NetHack beaten in 7 minutes 15 seconds real time - <AUTHOR> https://pellsson.github.io/ <comment><USER2> When I saw the previous submission of this as [https://news.ycombinator.com/item?id=18853508](https://news.ycombinator.com/item?id=18853508) (which describes it as a "tool-assisted speedrun" of NetHack on the online server nethack.alt.org), I thought "wait, you can't have a tool-assisted speedrun of a nondeterministic game with hidden information...!" (particularly on an online server where you can't roll back history).

Then I read the article and saw that this project went to absolutely insane lengths to work around the "nondeterministic" and "hidden information" parts.

<comment><USER3> They had to do quite a lot of source diving to achieve this.

The bumping into a wall to advance the RNG state without changing the game time is a really neat trick that I would otherwise have been completely unaware of, and I have played Nethack for many years and done some source diving myself.

Truly a great feat of engineering here.

<comment><USER4> This reminds me of something I read on reinforcement learning playing Atari / video games ... often you see the Deep net (I think the game in question was a tank game) just spazzing out on the controller when there's no enemy, the tank was spinning on the spot while waiting for a door to open for example.

Initially thought just to probably be some numerical instability when the next actions are all equally likely (I.e. there's nothing for it to do) but what was actually happening is the pseudo RNG was partially fed by controller input, and certain patterns of controller input would make random rewards more likely to spawn.

I always thought it was cool how these exploits get discovered by the deep nets

<comment><USER5> Do you have a source on this?

I was under the impression that machine learning is only good at learning things that can be approximated by continuous functions.

A RNG is almost the complete opposite of that. It's everywhere discontinuous!

<comment><USER6> Old games put the P in PRNG. Often, the technical limitations caused them to very roughly approximate randomness, for example a function that used the last n button presses plus the countdown timer as a seed. If your game has to run in under a kilobyte of memory, that n value might be a byte, or less (such as four bits, 2^4)

Some games were worse, far worse. Doom used a list of 256 random numbers that it looped through.

Pokemon is another game where the RNG function is extensively mapped, and even used in combination with bugs to generate Mew events, something that should never ever happen.

You see a lot of TAS of old games, especially popular ones, that abuse the RNG generator where feasible.

</comment></comment></comment></comment></comment><comment><USER7> This isn't the first time RNG manipulation in NetHack happened. In 2009, Adeon released a set of RNG manipulation tools for NetHack 3.4.3 (nethack_rng_tools-0.2.3.tar.bz2 -- I can't find that filename anymore, so I put up a mirror[1]). This allowed determining the RNG seed from a _running_ game. However, he also made a patch to use a cryptographically secure PRNG[2]. I'm not sure if nethack.alt.org (NAO) ran that patch. If they did, I'm not sure why they kept random() for 3.6.1 that was apparently run by SWAGGINZZZ.

[1] Since it had license headers, this is probably okay. [https://xorhash.bitbucket.io/nh/nethack_rng_tools-0.2.3.tar....](https://xorhash.bitbucket.io/nh/nethack_rng_tools-0.2.3.tar.bz2)

[2] [https://bilious.alt.org/?349](https://bilious.alt.org/?349)

</comment><comment><USER8> RNG manipulations are among some of my favorite speedruns just because of the absurd lengths players will go to align absolutely everything perfectly. For example, Dragon Warrior at AGDQ last year was an absolute treat to watch [1]

[1] [https://www.youtube.com/watch?v=Bgh30BiWG58](https://www.youtube.com/watch?v=Bgh30BiWG58)

<comment><USER9> Remarkable. So is this player performing all of these movements that change the RNG behaviour from (muscle) memory?

<comment><USER10> Yeah, pretty much. Speedrunning takes all the obsessive practicing of classical piano concert performance and applies it to video games. It's insane

</comment></comment></comment><comment><USER11> The best thing that nethack did for me was letting me ingrain the hjkl muscle memory. This in turn helped me thrive in vim.

Thriving in the dungeons though... that's something that's always been elusive.

<comment><USER12> I hacked the source slightly so I don't take any damage in combat. Is a simple one line change so it's a cheat but a tiny cheat. I _still_ cannot get past level 10-12 or so. (Wow, I suck.)

</comment></comment><comment><USER13> Had to look up this abbreviation:

c!oGL = cursed potion of gain level

[https://nethackwiki.com/wiki/Abbreviations](https://nethackwiki.com/wiki/Abbreviations)

<comment><USER2> For non-NetHack players, this is a joke that results in a useful strategy. The potion of gain level normally causes you to get an experience level. But if the potion is cursed, the universe instead misinterprets the magical effect and you gain a _dungeon_ level instead of an _experience_ level—that is, "You rise up, through the ceiling".

This is generally very disappointing because an opportunity for your character to become more powerful was effectively squandered due to the curse. But magically moving upward quickly through the dungeon _can_ be very useful if you need to escape from a dangerous monster quickly—or at the end of the game when you need to escape from the dungeon as a whole. The latter is what this speedrun used in order to avoid having to walk through the dungeon and take the stairs.

Most normal characters wouldn't be close to having enough potions of this kind to get entirely out of the dungeon by this means (also because of a certain complicating factor that prevents characters who can't control the RNG from knowing in advance exactly how many they'll need!). Although it's been done before by different forms of grinding, this is a whole other matter because the potions were obtained almost instantly with a preposterously lucky series of wishes.

<comment><USER13> Thanks for the write up, that makes parts of the article make more sense.

</comment></comment></comment><comment><USER14> _Blindly jumping to the altar and one-shotting the priest does of course take A LOT of attempts, but modern CPUs are pretty fast and NetHack is a pretty low-end game._

I can't help thinking of Phil in _Groundhog Day_ coming up with new challenges as he spends eternity in Punxsutawney PA.

</comment><comment><USER15> Maybe I'm reading too far into this, but I think there's a greater lesson to be learned from this.

This game's been around for 30 years, and is still under development. Some would assume that security patches on any 30 year old piece of software would have found nearly every bug or account for unexpected usages.

There's also a _big_ assumption that random states on remote systems can't be determined. Our assumptions around what's "good enough" keep getting broken. 32-bit states, MD5, SHA-1, etc... Now clearly (until quantum computers go mainstream) some problem spaces are just too big to reasonably brute force or find collisions.

Could/will we find critical bugs that allow us to do similar types of attacks for modern computing systems that aren't games?

</comment><comment><USER16> Huh. Given that the first 6 minutes (out of 7:15 total) were spent with a HUMAN player fumbling around looking for a fountain, presumably writing an AI capable of doing that step would get the ascension time down to just over a minute. I wonder why they didn't do so?

</comment><comment><USER17> I've been trying to reach the amulet for 30 years.

<comment><USER18> I've been playing since 1987 with the IBM PC version called Hack. My friend's floppy disk got damaged so he couldn't use a scroll of identify because it crashed the game, but he was still able to finish the game without it. For Hack all you needed to do was find the Amulet of Yendor under a boulder and bring it to the top.

I've never ascended on Nethack though despite all my time invested. I'm probably playing it wrong but I don't care it's still fun as hell.

<comment><USER19> That sounds closer to Rogue than Nethack.

<comment><USER18> No it was called Hack. This is around 1985 or 1986.

</comment></comment></comment></comment><comment><USER20> Just waiting for AlphaNethackZero to beat this record.

</comment><comment><USER21> > Turns out, every function in NetHack seems to find a way to call random(), > causing the RNG state to drift.

I recently stumbled across the concept of _splittable RNGs_ , which works around this very problem.

Once seeded, you can either "hand in" the generator to get a random number, or you can split it into two (or more) new generators that themselves can be handed in or split.

From a single seed generator, you would split off multiple generators for things like map generation and monster behavior, which then split their generators in turn to generate the level or move monsters.

As a consequence, if you change some monster behavior that uses the RNG, that does not cause the level generation to change, because that was split off earlier and is thus on an independent chain of random numbers.

<comment><USER22> Splitting the PRNG would provide resistance to tampering by walking into walls and the like, but it would also reduce the avalanche effect of _code changes_ , hiding inaccurate probability distributions (e.g. if a polymorph potion turns you into a yeti the next spawned monster is likely to have low hit points) that would cease to change drastically as PRNG calls are added or removed anywhere.

</comment></comment><comment><USER23> this seems like the plot of "edge of tomorrow," [1] but in nethack form.

so neat -- i love that the RNG space fits into 100GB (all nethack games that ever will be).

[1] [https://en.wikipedia.org/wiki/Edge_of_Tomorrow](https://en.wikipedia.org/wiki/Edge_of_Tomorrow)

<comment><USER2> The original article points out that it's all possible "Tou Hum Fem Neu" (female neutral human tourists). You have lots of other choices when you start a NetHack game. :-)

<comment><USER23> oh gosh, i didn't realize that. looks like there are around 38 combinations; i wonder what the table space looks like for the other ones!

<comment><USER19> The problem with the other classes is that their starting equipment is less random, so it's more difficult to figure out which seed you are on. You would have to include more of the generated map in the database to figure out which seed you are on.

And of course this would all be shot to hell if Nethack went to a 64 bit seed.

<comment><USER23> yeah, i wonder how much of the game information you would have to include to make it unique.

that being said, wouldn't map information be sufficient for the remainder of the classes? so using starting equipment is really just an optimization available for this class?

<comment><USER19> The problem with using the map is that you can't see most of it when you first load the game. So you have to play more (and build up more state) before you get to a completely unique solution. Being able to use the starting equipment makes it much simpler.

</comment></comment></comment></comment></comment></comment><comment><USER24> haha, nice. [https://alt.org/nethack/fastasc.html](https://alt.org/nethack/fastasc.html)

<comment> orbital-decay An ascension in -2147483648 turns by Khaos is another thing to note in the table. Did he really wait for 2 billion turns before ascending to overflow that counter?!

<comment><USER25> [https://nethackwiki.com/wiki/1-turn_ascension](https://nethackwiki.com/wiki/1-turn_ascension)

Check out the information at the very end of this page.

<comment><USER26> > paste it into NetHack's terminal, and wait approximately 19 days.

Thanks for the laugh

<comment><USER27> > If NetHack is compiled for a 64-bit platform, the "long" type will not wrap > around until it gets to 9,223,372,036,854,775,808. The above trick still > works in principle, but will take a few hundred million years to complete.

Another laugh.

</comment></comment></comment></comment></comment><comment><USER28> How can you achieve a +100 Magicbane without Wizard-mode? Damn.

I didn't watch the TTYREC but I am seriously puzzled by that. Anyone has insight into this?

<comment><USER29> Scroll of enchant weapon above +6 has a 2/3 chance of vaporizing the weapon and then a 1/N chance of actually increasing the enchantment by +1, so if you can manipulate RNG you can make sure that you always get the no-vaporize +1 result.

</comment></comment><comment><USER30> Is this just ai job for the 3000 if logic. Seems there is a feedback loop for the core trial and error logic

</comment><comment><USER16> Something else that's not obvious to me: why does the fountain have to be next to a wall?

<comment><USER31> They describe that in the article. To be able to bump into the wall and advance the RNG one step at a time without passing in-game time. Presumably that's to ensure that the next Wish will be successful.

<comment><USER16> D'oh. Not sure how I missed/forgot that. Thanks.

</comment></comment></comment><comment><USER32> NetHack can be very fun, if you invest some time. I recommend to start with a GUI version.

<comment><USER33> Alternatively, for a roguelike cut from the same mold as Nethack but with a very different philosophical bent, I recommend Dungeon Crawl Stone Soup, which can be played either locally, online in the classic SSH fashion, or via a web browser with a nice graphical UI (e.g. [http://crawl.akrasiac.org:8080/#lobby](http://crawl.akrasiac.org:8080/#lobby) , click on any name there to observe other players in action).

<comment><USER34> I think it's the very best dungeon crawler when it comes to comfort of use and startability for new players.

And I would suggest it not just for gamers but for programmers as well. There is a lot one can learn about user interfaces, shells, coding, architecture, data management (items, races etc are all data) with the additional motivation to learn it while playing.

<comment><USER35> > for programmers as well

[https://twitter.com/crawlcode](https://twitter.com/crawlcode) :)

</comment></comment></comment></comment><comment><USER31> Looks like the TTYrec is missing. Did NAO remove it?

<comment><USER36> Looks like the URL is mangled by being repeated, that's odd. It seems to work when I de-dupe it, though. ^^

[https://alt.org/nethack/trd/?file=https://alt.org/nethack/us...](https://alt.org/nethack/trd/?file=https://alt.org/nethack/userdata/S/SWAGGINZZZ/ttyrec/2019-01-05.23:56:16.ttyrec#)

<comment><USER37> That only has 3 frames...that can't be right..?

<comment><USER38> Try Firefox. Doesn't work in Chrome for me either.</comment></comment></comment></comment>


Devonshire Research Group's Tesla Report Part II [pdf] - <AUTHOR> http://devonshireresearch.com/research/Devonshire%20Research%20Group%20-%20Tesla%20Motors%20-%20TSLA%20-%20Public%20Release%20-%20Part%20II.pdf <comment><USER2> [https://news.ycombinator.com/item?id=11761915](https://news.ycombinator.com/item?id=11761915)

This was actually a very interesting read.

Possibly the next attempt to get this to HN front page should link bait with Ponzi Scheme somewhere in the title.

</comment><comment><USER3> the report comes off very biased, that being said, it's an interesting read</comment>


JSONbin.io – Simple JSON Storage (Beta) - <AUTHOR> https://jsonbin.io/ <comment><USER2> I suggest returning 404 Not Found instead of 422 Unprocessable Entity on failed GETs: [https://jsonbin.io/b/2342342](https://jsonbin.io/b/2342342) as well as Content-Type: application/json instead of current text/html.

"Entity" in "Unprocessable Entity" refers to request body and for GETs there is no request body: [http://www.restpatterns.org/HTTP_Status_Codes/422_-_Unproces...](http://www.restpatterns.org/HTTP_Status_Codes/422_-_Unprocessable_Entity)

<comment><AUTHOR> Hey, thanks, yes, I'll be releasing these fixes by tonight.

</comment></comment><comment><USER3> Really sleek and clean, love the design. A simple but useful product, nice job :)

The link to your Twitter on the about page is broken by the way, it should have a protocol.

<comment><AUTHOR> Thanks a lot :) P.S Twitter link is now fixed.

<comment><USER4> Minor bug: The Access URL it generates is invalid. E.g. copying "//jsonbin.io/b/591a7e1cc94cae11ebb443dc" into Chrome's URL bar results in attempting to navigate to "file://jsonbin.io/b/591a7e1cc94cae11ebb443dc", not jsonbin.io/b/591a851ac94cae11ebb4440e.

<comment><AUTHOR> Hey, thanks, but it's not a bug :) that's protocol independent URL, it works on HTTP, HTTPS, relative to what your website is running on.

<comment><USER4> The primary purpose of your app is to paste some JSON then send someone a URL to access it, right?

If a user pastes some JSON, clicks the Access URL text box, presses Command-A Command-C to copy the URL, then pastes it to someone else, that person won't be able to open the URL, because it lacks a "https: prefix. That's probably a bug, whether or not it's an intended feature.

It's not something that matters very much, but your users might be slightly annoyed at having to chop off the leading "//" every time they want to copy the URL.

I admit I might be missing something obvious, though.

<comment><AUTHOR> The primary purpose of the app is to provide free storage and an endpoint to access it in an app. I've also provided a VIEW link beneath the access URL to view it in the browser. If I hard code [https://](https://) in front of the access URL, it might fail on non-https URLs and vice versa. Still, I think your concern is legit, will look into it and try to make it more flexible. Thanks for the suggestion bud. Appreciated.

<comment><USER4> Ah, got it. Nah, you're right, it's obviously meant to be used from within apps, not manually sent to someone else. Just a late-night derp.

I didn't expect it to be a service for freely hosting data -- that's pretty cool. I assumed it would return a rate limit error if you tried to use it for anything substantial.

(I missed the About link [https://jsonbin.io/about](https://jsonbin.io/about) at the bottom, which explains all this.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Wait. So this just stores arbitrary byte blobs right. What exactly is the JSON bit about? Can I use jq syntax to query and transform whatever JSON is stored?

<comment><AUTHOR> You can transform whatever you want once you request for the stored JSON

</comment></comment><comment><USER6> Loved the minimal UI.

<comment><AUTHOR> Thanks a lot :)

</comment></comment><comment><USER7> I made the exact same thing couple of years back, but shut it down because I couldn't think of sustainably maintaining such a "free" service.

I have a lot of ideas like this, but I am super confused on the sustainability part. What ways are there to sustainably maintain such services?

<comment><USER7> On another note,

Why the 'snippet' additional step when creating new fiddles?

Being able to do:

curl -X POST -d @test.json [https://jsonbin.io/b/new](https://jsonbin.io/b/new)

will be cool!

<comment><USER8> I thought that's how it works?

[https://jsonbin.io/api-reference](https://jsonbin.io/api-reference)

<comment><USER7> $ cat test.json

{}

$ curl -X POST -H "Content-Type: application/json" -d @test.json [https://jsonbin.io/b/new](https://jsonbin.io/b/new)

{"success":false,"message":"Snippet parameter is missing"}

$ echo '{"snippet": "{}"}' > test.json

$ curl -X POST -H "Content-Type: application/json" -d @test.json [https://jsonbin.io/b/new](https://jsonbin.io/b/new)

{"success":true,"data":"{}","id":"..."}

<comment><USER8> Oh, you're right. My bad. Maybe they want to leave room for meta data in the future or something.

</comment></comment></comment></comment></comment><comment><USER9> Cool. I really like the UI. Response times are slow-er than I would have originally thunk, but I'm sure that's a side effect of the HN hug.

Are you saving these "bins" as files, and then serving them? Or are you putting them into a database? Mostly curious. :)

<comment><AUTHOR> Thank you :) yea, kinda overwhelmed right now with the traffic, should sort out once the dust settles down. As far as your question goes, I don't store them as files, they are in DB. The file is fine for a temporary run, not great when it comes to scaling.

<comment><USER10> Why not host them on S3? You can probably serve them directly from there too.

<comment><USER11> But the URL would not be that pretty, would it?

<comment><USER10> Why not? You can assign a domain to S3 buckets. It can be just as pretty as it is today. The only difference is if he serves them directly from S3, the domain will be different from the creation API.

But considering the additional features he's planning on adding, he will probably need to proxy S3 anyway, so not sure if it's worth it in this case.

But for something of the scope of the current API, S3 is the perfect solution.

</comment></comment></comment></comment></comment><comment><USER12> For a similar service which is entirely encrypted, consider: [https://safepaste.org/](https://safepaste.org/)

<comment><USER4> Your content is being sent to the server encrypted, but it gives you a URL which decrypts it on demand. TLS already does this, right?

Relying on this is a very bad idea. The server could be logging everything and you'd never know. Heck, the server could be imaged at wherever it's hosted and you'd never know. The "burn after reading" feature is impossible to verify. It's just another "Take our word it's doing this" service.

If the website can spit out out a URL that you're then able to view your unencrypted data in, that website is no more secure than pastebin.com. And at least pastebin.com is explicit that everything is logged.

<comment><USER12> > Your content is being sent to the server encrypted, but it gives you a URL > which decrypts it on demand. TLS already does this, right?

No, since TLS doesn't have anything to do with the original content being encrypted, such that the server can't read it. safepaste should combine TLS with this client-side encryption/decryption (as the hosted version does).

> Relying on this is a very bad idea...

Considering it's FLOSS, I don't think any of those points are valid. I agree that, for it to be more trusted, it should be self-hosted. So, self-host it! Verify it's not logging! Verify the "burn after reading" does the deletion! If you care at all about security, and hosting a secure service, that's going to be essential anyway.

Boiling down the FLOSS project to its provided hosted version is quite missing the point.

> If the website can spit out out a URL that you're then able to view your > unencrypted data in, that website is no more secure than pastebin.com.

Given that the encryption/decryption happens entirely on the client side, this simply does not apply. The server knows the paste id, not the secret key. That's kind of the whole point. :)

\- Edited for clarification

<comment><USER4> The server gives you a URL like [https://safepaste.org/10dab736#595f4642d2fbcf14a235a9de40a37...](https://safepaste.org/10dab736#595f4642d2fbcf14a235a9de40a376de2d3f47725301b7c8b774d8fc40d0357d). When you load it, the end result is that you're viewing your decrypted data. That means the server can also load the URL (which it generated for you originally, and therefore knows) and decrypt the data. What am I missing?

 _Considering it 's FLOSS, I don't think any of those points are valid. I agree that, for it to be more trusted, it should be self-hosted. So, self-host it! Verify it's not logging! Verify the "burn after reading" does the deletion! If you care at all about security, and hosting a secure service, that's going to be essential anyway. Boiling down the FLOSS project to its provided hosted version is quite missing the point._

This isn't valid. The fact is, this service isn't self-hosted and is encouraging people to use the non-self-hosted version. There is no guarantee that the code running on the server is identical to the github repo.

<comment><USER12> > What am I missing?

The key part; the secret key is never sent to the server. [http://stackoverflow.com/questions/14462218/is-the-url- fragm...](http://stackoverflow.com/questions/14462218/is-the-url-fragment- identifier-sent-to-the-server)

This was explained in safepaste's about page:

\-- The hash section of the URL, after the #, is never sent to the server; it's used only by the browser and safepaste takes advantage of that to store the secret key. \--

Thus, the server cannot know the contents of the paste, since all encrypting/decrypting is done client-side. It's just a blob store for encrypted data.

> There is no guarantee that the code running on the server is identical to > the github repo.

Agreed. That's why the whole paragraph you just quoted said you should run your own copy and verify it does what you want. That doesn't mean you should run your own for everyone else, it means you should run your own for you and those who trust you.

<comment><USER4> Ah, thanks for clarifying. I retract my comments.

</comment></comment></comment></comment></comment></comment><comment><USER13> Nice. This is basically my usual "How does this language/framework work?" test project.

I've still never built a twitter clone...

<comment><AUTHOR> Exactly. Wanted to learn a couple of new technologies. Nothing's better to develop a small app and learn as you move ahead with it.

</comment></comment><comment><USER14> Hi, very cool, simple service! I believe the example on the front page, should be Linkin Park without the "g".

<comment><AUTHOR> Hey, thanks a lot :D

P.S Fixed the typo x)

<comment><USER14> Nice!, Also when I click on Twitter link on the about page it sends me to a bad URL. Looks like you just need to add http in front of the link.

When I copy and paste the access URL I see it starts with // \- so the link doesn't go anywhere, is that the intended action?

<comment><AUTHOR> Thanks for the check again, much appreciated :) .. twitter link is fixed.

About the access URL, // is intentional as it's protocol independent. You can use either http or https, depends on your app page :)

I might make it all https once I sort out my nginx config :)

Thanks again for helping me out bud.

<comment><USER14> Your welcome, thanks for the explanation on the protocol independent link.

This type of post inspires me to continue working on my side projects / learning new things!

</comment></comment></comment></comment></comment><comment><USER15> Why is this better then just storing json files on s3?

<comment><USER16> This has a simpler copy-paste usage. And plus, JSONbin.io is a free service.

</comment></comment><comment><USER17> Really great! p.s. Any plan to support JSONP?

<comment><AUTHOR> Thank you. CORS is enabled so I don't think we need JSONP, or do we? :)

</comment></comment><comment><USER18> Any method of deleting bins?

<comment><AUTHOR> Will add once I introduce private bins feature.

</comment></comment><comment><USER19> would be nice if the user can set the url

sth like this

jsonbin.io/username/books/get/1

<comment><AUTHOR> Hey, thanks for the suggestion. I have that on my roadmap once I implement authentication. Later, one can create private bins, version control for the same, query only specific data out of your entire JSON and so on. Feel free to throw in if you have any more suggestions. :)</comment></comment>


Executing non-alphanumeric JavaScript without parentheses - <AUTHOR> http://blog.portswigger.net/2016/07/executing-non-alphanumeric-javascript.html <comment><USER2> Ctrl-F template strings... yep, there they are.

So if you didn't know, ES6 added template strings, which are these really awesome things because they have multiline and string interpolation capabilities (and they're safely far away from JSON, which in my opinion shouldn't have such capabilities). They are very pretty and incredibly handy; you write

        console.log(`
        I'm so ${scared} in case ${ I.fall.off() } my chair
        And I'm wonderin' how I'll get down the stair
        `);

and this gets converted into

        console.log("\nI'm so " + scared + " in case " + I.fall.off() +
            " my chair\nAnd I'm wonderin' how I'll get down the stair\n");

Except for one thing: they're called "template strings" because actually this is a sort of "default behavior" which can be metaprogrammed. There is a default interpreter which could be written:

        function interpret(text_segments, ...split_segments) {
            var out = "";
            for (var i = 0; i < split_segments.length; i++) {
                out += text_segments[i] + split_segments[i];
            }
            return out + text_segments[i];
        }

but... you can write one of your own, if you want, and put it on the beginning. Therefore:

        > console.log(`abc ${[1,2,3]} def`)
        abc 1,2,3 def
        undefined
        > console.log `abc ${[1,2,3]} def`
        [ 'abc ', ' def' ] [ 1, 2, 3 ]
        undefined

Notice that the side effect of console.log has happened with the arguments given to it, allowing for code execution.

As for mitigation... add detection of backticks to whatever code was detecting parentheses. It's not a very widely used symbol in any context other than shell scripting and LaTeX anyways, so you're probably good to go if you just outlaw that character before calling eval() on the whole.

<comment><USER3> "add detection of backticks to whatever code was detecting parentheses."

No, stop trying to "detect" whether something is code and just properly encode things in the first place. If this allows someone to get code into your website, that is not a minor flaw to be fixed with a quick tweak, it is indicative of a fundamental flaw in the understanding of whoever wrote that code. When things are properly encoded, browsers won't execute them. (Give or take some issues around content type detection.)

<comment><USER2> I mean, that's certainly a great ideal. The real world is somewhat less-than. I don't fault anyone for having to maintain a legacy codebase developed by people who rolled their own, say, JSON-parsing functions. (If you want to see what this sort of exploit mitigation looks like in practice, see [https://github.com/douglascrockford/JSON- js/blob/master/json...](https://github.com/douglascrockford/JSON- js/blob/master/json2.js#L464) ; think that this was the most popular JSON parsing library ever. Thank goodness IE8 is a goner.)

</comment></comment></comment><comment><USER4> Spent a couple minutes figuring out how to spell "butts":

[[]+{}][+[]][++[[]][+[]]+[++[[]][+[]]][+[]]]+[!![]+[]][+[]][++[[]][+[]]+[++[[]][+[]]][+[]]]+[!![]+[]][+[]][+[]]+[!![]+[]][+[]][+[]]+[![]+[]][+[]][++[[]][+[]]+[++[[]][+[]]][+[]]+[++[[]][+[]]][+[]]]

</comment><comment><USER5> I've done something similar with PHP, by casting an array to a string (The string "Array") and using "variable variables". If only there was a way to call functions in PHP without using letters in the code... [https://gist.github.com/nubs/5849633#file- nodigitsorquotesei...](https://gist.github.com/nubs/5849633#file- nodigitsorquoteseither-php)

<comment><USER6> You can call a function by name:

        $foo = "file_get_contents";
        $bar = "http://example.com/";
        $baz = $foo($bar);

In PHP 7 this doesn't even require you to give the function name its own variable:

        ("file_get_contents")("http://example.com/");

</comment></comment><comment><USER7> I found this article had more depth: [http://patriciopalladino.com/blog/2012/08/09/non- alphanumeri...](http://patriciopalladino.com/blog/2012/08/09/non-alphanumeric- javascript.html)

<comment><USER8> The parentheses-less javascript dialect in the title of this HN article relies on ES6 and uses 6 characters:

        !+[]`$

The parent link above is ES5 and uses 8 characters:

        !+[](){}

The jsfuck.com ES6 dialect uses 6 characters:

        !+[]()

jsfuck was previously ES5 but they now rely on ES6isms to shorten their code.

</comment></comment><comment><USER9> what's the use case? Circumventing code insertion filters?

<comment><USER3> Yes, and dually, demonstrating to people that their code insertion filters are inadequate. You may know better, but there's still a lot of people in the real world who try to "sanitize" Javascript with thing like "Remove all ()[]'";" and think they're security masters whose code is unassailable.

That last bit isn't snark; it's my personal experience.

As mentioned in the article, there are filters in the real world that will be penetrated by this.

</comment></comment><comment><USER10> This article did give me the _out-loud-at-the-office_ chuckle and a whispered "what the f°°°" that only awe-inspiring hacks far above my programming intelligence level can provoke. :)

</comment><comment><USER11> Reminds me of Church encoding or even iota reductions, where you reduce a set of higher level symbols to primitive symbols that in combination have provably the same meaning.

</comment><comment><USER12> If you want to automate this process: [http://www.jsfuck.com/](http://www.jsfuck.com/)

<comment><USER13> As far as I know, JSFuck still uses parentheses.

<comment><USER12> Ah, so it does. I didn't realise.</comment></comment></comment>


Show HN: Pokemon Go Team Tshirts - <AUTHOR> http://Pokemongotshirts.co <comment><USER2> I'm actually pretty down for this, seems like a good idea to be add to the lore

</comment><comment><USER3> There are already shirts like this on onceuponatee. They are also cheaper and also come as tank-tops.

<comment><AUTHOR> We went with a higher price point because we have a better quality Tshirt.</comment></comment>


Duterte confirms he personally killed three men - <AUTHOR> http://www.bbc.com/news/world-asia-38337746 <comment><USER2> Its a pretty insane situation, he's a classic quote, \--Mr Duterte denied that he was a drug addict himself, despite using the powerful pain killer Fentanyl. "I'm not an addict," he said. "Only when it is prescribed. Addiction is only with regularity, my friend."

</comment><comment><USER3> He can't be sued with his verbal confrontation, it needs proof</comment>


Ask HN: Does cold outreach actually work? - <AUTHOR> I'd like to shift my development focus on a particular business domain. I have the technical skills but have never work in that industry. I would like to talk to insiders to figure out how I could help them.
My idea is to cold email people and ask for their time. So far I haven't had any success with this.
Has anyone tried this before? <comment><USER2> Cold outreach is a lot like caching: the millions of people who have successfully implemented it, written down their process, and documented their results are not all lying. This doesn't necessarily imply that "put a cache in front of it" will always work.

You say you haven't had any success. Draw out your funnel and dig into where, specifically, you are failing.

Do you have a raw volume problem? Which of the following is most representative of how many emails you send per day: 50? 10? 3? If you have a raw volume problem, is it because you cannot identify people to email fast enough, cannot identify contact information fast enough, or cannot force yourself to push the send button fast enough?

Do you have a response rate problem? Is your response rate much, much lower than, say, 10~20%? If you have a response rate problem, is it because your subject lines are bad? Is it because your _offer_ is bad? Do you have an attractive offer? (There are ways to position "talk to insiders to figure out how I could help them" that are attractive to the insider and ways that are less attractive. What is in it for your counterparty?)

Do you routinely transition conversations into a successfully scheduled conversation? Does that conversation typically go reasonably well or not go well? Do you have a specific next step in mind after that conversation? Do you have high uptake to that next step?

<comment><AUTHOR> I surely have a raw volume problem because "cannot force yourself to push the send button fast enough". The main reason is I'm not sure I have an attractive offer as I'm asking strangers for help without really offering anything. And that feels weird.

> There are ways to position "talk to insiders to figure out how I could help > them" that are attractive to the insider and ways that are less attractive.

Could you tell more about those attractive ways? I struggle with that.

<comment><USER3> > I'm not sure I have an attractive offer as I'm asking strangers for help > without really offering anything.

Uh, fix your attitude first. You have technical skills that you feel may apply to their area. You have time, interest, and inclination to figure out how to make that work. You want to tailor a solution to their company's specific problem, or at least the problems you uncover in anyone who will discuss them with you. (This is as opposed to selling some one-size-fits-all type of thing, or telling them what they need.)

All of that has value, and that's the value you're offering. Prove it by doing what research you can on their company's problem, and lead with that. Sure, you don't know that what you're thinking actually makes sense and would be of use to them. And given that you're an outsider, it honestly probably won't. But having the conversation you're trying to have is a way to make it make sense.

</comment></comment></comment><comment><USER4> As much as I hate to say it, linkedin is extremely valuable for this.

When we were getting our business off the ground I wrote connection request messages to the C level guys in large companies we were hoping to work with. I was honest and said that id like to talk with them just to see if what we were thinking of doing was something they would be interested in.

A lot of them responded (especially ones from start-up backgrounds) and the resulting discussions were extremely positive. Even where we didn't end up working with them we learned a lot. But most of them are our clients/partners now.

Its amazing how many people are just happy to help. Im my experience the lowest & highest levels of the companies are the easiest to approach.

If you would like to connect with people but they are not in your network a good idea is to connect to headhunters or people who post a lot in that industry. It shouldn't take many to build up a network of 2nd level contacts you can send a connection request message to directly.

<comment><AUTHOR> That's interesting. The general opinion seems to be that sending LinkedIn messages doesn't work well, but connection requests might work. Thanks for sharing

<comment><USER5> InMails have a notoriously low open rate.

But once you've got an individuals profile details; it's relatively straight forward to reach them via a work address.

</comment></comment></comment><comment><USER6> _I would like to talk to insiders to figure out how I could help them._

When you contact people, ask for an informational interview. This is described in the book _What color is your parachute?_

If possible, don't cold call. Find ways to establish some contacts. Find events to attend or other means to start making social connections. It will go vastly better if you can say "So and so gave me your name." or "We met at X event. I was wondering if I could have a few minutes if your time to learn a little more about X."

</comment><comment><USER7> It does work but not always. The busier the person, the less likely a cold contact works. Warm intros are better. Sometimes cold emailing somebody who can get you a warm intro can work

The best advice I've found is this post by Steve blank on getting meetings with busy people: [https://steveblank.com/2013/08/12/how-to-get-meetings- with-p...](https://steveblank.com/2013/08/12/how-to-get-meetings-with-people- too-busy-to-see-you/amp/)

Basically offer people something in return for their time. Do your homework and genuinely try to help people when you ask for their time. It may feel inefficient or slow, but your hit rate is so much higher w this approach than a shotgun approach that it's worth it

Not to say that shotgun approaches can't work, it just depends on your audience. I used linked in searches combined with a tool called hunter.io that guesses people's emails based on public info w reasonable accuracy, downloaded the email addresses into excel and did a mail merge. The results were that like 60-70% of the emails were wrong, and of those like 10% responded, and of those maybe I got calls with half. So single digit hit rate. It took maybe a half hour to get 100 emails sent, so a half hour or so got me 2-4 calls maybe

This effort was for physicians however, so for other groups your numbers will likely be better. Many physicians aren't on linked in and don't have emails on their websites, so your linked in searches won't be that efficient. They are also extremely busy and inundated with annoying survey requests / marketing materials. For this group cold calls actually were almost better

</comment><comment><USER3> This isn't helpful, but I've had a surprisingly high success rate with cold outreach when I didn't have a need or expectation of a response. But then, I also tend to email researchers (and generally not the ones involved in some big breakthrough, just more niche ones that did something that I found personally very interesting.) And researchers are generally pretty happy to find out that anyone is interested in the topic they've poured their time and energy into, especially if you're not just asking the obvious followup questions. So I've mostly gone after soft targets.

I also have a habit of contacting higher-ups of the institutions I'm associated with (my company, my kids' school, etc.). Usually with jokes. Sometimes with complaints, in which I say things that I really shouldn't be saying if I value my job, but a little honesty and reasonableness seem to go a long way.

Quite a ways from what you're looking for, but the same rules probably apply: if you have something to offer, even if it's only your rapt attention for a topic of interest to them, then tell them up front in the first sentence or two. No tricks. Be honest. Make it easy for them to decide to _not_ respond as quickly as possible (rather than eg hinting at things or being ambiguous, hoping they'll interpret things in the most favorable light.) Value their time, and express that in how you write the email (but not by saying "I know how important your time is" or whatever. That's bullshit. You value someone's time by being efficient and not wasting it.)

If you're just asking for their time, you're doing it wrong. Why should they give it to you? Tell them why they should care first, then put your ask after.

It's best if you really _do_ have something of value to them. Then your email just needs to effectively and efficiently communicate that.

</comment><comment><USER8> In my experience cold calls are always hard work, it's much easier if you can find a common contact to make an introduction.

</comment><comment><USER9> We got our first 5 customers with cold emailing. It is all a numbers game with some A-B testing in my opinion. It can be very time consuming if you do not do it right, but if you do, it can work great. Granted, any "cold" sales method is going to bring in some un-qualified prospects but when you are just starting that can be a plenty fine strategy. I would suggest trying a few variations of the email, using a tool such as QuickMail (which allows you to import lists and schedule and do A-B), and making sure to send during the right times, for us that was Tuesday and Wednesday mornings for our prospects. Also, I would consider using Upwork to find a contractor to help with this process, we found a girl that collected lead emails for $4/hr. Hope this helps.

</comment><comment><USER10> You want to minimize the effort it takes one to reply.

1\. An information-dense subject line 2\. Tell them a soft compliment 3\. A sentence about yourself 4\. Say what you're up to 5\. A very very very simple ask, don't make them think. Once they respond you can send a follow-up, at this point pretty much everybody will feel obliged to respond.

My experience is only with cold emailing VCs, the reply rate was around 40% (including cordial rejections). CTR was over 70% (had a link in there).

</comment><comment><USER5> > My idea is to cold email people and ask for their time.

Understand that emails are easy to ignore. The Old School phone call is still a remarkable tool. They need to HEAR your voice. I'm a real guy, reaching out on a professional networking basis. I promise to be brief. Your advice and perspective would mean a lot.

Have some rock-solid questions ready. And be sure to ask if there's anyway you could return the favor and help them?

</comment><comment><USER11> I find that tradeshows and conferences are good for this. Just be honest and upfront with people what your intent is. And stay out of the way if one of their customers show up.</comment>


Keurig CEO Blames Coffee Pod DRM for Falling Sales - <AUTHOR> http://techcrunch.com/2015/05/08/keurig-ceo-blames-coffee-pod-drm-for-falling-sales/

<comment><USER2> Twitter and Keurig are finally seeing the impact of their decisions. How many more companies have to learn the hard way that strictly controlling how your users want to use your product is poor business practice?

<comment><USER3> What happened with Twitter?

<comment><USER4> This is a good summary: [http://www.mathewingram.com/work/2015/04/30/twitters- multi-b...](http://www.mathewingram.com/work/2015/04/30/twitters-multi- billion-dollar-mistake-happened-five-years-ago/) and the HN discussion: [https://news.ycombinator.com/item?id=9470312](https://news.ycombinator.com/item?id=9470312)

TL;DR: Twitter was an open ecosystem with lots of partners and a thriving developer environment. They chose to stop all of that, end their developer relations, and ensure that Twitter Inc was the only way that anyone could Twitter. Now, that closed-off-ecosystem is making growth difficult.

</comment></comment></comment><comment><USER5> I think people also probably just realized how much of assholes they're being by using single-use containers for making coffee every day. The one-use concept is nice in theory, but it creates so much trash. It's obnoxious.

<comment><USER6> This is a very self-righteous post. Do you ever eat out? Get coffee or drinks from restaurants? Use mayo/mustard packets? Eat frozen foods?

They are all analogous. They're all conveniences that use disposable containers. And no-one is calling people a holes for eating Hungry Man.

<comment><USER7> Do you eat two Hungry Man's every morning before work? It's not self-righteous and it's not analogous to your examples. People drink _multiple_ coffees per day. People put Keurigs in the office and get used _hundreds of times_ per day!

Introducing waste for activities that happen as frequently as coffee drinking is why it's different.

<comment><USER8> Keurigs in the office are the most ridiculously wasteful things -- it wastes _more_ time having everyone sit and wait for single-use pods to brew than for someone to just open up a stupid packet of grounds for a large carafe.

I really can't understand why offices use keurig.

<comment><USER9> >>I really can't understand why offices use keurig.

It eliminates the interpersonal drama that can waste crazy amounts of time in an office. If there's a large central carafe of coffee, it can lead to:

people fighting over what brand/roast/strength to make

people fighting over a freeloader not refilling it

people fighting over who cleans it and how often

etc.

(I know that sounds crazy, but I've seen it)

With the pods, everyone can get their own coffee/tea/whatever in a little independant transaction, no drama. To the company there might be a slight increase in cost (but still almost nothing) and increase in waste (do most companies care?), but their employees are happier, so it's an easy trade off.

Edit: I'm not saying I support the use of these pods in offices, just giving some of the reasoning companies have embraced them in some places.

<comment><USER10> I wonder if it would make more sense to give everyone the reusable fillable ones and keep 2-3 different bags of coffee around. Best of both worlds?

</comment></comment></comment></comment></comment></comment><comment><USER11> When they say "we were wrong", I take it to mean they were wrong to think their actions were profitable, nothing more.

<comment><USER12> If people vote with their wallets, their ethics directly correlate to the company's profit. A useful feedback loop, to be sure :-)

<comment><USER13> People don't really vote with their wallets over ethics, though. It'd take an enormous amount of effort to keep up with all the bad things various corporations do, or even just to keep track of which ones have been in the news for nasty behavior.

Even people who take time to consider the possibility of attempting to spend ethically are faced with the discouraging reality that 1) they'll still end up accidentally spending a lot of money with unethical companies, since even with a great investment of time their information will only be slightly better than someone who takes no notice of these things, and 2) it will have _no effect_ anyway unless a bunch of other people do it too, meaning tons of lost time and likely a great deal of lost money to accomplish nothing at all. Even with a publicity effort for an organized boycott (more time, more money, spent by someone) you're still just hoping that enough people will make bad individual decisions so that the decisions _become_ good ones ( _i.e._ they do more than just harming the people making them).

Most people don't even get that far. With everything else going on, "think seriously about how to spend in such a way as to maybe (but probably not) affect corporate behavior so that it becomes more ethical" drops down the priority list... and down... and right off the bottom. Doesn't mean their spending reflects actual support for corporate douchbaggery, though.

<comment><USER14> Counterpoint: Chipotle's successful brand strategy, [http://www.forbes.com/sites/scottdavis/2014/06/06/beyond- the...](http://www.forbes.com/sites/scottdavis/2014/06/06/beyond-the-burrito- chipotles-next-big-move/)

</comment></comment></comment></comment><comment><USER15> > We underestimated the passion the consumer had for this

The passion of their customers to not put up with bullshit?

Yeah, they definitely underestimated that.

</comment><comment><USER16> What's interesting is that they are not planning to scrap the system. Instead they are planning to sell a refillable pod that is compatible with it [1]. In the end, they still want the DRM, it's just that the damage done is too big and they have to say big words to try and undo it.

[1] [http://money.cnn.com/2015/05/06/investing/keurig-green- mount...](http://money.cnn.com/2015/05/06/investing/keurig-green-mountain- earnings-stock-fall/)

</comment><comment><USER17> I'm a 2-3x a year coffee drinker. Are these machines radically more convenient than the alternatives?

My folks manage to get by with one of those machines where you put the grounds in a basket, fill the water reservoir, put your mug under the spout and push the button. The machine is cheap, it looks like it's about the same amount of work to use as the Keurig machine and you get biodegradable paper + grounds afterwards instead of a plastic cup. And you can put in however much of whatever kind of coffee you want.

<comment><USER18> They're both pretty easy, but I can make a cup from a Keurig while holding my baby in under a minute.

The traditional machine takes two hands to set up, and 10 minutes to drip.

<comment><USER19> > _while holding my baby_

Hmmm, that's a great standard to test UX against.

</comment></comment></comment><comment><USER20> In 2014, enough K-Cups were sold that if placed end-to-end, they would circle the globe 10.5 times. Almost all of them ended up in landfills. They are not recyclable.

www.theatlantic.com/technology/archive/2015/03/the-abominable-k-cup-coffee- pod-environment-problem/386501/

<comment><USER21> Wow.

Another big offender is non-recyclable yogurt cups. Does anyone have figures on those?

</comment></comment><comment><USER22> I understand that their business model is probably based on the whole "give away the razor, sell the blades" thing, but what they probably should do is just make the coffee maker a little more expensive.

<comment><USER23> It would never work anyway. You can't print without a printer and ink, you can't shave without razor blades, but you certainly can make coffee without Keurig.

<comment><USER24> >You can't print without a printer and ink

You can with a laser printer and toner. Inkjet printers are still hugely profitable though.

>you can't shave without razor blades

You can buy a lifetime's supply of safety razor blades for the price of a modern kit. Razors are still hugely profitable.

</comment></comment></comment><comment><USER25> "We underestimated the passion", hah. Not giving money to greedy assholes: one of my passions indeed.</comment>


Movie piracy crackdown: Feds shut down nine websites  - <AUTHOR> http://www.latimes.com/business/la-fi-ct-piracy-20100701,0,2871905.story <comment><USER2> When the studios finally put all their shit on NetFlix, you'll likely see a pretty large dip in piracy. Piracy has two things going for it: convenience and cost. However, people are will to PAY for convenience. By making it more convenient to play on the Wii, XBOX or whatever, they're already doing the right thing.

</comment><comment><USER3> It seems that the War against Terror has finally been won.</comment>


Relativity Visualized - <AUTHOR> http://www.spacetimetravel.org/

<comment><USER2> I found that an interactive game, Velocity Raptor, gave a great intuition for relativity: [http://www.testtubegames.com/velocityraptor.html](http://www.testtubegames.com/velocityraptor.html)

The premise is that you control a character moving at relativistic speeds. The first handful of levels are just to get used to the controls, and not very interesting. It is worth sticking with it for the later levels.

<comment><USER3> That's a really good one! As I recall, it introduces concepts one at a time in a good, educational way, and it winds up fully relativistic (and kinda crazy) by the end.

Another more immersive but less "instructive" game is "A Slower Speed of Light": [http://gamelab.mit.edu/games/a-slower-speed-of- light/](http://gamelab.mit.edu/games/a-slower-speed-of-light/) It's pretty cool, though it gets disorienting by the end.

</comment></comment><comment><USER4> I've once made a simple demo about gravitational lensing. [http://codepen.io/cihadturhan/full/lqDdo/](http://codepen.io/cihadturhan/full/lqDdo/)

<comment><USER5> Really neat effect, and great use of canvas! Have we ever captured an image of something like a black hole-galaxy eclipse as displayed during the opening animation of your demo? I've never seen a full Einstein ring with darkness in the center... Cool nonetheless!

<comment><USER4> Thanks, I was planning to create a black hole simulation on the web and that would be the intro. I've inspired from the computer simulated animations but there are real images out there.

</comment></comment></comment><comment><USER6> I found this one quite helpful: [https://m.youtube.com/watch?v=C2VMO7pcWhg](https://m.youtube.com/watch?v=C2VMO7pcWhg)

<comment><USER7> Really loved it.

</comment></comment><comment><USER8> Does anyone know of a general & special relativity simulator? That is, a program where I can setup various "thought experiments", by placing clocks and masses at various point in space, where they can have various acceleration profiles, and can communicate with each other, and run the scenarios? I never really understood the twins "paradox" and the explanations for the source of the asymmetry seemed hand-wavy and "because".

</comment><comment><USER9> Very cool, I particularly enjoyed the wormhole trip. Reminds me of 'Real Time Relativity', a fun program for exploring 3d worlds at relativistic speeds: [http://realtimerelativity.org/](http://realtimerelativity.org/)</comment>


Brandon Eich new CEO of Mozilla - <AUTHOR> http://blogs.wsj.com/digits/2014/03/24/mozilla-picks-insider-eich-as-new-ceo/

<comment><USER2> Wonder if things like this might cause an issue: [http://tommorris.org/posts/2550](http://tommorris.org/posts/2550)

Mozilla has always stood for freedom of knowledge, and by extension human rights (so people can access that knowledge). I don't know what Brendan's political beliefs currently are, but I hope he doesn't still wish to restrict the human rights of certain people based on their sexual orientation. Not trying to make any assumption and wish him the best, but its at least possible this could be indicative of a world view that sees discrimination as acceptable in certain situations. I sure hope that's not the case. It would not be good for Mozilla, or the Internet at large.

</comment><comment><USER3> s/Brandon/Brendan</comment>


/dev/null as a Service - <AUTHOR> http://devnull-as-a-service.com/ <comment><USER3> Best nginx config ever?

      location /dev/null {
          if ($request_method = POST ) {
            return 200;
          }
      }

<comment><USER4> "200" makes sense. See wikipedia article on /dev/null[0]: "discards all data written to it but reports that the write operation succeeded."

[0] - [http://en.wikipedia.org/wiki//dev/null](http://en.wikipedia.org/wiki//dev/null)

<comment><USER5> wouldn't 202 be better?

<comment><USER6> _204 No Content_ would.

 _202_ assumes a possibility of further processing, but /dev/null can offer none.

<comment><USER5> True, but that still mirrors the successful wrote responses in the UNIX file system, right?

</comment></comment></comment></comment></comment><comment><USER7> Reminds me of [http://www.supersimplestorageservice.com/](http://www.supersimplestorageservice.com/)

<comment><USER8> I especially love that the web proxies at my place of employment block this site as "Online Storage"

<comment><USER9> haha, yeah here too

</comment></comment></comment><comment><USER4> IP address is owned by NSA Fort Meade office. Possible honeypot scheme? I can't think of any other reason it would have that attractive free tier.

<comment><USER10> You're teasing, right?

dig devnull-as-a-service.com

; ANSWER SECTION: devnull-as-a-service.com. 1481 IN A 22.214.171.124

[http://whois.domaintools.com/188.8.131.52](http://whois.domaintools.com/18.104.22.168)

Whois Server: whois.psi-usa.info ASN: Germany AS12337 NORIS-NETWORK noris network AG (registered Mar 22, 1999) IP Location: Germany - Bayern - <USER2> - Noris Network Ag Domain Status: Registered And Active Website

<comment><USER11> A reverse lookup shows that the server is also hosting [https://coffeestats.org/](https://coffeestats.org/) \- clearly there's someone here trying to collect vast amounts of data about the general public. I don't think the parents fears are unwarranted, the fact that it's hosted in a German IP block could be to throw people off the trail.

<comment><USER12> Seems like a genuine joke to me. This is the guy behind it: [http://noqqe.de](http://noqqe.de)

"About Florian Baumann (24). Arbeite bei der GfK SE und interessiere mich für allerhand Dinge unter anderem Debian, BSD, OpenSource, R, Statistik, Scripting, Hacks, Administration.

Was das alles so mit sich bringt schreibe ich manchmal hier auf. Manchmal nicht. Außerdem sammle ich hier ohne Sinn und Schema Zeug das ich nie wieder brauche."

<comment><USER11> Don't fret — I was joking too.

</comment></comment></comment></comment></comment><comment><USER13> At least these guys are honest: We know that everyone cares about thier privacy these days. We promise we won't let anyone have a look at your data[1].

[1] Anyone excluding the following companies and departments. Just the good guys, you know?: NSA, Nestle, Communist Party of China (CPC), The Coca-Cola Company, the KGB, some of your coworkers and our friends (especially if there is something funny).

<comment><USER13> This is actually implying that one of the listed entities is a department within company that produced this marvelous software. I wonder which.

</comment></comment><comment><USER14> You guys and your fancy HTTP services. Discard should be enough for everyone. [http://tools.ietf.org/html/rfc863](http://tools.ietf.org/html/rfc863)

<comment><USER15> Discard is fundamentally flawed. Because the service does not provide a response the client cannot reliably determine whether the data was successfully discarded.

Without a response there's the possibility that your data could be lost on its way to being thrown away, and you'd never know.

</comment></comment><comment><USER16> /dev/null is way too polite. For my services I much prefer to rely on the [http://foaas.com/](http://foaas.com/) API

<comment><USER17> Awesome. I thought "this is exactly the kind of thing my former colleagues would find hilarious". Then I scrolled down.

They wrote it.

</comment></comment><comment><USER18> I'd be wary of using this. There's no mention of their data retention policy.

<comment><USER19>
      Privacy

      We know that everyone cares about thier privacy these days. We promise we won't let
      anyone have a look at your data[1].

      [1] Anyone excluding the following companies and departments. Just the good guys,
      you know?: NSA, Nestle, Communist Party of China (CPC),
      The Coca-Cola Company, the KGB, some of your coworkers and our friends
      (especially if there is something funny).

[http://devnull-as-a-service.com/features/](http://devnull-as-a- service.com/features/)

</comment></comment><comment><USER20> What's up with HN today? Lots of reddit-style garbage in the front page.

<comment><USER21> Maybe get enough karma to downvote?

<comment><USER22> You can't down vote submissions.

</comment></comment></comment><comment> ryan-allen The website is missing a "meet the founders" page with the pre-pubescent CEO, CTO, Director of Marketing and Director of Customer Excellent, who just happens to be the CTO's little sister.

<comment><USER23> how do you know?

</comment></comment><comment><USER24> If they've not configured nginx carefully, it will be buffering request bodies to temporary files on disk.

So your data might not really be going to /dev/null - it might be going to a disk. Most likely not want you want at all.

I'll get a CVE allocated for this bug right away.

</comment><comment><USER25> Don't be fooled by this clever marketing for a scam service! Keen IO is the true market leader in /dev/null as a service! We released in April 2013 and have been serving customers with a 100% satisfaction rating ever since. See "Keen IO releases API for /dev/null" to get the full story and perspectives from industry experts on this robust REST API. Keen IO: /dev/null for modern developers.

[https://keen.io/blog/46856249197/keen-io-releases-api-for- de...](https://keen.io/blog/46856249197/keen-io-releases-api-for-dev-null)

</comment><comment><USER26> Probably the site is under load, but I loved that when I clicked on "features", I got back an Error 500 - Internal Server Error.

<comment><USER27> They only guarantee 85.66% uptime. They need to sleep too!

</comment></comment><comment><USER28> One reason I am not a devfs fan is because I'm a mknod(1) user. For example, FreeBSD has one of those famous "_________ is deprecated" bold warnings regarding mknod.

It is not deprecated in my usage. I use it all the time.

I do not rely on /dev/null.

I make my own null character devices as I need them.

<comment><USER29> > I do not rely on /dev/null.

> I make my own null character devices as I need them.

Why? Is there ever a reason to have more than one file on your system which acts as a /dev/null?

<comment><USER28> "Why?" Why not?

In my case, the reason is because it's shorter to type.

I would expect most longtime UNIX users have experienced what happens when, for one reason or another, /dev/null is not a null character device and you have scripts or programs writing to it as if it was. By the time you realize that this has happened, it's too late -- data has already been saved to this file.

There may be various workarounds for this. I'm not a professional sysadmin.

But in my case, for my own personal usage systems, by using my own null character device in my own tmpfs mounted folders, I can just test for the success/failure of the mknod command before I start redirecting anything to it.

I don't need a /dev/null. But I do need mknod.

<comment><USER30> And you need to be root, apparently.

<comment><USER28>
      setuidgid luser mknod ...

Are you sure?

<comment><USER30> Great. You just gave luser _at least_ read access to a whole lot of your hardware, including your whole hard disks, swap space, and some device nodes which potentially crash the system upon random reading.

<comment><USER28> My system has only one user: me. I am the only one using it.

Multiuser UNIX is a relic from a long past era of shared computing. The "root" concept creates more security issues than it solves. That's why Plan 9 did away with it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> I'm guessing this is a parody?

<comment><USER32> I'm guessing it's inspired by the video "MongoDB is Web Scale"

[https://www.youtube.com/watch?v=b2F-DItXtZs](https://www.youtube.com/watch?v=b2F-DItXtZs)

<comment><USER33> Wow I can't believe that video has gone viral — I remember showing it around to a few friends 2 years ago or so when it only had a few thousand views. Ironically, MongoDB has since become my go-to DB of choice...

<comment><USER34> Have you read [http://aphyr.com/posts/284-call-me-maybe- mongodb](http://aphyr.com/posts/284-call-me-maybe-mongodb) ?

</comment></comment></comment></comment><comment><USER35> Pity devnull.io was already taken.

</comment><comment><USER36> They had me at "Use our distributed service located in over 380 countries!"

<comment><USER37> I'd like to visit their backup Earth :)

</comment></comment><comment><USER38> Wow, is it April already?

Do you suppose after they successfully implement /dev/random as a service, they might implement /dev/zero or /dev/full next? Or /dev/console might be especially useful.

<comment><USER39> I've already launched a competitive /dev/urandom service!

<comment><USER40> You jest but... [http://www.random.org/clients/http/](http://www.random.org/clients/http/)

</comment></comment></comment><comment><USER41> If you don't let Google read my data, I'm ready for the 5k/y

</comment><comment><USER42> I wonder if it would be possible to sell a service like this for real. I bet it would.

</comment><comment><USER43> I get the feeling that the fact that the site never loads for me is intentional?

</comment><comment><USER44> "85,66% guaranteed uptime (we need some sleep, too)" lol!!!

</comment><comment><USER45> This is trash, literally and figuratively.

</comment><comment><USER46> leet timestamp on the HTML: 27.10.2013, 13:37

<comment><USER47> ;)

[https://github.com/noqqe/devnull-as-a- service/commit/a305550...](https://github.com/noqqe/devnull-as-a- service/commit/a305550d5c234834ec74c165e394d03be38f69fe)

</comment></comment><comment><USER48> I laughed at high availability /dev/null cluster.

</comment><comment><USER49> I've always dreamt of that!

</comment><comment><USER50> that's very silly.

</comment><comment><USER51> This must be at least few hundred millions of lines of _Java_ code (to be able to access /dev/null in a portable way).

</comment><comment><USER52> CC-NC epic fail</comment>


This is how I got punk'd today - <AUTHOR>

I just received this email.
A guy says our product (PageLever) infringes on a copyright owned by his client:
My questions at the end of the letter.
<comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----
Dear Jeff Widman,
I represent [redacted]. It has come to my attention that you have made an unauthorized claim of the business name Page Lever, which will from hereon be referred to as the the Name. I am personally contacting you directly so as to best be able to address this issue at a personal level to try to avoid future legal implications that none of the parties herein named would prefer.
My Client has reserved all rights for the Name, first published on April 3, 2009. I have in my possession the registered copyright documentation for the Name.
Your Name and Website, http://www.PageLever.com is identical to the Name and clearly used the Name as its basis.
As you failed to receive permission to use the Name from my Client, [Redacted], and you did not receive permission to make or distribute copies, including electronic copies, you have infringed my client's rights under 17 U.S.C. Section 101 et seq. and could be liable for statutory damages as high as $150,000 as set forth in Section 504(c)(2).
I demand that you immediately cease the use and distribution of http://www.PageLever.com and all other uses of the Name, which was derived from the Name, and all copies, including electronic copies. All unused and undistributed copies, including electronic copies, if applicable, are to be turned over to my Client's ownership, or to be destroyed immediately. You are to desist from reproducing Page Lever or http://www.PageLever.com or any other infringement of my rights in the future.
If I have not received an affirmative response from you by April 14, 2011 indicating that you have fully complied with these requirements, I, on behalf of my Client, will be forced to take further action against you that will include, but will not be limited to: seeking a copyright infringement lawyer, reporting this to any ad programs you may have on electronic copies, and seeking proper copyright infringement litigation for any damages caused by this reproduction.
Sincerely,
Alan J. Shore
Alan J. Shore Shore and Associates Florida State Bar No. 1-2345 111 South Street or P.O. Box 111 Miami, FL 82001 [redacted]@gmail.com
</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-----
1) This letter appears fake, perhaps someone trying to extort money from us.  How do I determine whether it's real?
2) Should this turn out not to be fake, the consequences range from annoying to serious. How do I prove that we have a legitimate claim to the names "PageLever" and "Page Lever"?
3) Even if this turns out to be a fake, I want to remove any risk of this happening in the future--should I file a copyright in our state of incorporation, or a trademark with the USPTO, or what?
Background:
I registered the domain in October 2009, barely more than 6 months after he claimed to file the copyright document.
We've been publicly using the name for various Facebook tools since July 2010. At the time I registered the domain, Google turned up pretty much nothing for the word "PageLever", and I couldn't find anything in Google to show this guy has been actively using the name.
It definitely smells fake--I think it should be a "trademark infringement" not a "copyright document", there's no phone number, it uses a gmail account, the office isn't listed on Google Maps, he isn't listed in the Florida Bar, (plus what are the odds his member number would be 1-2345?)
Aside from whether or not it's real, it's actually a fairly humorous letter. </comment><comment> mark-r First step, talk to a lawyer. Don't trust anything you read on the internet, including what comes next - I am not a lawyer, and even if I were I am not _your_ lawyer.

I find it funny that the letter talks about copyright and making copies. You can't copyright a name, although you can certainly trademark it. uspto.gov has a trademark search function.

</comment><comment><USER2> First, its not a copyright infringement its Trademark infringement, they are different. Search the USPTO trademark data base to see his clients trademark and their filing date.

If you don't believe there would be significant you can do one of two things: 1) Have an attorney respond that upon reviewing his letter you have concluded there is no basis for infringement. 2) Ignore him (although watch your mail for a certified letter notifying you if they decide to file suit.)

If on the other hand you find they have a trademark, legally registered, and that your business is apt to cause their customers confusion, then you your response will be somewhat different.

<comment><AUTHOR> I thought there was something about where if we're legitimately using the name, then even if we don't file the trademark, no one can come along after us and file for it... am I wrong?

<comment><USER2> Yes, if you are doing business with the mark you get precedence, especially if there is lots of documentation that it predates the filing.

However, be aware that everything I know about trademarks I learned over the an intense 6 week period when Sun was trying to figure out what to call Java (my suggestion was 'Silk' :-) and the browser (initially WebRunner but that was already in process by Apple/Taligent).

Do consult a lawyer, do file for a mark if you want to keep it.

</comment></comment></comment><comment><USER2> This is the search page for trademarks: [http://tess2.uspto.gov/bin/gate.exe?f=searchss&state=401...](http://tess2.uspto.gov/bin/gate.exe?f=searchss&state=4010:11gdf3.1.1)

Note that they use the Sun Logo as their favicon :-)

<comment><AUTHOR> Thx--I checked that, and nothing for PageLever or Page Lever appears.

Anyone have know an article that can walk me through the process of filing a trademark?

(I'll probably have our lawyer do it, but I want to make sure I understand the process)

</comment></comment><comment><USER3> If you haven't altered the signature, I'm thinking it's an April Fool's prank.

\- Alan J. Shore is the name of James Spader's character on "The Practice" and "Boston Legal".

\- Bar IDs in the state of Florida do not have hyphens.

\- 1-2345 is a very unlikely Bar ID regardless of the hyphen.

\- There is no registered "Alan Shore" in Miami (though there is an Allen M Shore in Fort Lauderdale).

\- I can't find any Trademark registration for either PageLever or Page Lever.

\- Edit: 12345 belongs to Samuel O Carson, of Gainesville, FL; Deceased. [http://www.floridabar.org/names.nsf/0D856BE6EA32ECE1052576D9...](http://www.floridabar.org/names.nsf/0D856BE6EA32ECE1052576D9006CBABB/F9EFF7B20A77982885256A82007C40E4?OpenDocument)

At this point, I'm thinking you've been Punk'd.

You should note, however, that if somebody else comes behind you and registers PageLever as a Trademark, it's very possible for them to take your domain legally.

Edited to add a link to Samuel Carson. Thanks FirstHop

<comment><AUTHOR> You're totally right.

Just got a phone call from my sister... she totally punk'd me. Now the ENTIRE office is rolling on the ground laughing...

Of all people, my non-techy sister!

</comment></comment><comment><USER4> You sure one of your friends isn't trying to freak you out on April Fools Day?

<comment> mark-r And there's no better reward for the prankster than taking your freak-out public.

</comment></comment><comment><USER5> There is a cheap service that could help you with the authenticity. But I don't want to spam good ole HN with it =P.

</comment><comment><USER6> The zip code 82001 is not Miami, it's Cheyenne, Wyoming.</comment>


Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac - <AUTHOR> I noticed something really peculiar this morning when I was invited to a Zoom meeting. I had uninstalled Zoom the night before but when I clicked the Join Meeting link, I was still prompted by the browser to open the zoom.us application. I went ahead and clicked OK to open it and I got the OSX popup: "You're opening the application "zoom.us" for the first time. Are you sure you want to open this application?" (https://imgur.com/nsOV3d5)
I checked my Applications folder and didn't see Zoom there so I clicked the "Show Application" button in the popup and it ended up opening the Applications folder from one of my Time Machine backups with Zoom installed.
I tested this with both Firefox and Chrome with the same results. Now I don't know if this is an OSX specific issue, a browser issue, or a Zoom issue.
Can anyone else confirm the same or similar behavior on Mac? If anyone can also shed some insight about this behavior, it would be much appreciated. <comment><USER2> This sounds like it might be a bug/misconfiguration in Launch Services, which deals things like application registration and URL scheme handling. Since I would expect your browser to do something like call to the system to open the URL (LSOpenURLsWithRole, et al.) I don't think this is a problem with Zoom.

<comment><USER3> In which case the following may help:

Dump LS database: /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -dump > ~/lsdump.txt

Purge LS database: /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -kill -r -domain local -domain system -domain user

</comment></comment><comment><USER4> It's doubtful that this is Zoom doing anything in particular.

Rather it's likely the OS doing the best it can to handle the URL for you. The OS has a mapping between the URL and the bundle identifier of the app, and apparently looked for the bundle on a disk that happened to be attached, after it didn't find it on your main disk. Which is perfectly reasonable in itself.

<comment><USER5> This is unexpected to me. If I remove an application I do not expect it to run. If the OS is willing to reach into the Time Machine backups will it also modify them? What if I delete an app, run it then install an update? Will it install to the backup? That would be very unexpected.

Looking at multiple application directories is one thing but executing things from the backup directory is another.

<comment><USER6> I checked before, and if I recall correctly, Time Machine backups are protected at the kernel level -- you cannot modify them, even with sudo. You can delete the whole backup, but you cannot modify part of it.

> but executing things from the backup directory is another.

Time Machine backups are structured in a very non-proprietary way. Each backup is just a folder, protected from modifications, with hard links used to save space. If anything, I'd say good on Apple for supporting a backup format that works exactly like making a copy of a folder.

<comment><USER7> You can also delete items from your backup. So like if wanted to delete Zoom from Time Machine just select it in a backup and then select the option to remove it from all your backups from the Action menu or a right-click.

<comment><USER5> Ok but why would I do that? The whole idea of a backup is that I can... go back.

Do other apps launch from backups like this? It's very strange.

My expectation is that if I want to go back to a backup I have to restore that backup first then run the application. Executing from a backup is surprising and frankly difficult to reason about. What version is even running? How would I know?

</comment></comment></comment></comment></comment><comment><USER8> Open a bug with Apple about this. They fixed an issue I reported a few years back about being able to launch applications in the Trash. They will likely want to add the same restriction to Time Machine Backups as well.

<comment><USER9> What if you need to run an old version of the application?

<comment><USER10> An informative popup beats running a deleted app any day of the week.

</comment></comment></comment><comment><USER11> It'll do that with any application on the Mac, this is not peculiar to Zoom. The Time Machine backup is, as far as the Finder is concerned, just another volume. It'll prefer applications on the root volume, but it'll launch them from other volumes as well.

<comment><USER12> So as long as the victim has time machine enabled and had an attack tool on their computer within the TM timeframe… the attacker could at any time re- initiate that tool from the grave? That's a huge security logic hole…

</comment></comment><comment><USER13> I wasn't aware that any non-OS service even had access to data and applications saved in Time Machine. This might be worthy of a bug bounty report to Apple.

<comment><USER14> There's at least one app for figuring out why every hourly backup takes half a gigabyte. It _might_ require root privileges, but I doubt that.

<comment><USER2> Wait, is that not normal?

<comment> yjftsjthsd-h ... unless you are writing a half-gig every hour, why would that be _remotely_ expected?

<comment><USER2> I would think that it's touching a bunch of log files slightly or something…

<comment><USER14> My guess so far is something like Firefox's history database.

<comment><USER15> If that is half a GB Firefox would be crawling. Here is is around 60MB on a well-used machine with an ancient FF profile.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> On a current version of OS X you should be getting something that looks like this on attempts to launch an app from a backup:

[https://i.imgur.com/eHlkGt0.png](https://i.imgur.com/eHlkGt0.png)

</comment><comment><USER17> It sounds like a (Mac OS|OSX) issue, because why is it looking for URL handlers in its backups?

You could test it with Slack, they also use the same way ("tell the browser to load a URL") to load their app from the browser.

</comment><comment><USER14> Sort of sidetracking, but: afaik applications open from a browser via a custom protocol in a link, and for that the application has to be already installed—unless MacOS offers to search the app store (if it does, not sure). So, this suggests to me that either MacOS leaves protocol associations in place after uninstalling an app, and has the machinery to resurrect such an app from the backups, or Zoom leaves around a protocol-handling app after an uninstall.

<comment><USER18> As with file types, the URL protocols an app can handle are configured in the app's Info.plist. An app doesn't have to be "installed" in any special way, the app just has to be somewhere on a disk mounted where the OS can see it in order for the OS to find it.

In OPs case, Zoom.app was still hanging out in his backup, ready to be launched (Time Machine backups are just a standard disk image)

</comment></comment><comment><USER19> I wish I could remember / find it right now, maybe it was my Witopia VPN? Need to check...

Anyway, I've had at least one application that said to remove it, first delete it, AND THEN EMPTY THE TRASH (?!?!) and maybe even reboot. Most of us are probably more troubled by the trash-empty thing than the reboot thing.

EDIT: OK Alzheimer's hasn't gotten me yet. It was Witopia / personalVPN:

[https://www.personalvpn.com/support/set-vpn-mac/app-setup- fo...](https://www.personalvpn.com/support/set-vpn-mac/app-setup-for- macos-10.14)

Just search the page for the word "empty". It reads:

<comment><comment><comment><comment><comment><comment><comment><comment><comment><comment><comment><comment><comment>~~

2\. If you already had the WiTopia personalVPN app installed previously: Go to your FINDER > Applications folder > Drag the WiTopia app from there to the trash > and empty the trash* to remove the existing app.

* If the trash is not emptied, this will not work!

<comment><comment><comment><comment><comment><comment><comment><comment><comment><comment>~~

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> I guess in some sense it is the price one pays for "it just works". The main problem I have is this seems like going to very far extremes in order to run the app no matter what and the tradeoffs were never discussed or put in front of people, which I find to be pretty unethical. Sort of like the privacy debate - the tradeoffs of everyone sharing their personal data were never really up for debate.

<comment><USER21> This is a bit of a charitable explanation. How can any project manager say, with a straight face, "we need to make sure the application is still available, even if the user deletes it." How can you accidentally delete an application? It is not like you press a button by accident and it is suddenly gone. Deleting an application requires the user to express intent and go through a process (go to the Applications folder, find the app, delete it, remove from trash).

There is malware that is easier to get rid of than Zoom.

<comment><USER22> > How can any project manager say, with a straight face, "we need to make sure > the application is still available, even if the user deletes it."

Someone absolutely did, though. Remember last summer when it came out that uninstalling Zoom would leave a local webserver running that would automatically reinstall it if you accessed a Zoom link?

[https://www.macworld.com/article/3407764/zoom-mac-app- flaw-c...](https://www.macworld.com/article/3407764/zoom-mac-app-flaw-camera- patch.html)

</comment></comment></comment><comment><USER23> If your time machine backup volume was mounted, I would expect this behavior. Back in the old days, when storage was at a premium, you could have applications stored on a network volume, so they would be shared by everyone on the LAN. The OS would launch an application that matched the requested file type from any mounted volume.

If it wasn't mounted, I would file a bug.

Either way, not really Zoom's fault.

</comment><comment><USER24> another plug for the zoom redirect plugin [https://github.com/arkadiyt/zoom- redirector](https://github.com/arkadiyt/zoom-redirector)

<comment><USER25> Except it appears Zoom has disabled their web client for now?

<comment><USER26> How up-to-date is this? I was able to join a zoom videoconference yesterday evening from the web browser.

And while on the topic of the web client, it turned out to be a very disappointing experience. There was no way to set focus on a given attendee; I wanted to view the host's video feed but the website kept switching feeds, seemingly haphazardly, to different attendees.

<comment><USER25> This is just today. [https://github.com/arkadiyt/zoom- redirector/issues/7](https://github.com/arkadiyt/zoom-redirector/issues/7)

<comment><USER27> My guess is that people stop using their native clients due to the security problems and now their webrtc servers are beyond capacity.

Could it be that they are limited by the number of servers that are available to them? A webrtc bridge shouldn't have a bottleneck and should perfectly scale. Who is their cloud provider?</comment></comment></comment></comment></comment>


Macaron: a high productive and modular web framework in Go - <AUTHOR> https://go-macaron.com/ <comment><USER2> I quickly looked this over. Does Golang have some hidden ORM like feature that makes complex persistence easy? I spent the last three months working on a storage mechanism that controls all of CRUD at the document level across what is essentially Google Groups (each op is allowed to multiple groups). This is where web work is complex.

<comment><USER3> Came here to say the same thing. Go won't enter "crud webapp" market until they have a better story on relational db interactions. I'm afraid this is way beyond the current possibilities of the language as it offer barely any meta- programming technics, on purpose.

<comment><USER4> Did you had a look at sqlx? [1] Granted, it won't generate the queries for you - but parsing into structs works 95% of time without additional mapping for me. Coming from other languages I also found the amount of necessary typing a bit disturbing first. But then you can actually read code instead of orm framework documentation, issue trackers and workarounds.

[1] [http://jmoiron.github.io/sqlx/](http://jmoiron.github.io/sqlx/)

<comment><USER3> sqlx didn't work in my case last time i tried (don't remember why exactly), but it's still far from any standard like sqlalchemy (python), hibernate (java) , active records (ruby),entity framework (.net), doctrine (php) or bookshelf (js).

Writing every select for every entity, with all the variations depending on whether you want to inner join with 1-n relationships (and which ones) is really tedious when you've got 30 entities in your model.

<comment><USER5> We use SQLalchemy at work and I would rather write queries by hand. A lot of that is because the documentation is a huge pain, but also because the object composition isn't intuitive. I've built a profile query builder in Go and it was pretty straight forward; I'm confident I could build an ORM in a couple of weeks.

<comment><USER3> sqlalchemy ( which i used and liked a lot) has multiple layers. query builder is the bottom one, but the most "challenging" one for go is probably the orm with things lazy loading and its parametrization ( such as eager loading of relationships).

keeping it all type safe ( not having the user cast interface{} to struct everywhere) and performant would be a challenge.

<comment><USER5> I'm not sure exactly what you mean about parameterization, but I suspect in general my notion of what an ORM is differs from yours (in particular, I don't assume lazy loading). Maybe what I'm thinking isn't appropriately called "ORM" (maybe "type relational mapping" is more appropriate?). At any rate, I don't think type safety should be a challenge (somehow a mapping must be generated for each type, just like SQLAlchemy--in Go this can be either explicit or inferred once via reflection or code generation) and I don't think performance would be more a challenge in Go than any other language (the trick to ORM performance is in building efficient SQL queries, not in reflection or type asserts).

<comment><USER3> compile-time code generation can only get you so far, unless you're ready to generate every single kind of query beforehand ( which grows exponentially with the number of -to-many relationship). You'll have to rely on introspection but i suspect things won't go smoothly.

anyway, it should make for a good exercise i'm sure.

as for the definition of Object-Relationnal-Mapper the idea is to completely abstract the fact that you're storing your object graph ( or struct graph in the case of go) in a relationnal database. To do so, the developper provides meta data , like an xml file or annotation, to describe the mapping. This is a pretty hard problem.

<comment><USER5> It's not too difficult. Where I work, we're building a BI tool that maps domain concepts ("objects") to fields in relational databases (we're using Python and building out SQLAlchemy queries, but we're not doing anything that wouldn't easily translate into Go). The domain concepts are analogous to structs in Go or simple classes in Python. You only need to get the mapping data once (in our case, the user configures these mappings in the UI and then we load them at runtime, but these could come from anywhere) and from then on there is no magic.

If you know ahead of time what your types are, then you can do everything in code gen easily.

The tough bit is query optimization.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Developed by a very smart, nice guy who used this to make Gogs among other things. I've been using Gogs for almost 2.5 years now and I've had zero downtime or issues. It's reliability and efficiently is one of the reasons I began very strongly learning and using Golang more.

A Django project can't use less than 100mb of memory because of Python. Gogs is a full github clone which uses 5-10mb on average. When you're trying to run something self-hosted it's super valuable that you don't need a huge server(i.e. $$$) just to make it responsive which helps make self-hosting make sense economically.

</comment><comment><USER7> Macaron is awesome. It's used in Gogs and Gitea

<comment><USER8> Grafana uses it as well last I checked

</comment></comment><comment><USER9> Does this have hot reloading?

<comment><USER10> Just use Gin: [https://github.com/codegangsta/gin](https://github.com/codegangsta/gin)

</comment></comment><comment><USER11> Starting to feel like Go is suffering from a glut of web frameworks.

<comment><USER6> This framework has been around forever and not really. Most people use the standard library unless they need better routing than the standard library provides.

There are actually very few web _frameworks_ that provide much other than a router in Go. Most of the frameworks are actually just packages that can be used for all sorts of things. e.g. Beego by astaxie

<comment><USER11> Well I wasn't commenting on age of particular projects. I had not heard of Beego so now I still feel there is a bit of over growth. Leads to confusion over what to use when you do want better routing which I think is pretty much every project. Perhaps routing will continue to improve in the standard library such that it does not feel like I need to pick a package or roll my own.

</comment></comment></comment><comment><USER12> I read this as Macron at first lol

<comment><USER13> And I expected their project logo to be more akin to e.g. [1].

[1] [http://d31f1lobboyy59.cloudfront.net/wp- content/uploads/2014...](http://d31f1lobboyy59.cloudfront.net/wp- content/uploads/2014/12/Macaron-photo-2.jpg)

<comment><USER5> Same</comment></comment></comment>