Ask HN: Why does Java continue to dominate? - <AUTHOR> It seems with Clojure, Groovy and Scala (among others), that Java itself as a language would at least be leveling off. But according to the TIOBE index [1], it is gaining momentum, it seems. Why is this?<p>[1] http://www.tiobe.com/index.php/content/paperinfo/tpci/index.html<p>Edit: correct spelling <comment><USER2> Because world is different than bubble of HN/Lobsters/Silicon Valley ;)

<comment><USER3> Exactly this. It would seem from reading tech websites and blogs that Java is dead. However there is an extensive industry of people writing and maintaining Java applications.

You won't hear of some new sexy startup using Java, but there are companies who quietly go into business either using Java for their product or providing services with Java applications.

</comment></comment><comment><USER4> Java is just finally recovering from the 2008 recession. Look at this graph[0] instead. You can see that Java is very slowly going down before 2008 but generally flat, then suddenly in 2008 it loses pace extremely quickly, only to then recover as the economy recovers.

Java is about as enterprisey as programming languages comes. When a recession hits a lot of organisations tighten their belts, and a lot of programming projects get put into "maintenance mode" for a few years (with programmers and managers often being laid off).

After the economy improves companies start paying for new feature development again, fix bugs that had been ignored, and in some cases migrate TO Java from something worse (You'd be surprised how old some large well-known corporation's internal software is, we're talking 1980s mainframe age).

We won't REALLY know if Java is gaining or losing pace for a few more years (assuming there isn't another recession due to Chinese-related market issues).

[0] [http://www.tiobe.com/index.php/content/paperinfo/tpci/Java.h...](http://www.tiobe.com/index.php/content/paperinfo/tpci/Java.html)

<comment><USER5> Or it could be "Java" in "Java Virtual Machine".

</comment></comment><comment><USER6> Same question could have been asked about COBOL some years ago, and to a lesser extent still can be, I guess.

Basically, at least partly, this other answer by tumdum_ explains it:

[https://news.ycombinator.com/user?id=tumdum_](https://news.ycombinator.com/user?id=tumdum_)

To clarify a bit: Even if newer languages / other technologies have merits (and of course they sometimes / often do), enterprises who have invested a good amount on getting apps built using older technologies (which may well have been current / popular at the time) may have no good justification to pay the cost [1] redesign and rewrite apps just to move to newer tech. ROI, CYA, etc.

[1] That cost is not only of design and writing but also prior research and evaluation, and subsequent deployment and training, etc.

</comment><comment><USER7> I'll never understand why people hate on Java. Writing in Java is nice and easy, debugging is easy and getting support online is easy.

<comment><USER8> 1) It's very verbose. You pretty much NEED an IDE

2)Eclipse. I gave up on java a few years ago when it took 5 minutes for the IDE to open up and then would freeze up every few minutes. This was about 5 years ago now and I was using a laptop, so it's probably not an issue anymore but the memory lasts

<comment><USER7> Personally, I don't find it that verbose. It is more verbose than other languages but it all just makes sense.

I agree, older version of Eclipse on bad hardware is truly awful. Thankfully I am using a better machine now.

</comment></comment></comment><comment><USER9> Lots of reasons:

1) Everyone knows it or has touched it. Walk down a street filled with developers and you'll run into many who know or have worked with Java.

2) Apache. Apache. Apache. The saying goes No one ever got fired for using Java / no one ever got fired for using apache. Most major apache projects and libraries are Java/JVM based and the Java interface provides the best way to interact with them. Don't underestimate the pull from Apache on language choice.

3) Libraries - people have spent millions of man hours developing libraries for Java/JVM languages that aren't replicated elsewhere. Odds are pretty good if you're looking for an open source library that does X someone wrote it for the JVM.

4) Legacy Systems. Java is the new COBOL. There are billions of lines of Java code in existence chugging away around the world. It's more expensive to overhaul and replace an entire code base than it is to find or train developers to work on it.

5) People are riffing on top of the JVM. Rather than fight it, all the new hot languages like Clojure, Scala, Groovy, etc. are building on top of the JVM and taking advantage of what it gives you under the hood and the fact that the JVM has a wide install base. This reduces the likelihood Java will die in many capacities since it's being pushed into a more key infrastructure role rather than outright replaced.

Edit: fixed spelling

</comment><comment><USER10> Because it works for what people are doing. No need to be the coolest kid of the block.

</comment><comment><USER11> Because choosing Java will almost never be a mistake, even if it isn't the most ideal language. The JVM(s) are fast(ish). So much open source code to grab and get productive on. Almost any developer you hire can be effective with it immediately, even if they've never used it before. Also, Android.

I've got only ever done one project in my career with it, and I found myself feeling "meh" about it, but I never hated it.

</comment><comment><USER12> Enterprise has made a big investment in Java. Once you build out a significant code base in a language, you are less likely to throw it all out.

Also in the Enterprise space, Oracle is a dominant database, and they have made some strong features for Java when it comes to the Oracle database. Having these features and someone you can call for support is good business and good risk protection for larger companies.

<comment><AUTHOR> I guess hearing the tech press, various blogs, etc. it seemed like many Java shops were jumping ship to the greener pastures of languages like Clojure, Kotlin, etc. Actual practice, apparently doesn't always follow the aforementioned sources. :)

<comment><USER13> They are. Kind of. You are just underestimating the scale of Java.

There are millions of Java devs. If 1% of them move to a better JVM language that's 10,000+ programmers who have moved. That is a lot of developers jumping ship.

In addition, by jumping ship they really mean starting new development in another language... They aren't rewriting their millions of lines of Java code. So they still maintain this code and as such would still be flagged as Java programmers.

</comment></comment></comment><comment><USER14> Wouldn't the rise of Android have something to do with this?

</comment><comment><USER15> The TIOBE rankings aren't to be trusted. Just click on Groovy to see its history graph - it went from #82 to #17 in a mere 12 months.

The last time Groovy made the top 20, it hit #18 in Oct 2013, but 3 months later (Jan 2014), had dropped back out of the top 50 (#32 in Nov, #46 in Dec). TIOBE said the following month "The data is produced by one of the sites that we track is interpreted incorrectly by our algorithms. After we fixed this bug, Groovy lost much of its ratings." [1] Just before that fix happened, interviews with the current Apache spokesperson for Groovy (Guillaume Laforge) promoting Groovy's top 20 position were published in 5 online rags (www.infoworld.com, www.eweek.com, cacm.acm.org, jaxenter.com, and glaforge.appspot.com), and all of them quickly appeared in Google's top 30 search results for "groovy programming" and remained there for 6 to 18 months afterwards. I'm guessing the same feedback effect was engineered again before the end of last month (Jan 2016), and Groovy will again start losing its new top 20 ranking.

This rapid rise then fall also happened with Groovy in December 2010. Groovy began a sudden rise from outside the top 50 when Groovy tech lead Jochen Theodorou "volunteered" his services to Tiobe in late 2010 to help them improve their algorithms. Than in April 2011, Groovy fell from #25 to #65 on Tiobe in a single month after they increased the number of search engines they monitor.

These fleeting peaks for Groovy in the TIOBE rankings (#25 in Apr 2011, #18 in Oct 2013, #17 in Jan 2016) between its usual ranking of somewhere between #51 and #100 (e.g. #82 only 12 months ago) are a bad thing for Groovy because of damage to its reputation as a solid language suitable for long-term IT solutions. Such ranking volatility gives off the stench of search engine optimization, a smoke-and-mirrors marketing tactic intended to benefit a single stake-holder, probably the person who privately owns the groovy- lang.org DNS domain.

[1] [http://www.infoworld.com/t/application- development/c-pulls-a...](http://www.infoworld.com/t/application- development/c-pulls-away-java-among-top-programming-languages-230603)

<comment><AUTHOR> Do you have an alternative ranking you prefer?

</comment></comment><comment><USER8> Keep in mind that many of these jvm languages allow you to use java code. So many of these languages are using the newer language and java so it won't drop off and instead should continue to increase

</comment><comment><USER16> Never ever use or trust TIOBE

</comment><comment><USER17> you mean php right?

<comment><AUTHOR> One could make an argument for that, but I am referring specifically to the TIOBE programming language index standings - Java is ranked #1 by a fairly large margin.</comment></comment>


Ask HN: Best resources to learn computer networking? - <AUTHOR> I never took a formal course on computer networking and have just learned bits and pieces along the way. However, I would like to fill in the gaps in my knowledge and learn more about networking, specifically in TCP/IP, CIDR, subnets, network masks, routers, gateways, NAT, firewalls, etc. I assume most of these topics would be covered in a networking 101 course of some kind.
Any suggestions on the best resources for studying these topics? Could be a book, an online course, a website with articles, etc.
Any suggestions are much appreciated. Thanks. <comment><USER2> 0\. Get a Linux.

1\. Read LARTC [[http://www.lartc.org/](http://www.lartc.org/)].

2\. Get a virtual machine hypervisor, a one that can work with a Linux bridge. KVM/libvirt should do, as should LXC on libvirt or lxc tools (lxc-create, lxc- start and the like). Avoid Docker, as its networking is not supposed to be understood by operator.

2.5. Setup several Linux guests. Three or four should be enough to see necessary bits.

3\. Try to setup different networks by hand (avoid using ifup/ifdown and their equivalents; use /(s)bin/ip, /sbin/ifconfig, and /sbin/route).

3.5 Learn how to use tcpdump (pay attention to -i option). Try understanding why some packets show up duplicated.

4\. Profit.

Note that in 2. you may easily replace VMs with physical machines with several network cards, but I guess it would be easier to go with VMs.

</comment><comment><USER3> Take a look at this course : [https://lagunita.stanford.edu/courses/Engineering/Networking...](https://lagunita.stanford.edu/courses/Engineering/Networking/Winter2014/about) . The recommended book is Computer Networking: A Top-Down Approach by Kurose and Ross.</comment>


BetterExplained has a Patreon - <AUTHOR> https://www.patreon.com/betterexplained <comment><AUTHOR> BetterExplained is a ridiculously awesome website for intuitive explanations of complicated maths concepts (that most of us pretend to understand but secretly don't). It's a really well-loved site (gets posted to hn every couple of months -- typical top comment: "This site is a hidden gem on the internet. This guy deserves a lot more credit") and is all the work of one guy, Kalid, who writes it as a side project. It's really important to him that the site stays free for anyone to access, but he finally agreed to start a Patreon so that those of us who want to support him can tip a little something in his hat. Personally I'm hoping that if enough of us donate he will eventually quit his day-job and write full-time, but in any case it's nice to be able to show some appreciation for one of the best & friendliest educational resources out there. I don't think he's promoting the Patreon at all so I just wanted to share it here for others who feel the same.

<comment><USER2> Just saw this come through, thanks man :). I had been shy about publicizing the Patreon (wasn't sure what to offer, was it "worth it" etc.) but I realize just having it out there for people who want to support the site is enough of a start. Thanks for sharing this.

</comment></comment><comment><USER3> Fantastic, happy to see this development. I keep a list of people/Patreons to support, and Kalid has been on it for a long time

<comment><USER2> Really appreciate it, thank you.</comment></comment>


Game Dev Examines Whether Nostalgia Is a Worthwhile Game Genre - <AUTHOR> https://www.staticcatgames.com/2020/08/tie-dye-review.html <comment><USER2> Thanks, interesting but I didn't really get the nostalgia angle from the article though?

</comment><comment><USER3> it's more a review of a single game than the "genre" as a whole unfortunately.

i do think it is could be an interesting idea, considering all the private servers for older versions of mmorpgs that exist out there.</comment>


China confounds all that western liberals believed about the net - <AUTHOR> https://www.theguardian.com/commentisfree/2018/nov/11/the-networker-how-the-new-china-confounds-everything-western-liberals-thought-about-the-internet <comment><USER2> Am I the only one that sees an irony with the deep blue states with this article? There seems to be an unbounded expansion of Government in those areas; from what intrusions it has on your personal life (sugar taxes [unless your starbucks]), to business regulations [coffee causes cancer signs, demanding women be on boards], and increasing the reliance of people on the government (business taxation to 'help' the 'homeless' in areas with high inflation, taxation of business cafeterias).

<comment><USER3> > Am I the only one that sees an irony with the deep blue states with this > article?

There's a vast chasm between the government being used as a tool for collective action (like when forcing human-friendly business regulations) and government being used as a tool for control.

<comment><USER4> Would you mind if I borrowed this as a political talking point in public forums?

<comment><USER3> Sure, that's fine—it's probably not my original thought, either.

</comment></comment></comment></comment><comment><USER5> I hate to be the one to point this out, but: it certainly isn't just China.

</comment><comment><USER6> This reminds me more than a little of Hernando de Soto's work with _The Mystery of Capital_, subtitled "Why Capitalism triumphs in the West and fails everywhere else." It's an interesting read for its specifics (and I think he's got it right that successful private markets depend heavily on a network of accepted public services). But one generalizable takeaway might be that would- be sociocultural exporters often don't understand why their social systems work -- it's easy to take for granted background cultural features and social institutions you simply assume are there.

Also: it's probably worth noting that while the US isn't particularly dystopian, it can't be taken for granted that it will remain a liberal democracy (there are highly visible impulses to turn it down a different path right now) or that technology won't be a significant tool of social control.

(Nor is it entirely clear that the West has capitalism totes dialed-in.)

<comment><USER7> Thanks for this comment. It initially piqued my interest because I confused de Soto with the Spanish conquistador of the same name, quickly cleared that up though! It was cool to realise he was key in the economic reforms of Peru, my family had to move because of the Shining Path, so it's close to home.

So I've quickly read his Wikipedia entry (and have the book to read later). It seems like the critiques of his approach, resulting him being lumped in the 'neoliberal' bucket, is that he pushes property rights as practically the _only_ requirement for developing countries to successfully reform their economies to the benefit of all. Whereas your phrasing as "successful private markets depend heavily on a network of accepted public services" (which I agree with more) would seem to encompass more than only legal and justice frameworks towards property rights.

Anyway, I'll read the book and think more about it. Thanks again.

<comment><USER6> Yeah, I'm probably overly vague about "accepted public services." More specifically, the kind of thing De Soto seemed to focus on are property recording systems, functioning courts working on reasonably well-defined property law, and permitting/review/accounting that makes economic activity legible. These aren't super sexy public institutions, and it may well be they aren't sufficient for a truly thriving society, but they are basic entry level public components of a functioning private enterprise system, and apparently more than a few attempts to export US capitalism have failed to account for them.

</comment></comment></comment><comment><USER8> I mean, Brave New World and 1984 predicted the abuse of technology to socially engineer societies into obedience. These novels were written in the 30s and 40s but still seem prescient today. China has become the living embodiment of those books, with its social credit system. It's not surprising per se, China's communist roots serve as an excellent breeding ground for techno- authoritarianism. My only fear is that the Western world has forgotten it's classical liberal roots...

</comment><comment><USER9> It is quite a common sense any technology can be used for whatever purposes at the hands of its master. Not sure the net should be an exception. As we have witnessed, social networks can be used to organize Arabic Spring. They can also be used to screw up the election process in many countries.</comment>


Best introductory statistics book to develop intuitive grasp of topic? - <AUTHOR>

What's a good introductory statistics book? I've found a few but they suffer from one of two faults:<p>* One type glosses over everything and just spits out a bunch of formulas that you are supposed to apply. There's no thought given to explaining the conceptual understanding...such as WHY confidence intervals vary as the square root of sample size.<p>* Another type is made for theoretical math majors and is based on extremely rigorous proofs of arcane details which I'm not interested in.<p>Is there a good book that strikes a balance and teaches me an intuitive grasp of statistics? I'm already very familiar with probability. <comment><USER2> Introduction to Statistical Thought is nice: <http://www.stat.duke.edu/~michael/print.pdf>

Also I think below links are all quite interesting:

<http://yudkowsky.net/bayes/bayes.html>

<http://www.stats202.com/>

<comment><AUTHOR> thanks! I will check these out.</comment></comment>


The History of the Marshfield Mummers (1999) - <AUTHOR> https://knightstoves.wordpress.com/history/ <comment><USER2> Thanks for sharing this. Another obscure (to me) British cultural reference by the band XTC now becomes clear.

Such traditions can be fragile things. The casual nature of the performance ("They only meet to rehearse about twenty minutes before leaving the church hall every Boxing day") is both a blessing and a curse - easy to learn and share with new participants, but also easy to skip which is what apparently happened in the 1880s.

<comment><USER3> A more recent Indy record, by Young Knives, has Whittlesea Straw Bear on the cover, and there must be other folk custom references in rock genres, especially Green Man, I guess.

You don't need much rehearsal for a single script after a few years, except for the topical ad-libs, and you traditionally consult the correct words written on the props -- not to be taken too seriously!

Most English (and maybe other) folk customs had died out by the end of the 19th century. Then even the early revival groups were wiped out in the First World War, particularly as they tended to join up together. That's been poignant in recent centennials.

</comment></comment><comment><USER3> In comes I, Knight George, to say how splendid to see mumming on the front page. Resources for anyone interested: [https://folkplay.info/](https://folkplay.info/) and [http://www.mastermummers.org/](http://www.mastermummers.org/).

</comment><comment><USER4> Not 100% related, but Philadelphia has a Mummers parade every New Year's which is, IMNSHO, the best US parade. Pity it is always colder than a witch's teat...

<comment><USER3> Yes, definitely not British Isles mumming (which doubtless happens in North America, probably connected with morris sides, who are often very good). It's interesting to see the folk custom, though.</comment></comment>


Revealed: NSA pushed 9/11 as key 'sound bite' to justify surveillance - <AUTHOR> http://america.aljazeera.com/articles/2013/10/30/revealed-nsa-pushed911askeysoundbitetojustifysurveillance.html

<comment><USER2> Is it irony that when that pompous asshat traitor Keith Alexander testified before Congress yesterday, after lying to Congress several weeks ago, started off by saying that no matter what they do is justified because they would rather destroy America from within than suffer another blow and attack.

The enemy is within, the enemy is the state, the enemy is us. These traitorous officials since the Bush administration have caused America more damage than any terrorist could ever even have a hallucinogen induced lucid wet dream about.</comment>


The Cold, Hard Facts of Freezing to Death - <AUTHOR> https://www.outsideonline.com/2152131/freezing-death <comment><USER2> Is it just me or has Outside Magazine really stepped it up with its online content recently? I never used to read it, but it seems like recently I've been stumbling across 1-2 high-quality long-form articles a week.

<comment><USER3> Could be, but this particular one is old.</comment></comment>


Ask HN: How to get in early (pre series A) with YC companies? - <AUTHOR>

Most of the offers I get in my inbox are for post series A companies, so the equity is negligible.<p>How can I find opportunities, with YC companies or elsewhere, that need a technical cofounder or early architect before any major funding? <comment><USER2> Nearly all YC companies that are smaller post their job postings on HN. Check here: [https://news.ycombinator.com/jobs](https://news.ycombinator.com/jobs) (it updates frequently, check it daily).

That said, if your goal is to become a technical cofounder, you are likely going to have a hard time. Very few YC companies are looking for a cofounder, and if they are they would likely look in their personal network first. You mention being an early architect, which is possible, but maybe not before major funding (depending on what you consider major).

Nearly all YC companies avoid hiring during YC, and instead hire after demo day. This is mostly because hiring is insanely time consuming, and during YC they focus almost exclusively on growth and getting the company in the best shape possible for demo day. Many companies also don't have the finances to hire someone until after raising, which happens after demo day.

Regardless, the HN job listings is your best bet.

<comment><AUTHOR> thanks for this. I don't know what I was expecting beyond the jobs board / who is hiring threads. maybe some kind of secret handshake that only ycombinator people know?</comment></comment>


What are the problems you face on a daily basis? - <AUTHOR> <comment><USER2> Silly people Lack of good requirements when building an application Office politics

</comment><comment><USER3> Anger, contempt, delusion.

<comment><USER3> By the way, I'm talking these are problems I face with people at work. Not problems that I personally have.</comment></comment>


Tracking Down a Stolen iPhone - <AUTHOR> http://happywaffle.livejournal.com/5890.html

<comment><USER2> It's only a matter of time before one of these Mobile Me adventure stories ends in a stabbing.

<comment><USER3> Sounds like a startup opportunity: provide a service to track down stolen phones and return them to their owners.

<comment><USER4> Sounds like a pitch for a reality TV show.

</comment></comment></comment><comment><USER5> A brutal robbery/assault locally was solved because the attackers stole an iPhone, which had location services turned on. The police had him within a few days. The other two suspects were identified on his facebook page.

</comment><comment><USER6> Pretty remarkable lack of street smarts.

Should probably stick to Legos next time.

</comment><comment><USER7> There is a much better (and much cheaper) version of "Find my iPhone" functionality for jailbroken iPhones called iLocalis (<http://www.ilocalis.com>). It can do things like force your phone to call a number, send you an e-mail when the SIM card is swapped, etc.. I've been using it for months and it's helped me find my phone several times already (although thankfully it hasn't been stolen).

<comment><USER8> iLocalis looks interesting, but do you trust those guys with all your information? I mean they basically know where you are at any time of the day, they might be able to browse your iPhone data, ...

<comment><USER7> That's a great point. Although I trust the guy who runs it (it's a small project run by an independent iPhone hacker/developer), there's no question that a service run by Apple is more trustworthy.

From my view, however, the cost/benefit analysis strongly favors installing the app. Benefit: It has saved me $500 once already. Cost: 14€ + (chance that the data on my phone will be used maliciously) * (average amount of financial damage that would be done in one of these instances).

But in my opinion, the "Find my iPhone" feature of MobileMe is not comprehensive enough. For example, it should still work if the SIM card is swapped. It should work even if the only available connection is Wi-Fi (such as being indoors) and should report back to the user the name of the hotspot. It should work if the OS is wiped/reinstalled.

iLocalis doesn't do all of these things, but it's much closer.

<comment><USER9> I think it should work with another sim and wifi only, as it also works with an iPod touch.

</comment></comment></comment></comment><comment><USER10> Not the best neighborhood in Chicago to try this in.

[http://chicago.everyblock.com/crime/filter/streets/medill- av...](http://chicago.everyblock.com/crime/filter/streets/medill- ave/2700-2799w/1-block/)

</comment><comment><USER11> Nerves of steel? I thought stolen phones would immediately be used to call the most expensive sex hotline possible? So my first move would have been to block the account, not sleep over it in vague hopes of iPhone finder getting it's act together.

</comment><comment><USER12> Great story.

I found myself doing just about the same thing (eerily similar settings in my neighborhood in Brooklyn) when my girlfriend's iPhone was stolen just a few days before WWDC and the Find My iPhone announcement.

At the time I wished for nothing more than this exact technology, but days later when we were reasonably sure we had found (through a few degrees of separation) who had stolen the phone and were _still_ unable to get it back, it dawned on me that this might be one of those social issues that will go mostly technologically unsolved at least for the time being.

<comment><USER4> Apple store personnel treat iPhones/iPods like cord wood. If it breaks, you often just get a new set of hardware. The iPhone might require a sim swap. Given that, there is a financial/technological fix: insurance plus customer service.

On the technological side, send a signal to erase the contents of the phone and permanently disable it. Apple could then give you a new phone. This could be a service like AppleCare, but which would expire every time you used it.

<comment><USER13> "permanently disable it" - self destruct on a text message :)

<comment><USER4> You'd want to use _really_ big public keys for that one.

</comment></comment></comment></comment><comment><USER14> Am I the only one who noticed that they didn't pay the promised $50? Despite multiple promises of reward.

</comment><comment><USER15> "I wuv you, iPhone"

I think I just threw up in my mouth a little.

</comment><comment><USER16> I wonder why they didn't just contact the Police?

<comment><AUTHOR> The cops wouldn't have been able to do much, and they probably wouldn't have cared. I once found an 80gb iPod on the street in Brooklyn - brand new. I took it to a cop and he just said "congratulations".

</comment></comment><comment><USER17> amazing story, I wonder if service like this could be used on other devices.</comment>


Tale of the Slave - <AUTHOR> http://www.colorado.edu/studentgroups/libertarians/issues/nozick_slave.html <comment><USER2> Incredibly thought-provoking and--I dare say, timely. Is it a coincidence this is hosted by colorado.edu?</comment>


VLC for iOS (source — actively being developed) - <AUTHOR> http://git.videolan.org/?p=vlc-ports/ios.git;a=tree

<comment><USER2> already existed, then pulled</comment>


(Yet another) parody of 2048, where you try to lose as fast as possible - <AUTHOR> http://negative2048.com/

<comment><AUTHOR> My friends and I made a parody of 2048 inspired by all the controversy about Threes and 2048, and how the latter is too easy. Your goal is to fill the board and run out of moves as quickly as possible, but there's an AI playing against you, so it's harder than it sounds.

We'd really appreciate any feedback and thoughts about the game, or criticism about bringing another unnecessary 2048 variant into the world.

</comment><comment><USER2> I may be mistaken, but I think you folks made it impossible to win -- new tiles that spawn always have a tile that they can merge into, so there can never be a lack of moves available.

<comment><USER3> Agreed. I had it reduced to a single tile available, yet there was no way to win. Every new tile matched one above or to the side of it.

<comment><USER4> Co-developer here- Not quite. It is possible, but you have to have the right kinds of tiles in the right positions. I won't give away the algorithm, but I do know it can be beaten. Not easily, perhaps, but certainly possible.

<comment><USER5> Can confirm, have just beaten it a few times.</comment></comment></comment></comment>


Secret forum reveals Oz firewall backroom dealing - <AUTHOR> http://www.theregister.co.uk/2010/05/10/australia_firewall_forum/

<comment><USER2> If 10K urls is considered the creaking limit of the system's design, it can hardly be much different than Cleanfeed, the system in place here in the UK, most noticeably involved in the Wikipedia Virgin Killer kerfuffle a while back.

</comment><comment><USER3> I find it more than a little disturbing that an entire nation can look on as their government plans to implement censorship on a massive scale with apparently little public outcry.

<comment><USER4> The fact that Conroy has been trying to implement an Internet filter since November 2007 without success, and has now been forced to delay any legislation until after the next election, demonstrates that there certainly isn't a lack of "public outcry". During the same period, Obama has received the Democratic nomination, won the presidential campaign, and drafted, introduced and passed a substantial and controversial healthcare bill. Considering that Conroy hasn't even managed to introduce any legislation at all into Parliament (and this article states that draft legislation has yet to be assembled) suggests that the government doesn't believe that the public would be receptive to such a policy.

<comment><USER5> True. There's been quite an outcry, it seems to me. What's more, should this legislation ever get passed, it will surely be challenged in court. It's entirely possible such a challenge would succeed.

So, dodgy legislation under threat from irate voters and an independent judiciary. Nothing too concerning there.

<comment><USER6> I can only speak for myself, but it seems common place within my "non- technical" sphere of friends and family to have the vague idea that a) the filter is a merely politicians beating their chests and b) it wont really go anywhere substantial.

<comment><USER7> Whilst it wont really go anywhere substantial I still find it alarming that it can even be seriously talked about. I find it alarming that experts in the area are ignored. I find it alarming that fear and ignorance are being used to stir people up.

Whenever I hear politicians talk about protecting the county/children/us from foreigners/drugs/paedophiles/criminals/whatever it always reminds me of this quote from Hermann Goering (a senior nazi)

"it is always a simple matter to drag the people along, whether it is a democracy, or a fascist dictatorship, or a parliament, or a communist dictatorship. Voice or no voice, the people can always be brought to the bidding of the leaders. That is easy. All you have to do is tell them they are being attacked, and denounce the peacemakers for lack of patriotism and exposing the country to danger. It works the same in any country."

I worry that all it would take is one or two Internet related incidents, a murdered child, something like that, and that would create enough fear for people to go along with this.</comment></comment></comment></comment></comment>


Ask HN: How many of you use ad blocking on most websites? - <AUTHOR>

I keep seeing threads in which people refer to online ads, and I realize that I hardly ever see online ads anymore. I've been running an ad-blocking add-on for Firefox for a long time, and it seems to work pretty well at keeping ads invisible from me. I also do various forms of cookie clean-up periodically to keep my browsing behavior from being tracked by advertisers, and use multiple layers of email spam filtering.<p>Do you like to read advertisements on websites? Do you click through on them from time to time? What ads do you like best? What ads am I missing that I should know about? <comment><USER2> I use fairly sophisticated filtering to block things that are shaped like ads, to block URLs matching certain patterns, and to control JavaScript behavior.

I honestly don't mind ads if they're sane, which is probably why Google is successful (their text ads tend not to be annoying at all). I understand the need for ads, to give sites revenue for the content they produce.

The problem I have is advertisers who are so eager to push their message on me, that they have absolutely no respect at all for me. Shoving things in my face, making loud, constantly animating, colorful abominations? That gets you on my permanent ban list, and may ensure that I never, ever return to your web site.

</comment><comment><USER3> I aggressively block all the ads I can, with the exception of the google text ads. I might start blocking those too.

I have different browsers I use at my client's offices, on which ads are not blocked, so I see the ads then. I occasionally unblock ads specifically, if I want to see what types of ads and how many are running on a specific google search. Almost all ad-clicking I do is "market research" and does not result in me buying anything.

</comment><comment><USER4> I have ClickToFlash, which almost amounts to complete ad blocking nowadays. The rest I don't mind, though I don't often see an ad worth clicking on.

<comment><AUTHOR> Thanks for mentioning that specific brand name.

</comment></comment><comment><USER5> I read advertisements from time to time. I click on them from time to time, especially on Google searches when I'm looking for a company/service that solves a particular problem. I almost never click them on any other site.

</comment><comment><USER6> I want to block all adverts, except search engine ads, which are sometimes useful and never prevent the page from loading.

In practice, I only use AdBlock+ and FlashBlock to block ads; if I used GreaseMonkey too I could probably filter out ads in GMail and Facebook, that appear as part of the html.

I would pay my ISP to filter out adverts.

It would be interesting to find out how much sites would receive for the ads I'm not seeing, and whether I'd be prepared to pay that much not to see them.

<comment><USER7> Actually AdBlock+'s element hiding rules can filter facebook ads. In fact I think a recent version has a subscription for filters that include facebook ad blocking.

</comment></comment><comment><USER8> Heh strange seeing people like Google ads - I tend to view them as the graffiti of the web.

They are nearly always irrelevant, have a very high proportion of spam/scam associated sellers and don't have enough information or value for me to click them.

</comment><comment><USER9> Never use ad blocker. As an entrepreneur, you should keep your market sense(IMO, blocking ads is against it.).

<comment><USER3> I don't think seeing ads helps your "market sense" or any other type of good sense. The ads are generally designed to make you spend money, and usually that doesn't involve making you smarter.

That would be like watching television commercials to learn how to make cars. It's not even good information on how to sell cars; most of car commercials are for cars made by companies going bankrupt, the last thing you want to do is copy them.

That doesn't mean that you might not want to monitor the ads your competitors are running and occasionally survey what else is out there; but in general, if an advertisement is spread across part of your computer screen, thebn fewer brain cells are working to make you money. Unless it is YOUR advertisement that you are working on, of course.

<comment><AUTHOR> _That would be like watching television commercials to learn how to make cars._

Well, it might be a little more like watching television commercials to be aware of what the typical experience of watching broadcast TV is like. A producer of television programs might do that from time to time, although perhaps not all of the time.</comment></comment></comment>


California Won't Accept Its Own IOUs - <AUTHOR> http://www.courthousenews.com/2009/08/04/California_Won_t_Accept_Its_Own_IOUs.htm

<comment><USER2> You have to pay taxes on your income, but you cannot pay taxes with your income.

</comment><comment><USER3> I'm confused:

"17. Can I use my registered warrant to pay my State taxes? You can use a registered warrant to pay some of your State tax liabilities, although you will not receive interest unless you hold the warrant until it is redeemable. For more information, visit the Franchise Tax Board's website at www.ftb.ca.gov." from: <http://www.sco.ca.gov/5935.html>

And: "We will accept registered warrants that are not yet redeemable for full face value towards the payment of tax liabilities." from: [http://www.ftb.ca.gov/aboutFTB/newsroom/Registered_Warrants....](http://www.ftb.ca.gov/aboutFTB/newsroom/Registered_Warrants.shtml)

Is the state not accepting them for payment of sales tax? Or?

Aside from that... 3.75% interest on those, that is tax free. Sounds like a deal to me.

</comment><comment><USER4> Great reason not to do business with the state. In any other transaction you get to dictate the form of payment, but in the government's case it's the other way around because you have no recourse if they renege.

<comment><USER5> Actually, you can sue them, which is what the businesses in question are doing.

It's not the best recourse, but it is the recourse intended by our system.

</comment></comment><comment><USER6> I don't understand how the IOUs are constitutional

Article 1 Section 8 (Powers of the Federal Congress)

"To coin Money, regulate the Value thereof, and of foreign Coin, and fix the Standard of Weights and Measures;"

<comment><USER7> I don't think it's any violation of the Constitution per se.

Put it this way. As is pointed out in the other comment a Bond is not considered currency and states issue those. A Bond in is just a certificate of debt. Whoever issues the bond is borrowing money from you and then paying you interest in return. So it represents currency but is not in itself currency.

An IOU is simply a Bond that doesn't collect interest. California is in effect using it's governing power to force it's vendors to buy high-risk, no interest Bonds from them.

<comment><USER8> _An IOU is simply a Bond that doesn't collect interest._

A dollar is a t-bill with an interest rate of 0% and a maturity of now.

<comment><USER7> Look, I didn't make the rules. But the bottom line is in economics there is currency and there is debt. Is debt just the absence of currency? Isn't Debt worth as much as the currency it represents? Does that make the line blurry?

Yes on all counts. But that's how it works. Debt does not count as currency.

</comment></comment></comment></comment><comment><USER9> If anyone wants to sue over this, pay attention to which day you go to file - all California courts will henceforth be closed the third Wednesday of every month. Your public dollars at work.

</comment><comment><USER10> Yeah. I'm VERY glad I'm not a vendor to the state.

</comment><comment><USER11> Imagine the problem they would have if they _did_ take them as taxes. Ultimately CA _must_ pay back its debts with federals, and the federals must come from taxation, eventually. (That or a bailout) Taking IOUs instead of cash is a serpent-eating-its-tail scenario.

This is actually how hyperinflation can occur, as CA has, in a sense, two forms of money--one they don't control, and one they do. For now, the one they control -sort of- has value, while the one in which their debts are denominated is uncontrollable. If the US and CA were separate countries, and inimical to one another, the US could drive those IOUs down to nothing.

<comment><USER12> I don't understand your first paragraph. Taking their own IOUs is equivalent to reducing the debt. The problem is that they effectively want to borrow money against the IOUs for free, by refusing to accept the IOUs as tax payments.

<comment><USER11> In a best-case scenario for CA, it could pay down its entire debt with IOUs. After that, its finances would somewhat improve because the IOUs pay (I think) three percent interest rather than whatever the bonds do. But then, imagine if the bond holders could sell those IOUs to California citizens for 99 cents on the dollar so that they could pay their taxes with them. The state would suddenly have its own paper on its books and would then need to borrow 26 billion dollars overnight, and the bond market would spank them. Of course, in that same scenario, they could conceivably just pay out the IOUs again, which is how a normal currency works.

Taking them piece meal as taxes would do the same thing, more slowly.

</comment></comment></comment><comment><USER13> Given that the state of California's budget has been getting progressively worse annually, I can't wait to see what next year brings :(</comment>


Recommendation on startup resources? - <AUTHOR>

I have seen many books and resources on startup. However, I haven't really seen a area that actually teach you how to start a tech startup from ground up (especially the technical side).<p>Thank you in advance. :-) <comment><USER2> <http://www.gabrielweinberg.com/startupswiki/Ask_YC_Archive>

</comment><comment><USER3> Check out this site if you haven't already <http://startupschool.org/></comment>


Thanks to Bryan Kennedy of Likebetter for most of the new look - <AUTHOR> http://aboutbryan.com <comment><USER2> I like the wider layout. Much more engaging and consumable. Subtle, still YC, yet well done. Kudos.

<comment><AUTHOR> It's not wider. Perhaps it seems wider because the top bar is narrower.

</comment></comment><comment><USER3> Much appreciated.</comment>


Ask HN: Working part time for equity? - <AUTHOR>

A friend of mine who is founding a company has asked me to work part time on his startup with him.  He's currently working on it part-time as well.<p>I'm wondering how much equity I should be asking for in exchange for ~10 hours a week?  Does anyone have any experience on not being a co-founder, but being the first person to assist in exchange for equity? <comment><USER2> All sorts of problems can crop up if you don't resolve the equity situation up front. Its good you're trying to resolve it as soon as possible.

Depending on how much thought leadership he's provided and how much direction he's given you, it should range from 50/50 in the very best case for you to 80/20 in the worst case (assuming you if you're the #2). That split also depends on whether he is paying you or not to do the work, and whether you really want to loop in with him long-term on the startup.

Are you guys incorporated? Regardless, make sure that the terms are in paper.

When making equity decisions with my co-founder, I found these posts pretty valuable: [http://startuplawyer.com/incorporation/how-to-split-the- star...](http://startuplawyer.com/incorporation/how-to-split-the-startup- founder-equity-pie) [http://startuplawyer.com/startup-issues/keep-your- startup-co...](http://startuplawyer.com/startup-issues/keep-your-startup-co- founder-closer)

Hope that helps.

<comment><AUTHOR> Yep, it's incorporated. It's his idea, and he's driving everything, so I have no qualms with him having the lion's share of stock. I have plenty of my own useful experience I'm bringing to the table of course, and will be working in a mainly product, slightly technical role.

This isn't his first company (hence why I'm happy to follow along and learn from his experience), but the amount of equity offered seems very low. 0.013% of all outstanding shares vesting per month.

Thanks for the links.

<comment><USER2> Agreed, thats a miniscule share of the equity. i know people who have joined companies with 20+ employees and gotten that much or more</comment></comment></comment>


Ask HN: What to look for in a NON-technical cofounder - <AUTHOR>

There is a lot of talk on HN about what to look for in a technical cofounder but I'm wondering what we should look for in a non-technical cofounder. Is there even a need for this person in a small startup? I recall reading that 37 signals doesn't hire anyone who doesn't have a strong technical skill set; no one whose only role is to manage others.<p>What should a non-technical cofounder bring to the table? <comment><USER2> You've submitted this twice so I flagged this version.</comment>


PG - Lost all my karma - <AUTHOR>

PG, I have lost all my karma. It was 93 I think.<p>PS: there should be an email id to send bug reports. <comment><USER2> Something definitely seems to have gone wrong. We'll figure it out.

Edit: There are some corrupted files on the disk. It seems to be related to the new memory we had installed on the server. Fortunately we have recent backups. We probably have enough to reconstruct what's missing, but it may take a few days because I'm travelling.

Anyone besides kashif, bootload, and ardit33 seeing problems?

<comment><USER3> I would be a bit concerned about WFP applications. Any submissions between your last backup and now that may be gone...

<comment><USER2> The only files damaged were a couple that were written just before a crash. No one has reported anything missing from an application.

</comment></comment></comment><comment><USER4> Your account was created 3 hours ago, how could you have had 93 karma? Creating a new account will start your karma over, in case you didnt know.

<comment><AUTHOR> No it wasn't. It was created a long time back. My point is that my account reset for some reason. Now if only PG could respond to this.

<comment><AUTHOR> This comment was posted before my account was reset. <http://news.ycombinator.com/item?id=63522>

<comment><USER4> Interesting, it looks like your entire user was reset along with your karma.

PG recently mentioned the server was running out of memory and they had to temporarily trim some content. Maybe this is related?

I upvoted to try and get this on the front page...

<comment><USER5> That's funny. I ran out of memory on my server last night too. Spent most of the morning trying to trim everything down.

The common scripting languages should include memory optimized basic data structures..

<comment><USER6> Arc is anything but a common scripting language.

<comment><USER5> It's my impression that memory usage is very obscured in functional languages. Others' thoughts?

<comment><USER7> In lazy languages, it's very obscured, because you're not sure whether the integer you're pointing at is a four-byte number or whether it's a big unevaluated expression.

In strict functional languages, and also in Lisp-like languages, it's not obscured. You might, say, not know exactly how many bytes a certain datastructure takes, unless you do some thinking but the same goes for C and C++. (For example, tell me how many extra bytes the std::string datatype takes in the nearest implementation of the STL.) Garbage collection adds the danger of leaving around dangling references, but that doesn't really have anything to do with the functional aspect of the language.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> my karma is gone too :(

It seems like an upgrade gone bad.

<comment><USER9> Fortunately I still have all 3 points of mine.

<comment><USER10> Looks like that comment helped to increase your karma four fold!

</comment></comment></comment><comment><USER11> Yeah now I'm pissed! All my Karma (ex #11 on leaderboard, 1142) , submissions are missing. Plenty of screenshots of mine exist. Boooo Boooo Sup pg?

<comment><USER10> You're _pissed_ because you lost your e-points on a news site? Seriously?

<comment><USER11> More the links to the submissions made and comments so I can mine them for data. For example you have your details over say 157 days.

\- <http://news.ycombinator.com/threads?id=kingnothing>

and

\- <http://news.ycombinator.com/submitted?id=kingnothing>

Mine are over 220 and there's a lot of information that I've been intending to mine in my hackerID project ~ <http://goonmail.customer.netspace.net.au/hackerid/>

That serious enough?

<comment><USER10> Oh, okay. I can understand being upset about that, but I'm sure it will get worked out.

<comment><USER11> _"... Oh, okay. I can understand being upset about that, but I'm sure it will get worked out. ..."_

Thanks, Just letting off some steam. The content is all still there but the index pages are screwed. It'll be interesting now to measure the acceleration of my articles since I'm starting from scratch. So it might actually be a good thing.</comment></comment></comment></comment></comment>


Amazon Route 53 Introduces DNS failover - <AUTHOR> http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/health-checks.html <comment><USER2> Route 53 is becoming a viable alternative to enterprise providers UltraDNS and Dyn. Performance is solid, but features have been lacking. This is a popular feature those providers charge $100+/mo for versus $0.75/mo on Route 53. Monitoring capabilities are limited (tcp and basic http only), but for many this is probably sufficient. DNSSEC is another feature I hope they will support in the future.

A few months back I wrote a blog post on the topic of managed DNS provider comparisons (performance, market share, price, features, network size, etc.):

[http://blog.cloudharmony.com/2012/08/comparison-and- analysis...](http://blog.cloudharmony.com/2012/08/comparison-and-analysis-of- managed-dns.html)

<comment><USER3> Read that post. So <http://www.dnsmadeeasy.com/services/global-traffic- director/> this service is zone based and not geo-ip ?

<comment><USER2> Correct - it is based on the IP anycast endpoint a resolver connects to, not the geo data associated with the resolver's IP.

</comment></comment></comment><comment><USER4> More details can be found in my blog post at [http://aws.typepad.com/aws/2013/02/create-a-backup- website-u...](http://aws.typepad.com/aws/2013/02/create-a-backup-website- using-route-53-dns-failover-and-s3-website-hosting.html) .

</comment><comment><USER5> isn't this offering cannibalizing AWS load balancers? if I have a set of web servers with a load balancer at front and health checks that takes unhealthy nodes out of rotation, isn't it cheaper now to just use this DNS fail-over?

<http://aws.amazon.com/pricing/elasticloadbalancing/> <http://aws.amazon.com/route53/pricing/>

<comment><USER2> Not really - DNS failover is typically much slower to respond compared to load balancing because records are cached.

</comment></comment><comment><USER6> We use DNS Made Easy but and are happy with them. However, for our level of DNS queries per month - e.g. over 50million Route 53 would give us some significant cost savings.

Do you guys know whether Route 53 offers templating mechanism? e.g. setup 1 template and apply to 50 different domains?

<comment><USER4> The AWS templating mechanism is called CloudFormation. Here's a snippet of a Route 53 template:

( [http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuid...](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref- route53.html) ).

</comment></comment><comment><USER7> Would be nice to have the ability to set up some type of alert/notification.

</comment><comment><USER8> Does this feature use EBS to store the state?

<comment><USER9> No, the health check system does not have a dependency on EBS. More importantly, the health checkers are highly redundant and will continue to function even in case of multiple AZ, region, service, or Internet outages.

</comment></comment><comment><USER10> noob question - why use load balancing if DNS failover does essentially the same thing?

<comment><USER2> DNS failover is subject to DNS caching and TTL. Load balancing is real time. A DNS driven failover may take 1-10 minutes to trigger versus instantaneous for load balancing. Good approach to failover is a combination of both.

</comment></comment><comment><USER11> Route 53 is slow ( For a paid solution ). At least when i tested it. It you are doing to use a Third Party DNS that you paid you are either going with the best ones or ones that are good enough like OnApp Anycast DNS.

<comment><USER12> Recommendations for "best"?

<comment><USER13> I personally have always liked DNS Made Easy.

Affordable, always in the top 3 for speed and lots of features.</comment></comment></comment>


Ask HN: Should I learn ReasonML, ClojureScript or Fable? - <AUTHOR> I want to bring powerful features of functional programming into web development. I am not big on the maturity of tooling and support if others( among these three) have better intrinsic features because of which we can conclude it to be more promising and needful in the future. <comment><USER2> ClojureScript if you like lisp and dynamic type. Elm if you like ml family languages and static type.</comment>


A Unikernel Firewall for QubesOS - <AUTHOR> http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/ <comment><USER2> I've seen people run a Linux firewall in runlevel 0 (this is 100% possible if you disable the shutdown script) where the entire user space was disabled and only the netfilter stuff running in memory was active. This MASSIVELY limits the attack vectors to only the kernel itself and virtually nothing in user space while giving you a full Linux feature set, something I'm guessing Qubes doesn't yet do. I learned about this technique in the late 90s where a guy had 2 firewalls in active / failover mode using I believe LVS (also in kernel) with the sentry firewall cd ([http://sentry.sourceforge.net](http://sentry.sourceforge.net)). There was out of band VPN into the network which allowed serial access to reboot them but once the ACLs were burned onto the CD, it was as immutable as it gets with no serious way to harm anything. Besides it being slightly harder to manage, I can't believe no one else has tried it and written about it.

Sorry for getting side tracked, this looks absolutely fascinating and is another great use case for Qubes. The world of unikernels and containers / lightweight vms is clearly converging for immutable infra.

<comment><USER3> I've been recently looking into Javascript based Unikernels. I have found 2 that look very promising.

NodeOS: Takes the linux kernel and strips it to its bare minimum then adds Node/V8 running in kernel space for application support. No C applications, no POSIX utilities. POSIX equivalents (written in JS) are provided for only the most necessary tools.

To build a server, you develop it as normal. Then, the build step packages your app with the kernel to be run as a standalone VM image. The OS is essentially immutable and since it contains no 'general purpose' utilities, the attack surface is limited to your application.

For example, if you need a load balancer. You could import a Node load balancer implementation as a dependency, add a custom config, and generate the VM image for deployment.

The image itself only requires a few MBs in space and can be booted up in seconds so versioning/deployment becomes trivial.

Runtime.js: Takes things even further. Instead of using a thin linux kernel, the whole OS is implemented in JS. They're still building out the basic low- level infrastructure (ex networking protocols, filesystem adapters, etc). Regardless, it's fascinating to see somebody building an OS from scratch in a language that generally isn't known for system-level development.

The performance improvements to be gained from eliminating all of the OS-level protections negate the performance disadvantages of using a higher level language. Eliminating all of the complexity that comes with monolithic, general purpose operating systems dramatically reduces the attack surface.

That's just Node.js. There are plenty of Unikernels being developed for other languages. Since the cloud operates on virtual machine infrastructures, with mostly single-purpose applications, it makes sense to build single-purpose operating systems that can be deployed to the cloud.

</comment></comment><comment><USER4> In short: running a firewall VM as an ML unikernel saves RAM, increases security. Source code available.

<comment><AUTHOR> That doesn't do it justice and there's more to it than that e.g. the readability (and 'debugablity') of the new code.

I note that the post _does_ have a very useful summary at the end, which is a 90 sec read (there's even a ToC at the beginning that can take you straight there). I've copied it below in case that's useful.

 _" QubesOS provides a desktop environment made from multiple virtual machines, isolated using Xen. It runs the network drivers (which it doesn't trust) in a Linux "NetVM", which it assumes may be compromised, and places a "FirewallVM" between that and the VMs running user applications. This design is intended to protect users from malicious or buggy network drivers.

However, the Linux kernel code running in FirewallVM is written with the assumption that NetVM is trustworthy. It is fairly likely that a compromised NetVM could successfully attack FirewallVM. Since both FirewallVM and the client VMs all run Linux, it is likely that the same exploit would then allow the client VMs to be compromised too.

I used MirageOS to write a replacement FirewallVM in OCaml. The new virtual machine contains almost no C code (little more than malloc, printk, the OCaml GC and libm), and should therefore avoid problems such as the unchecked array bounds problem that recently affected the Qubes firewall. It also uses less than a tenth of the minimum memory of the Linux FirewallVM, boots several times faster, and when it starts handling network traffic it is already fully configured, avoiding e.g. any race setting up firewalls or DNS forwarding.

The code is around 1000 lines of OCaml, and makes it easy to follow the progress of a network frame from the point where the network driver reads it from a Xen shared memory ring, through the Ethernet handling, to the IP firewall code, to the user firewall policy, and then finally to the shared memory ring of the output interface.

The code has only been lightly tested (I've just started using it as the FirewallVM on my main laptop), but will hopefully prove easy to extend (and, if necessary, debug)."_

</comment></comment><comment><USER5> Great work. That's doing it right. Another good one tried in separation kernels was safer runtimes for imperative languages like Ada. A networking stack and firewall in one like that would be an interesting experiment as well.

</comment><comment><USER6> QubesOS uses a Linux system with 300MB of RAM for the firewall? I just installed OpenWRT 15.05 Chaos Calmer on my router, with 32MB of RAM and 4MB of flash, and almost 1MB to spare. There are some differences between QubesOS and OpenWRT, but that still seems to be excessive by an order of magnitude.

<comment><USER7> I don't think Firewall VM is trimmed in any way, compared to their standard VMs, so it's running a lot of "cruft" [1] - Xorg, systemd and friends, extra Qubes plumbing. It all adds up to ~200MB, and then the rest is used by buffers/cache.

[1] at least on 3.1-RCx I have running, where I had to create Firewall VM manually, as installer has failed to deploy those "service VMs".

</comment></comment><comment><USER8> C3TV – Towards (reasonably) trustworthy x86 laptops: [https://news.ycombinator.com/item?id=10833637](https://news.ycombinator.com/item?id=10833637)</comment>


Ask HN: Is censorship by tech companies okay? - <AUTHOR> We live in a different world than when the constitution was first written. Now corporations are much more powerful and the truth is there is often only one option. You're not going to create a facebook alternative, for example.
But these tech companies are now heavily censoring the services we use to make sense of our world.
Do you think it's okay for tech companies to censor what you can say or what you can see? <comment><USER2> In one recent interesting case of PragerU v YouTube[1], it was ruled in California that YouTube is not a public forum and the First Amendment does not apply. It's not unthinkable that other platforms such as Facebook will or already have benefited from similar rulings.

In the case of PragerU being censored, of course I can't deny that I am personally happy that YouTube is doing something about their inflammatory hate speech, but that is just my opinion. Perhaps next time they decide that something that I personally agree with should be banned from the platform. How will I react then?

The major difference between Youtube and taking it to the streets is that the latter is protected by the law and provides a clear legal recourse if your right to express your opinion is denied. If private corporations now change how we take our opinion "to the streets", then the inevitable consequence will be that we're going to be censored one way or another. So to change all of this, perhaps we could

1) turn platforms such as YouTube owned by private corporations into public forums, 2) embrace a more federalized/decentralized web (web 1.0 self-host- style), where we put out our opinions on our own domains that we can call our own, 3) go out on the streets (difficult because covid-19)

The fact that people tend to flock around opinions and communities will never change, but what we might consider changing is how these communities (Facebook, YouTube, etc.) are organized.

[1] [https://www.bbc.com/news/technology-51658341](https://www.bbc.com/news/technology-51658341)

</comment><comment><USER3> > You're not going to create a facebook alternative

Bullshit. People need to stop treating facebook and others as if they're impossible to compete against. Dream big and build it.

Will it be hard? You bet. Impossible? Nope. And I certainly agree with you, censorship is the new norm. That also creates opportunities for others.

</comment><comment><USER4> No it's absolutely not ok. It's abusive and removes power from the people.

They aren't just a business - those that censor are absolutely the enemy of the people.</comment>


Apps downloaded with a promo code can't be reviewed anymore - <AUTHOR> http://www.tuaw.com/2011/05/03/apps-downloaded-with-a-promo-code-cant-be-reviewed-anymore/ <comment><USER2> While it's surprising they ever allowed it, it's good to see Apple working on bettering reviews.

</comment><comment><USER3> I'm glad to see Apple taking care of the App Store fraud problems

</comment><comment><USER4> ...that's Apple apps. This news does not pertain to any other apps from other sources or for other platforms.

</comment><comment><USER5> I hated the "PLS LET ME REViEW YOUR APP GOOD IF YOU GIVE ME CODE" emails you get all the time, and the inflated ratings by those who used them.

Good move.</comment>


Ask HN: Apartment Hunting Near Stanford - <AUTHOR> My partner and I are moving to the peninsula for 2 years. We most likely can't make a prior trip out to secure housing before the move. We have a small quiet dog.
We need to be able to get to Stanford's campus roughly 4 days a week. We are experienced bike commuters with a range of roughly 5 miles each direction.
What sources on info are most likely to be helpful to our housing search? My anxiety over this is extreme. Any good info is deeply, deeply appreciated. <comment><USER2> The Stanford community housing webpage looks useful:

[https://rde.stanford.edu/studenthousing/community- housing](https://rde.stanford.edu/studenthousing/community-housing)

<comment><AUTHOR> We unfortunately aren't eligible.</comment></comment>


Ask HN: Which books and open source projects make up the programming "canon"? - <AUTHOR>

Buzz Andersen mentions a few in this post: http://weblog.scifihifi.com/2005/07/22/on-interviewing/ <comment><USER2> K&R, SICP, TAoCP. Those aren't debatable.

Stevens is possibly only really _necessary_ for UNIX systems developers these days, but I see enough people with fundamental misunderstandings about protocols and networking and memory management and processes, etc. that maybe they should also be considered mandatory. At least worth a skim.

</comment><comment><USER3> Programming is too young of a field to have a "canon". And I think any field that does have one that people really care about is probably a bit ossified and dead.

<comment><AUTHOR> Why do you think that?

</comment></comment><comment><USER4> SICP comes to mind... Knuth's TAOCP also.

</comment><comment><USER5> I really liked The Pragmatic Programmer, although some might think it's not a very technically challenging work.

I also like most of O'Reilly's Perl books.

Also, Jonathan Rockway's book on Catalyst was very helpful for me, although there were some issues with typos in the first edition (which is to be expected.)

Also, Philip Greenspun has published a good free collection of computer- science and web-development related texts on his website.

(Sure, he's a little arrogant and some people find his writing style to be somewhat abrasive or even borderline nonsensical, but I certainly liked most of his work. And I believe I learned quite a bit from it, as well, though I'm sure that is debatable.)</comment>


Ivan Golunov, an investigative reporter at Meduza, has been arrested in Moscow - <AUTHOR> https://twitter.com/Alexey__Kovalev/status/1137088350500925440 <comment><USER2> Having worked in Meduza as CTO for 4 years, I have a rather thick skin on this matters. However, this particular shitshow really pissed me off.

Ivan Golunov is one of the best investigative journalists in Russia and have crossed so many powerful people that he is SUPER CAREFUL about abiding the law. I have heard he was working on the FSB corruption lately.

Now police arrests him, beats him, denies lawyer for hours and then says he had 10 kilo heroin in his apartment. They want to put him in prison for 10-20 years. This is insane even by Russian standards.

Fuck this regime.

<comment><USER3> > Now police arrests him, beats him, denies lawyer for hours and then says he > had 10 kilo heroin in his apartment.

How likely is it, that Ivan Golunov was targeted for his latest report, which was published the next day after his arrest[1]?

> This is insane even by Russian standards

No, that's not insane by Russian standards at all. At least he is still alive, unlike some of his colleagues[2]:

"The day before his fall, Borodin told his friend that he had seen armed, camouflaged men near his flat. Following this, he attempted to find a lawyer. Later, however, Borodin called his friend again and said he had made a mistake, and that he thought the men had been taking part in some kind of training exercise."

What I cannot understand, is why would anyone choose such a job without leaving Russia for one of the Baltic states first.

Is the "List of journalists killed in Russia"[3] not long enough already?

[1] [https://meduza.io/en/feature/2019/06/07/the- evictors](https://meduza.io/en/feature/2019/06/07/the-evictors)

[2] [https://en.wikipedia.org/wiki/Death_of_Maksim_Borodin](https://en.wikipedia.org/wiki/Death_of_Maksim_Borodin)

[3] [https://en.wikipedia.org/wiki/List_of_journalists_killed_in_...](https://en.wikipedia.org/wiki/List_of_journalists_killed_in_Russia)

<comment><USER4> It's the difference between exit and voice. I can perfectly well understand that many people may love Russia and it's culture, and hate the politics, so much that they're willing to die to change the politics. I'm sure they would rather not, but they appreciate the risk.

I can imagine that to readers, a journalist reporting from abroad looks less earnest, or perhaps readers think they are more susceptible to control by foreign interests. To the journalist, he or she can't interview Russians. And unfortunately, the Baltics wouldn't be much more safe for the determined state anyway.

</comment></comment></comment><comment><USER5> I was born in one of ex-Soviet republics and lived in Russia for a bit in the 90s and on one hand I'm surprised that people tolerate this level of bullshit, but on the other hand I can see why they do. Russian government basically needs to ensure that the quality of life is a tad better than what it was in the 90s to keep most people docile. Russians have been through so much shit that they can endure anything and the government is basically taking advantage of this and does whatever it wants in plain sight. This absurd submissiveness even has its own term in Russian - Vata (literal translation is cotton), which basically implies you're so soft, submissive and brainwashed that you ultimately don't care what happens to you as long as your basic, fundamental needs are met. However, the new generation of Russians is completely different and have no interest living in stagnation, deprived of future for themselves and their children, but man, the wall is so tall at this point it's hard to see what they can achieve. I really believe that not much is going to change in Russia until the Soviet generations die out, as sad as it may sound.

<comment><USER6> As one ex-Soviet to another, I think you are being too optimistic. The situation in smaller cities seems to be quite dire to me. Most of the people I know either don't know of the situations like this, or don't care. They still have some freedom of information, some level of access to "alternative" worldviews, but they prefer not to exercise it and to get their daily dose of brainwashing from RT and Russia 24.

For example, to most of my acquaintances Navalny is known as "the guy who stole the timber".

Honestly, I am not at all sure if Russia is still salvageable. I've been reading some of the classic literature from 18-19 centuries, and it reads like it was written yesterday.

I am thinking of just leaving as far away as I can from all this fucking bullshit, before the iron curtain comes crashing down.

<comment><USER7> As someone from Central Asia, allow me to correct you. The only people who matter are those who who live in the capitals and the biggest cities. As soon as people in Moscow start getting disappointed in the "system", the regime will quickly collapse.

</comment></comment></comment><comment><USER8> News stories:

[https://www.bbc.com/news/world- europe-48566028](https://www.bbc.com/news/world-europe-48566028)

[https://meduza.io/en/feature/2019/06/07/what-we-know-so- far-...](https://meduza.io/en/feature/2019/06/07/what-we-know-so-far-about- the-arrest-of-meduza-correspondent-ivan-golunov)

</comment><comment><USER9> It is remarkable how they incriminate him 5.37 grams of cocaine. This is 0.37g over "massive possession" legal threshold, but not even by a whole gram as to not hit too hard on some officer's private stash.

</comment><comment><USER10> "Doctor treating @meduzaproject 's Ivan Golunov says he may have broken ribs, a concussion and a hematoma. All likely sustained while he was in custody. Police won't allow him to be hospitalized or have an X-ray."

That's just abhorrent.

<comment><USER11> This is just modern Russia.

</comment></comment><comment><USER12> And just for people not from Russia - you don't really need to be an investigative journalist for the police to put you behind the bars, then to put 5+ grams of cocaine somewhere into your apartment and 228 you. All you need is a sucker who needs to meet the quota or a cunt who wants a bit of cash as bribe. As simple as that.

</comment><comment><USER13> Too bad this actual journalist doesn't have celebrities queuing up to advocate on his behalf. This sounds like a classic frame-up. [https://meduza.io/en/feature/2019/06/08/moscow-police-say- iv...](https://meduza.io/en/feature/2019/06/08/moscow-police-say-ivan-golunov- refused-to-surrender-forensic-samples-and-here-s-why-that-claim-looks- extremely-bogus)

</comment><comment><USER14> So ironic Meduza is operating from Latvia.

Meduza focusing more on Russia proper, I'm not aware of any decent quality local Russian language news media in Latvia. That leaves a large part of the population exposed to "news" worse than Fox News. That is not a healthy situation...

The _local_ news media in Latvia are mostly bad quality. Apart from ir.lv and small initiatives like rebaltica.lv, that is. Those are both Latvian language. The biggest newspapers diena.lv and nra.lv are both linked to local oligarchs. Quite ironic, especially when you know that nra translates to _independent_ morning news...

P.S. If anyone can point me towards decent quality Russian language media in Latvia, I'd be really grateful!

<comment><USER3> > If anyone can point me towards decent quality Russian language media in > Latvia, I'd be really grateful!

What about [https://rus.delfi.lv/](https://rus.delfi.lv/) ?

<comment><USER14> Thank you for your comment. Delfi's not too bad indeed, for a web news portal. Probably the best available.

I should have clarified that with "decent quality", I meant things like original investigative journalism and a verifiable ethics policy. Delfi falls short on the first and I'm not entirely sure about the second...

</comment></comment></comment><comment><USER15> Very sad to read about this. I actually didn't realize that Russia still had any free press.

<comment><USER16> Meduza is located in Latvia, only some of its journalists are in Russia.

</comment></comment><comment><USER17> In the fading days of the Soviet Union they put away dissidents in insane asylums where they were pressured into giving up their USSR citizenship and leaving for the West. While inhumane, no one ever got beaten or treated as poorly as the modern Russian police treats its opponents. That was partially why 1991 was a bloodless revolution, the USSR mostly abided by its own laws, minus the democracy part. I have a feeling history will judge the current regime worse than the Communists.

<comment><USER7> The situation is actually quite a bit more subtle. The most "lawful" periods in the Soviet Union were during the Khrushchev and Andropov times. Brezhnev's period (esp. th last days of it) was a a complete mess, when the Soviet police acquired enormous power and felt hey can do anything the want, especially in Moscow. Yet KGB was indeed quite bit less dirty than FSB.

</comment></comment><comment><USER18> Totalitarian countries always don't like the journalists, nothing new. Khashoggi and many others deals needs a good court.</comment>


99% of programmers are law-abiding citizens... - <AUTHOR> http://weblog.raganwald.com/2007/04/99-of-programmers-are-law-abiding.html <comment><USER2> What a douche. As if there's something glorious about being one of these 'tards who can't distinguish the difference between the way computers work and the way reality works. People, when speaking and writing, do not usually intend to be excruciatingly specific. Learn2deal.

<comment><AUTHOR> It looks very much like I didn't do a very good job of communicating my thoughts. I was actually trying to write an essay about the importance of the marginal.

Can you be a little more literal and tell me what part of the post seems to say something about distinguishing the difference between computers and reality?

Also, I thought I was hand waving the "99" thing and saying it isn't important how accurate the number is. Should I be more emphatic?</comment></comment>


US intercepts Russian bombers, fighter jets off the coast of Alaska - <AUTHOR> https://lite.cnn.io/en/article/h_11db5baf277754ae4110a168cfd46bfc <comment><USER2> Hope the Air Force has upgraded their radar systems. The one I worked on in Iceland was dismantled right after the Berlin wall fell:

[https://www.radomes.org/museum/showsite.php?site=Rockville+A...](https://www.radomes.org/museum/showsite.php?site=Rockville+AS,+IS)

[http://wikimapia.org/1006454/Former-Rockville-Air- Station-H-...](http://wikimapia.org/1006454/Former-Rockville-Air- Station-H-1-DYE-5-DEW-Line-Radar-Site)</comment>


Ask HN: Storing Credit Card Numbers - <AUTHOR>

I would prefer to constrain the discussion to methods of safely storing credit card numbers on a webserver, and stay away from the whole "don't do it" boilerplate.
Given that, how would you do it?
It seems to me, that any crypto magic you may perform on your data, before storing it into your database, is coded right there for any attacker with access to your source files.  If they have access to your database, I assume they also can access your source files.
So, does everybody ignore that fact?  Or do they use compiled code that they were careful to remove the source after they compiled it?
I'm envisioning a c program that uses variables like private ip address, ip address, etc, as encryption keys, or just as gates to keep the program from working.  Compile it, remove the source code, and bask in the knowledge that even if your harddrive is cloned, it still won't work when they run it on their system.
Is there a better way? <comment><USER2> The first issue is why do you want to store them, just for the record or do you need to do something with them. Do you need to store that actual number or would a hash of the number be acceptable (for comparison purposes).

Databases are commonly compromised by SQL injection attacks that reveal the contents of the database. Some databases, MySQL for example, have functions that allow the database to display the contents of files off the filesystem. But on the whole, if someone has gained access to your database it does not immediately follow that they have access to your code. Only that you need to tighten up on security.

An alternative to hashes, but somewhat more expensive computationally, would be to encrypt the CC number into the database using the public key of a Public/Private encryption scheme (PGP for example). So even if they got hold of your database and the public key they could still not, realistically, decode the CC number. Providing the private key is held securely on another server!

It all comes down to what you need to do with the CC numbers. Long ago I worked on some software to track CC fraud for a major store (was a CC number used in store A also being used in store B, it was likely that the card had been cloned as most customers only shopped at their local branch), we used hashes of the numbers. We didn't even need to know who the customer was, everything was driven by electronic till receipts and hashed CC number.

Do you need the actual CC numbers or would a hash be equally as usable?

<comment><AUTHOR> I need the CC numbers to do monthly billing.

</comment></comment><comment><USER3> Quite a few people suggested gpg/hash or public key. If you do that (I wouldn't), be sure to include fluff before and after the number inside your signed message; A credit card has ~30 bit of randomness, and if you know the hashed/encrypted (even if salted) version of the hash, a hacker can just enumerate the credit card number to see if it comes out the same.

It's not just the credit card numbers that are valuable -- it's the combination of credit card number + billing address that are generally required to make a purchase. 30 bit enumeration can require just a few minutes (or even seconds) on modern CPUs and GPUs. So, if you do store them this way, fluff them front and back with random data that you ignore when decoding.

What would I do? Make sure the user has a password (Use HMAC/bcrypt to verify password; DO NOT STORE PASSWORD!); When the user logs in, derive key from password using a different HMAC with different salt, and store in memory/session vars only for as long as needed. Use _that_ key to encrypt the credit card number with a symmetric cipher, e.g. AES; make sure to purge these keys from memory/session directory early and often.

Advantage: You don't have access to the credit card on record even if you (or a rogue employee) wants to. Active participation from user _required_ to get access to data. If your server is hacked, only credit cards used while a hacker has complete view of traffic are compromised, and not all data stored.

Even better: offload to payment processor and make it their problem.

Really.

<comment><AUTHOR> I am writing code to use authorize.net's CIM.

Here's the problem.

I don't like taking more information than is needed from people. I don't intend to take CVN numbers, and I don't intend to take Street addresses. You don't need them. All you need is a zip code for verification. I know people that run telephone chat lines. They only take zip codes, because people are typing everything into their telephones. No letters allowed.

Also, you'll note that 37 signals only takes a zip code. No CVN, no street address.

So, I log into my Authorize.net account, go to the virtual terminal, enter a transaction with only zip code verification. It works. No problem.

I go to their CIM panel, try to enter the same information. They tell me I need street address. Authorize.net tech support is extremely unhelpful, telling me to talk to Visa, ignoring that they allowed the exact same transaction through another area of their site.

So, I'm paying $25 a month for CIM, for the privelege of being forced to make my users life unnecessarily complicated. I have a problem with that.

If I can safely store those numbers without CIM, I intend to do so.

<comment><USER3> Well then, the method I described earlier would work for you; Exposure is limited to clients actually giving their passwords and/or using the credit cards _while the system is compromised_ ; It mitigates the risk that you keep hearing about in breaches, of _all_ accounts being exposed.

And just remember, that by storing those numbers locally, you're also taking potential liability for things that go wrong. To assess how much that is in cash, call a few insurance companies and ask them to give you a quote. Assume they have 25% markup on the real cost; That's how much you are "paying", although you are not doing it out-of-pocket (Though, in a catastrophic event, you _will_ be paying a lot)

</comment></comment></comment><comment><USER4> You should be using a separate database server than your web server if you're going to be storing credit card numbers. The database server should not be accessible by any machine except a small whitelist of IPs that you've specified. That way when your webserver gets compromised, it will require some looking around to realize the database containing credit card numbers isn't there.

Most server compromises that I've seen have stayed local to the server - I'm not a security pro; but generally I've seen the server that got knocked over get messed around with, anything on that server was fair game.

Beyond that, I'm sure there are other things you should do to protect the database that contains the credit card numbers; but seriously - keep them off your web server.

<comment><AUTHOR> That's actually a direction I was thinking about myself. Make myself a restful decryption webservice, Communicating by backchannel private ip to the webserver. When I need a number for monthly billing, submit it to the web service.

I also had the idea of some dummy security trigger database entries, so if somebody actually camps out on my server, using my own webservice to decrypt the database, eventually they hit one of my trigger entries, and my webserver reboots and my cell phone starts ringing.

<comment><USER3> If it's monthly billing, why not keep that computer off (plugged out if you're worried about wake-on-LAN attacks), and manually turn it on once a week/month for 10 minutes to process everything?

</comment></comment></comment><comment><USER5> I'd recommend starting with the PCI DSS. That standard is required by pretty much all card companies, and compliance is enforced by a self-assessment checklist and/or security assessor. If you plan on storing card information, you must be in compliance with this standard.

PCI DSS Standard: [https://www.pcisecuritystandards.org/security_standards/pci_...](https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml)

More info on Wikipedia: [http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...](http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard)

</comment><comment><USER6> You should look up what is recommended by the PCI DSS ([http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...](http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard) / <https://www.pcisecuritystandards.org/>).

</comment><comment><USER7> Let your payment gateway handle it. Just store the reference number they give you in your database, and look it up in their web interface later if you need it.

Don't let the number even touch the disk!

</comment><comment><USER8> If you're going to store that info, use gpg (or perhaps gpgme) to encrypt it and keep the private key for decryption somewhere completely separate. Access to the source code shouldn't matter at all.</comment>


Fraunhofer Lines - <AUTHOR> http://booktwo.org/notebook/fraunhofer-lines/ <comment><USER2> Amazing post and amazing story telling.

Sure, I got a bit lost in the middle (did the blog post ended? am I in a new blog post?) but all in all it was quite insightful on many levels (the lines themselves, the dual FOIA requests, etc.)

<comment><USER3> This is actually what I liked, two different parallel stories intermingled and somehow blending together at some point. Great post!

</comment></comment><comment><USER4> Shame this post doesn't have a subtitle attached - it is about Freedom of Information

<comment><AUTHOR> True but I avoid rewriting titles of what I post, only when they are too long.

</comment></comment><comment><USER5> I began reading this article hoping for some speculation on the spectrum, and in his words, "the politics of light". I was mildly disappointed that instead of analysis of the ownership, usage and/or pollution of the spectrum, the article built up to an art installation of Fraunhofer lines and redactions of FOIA-requested documents superimposed on a rainbow.

<comment><USER6> Yes, there's no "there" there. It's all sheen, no substance; the only aesthetic is in the "mystery" of what it means

</comment></comment><comment><USER6> This is Monster Rancher as Modern Art. The art doesn't add anything to our understanding of the redaction; it's just got some fluffy wording around it.</comment>