Implementing a System Call for OpenBSD - <AUTHOR> https://poolp.org/drafts/2020-05-28-015100-copy/ <comment><USER2> Just keep in mind that adding syscalls increases the attack surface of the kernel, and complexity needs justification in general.

Linux's syscall list is out of control. The many BSDs have managed to keep it more reasonable.

<comment><USER3> There is nothing specific about system calls that increases the attack surface. Individual sysctls, files in procfs, sysfs, ioctls, etc. are all separate attack vectors.

The last time I checked, FreeBSD's list of system calls was larger than Linux's. This is because Linux tends to expose more functionality through sysfs, procfs, ioctl, while FreeBSD uses dedicated system calls.

[https://filippo.io/linux-syscall-table/](https://filippo.io/linux-syscall- table/) <\- max = 313

[https://github.com/freebsd/freebsd/blob/master/sys/kern/sysc...](https://github.com/freebsd/freebsd/blob/master/sys/kern/syscalls.master) <\- max = 576, 356 marked 'STD'

<comment> vertex-four There's an argument that files can generally just, not be visible for specific processes using the same tooling that protects other files, but none of the kernels make this particularly easy as far as I can tell.

<comment><USER3> On the other hand, the 'everything is a file' paradigm does sometimes cause issues where you can make kernels crash by doing unexpected things with them.

\- macOS could once easily be panicked by calling something like fpathconf() on a message queue.

\- If you want to have fun, try calling revoke(2) on character devices that are not TTYs. I remember fixing a bug in FreeBSD once, where you could make the system panic by calling that function on /dev/bpf.

<comment><USER4> On the other hand, having a single abstraction / entry point makes it easier to implement generic sanity checks. If you add a check for that kind of problem at the right layer, it will cover other / future interfaces. On the other hand, if you use ad-hoc system calls, any mitigation or fix will typically only cover that one specific call.

<comment><USER5> Unfortunately, generic sanity checks are often not enough. You immediately run into problems where very file-specific concepts (owner, RWX permissions) aren't sufficient to handle certain types of represented-as-files objects (such as procfs files, where privileges with regard to a process aren't accurately described through Unix DAC permissions).

And then you get into some of the really hairy issues -- any user can trick a privileged program into writing or reading from any file by simply spawning a setuid program with stdio set to the file they wish to operate on. Thus, any interface which is administrative is simply unsafe to expose through the standard open/read/write interfaces -- which means that you have to come up with some alternative interface anyway.

</comment></comment></comment></comment></comment></comment><comment><USER6> Sorry, removed the article because it was a draft not meant to be published yet, I didn't think someone would spot my drafts directory... :-)

Will finish and republish in a few days.

</comment><comment><USER7> The font on that site is awful and too small. I'm on a MacBook Pro Retina 2015

<comment><USER8> Use the reader mode in your browser.

<comment><USER9> Still a weird choice of font for a website. It looks somehow ok in firefox, but unreadably thin in chromium

<comment><USER10> Looks the same in both to me.</comment></comment></comment></comment>


International Object Sizing Tool - <AUTHOR> http://blog.jgc.org/2012/01/international-object-sizing-tool.html

<comment><USER2> Great idea.

Now quick, someone start manufacturing these in titanium or some other vastly over-specified material, with laser-etched markings of course, and start selling them on ThinkGeek. :)

I thought the more readily-available Standard Reference Object was the matchbox, but perhaps nobody uses matches anymore?

<comment><USER3> A quick google search turned up AA batteries as a popular size reference [1].

[1] [http://www.google.com/search?q=%22shown+for+size+reference%2...](http://www.google.com/search?q=%22shown+for+size+reference%22)

</comment></comment><comment><USER4> At some point I thought about a different approach. When page is rendered it is possible to get the resolution. Now all you have to know is the screen size and you can render an image (from high-resolution image or vector) that will have screen size very close to the actual physical size.

I found a site that does just that but cannot remember URL from the top of my head. EDIT: It is <http://pective.com/>

</comment><comment><USER5> Love the idea, I'd like to see this applied to other quantas: electricity, weight, light, heat. How to build cheap yet not too fuzzy measurement tools on the fly.

</comment><comment><USER6> This inspires me to get a regular credit card with an image of ruler on it :)

<comment><USER7> <http://www.thecardstick.com/>

</comment></comment><comment><USER8> Nice try VISA marketing guy :-)</comment>


Silicon Valley and America's Brazilification - <AUTHOR> http://www.theamericanconservative.com/dreher/silicon-valley-america-brazilification/ <comment><USER2> Ironically, the comments in this thread will likely be as the writer of the article posted and I quote:

"UPDATE.2: You know what would be a nice change of pace? If commenters would refrain from saying, in effect, THIS IS WHY THE PEOPLE WHO ARE NOT LIKE ME ARE BAD AND CRAZY! I've tried to make it clear in this post that this problem belongs to all of us, and few if any of us have the right answers. If all you have to offer is the usual griping about the Other Side, don't post here."

How about more questions and solutions rather than finger-pointing, this isn't caused by one side or the other as there have been both Liberal and Conservative administrations and policies and people etc.

</comment><comment><USER3> Ignoring some of the right wing cultural points this is like 2/3 an economic liberal piece. I hear more economic liberalism from the right than from the "progressive" left. That is a problem.

<comment><AUTHOR> They tend to be far more religious than I would care for, but they often do make a lot of sense, and tend to be quite highly rated for accuracy; more so than pretty much any "progressive" media.

<comment><USER4> Who does the rating? Which progressive media were on the list?

<comment><AUTHOR> This: [http://www.allgeneralizationsarefalse.com/wp- content/uploads...](http://www.allgeneralizationsarefalse.com/wp- content/uploads/2018/01/Media-Bias-Chart_Version-3.1_Watermark-min.jpg)

<comment><USER4> Thanks!

You wrote "tend to be quite highly rated for accuracy; more so than pretty much any "progressive" media."

If I read it correctly, that shows that "American Conservative" is at the same level as MSNBC in terms of 'overall quality', and over half of the liberal media is ranked as having higher quality.

That doesn't seem to be in accord with what you wrote.

It is one of the more accurate of the conservative side, but the liberal press skews upward, and I've never heard of the 6 liberal publications in the red box, while I've heard of 5+ of the conservative press in the red box, and some of them have quite large readership/viewership.

My main progressive news source, Democracy Now, is ranked as having the highest quality of the hyper-partisan groups. That affirms my decision to be a monthly contributor.

<comment><AUTHOR> You're welcome!

I would not really consider MSNBC and alike to be particularly progressive or left-wing myself, that would be something that Sarah Palin would believe, with her screams about "lamestream media". Among the clearly partisan publications though (AmCon has it right in the name, after all) they are quite good.

The red box contains rags that are only good for making you scratch your head and go "umm, cam people really be that dumb?". I would not consider those to be news sources at all. But the orange box has some quite popular left (and right)-wing sources like HuffPo that are involved in "unfair interpretation of the news" \-- I'd think being there is already quite damning. At the same time, I have heard of HuffPo and DailyKos; Haven't heard of Democracy Now! will need to check it out.

I think you also need to make a distinction between primarily news and primarily opinion publications. I would expect both AmCon and, say, Mother Jones to apply their own interpretation to the news, but I would expect both to be honest about news and in their reasoning (well, most of the time anyway). I would not expect either to make up news to match their agenda, which is something that pubs in red and orange boxes often do.

<comment><USER4> I concur with your assessment of MSNBC, etc. I still think your original statement wasn't quite right, but not enough to warrant argument.

I stopped even following HuffPo links many years ago. It felt like too many opinions pieces dressed up as news, and with a business model based on getting people to write for free. (Could have changed in the last 5 years.)

Democracy Now is viewer/listener funded. They use the phrase "corporate media" instead of "{main,lame}stream media", and (in that respect) are aligned with Zinn and Chomsky.

<comment><AUTHOR> Maybe I did not word it well enough, too.

I am not sure if being viewer-funded by itself guarantees accuracy and relative lack of bias -- people will support what they want to see, not necessarily what is accurate, and the selection of news on DN front page certainly skews in the left direction. Writing for newspieces that are there however seems to be unbiased.

<comment><USER4> It was in reference to your reference to Palin's "lamestream media". That is, while some do argue that News-Corp/Fox provides news to challenge the "{main,lame}stream media" of Disney/ABC, Time Warner/CNN, CBS, and Comcast/NBC they collectively are all owned by large companies, so have a built-in bias towards issues that favor large companies.

That there can be a corporate media bias certainly doesn't mean that those who write for non-corporate media don't also have their own biases.

<comment><AUTHOR> Yeah, exactly. Pretty much anything will have _some_ bias.

Not to say that I would take this, or any other, chart as the gospel (if anything, I certainly wold not have put NYT as high), but it is interesting to see that WSJ, as corporate a paper as they get, is rated in the upper rectangle. Equally News-Corpsy Fox is way down.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


EmberFire: Official Firebase bindings for EmberJS  - <AUTHOR> https://github.com/firebase/emberFire

<comment><USER2> [Firebase founder here] We're really excited to launch these today! We've seen a ton of interest from our community in support for Ember, and these bindings should make life for these devs a ton easier.

A special thanks to Tom, Yehuda, and the rest of the Ember crew for helping us make these.

</comment><comment><USER3> So, the firebase customer database got stolen (or firebase got owned) and their customers are receiving phishing mails using those email addresses since September at least - however, I never received a heads up from Firebase. What gives? That's not a good way to build up trust.

</comment><comment><USER4> here's the blog post on it: [https://www.firebase.com/blog/2013-10-22-firebase- bindings-f...](https://www.firebase.com/blog/2013-10-22-firebase-bindings-for- ember.html)</comment>


Hello Opera 12 - <AUTHOR> http://my.opera.com/ODIN/blog/hello-opera-12 <comment><USER2> From testing out my demos in Opera Next over the past few months, I've been really impressed with the quality of their JS runtime and the UI. Unfortunately, their hardware-accelerated canvas support doesn't really keep up and their WebGL is outright broken - it looks like they went so far as to disable both by default in 12, a disappointment to be sure - and they still have serious issues with HTML5 audio (to the point of causing hangs/crashes).

Given that my only real exposure to Opera is from trying to ensure my stuff runs well in it, it's easy to get the impression that everything about Opera is broken. I wish they had a public bug tracker so it was easier to tell which things are known issues, which things have known workarounds, and which things I should file bugs about.

In particular, the audio issues are a point of frustration: At present, if you test the latest builds of Firefox, Chrome, Safari, Opera and Internet Explorer, Firefox is the _only one_ that actually has low-latency, functioning support for <audio> that doesn't crash or hang. It's ridiculous. Chrome at least has a custom webkit-only API you can use to get working audio, but the rest of the browsers are just flat out broken. And in each browser's case, they've had multiple versions to fix basic issues (limits on how many sounds you can load in a single page context; broken events and APIs; absurdly long playback delays, etc). Oh, and Firefox still doesn't support the loop attribute. :|

<comment><USER3> This is just an indicator that we need a proper native development environment. Devs who embrace new web technologies like WebGL, <audio> or <video> forget that those are just Javascript bindings to the technologies developed in C/C++. Can we please have native code instead, so developer controls the underlying system without having to rely on the wits of browser makers? Google Native Client is a step in the right direction.

<comment><USER4> > This is just an indicator that we need a proper native development > environment. Devs who embrace new web technologies like WebGL, <audio> or > <video> forget that those are just Javascript bindings to the technologies > developed in C/C++.

That is technically true, but what is the point? The bindings can make things better, or they can make things worse. WebGL, for example, covers over a lot of issues with OpenGL (security and convenience), making the web version very nice to use.

> Can we please have native code instead, so developer controls the underlying > system without having to rely on the wits of browser makers? Google Native > Client is a step in the right direction.

Native code is by definition non-portable.

NaCl in a partial attempt at portability adds bindings of its own to native APIs. Ask people developing for it, like any environment it has bugs and issues.

There is no simple solution here.

<comment><USER3> > That is technically true, but what is the point? The bindings can make > things better, or they can make things worse. WebGL, for example, covers > over a lot of issues with OpenGL (security and convenience), making the web > version very nice to use.

Last time I tried WebGL version of Quake3 on my machine which had the hi-end AMD graphics card at that time, it ran at less than 100FPS. For a game that's 10 years old that is a very poor result. The reason why I said bindings is because I want a language powerful enough to implement any technology I want _in_ that language.

> There is no simple solution here.

Of course it's not simple. It doesn't mean it's not possible. Microsoft's WinRT is another example of coming closer to the native code apps.

<comment><USER4> > Last time I tried WebGL version of Quake3 on my machine which had the hi-end > AMD graphics card at that time, it ran at less than 100FPS. For a game > that's 10 years old that is a very poor result.

The Quake II port was extremely unoptimized in how it was performed. It's not a good benchmark of anything.

> Microsoft's WinRT is another example of coming closer to the native code > apps.

What about just actual Android C++ apps, as an example of native code apps..?

</comment></comment></comment></comment></comment><comment><USER5> Why don't they enable WebGL by default?

I don't see why more people don't realize, WebGL is a prime Microsoft threat and the key to moving away from the MS Windows monopoly. That's why Microsoft has done so much work to try to scare people away from WebGL (by sponsoring 'security research' and creating FUD content on Wikipedia (seriously, look at the history of that article, the person who created the whole 'security' section on WebGL has an ip that originates right next to Microsoft headquarters, and the 'security research' is done by a Microsoft shop)).

What the Opera, Webkit/Safari/Chrome, Mozilla teams should focus on is getting mouse capture and WebGL uniformly supported and turned on across browsers and one or two well-hyped and playable 3d first person games. Any industry player who has money and wants to oppose Microsoft should put money behind big WebGL game releases and hype for such.

You get that working across browsers and push that and things like Google Docs, EditGrid, ethercalc, Zoho Creator, LibreOffice etc. and you will see WebGL games starting to take down PC games sales and Office alternatives hurting Windows/Office sales.

Anyway, please give the people in charge of those programs and funds a link to this explanation if you know anyone like that.

<comment><USER6> For background, I write a _lot_ of WebGL demos, I work for Mozilla on gfx optimizations (WebGL and otherwise) for the Boot2Gecko project. I also worked at Matasano Security previously, doing WebGL security research. As such, I tend to think that I'm pretty unbiased in this regard -- or perhaps biased towards WebGL, since I love it and want to see it everywhere. So with all that said, your characterization of MS's security claims as "FUD" are complete and utter bullshit. WebGL has a substantial attack surface in the browser (large API dealing with many issues from cross-origin restrictions to handling buffer locking and texture sharing, shader verification and translation, not to mention all the code required to actually make this stuff fast, which is what I work on), and it's only the tip of the iceberg that is the 3d stack.

Below the browser you have the userland driver components, which do things like further shader verification and initial stages of the compilation, validating index buffers, and simplifying the command stream. Below that you have the kernel components, which largely trust the userspace to have done their job properly, then do things like compile shaders for the specific hardware and put things into the proper form to send it off to the GPU, as well as handling synchronization and locking and all that. Then below that, you have a massively complex piece of hardware that under most circumstances is fully able to touch every single bit of your system memory (thanks, DMA), and _that_ doesn't care one bit about security; it assumes that everything coming from the kernel is 100% safe and intentional. If you tell it to copy memory from point A to B, it will do it without complaining. Meaning if you wanted to, say, write over kernel memory from a buffer in the browser...

So let's look at what needs to happen to get ring0 (kernel mode) access from WebGL: 1) get your payload through/around validation in the browser, using available APIs, 2) get through/around userland validation OR attack the optimization/compilation steps that occur at that layer, 3) potentially attack optimization/compilation steps that happen in the kernel component -- optional, since this layer may not be your target, 4) GPU does your work for you.

At most, you're talking 3 layers to compromise. Compare to real-world vulnerabilities against other parts of the browser (see also: Pinkie Pie) where you're involving dozens of steps, and suddenly this doesn't look too difficult. The tough part is that it requires a significant amount of domain specific knowledge, but I'm certainly not the only one with it.

WebGL, as awesome as it is, _is_ a security risk. It's one caused primarily by the fact that GPU vendors have never had to care about security along these lines before. It will be solved eventually, but it's damn sure not solved now.

<comment><USER5> How many examples of this type of "just 3 layers" compromise have we actually ever seen being used as an "attack"? How many is that compared to the number of known attacks against browsers using non WebGL-related technologies?

Did you actually see the specific 'security' concerns that that MS shop put out? Part of it was a laughable demo of an 'attack' that actually did not compromise anything, and looked like a mock-up that would be used in a movie. Whether there are potential security concerns or not, the actual 'concerns' that MS and that company raised were definitely FUD.

<comment><USER6> I haven't seen any real-world attacks using WebGL yet; we probably won't for a couple years, since it's still very new technology and there's a _lot_ to learn to be able to do even basic research there.

And have you seen them? [http://blogs.technet.com/b/srd/archive/2011/06/16/webgl- cons...](http://blogs.technet.com/b/srd/archive/2011/06/16/webgl-considered- harmful.aspx) Let's go over the points together:

> Browser support for WebGL directly exposes hardware functionality to the web > in a way that we consider to be overly permissive

The WebGL API -- outside of bounds checking and shader validation/translation -- is a direct conversion of the EGL API. This makes getting your data (legitimate or not) into the lower levels very easy. That cuts both ways, as I detailed.

> Browser support for WebGL security servicing responsibility relies too > heavily on third parties to secure the web experience

Read: The security of WebGL depends on GPU driver vendors, who write _terrible_ code. This point is well known by anyone who's worked on enough 3D code, or even just tried to fix graphics bugs in games by doing the driver update dance.

> Problematic system DoS scenarios

For the vast majority of GPUs, there's no way to set timeouts on rendering or shader execution, so DoSes are just downright trivial. This will be the first thing to get better, with the various robustness extensions that are coming.

All in all, I have absolutely no issues with what MS released on the subject.

<comment><USER5> "This makes getting your data (legitimate or not) into the lower levels very easy."

Bullshit. Completely unsubstantiated.

The browsers themselves are what are actually being compromised in reality, Microsoft by far more than others. The WebGL exploits are just theoretical. Every browser vendor is a third party.

Big fucking deal, somebody makes your browser or system freeze up.. like that is a new thing that you can't do with a browser or with Internet Explorer? Freezing the system isn't that easy to do with WebGL and depends on the specific setup of that machine. That's not a security concern, thats just a potential inconvenience.

I don't give a fuck what you dumbasses think, this is obviously Microsoft FUD. But its just another example of the sort of idiotic rationalizations that normally support the status quo.

</comment></comment></comment></comment></comment><comment><USER7> Opera 12 is the first third-party web browser for Windows to offer an official 64-bit version. (Neither Firefox nor Chrome have official 64-bit versions for Windows. And I think Safari for Windows doesn't have one either.)

Does this translate to any substantial improvements in speed? Does anyone here know of any benchmarks?

<comment><USER8> 64-bit is not really useful for browsers with multi-process architecture like Chrome. It is very unlikely that a single tab will need 64-bit address space.

<comment><USER9> Except once you have enought tabs Chrome starts putting multiple tabs in a single process. The cutoff seems to be somewhere in the low double digits. And at that point, you can in fact start running out of address space (not to be confused with running out of memory) without too much trouble, especially because system libraries on 64-bit OSes have a tendency to be mmap-happy, since they think they have lots of address space to work with.

</comment></comment></comment><comment><USER10> Kinda off topic, but Opera Mini and Opera Mobile for Android is vastly superior in terms of smoothness compare to all other available browsers. It is very noticeable especially if the page is heavy. A good test is to load this page [http://www.html5rocks.com/en/tutorials/internals/howbrowsers...](http://www.html5rocks.com/en/tutorials/internals/howbrowserswork/) on your Android in different browser and test the responsiveness.

<comment><USER11> I use Opera Mobile exclusively on Android. Pages load faster and zooming with fit text to screen works really well.

My one frustration is that when launching a web page from another app it always opens a new tab so I end up with 10 tabs open and have to close them all every so often.

</comment></comment><comment><USER12> I really like Opera. I've used it for months, but every time i just come back to Firefox. One big problem (for me) it's their release cycle. I know that many people hate the fast releases of Firefox and Chrome, but this way i get new features sooner than Opera. Another problem are addons. I'm an heavy Scriptish/Stylish user, and there aren't equivalents for those in Opera. I know that i can enable the userscript folder and copy scripts here, but I'm honestly too lazy to do it, and loading CSS through javascript is just not fast enough. Then there are the nitpicks. For example, on Firefox/Chrome "right click > search on google" open a new tab, on Opera it load Google in the current tab. Or, on Firefox/Chrome middle-clicking on the back button open the previous page in a new tab. On Opera this just doesn't work (at least, until Opera 11.64 - I haven't tried Opera 12 yet). And Opera is not opensource. While it's not a so big deal for me, i prefer to use opensource applications when i can.

There are also features that i would love to see on Firefox. Tab Stacking is awesome, way better than Panorama. I really like also how Opera put the tab bar on the left, I find it better than Tree Style Tab.

I'll try the new version later, but i doubt that the new features will be worth a switch for me.

<comment><USER13> > For example, on Firefox/Chrome "right click > search on google" open a new > tab, on Opera it load Google in the current tab.

In Opera Ctrl+Click opens a new tab, Ctrl+Shift+Click opens a new tab in the background. It's not a new feature. Learn to play your class. ;)

<comment><USER14> Nice trick. I use Opera as well, and didn't know about this.

However, i can't think of any other software where modifier keys makes a difference in context-menus, so i really wouldn't blame people for not knowing.

<comment><USER13> I'm not blaming people for now knowing, Opera has so many cool features it's hard to become fully aware of them. To be honest I don't remember how I found out about this one. In Opera (and other browsers) you can use modifier keys when clicking links, so it kind of makes sense to use this in context menus as well.

Opera is always surprising. Did you know you have mouse gestures (such as 'close') in menus such as preferences? It blew my mind.

</comment></comment></comment></comment><comment><USER15> Opera is still not getting some basic features right and that is costing them users.

I remember asking for a feature in forums in days of Opera 11.00. The feature was something that every browser has: "Remembering contents of a text field." For example, when I enter my email address once in a website and then come back another day and write first letter of my email id, it is displayed in a dropdown. But Opera outright refused to even consider.

Now, they lack a good full screen mode and drag and drop support in GMail, two real deal breakers for me. I tried Opera 12 for less than 12 min and sent it back to dark corners of my HD!

Goodbye Opera 12.

<comment><USER16> Opera has an inbuilt IMAP client... which I admittedly never use, but between that and Thunderbird, why would you even want to use webmail? Of course it should still work, even though it's silly, but you also "should" not even notice that it doesn't, is what I'm saying. Certainly if you imply your time is so precious, heh.

And what is wrong with F11?

<comment><USER15> F11: As far as I know, there's no way to make address/tab bar visible in full screen mode.

I prefer the way Safari does it. When I take cursor to top, address and tab bar are shown!

<comment><USER17> It's quite possible with .ini editing or some custom buttons: [http://my.opera.com/Tamil/blog/full-screen-mode-with- toolbar...](http://my.opera.com/Tamil/blog/full-screen-mode-with-toolbars-in- opera)

</comment></comment></comment></comment><comment><USER18> No one has mentioned that Opera 12 is the first GA browser (I believe) to support WebRTC. Basically you don't need to flash anymore to access devices such as webcams and microphones.

I built a really simple site to see how this all works. It will fall back to flash if you don't have WebRTC support which includes Google Chrome Canary and now Opera 12.

<http://gotcaption.com/p/39>

</comment><comment><USER19> They really improved the responsiveness, it feels as responsive as Chrome now.

Here's more if you are interested: [http://my.opera.com/desktopteam/blog/2012/06/14/twelve- under...](http://my.opera.com/desktopteam/blog/2012/06/14/twelve-under-the- hood-improvements-in-opera-12)

</comment><comment><USER20> I extensively test my webs manually on basically all relevant browsers, up to few old versions, and on different OS' and devices.

My conclusion is that Chrome on Windows 7 is by far the most 'snappy' and Firefox on any OS most 'dev friendly' (even though Chrome is coming along that way very nicely).

That being said, Opera on mobile is very fine, but I still prefer using whatever stock browser is on particular device. Everything else is a little buggy.

What I found lacking in any of the browsers is the developer friendliness on mobile devices. Anyone has any recommendations on that?

<comment><USER21> Unfortunately, I cannot claim that I have tried it, but I know Opera supports remote debugging. You get to run Dragonfly on your desktop and debug whatever's running in Opera Mobile on your device.

There seems to be documentation here: <http://www.opera.com/dragonfly/documentation/remote/>

</comment></comment><comment><USER22> One reason this is a big deal: Opera now supports CORS [1]. Until now, it was the only significant browser that didn't. (Even IE did, albeit - of course - in its own special way.)

[1] <http://en.wikipedia.org/wiki/Cross-origin_resource_sharing> \- secure cross-domain AJAX without hacks like JSONP, so you can do POST requests, set headers, etc.

</comment><comment><USER23> I don't know why I would ever switch from Chrome or Safari to Opera. On a Mac, Opera still has text rendering issues (<http://imgur.com/a/9bK1j>), scrolling stutters, and there's a noticeable difference in page load speed (Opera is much slower than Chrome, at least on my computer).

<comment><USER24> > Opera is much slower than Chrome, at least on my computer

It is the contrary on my computer: chrome is painfully slow, whereas firefox is OK and opera is faster. I guess opera is not the best for everyone.

<comment><USER25> same here, I would also be very unhappy without opera's instant backward/forward navigation.

<comment><USER11> Awesome feature. I hate that other browsers ask you to resubmit a form when navigating back. Opera just shows you the cached page that it bad before. Combining that with the mouse flip gesture, browsing is a breeze. In Chrome you have to click BACK or use BACKSPACE (or a mouse with a dedicated nav button). In Opera, I click the right then the left mouse buttons and I'm back at the previous page. Alternate to go back forward.

</comment></comment></comment></comment><comment><USER26> A word of warning: this update erased the persistent storage data for all sites. So if you're using plugins or if a particular site is using persistent storage, this will cause issues.

</comment><comment><USER27> I'm a opera user and I was excited to see this news! So I've downloaded the 12th version and went on to test it in the shining page. But it says that my browser is not supported? <http://www.shinydemos.com/touch-tracker/> \-- Your browser doesn't support all required features: Touch Events.

Anyone has the same issue?

<comment><USER13> If I'm not mistaken, "touch events" is a feature for tablets or mobiles. <https://developer.mozilla.org/en/DOM/Touch_events> It will probably not be included soon for the desktop version of Opera.

</comment></comment><comment><USER28> Anyone else having issues with iGoogle? I had it working in 11.6 by identifying as IE, since it would just show a blank page when identifying as Opera/Firefox.

Now, with 12.0, identifying as Opera/Firefox still shows a blank page and identifying as IE just shows the widget headers and no feeds.

</comment><comment><USER29> I just wish they'd forgo the use of that cramped sans-serif header typeface. It looks like somebody just outlined and compressed it horizontally in Illustrator—awful.

</comment><comment><USER30> My connection sucks. Have they fixed this? <http://jsfiddle.net/alanhogan/twCXt/>

<comment><USER31> Not sure what you mean now? I'm still on older Opera (11.61) and the checkbox is resized.

<comment><USER30> But it does not look checked, right? One should be checked. Also, clicking it has no (visual) effect (though it will toggle the checked attribute in the DOM). It's a truly terrible bug, and a strong argument that Opera should not use -webkit- properties like transform until it can actually handle them.

I reported it a couple months ago and have not received any follow-up at all.

<comment><USER31> It is checked and checking it works as well (11.64 at home now). But as other comment pointed out, it looks ugly. I tried FF 9 - same as Opera - works and is ugly. In Chrome 19 it does not work at all (i.e. the checkbox is small).

So it got fixed. And I don't think they do follow-up unless they need you to reproduce the bug or something.

<comment><USER30> Are you on Windows? I eventually tried in Opera 12 and it does not seem to be fixed.

Now I'm not sure why you say it doesn't work in Chrome at all. Because at least on my platform (OS X), it does, and it looks beautiful and hi-res.

</comment></comment></comment></comment></comment><comment><USER32> For me, the most important missing feature is tab lazy loading -- without that my usecase is impossible (hundreds of tabs).

<comment><USER31> I only use about hundred tabs (not hundreds) but I find Opera best in this regard - mostly because memory usage, stability (as opposed to chrome) and capability of the UI to handle that many tabs while being usable. The thing is, I don't turn the browser off. Maybe once a month to install Windows updates.

There's an ugly workaround though - start Opera without internet connection and then reload tabs as needed.

<comment><USER32> FF has lazy loading. Options->General->Don't load tabs until selected.

</comment></comment></comment><comment><USER33> I cant use Opera in home because the lack of a xmarks addon to sync my bookmarks with my firefox at work, it's a pity.

<comment><USER31> Use Opera at work as well :)

</comment></comment><comment><USER34> I'm disappointed that they still don't seem to support the file API in JS :/

</comment><comment><USER35> Still no ARM version available, by the way ? Or has this changed?

</comment><comment><USER35> So now Opera also features extensions ?

<comment><USER36> Extensions were introduced in 11 version almost two years ago.

Now Opera is ditching widgets and unite to focus on extenions.

<comment><USER35> I just read that on their main page. Are they getting a lot of support from developpers for extensions ?

<comment><USER13> Pretty much. What do you need?

</comment></comment></comment></comment><comment><USER37> Hello.

<comment><USER38> My reaction exactly. Just installed it like always before and no fuss about anything.

</comment></comment><comment><USER39> The scroll/codex analogy is cute but doesn't hold up.

Sure hope the page based css goes to the limbo.

</comment><comment><USER40> Anybody home?</comment>


Ask HN: Visiting Mountain View for the first time.  Where should I go? - <AUTHOR>

I'm taking a trip to Mountain View for the first time.  What should I not miss? (startups - I wonder if Zappos still give free tour, VCs, coffeeshops, restaurants, incubators, incubating office spaces, historical sites, etc) <comment><USER2> It really depends what kind of stuff you are into but I'd recommend checking out the Computer History Museum. There is a lot of awesome historical stuff there, and it is free. It might be quite boring if you're not into computers though.

<http://www.computerhistory.org/>

<comment><AUTHOR> Oo, I finally will get to see a punchcard computer in person! Very cool, thanks! Reminds me of the time I accidently found a Thomas Edison exhibit in Bandai Museum outside Tokyo.

<comment><USER3> It might be a good time to see it because I think a replica of the difference engine is on display there... pretty cool:

<http://computerhistory.org/babbage/>

</comment></comment></comment><comment><USER4> There's a pretty cool place at 1600 amphitheatre parkway</comment>


From scratch: reverse-mode automatic differentiation (in Python) - <AUTHOR> https://sidsite.com/posts/autodiff/ <comment><USER2> I'm just an enthusiast. With that said, I think the author's first image image really captures the core of forward propagation and back propagation. For people who want to get more of a feel on autodiffing, I find these 2 sources amazing [1, 2]. They don't use the word autodiffing, but looking at it, I can see it's the same thing.

I once made an attempt at animating feed forward propagation [3]. If I'd animate back propagation, I'd probably make an animation on autodiffing as well as that is the most intuitive way I know on how to explain back propagation right now. It's still on my big to do list ;-)

[1] [http://karpathy.github.io/neuralnets/](http://karpathy.github.io/neuralnets/)

[2] 3Blue1Brown does in episode 4 of his Deep Learning series: [https://www.youtube.com/watch?v=tIeHLnjs5U8](https://www.youtube.com/watch?v=tIeHLnjs5U8)

[3] [https://melvinroest.github.io/Interactive-Neural- Networks/](https://melvinroest.github.io/Interactive-Neural-Networks/)

</comment><comment><USER3> Nice introductory resource.

On the same topic, see also:

\- Andrej Karpathy's elegant micrograd library: [https://github.com/karpathy/micrograd](https://github.com/karpathy/micrograd)

\- This tiny neural networks API inspired by it: [https://github.com/bpesquet/pyfit](https://github.com/bpesquet/pyfit)

</comment><comment><USER4> This is a fantastic hands-on introduction to practical autodiff. (And the blog's other articles are worth reading too if you find their subjects interesting).

</comment><comment><USER5> I wonder if automatic integration is possible. And yes I'm aware LS.

<comment><USER6> There's a straight forward algorithm for automatic differentiation. You can think of it like long division: tedious to do, but you can easily program a computer to do it.

Integration is a whole different ball game. It's essentially a puzzle: what function, when differentiated, produces this result? There are various heuristics you can apply, e.g. integration by parts. And there are some databases of common integrals. But in the end, there's no algorithm, integration requires ingenuity to solve.

<comment><USER7> It's slightly better. [https://en.wikipedia.org/wiki/Risch_algorithm](https://en.wikipedia.org/wiki/Risch_algorithm): _"The Risch algorithm is used to integrate elementary functions. These are functions obtained by composing exponentials, logarithms, radicals, trigonometric functions, and the four arithmetic operations (+ − × ÷)"_

That algorithm isn't easily programmed, though, and will fail in the many cases where the integral cannot be expressed in elementary functions.

Worse, according to that page, it needs the ability to check whether expressions are zero ([https://en.wikipedia.org/wiki/Constant_problem](https://en.wikipedia.org/wiki/Constant_problem)), and that, in general, is undecidable if I understand that page correctly.

[https://mathworld.wolfram.com/RischAlgorithm.html](https://mathworld.wolfram.com/RischAlgorithm.html) seems a tiny bit more optimistic about the limitations of this approach, but [https://link.springer.com/chapter/10.1007/978-3-319-00894-3_...](https://link.springer.com/chapter/10.1007/978-3-319-00894-3_10) seems, to me, in line with what Wikipedia says.

<comment><USER8> There is also an open source rule based integrator that I came across.

[https://rulebasedintegration.org/](https://rulebasedintegration.org/)</comment></comment></comment></comment>


Show HN: Send Anything Anywhere Within 25 Miles from Your Doorstep - <AUTHOR> https://www.producthunt.com/posts/tossy <comment><USER2> Taxis did this for many years, and Uber did it briefly. I think Postmates may also have tried it.

<comment><AUTHOR> Apparently they didn't try enough ;)

</comment></comment><comment><USER3> That looks really cool but rife for abuse.

<comment><AUTHOR> Haha thanks. I'd consider that a good problem to have that we can solve hopefully.

</comment></comment><comment><USER4> Woah! upvoted by Kat and Justin Kan!</comment>


The Next Chapter - <AUTHOR> http://blog.aereo.com/2014/11/next-chapter/ <comment><USER2> I don't think many people had the opportunity to use Aereo. They had a decent presence in New York City, and as the company expanded across the country reporters cited customer numbers in the mid five figures.

As an Aereo user, let me tell you what you missed out on: one of the most amazing products I've ever used.

Aereo "worked." It worked like magic.

First, it lived up to its claim. You could stream live, broadcast television to your phone or computer, and you could AirPlay it to your television. Everything was in HD. It worked incredibly well. So many video products fail to deliver on the user experience, or the video is choppy, or it crashes all the time. Aereo's software had its struggles, but it worked far more often than not. I could have people over and stream the Super Bowl and never worry that Aereo would crap out.

Aereo also worked remarkably well during Hurricane Sandy. I live in Brooklyn, and Aereo's Brooklyn HQ was less than a mile from my apartment, but we streamed Aereo until we went to sleep that night. Considering reports that their antennae sucked a ton of power, that's incredible on a night when power was out all across the city.

I also interviewed with the company in 2013 for a business development role. Everyone that I met was really great. They treated me well during the process while clearly balancing a million things, including their legal concerns. I really, really wanted to work there, but it wasn't a fit for a lot of reasons, their uncertain future being one of them.

When my girlfriend told me that they were filing for bankruptcy, I was sad. This is innovative technology that worked for consumers, squashed by antiquated government regulation and a highly litigious, innovation-resistant, influential media industry.

Progress, halted.

A winning product that could have delighted millions, squashed.

<comment><USER3> What is antiquated about the idea that you don't get to use other peoples' valuable content without paying for it?

Look: the valuable product here is the content. All the technology can do is get in the way. It's great Aereo's technology got in the way less than its competitors, but that still doesn't mean people found the technology itself valuable. The content is what matters. The content is what delights consumers.

Given that reality, I think it's absurd to say that regulations protecting the people who create the content, the product without which the whole downstream ecosystem of streaming services and content consumption devices are utterly irrelevant, it's absurd to say those regulations are antiquated.

<comment><USER2> Keeping in mind that this content is being broadcast over public spectrum, you're right: the content is the most valuable product.

As a consumer, I want to access that content in an efficient, functional manner. My tax dollars are paying for it. So, I bought an antenna. It couldn't pick up any stations in my apartment, and this is a very common problem in NYC. Even if it picked up stations, I'd have to buy a separate device to record shows so that I can watch them on my schedule.

With Aereo, I was renting an antenna. The company built capital-intensive, power-sucking data warehouses in every city in which it operated and filled them with antennae for every customer. Aereo provided me with a cloud-based antenna, no different than buying one from Best Buy or Amazon.

Only:

(a) the signal was clear and reliable, not fuzzy. My friend has a long coaxial cable connected to his television and he tapes a 12" x 12" antenna to his window. Kind of ridiculous.

(b) they included a cloud-based DVR that allowed me to watch what I want, when I want. They improved the relationship that I had with broadcast content.

Aereo was very clear about the fact that they built a solution that adhered to the law because everyone had an individual antenna. This solution was very expensive, but it worked and though it was described as a Rube Goldberg machine, it made sense.

And here's the ultimate rub for content companies: now I don't watch your content at all. I don't see your ads. I have someone else's cable password, and I watch things sporadically, but I don't discover new shows like you want me to.

<comment><USER4> Your tax dollars are paying for TV show production?

<comment><USER5> No. But our eyeballs watching those paid ads on free broadcast TV are enabling payments + profit for the production of that content. The numbers may vary by broadcaster and program, but the business model is clear, or atleast was.

<comment><USER4> The people that make TV shows make money in several different ways. Paid ads are only a portion of their business.

</comment></comment></comment></comment></comment></comment><comment><USER6> I listened to a talk by an Aereo exec at SXSW and he made it clear then that there was no plan B. This was an all or nothing fight.

Unfortunately the Supreme Court squashed them, but they really could have changed the world had the ruling gone the other way. ABC, NBC, CBS, and all the other broadcast networks would have had to change their business model and adapt or slowly die like the Blockbusters of the world.

Despite the fact that it didn't work out, I respect teams like this with ambitious goals that put everything on the line without compromise. Kudos to the team and investors that supported Aereo.

<comment><USER3> Yes, changed the world by making it legal to build a business off someone else's content that you got for free through a legal hack. Tragic it didn't work out.

The Blockbuster analogy is frankly insulting to people who built real technology for video delivery. Blockbuster went bankrupt because technology made their middle-man position obsolete. In contrast, there is nothing obsolete about making content. Even in the face of modern technology that makes content creation cheap, peoples' demand for high-quality studio content is higher than ever.

<comment><USER7> _DISCLAIMER: Former Aereo employee. Views do not reflect those of my former employer. Blah blah blah._

This all goes back to the core of the argument though: Is Aereo a content provider or an equipment company?

Obviously SCOTUS disagreed with several lower courts and determined that we were infringing. But to paint it as a black and white issue strikes me as a gross oversimplification.

Just out of curiosity (I'm legitimately not trying to start an argument), do you think Cablevision* should have been overturned? If not, how do you reconcile the fact that their RS-DVR doesn't publicly perform, but Aereo did?

*I seem to recall seeing you comment on Aereo stuff a bunch in the past and knowing a fair bit about the case, so I assume you're familiar with the Cablevision decision. Apologies if I misremembered or assumed incorrectly.

<comment><USER8> I'm having trouble understanding the ruling, so maybe those here with more knowledge can help.

As a thought experiment, assume I live in a building that gets spotty OTA reception on my antenna. However, there is an apartment for rent on the top floor, and I decide to rent it for the sole purpose for storing property. If I set up an antenna in that apartment, but do not live in the space, and run a long cable from the top floor to my apartment, am I in violation of the law? I do not own the apartment that the antenna resides in, and I do not physically live there.

If this is not illegal, does it become illegal when I cut the cord between the apartments and instead encode the signal and stream it to my laptop?

So, said a different way, does the legality depend on whether I live in the same physical space as the antenna, or the fact that I have digitized the content between my two rented spaces?

It would seem that the courts view a company such as SlingMedia as a hardware provider and Aereo like the landlord of my second rented apartment. However, I can't resolve at what point what I do with my rented space and equipment becomes illegal.

Can anyone explain?

<comment><USER7> SCOTUS never really addressed this. The majority opinion was basically just a bunch of vague hand-waving that amounted to "if it looks like a duck...".

That was one of the most frustrating things for me when the decision came out. Obviously we all understood that we might lose, but to have a decision handed down that was so completely devoid of any sort of definitive logic or reasoning was really, really demoralizing.

They effectively just said "You look like a cable company, and even though we accept that legally you are most certainly _not_ a cable company, we still find that you publicly perform... because cable companies publicly perform".

<comment><USER4> Aereo argued that what they were actually doing in their datacenter mattered.

American Broadcasting Companies argued that the equipment you were running was irrelevant and what mattered was the service you were selling (streaming unlicensed TV over the internet).

I don't think the latter point is unreasonable. And I don't think your company thought it was unreasonable either (except when trying to win court cases). When trying to market your product to customers this is what your website said(1):

"Watch Real, Live TV on the Internet. Finally. With Aereo you can now watch live broadcast television online. No cable required."

The customer doesn't care about what's going on in your datacenter. Why should SCOTUS?

1\. [http://web.archive.org/web/20130302160437/https://aereo.com/](http://web.archive.org/web/20130302160437/https://aereo.com/)

<comment><USER7> I think the latter point _absolutely_ is unreasonable.

That marketing tagline you pulled could just as easily have come from Sling (i.e. "Put an antenna in your house and hook it up to a Slingbox"). But nobody seems to think that would be a public performance.

By your logic, Aereo should have been legal if the website said "User- controlled, individually assigned remote antennas and DVRs in the cloud".

The way you market yourself has nothing to do with copyright law. You need to look at what's _actually happening_ under the hood – not just base your decision on whatever the "user perception" is of the service.

<comment><USER4> You missed my point.

I didn't say that Aereo was legal or not based on its marketing, I said that there was a common cause to both Aereo's lack of legality and the marketing the company chose to sell the product.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Not surprising. This played out in Canada back in 1999/2000 in a similar fashion:

\- [http://en.wikipedia.org/wiki/ICraveTV](http://en.wikipedia.org/wiki/ICraveTV)

\- [http://archive.wired.com/techbiz/media/news/1999/12/33093](http://archive.wired.com/techbiz/media/news/1999/12/33093)

\- [http://news.cnet.com/2100-1033-237450.html](http://news.cnet.com/2100-1033-237450.html)

ICraveTV was less ambitious than Aereo as well, as it had no DVR functionality, and it still got taken into the courts until they gave up.

<comment><USER10> The biggest difference with Aero is that a bunch of their staff was lawyers and they had the financial backing to bring it to the supreme court. Without that any Aero like service is a non-starter.

</comment></comment><comment><USER11> This is such a shame.

Aereo was an important part of my cord cutting strategy here in NYC.

I can still get a lot of content from Roku + Chromecast but can't get the nationally broadcast channels (antennas won't work for my apartment location). Seems so backwards to me.

I can't wait for an Aereo replacement if anyone knows of one.

<comment><USER12> Seems like that's the point: There is no legal replacement.

Now, I'd love to hear about some kind of non-legal replacement. Like some kind of crowd-sourced antenna array that makes it difficult to target and shut down.

</comment></comment><comment><USER13> The best case for aereo was that they used their hack of the copyright system to eventually lobby to change the laws and become "legit". IMO there were always pretty slim chances of that happening. Still sad though, I hate the current copyright system as much as anyone.

</comment><comment><USER14> It seems that the Supreme Court took issue with the fact that Aereo operated not only the hardware, but also the DVR software (with similar functionality to that offered by the cable companies) that transmitted the copyrighted performance to subscribers. I wonder whether it would be legal to offer nothing but VMs in the cloud that happened to have a tuner attached, and let a separate company sell DVR software that records the TV show and transmits it privately. There must be some line between renting out one's hardware and infringing copyright; Aereo just went a bit too far.

</comment><comment><USER15> Aereo was great when I used it. I even tried applying to work there because I was super interested in their service. I only had one bad experience and it was trying to watch the SuperBowl using Aereo. It wasn't bad but wasn't great (freezing,buffering,slow speeds on a fios Connection) . I completely understood that it was a big national event and didn't hold it against them. It probably wasn't even their fault but their bandwidth providers was probably being hammered also.Unfortunately, because of that I ended up canceling and getting Fios TV.Mainly,because I hosted a Superbowl part at my house and everyone was upset at the stream so I ended up getting Fios TV that way for future events/parties I didn't have to worry about a buffer or people being upset again. Regardless I love what they stood for and used the service a lot when I had it. It's sad there's no real alternative.

</comment><comment><USER16> Anyone who wants a similar product/service can check out Tablet TV: [http://tablet-tv.com/](http://tablet-tv.com/)

A $100 device that transcodes OTA signals and sends them to your tablet.

They're launching next month in the Bay Area.

</comment><comment><USER17> Did Aereo as part of it's technology have the ability to strip out ads from content? Because honestly that's the only reason I haven't watched tv/cable whatever in years. Can't be bothered to waste my time on non-content when it's easier to just download a torrent and watch it via Plex. Or is this more aimed at sport, which necessarily needs to be "live" mostly?

<comment><USER18> And do you send the "tv/cable whatever" companies a check for whatever you think the content is worth? Otherwise you are just a thief.

<comment><USER19> I hope you don't use Adblock.

<comment><USER18> I don't.

</comment></comment></comment></comment><comment><USER20> This is very sad for US consumers.

</comment><comment><USER21> I wonder if they could have got away with it, had they not included the DVR feature and just strictly rebroadcast in real-time. As it was, they were too akin to something like The Pirate Bay to not get some sort of legal bruising.

</comment><comment><USER22> Pretty awesome example of greed and money beating out innovation and common sense.

</comment><comment><USER23> Sad news. I'm not sure what their next business step will be, or if this is it, but I really do hope they open source anything they decide won't be a part of their future products.

</comment><comment><USER24> Meanwhile, live and on-demand HD online streaming is already a thing for YEARS in Peru:

[http://play.tuteve.tv](http://play.tuteve.tv)

</comment><comment><USER25> A Napster moment for TV?

Having squashed a single company they could deal with, the TV industry may end up having to contend with some sort of P2P TV rebroadcast.

</comment><comment><USER26> This is yet another title change that removes context and makes it less difficult to understand why I want to read the article or comments. I really wish there was something beyond a mechanical "original titles only beep boop robot here" method for article titles.

<comment><USER27> It might help to consider the domain name part of the title. When I read this one that way, it doesn't seem to me to lack context.

I understand why the title changes sometimes seem mechanical, but in reality that is far from the case. Sample bias plays a huge role here, and rightly so, because titles and title edits shouldn't be the locus of attention. Unfortunately, though, when most of the data goes unnoticed, the remaining sliver of cases creates a misleading picture. I'm not sure what we can do about this.

</comment></comment><comment><USER28> While I applaud aereo's challenging of the law and twist on the law to create something. The outcome is correct! I read every day on hacker news; copyright laws are wrong, too long, not fair... I do not see it the same way. The hacker news community is a community who creates many things themselves; many of the community has chosen the path to give open licenses to their creation. This is their right and thankfully they do it. But. All things are not equal; while i think the giving open licenses to software benefits everyone. I do not see mandating open licenses and wide use of "The Arts" to do the same.

Creation needs to be a struggle. Taking someone else thing and modifying it is an easy path to create something. It also damages the original creation. Software and Art are NOT the same thing. Because software industry has chosen a different path should not mandate everything do the same.

Taking the collection of Marvel comic's characters and Tolkien's "Lord of the Rings" and creating a movie would also be cool, but it damages the original. It also by-passes the true meaning of greatness; Original. We as a society have in the last few decades valued bullshit Art over copyright and originality. Why? because it is easy and gives a short amount of pleasure.

Great things to not need marketing. Tolkien does not need marketing. He and his family (example) should be compensated forever. there should be no termination to it and his family should profit from it forever.

We should never take away the rights of the people who create things. If is their choice to give openness to them.

<comment><USER18> Wow downvoters, it's ok to have an opinion like this!

<comment><USER29> It's ok, and I didn't downvote, but it's an extreme viewpoint, so it is unsurprising that he's been downvoted.

He is promoting a view of copyright that extends far past the rights granted by _any_ extant copyright system, in a forum where a lot of us are very aware of how much of culture is constant remixing and borrowing, or outright "stealing" of past content that has only been possible because copyright law is not nearly as exclusionary as the property law principles he seems to believe should apply (and as I pointed out elsewhere, in his other comments he hints at support for a degree of control which does not even apply to any property law system in the world) .</comment></comment></comment>


Metasploit Rails 3 Remote Code Execution Hours Away - <AUTHOR> https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156?x=1 <comment><AUTHOR> Expect a point-and-click exploit that will run _arbitrary code_ on vulnerable servers.

If you've never dealt with a problem like this, you may not be ready. So, here's the most important thing you need to understand:

 _If you have a vulnerable application_ anywhere, on any port _it will be found and compromised. This is a spray-and-pray vulnerability._ It costs attackers nothing to try, attempts don't crash servers, and so people will try _everywhere_.

If you lose an application in your data center / hosting environment, that's the ballgame. It doesn't matter that the app you lost was the testing instance of a status dashboard with no real data in it, because the exploit coughs up shell access on that server. If there is one thing every black-hat attacker in the world is truly gifted at, it is pivoting from shell access on one server to shell access on every goddam server.

Please make sure you didn't just patch the app servers you know/care about. THEY ALL NEED TO BE PATCHED OR RETIRED.

Additionally:

* If you are one of those "same password on a whole bunch of services people", now is a good time to make sure nothing you care about has that password. Some app somewhere is about to lose that password.

* Now would not be the worst time in the world to go to your Twitter config, hit Settings -> Apps, and scrub out all the stuff you don't use.

* Now you know why you never give 3rd party web apps your Gmail password.

<comment><USER2> (Bah, great point about passwords. I need to reform my ways.)

To amplify and expand on Thomas here: when this was announced I pushed the Big Red Button and pushed three emergency patches to my servers at 3 to 5 AM Japan time. My perception was "This just can't wait." I went to sleep with the vague feeling that I had probably broken something (there's always _something_ that slips when you're tired and hasty) but that it was almost certainly acceptable given the alternative.

Sure enough: despite automated and smoke tests passing and metrics remaining nominal, Appointment Reminder suffered breaking downtime for some customers (it depended on browser - long story not relevant). This ended up locking them out for about 16 hours, felicitously mostly not during the US working day.

After being told of the issue by a few mighty pissed end users, I fixed it and spent a second awake-to-9 AM night both writing a to-all-customers apology email and fielding questions. I went into detail on why I screwed up (acted too fast) and a simplified version of why I had to (third-party software required an urgent patch; delaying deployment by one day would have been an unacceptable risk to customer data).

Several customers - including a few of the ones most inconvenienced - got it touch to say "Right call." One of them was of the opinion that, if I hadn't patched, _he_ would be in Big Red Button mode today, because _no machine or data on a local network with an unpatched Rails instance is safe_. "I honestly prefer knowing it broke because you were on top of things than it being stable because you weren't" end quote.

I'm not a security guy, I'm just a systems engineer, but my take on it is that this does not just require the Big Red Button, this is the paradigmatic example of why you _have_ a Big Reg Button. If you don't, or if you pushed it yesterday like you should have and something blew up, this is an excellent opportunity to improve procedures for next time.

Edit: Big Red Button is funny shorthand for "Immediately drop what you're doing, pull out the In Case Shit Happens folder, and have the relevant people immediately execute on the emergency plan." We call it something different in big Japanese megacorps but I always liked the imagery.

<comment><USER3> LastPass makes it much, much easier to never re-use passwords. Just make sure your master password is unique and strong and never re-used and you use 2FA!

<comment><USER4> I use SuperGenPass, it's comparable and requires storing no state, thus nothing to lose or back up.

<comment><USER5> Is it still completely vulnerable?

<http://akibjorklund.com/2009/supergenpass-is-not-that-secure>

<comment><USER4> I use EngimaPass[1], which, as an extension, renders outside the DOM, so it's not.

[1] [https://chrome.google.com/webstore/detail/enigmapass/bgkipgf...](https://chrome.google.com/webstore/detail/enigmapass/bgkipgfgpifliinhbnfoaafgdeemodoi?hl=en)

<comment><USER5> Thank you, I was looking for one and thinking of buying a yubikey as well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> For those who aren't familiar with the Metasploit Project, it's an open source collection of safe and vetted exploits. Once an exploit module makes it into the Metasploit Framework, it's immediately available to ~250K users. The Metasploit Framework isn't just exploits though, it's an integration point for offensive capabilities that simply work together. It's also very easy to hook your own stuff into it.

There are several programs that build on the Metasploit Framework and take advantage of it. Rapid7 has commercial penetration testing products. I build the open source Armitage GUI for it and a commercial add-on called Cobalt Strike.

It's worth spending some time to learn how it works and what it does. Here's a few links:

Metasploit Unleashed Wiki: [http://www.offensive-security.com/metasploit- unleashed/Main_...](http://www.offensive-security.com/metasploit- unleashed/Main_Page)

My 7-part course on pen testing (with Cobalt Strike & MSF): <http://www.advancedpentest.com/training>

Quick demo of what it looks like to attack a workstation and use it as a hop point to get other things: [http://www.youtube.com/watch?feature=player_embedded&v=S...](http://www.youtube.com/watch?feature=player_embedded&v=S_ejYRTM8J0)

The best way to try the Metasploit Framework is to setup BackTrack Linux in a virtual machine: <http://www.backtrack-linux.org/>

A free vulnerable target is the Metasploitable virtual machine, available at: [http://sourceforge.net/projects/metasploitable/files/Metaspl...](http://sourceforge.net/projects/metasploitable/files/Metasploitable2/)

<comment><USER7> This particular gentleman also has a few good presentations on Metasploit I saw at Defcon/Bsides:

[http://www.youtube.com/watch?v=G-JaHWaLmgc&hd=1](http://www.youtube.com/watch?v=G-JaHWaLmgc&hd=1)

[http://www.youtube.com/watch?v=y2M3SpOzeJY&hd=1](http://www.youtube.com/watch?v=y2M3SpOzeJY&hd=1)

</comment></comment><comment><USER8> Available now:

<https://github.com/rapid7/metasploit-framework/pull/1281>

<https://gist.github.com/4499206>

</comment><comment><USER9> How prevalent is Rails 3 right now?

I somehow feel that defensive programming practices would have caught this bug. There is a lot of "magic" going on that lead to this exploit.

Sending text/xml to an application shouldn't have a huge impact but when you are dynamically creating objects out of the content it can lead to some serious problems.

Python has this too with pickle. However with Python it is pretty damn obvious that pickle is NOT SAFE. You also have to import it manually.

<comment><USER10> I don't think defensive programming would have based on the current situation across a number of languages. Basically no serializer in any language PHP, Python, Rails, etc is completely safe. There are known exploits for all of them.

There is lots of magic in rails, but I bet there are a number of popular PHP and Python libraries/frameworks that are unserializing in an unsafe way.

<comment><USER11> There's an enormous difference between serializers that make _any_ effort at all to be safe, and those like Ruby's YAML library, which make no effort. Python's YAML, for example, exposes a safe_load() method.

It's really criminally negligent that no such method exists in Ruby's YAML library.

<comment><USER12> Python's Pickle lib had something similar to safe_load(), that they _removed_ because it gave a false sense of security.

<comment> X-Istence If you are accepting pickled objects from a remote and using it ... you are an idiot.

</comment></comment></comment></comment></comment><comment><USER13> Proof-of-Concept Exploits for CVE-2013-0156 and CVE-2013-0155 are here:

rails_rce.rb (<https://gist.github.com/4499206>)

rails_sqli.rb (<https://gist.github.com/4499032>)

rails_dos.rb (<https://gist.github.com/4499017>)

rails_jsonq.rb (<https://gist.github.com/4499030>)

</comment><comment><USER14> It's arrived:

[https://github.com/rapid7/metasploit- framework/blob/master/m...](https://github.com/rapid7/metasploit- framework/blob/master/modules/exploits/multi/http/rails_xml_yaml_code_exec.rb)

Same story I submitted yesterday : <http://news.ycombinator.com/item?id=5030906>

</comment><comment><USER15> The Good:

The way the Rails team responded so quickly in patching this.

The Bad:

The patches for this and other recent security issues had little time for testing and hence broke things. The old failed idea of trying to prevent full disclosure, which ultimately harms the community whilst doing nothing to really prevent the bad guys arming themselves with working exploit code, and all the resulting kerfuffle we saw.

The Ugly:

The Rails codebase. Seriously. As you read this, interested people are now pouring over it, looking for new vectors of attack, and we are awaiting the next series of having to scramble and fix the bad things that the magic in Rails enabled.

</comment><comment><USER16> If you installed Rails from Ubuntu, you have to patch it by hand since they're not patching it.

Use the conversions.rb patch for 2.x from [https://groups.google.com/forum/#!topic/rubyonrails- security...](https://groups.google.com/forum/#!topic/rubyonrails- security/61bkgvnSGTQ/discussion)

"We're not patching it" statement: <https://launchpad.net/bugs/320813>

<comment><USER17> In my experience, using Ruby or gems from your package manager leads to headaches down the line - I'd highly recommend using bundler to manage your gems at the very least, and rvm or rbenv to manage rubies.

<comment><USER18> Does this also apply to end-users of Ruby apps that are just an apt-get away? I don't really want to learn all that stuff (and remember to redo it on all installs) just to use some tool that happens to be written in Ruby.

<comment><USER19> I don't believe there are any rails-apps-as-packages in the official debian/ubuntu repositories, but if there were I assume they would use bundler to bundle their gems internally.

<comment><USER16> Yes there are, in our case Redmine. A pretty popular piece of software I believe. In Debian it's in main and in Ubuntu it's in universe.

Re. bundler/gems, I don't know what those are - the file "core_ext/hash/conversions.rb" I hand-patched was from a package called ruby- activesupport-2.3 which is a dependency of the Rails package.

<comment><USER17> It was redmine I was using when I had the issues actually. The real problem though was that I was trying to use a newer version of Redmine than was available in the repo, and I did still manage to satisfy the dependencies but upgrading my Ruby version broke literally everything.

I think if 100% of your eco system is from the package manager you would be fine, but if even a single component needs to come from outside I would reach straight for rvm and bundler (no prejudice against rbenv, rvm is just what I use)

</comment></comment></comment></comment></comment></comment><comment><USER20> So all these rails exploits are cropping up because someone decided to actually look at a single module of code? I saw in the last thread someone comparing these Rails vulnerabilities to Python Pickle (which has a huge warning screaming "DO NOT USE") and Django's various issues but that comparison seems pretty unfair now. Rails seems to be at the PHP4 league of bad code and reading the security threads on this back in time you see tons of people brushing the initial vulnerability off ("You need the secret key" "Only projects that leak the secret are vulnerable" etc)

Is a simple code review all it took for this fail cascade?

<comment><USER21> It wasn't a simple code review, it was a vulnerability that existed in code unnoticed for a number of years. It required skilled security researchers to unearth it. Vulnerabilities exist unnoticed in a number of foundational OS projects like this, and it's only when a CVE is released that people realize it had been there for quite some time.

<comment><USER22> Unnoticed...

Do not make the mistake of assuming that because there's no CVE, that a vulnerability is unknown. Not everyone who analyzes code is wearing a white hat.

<comment><USER21> Very true. There were no widespread reports of incidents based on this vulnerability in the wild, though, or it would have been discovered already. Thankfully, the folks that found this exploit (and the others they are sitting on for the moment) were wearing white hats. Also thankfully, the core team responded quickly to rectify and publicize the issue.

</comment></comment></comment></comment><comment><USER23> What is a 'metasploit'? I just suddenly read this 50 times on twitter and I have no idea what's going on. I'm halfway through this article and still not making sense.

<comment><USER24> It's an automated vulnerability tester.

It will probe websites (and local networks) to find out the OS/server information (IIS, apache, etc), database info (mysql, mssql) and language (asp, php).

It then uses a database of known exploits and scripts (all types XSS, SQL injections, etc).

<comment><USER23> So is it a good tool (testing tool) or malicious?

If it's a good tool, why would he release it so soon without giving people much time to update?

If it's malicious, why is he telling people about it?

<comment><USER25> It's intended to be used for security testing against one's own machines, demonstrating a vulnerability if it exists by directly exploiting it. The general nature of such tools, however, is that they can be used for good or for evil. It's just assumed that the bad guys have something of the sort already.

<comment><USER26> You know, when I look at what it is and what it does... I'm not sure I believe that's what it's 'intended' for, although that certainly is what they say it's intended for.

But anyway, in the end, it doesn't matter, it exists. Authorial intent is so 20th century.

<comment><USER21> That's exactly what it's intended for, actually. It was built by pentesters to perform their work. I'd rather my security tools be open sourced and available for all the world to see and contribute to. Doing so also compels lazy vendors to patch awful vulnerabilities.

<comment><USER26> Wikipedia says:

> The Metasploit Project is also well known for anti-forensic and evasion > tools, some of which are built into the Metasploit Framework.

If so, how are such functions valuable for a pentest/audit?

<comment><USER22> Say you're doing a pentest, and your target has an IDS/IPS to both prevent infiltration and exfiltration of data. And while you discover a system that is vulnerable, the payload that you want to deploy to this vulnerable system would normally trigger an alert by an IDS. With some of the tools in MSF and BackTrack, you can use an encoding process to obfuscate the payload enough to get past the IDS/IPS.

Now a blackhat would be able to do this without BT or Metasploit. The tools are out there, and well known. So the fact that these tools are in BT and Metasploit doesn't change that. But it does make it easier for a pentester to prove a system is vulnerable, and to help a company address their vulnerabilities through remediation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Boy did I pick the right week to leave my last job.

</comment><comment><USER28> I just saw a PoC on twitter a few minutes ago. I tested it locally and was able to run arbitrary ruby code via YAML.load, including shell commands.

<comment><USER29> which one works w/o Rails?

</comment></comment><comment><USER30> How about an exploit that patches Rails? or at least disables it?

<comment><USER31> Current US law would still see you as hacking ("unauthorized remote computer access"). Hey, if you break some apps, their owners would probably agree, so don't do it.

</comment></comment><comment><USER32> I wrote up a detailed explanation of the issue and how the proof of concept works here: [http://blog.codeclimate.com/blog/2013/01/10/rails-remote- cod...](http://blog.codeclimate.com/blog/2013/01/10/rails-remote-code- execution-vulnerability-explained/)

</comment><comment><USER33> What's the easiest way to verify that "ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::XML)" is handling requests with xml parameters properly? Does one of you beautiful people know of a tool that I could use?

<comment><USER34> I posted about this a little bit further up. Run the exploit code on your local server and ensure that no parameters are getting logged.

You can test by running this ruby file: <https://gist.github.com/4499206>

      $ ruby rails_rce.rb http://localhost:3000 param "User.destroy_all"

Monitor your server and ensure it is disregarding the post parameters.

<comment><USER33> thanks!

</comment></comment></comment><comment><USER35> So for old versions of rails 2, can someone tell me where to put this?

ActionController::Base.param_parsers.delete(Mime::XML)

if i just stick it at the bottom of environment.rb, will that work? i am not sure how to test to confirm that i've fixed it.

<comment><USER36> run this for rails 2.x

      curl -i -H "Content-Type: application/xml" -X POST -d '<id type="yaml">--- !ruby/object:ActionController::Base bar: 1</id>' http://localhost:3000

If in your logs the params[:id] is an object, then you are vulnerable. If it's just a string, then your fix worked.

I put mine in an intializers file.

      ActiveSupport::CoreExtensions::Hash::Conversions::XML_PARSING.delete('symbol')
      ActiveSupport::CoreExtensions::Hash::Conversions::XML_PARSING.delete('yaml')

<comment><USER35> Thank you, very helpful.

EDIT AGAIN: I think putting it at the end of environment.rb works. I somehow messed it up and got confused, but then I tried it again and it worked. Just make sure you confirm your fix with the curl command!

<comment><USER37> I can confirm that this method produced the desired change in a Rails 2.1.2 app.

</comment></comment></comment></comment><comment><USER38> Can anyone confirm whether or not I still need to add ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::XML) to an initializer if my apps have been updated to rails 3.2.11?

<comment><USER39> I suggest that you test it. You should get something like 'Disallowed type attribute' error if everything is installed correctly. You can use Postman Chrome extension to quickly test if your server is ok.

<comment><USER40> You will only get that error if you upgrade to 3.2.11 (or whatever) and _do not_ disable XML. If you disable XML, you'll just silently not parse the XML (regardless of update status).

<comment><USER41> If you disable xml or yaml parsing, you'll see the raw yaml come through in the parameters hash.

</comment></comment></comment></comment><comment><USER42> Question: this only affects Rails Version 2 and higher, right?

I suspect I'm not the only person out there with legacy Rails Version 1 sites, so it would be very good to know the answer to that!

<comment><USER43> Note the comment about Yaml parsing in 1.1 era rails apps. You'll want to at least look into what your app is doing.

<comment><USER42> Yeah - my eventual decision was that it wasn't worth the risk. One extremely busy day later, we don't have any active Rails apps.

</comment></comment></comment><comment><USER44> After reading tptacek's comment, I'm curious:

Has this never happened before? Has there never been an exploit of this significance that has made it to Metasploit, and why not?

<comment><AUTHOR> Yes, many many times. It's just new to startupland.

</comment></comment><comment><USER45> Metasploit Framework, the 2nd most important software framework written in Ruby, and Rails, the topmost ...sweet irony ;)

</comment><comment><USER46> I wonder if Heroku's current downtime on their MyApps site is related?

</comment><comment><USER47> I've found a lot of the posts so far to not cover both how to use Metasploit and actual secure a site. So I wrote [http://blog.endpoint.com/2013/01/rails- CVE-2013-0156-metaspl...](http://blog.endpoint.com/2013/01/rails- CVE-2013-0156-metasploit.html).

</comment><comment><USER42> Sheeeeit.

Is there a quick way to fix this problem for sites running older versions of Rails? I can't be the only one who is in that situation. Frankly, provided it leaves _some_ version of the website online, I'm OK with losing some functionality, even.

<comment><USER48> Older than 2.3? <http://weblog.rubyonrails.org/>

<comment><USER42> Yes. MUCH older. I still have version 1 Rails sites...

<comment><USER48> Not sure this is correct. I just skimmed the article.

<http://www.insinuator.net/2013/01/rails-yaml/>

From the comments:

"From what i've see here is that versions below 2.0 should not be affected by this issue as they do not support xml parameters and don't have any XMLMini implementations."

</comment></comment></comment></comment><comment><USER49> If I download a fresh version of rails from <http://rubyonrails.org/> is it vulnerable to this?

<comment><USER50> No, rails-3.2.11 has fixed this vulnerability.

</comment></comment><comment><USER51> metasploit people seem to be getting stuck trying to get a version that runs against rails 2.x 3.x and different ruby versions. so might be a while before they release :)

however, there are multiple PoCs floating around so it is fairly safe to assume attackers have access to it.</comment>


Ways for non-tech founders to build a startup - <AUTHOR> http://www.shoestring.com.au/2013/08/12-ways-for-non-tech-founders-to-build-a-startup/

<comment><USER2> We launched our site SideProjectors ([http://sideprojectors.com](http://sideprojectors.com)).

It's a market place for side projects (pretty obvious).

An interesting thing we have found so far, is that many of non-technical people are visiting and checking out what projects have been attempted.

Many of our users are trying to see if they can buy side projects without having to program from scratch.

Of course there is Flippa, but we launched our site aiming at a lower level side projects which might have stopped or been "killed" due to varying reasons (e.g. busy, no time to market) and allow developers to find someone else to take over.

I wanted to raise it here to let other non-technical people know about it as another way to explore their startup options!</comment>


Ask HN: What Are Your Go-To Websites for Industry News and Business Moves? - <AUTHOR> Business Acquisitions, New Market Entries, New Waves of Technological Innovations, etc. <comment><USER2> Well, Hacker News is pretty much exactly that.... Unless I'm missing something?

</comment><comment><USER3> Stratechery</comment>


Coding As A Substitute For Meditation? - <AUTHOR> http://statspotting.com/2012/12/coding-as-a-substitute-for-meditation/

<comment><USER2> To be fair - there's a massive different between focusing on something you're passinate about (like coding) and focusing on not thinking. Not thinking and letting your mind relax is completely different from, and often way harder than, thinking about a passion.

Jusy "getting in the flow" is not the point of most meditation.

<comment><USER3> Please keep in mind that the flavour of meditation you are describing is not the only one.

"[M]editation refers to a family of self-regulation practices that focus on training attention and awareness in order to bring mental processes under greater voluntary control and thereby foster general mental well-being and development and/or specific capacities such as calm, clarity, and concentration" Walsh & Shapiro (2006)

"[M]editation is used to describe practices that self-regulate the body and mind, thereby affecting mental events by engaging a specific attentional set.... regulation of attention is the central commonality across the many divergent methods" Cahn & Polich (2006)

The practice of 'coding in the zone' might as well achieve the same effect as traditional meditational practices and be called meditation on that ground. In fact, you _are_ training the control of your attention with that practice.

<comment><USER4> I have similar deep experiences doing meditation related practices (Pranayama) and programming. This happened when I was focused on solving a single algorithm for long time. If I have to describe details about this time I can say that I was 18 years old, was doing my own parsing algorithms for a small language, and I debugged the algorithm in my head all the time.

</comment></comment></comment><comment><USER5> Exceptionally misguided. Having meditated for an average of forty minutes every day (sometimes for as much as 2 hours a day, in 40 minute blocks) for the last half year and having coded many, many hours in my life, I can say that this conclusion is decidedly incorrect. Most forms of meditation are about doing nothing except breathing. Coding, like any other task, is far from this. Again, exceedingly misguided.

<comment><USER6> _Exceptionally misguided._

Indeed, I would even say such misconceptions are harmful, since coding has quite the opposite effect. After a day of too much or too intensive coding, I usually find that my brain continues to be occupied with coding problems. E.g. when I'm half-sleeping I see problems that don't exist (at least not in sleeping ;)). Meditation has the opposite effect: the mind becomes calm and unoccupied.

It's important to give the mind rest and time to process your day.

<comment><USER7> I agree, I think the original post is harmful because the author suggests an activity that will strengthen identification & thereby increase suffering. Meditation does the opposite, in my experience, anyhow.

</comment></comment></comment><comment><USER8> Why not do both until you understand the real differences?

The reason people voluntarily stay up late to code, while meditation by contrast seems kind of boring — the reason why people are so eager to come up with different "substitutes" for meditation that just so happen to align with their favorite things to do — is very near the essence of why meditation probably shouldn't be replaced by coding, or running, skiing, drinking, smoking, or whatever your favorite activity is.

</comment><comment><USER9> Meditation is not about cluttering your consciousness, but freeing it from agitations and useless load, we produce themselves.

It is not about chanting mantras. It is about realization of the "source" of the mental content.)

Calling a concentration, deep focus of so-called state of flow a meditation is confusing misuse of the language (using wrong associations).

Constant agitation and restricted, repetitive patterns of "thinking" is misuse of the mind.)

</comment><comment><USER10> No. What you described is called flow.

There is a good chance however that practicing meditation will help you find more 'flow' in your activities.

</comment><comment><USER11> I'm not a Buddhist, but I have attended a few classes on medetation. I had a bit of an epiphany at one session. Portions of the experience of meditation are similar to being "in the zone" when coding. A lot of other commenters here have already mentioned it: "flow".

There is a significant difference though. When you are coding, you experience flow with your mind already full of things. When meditating, you start with an empty mind, so the perceptive influence of flow is far more noticable. It's enough to throw you out of the meditative state if you are unprepared.

The goal of meditation is different than that of coding as well. Meditation starts from an empty mind so that you once you reach a meditative state, you may choose to do any number of things. One exercise the instructor had us perform was to find a meditative state, then meditate on the first thought that entered our mind, and to not sway from that thought.

When you're coding, you are keeping many things in mind. I find that when you end up in the "flow", it is because you have pushed everything out of your mind as a result of there being no space for it. Meditation is about pushing everything out of your mind so there is space for anything.

</comment><comment><USER12> I'm kind of turned off by this post. I'm a fairly experienced meditator in a few Buddhist traditions. You could definitely make coding a kind of meditation. People do driving meditation, or dish washing meditation, but it's usually as an extension of other mindfulness practice. I wouldn't just slap the 'meditation' label on coding unless the practitioner is explicitly going out of his/her way to make it a meditation.

</comment><comment><USER7> Commenter on the blog nailed it ("noise is a substitute for quiet"), or: activity as a substitute for inactivity, work as a substitute for rest.

In the Buddhist traditions meditation is used as a tool to examine the subtle nature of the mind's processes, how they may create suffering through craving, aversion & identification (dependant origination) which initially at least requires some down-time to bring the mind to a relatively quiet state. You really learn a lot about craving when all the goodies are taken away, similarly you learn about aversion from the small discomfort from sitting.

I love coding, it's my main intellectual outlet, but I never want to be someone who has to lug along a laptop on holiday because the pain of being away from code is too great, I take any such pain as indication that I'm broken in some way (addicted). If I simply coded every time I feel that addiction I'd never truly discover how dependant my happiness is on coding & I'd never discover that I can be happy without coding. I think coding is nicer when I'm not addicted to it.

</comment><comment><USER13> Perhaps there are comparisons to be drawn between the two, but I think don't think they should be dependent on set amounts of time doing them: After an hour of coding something, I'm likely to either want to continue hacking on what I started, work on something else, or stop working entirely(rather than presumably continue working with a refreshed mental state..?).

Part of meditation is precisely /not/ doing or thinking about anything. As another comment pointed out, this is sort of finding a substitute for meditation in something most of us would likely being doing anyways, since the majority of us have trouble breaking out of our day-to-day cycle to literally sit for 15 minutes and do nothing whilst so much is going on regardless. I think there are similarities to be drawn in terms of "flow" or getting "in the zone" so to speak while writing code, though.

</comment><comment><USER14> I don't think it's valid to compare a flow state with meditation. Coding isn't just "one thing", not like mindfulness mediation practices are about "one thing".

It seems to me that coding is about actively using a lot of your brain. At the abstraction level of a brain or a mind coding is a whole lot of different things.

I happen to think meditation is good practice for directing your attention mindfully, improve your ability to direct your thoughts. Good at directing your thoughts at something? You'll find you enter flow states when doing it. So I see the connection, but they aren't the same.

</comment><comment><USER15> This is wrong on so many levels. Why is this on the front page?

</comment><comment><USER16> I think you are mixing the feeling of achieving a state of flow with the goal of an activity.

There are many ways to reach a state of Flow , coding and meditating may get you there, but as practices I don't think they have more in common than skydiving, rock climbing or surfing a perfect wave..

Personally.. meditating for me is more is like a call to System.gc() on my brain.

</comment><comment><USER17> <http://en.wikipedia.org/wiki/Flow_(psychology)>

</comment><comment><USER18> Similarly, I've found that playing engrossing video games draws most of my attention from pain -- or anything else really.

<comment><USER19> Yes, when I was exhausted from coding or simply the stress of work playing an imersive video game helped to refresh my mind.

Also, years ago when I was studying and had headaches, playing chess against computer was also refreshing. I suppose I was using different parts of the brain and letting others rest.

</comment></comment><comment><USER20> This an observation well supported by the theory of Flow. It's psychology's foray into positive thinking, a big part of which is productivity.

Coding, when you're good at it and have mastered your tools, IS meditation (at least on the surface) as you feel an intrinsic sense of well-being.</comment>


Self-Driving Tractor (1978) [video] - <AUTHOR> https://www.youtube.com/watch?v=_3xS3eIHzLk&hn

<comment><USER2> Tractors are now routinely used with GPS-based hands-off driving, just to get precision rows. Trimble Navigation and John Deere offer that. But few go all the way to driverless operation. There have been lots of demos, experiments, and startups, but full driverless operation is still rare. Autonomous Tractor Corp's site still says "will be demonstrated in the field in the fall of 2014".

Automated precision driving is a big win, because all the field operations work better if they're precisely lined up on the rows, and driving that accurately by hand is wearing. But equipping a tractor with all the sensors needed to avoid obstacles and accidents is still difficult. It's necessary to distinguish between tall corn and someone standing in the corn.

<comment><USER3> I'm not sure it is that important. If the tractor has some failsafe to just stay in the field, then somebody standing in the field is going to have a bad day. They're in the way of some industrial operation, and its their fault.

I know, children and kittens etc. But plenty of other industrial processes are dangerous and don't deal with it; why should farming?

<comment><USER4> Dangerous industrial places like ports, for example, have big fences and security cameras and security officers watching those cameras and driving around. It could be that hiring a tractor babysitter is cheaper than all of that.

<comment><USER3> Ever been in a corn field? No need for fences and cameras. They are way out in the middle of nowhere. Distance makes them safe. I spent large portions of my childhood in corn field/hay fields etc, and nobody ever, ever went out there but me and people like me who had business there.

<comment><USER5> And if you do wander into a random corn field in the middle of nowhere, the presence of a human farmer doesn't suddenly make it safe. You can get run over by a manned tractor just as well as an unmanned one. And an unmanned one won't shoot you with a shotgun if it feels threatened.

</comment></comment></comment></comment></comment><comment><USER6> Credit where it's due: this work was done at Silsoe Research Institute, which was the engineering base of the UK's BBSRC (biology research funding agency).

They were based at Wrest Park, a beautiful stately home in gorgeous grounds designed by Capability Brown. You can see the main house in the background in the first few seconds of the video. The UK govt in their wisdom closed it down a few years ago.

[http://www.silsoeresearch.org.uk/](http://www.silsoeresearch.org.uk/)

<comment><USER7> Merged with Cranfield I belive

</comment></comment><comment><USER8> I'll raise you Self-Driving Air Tractor. (ca 1996). [http://www.agairupdate.com/article_detail.php?_kp_serial=000...](http://www.agairupdate.com/article_detail.php?_kp_serial=00001605)</comment>


Share42.com – Social Sharing Buttons Script - <AUTHOR> http://share42.com/ <comment><AUTHOR> I'm impressed: this is small and doesn't seem to cause any off-site tracking, slowness etc (cf AddThis pulling in ~300kB).

Is currently lacking an HN button, but I put in a request to fix that!

Rgds

Damon</comment>


Locust Swarms Ravaging East Africa Are the Size of Cities - <AUTHOR> https://www.bloomberg.com/features/2020-africa-locusts/ <comment><USER2> What are good ways for large scale killing of locusts?

Genetic modification that prevents reproduction, some light based traps for the night, large flame throwers?

What can be done?</comment>


Ask HN: Why are p2.16xlarge EC2 spot instances 10x the price of on-demand? - <AUTHOR> EC2 is currently listing Linux-based p2.16xlarge instances in Ireland at $155.52 / hour at the moment. Getting on-demand instances at $15.552 / hour is proving impossible. Any idea why there's a price spike? Any good alternatives short of just buying some cards? <comment><USER2> I haven't used AWS for a year, but last time I saw this it was crypto coin miners who didn't know how to use the spot market place properly. This was way back when Bitcoin was first spiking, and for about two weeks the price of the compute instances was ridiculous (CPU mining was still a thing). This was confirmed later by an AWS person.

If you look outside the default us-east-1 region you often find prices are more stable (though not always as cheap)

</comment><comment><USER3> Funny you should ask. I just looked into this:

[https://twitter.com/dakami/status/884715382061252608](https://twitter.com/dakami/status/884715382061252608)

Yeah. Ethereum blew up and all that compute is going towards GPU Mining.

</comment><comment><USER4> I'm guessing if you can't even get any at on-demand pricing, the demand is high, the supply is too low, so the only way to get access is to pay through the roof.

<comment><AUTHOR> I'm wondering if the Cloud providers are seeing cryptocoin mining as the primary workload at the moment and don't want to be left with a ton of inventory the next time there is a difficulty increment and clients move on.</comment></comment>