The State of Go: Where we are in February 2016 - <AUTHOR> https://talks.golang.org/2016/state-of-go.slide#1 <comment><USER2> The Go runtime is really starting to look sexy. 20 ms GC pauses on 200+ GB heaps!

I remember a thread discussing a pauseless GC on the dev mailing-list; where Gil Tene, of Azul C4's fame, commented on having a clear policy on safepoints from the beginning was paramount to having a good GC. It looked like the community is very biased towards doing the fundamental things well, and attracting the right people.

And on top of that we're get BLAS and LAPACK bindings from [https://github.com/gonum](https://github.com/gonum)

<comment><USER3> You have to be very careful about these sorts of GC statistics. Things are often not quite what they seem and they depend a lot on the type of app you run.

The first thing to be aware of is that with modern collectors (I have no idea how modern Go's new collector is though), GC pause time depends on how much live data there is in the young generation. So you can easily have enormous heaps with very low pause times if all your objects die young and hardly ever make it into the old generations, because then you never really need to collect the rest of the heap at all.

Of course, outside of synthetic benchmarks, many apps don't show such pleasant behaviour, and often GC algorithms face difficult tradeoffs that are only really knowable by the developers. For instance, do you want low pause times, or less CPU used by the collector (higher throughput)? It turns out that's a fundamental tradeoff and the right answer usually depends whether your app is a user facing server (needs low pause times) or a batch job (better to pause for long periods but complete faster). No runtime can know that, which is why the JVM has tons of tuning knobs. Left to its own devices you can theoretically get away with only tweaking a single knob which is target pause time (in G1). Set it lower and CPU usage of the collector goes up but it'll try and pause for less time. Set it higher and the collector gets more efficient.

Or you can just buy Zing and get rid of GC pauses entirely.

So a stat by itself like "20ms GC pauses on 200GB heaps" doesn't mean much by itself. You can get very low pause times with huge heaps out of the JVM as well:

      http://www.slideshare.net/HBaseCon/dev-session-7-49202969

but of course, you have to pay the piper somehow ... assuming non-weird heap usage the program will run slower overall.

<comment><USER4> The GO gc is not generational, those 20ms are for a full gc. Certainly the details of the heap usage of the application is going to affect gc times, but this is not the time for just a nursery collection.

<comment><USER3> OK, the tradeoff they're making that I missed is that it's not a compacting collector. So eventually your heap can fragment to the point where allocation gets expensive or impossible. Unusual design choice.

<comment><USER5> Unlike Java Go has first class value types and memory layout can be controlled by developers. So it leads to much less objects on heap and compact layouts both will lead to far less fragmentation. As you can see here Go apps use quite less memory than Java. [https://benchmarksgame.alioth.debian.org/u64q/go.html](https://benchmarksgame.alioth.debian.org/u64q/go.html)

<comment><USER3> Unfortunately it's impossible to reliably measure the memory usage of Java that way because the JVM will happily prefer to keep allocating memory from the OS rather than garbage collect. It makes a kind of sense: GC has a CPU cost that gets lower the more memory is given to the heap, so if you have spare memory lying around, may as well deploy it to make things run faster.

Of course that isn't always what you want (e.g. desktop apps) ... sometimes you'd rather spend the CPU and minimise the heap size. The latest Java versions on some platforms will keep track of total free system RAM and if some other program is allocating memory quickly, it'll GC harder to reduce its own usage and give back memory to the OS.

In the benchmarks game I suspect there aren't any other programs running at the same time, so Java will go ahead and use all the RAM it can get. Measuring it therefore won't give reasonable results as the heap will be full of garbage.

Value types don't have much to do with fragmentation, if anything they make it worse because embedding a value type into a larger container type results in needing larger allocations that are harder to satisfy when fragmentation gets serious. But ultimately a similar amount of data is going to end up in the heap no matter what. Yes, you can save some pointers and some object headers, so it'll be a bit less. But not so much that it solves fragmentation.

</comment></comment></comment></comment></comment></comment><comment><USER6> At work (Lytics) 100% of our backend code has been in Go since the beginning over 3 years ago, so slide #6 highlights one of the most things with nearly every Go release:

> Changes to the language: None

[https://talks.golang.org/2016/state-of- go.slide#6](https://talks.golang.org/2016/state-of-go.slide#6)

We generally get our entire stack upgraded to the latest release within 1-3 months with little effort. It wouldn't be much more work to be ready to upgrade on release day, but we haven't found a reason to worry about it.

Go is such a breath of fresh air compared to past Java and Python jobs where production was usually at least a major release version behind the latest and there was extra effort spent getting everyone using the same implementation (Oracle Java v OpenJDK or Ubuntu's Python v CentOS's -- there are differences!).

Conservative releases aren't a must-have for a language, but I do appreciate having one less operational headache to consider.

<comment><USER7> Can you speak to why you were behind latest on the JVM? I can think of less than a handful of breaking changes over the last 15 years. I'd say it was _more_ stable than Go.

<comment><USER8> Issues I've seen with JDK upgrades over the years (that I can think of right now):

* when "enum" keyword was added, if you had a variable named enum you had to rename it.

* If you use any of the sun.* packages you always ask for trouble on major upgrades.

* GC changes over the years can change how your program runs (latency changes, OOM issues). This probably applies to Go as well.

<comment><USER6> GC changes is a big one in the JVM, but not so much in Go (so far) as Go offers basically no GC tunables.

So while your awesome CMS tweaks from JDK7 become worthless once you switch to G1 on JDK8, with Go all you can do to optimize the GC is to create less garbage to begin with.

Not trying to say one approach is better than the other: Go's approach is operationally simpler but far less sophisticated than the JVM's.

<comment><USER9> >as Go offers basically no GC tunables.

This isn't actually true, Go has a single tunable: "GOGC" [https://golang.org/pkg/runtime/](https://golang.org/pkg/runtime/)

<comment><USER6> I consider that "basically no" compared to Java's daunting array of options.

</comment></comment></comment></comment></comment></comment><comment><USER10> The concurrent map access checks in Go1.6rc1 have already uncovered one such bug in my code. Love it!

Oh, and I've already made use of the whitespace-stripping in text templates, too! :)

One thing I was worried about from the focus on reducing maximum GC pause times (i.e. latency) was that this might negatively affect GC _throughput_. For example, maybe the pauses are shorter but there are many more of them. The project I'm working on at the moment exercises the GC heavily but is not concerned with latency (it's bulk data-processing), and I didn't see any significant regression in performance/throughput from 1.5 to 1.6rc1. So, yay.

<comment><USER11> Aggressive GC latency improvements, like the ones Go is making, virtually always negatively affect throughput. For example, Azul C4 has lower throughput than HotSpot (at least per the numbers cited in the paper). There's no free lunch in GC.

<comment><USER12> But I would argue that most people who use Go, use it to write user-facing server apps, or at least server apps in which response time is an important metric. I don't know anybody who uses Go to primarily write batch jobs where throughput matters more than latency.

<comment><USER3> Yeah, but that's circular - if you did want to write a high performance batch job, maybe you wouldn't use Go because of the GC.

And hi by the way ;)

</comment></comment></comment></comment><comment><USER13> A Golang beginner's question: do these GC improvements make Golang a suitable language/ platform for writing games?

EDIT: I realise this is a vague question. I suppose I was wondering if the order of magnitude GC performance in Go is likely to interfere with game loops you might find in reasonably CPU/ GPU intensive Indie games (i.e. NOT Crysis).

<comment><USER14> You have to ensure that the GC never makes you drop a frame. For 60Hz, that means staying below 16.7ms.

Given that a Go 1.6 GC will still take about 4ms, you have 12.7ms to generate a frame, which can be too limiting for some CPU-intensive games, but is perfectly acceptable for many games.

(In Go 1.5, a GC was much more likely to make you drop a frame, as it could easily average 40ms.)

On the other hand, there are less high-quality libraries in Go than in C++ or in JS. That may be the most limiting factor.

<comment><USER3> Interesting fact: Unreal Engine uses a GCd heap (or used to at least) for its core game state, so that means many AAA games use GC. And you can hit 60fps with it.

Their secret is they keep the game state heap really small. Like, 50 megabytes, maybe.

<comment><USER15> They still do

[https://docs.unrealengine.com/latest/INT/Programming/UnrealA...](https://docs.unrealengine.com/latest/INT/Programming/UnrealArchitecture/Objects/Optimizations/index.html#garbagecollection)

</comment></comment></comment></comment><comment><USER16> Their solution to the template whitespace thing underlines a fundamental difference between what the Go core developers consider to be good language/library design and what I do.

To me adding the - to the template tag {{foo -}} to get rid of whitespace on that side of the tag is totally unintuitive and a really kludgy solution. Sure, it's terse and being terse can be nice, but terseness to me probably doesn't even make it into my top 10 concerns when designing a language or library.

In my mind a lot more thought and consideration should be put into solutions for problems that are going into core libraries. Stuffing cute hacks into the core libraries willy nilly leads you to PHP. The consequences of which I deal with daily.

<comment><USER17> This change simply draws from Jinja, which has had this feature for nearly 10 years[0]. It's a simple and efficient solution to the problem of trimming whitespace on either side of a template tag, I fail to see what is kludgy about it (and intuitiveness is in the eye of the beholder). In my experience it's clear, simple and doesn't make the template less readable.

> Sure, it's terse and being terse can be nice, but terseness to me probably > doesn't even make it into my top 10 concerns when designing a language or > library.

The whole point of this feature is to be terse, otherwise you could already use template comment to trim formatting whitespace.

[0] [http://jinja.pocoo.org/docs/dev/templates/#whitespace- contro...](http://jinja.pocoo.org/docs/dev/templates/#whitespace-control)

<comment><USER18> Perl's Template Toolkit has had this feature since at least 2001 (and I remember it being available before that but my googlefu is failing me right now.)

cf [http://www.perl.com/pub/2001/01/tt2.html](http://www.perl.com/pub/2001/01/tt2.html)

> If these tags are replaced with [%- -%] then the preceding or following > linefeed is suppressed.

<comment><USER17> Nice, thanks for the history lesson. Now I wonder whether Armin Ronacher got it from there or independently reinvented it.

</comment></comment></comment></comment><comment><USER19> How the Go GC does comparing with the JVM one ?

<comment><USER20> JVM's gc is most likely significantly better. On the other hand golang's gc needs to collect less objects, in _some_ cases orders of magnitude less.

If you compare a slice of structs with 1000 elements, it'll be one object (and allocation) in golang. Equivalent array in JVM requires the array itself + 1000 Objects, 1001 allocations. In this case, golang has lot less object graph to gc.

Of course slice of 1000 interfaces or pointers faces the same 1001 issue in golang as well.

You could emulate same gc load cost in JVM at cost of runtime performance by storing the objects in a byte array and [de]serialize as needed, but that's neither idiomatic or acceptable solution most of the time.

<comment><USER21> Could you explain what essential things JVM does better than Go at this point ? Does it stop the world less ? Or does it do more things in parallel ? Thanks

<comment><USER22> Although Go's GC is tunable to some extent, the open source HotSpot JVM are already has multiple GC implementations that you can choose based on your use case and further tune. There is also work being done in the OpenJDK project for a GC that can collect > 100GB heaps in < 10ms [1]. There are also alternative proprietary implementations available today that already have no stop the world collections [2]

[1] [http://openjdk.java.net/jeps/189](http://openjdk.java.net/jeps/189) [2] [https://www.azul.com/products/zing/](https://www.azul.com/products/zing/)

<comment><USER21> From this "work being done in the OpenJDK project for a GC that can collect > 100GB heaps in < 10ms" I deduce that Go 1.6 is not that bad at all and 1.7 or 1.8 could even beat that easily. [https://talks.golang.org/2016/state-of- go.slide#37](https://talks.golang.org/2016/state-of-go.slide#37) [https://github.com/golang/proposal/blob/master/design/12800-...](https://github.com/golang/proposal/blob/master/design/12800-sweep- free-alloc.md)

<comment><USER11> Latency isn't the only concern; you also have to look at throughput. The JVM's GC has been carefully tuned to strike a balance here.

In particular, Go's GC is not yet generational from the talks I've seen, which is a large throughput loss compared to the GC of the JVM.

<comment><USER5> If it is carefully tuned why it needs such a big GC tuning guide and 100s of JVM flags to tune runtime. Any Java product of consequence comes with custom GC settings meaning they do not find default ones suitable.

[https://docs.oracle.com/javase/8/docs/technotes/guides/vm/gc...](https://docs.oracle.com/javase/8/docs/technotes/guides/vm/gctuning/)

<comment><USER11> Because the JVM developers had customers who asked for the ability to tune the GC for their particular application.

Go will receive those feature requests too. The Go developers may not be as willing to provide so many knobs (which is a position I'm entirely sympathetic to, don't get me wrong). But the settings always exist, regardless of whether Google hammers in values for them or leaves them adjustable. GC is full of tradeoffs; they're fundamental to the problem.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> {{range . -}}

{{.}}

{{end -}}

This seems like a bit of a hack to be honest. Would anything break if

{{range .}}

{{.}}

{{end}}

worked as expected?

<comment><USER17> It would become unusable for general-purpose text templating[0], and would either break interspersing dynamic text ("this is {{ name }}" with name=Bob would be rendered as "this isBob") within static text or would need a semantic understanding of HTML.

And even then the presence or absence of whitespace in HTML does have rendering impacts (though I don't remember one offhand — aside from linebreaks — it's been a long time since I last hit one), so the template author must be able to control it and importantly to keep whitespace present between static and dynamic items.

[0] html/template is a relatively thin layer over text/template with built-in XSS security where the original does "raw" output by default

<comment><USER23> I just think that a simpler solution would be to always ignore the first line break after the range begin and end tags. I can't really see the case where that would cause an issue, if you REALLY do need the "extra" line break just put it inside the range.

Whitespaces shouldn't be touched, just parse them though and don't process them.

That would make the templates look more like those of Django and Jinja2, which most seem comfortable with.

<comment><USER24> Funny that you mention Jinja.

This is actually a feature that's been in Jinja forever that I've always wanted in Go's text/template

[http://jinja.pocoo.org/docs/dev/templates/#whitespace- contro...](http://jinja.pocoo.org/docs/dev/templates/#whitespace-control)

</comment></comment></comment></comment><comment><USER25> I develop a lot of command line tools for Linux using shell scripting. The scripts are getting huge and ugly, so I have been looking at Go and it seems I can do so many things by just using the standard library and in general a big improvement over using scripting.

However, everytime Go is discussed at HN I see many posts criticizing the language for various reasons and this has put me off getting started learning Go.

<comment><USER26> I suggest just writing something in it.

A lot of the criticisms turned me off as well, but I dove in anyway.

I stopped paying attention to the criticisms when I found out how incredibly productive I was able to be in Go.

Give it a try and make your own call on it. The cognitive overhead of jumping into Go is so small compared to many other languages.

<comment><USER27> > The cognitive overhead of jumping into Go is so small compared to many other > languages.

I'm not using Go now, though I have tried it out years ago. Your point is exactly why it stays on my radar for possible future use. Especially if you consider any sort of business aspect, ramping up the help. I would strongly consider using it for any serious backend project in a business environment due to the performance, ease of learning and compatibility promise.

</comment></comment></comment><comment><USER7> Are there any published benchmarks around allocation times after many garbage collection events with the golang garbage collector?

I'm wondering how it holds up without compaction and in the face of fragmented heaps.

</comment><comment><USER27> > Changes to the language: None

Best part of Golang, more languages need to borrow this feature. Second best is how relatively easy it is to get going with it.

</comment><comment><USER28> I get where we are...but where are we going?

<comment><USER29> Go 1.7 Planning: [https://groups.google.com/forum/#!topic/golang- dev/TerfinvPf...](https://groups.google.com/forum/#!topic/golang- dev/TerfinvPffw)

</comment></comment><comment><USER30> I'm wondering who is using Go in production outside US?

Noticed couple e-commerce companies and Google itself in Singapore. Few Russian companies are doing small infra project.

Anyone else seriously investing in Golang?

<comment><USER31> It's incredibly large in China (Baidu, Qiniu). I apologize since I haven't looked into countries specifically, but to respond to "anyone else seriously investing in Go?", I'll paste it here for you anyways.

Walmart, Apple, Facebook, eBay, Intel, Google, Mozilla, IBM, Microsoft, Red Hat, DigitalOcean, Zynga, Yahoo, BBC, VMware, Uber, GitHub, Getty Images, Twitter, Stack Exchange, Docker, SpaceX, Baidu, Qiniu, Imgur, CloudFlare, Bitbucket, Dell, Twitch, Dailymotion, bitly, Cisco, Verizon, Dropbox, Adobe, New York Times, HP, Canonical, Cloud Foundry, 99designs, BuySellAds, CoreOS, MongoDB, Basecamp, Rackspace, Booking, MalwareBytes, Kingsoft, Iron.io, OpenShift, Heroku, Square, Spring, Tumblr, VMWare, Symantec, Comcast, CBS, SendGrid, Digitally Imported, Pivotal, Couchbase, Koding, Shopify, Shutterfly, MaxCDN, Linden Lab, SolarWinds, IMVU, EMC, Teradata, and I'm sure many more which I'm unaware of, are all using Go to some capacity.

</comment></comment><comment><USER32> How about adding a flag to the bloody compiler to allow me to compile my code with unused bits?

I refuse to touch Go until that happens. Go is the asshole of programming languages. It forces you to put code in deeply nested annoying directories

        vim foo.go
        vim ../../../github.com/blahblah/moreblahblah/blah.go
        sigh

But that I could live with. But constantly commenting the code out (which of course leads to commenting out even more code!) is the real PITA.

All said and done it looks like a useful, if uninspired, language. Can avoid it so may as well use it. But this nonsense has to stop!

<comment><USER33> You can use the _ signifier to mark imports as optional during development: use

        import _ "net"

Make sure you don't check such lines of code in to your repo, because there is a concrete benefit to having the language enforce this import strictness.

But the person who would check in code with unused _ imports, would probably abuse a hypothetical "allow unused imports" flag in production. Go is probably not for that person.

<comment><USER34> Most Go developers just use goimports. So really this "unused import" warning is a "you forgot to push the magic fix-it button." (Why didn't it push it for me?)

Or more to the point, if Go can figure out imports, why require them to be explicit at all?

</comment></comment></comment><comment><USER35> What do people think of Go's new(ish) vendoring?

</comment><comment><USER36> Does Go have an interactive debugger yet?

</comment><comment><USER37> yes yes, you wrote an AI that beat Fan Hui, we heard, stop bragging

</comment><comment><USER38> Oh, that Go.

</comment><comment><USER39> On FF 44.0:

\- The header is cut off

\- Slide 20 gives an error when running [c: template: redefinition of template "list"]

\- Stable sort example does not seem to work. Gives same output as regular sort

<comment><USER40> From the third slide:

> Most of the code examples won't run except locally and using Go 1.6.

> The playground still runs Go 1.5.

<comment><USER39> Ah... thanks. I think I rushed past the preamble slides and missed that.</comment></comment></comment>


Show HN: RideConnect – create your own rideshare - <AUTHOR> http://www.rideconnect.com <comment><USER2> Hi guys,

We're on ProductHunt.

[https://www.producthunt.com/posts/rideconnect](https://www.producthunt.com/posts/rideconnect)

</comment><comment><AUTHOR> With RideConnect, you can create your own rideshare and give your customers rides while keeping all the money you make, no fees

</comment><comment><USER3> Which ridesharing niche are you targeting? Taxi, limousine, carpooling?

<comment><USER2> We provide the platform that can be used by any niche. Our marketing is focused on taxi/limo/Uber drivers.

Basically, if you wanted to setup your rideshare company, you could use RideConnect. There would be your company, your riders and RideConnect would be the app that would be used. We wouldn't take a cut per ride, thus having you get more money than if you were to be a driver through Uber or Lyft.

Not only that, you could setup your rideshare for a party or a wedding, or some personal event where people are attending. I've had this need before, personally. In this case, all the attendees or guests install RideConnect, you setup your private rideshare and then people in that rideshare can coordinate their rides - whether it's a ride hail or scheduled rides.

Who are the drivers?

Drivers are who you include into your rideshare. Anyone can switch on the driver mode and then start receiving ride hails. Just as easily, they can switch it off.

So who decides what to charge?

If you want to charge for rides, you decide how much to charge. The market will decide if you're charging too much, and we won't. Ultimately, we don't demand that you charge any money to give rides, but we'll give you the tools to do so if you choose.</comment></comment>


I Can't Figure Out What Facebook Is For - <AUTHOR> http://www.overcompensating.com/posts/20080903.html <comment><USER2> Me too.</comment>


Last One Out, Please Turn On The Light - <AUTHOR> http://www.richardnicholson.com/darkroom/

<comment><USER2> What's with the horizontal very wide page?

<comment><USER3> It's "art".</comment></comment>


Donald Knuth at a March for Science - <AUTHOR> https://twitter.com/jchchm/status/856542680830038016 <comment><USER2> He's one of the greats. Gates famously wrote "If you think you're a really good programmer... read (Knuth's) Art of Computer Programming... You should definitely send me a résumé if you can read the whole thing,"

"It took incredible discipline, and several months, for me to read it. I studied 20 pages, put it away for a week, and came back for another 20 pages. If somebody is so brash that they think they know everything, Knuth will help them understand that the world is deep and complicated."

His books are probably the most owned, least read volumes since the Bible.</comment>


"Ecxsue brvty/tpyos – snt whl mbl" - <AUTHOR> https://medium.com/simone-brunozzi/ecxsue-brvty-tpyos-snt-whl-mbl-247ce78dcae2#.nt6gkc7z7 <comment><USER2> Love this! Thank you for sharing and making me smile on a Wednesday.</comment>


Ask HN: Why elements with absolute CSS units can be zoomed? - <AUTHOR> For example, I have a 5cm x 5cm div on a web page. If I zoom a web page (cmd+ or cmd-), this div is zoomed as well and as a result, in absolute measurements, it becomes bigger than 5cm <comment><USER2> I would imagine that it's due to an accessibility requirement as technically it's still 5cm x 5cm but it's perceived size is larger</comment>


Webpack option suggested for Rails 5.1 - <AUTHOR> https://github.com/rails/rails/pull/26836#issuecomment-264242030 <comment><USER2> Opinion forming:

Isn't this a way to invite volatility into the Rails ecosystem? Maybe instead of adding options for webpack, yarn etc. Rails should decouple itself from the front-end so that most of us can use our Preferred approach™

Alternately something in the vein of moonglum's gem [0] should also work but again, as an external lib. not part of Rails.

[0] - [https://github.com/fejo- dk/rails_external_asset_pipeline](https://github.com/fejo- dk/rails_external_asset_pipeline)

<comment><USER3> You could say that work is already done. Generate a rails API app and then use whatever front end you want.

<comment><USER2> Yes but that's geared towards building an API (ofc I can strip Rails however I like, dropping whatever I don't use) but it wasn't my main point - the tooling in the JS world changes rather quickly, now, this would imply lots of changes in main Rails just to support all of those external changes hence the volatility part in my comment.

For example looking at the Phoenix framework - they choose by default Brunch [0] but they also let you implement whatever you want.

It's still opinionated but they make it clear is not part of the core framework.

[0] - [http://www.phoenixframework.org/docs/static- assets](http://www.phoenixframework.org/docs/static-assets)

</comment></comment></comment><comment><USER4> > Where Webpack really shines is for application-level JS. So that's also a > way for having the two systems coexist, especially for existing apps.

I really like each version make Rails more complicated and hard to learn.

<comment><USER5> It seems it would actually change nothing because its a optional flag and you can simply not use it.

Also i cant really agree with that (doing Rails since 3).

</comment></comment><comment><USER6> The original commit being linked to is actually for adding optional support for Yarn, which is awesome in itself:

"This add a package.json and the settings needed to get npm nodules integrated in new apps when the --yarn option is used (e.g rails new blog --yarn)."

</comment><comment><AUTHOR> [https://github.com/rails/webpacker](https://github.com/rails/webpacker) finally

</comment><comment><USER5> Your title shocked me, glad it is actually just a optional addition.

</comment><comment><USER7> I think this is great news. webpack + rails would make front-end simple yet powerful.</comment>


Biggest participatory film project ever made - <AUTHOR> https://lifeinaday.youtube/ <comment><AUTHOR> In July 2010, tens of thousands of people picked up their cameras and followed a simple invitation: show what your day looks like. 80,000+ clips were submitted from 189 countries. This is now being repeated for 2020.</comment>


Is there association between Toxoplasma gondii infection and bipolar disorder? - <AUTHOR> http://www.jad-journal.com/article/S0165-0327(16)30561-4/abstract <comment><USER2> Another article on this subject: [http://www.theatlantic.com/magazine/print/1969/12/how- your-c...](http://www.theatlantic.com/magazine/print/1969/12/how-your-cat-is- making-you-crazy/8873/)

Discussion: [https://news.ycombinator.com/item?id=3573694](https://news.ycombinator.com/item?id=3573694)

And a good conversation with Robert Sapolsky: [https://www.edge.org/conversation/toxo](https://www.edge.org/conversation/toxo)

</comment><comment><USER3> 8 studies included, each with small sample sizes, with a combined OR estimate of only 1.26 makes it hard to draw any conclusions from this.

<comment><USER4> If the effect size were much larger, like an OR of 3, that would be suspicious as well, since the ORs for suicide/accident/mortality/schizophrenia and Toxoplasma also tend to be in the 1-2 range. I would consider this as part of a broader picture showing a pervasive small-medium correlation of toxoplasma infections & bad things involving the central nervous system.

It's interesting because we know that a lot of other infectious agents can really screw up the nervous system, and psychiatric disorders repeatedly show genetic correlations with the immune system.

<comment><USER3> Very happy to have your comment, Gwern. I am a big fan of some of your work.

I certainly agree with you in principle. I just am not sure the sample sizes here are truly large enough to capture an effect on the order of 1.25x for such a complex phenotype. It's not necessarily a criticism of the author's work, which appears to be well-done. I just updated my prior and remain not yet convinced.

I also agree that many psychiatric disorders certainly have integral immune components, but on the other hand this is also true for most chronic diseases and pathologic processes (in my opinion).

</comment></comment></comment><comment><USER5> "Crazy cat lady" is possibly more than just a term of endearment.

</comment><comment><USER6> How is T. gondii infection actually diagnosed? Is there a way to treat it?

<comment><USER7> Simple blood test. No way to treat it.

In Turkey it is prevalent. Pregnant women who tested negative are discouraged from eating raw fruits or vegetables unless they know that the food was properly sanitized. Catching it during pregnancy might cause disfigurement of fetus.

<comment><USER8> No way to treat it? what about antibiotics and then the healthy immune system?

<comment><USER9> It's a protozoan, antibiotics aren't going to do anything.

<comment><USER10> Lots of people refer to all antimicrobials as antibiotics. Protozoa can still be treated in multiple ways with antimicrobials.

</comment></comment></comment></comment></comment><comment><USER11> Cats</comment>


New research supports the creation of more marine reserves - <AUTHOR> https://phys.org/news/2017-03-fish-evolve-safe.html <comment><USER2> Forbid phishing in some areas and those areas will have more fish. Those fish who venture outside will be captured, those who develop a sense of "not out of here" will be still alive. Hum. Don't get what's the great advance in such research.</comment>


Show HN: Betty, Open Source Google Voice with Receptionist Abilities - <AUTHOR> https://github.com/SamyPesse/betty

<comment><USER2> > "Open source Google Voice"

Which voice library does it use? I see a lot of Twilio references in the code.

Beside that, the GitHub description reads "Open source Google Voice with Receptionist abilities, built on top of Twilio" \- the last few words are missing in the HN title - and that makes it misleading. As the code contains no open source Google Voice library/etc. It's a showcase for Twilio API.

<comment><USER3> Yes it's basically an advanced use of Twilio API.

I'm the creator of the open source project, but somebody posted it on HN without me knowing it so I can't change the title or anything.

<comment><USER4> So the person who posted this as a "Show HN" isn't a contributor? That's not just bad form, that's a violation of the Show HN guidelines. It looks like the submitter has a history of doing this.

[https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

[https://news.ycombinator.com/submitted?id=vvoyer](https://news.ycombinator.com/submitted?id=vvoyer)

<comment><USER3> No he is not a contributor (I don't know him), I originally wanted to share this project on HN this week after finalizing some stuffs.

<comment><AUTHOR> Did not know we could not post show HN without being the author, I can change the title thought just give me one

</comment></comment></comment></comment></comment><comment><USER5> There's also OpenVBX [http://www.openvbx.org/](http://www.openvbx.org/) that I have found very fun to use.

</comment><comment><USER6> Looks very interesting. Does it also, or are there any plans to support WebRTC calls directly from the Web Dashboard?

<comment><USER3> Already done :) [https://raw.githubusercontent.com/SamyPesse/betty/master/pub...](https://raw.githubusercontent.com/SamyPesse/betty/master/public/images/preview.png)

<comment><USER6> That's cool. Will try it out shortly!

EDIT: It's probably my lack of experience with node/npm, but I can't seem to start betty. See [https://github.com/SamyPesse/betty/issues/7](https://github.com/SamyPesse/betty/issues/7)

EDIT2: all ok. was my stupid mistake install nodejs</comment></comment></comment>


Cyber war will not happen, at least not how you think [Thomas Rid] - <AUTHOR> http://www.theglobeandmail.com/commentary/cyberspace-is-not-a-combat-zone/article13035562/

<comment><USER2> > "But if you put intelligence agencies in charge of cybersecurity, they're > more likely to apply an offensive mindset to the problem than ministries of > interior."

That's exactly what I thought would happen, and exactly what _did_ happen. They keep asking for more funds and new bills to increase the power of cyber "security", and to "defend" us, but instead they go and make stuff like Stuxnet and Flame with that money, and committing countless acts of war against other countries (including hacking and spying on their systems).</comment>


Why Microsoft and everyone else loves Indian CEOs - <AUTHOR> http://www.livemint.com/Opinion/jSTbY97pmjDgGSGHvG2POP/Why-Microsoft-and-everyone-else-loves-Indian-CEOs.html

<comment><USER2> Starting from a lower place builds a degree of inner strength. Coming from a lower starting point can also help you learn and maintain a degree of humility. If you're able to do both that there's a higher chance you'll go far. That has been my experience with senior managers coming from India at a larger company. Those were the guys who were in senior positions and at least in my case I could clearly see and understand why.

</comment><comment><USER3> Having been to India I suspect that it is because managing things there is a nightmare. If you can do that you can do anything pretty much.</comment>


NuttX – A POSIX-compliant RTOS for embedded platforms - <AUTHOR> http://nuttx.org/ <comment><USER2> A few bits of trivia for anyone considering NuttX:

      - uses a pure software interrupt and redirects to your ISR's, so you incur additional overhead for all interrupts in your system
      - ships with a homegrown c stdlib, which has several functional/security bugs (ex: vscanf will overflow if you use format specifiers other than [l]i/u), and neglects to provide gcc attributes for arg checking for the printf family functions
      - build system issues $(MAKE) calls in every folder you're building, which makes it terrifically slow (especially noticeable on incremental builds)
      - architecture makes it difficult to write custom drivers without building them into the kernel (eg if you want to use the kernel as a module in your project)

<comment><USER3> > \- uses a pure software interrupt and redirects to your ISR's, so you incur > additional overhead for all interrupts in your system

Not true. Like Nucleus OS, NuttX supports two class of interrupts, What nucleus calls "managed" and and "raw" interrupts. The raw interrupts zero- latency, no overhead interrupts: [http://www.nuttx.org/doku.php?id=wiki:nxinternal:highperfint...](http://www.nuttx.org/doku.php?id=wiki:nxinternal:highperfints)

> \- ships with a homegrown c stdlib, which has several functional/security > bugs (ex: vscanf will overflow if you use format specifiers other than > [l]i/u), and neglects to provide gcc attributes for arg checking for the > printf family functions

Yes, it uses a custom, POSIX-compliant C library. I have never heard of any such bugs, however. All of the NuttX common code is compiler agnostic.

>\- build system issues $(MAKE) calls in every folder you're building, which makes it terrifically slow (especially noticeable on incremental builds)

Re-build time is around 10 seconds or so on a lower-end to mediocre Linux box. A full build cycle (clean, reconfigure, build-from-scratch) is more like 30 seconds.

Windows-based builds are a lot longer.

>\- architecture makes it difficult to write custom drivers without building them into the kernel (eg if you want to use the kernel as a module in your project)

Kernel modules are fully supported: [http://www.nuttx.org/doku.php?id=wiki:nxinternal:kmodules- sh...](http://www.nuttx.org/doku.php?id=wiki:nxinternal:kmodules-sharedlibs)

<comment><USER4> Most RTOSen allow you to access a minimal set of kernel services from interrupt context, so that you can implement the standard top-half/bottom-half driver processing model. NuttX's managed interrupts are in this category, and almost any driver's interrupt handler needs to be as well.

Almost any RTOS on the Cortex-M profile will fully utilize the NVIC, giving you a hardware-managed preemptive FIFO scheduler even in interrupt context. NuttX's lack of this feature is a severe weakness, and a major reason to avoid using it.

Additionally, some RTOSen will provide the ability to install interrupt handlers that cannot safely access any kernel services. These are usually not capable of doing much more than provide user-defined error handling prior to taking a reboot. NuttX's raw interrupts are in this category.

<comment><USER3> > Almost any RTOS on the Cortex-M profile will fully utilize the NVIC, giving > you a hardware-managed preemptive FIFO scheduler even in interrupt context. > NuttX's lack of this feature is a severe weakness, and a major reason to > avoid using it.

I think this is a miconception about how RTOS's can work. Certainly in a bare- metal environment (or with a minimum RTOS), prioritized interrrupt-level processing is critical. But with RTOS's like NuttX, interrupts should be very brief: You should enter the handler, perform mimimal housekeeping, and signal a prioritized thread to perform the interrupt-related operations.

This is not a oversight in the design, it is intentional replacement of prioritized interrupt handling processing with priorotized multi-tasking processing.

The NuttX interrupt handling is designed so that the context switch after signaling the prioritized thread is ZERO. The return from interrupt vectors directly in the prioritized task (assuming it is the highest priority). This is all intentional design and is very efficent in these regards.

There is no one-size, fits all RTOS. You find that some are too minimal and primitive to meet your needs (I am thinking FreeRTOS, ChibiOS, Zephyr, ...) and some may be heavier weight than is necessary for your purposes (perhaps NuttX, nucleus, RTEMS, ...) or even heavier (VxWorks, QNX, Integrity, and on up to Linux). If you want the features of one class of RTOS, then you will find the others flawed in various ways, whichever RTOS is that one that meets your needs. It is a kind of Goldilocks effect.

</comment></comment></comment></comment><comment><USER5> I have used it in a few shipped products. FreeRTOS is fine as a kernel, but a the interfaces for networking or devices always felt just smashed on top of it with no clean interfaces. This also made moving between hardware revisions much more difficult. NuttX forces abstraction layers which sometimes makes it a pain to do something simple, but in the long run prevents you from shooting yourself in the foot.

Also they are having their first conference this year.

[https://nuttx2019.org](https://nuttx2019.org)

<comment><AUTHOR> Would you mind sharing details (or rough descriptions) of the shipped products? Or a broad category, i.e. "pace makers" or "motor controllers"?

<comment><USER6> There are many products in the market running NuttX: many Sony audio recorders and bluetooth headsets; all drones/quadricopters powered by PX4 are running NuttX because PX4 is based on NuttX; Xiaomi/Pinecone are using NuttX on their products and doing great contributions to NuttX mainline; Haltian ThingSee was the first commercial IoT device powered by NuttX; Daruma DR-800 was the first thermal printer powered by NuttX; many OptoFidelity products are powered by NuttX, so if you have a good NuttX skills you can apply for this job: [https://rekrytointi.com/en/vacancies/optofidelity/embedded-s...](https://rekrytointi.com/en/vacancies/optofidelity/embedded- software-engineer-tampere/562325/) Our community is growing, even without a big company like Amazon (FreeRTOS) or Intel (Zephyr) paying our bills. It's growing because because this is a great and powerful RTOS.

<comment><USER3> The defunct Google project Ara and it its living decendents TizenRT (tinyara) and the Motorola MDK.

<comment><USER3> Fitbit?

</comment></comment></comment></comment></comment><comment><USER7> I personally only used FreeRTOS but NuttX always looks cool to me. There are few open-source RTOS for microcontrollers that supports the wide range of POSIX and VFS.

A notable use case is PX4 Drone Autopilot [1], one of the most successful open source drone firmware project.

[1]: [https://github.com/PX4/Firmware](https://github.com/PX4/Firmware)

<comment><USER8> ArduPilot has switched from NuttX to ChibiOS. See the video for more information [1]. If you don't require POSIX compatibility, it's really the way to go. The kernel is very fast, and the HAL is much better compared to the typical vendor peripheral libraries. Definitely take a look at it if you've used FreeRTOS in the past. The community is excellent too with high SNR content [2], and the main developer is very responsive.

[1]: [https://www.youtube.com/watch?v=y2KCB0a3xMg](https://www.youtube.com/watch?v=y2KCB0a3xMg)

[2]: [http://www.chibios.com/forum/index.php](http://www.chibios.com/forum/index.php)

<comment><USER3> To be clear, they switched from a 3 or 4 year old version of Nuttx (prior to interrupt optimatizations) to current ChibiOS.

<comment><USER8> Correct, and upvoted.

</comment></comment></comment></comment><comment><USER9> I found that Sony Spresense [1] board is one of example device that implements NuttX [2].

[1]: [https://developer.sony.com/develop/spresense/](https://developer.sony.com/develop/spresense/)

[2]: [https://developer.sony.com/develop/spresense/developer- tools...](https://developer.sony.com/develop/spresense/developer-tools/get- started-using-nuttx/nuttx-developer-guide)

<comment><USER7> Wow, I have never seen 6-Core Cortex-M microcontrollers like this.

<comment><USER10> Clicking through, the price is more accessible than I expected, too. It's $66 for the base board.

</comment></comment></comment><comment><USER11> I recall taking a look at NuttX when I was shopping for an RTOS for a project a while back. Ended up choosing Zephyr ([https://www.zephyrproject.org/](https://www.zephyrproject.org/)) but I'm curious if anyone here has experience with both and can contrast them a bit.

<comment><USER12> That's the thing, hard to have experience with multiples. People generally stick to learning one or two. I know RTX and FreeRTOS differences, but I know without a doubt I'll try NuttX.

I starting looking at RTOSes when you were lucky to have 3 or 4 options anywhere - and it wasn't that long ago!

Now... with Amazon owning FreeRTOS... Intel and Nordic and Others going heavy in zephyr for multicore... professional but niche options like RTX, Segger's OS, and a hundred others... and if you chip has a MPU/MMU someone is trying to get Linux on it (whether it makes sense or not!)...

I think the market is getting pretty crowded. Personally the viable options right now unless you need something large like VxWorks for Java runtime, I think it's a choice between Amazon FreeRTOS and Zephyr.

</comment></comment><comment><USER13> So far I've been having a lot of success with Zephyr OS [https://github.com/zephyrproject- rtos/zephyr](https://github.com/zephyrproject-rtos/zephyr)

It's quite easy to set up and writing drivers for it isn't really so much of a pain. I don't know if one should state it as a pain point or a good point but they do use CMake for the build system. So it's reasonably quick at least they are using a newer version of CMake than most projects I've had the joy of testing out.

Their APIs are quite linux/posix inspired in my opinion but with their own zephyr flavor on top. But I would say NuttX is probably a more mature project and Zephyr has been reworked quite heavily lately so a lot has changed but at least they'll have an LTS release soon.

</comment><comment><USER14> Does anybody know if this will run on the BBC microbit, and if it does, will it have an advantage over mbed?

<comment><USER3> The BBC Microbit supports a NXP/Freescale KL26Z. That chip is supported by NuttX so the answer would be yes, with some additional board level support.

The NXP/Freescale KL26 has very limited resources, however. I would not recommend using a higher end RTOS with very low end, severely memory constrained MCUs.

</comment></comment><comment><USER15> Cool. First time I've read about real-time operating systems. A pseudo filesystem that resides in RAM is very interesting. I like how they've strived for "greater scalability from the very tiny platform to the moderate platform".

<comment><USER16> RTOS are in everything! They make a ton of sense if you have a lot of resources to manage or calls to external services that may block for some time, like a modem connection. Lots of IOT products have RTOS's running under the hood, where running a kernel even as stripped back as Linux can be is too expensive computationally. And with less kernel/OS overhead, a true hard real time system can be implemented with a pretty strong guarantee of safety (not crypto safety, operational safety). There's a reason Amazon bought FreeRTOS a while back.

</comment></comment><comment><USER17> Professionally, I've used FreeRTOS, ThreadX, and NuttX. I'm neutral on both FreeRTOS and ThreadX, but had a really tough time with NuttX.

On a surface level, NuttX seems nice. Driver abstraction, POSIX compliant (mostly), lots of platforms/systems already integrated and working in their build system, lightweight (?), and includes some nice features out of the box like a file system. It can be nice for small projects and with people who are familiar with writing code for a Linux based project or who love to learn the internals of the system. This is rarely the case.

I had two big issues with NuttX. The first was how huge it is from the get-go. There are 10-50 files with the same name (for all the platforms) and a massive amount of build system logic, which makes discoverability and knowing where to make fixes difficult. Most companies only need 1-2 platforms, and the extra 48 laying around feels like unnecessary bloat, but deleting them feels like a sin.

My second, but probably larger, issue with NuttX was around trying to develop unit tests for the 90% of the code we added on top of it in the services layer.

NuttX is a POSIX compliant operating system, and it likes to use the same naming convention of many of the functions and files you'd find in your standard UNIX/Linux system. When you try to write a unit test for your embedded code to run on your x86 development machine, as soon as a file you are testing touches a standard header file, it's really difficult to wrangle things. You have to provide a ton of override headers (eek), stubs, fakes, and even then, as soon as someone includes a header somewhere in the include tree, it'll break that unit test that was particularly well crafted so that it would run on a Mac. If you want to run that test on a Linux machine, it would require more IFDEF's and more time. The rationale for Linux not having unit tests is that they have a massive community of nightly alpha testers to surface and fix issues. That is not a good rationale for a firmware RTOS because a simple service layer logic bug can result in a bricked device (or thousands and thousands).

There's something special about reporting a bug to Express Logic about a bug in ThreadX or (and in my case) FileX and being able to provide a simple 20 line unit test which compiles on any system without any special hackery that exposes the bug. When we tried to do this with NuttX for the various bugs found in the SmartFS module, it was actually really hard to report/reproduce these bugs since there wasn't a simple way to "package" up the environment. The "easiest" solution was to package the entire OS, a FUSE port of SmartFS, and some of our code on top, which would run in simulator mode on our machine which then could exposed the bug.

FreeRTOS and ThreadX have their issues as well, like blurred lines between upper and lower layers and lack of training wheels from the satrt, but the projects with these OS's could more easily build a modern firmware environment with unit tests, faster build times, modern build system, and crafting a full OS that worked better to solve the problems at hand.

<comment><USER3> > NuttX is a POSIX compliant operating system, and it likes to use the same > naming convention of many of the functions and files you'd find in your > standard UNIX/Linux system. When you try to write a unit test for your > embedded code to run on your x86 development machine, as soon as a file you > are testing touches a standard header file, it's really difficult to wrangle > things. ...

I use a trick to do that based on the objcopy utility with the --redefine option. This is a not complicated, but still mind-bending at times.

NuttX supports a simulator that runs NuttX as a Linux application. This requires the full bag of tricks to avoid name collisions: [https://bitbucket.org/nuttx/nuttx/src/c38b6cb068404827d7c071...](https://bitbucket.org/nuttx/nuttx/src/c38b6cb068404827d7c071ae6f88aa6934d06b72/configs/sim/README.txt#lines-148)

</comment></comment><comment><USER18> Nice and nifty. Although it doesn't support 68000 cpu family :/

Too bad it's not usable for high assurance. SeL4 is about the only option there.

<comment><USER7> What is high assurance in the context of RTOS for microcontrollers?

<comment><USER18> Guaranteeing things like worst case timing, complete with formal proofs.

Without formal proofs, no hard realtime is possible; What you've got is soft realtime instead, the relaxed version where there's no guarantees.

<comment><USER19> Hard real-time without formal proofs is not only possible: it's the norm for almost all hard, real-time systems out there. It's mostly about careful coding and time analysis. Recent ones have had stronger isolation with formal verification of a few. It's not necessary to get them working most of the time, though.

Matter of fact, regulators for safety-critical fields are just starting to accept formal verification as evidence. CompCert is only tool I know of that's qualified to just one standard. If in those fields, using formal verification instead of whatever evaluators are used to can get something rejected. It can aid the development or be supplementary evidence at best.

<comment><USER18> You're right in that this insanity is not uncommon.

Without formal verification, there's no guarantee deadlines will not be missed, hard realtime will not fail and people will not die.

Sometimes failure is cheap; Other times it is not. A lot of systems out there make outrageous claims of fitness with no formal basis.

What a sad state the industry is in.

<comment><USER3> Ultimately, an RTOS can only provide you with the tools to create a hard real- time system. The RTOS cannot guarantee that your application can meet any deadlines. That requires the proper use of those tools by the application.

If you improperly prioritize tasks or use semaphore locks improperly or keep interrupts disabled too long, then your application will not be real-time.

NOTE: NuttX does provide tools to measure interrupt latencies, response times, and critical section times. Those are helps in creating a real-time system.

So, it is not a meaningful to ask if the RTOS has been certified in some way to always meet deadlines. You should ask rather, does the OS provide the tools that you need and does your overall application meets its deadlines.

<comment><USER18> >So, it is not a meaningful to ask if the RTOS has been certified in some way to always meet deadlines.

It is meaningful. If the system doesn't offer these guarantees, no matter how good you are and how much effort you put into what's within your scope to implement, you won't be able to offer any guarantees.

This is ok if you can afford to fail. Just don't use it e.g. where human lives would be put at risk.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> As someone who has converted (symmetric) multithreaded apps to embedded, seeing POSIX pthread support excites me.

</comment><comment><USER20> The name tho...

</comment><comment><USER21> What a terrible name.

Edit: Obvious sexual connotation to my ears. If I told a coworker "Just go to Nuttx's website" I am 100% sure I'd have to explain it was SFW.

<comment><USER7> It is just the auther's surname (Nutt) + X. What's the issue?</comment></comment>


Show HN: DueProps, my employee motivation startup after selling Hashrocket - <AUTHOR> http://dueprops.com

<comment><USER2> This fits very well in with the article discussed in <http://news.ycombinator.com/item?id=4042931>. I've just told my company's HR to please evaluate DueProps. It seems to be very nice for this goal of recongition made fun.

</comment><comment><USER3> Obie, that is a very cool idea! It also sounds like you are out of the consulting services business.</comment>


Boeing spent 18 hours drawing an outline of the 787 Dreamliner across America - <AUTHOR> http://www.businessinsider.com/boeing-dreamliner-787-test-flight-america-2017-8 <comment><USER2> This has become pretty common on test flights, although this looks like the most precise I remember seeing.</comment>


How to Develop a Mindset for Math - <AUTHOR> http://betterexplained.com/articles/how-to-develop-a-mindset-for-math/ <comment><USER2> Yes, math -- like every other discipline that can take itself seriously -- is about models and relationships. But given these models, we ought not necessarily "apply them to real-world objects." Rigorous math is powerful precisely because it is _abstract_.

One of this guy's prized "deep insights" is that negative numbers refer to deficits of cows. Granted, that's a slick (if not wholly obvious) way to represent an intuitively awkward concept, but it engenders a false confidence. Negative numbers don't exist to represent bookkeeping deficits. They are there because some formal mathematical argument grounded in pure logic _said_ they had to be there. The fact that we use negatives to refer to cows reveals more about primitive functions of the human brain (distinguishing among objects, counting) than it does the deep algebraic structure of the numbers themselves.

I admire attempts to ground difficult abstractions in physical reality as much as the next guy, but we shouldn't confuse these simplistic observations with mathematical insight.</comment>


Ask HN: Share hosting/domain account for friend's website? - <AUTHOR>

I'm making a basic website for my friend's company, but I have a few questions.
Should I use Wordpress, Tumblr or other easy template website?  All he needs is a nice professional theme and some basic pages (Home, About, Services, Testimonials, Contact), possibly a blog.
Also, should I use my hosting account and my domain registration account or keep everything completely separate? Am I required to put myself on as the admin of the domain? <comment><USER2> Treat this like any other professional project:

* create and use separate accounts for hosting provider and domain registrar. Assuming that your friend's business doesn't have an email, create a gmail account that you consistently use when signing up for services.

* Set payments for hosting/domain to automatic renewal.

* Make sure you can easily hand over the project to another developer if the need arises. This is why you create seperate login accounts for the customer, all connected via the same email address.

* Yourself as admin? Well, someone has to do maintenance; even the most basic sites require backup, adding content, updating software/libs/frameworks, etc. Just make sure you get compensated for the work you do.

* I would recommend using your own Wordpress installation because it's cheap, robust and easy to grow with. Pretty much any dev out there know their way around WP. I would NOT develop a solution from scratch nor would I use Tumblr or Posterous (way to limiting). Wordpress.com? Not worth it it the long run: even basic features cost and you're not in total control of your data (warning: if there won't be anyone doing maintenance, then go for a hosted solution! You do NOT want to leave a WP installation without regular checkups).

* There are countless of free WP themes at wordpress.org. For even more themes, ThemeForest is unbeatable wrt price and quality.

<comment><AUTHOR> * I'm using his personal email. That what he told me to use. Im probably going to set up a new main gmail and setup pop3 email accounts inside for his employees to send using professional email accounts

* Thanks for remimding me about automatic renewal. I asked him if he want to purchase 2 or more years in advance, but he said no. This way it will be renewed when the time comes unless the cc# changes.

* When you say 'your own Wordpress installation' you mean installing it fresh from my hosting using wordpress.org? That's what I plan to do.

* I looked at ThemeForest, they have really nice themes for cheap. He just needs a simple basic business theme, so thank you again for the suggestion!

I told him if I can't complete the project or he's not happy with it, he owns the domain/hosting and can take it anywhere he wishes. Question was whether to save money and share accounts at first, but I agree I'm going to keep everything separate since its the safest for everybody!

Thanks.

<comment><USER2> "When you say": yes, I mean using the default package available on wordpress.org.

Good luck.

</comment></comment></comment><comment><USER3> i would use posterous. they allow you to quickly throw some thing up and also allow you to edit the html/css. you can create pages, etc..while also maintaining your blog.</comment>


The Demise of Chrysler - <AUTHOR> http://www.newsweek.com/id/166659/page/2

<comment><AUTHOR> And I meant to post this: <http://www.newsweek.com/id/166659>

</comment><comment><AUTHOR> Sometimes I wonder if this will ever happen to silicon valley. The tone of the article is very ... final.</comment>


How can we get willpower back once it has been depleted? - <AUTHOR> http://www.scienceandreligiontoday.com/2011/06/15/how-can-we-get-willpower-back-once-it-has-been-depleted/

<comment><USER2> Here is a pertinent wikipedia article with some links: <http://en.wikipedia.org/wiki/Ego_depletion>

It's interesting how this applies to more trivial things, like trying to keep yourself from laughing.

Would it be a stretch to say that this supports the idea that we should automate as much of our lives as possible? If I don't have to decide to put a certain amount of my paycheck in savings every time I get it, and it happens automatically, I could potentially reserve that energy for another decision- based task.

<comment><USER3> Not a stretch at all-I have become massively more productive since automating the simple things in my life, not because it saved any amount of time (maybe 45 mins/day), but because it saved so much of my mental energy.

Even getting a GPS made me more productive at work, because figuring out directions is mentally exhausting for me.

Willpower is also directly linked to glucose. I tried eating more low glycemic index foods and eating somewhat sugary stuff when I was mentally exhausted, and it has worked wonders.

</comment></comment><comment><USER4> TL;DR: Sleep/rest well, exercise, possibly avoid caffeine, try to put yourself in a good mood.

<comment><USER5> Caffeine: "improves our willpower for some things, such as concentrating on a boring and detailed task, but it has no effect or actually impairs our willpower for other things, such as being polite under trying circumstances."

Sounds good enough to me and probably most coders... I can continue to stick to my 5-8-mugs-a-day habit of 13 years then. My willpower hasn't suffered much I think, although it's hard to tell without some experimental withdrawal period.

<comment><USER6> Ditching caffeine did wonders for me. While I tend to feel a little less "manic" when I'm focused on something, I'm also way more clear headed so I'm certain I'm actually more effective and thus able to reach a much deeper level of concentration.

And don't even get me started on how much better I feel first thing in the morning, or how I can get through a whole week now without headaches, or how my energy levels don't spike and crash like crazy through the day, or how much better my digestive system feels without all that coffee in it... and what all _those_ things do to one's concentration.

It's insidious as well, because you gradually drink more over time; nobody goes from a standing start to 5-8 mugs a day. If they did, they'd feel like hell. So as you seem to acknowledge, after over a decade you're not even making an informed choice any more; there's not been a single moment in all that time that you haven't either been affected by caffeine or it's temporary withdrawal.

</comment></comment></comment><comment><USER7> Willpower and the problem of the lack thereof are pretty hazily defined here. Poor personal performance is a complicated issue that "Get sleep and exercise" is a poor prescription to. Poor organization, personality conflicts, attitude issues, perfectionism, and poor self image will make even the most well-rested and healthy person underperform at work.

I highly recommend "Procrastination: Why You Do It, What To Do About It" by Jane B. Burka and Lenora M. Yuen and "Getting Things Done" by David Allen for a deeper examination of these issues and some solutions.

<comment><USER8> I agree that there are plenty of possible reasons for poor personal performance, and it would be foolish to assume that more sleep/exercise is a universal solution. But the article never even went there. It's specifically talking about willpower - getting it back or getting more of it. I'd say that the concept of willpower is more of a subcategory to the larger idea you mentioned about underperformance. In that sense, it's about solving a piece of the problem, not the whole thing.

</comment></comment><comment><USER9> "A good deal of willfulness must be inborn, because it's common to see families where one sibling has much more of it than another. Circumstances can alter it, but at the high end of the scale, nature seems to be more important than nurture. Bad circumstances can break the spirit of a strong-willed person, but I don't think there's much you can do to make a weak-willed person stronger-willed." - <http://www.paulgraham.com/determination.html>

<comment><USER10> I would love to see citations for all of these very general claims about some of the fundamental debates in modern science (such as nature/nurture). Its great to quote pg (especially on this board), but hold off on taking his word as that of a prophet.

<comment><USER9> Touche, though I still wouldn't knock pg's insights, even if they're just general inferences. His track record at identifiying winners speaks for itself.

</comment></comment></comment><comment><USER11> Did my mother write this article? "Sleep well, eat your vegetables, and work hard!!!"

</comment><comment><USER12> Article forgot to mention amphetamine.

<comment><USER13> I am actually interested in the eventuality of caffeine (which they did mention) causing adrenal depletion. Those findings would apply even more violently to a more violent stimulant such as amphetamine.

I agree with their idea that one can get a spurt of willpower (and brainpower in general, in my experience) from a stimulant but the crash can be debilitating.

<comment><USER6> And no matter how much caffeine you have, unless you're taking it intravenously, you're spiking and crashing constantly throughout the day.

</comment></comment></comment><comment><USER14> Meditation

scientific keyword here is "executive function"

</comment><comment><USER15> One of the things I've learned from meditation is that the "depletion" model of willpower is bogus.

 _The Happiness Trap_ is a good model for the development of willpower. <http://www.thehappinesstrap.com/>

<comment><USER8> What exactly do you mean when you say you've learned "the 'depletion' model of willpower is bogus"?

<comment><USER15> There is always capacity to choose not to act on a reactive impulse. The notion that that capacity is a finite resource which can be depleted is an illusion.

<comment><USER8> Resisting reactive impulse is one thing, but do you not find that you have a limit when it comes to willing yourself to do difficult things? Assuming that these things come one after another, of course. I'm willing to agree that capacity for hardship is infinite in a sense, but I would also contend that it gets harder and harder to call on your willpower/self-control if you've already had to do so many times in the same day.

</comment></comment></comment></comment><comment><USER16> blessed potion of willpower

<comment><USER17> Be careful though. Once I drank a cursed potion of willpower and wound up lying on the couch for an entire weekend.

On second thoughts it was twelve margaritas.

</comment></comment><comment><USER18> Replace "willpower" with "gumption" and go read the relevant chapters in Zen and the Art of Motorcycle Maintenance.</comment>


What Have We Learned from This Open Source Project? - <AUTHOR> http://taskwarrior.org/docs/advice.html <comment><USER2> "Do not start an open source project if you need praise, warmth and love from your fellow human beings."

Ugh, very true. Folks forget that most FOSS work is volunteer & berating the hackers who make it won't help one bit. Worst is the issue reports about a fixed bug, followed by "What version do you have?" aaaaand silence. At the very least come back and close the issue.

<comment><USER3> Yeah. Open source seldom realizes it needs the same infrastructure as a commercial product: separate project management issue queue and support issue queue.

What are we doing next, what version did we fix Y in, what VCS branch are we working on Z in, who is working on X, etc. are separate from Who reported problem, what version of the product do they report having used, what did they expect and what did they get, is that part of the design of the product, did they ever get back to us, etc.

The other problem is ill-defined roles. If everyone's a developer is a support volunteer, is a user, then you can have people be pretty shitty and reflect on the project in a way that they shouldn't be allowed to.

Random users should be able to file support tickets, but only to view project management tickets.

Only designated volunteers should be able to respond to existing support tickets and create project management tickets from them, these people speak as the public face of your project, that's really really important to have a handle on.

Support tickets probably shouldn't be public, for that matter.

Now of course this is all unpaid, volunteer -- I'm not saying any of these queues should have a defined SLA or anything. By all means keep project a bazaar -- let support queue handle outside feature requests and feedback and everything -- continue to have a public repos, roadmap and changelog, etc.

<comment><USER4> I know what you mean, but there's another side. For instance just on:

> Support tickets probably shouldn't be public, for that matter.

Open GitHub issues, combined with Google, have turned out surprisingly useful to me as a user of open source packages. Often an answer to some trouble I've run into is found in an issue -- both 'support' ticket style issues, and development roadmap style issues, and the line sometimes gets blurred.

Also, there's a positive aspect of the blurring of the boundaries in open source -- when a user contributes code, or documentation.

But yeah, people running open source projects need to at least think about how they're going to deal with project management as well as support at some point, and just the thinking about it and the iterating to figure out how to do it better is for some a chore they don't want to do. The projects that figure out how to do this well are the ones that are a joy to use or to contribute to though.

Oh, and my experience I'm talking from is with open source code packages meant for use by developers. Open source end-user applications (including OSs like Linux) are a different animal, and are _much harder_ to deal with support and project management and the overlap, in my observation. Not sure which you were thinking of, but now I'm thinking maybe end-user apps.

<comment><USER3> Agreed, but I think stack-exchange style communities are better at this than a project's issue queue or a support channel.

There's also nothing preventing common support issues getting turned into documentation improvements, creating googleable (but more concise) results. I'd rather find a wiki page for "libchitz Error: Insufficient Flurbos in /var/lib/blips" than a forum post/issue with tens of comments and have to scrape through the results.

Also, there's plenty of times googling something should get you a documentation page on a subject but instead gets you forums/issues/etc. that aren't helpful.

<comment><USER4> > There's also nothing preventing common support issues getting turned into > documentation improvements,

Nothing but someone with the time, willingness, and skill to do it well. Which is not nothing. A lot of the amazingness of GitHub's effect on our work is how it gives us lots of useful stuff that happens as 'byproducts', without someone needing to spend time and energy to do it well.

</comment></comment></comment></comment></comment><comment><USER5> There is some internal contradiction and repetition.

One repeated theme is what people won't talk about, do talk about, and loudly social signal about, generally have nothing in common, so assuming any of those individually is a universal truth is likely to be a disaster. This applies to a lot more of life than just FOSS development.

As an example of contradiction was the claim that people won't read the docs but they will watch animations. The reality as seen above is 99% of the population will read the docs and never contact you unless your docs suck, 0.9% will watch the pictures, and 0.1% will aggressively track you down and ask you to read the docs for them. Although adding animations will cut annoyance contact by 90%, that doesn't mean gifs are the only thing that matters; the docs are what's really important.

</comment><comment><USER6> I've noticed some cultures tend to have unusually high standards for open source software and an expectation of personalized support. Perhaps because of the pervasiveness of "freemium" business models, I think a lot of people are really oblivious to the realities of open source. E.g. That they are not customers, nor are they owed anything in particular.

</comment><comment> r-w Hasn't the original author of "What Have You Tried?" themselves discouraged blind application of that prompt? [http://mattgemmell.com/hindsight](http://mattgemmell.com/hindsight)

</comment><comment><USER7> This was a great read and made me less fearful of my own impending Open Source attempt.

</comment><comment><USER8> So many true points in there. Thanks for the read!

</comment><comment><USER9> These are very good points here.

</comment><comment><USER10> > You can choose the most permissive software license, and people will still > argue with you about your choice.

The irony of people getting annoyed because of "missing restrictions".

<comment><USER11> It's about missing guarantee of future freedom rather but I am sure you know that.

<comment><USER12> Copyright owners can always decide to release future versions under whatever license they please.

<comment><USER13> A project that's copyleft _and_ accepts contributions under copyleft without a CLI means that nobody has the power to unilaterally bypass the copyleft term for the whole project.</comment></comment></comment></comment>


Simplicity Is Not the Answer - <AUTHOR> http://www.jnd.org/dn.mss/simplicity_is_not_the_answer.html <comment><USER2> I've read the article a few times, and I'm still not sure what point the author is trying to make. However, this quote from the article appears to neatly contradict the title (if that faithfully represents his premise):

      How do we manage complexity? We use a number of simple design rules.

Perhaps simplicity _is_ the answer.

<comment><USER3> I haven't decided yet, but I think he's trying to say that we're confusing _simplicity_ with _usability_.

I don't agree with that. One look at the iPod and I'm convinced.

<comment><USER4> Which iPod? My old 3G was a usability nightmare.

<comment><USER3> I haven't used that, sadly. First one I bought was the _nano_.

</comment></comment></comment></comment><comment><USER5> I can't help but notice that the graph in this article seems to have an obvious equilibrium point. I think it best describes the issue. There is a balance between capability and usability that maximizes desireablity.

And, if you can shift the capability line to the up-left, or the usability line to the up-right, you end up with a more desirable product. It's all about doing more with fewer features.

</comment><comment><USER6> This article is based on the premise that people correlate the number of features of a product to the simplicity of using the product. This isn't an accurate premise. A better description of the problem would be that features get added to products without much thought for how it integrates with usability. "The Design of Everyday Things" is a good book that addresses where and why design goes wrong. <http://amzn.to/17Wew>

<comment><USER7> I'm sorry, did you just say that Donald Norman doesn't know what he's talking about and then recommend that he go read _his own book_ to find out why?

<comment><USER6> No need to be sorry as you're absolutely correct.

</comment></comment></comment><comment><USER8> Simplicity is subjective. Any given interface may feel simple to some users while complex to others. The objective of interface design shouldn't be to make things "simple" for the sake of it. The objective of interface design should be to allow the highest number of users to achieve the goals they have, while keeping in mind how frequently they want to achieve that goal. Iconography, for example, works pretty weel for frequent tasks, but it may fail when the user is only doing a given task once in a blue moon. When in doubt, and in the spirit of pursuing objectiveness, split A/B testing works pretty well.

</comment><comment><USER9> Simplicity is the goal. This doesn't mean that you lose features, it means that things must be designed. You can have lots of features and lots of simplicity, it just isn't easy.

</comment><comment><USER10> A better article on the same topic:

[http://headrush.typepad.com/creating_passionate_users/2006/0...](http://headrush.typepad.com/creating_passionate_users/2006/09/easeofuse_shoun.html)

</comment><comment><USER11> _If my cellphone only had one button it certainly would be simple, but, umm, all I could do would be to turn it on or off._

Not really. It could be voice enabled. Press the key, Say New Number, Say Name, Say Digits, Say Save. Press the key, Say Call XYZ.

<comment><USER12> Actually my phone only has one button and it is still one of the most capable phones ever made. In fact, I'm writing this on my phone with a single button.

<comment><USER13> but it probably has a touch screen, making it possible to display lot of buttons at the same time.

one physical button != one button</comment></comment></comment>


Hypervelocity Macron Accelerators - <AUTHOR> http://toughsf.blogspot.com/2019/11/hypervelocity-macron-accelerators.html <comment><AUTHOR> Tiny projectiles can be accelerated to speeds so high that fusion reactions are ignited upon impact. This means you can get more energy out than you put in... from a distance. Like most technologies in space, it can be a weapon and/or propulsion system.</comment>


Google Launches White Space Database - <AUTHOR> http://www.dailywireless.org/2013/11/14/google-launches-white-space-database/

<comment><USER2> google's browsable map: [https://www.google.com/get/spectrumdatabase/channel/](https://www.google.com/get/spectrumdatabase/channel/)</comment>


Blizzard games were vulnerable to DNS rebinding attack - <AUTHOR> https://bugs.chromium.org/p/project-zero/issues/detail?id=1471&desc=2 <comment><USER3> So basically this is a local web server that is used for IPC? Is there a reason to do local IPC over TCP/IP, rather than over named pipes / unix pipes, other than not knowing about the existence of named pipes / unix pipes?

<comment><USER4> That's how it should be done yeah. Developers on Windows seem to be really loose in their use of TCP or UDP for IPC. Even my mouse driver opens up a port on 0.0.0.0.

<comment><USER3> UDP for IPC seems to be especially crazy to me. I mean sending data over TCP to localhost is basically a memcpy(), what advantages could UDP possibly have in that context?

<comment><USER5> Guarantee of preserved message boundaries? It's the reason Unix domain sockets have SOCK_SEQPACKET and Windows named pipes have message mode.

</comment></comment></comment></comment><comment><USER6> Disappointing (lack of) response/fix

Would have assumed they'd do better given how polished their consumer products are

<comment><USER7> Could someone explain in the most accessible language, how a problem like this could even be fixed?

<comment><USER8> Answer:

The service should check that the `Host` header on every request specifies `localhost`, `127.0.0.1`, or whatever other name is normally used to access it. If the `Host` header specifies a possibly-attacker-controlled name, the service should reject the request.

Explanation:

The problem is that the service is relying on same-origin policy to prevent a web site running in a local browser from making requests to it -- but it does not actually check what origin requests are addressed to. A random web site running in a browser normally cannot make requests to a hostname other than its own. Or, more precisely, it can make requests, but it can't read the responses. The Blizzard updater therefore forces the client to make an initial request whose response contains a secret token, and then subsequent requests contain that token, proving that the client was able to read the response and is therefore not a web site running in a browser.

However, it's perfectly possible to define an evil hostname whose DNS records assign it the IP address 127.0.0.1. Thus requests to this evil hostname would end up reaching the local Blizzard updater service. Unfortunately, the service will happily respond to these requests because it does not pay attention to what hostname the client was requesting.

(To actually exploit this, it's necessary to load an evil web site from the evil host name, which then performs the attack. This means that the evil hostname can't _only_ map to 127.0.0.1, but must also map to the attack server. But a hostname can indeed have multiple DNS records, and the browser will arbitrarily switch between them, allowing an attack to proceed.)

<comment><USER9> And/or simply implement CORS headers.

<comment><USER8> No, CORS doesn't apply here. CORS regulates cross-origin requests, but the attack here makes the browser think the requests are same-origin.

(Also, CORS can only be used to permit access that would normally be denied. CORS does not offer any way to deny access that is normally permitted.)

</comment></comment></comment></comment></comment><comment><USER10> the DNS rebinding vulnerability exists in applications other than Blizzard games, such as this one in Bittorrent Transmission also reported by Tavis Ormandy....

[https://github.com/transmission/transmission/pull/468](https://github.com/transmission/transmission/pull/468)

Seems to be a quite prevalent issue...

<comment><USER11> That's because for decades binding to localhost has been taken to mean "only users on the local machine can access this". Now chrome is breaking that assumption through a leaky sandbox, and demanding everyone else change rather than fixing their own security issues.

<comment><USER12> Can you explain why this is a Chrome-specific issue? I believe that it applies to all web browsers, including Internet Explorer for UNIX (which I do have access to and I can test if you would like me to confirm). I remember this being a vulnerability class with CUPS, which listens on [http://localhost:631/](http://localhost:631/), about 10 years ago.

In particular, note that the request is _not_ made to localhost, it's made to a DNS name that simply happens to resolve to 127.0.0.1. Should Chrome and also all other web browsers add a special case for DNS names that resolve to 127.0.0.1?

<comment><USER13> How about caching a DNS result for the duration of a tab? Doesn't solve everything but probably good enough. I don't think it'd break many things (sure it may affect some round robin DNS things for long-open pages that are Ajax'ing back home frequently, but that should be minimal)

<comment><USER12> I could believe that caching "is it localhost / RFC 1918 space or not" for a tab would have a sufficiently low false-positive and false-negative rate to be worth doing. It would still break the average business user who has an email half-written in OWA via an RFC-1918 address, puts their laptop to sleep, and goes home and expects OWA to still work over the public internet, but maybe OWA can figure out a solution there like local storage + document.reload(). It won't solve all the problems but it'll solve many of them.

I think caching all DNS resolutions is going to make a lot of cloud-native websites very sad (e.g., I'd imagine something like Slack would break quickly), and also cause poor performance because you don't get the benefit of a CDN's DNS server telling you that other servers are closer now. A lot of people have long-running tabs.

<comment><USER13> I don't mind breaking legitimate uses rebinding here. I'm not familiar w/ how OWA changes IPs from private-network to public-network, but I'd say using DNS is the wrong approach. And Chrome can probably detect DNS server change and then evict its known cache anyways. Yeah, a first step is probably just localhost/private-IP specific.

<comment><USER12> It's just that OWA is a web app that is often configured to be accessible on the internal network via an internal IP, and on the external network via an external IP (so you can get webmail even if you're not in the office), but it's the same app.

I certainly don't think it's worth supporting this from first principles - i.e., had the web been designed the way you suggest from day one, that would have been great - but it's got a very large deployment, and "Chrome silently loses your Outlook emails because of a security issue in video games and a BitTorrent client" is a good way to get Chrome removed from enterprises, and other browsers to decide not to ship the same fix....

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> A mischievous person renting a domainname can list _any_ public or private IP addresses in her A records; and she can list any nameservers, including ones with which she has no relationship. She can list an IP address that the user may be utilising or renting.

I use a fast DNS resolution solution that only queries authoritative servers and stores IPs in constant, perfect hash databases, then in kdb+. No caches. I see the IP addresses that are returned in DNS packets not as ephemeral and inconseqential, but as entries in a database that need to be validated before insert.

If I see some nonsense like 127.0.0.1 in an A record, let alone a public IP address that Im using, it is rejected. I have seen NS records with 127.0.0.1 as well.

Are there DNS rebinding attacks that do not use iframes, Javascript or some other way to trigger automatic lookups _without user interaction_? In theory perhaps. But every attack I have seen relies on triggering lookups automatically.

Its too bad the popular browsers make automatic requests for resources, automatically follow redirects and do not allow users to disable this default behavior.

However users can make use of less complex HTTP clients that do not make such automatic requests and where redirects can be disabled. These can be used in tandem with the popular browsers to give users more transparency and control.

Also isnt it possible to use SSL/TLS for localhost JSON-RPC? Theoretically couldnt users make use of client certificates?

Just a thought.

<comment><USER15> Yep, I saw 127.0.0.1 for an A record about 20 years ago.

It was discovered when going to that name outside revealed what seemed to be a copy of our own internal webserver!

What had happened is that our webserver was on the same host as our squid proxy. So we were in fact seeing our own site under the external name.

Protection for this sort of thing is in the default squid conf these days (from memory)

<comment><USER16> It was a standard joke to point warez.yourdomain.country to 127.0.0.1 - <USER2> wouldn't be surprised if there were still some left and could be used for rebinding attacks!

</comment></comment></comment><comment><USER17> Developer 101: if you want to do a blacklist, do a whitelist instead.

<comment><USER18> I think it depends mostly on the context. If you only want to allow a known subset of items, prefer a whitelist. If you want to avoid a subset of items, prefer a blacklist.

<comment><USER19> Yeah, but the hard-earned wisdom the parent post is trying to impart is that if you think you want to avoid a subset of items, you're probably wrong.

In an explicitly enumerated category, blacklists and whitelists are logically equivalent and can be used interchangeably. In almost every other case blacklists are insufficient because new items can generally be created, either maliciously or just accidentally as the size of the category grows, which are not on the blacklist but which share whatever bad trait you were hoping to protect against.

I'm sure there are a few exceptions, but generally speaking any problem that can be solved with either a blacklist or a whitelist should use the whitelist, just to be safe. A problem that can't use a whitelist is probably not actually solvable by a blacklist either, and trying to use one is likely to fail in the long run.

</comment></comment></comment><comment><USER20> The vulnerable update daemon is running all of the time if you've installed any Blizzard game in the past, not just if you currently play Blizzard games?

<comment><USER21> I believe they've patched it already. But if you haven't updated the updater yet, you're probably still vulnerable.

<comment><USER20> The posting says that the patch is not very good, but that's a separate issue.

<comment><USER21> Edge in particular was missing, I don't think that uses "iexplore.exe".

</comment></comment></comment></comment><comment><USER22> Would having TLS on the localhost endpoint (without client certificates) make the attack more difficult? the browser would have to validate the localhost- returned cert against the attacker.com hostname.

</comment><comment><USER23> > Any website can simply create a dns name that they are authorized to > communicate with, and then make it resolve to localhost.

So if I understand this correctly, websites can now bypass all firewalls and send traffic to any _local_ port at will? It also seems that this same trick would apply to local/intranet IPs (e.g. have domains that redirect to 192.168.0.x) allowing interaction with things like printers. While Blizzard has a bug, it seems to be the browser that has the real vulnerability here.

Edit: The replies have good explanations with more detail why this would be difficult to fix -- the host doesn't have enough context to differentiate between "intended" and "unintended" IPs without a bunch of pernicious edge cases.

<comment><USER24> Agreed. Not that lost ago, there was a post about how a BitTorrent client had a similar issue. Just like in that case, the real vulnerability was in browsers. I wonder how many programs are going to be discovered to be "vulnerable" before people realize that they are missing the point.

<comment><USER12> What do you think browsers should do instead?

<comment><USER24> There are a few options. IMO the best is saving ip address that each DNS name is resolved to for every connection for the duration of a windows existence.

<comment><USER12> That doesn't save you from this attack - you can send the index page and some JS over with a long Cache-Control header, and then trigger the site to get loaded some days later when DNS has been changed to point to localhost. The JS will trigger the same XHR and it will succeed this time.

(.. and now that I think about caching, the various "within the same tab" solutions elsewhere in the comments don't work, because they'd force Gmail / OWA / Slack / etc. to get reloaded _with a full cache flush_ when they change IP addresses, which everyone would hate.)

<comment><USER24> Can you really reload a website just even if it is rejecting connections just using a long Cache-Control header? I find that hard to believe.

> because they'd force Gmail / OWA / Slack / etc. to get reloaded with a full > cache flush when they change IP addresses

I think security issues should be fixed even if the fix imposes an inconvenience. Especially since the inconvenience is basically just a performance issue.

Side note: I don't find the idea that this attack is hard to fix a particularly strong justification for not fixing it. Not being able to connect to arbitrary hosts is deliberately not part of the API exposed to javascript so I think it would be hard to argue that DNS rebinding isn't a bug.

Side note 2: The workaround of "don't trust" localhost doesn't prevent all DNS rebinding based attacks. For instance, if you took out an ad, you could then have a botnet to bypass any ratelimiter.

</comment></comment></comment></comment></comment></comment><comment><USER25> I assume there's a similar patch for the Mac client, but this offers no protection for users running the Windows client via WINE.</comment>