NESticle, a classic NES emulator for DOS, is 20 years old today - <AUTHOR> https://twitter.com/dosnostalgic/status/849093769718792193 <comment><USER2> For context: prior to Nesticle you needed a very beefy machine (for the time) to emulate NES games at a half-decent frame rate. All of the existing emulators were basically unplayable on my Pentium60.

Nesticle came out of nowhere and was a huge improvement. Totally playable. I think it was the first jitting nes emulator.

<comment><USER3> I very much doubt that Nesticle used dynarec. With games of the era requiring precise timings, a JIT would have been more trouble than it's worth. I can't find any source for Nesticle having a JIT compiler either. It was however very inaccurate, which may have contributed to it running faster than most of the emulators of the time.

Dynarec has mostly been used from the N64/PS1/Dreamcast generation and onwards.

<comment><USER4> Vague memory hanging out with these folks while they were working on this that a lot of speedup was due to well placed inline assembly

<comment><USER3> Mhm. That's been the general solution to make emulators of the time fast. ZSNES was mostly assembly too.

</comment></comment></comment></comment><comment><USER5> Ahh, Bloodlust Software. Noggin Knockers 2 and Timeslaughter. The pic in the tweet is of "Buddy" from those games. The character was hidden and was accessed by pressing the down arrow repeatedly on the character select screen until his "down syndrome" caused him to be selected. I'm sure the games suck but I LOVED them when I was 10.

<comment><USER6> > and was accessed by pressing the down arrow repeatedly on the character > select screen until his "down syndrome" caused him to be selected

Haha. There was so much crazy humor very widespread everywhere before "PC landed" (as a wave) over the last ~decade (by which I mean the herd moved from "let's make the odd joke of any one group at times but not seriously harm anyone in reality" to "anything could be offensive to _someone_ so let's not come up with much to cultivate uber-tolerance for the sake of it"). Even freaking Donald Duck euro-comics from the 70s til mid-90s are quite awash reading them as an adult today (with a broader horizon of reference points).

</comment></comment><comment><USER7> With emulation, comes emulation scene drama: [http://patpend.net/articles/zd/article2.html](http://patpend.net/articles/zd/article2.html)

<comment><USER8> It's just absolutely fantastic how much the world has changed since this article was written. Let's see...

In one paragraph, we have:

> Damaged Cybernetics was a general grey-area information group. Their main > goal, so they said, was to free as much information as possible, for, as the > saying goes, information wants to be free. They had sections on their > website dedicated to such things as Audio Piracy information (the ripping of > CD-DA Audio Tracks and compression to the MPEG-2 Layer 3 audio format),

followed in the next paragraph by:

> What exactly is grey area information, you may ask? It is information that > many people would rather not touch with a ten foot pole. It lies somewhere > between the realm of legal and illegal.

It's genuinely hard to imagine a world where ripping your own CDs to MP3 was considered "grey area information" that you wouldn't want to "touch with a ten foot pole". The '90s was a _very_ different place.

And then there's this:

> How did he steal the source code? Sardu was running Windows 95 at the time. > He made the mistake of leaving drive sharing on (which should not have been > on by default, but for some reason, it was on). MindRape was then able to > mount Sardu's hard drive (since drive sharing was enabled) with Samba. > Pretty clever, right? Regardless, he did this and not only was he able to > retrieve the NESticle source code, he was able to look through all of his > drives. His Zip drive. His hard drive. His CD-ROM drive. Whatever he wanted. > Such an invasion of privacy is ridiculous, but this is what transpired.

Mounting somebody's hard drive through Samba over the open Internet! Of course, this was back in the days of dialup, when everyone's desktop computer had a public IP address. You'd dial in to your ISP, and the IP would be directly assigned to your PC. And, of course, IRC networks back then had no concept of shrouds, so you could just find somebody on IRC, get their IP, and start hitting their open ports! A lot of people will vehemently say that a NAT router isn't a proper substitute for a real firewall... but in this case, it _would_ have prevented this attack. Even the most dirt simple of NAT routers would prevent some rando from over the Internet mounting your HDD via Samba. At the very _least_ they'd have to spear-phish you into running a trojan now. But, of course, home NAT routers weren't a thing until people started using cable and DSL and having multiple computers sharing the same Internet connection. Back in the days of dialup, if you had multiple machines, you paid out the nose for multiple phone lines and then you paid your ISP an extra $5-10/month to allow you to have multiple simultaneous connections on the same account (or you had multiple ISPs; hey, they were only $20 a month and there were dozens to choose from in every major metro area).

The mention of the Zip drive dates it, too. Man, remember when every major PC manufacturer was putting internal Zip drives in their computers? That was a looooooooooooong time ago...

<comment><USER9> > It's genuinely hard to imagine a world where ripping your own CDs to MP3 was > considered "grey area information" that you wouldn't want to "touch with a > ten foot pole". The '90s was a _very_ different place.

Yes, but you could also argue it was a much freer place, as in wild west free. On the one hand there was a lot of legal scare, surrounding MP3, patents, DMCA, export controls, etc., and a few people actually got into trouble. On the other hand, you could run a illegal Warez or music download site for years with impunity. Everything was in flow. We as a society haven't determined what goes and what doesn't yet. Good times :-).

<comment><USER6> > On the one hand there was a lot of legal scare, surrounding MP3, patents, > DMCA, export controls

As with any "scares", it took place largely in the media (even there not that much, maybe the odd op-ed and tech/talkshow) while in on-the-ground reality nobody cared and everyone either directly got eagerly and excitedly "into it" or asked their "tech-savvy neighborhood youth" to hook them up with warez or music or in any event back up /digitize their existing collections. (Apart from your typical cautious disposable-income-middle-classer who actually enjoyed regularly investing some of their funds into their ever-growing legal collection of CDs/DVDs/etc) The "scares" initiative really only began in earnest as movies became a feasible target and the music industry must have been much more focused on not sharing the music industry's fate (ie "almost die, then be 'rescued' on breadcrumb terms by Apple")

</comment></comment></comment></comment><comment><USER10> Holy hell. I got my start in software hacking on NES ROMs many years ago. NESticle definitely played a part in me being who I am today. It's strange to see things getting old, but I guess so am I.

</comment><comment><USER11> Good ole' Nesticle. I remember I was so pumped because I could play the Japanese Final Fantasy's that never got released here. Then I was part of the Destiny of An Emperor 2 translation beta into English, that was fun.

I was in... 6th grade I think when I found out about Nesticle, it changed my life.

</comment><comment> rlv-dan Ah, the memories. I especially remember the "Pentium Bug" menu option that I clicked out of curiosity. Nothing happened. Literary :-)

[https://en.wikipedia.org/wiki/Pentium_F00F_bug](https://en.wikipedia.org/wiki/Pentium_F00F_bug)

</comment><comment><USER12> Slightly off topic but does anyone happen to know the state of NESBox? Their repo hasn't had any real updates since June of 2015 - [https://github.com/nesbox/emulator](https://github.com/nesbox/emulator)

</comment><comment><USER13> NESticle got me into modification and reverse-engineering. Specifically, it allowed the user to not only view the graphics ROM data all at once, but also modify the tiles and see the effect in real-time!

</comment><comment><USER14> I can still picture that icon in my head 20 years later...

</comment><comment><USER15> What was the first console/arcade emulator?

<comment><USER16> In terms of arcade, I think the first usable arcade emulator (as opposed to things that could just boot up and get to the attraction screen) was "Dave Spicer's Arcade emulator" circa 1995 for DOS. It only supported a tiny handful of games (Pac-Man, Galaxian, and an obscure game called Amidar)

<comment><USER17> Neil Bradley did a vector arcade one as well around that time: [http://www.emuviews.com/cgi- local/show.cgi?SERIAL=99](http://www.emuviews.com/cgi- local/show.cgi?SERIAL=99)

For consoles the earliest ones might have been Virtual Gameboy? Or one of the Atari 2600 ones? I'm sure they came along in early 1996.

<comment><USER18> Emulators for 8 bit computers like the ZX Spectrum and CPC were around for a while, but I remember people saying that emulating games consoles would be impossible, then suddenly they started making leaps and bounds.

<comment><USER16> Yeah, I remember that ZX Spectrum emulators seemed to be early (before C64 and Apple ][ emulators). Being an American, I never used a Spectrum back in the day, but I used the early Spectrum emulators to play 8-bit games as many of them were the same games as I remember playing on the Apple ][.</comment></comment></comment></comment></comment>


OTL: The Long, Strange Trip of Dock Ellis - <AUTHOR> http://sports.espn.go.com/espn/eticket/story?page=Dock-Ellis

<comment><USER2> The linked ... article? Media? Whatever it is, isn't loading for me; after more than ten minutes, I'm still just seeing the "buffering" dots.

In the interim, assuming it's about the same thing, here's a fantastic animated short about Dock's famous no-hitter, pitched on LSD:

<http://www.youtube.com/watch?v=_vUhSYLRw14>

EDIT: The problem may have been Chrome, or the extensions I'm using there; it loads right away in Firefox.

</comment><comment><USER3> Can anyone explain to a Non-American what the fuss is about? Did he play a very well game on LSD? Or a very bad game? Is it so inconceivable to play a good game while tripping that it warrants a long fawnish article? What is it about?

<comment><USER4> In baseball, a "no-hitter" is a game were one team prevents the other team from hitting the ball all game (<http://en.wikipedia.org/wiki/No-hitter>) and is quite a rare feat. That Dock Ellis was able to pitch a no-hitter while on LSD is even more remarkable. The article is more about Dock and his life than that one event.

<comment><USER3> Thanks, that makes it more clear!

</comment></comment></comment><comment><USER5> The future of online media is annoying parallax effects?

<comment><USER6> I actually enjoyed browsing through this. I can see how a well researched and written article augmented with media elements such as video can be something people are willing to pay for. I think I would.

Edit: But you can say, so can any other page on the web. What I actually appreciated about this was the care that had gone into preparing the content. It would also mean that content becomes more individual rather than placing text in a box standard framework like a typical news website does.

Edit 2: I can see how e.g. a news site can have publicly available content and content behind a pay-wall that is prepared like the content illustrated in this example. More magazine style content.

</comment></comment><comment><USER7> Using the cursor keys to try and scroll on that site is really aggravating.</comment>


Free Graphics Software Vectr 1.4 Launched - <AUTHOR> https://vectr.com/blog/updates/vectr-1-4-brings-grouping-of-layers/ <comment><USER2> If you download, does it run completely offline or does it still rely partially on your servers?</comment>


Control Your Google Account From the Grave - <AUTHOR> https://www.google.com/settings/u/1/account/inactive

<comment><AUTHOR> In case your account is not yet enabled for inactivity...

 _What should happen to your photos, emails and documents when you stop using your account? Google puts you in control._

 _You might want your data to be shared with a trusted friend or family member, or, you might want your account to be deleted entirely. There are many situations that might prevent you from accessing or using your Google account. Whatever the reason, we give you the option of deciding what happens to your data._

 _Using Inactive Account Manager, you can decide if and when your account is treated as inactive, what happens with your data and who is notified._

</comment><comment><USER2> Not available for Google Apps Accounts:

"You are trying to access Inactive Account Manager from a Google Apps Account. Inactive Account Manager is only available for Google Accounts."

Bummer for those of us that manage our family email via Google (ie. email@example.com)</comment>


Why the economy will take a long time to recover - <AUTHOR> http://scottsmigler.com/myblog/2011/06/27/tax-small-business-to-keep-government-from-shrinking/

<comment><USER2> Economic issues are a bit more complex then shrinking then down to cause/effect analysis as in this case. The fact is that there are a myriad of variables that have to be ascertained when analyzing economic growth prospects. As such, I think this article is woefully misleading in shrinking the entire matter to a simple case of increasing taxes on small businesses. There is a large amount of economic literature which has determined that increasing taxes does not necessarily have to have a negative impact on growth. For a better discussion of why the economy is stalling I would read Becker's analysis on his blog:

[http://www.becker-posner-blog.com/2011/06/the-slow- economic-...](http://www.becker-posner-blog.com/2011/06/the-slow-economic- recovery-becker.html)

<comment><AUTHOR> "I think this article is woefully misleading in shrinking the entire matter to a simple case of increasing taxes on small businesses"

You are misrepresenting the post. It states, "it should be clear that policies like this one will hold back the economic recovery in the United States," not that this policy alone will be responsible for harming the economy. The article you posted backs up what I said quite nicely.</comment></comment>


Ask HN: Looking for a JavaScript contract but don't have code to show. What should I do? - <AUTHOR>

I've been working remotely for the last year as solo developer on a MVP for a startup, doing full stack work (PHP / Node.js / jQuery / Python). The product is in private beta and it's not 100% related to the type of technologies I'd like to use in my next contract.
I just moved back to London, UK, and I've contacted many recruiters for JavaScript contracts: the point is, I've got many years of experience, great clients and a strong CV, however I don't have any JavaScript projects to show that I'm proud of (the ones I've got are too old/outdated technologies and they don't really show my skills). My GitHub account is not very solid from this perspective either.
So I'm in the process of creating a portfolio to showcase four of the best and most recent/relevant projects I've built, with the objective to use the portfolio itself to showcase my skills: I'll then be able to use it as an example of code I'm proud of (or by looking at the source or by publishing it on GitHub).
Do you thinks it's a viable solution?
Do you have any suggestion?
Many thanks for your time. <comment><USER2> Even if you don't have source to show, if your back-end experience includes Node and you can converse about it freely and intelligently, I think you'll be fine.

Maybe you could write a blog post examining some confusing element of Node architecture? Or walking people though a simple JS MVC PoC? Basically just provide some sort of technical copy (on your resume/linkedIn/wherever)that shows you understand some of the basic features of JS development (closures, callbacks, prototypical inheritance - which sounds like its all old hat for you). With your other projects and experience, I think that would be enough.

<comment><AUTHOR> Thanks for your reply. If this was a permanent position instead of a contract, it will be a lot easier for me as I'll have to go through the interview stage, and I don't think I'll have any issues with that. However it seems that for a contract position I cannot even get an interview and I think it's understandable: if you have to choose between two developers for a 3 months contract and both have a strong CV but one of the two has some examples of work to prove his skills/experience, I'd personally choose the one with the examples (assuming that they're good) instead of hiring/interviewing the other just basing myself on trust. So unfortunately I need source code to show.

<comment><USER2> Well then it sounds like you need to show source code ;)

</comment></comment></comment><comment><USER3> Why do you want JavaScript contracts specifically? I've done contracts with languages I don't have a strong portfolio in but the clients weren't interested in the technology, they just wanted a solution to their problem. If you're proficient in several varied languages a new one isn't going to slow you down much. You're likely to get scrutinised more if the contract is specifically about JavaScript though.

</comment><comment><USER4> Landing a contract gig can have lots of hoops, verifying past experience, background checks, etc.

For starters you could use your dated sites as portfolio pieces and try to get approval to obtain private beta credentials from your recent MVP work to show off your work. This would probably represent your experience more than making portfolio pieces just for your portfolio. Most companies aren't really picky about what your older work looks like as far as being dated. All projects looks dated after a few years. So I'd give it a go with your existing work and see if that opens doors. You can also work on adding in some portfolio pieces too while you're going through the process with what you have.

Typically on interviews some of the conversation will center on code, but a big part will be experience working remotely, what would you do in this situation (project is getting behind schedule, you aren't getting data/information you need, etc). So focus on working as a team, bringing value to a project, tackling/learning new things, recommend frameworks/services that can help the project. Related experience with similar apps/websites.

Good luck landing your first remote gig.

</comment><comment><USER5> Yes I think you're on the exact right track. You'll still have to jump through the hoops of coding-tests, etc for certain companies, but you'll have demonstrated enough proficiency to get your foot in the door.</comment>


Proj: Simple project tool for Vim - <AUTHOR> http://www.vim.org/scripts/script.php?script_id=2719

<comment><AUTHOR> Please report any bugs and/or feature requests. Project.vim stinks so I'm set on finding a simpler path.

<comment><USER2> Why do you think Project.vim stinks? I've been using it for nearly a year now on a daily basis and I can't live without it.

I tried your plugin out and it worked well, but I have no reason to switch. The one thing I can't do without is being able to quickly search through all of the files in my project. Is there any way to do this within Proj?

<comment><AUTHOR> > Is there any way to do this within Proj?

Nope, it's simple by design. Project.vim seems mainly for projects that need to pull in files from all over the place and probably fulfills that goal well. If I need to search the working directory, I'll use ':!grep -RI "term" .' (or vim's grep which is pretty nice).

I say that project.vim stinks because it's awkward and its usage is unclear. Maybe I've never "gotten" it, but I think there are many others like myself who really, really wanted to like project.vim but just couldn't use it.

I have my mind on other goals. One is to add a toggleable split that gives useful version control information by integrating with the VCS plugin.

<comment><USER2> Sorry, I was a bit vague. I also use grep -R to search _through_ files. I meant searching _for_ files. As in, I have hundreds of files and I want to quickly open bar.rb which is buried in some directly. In project.vim I type '^wh/bar.rb[enter]\s' and boom, I'm in that file.

I guess that's honestly the main functionality I get out of project.vim. I can't comment on how it handles others' needs.

<comment><AUTHOR> Interesting...I use FuzzyFileFinder for finding the files themselves right now, but I can see the value in having a feature like that built-in.

</comment></comment></comment></comment></comment><comment><USER3> It would be nice if it did more introspection. I have a root projects directory (~/workspace) and it'd be nice if I could specify that root then try like _:Proj ticketstumbler_ and just have it figure out from the directory name what I want. The projects file could be used to override defaults, so if I specify the same project in that file, it uses that config.

Also, why make me put quotes around the project name?

<comment><AUTHOR> Thanks for the feedback. I like the idea of introspecting the directory names...I'll see if I can work that in there.

You have to put quotes because otherwise Vim complains about using undefined symbols (I don't plan on using the command interface in the long run; probably something more like what MiniBufExplorer does, or even FuzzyFileFinder's hack of the completion system). I agree that it's clumsy, but the command interface is limited, and can only accept paths with quotes omitted.

</comment></comment><comment><USER4> Emacs users may like eproject: <http://github.com/jrockway/eproject/tree/master></comment>


IBM solar dish produces heat and power  - <AUTHOR> http://www.technologyreview.com/view/513986/ibm-solar-dish-does-double-duty/ <comment><USER2> This doesn't _produce_ heat, it _absorbs_ heat and converts some of it into energy. Details are important here.</comment>


From Node to Deno - <AUTHOR> https://dev.to/aralroca/from-node-to-deno-5gpn <comment><USER2> It looks like a good evolutionary improvement over Node.js. However, I have a concern about its security claims. Perhaps someone on the project can allay these concerns.

My brief skimming of its site indicates that its security model is based around the ability to disable, say, network access for whole Deno programs. However, does it allow starting up with network access, allowing a subset of the program to handle it, and then dropping those rights for the rest of the program, _especially_ subdependencies?

I can't see any mention of a more fine-grained approach: [https://deno.land/manual/getting_started/permissions](https://deno.land/manual/getting_started/permissions)

A modern Node.js web service will have hundreds, if not thousands, of indirect dependencies. Some network access will be required for at least the Express routing, or an equivalent.

For a Deno equivalent, this would amount to enabling network access for all hundreds of those subdependencies, not reproducing the isolation in capability-based security such as WebAssembly nanoprocesses.

Have I missed something here? That doesn't seem like much of an improvement over Node.js except for very small and contained programs. Yes, Deno's dropping of centralised package repositories and package.json might alleviate this problem _somewhat_, but the same fundamental issue seems to remain.

<comment><USER3> Permissions are a whitelist.

While the grant is a blanket grant to a program and all dependencies, typically, a well behaved program will seek a limited scope of permissions. Like "[https://my-program.com"](https://my-program.com"), "[https://preferred- analytics.com"](https://preferred-analytics.com") etc.

This prevents dependencies from using call back locations that are outside the permitted list, preventing much of the nefarious activity they can dream up.

If a dependency needs access to specific resources, it can advertise this fact and the parent module can in turn request this from the user.

Importantly, the user is explicitly aware of these & controls it in an absolute sense, at run time.

<comment><USER4> > Importantly, the user is explicitly aware of these & controls it in an > absolute sense, at run time.

I mean, I guess I see value there for the use case of "I want to download a script to run locally on my machine" type of thing, but for the most common use of Node, i.e. I'm running a server process, does this really even matter?

<comment><USER5> I think the most common use of Node might actually be Electron if you go by number of users.

</comment></comment></comment></comment><comment><USER4> I'm really curious about whether people think Deno will succeed. Node certainly has its warts, but I feel like with recent improvements in the JS language and Typescript that Deno doesn't really solve problems people have nowadays. I don't think the decoupling from NPM and the dependency management approach (or lack thereof) is really a thing that most developers want. NPM certainly had a bunch of "dumpster fires" for years IMO (lock files mess, signed code mess, etc.) but I feel most of those pain points have largely been addressed.

I downloaded Deno and tried it out, but at this point I'm just left thinking it doesn't really add anything for me that I need.

<comment><USER6> This is puzzling to me because I had the opposite reaction: among other things, Deno solves an incredibly important problem with Node, which is the complicated configuration used with most projects. Deno can perform, out of the box, many of the things you'd need to configure Webpack + Typescript to do:

        SUBCOMMANDS:
            bundle         Bundle module and dependencies into single file
            cache          Cache the dependencies
            completions    Generate shell completions
            doc            Show documentation for a module
            eval           Eval script
            fmt            Format source files
            help           Prints this message or the help of the given subcommand(s)
            info           Show info about cache or info related to source file
            install        Install script as an executable
            repl           Read Eval Print Loop
            run            Run a program given a filename or url to the module
            test           Run tests
            types          Print runtime TypeScript declarations
            upgrade        Upgrade deno executable to given version

What would it take to get Node to do all of that? Which documentation tool would you choose, and how would you configure it? Testing? Bundling? Formatting?

<comment><USER7> If anyone remembers, this is similar to the "Turbo Gears" vs "Django" of Python world. Turbo Gears allowed me to choose the best of each component - but pretty soon one ends up having to upgrade or migrate to the new-best-sub- component on a weeekly/monthly basis. django helped avoided a lot of headache by defaulting a decent, but not necessarily the best tool, and sort of "won" in the end.

For some reason, we continue to replay this fight in each and every language and environment.

<comment><USER8> This strikes me a similar to a dynamic at the level of entire corporations and industries—commodification/modularization on one end, wholeness/integration on the other: [https://stratechery.com/2015/netflix-and-the-conservation- of...](https://stratechery.com/2015/netflix-and-the-conservation-of- attractive-profits/)

</comment></comment></comment></comment><comment><USER9> Few things comes to my mind if you are moving from NodeJS to Deno:

1\. Deno lacks the library eco system which is required to build a production level app today. I am not saying it cant be done. Just think of the different third party service integration modern application has to do, their maintainance and testing by individual vendors or open source contributors ! Blogs mentions few DB driver libraries, i highly doubt they are as mature.

2\. Deno's security model overly hyped at least i see it this way. In last few version of NodeJS, many security flaws have been addressed, see their changelog if you dont believe me. But most importantly, security flaws with native JS is handled by V8 which is common to both NodeJS and Deno. On top of that, most of the libraries and frameworks in NodeJS during their various releases sorted out many security issues in their code. If someone is still doubtful they can use eslint-plugins for sanity and security checks in their JS files. Adopting Typescript also helps if you cant live without types.

3\. Learning curve to adopt new SDK for Socket API, File API, System call API etc. I don't think NodeJS falls short significantly anywhere, in fact it provides more and those APIs have been relatively more battle tested over the years.

4\. Irrespective of using NodeJS or Deno, following a BDD/TDD practices to ensure sound test coverage of your business use logic still remain the most promising tool to make, break and refactor your codebase.

<comment><USER10> Solely addressing #1 here, and this may come off harsh, but I think it's ridiculous to expect Deno to match the library ecosystem of Node on day 1. That's just literally impossible, but whenever a new language or runtime is released, it manages to become the most prominent question/concern.

It also is something of a moot point anyways, because people pushing something into production already are probably not using something so new. Early adopters don't care about how mature the ecosystem is; part of the appeal of being an early adopter is helping to build that ecosystem...

<comment><USER11> Well, you should scratch language there. kotlin did manage to start with the huge ecosystem of Java without hassle

</comment></comment></comment><comment><USER12> Thanks for doing this. I have a few questions regarding packages/dependencies, and TypeScript in general.

I tried installing Deno, and I tried including a package, and immediately the TypeScript typechecking in my IDE (VSCode) failed, of course. The IDE doesn't know what to do with a URL as a dependency. Is this something Deno will be able to handle?

The next question is that TypeScript packages I have written in the past use `baseUrl` and `paths` in their own configs to allow for absolute import paths. When I look at third-party Deno repositories, I didn't see any that were building out to JS/declaration files, and were instead just meant to be included as the original TypeScript source code. Won't this break things like absolute import paths and other behaviors of the dependency's own tsconfig file, or does this work fine with Deno/TS?

<comment><USER13> [https://stackoverflow.com/questions/54794933/how-to-pull- typ...](https://stackoverflow.com/questions/54794933/how-to-pull-typings-in- deno)

Looks like there's a plug-in. Can't research much now, but I hope there's something like that for emacs tide.

<comment><USER13> I think for emacs/tide I'll just be able to follow the instructions for Atom here: [https://github.com/justjavac/typescript-deno- plugin](https://github.com/justjavac/typescript-deno-plugin)

</comment></comment></comment><comment><USER14> The other major threads so far:

[https://news.ycombinator.com/item?id=23172483](https://news.ycombinator.com/item?id=23172483)

[https://news.ycombinator.com/item?id=23093737](https://news.ycombinator.com/item?id=23093737)

[https://news.ycombinator.com/item?id=22102656](https://news.ycombinator.com/item?id=22102656)

[https://news.ycombinator.com/item?id=20373430](https://news.ycombinator.com/item?id=20373430)

[https://news.ycombinator.com/item?id=17183241](https://news.ycombinator.com/item?id=17183241)

Let me know if I've missed any.

</comment><comment><USER15> Using JavaScript outside a browser by running the V8 JavaScript browser engine on the server is a bit of a gimmick, but enough people can't bother to be a polyglot, and it's not that crazy.

But, once you are writing code in TS, then transpiling that to JS, then running that in V8 on a server, you have taken a big step into the Rube Goldberg dimension.

</comment><comment><USER16> Desktop apps build on Electron should be a good fit for Deno, because Denos API is more like a Browser API than like the Node API.

<comment><USER17> Is there a decent browser (or other GUI framework) in Deno though? It has a wrapper for zserge/webview but I haven't used a webview in ages.

</comment></comment><comment><USER18> The one big thing missing is an ORM. And making those things is notoriously difficult. Hopefully something will turn up

<comment><USER4> The idea that ORMs are a net-positive is definitely an open question. After 20+ years I'm certainly of the opinion they're not. I recently discovered Slonik (only for postgres, hope there is eventually a port for MySQL and others) and I'm a huge fan of the overall approach and the API. This blog post from the creator explains: [https://medium.com/@gajus/stop-using-knex-js-and- earn-30-bf4...](https://medium.com/@gajus/stop-using-knex-js-and- earn-30-bf410349856c)

<comment><USER19> > The idea that ORMs are a net-positive is definitely an open question.

If it's still being debated, isn't that a good indication that there's no perfect solution for every use case?

ORMs are likely more straightforward when you know you're not going to need to do anything advanced, but get in the way when you need fine grained control for example.

<comment><USER20> The problem is that easy queries are easy, who cares about orm, and hard ones are too hard for orm. I haven't been able to see the benefits in either easy or hard projects.

<comment><USER21> you nailed it: In simple cases the abstraction doesn't help enough to justify including it and in complex ones it actually makes things much more complicated because it just doesn't work right.

Ultimately it's useless for both.

</comment></comment></comment></comment></comment><comment><USER22> and the great migration begins. but when you look at other backend ecosystems e.g php, ruby on rails they're still getting shit done. even though people might say those languages/frameworks might be slow or insecure. stability is what's lacking in the JS ecosystem. glad I do my backends in flask now

<comment><USER23> Maybe it would be OK if all the Typescript people went Away to Deno and the few of us left who just want to run plain JS on Node, could, in peace.

... As long as there is enough interest still in Node to maintain it. Hopefully, there is still interest in running the same language as browsers do, without additional dependencies.

Personally, I would prefer Clojurescript to TS, but not strongly enough to want to be tied to its fate.

</comment></comment><comment><USER24> What Node is missing due to it's design is parallel (not just async-on-a- single-thread) processing using either green or OS threads without the overhead of serialization to web-workers or a cluster. Last time I checked, Deno didn't have a story there.</comment>


MIT and Cambridge have worst cybersecurity scores out of 485 major universities - a-kay http://info.securityscorecard.com/2015-education-security-report?portalId=533449&hsFormKey=e5ea15ab907f9c85237f43d9cd643d81&submissionGuid=f078c928-3582-4ae4-adb2-87c8f3706caf#wizard_module_236695011562853653064586739756806737042 <comment><AUTHOR> This link just leads to a page that makes you sign up and provide personal info to read the report. Since I don't want to do that, I can't criticize you on your methodology or conclusions, but the finding that MIT has the worst cybersecurity scores immediately raises questions.

In particular, MIT has at least 10X more public-facing IP addresses, did you normalize for that?</comment>


Why Are There So Many Pythons? - <AUTHOR> http://www.toptal.com/python/why-are-there-so-many-pythons <comment><USER3> I'll give a shoutout too Hy. It removes the Python interface, and replace it with a LISP interface. The neat part is that its currently compatible, and bidirectional, with 2.6, 2.7, 3.2, 3.3 and pypy. We even added a few steps so we will have support for 3.4!

[https://github.com/hylang/hy](https://github.com/hylang/hy)

It's a great example of how Python isn't that different from LLVM and JVM!

<comment><USER4> I wish I knew this sooner! The online console is really cool too: [http://try- hy.appspot.com/](http://try-hy.appspot.com/)

</comment></comment><comment><USER5>
        > It's fast because it compiles source code to native code

Actually, that's why it's slow. pypy is significantly slower than cpython in fact, primarily for short-life scripts.

The initial start time can easily double or _triple_ the run time in some cases.

To be fair, it's only a couple of seconds extra, but for many tiny scripts this amounts to a lot of wasted time. It's not a magical cure all in all situations.

...that said, its so fantastically easy to drop in, in most cases its worth trying to see how it performs just for fun~

        pypy setup.py install
        pypy app.py
        [INFO              ] Kivy v1.8.0-dev
        [INFO              ] [Logger      ] Record log in /Users/d/.kivy/logs/kivy_14-01-15_2.txt
        [INFO              ] [Factory     ] 156 symbols loaded
        ...

(drop in replacement for fun times? without having to change all your print and import statements? yes please~)

<comment><USER6> Sooo... the next logical step would be to add to pypy the ability to produce a natively executable file? Or has that already been done? (Disclaimer: I know relatively little about the python ecosystem).

<comment><USER7> It hasn't been done. If I understand correctly, it would be more like 'rewrite pypy to' rather than 'add to pypy'.

Pypy does have tooling to convert a limited subset of python ( they call it RPython) into an exe.

<comment><USER8> It isn't that limited. Also take a look at shedskin. [http://en.wikipedia.org/wiki/Shed_Skin](http://en.wikipedia.org/wiki/Shed_Skin)

</comment></comment></comment></comment><comment><USER9> Futamura projections would completely blow this guy's mind. It's amazing what ignorance of computer science causes people to think is new and special.

[http://en.wikipedia.org/wiki/Partial_evaluation#Futamura_pro...](http://en.wikipedia.org/wiki/Partial_evaluation#Futamura_projections)

<comment><USER10> Are Futamura projections used anywhere, or are they mostly of theoretical interest?

<comment><USER11> Futamura projections are what PyPy is doing, as described in this blog post. PyPy uses the first and second projections. In fact, it's likely that the author is actually familiar with the Futamura projections, but wanted to describe PyPy in more detail instead of relying on jargon.

<comment><USER12> Which blog post are you referring to? (Did you forget to add a link?)

<comment><USER11> I meant the "Why Are There So Many Pythons" blog post that is the topic of this conversation.

</comment></comment></comment></comment></comment><comment><USER13> Well, with a habitat that reaches across Africa and Asia, and their ability to thrive in rain forests and grasslands, there are.... Oh. _Ohhh._ Never mind.

<comment><USER14> Also in Florida.

</comment></comment><comment><USER15> Funny that an article written to describe why there are so many Python implementations, fails when comparing Python with C and Java.

There are quite a few interpreters available for C.

Although Sun/Oracle's implementation is JIT based only, there are other Java vendors with toolchains that support ahead of time compilation to native code.

<comment><USER16> Aye. The article also makes the well-know blunder of asking this question:

> Is Python interpreted or compiled? The question isn't really well-formed.

which is then repeated:

> C compiles to machine code, which is then run directly on your processor. > Each instruction instructs your CPU to move stuff around.

No, "C" does not "compile" to machine code. The C compiler compiles C, and sometimes does so to machine code, and there are a C compilers that compile first to a form of bytecode or other symbolic representation, then to native. <language> is compiled/interpreted is a sad leftover from the heavily-diluted introductory computer books in the 1980s.

<comment><USER17> I think another source of confusion is that the term "compiler" has gained this connotation that all compilers generate low-level code from a high-level source language. However, once you understand the concepts, you realize that many things are technically compilers; source-to-source translators, for example, or ORM code generators.

Hell, I would call Python's own 2to3 tool a compiler: it generates a full parse tree using a grammar, it runs some translation rules, and it generates Python 3 code.

<comment><USER18> There are no compilers. There are translators and optimizers.

<comment><USER19> That's the definition of a compiler though, "A compiler is a computer program (or set of programs) that transforms source code written in a programming language (the source language) into another computer language (the target language)."

All a compiler is is a combination of a translator and (possibly - but not necessarily) an optimiser.

</comment></comment></comment></comment></comment><comment><USER20> Why isn't there a branch of python 2.7.2 which introduces the features from 3.x that don't require syntax changes and fixes known bugs in 2.7.2?

I get that these are the reward for upgrading, but it seems unreasonable to hold back.

<comment><USER21> > Why isn't there a branch of python 2.7.2 which introduces the features from > 3.x

Because 2.7 was born for this exact reason.

People use good enough 2.6 and need a bridge version between 2.6 and py3k. Many py3k features were backported to 2.7 as well.

Now you want bridge over bridge?

<comment><USER8> That would be bridge-on-bridge technology and I have a patent for that.

</comment></comment></comment><comment> vezzy-fnord This is basically an article for beginners that explains the difference between a language's specification and its actual implementation, using Python as its illustration.

<comment><USER22> The most interesting aspect for me is that I can run Flask / Django in PyPy / I wasn't aware of this yet.

<comment><USER23> You may be missing some specific extensions that are based on C, though. When I tried it last, the database libs I used were not functional. That said, there pure-Python database libraries that worked just as well. The performance loss was negligible -- database IO completely drowned out any measurable loss in my use case.

<comment><USER24> If performance was dominated by database IO, why use Pypy at all?

<comment><USER25> The parent is referring to the performance of the database driver. The performance of the database driver doesn't affect the performance of the rest of the application.

</comment></comment></comment></comment></comment><comment><USER26> "In very brief terms: machine code is much faster, but bytecode is more portable and secure."

Does anyone else have trouble with that statement?

Maybe it should read "bytecode is more portable and is easier to secure." ?

Java is what, 20 years old and based on bytecode and despite Sun/Oracle's efforts still has security problems.

<comment><USER27> I think you need to parse it as

      more (portable and secure)

rather than

      (more portable) and secure

<comment><USER28> portable and securable

</comment></comment></comment><comment><USER29> Question: This, and many other posts, suggest that PyPy is the way to go (as a user). Faster and compatible - what's not to like? But elsewhere I read, 'hold on'. It actually isn't faster with things that use a lot of C optimizations (like numpy and pandas, which I use extensively). I don't mind small startup JIT penalties, but I don't want to have my core code run more slowly, or fail. Is there a simple direction? (ie: Use standard cPython or use PyPy) Or is it, as always, 'it depends'?

</comment><comment><USER30>
        x = random.choice([1, "foo"])

this is given as an example of why Python could never be strongly typed.

Honest question: isn't this solved using Either in Haskell?

<comment><USER31> Using Either in Haskell would require changing the program a little to add injections. But that _exact_ program (modulo syntax) can be written in Typed Racket:

        #lang typed/racket

        (: choose : (All (A) (Listof A) -> A))
        (define (choose e)
          (list-ref e (random (length e))))

        (define x (choose (list 1 "foo")))

Unfortunately, people tend to assume that "type systems" and "the type system in Java/ML/Haskell" have the same level of expressiveness.

<comment><USER8> I just realized that all programs have types and type systems. Some dynamically typed programs have hairy n-dimensional fractal type systems that no human would ever figure out (usually from bad code).

The inferred languages just have this dude that watches your code and says, "yeah, I understand what is going on, your stuff is internally consistent"

<comment><USER31> Well, I don't think that's correct -- it would make the term "type system" meaningless. In particular, lots of programs have bugs that type systems can catch.

For more on whether all programs have types, I wrote this: [https://medium.com/p/8a3b4bedf68c](https://medium.com/p/8a3b4bedf68c)

<comment><USER8> I don't think it makes the standard definition of "type system" meaningless. Maybe what I am referring to above is a "type space".

I agree with some of what you said in the medium link. Python does have a type system, structural and dynamic strong. The way the plus operator works was a mistake, Lua is superior in this regard.

Take a look at the type inferencing that Shedskin and RPython in PyPy can do. If there wasn't a type system, how are those 'static strong' programs created?

The programer and the program has a type system where the language may not.

<comment><USER31> What is a "type space"?

As I say pretty explicitly in linked post, Python doesn't have a type system. Also, the term "strong" type system doesn't mean anything. Also^2, "structural" type systems are about how types are compared, and to whatever degree Python compares types, it isn't structurally.

RPython is a different programming language, which is statically type. Shedskin is similar.

<comment><USER8> [http://stackoverflow.com/questions/2351190/static-dynamic- vs...](http://stackoverflow.com/questions/2351190/static-dynamic-vs-strong- weak)

RPython and Shedskin as not different languages, they are subsets. All programs in RPython and Shedskin are proper python programs with the same semantics.

<comment><USER31> First, as the second answer points out, the terms "strong" and "weak" shouldn't be used and are confusing.

Second, having a type system makes a language very different! Language subsets are different languages.

<comment><USER8> So when I use quickcheck with Python or Erlang I am creating a different language? Linguistically I don't understand how a proper Shedskin program which is also a Python program with the same semantics is in another language. By that definition, the runtime system effects what the language is, but this happens _after_ it is written, so how can it do that?

<comment><USER31> No, quickcheck is a testing tool, not a type system. It never rejects your program.

What you're saying is that Shedskin and Python have a non-empty intersection. But would the language of numbers with `+` be the "same language" as Python? It has the same relationship as Shedskin.

<comment><USER8> We might run out of reply space.

I made a mistake when I said quickcheck, I was thinking of the combination of Dialyzer and Typer in Erlang ( [http://www.slideshare.net/konstantinvsorokin/kostis- sagonas-...](http://www.slideshare.net/konstantinvsorokin/kostis-sagonas-cool- tools-for-modern-erlang-program-developmen) )

I think I get what you are saying, that you have to take the totality of language in the current context.

And I would have to say yes, the language of numbers with "+" is in fact Python. I think it is also Haskell and lots of other languages. If I look at a corpus of language through a slit, I will always see a subset of that language. But it doesn't stop being that language by looking at with a microscope. What happens we see a code snippet like

      a = 5 + b - <USER2>

We don't know what language it is, but it doesn't matter. It is valid Ruby,Python,Lua,JavaScript, etc.

Are we,me splitting hairs? I am just a layperson, I would like to fix any discrepancies in my knowledge.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> "CPython makes it very easy to write C-extensions for your Python code because in the end it is executed by a C interpreter."

Say what? What C interpreter might that be? In the end it is executed by machine code compiled from C programs designed so as to implement a Python virtual machine. Much, much different and much harder to make the intended connection.

Now why, really, is it easy to write C extensions for your Python code?

<comment><USER33> Since it is written in C, it is easy for the interpreter to define a C API that exposes the Python runtime (Python.h). This means python C extensions can have access to the python runtime.

</comment></comment><comment><USER34> Awesome article, I thoroughly enjoyed it -- sent me on a tangent to learn more about Tracing JIT compilers, RPython (and eventually I started looking for python-interpreted lisp, haha).

blog posts that helps me understand my tools/ecosystem better (rather than just harp on some recent happening in SV, for example) is awesome.

<comment><USER29> I second this. I read the other comments about the flaws in the article, and I'll take them as valid. Even barring them, I understand a lot more about the different types of python and, the different layers in the stack, and even a bit about compilation, JIT, etc. etc. Imperfect? Maybe. Extremely helpful to me? Definitely. Thanks!

</comment></comment><comment><USER35> That's not many. Most of older languages have even more implementations.

</comment><comment><USER36> Why does one need a Jython Interpreter once the byte code is available for a JVM. Isn't there the standard java that I can use?

<comment><USER37> No built-in dynamic typing support before Java 7.

<comment><USER36> Ok, thanks for clarifying that. I just looked it up and learnt than an interpreter-based approach is another option compared to other ways of supporting a dynamic typed language( by reflection, base object declaration)

</comment></comment></comment><comment><USER38> Since the JVM is also JIT compiled to native, is the jvm python implementation as fast as pypy ?

</comment><comment><USER39> This really should have been written in the form of a parody of Snakes on a Plane.

</comment><comment><USER40> This article lost credibility pretty early for carelessly conflating tokenized python with Java bytecode. That is unfair to readers that don't already understand the difference. It's not a trifle.

</comment><comment><USER41> TBH there are only 2 versions of Python I feel is worth worrying about/using 2.7 and 3.3

</comment><comment><USER37> "It all starts with an understanding of what 'Python' actually is."

It's basically a script language.

<comment><USER42> Using the term "scripting language" to describe things like Python and Ruby fell out of favour quite a few years ago. Calling something a scripting language implies that you can't write a full application using it. This has been proved incorrect a thousand times over.

<comment><USER43> > Calling something a scripting language implies that you can't write a full > application using it

No, it means the language is interpreted instead of being compiled to native code AOT.

<comment><USER44> By your definition, Java is a "scripting language" too.

I don't think anyone who's ever programmed in Java would actually consider it a scripting language.

<comment><USER43> You have a point. We need a subset of the interpreted languages. Maybe something to do with ease of use?

<comment><USER44> I think that would be a little too squishy.

For me, when most people say "scripting language" they really mean a dynamic language.

Perl, Ruby, Python, JavaScript, Lisp... These are all considered "scripting" languages and the main thing they have in common is the dynamic linking and type systems.

Statically typed languages like Java are generally not used for scripting purposes.

<comment><USER43> I don't think Common Lisp is considered a scripting language, even if it's a dynamic language. Or Clojure, for that matter.

<comment><USER44> How about emacs lisp? Would you consider that a scripting language?

<comment><USER43> When used like this, yes: [http://www.leancrew.com/all-this/2008/04/emacs- lisp-as-a-scr...](http://www.leancrew.com/all-this/2008/04/emacs-lisp-as-a- scripting-language/)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER45> The real question is why is there one python. Perl was already doing everything python can do and it is pointless to write every supporting library in 20 different languages. You can write good or bad code in any language; the language is nearly irrelevant. Of course, I wouldn't propose going to Bourne shell or something.

<comment><USER46> It's much harder to write correct software in Perl because there are so many bugs it doesn't catch. Almost everything converts a string that isn't numeric to zero instead of dying. ++$a{$x} doesn't even check that %a is initialized, much less actually has $x as a key. By default syscalls that fail set $? (which can be ignored and usually is) and don't die, and making them die breaks a lot of library code that only "works" because it ignores errors. And the production version _still_ makes ridiculous legacy distinctions like

      @a = (1, 2, 3); print "@a\n";
      $a = [1, 2, 3]; print "@$a\n";

which have no expressive value (if lists and hashes had been first-class values there'd be no reason for references to exist as a type) but only cause subtle mistakes.

<comment><USER47> Here's the script:

        #!/usr/bin/perl
        use strict;

        ++$a{$x};

and when run, produces,

        Global symbol "%a" requires explicit package name at ./test3.pl line 4.
        Global symbol "$x" requires explicit package name at ./test3.pl line 4.

So, I'm not sure if I see that point. Are you not a fan of autovivification? Because it: rules. I think the only thing one has to understand is the use of exists(), to see if there is, say, a key in a hash, rather than defined():

        #!/usr/bin/perl
        use strict;

        my %foo = (batz => undef);

        for (qw(bar batz)){
            if(exists($foo{$_})){
                print "$_ exists!\n";
                if(defined($foo{$_})){
                    print "and $_ is defined.\n";
                }
                else {
                    print "and $_ is undefined.\n";
                }
            }
            else {
                print "$_ doesn't actually exist\n";

            }
        }

prints,

        bar doesn't actually exist
        batz exists!
        and batz is undefined.

<comment><USER48> As it happens, hashes in Perl 5 autovivify by default (rather like defaultdicts in Python). In retrospect, this can seem rather surprising (if not off-putting) to newcomers, so an argument can be made that a more conservative default behavior should have been chosen (like the more "hard- nosed" behavior of standard dicts in Python).

OTOH Perl people tend to like the way we can, for example, create histograms (and nested structures like graphs) a bit more fluently with autovivifying hashes, e.g.:

        my %a;
        for my $x (@x)  { $a{$x}++ }

than if we always had to be saying

        if (exists $a{$x})  {
            $a{$x}++
        }
        else  {
            $a{$x} = 0
        }

Or as Perlistas would be more prone to write (if forced to use a non-vivifying hash):

        exists $a{$x} ? $a{$x}++ : { $a{$x} = 0 }

Or gosh, who knows:

        $a{$x} = exists $a{$x} ? $a{$x}+1 : 0

Or to have sat around and waited for 10 years or so until Hash::Util was invented (after Perl 4's initial release), provided then you knew to look for it, and how), at which point you'd finally be able to say:

        use Hash::Util 'unlock_keys';

But as it happens, when Perl 4 first came out, autovivification (and its cohort, promiscuous ducktyping) were chosen as the default behavior for many of the language's core constructs (not just hashes and arrays). It's just the way Perl rolls. Whether it's the "right" tradeoff to make or not, from a socio-engineering perspective, is an interesting question (and partially a matter of taste). But in general Perl has been pretty consistent in its approach to tradeoffs like these.</comment></comment></comment></comment>


Ask HN: Have you architected an auto-update feature? - <AUTHOR>

Have you architected the auto-update feature of an application, including the implementation on the client side as well as the infrastructure required at the server side? How did you scale it from a few hundreds of end-users to a few hundred thousands? What were the unexpected problems? Did you make the application contact "updates.<vendor>.com" at random intervals? Did you use anycast? Did you host the infrastructure in different datacenters? How did you prevent bad updates from breaking the auto-update client?<p>I would love to hear answers from engineers having participated in the design of, for example, Windows Update, Google Update for Chrome, or popular antivirus software. <comment><USER2> Checkout Omaha (Google Update) and read more at <http://code.google.com/p/omaha/></comment>


A platform for discussing a new web directory with a focus on human editing - <AUTHOR> https://curlz.org <comment><USER2> DMOZ was great in the 90s (I was there.. and I remember using DMOZ and I appreciated it at the time). Search engines werent that great, and there werent that many websites.. 250k in mid-90s, and a few million at the end of the 90s. That's few enough that a group of people could review each one, and add it to a directory.

But now there are perhaps 250 million active websites[0]. Is it possible for a small group to review all of these?

And if it is, how many are directory worthy? I would guess there are enough high quality websites to overwhelm a directory...

My question is, with the amount of high quality content out there.. is a directory the way to find it today? And what about the near future.. how would a directory keep up with the rapid growth of the web?

The obvious answer here is to simply leave out websites.. which is exactly what DMOZ did.. it's been very difficult to impossible to get your website on DMOZ for many years.. but IMO, this is exactly what lead to the irrelevance of DMOZ, since it forced users to go elsewhere to find the content they wanted.

IDK.. I really like the idea.. but part of me also thinks the time for a directory has passed. (edit: at least in the form of dmoz.. maybe you can create a dmoz 2.0 that addresses some of those challenges though.)

0\. [http://www.internetlivestats.com/total-number-of- websites/](http://www.internetlivestats.com/total-number-of-websites/) (this says 1B websites, but 75% are inactive)

</comment><comment><AUTHOR> I asked former editors of DMOZ if they would like to continue working on a human edited directory.

100 of them replied with mixed emotions, but nearly all of them are willing to contribute to the development of a DMOZ successor.

So, I build a platform (just a forum and a wiki at the moment) to collect all these likeminded people and start building something great together.

Tell me what you think about humanly curated web directories in 2017 or your ambitions to be a user or a contributor of a decent successor of the ODP.

Thank you for your feedback!

<comment><USER3> Starting from the other end, who would use a DMOZ successor?

Clearly DMOZ hasn't been getting a lot of real user traffic, which I think is because newer users (that's most users) have only ever used search, never been introduced to the concept of a directory.

So, the focus should be on who it's being built for, and how they would find and use it, rather than just replicating something from a different era.

For example, it could be a blog where guest bloggers (or blogger teams) each submit a carefully edited post describing the top sites (and perhaps apps) in a niche, and what's good about them. And then keep the posts up to date.

Quality could be maintained by a moderating team that only accepts the best posts, and ensures that they are maintained (otherwise deleted).

The resulting post when found in a search engine would be more readable, and probably more useful, than a directory listing page.

<comment><AUTHOR> In my opinion you're 100% right!

Those challenges are real and a new version cannot be just a clone of dmoz.

AI/recommender systems could play a role in such a project, the relationship between discovery of new stuff and finding resources on already known topics has to be discussed and so on...

I invite you to bring in your ideas here or in the curlz.org forum.

</comment></comment></comment><comment><USER4> DMOZ is a useful data source for what's on the web. Are there any machine- processable alternatives?

I use DMOZ to drive a list of major domains currently being used by phishing scams.[1] That's a list of who's in both PhishTank and DMOZ, ordered by the number of hits. (216 today. I used to try to get it down by nagging companies on the list, and got it down to 47 once.)

[1] [http://sitetruth.com/reports/phishes.html](http://sitetruth.com/reports/phishes.html)

<comment><AUTHOR> Someone mentioned the 4 yrs old blekko slashtag collection ([https://github.com/blekko/slashtag-data](https://github.com/blekko/slashtag- data))

I'm not aware of any other collection, but I hope curlz.org is gaining some importance soon ;)

<comment><USER4> I just signed up for "curlz.org". All they have right now is a forum, with a total of five posts. They don't even have a snapshot of the DMOZ directories. They need to at least host the DMOZ dump.

The entire content of DMOZ, in XML, is at

        http://rdf.dmoz.org/rdf/content.rdf.u8.gz

It's about 250MB. Save a copy, just in case. I just downloaded a copy.

Archive.org has a copy, at

        http://web.archive.org/web/*/http://rdf.dmoz.org/rdf/content.rdf.u8.gz

<comment><AUTHOR> I will add the dump in the next days, of course

</comment></comment></comment></comment><comment><USER5> The DMOZ data is licensed under creative commons and there is a RDF export. I downloaded the data, registered a domain - [http://www.zedurl.com/](http://www.zedurl.com/) \- and I'll try knock up a mirror of DMOZ tonight as a rails app. I'll update this post if things go well.

<comment><USER6> How about offering to collaborate with the OP?

</comment></comment><comment><USER7> There are endless link directories out there. Why do you think you can make a difference? Starting from fresh nobody will care to submit links because it's not really how SEO works anymore.

I doubt anyone just casually browsed DMOZ. A general link dir is probably a dead idea. A specialized niche one, not so much.

<comment><USER6> > There are endless link directories out there. Why do you think you can make > a difference? Starting from fresh nobody will care to submit links because > it's not really how SEO works anymore.

It _never_ was how SEO worked, ever. The fact that DMOZ was a collection of high quality links made SEO jerks spam it to death but that was a side effect.

DMOZ was the polar opposite of search engines, though many of them took DMOZ as their starting point _because_ of the high quality of the links.

</comment></comment><comment><USER6> DMOZ is how just about every search engine currently alive got seeded. The quality of the links was good enough that you could be reasonably sure to only hit spam after the second or third link traversal which gives a good testset to train a classifier with.

<comment><AUTHOR> I've heard that point quite frequently.

So, one option for DMOZ to continue could be a movielens.org for bookmarks ;) But I'm sure there are further possibilities...

</comment></comment><comment><USER8> I know you're probably just looking to replace DMOZ, and build something vast in scope/size. But please keep the idea I posted yesterday in mind:

[https://news.ycombinator.com/item?id=13802555](https://news.ycombinator.com/item?id=13802555)

Somewhat ironically/fitting one of the triggers for this idea was my dislike for the amount of corporate/institutional "spam" on dmoz.org. Browsing dmoz today it doesn't feel like browsing a treasure chest of information; it feels like browsing one of those vanity contact books that people are scammed into paying for placement in.

Just because 50 different museums from around the world are super reputable (to someone) that doesn't mean they should have a guaranteed place in the "art" category, for instance. They should need to have a kickass art collection online with great UX, super-highres images, easily downloadable if it's stuff that's out of copyright and so on. Just list the best ten (twenty? thirty? no idea what the right number is. it probably depends on the category) things, not every single art institution on earth that someone has bothered to submit.

I guess I would summarize this as opinionated, content quality-based selection.</comment>


Excess Automobile Deaths as a Result of 9/11 - <AUTHOR> https://www.schneier.com/blog/archives/2013/09/excess_automobi.html <comment><USER2> > The inconvenience of extra passenger screening and added costs at airports > after 9/11 cause many short-haul passengers to drive to their destination > instead

"Inconvenience" is putting it mildly. Even before my recent experiences with airport security[0], I preferred to drive or take the train for short distances (NYC to Boston, Philly, DC, etc.). As one can imagine, that aversion has only increased.

Nate Silver puts this well:

> According to the Cornell study, roughly 130 inconvenienced travelers died > every three months as a result of additional traffic fatalities brought on > by substituting ground transit for air transit. _That's the equivalent of > four fully-loaded Boeing 737s crashing each year._ [1]

Emphasis mine.

[0] Previously submitted to HN, but for the lazy: [http://varnull.adityamukerjee.net/post/59021412512/dont- fly-...](http://varnull.adityamukerjee.net/post/59021412512/dont-fly-during- ramadan) [1][http://fivethirtyeight.blogs.nytimes.com/2010/11/18/the- hidd...](http://fivethirtyeight.blogs.nytimes.com/2010/11/18/the-hidden-costs- of-extra-airport-security/?_r=0))

<comment><USER3> Since the new "security measures" have gone into place. I've instituted a 12- to 14-hour rule: if I can get somewhere by driving there in less than 12 (to 14) hours, I'll drive.

As a tall person, a plane has always been uncomfortable for me. Add to that experience the long security lines and being treated like cattle... nah. It costs me more, but I'll drive.

<comment><USER4> If you had a self-driving EV such that a drive cost you duration of sitting in a comfortable chair with high-speed internet, a refrigerator full of drinks, and maybe $50, how far upward would you revise this?

I'd probably seriously consider commuting weekly or biweekly from central WA to SFBA, even if it took 20h. 10h would be nothing, as I could just sleep.

<comment><USER5> As a tall person who is prone to motion sickness, not one bit. If I so much as looked at that screen, I'd be ill.

I have a feeling that as time goes on, this will be seen as more and more of a handicap instead of a minor inconvenience.

<comment><USER6> If transportation changes to where most people will need to be comfortable in those situations, getting over motion sickness will be like getting your "sea legs" or accommodating to Zero G. You will just have to have a few unpleasant trips until you get used to the sensations. Sorry!

<comment><USER5> I cannot explain how infuriating it is that you'd have the gall to assume that "a few unpleasant trips" would solve the problem. If I could I would give you the experience of feeling nauseous for several hours after making the mistake of playing a first person shooter or reading directions to the driver in a moving car. Maybe after you experienced that you'd understand that the issue I have is not simply, "Get sick a few times and you'll stop complaining about it.

<comment><USER4> Somehow this used to really bother me when I was 4-8 years old, and then it stopped. I don't know if that's normal. Being directly in-line with the direction of travel mattered then, too (now I can sit sideways in an aircraft doing a combat spiral landing and not get sick). I don't think "doing it a few times" is what stopped it for me, it was probably some morphological change as I grew up.

Presumably you've tried medication? It would probably be horrible to have to take transdermal scopolamine fairly continually, though.

<comment><USER5> Dramamine works for me. Of course use of that is not conducive to performing any complex activities.

I'm aware that motion sickness can change as people grow up. But given that I'm in my 40s, the odds of "growing out of it" are rather dim.

<comment><USER4> From watching people on boats, transderm scop is less likely to cause tiredness than the oral antihistamines.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> After the tube-bombings in London a friend's mom offered to buy him a car so he didn't have to get the tube and risk being blown up.

Ha.

He refused (mostly to spare her the cost I think) while pointing out that would have been a good way to increase the chances of him dying while traveling.

<comment><USER8> I am (irrationally) afraid of flying, but I try and counteract it by telling myself, when I get out of the car at the airport, "Phew, that's the dangerous part of the journey over with."

<comment><USER9> That depends on how far you drive to the airport versus how far your plane trip is.

<comment><USER10> I'd guess the distance of the flight is not that important, because risk is mostly constant (one take off, one landing).

If you can choose to drive instead of to fly, however...

<comment><USER11> In fact, shorter flights may carry more risk with the regional pilots that operate them typically having less flying experience and a higher likelihood of suffering from fatigue.

</comment></comment></comment></comment></comment><comment><USER12> Security theater. _sigh_ If the government was actually serious about protecting women and children from people with malicious intent, terrorists would be toward the bottom of the list, just above school shooters. Domestic abuse far outstrips any news-worthy outrages, but you don't get many votes talking about that.

<comment><USER13> Security theater to treat criminal violence theater. It makes a perverse sort of sense.

Terrorism is not really about deaths; there are many greater causes of preventable death, as you note. It's about attacking a nation's _perception_ of safety. You can ignore another random car accident or drug-related murder, but it's much harder to ignore 9/11.

I'd much prefer the vaccine to the "cure": to educate ourselves on this tactic and refuse to play along, treating terrorism the way we would treat a natural disaster. But alas, there's too much money and power to be gained in the security theater racket, and power abhors a vacuum.

</comment></comment><comment><USER14> We tend to accept that death has a color [1]. Unfortunately, we tend to let our governments decide which deaths have what color. No doubt the 500 or so US residents who died each year as a result of actions following 9/11 constitutes many individual tragedies. But there have been many many more colorless deaths around the world as a result of other government actions with 9/11 as their rationalization.

[1] [http://ansuz.sooke.bc.ca/entry/23](http://ansuz.sooke.bc.ca/entry/23)

<comment><USER15> There might have been many due to other government actions, but the vast majority are surely attributable to the US government. What's a few hundred thousand deaths when they are Muslim though?

</comment></comment><comment><USER16> From the comments:

 _Another good illustration: In the past 20 years total, deer have killed more on American soil (~150-200 /yr) than terrorists. So where is the trillion dollar War on Bambi?_

<comment><USER17> That's a ridiculous comment. The commentor is comparing the numbers of deaths that occurred over 20 years to the number of deaths that occurred during a single morning on 9/11?

<comment><USER18> Major terrorist attacks are extremely rare in America. They were rare before 9/11 and they have been rare since. Deer hits, on the other hand, are common and cause extensive damage to vehicles and injuries to drivers.

Also, there is a war on deer, but we prefer to call it "hunting." Hunting regulations are designed to cull the deer population, particularly in areas where natural predators were killed off by humans long ago. Hunting regulations balance the need to keep the deer population down with the need to not drive deer into extinction. It might make sense to bump up the number of kills allowed per hunter per season or to make the seasons longer if automobile hits are a serious enough problem (there are still more deer now in many eastern states than there were when the colonies were first established).

<comment><USER19> Around where I live if there were not enough deer killed in the regular hunting season, the DNR will open a late season to bring the numbers in line with conservation figures. Deer population conservation is a highly regulated and very important activity since there are so many humans living in areas where deer congregate, and we have been incredibly effective in wiping out their natural predators.

</comment></comment></comment></comment><comment><USER20> An interesting tidbit in the post is that DHS values each life at $6.5 million. Since most people do not have a net worth that high, and will never earn anywhere near that much in their lifetimes, it really makes me wonder where they get these numbers. While any loss of life is tragic, that loss rarely represents a financial loss of $6.5 million to the economy - even if you take earning potential into account.

<comment><USER21> Are you actually expressing confusion that the value of a life is higher than its discounted cash flow?

</comment></comment><comment><USER22> I don't understand why this post is featured on HN. It is just commentary on a previous essay, and doesn't even sound like a comprehensive commentary; just a few observations.

<comment><USER23> Bruce Schneier.

</comment></comment><comment><USER24> "since airline travel is far safer than car travel" \-- source quoted by Schneier

This old line has been exaggerated because people make a fallacious comparison. Ask whether people _feel_ safer driving or flying, and many will say driving - this may still be statistically wrong, but it is intuitively based on the correct comparison.

The comparison people intuitively make is "events I can't control in each alternative", while the fallacious-debunkers compare _total casualties_. But _almost all_ of the plane casualties are beyond the traveler's control, while on the other hand he/she can make sure the car is in good condition, drive while alert, obey speed limits and so on. The plane casualty number may still be lower than the corrected car casualty number, but not nearly by as much as is sometimes claimed.

<comment><USER25> You can't control other drunk drivers, either.

<comment><USER3> It does always take two people to get in a [two vehicle] collision. You can't control the other driver, but you can control how you react - and usually whether you've seen them coming in time to do so.

Sometimes it's unavoidable - you're stopped at a light and someone crosses the median to plow into you. In that situation, you are screwed.

But often, there is something you as the not "at fault" party could have done to avoid the collision (even with the drunk driver), had you been paying attention enough to see the situation. Change lanes. Slow down. Speed up. Leave more room. Leave less room. Always, no matter what, be _looking_.

Once I prevented myself from getting rear-ended at a traffic light: I was stopped and saw someone coming up behind me way too fast. I leaned on my horn, they clued in, and braked in time to stop just touching my fender. (I was in a motorcyle at a time, so REALLY happy with the outcome.)

Again, sometimes it really is unavoidable - but in a surprising number of situations there are actions a driver can take to avoid or reduce the severity of the incident.

Insurance companies understand this - that's why your rates raise when you get in an accident, regardless of whether you're legally "at fault".

Driving well and alertly doesn't end at the bounds of legal fault. Sure if you were rear-ended someone else will pay damages - but if you're in a wheelchair or dead, that money isn't going to make things better.

So to GP's point: there are a LOT of things that are far more under your control when you're driving. Falling out of the sky... not so much.

<comment><USER26> Indeed- I teach car control clinics, and it's alarming how many people simply freeze when put in a panic situation behind the wheel.

<comment><USER27> At some point the high rate is just called "normal". I would expect that majority of people freeze. And unless we're all trained in specific situations and see the situation perfectly and have a good reflex and ... there will be no reaction. And how would we prove that any kind of reaction is better than none?

<comment><USER26> You don't have to be trained to see the situation perfecty or even trained in a specific situation. It is possible to train you brain to still function in a panic situation and try _something_. You can think about whether that was the right action at a later time.

I've had people tell me "I don't even remember the last 60 seconds" after inducing a spin in a vehicle. It's a scary thought.

</comment></comment></comment></comment></comment></comment><comment><USER28> I'm one of the "people that commented" and the thread is here: [http://skeptics.stackexchange.com/q/17578/96](http://skeptics.stackexchange.com/q/17578/96)

</comment><comment><USER29> To really properly balance this you'd have to compare with a world where the TSA does not exist. But we don't actually have the possibility to compare the two. Chances are (not saying this is the case) that the combined haul of what the TSA found during the last decade would have led to more deaths. Controlled experiments on this scale are unfortunately not possible so in the end it all boils down to what you wish to believe most or what seems to be most reasonable.

<comment><USER30> In Europe we had a rash of airplane hijackings in the 1970s and 1980s, onsequently there is plenty of institutional experience in how to deal with terrorism and aircraft.

We chose not to plump for the TSA groping squad. Neither should the US.

<comment><USER31> There were also quite a lot of hijackings in the US during that period. But none of them ended as badly as 9-11, so it's not a terribly meaningful comparison.

<comment><USER30> I wouldn't say the comparison was meaningless. The blood toll of Entebbe and Landshut was less, but the public impact was enormous.

One must keep the public mood in the back of one's head - this was in 1977, there was a series of attacks by the Red Army Faction, which everyone had thought was dead, and then, just as now, there was the discussion about dragnet surveillance and civil liberties, there was even discussion about the aims of the RAF, perhaps they even had a point.

The keyword is "Deutscher Herbst".

</comment></comment></comment></comment><comment><USER32> I bet a lot of people chose driving over flying not just because they're afraid of having their planes hijacked, but also because of the TSA and not wanting to deal with them.

<comment><USER24> Exactly. The Xray scanners (now pulled), the offensive groping, the authoritarian attitudes, the long delays - I'm sure I saw some numbers showing big declines in the airline industry from late 2001, and undoubtedly few Americans today think terrorism is a big threat, but no one likes the TSA.

</comment></comment><comment><USER33> This just shows you that security is always a trade-off, whether in your application or in life in general. People rarely consider the true cost of a change in security policy.

<comment><USER34> Yes, but the TSA added inconvenience does not directly result in visible added safety.

<comment><USER35> It is probably more correct to say, "Everything in life is a trade-off."

</comment></comment></comment><comment><USER36> I read the original Cornell paper which attempted show the effect of security measures on demand for air travel ([http://dyson.cornell.edu/faculty_sites/gb78/wp/airport_secur...](http://dyson.cornell.edu/faculty_sites/gb78/wp/airport_security_022305.pdf)), and frankly I didn't find it very compelling. But even were one to accept its conclusion that security measures (and not an economic downturn or a change in preference due to a _percieved_ risk) caused the change in demand, no one presents any evidence that the air travel was replced with car travel. It seems quite likely that many trips would have been simply forgone, or along the BOS-NY-WAS corridor replaced with the train.

</comment><comment><USER37> Why does the Wikipedia article show a steady decline of fatalities? And this is occurring in a growing population.

[http://en.wikipedia.org/wiki/List_of_motor_vehicle_deaths_in...](http://en.wikipedia.org/wiki/List_of_motor_vehicle_deaths_in_U.S._by_year)

<comment><USER38> you answered yourself, the decline is in fatalities per capita

<comment><USER39> It also is in absolute number of fatalities, since 2002, except for 2005.

</comment></comment></comment><comment><USER40> I first heard about this from the book, the "Science of Fear". It's unfortunate that fear of something like flight, can lead to death by other means.

</comment><comment><USER41> Our irrationality in the face of minor but "scary" risks (vs. chronic ones) is brilliant for Schneier to point out -- it's really one of the pivots on which the whole surveillance issue rests.

Throwing away our freedom to prevent rare, statistically insignificant events is equally stupid. By doing so we are risking a much greater danger -- the chronic danger of a corrupt and possibly deadly police state.

</comment><comment><USER42> This is a morbid point, but I dislike the figure of ~3K people killed in the 9/11 attacks.

If either of the towers had fallen sooner or had fallen sideways instead of collapsing almost completely vertically, then it could have been much worse.

I'm trying to make the narrowest possible point when saying this: just that ~3K casualties was far from the worst case outcome that was possible that day.

EDIT: per my reply below, I'm only trying to make the discussion as honest as possible. At the core is the question, "Given X casualties to air travel based terror attacks, is a particular security policy worth implementing if it leads to Y casualties indirectly?". I'm addressing a shortcoming in what I see as the figure being used for X, since it's a small data set. It would be interesting to address the effectiveness (% of attacks thwarted or discouraged) of the security policy, too.

<comment><USER43> Why limit this to Air terrorism attacks then? If the first World Trade Center attack [1] had succeeded in bringing the towers down the casualties would have been far worse. Or if the terrorists had smuggled a nuke into New York it would have been even worse than that.

As it stands 9/11 is actually a worse terrorist attack than can ever be achieved with the use of airplanes again, see Flight 93. So it doesn't make sense to consider these sorts of hypotheticals when talking about changing air security policy.

[1] [http://en.wikipedia.org/wiki/1993_World_Trade_Center_bombing](http://en.wikipedia.org/wiki/1993_World_Trade_Center_bombing)

<comment><USER42> "As it stands 9/11 is actually a worse terrorist attack than can ever be achieved with the use of airplanes again, see Flight 93." I think this point is highly debatable, though I hope we don't find out in our respective lifetimes.

Anyway, as to why I didn't address non-air terrorism: I didn't set the scope of the discussion, I'm just participating in it. Sadly I'm well aware of the '93 bombing, the Bali bombings, the African embassy bombings... all sorts of non-aircraft attacks.

I literally said in my post that I was trying to make the "narrowest possible point". I meant it.</comment></comment></comment>


Ask HN: OSX App Developer - <AUTHOR>

I have an idea for an OSX app and I want to get started ASAP. Unfortunately, I don't have the skills needed to get an app to market in the time frame i'd like. The initial offering is basic enough that I would be able to wrap my head around the code shortly enough to continue developing other features.
My questions:
Where/How do I find OSX app developers? What should I expect to pay (hourly) for osx app development? Is an NDA a good idea? Necessary? Any extra info on that? <comment><USER2> Google for "Cocoaheads". If you live in San Francisco, hang out at NSCoders.

Go to hackathons, often you'll meet Objective-C devs.

Find an indie Mac developer whose products you like and pitch the idea to him or her.

</comment><comment><USER3> How should devs get in contact with you?</comment>


First known object with 1 stable and 1 unstable equilibrium point - <AUTHOR> http://gomboc.eu/

<comment><USER2> First known _homogenous_ object...</comment>


Microsoft apologizes for using Japan disaster to market Bing - <AUTHOR> http://www.networkworld.com/community/blog/microsoft-apologizes-using-japan-disaster-mar

<comment><USER2> Previously: <http://news.ycombinator.com/item?id=2317716></comment>


How Fish Got Hooked on Hydrocodone - <AUTHOR> https://www.painnewsnetwork.org/stories/2017/8/25/researchers-get-fish-hooked-on-hydrocodone <comment><USER2> The fish were taught that when they swam over a yellow platform, a motion sensor would trigger, releasing opioids (i.e. hydrocodone). Within two weeks, the fish were exhibiting "drug-seeking" behavior? How? How does this differ if we replace the opioid with food? This is pure classical conditioning, rewarding them when perform a particular action.

<comment><USER3> Doesn't "drug seeking" pretty much mean that the fish behaved as if the drugs were a reward?

Drug use becomes a problem when drug seeking merely competes with basic motivations, it doesn't have to completely replace them. So I wonder where you think the line should be drawn.

<comment> 52-6F-62 I think you're onto the main question. Were the fish neglecting more natural instincts and past learned behaviours that led to the search for food -- instead preferring the platform that indicated a release of the drug?

It would need to show that they were acting actively against their best survival interests for an endorphin release provided by a substance they learned they could acquire by acting in this certain way. That would be the damning conclusion.

</comment></comment></comment><comment><USER4> I'd like to see the fish equivalent of the "rat park" experiment where rats were tested on addictive behavior in a barren cage, and then again in a cage with lots of toys and social opportunities.

Those fish were pretty much in the worst environment possible.

<comment><USER5> The "rat park" experiment: [http://www.huffingtonpost.com/johann-hari/the- real-cause-of-...](http://www.huffingtonpost.com/johann-hari/the-real-cause- of-addicti_b_6506936.html)

<comment><USER6> Wasn't the rat pack study debunked or at least shown to not be replicable (enough)?</comment></comment></comment>


London courts declare "one" is legally anything between 0.5 and 1.5 - <AUTHOR> http://www.independent.co.uk/news/science/what-exactly-does-one-mean-court-of-appeal-passes-judgement-on-thorny-mathematical-issue-10350568.html

<comment><USER2> By this legal definition I should be able to pay for a product priced at 1 pound with any amount from .5 pound to 1.5 pounds. As I understand numbers they represent an abstract concept of reality. To say anything between .5 to 1.5 should be 1 is to do injustice to all numbers both real and imaginary.</comment>


New Survey Confirms Shoddy U.S. Broadband - <AUTHOR> http://www.businessinsider.com/new-survey-confirms-that-the-us-shoddy-broadband-2010-7

<comment><USER2> The actual content in this story seems to be here:

[http://www.connectivityscorecard.org/countries/united_states...](http://www.connectivityscorecard.org/countries/united_states_of_america)</comment>