* If old hash does not exist then just check against new hash only.

Run the above code for X time (X being the time it takes Y% (Defined by company) of your users to login at least once.

After X time THEN you start forcing the remainder to switch over.

Done properly for the vast majority of your users should not even know you have changed anything.

[EDIT] - With some extra code you could probably avoid having to create a new field for the new hash by just checking against one hash field using old algorithm then new algorithm. This would avoid a potentially costly DB migration.

<comment><USER6> It's much safer to just hash twice: the first time using your old hash function and again using a secure hash. Then to migrate you only have to update all your customer's password hashes in place. Additionally, if you lose your database, you don't lose all the old, weak password hashes.

<comment><USER4> Ooo, I hadn't thought of that! For some reason, I had it in my mind that some insecure hashing algorithm as the base would result in an insecure resulting hash, but of course that all goes out the window when your whole password table is out in the open.

I'm glad you mentioned "safer", because for some reason rurounijones's approach made me nervous, but I couldn't quite put my finger on it.

Here's some more discussion on the issue: [http://crypto.stackexchange.com/questions/2945/is-this- passw...](http://crypto.stackexchange.com/questions/2945/is-this-password- migration-strategy-secure) (I found that from here: [http://stackoverflow.com/questions/3955223/password- hashing-...](http://stackoverflow.com/questions/3955223/password-hashing-how- to-upgrade)).

</comment></comment></comment></comment></comment><comment><USER7> Hearing about all these recent hacks (LinkedIn, RubyGems, LivingSocial) really makes me nervous and wonder how I can avoid hacks. Are there any details on how these systems were hacked in the first place, so that the rest of us can learn from the lessons? I already use as many security good practices as I can (bcrypt, processes and apps running under different user accounts and database accounts, read-only accounts, principle of least privilege, firewall, fail2ban, key-only SSH logins, file modification monitoring, forwarding logs to a log host, etc) but I can't shake off the feeling that I may be forgetting something.

<comment><USER8> "and wonder how I can avoid hacks"

(I'll leave it to others more knowledgeable to answer this but keep what I say next in mind.)

My question to you is, how big of a target are you?

I mean the security you would use if you are Madonna is not the same as a "B" list actor or the person working in the local coffee shop.

You can put untold hours into this but unfortunately security is a full time job and can also detract from other things you need to be concerned with that might be more important for your particular situation.

"I may be forgetting something"

Sure but the same concern is in play when taking a trip or with anything. What are you forgetting? Where are you going? How easy will it be to solve the problem and how much impact will forgetting dental floss have? Are you going to an uninhabited island or Manhattan where you can buy almost anything 24/7?

<comment><USER9> What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on.

While the former member might not be a high profile target for the moment (and let's assume that he isn't for the sake of devils advocate), who's to say that next week a story hits the news about his wife or children or even a company he's affiliated with and then reporters decide to start poking about on forums and social media for cheap information to write sensationalist reports on? Or that hackers use that news as an excuse to target the poor guy?

Or even who's to say that next month he annoys someone on HN who decides to play some pranks?

While you are right that that security is a full time job, you should never advocate the numbers game because as remote as the odds might be, people do win the lottery.

<comment><USER4> I think both of you and your parent post's points are well-taken. IMO you should do all that you can to secure your site within practical reasoning.

The LivingSocial password hashing debacle is an example of a security failure that pretty much every website in the known universe could improve on by changing a single line of code -- that's what's so frustrating about it in the first place.

There are cases, though, where certain security measures are probably not needed. For example, I would probably not recommend that my mom use a keyfob security token to log into her blog admin page (although I'd probably offer to make one for her with an Arduino as a weekend project lol), or hire armed guards to guard her database servers. Enterprises certainly need these measures along with many others.

<comment><USER9> What you're discussing is how valuable is the data. eg if your mum lost her blog (and kudos to her being tech-savvy enough to run one - my mum certainly isn't!), it would be frustrating, but not really a big problem. She'd just just restore from a back up, change the passwords then back to business as usual. But then you're comparing it against examples where there's confidential information (eg user passwords) which, if stolen, is a massive problem.

I'm assuming from the OPs tone, that his box sits somewhere between the two extremes. However the very fact that he's got an SSH account on it makes the box a much more favorable target than the millions of free blogs on shared hosting services - so even if his box doesn't contain 3rd party passwords and/or credit card information, and even if he can easily restore the box from a back up, he still has the problem that a break in could see his box used to send spam and what not. Many hosting providers will just kill your subscription if that happens.

So while you're right that there's a balance between security and usability, security most definitely comes first if you're administrating your own VPS / dedicated hardware.

</comment></comment></comment></comment></comment><comment><USER10> I wonder why password tables are readable at all. An application only needs to call a stored procedure that compares the computed hash value against the stored. This stored procedure needs the rights to read the data. No application, no administrator should to be able to read that data.

<comment><USER11> The issue is how you enforce this. Obviously if somebody has root on your server they can just disregard any rules for how the database should be accessed.

Maybe by having the database on external hardware with an API, but I can imagine this is hard to scale. What if you need to sync it across several load balancing servers, or what if you want to make backups?

<comment><USER10> > _Obviously if somebody has root on your server ..._

... then it's game over for you. But I guess intruders typically use either SQL-injection or somehow get the application password to access the password table. In both cases an unreadable table would thwart the intruder.

<comment><USER11> But is it?

If the only way your production server can check passwords is by sending hash(salt+pw+salt) and getting a true\false reply from a piece of external hardware...then even if an intruder got complete control though some exploit or injection, he wouldn't be able to dump the database for later cracking with rainbow tables.

<comment><USER12> You may have just re-invented the Hardware Security Module(HSM)[1] :-)

See also [2] for a cute implementation using an Arduino to secure an AWS API key

[1] <https://en.wikipedia.org/wiki/Hardware_security_module>

[2] [http://stefan.arentz.ca/signing-aws-requests-with-your- ardui...](http://stefan.arentz.ca/signing-aws-requests-with-your-arduino.html)

</comment></comment></comment></comment></comment><comment><USER13> Are tech companies that store a fair amount of personally identifying information on millions of people ever subject to security audits? Not saying it would help, but it seems like as attacks get more prevalent and old security practices become obsolete that users might be able sue companies for negligence by not using optimal data encryption. Of course the tech company would counter sue for stupid passwords. And even if they want to restrict users from dictionary passwords with symbol replacements, hey, it's patented.

<comment><USER14> I think in N. America if you do credit card processing you have to conform to PCI standards, unfortunately those standards are loosely audited and relies mostly on self-reporting. More than a few of the security protocols are cargo culty and even detrimental to security.

</comment></comment><comment><USER15> One way they could have upgraded their database to make it more secure: [http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish- pass...](http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish- password.html)

<comment><USER16> I would vote for PBKDF2-HMAC-SHA512. The SHA512 part makes it a little harder to do in GPU as key lengths are 64-bit vs 32-bit for sha256.

Pbkdf2 has been recommended by NIST, while the main crypto algorithm for bcrypt hasn't seen as much attention (though it has been around for a while and is probably safe).

Edit: Though, it looks like PBKDF2-HMAC-SHA512 is not FIPS compliant.

<comment><USER17> So, this isn't a bad recommendation, in that PBKDF2-XXX for any XXX is _much_ better than "salted hashes", but I'm confused about this meme that recommends PBKDF2 above bcrypt and scrypt, both of which are better, marginally in bcrypt's case, and significantly in scrypt's.

SHA2-512 is designed to be fast on hardware.

<comment><USER16> True true, all of them are better than just salted hashes. It is much harder to brute-force bcrypt and scrypt in hardware (ASIC, GPUs, etc...).

It's just important to understand the differences and trust behind the different algorithms. PBKDF2 is NIST recommended, which I would say speaks to its strength (unlikely it will be easily cracked). It can also be used with any input size. Though, calculation requires little memory, so it can easily be implemented in hardware.

bcrypt has been around since 1999 has is still going strong, but is limited to input sizes of 55-characters.

scrypt is fairly new and I don't feel has been wrong long enough to be vetted by the security community.

<comment><USER17> You say it's "unlikely it will be easily cracked", but, obviously, it's demonstrably easier to crack than bcrypt and scrypt.

<comment><USER16> SHA-1 and SHA-256 use 32-bit word sizes which makes them very easy to implement on current GPUs. CUDA and OpenCL allow for computation on 32-bit floats very quickly, but neither can easily do 64-bit floats right now. Which is why I said originally that SHA-512 would be preferable right now (due to 64-bit word sizes for its keys).

I don't follow GPU tech enough to know if they plan on implementing 64-floats any time soon, so commodity hardware to easily brute-force SHA-512 may not be around for a while. Though, they can still implement SHA-512 calculations on a GPU a lot easier than they can for scrypt or bcrypt.

Now, if you use PBKDF2 with a large iteration count (lets say 20000), it will make the time to calculate the final solution a lot harder. You could give an iteration count to PBKDF2 to have it take the same amount of time as bcrypt would take to run. The only thing you can't do with PBKDF2 is adjust the amount of memory required to calculate the solution.

<comment><USER17> _Though, they can still implement SHA-512 calculations on a GPU a lot easier than they can for scrypt or bcrypt._

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Everyone should be salting and hashing correctly - it's trivially easy to implement and the cost is trivial. However, once the user database is stolen in its entirety, there are other factors that become as important:

\- Did the user use a common passwords? If they did, then it will quick to brute-force.

\- Did the user reuse the same credentials on other sites? If they did then the value of recovering the password becomes worth plowing through well-salted scrypt.

The real problem is that far too many people use the same credentials for LivingSocial and their Gmail.

<comment><USER19> It was my understanding that hashing and salting is now obsolete, and doesn't really increase security that much. AFAIK, the best 'recommended' way currently is to use bcrypt.

<comment><USER20> Your understand is completely wrong.

Plus bcrypt is used as a hashing function and includes a salt. So even if what you said was true, it would make bcrypt obsolete.

Yes, I know, bcrypt uses a block cipher but block cipher can be easily used for cryptographic hashes (see DES for one example).

<comment><USER19> Yes, bcrypt is used as a hashing function, and includes a salt; but it isn't what is usually meant when "Hashed and salted" are suggested - the salting part becomes part of the algorithm used, rather than something you specifically have to implement yourself.

From the perspective of the person using it, it's just a single hash. Saying "Hashing and salting" works is not really any better than what people do already, because, e.g. the passwords in the case discussed in this article WERE hashed and salted, but with a relatively weak hash.

</comment></comment></comment></comment><comment><USER21> Sorry if this has been asked, but I haven't seen anything on it yet. What about users that only signed in via Facebook? Any actions I need to take?

</comment><comment><USER22> Does anyone actually know how to close a livingsocial account? I scoured their site but saw nothing that pointed me in the right direction.</comment>


Study compares Reddit, Digg, and Del.icio.us to mainstream news sites - <AUTHOR> http://news.bbc.co.uk/2/hi/technology/6990033.stm

<comment><USER2> I don't get why this study is trying to draw big conclusions through comparing stories published by mainstream news outlets and stories that are popular on social news sites heavily, heavily skewed towards geeks.

As the cliche goes... apples vs. oranges.

The guy doing the study even says this about the inherently different foci of the two:

"This technology bias was partly down to the fact that it was early adopters of technology that lead the way when it came to 'playing with the potential of the internet to empower users', said Mr Rosenstiel.

<comment><USER3> Once "citizen journalizm" gains widespread popularity, expect reddit and digg have their front pages occupied by Paris Hilton news, fart stories, soft porn and updates on mysteries of Anna Nicole's tragic death.

Real crowds suck.

</comment></comment><comment><USER4> "It found that the interests of users was markedly different to that of traditional editors."

By saying this the author makes a couple of assumptions:

1) By users, the author seems to imply the same people who use mainstream media. But really, in this case, "users" are dedicated communities built around digg, reddit and delicious -- which explains the propensity for technology related news items.

2) It could be that users dont prefer to promote mainstream news stories simply because old school media is an existing reliable source of such stories. For example, you could rely on BBC and CNN to report the latest natural disaster -- digg and reddit dont have to do this for their users.

</comment><comment><USER5> _One of the biggest differences noted by the researchers was the emphasis put on a single story. While the mainstream media tended to revisit the same story from a different angle each day, users were happier dipping in to a variety of topics._

That's a big reason why I basically just never watch the news on TV.

_"It was more hit and miss with a sense that they wanted to know a little about a lot of things," said Mr Rosenstiel._

Which is basically like the format of BBC World News Today (if it's still called that). It's a little bit about stuff going on all over the world. It's just the news, without all the self-important analysts clogging up airtime with commentary almost bad enough for YouTube.</comment>


'Airline pilot' protocols in finance - <AUTHOR> http://www.ft.com/cms/s/2/86d97610-00ab-11df-ae8d-00144feabdc0,dwp_uuid=a712eb94-dc2b-11da-890d-0000779e2340,print=yes.html

<comment><USER2> I can't believe this isn't on the front page

<comment><USER3> I think it's a really bad title. Something more like "Excerpt from new book 'The Checklist Manifesto'" would have probably gotten a lot more attention.

After reading this excerpt, it's going on my library list. (I'm a big fan of checklists.)</comment></comment>


Hydraloop wins Best of best award at world's largest electronic show CES2020 - <AUTHOR> https://www.dutchwatersector.com/news/hydraloop-wins-best-of-best-award-at-worlds-largest-electronic-show-ces2020 <comment><USER2> So this was described as a 'decentralized water recycling unit' \-- can anyone inform me how decentralizing this service in the form of this appliance is going to be more efficient than large scale bulk wastewater treatment setups, like we have now (or do we)? As an outsider to the industry I don't know what the advantage is in localizing the water processing like this versus doing it all at scale in the same place then piping it back to customers. If it's the case that the water that drains from showers is not being recycled/reused currently, then I see how this makes sense, although I still wonder why doing that locally versus centrally is preferable.

<comment><USER3> _" It cleans and disinfects shower, bath, and washing machine water so it can be reused for toilet flushing, washing machines, the garden, or swimming pools"_

⇒ This produces "greywater"([https://en.wikipedia.org/wiki/Greywater](https://en.wikipedia.org/wiki/Greywater)). That can also be done (and, I expect, more economically) in a centralised location, but using that water would require laying a second water main to all houses.

An argument in favour of local treatment also might be that it makes it harder/impossible for users to use the wrong kind of water (drinking greywater or using "blackwater" where greywater would suffice)</comment></comment>


Google Login will be mandatory for Firebase accounts - <AUTHOR> https://groups.google.com/forum/#!topic/firebase-talk/13QtLRCiIv4 <comment><USER2> A Google Login isn't as drastic as it used to be. From the FAQ:

> I don't have an existing Google account and I don't want to sign up for > Gmail, Google+, or any other Google services. What should I do?

It is easy to create a Google account for any existing email address without tying it to any Google services. It will only be used for identification and login. You can sign up for this "slimmed down" Google account here. You can also create this type of Google account via the existing migration flow on firebase.com.

<comment><USER3> Does this still have the nasty side-affect of meaning anyone using Google email services can't send you regular calendar invites by email any more?

When I made the mistake of creating a google account using an existing email address, they apparently created a google calendar account for me, and then any Gmail/Google Apps email invites sent to my email address, never reached me, because they would get diverted straight to this Google calendar account I had no knowledge of, or desire for.

<comment><USER4> Same kind of thing happened to me with google chat, years ago, when it was an xmpp service. They turned it into a gmail account and automatically inserted it into the address book of everyone I chatted with, and it was close to half a year of confusion before I worked out why certain people just couldn't seem to get in touch with me anymore.

</comment></comment></comment><comment><USER5> Context: Firebase was bought by Google in 2014[1]

[1] [http://techcrunch.com/2014/10/21/google-acquires-firebase- to...](http://techcrunch.com/2014/10/21/google-acquires-firebase-to-help- developers-build-better-realtime-apps/)

</comment><comment><USER6> This only means that the developers have to login with a Google account? Firebase is a Google-owned product, so why would that be a surprise? It doesn't sound like your app's users have to login with Google.

Edit: if you don't want someone telling you how to login, maybe check out Kinto?

[http://kinto.readthedocs.org/en/latest/overview.html](http://kinto.readthedocs.org/en/latest/overview.html)

</comment><comment><USER7> I didn't know about this: [https://accounts.google.com/SignUpWithoutGmail](https://accounts.google.com/SignUpWithoutGmail)

<comment><USER2> Sadly HN's URL trimmer buries the lede here: /SignUpWithoutGmail (see my other comment for where this came from James's FAQ).

<comment><USER7> Are you on a phone? I don't see any trimming, either logged in or from an incognito window.

<comment><USER2> Ha, yes sorry about that (I've gotten so used to the new responsive thing I didn't even think twice about it).

</comment></comment></comment></comment><comment><USER8> Sure, don't mind.

</comment><comment><USER9> Firebase has stagnated for quite some time now. Months ago I mailed them about Twitter now allowing email addresses in their Auth but Firebase has yet to catch up. This means you cannot get email addresses of users signing up via Twitter. They suggested I manually ask the user to type it in, which obviously defeats the purpose of OAuth.

A request has been pending for over a year to add the client IP in their ServerValue response which is a common security ask but the boilerplate response of we're working on it has got no traction.

They still don't have a password reset email template so you must use the forgot pass template.

Even so, their forgot password mail adds the username in the URL. If like me, you use the email address as the username this won't work. That's because they don't encode the email address in the URL. I brought this up months ago, they acknowledged the bug and then suggested I manually ask the user to type it in. This still doesn't work.

There were some other issues but I gave up on the service.

</comment><comment><USER10> I really hope that the next generation of companies founded and run by people who grew up being on the other side will refrain from making this kind of decisions.

<comment><USER11> Why do you object to this decision?

If I'm building a service that needs an account system with 2FA, detection of automated attacks, and some decent amount of internal security, I am surely not going to build it myself. It is just like rolling my own crypto in all the wrong ways.

There are a couple of providers that will do this for me, for free: Google, Facebook, Twitter, Amazon, and GitHub come to mind. Each has some tradeoffs of public perception, losing audience members who refuse to have an X account, etc., but it's mostly a tossup. For a technical service like this I might have gone with GitHub, but if they're owned by Google, having only Google logins seems like the right choice. (Among other things, you already _have_ a Google account in a sense when using Firebase, it's just run by a separate team at Google.)

Sandstorm, a project that encourages you to _self-host_ all your web services, came to the same conclusion:

[https://github.com/sandstorm- io/sandstorm/issues/150#issueco...](https://github.com/sandstorm- io/sandstorm/issues/150#issuecomment-62084752)

Is there a better third-party alternative here, or a way to do this securely and easily yourself that I'm missing?

<comment><USER12> This announcement is about the developer login, not the user login.

Firebase apps can keep on logging users in via github, facebook, many others, and yes also google. It's up to the firebase dev to config that.

</comment></comment></comment><comment><USER13> I was gonna write a long post about how Google just doesn't get it, but I think I give up.

<comment><USER14> The 4th most valuable company in the world after only 17 years "doesn't get it"? Yes, you should give up.

</comment></comment><comment><USER15> I think it is pretty fucked up that google is bundling their free email, storage and suite of office products with their free/low cost nosql database.

There just aren't any noSQL options out there right now.

<comment><USER7> "whoosh"

[hint for ESL folks: the adjective "free" used twice]

<comment><USER15> Haha and people ask why I use satire tags when it is "obvious". Also, a good hint was the lack of noSQL options in the marketplace....</comment></comment></comment>


To Stop Cheats, Colleges Learn Their Trickery - <AUTHOR> http://www.nytimes.com/2010/07/06/education/06cheat.html

<comment><USER2> Single page: [http://www.nytimes.com/2010/07/06/education/06cheat.html?pag...](http://www.nytimes.com/2010/07/06/education/06cheat.html?pagewanted=all)</comment>


IE 6 support being phased out for Google's docs and sites apps - <AUTHOR> http://googleenterprise.blogspot.com/2010/01/modern-browsers-for-modern-applications.html

<comment><USER2> If only they would stop supporting IE6 on google.com.</comment>


"There will be no Typelevel event @Lambda_Conf if [Yarvin's] invitation stands" - <AUTHOR> https://twitter.com/typelevel/status/713042825802178560 <comment><USER2> There is obviously no unanimous opinion on how bad he is, _even if_ most people agree it is some shade of "bad". And therefore if we start banning on non-unanimous cases like this, we run a terrible risk.

For example, people that support abortions and people that eat meat are both considered (by different people) to be supporting murder by significant parts of the population. Not figurative murder, literal murder. They feel strongly about that. But we shouldn't let them ban people, or we'll have "A functional programming conference for liberals", "for conservatives", "for vegans", etc. Is that what we want?

And that's just the practical risk of fracturing our communities. The moral risk is that even if we did have unanimous consensus to ban him over personal political views, we are in dangerous territory. The majority has been wrong many times in the past. Tolerating a minority, even if its views (not actions) seem offensive to us, is generally the right thing to do.

</comment><comment><USER3> Good for them.

</comment><comment><USER4> Typelevel does a great job at destroying the scala community.

</comment><comment><USER5> A disappointing lack of professionalism on Typelevel's part, but fortunately such behavior is also self-limiting.</comment>


Show HN: I created a social network to share geotagged recipes - <AUTHOR> http://snapaliciousapp.com/

<comment><USER2> i'm a big fan of world cuisine and i really would love a web site (some might like an app) to browse recipes categorized by region / country. if all the recipes would go through someone who's good at cooking (or eating) and visitors knew that their meal will taste exactly the same -or the closest it can be- many people -including me- would pay for it. do one thing different than the others. almost every god damn recipe site on world cuisine made me upset.

another suggestion is there is not a single point on what snapalicious does. you gotta make a better landing page.

good luck with it.

</comment><comment><USER3> I like world cuisine. Couldn't tell what your app really did. Need a better landing page and explanations. Keep working, good luck!

</comment><comment><USER4> How can i view the recipe?

<comment><AUTHOR> Not all users share a recipe for a dish. If there is one you can see it. See here: [http://snapaliciousapp.com/posts/A98UiSGCzw](http://snapaliciousapp.com/posts/A98UiSGCzw)

<comment><USER4> y dont you start paid recipes. Atleast users will share recipe if they are paid</comment></comment></comment>


Show HN: Simple Hash Table Implementation for C - <AUTHOR> https://github.com/watmough/jwHash

<comment><AUTHOR> I know this is pretty simple, but I never ever did at any point implement a hash table, just went more or less straight to programming in Assembler in a semi-mature system, then to MFC on Windows since about 1998.

Performance-wise, my single-threaded test runs about 6 times faster than the equivalent JS, which puts it in the C ballpark.

I _was_ really pleased about the performance under multi-threading. With 4+ threads, it's near to being 4 times faster, and the bucket lock only spins occasionally (prints a few '.' but still works).

</comment><comment><USER2> I'm currently using [https://github.com/attractivechaos/klib/blob/master/khash.h](https://github.com/attractivechaos/klib/blob/master/khash.h) in professional projects. I know it's pretty much full of macro "magic" (well it's readable so not really..) so that makes some people scared. I really like these header file "libraries" and am also a big fan of BSD's sys/queue.h

<comment><AUTHOR> Yeah thanks, I'm on OS X, and stuff like timersub is coded in sys/time.h

I'll check out sys/queue.h

<comment><AUTHOR> Thanks a bunch for that, khash looks really interesting, and it does what I kinda wanted to do, but didn't really realize was possible.

Suddenly, the C preprocessor doesn't seem quite as far distant from C++ templates as I'd thought...

</comment></comment></comment><comment><USER3> Cool! Hashtables make for a fun project, to be sure.

Also worth checking out is uthash[1], which has been around for ever. It's a single header file include, full featured, and pretty bulletproof.

[1][https://troydhanson.github.io/uthash/](https://troydhanson.github.io/uthash/)

<comment><AUTHOR> Ahhh, thanks for that. I will take a look.

Definitely interested to see how other people handle some of issues with threading, hash-collisions etc., and also how to best build code that'll run out of a single header file.

<comment><AUTHOR> Yes, there's definitely some stuff in there I hadn't thought of like how to handle strings as char[xxx] vs string ptrs.

Thanks.

</comment></comment></comment><comment><USER4> Looks fun. A couple of minor comments:

* The copystring() function looks like you re-implemented strdup() from string.h.

* The call to malloc() followed by a call to memset() to zero it can be replaced with a call to calloc(). This is faster on some platforms, and makes for cleaner code.

<comment><USER5> Because strdup() is not standard _enough_ to rely on. You have to test all sorts of magic values to pull it in, then you have define it yourself for those cases where it isn't defined. Why bother? Just write you own equivalent.

<comment><USER6> If you're not running on POSIX.1-2001, you're not likely to have pthreads or GCC builtin functions.

<comment><USER5> If you specify -std=c11 you won't get strdup().

</comment></comment></comment></comment><comment><USER7> I use uthash:

[https://github.com/troydhanson/uthash](https://github.com/troydhanson/uthash)

You can compare performance with it and other C hash table implementations.

</comment><comment><USER8> It seems like all the hash implementations I've seen have an insertion rate of ~Million/sec. I wonder if it's possible to get at least an order of magnitude faster (single threaded). Are we close to the input string parsing at this rate? Would sorting/caching help a lot?

</comment><comment><USER9> Neat looking code! I've been looking for something like this. Will try it! I find it a lot more readable than the usual "header-libs"

</comment><comment><USER10> I've never implemented one but the origin of Ruby's won me over with nostalgia. [https://github.com/ruby/ruby/blob/trunk/include/ruby/st.h](https://github.com/ruby/ruby/blob/trunk/include/ruby/st.h)

</comment><comment><USER11> Nice.

I'll just add, any sane implementation of make should already define $(CC) for you.

<comment><AUTHOR> There's some issues on my copy of OS X with getting a working gdb, which I needed on something else I was working on ... hence the manual def.

</comment></comment><comment><USER12> It is bad that you can insert an integer and then if you try to read the value back as a string, it'll happily interpret the integer value as a char *.

<comment><USER6> Not really. If you don't know if you're dealing with integers or strings, you shouldn't be writing C anyway.

<comment><USER12> [First of all, what's the deal with the anonymous upvoters bringing my previous comment, which _is_ against the guidelines for Show HN, back into the black? Bad comments should go to the hell where they belong!]

If you're dealing with integers or strings on a key-by-key basis and can statically predict as a function of key whether it's an integer or a string, you shouldn't be using a hash table, you should be using a struct or two hash tables, one with the integers and one with the strings.

If you're dealing with integers or strings on a key-by-key basis and can't statically predict whether it's an integer or string, you'll need some mechanism for ascertaining that and the best way is for the hash table to store and expose that information, because you'd be storing it elsewhere anyway. You _could_ expose the underlying tagged union.

If you're not dealing with integers or strings on a key-by-key basis (I guess you're dealing it on a table-by-table basis, which is a more likely usage, I hope), you just want to avoid duplicating code. There's little harm in having a tag and doing a run-time check anyway. Also, if you don't want to do that, you can make one underlying implementation, and then wrap it in types "struct hash_string_int" and "struct hash_string_string," and the like, and permit only the right kind of methods to be called on the right structure type.

It's never the right thing to do to make needlessly risky code -- if that's how you like to code, then _you_ shouldn't be writing C.

</comment></comment></comment><comment><USER13> That is an excellent documentation in the README. Even though I do not know C, I immediately have a clue of how to use this lib.

</comment><comment><USER14> Would be nice to see a comparison with std::unordered_map<>, both on the performance and usability side.

</comment><comment><USER15> Very cool. Reminds me of my grad school days when I was implementing cuckoo hashing on a cell processor.

</comment><comment><USER16> repost: [http://www.reddit.com/r/programming/comments/3692g7/simple_h...](http://www.reddit.com/r/programming/comments/3692g7/simple_hash_table_implementation_for_c/)</comment>


SnapChat: Saying It Doesn't Make It So - <AUTHOR> http://www.builtinchicago.org/blog/snapchat-saying-it-doesnt-make-it-so

<comment><USER2> What? If you wanted to make snapchat more successful then there wouldn't be a medium at which your snaps would go through. A one way encrypted app would send the picture to one party. I wouldnt expect the nsa not to be able to see them... at least in time. I made snap-wall.asmallgrin.com and check out /send.html for some fun.</comment>


Announcing Flattr Plus [Flattr and AdBlock Plus] - <AUTHOR> http://blog.flattr.net/2016/05/announcing-flattr-plus/ <comment><USER2> No, do not want! Flattr's main problem is already that it's far too easy to game, and if you give in and click on everything, you dilute your contribution to the things you actually care about. Replacing the ad with a flattr button is good - in fact it's great! but auto-clicking that for you - no! Let's not replicate the clickbait economy.

</comment><comment><AUTHOR> Some more info in Swedish in this interview: [http://www.idg.se/2.1085/1.657431/flattr-adblock- plus](http://www.idg.se/2.1085/1.657431/flattr-adblock-plus)

</comment><comment><USER3> The "ideals" [...] "of making the web a cleaner place" by blocking ads except for advertisers who paid the blocker is, _very_ dirty.

What seems to happen here is the "pay-for-everything-you-will-access" paradigm, and it is frightening.</comment>


Frontend: The web visual editor - <AUTHOR> http://www.kickstarter.com/projects/emoriz/frontend-the-web-visual-editor Kickstart campaign for the most advanced open-source web editor for your browser. <comment><USER2> A shameless plug for my own similar open source project with an already functional version [http://www.brickseditor.com/](http://www.brickseditor.com/). It uses Bootstrap for the layout but there are plans to support other frameworks. It's built on AngularJS. I'm currently working on it full time. Maybe there could be some way we could collaborate if this Kickstarter isn't successful?

<comment><USER3> Very nice! Yours is much more than just a front-end editor, yours create complete apps.

EDIT: And yours is not MIT licensed and has separate commercial licenses.

<comment><USER2> The goal is to allow make the whole development process, from prototyping to deployment, easier.

It's AGPL. The commercial licenses are for people or companies who may want to modify it without releasing their modifications back to the community. If they don't want to contribute their code, they will at least contribute financially.

<comment><USER3> It really does, just don't over-complicate things and add support for plugins and it will be perfect!

Do the commercial license cost 299$ per year? Is it limited per install, or company-wide?

<comment><USER2> Support for plugins is high priority!

It will be per install. I just put that price as a baseline. It will be adjusted depending on the needs and use cases. If you would like to talk about it in depth, shot me an email.

</comment></comment></comment></comment></comment><comment><USER4> It pains me to see how he repeats the same action for each subtitle-block element, doing the same thing 3 times total. Imagine you had a scrollable area with 20 blocks.

If it's a mockup editor, then it should be easy to customize from JS to make anything useful from the mockup.

If it's a site builder, better add support for templates, so that one would then be able to drag and drop data (e.g. json) onto the canvas and bind it to a template to automatically populate a whole set of elements at once.

P.S. No matter how slick your UI is, if it's not programmable, it's not useful.

<comment><AUTHOR> The system has a code editor for your convenience @alco. I will try to make that more clear.

Also, you will be able to select multiple elements and parent elements and apply the same actions.

</comment></comment><comment><USER5> Although Frontend is impressive, the target market is a bit blurry. As a front-end developer, I don't see myself using such a tool. And non tech-savvy people would probably feel a bit overwhelmed and would still have issues designing a decent layout considering it's not their job.

For some time, I've had in mind a service where people could easily build their websites. A bit like Squarespace (which is amazing) but with a different interface. For many clients who only need a homepage, a contact page, an about page, and some content pages, I usually end up building a custom WordPress theme because its admin interface is efficient and user-friendly, and because I have much experience in it. But still, I don't consider it the best tool for the job.

I'm not a great programmer, but I have UI, UX, and front-end skills. I'll probably try to develop a workable draft of this app I have in mind, but if anyone is interested in building an easy-to-use platform for non tech-savvy people, feel free to contact me. I have some ideas about how the workflow should be and what features it should have.

<comment><USER6> I am working toward a similar goal with my open source project (respondcms.com): allow the developer/designer to focus on design while allowing the end-user to focus on creating content.

<comment><USER7> I have been watching on this CMS for some time, great job!

<comment><USER6> Thank you. It is always a work-in-progress, but it (hopefully) gets better with each release.

</comment></comment></comment></comment><comment><USER8> Looks cool. But nothing related to Photoshop. They can say this something like iWeb or DreamWeaver, but not Photoshop at all.

</comment><comment><USER9> Bro, do you even Bootstrap? Edit: Sorry, it's not Bootstrap, it's their own framework. Though visually it's very similar.

But seriously, I'm not sure who this is for. It looks like there's quite a technical hurdle to setting it up - node.js and vagrant aren't easy to install for a novice user, and they aren't suitable for any shared hosting environment that I've come across.

I imagine (possibly incorrectly) that the market for simple point and click interfaces wouldn't necessarily overlap with that of people who are comfortable setting up complex hosting environments.

Now, as an online subscription model, I think it could be quite competitive. That's an entirely different route which definitely has a market.

<comment><AUTHOR> Hey jwarren. Thanks for the comment.

Online system is definitely an option down the road.

About the setup. Basically the only thing you need to install is vagrant. The Frontend VM has all the files and tools required to run the application on your machine.

1\. Install Vagrant (with our installer);

2\. Run VM

3\. You are ready to go.

</comment></comment><comment><USER10> The open source part of it is cool, but i still have a couple of issues with it:

\+ why do you need 75K as a minimum ? Sounds a bit high, even for 2 people

\+ They say its built with node, but what about the frontend of frontend ? Only jquery ?

\+ does it support bootstrap or other layouting frameworks?

\+ when will they let people contribute to it ?

Id really like something like this being open source, but in that case i feel it would need some more flexibility to be integrated into CMSes and Frameworks. Abstracted reusable components to plug it into existing systems, some kind of Content Repository integration for versioning etc. If thats the plan, ill fund in a heartbeat. If its meant just as a downloadable tool to built basic websites it wouldnt have much appeal to me though.

<comment><USER11> It is a CMS in itself. How is 75k high for two people? Are they supposed to commit to living below the poverty line?

<comment><USER12> In which country living with $75k is living below the poverty line exactly?

<comment><USER13> As I understand it, that's for 2 devs. Subtract the Kickstarter fees, sending out the Kickstarter rewards, and various taxes, that leaves them with maybe $20k per person. Of course, that number is meaningless by itself, not knowing how long it will take them to complete the project. If they devote more than a year to the project, depending on where they live that's not a lot of income.

</comment></comment></comment></comment><comment><USER14> Have you seen Webflow[0] and Froont[1]?

[0] [https://webflow.com/](https://webflow.com/)

[1] [http://froont.com/](http://froont.com/)

<comment><AUTHOR> Yes, they are great. I have met with the Webflow team (great guys).

The differences:

1\. Frontend is open-source;

2\. Database integration;

3\. Plugins (components) create by users;

Other differences will appear on the stretch goals.

</comment></comment><comment><USER11> Do the components include back-end Node.is code also? If so I really hope your project becomes popular and is open source. Because I think that developers should code components not UIs or reinventing Crud or email sign up forms. So this is the right direction for developers not just designers or novices. The popular approach with a lot of manual code for basic things like layout and other things is very dumb. Components are the way to go.

<comment><AUTHOR> Components should be easy to plugin on the system using any available APIs out there. Facebook Login, Twitter Feeds, Database integration, etc. Our goal is not to build a simple visual editor. We want to create an ecosystems for developers, designers, and regular users. This is just a "kickstart".

</comment></comment><comment><AUTHOR> Hey everybody. Please give a second look over the project. We tried to make clear the differences between Frontend and the other options out there. Let us know about anything we can improve on the Kickstarter page. Thank you.

[http://www.kickstarter.com/projects/emoriz/frontend-the- web-...](http://www.kickstarter.com/projects/emoriz/frontend-the-web-visual- editor)

</comment><comment><USER15> Webflow, an existing product, is much more powerful and pretty affordable. Macaw, if it's as awesome as it looks in the demo, may be better than Webflow.

This, this is thoroughly underwhelming. Sorry.

If open source is your biggest differentiator, I think you should emphasize this. Being able to use this as a part of other environments would make it much more compelling. Maybe change up the kickstarter page?

<comment><AUTHOR> Webflow is great and Macaw seems amazing, but let me try to make the difference clear here:

Frontend vs Webflow:

1\. Frontend is open-source (as you mention);

2\. Frontend has a databased integration (ORM);

3\. Frontend let users create their own components and templates and plugin on the system;

4\. You can develop locally (for speed) and push projects to the web whenever you are done;

6\. You can host frontend on your own server online and deploy projects from there;

Frontend vs Macaw:

1\. Frontend runs on the browser, there is not "preview" process;

2\. Frontend is open-source;

3\. Frontend let users plug their own components and templates;

4\. You can develop locally and push projects whenever you are done;

5\. You can host frontend on your own server online and deploy projects from there;

6\. Frontend is responsive (mobile ready), with Macaw you need to check if your project will work on mobile first (and on tablet);

More differences will appear on the stretch goals.

Thank you for the comment.

</comment></comment><comment><USER16> 1.How is it different from macaw or Adobe Muse ? 2.I did not understand why are you using a custom web framework xtyle , instead why not go for Bootstrap ?. Its already used by millions and you also save a lot of time. 3.Components feature sounds exciting , but how much similar is it to angular directives. 4.What is target market ? front-end developers or non-tech people?

<comment><AUTHOR> Macaw and Muse are commercial tools. Frontend was created as an open-source alternative.

We use xtyle by default, but you can for sure use Bootstrap (its your choice).

Components are anything you can plugin on the system (including directives if you are an Angular developer). The target market are front-end developer, designers, and non-tech.

</comment></comment><comment><USER17> This is Microsoft Frontpage all over again.

I'm sure they will have market: people who don't have the money to contract serious developers, and some novel developers who may like this idea, but in the end, I think it's a product with few possibilities.

</comment><comment><USER18> Looks to me like it works pretty much just like Squarespace (except self- hosted and open). The way Squarespace makes it easy for non-web-designer folk to put together nice-looking websites is excellent, so it's a good model to work from.

</comment><comment><USER19> It irks me that this is called Frontend. It's not, it's design. Call it Design. Or Frontpage 2013. Whatever. Frontend is a development skill, which requires intricate knowledge of markup and javascript languages/frameworks.

<comment><USER20> Oh come on. "Frontend" isn't a skill. It's a piece of software that makes interfacing with another piece of software easier.

There have been frontends long before there was HTML.

<comment><USER19> That's a fair point. I may have made the assumption that this was named after the skill.

</comment></comment></comment><comment><USER21> What about [https://rukzuk.com/en/](https://rukzuk.com/en/) ? Not open source but the only tool I found which has integrated CMS. Website says it's even extendable with custom code.

<comment><USER3> It's a really nice tool, but it's a SAAS - no go for us.

</comment></comment><comment><USER22> The reward structure is odd. For example, the 'super backer' $1000 level is limited to 200, yet the rewards given (e.g. The memory stick) are unlimited in the previous levels. Why artificially limit yourself to 200?

<comment><AUTHOR> You are right Joosters, thank you for your comment. We will work on the rewards.

</comment></comment><comment><USER23> This seems to be more or less exactly the same as [http://jetstrap.com](http://jetstrap.com)

<comment><USER11> Looks like its different because its not for building only front ends but actually fully functional websites on Node.us. and its open source.

</comment></comment><comment><USER24> The product looks amazing but the Kickstarter reward levels need to be rethought.

<comment><AUTHOR> I agree sycren. We are first timers on Kickstarter, but we will work on that. Thank you for the comment.

</comment></comment><comment><USER25> there are many of this apps already, and while there are a couple that are nice my question is: has anyone actually ever used any of this for something serious?

<comment><USER26> Yes but this one is slightly different being open source - it means (rather than everyone re-inventing the wheel) it can be integrated into Drupal, Wordpress, any other CMS... which I for one would be in favour of, as it would level the playing field again.

<comment><USER3> +1 for this excellent argument!

</comment></comment></comment><comment><USER27> Nice. What technologies are you using to build Frontend?

</comment><comment><USER28> If you have no ideas - create secure messenger...or web builder.</comment>


Is OpenOffice.org a Threat? Microsoft Thinks So - <AUTHOR> http://www.computerworlduk.com/community/blogs/index.cfm?entryid=2712&blogid=14

<comment><USER2> >What's of note here is not just the business about marketing programs and changing perceptions, but the fact that a key part of this "Linux and Open Office Compete Lead" position is "engaging with Open Source communities and organizations". This confirms what many of us have been warning about for some time: that Microsoft's new-found eagerness to "engage" with open source has nothing to do with a real desire to reach a pacific accommodation with free software, but is simply a way for it to fight against it from close up, and armed with inside knowledge.

I'm not seeing how A confirms B here.

</comment><comment><USER3> Maybe it will be in a few years when my generation has supplanted the current generation of decision-makers, but not now.

A short story:

My company has recently taken a liking to buying lots of netbooks for our roadwarriors. This is...fine, I guess. In my ideal world, they would all be running a stripped down linux distro with fvwm, thunderbird, firefox, and tn5250 (damn you, IBM)...but this is how the conversation went when I brought it up.

"Well...", the boss says apprehensively "I don't think so, they're not really familiar with that so let's just stay with what we've got"

"But there won't be anything different! I will make it look and feel exactly like what they're already used to. It will be faster, easier for me to fix when they're on the road and just simply better in every single conceivable way!"

"No...just leave what's on there on there."

"Fine...are they going to need MS office?"

"Yeah"

"Okay, you know that the license for that is like $300, right?"

"WHAT!?"

"Yeah, $300...as in more than we're actually paying for the netbook. Can I just give them thunderbird for mail and openoffice for office?"

"How much does it cost?"

"It's free."

"Free? Yeeeaaaaahhhhh....I don't think so."

/me facepalm

"Boss, do you understand that our mailserver, our fileserver, our firewall, our DNS server, our webserver, our database server, our VPN, and just about everything else other than the iSeries are _all_ running on free software?"

"Just get office"

\-----

So what is my point with recounting this little conversation I had? Openoffice might be a threat in the "college student looking for something to write papers with" market, but it isn't going to be a threat in the corporate world until it costs almost as much as MS office and changes its name.

People who don't know anything about a product will just look to the price. "This burger from McDonalds costs $1.29...the one from Applebees costs $12.99...the one from Applebees is surely better." and so-forth.

I _really_ wish there was a version of OO that I could buy for $150...then I would finally get to start using it and wouldn't have to deal with Outhouse anymore.

</comment><comment><USER4> I'm not really sure why this is hacker news. So Microsoft's hiring some marketers to look at OO? What did you expect them to do?

I hate how the author drags the old "they're infiltrating our open process" argument out again. Sun, IBM, etc., all profit from OSS and are given a pass.

To me, the real question is this: given that OO is free, _so what_ if anyone uses it? Sun's strategy seems to be to come up with a reasonable clone to MS Office and give it away. I don't understand what they're trying to accomplish: they're not monetizing it, so why does it matter if they're taking marketshare away from MS? And they're not even very good at that: they're mostly behind MS's featureset every release. So what's the benefit for them? Corporate goodwill?

<comment><USER5> Not only behind on features, but its buggy, slow and crashes semi-regularly. (I use OO at home and on my netbook, MS Office at work).</comment></comment>


Fewer mallocs in curl - <AUTHOR> https://daniel.haxx.se/blog/2017/04/22/fewer-mallocs-in-curl/ <comment><USER2> Meta-comment, curl is one of the few products I know that a) has authors who care about such low level tweaks and b) does a good job at presenting it all in a blog-readable format on a timely basis...either that or it's just Daniel.</comment>