Ubuntu Systemd Vulnerability - <AUTHOR> https://www.ubuntu.com/usn/usn-3341-1/ <comment><USER2> The most dangerous thing about systemd-resolved is that it exposes its own non-standard DNS resolution protocol over dbus, which the documentation recommends applications use instead of standard, interoperable protocols[1]:

> The native, fully-featured API systemd-resolved exposes on the bus. See the > API Documentation for details. Usage of this API is generally recommended to > clients as it is asynchronous and fully featured (for example, properly > returns DNSSEC validation status and interface scope for addresses as > necessary for supporting link-local networking).

systemd wants applications to depend on systemd-resolved so it becomes irreplaceable. This is very bad, because the first thing you should do on a system with systemd-resolved is uninstall it. The systemd developers are not qualified to write either DNS software[2] or C code that talks to the network.

[1] [https://www.freedesktop.org/software/systemd/man/systemd- res...](https://www.freedesktop.org/software/systemd/man/systemd- resolved.service.html)

[2] See [http://seclists.org/oss-sec/2014/q4/592](http://seclists.org/oss- sec/2014/q4/592), which came out after Lennart Poettering had the hubris to call systemd-resolved a "pretty complete caching DNS and LLMNR stub resolver"[3] even though the dangers of DNS cache poisoning were already well known at the time.

[3] [https://lwn.net/Articles/609740/](https://lwn.net/Articles/609740/)

<comment><USER3> Does anyone have any insight as to why systemd has its own DNS resolution API? That seems like a very strange decision. Is it really only so that systemd "becomes irreplaceable"?

<comment><USER4> It's more about dbus, really. They are trying to get rid of 'everything is a file' and move to a pub/sub service model.

<comment><USER5> "They are trying to get rid of 'everything is a file' and move to a pub/sub service model."

I thought we were trying to move _towards_ "everything is a file" ... isn't that the goal of the plan9/Inferno movement ?

I thought _that_ was the progressive direction in UNIX design.

We want to move _away from_ "everything is a file" ?

<comment><USER6> Everything is a file ≠ everything is a blob/adhoc plaintext interface.

DBus is a much superior "everything is a file" abstraction, except DBus calls files objects and doesn't special-case directories.

Quick comparison:

Inode — Client address

.. e.g. 3597293 — :1.32

Mount points — Well-known addresses

.. e.g. /proc/subsystem — org.foo.subsystem1

Directory/file hierarchy — Object hierarchy

.. e.g. /foo/bar/xyz — /foo/bar/xyz

Implicit RPC — Explicit RPC

.. e.g. IOctl or echo "foo" > /foo/bar — org.foo.Interface1.methodFoo(int, int, string)

Security

.. sudo vs Polkit

etc.

<comment><USER7> > Everything is a file ≠ everything is a blob/adhoc plaintext interface.

Actually, yes, it more or less means exactly that. Everything is a file means your interfaces (i.e. object methods) are generally limited to open, read, write, and close. Of course you can synthesize whatever you want on top of that, but the basic contract relies on those primitives exclusively.

<comment><USER6> And this is better how exactly?

<comment><USER7> Ever try to use a dbus service from the shell? From any language that _doesn't_ rely on a binding to the C library? Therein lies your answer.

It's like ioctl. The ioctl interface is an abomination precisely because it breaks the open/read/write/close interface. Ever try to use an ad hoc ioctl interface from any language other than C or C++?

If all the world used the same programming language with the same control flow constructs then a strongly typed RPC interface would make a ton of sense. But it doesn't.

The everything-is-a-file contract works well for the same reason that IP works well: because it pushes the complexity to the edges, and when the technology changes you don't need to upgrade every piece of middleware.

Almost every modern language supports open, read, write, and close from day 1, giving you the necessary primitives to communicate with anything supporting that model. Of course, maybe batteries aren't included and you have to do some grunt work. But that's often the interface designers fault. Opening a TCP connection on Plan 9 is as easy as a single open call, vs multiple complex system calls using a more typed interface like the BSD Sockets API.

Even dbus can be exported through the file model. Theoretically you could expose dbus through the filesystem namespace using something like FUSE. And, actually, here's an attempt at that: [https://github.com/sidorares/dbusfs](https://github.com/sidorares/dbusfs) Which goes to show how flexible the open/read/write/close model truly is.

<comment><USER6> > Ever try to use a dbus service from the shell? From any language that > _doesn't_ rely on a binding to the C library Therein lies your answer.

There are many libraries that do not bind to libdbus. GLib's, QT's and outside of C/C++ you have native python (txdbus), native javascript (node-dbus, which is btw powering the dbusfs you linked) and native C#/mono. That's just off the top of my head, I'm sure there are many more.

As for shell, I am not a fan, obviously, but qt-dbus (and the glib one) has existed for a long time and busctl is even nicer. Works just fine if you just need the client functionality.

DBus lends itself to something much more powerful like Microsoft's Powershell (but without the CLR). Bash is obviously designed for filesystem interface, it also is not a great fit for SQL. Doesn't mean SQL is shit.

> Which goes to show how flexible the open/read/write/close model truly is.

It's useless, not flexible.

Everything has some ad-hoc implied interface, documented who knows where, if at all, and this giant hack is somehow something to admire?

Garbage-in, garbage-out. I'll take DBus any day.

> Theoretically you could expose dbus through the filesystem namespace using > something like FUSE.

You can expose the filesystem via DBus as well (e.g. org.gtk.vfs). Shows you how flexible DBus is.

<comment><USER8> At this point in the discussion, I am reminded of [http://gentooexperimental.org/~patrick/weblog/archives/2014-...](http://gentooexperimental.org/~patrick/weblog/archives/2014-11.html#e2014-11-23T09_26_01.txt)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> A year ago, there was this:

[https://lists.dns-oarc.net/pipermail/dns- operations/2016-Jun...](https://lists.dns-oarc.net/pipermail/dns- operations/2016-June/014964.html) discussed at [https://news.ycombinator.com/item?id=11845051](https://news.ycombinator.com/item?id=11845051)

The 3rd bullet point is worth reading several times, in order to take in the absurdity of it all.

<comment><USER10> On the other hand, it improves safety and security for many users.

Because on most distros, using unbound or BIND9 as local DNS server, they bind to all interfaces, publicly.

Which is the reason why DNS amplification DDoS even is possible.

I've seen it often enough happen, and basically every person who's set up their own servers has made the mistake of leaving the defaults.

<comment><USER11> But who runs a DNS server? 99% of users only do DNS resolution and for that you don't need to run a DNS server on your system.

<comment><USER10> Many people run a DNS server to cache DNS responses locally. And they don't want to expose the DNS server publicly. systemd-resolved does that, you can't even expose it accidentally.

But many distros actually install a DNS server by default, usually unbound or BIND9, and while some bind it to localhost, many bind it to all interfaces.

As you said, that's not necessary for most users, yet, major distros do it.

<comment><USER12> Which distros install a DNS server (and enable it) by default? I've never seen this.

<comment><USER13> dnsmasq has been installed as a local DNS cache on Ubuntu and other Debian derivatives for many years. /etc/resolv.conf normally points at localhost.

<comment><USER14> It only listens on localhost though (127.0.1.1 by default), so it's not possible for it to be abused for dns amplification attacks.

<comment><USER15> IIRC dnsmasq still listens on all interfaces for some reason

<comment><USER10> Which is exactly the issue I mentioned.

You get on some distros by default something that that makes you subject to DNS amplification attacks.

<comment><USER15> It is supposed to reject requests from the _addresses_ it does not listen on. I just found it strange that it binds on all _interfaces_ regardless.

<comment><USER10> I've noticed it respond with an error packet – which ended up being used for DNS Amplification nonetheless.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> > systemd-resolved could be made to crash or run programs if it received a > specially crafted DNS response.

As nation states are hording zero days, and the security sheep herd insists updates are the way to go, I have never been more convinced that sticking to an OLD AND TRUSTED source code base for your infrastructure is the way to go. You can pop layers on top of that to get newer software running if you like, but trying to keep up with this psuedo-rolling-release avalanche of crap coming down the pipe is not a fair burden for administrators to handle. The devs need to shove it because we don't want it. I am hoping the next economic recession starves out the enthusiasm for disposable infrastructure and "move fast and break things" and businesses can go back to focusing on long term stability.

<comment><USER5> "I have never been more convinced that sticking to an OLD AND TRUSTED source code base for your infrastructure is the way to go."

I recently (2016) built a little network appliance for a specific task that needed to be safe and secure.

I used FreeBSD 4.11.

<comment><USER16> Are you sure it has no remote vulns since it's been discontinued or did I just prove Poe's law?

<comment><USER7> I think that's called security by obsolescence. Not sure how well that actually works. Root kits don't just disappear and FreeBSD 4.1 isn't as obscure as, say, VMS. But as long as there are no remote vulnerabilities it's probably no worse than a typical Linux install, in the sense that both would be trivially rootable once you get your foot in the door.

<comment><USER4> Usually with BSD you can apply new patches to old systems without any trouble. No need to upgrade everything.

<comment><USER7> Maybe FreeBSD is different, but I've run OpenBSD for 17 years and this is definitely not the case for all BSDs. Because OpenBSD is a cohesive system they're not afraid to do aggressive refactors. Which means subsystems can change drastically within just a few release cycles, meaning you can quickly lose the benefit of further fixes.

For example, just today Theo announced that he's staging the removal of TIOCSTI, the perilous ioctl that allows injecting data into a process group TTY. It's a huge break with historical BSD. That means if there's a TIOCSTI exploit found next year (say, in the NetBSD or FreeBSD code) that effects OpenBSD 6.0, there won't be an OpenBSD fix to backport; you'll have to craft one yourself and maintain it going forward.

NetBSD imported Lua 5.1 (IIRC, or maybe Lua 5.2) into their base, then in later releases upgraded it to Lua 5.3. the difference between Lua 5.1 and Lua 5.3 is like the difference between Python 2 and 3. Plus, Lua 5.1 is completely unmaintained at this point. If you're on an unsupported NetBSD release don't expect any fixes coming down the pipe for Lua 5.1.

But I admit that FreeBSD is definitely not OpenBSD, for better and worse, in terms of the pace of major refactoring work.

</comment></comment></comment></comment></comment></comment><comment><USER17> Current situation in Debian:

Jessie is not vulnerable.

Stretch is vulnerable (no patch yet), but systemd-resolved is not enabled by default.

[https://security-tracker.debian.org/tracker/CVE-2017-9445](https://security- tracker.debian.org/tracker/CVE-2017-9445)

</comment><comment><USER18> Is anyone else fed up of systemd yet? Increasingly Jack of all trades, master of none. Can we have something new instead? Or maybe Red Hat can put Pottering back in his holster?

I'm sick of Linux Servers I use, being "improved" with Desktop implementation in mind.

<comment><USER19> Yes. I've burned hours on systemd related problems that just didn't exist before. From DBus message delivery failures, debugging things that haven't broken for 20 years (which has incidentally got MUCH harder) to the whole shit crock that is NTP and locale management. That and the whole desktop buggery that has been going on for the best part of 8 years now has really put me off. To be honest you haven't really experienced systemd's fuckery until you have a hosed box. It's like negotiating a boot with a pigeon. Any other platform is ZERO hassle and that includes windows, OSX, freebsd, openbsd etc.

And you can't criticise it anywhere (watch the downvotes).

The problem is it lacks the mysterious as in _Zen and the Art of Motorcycle Maintenance_ class "quality". Merely glitter around a turd.

However we're stuck with it so it's suck it up or move on.

On the subject of moving on, you could run FreeBSD to run your servers. Much lower resource overheads, native ZFS, simple service management, some documentation worth more than toilet paper and the best thing of all, more sleep at night. Now there are binary updates and packages it's pretty easy. No more make world of any of that stuff.

<comment><USER20> _Any other platform is ZERO hassle and that includes windows, OSX, freebsd, openbsd etc._

I'd add Slackware to that list, at least for now. I've switched some servers to OpenBSD and a few others to Slackware, plus I've switched to Slackware for a laptop I use.

I'm cautiously optimistic that Patrick will keep systemd out of Slackware for the foreseeable future. It is after all one of the most BSD like Linux distros available.

<comment><USER21> Add Void Linux to the list, it uses runit.

<comment><USER22> Didn't Docker switch to using Void as basis for their container images?

<comment><USER23> No, alpine. But running systemd in Docker has never /really/ worked (except if you're running on RHEL because they have a bunch of patches to make it work) due to how much shit systemd does that makes it hard to run in a container. Even systemd-nspawn (their container runtime which runs systemd inside the container) doesn't work in a lot of cases.

LXC is the only runtime I'm aware of that actually runs systemd inside containers well, but they had to do a lot of unholy shit to play nicely with systemd.

runc has had countless issues with systemd thinking that it owns the system and it messing with container cgroups.

And don't get me started on the fact that cgroupv2 is specifically designed to only work if you have a global management process for cgroups (can you guess what management process that is?).

<comment><USER22> And surprise surprise, the current cgroups maintainer is a Red Hat employee.

I'm not saying it is planned, but i wonder if there is a echo chamber effect going on...

<comment><USER19> He who controls the spice....

<comment><USER22> In in this case, the source...

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Let's face it: systemd is a bad design... The solution I found: FreeBSD and OpenBSD !

<comment><USER25> But does not the FreeBSD project even more focus on memory unsafe languages (C) and is more monolithic then Linux distribution in general (userspace must match kernel).

<comment><USER26> No more so than a Linux distro does.

With the latter, you're referring to base. FreeBSD isn't really any more monolithic than your average distro in that regard though; it's just that with some services, the userland, and the like it (historically) made sense to maintain with particular stable versions of the kernel. Base is being slimmed down where possible though: bind has been replaced with unbound, dma is likely going to replace sendmail in FreeBSD 11, IIRC, and now that pkgng is proven, the process of packaging the base system should be complete for FreeBSD 12, which will allow freebsd-update to be (mostly) replaced.

</comment></comment></comment><comment><USER27> Memory corruption...

Someone would ask this sooner or later, so.. why is this written in C, really?

<comment><USER22> Nah, more like why do systemd include anything to do with DNS at all.

The shoggoth keep sprouting pseudopods as devs gets bored and think they can reimplement a time tested daemon in a weekend.

<comment><USER28> > The shoggoth keep sprouting pseudopods as devs gets bored and think they can > reimplement a time tested daemon in a weekend.

"Ph'nglui mglw'nafh Cthulhu _Raleigh[1]_ wgah'nagl fhtagn" ("In his house at _Raleigh_ , dead Cthulhu waits dreaming.")

1\. I'm so sorry, but I couldn't keep myself from punning Red-Hat-sponsored systemd with the Cthulu mythos. For the non-Lovecraft fans, the original city is named "R'lyeh"

<comment><USER22> Lovely. I actually confuse the two from time to time.

</comment></comment></comment></comment><comment><USER29> Debian without SystemD

[https://devuan.org/](https://devuan.org/)

</comment><comment><USER30> It only affect ubuntu's way of systemd that is discouraged by systemd's community

Some one called a title another systemd's vulnerability a click biat

Quote

Try to guess what title catches more clicks: 1\. CVE-2017-9445: systemd Hit By New Security Vulnerability 2\. CVE-2017-9445: systemd-resolved, which is not recommended on most systems and isn't used outside of Ubuntu Hit By New Security Vulnerability

</comment><comment><USER31> 16.04 is not affected

<comment><USER32> I bet init is also unaffected.

<comment><USER4> 14.04 used upstart (also used by chromeos). sysvinit was used in ubuntu prior to upstart, and there are some distros that use bsd style init. Go read up on init system options a bit more.

<comment><USER32> yes, i'm aware of bsd init, sysvinit, upstart, systemd et al.

systemd & upstartd all aim to replace pid 1/init. Which as far as i'm concerned anything beyond bsd init is over complicating things, and these are the results.

</comment></comment></comment></comment><comment><USER8> This is not CVE-2017-9217, note.

* [https://github.com/systemd/systemd/pull/5998](https://github.com/systemd/systemd/pull/5998)

* [https://news.ycombinator.com/item?id=14451642](https://news.ycombinator.com/item?id=14451642)

</comment><comment><USER33> Looks like you need to make a DNS request to a malicious server to be vulnerable. This means you are safe if you are using 184.108.40.206? Or another trusted network? (Or your ISP if you trust they haven't been compromised).

<comment><USER4> US corporations control the root name servers and seem to have no problem cooperating with government requests to fuck^H^H^H^Hkeep a close eye on everyone else.

<comment><USER34> K root is operated by RIPE NCC M root is opreated by WIDE from Japan

[http://root-servers.org/](http://root-servers.org/)

Use DNSSEC, it's pretty tamper proof, keys are in HSM and "geo distributed" ( [https://www.schneier.com/blog/archives/2010/07/dnssec_root_k...](https://www.schneier.com/blog/archives/2010/07/dnssec_root_key.html) ), the weak points are probably the facilities themselves in the US (one on the East Coast and one on the West Coast), but the trust anchor is pretty much fixed in the root servers, and it'd be quickly discovered if someone rolled a new one out of schedule.

<comment><USER35> DNSSEC does absolutely nothing to resolve the problem the parent commenter is referring to. In fact, DNSSEC _cryptographically ratifies the status quo_ of the most important TLDs being de-facto controlled by Five Eyes governments.

In years of watching for mentions of DNSSEC on HN, I can't remember off the top of my head a single case in which DNSSEC was introduced into a conversation as having some benefit where that benefit was real. It's weird what people believe about DNSSEC.

<comment><USER34> Please elaborate.

Parent seems worried about the root servers serving malicious responses for any given domain. (While assuming all root servers are under US control.)

In case of a non-US controlled TLD (.ru, .cn, .de, .eu) why DNSSEC is worthless?

</comment></comment></comment></comment></comment><comment><USER29> Debian without systemd: [https://devuan.org/](https://devuan.org/)

</comment><comment><USER36> Does this affect computers that did not ask for such packet (dns response)?

<comment><USER37> DNS is UDP so you might just get a broken packet sent to you, I guess?

<comment><USER38> Only if daemon is listening to the outside, which I _hope_ is not the case by default.

</comment></comment></comment><comment><USER39> The title is slightly misleading since it is specifically the optional (but installed by default on Ubuntu) systemd-resolved package (an ancillary package under the systemd name), not systemd the init system as I think many people will assume.

Edit: It seems Ubuntu builds it together with systemd so users have no choice. There may be a good technical reason for this, but I'm not sure what it is because it seems very user-hostile to remove choice like this.

Edit2: Upon further inspection this appears to be common practice, you just don't enable the parts you don't want. It would be nice if they could be put into separate packages or something of that nature though.

<comment><USER40> I don't exactly know why it's in the same package as systemd, but why do you consider it an user-hostile decision?

Unless you have so little storage you can't afford to have an extra binary installed in the system, there is no downside of having it on the machine.

You can still disable the daemon and switch to another one (like dnsmasq), as if it was in a different package.

<comment><USER41> Technically it's not a huge problem; politically, bundling unrelated software together means that the bundled software has an advantage and a tendency to get more market share than its competitors who compete fairly. In the case of open source distros, I'm sure that this isn't _illegal_ , but it seems like it isn't in the interests of the community.

<comment><USER40> Well, it's clear it doesn't compete fairly with the other daemons, because it's the default one since Ubuntu 16.10 [1]. So, bundling it with the systemd package doesn't harm anybody, because you'd have to install another package anyway to change the default.

[1] [https://lists.ubuntu.com/archives/ubuntu- devel/2016-May/0393...](https://lists.ubuntu.com/archives/ubuntu- devel/2016-May/039350.html)

</comment></comment></comment></comment><comment><USER42> "Rewrite It In Rust" should be the default, pre-set comment to every article about every vulnerability

<comment><USER43> Maybe every memory access related one. I assume rust still allows you to pass untrusted user input around, for example.

<comment><USER44> Oh yeah. Cross site scripting and SQL injections are still perfectly easy to write in Rust. You can accept a web POST and pass it directly, unquoted, to a local shell too.

</comment></comment></comment><comment><USER45> Who could have predicted that bloating PID 1 process could result in funny CVEs like this!

<comment><USER46> systemd-resolved is a separate process (not PID 1) that just was written by the same authors as systemd-the-pid-1.

<comment><USER47> Maybe there would be less confusion if they changed the name to something not including systemd, and decoupled the development and distribution of these clearly unrelated projects.

Then this DNS resolver could get the distribution and usage it deserves based on its own merits.

Of course, that's not going to happen, because the creators want systemd to be an OS by itself, with every buggy unreliable component standing as a monument to them only, and that means strong-arming in projects that could never compete with the existing working solutions on merits.

<comment><USER22> Effectively Freedesktop has given up on defining the Linux desktop by specification, and have switched to do so by canonical (heh) implementations.</comment></comment></comment></comment>


Medpedia's Health Platform Could Be Just What The Doctor Ordered - <AUTHOR> http://www.techcrunch.com/2009/02/17/medpedias-health-platform-could-be-just-what-the-doctor-ordered/ <comment><USER2> A professional, informative, non-trivial social networking. Let's wish it well. Techcrunch synopsis of the startup:

MedPedia is a free collaborative encyclopedia of health, medicine and the body. MedPedia has partnered with top medical schools and organizations such as Harvard, Stanford, Berkeley, U. of Michigan, American College of Physicians.</comment>


Imagining version control for APIs - <AUTHOR> http://clipperhouse.com/2015/12/20/imagining-version-control-for-apis/ <comment><USER2>
        Is there a form of static analysis that transforms source code into a normalized representation, such that two semantically identical programs with different source can be proved identical?

No, there isn't. Not in the general case. Solving program equivalence would also provide a solution to the Halting problem.

One way to prove this is as follows:

Given an arbitrary function, _f_ , we choose a number _x_ and define a function _f '_, which on input _n_ returns 1 if _n = x_ , and otherwise calls _f(n)_.

We now statically know that _f '_ halts on at least one input. If functional equivalence were decidable, then deciding whether _f_ is identical to _f '_ decides whether _f_ (which, recall, is an arbitrary function) halts on input _x_. That would solve the Halting problem. Thus, functional equivalence is undecidable.

You can design normalized forms which will tell you if _some_ classes of programs are functionally equivalent or not (and it's a darn good thing, too, or it would be impossible to do compiler optimizations), but any realizable algorithm for such must always have edge cases where it either gets the answer wrong, or has to output "I don't know".</comment>


Tesla warns 'self-driving package' buyers that activation is 'very far away' - <AUTHOR> https://electrek.co/2019/01/09/tesla-self-driving-package-buyers-regulations/ <comment><USER2> (posted this thought on reddit, but it works here too)

I did not buy FSD for my TM3 nor am I likely to do so in the future. However if they want to sell me on it then I suggest they show us its ability to recognize certain events.

I know some have said their car "recognizes" speed limit signs but mine never has. So when it comes to when Tesla wants to push this out and make money I hope they open up the simple examples that the car is aware of its surroundings. Like, showing the speed limit based on signage and especially recognizing school zone lights. As you come up to a signal it could replace the speed limit sign with an image representing the signal it detects and state. This can be simple as a stop sign but for a traffic light it would show what state it thinks its in.

I am in that camp Woz mentioned, Tesla has promised each generation was "it" only to have a new generation to become it. I am willing to wait for it to be IT

</comment><comment><AUTHOR> Note that TFA says this is due to regulations. The HN max title length is 95 and I had to shorten it.</comment>


I Hate Open Source Software - Why Open Source Sucks - <AUTHOR> http://www.grumpynerd.com/?p=132

<comment><USER2> Not everyone has the grace and skill of Maddox; this person, trying to emulate Maddox, being one of them.

</comment><comment><USER3> This is great.

"Open Source nerds don't have the discipline to write documentation because it's no fun. Writing new code is fun." - as I discovered when trying to learn how to use the last 2 open source frameworks I came across.

<comment><USER4> This would be a more compelling complaint if proprietary software generally came with detailed, clearly written documentation. Which most of the time it doesn't.

In the worst cases, the proprietary software vendor expects you to pay to get access to the kind of not-end-user-oriented-but-still-useful documentation (like an API reference) that open source projects publish for free.

In other words, it's not that open source software tends to be poorly documented, it's that _software_ tends to be poorly documented. At least with open source software you can go and look and the source code to figure out the stuff the docs leave out.

<comment><USER5> My complaint with a lot of proprietary documentation is that although it _exists_ , it's often almost information free...

E.g., for a function called "void ReverseDirection (x)", the doc says "Reverses the direction of X", without _any_ mention of context, possible issues, subtleties, ... just a mechanical statement of the obvious.

</comment></comment></comment><comment><USER6> This wouldn't be so hysterical if I didn't have a guy in my office that has made every single one of these arguments in the past.

and this gem:

>Flaviu Flav:

>Are you still wearing those clocks around your neck? Those were fly.

I love it when the lines between satire and reality blur into an indistinguishable smudge.

</comment><comment><USER7> I realized it's satire after this paragraph: "Well Grumpy Nerd maybe you're just not smart enough for Linux…"

<comment><USER8> It's not satire

</comment></comment><comment><USER9> To expand on the 2nd type of open source software - corporations love FOSS because they get a huge amount of value at little cost. FOSS coders undervalue themselves and should get paid what they are worth.

Don't believe that? Ask Apache how many companies that rely on httpd for their entire revenue stream have contributed anything at all.

<comment><USER10> > FOSS coders undervalue themselves and should get paid what they are worth.

I do open-source coding with a completely non-related day job to keep proficient and because I like building software. What should I bill per hour? Who should I bill it to?

As far as I'm concerned I'm already making value from my code, I certainly don't need others swooping in to tell me what I should and shouldn't charge for it.

</comment></comment><comment><USER11> This is so wrong it isn't even false. Direct experience contradicts every single assertion GrumpyNerd makes.

<comment><USER4> _Remember Ruby back in 2006? (Or just Rails if you're a cool dork) oh you couldn't turn a corner without some douche-canoe evangelizing the wonders of this horrible little fad framework and how it was going to revolutionize delivering software and services to the web and like the Segway Scooter of computer science… BAM in 2011 no one uses it._

Nobody was using Ruby in 2011? Really? _Really?_

It's not even worth going through and picking out all the mistakes, really. I feel bad about even having taken the time to pick out the one above. It's like beating up the fat kid on the playground.

</comment></comment><comment><USER12> Not sure if this is meant to be funny, but it is in any case

</comment><comment><USER13> Peasants,

Grumpy Nerd likes it when you link the indisputable brilliance of his blog from this shitpile of a website.

-Grumpy

</comment><comment><USER14> Is stupid not to use it given sometimes is high quality and it's free. There is nothing cheaper than FREE!

</comment><comment><USER15> I can't wait for his Metro review. As that article was year+ old -- his Metro rage shall be epic.</comment>


Elsevier journal editors resign, start rival open-access journal - <AUTHOR> https://www.insidehighered.com/news/2019/01/14/elsevier-journal-editors-resign-start-rival-open-access-journal <comment><USER2> Not too long ago, I had communications with Elsevier's technology team, and through that experience, I also spoke with some of their directors. Let me say that the experience was kind of mind-boggling and surreal.

My impression is that Elsevier is a company locked into the past by a couple of decades. The leadership that I spoke with seemed to have worked in publishing for a very long time. And, probably because of that, they had an old-school publishing mentality with regards to how to reach their customers, provide value, and create revenue.

I sensed that many in the technology team seemed frustrated with their leadership. They had new visions for how to evolve the publishing model to reflect the rise of sci-hub and changes in the industry. However, they were stymied by a very bureaucratic, well-entrenched, and siloed organization.

I expected that the leadership would have some strategy for dealing with this, but it seemed like they were aloof, probably grown fat from decades of near- monopoly. They had a net profit margin of 37% in 2017! Talk about a business ripe for disruption.

Elsevier has been around a very, very long time (wikipedia says 1880), and it shows. I can't imagine getting anything done within that company. So, it's no surprise that some of them are finally leaving to try out a new model. Let's hope for the best.

<comment><USER3> Who reads all these journals? Let alone pay for them...

<comment><USER4> mostly academics in the relevant fields, largely paid for by the institutions they work at

<comment><USER5> Institutions in turn funded by some combination of the state, undergrads, or endowments.

</comment></comment></comment></comment><comment><AUTHOR> I have so much respect for the editors who were willing to make this jump.

I've wondered if there is some cognitive dissonance between the strong feelings I have that scientific journals should be open access and my willingness to buy and use closed source software (even though I run an open source software foundation). But I don't think so.

Fundamentally, I think authors have the right to determine how their work is used. If they want it to be used and available as widely as possible, they should publish it under an open source license and in an open source journal. But when for-profit companies like Elsevier control the journals in which publication is necessary for getting tenure, they are restricting information flow and harming science with no countervailing benefits. Furthermore, many journal articles are supported by government grants, and it's just appalling to me not to have access to the results of research that I am paying for. (If not for [https://sci-hub.tw/](https://sci-hub.tw/) obviously.)

I'm optimistic that the author-pays model of funding copy editing will work out and that for-profit journals will be seen in another couple decades as akin to leeching and phrenology.

<comment><USER6> Except that leeching has benefits

<comment><AUTHOR> It does! I wondered if someone would point that out. (Though blood letting does not). [https://en.wikipedia.org/wiki/Bloodletting](https://en.wikipedia.org/wiki/Bloodletting)

<comment><USER7> Blood-letting also has benefits in some cases! For example, venesection is a standard treatment for haemochromatosis: [http://haemochromatosis.org.uk/haemochromatosis/treatment/](http://haemochromatosis.org.uk/haemochromatosis/treatment/)

</comment></comment></comment></comment><comment><USER8> Aaron Schwartz would be pleased to see this.

Elsevier, Springer etc. are just syndicates sitting between researchers and consumers.

They have no place in today's world.

<comment><USER9> Do you mean Aaron Swartz?

</comment></comment><comment><USER10> Journal of Computer Graphics Techniques recently published a breakdown of their costs hosting an open journal. Approx. $100 per annum ;)

[http://jcgt.org/news/2018-01-04-expenses.html](http://jcgt.org/news/2018-01-04-expenses.html)

<comment><USER11> Last year they published a grand total of 8 articles with the editorial staff doing the copy-editing, and web work for free. It is nice they are doing this but it isn't indicative of the cost of hosting/peer review/copy-editing more substantial journals.

<comment><USER12> As for "peer review", this has no cost: reviewers are not paid.

<comment><USER11> Facilitating peer review does have a cost. You would be surprised how much it takes to find referees that are both qualified to assess the paper and do not have too close of a relationship with the authors. Then there is the whole thing of getting them to file their reports.

</comment></comment></comment></comment><comment><USER13> The same thing happened with "Topology", now "Journal of Topology". After some years it was bought by Wiley and is no longer free...

A journal is not an easy task to manage.

<comment><USER14> Often, journals aren't founded by the current publishers but instead by people who do actual research in that field. Then, a publisher approaches them and offers them a lot of money. Who would decline such an offer?

You are right, this move might just be a strategic measure to get more money from the publisher.

<comment><USER15> That's not exactly the story with Journal of Topology. It's published by the LMS, which partnered with Wiley.

</comment></comment></comment><comment><USER16> > _Rooryck, who was editor of Lingua and now leads Glossa, said the most > challenging aspect of starting a new open-access journal is securing funding > to ensure it survives. He said Glossa is doing well and has more submissions > now than Lingua did. Lingua has been described as a "zombie" journal by some > scholars, but it continues to receive hundreds of submissions._

Is there a list of "zombie journals" somewhere? Would be interesting to see them all laid out.

<comment><USER17> Not really.

>Unfortunately, unless black and white lists are updated continuously, they can never keep up with changes in the publication industry. [...] So, the quick answer to the question 'where shouldn't I publish?' is that [...] researchers need to engage in critical enquiry and reflection about a potential publisher. This should not come as a shock – the same advice would have been true long before the end of Beall's List.

[https://ahrecs.com/research-integrity/world-hijacked- clone-z...](https://ahrecs.com/research-integrity/world-hijacked-clone-zombie- publishing-shouldnt-publish)

</comment></comment><comment><USER18> So, as an academic myself, I have been wondering. Why don't some tech-savy people (the kinds that roam around HN) create an open-source publishing platform and offer journals to use their services for free / cheaply? Something like a GitLab for publishing papers. I wouldn't be surprised if the German government would agree to fund such a thing these days. This would make such a jump for willing editorial boards much easier.

<comment><USER19> Recognition/prestige is what the journals offer. Hosting is incidental. Editing and reviewing too.

<comment><USER20> I mean, github does too. Some projects have 0 stars, some have 16k; some have 0 contribs, some have thousands; some have no forks, some have hundred. You know what I mean ? All these variables are a pretty good measure of recognition, I check them every time I add dependencies to my projects. And just like any other measure, it isn't perfect and is hackable in ways I haven't imagined yet.

Forks are similar to citations in a way. It's not the same, there are many differences, but there are some similarities in my opinion. By the way, wouldn't it be great to be able to contribute to papers, and their assets (figures, code, equations) ? I don't know how a system like that might work in practice, it must be non trivial to govern, like any other sizable community - but I can see how it could work.

Does science really need to pay for recognition and prestige today ? It used to be the these journals allowed more people to have access to quality research, now it restricts them. Non free journals are dead a parellel universe Nietzsche might write.

<comment><USER21> The number of stars on GitHub is significant because most people whose opinion you'd care about are on GitHub, they wouldn't star project that they were not interested in and there aren't widespread fake accounts.

I don't believe that there is an equivalent in academia, one that would capture the h-index dynamic (copied by PageRank) that a star from a prestigious professor is worth a lot more. It's trivial to build, but "growth hacking" for lack of a better word, is hard, especially in areas where actual growth hacking would be frowned upon.

That's why, for instance, Facebook celebrates its billion of users so much: it's genuinely hard to make that. Hosting them too, but not in the same way.

<comment><USER22> In case you're interested: I'm working with eLife and the Center for Open Science on creating something just like that. Having those two organisations as partners has really boosted the profile, leading to others jumping on board.

There's still ways to go, but I think we're on the right track. But you're right: it's really hard, and it took me a year to even get here.

</comment></comment></comment></comment></comment><comment><USER23> Hurra, Elsevier are a band of crooks, they have way more profit margin than giants like google and apple, science does good by moving away from them.

<comment><USER24> Basically we want a similar system but at rates where profit is c. 0 (zero) and wages are around the median?

But doesn't that translate to other "industries"? Or, is it recognition that science has a fundamentally greater importance to humanity ... it's that true though, arts are pretty fundamental too, medicine certainly is, housing, food, water supply, sewerage, ... Why do we accept rent-seeking and profiteering and excessive wages and whatever in these other things?

Aside: Seems to me "science must seize [some of] the 'means of production'" is pretty communist.

<comment><USER25> > Aside: Seems to me "science must seize [some of] the 'means of production'" > is pretty communist.

When the research is funded by the state it seems reasonable.

<comment><USER24> So only industries that get government support - like rail, electricity supply in UK? Food production in USA? Farming across the EU?

Then there's the premise that "private property is theft", so perhaps all industries that use land ownership or natural resources owe their utility to the public too?

</comment></comment></comment></comment><comment><USER26> The board's letter is linked in the article.

[https://www.documentcloud.org/documents/5683932-Resignation-...](https://www.documentcloud.org/documents/5683932-Resignation- Letter.html)

There appear to have been multiple complaints:

1\. Ownership of the journal is non-negotiable.

2\. Article Publishing Charges (APC) are non-negotiable. APC is the charge paid by an author to get an article published under the journal's current Open Access policy.

3\. Unwillingness to participate in an initiative to freely publish article citation data (I4OC): [https://i4oc.org](https://i4oc.org)

Many journals have instituted author-pays Open Access policies. In my view, this model is just as unsustainable as reader-pays (or more accurately, library-pays).

The crux of this entire problem is that nobody knows how much it really costs to run a journal in the digital age. Or at least they're not telling. I'm not talking about costs excluding unpaid volunteers. I mean the full cost.

I suspect the board of JOI will find out for sure. It will be interesting to see: (a) whether it charges APCs; and (b) if it does, how they compare to those Elsevier charges.

<comment><USER27> > The crux of this entire problem is that nobody knows how much it really > costs to run a journal in the digital age. Or at least they're not telling. > I'm not talking about costs excluding unpaid volunteers. I mean the full > cost.

I know you're asking about the full cost including the time of the people working for free, which you're right, is an impossible number to get. But I fail to fully see your point. The new journal that's going to be run by MIT Press isn't going to start paying editors and reviewers any differently than Elsevier (meaning not paying them).

To answer one of your questions, the article mentions they are indeed going to try to charge less for APCs ($600-800 instead of $1,800), and they're going to be fully OA, but those are the only major changes.

But to part of your question about the cost of publishing, PLOS publishes their financials [1], as does eLife [2]. eLife published 1,307 papers in 2017 and had total expenses of 5.3m GBP (~6.9m USD) for an average per-article expense of $5,244. PLOS published ~27,000 articles in 2016 [3] and had total expenses of $42.8m USD for an average per-article expense of ~$1,500. These of course aren't apples to apples comparisons, since what they're trying to do with this journal isn't the same as what PLOS does or what eLife does. But I think those are some good ballparks to understand what the range kind of looks like.

[1] [https://www.plos.org/financial-overview](https://www.plos.org/financial- overview)

[2] [https://elifesciences.org/inside-elife/50d52087/annual- repor...](https://elifesciences.org/inside-elife/50d52087/annual-report- looking-back-on-2017)

[3] [https://www.plos.org/files/PLOS-Annual- Update-2016-online.pd...](https://www.plos.org/files/PLOS-Annual- Update-2016-online.pdf)

</comment></comment><comment><USER28> This is awesome.

I'm working on something that would VERY much benefit from open access journals:

[https://getpolarized.io/](https://getpolarized.io/)

With Polar you maintain all your research in one place and can annotate and share with other users.

One thing I want to add is the ability to sync up with open access sources to fetch PDFs, get metadata for them, find related PDFs and research, etc.

Going to go heads down into this today.

<comment><USER22> You probably know about it already, but you'll probably want to use Unpaywall: [https://unpaywall.org/](https://unpaywall.org/)

It catalogues Open Access links given a DOI, provides an API, and also provides links to direct PDFs (or web pages containing the complete article, if available).

</comment></comment><comment><USER29> Making academic journals more accessible is a problem that I've been working on the last few years with my project, Scholastica. We provide software that allows journals to manage their entire toolchain from peer-review to publication.

Homepage

[https://www.scholasticahq.com](https://www.scholasticahq.com)

Two journals that use our software: [https://www.surveypractice.org](https://www.surveypractice.org) (OA journal published by American Association for Public Opinion Research)

[https://discreteanalysisjournal.com](https://discreteanalysisjournal.com) (arxiv overlay journal started by Fields Medal winner Tim Gowers)

<comment><USER22> Heh, I mentioned you above :)

[https://news.ycombinator.com/item?id=18921700](https://news.ycombinator.com/item?id=18921700)

<comment><USER29> Thanks, I really appreciate it :D

</comment></comment></comment><comment><USER30> There seems to be an even more effective solution to closed journals than just telling scientists that if they take money their paper needs to be in an open journal.

Also tell them that when they apply for funding only scientific research which is available in open journals will be considered.

You'd then get people not only submitting new research in open journals, but making all their backlog available as well to increase their odds of getting funding.

That would chip away even more at the moat of companies like Elsevier since presumably much of their funding is from universities who'll need access to historical research for a _long_ time.

<comment><USER31> One problem this does is it shifts the costs of this to individual _projects_.

In my field, the average OA field is probably around $3000.

Assuming a five year project that produces 5 papers a year (not unreasonable), you get $75,000.

That's almost exactly what it costs, with salary, tuition, and fringe, to support two graduate students. So funders would have to accept getting _less_ productivity from the same projects.

It also favors large labs with senior PIs that have the funding to absorb those costs.

<comment><USER27> Your lab only has to pay grad students $7,500 a year? Seems like that might be the number that's out of whack in the equation. To be fair, I live in the Bay Area, where $7,500 only gets you like 3-4 months rent.

<comment><USER31> ^For a year. Which is still a significant loss, but yeah.

</comment></comment></comment></comment><comment><USER32> If you have the means to do so, can I suggest you sponsor one paper that you like to support for open access? It's $600m, which is a significant sum, but if you feel that your career has been helped in a significant way by research performed by others that freely available to you, and if you have the means to do so, this would be a good way to start giving back to the community. Now I just wonder if any of the journals allow such individual contributions.

</comment><comment><USER17> JOI is a great journal. I hope they manage to keep QSS top tier.

</comment><comment><USER33> I had a crooter approach me about a software position at Elsevier once. I told her no, and that you can't spell Elsevier without E-V-I-L.

</comment><comment><USER34> As a shameless plug, we are hiring right now (we're a small remote team) working on this exact problem - neliti.com/careers

</comment><comment><USER35> Imagine if they had signed the ubiquitous non-competes we have in the tech- world outside California.

</comment><comment><USER36> Elsevier has editors?

</comment><comment><USER37> This is great.</comment>


Snakes on the Web - <AUTHOR> http://jacobian.org/writing/snakes-on-the-web/ <comment><USER2> > This usually breaks down as follows:

> You develop your first little toy app using Framework X.

> ...

> Then one day you become Twitter, and all hell breaks loose.

Really? Web apps _usually_ become Twitter? I agree that knowing how to scale a web app is important, and that it's not always exactly straightforward, and that it could be made easier with some better tools. Heck, I even gave a talk at PyCon about it (<http://www.polimetrix.com/pycon/slides/>).

However, statistically speaking, almost zero percent of web apps end up like Twitter. And if they do, they have VCs knocking down their door so hard that they can afford to hire enough engineers and buy enough hardware that scaling won't be an issue for long. That's a problem we'd all love to have.

Not that we shouldn't continue to improve our server-side technology, but 99.9% of my pain developing web apps these days is due to client-side issues. The stuff that runs on the server usually Just Works and is an absolute pleasure to code.

<comment><USER3> _hire enough engineers and buy enough hardware that scaling won't be an issue for long_

I don't know about that. Twitter is _still_ having problems with downtime due to scaling. The way I see it: don't completely ignore scaling, but don't focus on it (at all) at the beginning. Keep it in your mind though, and try not to close yourself in, and create something which can't be scaled without significant modifications to services. Do not confuse that with modifications to your code. If you're going to scale large, expect at least one complete re- write, but don't offer services which are incapable of scaling.

</comment></comment><comment><USER4> Does anyone have thoughts about the utility of cappuccino for web app development where you load a GUI and then do all your state control for each [user not model perspective] entity via rpc to the server? I haven't tried it yet but expect this will be easier because you can bypass much of the grunt work of templating, and you don't have to deal with the back button issues either. I think the back button maps OK onto entities (i.e. get the user to link if they're going to a new booking) but not state transitions within an entity (i.e. if they add a person to the booking then there's no need to provide back functionality).

"The big problem, though - the elephant in the room - is that gateways suck, too. Gateways aren't APIs." Too true.

On python - the python critics could fork, stick in the features they want, and benefit from the libraries. I'd have thought this would be a better starting point for a new language in that direction than a blank canvas. I admire clojure for similar reasons - find a VM and leverage it.

<comment><USER5> That's definitely what I'm considering for a (future) web app.

Rich front end in cappuccino, talking basically to a bare web api on the back end.

</comment></comment><comment><USER6> Very helpful! A web app recently jumped into my hobby project hopper, and the last thing I can remember of web work is CGI--and it's all new and shiny the way I remember it, too. I knew that was a bad sign, I knew I was so out of touch that I didn't even know what questions to ask . . . but I didn't realize a whole generation had come and gone without me.

I've _got_ to start paying more attention.

</comment><comment><USER7> the house analogy breaks down when you consider that you can build a house to look like anything and it doesn't have to interface with anything else, like your neighbors' houses.

a web application has to interface with standard browsers and protocols, so maybe it's like a car that has to operate on standard roads and can't take up 2 lanes or fly.

<comment><USER8> Actually, the things houses have to 'interface' with are so standardized you don't even think about it. Appliances, plumbing fixtures, computers, furniture. Everything is standard sizes, so they fit through doors, plug in and hook up properly.

Lumber dimensions, electrical connections, even door sizes are standardized.

</comment></comment><comment><USER9> _"Web development sucks."_

Yes. It's so practical compared to old-school GUI development, and so it pulls you in and mushrooms into a scaling/integration/maintenance fiasco unless you can say "no no no!" to every non-essential feature. Things like Django, JQuery, HTML5 are app-level improvements but we're still asking too much of our feeble software infrastructure.

Step back, ask what we're trying to do with the web (decentralized computing?), and come up with a system that solves the basic UI/OS/protocol/language needs "once and for all". Implement it as a kludge on top of the web; use and refine; discard the web; discard the old OSes. It's a pretty tall order :-)</comment>


MikeOS - simple OS you can use for learning about how OSes work - <AUTHOR> http://mikeos.berlios.de/

<comment><USER2> Other good ones:

eCos - it's an embedded system used in the real world, so it's not _super_ simple, but since its aims are less universal, there is less code and therefore it's easier to follow what's going on.

Minix - this has really clear, readable code. I once needed a floppy driver for eCos and ended up porting the minix code, because the Linux and *BSD drivers were so hairy.

</comment><comment><USER3> This seems a little too primitive. If you want to learn about things like preemptive multi-threading, virtual memory etc... you might be better served looking at something like Minix or XINU. Not to mention that C code is going to be easier to wrap your head around than all assembler.

<http://www.cs.purdue.edu/research/xinu.html>

<http://www.cs.purdue.edu/homes/dec/xsoft.html>

<http://www.minix3.org/>

</comment><comment><USER4> This reminds me of CS 350...we used Nachos, here is a good walk through.

<http://www.cs.duke.edu/%7Enarten/110/nachos/main/main.html>

I got a good laugh from the marking scheme, I had forgot all about this:

      Normal  = (0.02*A0 0.10*A1 + 0.10*A2 + 0.13*A3) + 0.20*M + 0.45*F
      Exam    = (0.20*M + 0.45*F ) / 0.65
      Assigns = (0.02*A0 + 0.10*A1 + 0.10*A2 + 0.13*A3 )/ 0.35

      if ( Exam < 50% ) {
        Course Grade = min (Normal, Exam)
      } else {
        Course Grade = Normal
      }

Then on the first day of class they tell you if you fail the assignments, you fail the course.

I really enjoyed taking that course, it was very interesting material.

</comment><comment><USER5> I agree this is great for learning purposes, Assembler code looks like well documented, hopefully it will keep small as it is now, I think simplicity is the most important feature of this OS.</comment>


A Proposal to Add 2D Graphics Rendering  and Display to C++ [pdf] - <AUTHOR> http://isocpp.org/files/papers/N3888.pdf <comment><USER2> In the past the argument against putting things like this in the standard library was always that it is non-portable. C and C++ are meant to run on systems which do not even have a monitor, much less a GPU (think embedded). The logic was that standard library functions should work on all systems. That is also the reason why the "file system" API of ISO C/C++ is so severely limited. It is designed for the lowest common denominator. There are no functions for handling directories because of the assumption that some platforms do not even have directories. In fact the file system API does not even assume a hard disk but can be implemented by returning handles to RAM.

Now that this principle seems to be abandoned why not go all the way and give us a full GUI toolkit? That would be so much more versatile than just a 2D drawing API.

I do not see much use for this except maybe making ISO C++ tutorials more exciting because your programs can show something else than console output.

And I mean Cairo is not a simple framebuffer, it is quite complex so why not make another step and give us a full GUI?

I read that the C++ guys want a standard library comparable to those of modern languages like Java, C#, Python etc. and they all come with GUI support.

Oh, and before they even think about adding graphics they should beef up the file system API. That is an actual issue. Right now every piece of crossplatform C/C++ includes a wrapper around platform specific APIs just to handle something as basic as getting a list of all files in a directory. They want to give us vector graphics rendering before that?

<comment><USER3> If you check the working groups there are lots of APIs being worked on, including file system ones.

[http://isocpp.org/std/the-committee](http://isocpp.org/std/the-committee)

\- SG1, Concurrency

\- SG2, Modules

\- SG3, File System

\- SG4, Networking

\- SG5, Transactional Memory

\- SG6, Numerics

\- SG7, Reflection

\- SG8, Concepts

\- SG9, Ranges

\- SG10, Feature Test

\- SG11, Databases

\- SG12, Undefined and Unspecified Behavior

\- SG13, Graphics

Any modern language should have a "batteries included" set of libraries, even when targeted for systems programming.

<comment><USER4> > Any modern language should have a "batteries included" set of libraries, > even when targeted for systems programming.

I would argue the inverse: modern languages should have a lean standard library but a strong package ecosystem.

<comment><USER3> A standard library is a guarantee that all packages are supported in the target environments for the language.

Can you provide the same guarantee with a package system?

I don't what to target operating system XYZ only to find out the package does not exist.

</comment></comment></comment></comment><comment><USER5> I'm not sure about Cairo, but IMHO AGG is probably one of the best C++ libraries out there. Great use of C++ capabilities like templates. Too bad, development isn't active anymore.

AGG - [http://antigrain.com](http://antigrain.com)

<comment><AUTHOR> Oh shit, apparently the guy behind AGG, Maxim Shemanarev, died 2 months ago.

[http://beta.slashdot.org/submission/3154635/rip-maxim- sheman...](http://beta.slashdot.org/submission/3154635/rip-maxim-shemanarev)

<comment><USER6> I came across AGG very recently. Yes, several parts of the code are designed and implemented very well. Unfortunate that Maxim died.

</comment></comment></comment><comment><USER7> C++ needs _something_.

It's a bit embarrassing when someone used to the standard library from most other languages asks "How do I draw this picture of a cat" or "how do I print 'Hello World!' in red in a welcoming font" and you have to say, erm, well.. there is nothing in c++ for that. Maybe you can find a platform dependent library that will work for you.

It doesn't need a library to do everything, but something that lets you draw and write text to a window seems like something that should be available on every platform that can support it.

<comment><USER8> "Most other languages" seems like an exaggeration. I don't think you can do any of the things you list easily in Python, PHP (you wouldn't even want to in PHP), JavaScript or Haskell.

<comment><USER9> Python includes Tkinter for GUI programming. That said, Tkinter is pretty crappy compared to PyQt.

<comment><USER10> The number of users of Tkinter in Python is so low that I would seriously question its utility in the standard library. IDLE is the only piece of software that I know of that targets it, and it's quite underwhelming.

</comment></comment></comment></comment><comment><USER11> The motivation reads exactly like the xkcd comic on standards. [http://xkcd.com/927/](http://xkcd.com/927/)

The rest of the document reads like someone just discovered the Cairo library and wouldn't it be cool if we jammed this into our already overly-bloated standards document?

There is no all-purpose graphics library. What's good for games isn't necessarily good for rendering PDFs and vice versa.

<comment><USER12> _...wouldn 't it be cool if we jammed this into our already overly-bloated standards document?"_

I think C++ gets the most flack for being too complex and bloated. But when you compare it to Java and C#, C++11, the language (based on language specification word/page count), is smaller than Java and only a little bigger than C#. The C++11 standard library is _much_ smaller than both the Java 7 SE and the .Net (FX only) libraries.

Source: [http://media.ch9.ms/ch9/5c51/d30749f7-09d7-4266-bd57-d1d4461...](http://media.ch9.ms/ch9/5c51/d30749f7-09d7-4266-bd57-d1d446165c51/GN13HerbOneCpp_mid.mp4), just after 15 minutes in. Or [http://view.officeapps.live.com/op/view.aspx?src=http%3a%2f%...](http://view.officeapps.live.com/op/view.aspx?src=http%3a%2f%2fvideo.ch9.ms%2fsessions%2fgonat%2f2013%2fGN13_Sutter.pptx), slide 14 and 15 (see the top-right corner of slide 14 for the metrics used for the comparison (page/word count of the language specs). EDIT, for context: the speaker/author referenced is Herb Sutter, member of the C++ standisation committee, and one of the authors of the graphics proposal in question.

<comment><USER13> >But when you compare it to Java and C#, C++11, the language (based on language specification word/page count), is smaller than Java

I watched the presentation where Herb Sutter said that, and I think that claim is disingenuous, because the Java Language Specification is much wordier than the C++ spec.

For example, the section on integer literals in the JLS is 1.5 times longer (measured by word count) than the same section in the latest C++ draft. Is it because Java's literals are more complex than C++? No, it's because of things like explicitly listing the minumum and maximum numeric values of int and long literals (in each of decimal, hex, octal and binary)

In general, I think that the terseness of the C++ spec is not a good measure of the relative simplicity of C++.

<comment><USER12> Well I think the idea is that it is a good general metric which should average out over thousands of pages. Just because one section of the Java language spec is wordier than the corresponding one in the C++ language spec does not mean it holds for the entire document.

But I concede the point of complexity; the C++ spec is no doubt more dense. I just don't think it deserves to always be singled out as the most overly- complex/bloated language. The difference is not as big as the cliche would have people believe.

Also, the article is about adding to the standard library, which is _much_ smaller than Java's and .Net's, so invoking bloat is probably not appropriate in the context of the article.

</comment></comment></comment></comment><comment><USER14> Cairo is dual-licensed under the LGPL and MPL. Both of these are restrictive enough to make them incompatible with, eg., App Store terms. Yet the proposal does not seem to even mention the license (or maybe I just missed it).

The standards committee is conserned about portability, at least on a technical level. I wonder what their take is on portability issues caused by license terms.

<comment><USER15> They wouldn't be using the library code. They would just specify what have to be implemented based on the library. They have been doing this with all the libraries that they include in the standard (such as part of boost) and most of the time the resulted specification is way simpler and limited than the original inspiration. Also this is a design for implementation, once done each implementer have to decide how to make it real.

<comment><USER14> Boost has a very liberal license, unlike Cairo. C++ libraries, at least the GNU C++ library, have directly based some of their implementations on Boost.

This might lead to C++ library vendors not implementing the standard and requiring using a third party library, perhaps later integrating them into their own libraries.

Thinking about it, it is not probably a bad thing, it will just take longer than with other parts of the standard. Of course, this is just pure speculation and things might turn out very differently.

<comment><USER15> You have a point if implementers choose to use cairo code instead of re- implementer it, but in the other case they don't need to follow any license at all since licenses are valid just for code, unless they have patents on it (which I don't think is the case in libcairo)

</comment></comment></comment></comment><comment><USER16> It's not quite the Java 2D API, but damned it's close.

Why not just knock off a good API, like that for <canvas>?

<comment><USER17> Cairo & <canvas>'s drawing models are rather similar iirc.

<comment><USER18> The <canvas> drawing model is a very thin layer over the Mac OS X Cocoa drawing model (because it was originally developed by Apple as a proprietary extension to Webkit). The Cocoa drawing model is based on the "Display PDF" model, which is a descendant of the "Display Postscript" system used by the original NeXT OS, which of course was derived from the PostScript page layout language.

I think Cairo just borrowed the PostScript drawing model from the start.

</comment></comment></comment><comment><USER19> Third-party libraries are third-party for a reason.

Adding every conceivable library as standard doesn't make sense, unless you're Java, in which case no one cares how much crap you bring along.

<comment><USER20> Other platforms doing this include Python, Erlang, Perl, and C#.

"Batteries included" works very well in many cases. Having a single de-facto dominant implementation helps.

<comment><USER10> None of those languages are meant for systems programming.

<comment><USER3> So what?!

Every language should have a proper set of "batteries included" in the standard library.

One is not forced to use every single feature on every program.

<comment><USER10> You're making the situation far simpler than it is.

Extra batteries imply a greater codebase that has to be maintained, must support all modern architectures and compilers, and must evolve in a graceful way while maintaining backwards compatibility.

In general, backwards compatibility is a pain in the neck and results in libraries not evolving once they reach the standard library.

Python has tons of examples: urllib, urllib2 (both of them superceded by Requests, an external library that manages to incorporate a sane API), multiple subprocessing libraries, several refactorings of the OS exception hierarchy, etc.

Oh, and nobody actually uses the included GUI library for anything except the smallest of trivial examples.

This is something that can be tolerable in some high-level languages where performance is not a concern, but systems programming languages should tend to more conservative defaults and things that can be used in production to a certain degree of satisfaction.

 _Nobody_ is going to be happy with the default GUI lib in at least one of the many platforms; the existence of dozens of UI toolkits with different idioms, different looks, and different levels of integration are proof of that. And contrary to some more basic use cases, UI libraries tend to be, by necessity, absolutely enormous.

If the end result is going to be another poorly-designed library like many of the STLs modules, I'd _much_ rather developers use the proper UI toolkit for the situation.

<comment><USER3> The goal is to have something that any programmer can use regardless of the the operating system.

Libraries in C and C++ are a pain to use, because they are only available for specific operating systems, specific compiler versions and tend to lack compatibility among themselves.

This pain also tends to be part of C culture, as other system programming languages already had the tradition to provide a proper set of libraries on their runtimes.

I think the main cause is that UNIX is actually C's set of libraries, but those libraries do not exist in all operating systems.

However having a set of libraries as default, is great for the guarantee to be able to write OS agnostic code.

No one is forced to use them, if they required more advanced use cases.

<comment><USER10> Like I said before, _nobody_ is going to use an OS-agnostic UI library because UIs imply necessary integration and a level of specificity that can't be generalized.

There's half a dozen blitting models with difference performance optimizations. You have at least 4 or 5 popular widget toolkits. Do you support 2D drawing? 3D?

There are some things that just can't be abstracted away without massive engineering costs. No portable standard UI toolkit would be complete and compatible enough to be used for serious applications unless they're willing to stoop to levels as low as Java's so-called "multiplatform" UIs, which honestly look like crap.

A UI toolkit that's low-level enough is useless in desktop and modern mobile platforms. At higher levels they're too OS and device-specific. If they're too device-specific they have no place in a standard library. Thus, no UI toolkit is apt for this space unless you're willing to settle for mediocre, second- class toolkits.

<comment><USER3> > Like I said before, nobody is going to use an OS-agnostic UI library because > UIs imply necessary integration and a level of specificity that can't be > generalized.

 __Begineers __and people that care about presenting simple stuff will do surely use it.

The idea is to have good enough libraries to write portable code for simple stuff.

Should anyone have to go though the pain of creating a OpenGL context, matrixes and shaders to put some text on the screen?

You are always free to go write Win32, Xlib, Qt, GTKmm, MFC, Motif, wxWidgets, WPF, embedded Chrome or whatever UI flavor of the months is for REAL applications.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> I know it is irrelevant but still is interesting that one of the authors is Herb Sutter from Microsoft and that he chooses to propose an open source library from C instead of something coming from Microsoft.

</comment><comment><USER21> Earlier discussion: [https://news.ycombinator.com/item?id=7012329](https://news.ycombinator.com/item?id=7012329)</comment>


Ask HN: Why did I get printed the wrong boarding pass? - <AUTHOR> I took a flight from Montreal to Frankfurt. Today i checked my printed boarding pass (apparently the first time) and noticed it is completely wrong.
things which seems to be in common: Flight number: AC 8742 (printed flight)
               AC 874  (my flight)
levenshtein distance of printed name: 12, m = 15, n = 12
boarding pass: https://imgur.com/56ZRhOI
Seems like the only thing in common is that the boarding passes where probably printed at the same time.
Any suggestions what can possibly go wrong when a computer system prints a boarding pass, based on
the scanned passport?
In case you feel like that could be your lines of code, let us know :) <comment><USER2> You took a flight from Montreal to Frankfurt, but your boarding pass says Montreal to Bathurst, New Brunswick.

A handy way to look up flight numbers and destinations is an airline's timetable. Here is the one published by Air Canada:

[https://services.aircanada.com/portal/rest/timetable/pdf/ac-...](https://services.aircanada.com/portal/rest/timetable/pdf/ac- timetable-en.pdf)

So, flight 8742 is from Montreal to Bathurst. That matches up. The boarding pass confirms that. And flight 874 is indeed a flight from Montreal to Frankfurt, as your post explains.

If I had to guess, your flight was a short hop from Montreal to Bathurst to pick up more passengers and possibly fuel/cargo on the way to Frankfurt. Your boarding pass says 8742 since that's the first leg of the trip that you boarded in Montreal.

Does any of this match up? Did you change planes in Bathurst?

<comment><USER3> Nice spot. Could be it. It would be unusual not to be given both legs' boarding passes at check in. Unless you have to unboard and board again at the intermediate airport. That happened to me in Singapore airport once (scary as only had < 1hr to do it), but that was 2005.

<comment><USER2> You won't get a second boarding pass if your itinerary means you sit on the plane during the stopover. YUL-ZBF would be a domestic flight so there's no need to clear the plane with customs and then reboard it.

</comment></comment></comment><comment><USER4> My first reaction thought would be to ask airline.

My last reaction would be to ask hacker news.

<comment><AUTHOR> i already asked the airline but i don't expect technical details :)

</comment></comment><comment><USER5> The universe does not work perfectly.

<comment><AUTHOR> how do you know that?</comment></comment>


Ask HN: CI/CD on AWS lambda like thing - <AUTHOR> So, I envision a flow similar to using AWS S3 like service for a repository, where we are billed based on storage/bandwidth/requests.
Then we'll have a lambda-like service which automatically pulls stuff from a repo, runs tests in the cloud. We set a concurrency limit and service works as is.
Is there any company which offers similar flow? I've googled but found Jenkins and stuff like that which are big apps and not smth simple. <comment><USER2> The same answer applies here as with your other question: [https://news.ycombinator.com/item?id=16357653](https://news.ycombinator.com/item?id=16357653) but with some additions, you can use AWS lambda for that with some hacks or set up your own service, just spin up a docker image and run what you need doing in that (its what you do with pipelines either way). You can use githooks if you want functions to be executed at some self-hosted repository once someone pushes.

</comment><comment><USER3> This works if and only if each test or test segment is guaranteed to return within 300 seconds. For a lot of workflows, that's not doable.</comment>


Show HN: Sayable – send links with 3 randomly generated words - <AUTHOR> https://sayable.co/ <comment><USER2> Nice work, much better than the usual hard for humans - easy for computers URL shorteners. [https://xkcd.com/936/](https://xkcd.com/936/)</comment>


Find an Angel Investor, Without Going Through Hell - <AUTHOR> http://www.caycon.com/blog/2011/04/find-an-angel-investor-without-going-through-hell/ <comment><USER2> Surprisingly, no mention of <http://angel.co/>

<comment><USER3> That, and giving Keiretsu any air, make this a dubious source of advice.

<comment><USER4> What is it about Keiretsu that is dubious (really curious)?</comment></comment></comment>


Ubuntu Server is No Longer the Best OS for Cloud Computing - <AUTHOR> http://undacuvabrutha.wordpress.com/2012/04/04/ubuntu-server-is-no-longer-the-best-os-for-cloud-computing/

<comment><USER2> I use Ubuntu Server exclusively and Juju looks _amazing_ , but the title of this blog post _really_ got under my skin.

I kept reading through the post trying to relate what was being said to the title and eventually started skipping paragraphs to see if the author was going to tell me why I should stop using Ubuntu Server.

That never happened; the title is a red herring apparently designed to draw attention to what is a really a post about the (apparently favourable) economics of scaling out Ubuntu Server. Which is fine, but that's not the article I wanted to read based on the title - please don't do that. I'm happy with my choice and didn't want to read a advertorial reaffirming it.

<comment><USER3> He does sort of explain it: "what Ubuntu Server should actually drive towards is being the best OS for scale-out computing." (Which I guess also includes cloud.) But this is definitely an achievement in headlines: both linkbait and confusing.

</comment></comment><comment><USER4> Hold the phone, was there consensus that Ubuntu _was_ the best OS for cloud computing? 'Cause I wasn't aware of that if it's the case.</comment>


The real Cyrano de Bergerac - <AUTHOR> https://www.the-tls.co.uk/articles/public/cyrano-de-bergerac-anniversary/ <comment><USER2> I recently saw the documentary Catfish, and was struck by the similarities to the Cyrano play. It's interesting how Cyrano gets the audience's sympathy even though he is a blatant manipulator. In Catfish, the woman with the corresponding role gets painted as borderline psychotic, which may be warranted. There are other differences as well, but it's interesting how big a difference the gender swap makes.

</comment><comment><USER3> > Earth turns and is not the immobile centre of a revolving universe

Well that's never been an heresy and was not exactly the point of Galileo's trial</comment>


A year with AirPods, or, how my AirPods fell in the toilet and lived - <AUTHOR> http://stephencoyle.net/airpods-2017 <comment><USER2> Similar anecdotal experience here. Owned my AirPods for about a year now - about a month in I was shaving and the right one fell into the sink full of water.

Pulled it out pretty quick, rinsed it off, dried it with a towel, and it's worked without issues.

I honestly feel like the AirPods are the most delightful product Apple has put out in a long time. They're great.

<comment><USER3> Mine went through the washer and the dryer, though I figured out that they were in the dryer after 15 minutes.

They still work perfectly.

<comment><USER4> I had a similar experience with their EarPods. I'm pretty sure it got ear wax and all out too :)

It does feel like AirPods should be officially water proof though. (Especially since the iPhone and Watch models that launched with it were waterproof.)

</comment></comment></comment><comment><USER5> I love my AirPods. I use them as my daily work headphones as well as my workout headphones.

My primary issue is that switching between my laptop and phone is not as seamless as they make it seem. Regularly I have issues where when I switch from one to the other, one of the devices doesn't want to let go of the connection. I solved this by disconnecting first and then connecting to the other device.

Also there are times when my iPhone refuses to connect to my airpods.

<comment><USER6> I have a pair of earphones that are really magical. You never are unsure what device you are connected to, and they connect instantly when plugged in. They are compatible with almost every device from any company, even devices made 20 years ago.

Furthermore, the battery life on these things is phenomenal. In fact, I've never charged them once since I got them, and they still work great.

<comment><USER7> The biggest pro of AirPods for me is the lack of this cable. The case is the size of a Zippo lighter. They fit easily into my pocket, they never get tangled. They are so light weight without cable dangling down, or a headband over my hair, or battery around the neck, that after putting them in my ears, I will often forget they are there. They almost melt into the surroundings, creating a totally different listening experience than I have ever had with other headphones.

I was totally skeptical of the AirPods, but they are the best headphones I've owned (from a practicality standpoint). I own a pair of $500 Sennheiser Bluetooth headphones that go unused, except when traveling, where noice cancellation is required.

My Beyerdynamic studio reference cans are now limited to gaming and audio production.

AirPods win in every other category.

</comment></comment></comment><comment><USER8> I think it's pretty safe to say that AirPods have really taken off and users are highly satisfied by the product. Does anyone have other wireless earbuds that they feel are comparable to AirPods? I purchased the Bragi headphones when they first released a while back and while the sound quality is pretty good and the fit is not bad, the syncing with my iPhone and the trouble with pushing them into my ears because of the buttons are really making them an annoyance (and not to mention, potentially damaging to my ears).

Would love to hear some comparable alternatives!

<comment> K-Wall I really enjoy my pair of BeatsX. They have the same W1 chip as the AirPods which makes pairing simple. They do have a cord between the buds but also have an inline mic and volume / music controls.

They aren't as sexy as the AirPods but I was able to pick them up on sale for $75 so I have no real gripes.

<comment><USER9> I have the similar PowerBeats3. W1 chip and connecting cable but a bigger battery housing. I use them for cycling (I know) and they're great. I think the Bluetooth dropped out once in over a year. Battery life is great and they just work.

Regular Apple ear pods fall out of my ears so I'm not so sure about AirPods.

</comment></comment></comment><comment><USER10> I've had my airpods for about two months now and I really like them a lot. They are small enough in their case that I usually carry them in my pocket, which I didn't normally do with other earbuds, and so I've found I get to listen to music in more situations, unexpectedly waiting in long lines or what have you, which is nice.

I don't like them as much as my good aviator style headphones, but for earbuds their sound quality is good.

<comment><USER11> Do they routinely fall of your ears? Seemingly, this was the most common issue or complaint against the adoption of AirPods.

<comment><USER12> I've had AirPods for a little over a month now and they have never fallen out of my ears - they are sturdy enough where it's not even a concern. And thinking about it, why would AirPods fall out of your ears any more than wired Apple earbuds.

The technology is really seamless - my only gripe with the product is battery life. You can't listen and charge at the same time, and I've never gotten all day batter life. It makes it hard to use as a daily driver - I have my AirPods for most situations and then a set of headphones for work on the laptop

<comment><USER13> i don't have airpods, but i've heard it mentioned that the weight of the wire holds the wired style earpods down in the cradle of your ear more so than airpods.

<comment><USER14> On the contrary, the wires seemed to pull them out more than anything else. AirPods stay in my ears way better, with no discomfort.

<comment><USER15> That's my experience from running with regular earbuds. Have to find a way to hold my phone _just so_ to keep the cord from jostling them out. I've also tried a phone arm-strap but couldn't work out a place that worked for the headphones cable.

Don't have airpods, but I've heard nothing but great reviews so I'm thinking about it. Wish they didn't cost so much.

</comment></comment></comment></comment></comment></comment><comment><USER16> Super awesome product, definite advantages over traditional headphones or other wireless headphones.

The only negative point I have with them is that they are now something that I have to know where they are all the time eg I tap my pockets to confirm phone wallet keys and now air pods.... I didn't used to do that with normal headphones.

<comment><USER17> If only they had done the same thing around headphones that weren't uncomfortable and sound like garbage.

<comment><USER14> I find them very comfortable. I couldn't wear the previous ear pods at all, but AirPods fit me great. YMMV of course.

They sound fine to me, I'm no audiophile.

</comment></comment></comment><comment> j-kearl When interning at Microsoft, Satya came to us one day to present about customer engagement. What stuck with me most from his talk was how important it is to find what he calls a "real fan" of your product. To him, this is the kind of person who loves your work so much that they will go out of their way to talk about it and recommend it to their friends and colleagues.

Since then, I've been looking for products I am a "fan" of. The only two that have come up from the "big companies" are VS Code and AirPods. Maybe iMessage. Kind of a shame that with all the millions/billions that have gone into product development. Those 2/3 seem pretty wide spread; I'd be interested to see what additional things others are fans of.

</comment><comment><USER18> Reliable bluetooth may be finally hitting its stride (don't want to jinx anything!).

A mono alternative (Rowkin Mini) currently $40: [https://amzn.com/dp/B01IU5ZTKC](https://amzn.com/dp/B01IU5ZTKC) (here's a referral, if you're feeling overly generous: [http://amzn.to/2irAi7v](http://amzn.to/2irAi7v))

HN anecdatum: [https://news.ycombinator.com/item?id=15722049](https://news.ycombinator.com/item?id=15722049)

> _That link is the exact model I have, though, and it 's been awesome; I > might pick up a couple of spares just to have them against need._

</comment><comment><USER19> Only issue I've had with mine is that they seemed to get clogged relatively easily. I suppose it's improved my hygiene though, now I clean my ears multiple times a day to avoid getting any earwax in my AirPods

</comment><comment><USER20> Unlike many commenters, I actively love products which have a wire. My mouse, keyboard, headphones, chargers are all wired and I hope they remain that way. Having to baby sit (charging) these devices is the last thing I want to do. Besides, I have no issues with using my headphones during my run or biking.

And oh, the great thing about my headphones is that I never drop them in a toilet/sink/river bed/all the water bodies other commenters have listed!

<comment><USER21> I love wired devices too. Especially for anything that doesn't have to get moved around. (Mouse, Keyboard, etc...)

Charge management is a pain in the butt. For anything wireless I like to be able to plug it in while I'm using it. Too many bluetooth headphones won't even work while they are plugged in...

</comment></comment><comment><USER22> > Semi-related to previous point, the ability to use Siri without dropping to > a lower bit rate audio stream would be nice.

I assume this an inherent limitation of the underlying Bluetooth protocol? It probably switches to calling mode. That is very noticeable, on any headphone.

</comment><comment><USER23> I love them too, but they only last a few hours, not a whole day. Then you need a wired headset.

<comment><USER24> This is a fair assessment, but the case charges them so fast that I almost never even consider the battery life, despite using them all day.

</comment></comment><comment><USER25> You know what'd be awesome? A sort of tether to prevent headphones from falling onto the ground or into a toilet. If we made it out of wire, we could even send the audio signal over it, which has the added benefit of reducing audio latency and electronics cost. Why, we could even get away with batteryless headphones: the future can be now!

<comment><USER26> I realise you are being sarcastic (which is a little weak) but this feels like a good chance to point out you can buy third party covers that do this job perfectly. You don't need wires; they just lightly lock into your ears.</comment></comment>


The New SDK for LEIA 3D - <AUTHOR> https://www.leia3d.com/2015/09/26/introducing-the-new-sdk-for-leia-3d/ <comment><USER2> I'm guessing the point of this is that you can move around and see the displayed content from different directions, so why are all of the promotional videos shot from a stationary camera? Everything on this site makes it appear indistinguishable from a regular LCD.

</comment><comment><USER3> The videos show color displays.

The dev kit says 200x200 monochrome.

Using WebGL sounds like a cool way to get people introduced to it, but showing color and it actually being monochrome is.. disingenuous.

</comment><comment><USER4> Hey guys, Thanks a lot for your interest in our devKit! For an overview on our technology, feel free to have a look at this MIT Technology Review article: [http://www.technologyreview.com/news/535376/new-display- tech...](http://www.technologyreview.com/news/535376/new-display-technology- lets-lcds-produce-princess-leia-style-holograms/)

In response to your questions: Yes, we are commercializing an auto stereoscopic display which produces 8x8 (horizontal x vertical) images to give a natural 3D experience. The devKit is able to show monochrome images, in principle in any color. Hence the baby in our promo video is legit :-) [https://www.youtube.com/watch?v=0n5ypUbCuoc](https://www.youtube.com/watch?v=0n5ypUbCuoc)

In essence, we use a nano-technology backlight which is carefully aligned behind the actual LCD matrix, to send specific pixels in specific directions. In this way, we are able to send different images to you left and right eyes; no eye-tracking, no head-tracking; and no lenticular image breakups.

Our devKit has a native resolution of 1600x1600 pixels, which means that each of the 8x8 views will have a resolution of 200x200 pixels.

We have freely available webGL and unity plugins for people to create content, and support the developer community.

Since one cannot see the full 3D effect of our display on a normal 2D screen, we invite you to come and meet us during one of our upcoming meetups (RSVP at address below).

In the meantime, here is a short video showing the devKit (remember your 2D screen won't give you a full 3D depth experience): [https://www.youtube.com/watch?v=LBT3dNA1MtQ](https://www.youtube.com/watch?v=LBT3dNA1MtQ)

Thanks!

Armand RSVP: firstname.lastname@example.com

</comment><comment><USER5> This appears to be a product demo: [https://www.youtube.com/watch?v=_Rd0mEAPT0Y](https://www.youtube.com/watch?v=_Rd0mEAPT0Y)

</comment><comment><USER6> This is the best video I've found of the prototype (it autoplays):

[http://www.reuters.com/video/2015/03/05/star-wars- inspired-p...](http://www.reuters.com/video/2015/03/05/star-wars-inspired- prototype-creates-hol?videoId=363395789)

</comment><comment><USER7> does anyone know how this works? and is there any real pictures out there? the video is a composite, so doesn't actually tell me anything.

Is it auto steroscopic? is it layered oleds?

</comment><comment><USER8> So no evidence at all this is more than an lcd in a box?

</comment><comment><USER9> Is there a video of the proto ?</comment>


Apple seeks patent for Smart Cover with embedded secondary display - <AUTHOR> http://www.engadget.com/2012/08/02/apple-smart-cover-display-patent-application/

<comment><USER2> Its a interesting idea, but its one of those things Apple would only do if they thought they could make it truly mainstream.

The trouble with this, is it reminds me of the embedded screen in the Dreamcast. Its almost a gimmick to sell devices but one that is rarely used.

Considering apple was going to ditch the iPhone because they had trouble getting a sensor that could shut off the touch screen properly when held to your ear, its highly unlikely they would release this. Remember Apple will only go ahead with this if they really think 90% of their customers would use it.</comment>


Cloudflare is fighting one of the largest DDoS attacks in history - <AUTHOR> http://thenextweb.com/asia/2014/06/20/cloudflare-hong-kong-democracy-movement-battling-one-largest-ddos-attacks-history/

<comment><AUTHOR> The attack is started on 16 Jun, which pull down the political surveying site [http://www.popvote.hk](http://www.popvote.hk). It is a project initiated by The University of Hong Kong. [http://hkupop.hku.hk/english/release/release1149.html](http://hkupop.hku.hk/english/release/release1149.html)

<comment><AUTHOR> Two days later, 18 Jun, website of the most popular local press in Hong Kong, apple daily[1], was also under attack. Taiwan branch of AppleDaily also felt victim to the attack. And AppleDaily turned to post news on Facebook[2].

[1]: [http://hk.apple.nextmedia.com/](http://hk.apple.nextmedia.com/) [2]: [https://www.facebook.com/hk.nextmedia](https://www.facebook.com/hk.nextmedia)

</comment></comment><comment><USER2> What would be interesting is for Cloudflare to mention how much traffic is hitting which of their locations and how isolated the traffic is.</comment>


Ontario Warned of a Nuclear 'Emergency,' Then Said Never Mind - <AUTHOR> https://www.nytimes.com/2020/01/12/world/canada/ontario-nuclear-pickering.html <comment><AUTHOR> The Canadian governments send all alerts at the « presidential » level. Whether an Amber alert or an incoming nuclear incident.

And many of the Amber Alerts in Ontario have been vague, too late to do anything, nobody in danger custody disputes, not geotargeted where reasonable, or sent so late the missing could be anywhere.

The government's have wiped aside any concerns people have about the system and largely doubled down on its design.

</comment><comment><AUTHOR> About 11m people woke up to this vague message this morning:

[https://static01.nyt.com/images/2020/01/12/world/12canada- al...](https://static01.nyt.com/images/2020/01/12/world/12canada- alarm2/12canada-alarm2-articleLarge.jpg)</comment>


TableSchemer: An iOS library for making UITableView much, much easier to use - <AUTHOR> https://github.com/Weebly/TableSchemer

<comment><USER2> Looks interesting, I hate working with UITableViews. Anyone know if this thing handles dynamic row heights?

<comment><USER3> I think it does: [https://github.com/Weebly/TableSchemer/wiki/Creating- Custom-...](https://github.com/Weebly/TableSchemer/wiki/Creating-Custom- Schemes#height)</comment></comment>


My Startup School experience. - <AUTHOR> http://sahillavingia.com/blog/?p=49&preview=true <comment><USER2> > Join a startup

I liked how Adam D'Angelo suggested that people should join a startup that a) has a great team that is still small, and b) has traction, and c) lets you learn a ton of stuff.

We're in exactly that situation. Our startup, iTeleport, makes the top grossing VNC-based remote desktop client on the iPhone / iPad.

a) We're a team of two people -- myself (I did my CS PhD from CMU) and Vishal Kapur (BS/MS from MIT, and has worked at a large company and a successful startup over the past few years) -- and we're having a lot of fun doing what we're doing.

b) We've got traction -- more than 100,000 paying customers @$25 a pop, and growing -- we've even been featured on 37signals' Profitable and Proud blog series.

c) Finally, we're working on some incredibly challenging problems all the way from redesigning the user experience (we applied for a patent on our interface hack, which was recently approved) to squeezing every bit of performance juice out of memory and CPU constrained devices when transferring large amounts of graphical data. We're working on a p2p network stack that enables any endpoint to speak directly with any other endpoint without requiring any servers of our own to manage (and pay for (and worry about)). Most importantly, we're in touch with our users, we know what they want, and we want to learn how we can continue making something they want and like. We're making more than $1m in revenues a year, but we feel we've only scratched the surface, and people who join us now are going to really learn an incredible amount about every single aspect of how to build and grow a startup.

We're a team of two, and we're looking for a third. We're very picky, but for the right person, this could be the opportunity of a lifetime. If anyone's interested, go to iTeleportMobile.com, see what we're all about, and email us from the jobs page.

<comment><USER3> > Join a startup

"I liked how Adam D'Angelo suggested that people should join a startup that a) has a great team that is still small, and b) has traction, and c) lets you learn a ton of stuff."

This is a really big challenge for me. The decision to join a really young team versus running off and doing your own thing is really hard, especially when you see lots of awesome startups that actually have a lot going for them. For instance, if I wasn't so caught up in my own world, I would instantly want to join airbnb. I'm sure they're going to be huge.

The question is: Does being a founder outweigh the opportunity of being an early employee at someone else's startup?

</comment></comment><comment><USER4> > Join a startup

I'd love to do this, but there are so few late-stage startups in Australia that I'm finding doing this rather tough.

Heck, finding companies that are product-focused shops (instead of consulting shops, like design agencies) is really tough as well.

I'd love to get involved with building an awesome product. I'm going to keep looking, but if anyone is here in Oz and has some pointers as to how to find these people, I'd be very grateful.

</comment><comment><USER5> Wasn't accepted this time around. I'll definitely try again next time though, sounds awesome.

</comment><comment><USER6> I'm sure Startup School was great, but much of this is advice I've already read through various blog posts on HN and elsewhere. Does anyone else think they're reached the point of diminishing marginal returns on startup advice?

<comment><USER7> Hmmmm...

On the drive back home after attending startup school I was thinking about what advice I had heard/read before and what I had not.

I came to the conclusion that it didn't matter...

I realized, there's a huge difference between attending the concert of your favorite band, compared to watching that same concert on DVD.

That's why I was driving home feeling so much more informed attending Startup School this year, rather than watching it via Justin.tv like I did last year.

</comment></comment><comment><USER8> Dude, you don't have to move to SF. LA has a good startup scene and high-end engineering talent pool from Caltech/USC/UCLA, plus design/marketing/UX/etc people from the entertainment industry. There are no serious hurdles to founding a consumer internet startup here.

At startupschool, I met a bunch of people from the bay area, but none of them were interested in founding a new company. They were either already founders (looking for employees/funding/revenue), or, pretty happily working for a large company like GOOG/NVDA/AAPL/etc and not quite ready to leave. The people I found most interesting as future potential cofounders, were from other cities with "weaker" tech/startup scenes.</comment>