Udp.c in Linux kernel pre-4.5 allows remote attackers to execute arbitrary code - <AUTHOR> https://nvd.nist.gov/vuln/detail/CVE-2016-10229#vulnDescriptionTitle <comment><USER2> Red Hat (RHEL 5/6/7) not affected: [https://access.redhat.com/security/cve/CVE-2016-10229](https://access.redhat.com/security/cve/CVE-2016-10229)

Highest impact is on Android: [https://source.android.com/security/bulletin/2017-04-01](https://source.android.com/security/bulletin/2017-04-01)

<comment><USER3> The RHEL web page is singularly unhelpful. Do they mean that is not affected _if you update today and reboot_ , or that they have never shipped a kernel with the affected functionality enabled? I have a server with just over a year's uptime, so I need to know.

The debian web page at least lists the exact kernel version they ship where it is confirmed fixed.

<comment><USER4> The Statement near the top seems unambiguous:

> This issue does not affect the Linux kernel packages as shipped with Red Hat > Enterprise Linux 5, 6, and 7, Red Hat Enterprise MRG 2, and realtime kernels > as the code that introduced the flaw is not present in these products.

<comment><USER3> That statement has been subsequently added. And yes.

</comment></comment></comment></comment><comment><USER5> Looks like this was patched a while ago in both RedHat and Debian distros.

[https://access.redhat.com/security/cve/cve-2016-10229](https://access.redhat.com/security/cve/cve-2016-10229)

[https://security-tracker.debian.org/tracker/CVE-2016-10229](https://security- tracker.debian.org/tracker/CVE-2016-10229)

</comment><comment><USER6> Always funny to see how banal bug fix commits are in comparison with the severity of the bug itself

[https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191)

<comment><USER7> I'm not sure how the Linux kernel handles these, but in some projects, this is intentional, the goal being to land the fix and make everyone safe before knowledge of how to exploit the bug is widely known.

Of course, sometimes just fixing up code for stability reasons may close a security hole that isn't really known or understood yet.

Not sure which was happening here.

<comment><USER6> I just mean the code delta itself; one line of code can make a lot of difference :)

<comment><USER8> Sometimes even one character can make a lot of difference: [https://en.wikipedia.org/wiki/Mariner_1#.22The_most_expensiv...](https://en.wikipedia.org/wiki/Mariner_1#.22The_most_expensive_hyphen_in_history.22)

</comment></comment></comment></comment><comment><USER9> This is probably less severe than it sounds like because of the MSG_PEEK option needed in recvfrom(), which is rarely used.

<comment><USER10> Public information is very thin on the exploitability of this. Are you able to elaborate a little bit where MSG_PEEK might be used? Is it used in the kernel? Only in specific applications?

<comment><USER9> Reading the original link, it looks like the kernel corruption only happens when an user space application uses the recvfrom() syscall using the MSG_PEEK option. MSG_PEEK is only used AFAIK only in specific applications that need to "peek" at the message without consuming it. This is not a very common use case, but some research should be done to understand if there is some popular application using it.

<comment><USER11> If I've understood this correctly, it turns it into a local privilege escalation opportunity: run a vulnerable application as the user, use the exploit to get code execution in the _kernel_.

<comment><USER12> Yeah, but there is still a little bit of explicit usage of recvfrom() with MSG_PEEK

[https://codesearch.debian.net/search?q=recvfrom+.*+MSG_PEEK](https://codesearch.debian.net/search?q=recvfrom+.*+MSG_PEEK)

And probably more implicit

[https://codesearch.debian.net/search?q=recv+.*+MSG_PEEK](https://codesearch.debian.net/search?q=recv+.*+MSG_PEEK)

<comment> ryan-c The use in wget seems a little scary.

</comment></comment></comment></comment></comment></comment><comment><USER13> I really wish these announcements would come with a short check to see if you're affected and some example code to test if you're vulnerable.

Does anyone know of a simple check to see if your server is affected?

<comment><USER14> MSG_PEEK is a pretty obscure feature. I'm not personally aware of any commonly-run UDP code that actually uses it. You'll want to patch your kernel for sure, but unless you're running really crazy UDP servers, you're probably not immediately vulnerable.

<comment><USER15> > MSG_PEEK is a pretty obscure feature. I'm not personally aware of any > commonly-run UDP code that actually uses it. You'll want to patch your > kernel for sure, but unless you're running really crazy UDP servers, you're > probably not immediately vulnerable.

Or unless you have untrusted users on your machine, in which case _they_ can run crazy UDP servers and escalate to root.

<comment><USER14> Yes, which is an important point: this serves as a local root escalation to any process which can open a UDP socket.

</comment></comment></comment></comment><comment><USER16> Ubuntu 14 LTS Current kernel is 3.13.0-116-generic and issue was fixed in released (3.13.0-79.123)- so NOT AFFECTED

Ubuntu 12 LTS Current kernel is 3.2.0-118-generic and fixed in released (3.2.0-99.139) - so NOT AFFECTED

</comment><comment><USER17> It seems [1] recent kernels are not affected by this. So if you are running older (hopefully lts kernels), you might need to verify them, otherwise you should be fine (check back with your distro obviously).

[1] [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191)

<comment><USER18> Correction: ALL production OS and kernels are affected.

"udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]"

There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

<comment><USER19> This doesn't seem true from the commit: [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191)

The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.

<comment><USER20> The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare:

[http://lxr.free- electrons.com/source/net/core/datagram.c?v=3...](http://lxr.free- electrons.com/source/net/core/datagram.c?v=3.19#L645)

[http://lxr.free- electrons.com/source/net/core/datagram.c?v=4...](http://lxr.free- electrons.com/source/net/core/datagram.c?v=4.1#L645)

[http://lxr.free- electrons.com/source/net/core/datagram.c?v=4...](http://lxr.free- electrons.com/source/net/core/datagram.c?v=4.2#L682)

I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that?

EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.

<comment><USER19> Why "problematic"? The Al Viro change mentioned in the fix is [https://github.com/torvalds/linux/commit/227158db160449b6513...](https://github.com/torvalds/linux/commit/227158db160449b6513d2e31894a135104b90e90). The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.

</comment></comment></comment></comment></comment><comment><USER21> The wording makes it sound like Hertbleed/Cloudbleed level vulnerability.

I mean impact wise, all those routers and cameras got another attack vector?

<comment><USER22> This would make heartbleed and similar look like childsplay - this is a worm level attack if it's as bad as the title sounds.

But given that redhat has so far labelled themselves not vulnerable, I'm guessing there's more to it than the title lets on.

<comment><USER23> What does worm level mean? I heard it in relation to heartbleed [or something] but couldn't figure out why it's worse than non-wormable.

<comment><USER24> Worms are viruses that worm their way in to connected computers through the network without any action on the user's part, and then use newly-infected computers to worm through to others.

Unlike many other viruses, you don't have to visit a page that runs an exploit, download a trojan, open an attachment, or do anything else to trigger it. Any computer that can contact the exploitable service can infect you (and will, if it has the worm too).

"Worm-level" would call back to classic worm attacks where any computer connected to the internet and running Windows 2000/XP was at real risk of infection just by being connected. LAN/corporate networks could be infected if someone plugged an infected computer into the LAN, or if it spread through the DMZ.

This type of attack doesn't happen very often anymore, as almost all home connections are firewalled by default, vendors have become more careful with security, etc.

<comment><USER25> The original worm: [https://en.m.wikipedia.org/wiki/Morris_worm](https://en.m.wikipedia.org/wiki/Morris_worm)

</comment></comment></comment></comment></comment><comment><USER26> This vulnerability has already been disclosed and fixed in mainline, upstream longterm releases and major distribution kernels _last year_ , I don't understand why it made the news today, am I missing something, is it slow news day or is it fear mongering?

I flagged the thread because it is harmful (or time waster at best). From the comments I can see people are worried and unknowingly wasting their time checking their kernels to see if they are affected _from a vulnerability that has already been fixed more than a year ago_. Damn, _I_ wasted half an hour of my time to see what really the situation is about.

<comment><USER27> Android patches were released a week or so ago that fixed this vulnerability. [[https://source.android.com/security/bulletin/2017-04-01](https://source.android.com/security/bulletin/2017-04-01)] That probably explains why it is bubbling up now. Many phones and routers will remain unpatched.

The CVE was marked as highly critical and the kernel patche comments are vague at best as to the risks.

The issue is not with this being on HN, the issue is with the lack of clarity about the scope and severity of the vulnerability.

</comment></comment><comment><USER28> Does anyone have an explanation for how this exploit works?

<comment><USER29> You're not the only one confused here. Tavis isn't sure what's going on either:

[https://twitter.com/taviso/status/852571815079591936](https://twitter.com/taviso/status/852571815079591936)

</comment></comment><comment><USER30> Why is this bubbling up again?

</comment><comment><USER16> this is soo confusing...</comment>


Erlang as middleware - <AUTHOR> http://debasishg.blogspot.com/2008/08/erlang-as-middleware.html <comment><USER3> _All these applications/services rely on the intrinsic scalability of Erlang as a platform._

I have to take issue with this assertion; I've seen a similar sentiment expressed here. Certainly, Erlang lets you naturally _express_ concurrency in your application, but that doesn't automatically mean it will _scale_.

People have been writing high performance, message passing programs for a long time using libraries like MPI. The programming model used for creating distributed MPI applications is basically that of Erlang. The difference - <USER2> it is a big one - is that Erlang lets you do everything at a higher level with language constructs. This is a huge win.

But parallel applications don't automatically scale; scalability is a runtime behavior that depends on the problem you're solving and design decisions you made to solve that problem. How well a concurrent application will scale is usually not obvious.

There's no free lunch. You can't expect to start using Erlang and automatically get scalability. Like we've always done, you'll have to think carefully about issues such as data distribution (who has to know what when?), granularity (what's the smallest amount of work that should be parallel?) and synchronization overhead (does doing this concurrently actually cost more than sequentially?).

<comment><USER4> Erlang is not magic fairy-dust that suddenly makes you app scale. What makes Erlang different than most languages is that it does not get in your way when scaling becomes necessary. There are fewer leaky abstractions and hidden "gotchas" that will end up making your life hell. The fact that it happens to come with battle-tested frameworks for handling a lot of the dreary details for code and data distribution along with strong fault-tolerance features are nice benefits to be able to draw upon.

<comment><USER3> That all sounds excellent. I've never actually had the chance to use Erlang, but I do have experience with concurrent applications in general.

I think concurrency will be the norm in the future, so I'm excited by things like Erlang, even if I've never had the chance to use them. I just want to make point out that a language like Erlang makes solving a hard problem easier, but it's not the solution itself.</comment></comment></comment>


Show HN: Visualize how HN/Reddit talk about your company and products - <AUTHOR> http://brandimage.io <comment><USER2> I was at a company that tried "sentiment analysis" 10 or 15 years ago. It was impossible to get right. The results were useless. It's funny how nothing seems to have changed. There's always some executive who's heard of "sentiment" and thinks they can spend a week shoving a bunch of text into a database, and then have it tell you whether the words are perceived as good or bad.

\- I typed "Chevrolet" and it says "mpg" and "venerable" have negative sentiment, while "underachieving", "supposedly", "kilometers", and "cars" have positive sentiment. "Stunning" and "awkward" are both neutral.

\- I tried "Mazda" and it was only slightly better. "Praise" is neutral, "regret" is positive, and "touring" is negative.

\- I tried "Petzl" and only shows 16 words, all neutral, and that includes stop words like "had" and "and" and "etc".

Those are at least companies with unique names. For companies with less common names, you might be lucky to get keywords related to the right company at all.

I think there can be good uses for word clouds, but they are few and far between, and this isn't one. Just make 3 lists, side by side, and title them "positive", "neutral", and "negative". Instead of font size, put the more common words higher on their respective list. The only reason I can see to use a word cloud here is to hide how bad the analysis is.

<comment><AUTHOR> Let me elaborate a bit more on how the app computes sentiment. For a particular word, its sentiment is the average of the sentences' sentiments which contain both the word and the brandname (in order to identify the sentiment targeted at the brand, not just the overall sentiment).

For example, in the case of Mazda where you say that "regret" is classified as positive, if you look into which message it comes from you can see the original sentence: "Buy a Mazda, you won't regret it :)"

I agree with you that the word cloud is not useful on its own, and this is why you can click on a word to see the actual messages. Think of the word cloud as merely an entry point into a more detailed analysis by a human.

Thanks for the feedback.

</comment></comment><comment><USER3> This is a really cool idea, there are other products out there that do the same thing, but there is definitely room to differentiate yourself.

One interesting issue, you might need to read the context a bit more to gauge if the post is actually talking about the Brand. For example Target is a common english word, and if you look at the results, only 1 usage was actually referring to the store Target.

One nice bonus that would be useful, I'd like to be able to compare sentiment by Subreddit, if i'm marketing on Reddit I would not target "Reddit" as a whole.

<comment><AUTHOR> Thanks for the feedback! It's a great idea, I'll definitely implement some Named Entity Recognition or other contextual model in the future to be able to distinguish from common words.

As for the subreddit, it's already on my next features list :)

</comment></comment><comment><USER4> Good idea in principle, however, did you even try to run a test before releasing it to the public?

For a particular term I get the following words having "positive" sentiments: boycott, punishment, greed, backlash, protesters, damaging, upset.

How in hell is that positive?

<comment><AUTHOR> That's a fair criticism. Sentiment analysis is quite hard to get right on social media messages because of diversity, subtlety, and many other aspects. From my experience with similar commercial and (very!) expensive products, their accuracy is far from perfect too.

Also consider the lack of labeled data for HN and Reddit messages: I had to use Twitter messages to train the classifiers.

This is the reason why I tried to play with BERT to see if I could get a model to generalize well from only Twitter messages. From my experiments, if you activate BERT (which makes the app much slower), you should be able to get 60~70% accuracy.

It's not perfect, but not too bad as well if you are getting averages over a large amount of messages.

Overall it's still a work in progress, I expect to greatly improve the accuracy over the following weeks!

<comment><USER5> I came here to say the same thing as the GP. I don't understand why some words are red or green.

For example, you can type in non-brand words as well. I typed in "houses" and the word "homeless" came up in green!

With a brand, facebook, I got this word "amiriteguyze" in red and clicking on it

Negative 11/19/2019, 12:13:31 PM

facebook is bad amiriteguyze?!?!?!?

Why is that even a word that would show up in the word cloud? I can't imagine it was entered a bunch of times. I can't intuit any correlation between the colors, sizes, or words themselves that show up in the clouds.

<comment><AUTHOR> The algorithm will try to give more importance to words which appear rarely and are only used with the chosen brandname (similar to TF-IDF). This is why sometimes weird words can surface to the wordcloud, especially when the sample size of messages is small.

To prevent those words from appearing, I was thinking to implement some dictionary-check to only allow for meaningful words. However this approach also have drawback as you restrict people's words and can miss important new concepts.

Thanks for the feedback.

</comment></comment></comment></comment><comment><USER6> Getting an error on [https://brandimage.io/](https://brandimage.io/)

Over Quota

This application is temporarily over its serving quota. Please try again later.

<comment><AUTHOR> Thanks for letting me know, I just increased the quota from the hosting service. The website is online again now!

</comment></comment><comment><USER7> Cool stuff!

I found an issue with "+" symbols in the brand name. Check out this URL - [https://brandimage.io/insight/c++?source=hn](https://brandimage.io/insight/c++?source=hn)

If "+" symbol is present, the UI won't show anything.

</comment><comment><USER8> Pretty awesome that it's open source.

For large companies there are some proprietary solutions for this. Example:

[https://www.trendkite.com/](https://www.trendkite.com/)

Disclaimer: family member works there so that's the reason I'm aware that this niche exists.

</comment><comment><USER9> I kind of hate this idea.

It's one thing if companies want to find out what people are saying about them so they can improve. However, I'd be surprised if that's how it is used.

This feels more like a way to measure the effectiveness of their astroturfing or low-key marketing efforts.

</comment><comment><USER10> Good job. Certainly see some potential. Our company used Clara in the past. I actually wrote my own in xls if you can believe it but it was highly vertical and tight topic so it was relatively easy. Where are you physically located?

<comment><AUTHOR> Thanks for your message, like you said it's a real challenge when the domain is quite broad (such as social media). I'm currently based in Taipei.

</comment></comment><comment><USER11> Interesting project, and I like the simple UI. How does the Sentiment Analysis is done? What kind of back-end have you used?

<comment><AUTHOR> Thanks! The basic (default) version for the sentiment analysis is based on TextBlob library, but you can choose to activate deep learning to analyze sentiment with Google AI's BERT (trained on Twitter messages), though it is quite slow at the moment because inferences are made on a CPU and not a GPU.

The back-end is just Python/Flask and I use the free Algolia and Pushshift.io APIs to source the messages from HN and Reddit (big thanks to them!)

<comment><USER12> This looks really great with such a simple UI.last year I tried to do a realtime sentiment analysis on twitter messages using TextBlob.It was fast but not very accurate. Can you suggest any other library which might works fast enough on realtime messages.

<comment><AUTHOR> For inference speed I recommend a Naive Bayes model. I've tried this on Twitter messages and got near ~90% accuracy with 3-class (positive, negative, neutral).

The easiest library to do that would probably be scikit-learn with their ComplementNB class: [https://scikit- learn.org/stable/modules/generated/sklearn.na...](https://scikit- learn.org/stable/modules/generated/sklearn.naive_bayes.ComplementNB.html)

For the data you can use the SemEval 2017 Task4-A dataset (around ~10K labeled tweets): [https://github.com/cbaziotis/datastories- semeval2017-task4/t...](https://github.com/cbaziotis/datastories- semeval2017-task4/tree/master/dataset/Subtask_A)

</comment></comment></comment></comment><comment><USER13> We made something similar at a hackathon: [https://spicy- lip.surge.sh/features](https://spicy-lip.surge.sh/features)

<comment><USER14> your link is dead

</comment></comment><comment><USER15> Interesting concept, but the models powering it need a lot of work. For example, searching "Apple" brings up "cider".

</comment><comment><USER16> negative: "employer", "apps", "perf", "idioms", "culture", "humanity"

positive: "closes", "binary", "btw", "disclaimer", "bullshit"

The word cloud seems fairly useless.

</comment><comment><USER17> Getting a "503 Over Quota" when trying to access your site :(

</comment><comment><USER18> This is fantastic, good work. Love the idea.

</comment><comment><USER14> Very cool.

<comment><AUTHOR> Thanks!</comment></comment>


Is ello unsustainable? - <AUTHOR> https://ello.co/manifesto

<comment><USER2> It's hard to say, considering they don't mention how they pay for expenses in the manifesto..

<comment><USER3> If they keep posting links to landing pages that are not related to the headline, just lead to an unrelated call to action, they're likely to get their entire domain banned from HN. That would probably get them some more attention.

After clicking this link, which brutally hijacked the back button in my browser, I can honestly say that I really don't want to click another one! :D</comment></comment>


Show HN: Fieldbook Codelets: Host snippets of code, integrated with Fieldbook - <AUTHOR> https://medium.com/@fieldbook/announcing-fieldbook-codelets-77389d9eb59f <comment><USER2> This looks fantastic! I use Fieldbook to organize my life and it's great to see the pace at which new features are being added.

I would love to see a custom forms feature where I can build a form for myself or for others to enter rows. Collecting info is the one feature where I still turn to Google Spreadheets

<comment><USER3> Glad you're enjoying Fieldbook! Did you see our build-a-form example with Codelets, its one the features I hope people can get a lot of use from. Here is a direct link to that example: [https://github.com/fieldbook/api- docs/blob/master/codelets/f...](https://github.com/fieldbook/api- docs/blob/master/codelets/form.md)

<comment><USER2> Wow, fantastic! I just made a codelet form and it works beautifully! I'm now recommending this to everyone.

</comment></comment></comment><comment><USER4> This is the best feature you could ever think about implementing. It solves tons of problems, real and potential, at the same time.

I'm using Fieldbook for running my non-tech physical business and it's awesome. Now I'm starting to introduce it to another small business in which I'm a partner.

</comment><comment><USER5> Love this! Is there a way to trigger it to run when an event happens in my book?

<comment><AUTHOR> Yeah, you could create a codelet and then configure a webhook to invoke the codelet: [https://github.com/fieldbook/api- docs/blob/master/reference....](https://github.com/fieldbook/api- docs/blob/master/reference.md#webhooks)

(In the future we'd like to have an even easier / more seamless way of handling webhooks with codelets.)</comment></comment>


The Tax System Explained in Beer - <AUTHOR> http://www.ijreview.com/2012/04/688-tax-system-explained-beer/ <comment><USER2> I know a bunch of those "tenth man" beer drinkers who are no longer U.S. citizens. I did the legal work to make them so. Investment capital and jobs went with them.

Interestingly, a lot of them go to Europe and Australia/New Zealand. They aren't attempting to escape payment of income tax--they're going to high-tax countries. They're attempting to escape _our_ particularly pernicious tax system.

Also, it is interesting to read the comments to the article. Lots of rant. Lots of unwillingness to (attempt) to see some reality. Lots of closed minds. (My definition of a closed mind is one that is so full of its own ideas that there is no room for other ideas to enter).

</comment><comment><USER3> That's a little simplistic, and I say this as a capitalist.

The analogy doesn't ever consider that "man 10" often doesn't pay $59, because there is a rule that he can buy 2 shots for the bartender's hot daughters at $1 a piece and reduce his beer burden to $12.

It also doesn't consider that the whole point of a progressive taxation system is to pay for a finite amount of beer that cannot be counted on to be equally allotted. Not everyone receives 1 beer every day. Sometimes, the men only collectively use 8 beer, other 12 (especially when the men figure that they should buy some beer for the bar across the street). Sometimes, "man 6" needs 3 beers because he had a bad day, but he still only pays $3, because paying $9 would bankrupt him and create 5 people paying nothing, which is a detriment the entire group.

The breakdowns continue... 2-3 out of the first four men actually do not stay permanently in this state. Often, they become payers into the system as well at different levels. The system is designed to encourage this mobility, because at the end of the day, we are better with as many "tenth men" as possible.

The tenth man often can only be the tenth man with men of 5, 6 and 7 calibre to work for him. Without this labour, he is only a "eighth man". The system is symbiotic. The 10th man cannot just up and leave, anymore than the first man can, otherwise he would have already done so. The fact is that he too benefits from this relationship.

At any rate, my overall point isn't that one way is better than any other way, it's that the taxation systems of modern western nations - in that they are meant not only to fund government but to change macro-behaviors - are much too complex to be compared to 10 men buying beers.</comment>


Ask HN: Forget technical co-founders, where do you find a good designer? - <AUTHOR>

I've been working on my first project in Django and Python, and I've been finding that the coding takes way less time than trying to get the design down. I'm okay with HTML/CSS and know my way around Photoshop/GIMP, but anything related to design still takes me forever. Anyone have suggestions on where to find designers willing to join a startup? <comment><USER2> I'm in a similar position, and usually turn to a designer friend that I've done business before (he's my "go to" guy for anything design related).

That said, if you're just starting, you could just buy a design (from sites like <http://themeforest.net/>) and then tweak it according to your needs. The end result won't be the same as custom designed by a designer, but it can often be good enough for early iterations of the product/app/site.

<comment><AUTHOR> That's the direction I'm going in now, it just seems like I'd be able to get things done a lot faster with someone helping out on the front-end. Is it common for startups to have back-end devs also work on the front-end when they first start? Is it worth offering 20 or 30 percent, or is it better to just hack something together until you can afford to hire a designer?</comment></comment>


The Most Awesome Feature in iOS 7 - <AUTHOR> http://front.kinja.com/this-is-the-most-awesomerest-feature-in-apple-ios-7-512390674

<comment><USER2> There is a pretty obscure feature in current and recent versions of iOS that I think is cooler: some brushed-metal appearing buttons, for example the one that appears to control the volume when you double-click the lock screen to bring up the music controller, subtly change their appearance as you tilt the phone, as if they are actually reflecting light. It probably remains subliminal for most users. I frankly find the parallax effect from the GIF in the linked article a little cheesy; it reminds me, strongly, of those cheap "3D" photographs with the plastic ridges on the surface.</comment>


Status Chart: Your Professional Dashboard - <AUTHOR> https://www.statuschart.com/

<comment><USER2> What is the purpose of this website? The landing page doesn't make it very clear why I might want to sign up.

Poking around the about page I found a link to the founder's status chart (why isn't that link on the main page as a sample?) and at least I can see what it does, but it seems like it would only be useful for folks who attend a lot of meetups or do a lot of conferences.

As it turns out I'm one of those people, but I'm still not quite sure why I might want to use this.

<comment><AUTHOR> Yeah, I need to put up more info up on the landing page.

Here is my profile on Status Chart: <https://www.statuschart.com/kennedysgarage>

Two weeks ago I was not happy with my traditional résumé and decided to take a closer look it. I noticed that my career path did not fit on the typical one page one often has. I decided the solution would be to keep my résumé a traditional résumé and create something to enhance it.

I created Status Chart to list out all of my projects, hackathons, events, and so on. I fell that these items are what really make me who I am, not necessary the "jobs" I have had, although important.

<comment><USER3> I like the problem you're trying to solve, and I think you're on the right track, but this doesn't really work for me.

\- The name is obnoxious. Highlighting the events you've been to is somewhat interesting, but implicitly claiming that paying to go to some conference gives you higher social status is lame.

\- Too many items. If I were hiring someone would I really want to read through all that? Maybe, but not at first glance.

\- Organizing items by the date they were started / completed isn't especially compelling to me. I don't really care how busy you are, I just want to see the most interesting things you've done period.

\- It's not clear whether or not you can choose your own categories of what to add based on the front page, and presumably you can't since they each have their own unique icon. This is a problem, because what I would want to highlight about myself wouldn't fit especially well into these categories.

<comment><AUTHOR> Thanks so much for the feedback!

\- I was not trying to imply that someone has a higher social status. Just that I personally have gained so much from conferences, in the terms of knowledge. I have also gained equal amounts of knowledge from just watching videos online for the once I could not make it to.

\- I do agree that there is a lot of items. I have just implemented the original filtering system first as that seemed to work. We are working on other way to showcase the items you have, because we know not all profiles will be the same.

\- I love this idea, maybe we users could mark items as highlights.

\- Right now we are only have those categories. Something that I am trying to take care of first and deciding a better way of doing this.

Thanks so much for your feedback. I really appreciate it!

</comment></comment></comment></comment><comment><USER4> Looks great, can't wait to try it out!

One note - you've got a typo on your invitation request confirmation page[1]. It says "We applicate your request..." instead of "appreciate."

1\. <http://www.statuschart.com/invite-thanks>

<comment><AUTHOR> I appreciate it, thanks for catching that :)

</comment></comment><comment><USER5> Seems very useful, but the fact that the design is not responsive makes it unusable for me. What about people who want this open on the right side of their screen, with code on the left side?

<comment><AUTHOR> This is something we are working on. We had it responsive, but it didn't flow right. We want to spend just a bit more time getting it right.

</comment></comment><comment><USER6> Some comments to take or leave as desired

1\. It _looks_ really good. But on second glance I just got confused. There is a lot of info, a graph I dont get and a list of seemingly unconnected events with no exposition.

2\. It took a couple of plays to work it out - its really about the categories you have set up. Clicking the filter gives you a good sense of what the person has behind them Now I get it, I like it.

3\. So that leads me to: If I am a non-speaking, non-hackathoning (Whats a hackathon) uncharitable, non conference goer - my statuschart will look pretty thin. Can I alter the categories to suit me? At worst just change the labels

4\. I definitely want to expand the 'projects' section - I would want to do F/OSS, Salaried jobs, contract work, education etc.

5\. pricing - I think it was on the PR piece you got - $5 a month and 30/year. That sounds good but why make people sign up before they can follow / read a page. If I wanted to give this to a propspective employer, I would be forcing them to sign in before seeing my CV - or have I missed something

6\. Instead of category @all@, which is just a big long list of confusing, can I suggest _top_ \- where i can weight each event and then there is a simplish algorithm to float the events I weighted highest to top (perhaps weight / days since). That way there is a default page open that has my best stuff listed right at the top, and only then does someone have to filter out.

7\. I am thinking of this as a CV - I would want to put a small paragraph onto some events to explain them, maybe in a popup.

Otherwise really good - there is a rash of github resumes and other 'show off my stuff' sites. Its going to be an interesting area - good luck iterating.

cheers

Edit: kicked off a bit strong, toned it down a littel

</comment><comment><USER7> It's not very clear what it does, or what it is for?

<comment><AUTHOR> Jessica Roy from BetaBeat wrote about it this morning, she helps explains things a little better [http://betabeat.com/2012/09/status-chart-the-resume- porn-for...](http://betabeat.com/2012/09/status-chart-the-resume-porn-for- self-quantifiers-officially-beta-launches-today/)

I will update the site in a bit with some copy, I forgot to add that :/

<comment><USER7> Thanks, that makes it much clearer, pretty good concept and nice domain name.

<comment><AUTHOR> Cool. Yeah, I was pretty surprised to find this domain. I literally thought of the name and saw the domain & twitter was all available in 5 minutes after deciding to put up a landing page.

<comment><USER7> Yeah I didn't think there were any dotcoms available with such common words.</comment></comment></comment></comment></comment>


Leap of Confidence - How to grow your skills - <AUTHOR> http://blog.davidwurtz.com/the-leap-of-confidence

<comment><USER2> A nice link on how to broaden our skillset [http://blog.polyglotprogramming.com/2009/11/6/cultivateyourc...](http://blog.polyglotprogramming.com/2009/11/6/cultivateyourcareertoday)

</comment><comment><AUTHOR> and while you're at it, check this article out: [http://www.huffingtonpost.com/cent/make-everything-your- own_...](http://www.huffingtonpost.com/cent/make-everything-your- own_b_356915.html)</comment>


Ask HN: What news aggregator like HN do you visit every day? - <AUTHOR> Hi there.<p>HN has became part of my daily routine, i wonder what other websites / news aggregator / app do you use for getting informed ? <comment><USER2> Techmeme - [https://www.techmeme.com/](https://www.techmeme.com/) Memeorandum - [https://www.memeorandum.com/](https://www.memeorandum.com/) Arts & Letters Daily - [https://www.aldaily.com/](https://www.aldaily.com/)

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER3> Curated news extracting relevant trends, micro-trends and some edge cases: [https://www.slowernews.com/](https://www.slowernews.com/)

<comment><AUTHOR> Thank you for the suggestion, I love the idea of slower yet deeper news.

</comment></comment><comment><USER4> Any good ones discussing stocks/company analysis/competitive markets etc? I started writing about investing in innovation last year and looking for like minded people to discuss companies/business models/competitive advantages etc. Not interested in trading or sites that simply share recent headlines. Thanks.

</comment><comment><USER5> Not yet an aggregator per se, as there are no people to submit the news, but I'm building [https://littr.me/about](https://littr.me/about), which is an (old)reddit like link aggregator with ActivityPub support.

The idea would be that communities can put up their own instances of it, and then participate in the larger fediverse and interact with one another.

There's still some way to go, to fulfill this goal, but I'm slowly making my way there.

</comment><comment> tech-historian Techmeme.com. It's the best aggregator and has been for over a decade IMHO.

And I appreciate the pithy article summaries.

</comment><comment><USER6> [https://quill.news](https://quill.news)

It's a side project of mine that uses article/historical semantic analysis to find objective news. It not super accurate but surfaces some interesting reads.

<comment><USER7> Thanks for hijacking my back button.

<comment><USER6> Works fine for me.

<comment><USER8> The issue is that / redirects to /news even on back button presses (Chromium 83). Since you linked to / instead of /news, it gets stuck in a redirect loop.

</comment></comment></comment></comment><comment><USER9> Skimfeed [https://skimfeed.com](https://skimfeed.com) is still my daily driver. Good with the morning coffee.

</comment><comment><USER10> I've experimented with rss readers like Feedly. I have a few go-to news sources and websites - it's nice to have all of the top stories in one place.

</comment><comment><USER11> skimfeed.com

I actually use this site to aggregate HN.

</comment><comment><USER12> Slashdot.org

The original.

</comment><comment><USER13> [https://lobste.rs](https://lobste.rs)

I'd appreciate an invite as well if anybody has one.

<comment><USER14> I can provide one, would need your email address.

<comment><USER13> Please send it to firstname.lastname@example.com

Thanks!

<comment><USER13> that inbox expired. Here's another one:

firstname.lastname@example.com

</comment></comment></comment></comment><comment><USER15> [https://www.nakedcapitalism.com/](https://www.nakedcapitalism.com/)

For news and daily events 2x a day

</comment><comment><USER16> lobste.rs It tends to be more focused on computers and programming than HN is these days.</comment>


Using OpenCV To Determine Skin Tone Diversity Of Time Magazine Covers - <AUTHOR> http://www.drewconway.com/zia/?p=2874

<comment><USER2> Skin tones in images are very sensitive to lighting conditions. How are they planning to normalize these differences?

<comment> excuse-me In HSV space it's not as much of a problem. People fit into a black-white-red triangle

<comment><USER2> I don't understand why the choice of colorspace used to represent the person's face matters. The lighting used when the photo was taken can alter the apparent skin tone, possibly to another natural looking skin tone.

<comment> excuse-me Because you are using relative colors so the brightness ()and to an extent the color) of lighting largely cancels out.

Unless of course you take a very pale blonde person and light them with a brown spotlight!

</comment></comment></comment></comment><comment><USER3> Saw this a while ago and it's a cool thought experiment. The application fails, though, as some HNers have pointed out. It looks like Time covers have simply become darker, independent of the skin tones on each cover.

Someone points out the lack of "image normalization" in his dataset. I'm surprised he didn't take this first step, but this looks like more of a weekend/toy project than something extremely rigorous.

</comment><comment><USER4> Lighting conditions make this impractical. I clicked on several of the darker brown colors and they all had white people of European origin. In fact, after clicking a while on dark brown I could _only_ find white people!

<comment><USER4> I clicked for a while longer, still only european looking or caucasian people. The only candidate I clicked on that actually was naturally brown was the picture of a chocolate (september 12th 2012). I'm going to stop clicking now, this site is a waste of my time as the underlying technique is proven to be a fiasco.</comment></comment>


Ask HN: How to market a chrome extension? - <AUTHOR> I am looking for resources where I can learn how to market and grow a chrome extension user base. Also interested in looking at any case studies related to chrome extension marketing. <comment><USER2> It feels you're being a bit specific. Look for good marketing advice and the principles are very transferable. E.g. Read 'Ogilvy on Advertising' as a guide on how to communicate your product. The product is largely irrelevant if you understand the method of pitching.

</comment><comment><USER3> I build a MVP cross platform extension bookmark/chat app that used [http://kangoextensions.com](http://kangoextensions.com) \- hope that helps :)</comment>


Azure overtakes Amazon's cloud in performance test - <AUTHOR> http://www.networkworld.com/news/2013/021913-azure-aws-266831.html

<comment><USER2> The first question I always have when I read headlines such as this is "Who paid for it?" I filled in the form for to download the report and it contains the following:

 _Disclaimer

The tests reported upon in this document are conducted by us using our own test tools under test conditions chosen by us. The test conditions were chosen by us to reasonably represent what our customers would experience using our Service with their representative environments and workloads. The tests have been designed by us to only look at the performance aspects of the CSPs that we believe are relevant to our customers – it is intentionally narrow in scope. Nasuni is not in the business of benchmarking CSPs, certifying test results or selling performance metrics. We have attempted to make sure the tests are fair and consistent within our selected parameters and have worked with several of the vendors to confirm our results. Our tests are not meant to indicate performance from each CSP under ideal conditions to the CSP, and, in any event, performance should only be one factor of many in a CSP selection process._

AFTER EDIT:

and from the conclusion (which is worth reading):

 _While Microsoft has secured the leadership position this year, it is quite possible that things could change again next year. In the two years this report has been published, there was a different leader each year._

AFTER EDIT 2:

From the second page of the article:

 _Based on the findings of the report, Nasuni uses both Azure and AWS public cloud resources as part of the company's enterprise storage offering._

If you don't want to fill in a form to read the report, there's an infographic:

[http://www.nasuni.com/blog/193-comparing_cloud_storage_provi...](http://www.nasuni.com/blog/193-comparing_cloud_storage_providers_in)

<comment><USER3> You beat me to it...I was primed to type "How much did Microsoft pay for this review?". That said, I cannot make any direct accusation. But, having been in this industry for >25 years, I did learn long ago to be very leery of such reviews when made by an industry "trade rag". I know from having worked for very large technology companies that, cynicism notwithstanding, reviews in trade rags are indeed often "bought".

<comment><USER2> Indeed, from my quick scan of the report it looks like it was done in good faith. It could be that MS influenced Network World to publish it. Even if I knew they had I'd still be more favourably disposed towards Azure having read this report:

 _Microsoft consistently performed better than the other CSPs in the tests, delivering the best Write/Read/Delete speeds across a variety of file sizes, the fastest response times and the fewest errors. Not only did Microsoft outperform the competition significantly during the raw performance tests, it was the only cloud storage platform to post zero errors during 100 million reads and writes. In those categories where Microsoft was not the top performer (uptime and scalability variance), it was a close second._

In contrast, I'd much more wary of using Google Cloud Storage after reading this.

</comment></comment></comment><comment><USER4> That genuinely doesn't surprise me at all. I've used both extensively and Azure definitely has the edge with respect to performance (and management which is pretty neat).

Also I've had severe reliability problems with S3 over the last couple of years.

Azure support is actually better as well. I've found it very easy to get through to a human unlike when we had a major EC2 problem.

However, I'd pick neither of them if I had to choose and would go with a smaller, old fashioned dedicated hosting company as you are rarely lost in the noise then if something goes bang. Prime example being Azure's reporting services which was dead for nearly an entire week.

<comment><USER5> What kind of problems have you had with S3?

I think we've all been affected by EBS in someway the last couple of years but I've not run into S3 issues.

Could you elaborate?

<comment><USER4> Connection reliability (we upload large files), the .net API is unreliable in the AWS SDK and lots of spurious issues.

We've basically had to implement a retry wrapper around their API.

</comment></comment></comment><comment><USER6> Azure also seems cheaper than EC2 right now. Or at least in a couple of micro instance scenarios I just looked at they are...

I might have to give Azure some time.

<comment><USER7> _Azure also seems cheaper than EC2 right now._

Probably by design, MS has a lot of leeway when it comes to spending thanks to Office, Windows and Enterprise. Amazon's profits are razor thin so MS might be trying to pressure them even more.

<comment><USER6> Maybe, but whatever keeps the market competitive is fine by me. Without Azure then Amazon has no reason to even re-evaluate their pricing.

</comment></comment></comment><comment><USER8> This report is essentially a summary of network connectivity between 3 arbitrarily chosen external client VMs and 5 object storage platforms: AWS S3, Azure Blob storage, HP Object storage and Google developer storage. The results are highly dependent on network proximity between said clients and provider networks. With such a small client test population and no details provided about them (other than that they are on the east coast), I think the findings are inconclusive at best, and cetainly undeserving of these kinds of sensational headlines. Nansuni even acknowledges that the most optimal test conditions for object storage is use of clients within a provider's associated compute platform.

</comment><comment><USER9> There are a lot of things to like in Azure but performance isn't one of them. Disk IO is so dismal for VM's, we benchmarked against OrionVM and Zettagrid and the difference was about 10 to 1.

<comment><USER9> Found it <http://openbenchmarking.org/result/1206086-BY-1103157IV31>

</comment></comment><comment><USER10> If you search hard enough you are bound to find a few vanity tests where your product will beat the competition, im sure Microsoft also have a whole series of searches for Bing that totally own Google.

I dont buy into an isolated test funded by the company who will profit from performing well in it.

<comment><USER11> Have you got a source for evidence that MS funded this test?

</comment></comment><comment><USER2> If you don't want to fill in a form to read the report, there's an infographic:

[http://www.nasuni.com/blog/193-comparing_cloud_storage_provi...](http://www.nasuni.com/blog/193-comparing_cloud_storage_providers_in)</comment>


MyBalsamiq reaches $200,000 in total revenue ($40K/month) - congrats - <AUTHOR> http://blogs.balsamiq.com/product/2012/07/09/22pre/ <comment><USER2> Wonder what they thing about their new competitor? <http://news.ycombinator.com/item?id=4222992>

<comment><AUTHOR> ...what they usually do: work hard on creating (and improving) an awesome product. Peldi always seemed to focus on the product more than on the competition.

myBalsamiq is being developed by a proven team and they have quite some headway in terms of traction and features (in particular the project management features, it's more than a sketch app). Does this mean they will be the only ones making money in that market? No. There's always room for a different take on mockups, but it's going to be tough to compete directly with Balsamiq.</comment></comment>


Coggle.it is amazing tool for organizing pretty much anything - <AUTHOR> http://www.uxd4u.com/software-review/coggle/ <comment><USER2> After looking at the home page a couple of times, I still have no idea what it does.</comment>


Alex Jones Hit with Bans from Facebook and Apple - <AUTHOR> https://arstechnica.com/?p=1353605 <comment><USER2> How did the earlier story get marked as a dupe rather than this one?

<comment><USER3> that's my question?</comment></comment>


Screencast: Demo of Threesome, a 3-way merge plugin for Vim (work-in-progress) - <AUTHOR> http://vimeo.com/25764692

<comment><USER2> One of the best vim plugin interfaces i've seen yet :). This merits a plus. Thinking of using it right away, even if it is not already stable.

</comment><comment><USER3> Oh, great!</comment>


John Hopkins Covid Data Errors - <AUTHOR> https://github.com/CSSEGISandData/COVID-19/issues/804 <comment><USER2> Without more info, I would assume data repeated is just data not being reported on a given day, and it will be corrected the next time it's reported. Of course it could be a mistake, but personally I think it's a mistake to assume that this data isn't already off by like 10x in number of actual infections. This is the "confirmed" cases being reported, but we know for a fact already that lots and lots of people have been refused tests, or didn't have access to tests, or didn't show strong enough symptoms to care, or any number of other reasons. There's absolutely nothing wrong with reporting it and trying to fix it, but I wouldn't get too hung up on slight glitches in the reporting here when the source as a whole has a _lot_ of error. (I'm referring to, for example, the comment complaining about accuracy being super important because people are panicking.)

</comment><comment><USER3> Using the last know correct value is not more wrong that posting zero or NULL.

Not updating it when they could would be problematic but there is allot going on, maybe give them some breathing room.</comment>


AMA: Bill Gates - <AUTHOR> https://www.reddit.com/r/IAmA/comments/aunv58/im_bill_gates_cochair_of_the_bill_melinda_gates/ <comment><USER2> >I have not written code in a shipping product for a long time but I do write enough code to understand the new tools like Typescript or Github (shameless Microsoft plugs).

Cool to see he still tries to stay up to date on new technologies.

<comment><USER3> You left out the part of that comment where he solved the tabs v spaces war.

<comment><USER4> You left that out, too :-). For anyone else wondering what his answer is:

> I actually do use tabs. It is easy to convert tabs to spaces and vice-versa > so we shouldn't waste too much time on this issue.

</comment></comment></comment><comment><USER5> Do people derive pleasure from these AMAs? Gates seems to reply with the same platitudes and non-answers to the point where its hard to tell if it's him or the BMGF publicist.

<comment><USER6> I skimmed the AMA for a few minutes, and saw him say that:

\- He thought nuclear weapons, bioterrorism, and climate change were the biggest threats to humanity.

\- He thought paying $10B in capital gains taxes was not enough and he should have paid more.

Maybe those are platitudes but it's real enough for me.

<comment><USER7> _He thought paying $10B in capital gains taxes was not enough and he should have paid more._

I'm always annoyed when rich people say things like this. I had one say almost this exact thing to me in an elevator once.

 _There 's nothing stopping him from paying more._ He just writes a check to "Department of the Treasury" and sends it off to D.C. Problem solved.

But then he doesn't get to passive-aggressively whine about all of his piles of money that the government won't take from him.

<comment><USER6> It's really, really simple, to the point where I suspect that most people that make the argument you are making are being disingenuous.

Bill Gates is willing to pay more taxes if other billionaires pay more taxes. If they don't, he isn't.

Just like I think _my_ taxes should be higher, but I'm not going to voluntarily pay higher taxes, unless others in my tax bracket also pay them.

Even chimpanzees would probably understand and disagree with you [1].

1\. [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4451566/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4451566/)

<comment><USER8> > Even chimpanzees would probably understand and disagree with you

I think it's important to stress the practical side of the argument too, rather than just appealing to intuitions of fairness.

Bill Gates probably believes (and is probably correct) that for any sum of money he is willing to part with, he could do more good by directing it toward carefully selected philanthropic causes than by donating it to the government. So when acting alone, there's no reason for him to unilaterally pay extra tax, unless he believes it will have very good indirect effects and/or is just seeking a PR boost.

He also believes that if people in his class (including him) paid much more in taxes than they currently do, the world would be a better place than it is now.

These two beliefs are entirely consistent, for at least two reasons:

* For a lot of people in his class, the likely alternatives are not philanthropy vs. taxes, but non-altruistic spending vs. taxes.

* There are, at least arguably, some things that government is better suited to doing than private charities are. Perhaps these tend to be the kind of large-scale projects that could be funded by higher taxes on all super-rich people, rather than anything that would result from a donation to the government by a single billionaire.

Even if your opinion of government is very low and you disagree with the second point, the first should be enough to show that his position is perfectly consistent, and would be even for someone unrealistically altruistic and willing to be on the wrong end of an unfair situation.

</comment></comment></comment></comment></comment><comment><USER9> Hot take: Bill Gates is massively underrated today, compared to how he will be viewed by history.

When the reckoning of history books happens, I could see him in the running for "most positive social influence of anyone 1800-2100".

His humanitarian work is second to none and we can expect 20+ more years of his direct influence on global policy. The world is a better place thanks to Mr and Mrs Gates.

<comment><USER10> Not really. You look at Andrew Carnegie who has a similar history, and even a hundred years out, no one cares. People like Einstein and Picasso are who lasts. No one really gives a shit about businessmen, regardless of their philanthropy.

<comment><USER11> Carnegie was worth only $5 billion in inflation-adjusted dollars. Gates is worth $100 billion, so we can expect him to have a philantropic impact 20 times greater.

<comment><USER12> $372 billion for Carnegie in 2014 dollars: [http://money.com/money/3977798/the-10-richest-people-of- all-...](http://money.com/money/3977798/the-10-richest-people-of-all-time-2/)

3x gates.

<comment><USER11> They don't calculate his net worth correctly. They calculate his worth based on a percentage of GDP.

If you actually do the math based on an inflation calculator, you find $5 billion: [https://www.forbes.com/sites/chloesorvino/2014/07/08/whats-b...](https://www.forbes.com/sites/chloesorvino/2014/07/08/whats- become-of-them-the-carnegie-family/#16614d9e7b55)

</comment></comment></comment></comment></comment><comment><USER13> Can anyone point to a list of problems the Gates foundation has solved through program(s) it has funded?

Edit: took out some things about Gates and the dual nature of his work at Microsoft and the Gates Foundation.

<comment><USER14> it's almost like you've never read a single thing about the organization. nearly every annual letter and report details their impact.

<comment><USER15> Please follow the site guidelines when posting here. Your comment would be fine with just the second sentence.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment><comment><USER16> is there a way to be notified about upcoming AMAs on reddit?

<comment><USER17> Here is a link to a Google calendar created by the IAmA team. Not sure how often it's updated, I assume as they get arranged

[https://calendar.google.com/calendar/embed?src=amaverify@gma...](https://email@example.com&pli=1)

<comment><USER18> IAmA mod here - we have a bot that updates it every time a guest schedules a new AMA, so it should always be up to date. We also manually add events in as they come from other sources.

Bill likes to do his AmA's as "surprises", though, so we don't usually schedule those!

<comment><USER16> thank you guys

</comment></comment></comment></comment><comment><USER19> I wonder, if Gates was still driving Windows development would Windows 10 still spy on users and restrict their ability to control updates like it does with Nadella at the helm?

<comment><USER20> Automatic updates are a good thing, otherwise far too many machines would be lagging behind on security fixes.

<comment><USER21> Can we stop this tired rhetoric? Yes ideally everyone would keep their system up to date 100% of the time, however it is not a good thing that users have that control stripped away from them, especially when these updates can actually have _adverse_ effects on their systems _cough_ randomly deleting files _cough_.

I may disapprove of users not updating their systems, but I'll defend to the death their right to not do so.

<comment><USER22> You can already do that. Buy the business edition. Or use Linux and run windows in a VM. Or block the windows update system in one of a million ways including firewalling it. If you are really such a power user, you can do what you want already.

For the millions of others people who don't know how to find facebook without putting it into google search... yeah the automatic updates are _good_ for them, and I'm tired of power users thinking their opinions are the only ones that matter.

<comment><USER23> Do you know where can I buy one license of the business edition?

I recently purchased a Pro license and couldn't find this "LTSB" (I believe it's called) version.

<comment><USER24> It's called Windows 10 Enterprise LTSC 2019 (there was a 2016 version as well). Without getting into the Byzantine nature of Microsoft licensing for their enterprise products, I recommend you just use local group policy to set the 'defer updates' option and put yourself on the Current Branch for Business release track in your current Windows 10 Pro.

</comment></comment></comment></comment></comment></comment><comment><USER25> I feel like every other month Gates guest edits the Verge or has an interview there. Or I see his annual letter all over LinkedIn, or an AMA...

He gets so much exposure I imagine because he's a "good billionaire trying to fix the world." I guess it's the most we can hope for these days from our growing class of ultra wealthy, but I really don't think that means they should get the right to shout their opinions at us from every corner of the web.

<comment><USER26> You'll be surprised how many people ignore Gates Foundation's deep involvement on ending Polio

<comment><USER7> It's at least as any as the number of people who ignore the way George W. Bush is hailed as a hero for his work stemming the tide of AIDS in Africa.

[https://abcnews.go.com/blogs/politics/2013/04/george-w- bushs...](https://abcnews.go.com/blogs/politics/2013/04/george-w-bushs-legacy- on-africa-wins-praise-even-from-foes/)

<comment><USER27> His ledger is still in the red.</comment></comment></comment></comment>


PRISM is not the problem - <AUTHOR> https://medium.com/i-m-h-o/343b5d6c2da0

<comment><USER2> I agree but only to a point. I actually have a piece on my blog I will be submitting here today which discusses the idea of a PKI for the current threat model (resourceful organized crme and secret government surveillance. I have an idea for how to build a PKI to help combat these and laid my ideas out there.

But what is relevant for this discussion is that one of the goals has to be to increase the effort of a security compromise and reduce the value of one. Nothing is going to stop a government official spearphishing a target with an appropriate warrant, but if you can force the issue to that level of attack, and if you can make sure that the endpoints and only the endpoints are where compromises are vulnerable to sustained secret attacks, then maybe we have a chance. (It also means it is a lot easier to serve a warrant on the related computers rather than evesdropping silently in the middle.)</comment>


If PHP were British - <AUTHOR> http://www.addedbytes.com/blog/if-php-were-british/ <comment><USER3> As a Brit living in the US I'm getting a bit tired of the strange fascination you guys have with everything British.

Yes, it was fun at first being asked to say all sorts of words which sound so funny to you guys. Convincing the more provincial of Americans that yes, we do in fact get to meet the Queen for a cup of tea on occasion and yes, she is a very nice lady.

But when I see posts like this I can't help but be reminded of a tired old joke that no-one thinks is funny anymore but they keep on telling it anyway because they don't know how to stop.

Or perhaps I'm just being a grumpy old sod. We're famous for that too.

<comment><USER4> I'm also a Brit living in the US, and honestly, I'd say just have fun with it in return. I have, variously:

\- Told people my name is Rupert, Tarquin, or Archibald (no-one will question it for fear of sounding rude- doubly so because they think we're very particular about manners)

\- "Where are you from?" "Iowa." "Oh..."

\- "Harry? Oh yeah, good lad. Bit racist but what are you going to do"

And so on, so forth. I certainly don't begrudge an interest in all things British, because it's preferable to the situation Americans often find themselves in when abroad, where they're considered cheeseburger eating morons.

Just think- they _could_ all be asking you when your last football riot was.

<comment><USER5> > Harry? Oh yeah, good lad.

Surely, that should be "good old chap", if P.G. Wodehouse taught us anything ;-)

</comment></comment></comment><comment><USER6> On a related note, perl happily let's you subclass the language to the dialect of your choosing. Here's Australian (ie "strine")

[http://search.cpan.org/~simonw/Acme-Lingua-Strine- Perl-0.54/...](http://search.cpan.org/~simonw/Acme-Lingua-Strine- Perl-0.54/Perl.pm)

or perhaps you prefer to program in Nigerian Spammer?

[http://search.cpan.org/~jwalt/Acme-Lingua- NIGERIAN-1.0.0/NIG...](http://search.cpan.org/~jwalt/Acme-Lingua- NIGERIAN-1.0.0/NIGERIAN.pm)

<comment><USER7> Or Latin: [http://search.cpan.org/~dconway/Lingua-Romana- Perligata-0.50...](http://search.cpan.org/~dconway/Lingua-Romana- Perligata-0.50/lib/Lingua/Romana/Perligata.pm) [http://www.csse.monash.edu.au/~damian/papers/HTML/Perligata....](http://www.csse.monash.edu.au/~damian/papers/HTML/Perligata.html)

I mention this because this is no mere regex "rename the keywords" exercise either, but a decent attempt at really making Perl work in grammatical Latin.

</comment></comment><comment><USER8>
        would_you_mind {
            // Code here
        } actually_i_do_mind (Exception £e) {
            // Politely move on
            cheerio('Message');
        }

amazing

<comment><USER9> actually_i_do_mind is a tad confrontational. If I might suggest:

        would_you_mind {
            // Code here
        } sorry_im_afraid_that_might_present_something_of_a_challenge_right_now (Exception £e) {
            // Politely move on
            cheerio('Message');
        }

<comment><USER10> Better if it was

      would_you_mind {
      // Code here
      } i_cant_be_asked (Exception £e) {
      // Politely move on
      cheerio('Message');
      }

<comment><USER11> I think you may have been mishearing <http://en.wiktionary.org/wiki/arsed>

<comment><USER12> Yes. I've heard a few stories of foreigners getting that wrong when working in the UK. Suffice it to say that, "I can't be arsed" is not a great thing to say to your boss.

</comment></comment></comment></comment></comment><comment><USER13> If they made it British it would probably have one of the best queuing mechanisms as well.

<comment><USER14> Said someone who's obviously never gone through the immigration line at Heathrow... The most disorganized, slow, and unfair queue I've ever been in:(

<comment><USER15> But are people in that line all British? If not, then is just proves the point.

<comment><USER16> The fact that British are good at queuing (they're not) wouldn't imply that they're good at organising queues (again, also not true).

</comment></comment></comment></comment><comment><USER17> <http://spiffingcss.com/> deserves a mention here "the preprocessor made for Brits"

No more scratching heads when things like the following don't work:

#id {

      text-align: centre;
      text-transform: capitalise;

}

:)

<comment><USER18> I see center and meter so much I often get confused when I'm required to write them correctly!

<comment><USER19> Having lived in the US for a few years (but now back in the UK) I get confused by many of the UK/US spelling differences. Not the -ise/-ize or colo[u]r type stuff, but things like "tyre/tire", "centre/center", "litre/liter", etc. It'll eventually sort itself out I suppose.

<comment><USER20> Pity us Canadians, then. We use a pseudorandom mixture of the two. There are, apparently, rules, but they change weekly and there is something in the Statute of Westminster that forbids any discussion of them. No two Canadian English spelling dictionaries agree on anything, nor do any of the style guides. We just carry on and hope that no more than 30% of our Canadian readers think we're idiots on any given day.

<comment><USER16> Someone with one watch always knows the time, but someone with two watches is never quite sure…

</comment></comment></comment></comment></comment><comment><USER21>
      "Parse error: syntax error" -> "You taking the piss, mate?"

Because that's British manners too.

</comment><comment><USER22>
      Yes, connexion.

No, connexion. From the Wikipedia article he links:

      The spelling connexion is now rare in everyday British usage.

<comment><USER23> If you know of any good en-US <-> en-GB references, please let me know!

I manually went through half a dozen dictionary files - all of them were terrible, full of things like "connexion", and even words that haven't been used since Chaucer's time. The online dictionaries aren't much use either, all the American ones are wrong, and the OED is far too out of date to be of any use (Britain is absorbing a lot of American words and spellings at the moment)

Edit: And let this be a lesson to anyone else trying to localize a website from en-US to en-GB: Every reference you have to hand is wrong. If you don't get an actual British English speaker to look over it, we will laugh at you.

Edit2: Dug up some of my notes from an en-GB <-> en-US dictionary file we attempted to use:

We don't use "gaol" or "gramme" anymore

"Ton" and "tonne" are different measurements, not translations of each other

"Practise" and "practice" are not interchangeable

"Check" cannot be globally replaced with "cheque"

"Terrorise" is not and has never been a word

<comment><USER24> > "Terrorise" is not and has never been a word

Really? That's how I've always spelt it.

<comment><USER23> I just looked it up again to be sure, and I am slightly mistaken. OED has both forms in use in the 1800s and early 1900s, but all usage examples from the second half of the 1900s onward is -ize only.

</comment></comment></comment></comment><comment><USER25> Looks to be down, here's the cache: [http://webcache.googleusercontent.com/search?q=cache:Fdewfzb...](http://webcache.googleusercontent.com/search?q=cache:Fdewfzbi- ZkJ:www.addedbytes.com/blog/if-php-were-british/&hl=en&gl=us&strip=1)

</comment><comment><USER26> Fun fact, only about 4% of english speakers are english.

I know this article is tongue in cheek, but I like to roll that out when one of my fellow brits goes on a rant about american english.

Me personally, I go with the american spellings all the way.

<comment><USER4> Another fun fact- the "z" spellings are actually the original. After people left for America, all things French became fashionable, including spelling. A favourite of mine to pull out when a fellow Brit is spouting language-hate.

(I still use the "s" spellings, though)

<comment><USER27> Ask them what the official national language is of England as well. ;-)

<comment><USER28> What is it? I looked it up hoping to be surprised and all I found was that it's supposedly English (no surprise) and that Polish is now the official second language apparently. Even Wikipedia didn't help. <http://en.wikipedia.org/wiki/Languages_of_the_United_Kingdom>

I'm really curious now, please tell us the answer.

<comment><USER27> England doesn't have an official language (or maybe it was the UK), neither does the US.

</comment></comment></comment></comment></comment><comment><USER29> Love it, if only PHP were like this. My favorite is definitely the catch block, sorry, would_you_mind block!

<comment><USER30> actually_i_do_mind cheerio :)

</comment></comment><comment><USER31> I made a similar thing for my French company: Javascripte - Un langage pour les vrais JavaScripteurs. [https://github.com/mrspeaker/javascripte/blob/master/index.h...](https://github.com/mrspeaker/javascripte/blob/master/index.html) It's JavaScript in French (made with Sweet.js macros). All programs are required to commence with "Bonjour Ordinateur".

<comment><USER32> I was half expecting this from a fellow 'cheese-eating surrendering monkey' (British derogatory term for my country folks). XD

</comment></comment><comment><USER33> This article pops up every few months, but I still love it every time.

      cheerio('Message');

</comment><comment><USER34> Right, now try PHP in Cockney rhyming slang.

<comment><USER35> You beat me to it.

</comment></comment><comment><USER36> An oldie, but goodie.

</comment><comment><USER37> <https://news.ycombinator.com/item?id=2906480>

<https://github.com/dzautner/British-PHP>

</comment><comment><USER38> I read HN every day. And yet, somehow, I miss my own work appearing here. Typical. I was probably too engrossed in drinking tea and eating scones to see it.

</comment><comment><USER39> This is worth a patch to PHP core... not that it would get accepted.

<comment><USER40> Why wouldn't they accept localization efforts? ;-)

<comment><USER41> I am of an opinion that it should be an option for people who really want it, but it should not be an acceptable industry practice to write code/comments in a language other than English. Latest example of this is the official Sony PSM SDK, which has half of its documentation and code comments in Japanese. So now Sony has to pay somebody to actually translate it, instead of simply insisting on their Japanese programmers using English in the first place, which I am pretty sure they are perfectly capable of. The same situation with the official PS3 SDK - but that was released more than 7 years ago now,so I doubt that they will ever fix it. And that's a product for which you have to pay serious money as well, so it's completely unacceptable.

<comment><USER42> Have you ever tried to work in a language other than your own? It's non- trivially harder. Also, Sony sell their SDK in several countries - <USER2> translate it into English, rather than say, Spanish (or insist they use English, rather than Spanish).

<comment><USER41> Of course I have, English is not my native language and all of my code and all of my comments are in English. I frown upon people who write comments in my own language in the code, I see it as not professional.

And insist on using English, because most programming languages are in English. It is defacto standard for programming and computers in general, and I am not discussing it - it's just how it is. Therefore selling a commercial product and providing documentation only in Japanese is a massive oversight on Sony's part.

</comment></comment></comment></comment></comment><comment><USER43> Please tell me someone has implemented most of the control structure stuff as a DSL in Ruby. I would find that a most hilarious prank.

</comment><comment><USER44> O that someone would create a preprocessor so I can write like this - it would be spiffing!

</comment><comment><USER45> perchance...otherwise is awesome.</comment>


Information Theory: Obstacles To True Artificial Intelligence - <AUTHOR> http://paulbohm.com/articles/artificial-intelligence-obstacles-information-theory/

<comment><USER2> While I believe the author is not wrong in his argument that information theory is a bound on machine intellignce, I think the problem with using information theoretic bounds is that it is not a tight bound. In other words, I don't think information theory is currently the limiting factor.

The author argues that any AI will consist of two parts, the machine learning program L and the training set T, which combine to form the "intelligent" program M. And thus by information theory, k(L) + k(T) >= k(M) [where k is the kolmogorov complexity]. Thus M is bounded by the information in L and also bounded by T. The author argues that since these both depend on humans supplying them, we are limited by the human factor.

But how much information does one really need for AI? Well, how much information is necessary for human intelligence? Assuming that L is our genome (ignoring epigenetics), and T is our life experiences. The amount of data in our genome is on the order of around 3gb. I would argue that's certainly within the realm of feasibility for programmer's output. How about the training set T? That's harder to say; does it include video, audio, touch, etc? How many years until a human is considered intelligent (by AI standards)? I think it's safe to say that a 10 year old blind human could pass a Turing test. So if we ignore tactile and olfactory feedback, we basically just need 10 years of compressed audio as the training set. Generously encoding the audio at 128kbps 24/7 for 10 years = 4.7 terabytes. Which is easily within the realm of current machine learning. We have far more information than that (and much more densely encoded as text), but still aren't close to True AI.

I think the problem is not that we don't have enough Information, I think it's that we have not yet searched enough of the problem space. And that's where more hardware can help us.

<comment><AUTHOR> as per <http://paulbohm.com/pdf/10.1.1.76.5543.pdf> and <http://paulbohm.com/pdf/general_limitations.pdf> learning by example requires many more examples than the kolmogorov complexity of the target concept.

T then is not just the life experience of one human - to learn from observation by example, to reconstruct a human, you'd need to observe the life experiences of trillions and trillions of humans to gain sufficient information about humans to narrow down the possible implementations that match human behavior not just mechanically given the same input, but also given new previously untested input.

at 3gb encoded as dna the search space already is huge, but that ignores that the genome alone doesn't contain the information needed to read it. (e.g. you need a living thing to use the DNA, for it to make sense)

<comment><USER2> Well I guess I have some citations to read later, but intuitively I just have a hard time believing that lack of training data is the problem. There's so incredibly much data available on the internet. If that was the limiting factor, it would just be a matter of throwing more data at T to increase the amount of information in M, but that doesn't help if we haven't found the right machine learning algorithm L. And searching that space is the real challenge of AI. To search that space we either need human experts, huge amounts of computational power to brute force, or some combination thereof. We've tried human experts alone for decades, without much success, so I think it's likely that we will need some computational assistance to find the right algorithms. That's why AI people love throwing around graphs of Moore's law.

<comment><AUTHOR> not if the amount of training data required to learn by example is exponential or even combinatorial. we might not even be in the same ballpark. all data ever recorded on digital media might not be enough to learn even a simple intelligence without assumptions about structure.

a kind of analogous problem is: can you learn how to build a living thing purely from digitally recorded DNA samples, if you don't have access to the internal structure of any living thing? How many dna samples would you need?

</comment></comment></comment></comment><comment><USER3> As an AI researcher, I've often been asked when I think we will have sufficient computational power for strong AI. I always answer, "About ten years ago." And I've been giving that answer for over ten years. I agree with the author that AI is a software problem rather than a hardware problem. But I think he misformulates the limitations. In AI, the issue isn't whether we can brute force a particular transformation (that is the ML approach), it's whether we can create a self-organizing _system_ that recognizably approximates human cognition. Growing a redwood versus trying to build one, so to speak. Not an easier problem, but a different one whose limitations have not yet been defined.

</comment><comment><USER4> This seems to be the core of the argument:

 _To get a better model, we either need make the learning algorithm more complex/write more code (which is human work), or we need to gather more or better sample data (which requires human work as well)._

Assuming this is a correct formulation, I don't see why this necessarily poses problems. The gathering of data in particular seems like a process that can be supercharged. You aren't restricted to one human speaking into the computer's ear. You have (to start) the entire internet to consume. If you want/need more structured data, you could hypothetically organize dozens or hundreds of individual humans processing information for the 'mind'.

And once the AI has reached some valuable state, you can then start cloning it (presumably a simple process of copying electronic state elsewhere). The one or more limited AI's you've created could then be tasked with generating the next step up the chain - even if that is simply learning to process and ingest ever vaster amounts of information.

I'm not a wild-eyed futurist, but I either don't get or don't buy the fundamental objection here.

<comment><AUTHOR> author: there's no fundamental objection. i'm only pointing out that throwing faster computation at the problem doesn't necessarily solve it. right now all the work essentially needs to be done by humans.

If you follow the link to the lower bound to learning by example, you'll see that it's really hard to learn by example if you haven't pre-encoded ideas about the interpretation into the reading program. Without prior knowledge, you need lots and lots and lots of examples.

All the information that humanity has ever stored on digital media is likely not remotely enough to reconstruct a human mind from.</comment></comment>


How to manipulate standards - <AUTHOR> https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein

<comment><USER2> Seems to be down

<comment><USER3> Here's a PDF link to the slides: [http://cr.yp.to/talks/2015.05.08/slides- djb-20150508-a4.pdf](http://cr.yp.to/talks/2015.05.08/slides- djb-20150508-a4.pdf)

<comment><USER4> I went over this and I feel like I need a little context to understand exactly what this is besides some guys ramblings about Verizon. Or is this an official document "leaked" from Verizon?

<comment><USER5> It seems that DJB went a bit too far with his sarcasm. Or it's not entirely clear from the slides alone.

</comment></comment></comment></comment><comment><USER6> Uh... How long is this guy planning to keep his job?

EDIT: I'll leave this up as a reminder to myself that my disbelief needs to be given greater weight...

<comment><USER7> djb? Probably a while; after all, he does have tenure...

<comment><USER8> FYI, I can no longer reply to this thread ( [https://news.ycombinator.com/item?id=9517903](https://news.ycombinator.com/item?id=9517903) ), but you can email me at my address in my profile if you are still interested in a reading list.</comment></comment></comment>


Ratio of interviews to accepteds and how are groups picked - <AUTHOR> Does anyone know how many groups are invited to interviews relative to the number that are accepted?  Is it something like 2 to 1?
I am also just wondering what kind of system is used to pick groups.
Is it like Reddit where all the partners can up-vote or downvote?
Is it like the United Nations where the founders have veto powers?
Is it like American Idol by the sum of votes or is it more like X-factor with three X's and you're out?
It would be interesting to find out what system they use to pick. <comment><AUTHOR> I just saw a YouTube video where Michael the CEO mentions that only 25-30% of groups interviewed actually are accepted.</comment>


Show HN: TransomJS – Rapidly Develop REST APIS on Node Using TransomJS - <AUTHOR> https://transomjs.github.io/ <comment><USER2> Is it possible to generate an api with transom from my swagger.json?

<comment><AUTHOR> Sorry, It's not. We are however, considering to go in the opposite direction, to produce a swagger.json from the loaded plugins & configuration. That would give users a nice way to explore their API and quickly see the result of various changes to the loaded config.</comment></comment>


I Was a Russian Facebook Troll Named Martha - <AUTHOR> https://spectrum.ieee.org/view-from-the-valley/telecom/internet/i-was-a-russian-facebook-troll-named-martha <comment><USER2> People criticize Facebook (and others) about doing too little about Russian and other propaganda. But if we want to think about why FB does that, we should study the image in the mirror.

The same people are highly active and effective on HN. Every discussion of Russia or China is dominated by the standard propaganda talking points: 'there's no evidence of X', for any X; and 'the U.S. does it too'.[0] As a result, on certain issues HN discussions are propaganda (expressed civilly, to stay within the rules) and no substantive discussion takes place on probably the most important issue in the history of the IT industry. The purpose of propaganda is exactly that - not to persuade but to paralyze.

HN's main response, AFAICT, is to ban users from saying that any comment fits the propaganda profile; this rule perversely protects the propagandists and it shuts down people who oppose them and want substantive discussion, all in the name of keeping things 'civil'. It's capitulation to the power of the propagandists - they won; just cede them the ground in order to avoid the unpleasantness of a fight. Again, the outcome is propaganda expressed civilly and no substantive discussion (and the discussion that exists is boring, meaningless, and endlessly repetitive). I'm not saying it's an easy problem; I'm saying we should look in the mirror in order to understand Facebook.

[0] For example, currently there are 4 top-level comments in this discussion, all of which fit that profile.

EDIT: Some minor edits

<comment><USER3> I mostly agree, but there is a better justification for HN's rule, offered by its mods: [https://hn.algolia.com/?query=by:dang%20astroturfing&sort=by...](https://hn.algolia.com/?query=by:dang%20astroturfing&sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0), I think it's not as perverse as you think.

<comment><USER2> > there is a better justification for HN's rule

I'm aware of that. I wasn't talking about the justification but the outcome. I'm certain dang and sctb don't want the propaganda here either; my point regarding the HN rules is that the well-intentioned policy ends up protecting propaganda. They have a real problem; the propagandists are gaming their system of civility.

</comment></comment></comment><comment><USER4> It's pretty strange that the term used is 'Russian Troll', when there's next to no evidence that Russians were involved, as well as no evidence that the compromiser's goal was 'Trolling'. This article has basically no content and just seems like clickbait.

<comment><USER5> Except that this is a common behavior for "Russian Trolls". So common, that an old account getting compromised and starting to engage with people in Russian is very likely to start spreading Russian propaganda at some point.

</comment></comment><comment><USER6> This is kind of amusing, but in the grand scale of things, does anyone think that propaganda is a new thing? When I was a kid and Russia was the great red threat, propaganda was par for the course. Why should it be any different now?

The amount of news on foreigners hacking US based companies is not surprising, but based on the Snowden revelations, the US is doing it right back. Why does it seem like everyone is up in arms over just Russia?

<comment><USER7> >Why should it be any different now?

Right now propaganda is exploiting the edge between old media and new. Apparently a lot of people have trouble telling if a news source or comments from fellow citizens are real. They're used to a world where faking a news story or getting a shill close to you took a lot of time and effort so 'trust by default' made more sense.

>Why does it seem like everyone is up in arms over just Russia?

Because you're probably viewing western-based news sources? People tend to focus on things that affect them and this is affecting the west right now because that's who Russia is targeting. Nothing magical about it.

<comment><USER6> > _Apparently a lot of people have trouble telling if a news source or > comments from fellow citizens are real._

Wouldn't that even apply to this news story?

> _Because you 're probably viewing western-based news sources?_

Years ago I started the habit of reading both CNN and Foxnews, and I try to do the same with global news as well. Which is why the Syria fighting, the immigration issues, Russia and elections all seem to be treated one sided no matter which source you look at.

But despite this, CNN and Fox will make some odd changes lock-step, but not international news in the same way. But you'd only notice this if you have a habit of looking at all sides.

</comment></comment></comment><comment><USER8> "Russian" \+ "Facebook" in the title sounds like something about political content, while there's nothing in the article about that.

</comment><comment><USER9> TL;DR A dormant FB account gets highjacked, but the amateur thief forgets to change the email associated with the account. This allows the owner to deactivate the account.

I doubt the authors conclusion about russian troll though: a FB account highjacked by somebody using Cyrillic can be utilised for various purposes.

</comment><comment><USER10> Author gets her ancient Facebook account hacked.

Person in control then sets new name, profile picture and makes two friends ("one in the Ukraine, one in Tanzania").

That's all.

There is nothing to suggest this being related to what the media stupidly calls "Russian Trolls".

End of story.

In other words, total rubbish of a weak attempt of exploiting the TEH RUSSIANZ boogieman by making up a story.

<comment><USER11> ^ Russian troll</comment></comment>


Google's Whitehouse petition reaches required 100k - <AUTHOR> https://petitions.whitehouse.gov/petition/reform-ecpa-tell-government-get-warrant/nq258dxk?successful <comment><USER2> I'm astonished that the heightened 100k requirement is given such short notice and that an organization such as Google was only barely able to make it on an issue like this.</comment>


Cesium – An open-source JavaScript library for 3D globes and maps - <AUTHOR> http://cesiumjs.org/ <comment><USER2> For those not familiar with WebGL community. Cesium guys are the key contributors to the whole WebGL ecosystem. They for example are main authors of the glTF standard for delivering 3D assets optimized for the browser (adopted by many engines). Also the main reference book that gathers community knowledge 'WebGL Insights' is edited by the Cesium founder.

</comment><comment><USER3> Don't mean to hijack, but if you're interested in 3D globes (and 2D projections), NASA has been working on porting World Wind to Web:

[https://github.com/NASAWorldWind/WebWorldWind](https://github.com/NASAWorldWind/WebWorldWind)

and

[http://webworldwind.org](http://webworldwind.org)

The power of WebGL is awesome!

<comment><USER4> It isn't really fair to posters of a neat open source project for the top reply to be a hijack pointing people at a competing project, even if it does say "don't mean to hijack."

<comment><USER3> I totally agree and Cesium is a really cool project and I encourage people to check it out (the number of interesting applications they showcase is really impressive). Just proud of what our team has come up with and wanted to share.

<comment><USER5> That sounds like a ShowHN would be a better fit than a comment.

</comment></comment></comment></comment><comment><USER6> This is from the same people that make Systems Toolkit (STK), which is well- known and used a lot in the space industry. They know what they're doing.

</comment><comment><USER7> I used Cesium.js for a visualization project for one of my clients a few months back and was pleased at how well the engine was designed. As someone interested in globe-based graphics rendering, I found a lot of interesting insights in the book the Cesium developers wrote, "3D Engine Design for Virtual Globes":

[https://www.amazon.com/3D-Engine-Design-Virtual- Globes/dp/15...](https://www.amazon.com/3D-Engine-Design-Virtual- Globes/dp/1568817118)

</comment><comment><USER8> Note for anyone using HTTPS Everywhere: The demo currently doesn't work over HTTPS, due to '[http://cesiumjs.org/Cesium/Build/Apps/CesiumViewer/index.htm...](http://cesiumjs.org/Cesium/Build/Apps/CesiumViewer/index.html') being served over HTTP.

</comment><comment><USER9> A related effort is Terria which uses both Cesium and Leaflet for 3D and 2D mapping. Kevin Ring contributes to both Cesium and Terria.

[https://github.com/TerriaJS/terriajs](https://github.com/TerriaJS/terriajs)

[http://nationalmap.gov.au/](http://nationalmap.gov.au/)

</comment><comment><USER10> Does it handle the usecase where KML has tracks that cross the -180/+180 latitude boundary?

<comment><USER11> Been there. I feel your pain.

</comment></comment><comment><USER12> This seems like it would work really well to transition users from Google Earth and other closed-source globes to more open data sources. Specifically, this would be hugely valuable for developers in the military, disaster response, and intelligence communities and opens up the possibility for more quickly prototyping geospatial "Common operating pictures"

That said, as a day-to-day developer short of star mapping or orbits I'm not sure I prefer the globe format to a flat earth projection. Cool to see this open source and I'll definitely keep it in mind.

<comment><USER13> Cesium does have a flat earth projection built in as well (there's a wireframe globe in top right of main page demo, and clicking it allows you to switch between 3D and 2D).

</comment></comment><comment><USER14> Holy shit this is smoother on my iPhone than scrolling is on most websites on my laptop O.O

</comment><comment><USER15> Very cool! Couldn't find a way to generate a link to a direct spot on the map, but if you go to Kennedy Space Center you can see the shuttle external fuel tank and booster rockets on the pad (no shuttle though).

</comment><comment><USER16> Does anyone know of published data indicating the rate of support for advanced(ish) WebGL like this among everyday consumers?

I realize it's a bit of a vague question but would be grateful if anyone had some insight.

<comment><USER17> [http://webglstats.com/](http://webglstats.com/) is great.

<comment><USER16> Wow, this is phenomenal.

</comment></comment></comment><comment><USER18> This would be cool for a tiny world globe project I have with longitude and latitude . I wonder how I could make use of this

</comment><comment><USER19> The demo link in the hero image didn't work for me, but the links to community projects further down the page did.

</comment><comment><USER11> This is awesome. I am going to try and hook this up to our geoserver instance via WMS

</comment><comment><USER20> This is excellent.

Pinch and zoom doesn't seem to be quite right on iOS 10.

</comment><comment><USER21> Didn't show in latest chrome

</comment><comment><USER22> Crashed Browser Didn't Read

<comment> maze-le Same here, I think it has something to do with WebGL

<comment><USER22> One of the reasons why I fired my bizdev guy was that he didn't see there was a problem with Linkurious not using their own product on their own web site. (i.e. Linkurious uses WebGL)</comment></comment></comment>


Random realities of programming - <AUTHOR> http://clemesha.posterous.com/7-random-realities-of-programming

<comment><USER2> "Projects will take either 3 times as long or 10 time as long - which is exactly the time it takes you to become disinterested, and interested in your next project."

In the forward to the 1995 version of the Mythical Man-Month, Fred Brooks talks about the axes of expanding a software program. On one axis you go from a program to a "programming product", and that takes 3x effort. On the other axis you turn a program into a "programming system" and that takes also takes 3x effort. To go from a "program" to a "programming system product" takes 9x effort.

So I was struck by how close the numbers were.

<comment><USER3> Sorry for being such a pedant but I really can't stand to see more misspellings of foreword. It's "foreword", everybody, not "forward", not "farward", not "forword", not any of the thousand uglier varieties I've lately run across, sometimes even in published (and supposedly edited) books.

<comment><USER2> Apologies, it was a typo. I know how to spell it.

</comment></comment></comment><comment><USER4> #6. Oh the shame.

Mine's called "support" (.pm, .c, .py etc)

<comment><AUTHOR> No shame man, we're all in this together.

</comment></comment><comment><USER5> 8) Software is never finished. It is abandoned. ~Corey Sanders

<comment><USER6> My code isn't "released" so much as "escapes".

Also, #1 used to be true, but nowadays I'm more often amazed that people use technology Y, when clearly _everything else_ is better. Even starting from scratch.

</comment></comment><comment><USER7> I am glad to see I am not the only one constantly confusing useradd and adduser.

<comment><USER8> I always remember because I associate easier/proper grammar with user friendliness: "adduser" is proper and runs the prompt-based script for adding users, whereas useradd is the unix command that goes along with userdel and usermod, etc.

<comment><USER9> Heh, thanks for the tip, we'll see if that works for me next time. I am definitely one of the adduser challenged.

</comment></comment></comment><comment><USER10> package util, we meet again.

I've created and killed one of those in the past 48 hours. "It's never a good idea," I said on Wednesday. "Well, maybe this time," I said on Thursday. "No, it's never a good idea," I decided on Friday.

At least I come to my senses _quickly_ these days.</comment>


Learn Morse Code with Google - <AUTHOR> https://morse.withgoogle.com/learn/ <comment><USER2> Déjà vu! It's proprietary _' Internet Explorer'_ all over again. This time the site only works with Google's Chrome! (The site even says so: _" This experiment is not availble [sic] on this browser. Try it on Google Chrome._")

No, the spelling of 'availble' isn't my mistake.

 _Now, that message has to tell us what YC uses for its browsers!_</comment>