Windows Package Manager Preview - <AUTHOR> https://devblogs.microsoft.com/commandline/windows-package-manager-preview <comment><USER3> ... this thing literally just downloads .exe files and then executes them. There's no dependency management.

Look at the firefox "package": [https://github.com/microsoft/winget- pkgs/blob/master/manifes...](https://github.com/microsoft/winget- pkgs/blob/master/manifests/Mozilla/Firefox/75.0.yaml)

There isn't even any uninstall functionality.

This is a package manager as much as a piece of cardboard is a swiss army knife.

Even if you say "but it's a preview", there's just no where to go when your starting point is "execute some arbitrary binary". The point of packages is to be declarative as much as possible.

<comment><USER4> Would dependency management really make much sense on Windows?

Under normal circumstances you share as little as possible. There isn't a situation where an app needs "library X version Y or greater".

Some runtimes etc is usually all that's shared.

<comment><USER5> Has this changed from the 90s/2000s? I've been on Lin/Mac for the past decade, but back then many libraries (DLLs) required (msxml4.dll, msvbvm50.dll) - <USER2> specific versions.

<comment><USER6> Windows has supported installing multiple versions of the same system library ever since Windows XP via WinSxS. It's been a non-issue for a long time.

<comment><USER4> Still, for application developers the idea of installing "system-wide libraries" is all but gone. An application installer will just install to \Programs and that's normally it, even for very large applications (Obviously something system-y like a driver still installs system files). Even things that used to be typical system things like runtimes (C++, .NET) can now be locally deployed, which is nice.

In the 90's it wasn't uncommon for installers to just poop application files or config files into Windows\System32.

</comment></comment></comment></comment></comment><comment> open-paren This[1] is the repository from which it pulls. It sounds like third-party repos are a planned feature. Basically, every package is a yaml file like this:

      Id: string # publisher.package format
      Publisher: string # the name of the publisher
      Name: string # the name of the application
      Version: string # version numbering format
      License: string # the open source license or copyright
      InstallerType: string # enumeration of supported installer types (exe, msi, msix)
      Installers:
        - Arch: string # enumeration of supported architectures
          URL: string # path to download installation file
          Sha256: string # SHA256 calculated from installer
      # ManifestVersion: 0.1.0

Doesn't look like there is field for dependencies of a package, but this is also a 0.1.0 release.

[1]: [https://github.com/microsoft/winget- pkgs](https://github.com/microsoft/winget-pkgs)

<comment><USER7> YAML? That's very surprising to me (I grew up in the XML-for-everything days). Would this be the first-ever first-party Microsoft project to use YAML?

<comment><USER8> Not sure about YAML, but I was happy to see Windows Terminal use JSON for configuration instead of XML.

[https://github.com/microsoft/terminal/blob/master/doc/user-d...](https://github.com/microsoft/terminal/blob/master/doc/user- docs/UsingJsonSettings.md)

<comment><USER9> VS Code also uses JSON for configuration, IIRC.

<comment><USER8> Yes, it uses jsonc ("JSON with Comments"), which is even better. :-)

[https://code.visualstudio.com/docs/languages/json](https://code.visualstudio.com/docs/languages/json)

</comment></comment></comment></comment></comment><comment><USER10> I found the issue I think Microsoft is going to actually foul up poorly here, which I... went ahead and filed an issue on: [https://github.com/microsoft/winget- pkgs/issues/288](https://github.com/microsoft/winget-pkgs/issues/288)

In short, a Microsoft employee added AdoptOpenJDK 8 to the repo. ...Java 8? ...In 2020? Another user has opened a PR to add what looks like the FSF's OpenJDK 14 to the repo. So are we supporting 8 or 14? Are users who want to "winget install openjdk" going to get 8 or 14, Adopt or FSF?

I doubt Microsoft is willing to pick winners or losers or opinionate on the authority of third party package sources, and hence, the dream of "winget install powertoys" will probably only reliably do what it should for Microsoft tools.

<comment><USER11> This was a bug of sorts, we've engaged the Java team at Microsoft to get this sorted. Disclaimer - I run the Java team at Microsoft

<comment><USER10> Good to hear. While I noticed Java as the example here, I feel this does speak to a general issue about how to handle multiple releases and some of the decision-making the Package Manager team is going to need to have in place before this leaves preview. For winget to be not just useful, but trusted, it needs to make decisions, not just be an open dumping ground for package installers.

The decisions the team chooses will end up informing the community on the reliability of it as a platform. And I'm definitely excited to see what happens here!

</comment></comment></comment><comment><USER12> I'd recommend to take a look at the project's roadmap to get an idea where Microsoft is going with this:

[https://github.com/microsoft/winget- cli/blob/master/doc/wind...](https://github.com/microsoft/winget- cli/blob/master/doc/windows-package-manager-v1-roadmap.md)

</comment><comment><USER13> I'm pretty satisfied with the package manager scoop. Scoop for now works best when you just install binary software. It is not a replacement for package managers like vcpkg yet with which you can pull dev dependencies for a project.

How does winget compare to scoop? Does it replace vcpkg/nuget/conan/...?

<comment><USER14> Anyone else looking to try scoop should be familiar with this list: [https://rasa.github.io/scoop-directory/by- score](https://rasa.github.io/scoop-directory/by-score)

</comment></comment><comment><USER15> I like scoop, and this is a show stopper for me.

"This project collects usage data and sends it to Microsoft to help improve our products and services. See the privacy statement for more details." from [https://github.com/microsoft/winget-cli](https://github.com/microsoft/winget- cli)

<comment><USER16> Why is that a showstopper?

People do not give feedback so it's impossible to tell how their programs are being used.

The other choice is to listen to the vocal minority that offers feedback than you get into issues of implementing features that no one wants/uses.

<comment><USER15> It's not opt-in, so quite likely a breach of GDPR.

The telemetry in question seems to be logging what is installed, not just how the application is used.

Regardless of consumers willingness to provide feedback it's not a reasonable choice for a large software vendor to collect data from customers computers about competitors products.

<comment><USER16> It's logging what's used so that the app can be improved to fit the use cases of its users.

Of course it's reasonable. The other choice is developing blindly or listening to the vocal minority. Both of which hurt ALL users in the end.

<comment><USER17> Software has always been developed that way and it has never been a problem. It's only recently that developers somehow got the idea that they are entitled to perform surveillance on their customers. It's nonsense.

<comment><USER18> > Software has always been developed that way and it has never been a problem.

It's always been a problem, most people just don't know that because the majority of users don't express their concerns in the way(s) that the developers are open to hearing those concerns.

</comment></comment></comment></comment></comment></comment><comment><USER19> Most of the responses here do a really great job at pointing out the flaws of this project. My biggest gripe is it currently has no plans to be integrated by default. So just like all the other package management tools for windows the tool itself is a prereq requiring another hoop. If I have to deal with more configuration management to install this from the app store I'd rather use chocolaty at least that can be installed reliably.

</comment><comment><USER20> I'm not a Windows user... but didn't they already do this with OneGet? Did that get deprecated? Is this just a re-branding?

<comment><USER21> I'm a Windows user, but I've never even heard of OneGet?

<comment><USER20> This one, as I recollect: [https://docs.microsoft.com/en- us/powershell/module/microsoft...](https://docs.microsoft.com/en- us/powershell/module/microsoft.powershell.core/about/about_packagemanagement?view=powershell-7)

</comment></comment></comment><comment><USER22> So in 199{7,8,9}? I was using yast and/or apt-get to get packages. That was >20 years ago. Now MS have offered something like tar.gz of binaries without dependencies.

But I guess this is an answer to the "where's package management" question. Still not there.

<comment><USER23> All the dependencies are just in the original thing. I have very limited experience with Linux but chasing down problems with dependencies of dependencies feels like a special circle of hell to me.

<comment><USER22> > chasing down problems with dependencies of dependencies feels like a special > circle of hell to me.

Were you getting source from author sites or using the package manager?

I've never had problems with apt or yum. In the days before yum it was a different story in Red Hat. Debian have always had it right with apt IMO. You could attribute the success of Ubuntu to it I feel.

<comment><USER23> I don't remember. I tried to do some rails development in linux like 10 years ago. I know I was using apt, or at least started there. I don't think I ever even got the environment running. I'm sure I was doing something wrong, so no need to blame me, I already know.

</comment></comment></comment></comment><comment><USER24> How does this relate to `install-package`, the Microsoft-official 'package manager for package managers' released a few years ago?

<comment><USER25> Microsoft would be much better off if they had a YAML format for creating Windows installations, as opposed to their current unattended installs.

</comment></comment><comment><USER26> Frankly, this is a very lame attempt at the package manager. All it does is download installer executables and run them. There is no ability to list installed packages, neither is the ability to uninstall. Where's the actual package management functionality?

Both Scoop and Choco are way better than this.

</comment><comment><USER27> It mentions oneget, isn't that nuget now? and also by Microsoft?

</comment><comment><USER28> It talks about installing apps. But what about DLLs? .NET framework versions?

<comment><USER29> It has been ages that the best practices are to install them alongside the applications instead of polluting C:\Windows.

Also .NET Core is supposed to be bundled with the application.

<comment><USER30> Unfortunately, this causes file duplication (which is not that bad these days of endless storage) and unnecessary vulnerabilities when outdated vendored libraries are used by applications.

Linux distributions tend to keep shared libraries in their own packages and applications depend on them so that when you install an app, the packages with the libraries also get installed. And all packages in the distribution tend to use the same versions of those shared libraries.

<comment><USER29> Which is why nowadays Linux suffers more from .so hell and ABI breakages than Windows does.

<comment><USER31> Not really? In the Debian ecosystem, at least (can't speak for any other), every major version of a library package is expected to be packaged as its own separate concurrently-installable package. You'll find e.g. postgresql-11-dev and postgresql-12-dev both exist as packages, and one provides libpq.11.y.z.so + its headers, while the other provides libpq.12.y.z.so + its headers. Each gets updates independently. One will never automatically switch you over to the other.

And major versions are the only things that _need_ to be separately packaged, because the Linux native-library ecosystem is expected to keep .so ABI compatibility through both "patch" and "minor" updates (the only difference between the two being that "minor" updates can add new exported symbols to the library; they still should not break usages of existing symbols.) This particular arrangement was, in fact, what the Semantic Versioning standard was introduced to accomplish—getting upstream developers to use their version- tuples to mean the same things that Linux-distro package maintainers expect them to mean, allow Linux-distro package maintainers to reuse upstream version schemes rather than needing to maintain their own.

<comment><USER32> All true _in theory_ , but in practice these mechanisms are worthless because for most libraries Debian developers are dropping older version of libraries immediately after transition to the new version is completed. Want to to run a 3rd party binary that depends on an older library? You're favorite package was dropped during the transition? Tough luck. Your best bet is installing needed library packages from previous debian release and praying that'll work.

<comment><USER31> True enough, but if stability is your desire, that is precisely why distros cut releases (and especially LTS releases) in the first place. If you want a program that can run without ABI-conformance changes for years and years, base it on an LTS release, and that LTS release will keep whatever ABI-major versions of the .so library-packages it shipped with updated (with security updates, at least) until the release's EOL. If you don't want ABI breakage, then _don 't dist-upgrade_!

But, this is also to say: if you're creating a new, greenfield project, or a new major version of your own app—and you haven't yet deployed it into the wild as a fixed binary that people rely on to continue running on their boxes between upgrades—then nobody else but you has any incentive to keep things stable for you. If you want to develop against the newest Debian release at any given time, then it's up to you to catch up to whatever the newest ABI- major versions of your deps are at any given time. That's a problem you've chosen for yourself.

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> I'm sure the developers of Chocolatey have been dreading this day for years.

<comment><USER34> Dreading? I doubt it. It's a relief when the problem your library solves no longer needs solving!

<comment> _-david-_ If it was just a free library that would be one thing but they have a company with multiple employees.

<comment><USER35> I won't say it was silly to ever make Chocolatey, but it was living on borrowed time from day one.

What's interesting to me about this announcement is that it seems to replace something they already had; Microsoft released OneGet several years ago and was positioning it (I thought) the same way they are positioning this. It's in maintenance mode now. So I would say Chocolatey is doomed only if this actually sticks.

</comment></comment></comment></comment><comment><USER36> Software management on Windows is such a mess.

After decades of opportunity for improvement, it's largely gotten worse. Uninstall is too often a myth, and the majority of programs out there leave bits and pieces behind. These add up over time to bloat your registry, disk, kernel drivers, etc, degrading the performance and reliability of your computer. Multiple conventions for where things go makes it difficult to track down the bits. (Program Files? (x86)? AppData\\[Local|LocalLow|Roaming]? SteamApps\common? ProgramData? System32/SysWOW64? Dozens of registry locations?)

So many installers require unfettered, administrative access to my computer with little indication of exactly what they intend to do (Litter my desktop with new shortcuts? Add shell hooks? Install a rootkit?) and no opportunity from the OS to consent your partial permission or retroactively examine the changes. (Don't miss that popup balloon about a new driver! Have fun parsing through all the noise in your event logs).

Even simple chores like managing file type associations became more painful somewhere along the way.

There's a reason professionals so often fall back to advising a reformat. Makes me miss the days when your program went someplace like C:\PHOTOSHOP and most everything for it was contained within.

It's easy to point fingers at individual software publishers (I've called out some incompetent ones) but mostly I blame Microsoft for failing to evangelize rigorously thought-through best practices and provide better tooling to make it dead easy for developers to get it right. I might be wrong about this, but the preview looks like a gimmick for finding and running installers. I would have liked to see improved methodologies, packaging tools, and end-user empowerment announced alongside it.

Hats off to folks like Nir Sofer and Mark Russinovich who've shown the world just how much you can pack into a small, single-file, zero-installation EXE that just runs when you click it.

I've been using the same computer for 10 years now (with upgrades to components like video, RAID controller, SSD's) and have over 700 programs installed on it. I use third party monitoring software [1] to capture a disk and registry snapshot before and after any installation (and often on updates). The machine is still nearly as snappy as the day it was built (yes, I benchmark!), but it's taken a LOT of ongoing work to keep it that way. I use other tricks, like locking down certain registry keys and folder locations which programs like to pollute (or where that causes breakage, using startup scripts to clean them out after the fact in a cat and mouse game). One big win was completely giving up on My Documents. I treat it like just another AppData, and organize the content I really care about elsewhere.

All that said, I really like that my Windows software still comes directly from the vendors. I'm not sure how I feel about distribution becoming more centralized under Microsoft's control. Part of me hopes to see a vibrant ecosystem of third-party repos emerge, while another part dreads the confusion about where to get a package that may entail.

I do have to give Microsoft credit for enabling third party tools to take care of some of the shortfalls they haven't. On more locked down platforms that's been more difficult.

[1] [https://www.martau.com/](https://www.martau.com/)

<comment><USER37> UWP and MSIX are/were intended to address the problems you mention

</comment></comment><comment><USER38> Do you need a microsoft/whatever account for this? I can't see anything about it but wouldn't be surprised if they forgot to mention it...

</comment><comment><USER39> I'm interested to know whether the SHA256 hashes are just done on a TOFU basis, or whether they actually verify the Authenticode/GPG signatures of the EXE files to get an 'authoritative' or 'trusted' hash.

</comment><comment><USER40> What about uninstalling apps?

</comment><comment><USER41> Maybe the most exciting thing I've heard so far from Build 2020.

Getting Closer to my dream install:

* WSL 2

* VS Code

* .NET 5

* Windows Terminal

* Package Manager

* Edge

All that's missing is Edge on Linux and letting me write cross platform apps that use edge as a (headless) common runtime.

<comment><USER42> Given that edge is just chromium now, I'm curious as to how an edge headless runtime would differ from node or electron

</comment></comment><comment><USER43> Is this an msi hiding in a wrapper? Anyone who has dealt with the innards of an msi file knows it's a dog's breakfast!

</comment><comment><USER44> Are they doing any form of caching (think CDN) to battle link rot?</comment>


Saharan 'carpet of tools' is earliest known human-made landscape - <AUTHOR> http://www.sciencedaily.com/releases/2015/03/150311160254.htm <comment><AUTHOR> The summary:

> A new intensive survey of the Messak Settafet escarpment, a massive outcrop > of sandstone in the middle of the Saharan desert, has shown that stone tools > occur "ubiquitously" across the entire landscape: averaging 75 artefacts per > square meter, or 75 million per square kilometer.

I'm having trouble wrapping my head around these numbers. But if you figure a population density of maybe 1 hominin per every 10 square kilometers times hundreds of stone tools per hominin per year times 1 million years, maybe the numbers work out. I'm kind of wondering if they're counting discarded flakes from stone tool production and not just the stone tools themselves.

<comment><USER2> That is correct: in the field _every_ object that was created by homo sapiens sapiens is counted as a separate artifact. So each flake / discard is also counted - when flint knapping, there will be many such artifacts per finished edge.

A more interesting question to ask:

Why?

 _But around 10,500 years ago, a sudden burst of monsoon rains over the vast desert transformed the region into habitable land._

 _This opened the door for humans to move into the area, as evidenced by the researcher 's 500 new radiocarbon dates of human and animal remains from more than 150 excavation sites._

 _" The climate change at [10,500 years ago] which turned most of the [3.8 million square mile] large Sahara into a savannah-type environment happened within a few hundred years only, certainly within less than 500 years," said study team member Stefan Kroepelin of the University of Cologne in Germany._

[http://www.livescience.com/4180-sahara-desert-lush- populated...](http://www.livescience.com/4180-sahara-desert-lush- populated.html) 2006

 _The findings of this study are that the sedimentological and geochemical properties of the lake sediments confirm that the Sahara has been drying slowly from six thousand years ago to reach the present day conditions around 1,100 years ago," said lead author Pierre Francus, professor at the National Institute of Scientific Research in Quebec, Canada..._

 _Climate scientist Gavin Schmidt, of NASA's Goddard Institute for Space Studies, explained that around 8,000 years ago, the Earth's orbit was slightly different to how it is today. The tilt changed from around 24.1 degrees to the present-day 23.5 degrees._

[http://www.astrobio.net/news-exclusive/how-earths-orbital- sh...](http://www.astrobio.net/news-exclusive/how-earths-orbital-shift-shaped- the-sahara/)

So, about 11k years ago the Sahara suddenly burst into life, and about 8k years ago axial tilt changes started the process of removing this burst.

The Sahara is also linked to fertility rises in rainforests in South America.

<comment><USER3> Thanks, this was interesting:

 _" The changes in the Earth's orbital tilt and precession (or the wobbling motion) occur because of gravitational forces emanating from other bodies in the solar system. To understand exactly what happens, picture a spinning top when it is slightly disturbed. Just like a top, the Earth too wobbles slightly about its rotational axis. This tilt changes between roughly 22 and 25 degrees about every 41,000 years, while the precession varies on about a 26,000-year period. These cycles have been determined by astronomers and validated by geologists studying ocean sediment records. _"

Are there any recommended references on this 26,000 year cycle?

<comment><USER4> Here is a pretty decent documentary about it: [https://www.youtube.com/watch?v=2OVAkMrdeKI](https://www.youtube.com/watch?v=2OVAkMrdeKI)

<comment><USER3> Thanks!

</comment></comment></comment></comment></comment><comment><USER5> [http://www.cam.ac.uk/research/news/saharan-carpet-of- tools-i...](http://www.cam.ac.uk/research/news/saharan-carpet-of-tools-is-the- earliest-known-man-made-landscape) The source I believe.

</comment><comment><USER6> I've gotten used to the frequent feeling of "everything you know is wrong" \- or at least, more complicated - as more fields of investigation become computation-friendly and hop on the Moore's Law Express.

But once in awhile, something like this comes along and leaves me with skin abrasions on my dragging lower jaw.

I'm gobsmacked by the idea that I could stand in the middle of this escarpment and that the ground everywhere, as far as I could see, would be littered with a million years' work of my near ancestors and cousins.

Wow.</comment>


C++17 is formally approved - <AUTHOR> https://herbsutter.com/2017/09/06/c17-is-formally-approved/ <comment><USER2> C++ shows that in theory you can fix any flaw in an existing programming language as long as you maintain backwards compatibility by simply adding more features. The only thing you cannot change are implicit defaults (e.g. pass by value is the default, you have to manually opt out to pointers or references).

I like modern C++ because for me it's a reasonable compromise between java safety and C safety. Other than out of bounds memory accesses and legacy code I feel there is not much that can go wrong. However compiling C++ projects takes ages and in the projects I've worked on I often have to modify headers that are included almost everywhere. Every trivial changes requires a 5 minute rebuild.

After working with several high level programming languages with slow compilers I realised the following: typing is fast, compiling is slow. There is a reason why go is so popular. It offers that tradeoff in fast turn around time / compilation time with reasonably good performance and simplicity in exchange for more keyboard bashing and keyboard bashing is a cheap price to pay for what you're getting back.

<comment><USER3> > C++ shows that in theory you can fix any flaw in an existing programming > language as long as you maintain backwards compatibility by simply adding > more features.

I feel like C++ proves exactly that you can't.

<comment><USER4> If C++ is so bad then why:

1) are 90% every really large software projects written in C++. All the programs "everybody knows" just happen to be in C++. Examples include Chrome, Windows, Microsoft Office, Adobe tools, KDE, Autodesk, ...

Clearly those programs have massive scopes, large complexity, the need for extensive abstractions, the need for large teams cooperating, tests, ... all the stuff we value as programmers.

2) Are all programs in most other languages so ... small. In scope, in features, in ... Just look at Go programs on github. Or python ones.

Very large Python projects are a few 10's of thousands of lines of code. And they are limited by their complexity. Somehow C++ programs seem to have less of this problem.

Very large javascript projects don't even seem to get above a few thousand lines of code. And reading them, I can see why. Typescript at least seems to match Python in how much complexity it can contain without imposing too much of a burden, but that language doesn't match C++ either.

Most of those fancy languages are artificially limited in some ways. For instance, you cannot easily link QT into Go (nor can you do that with many other libraries, GTK has the same problem). C++ does not have that problem, and if it does, you can solve it. I do not claim doing so is easy, but it can be done. You're not stuck. Go on IOS ? It sort of works, with a boatload of limitations that make it utterly unworkable. C++ on IOS ? It works, with less limitations than Objective C.

I feel like C++ gets a much worse reputation than it deserves. Much worse. It is not the solution to everything, of course.

<comment><USER5> 1) I know so many programs which are the same size or bigger than your "well- known" programs you probably never heard of but still use daily - They are just not desktop programs, a place where C++, for various reasons, is often the language of choice, but desktop programs are (for better or worse) just a small subset of all programs written.

2) See answer above.

> I feel like C++ gets a much worse reputation than it deserves. Much worse. > It is not the solution to everything, of course.

In the end it all boils down to Stroustrups quote about programming languages: 'There are only two kinds of languages: the ones people complain about and the ones nobody uses'

</comment></comment></comment></comment><comment><USER6> Here's a good rundown of all the changes in C++17:

[https://stackoverflow.com/questions/38060436/what-are-the- ne...](https://stackoverflow.com/questions/38060436/what-are-the-new-features- in-c17/38060437#38060437)

<comment><USER7> You may want to change the link to

[https://stackoverflow.com/questions/38060436/what-are-the- ne...](https://stackoverflow.com/questions/38060436/what-are-the-new-features- in-c17/38060437#38060437)

<comment><USER6> Done. Thanks!

</comment></comment></comment><comment><USER8> So I'd like to learn more about modern C++ and how to write it, but I'm not really sure where to begin. I've tried a couple of times, but coming from a C background, my code tends towards C styling with only the occasional use of C++ features.

Is anyone aware of a good tutorial or reference list for writing good modern C++ (C++11 or newer, I guess)?

<comment><USER9> As a newcomer to C++ myself, I found Stanley Lippman's C++ primer to be helpful. The latest edition includes the newer features.

And in case it helps, the main things I find myself using differently to C are:

\- Smart pointers. If you're not using them, use them. They're amazing. Seriously. Never have to worry about freeing something ever again.

\- Object oriented design.

\- Const reference arguments.

\- The occasional auto.

<comment><USER10> I'd second _C++ Primer_. It's a great overview of the language and has been updated for C++11. Unfortunately it was written too early for C++14 and beyond so if there is a newer edition planned (I've no idea) it might be worth the waiting. In any case C++11 was the big change for C++ so the fifth edition is still worth while.

One word of warning though, there's a confusing similarly titled book called "C++ Primer Plus" which you should avoid at all costs.

</comment></comment></comment><comment><USER11> It's very nice to hear progress on the C++ all the time. On the other hand, I cannot find any news on the C2x progress, as if C did not evolve.

</comment><comment><USER12> So I used C++ a long time ago but moved to Java/dotnet/python platforms. I do miss some low level stuff but not random crashes.

Is there a reason to use C++ any more? Has anyone gone back and had good experience? I'd kinda like to but am wary of the old problems. (The other problem is that most interesting business logic is no longer in C++.)

<comment><USER13> If you had 'random crashes', you probably weren't that good with C++ ...

<comment><USER14> It's definitely getting easier, but I still wouldn't even consider C++ without valgrind or similar watching over my back; and I've been writing C++ since 1995. Accessing a variant value as the wrong type, dereferencing empty smart pointers and accessing non-existing elements in collections and many many more cases will still segfault; and I don't expect that to change since it lacks that level of security by design. That being said, it's still the most pragmatic language around; the only language that allows me to choose my own level of crazy.

<comment><USER13> Exactly! C++ is a language where you are free to choose level of safety.

None of your examples are a fault of the language - it is a fault of developer not doing necessary safety checks.

<comment><USER15> The point is: some languages have capabilities to take some classes of errors out. A language with GC and heap-allocation only makes it hard to get access- after-free-style errors. Languages with bounds checks on all elements reliably crash (throw an exception) instead of showing "random" behaviour on bad reads. Of course all of that comes with a cost, but for many domains that works out ...

</comment></comment></comment></comment></comment><comment><USER16> Scanning through the list of features, one I dislike is selection statement initializers:

if (init; condition) {}

(Ref: [http://www.open- std.org/jtc1/sc22/wg21/docs/papers/2016/p030...](http://www.open- std.org/jtc1/sc22/wg21/docs/papers/2016/p0305r1.html)). It just seems like clutter. I generally prefer when languages discourage side effects in a branch condition.

<comment><USER17> That's sorta the point... the init isn't the branch condition. It gives terser syntax to a common patter where you want to scope something into the body of an if statement.

      {
        std::unique_ptr<T> x = foo();
        if(x->something()) {
          // use x
        }
      }
      // x out of scope, destructed

becomes

      if(auto x = foo(); x->something()) {
        // use x
      }
      // x out of scope, destructed

It's makes it easier to read the lifetime of x (an important thing you have to manually keep an eye on in C++ in many cases), and to determine what is in scope outside of the if statement. It's analogous to for-loops vs. doing loops "manually" with while. You're just used to for-loops by this point (if you don't like for loops then ok :).)

C# is also getting (has got?) this feature.

<comment><USER16> If I'm reading the paper right, the init statement could be any expression- statement or simple initialization. So, modifying unrelated, externally scoped variables in the init would be legal. I don't see this improving readability.

<comment><USER18> It's no different than the init and conditional parts of a for loop. Do people abuse for loops to do unrelated tasks? Not really.

It does improve readability. If you've ever had to have a series of conditionals in their own braces to keep the init variable in its own scope, then you have a use for this. The alternative might be having foo1, foo2, foo3… all in the same scope, and it's too easy to use the wrong one. This keeps things specifically constrained to the scope in which they are used, which improves safety and correctness, and I think also readability once you adapt to it.

Yes, it could be abused, but I don't think that's a reason not to use it for its intended purpose.

<comment><USER16> People mess up for loops a lot! That's why range-based for and the STL algorithms library are so useful. I agree having multiple fooX variables in scope is bad. In practice, I've found that either many of these return types are identical, so variables could be reused, or the logic flow could be organized in a more straightforward way.

<comment><USER18> I wouldn't want to reuse a variable for multiple purposes though; that can lead to unintentional use of the wrong value. At least this way you ensure that can't happen.

And agreed that people mess for loops up, and range based loops are better. My point was only related to the syntactic precedent for coupling an initialiser and conditional in a statement.

<comment><USER16> Generally, variable reuse is bad. But for something like an error flag that immediately causes function exit and is never referenced again, I wouldn't raise an objection in a code review.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> I really hope I can soon replace

      add_compile_options($<$<COMPILE_LANGUAGE:CXX>:-std=c++1z>)

with

      set (CMAKE_CXX_STANDARD 17)

Note: we had a green field application that started with an empty Emacs buffer so figured we could go straight to C++17. I doubt this is a particularly common case right now.

<comment><USER18> Supported since CMake 3.8!

<comment><USER19> Yeah, CMake supports it and G++ accepts it but Clang++ doesn't yet, and we compile with both compilers.

Edit: and LLVM 5.0 was released today; clang now accepts the flag!

</comment></comment></comment><comment><USER20> There are some nice things in there, but the destructuring looks a bit odd:

      struct S { int x1 : 2; volatile double y1; };
      S f();
      const auto [ x, y ] = f();

So it's just ordering based, I can't pull out one member by name?

<comment><USER21> It's yet another feature stolen from Python.

Next version maybe they will even allow stuff like

      [x, [y, z]] = f()

or

      [x, y, z...] = f()

<comment><USER22> These ideas are a lot older than python, about as old as multiple return values.

</comment></comment></comment><comment><USER23> Does anyone know the status of UFCS?

I know it's not in C++17, will it be in C++20?

</comment><comment><USER24> Does it have coroutines? Python has had them since 2.5 (2005) and Golang has obviously had them since the beginning.

When will C++ finally catch up?

<comment><USER25> When will Python finally get rid of the GIL and offer AOT compilation to native code?

<comment><USER26> To be fair, none of these would be part of a language specification, only a specific implementation.

<comment><USER27> Something something "export" for templates cough gargle

<comment><USER26> Gesundheit!</comment></comment></comment></comment></comment>


The UK Government should protect encryption not threaten it - <AUTHOR> https://www.openrightsgroup.org/blog/2017/tcns-encryption <comment><AUTHOR> Deadline to complain to the home office is 19 May (tomorrow). You may also want to write to your MP, as they will probably be up for re-election very soon.

[https://action.openrightsgroup.org/tell-home-office- protect-...](https://action.openrightsgroup.org/tell-home-office-protect- encryption)</comment>


Tell HN: When using Notepad (Windows), press F5 to print current date and time. - <AUTHOR>

<comment><USER2> If you start the file with ".LOG" it will add date when the file is reopened.

Stupid party trick.

</comment><comment><USER3> This is a pain when I teach kids HTML using notepad. I instruct them to ctrl+s to save, alt+tab over to their browser and F5 to refresh.

Inevitable they forget the middle part and we end up with webpages filled with timestamps.

<comment><USER4> Just tell them to press Ctrl+R to refresh.</comment></comment>


A BlockTogether list for election propaganda bots on Twitter - <AUTHOR> https://americapossible.com/2019/01/27/cleanup-twitter-for-the-2020-elections/ <comment><USER2> I'm a bit skeptical of this. It could be used for some rather nefarious means. However, I found this comment from one of the authors of it troubling:

> _Twitter users should be able to engage in healthy online discourse without > foreign countries and organized groups manipulating the conversation._

This rhetoric makes it sound like only Americans should engage on Twitter.

<comment><USER3> I believe they mean foreign governments, from interfering with domestic elections. This would actually be useful outside of the U.S. as the U.S. is far from the only country this kind of manipulation has occurred in, in fact it is probably even more prevalent elsewhere.

<comment><USER4> That in mind, in the interest of specificity I wonder if the phrase '[foreign] state actors' would be better used?

<comment><USER5> Yes, if it were justified.

It isn't justified. There is zero reason to believe that these accounts are foreign or bots. I checked a bunch of them. Every account looked like a normal human American on one side of the political spectrum.

It would be nice if the list were clear on that, but "block foreign bots" is more marketable than "filter bubble me harder".

</comment></comment></comment></comment><comment><USER6> I find the methods listed on [https://botsentinel.com/faq](https://botsentinel.com/faq) a bit confusing:

"Q: How do you determine which accounts are classified as fake news?

Classifying fake news accounts is a manual process. We review hundreds of tweets and retweets during the review process. If an account has a large number of followers and a high percentage of misleading and/or factually incorrect tweets, that account could be classified as Fake News."

"Q: Why is my account rated problematic or alarming?

Our machine learning model was developed to identify accounts that exhibit irregular tweet activity related to politics. The more you exhibit irregular tweet activity, the higher your trollbot score will be."

So how much is manual and how much is their model? By what criteria do the manual reviews judge tweets?

It all seems way too opaque without more information.

<comment><USER7> Totally. Are they sure thd training data aren't biased? Are they considering the full spectrum of politics? Are they neutral to results?

<comment><USER8> if you review the list of users on the list, it clearly is biased - I've only checked 10 random accounts but at least half of them appeared to be real, regular Republicans. I mean, the fact that botsentinel rate accounts as "problematic" is pretty amusing given that it's language associated with a particular political orientation.

</comment></comment></comment><comment><USER9> This is interesting given that Twitter could be doing this on their own to promote a better platform.

But instead requires trusting a 3rd party. Which, from an open source standpoint could be better with verification and such that seems to be present.

<comment><USER10> I'm under the impression that the number of times an account is blocked _could_ provide some signal to twitter that, hey, maybe this person/bot/thing shouldn't be on here - so I went ahead and clicked the go button for this huge list.

</comment></comment><comment><USER11> I vigorously curate and purge my Twitter of anything (or anyone) remotely political, and it makes it a great place to see what people in the industry are up to. Otherwise it's a complete dumpster fire. I'm completely convinced that >90% of all accounts are not a human being.

</comment><comment><USER12> Maybe a step in the right direction but I would much rather have the content from these entities still be visible, but flagged, so I could warn others.

Probably not possible without a custom twitter client, though.

<comment><AUTHOR> If you follow @botsentinel, it does this.</comment></comment>


New system could make censorship of Internet sites virtually impossible - <AUTHOR> http://www.gizmag.com/telex-anti-censorship-system/19488/ <comment><USER2> I could see the government getting around this by regulating HTTPS or making encryption for the purposes of subverting censorship a crime.</comment>


Show HN: Keyword Search in Telegram Group Chats - <AUTHOR> https://frozen-sierra-06305.herokuapp.com/ <comment><AUTHOR> Author here :) I am planning to launch a keyword search app for telegram chats. Let me know what you think of this demo. Telegram is the de facto leader in crypto communication. Keyword search is helpful when you are trying to spot the trend in crypto. Cheers!</comment>


Facebook TOS vote a con trick? - <AUTHOR> http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-564312

<comment><USER2> Facebook is a _website_ , not a state or any other sort of political entity. Why people seem to feel that they have "rights" when it comes to facebook is beyond me. I wonder if those complaining are the same people that keep yelling about bailout money and saying that "the market should correct itself"?

Funny how market correcting forces don't seem so pleasant when you're caught in the middle of one of those corrections...

<comment><AUTHOR> You're comparing apples to oranges.

Facebook is a website that _hosts your personal info_. Whats more, they want to _store_ that info for as long as they want and use it for whatever they want, besides making money.

If facebook was a site that didn't store any info about you, then they can do whatever they want and I'd be willing to bet that nobody would care. But it's not. So yes, we _do_ have rights when it comes to this stuff. Which was explicitly displayed when people began to close their facebook accounts.

<comment><USER3> They didn't take your personal info. You gave it to them, because you like what they do with it. I'm sorry, but I think you're going to find that you don't actually have "rights" here.

<comment><AUTHOR> Sweet Lord grant me the strength.

The whole reason why we _posted_ (notice I didn't say give, we didn't give them anything) our info was because of the inherent understanding that they wouldn't do anything stupid with it. Like saving it forever ever even after we want to delete it.

And once again, like I mentioned in my first comment, once this trust was breached, people exercised their _right_ (yes, we do have rights here) to delete their accounts.

Bottom line - if they want to use our info to market ads towards us, fine, the site is expensive to run and I can certainly understand and support their efforts, for as long as I maintain my info there. It's an equal give and take - I use the site and they make money off my info. But once I delete my info, it's only common sense for them to delete it all as well. How is this so hard to understand?

<comment><USER3> No offense, but that was dumb of you. You will never get that information back. You might as well organize a protest in front of Experian. You had no contract with Facebook requiring them to do anything at all with your information once you left.

<comment><AUTHOR> You're right. There was no contract. It was based on a silly thing called trust. It _was_ dumb of me to blindly trust them. No argument there. Lesson learned.

I know now that when I launch my startup, my focus will be on maintaining customer trust. The first question I will ask myself when it comes to any changes will be "can I achieve the desired outcome without hurting my userbase?"

Facebook taught me that.

<comment><USER4> 'The first question I will ask myself when it comes to any changes will be "can I achieve the desired outcome without hurting my userbase?"'

Judging from their growth rate, it looks like they asked that question and the answer was yes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> After voting, I see:

"More than 280,597 people have voted.

73.16% (for the proposed documents)

26.84% (for the existing documents)"

<comment><USER6> What percentage of total users does that add up to?

<comment><USER7> Assuming 200 million active users, 0.14%

(<http://www.facebook.com/press/info.php?statistics>)</comment></comment></comment>


Grokking the anthropology of social networks - <AUTHOR> http://www.danah.org/papers/FriendsterMySpaceEssay.html <comment><USER2> I've been a big fan of Danah's work for the past 3 years. This is an interesting analysis she published a while back (though it's ever evolving), especially since most people are quick to generalize Friendster's demise as a product of internal politics and featuritis.</comment>


GitHub System Status - 9 Oct 2015 16:15 - <AUTHOR> https://status.github.com/?t=1615 <comment><USER2> As usual, I'm tracking this outage over at StatusGator: [https://statusgator.io](https://statusgator.io). If you want alerts on this sort of thing, it can post to your Slack and the like.

The most interesting thing to me about GitHub outages is how many services it affects. I always get notifications for at least 20 or 30 services which all proactively and automatically post warnings about their GitHub integrations potentially being down. A _lot_ of services integrate with GitHub!

<comment><USER3> Do you just monitor the service status boards? Or do monitor the actual services? I ask because several services will frequently be down or impacted for at least 30-60 minutes before they update their status boards, which by then is far too late to take action.

<comment><USER2> Only the status pages. I have a hope that having more eyeballs on the status pages will increase the provider's responsiveness to posting on them, because you are absolutely right that some do it as an afterthought.

The use case that brought me to create this was a bug I was dealing with involving the Facebook API. After hours of debugging I decided to check Facebook's status page and realized they had long prior published an issue they were experiencing.

</comment></comment></comment><comment><USER4> What am I looking at? "All systems operational"

</comment><comment><USER5> Has the status page itself stopped updating? The daily app server availability was updating for a few minutes, but has not updated for about ~20 minutes.</comment>


Electroneum Now Trading on Kucoin – Cryptocurrency News - <AUTHOR> https://altcoinreport.co/electroneum-etn-listed-on-kucoin/ <comment><USER2> Will Electroneum ever be listed on a major exchange like Binance? The token is really getting off to a slow start.

<comment><AUTHOR> It's possible although the token will need to prove to Binance that they are of value more than every other altcoin trying to get listed there. If they actually go live on one of their mobile carriers they claim to have ties with, the expansion of cryptocurrency exchanges will be streamlined.</comment></comment>


The Three Worst Programming Languages - <AUTHOR> https://medium.com/@richardeng/the-three-worst-programming-languages-b1ec25a232c1

<comment><USER2> reads title of HN post

I'll bet my weeks paycheck PHP is on this list

Clicks link

Yep! PHP made the top of the list!

I got my start in PHP

3/4 of my resume is about experience using PHP

Every week I get a message from a recruiter on LinkedIN about a job using... PHP

IMO - That means PHP is a great language; it got me my start; it got me most of my jobs and it continues to produce prospects for new jobs in PHP

Stop hating on PHP!

</comment><comment><USER3> PHP only gets a bad name because there is so much crap code out there. It's also not cool anymore.

I remember when RoR was all the rage here on HN. Nobody wanted to admit the glaring DB and security issues and anyone against RoR during that time was promptly down voted and called an idiot.

It's funny. All the RoR people I know jumped ship years ago and moved onto the next 'cool' language. IE: Javascript Frameworks.

Many startups are just as much about using the hip new language as they are changing the world.

The real software engineers use what they know works, not what's cool.</comment>


NIST Simulates New DNA Sequencing via Base Attractions through Graphene Nanopore - <AUTHOR> http://www.nist.gov/mml/acmd/nist-simulates-fast-accurate-dna-sequencing-through-graphene-nanopore.cfm <comment><AUTHOR> Previous approaches relied upon detecting electrical changes in the graphene nanopore as the strand passed through; this new approach cleverly uses graphene nanoribbons with copies of nucleotide bases attached which chemically micro-bond to their respective opposite base (A<->T, G<-C) as the strand is passed through. This significantly improves accuracy of the detection method.</comment>


History of the ISA: Digital Equipment Corporation - <AUTHOR> https://www.allaboutcircuits.com/news/history-of-the-isa-digital-equipment-corporation/ <comment><USER2> This article really barely touches on the issue, even with regard to earlier influential architectures by DEC alone (plenty of others contributed as well, though in this regard the most influential were DEC, Intel and IBM in no particular order). It also ignores Gordon Bell, possibly the inventor of the ISA as an idea with his profound design choices in the early DEC architectures.

The most important machines to DEC were PDP-1->PDP-6->PDP-10->DEc-20", PDP8, and PDP-11->VAX, and from an ISA perspective the -10 and -11/Vax sequences had pervasive influence until today.

The 36-bit PDP6 architecture (unfairly called a "dead end" by another poster on this discussion) was highly influential: it was highly orthogonal and what we would consider today almost RISC, but was easy to program in both assembly and with a compiler. This is the architecture that gave us the Internet, Lisp machines, the bitblt instruction (ever used a bitmapped display?) and other technologies that led to today. The PDP-11 gave us C[+] -- there's a little PDP-11-like machine in every C and C++ compiler, and pretty much every other CPU-targeting compiler these days, and as a result, almost every modern ISA looks like a PDP-11 if you squint a little.

(The article also ignores what a barn burner Alpha was. Its biggest misfortune was to be born at the wrong time into a family that had fallen on hard times).

<comment><USER3> >The article also ignores what a barn burner Alpha was.

Indeed. 300mhz, dual-issue...in ~1991! Of course, that was before low-power was "cool" and the first chips were very nice space heaters.

Source: worked on the Alpha team before it was "Alpha" ("EVAX").

<comment><USER4> dont you mean 150MHz in 1992-3?

<comment><USER3> Ah, you are right. 300 "mips" (peak), 150mhz.

The cryo guys had something faster running in the back lab, but I don't think they got 2x.

</comment></comment></comment></comment><comment><USER5> Nothing about the PDP-11 (direct ancestor of the VAX, which the article starts with). No details of how one ISA influenced another. I guess we can forgive the relative dead-end of the PDP-8 and PDP-10 architectures.

Good picture of Ken Olsen, though :-)

(I'd forgotten about PRISM, which was canceled through some nasty politics and caused Dave Cutler to move to Microsoft -- and Cutler's Windows NT was a heavy contributor to DEC's failure).

</comment><comment><USER6> Hmm...is that one article in a series on ISAs, with this article the one on DEC. Or is it an article on ISAs, using DEC as the example?

The thing is, I can't find an article on IBM's 360, and while I like DEC's ISAs, the 360 is really the seminal example.

</comment><comment><USER7> The article states:

>"VAX was a 32-bit Complex-Instruction-Set-Computer (CISC) ISA designed for DEC's VMS operating system."

Is it unique that they designed the ISA for OS? Was this common back then? It seems the norm for some time now been to write an OS that targets an ISA and then possibly port it to other ISAs.

EDIT I guess its easy to forget that virtual memory was new and so you needed to design an architecture that had the concept of paging before you could have virtual memory support in your OS(VMS)

<comment><USER8> The VAX and VMS were designed for each other. Many features in the VAX were created specifically to support VMS. That said, just as the PDP-11 was the parent of the VAX, the RSX-11 operating system was the parent of VMS.

BTW, the original article is annoying unsubstantial.

<comment><USER7> Thanks.

I agree that the original article here is annoying and unsubstantial. Might you have some better references or links on the the history of VAX/VMS development and some of the lineage you mentioned such as the RSX-11? Cheers.

<comment><USER8> Search for a copy of "VAX VMS Internals and Data Structures". I have the version 4.4 book, but it appears later editions are available at Amazon and online as pdf. This is pretty dense reading and really goes into detail on the design and rationale for the design. I'd say it's a whole CS education in one volume. DEC had some pretty clever people and it shows in this book.

You might find some more historical information at [https://williambader.com/museum/vax/vaxhistory.html](https://williambader.com/museum/vax/vaxhistory.html) for VMS or for RSX-11 and PDP-11 here [https://williambader.com/museum/vax/pdphistory.html](https://williambader.com/museum/vax/pdphistory.html). Wikipedia has a good article on RSX-11 too.

Apparently you can even legally run RSX-11M on a simulator. Check [http://simh.trailing-edge.com/](http://simh.trailing-edge.com/) and [http://rsx11m.com/](http://rsx11m.com/).

I loved PDP-11s, particularly to write assembly, they were elegant. But it was always a struggle to fit a larger application into a 16 bit address space.

I'd be tempted to try the simulator, but my current hobby computing is doing embedded firmaware on the STM8 which satisfies my desire to puzzle solve fitting a lot of function into too small resources.

<comment><USER7> Thank you these are great links, I appreciate it. Cheers.

</comment></comment></comment></comment></comment><comment><USER9> This article is fluff. If you're looking for substantive information on the earlier half of DEC's history, I recommend this book.

Computer Engineering: a DEC View of Hardware Systems Design C. Gordon Bell, J. Craig Mudge, John E. McNamara

[http://www.computerhistory.org/collections/catalog/102630383](http://www.computerhistory.org/collections/catalog/102630383)</comment>


Amazon's cloud is about to announce a huge health-care deal with Cerner - <AUTHOR> https://www.cnbc.com/2017/11/22/aws-is-partnering-with-cerner-on-cloud-deal-for-healtheintent.html <comment><USER2> This is awesome. The Bad Guys already have all my credit history and personal data from the last hack. Soon they'll be able to add my medical history to complete the profile.

Because fuck me.

<comment><USER3> But won't you be relieved on some level that there is nothing else to be stolen? Now you can run an old crippled version of Android, start using "password" for every password and turn off your security cameras! The game is over and you lost, but at least the game is over!

</comment></comment><comment><USER4> This article reads like PR spam...

<comment><USER5> Perhaps, but HIPPA compatible cloud services is newsworthy, especially with a name brand client.

<comment><USER6> AWS and GCP already both offer HIPAA compliance and have for years

<comment><USER7> Across what subset of capabilities?

HIPAA compliant storage, or even compute nodes, isn't all that interesting. It's the higher level services that matter.

<comment><USER6> [https://aws.amazon.com/compliance/hipaa-eligible-services- re...](https://aws.amazon.com/compliance/hipaa-eligible-services-reference/)

[https://cloud.google.com/security/compliance/hipaa/#covered-...](https://cloud.google.com/security/compliance/hipaa/#covered- products)</comment></comment></comment></comment></comment>


Kids should learn to think - <AUTHOR> http://blog.codeso.me/ <comment><USER2> Everyone should learn to think. But the basic problem is that critical thinking can't be divorced from specific content areas—in other words, you _have_ to teach it through drawing, or coding, or Sonnets, or whatever. It is also, quite simply, hard to teach. That's Daniel Wilingham's research speaking; he describes more here: [http://www.aft.org/pdfs/americaneducator/summer2007/Crit_Thi...](http://www.aft.org/pdfs/americaneducator/summer2007/Crit_Thinking.pdf) . His book _Why Don't Students Like School?_ is also very good.

I wrote about it here: [http://jseliger.wordpress.com/2011/01/24/why-dont- students-l...](http://jseliger.wordpress.com/2011/01/24/why-dont-students- like-school-daniel-t-willingham/) .

</comment><comment><USER3> After reading 3 articles:

\- Kids should learn to Code \- Kids should learn to Farm not Code \- And now, Kids should learn to think

I want to say, yes they are very noble causes, each with its benefit, but what really matters is:

Adults should learn to let Kids Live.

What I say does not mean that kids should go uneducated, but its rather, Kids should have choices, and we should not impose them to take 'X' no of choices. The stress is growing on kids, and true, they are becoming smarter, and the planet is growing faster, it does have a terrible cost: Childhood.

</comment><comment><USER4> More importantly, kids should learn to learn from everything. Too often I work with kids or young adults that hate school, but after a little discussion, discover that they actually really love learning. If the education system is not meeting their needs, they should be empowered to take education into their own hands.

</comment><comment><USER5> "Right Brain" people stil believe in the dichotomy of "creative" people and "non-creative" people (they still use the outdate terms "Right Brain" and "Left Brain"), probably because they associate technical work with mental computations and algebraic manipulation ("doing math").

It's true that technical people will are already less burdened by the heavy lifting of "doing math" or organizing complex technical systems, but that doesn't mean that they are going to be "replaced" by the "artists". It only means that the "soft-technical" aspect of, for example, engineering, is going to be more present (less time focusing on technical details and more on the design and articulation of the mathematical models themselves).

</comment><comment><USER6> In my mind, in addition to teaching fundamental skills like reading and writing, the purpose of K-12 school is to expose kids to a bunch of different subjects so that hopefully they'll find something they're passionate about.

So yeah, every kid should ( _try to_ ) learn to draw and code and everything else we can reasonably expose them to.

<comment><USER7> If only it worked that way. I think in practice it works by exposing kids to a significant amount of drudgery and pain associated with a bunch of different subjects to cause kids to pretty much hate learning in general. It's a wonder that anyone manages to survive K-12 education with any degree of passion for learning intact.

P.S. [http://www.smbc-comics.com/index.php?db=comics&id=2112](http://www.smbc- comics.com/index.php?db=comics&id=2112)

P.P.S. From a lot of different people I've heard the same story of having a hard time re-engaging in learning and especially reading after coming out of formal education. A lot of people have an aversion to the books and authors they studied in school, and often to reading in general. It seems to typically take several years for people to (re)develop an individual passion for reading and to be open to reading those authors again, though some people seem to never get past that aversion.

</comment></comment><comment><USER8> Related thoughts on education... from CGP Grey: [http://www.youtube.com/watch?annotation_id=annotation_830833...](http://www.youtube.com/watch?annotation_id=annotation_830833&feature=iv&src_vid=AqwJXTyfNqU&v=7vsCAM17O-M)

Also watch Greys favorites vol 4 (playlist on CGP Grey channel). These thoughts from Salman Khan are most relevant here: [http://www.youtube.com/watch?v=CiKrFcgVSIU&list=PLgE-9Sx...](http://www.youtube.com/watch?v=CiKrFcgVSIU&list=PLgE-9Sxs2IBVEoz0MkIzcUmFkXWpmw2zo)

</comment><comment><USER9> Kids should learn to swear in 32 different languages.

</comment><comment><USER10> "Machines should work, People should think."

<https://www.youtube.com/watch?v=_IZw2CoYztk></comment>


When do you need to report your app's use of encryption? - <AUTHOR> https://getonthestore.com/export-compliance/ <comment><AUTHOR> Previous discussion on reddit [https://www.reddit.com/r/iOSProgramming/comments/hhnilf/when...](https://www.reddit.com/r/iOSProgramming/comments/hhnilf/when_do_you_need_to_report_your_apps_use_of/)</comment>


dd – Destroyer of Disks (2008) - <AUTHOR> http://www.noah.org/wiki/Dd_-_Destroyer_of_Disks <comment><USER2> About drive wiping: You're probably better off using the ATA Secure Erase command, which is very quick and does the entire disc. dd and other tools risk not doing blocks marked as bad, for example.

He's right that a single overwrite of zero is probably good enough to make sure that data is gone, but it's probably not enough to persuade other people that it's gone. A few passes of pseudo random data is probably better if you need to persuade other people that the data has gone.

But if it's really important drive wiping is what you do to protect the drives until you get a change to grind them.

<comment><USER3> >but it's probably not enough to persuade other people that it's gone.

I believe there is a long standing bounty for anyone who can retrieve useful data from a drive that had been zero'd once. No one has been able to thus far.

A lot of the disk wiping "culture" stems from a much earlier time when disk technology was less reliable, especially in regards to writes. Dan Gutmann himself says that the Gutmann method is long antiquated and only worked with MFM/RLL encoded disks from the 80s and early 90s.

Perhaps instead of humoring these people, we should be educating them. A zero'd out disk is a wiped disk until someone proves otherwise.

<comment><USER4> This reminds me of assertions we used to take for granted about DRAM. We used to assume that the contents are lost when you cut the power, but then someone turned a can of cold air on a DIMM. We usually assume that bits are completely independent of each other, but then someone discovered the row hammer. The latter is especially interesting because it only works on newer DIMM technology. Technology details change, and it's hard to predict what the ramifications will be. A little extra caution isn't necessarily a bad thing.

<comment><USER3> I agree but redoing a wipe isn't extra caution, its just literally repeating the same thing. If that thing is wrong, you're not helping the situation, just wasting time/resources.

Extra caution would be shredding the drive or some other non-wipe method. At work for example, we zero out drives and then those drives get physically destroyed by a vendor.

</comment></comment></comment></comment><comment><USER5> > Unfortunately, there is no command-line option to have `dd` print progress

How difficult could it be to write a dd command from scratch that does include progress-reporting? I mean, dd is simply reading blocks of data from one file descriptor and writing them to another.

<comment><USER6> `pv` (pipeviewer) is usually very useful for tracking progress.

dd if=/dev/zero count=10 bs=1M | pv > file.bin

The other way to see progress on `dd` is to issue a signal 3 (USR1, iirc) to the dd process. kill -3 <dd pid>

<comment><USER7> > The other way to see progress on `dd` is to issue a signal 3 (USR1, iirc) to > the dd process. kill -3 <dd pid>

Be careful with this on some distributions and compilations of DD. Purely anecdotal evidence, but in college I had a friend imaging a very large (5400RPM) drive and about 10 hours into the process he lamented that he wished he could see how far along it was.

I popped open a terminal, ps -A |grep dd, kill -USR1 $PID, and it just exited.

He was rather pissed that I lost him 10 hours.

</comment></comment></comment><comment><USER8> Does the third command really work as intended?

        sudo cat ubuntu-14.04-desktop-amd64.dmg >> /dev/sda1

I believe this will attempt to write data after the of the the block device, which almost by defintion will fail.

However, I often do the following, which works pretty well:

        sudo cat ubuntu-14.04-desktop-amd64.dmg > /dev/sda1

<comment><USER9> Better:

        cat ubuntu-14.04-desktop-amd64.dmg | sudo tee /dev/sda1

<comment><USER10> I know you meant to use the pipe instead of redirection, but it might be worth updating your comment for the benefit of others who are less command line literate :)

<comment><USER9> Whoops, fixed.

</comment></comment></comment></comment><comment><USER11> It's actually 'copy and convert' but 'cc' was taken.

</comment><comment><USER12> You can 'dd' from Unix to the cloud ... well, some clouds ...

      pg_dump -U postgres db | ssh email@example.com "dd of=db_dump"

      mysqldump -u mysql db | ssh firstname.lastname@example.com "dd of=db_dump"

... although these days, now that we support attic and borg[1], nobody does things like this anymore.

[1] [http://www.rsync.net/products/attic.html](http://www.rsync.net/products/attic.html)

<comment><USER13> That has only one minor advantage compared to:

      mysqldump -u mysql db | ssh email@example.com "cat > db_dump"

Namely, the syntax is one character shorter. (But only because I used whitespace around >).

With dd, you can control the transfer units (the size of the read and write system calls which are performed) whereas cat chooses its own buffering. However, this doesn't matter on regular files and block devices. The transfer sizes only matter on raw devices where the block size must be observed. E.g. traditional tape devices on Unix where if you do a short read, or oversized write, you get truncation.

</comment></comment><comment><USER14> > If you want to erase a drive fast then use the following command (where > sdXXX is the device to erase):

        dd if=/dev/zero of=/dev/sdXXX bs=1048576

Question: is there a disadvantage to using a higher blocksize? Is the read/write speed of the device the only real limit?

<comment><USER4> > is there a disadvantage to using a higher blocksize?

Maybe, depending on the details. Imagine reading 4 GB from one disk then writing it all to another, all at 1 MB/sec. If your block size is 4 GB, It'll take 4000 seconds to read, then another 4000 seconds to write... and will also use 4 GB of memory.

If your block size is 1 MB instead, then the system has the opportunity to run things in parallel, so it'll take 4001 seconds, because every read beyond the first happens at the same time as a write.

And if your block size is 1 byte, then in theory the transfer would take almost exactly 4000 seconds... except that now the system is running in circles ferrying a single byte at a time, so your throughput drops to something much less than 1 MB/sec.

In practice, a 1 MB block size works fine on modern systems, and there's not much to be gained by fine-tuning.

</comment></comment><comment><USER15> It is worth noteting that the shred program mentioned is more or less useless on modern filesystems for a variety of reasons, the man-page has a list that it will fail to work correctly on (btrfs, ext3, NFS).

It may well be that the only usable filesystem for it, is FAT32 (and possibly NTFS, not sure on that thou).

</comment><comment><USER16> This usually messes stuff up pretty good:

      perl -e '$file = '/dev/sda';\
      $s = -s $file;\
      $i = $s/2;\
      while(--$i > 0){\
        $r = int rand($s);\
        system("dd if=/dev/urandom of=$file skip=$r count=1");\
      }'

</comment><comment><USER17> The "Unable to install GRUB" recommended fix to remove the GPT is wrong. The proper thing to do is create a 1MiB partition, BIOSBoot partition type (gdisk internal code 0xEF02), and then grub-install will find it and install core.img there automatically.

</comment><comment><USER18> I prefer `pv` (pipe viewer) for watching dd's progress

[http://linux.die.net/man/1/pv](http://linux.die.net/man/1/pv)

<comment><USER19> CTRL+T on BSD platforms works brilliantly. I will never understand why Linux refuses to adopt CTRL+T (SIGINFO)

</comment></comment><comment><USER20> The point of using random instead of zero is that it's harder to see which parts have been overwritten and which parts haven't been.

<comment><USER21> When is that useful?

<comment><USER22> In the case of a partial erasure (eg, maybe someone disconnected the power during the write, to stop the write from completing), I guess it would make it harder to prove someone had tried to erase (and therefore possibly hide/destroy) information.

</comment></comment></comment><comment><USER23> I don't believe this is the actual name. Are you serious?</comment>


DNA could be the future of data storage - <AUTHOR> https://www.researchgate.net/blog/post/dna-could-be-the-future-of-data-storage <comment><USER2> Sounds like a bad idea. Genomes arent static and have a ton of helper protein enzyme complexes to repair damage. We don't even really know how epigentics really affects much of anything.

</comment><comment><USER3> There's also a neat startup from IndieBio doing something similar: [https://catalogdna.com/](https://catalogdna.com/)

</comment><comment><USER4> What I really wonder is what does this mean for the future of copying the data.

If it's DNA it seems like you could split and replicate the DNA in a PCR to come up with a huge number of copies. (like they do to amplify DNA for testing)

Not to mention, the future of injecting someone with some data DNA that is to be reproduced by the host body and later recovered possibly without notice by the target. Also using the DNA repair mechanisms to keep the data correct.

Pretty cool stuff.

</comment><comment><USER5> tl;dr a team has used some kind of novel encoding to pack the max bits into some test tube dna. Presumably a strategy better than 4B5B? Far future use is Amazon Glacier storage.

I recommend [http://dnafountain.teamerlich.org/](http://dnafountain.teamerlich.org/) over the linked interview. It has links to their paper and github page.

</comment><comment><USER6> Old news, it's been known as a method for cold storage of data for at least 10 years. We probably won't see it used in your smartphones in the near future unless your phone looks like amoeba.

</comment><comment><USER7> I can't find any numbers on throughput?</comment>


Show HN: My first pay to download Android App - <AUTHOR>

Hello,
I have just finished my second app, which is also my first ever pay to download app. It's called StreamClock, It's like a radio alarm clock, but uses a Last.fm radio station, or Spotify Track  chosen by the user.
It took me 1 month of evenings and weekends, and I fell like I have learned a lot. I am particularly proud of the logo...
To find it just search "StreamClock" in Google Play.
I would really appreciate any feedback, comments, questions or suggestions. Thanks. <comment><USER2> This is awesome. I'd say, plug the fact that you can use the "Share" feature in Spotify to set tracks/playlists for alarms rather than pushing your own UI. People will have a better time choosing things that way, but it's otherwise a hidden feature. Shame Last.fm doesn't support "Share".

Feature request: Google music integration.

<comment><AUTHOR> Thanks, good idea. I wasn't sure how easy it would be for someone to work out how to set up a Spotify alarm... I'll promote the share feature some more.

As far I can I tell the share works for Last.fm on my Nexus 7... What device are you using?

Google music is one of the top items on the todo list, thanks.

</comment></comment><comment><USER3> This is a great idea. May I ask why you chose to go with a pre-ICS layout instead of building on top of Holo?

<comment><AUTHOR> I was using both a Nexus 7 and a HTC Wildfire S (Android 2.3.5) to test my app. To start with, I used just my N7 and the app was using the Holo Theme. Then when I installed it on my HTC, something changed somewhere and the default theme changed to the old one. I hadn't really looked at themes, and didn't really know what had happened, or why it affected subsequent installs on my N7, so I decided to write it off for now, and change it in an update later on.

Do you think that it makes it look really old? If so I'll bump the theme update up in my priority list. Thanks

</comment></comment><comment><AUTHOR> Clickable link: [https://play.google.com/store/apps/details?id=com.kiteflying...](https://play.google.com/store/apps/details?id=com.kiteflyingmonkey.streamclock&feature=search_result#?t=W251bGwsMSwxLDEsImNvbS5raXRlZmx5aW5nbW9ua2V5LnN0cmVhbWNsb2NrIl0).</comment>


Richard Feynman on Artificial General Intelligence - <AUTHOR> https://medium.com/cantors-paradise/richard-feynman-on-artificial-general-intelligence-2c1b9d8aae31 <comment><USER2> His predictions are mostly spot-on.

The one that doesn't seem to hold up:

> So, there's no question that the later machines are not going to think like > people think, in that sense.

Interestingly, many of the gains in ML have been around making them work more like humans (neural nets). However he's still overall right. Artificial neural nets have significant differences from their biological counterparts.</comment>


Hidduc Posmeg's Hoon Tutorials – The Urbit Programming Langauge - <AUTHOR> http://hidduc-posmeg.urbit.org/home/pub/hoon-intro/ <comment><USER2> These are some useful but quite unofficial tutorials written by ~hidduc- posmeg, who's probably asleep right now. It's always pathetic when your users shame you into documentation by reverse-engineering the system and writing their own. (See also: [https://github.com/laanwj/urbit- tools](https://github.com/laanwj/urbit-tools))

These are markdown files served from ~hidduc-posmeg's own planet and converted to HTML by urbit, proxied by ~hidduc-posmeg's star ~doznec. Since this system isn't actually supposed to be live yet, hidduc-posmeg.urbit.org is DNSed to doznec.urbit.org; ~doznec talks to ~hidduc-posmeg over Urbit's own network, an encrypted P2P protocol (%ames). Ideally, hidduc-posmeg.urbit.org would DNS to the actual Unix server the planet is running on, for obvious reasons.

This whole thing, like [http://www.urbit.org](http://www.urbit.org), would fall over in a few seconds of HN traffic if it wasn't behind an nginx cache. However, if you look at your network window you should see a long-poll. If ~hidduc-posmeg edits zir tutorials from vim on zir Unix server and saves, this will drive an update event that'll propagate forward and refresh your browser. You can see this in action in our demos...

<comment><USER3> No markdown about it - it's a ford page, and the example code is actually compiled and evaluated along with everything else.

Urbit is secretly much cooler than you give it credit for...

<comment><USER2> Doh! Yeah, another thing Urbit is ok at is generating HTML. If you were designing a language, especially a language that's basically in some sense a Lisp, in 2015, you'd probably want custom syntax for XML-shaped data, to avoid having to use a separate template syntax...

</comment></comment></comment><comment><USER4> > _If you want to use a webpage, which will allow you to use the tall forms of > the runes, then you 'll need to setup up a page to work in. First get the > code from: [https://bitbucket.org/zaphar/hoon- > intro](https://bitbucket.org/zaphar/hoon-intro). Then you will need to copy > the lib.hoon file into your urbit instance's desk, By first mounting the > desk onto your filesystem._

...am I the only person who has absolutely no idea what this guy is talking about?

> _Gates are a of type core that have only one arm with the empty name '$'._

Okay

<comment><USER5> No, you're not alone. It made me feel like I've missed out on the past 30 years of computing, like they never happened like I remember them, or like I'm suddenly in a parallel universe. Quite scary. I guess I sound like that to some people too, some times.

</comment></comment><comment><USER6> So probably no one is still reading this. But I'm the author.

I enjoy investigating new languages and technologies. These tutorials were built while I was doing that for urbit. They probably read like a foreign language to some folks. It does assume a little bit of familiarity with nock and urbit servers.

<comment><USER7> Totally off-topic, but about 10 years ago I played an MMO called Star Wars Galaxies. My character's name was Zaphar Waverunner (at this point I can't remember if it was a totally random name from their generator or if I modified one in homage to Zaphod Beeblebrox). I'd never seen that word in another context until I saw one of your posts here recently.

<comment><USER6> My name was absolutely modified in homage to Zaphod Beeblebrox. Zaphod was already taken for some reason so I modified it to Zaphar instead and it's been that ever since.

</comment></comment></comment><comment><USER8> The "we'll release this to the public when it's finished" mentality is what's causing this project to fail.

Urbit sounds really cool, but it needs people to actually get used to it, understand it, and then parse it and explain it for us mortals.

<comment><USER9> I honestly think you're absolutely right. Some people have pushed through our "unreleased" status and have learned quite a bit anyway. The guy who wrote these tutorials is not one of urbit's primary devs, but he still managed to get a pretty decent grasp on the system, and he even wrote some great doc.

We're generally quite responsive on the urbit-dev mailing list, and we're making a concerted effort to be more helpful everywhere. Urbit is one of those projects that can't succeed without a community. The pace of github pull requests from outside contributors is increasing, and more and more docs are coming out, both from the core dev team and outside contributors.</comment></comment>


Rollendurchmesserzeitsammler (Real Time Garbage Collector) - <AUTHOR> http://users.notam02.no/~kjetism/rollendurchmesserzeitsammler/

<comment><AUTHOR> This is a real-time conservative garbage collector designed specifically for computer music with a mechanism to simulate worst case. The overview also contains even weirder acronyms such as SATBCUCOWIVM.

I was inspired to post this after reading <http://news.ycombinator.com/item?id=3241093> (Optimization Tricks used by the Lockless Memory Allocator)</comment>


Adobes Creative Cloud is great for professionals, not hobbyists - <AUTHOR> http://www.screamingatmyscreen.com/2013/5/adobes-creative-cloud-is-great-for-professionals-not-hobbyists/

<comment><USER2> I find that the students and new-comers are also benefiting from Creative Cloud because it allows one to try out all the tools unrestricted (and maybe even profiting from work) without having to take out a loan or worry about 30 day trials.

> I think Gimp vs. Photoshop is the vim vs. Emacs for digital artists.

As a programmer and a hobbyist painter, the analogy should be more like (vim/emacs/sublime) vs MS Notepad. While GIMP is great for general photo manipulation and editing, it is out of Photoshop's league when it comes to painting.

<comment><AUTHOR> Author here. I didn't think of them - most digital arts or however it is called students I know get a copy of the current master suite from their university.

Since the creative work is done by other people I am not fully aware of all the advantages and differences, so your analogy is likely better - even if Gimp fans will likely disagree ;)

<comment><USER2> Yes, they do! However, some art students I know would like to freelance while studying to pay off their student loans. The student edition won't allow them (legally anyway) to make money off of their work.</comment></comment></comment>


Show HN: Guestboard 2.0 – Our Alternative to FB Events – Now with Video Chat - <AUTHOR> https://guestboard.co <comment><AUTHOR> Hey everyone,

Peter, Nick, and Joseph here with [https://guestboard.co](https://guestboard.co), and we're back with some significant improvements, a snazzy iOS app, as well as our own pivot/response to the growing need for virtual event solutions.

The problem that Guestboard continues to solve is that there are MANY event types that are too complex for a simple digital invite like Paperless Post, and too small for pricey event software.

Facebook Events used to claim this title, but the average Joe/Jane needs a flexible and intuitive tool that can scale with their needs, and can manage groups of 10 - 1000 people, whether it's personal or professional events.

But with COVID, we were presented with a new hurdle. In-person events being out the window for a while, we didn't want to lose sight of our original mission. But we also needed to meet the changing landscape.

Among other updates, we just released our Video Chat widget– one of 10 optional (and free) event tools you can activate in your event board.

The Video Chat widget is nothing groundbreaking, to be honest. Just stable, encrypted videocalls powered by Jitsi Meet's open source platform. But with this, we were able to build one important distinguishing feature..

With Video Chat, you can schedule multiple AND concurrent video calls, with slick invitations that are sent directly to your existing guest list within Guestboard.

When paired with other widgets like Schedule, Checklist, Message Board and Shared Resources, you're able to build an event board that is perfectly tailored to the needs of your group, foster a little community around your event, and streamline your communication all in one place.

As always, we're here for some real feedback and critique, so if you're the type of person who typically wrangles large groups of people, how can we solve your pain points even further?

Happy Friday!

</comment><comment><USER2> Homepage looks absolutely beautiful, but I suspect it would convert better if you had more visual emphasis on getting people to click on your call to action (which presumably is hosting an event).

<comment><AUTHOR> Thanks! Always good to remember the CTAs :) We'll take a fresh look at the page with that in mind.

</comment></comment><comment><USER3> The product looks great. Congrats with 2.0.

However, I used Jitsi Meet on a daily basis for a year. I was a frequent person to a Jitsi Meet room recently as well.

It was and is pretty bad relative to others. There's almost always an issue once you get to double digits. Even in smaller numbers, it is buggier far more than Whereby or Zoom.

Its cpu and Bandwidth usage is too high too compared to better video options.

I avoid Jitsi as much as possible.</comment>


Debugging Node.js memory leaks - <AUTHOR> http://blog.flowdock.com/2015/06/22/debugging-node-js-memory-leaks/

<comment><USER2> Other links relating to debugging memory related issues in NodeJS which I have bookmarked (in no particular order):

* [http://www.willvillanueva.com/the-node-js-profiling-guide-th...](http://www.willvillanueva.com/the-node-js-profiling-guide-that-hasnt-existed-finding-the-cause-of-a-memory-leak-using-heap-snapshots-part-3/)

* [https://github.com/felixge/node-memory-leak-tutorial](https://github.com/felixge/node-memory-leak-tutorial)

* [https://strongloop.com/strongblog/node-js-performance-tip-of...](https://strongloop.com/strongblog/node-js-performance-tip-of-the-week-memory-leak-diagnosis/)

* [https://github.com/bnoordhuis/node-heapdump](https://github.com/bnoordhuis/node-heapdump)

* [http://www.nearform.com/nodecrunch/self-detect-memory-leak-n...](http://www.nearform.com/nodecrunch/self-detect-memory-leak-node/)

</comment><comment><USER3> Some great lessons in this post:

* open()/close() (in other words: resource management) are as likely to cause leaks as malloc()/free() (aka memory management)

* Single threaded code can have race conditions

* No single tool (debugger, heap profiler, logging, etc) will be a panacea for troubleshooting production

</comment><comment><USER4> Great post- thanks for the writeup!

I would love to see a post detailing some best practices, or even comprehensive setup guides, for instrumenting a full Node.js service. So far most of the information I've seen is very limited in scope and specific to just one aspect of the bigger picture.</comment>


Apple Maps Accidentally Revealed a Top Secret Military Base - <AUTHOR> http://gizmodo.com/5950391/apple-maps-accidentally-revealed-a-top-secret-military-base

<comment><USER2> From the gizmodo.com article: _Taiwan's secret radar, which was supplied by Raytheon, was probably on China's metaphorical radar already_

"Probably"? I bet that the People's Republic knows the location at least as well as the Taiwanese government, and I bet there's a treaty obligation to tell. That was true of USA/USSR relationship during the cold war. "Secret" missile silos were only secret from the ordinary citizens of the respective countries. The military establishments knew locations of the other's missiles.

So, why keep it secret from their own citizens? Given that statistically speaking, there's very few real national security secrets, keeping secrets from citizens probably just enables fraud, waste, corruption and cover-ups at biblical scale.</comment>


Ask HN: Need website screenshot generator - <AUTHOR>

Need to take screenshot of a website every hour, which webbased service do you reccommend ? <comment><USER2> Other options include ShrinkTheWeb (<http://www.shrinktheweb.com>) and PageGlimpse (<http://www.pageglimpse.com>)

</comment><comment><USER3> Have a look at Websnapr: <http://www.websnapr.com>

</comment><comment><AUTHOR> Will give it a try, thanks!

</comment><comment><AUTHOR> btw, isn't there a yc founded company that does this ?</comment>