Man or boy test - <AUTHOR> https://en.wikipedia.org/wiki/Man_or_boy_test <comment><USER3> I am about a third of the way through Knuth's Art of Computer Programming. It is an amazing piece of work created by one man. The sheer breadth and level of complexity in the work is awe inspiring. I wish my younger self had read a copy when learning 6502 assembly in the 80s simply to understand data (information) structures.

That said, this procedure is a doozy. It reminds me of the Ackermann function but doesn't quite grow as fast (understatement).

<comment><AUTHOR> If you like the Ackerman function you're gonna love Kruskal's tree theorem.

[https://en.wikipedia.org/wiki/Kruskal%27s_tree_theorem](https://en.wikipedia.org/wiki/Kruskal%27s_tree_theorem)

<comment><USER4> This essay is also great if you like this kind of thing: [https://www.scottaaronson.com/writings/bignumbers.html](https://www.scottaaronson.com/writings/bignumbers.html)

<comment><USER5> Or this page [1] on large numbers.

[1] [https://mrob.com/pub/math/largenum.html](https://mrob.com/pub/math/largenum.html)

</comment></comment></comment></comment><comment><USER6> The RosettaCode versions:

[http://rosettacode.org/wiki/Man_or_boy_test](http://rosettacode.org/wiki/Man_or_boy_test)

"Haskell

Haskell is a pure language, so the impure effects of updating k must be wrapped in the IO or ST monad (...)

On an AMD Opteron 6282 SE (1) using GHC 7.8.2 this program can compute k = 30 in 1064 s and 156.2 GiB. (2)"

"JavaScript

In Chrome we get a "Maximum call stack size exceeded" when a > 13\. In Firefox we get "too much recursion" when a > 12." (Note: it should say "k" (the parameter) not "a").

\---

1) 16 cores.

2) 156 GB of _RAM_ : "159874 MB total memory in use"

<comment><USER7> I'm not super familiar with Algol but it seems that this function is not using call-by-value? In most of the translations the parameters to A are functions instead of reals.

Is this call by name or call by reference? And how would call by value look like in Algol?

<comment><USER8> Call by name.

<comment><USER7> Do you know if there a way to specify that a parameter should be passed using call-by-value?

<comment><USER8> Function parameters can be declared 'value'.

</comment></comment></comment></comment></comment><comment><USER9> When I saw the title I thought, huh, maybe it's that thing were old prisoners threaten the young ones to see who's easy prey but no - it's a test in Algo 60 to see what compilers correctly implement recursion.

<comment><USER10> I thought it was going to be about rituals present in many cultures around the world (especially before contact with modern technological civilization) - <USER2> rites of passage from childhood to adulthood.

<comment><USER11> I was interested to know if I thought I could pass such a ritual. And then I was interested to know if I thought it was important for me to pass :-) Not sure I know the answer to that last one!

<comment><USER10> I think the answer to the last one depends on your social circle :). Rites of passage are group membership rituals. There's no point in doing the movements and sacrifices if there's no group you wish to enter that uses it as a condition of membership.

<comment><USER11> This is a super good point. I keep going on about how in Japan (where I live) it is super important to be willing to do the things that are required when trying to move to an in-group. You can't generally pick and choose ("I'll follow the rules that makes sense to me" doesn't fly here). So, you have put your finger on it. I would definitely do that if I valued the in-group I was trying to move to.

<comment><USER12> You seem to be under the impression that somebody would say "I'll follow the rules that make sense to me" when entering a new group and suffer no negative social concequences in other societies.

I really don't think picking and choosing which rules you follow would be appreciated anywhere.

</comment></comment></comment></comment></comment></comment><comment><USER13> Of course it is in the Online Encyclopedia of Integer Sequences: [https://oeis.org/A132343](https://oeis.org/A132343)

</comment><comment><USER14> Knuth also wrote the "trip" and "trap" suites for TeX and MetaFont conformance.

[https://texfaq.org/FAQ-triptrap](https://texfaq.org/FAQ-triptrap)

</comment><comment><USER15> ...and girls from gals</comment>


Show HN: I build a website for picking Chinese names - <AUTHOR> https://pikaname.com/ <comment><AUTHOR> Hello, I notice that many people like to have Chinese characters tattoo on their body. However, they don't know the real meaning and the culture behind those characters. Therefore, as a native speaker, I build a website for picking Chinese names called Pikaname.

Behind the scenes, we have native Mandarin speakers pick the most suitable name for you base on your preference. We pick names from traditional chinese characters, which we think has kept the beauty and full meanings of Chinese culture. Thanks for reading and we hope that we could pick a great Chinese name for you :)

<comment><USER2> Your website doesn't portray the problem you're solving. You sell it better here.

Pikaname - stopping embarrassing tattoos.

Have you ever had a friend who got a "cool" Chinese tattoo only to find out later it meant "toilet"? Don't be that guy. For just $5, a native speaker will choose the best Chinese name for you, based on you and provide a full explanation of its origins.

—-

I'd then market to tattoo shops as an add-on service and give them a cut ($1 per transaction).

Build them a portal they can log into with a customer, branded to them, and provide the report with the shops branding too - you'll have an army of sales people every day if you invest a little further in your tech and market it smartly.

<comment><AUTHOR> I see, thanks for your idea, it's really helpful!!!

</comment></comment></comment><comment><USER3> Hah nice one, Chinese native here as well. I think giving a few samples (with input english name and output chinese name + pronunciation/meaning) might give more confidence and perhaps more conversion.

<comment><AUTHOR> I think the toilet example is quite realistic, thanks for your guys help!</comment></comment>


Twitter's terrible 2016 just got worse - <AUTHOR> http://www.cbsnews.com/news/twitter-overcharged-some-advertisers-adding-to-its-many-woes/ <comment><USER2> I feel bad for anyone who's still an investor in this social media network of bots and marketers.</comment>


NASA's Spitzer Space Telescope Ends 16-Year Mission - <AUTHOR> https://www.nytimes.com/2020/01/30/science/nasa-spitzer-space-telescope.html <comment><USER2> The telescope ran out of coolant in 2009, but it continued operating for quite a long time after that. The article says that one of the biggest concerns is the difficulty of communicating with it, as it falls further from Earth in its Earth-trailing orbit.

Compared to the 2.5-year mission specification, its lifetime was long. I know NASA over-engineers, and extends each mission as long as _some_ hardware operates (see Opportunity), but that's still an impressive mission lifetime.

</comment><comment><USER3> A nice article, but it would have been good to hear more about the specific justifications for shutting the telescope down in advance of JWST's launch. $14 million/year doesn't seem like that much, in the grand scheme of things.

Heck, why shut it down at all? Document the communication protocols and orbital elements, and turn it over to amateurs.[1]

We seem to have put an awful lot of our eggs in the JWST basket.

[1] [https://uhf-satcom.com/dsn/dsnstart](https://uhf-satcom.com/dsn/dsnstart)

<comment><USER4> It ran out of coolant for its primary instruments, and the battery can only manage a short period each day for data transmission.

<comment><USER3> As the article says, they've already been working around that. It can no longer meet its rated performance specs, but it's far from useless.</comment></comment></comment>


Markets Sent a Strong Signal on Trump - Then Changed Their Minds - <AUTHOR> http://www.nytimes.com/2016/11/19/upshot/markets-sent-a-strong-signal-on-trump-then-changed-their-minds.html?_r=0 <comment><USER2> This is actually an interesting article. It's not about Tump, but about sentiment, group decision making, etc.</comment>


Gmail Labels: drag and drop, hiding, and more - <AUTHOR> http://gmailblog.blogspot.com/2009/07/labels-drag-and-drop-hiding-and-more.html

<comment><USER2> I think this is great, though I found myself confused by why I can't drag emails from one inbox to another. (I have multiple inboxes enabled.) No biggie though, hopefully that will be rolled out later as well.

</comment><comment><USER3> As much as I want to be a keyboard-snob, I find this feature to aid my productivity due to the sheer number of labels I have.

</comment><comment><USER4> Hasn't happened on my screen yet.

<comment><USER2> Apparently they are rolling it out over a period of time. You should get it today though.</comment></comment>


Silicon Valley start-up looking to mine the moon  - <AUTHOR> http://latimesblogs.latimes.com/technology/2011/04/moonex-rare-earth-rockets-space-travel.html <comment><USER2> There is no law clearly defining private property rights on the moon, but you can bet that it's not going to be as easy as just showing up and starting to dig.

A couple key quotes: "The UN says that private expeditions count as national activities and are covered by the treaty, which has been signed by all the major players. Lawyers disagreed and a second agreement - the 1979 International Moon Treaty - was drawn up to explicitly ban private ownership of lunar real estate." -[http://www.guardian.co.uk/science/2005/oct/24/spaceexplorati...](http://www.guardian.co.uk/science/2005/oct/24/spaceexploration.ideas)

"the activities of non-governmental entities in outer space, including the moon and other celestial bodies, shall require authorization and continuing supervision by the appropriate State Party to the Treaty" - <http://en.wikipedia.org/wiki/Outer_Space_Treaty>

Some good articles on trying to use the moon for private gain:

<http://www.slate.com/id/2202888/>

<http://www.space.com/6210-owns-moon.html>

<comment><USER3> Great post. But I can't help wonder how governments would stop an organisation that has sufficient technology to go and mine the moon.

A well-capitalised moon mining operation could maintain a base in space and send energy to Earth via laser beam (or whatever similar scientific approach you favour). I'm sure that governments could confiscate earth-bound assets of such enterprises, but they will presumably retaliate by keeping all their assets in space.

I think that exploitation of space (as an activity) will completely screw with our concepts of "nation" and "government". Once a private enterprise can go mine asteroids they're going to have far more capital (i.e. money) than any nation on Earth.

<comment><USER4> >> Once a private enterprise can go mine asteroids they're going to have far more capital (i.e. money) than any nation on Earth.

Private enterprises like the Rothschilds and Rockefellers have had more money than any nation on Earth for more than a century.

<comment><USER5> I've never seen any reference saying the Rothschilds or the Rockefellers ever had more than a few hundred billion in today's dollars. Compare to the US federal budget, which is over 3 trillion per year.

<comment><USER4> I, and many others, believe Rothschilds have over 500 trillion. Plus 80% share in Bank Federal Reserve New York ...

<comment><USER6> I am currently neutral towards your assertion. Can you provide a link that tips the balance one way or the other?

<comment><USER4> Well buddy, it's up to you. My advice: do your own research and make your own conclusions. There are a number of books on Rothschilds and a ton of Google hits.

Generally to understand the history of any advanced civilization you have to follow the money. And since 1815 Rothschild have had enough capital and reputation amongst private investors to decide who rules in most countries, which country has the credit to start a war, which country/alliance has the money to win a war, etc

<comment><USER7> _There are a number of books on Rothschilds and a ton of Google hits._

Dude, that's such an utter cop-out.

<comment><USER4> <http://www.rense.com/general79/tril.htm> (short intro into Rothschilds and how they control things)

[http://www.iamthewitness.com/DarylBradfordSmith_Rothschild.h...](http://www.iamthewitness.com/DarylBradfordSmith_Rothschild.htm) (timeline with narrative)

<http://www.iamthewitness.com/DarylBradfordSmith_Bankers.htm> (banking and usury timeline in general)

<http://www.iamthewitness.com/doc/RothschildsTimeline.ppt> (powerpoint slide deck on Rothschilds from the sources above)

[http://www.rumormillnews.com/cgi- bin/archive.cgi/noframes/re...](http://www.rumormillnews.com/cgi- bin/archive.cgi/noframes/read/39506) (how Nathan Rothschild cornered the London Stock Exchange and became a billionaire in early 1800s).

<http://video.google.com/videoplay?docid=5352106773770802849> (Money as Debt - quintessential primer on fractional reserve banking and debt)

Money Masters - <http://www.sprword.com/videos/moneymasters/>

The Secret of Oz Trailer - <http://www.youtube.com/watch?v=6cq9yEVcGIU>

A few more [http://linkedtheory.blogspot.com/2011/02/world-economic- coll...](http://linkedtheory.blogspot.com/2011/02/world-economic-collapse- ahead.html)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This raises many questions:

\- how speculative are they about the rare material they intend to find?

\- how are they going to mine and transport them?

\- how much is it going to cost?

\- will it be worth it in the end, compared to earth mining (which to this day still requires considerable manpower)?

Until such questions are answered, I think it would be more appropriate to look at this more as robotic experiment, not a moon mining startup project.

<comment><USER9> There are something like 20 minerals that are important to US industry (some are essential) for which the US has no usable internal sources and so relies on imports. For many of these, most of the world's supply is in assorted unstable third world countries (mostly in Africa), or the former Soviet Union, or China. These minerals are often called "strategic minerals".

For instance, here's a map of where cobalt comes from: [http://upload.wikimedia.org/wikipedia/en/9/94/2005cobalt_%28...](http://upload.wikimedia.org/wikipedia/en/9/94/2005cobalt_%28mined%29.PNG). (Cobalt is essential in making the alloys used in jet engines, so a loss of access to cobalt could serious harm the US militarily).

Having an emergency backup plan for these minerals, such as moon mining, would be good even if it is expensive.

<comment><USER4> There is such plan for every single strategic resource. Stuff like opening mines, that are currently unable to compete, because of low prices of Chinese, etc. products.

</comment></comment></comment><comment><USER10> This is interesting. In my time designing lunar excavation equipment, much of our problems arose from the intended location: permanently shadowed regions of craters. We were intending to mine for water for propulsion, consumption, etc purposes.

Basically, it's _really_ hard to mine in those conditions. And when I say "conditions," I mean down to 50K. Lots of familiar materials just won't work at those temps.

Mining, instead, for high-value minerals would presumably not require such extremely low temperatures. It would, however, still have to endure many of the other issues we faced: never-eroded (read: abrasive) regolith, the vacuum of space, reduced reactionary mass, etc.

I wish them luck!

<comment><USER11> Couldn't you use mirrors from the surface? I would think you could easily double that temp in K considering the light from a mirror the size of a piece of paper puts out about 15W of heat.

</comment></comment><comment><USER12> Nearly 40 years ago I heard the sometime astronaut and future senator Harrison Schmitt speak at the Colorado School of Mines. Nearly all I remember is that I learned that it was possible to sleep sitting up in uncomfortable plastic seats--Schmitt was not a good public speaker.Yet I remember him, in response to a question from the audience, distinguishing bodies of ores, which can economically be mined, and formations of minerals, which perhaps can, perhaps can't. Schmitt, then and suppose yet the only geologist who had been to the moon, did not seem to think we'd be mining there soon.

</comment><comment><USER13> Sending stuff in space (above low earth orbit) is the costliest things ever. So far, only a handful of states managed to send things to the moon, and only two managed to bring something back from it. The last time it happened was thirty-five years ago. And when I say "bring something", I mean a hundred grams (less than 3.6 ounces).

Only one organisation managed to send astronauts there and bring them back.

There are plans to do it again, but you can bet space exploration will remain state controlled for a very long time.

</comment><comment><USER7> More on the redoubtable Naveen Jain: <http://www.crunchbase.com/person/naveen- k-jain/posts>

</comment><comment><USER14> It's a scam. Just doing some basic arithmetics would show you that even if you find rare earth metals on the moon, there is no way you can get them to earth for anything near their cost on Earth.

These guys probably just want to win the Google challenge and do some cool spaceship stuff and need a story to tell investors.

<comment><USER15> well actually we dont know whats inside the moon soil, just like you can have some sort of "scanner" and scan earth below to determine where diamonds are located.

AFAIK, there never been any digger machines located on the moon, so... :)

</comment></comment><comment><USER16> Mine the moon? That's a pretty stupid idea. Much better to aim for an asteroid - no property rights and no gravity well to escape afterwards. Net value of the rare earths in a 1 km asteroid was ~1 trillion dollars, from memory.

There aren't any trojan asteroids in the earth-moon system according to <http://map.gsfc.nasa.gov/mission/observatory_l2.html>, but there are quite a few close approachers which could potentially be redirected closer to Earth.

btw, this is not a new idea, so there's no excuse for not knowing about this, especially if you're in the field: <http://www.nss.org/settlement/L5news/1982-harvesting.htm>

<comment><USER4> Those close approaches are moving very fast.

Plus who would wont some limited liability startup to redirect asteroids closer to Earth, probably using big thermonukes?

<comment><USER16> Objects in orbit are also moving pretty fast. Slowing it down a bit so that it's captured by Earth's orbit wouldn't take that much energy. Also, mass drivers would be the preferred option, no nukes necessary.

A 200 metre asteroid might make a pretty big hole, but then so would profitable quantities of ore coming back, or a rocket capable of getting to the moon in the first place. Nobody seems to be too worried about SpaceX accidentally crashing their moon-capable rockets into a city.

<comment><USER17> Seriously? You're comparing a rocket with a self-destruct button to an uncontrolled projectile with several hundred times more mass?

<comment><USER16> Several hundred? I think you're at least a couple of orders of magnitude out there...

The point behind the rocket analogy was that rockets are inherently dangerous, uncontrolled projectiles. They explode, spin out of control, travel at hundreds or thousands of km/hr - but that's apparently ok. And it is, because there are safeguards in place.

a) how are you getting the ore back to earth? Your choice is to either burn it back in on a rocket or splash down your hundred or thousand tons of platinum somewhere. Rockets are hideously expensive, which leaves you with... an uncontrolled projectile.

b) mass drivers have a small amount of thrust, over a long period of time. It might take a couple of years to get it captured by earth - think slow orbit corrections over time rather than an uncontrolled asteroid missile. Once you get to that point, you'll have several more years to circularise the orbit. Hardly an uncontrolled projectile - Its path is easy to predict, and is incredibly unlikely to hit the earth. You'd need to burn a lot of energy to do so once it's in a stable orbit.

<comment><USER17> Yep... you're right... s/several hundred/thousands/

My main point is that rockets have a big red button, and an 8,000,000,000kg rock does not.

<comment><USER16> Well, yes - but asteroids have plenty of time to correct, whereas a rocket doesn't. The safety measures are likely to be completely different.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> About time.

All I can say is good luck, and that I hope to see lots of competition for these guys in the near future.

</comment><comment><USER19> Gerard K. O'Neill is smiling up in heaven at this — if you don't know him read his bio: <http://en.wikipedia.org/wiki/Gerard_K._ONeill>

<comment><USER20> go here instead :) <http://en.wikipedia.org/wiki/Gerard_K._O%27Neill>

<comment><USER19> Thank you kind sir!

</comment></comment></comment><comment><USER21> Does this mean we're in a bubble now?

<comment><USER22> No the space bubble ended the day Neil Armstrong set foot on the moon, we're currently rebuilding technology to get us back to 1969.

</comment></comment><comment><USER23> I'm no astronomer or physicist, but isn't the mass and weight of the moon sort of vital to maintaining stable life as it is now on Earth?

<comment><USER24> The moon is quite large. To move a measurable percentage from there to here (one large enough to affect things like tides) is well beyond our current capabilities. We'll be OK. :)

<comment><USER23> Oh, sure. I'm sure we used to say that about the bison, too. :)

</comment></comment></comment><comment><USER25> It is the anti-pioneering spirit in me telling me that this is rubbish?

</comment><comment><USER26> That's it. I'm starting a new organisation called Greypeace, to protect the moon's ecological system. Our goal will be attacking these lunar rovers with inflatable rockets in order to raise public awareness.

I'll post a link where you can donate money for this completely legit organisation shortly.

<comment><USER27> I know you're joking, but...

When I was in college, I was hanging out with some guys who worked for Greenpeace. I asked them, "how would you feel about mining the moon for raw materials?" The response I got back was basically, "NO!", "THAT'S HORRIBLE!", "O.M.G. YOU'RE EVIL!"

I tried to explain that the moon was a big, lifeless, ball of rock. But they were having none of it. They all thought we should leave the moon alone, pristine in its lifelessness. <shrug>

<comment><USER28> That _"big, lifeless, ball of rock"_ partially controls the oceans' tides. I would be in favour of leaving it alone. Just because something is technically possible doesn't mean it should be done.

<http://en.wikipedia.org/wiki/Tide#Forces>

<comment><USER29> You would have to remove a significant chunk of the moon's mass before mining it affected the tides in any serious way. There's a lot of useful mining you can do without violating that constraint.</comment></comment></comment></comment>


Is the Universe a Hologram? - <AUTHOR> http://www.sciencedaily.com/releases/2015/04/150427101633.htm

<comment><USER2> It's funny how some of the more advanced cosmological theories sound as if they came straight from the minds of stoned teenagers. To wit: [http://en.wikipedia.org/wiki/One- electron_universe](http://en.wikipedia.org/wiki/One-electron_universe)

The universe is a strange place indeed.

</comment><comment><USER3> Sure, it's one interpretation and a solution to the Black hole information paradox. But I don't like to talk about space without time, preferring this solution [http://en.wikipedia.org/wiki/Black_hole_information_paradox#...](http://en.wikipedia.org/wiki/Black_hole_information_paradox#Information_is_encoded_in_the_correlations_between_future_and_past.5B14.5D.5B15.5D)

<comment><USER4> You can talk about space without time though you can't talk about changes of information (i.e.: movement through space) without time.

</comment></comment><comment><USER5> > They are negatively curved, any object thrown away on a straight line will > eventually return.

Isn't that describing positive curvature (e.g. a sphere)?

<comment><USER6> The inside of a sphere. [http://i.imgur.com/b2KgM6X.gifv](http://i.imgur.com/b2KgM6X.gifv)

<comment><USER7> That was really interesting, do you have a source? (The title makes it seem like a joke though)

<comment><USER8> Google Hollow Earth. There are many conspiracy theory sites handling it, but I think it is a quite interesting concept nontheless.

</comment></comment></comment></comment><comment><USER9> Why it should be 2D? Three-dimensional hologram would totally works for us. Something like The Matrix and 13th Floor combined... You have everything in 3D around you and just a tiny part of the Universe (where you are currently looking at), because it is not possible to simulate the full Universe (the energy since the Big Bang till now won't be enough).

<comment><USER10> All holograms only have 2 dimensions. They "trick" us into thinking the image you are seeing in the hologram has 3 dimensions. The idea behind the Universe being a hologram is that everything exists in flat space; however, it appears to us as being in 3 dimensions. Think of a video game, where you are moving around in a 3d world, but it's not really 3d, it just "feels" like it is.

<comment> saiya-jin ever been diving? feels pretty much as 3D as you would expect

</comment></comment></comment><comment><USER11> Anyone interested in this can find an excellent lecture here [http://m.youtube.com/watch?v=dEaecUuEqfc](http://m.youtube.com/watch?v=dEaecUuEqfc) and of course by looking up leonard susskind's stuff on the black hole wars and universe as a hologram

<comment><AUTHOR> yes leonard susskind's stuff on this is excellent!

</comment></comment><comment><USER12> What will happen when photons reach the outer boundary of the universe? Where time and space starts to slow down ... Will the photon also slow down, and then take an elliptic path? Might explain why the universe seem to expand in all directions.

</comment><comment><USER13> [http://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines](http://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

<comment><USER14> I don't think it really applies in this case? It's pointing out a new scientific theory that raises a question. The author isn't poising a question him/herself

</comment></comment><comment><USER4> It From Bit : )

<comment><USER15> Wheelerian thought should never be down-voted.

</comment></comment><comment><USER16> someone once told me, the Universe is someone's dream.

When we dream, is it in 2d or 3D ?

<comment><USER17> Memory is in 3rd person.

This is entirely irrelevant.

</comment></comment><comment><USER18> The universe is just a projection of a massive Turing machine two dimensions, time and tape.</comment>


Ask HN: A way to follow G+ users through code? - <AUTHOR>

I was looking for a Google+ API so I could scour through the folks I follow on twitter, find them on G+ and then follow them. So far, no dice. Has anyone found a way to follow someone or search G+ through code? <comment><AUTHOR> A search for people on G+ can be done like so: [http://www.google.com/search?q=google&hl=en- US&tbs=p...](http://www.google.com/search?q=google&hl=en-US&tbs=prfl:e)</comment>


Show HN: Free alternative to intercom.io live messaging - <AUTHOR> https://crisp.im <comment><USER2> Great product! I already use it and my retention have just explode. My users now talk to me easily and I can retrieve a lot of feedback. I have test other products like intercom and cie and in two words: it's expensive for a lot of complicated tools that I will never use.

</comment><comment><USER3> Looks really great!

Do you guys plan to open up the plugin capabilities? We're building a marketing automation platform that we're hoping to connect to support software as well

</comment><comment><USER4> This looks perfect for what we need, and the price is certainly right.

<comment><USER4> The notifications don't play any sound or vibrate on my Nexus 6. Also, if I go to the notifications screen and hit save, it alerts that the changes are saved, but it doesn't close the screen, so I'm stuck there until I hit cancel. Little bugs, nbd.

<comment><USER5> Hi! We're still early in the product, mobile apps are in beta ATM, we're working on native versions for them, current versions are just transitional versions.

</comment></comment></comment><comment><USER6> How do you plan to make money if it will be free forever?

<comment><USER7> We plan a plugin system. The core is all free, and to get special features we have a marketplace. Crisp + Slack, Crisp + Zendesk, etc.

<comment><USER6> Trello is doing something similar.

</comment></comment></comment><comment><USER8> The chat seems to be completely broken - getting an "Invalid chatbox code" and its not possible to add a site.

<comment><USER5> Can you retry now? We had some event processing delays due to our growth.

</comment></comment><comment><USER9> Email notifications doesn't send if visitor doesn't leave it's email

<comment><USER5> Hey! Which way? Email notification for an unread message from visitor to operator after 1 minute, if visitor doesn't leave his email, is that right?

<comment><USER9> Exactly. I'm talked about it in support chat some days ago (last message – 26 / 02).

PS. Found small bug – February dates became January :-) [https://yadi.sk/i/SCwY2ubWpnqnV](https://yadi.sk/i/SCwY2ubWpnqnV)

<comment><USER5> Bug fixed. Email event processing was delayed yesterday, emails should have be dispatched a few hours back ago.

<comment><USER9> Thank you, it really work now!

</comment></comment></comment></comment></comment><comment><USER10> This is awesome. Totally trying this out. Thank you for sharing.

</comment><comment><USER11> curious what the tech stack is?

<comment><USER5> Hello! We're running NodeJS (ECMAScript 6), RabbitMQ and Redis at the core of our infrastructure. The whole thing is split into micro-components (eg: a worker dedicated to emails, another to client-side websocket, another to messages, etc).

<comment><USER12> If you looking for free alternative for intercom: [https://userengage.io](https://userengage.io)</comment></comment></comment>


BlueBrain - Year One - Modeling the brain - <AUTHOR> http://thebeautifulbrain.com/2010/02/bluebrain-film-preview/ An Amazing Project. <comment><USER2> A very interesting and informative piece. I knew in the abstract what the Blue Brain project was doing, but this really clarifies the route they're taking. Was a bit annoying how it sounds like they need to justify it with. This is worth doing for the pure coolness of it.</comment>


Show HN: dstack.ai – publish, track, and share data visualizations - <AUTHOR> https://dstack.ai <comment><AUTHOR> Hi HN,

I am Riwaj from dstack.ai. dstack.ai offers a convenient way to publish, share, and track data visualizations, analysis results, and data reports.

In our experience, as of now, many data analysts and data scientists work through the data in various tools such as excel, Jupyter notebook, etc. and then share the graphic with their peers, managers or clients using local network drives or emails in the form of PDFs or PowerPoints. There is also a growing number of users and teams who use BI Tools, Tableau, Superset or build custom applications to organize interactive dashboards and reports. When it comes to tracking the visualizations or analyzing results, some teams resort to work around methods such as printing the result in a document and then using version control tools over the document. In summary, there are a variety of tools available for exploring, tracking and sharing reports, but many of these allow to publish reports generated by their own tools thus allowing for very little flexibility for a team that works with multiple programming languages, tools, and plotting libraries.

We at dstack.ai have built a light-weight solution where you can publish the data visualizations via APIs from anywhere (a Jupyter notebook, a script or an application) and store them in our web application (which is also mobile friendly) for collaboration with teams and clients, i.e., you can share the published charts via URL and comment on each stored chart (think of Instagram). Our current version supports Python and R as programming languages, and Matplotlib, Ggplot2, Plotly and Bokeh as plotting libraries. In our first version, we only support static charts and basic interactive charts, i.e., if you stored charts with certain parameters, the users who browse through those charts can play with only those specific parameter values.

We think there is a lot more one can offer to improve the current process of a collaborative exploration of data visualization for teams. As basic as our current solution is, we are currently working on releasing new features such as \- Organizing the charts into dashboards \- User groups and permission management \- Plugins for spreadsheets such as Google docs and MS Excel \- Dynamic plots and dashboard that fetches data from a data source and can be scheduled to update regularly \- A mobile application to access the visualizations, \- On-prem options

We would love to hear about your challenges in the area of collaboration around data visualization, and receive any feedback on what we currently have. For your reference, here is the documentation for product usage. [https://docs.dstack.ai](https://docs.dstack.ai)

</comment><comment><USER2> DataViz-as-a-service?

<comment><AUTHOR> Hi shail619, the service we offer is currently tailored for collaboration on data visualizations. We hope that our current solution bridges the two parties that work with data reports - those who produce it and those who use it to make business decisions. In the future, we aim to extend our service to other kinds of data services around data science and data engineering.

<comment><USER2> Actually, thinking about it more, it sounds more like a marketplace.. a market place that brings together the dataviz producers and consumers.. ebay for data viz of sorts almost

</comment></comment></comment><comment><USER3> So it's plot.ly, but costs money?

Oh I see you have a dot-ai domain. Very cool.

<comment><USER4> Hi, a co-founder here. My name is Andrey. Actually, Plotly is our source of inspiration in a way. However, I think, the problem we are trying to solve lies a different direction. Just a few points to show how we are different: 1\. We would like to support Plotly as one of the plot libraries (which is super great by the way). In addition we'd like to support many other libraries – anything that the user is using, incl. ggplot2, Matplotlib, Bokeh, etc. 2\. We would like to combine the approaches Plotly offers in two different products (Chart Studio and Dash) into one and simplify the process of reporting data and the process of organizing dashboards. 3\. Ideally, we'd like to help companies also organize and simplify their security around accessing the data. 4\. We'd like to help build dashboards easier – by eliminating the needs of development entirely.

Just also want to mention, that our current offering and all other basic functionality that we will add, such as permission control, dashboards, etc will remain free. Anyway, it's just a start for us to really learn what our potential customers and users are doing and build that things that are currently missing – not blindly copying anyone's features. Having said that, I'd still like to thank you for your feedback. In case you have an idea of how we can help your teams collaborate around data, please let me know andrey at dstack.ai</comment></comment>


Show HN: FunFeed - a reddit, 9gag, and other 'time waster' site aggregator - <AUTHOR> http://www.funfeed.io

<comment><USER2> Wow, this is actually pretty amazing -- good design (maybe consider multiple things on row or some sort of grid setup?), and it definitely works pretty well.

Hopefully this isn't a premature optimization, but you're definitely going to want to look into as much caching as possible -- you could get a ton of traffic much faster than you think, and the requests people do to turn on certain pages would benefit.

Also, add some sharing possibilities (you know, the usual fb/twitter/digg/etc bar) -- and you might see this jump really quick.

The most important thing I have to say, is that it was easy/pleasing enough to use that I started using it almost instantly, which is a great sign.

Also, make sure you're not violating any TOS's?

[EDIT] - Thought of some more stuff -- Would it be terrible to color code the background of each entries? In addition to putting them in some sort of grid format, you could give reddit, 9gag and the last one their own color, and have all the things from each source color coded, that way, you could save some space (without the square), but yet have really clear attribution (I'd suggest blue for reddit, gray for 9gag, and... whatever color for the third one?)

BTW I am like 15~20 mins into using your site right now, definitely is awesome

[EDIT2] - You could also add some in-browser (js) repost detection (I mean simple levenshtein distances could be a good start), that would be great, and would get rid of some redundancy that I'm seeing in stories

<comment><AUTHOR> Thanks for the feedback! All good points. I definitely need to add some sharing capabilities in there. In the future I'll give users the option to switch between grid and list views, but for now I just want the site out there for people to use and give me feedback on.

Anti-repost functionality is another thing I'm working on and will add in a future release.

<comment><USER2> Oh, I meant just to share the site on fb or something... There's sharing for each one of the posts, but I also just mean in general for the site</comment></comment></comment>


RESTful API that Unifies Cloud Storage - <AUTHOR> http://airpost.io/

<comment><AUTHOR> I wanna know what devs think. Is this useful?

<comment><USER2> It looks and reads like a parody of filepicker.io.</comment></comment>


Google, Apple and the future of personal computing - <AUTHOR> http://www.roughtype.com/archives/2007/10/google_apple_an.php

<comment><USER2> Another human predicting future. When all of these "fantasy" ends?

You dream/vision about something and you do it. That's when dream/fantasy becomes reality. Not when some hi-tech blogger wrote an article how to use your MacBook with your Google account.

<comment><USER3> His writing could very well be the inspiration that one of us needs to get to work his version of the future.

</comment></comment><comment><USER4> That honestly doesn't sound terribly innovative to me. Of course the data will be centrally located, and of course the low-end computers will be cheap. However, there will always be a market for high-end computers, and companies will gladly provide them (and reap huge margins)

The most important thing about the future of computing, in my opinion, is the connectivity; the fact that you'll be connected to all of the world's information, and all of its inhabitants, always, no matter where you are.

I'm still waiting for a computer I can wear.

</comment><comment><USER5> This device is already here. It is called the iPhone.

Personal Computing, to me, could be summed up to "uses of a computer when you are not working".

Video, Music, communication, consuming services, games. What kind of software in "Personal Computing" is lacking for any smartphone to be considered a "Personal Computer"?

</comment><comment><USER6> I don't think Apple is interested in creating cheap computers.

<comment><USER3> Sure they are.

If they can keep making quality products and get them in to the hands of even more people, why wouldn't they? It would only mean more profit for APPL.</comment></comment>


Automatic Responsive Images on Jekyll Without Plugins - <AUTHOR> https://jetholt.com/jekyll-responsive-images/ <comment><USER2> This is great, one of the things that Jekyll lacks, thank you for sharing this.</comment>


CVS Disables NFC Terminals, Stops Accepting Apple Pay, Google Wallet - <AUTHOR> http://www.macworld.com/article/2839081/cvs-disables-nfc-terminals-stops-accepting-apple-pay-google-wallet.html <comment><USER2> [https://news.ycombinator.com/item?id=8508894](https://news.ycombinator.com/item?id=8508894)

</comment><comment><USER3> Well, as a happy Google Wallet user, I'm more than happy to take my business to Walgreens, instead.

Apple's marketing engine is one of the best in the world. It seems borderline suicidal to go up against them by intentionally hamstringing a new iPhone feature in order to promote an inferior alternative when people have an easy alternative. Google Wallet I could understand - it's been woefully underpromoted, and carrier shenanigans have really stood in the way of adoption, but Apple drives adoption like nobody else - I was excited for Apple Pay specifically because I expected it to drive the adoption of NFC at more retailers (which means more Google Wallet support for me!)

I wonder who greenlit this thing.

<comment><AUTHOR> Like you, I'm super glad that Apple Pay is using the same underlying standard as Google Wallet (now all I need is a good Android phone with something Touch ID-esque).

The greenlighting probably came from the entire Business Intelligence department of these retailers who are going to lose the names of the people they're recording. If everyone went to NFC tomorrow loads of people will have to find new ways to do their jobs (ironically Apple is also pushing iBeacon for tracking consumers, so the solution is already there really).

<comment><USER3> > going to lose the names of the people they're recording.

I just don't buy this. Loyalty cards are a thing specifically because they give those retailers customer information and associated purchase histories completely independent of payment method. Crank a few prices up and "reduce" them with a swipe of the loyalty card and you've got all the data you need.

<comment><AUTHOR> loyalty cards give them the right to spam you with ads (through snail mail) as well though.

I'm not saying this is a right action, but this is one thing they lose. I don't know about adoption rates of loyalty cards at stores in the US.

</comment></comment></comment></comment><comment><USER4> I understand they would like to capture some of the value, but seriously? They are building a technology that, when built, will be worse than already implemented technology backed by the two largest tech companies google and apple. They have to think, does getting the customer information (which they could just freely share with each other without this system) provide enough value to actually spend money to compete with large tech companies? They obviously won't succeed.

<comment><USER5> You and I think it's obvious, but the complexity of these projects is not obvious to people outside the software industry.

</comment></comment><comment><USER6> "The upcoming CurrentC system, by comparison, will require you to scan a QR code, or show a QR code to your cashier"

Yeah, good luck making this inconvenience fly [http://techcrunch.com/2014/10/25/currentc/?ncid=rss](http://techcrunch.com/2014/10/25/currentc/?ncid=rss)

</comment><comment><USER7> Goodbye CVS, goodbye RiteAid. Hello, Walgreens. I'll vote with my money (or rather, iPhone 6). And I bet that they'll reverse that moronic decision eventually once ApplePay gets sufficient traction and cuts into their bottom line, and/or their own home-baked store-specific solution doesn't take off.

</comment><comment><AUTHOR> Apparently CVS and Rite-Aid are participating in this competitor retailer-run card program called CurrentC, run by something called Merchant Customer Exchange

[http://www.mcx.com/](http://www.mcx.com/) <\-- their website is ultra-broken, but seems like they're getting a lot of partners.

</comment><comment><USER8> No, America. Please don't ruin this for us. Australia has been ahead of you guys on NFC takeup for a while now, and it's _wonderful_. Every Visa/Mastercard has NFC support, and it's now super unusual to find a retailer that doesn't accept it. If you guys come up with a competing standard that's _worse_ , and it gets enough acceptance that it has effects over here, I'm going to be pissed.

</comment><comment><USER9> AM I the only one who think this is a good thing? Why am I paying 2-3% Credit Card tax for every purchase when I can pay from my Bank account directly?

Apple and Google took the easy way out to base on existing Credit Card infrastructure where ultimately consumers are paying for it. Retail is a low margin business and 3% definitely is a big deal.

<comment><USER10> Do you really want these guys to have direct access to your bank account given their track record for data breaches? On top of this you get no credit card protection, no rewards points on your card, and no double warranty which most cards give these days.

<comment><USER11> You're thinking too small. It's possible to have a payment infrastructure that doesn't give Visa and Mastercard money, and it's possible for it to work really well. [https://en.wikipedia.org/wiki/EFTPOS](https://en.wikipedia.org/wiki/EFTPOS)

<comment><USER12> note that in practice EFTPOS is getting beaten down by still not doing contactless, while Visa Debit/Mastercard Debit contactless cards are ubiquitous in Australia, and banks pushing Visa/Mastercard Debit for the higher interchange fees.

</comment></comment></comment></comment><comment><USER13> Does that include PayPass/PayWave contactless cards as well? Most credit and debit cards in Australia use that tech - disabling it wouldn't fly over here...

Also, it's laughable to think that a system that requires scanning QR codes would gain traction over an NFC based solution. Just seems janky and annoying.

</comment><comment><USER14> CVS, Wal-Mart, et al are pretty smart. I think this is less about margin than this is about a nascent existential threat. It's about who owns consumer data. That data gives anyone the leverage to displace your business.

You might say - well, what's the difference between credit card providers and Apple Pay? It's this: credit cards don't have a screen; the output is a piece of paper every 30-days.

<comment><USER3> How do you figure? They already own the consumer data via "loyalty cards" independent of the payment method.

How does Apple Pay/Google Wallet rob them of information and put their business at risk?

<comment><USER14> It's not zero-sum; the data is duplicated, and then can be used to build services that undermine the retailer. Slightly less nefarious, building services which the retailer can pay for - starting an arms race that apple profits from.

</comment></comment></comment><comment><USER15> Why does vicious competition exist in the mobile payment space? All these solutions only introduce a convenient middleman between the credit card and the physical store.

Is there some sort of profit motive involved here, like fees off every transaction?

If not, I have no idea why mobile carriers and retail stores are jumping in to try to monopolize everything if it's just a convenience.

</comment><comment><USER16> Apple should just return the favour by promising to reject their app, when it comes out for the same anti-competitive reasons.

</comment><comment><USER17> Meh, in the end, it will be another bank that NFC wallets will provide.

</comment><comment><USER18> so this one finally made it to the front page.

very curious as to what happened to these stories here on HN. twitter lit up (devs ands business people), gruber wrote a story, etc - HN could not get it on front page.

<comment><USER2> It was: [https://news.ycombinator.com/item?id=8508894](https://news.ycombinator.com/item?id=8508894).

Curiosity is good, but I'm pretty sure the reason for what you're asking about is just randomness.</comment></comment>


Treating the Stone in 16th Century Wales (According to the Vicar of Gwenddwr) - <AUTHOR> https://recipes.hypotheses.org/9209 <comment><USER2> Title does not match link. Title matches: [https://recipes.hypotheses.org/9209](https://recipes.hypotheses.org/9209) While link matches title: "DYEING TO BE CURED".

<comment><USER3> Thanks! We updated the link to the article matching the title.</comment></comment>


Clojure, Parallelism, and Genetic Algorithms - <AUTHOR> http://blog.ethanjfast.com/2009/10/on-parallelism/

<comment><USER2> This isn't surprising, the simplicity of the problem does not exceed the overhead of parallelism. A task like that is actually quite rare in practice, but easy to stumble upon when doing demo or example code.

Even with Erlang I don't expect much improvement, when what you're solving is trivial for a single core, adding more cores and processes does not help.

<comment><USER3> Yes, mainly because pmap is an early demo of how one could do parallelism in Clojure. It remains useful for mapping very heavyweight functions across relatively small data sets. It is not a substitute for Fork/Join, which is on the way.</comment></comment>


Why you shouldn't share private links on Facebook - <AUTHOR> https://medium.com/@intideceukelaire/why-you-shouldnt-share-links-on-facebook-f317ba4aa58b#.9prlbyj7i <comment><USER2> Previous discussions: [https://news.ycombinator.com/item?id=11875419](https://news.ycombinator.com/item?id=11875419) and [https://news.ycombinator.com/item?id=11868077](https://news.ycombinator.com/item?id=11868077)

</comment><comment><USER3> Minor correction if we go by my own anecdotal evidence:

> When is a link scraped and stored in Facebook's database?

> From my testing I assume that a link is stored in Facebook's database from > the moment someone actually clicks it on Facebook. This does not apply to > links shared through Facebook which no one clicks on.

Watching server logs at the time I paste the link, the link is scraped immediately. Before you even hit send immediately. I imagine they do this so that they can populate the little preview window if you've pasted something that has an og:image or other rich media. If you paste it, it's instant, otherwise if you're manually typing the link it seems to wait for you to type a space character.

<comment><USER4> Pure speculation, but it's possible you are both correct. They definitely scrape the link for a preview when you paste (or if someone's already shared it, maybe just re-use the info from a previous scrape) but probably it's not stored in their database (and thus available through the Graph API) until after it's been shared. (Or clicked on?)

</comment></comment><comment><USER5> Better, don't put private information behind a publicly accessible link. E.g. that google doc has its own access control, don't set it to "share with anyone who has the link".

Links are leaky, think about Referer, JS to access history, DNS request, ...

<comment><USER6> Right. Don't put anything on an email, or on Facebook, that you wouldn't want the world to know. After all, it's all stored somewhere and is readable there (except if it is end to end encrypted and encrypted while at rest).

</comment></comment><comment><USER7> Just as a general rule, I tell my kids that anything posted anywhere on the internet should be considered public. If you aren't comfortable with that, don't post it.

<comment><USER8> At some point, FaceBook, gmail, or some other instant messaging platform will be hacked and its data leaked, probably ruining lives of thousands of people.

I like iMessage for that reason -- Apple doesn't see my messages. I don't know what's happening with my email on Google's servers, or my instant messages with friends on chat apps for example, but I assume the data is stored for a long time, even if you delete it.

Just today there's news about a dating website being hacked and private messages leaked - [https://news.ycombinator.com/item?id=12008234](https://news.ycombinator.com/item?id=12008234) That's with a smaller site, it's only time before one of the big boys are leaked.

</comment></comment><comment><USER6> More accurate title: why you shouldn't share any private links on Facebook.

<comment><USER9> Even more accurate title: Facebook doesn't care about privacy

<comment><USER10> No, this is less helpful. Everybody knows this, yet still a lot of us use facebook. It's nice to know what the specific problems are.

</comment></comment></comment><comment><USER11> Don't click on them either; they might be altered.

</comment><comment><USER12> Very informative!</comment>


Show HN: Taurus.io - Create a product tour for your web app in 15 minutes - <AUTHOR> http://taurus.io/

<comment><USER2> Cool product! Congrats on launching. I can think of several companies off the top of my head who should implement this yesterday. But I have to take issue with the price point. $3 a month? If you're doing it for fun, make it free. Otherwise, the price should be 10x if not 100x your current rate. Trust me, if someone is going to go through the effort of setting up your product, they'll be willing to pay more than $3 a month. At that price point you'd need 1,000 customers just to be ramen profitable!

<comment><AUTHOR> Thanks!

The problem with being 10x or 100x the current rate is that we can't actually justify that cost for the value we provide. When we set the price point, we basically asked ourselves how much we'd actually pay for the same thing.

<comment><USER3> What others have said, plus: I don't trust you to stay in business at $3/mo. You may deliver an awesome product, but I simply don't believe the economics will work at all for $3/month. At best, you'll cut corners and your service will start to suck. This makes me much less likely to put you in the critical path of my business. So charge more and make everybody happy!

Suggestion: segment on the complexity of the product tour? Maybe by the # of steps included? Or (better) allow me to add audio/video to my tours and charge me more for that.

<comment><AUTHOR> Great suggestions! # of steps included is something we haven't thought to implement, will do!

</comment></comment></comment></comment><comment><USER4> Ok, so a lot of people are commenting you are charging too little and your general reply was you felt you didn't deliver the value to justify a higher price.

In that case, I think you need to search for value. What can you do to make a higher price worthwhile?

Here are my thoughts:

\- Analytics! What are people viewing? Plug it in and tell me what is working and getting mouse time or clicks (or conversions)

\- Split testing! I'd love to test out two tours to see which converts better.

You could make the current version free, to a certain point of traffic and make all the new features points of value to charge a better price.

<comment><AUTHOR> Split testing sounds like a really neat idea! We'll talk about working that in later down the line. :)

</comment></comment><comment><USER5> Feature request that will make this much more valuable - relative adjustment, if you can create a tooltip that will stay near a selector (regardless of browser resizes) and will be responsive (e.g. size and font will adapt based on size) then you'll have something worth not 3$ but 30$ a month easily.

I like that you demo the usage of the tool rather than the end result, but for some people it might be too cumbersome, at least make the demo login automatic

By the way, a solution to both issues - use your own product to tour your own product.

<comment><AUTHOR> This was originally in our plan for beta launch, but we yanked it to get something out faster. It's definitely in the pipeline. :)

</comment></comment><comment><USER6> Looks like Kera.io, great project. I'd love to hear how you guys differ btw :)

<comment><AUTHOR> This is pretty cool. We're less intensive than this, but we try to make the whole product tour setup very WYSIWYG. From what I saw, they do a neat job of delivery the full product-tour-package, but at the cost of engineering effort.

<comment><USER7> Cameron from Kera here. You're right about you guys being wysiwyg and I think that's awesome. It's super important and I think you're on to something!

</comment></comment></comment><comment><USER8> Looks really great, congratulations.

A few things I picked up on though:

1\. Couldn't toggle Absolute/Relative after I had placed a tooltip.

2\. If you position your tooltip then click the "Display Next Button", the arrow moves, but the positioning stays the same (with a side arrow). Just a UI bug.

3\. Instructions on the syntax to use for javascript event field.

4\. Binding to an element would be nice.

5\. Having the "Next" button move on to the next tooltip, hiding the old, and displaying the next. I think I'd like to use that flow rather than seeing all the tips at once.

<comment><AUTHOR> Thanks! We'll look into those issues; additionally, we'll be adding a bind to element feature in the future.

</comment></comment><comment><USER9> what's the different with using Bootstrap tour ( <https://github.com/sorich87/bootstrap-tour> ) or Joyride ( [http://www.zurb.com/playground/jquery-joyride-feature- tour-p...](http://www.zurb.com/playground/jquery-joyride-feature-tour-plugin) ) for example?

<comment><AUTHOR> When we worked on a previous project, bootstrap was something we based our product tour off. Joyride, similarly, accomplishes the same deal with a little more fluff. However, there were a few things that were tedious.

\- Keeping track of who has seen what tooltip, when they should show up, backend type stuff.

\- When things moved around, layouts modified slightly, they were a pain to update. Granted it wasn't always the case, but it was enough that we decided we ought to build a front end to handle it. And thus, Taurus was born.

We realized that while engineering the product tour isn't hard, it takes time to make and maintain, and that we could help solve that.

<comment><USER9> Thanks for the reply. You should put that on your website because from what I saw it wasn't really clear that there's a backend to manage my tours and to see some metrics.

<comment><AUTHOR> No problem! Will do. :)

</comment></comment></comment></comment><comment><USER10> Looks cool. I think I would find it more useful if I could see a demo (not of the authoring, but of the result).

<comment><AUTHOR> Thanks! If you create some tooltips on the page and refresh the page, you kind of get a feel of what it would be like for a visitor (though "Hide" won't permanently hide the tooltips in that state).

<comment><USER11> This is not evident from your demo. Can you include the tooltips to show up by default in your demo page? I am guessing most people would first want to see how the tooltips come up, before they get interested in editing/authoring them.

</comment></comment></comment><comment><USER12> I signed up to be notified. But... Please include a quick summary of the app in the notification mail to make us remember what it was, when the time comes.

<comment><AUTHOR> Will do. :)

</comment></comment><comment><USER13> Beautiful site. Have seen a few of these on HN but your implementation looks the best so far. We need this - looking forward to launch.

<comment><AUTHOR> Thanks for the kind words. :)

</comment></comment><comment><USER14> This would certainly be useful for a lot of the other Show HN's. Can't wait to see this in production.

</comment><comment><USER15> Keen to get this setup, we need a product tour but didn't have a good way of building it quickly.

<comment><AUTHOR> Send me an email, I'll be sure something comes your way when we launch.

firstname.lastname@example.com

</comment></comment><comment><USER16> It's not working for me. It just says [object Object] Firefox 16.0.1 on MAC OS X

<comment><AUTHOR> Ah shoot. Haven't heavily tested outside of Chrome. I'll check it out, thanks!

Edit: Fixed the issue. Looks like just a small problem with the bookmarklet. Pushing it up now. :)

<comment><USER16> I see the admin panel now. I'll keep playing with it.

</comment></comment></comment><comment><USER17> I think the product is pretty cool. I also really like the design of the site.

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER18> This looks pretty sweet. Good job.

</comment><comment><USER19> Neat tool.

<comment><AUTHOR> Thanks!</comment></comment>


How to contact Google SRE by dropping a shell in Cloud SQL - <AUTHOR> https://offensi.com/2020/08/18/how-to-contact-google-sre-dropping-a-shell-in-cloud-sql/ <comment><USER2> > One of our interesting findings was the iptables rules, since when you > enable Private IP access (Which cannot be disabled afterwards), access to > the MySQL port is not only added for the IP addresses of the specified VPC > network, but instead added for the full 10.0.0.0/8 IP range, which includes > other Cloud SQL instances.

> Therefore, if a customer ever enabled Private IP access to their instance, > they could be targeted by an attacker-controlled Cloud SQL instance. This > could go wrong very quickly if the customer solely relied on the instance > being isolated from the external world, and didn't protect it with a proper > password.

I'm not convinced by this, I'm not sure it is vulnerable in the way the author is suggesting "they could be targeted by an attacker-controlled Cloud SQL instance".

First of all, GCE has firewall rules outside of iptables. But the main thing is that the way Cloud SQL does Private IP is via VPC peering. Google creates a VPC on their side, runs MySQL in it, and peers that VPC with your VPC. You actually tell Google what CIDR range to use in the their VPC (the Cloud SQL VPC).

I don't think is it fair to assume that all customers are in the same VPC, and same subnets, with routes between them, and no GCE firewall rules blocking them.

<comment><USER3> We found every Cloud SQL instance runs in a Google-owned project called "speckle-umbrella-<num>", with <num> being a number between 1 and 80. Each speckle-umbrella-* project contains several Cloud SQL instances, of different customers, and they do seem to be on the same network and without proper firewalling, because we ran zmap on 10.0.0.0/8 and could see several IPs with the MySQL port open (We did not try to connect to any of them though).

This problem would have probably been avoided if Cloud SQL used different tenant projects per customer (Something most other GCP services do), but for some reason it doesn't do that.

<comment><USER2> That is interesting. There is some magic networking going on if Google allows every customer to allocate an IP range of their choice, and the customer can use all the IPs in that range, and Google runs multiple customers on the same network (same VPC and subnet).

A project can contain multiple VPCs. And a VPC can contain multiple subnets, but not with overlapping ranges.

[https://cloud.google.com/sql/docs/mysql/configure-private- se...](https://cloud.google.com/sql/docs/mysql/configure-private-services- access#configure-access)

</comment></comment></comment><comment><USER4> The lengths you have to go to talk to a real person at Google!

<comment><USER5> We had an issue with our GKE cluster once, which first threw an unknown error during a (much anticipated) bug fix release, and was subsequently stuck in some kind of loop. No other deployments could be created, three notifications about an unknown error were spawned per second, the audit log was overflowing. Tried to reach someone at google, no chance. The situation fixed itself after a few days, presumably some kind of timeout was reached.

<comment><USER6> This is Google Cloud GKE? You can't speak to support there within a few days on a paid account when their systems completely break?

<comment><USER5> Unless you pay for a separate support subscription, no. Not even if it's their systems at fault.

<comment><USER7> I mean, this seems fair to me. If you want support, you have to pay for it.

<comment><USER8> If I'm paying for a service, I expect to be able to speak to someone when that service breaks. If Google Cloud breaks my GKE cluster, it's unreasonable that I can't get anyone to go and fix it without having to pay extra money.

If I break it, sure, fine, no problem. IF it's their fault, I expect to be able to hold them to account.

<comment><USER9> That's absolutely not the agreement. If the service breaks you will be eligible for SLA credits if the service downtime exceeded the SLA target.

The GKE SLO is something like no more than 3.5 hours of downtime per month.

"I expect to hold them to account".

No - if you are not paying for support you will just be able to claim the credits. You do this by filling out a form within 30 days. That's it.

<comment><USER10> I, and I'm sure others, appreciate this response. But I think if someone is under the belief that "I expect to hold them to account", then the only appropriate response is: "Then GCP is not for you"

<comment><USER9> Not entirely true. If you have a business need that demands this level of holding another big company to some account / get some response, then you pay for it.

I think google's higher end service level starts with a $150K/year base fee + cut of spending. That's actually a pretty good deal (1FTE) to have your back much more covered when there are issues - I think they work towards 15 minute response times there. Plus they can help you avoid screwing up your own redundancy planning through reviews of your setup.

What wasn't clear from parent was do they expect to hold google ($100B+/year) to account while spending $2,000/month - that isn't going to happen at all as google as already outlined how they will compensate you for downtime.

Finally - for really large deals you can negotiate with their sales folks.

<comment><USER10> An important distinction, absolutely.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> The /mysql/tmp/greetings.txt trick was cute

but do kids these days not know about [https://linux.die.net/man/1/wall](https://linux.die.net/man/1/wall) ?

<comment><USER12> These systems are stripped down to the bare minimum. There's no reason to believe that every "standard" program, and certainly not a setgid programs like wall or write, would be present.

<comment><USER13> All you need is write access to the pty fd (or in the case of a reverse shell, just the fd of the tcp socket). The SREs could talk to the hackers and the hackers could just echo stuff in their terminal which the SREs could read. Writing a file to disk is less l33t, but more straightforward :)

Edit: I think I was wrong; you can't manipulate network socket fds this way, you'd have to use ptrace() on the process. If it were a real shell with a pty I believe what I suggest could work, but reverse shells don't open ptys.

<comment><USER14> The "# cat greetings.txt" has a # suggesting they sorted out a real pty somehow. Or it was faked later :)

<comment><USER15> The usual trick to get a pty is `script /dev/null` by the way, if that command is available

</comment></comment></comment></comment></comment><comment><USER16> Nice work and writeup. All stemming from very basic mistakes -- SQL and command injection.

Worrying that the CloudSQL internals (like the private IP range) aren't strongly walled off. It will be interesting to see how this changes in response to the researchers' work.

<comment><USER17> looks like a shortcut:

> the container was configured with the Docker host networking driver > (–network=host).

<comment><USER18> unreal. lol.

<comment><USER19> Probably wasn't meant to be a security boundary.

</comment></comment></comment></comment><comment><USER20> This is the type of write up that used to appear in _hackernews_ great work

<comment><USER21> It is evidently the type of write up that is still posted to HN.

<comment><USER20> Yep less and less we see this

</comment></comment></comment><comment><USER22> You have to realize something and its true for Azure, AWS and Google (practical experience):

You have to pay for your support and its not cheap.

Its a good thing on one side: You get yourself a cheaper selfservice solution and you can use a ton of stuff until you really need support. Its a bad thing as you haven't thought about this and support costs money.

Big company with Support contract with Google: Its awesome. Srsly. You get an answer in the next 4h, they will experiment, they will talk to the product teams, they will keep you posted etc.

<comment><USER23> Yes, I have experienced both the "quasi direct line" and the "just a startup" side. Things are different. And it does make sense that things are this way. :-)

</comment></comment><comment><USER24> Thank you!

CloudSQL (expensive wrapper around mysql) restricts you changing the wait_timeout which is really terrible when using cloudfunctions OR innodb_flush_log_at_trx_commit. Now! With my own reverse shell I can finally edit the CloudSQL variables and contact a SRE.

[https://dev.mysql.com/doc/refman/5.7/en/server-system- variab...](https://dev.mysql.com/doc/refman/5.7/en/server-system- variables.html#sysvar_wait_timeout)

<comment><USER25> Google cloud SQL does not prevent you from changing wait_timeout ([https://cloud.google.com/sql/docs/mysql/flags](https://cloud.google.com/sql/docs/mysql/flags))

However, it seems like innodb_flush_log_at_trx_commit is not supported indeed.

</comment></comment><comment><USER26> They write up is excellent, but here there is a tl;dr

The Google Cloud console offers a way to export data into cloud storage based on a SQL query expression.

By exploiting a SQL injection vulnerability related to that SQL query expression field, the attacker learned that they had file write access to /mysql/tmp.

The attacker found a second vulnerability affecting the API endpoint used to export data. This endpoint invokes mysqldump behind the scenes.

Then, the attacker creates a database with a malicious plugin embedded in a BLOB. This plugin is a C program that creates a shell process where standard input and output file descriptors are an alias for a socket file descriptor, creating a "reverse shell" where the attacker can execute commands remotely.

Then, this malicious database was imported via mysqldump, and the malicious plugin was written to /mysql/tmp, then loaded, thus executing the malicious plugin.

Using the reverse shell created by the malicious plugin, the attacker found that the process was running in a Docker container using host networking, which could be used by the attacker to monitor network traffic in the VM host machine.

Using traffic monitoring, the attacker found traffic related to the Google Guest Agent, and then used a TCP connection hijack attack to hijack connections to the Google Guest Agent.

The connection hijacking was used to trick the Google Guest Agent to authorize a new SSH user, which was then used to escape the Docker container VM.

<comment><USER27> Thank you! The article lost me after the reverse shell, but your explanation helped me to understand.

</comment></comment><comment><USER28> Google CTF event is this weekend, I believe it's not too late to gather a team , register it, and take a part ; such events are a very special kind of fun; I participated in one of CTFs recently, and quickly understood limits of my knowledge, as well as multitude of ways to enrich given context, and exploit it.

</comment><comment><USER29> You had to scroll all the way down the article, but:

>Therefore, if a customer ever enabled Private IP access to their instance, they could be targeted by an attacker-controlled Cloud SQL instance. This could go wrong very quickly if the customer solely relied on the instance being isolated from the external world, and didn't protect it with a proper password.

Anyone care to expand on that? Would that be common practice?

<comment><USER30> They're making a reasonable assumption for a bare-metal network, but their conclusion doesn't hold for Google Cloud (and likely Azure/AWS). A customer's Cloud SQL instances do not live in the same VPC as another customer's, and in Google Cloud, VPCs are fully isolated -- 10.0.0.0/8 in VPC A is a distinct network from 10.0.0.0/8 in VPC B, and the two cannot communicate unless there is a Cloud VPN, VPC peering, or a multi-NIC instance acting as a bridge between the two. The broad firewall rule is harmless; I must admit I'm not even sure why the iptables rules are there at all. Probably something about security and onions.

Source: I work in GCP support.

<comment><USER31> If you work in GCP support, have you ever looked at the Cloud Spanner project(s) in Pantheon? There are thousands and thousands of Cloud SQL VMs sitting in one project, so it's absolutely plausible that there might be some traversal possibilities.

</comment></comment></comment><comment><USER32> Just remembered - a long time ago, in a galaxy far, far away, to drop into debugger - and get superuser permissions - on BESM-6 one could launch a clone of "Colossal cave" on a terminal, get to a particular place inside and wave a magic wand...

<comment><USER33> Wow, thanks for the nostalgia trip!

I think I might alias "XYZZY" to "sudo -i" :)

</comment></comment><comment><USER34> That must've been such an exciting moment to have someone say hello.

Chilling too.

<comment><USER35> More importantly, it means those same employees probably have unaudited access to the data in your cloud SQL database.

If SRE can write a file to the filesystem, they can totally copy the database files out too.

I completely support SRE being able to log into instances for debugging, but them being able to do that without leaving an audit trail visible to me, the data owner, isn't up to modern standards IMO.

<comment><USER36> As far as I can tell, there is nothing in the writeup that suggests the file wasn't there from the beginning and present on all Cloud SQL instances. I know this was a standard practice in a few of the products I worked on where we expected the first few layers of security/obfuscation would be peeled off by curious outsiders.

This seems much more likely than OP's exploration being detected in realtime, then someone SSHing into the container manually to put a message.

Disclaimer: I work at Google, not on Cloud SQL, and don't know anything specific about that greetings.txt.

<comment><USER37> I work on Cloud SQL, we definitely don't add a file like that.

<comment><USER38> It could be the case that SRE recognized our accounts since we are hunting on a daily basis.

In rare cases SRE's reach out to ISE's who contact us on their behalf. In this case a file was added. I personally don't see any reason why this would be a bad thing, it's a managed service and we tried to attack it after all. No data was removed, nor is there any indication that there are no audit trails. I hold both the ISE's and SRE's in extremely high regard. (If you try to Hunt for bugs in GCP you will find out why)

</comment></comment></comment></comment></comment><comment><USER14> In the tcpdump screenshot the hostname is something.bugbounty.internal . Was the author running against specific bugbounty machines or something?

<comment><USER38> The tcpdump screenshot was created after the bug was fixed. It demonstrates the interception of traffic generated by the Google Accounts Daemon on a instance running within my personal project.

</comment></comment><comment><USER39> Curious about the container capabilities that enabled them to attack the host network: per the docs [1] containers do not get `CAP_NET_ADMIN` by default, but they do get `CAP_NET_RAW`. I assume that's what allowed them to inspect/inject and network traffic and thus spoof the HTTP response.

So `docker run --net=host --cap-drop=NET_RAW` seems like it might be a good idea. I wonder if it's still needed for `ping` and such in modern Linux?

[1] [https://docs.docker.com/engine/reference/run/#runtime- privil...](https://docs.docker.com/engine/reference/run/#runtime-privilege- and-linux-capabilities)

<comment><USER40> Mostly its not needed for ping but the config is not yet great in all distros, I talked about this in [https://docker.events.cube365.net/docker/dockercon/content/V...](https://docker.events.cube365.net/docker/dockercon/content/Videos/5xr3jskfFKk5jm6pL)

</comment></comment><comment><USER41> Hey, I recognize Offensi from the Liveoverflow video! [1]

I've been reading some Google VRP writeups [2] in order to inspire me in my bug bounty journey. There are a few by Ezequiel Pereira and Offensi. There's some really cool stuff, that go beyond XSS.

[1] [https://www.youtube.com/watch?v=E-P9USG6kLs](https://www.youtube.com/watch?v=E-P9USG6kLs) [2] [https://github.com/xdavidhu/awesome-google-vrp- writeups](https://github.com/xdavidhu/awesome-google-vrp-writeups)

</comment><comment><USER42> I had never heard of a reverse shell before. That is a very neat and simple little trick!

<comment><USER43> You might also like [https://en.wikipedia.org/wiki/Shellcode](https://en.wikipedia.org/wiki/Shellcode) if you haven't heard of that either.

Shellcodes are binary strings that you write to memory or execute another way (like this plugin situation) through an exploit to actually initiate a shell under that process' user id. This can be local on a setuid process for escalation or remote (there are 2 other types in that article in addition to the reverse shell).

<comment><USER42> Thanks for the share!

</comment></comment></comment><comment><USER44> I was able to follow this until the point of escaping the container.

How did they get the user wouter created on the host and how did it have sudo access?

<comment><USER45> GCP supports remotely loading public ssh keys onto a box. They do this using the metadata endpoint - this is (in theory) a trusted API endpoint available to instances @ 169.254.169.254. IAM actually uses this - when you call other services, client libs reach out to the metadata endpoint and get IAM creds to send with each request.

Anyway, they have a local process that polls the metadata endpoint and adds authorized keys on the host. So you can e.g. upload your public key in the web UI, their metadata endpoint will serve it up on your instance, the guest agent will poll the metadata endpoint and add your key to the authorized_keys file.

These folks spoofed a response from the metadata endpoint. They used [https://github.com/kpcyrd/rshijack](https://github.com/kpcyrd/rshijack) to inject their own hand-crafted public key, which the guest agent happily added to authorized_keys (and created the wouter user).

They then ssh'd using their key:

> ssh -i id_rsa -o StrictHostKeyChecking=no wouter@localhost

> Once we accomplished that, we had full access to the host VM (Being able to > execute commands as root through sudo).

Looks like they had passwordless sudo as well.

<comment><USER43> What's a mitigation for the spoofed packet? TLS or something of the sort?

<comment><USER46> If the docker container was running with something other than --net=host, it could have been avoided easily with standard networking concepts (route tables with reverse path filtering or iptables rules), even if the attacker somehow managed to get CAP_NET_ADMIN in the container the host network namespace still would refuse the packets. Although, with --net=host you could actually add iptables rules that match based on the cgroup and limit the IPs/ports allowed. It'd also be possible to filter the container's syscalls with seccomp. I'm not entirely sure why the container had CAP_NET_ADMIN at all, which is required for tcpdump and the man in the middle. Also, using user namespaces would have limited the attacker's abilities even if they had root in the container. A lot of defense in depth techniques are possible here.

There's also: simply not leaving the gcp login backdoor open. We run our gcp instances similar to ec2: on first boot we take the ssh keys from the metadata service and lay them down and do not run the GCP agent, we have standard config management + ldap for login after the first boot. This means that a hacker gaining access to your GCP credentials can't gain a shell on an existing instance trivially.

</comment></comment></comment></comment><comment><USER47> > Most of the time, we were able to type fast enough to get a successful SSH > login :)

I thought it would have been automated by a script. Either they are super fast typers or the metadata server is quite slow!

<comment><USER48> Looks like the metadata service uses HTTP long polling (" This request also includes a timeout (timeout_sec=<TIME>)"), so I think they had a <TIME> second head-start in racing against the real metadata response.

</comment></comment><comment><USER49> All this is interesting read knowing so many people are still using MySQL 5.7 . No announcement this week on new version support.

Will you ever be in MySQL 8

</comment><comment><USER50> This is excellent, I wonder how to reach such a level of understanding.</comment>


The Origin of CAR and CDR in Lisp (2005) - <AUTHOR> http://www.iwriteiam.nl/HaCAR_CDR.html <comment><USER2> To cut to the chase and save reading though all the unnecessary speculation, this is the relevant part of this article...

>"The 704 family (704, 709, 7090) had "Address" and "Decrement" fields that were 15 bits long in some of the looping instructions. There were also special load and store instructions that moved these 15-bit addresses between memory and the index regiseters ( 3 on the 704, 7 on the others )

We had devised a representation for list structure that took advantage of these instructions.

Because of an unfortunate temporary lapse of inspiration, we couldn't think of any other names for the 2 pointers in a list node than "address" and "decrement", so we called the functions CAR for "Contents of Address of Register" and CDR for "Contents of Decrement of Register".

After several months and giving a few classes in LISP, we realized that "first" and "rest" were better names, and we (John McCarthy, I and some of the rest of the AI Project) tried to get people to use them instead.

Alas, it was too late! We couldn't make it stick at all. So we have CAR and CDR."

<comment><USER3> Well, after all we've always used CAR and CDR! If it was good enough then, why shouldn't it be good enough now?

Also, the proposed new keywords were on average 50% longer. Just too much typing! With FST and RST they would have stood a chance. HD and TL would have been clear winners!

<comment><USER4> And fst and rst allow for composition too:

        caar -> ffst
        cddar -> rrfst

<comment><USER5> But that doesn't look as nice.

<comment><USER6> It would need to have a pronunciation convention before it could catch on.

[https://people.eecs.berkeley.edu/~bh/pronounce.scm](https://people.eecs.berkeley.edu/~bh/pronounce.scm)

<comment><USER7> Instead of (f)irst/(r)est we could use (h)ead _or_ (f)irst and (r)est. Then the pronunciation is just exactly as it is spelled - [https://www.youtube.com/watch?v=spefM2OjKp4](https://www.youtube.com/watch?v=spefM2OjKp4)

</comment></comment></comment></comment></comment></comment><comment><USER8> One interesting thing here is that the attempt to get people to stop using the 'bad' names car and cdr is only a few months younger than car and cdr themselves. This is analogous to the plan (which lasted a few years) to replace s-expressions with m-expressions. In both cases the 'bad' construct stuck around because it's easier to program with.

<comment><USER9> I think people might still start new s-expression based languages, whereas any respectable new language will use head/tail rather than car/cdr.

<comment><USER8> I don't know about respectable, but I prefer car/cdr even in a new Lisp. In addition to the composability of the notation, which others have cited, there's the clear lexical symmetry between the two; their compactness, which adds value when writing and reading concise programs; and how easy they are to say out loud. There's something also about their precision: when you say 'car' or 'cdr' in a Lisp context it's immediately clear that there's a linked list at hand and you're talking about it.

The main disadvantage is that they're words with no immediate connection to their meaning, but that's true of many words we're all familiar with. It really only costs anything in the learning stage—which admittedly is a critically important stage. But I think it's fair for a programming language to use specialized idioms for a small number of their most fundamental constructs.

<comment><USER10> CAR and CDR are also good names because they are part of the Lisp tradition. Also due to this tradition, they have a clear meaning in the context of Lisp. If the "new Lisp" keeps conses (and some may argue that if it doesn't, it shouldn't really fall under "a Lisp"...), perhaps it should also keep these names.

</comment></comment></comment></comment><comment><USER11> car and cdr may not be the best names, but they allowed for composition, like:

        (caar x) == (car (car x))
        (cddar x) == (cdr (cdr (car (x)))

Something which you can't do with first and rest. This has (AFAIK) always been one of the arguments for car and cdr.

<comment><USER12> I dunno, as a latecomer lisp-enthusiast, that cadaddaaadr stuff seems heinous to me.

<comment><USER11> It's not pretty, but it has a consistency to it that includes a lot of compact information in a digestable manner. It takes no longer to decode what the instructions say, but it saves a lot of time parsing, for the human reader of the program.

Compare:

        (caadar x) => (car (car (car (cdr (car x)))))

Saves parens too.

<comment><USER13> You can make it even easier on human readers by defining accessors (even if they're just wrappers over car/cdr) and giving them meaningful names. Asking for the car of the car of the cdr of the car of an ad-hoc data structure is pretty hostile toward human readers regardless of whether or not you use caadar.

<comment><USER14> That's why you actually won't find many instances of such patterns in practice. Either you refactor to have structures/classes, or you define your own accessors. Besides, if you are using CL, FIRST, SECOND, THIRD, ... , TENTH, NTH and REST are defined by the spec ([http://clhs.lisp.se/Body/f_firstc.htm](http://clhs.lisp.se/Body/f_firstc.htm)).

</comment></comment></comment></comment></comment><comment><USER15> I prefer car/cdr over first/rest since a list is an implicit type and cdr/car are actually operating on pairs that are not necessary part of a list.</comment>