When Carl Icahn Ran a Company: The Story of TWA - <AUTHOR> http://blog.pmarca.com <comment><USER2> For those that don't know what is going on, here is the backstory:

Carl Icahn has recently bought a bunch of ebay stock. He has claimed the company is mismanaged. He has also personally attacked Marc Andreesen. Here is the accusation from Ichan:

1) Marc Andreesen was/is on ebay's board.

2) While on ebay's board, Marc bought most of Skype from eBay.

3) He flipped Skype to Microsoft in less than 2 years, earning himself a multi-billion dollar profit.

Carl Icahn is running Marc Andreesen name through the mud. The basic accusation is that if Marc knew Skype was so valuable as the smart phone wars were heating up, he had an obligation as a board member to give ebay better advice on the divesture.

Now Marc is fighting back.

This is a comic schoolboy fight among billionaires.

Edit: After a bit of fact checking, it looks like A16Z only invested $50M in the skype deal. Their fund at the time was around $300M. His gain was on the order of $150 million, not billions. A16Z only had around 2% of skype, and ebay retained 35%.

<comment><USER3> Carl Icahn is scum. He does serve a purpose, and scum cleans out scum every once in a while. But I believe he is a virus and a destructive force dismantling companies for personal gain. Although he is scum, if there were virus's like him, large companies would live on forever and have nothing to fear. Interesting mechanics at work.

<comment><USER4> I upvoted you, but I'm not sure I agree. If you look at people who've really disrupted industries, they don't tend to be like Carl Icahn. Increasingly, as I read up about what happened during the M&A boom of the '80s, it does seem to me that finance played an essentially destructive role during that decade and the three that have followed. I don't see very many advances that would have been impossible without the financial industry. Instead, I see an industry which has become focused on short-term profits in exchange for long-term bailouts. Carl Icahn epitomizes this trend. That's why so many people hate him.

<comment> barry-cotter Leveraged buy outs aren't about disruption, they're about efficiency. Any company worth doing a hostile takeover of has a working business model (product market fit) and the acquirer is betting they have a lot of expenditures that are basically irrelevant to what they do to make money, or they are running at far below full utilisation on some resources or capacities, which can be cut without materially effecting anything the customer really cares about.

It usually sucks to be the employee of a company that's just been LBOd because layoffs are almost certainly coming, and whether they are or not, you're going to have to do more work, probably with less resources.

But for society as a whole it should be a win if competently executed; getting the same product/service out of less resources leaves the now excess resources free to be used elsewhere.

<comment><USER5> well most of the time its about asset stripping and loading up a company with expensive debt and selling it before the chickens come home to roost as a recent number of company collapses in the uk proves)

Or its about forcing companys to do trendy things - bad for the long term by selling off core assets on the cheap BT selling O2 is a classic example.

</comment></comment></comment></comment></comment><comment><USER6> In my view, after his humiliation by Apple's board, Carl Icahn feels his power (and by proxy the power of wall street) slowly and surely being stripped away by tech. This is at the root of his obsession with pmarca, who famously claimed that "software is eating the world."

The world that's being eaten is the world of Icahn and wall street financiers like him. The tech industry has its own source of finance (namely angels, vcs, y-combinator etc .. people like pmarca). Icahn's recent attention seeking is a symptom of the despair he feels at no longer being needed.

Good riddance, in my opinion.

<comment><USER7> I can't presume to understand Carl Icahn (as you admitted as well) but IMHO, this is untrue and can lead fellow HNers into an echo chamber.

First, Wall Street's role in capital markets towers over Silicon Valley. Venture Capital Assets Under Management is approximately $200 billion. Blackrock, the world's largest fund, has $4.3 trillion AUM.

Second, while I believe pmarca acted entirely in good faith and is legally in the clear, there is enough "there" to begin fighting a proxy war. For example, the (tech) market was more forgiving when Dan Loeb fought Yahoo because it got the outcome we wanted (Marissa joining, Yahoo focusing).

Let's not conflate what is arguably an ill-advised but legally legitimate proxy war with a misdirected turf war between finance and tech. As a point of reference, I'm a tech co-founder (who poorly codes) and a former investment banker.

<comment><USER6> > _First, Wall Street 's role in capital markets towers over Silicon Valley._

True, but what's the _delta_? Where are the sources of _new_ power (and subsequently wealth) being generated? Why, for that matter, are you a _former_ investment banker and now a tech-cofounder and coder? As I'm sure you know, you're not the only one who's made that (smart) move.

What moving around money was to the 19XXs, moving around information is to the 20XXs. That's the crux of "software is eating the world".

AUM doesn't seem a useful metric for power, in fact it's debt and so it all depends on what you do with it. What % of those assets are depreciating? How fast are the % of assets that are appreciating doing so?

I know little about capital markets, but these seem like the obvious begged questions, don't they?

<comment><USER7> New power/wealth generation is and will be in finance for the foreseeable future. I can go into great detail on this but for TL;DR purposes, I will generalize: finance > tech in making aggregate money because finance only cares about making money and tech cares about a lot of other things, which in turn generates money.

I moved into tech because I liked it, not to make money. If I were still in investment banking, I'd be making 7figures a year (and killing my soul in the process). This is not a judgment call; it's a personal choice. There exists good-willed bankers as well as selfish, rent-seeking coders.

Moving money around has not been limited to the 19XXs. It's been around since humans put a face of an important person on some piece of metal (actually earlier, but it lacks the imagery).

<comment><USER6> Power and money aren't the same thing. Power is the ability to control your environment .. i'd say that's _exactly_ the "lot of other things" that tech cares about. Power derives from generating _wealth_ , which is making people's lives better.

Of course, people have always moved money (and information) around (and always will). Just as we've always moved goods around. That wasn't my point. When "Brittania rules the waves" became Britain's national anthem, it was because ruling the waves (and moving goods) was the main source of power in those days. Since then, shipping has become a commodity. This is now happening to finance.

<comment><USER7> Agree to disagree my friend. I wish you well.

</comment></comment></comment></comment></comment></comment><comment><USER8> Financiers like Icahn are motivated by short term profits above all else. Building a company takes people with a long term vision. The two are often not compatible. Having a leech trying to bleed out every cent as soon as it's made is not generally a good thing unless your company throws off wads of unneeded cash like nobody's business.

<comment><USER9> > _Financiers like Icahn are motivated by short term profits above all else._

That's one way to look at it.

Another is to note that Icahn built a thriving financial company that has survived for over 4 decades, and employs over 60,000 people globally. I'd say that requires long term thinking and demonstrates a bit of business acumen.

<comment><USER10> that's the only way to look at it; Icahn is a thieving sack of shit. Look at TWA: Icahn got fucking paid no matter whether TWA succeeded or failed. I can _maybe_ see how these leeches ought to get 1/2 billion dollar payouts if they come in and rescue a company, but 0.5B when they ruin a company?

Heads I win, tails you lose.

<comment><USER11> What puts you in a position to be an objective judge of the dealings of billionaires?

<comment><USER10> their behavior, particularly said behavior's effects on others

</comment></comment></comment></comment></comment><comment><USER12> It's kind of absurd how closely Carl Icahn's mirrors that of the story of Gordon Gekko in Oliver Stone's movie _Wall Street_. What Icahn did to TWA is pretty much exactly what Gekko did (or planned to do) to Bluestar Airlines in that film. Longer period of time - but in principle, very similar.

<comment><USER13> I was just about to post exactly this. Anyone interested in what Wall Street actually does needs to watch this movie.

I have an MBA. I have nothing against making money. But while it's possible to make money by _creating something of value_ , it's unfortunately possible to make even more money while doing the opposite.

<comment><USER14> From what I've read, Icahn argues that the companieshe's going up against aren't do a good job of running the company. If that's true, Icahn is doing shareholders a service.

<comment><USER15> Given what he did with TWA and reselling tickets, its hard to think that served any other shareholder but himself.

<comment><USER14> Whenever I hear a story about someone being "underhanded" and "of low character" I always see what the other side of the story is. Usually, the truth isn't so straightforward.

It appears that TWA owed him money so he negotiated the cheap ticket as a form of payment...[1] How convenient that Marc left that out of his blog post...

 _In the interim, Icahn negotiated for airline vouchers from the company in lieu of the $190 million that TWA owed him. As the deal included the provision that he could not sell these tickets through travel agents, Icahn founded LowestFare.com, where he both sold the tickets and created a revolution in the travel industry._

[1][http://www.investopedia.com/articles/financial- theory/08/car...](http://www.investopedia.com/articles/financial- theory/08/carl-icahn-lift.asp)

<comment><USER15> So, how did that help the other shareholders?

<comment><USER14> I don't know the details, but maybe it kept the company from filling bankruptcy by a few months? They didn't have the cash to pay the loan, so they offered the tickets.

<comment><USER15> Selling off the most profitable route, tickets, short ordering replacement aircraft - there is not one thing he did that benefited anyone but himself. Nevermind long term company value.

<comment><USER14> That doesn't make any sense. Icahn is a shareholder himself and he mainly makes his money through share appreciation. If the share price goes up, all shareholders benefit.

I don't know enough about the TWA business dealings, but sometimes a company is more valuable broken up.

<comment><USER15> Did you read the article you linked to with the stock buy-back, ticket sales, and then tanking it in Chap 11? That didn't benefit the other shareholders.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I like to see them swinging back at Icahn.

He uses wildly over-dramatic statements ('ebay is the worst run company ever') to try to force boards to do things that are specifically in his short term interests. He has absolutely no concern for the long-term well being of a company. After he gets his stock pop, he liquidates and is gone. Icahn's entire strategy operates strictly on the basis of greenmailing the leadership of a company into discharging cash into his lap. He will say anything he has to in order to generate that outcome.

</comment><comment><USER17> Andreeson's defense seems to be that Icahn has had as many conflicts of interest and selfish motives on boards as he has, if not more.

I'm not sure that's a good defense: "He's killed twice as many people as I have, and he's been at it longer, too!"

When people so alike bicker like this in movies, they're usually about a minute away from kissing.

<comment><USER18> Marc has already pointed out that he removed himself from the decision making process regarding the divestiture of Skype and fully disclosed his conflict. ebay held 30% to his 3% during all of this so Icahn's claims seem pretty baseless and should be easily confirmed or denied by another member of the ebay board with knowledge of the proceedings.

</comment></comment><comment><USER19> Can someone explain to me the significance of the animosity between Carl Icahn and pmarca? There are half a dozen posts on pmarca's blog discussing how Icahn is making claims against Andreessen. I understand these claims, but I don't understand their significance.

I deeply respect pmarca but I can imagine that he, like any high visibility person, has many detractors. What power does Carl Icahn have that warrants such a strong response?

<comment><USER20> Icahn called out his conflict of interest in Ebay:

[http://online.wsj.com/news/articles/SB1000142405270230407100...](http://online.wsj.com/news/articles/SB10001424052702304071004579409813180461206)

<comment><USER18> Andreessen responded:

[http://blog.pmarca.com/2014/03/03/my-statement-on-ebay- direc...](http://blog.pmarca.com/2014/03/03/my-statement-on-ebay-director- role-and-governance/)

</comment></comment></comment><comment><USER21> I submitted this under the permalink URL earlier in the day: [https://news.ycombinator.com/item?id=7421591](https://news.ycombinator.com/item?id=7421591)

Can any mods delete my submission and update this URL to that URL? It seems illadvised to have this item pointed at pmarca's blog homepage vs. the item we're discussing.

</comment><comment><USER22> I don't understand what eBay's problem is. I mean c'mon, Gordon Gekko was only _partially_ based on Icahn.

</comment><comment><USER23> If everyone was like Icahn, we'd already be through a few revolutions. He likes to engineer market events just ask Apple. Like this article said, he does this to the detriment of everyone around and destroys value. Marc creates value and companies and Icahn from what I have seen previous and here, likes to create money for himself out of destroying that value. When the world says don't, he says Icahn.

</comment><comment><USER24> Not sure that's the most sophisticated PR strategy. One post looks like a rebuttal, 8 look like an obsession.

<comment><USER25> He's trying to create FUD here, not look good. As the incumbent, he has the advantage; if all shareholders are paralyzed into inaction because all the major players look like assholes, he wins. He only loses if a majority of EBay shareholder votes believe that Icahn will generate shareholder value, hence he wants to make abundantly clear that Icahn destroys shareholder value to enrich himself.

</comment></comment><comment><USER26> With each volley that Icahn and Andreessen fire back and forth, I'm left more humbled by how incredibly smart these two men are. I feel like I'm watching master communicators slug it out and I'm learning an incredible amount from the action.

</comment><comment><USER27> Carl Icahn _is_ the Cryptonomicon's Dentist. A wolf that ravages, feeds and moves on.

</comment><comment><USER28> What is it with pmarca? As a subscriber of his blog, he's been lambasting Carl Icahn for awhile now. Don't get me wrong! I hate Carl Icahn, but pmarca's critique is hard to get and overobsessive.

<comment><USER16> It's because it has gotten personal between Icahn and Andreessen. Icahn has been specifically dragging Andreessen's character through the mud since it became obvious he wasn't going to get his way on eBay.

</comment></comment><comment><USER29> Marc's paying for too much attention to Icahn. He should have simply issued a short statement refuting Icahn's allegations and laying out the facts, and then ignored him, like one would a crazy homeless guy ranting on the street.

Instead, it's in danger of turning into a mud-slinging contest.

</comment><comment><USER30> Every single post in this blog seems to be about Carl Icahn.

</comment><comment><USER31> The article left me with lots ofdoubt... Take this sequence of events:

Bought 20% of company.

made it private.

Sold London route.

So, how can someone with 20% make a company private? And how can someone having his shares bought back after company went private still command it to sell anything?

Was he ceo all along?

<comment><USER32> I don't know the details but from the description he'll have done through the form of a leveraged buyout.

Icahn secures a loan from a bank (or group of banks/financiers - possibly even one of his other companies, I don't know what the law is like in this regard in America) to purchase enough shares to take the company private.

Here's the 'trick' though. That loan is not secured by Icahn, it is secured by the company he has just "bought out" \- the repayments of the loan being secured against the companies current capital assets and future profits. In effect Icahn gets the company to take out a loan which he uses to take control of the company.

Obviously there needs to be enough shareholders willing to sell for this to work but if the leveraged buyout offers a great enough premium then they'll normally find enough willing sellers.

</comment></comment><comment><USER33> The sketchiest thing about Andreeson is that he sits on the board of directors for HP... and at no point has he told investors that it's a rudderless shell of it's former self with almost no hope.

</comment><comment><USER34> andreesen and icahn deserve each other.

</comment><comment><USER35> I love Marc and understand he's upset about the accusations, but it's time to move on. Nobody who knows anything about Marc takes them seriously. I'm obviously not privy to what goes on in eBay's boardroom, but the notion of Marc being some svengali forcing them to cede him 100s of millions is blatantly ludicrous, not to mention insulting to the other board members. If I were Marc (and it's probably much easier to say this since I'm not) I'd just ignore.

</comment><comment><USER36> I kind of find fault with pmarca recusing himself from the eBay board during the skype deal in spite of his conflict of interest, as he's clearly 100x more intelligent than anyone else on the eBay board. I'd rather have a smart guy who has particular knowledge advocating for my interests, even if he has some biases which he discloses, rather than some former CEOs of eBay (not exactly winners there) or some big dumb fund people, which is what you're left with otherwise.

</comment><comment><USER37> Is there any positive perspective on this guy too? In this interview ([http://www.youtube.com/watch?v=CTIp9ebXAh0](http://www.youtube.com/watch?v=CTIp9ebXAh0)) he kind of makes sense with `restructure to concentrate on shareholder value` and `restructure for short term or sure profits` line of thinking...

</comment><comment><USER38> I'd like to see Marc be a bit more vicious about this, starting with Herbalife as the first target.

</comment><comment><USER39> Dear Marc:

Who gives a rats ass what Carl Icahn thinks? Stop paying so much damn attention to him.

You're leaving me the impression that what he is saying is actually applicable. If it is, get to the point. Otherwise, move on....this story is getting old.

</comment><comment><USER40> Permalink: [http://blog.pmarca.com/2014/03/18/when-carl-icahn-ran-a- comp...](http://blog.pmarca.com/2014/03/18/when-carl-icahn-ran-a-company-the- story-of-twa/)

</comment><comment><USER41> I like this guy's writing. The multiple ellipses every 3 sentences bothers me.

</comment><comment><USER42> I hope the folks at Apple are paying attention.

<comment><USER43> Why? I thought Icahn threw in the towel on that crusade.

</comment></comment><comment><USER44> Maybe he should buy Microsoft.

</comment><comment><USER45> If you want to see the face of capitalism, look to Carl Icahn.

<comment><USER46> That's not capitalism, that's greed. Sadly, many of the greedy are hiding behind the banner of capitalism, but don't be confused.

<comment><USER45> It's exactly capitalism. Carl Icahn, capitalist, used capital to establish control over TWA and, having done so, exercised his property rights in a way to maximize profit and return.

<comment><USER46> I don't disagree that Carl Icahn is a capitalist, so are Warren Buffett and Marc Andreesen (now).

Look at the definition of capitalism "an economic and political system in which a country's trade and industry are controlled by private owners for profit, rather than by the state."

Nowhere in the definition does it state that a capitalist must be a greedy a __hole who destroys companies and the lives of employees in order to fill his own pockets.

Sadly, we see too many examples of this, but it isn't capitalism, and we need a better label for it, or we risk throwing the baby out with the bath water.

<comment><AUTHOR> Agreed.

Capitalism gives people the ability to be driven by generally selfish factors, but there is a line between selfish motivation and greed.

Unfortunately that line is more of a moral one which can make it harder to define.</comment></comment></comment></comment></comment>


Ask HN: What is your shortlist for hot/popular/trendy Open Source Projects? - <AUTHOR> Just looking for projects - feel free to give a reason why. <comment><USER2> Hot as in cool: Etherpad. Almost one of a kind, taken over and closed down then open sourced after a large backlash. I think a good additional web concept to join wikis and forums and sidebar-chats.

Are you looking for something to use or something to contribute to or what?

If you really care about popular and trendy, get some real data e.g. from <http://sourceforge.net/softwaremap/> and be surprised that the most popular of the past week are a package of Microsoft Fonts and an ERP, Accounting and CRM app. The most popular of all time are eMule and Azaureus file sharing and Sourceforge.net itself and the Crystal Space 3D SDK.

In fact the most webby looking one in the lists seems to be PHPMyAdmin, of all things.

<comment><USER3> It's possible that all of the more trendy apps have moved to Github by now.

<comment><USER4> This page hasn't officially launched yet, but we're working on exposing trending repos: <http://github.com/explore>

edit: naturally, 5 minutes after I wrote this we decided to go live with it <http://news.ycombinator.com/edit?id=1069047>

</comment></comment></comment><comment><USER5> LÖVE (<http://love2d.org/>) -- a 2d game library for Lua. It's simple, easy to use, cross-platform, and allows for convenient distribution of finished products.

(It's not really popular or trendy, but I think it's cool and I like it a lot.)

<comment><USER6> Thanks for new shiny thing! This does look cool.. what a great excuse for learning Lua!

</comment></comment><comment><USER7> WebKit/Chrome/V8 are leading the way in web standards implementation, with Firefox/Gecko/TraceMonkey also doing lots of great stuff.

Haskell is really taking off, both in terms of compiler improvements and in the size of the community and available libraries. I'm using it for several projects now.

MagLev, LuaJIT, Unladen Swallow, and V8 (again) are all exciting because they're bringing modern dynamic language VMs closer to Java-like (and sometimes even C-like) speeds.

Android - my phone runs an open source OS, I can install software on it without an app store, and it can run SSH, Python, and Lua. Sweet!

</comment><comment><USER8> Redis - I wrote about why in October ( <http://simonwillison.net/2009/Oct/22/redis/> ) and it's gained some awesome new features since then, including ordered sets and blocking fetch against queues. It's a very different beast from the other stuff that gets branded as NoSQL.

</comment><comment><USER9> node.js (both the core and projects which build upon it)

<comment><USER10> "I'd like to see Twisted take advantage of the hype around Node.js -- They're the same! Except Twisted is mature and does more. And is Python" -<http://twitter.com/progrium/status/7900106071>

<comment><USER11> sigh.. I know python is cool and all (and I know Jeff (progrium) somewhat), but being able to do development in the front-end and backend with the same language (javascript) makes things so much easier sometimes. I am by no means a python expert (I'm still learning), but the two languages just feel different, and I really really enjoy the prototypical/functional nature of javascript. Maybe python has this as well, and I'm just missing it? Anyway, node.js deserves all the hype it is getting.

</comment></comment></comment><comment><USER12> Clojure, Redis

<comment><USER13> and you can play with both at the same time with redis-clojure: <http://github.com/ragnard/redis-clojure> that is, Clojure library for Redis.

</comment></comment><comment><USER14> MongoDB

<comment><USER15> +1 for MongoDB. I love in particular the lack of structured schema meaning you can arbitrarily modify records without migrating the DB.

Also there's a growing, awesome community.

</comment></comment><comment><USER16> Django

</comment><comment><USER17> Django & jQuery - These two tools have made web development fun for me, again.

Clojure/Lisp - I've had a Lisp like language on my languages-to-learn to-do list for long

Redis - Looks like an excellent NoSQL DB to begin learning this new concept with.

</comment><comment><USER18> Languages: Clojure, plt scheme and (I guess a little) newLISP.

"noSQL": Riak, MongoDB, Redis, (I think the "new-ness" has worn off CouchDB")

Trendy: node.js, ruby on rails, django, lift

*Really any "web framework that promises to make development easier"

</comment><comment><USER19> mongodb, mongoengine, redis, node, tornado, neo4j, django

want to play with openframeworks and cvtypes, but haven't had time

</comment><comment><USER20> Jakarta. It may not be hot and trendy, but it's certainly popular

Edit: To the persons who downvoted me. I was not being sarcastic. I use stuff from the Jakarta project on a daily basis.

<comment><USER2> I didn't downvote you for sarcasm, I had the plan to downvote everyone who posted

{project}

regardless of whether I like or dislike the project, and equally upvote everyone who posted

{project because .. reasons or thoughts or justifications or content which took some time to write ..}

But hardly anyone seems to have bothered, and I feel mean now so I've stopped. :/

</comment></comment><comment><USER21> The Linux kernel (Popular. Not hot nor trendy). Over the past 12 months, I've touched Redis, Node.js, Clojure, and a few others on this list, but nothing blows my mind more than learning a new system call or OS feature.

Learn the exact copy on write semantics of forking (What happens to file handles? Threads? How does the OS know a paged needs to be copied?), copy two file descriptors with splice, put something in shared memory, move messages over an IPC queue.

</comment><comment><USER22> If you have any interest/connection with education then <http://moodle.org>

It's used by millions of people all over the world (<http://moodle.org/stats/>) and is helping to make education more accessible.

</comment><comment><USER23> XBMC

</comment><comment><USER24> I don't know about hot and trendy, but these are a few open source projects that come to mind that make my life and work much, much easier:

      Drupal
      jQuery (included in Drupal)
      Xdebug
      EtherPad
      Adium
      Miro
      Quicksilver
      Clyppan

</comment><comment><USER25> Math.NET Numerics: <http://numerics.mathdotnet.com/>

Merging of the two largest open-source .NET math libraries...should be an excellent library when it's complete.

</comment><comment><USER26> Hadoop and subprojects, specially Pig. It may be written in the unsexiest of languages, but if you have lots of data and need flexibility to do anything you want with it, Hadoop is your best friend.

</comment><comment><USER27> jQuery

</comment><comment><USER28> Ruby on Rails, node.js, MongoDB, jQuery, Webkit, Sinatra, HAML+SASS

</comment><comment><USER27> Ruby on Rails

</comment><comment><USER29> Tornado and mongodb... primarily beause I'm using them to develop my side project. Also have interests in Cassandra and seeing what happens with it in the future.

</comment><comment><USER30> Cramp - <http://m.onkey.org/2010/1/7/introducing-cramp>

Ruby equivalent of Tornado?

</comment><comment><USER31> PHP, KohanaPHP; Python; PLT-Scheme; Erlang/OTP; PostgreSQL; Apache, Lighttpd; Emacs; Firefox.

Those are the essentials - I'm sure there is more.

</comment><comment><USER32> <http://monotone.ca> There's more to distributed VCS than Git.

</comment><comment><USER33> Dojo They have a comprehensive toolkit for building complex web-app front ends.

</comment><comment><USER34> Boxee <http://www.boxee.tv/>

</comment><comment> adam-_- Redis, node.js & sinatra

<comment> adam-_- Also I'm a fan of Catalyst but it's not necessarily hot and trendy...

</comment></comment><comment><AUTHOR> Riak

</comment><comment><USER35> Drupal, jQuery, Chrome

</comment><comment><USER36> Hadoop, Hive, Scribe

</comment><comment> b-man plt scheme

<comment><USER31> I like PLT a lot - DrScheme is a great environment; the stepper is such a crucial tool, especially since I'm still in the learning stage.

</comment></comment><comment><USER37> Mogilefs, transmission & django

</comment><comment><USER38> couchdb

</comment><comment><USER39> clojure

squeak

</comment><comment><USER14> COBOL :)

<comment><USER40> <http://www.coboloncogs.org/INDEX.HTM>

</comment></comment><comment><USER41> hobo</comment>


Caines Arcade theme song - <AUTHOR> http://cainesarcade.bandcamp.com/ <comment><AUTHOR> Pay what you want, help send Caine to college.</comment>


Debugging why ping was Broken in Docker Images - <AUTHOR> https://www.cyphar.com/blog/post/docker-broken-ping <comment><USER2> > Most people agree that the Unix privilege model is a hold-over from an older > time. Concepts like "binding to a lower port requires root" are warts of the > original design of Unix.

...no. Privileged ports are a way to prevent an unprivileged user from turning a service crash into a service _takeover_.

Windows Firewall _seems_ to _sort of_ mitigate this by only permitting a given program to communicate on a port, but -from what my testing revealed- it does _not_ prevent _other_ programs from _binding_ to that port. So, I strongly suspect that on Windows systems, an unprivileged user can turn a service crash into a service DoS by racing to bind to the service's port.

<comment><USER3> > ...no. Privileged ports are a way to prevent an unprivileged user from > turning a service crash into a service takeover.

Whilst privileged ports are indeed used for that purpose, that doesn't mean they aren't a wart.

There's no necessary technical reason why unprivileged users can't bind to port 80, except that the designers of the network API decided to equate successfully binding to a port with having permission to receive connection requests for that port.

This leads to unpleasant situations like a web server having to run as root, even if (usually) only temporarily, solely because it needs to bind port 80.

This makes less sense _especially_ with Docker, since even if a containerized web server binds to port 80, it won't receive connections from the outside world unless the container is configured to forward the "real" port 80 to it.

<comment> mh- _This leads to unpleasant situations like a web server having to run as root, even if (usually) only temporarily, solely because it needs to bind port 80._

not on modern linux. see CAP_NET_BIND_SERVICE in `man 7 capabilities`.

</comment></comment></comment><comment><USER4> I see this all the time when dist-upgrading a root-on-NFS debian machine; there's always an error message about how setcap'ing the ping binary fails and then it falls back to setting the suid bit.

</comment><comment><USER5> Oh no thats not all... Linux also has had a way to allow non root users to do ping, using `socket(PF_INET, SOCK_DGRAM, IPPROTO_ICMP)`, which would get around the whole suid/capabilities approach to ping. That was the whole reason why it was introduced, and it can just do ICMP not generic raw sockets like CAP_NET_RAW (which lets you spoof any traffic), and avoids suid root binaries. Unfortunately you have to explicitly enable it (and there was at least one security issue in that implementation too), with net.ipv4.ping_group_range (or ipv6).

<comment><USER6> I didn't know that. But I guess the reason why it's not just implemented that way by default is so it can be easily ported (even if all kernels supported it, relying on the kernel implementation of ICMP packets might cause inconsistencies you wouldn't see in raw sockets).

<comment><USER5> It is the same interface, and I believe all the implementations are compatible with it, it just filters the types of raw packets you are allowed to create.

</comment></comment></comment><comment><USER7> _> One of these historical warts is that the creation of raw sockets, which is how ping sends ICMP packets, requires root._

It's a good thing raw sockets require root. Raw sockets are incredibly powerful tools that can be used for all sorts of mischief (including source address spoofing in case of udp, so perfect for various dos attacks)

It's a feature if some clueless user that just downloaded some Trojan flash player update can't fire off a DNS reflection attack against a third party

<comment><USER8> > In May 2001, a well-known CEO of a security and consulting company, Steve > Gibson, released the Raw Socket's warning. According to his Web site, Raw > Sockets was a "seriously dumb idea...from Microsoft" that "...spells > catastrophe for the integrity of the Internet."

[http://www.informit.com/articles/article.aspx?p=27289](http://www.informit.com/articles/article.aspx?p=27289)</comment></comment>


Inorganic phosphates may be making us couch potatoes - <AUTHOR> https://www.utsouthwestern.edu/newsroom/articles/year-2019/food-additive.html <comment><USER2> Actual title: "Stuck on the couch? Good exercise habits derailed by common food additive"</comment>


Do not let your CDN betray you: use subresource integrity (2015) - <AUTHOR> https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/ <comment><USER2> "The security properties of a collision resistant hash function, ensure that a modification results in a very different hash."

I really appreciate the clarity of this post. The author is building up the groundwork without skipping steps that may be obvious to many readers. I of course knew the purpose of a hash before reading the article, but some people don't - and that sentence clearly let those users know why the hash matters without making it less readable for knowledgeable readers.

Writing clarity matters.

<comment> default-kramer Honestly, I thought this line wasn't very clear, at least if I understand it correctly. It is not important that modification produces a "very" different hash, even a minimally different hash is still different enough. What is important is that it is computationally infeasible to generate a collision. So if your evil plan is to modify someone's .js file and then play with comments/whitespace until the hashes match, you and the website will both be dead before you find the collision.

<comment><USER3> no, it be "very different" means you can't do things like generate a hash of all dictionary entries and identify when someone has a password that's only a slight change from a known dictionary entry.

It's absolutely important in the security of hashes.

<comment><USER4> It's very important in the storage of hashed passwords, but not in checking the integrity of files, which is the use case here.

</comment></comment></comment></comment><comment><USER5> If you use webpack, just drop in webpack-subresource-integrity [0] for basically "free" SRI tags on all scripts.

It's not really as useful if you are serving your static assets from the same place as the HTML (and you always use HTTPS) but if you load your js/css on another server SRI can still provide some protection.

[0] [https://github.com/waysact/webpack-subresource- integrity](https://github.com/waysact/webpack-subresource-integrity)

<comment><USER6> And IIRC, it's built-in to creat-react-app.

<comment><USER7> It used to be, briefly, unfortunately it had to be removed again because create-react-app has a zero-configuration policy and SRI can break pages served without TLS unless Cache-Control: no-transform is set on the server [1].

[1] [https://github.com/waysact/webpack-subresource- integrity#pro...](https://github.com/waysact/webpack-subresource- integrity#proxies)

</comment></comment></comment><comment><USER8> It'd be cool if the browser used this to allow cross-origin caching as well.

Say I have jQuery previously loaded a page that included jQuery from CDNJS and now I'm in China and another site tries to load jQuery from Google's CDN.

Currently that request would get blocked by the great firewall. But since the browser should know that this file matches one it has seen (and cached) before it should be able to just serve the cached file.

This could also save a network request even if I'm linking to a self-hosted file on my own servers if I include the hash.

<comment><USER9> The potential problem I see with this is that it could be abused for a "have you loaded this resource" privacy leak. Simply pick a unique script on a website, if my server doesn't get a hit then I know you went there before.

<comment><USER10> Possible solution is to have a content hash proxy trusted by the user but shared between multiple users. Then the site can only get the data at the proxy-level rather than the user-level, and not even that if the proxy is large enough to justify crawling the web to pre-cache everything, or is behind a larger cache that does.

<comment><USER11> That's not a solution but a work-around. The original privacy issue stands. browsers can't cache hashed content by default. :/

<comment><USER10> The browser would know if it had a content hash proxy configured and then could use it for all content hashed data. The issue becomes getting people to use one, but partial uptake is better than nothing. You could at least get most corporate and education environments with some equivalent to WPAD[1], and maybe even some consumer-level ISPs the same way if they want to reduce the traffic over their network.

[1] [https://en.wikipedia.org/wiki/Web_Proxy_Auto- Discovery_Proto...](https://en.wikipedia.org/wiki/Web_Proxy_Auto- Discovery_Protocol)

</comment></comment></comment></comment></comment><comment><USER12> Not just CDN, there's benefits to rolling out SRI for lots of your third parties.

Your stripe js, scary ad networks js, front-end analytics companies. SRI is really neat and helps protect yourself from these many 3rd parties being pwned.

<comment><USER13> SRI may be a double edged sword. What if stripe fixes a bug and rolls a new version of their JS? Your page stops accepting payments. That's bad.

If jQuery is compromised you'll detect it and download from different location but for stripe there is no fallback.

<comment><USER14> Well, if Stripe wants you to stop accepting payments, you will. They already can take the resource offline, I don't see how this is a new/additional problem.

If they want you to stay up-to-date, they'll provide a piece of PHP/Node that emits the latest URL/SRI tag.

<comment><USER15> You, as the web developer, want to start using subresource-integrity. Stripe, as a depended-upon 3rd party, has not yet bought in to subresource-integrity hype-train.

Stripe rolls out a fix for a security issue or other bug in their JS. This breaks your subresource-integrity check. The didn't want you to stop accepting payments, they wanted to fix a vuln.

That hampers the usefulness of using subresource-integrity on 3rd-party resources _today_ (which is what yeldarb suggested). Perhaps in the future the 3rd party would provide a script that emits the URL/SRI, but that isn't today.

<comment><USER16>
      the 3rd party would provide a script that emits the URL/SRI

And we're back to square one - we can't trust _that_ script to not get pwned

<comment><USER14> Not really, isn't packaging and securely distributing PHP/Node.js libraries a solved problem?

<comment><USER17> If you're not updating the PHP/Node.js library, and you're not updating any data you give it, where does it get the information it needs to update the URL/SRI tag?

And if you are doing any of those things when Stripe pushes an update, how is it any different that having to update the URL/SRI tag?

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> See also Content-Security-Policy require-sri-for

[https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Co...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Content-Security-Policy/require-sri-for)

<comment> dane-pgp By combining this with an extended form of SRI that supports hashes signed by a private key, it would be possible to bring the security model of web apps almost up to the level of desktop apps. You might still have to Trust On First Use whatever key/identity was signing a given version of a web app (at least the client-side component of it) but a browser could ask you "Do you want to update to version X.Y of this web app?" before running any JavaScript that you might want to check the release notes or reviews for first.

Ideally this would be combined with something like Binary Transparency, where the new version has to have appeared in a public log for some time, and with no trusted third parties publishing a "Do not trust version X.Y" warning in another public log, acting as a sort of distributed immune system for the web.

</comment></comment><comment><USER19> "An important side note is that for Subresource Integrity to work, the CDN must support Cross-Origin Resource Sharing (CORS)."

This doesn't make sense to me. Why shouldn't I be able to perform integrity checking on resources from non-CORS domains?

<comment><USER20> Attackers could otherwise verify that resources on private networks or retrievable only with the victim's cookies have certain content.

See, e.g., <[https://github.com/w3c/webappsec/issues/418>](https://github.com/w3c/webappsec/issues/418>) for some broader discussion.

<comment><USER21> Thanks for the link, but the closing '>' should not be part of it.

<comment><USER22> That's a bug in ycombinator's linkification code. A quite frustrating one, since <> is _the_ standard way to delimit URLs in plaintext (going back to earlier than section 2.2 of RFC 1738, back in 1994!), so having linkifiers that still fail to respect it is really unfortunate.

<comment><USER23> Is there a reason to delimit a URL in plaintext? I can't recall ever seeing this syntax before and I don't really see a need for it.

<comment><USER22> Yes, there is. Consider a URL followed by punctuation. How do you tell whether that comma, period, question mark, etc should be included in the URL or not? Had I put in a link to [https://www.ietf.org/rfc/rfc1738.txt](https://www.ietf.org/rfc/rfc1738.txt) in my original comment instead of "RFC 1738", there would have been a comma right after the URL, for example.

The possible solutions to this punctuation-following-URL problem are that you delimit the URL, contort your sentence so the URL is followed by a space and some other words instead of punctuation, start adding random whitespace after the URL but before the punctuation to avoid the linkifier eating the punctuation, or stop putting URLs in plaintext. I've seen all of these used; the first solution is by far the best.

Oh, and that's all from a Western perspective. If, on the other hand, you're using a language that does not use space-separated words (e.g. a number of East Asian languages), then delimiting becomes even more important, because you can't just guess that the URL ends at the space character; there are no space characters around.

I can't speak to your experience seeing or not seeing this syntax, but as I said it's been part of the URL RFCs for over two decades, is used in other RFCs where URLs can appear (e.g. the Link header syntax), and is reasonably commonly used by people who both put URLs in their email and want to punctuate it properly. I will grant that proper punctuation is out of fashion in certain demographic groups. As is writing plaintext, I guess.

</comment></comment></comment></comment></comment></comment><comment><USER24> This might have been mentioned somewhere else but - will browsers remove or make an exception instead of blocking mixed-content[0] when a sub-resource integrity check is present? I mean there really is no reason to be paying the TLS over-head for commonly used libraries.

[0] [https://developer.mozilla.org/en- US/docs/Web/Security/Mixed_...](https://developer.mozilla.org/en- US/docs/Web/Security/Mixed_content)

<comment><USER5> Integrity is only 1/3 of the major benefits of TLS.

The other 2 (privacy and authentication) are very important as well and for many are the main reason TLS is wanted.

<comment><USER24> Do you care about privacy and authentication when downloading react.js from a CDN?

<comment><USER5> You might not, but some may. Others still may care about keeping their ISP or the public WiFi they are on from seeing they are downloading some scripts from CDNs. Things like that are great for fingerprinting (only 2 sites happen to use these 6 scripts with these specific versions, so if someone downloads those they are on one of those sites).

Plus it still leaks tons of data in the headers. Request time, cache length, useragent, cookies (maybe, hopefully not), accept-* headers, if modified since leaking the last download time, and possibly a lot more.

</comment></comment></comment></comment><comment><USER25> And get all your resources requested twice on Chrome: [https://bugs.chromium.org/p/chromium/issues/detail?id=677022](https://bugs.chromium.org/p/chromium/issues/detail?id=677022)

<comment><USER26> Well, that sounds twice as secure!

</comment></comment><comment><USER27> This only helps for JavaScript (and soon CSS) resources.

If your HTML goes through a CDN (say, you use the full Cloudflare package), the CDN can of course just remove or modify these integrity attributes, or add new scripts altogether.

</comment><comment><USER28> Looks like it has good support in Firefox and Chrome, but none in IE/Safari.

[http://caniuse.com/#feat=subresource- integrity](http://caniuse.com/#feat=subresource-integrity)

</comment><comment><USER29> The title should have a "(2015)" suffix.

<comment><USER30> Date tags are only relevant when the information they contain is of a time sensitive nature. This article would say exactly the same thing if it was written today.

<comment><USER31> Someone who reads the title and thinks "Hmm, this new article sounds like that Mozilla security engineer's article from a few years ago" would still appreciate the date tag.

</comment></comment></comment><comment><USER32> This tool lets you quickly assess whether third-party assets are protected by SRI: [https://sritest.io/](https://sritest.io/)

Disclaimer: I am the developer of sritest

</comment><comment><USER33> or even better, avoid CDNs? it might even be cheaper when you account for the extra work... and faster when you don't have to load data from 10 servers to load just 1 web page

</comment><comment><USER34> Previous discussion: [https://news.ycombinator.com/item?id=10310594](https://news.ycombinator.com/item?id=10310594)

</comment><comment><USER35> I wonder if it would be a good idea that if the SRI detected a modified javascript file that a warning should be presented to a web user when this occurs?

<comment><USER36> What would the user do with that information?

</comment></comment><comment><USER37> It would be infinitely better if I could use a small hash instead of the giant sha variants, imagine 40 or so resources x sha-x length.

<comment><USER38> There's no point in using a hashing algorithm that can be maliciously collided.

</comment></comment><comment><USER39> SRI shouldn't use static hashes, it should set pub keys of different people and the response must have N/M signatures. This way updates are possible and you know N people confirmed the source as safe.

</comment><comment><USER40> fyi, Edge and Safari has yet to support this feature.</comment>


Xapiand: A fast, simple, modern search and storage engine - <AUTHOR> https://kronuz.io/Xapiand/ <comment><USER2> Xapian has a long history starting in the early 80s:

[https://xapian.org/history](https://xapian.org/history)

I've used Xapian extensively, but not this new Xapiand tool, so I can only speak to the actual library. Xapian is a C++ library that accesses index data files directly on disk. There are bindings for various languages, say Python, let's you do 'import xapian' and get FFI bindings to the library, then you basically open your on disk index files and issue queries.

Xapian supports many concurrent readers, but only one writer. It's not a server, there are no protocols. Maybe that's what this Xapiand tool adds. In general the overhead is very, very light, just enough ram to hold the library code, the OS takes care of all the filesystem level caching.

Many of the very same concepts that are in Lucene, Documents, Terms, weights, flavors of BM25 relevance ranking, query parsing trees, relevancy operators, etc, all apply to Xapian as well.

<comment><USER3> I love Xapian, the quality of its recall is excellent and indexing performance very hard to find fault with. There's just a tiny problem - it's stuck with the GPL, despite a long effort to relicence the code going back years.

<comment><USER4> Remind me what's wrong with GPL, here? You can't repackage and resell it?

<comment><USER5> You can't include it in your code and sell your software without distributing the source.

<comment><USER6> Is there actually precedent for a GPL library, clearly setup to be consumed with an API, to require GPL of the whole binary? On the one hand that's clearly not the case in the Linux API, on the other hand the LGPL exists. But was curious if this is actually settled or just too murky to live with.

<comment><USER7> The Linux kernel has explicit rules for the cases where it allows it:

An explicit license exception for the syscall interface, stating that calling it from userspace is freely allowed: [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/LICENSES/exceptions/Linux- syscall-note?h=v5.0-rc2)

And modules, e.g. drivers, have various statements from Linus on how they're not necessarily considered derived works of the kernel/linked to the kernel, e.g. [http://linuxmafia.com/faq/Kernel/proprietary-kernel- modules....](http://linuxmafia.com/faq/Kernel/proprietary-kernel-modules.html) or [http://lkml.iu.edu/hypermail/linux/kernel/0312.0/0670.html](http://lkml.iu.edu/hypermail/linux/kernel/0312.0/0670.html)

<comment><USER6> I know the situation of the Linux kernel. The discussion hinges on what is a "derived work". Kernel modules are very interlinked with the kernel, particularly since there are no stable APIs inside the kernel. It seems strange that just linking to a GPL library that defined an API makes you a derived work. But that is the FSF position:

[https://en.wikipedia.org/wiki/GNU_Readline#Choice_of_the_GPL...](https://en.wikipedia.org/wiki/GNU_Readline#Choice_of_the_GPL_as_GNU_Readline's_license)

This is why I always do libs as LGPL but it seems strange to me that it's even needed. If I've defined a proper opaque API, to be consumed by external code I know nothing about, it's strange to then argue that library callers are derived works and LGPL is explicitly needed.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I am always surprised when I find out that developers with bold claims to fame have not heard of Sphinx [0] and of Xapian [1]!

[0]: [http://sphinxsearch.com/](http://sphinxsearch.com/)

[1]: [https://xapian.org/](https://xapian.org/)

<comment><USER9> Sphinx is a workhorse. Very light memory and CPU usage compared to the popular Elasticsearch.

</comment></comment><comment><USER10> I checked out Xapiand several months ago after I stumbled across it during a fit of Github browsing. It certainly seems fast and very easy to add documents but there is so little documentation that I was unable to test it out in any significant way. I'm very interested to see where the project goes, especially if Xapian itself switches away from the GPL.

</comment><comment><USER11> Somewhat unrelated but I've written a restful search server that's powered by Sqlite's full-text search. Extremely lightweight python (flask) app. Nice for blogs or small projects, if I say so myself!

[https://github.com/coleifer/scout](https://github.com/coleifer/scout)

</comment><comment><USER12> Still beta, last release[0] was 0.8 on 2018 November 18.

It is also not clear to me what, if anything, already integrates with this, and therefore how much code I need to write to try it out and compare against ElasticSearch.

[0] [https://kronuz.io/Xapiand/news/](https://kronuz.io/Xapiand/news/)

<comment><USER13> fwiw also 11 patch releases (meaning 0.8.z) since then [https://github.com/Kronuz/Xapiand/releases](https://github.com/Kronuz/Xapiand/releases)

</comment></comment><comment><USER14> I'm interested, can anyone give a quick overview of why you'd use this over Elasticsearch?

<comment><USER15> Well for one, Java is ridiculously memory hungry. The resource costs of Elasticsearch is the #1 reason I'm not using it. I've seen a few projects which had the aim of reimplementing the Elasticsearch backend in Rust, but were incomplete. That would be my ideal solution, personally.

<comment><USER16> I don't know how true that is anymore, that "Java is ridiculously memory hungry".

It does power billions of devices, after all. :-P

<comment><USER17> So does the diesel engine, but's not eco friendly.

<comment><USER18> Compared to?

<comment><USER17> Electrical Engines ? I am giving a contrasting analogy to the previous statement that the fact is it widely used does not make it necessarily good

</comment></comment></comment></comment></comment></comment><comment><USER19> Xapiand depends on xapian-core which is licensed under GPL (not LGPL). Makes me think that Xapiand should be licensed under GPL, instead of MIT?

<comment><USER20> the author can license his own source code however he likes. only, when distributing the compiled binaries, you're required to provide the whole sources under libre (gpl compatible) terms.

</comment></comment><comment><USER21> It's nice to see new search servers, especially low level ones. I'm going to give this a few tests.

<comment><USER22> Not sure if you know about tantivy but it's cool too: [https://github.com/tantivy-search/tantivy](https://github.com/tantivy- search/tantivy)

<comment><USER23> Also worth mentioning is Toshi: [https://github.com/toshi- search/Toshi](https://github.com/toshi-search/Toshi)

Toshi is to ElasticSearch as Tantivy is to Lucene if that makes sense.

Obviously as they are new they are not at feature parity, but Tantivy does win at some benchmarks: [https://tantivy-search.github.io/bench/](https://tantivy- search.github.io/bench/)

<comment><USER24> There is also Blast (golang), built on top of Bleve.

\- [https://github.com/mosuka/blast](https://github.com/mosuka/blast) \- [http://blevesearch.com/](http://blevesearch.com/)

<comment><USER5> Yeah but it's golang, so it's kinda like java, so I see no pros in it TBH.

<comment><USER22> There are a lot of differences between Golang and Java. As much as I dislike writing Java when I have a choice, the JVM (with Java or whatever else on top) is a very capble tool... Could you explain what you mean by there being "no pros"?

Are you maybe trying to get at the difficulty of tuning the JVM?

<comment><USER5> rust/c++/c has no gc and better performance/efficiency compared to java/golang. so you get excited for a library/db in those languages

golang is kinda a java alternative. a db/search-engine in java/golang kinda sucks (it will under pressure)

<comment><USER22> While I definitely agree with you on the broad strokes of the differences between rust/c++/c and java/golang (representing languages without runtimes and those with them respectively), I'd say that golang is a bit more than a java alternative if we consider more than whether a runtime is included or not.

Of course, if the only consideration is whether a runtime is there or not, golang is identical to java but also identical to common lisp or maybe even interpreted languages like python.

I do want to point out that it's possible to write horribly buggy code in c++/c (less so in rust :), which can tank performance/efficiency when compared to a java/golang program. All things considered though, the ceiling on performance and efficiency is of course higher in manual memory management land.

Thanks for clarifying what you meant!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> From the features list:

> Ranked search (so the most relevant documents are more likely to come near > the top of the results list) with built-in support for multiple models from > the Probabilistic, Divergence from Randomness, and Language Modelling > families of weighting models. Custom user-supplied weighting models are also > supported.

Could someone explain in a little more detail what these terms mean?

<comment><USER26> tl;dr is that those are different approaches to weighting documents in order to return the most relevant ones for a query.

For an intro to the problem space, see [https://opensourceconnections.com/blog/2014/06/10/what-is- se...](https://opensourceconnections.com/blog/2014/06/10/what-is-search- relevancy/)

If you want a lot more detail, check out the book Relevant Search.

[https://www.manning.com/books/relevant- search](https://www.manning.com/books/relevant-search)

</comment></comment><comment><USER27> Haven't heard of Vespa? [https://vespa.ai](https://vespa.ai)

<comment><USER28> Can you tell us why you like it?

<comment><USER27> Has been in production far longer than any other open source solution. Runs at scale across Yahoo, powering even Ad systems, with live configurations pushes. Everything you need for highly available product. It also has capabilities to be used for more complex uses cases around AI.

</comment></comment></comment><comment><USER29> If you are looking for an easy to run/manage, typo tolerant search engine, I've been working on this: [https://github.com/typesense/typesense](https://github.com/typesense/typesense)

</comment><comment><USER30> apt-get install recoll

Consider your problems solved...

</comment><comment><USER31> I really hope this is the long awaited thing. From the number of commits, this project looks huge, Elasticsearch is really a big liability for resource limited deployments, I have seen some smaller projects made in Rust and Go but can't compete with Elasticseatch at any level, but this looks different and I hope it does.

</comment><comment><USER32> I was genuinely wondering recently why the Hackernews site search tool didn't show a very recent article with very obvious keywords, that google, for example, had in the first place in the results, when adding "Hn" to those 2 keywords in the search field. Is it a matter of the indexing, it means the article was too recent and it wasn't yet in the Algolia's(I believe) based HN's search tool memory; and in this case google copied it to memory faster; Or is this purely a matter of the Algorithms themselves? The algorithms for sure sound to be the matter, when the case is that of a search for an old article, that should be in memory already. It seems unnatural. Algolia has a free tier for open-source projects, what is very nice of them and thanks. I genuinely wonder if those algorithms are indeed so complex to justify those comparatively weaker behaviors seen at HN's internal search.

<comment><USER33> [https://hn.algolia.com/](https://hn.algolia.com/) only searches the text content of the submitted stories (as in the title and url) and the comments.

It doesn't index the actual article content nor take into account links across sites and content like Google does. Algolia (as self-described) is designed to search for things (like products in a ecommerce store) rather than text with concepts, relations, and entities in a knowledge graph like Google.

<comment><USER32> Maybe too late now, but i would like to point that I went to read Elasticsearch, Algolia, and Xapialand product descriptions before I made my comment, so I know well what Algolia is for, and in the example I gave, I was searching for a Headline, not for internal content inside the comments, and It was a headline that was in the first page of results at HN on that moment, so, I think I have phrased my comment in a polite way towards Algolia, understanding that search has more moving parts then the pattern matching algorithms of the logical core. :ps I am sincerely grateful for the information you gave in your comment, about Entities, Concepts and Relations on a Knowledge graph. This is exactly the kind of info I was looking for when I made the comment, so It was enlighting to know that, and thank you again.</comment></comment></comment>


Ask HN: How tf do I find the right team? - <AUTHOR> I'm non tech and know the general description but literally no idea about where to start finding these people <comment><USER2> Well, we will all just sit here and read your mind about what your looking for so we can help you.

NOT.

Using your words might a good way to start.</comment>


Desks Near Me - find great coworking places to work at - <AUTHOR> http://desksnear.me/

<comment><USER2> Price would be useful to have. It looks like the front page asks non-free spaces to mention that clearly in the description, but browsing through, the descriptions are pretty vague on that. Clicking through to the sites, it looks like they range from a person or small company with some spare desks they're willing to let you use free, to dedicated commercial spaces charging $20-30/day to rent. Those are pretty different categories, and I doubt I'd normally be looking for both simultaneously.

<comment><USER3> We completely agree. We are currently discussing the best way to do this

<comment><USER4> Also, please show number of desks available at the "at a glance" page. <http://desksnear.me/workplaces>

Right side can be reformatted to present more information.

So something like "20 @ $30" would be useful.

<comment><USER5> Its on the list of things to do in our next release. We cant push any new features up for 5 days because of the competition were in.

</comment></comment></comment></comment><comment><USER6> Just a note to anyone visiting the site. We are currently having issues with the mass demand of visits and going over our Google API request limit.

Currently in a team Skype call trying to resolve the issue. You can still see all the workplaces available via the "Workplaces" link. Search and creating workplaces are the pages that are affected.

Thanks to everyone for checking us out. We will keep @desksnearme updated with the progress.

Cheers.

<comment><USER6> We are back online and ready to take your search queries. But dont all geocode at once ;)

</comment></comment><comment><USER7> I like it. Actually, I'm looking for a desk to work at in Buenos Aires for the next 3 weeks. The cafes here are very busy and noisy.

I wonder if AirBnB will enter this category since they are a "marketplace for space".

<comment><USER8> You beat me to it! I was just going to comment that this was the office version of AirBnB! Hopefully there will be some Toronto additions.

<comment><USER9> A few weeks ago I was wondering about AirBnB for offices. Wasn't sure if it would be massively successful, but thought it might make a quality side project. Good to see someone's built it and their execution is decent.

</comment></comment></comment><comment><USER10> There's one location listed in Hollywood, CA, with an address listing of 'hollywood': <http://desksnear.me/workplaces/7-fortress-of-solitude>

The idea is cute, but I assume there's some kind of QC available for verifying links? Otherwise you're literally begging to be overwhelmed by griefers at this stage.

<comment><USER6> Yup, Keith created that. Its a test record. Because we created this for a coding competition we need people to be able to judge the site and make bookings without actually making a real life booking.

<comment><USER10> Oops, I probably could have guessed that from reading your footer :]

Makes sense if it's a submission like that. I really like the idea and would 100% use a service like this were it populated well. Best of luck!

</comment></comment></comment><comment><USER11> The search function does not work for me. I typed in 'Baltimore' and received zero results. But when I browsed the listings I came upon Beehive Baltimore ( <http://desksnear.me/workplaces/32-beehive-baltimore>).

<comment><USER6> Hey. We are onto this right now. Just having some issues with using a Google API service and request limits. Team Skype call is underway :)

<comment><USER12> Is it an issue with the geocoding limit ? if so why don't you geocode client- side ?

<comment><USER5> We have a fix in the pipeline that does :D But we can't push it up just yet...

<comment><USER12> Yeah I imagine it's not that easy to change the flow :)

</comment></comment></comment></comment></comment><comment><USER13> Little known secret: libraries and hotel lobbies are great coworking locations for little to no cost.

<comment><USER3> that's true but a lot of the time you don't care about the location as much as about being around other people.

<comment><USER13> and sometimes you just want peace and quiet to get work done. it's all about appropriate context really.

</comment></comment></comment><comment><USER14> Great! As someone who floats from cafe to bedroom to cafe throughout the week, this is a service i have been looking for. Impressed that you already have a location in Melbourne, Australia in your database, i'll probably go check them out.

<comment><USER15> It's because we're from Australia :)

</comment></comment><comment><USER3> We've been getting a lot of really great feedback from this site and twitter and we've been taking it all under consideration. Feel free to check out <http://blog.desksnear.me> for some updates.

And guys, if you love the idea and want to see the site around, please vote for us at <http://railsrumble.com/teams/the-rad-warlike-annex> when public voting opens on Oct 21! The prizes will keep us alive for a long type!

</comment><comment><USER16> Would it be beyond the scope of this to list temporary coworking spaces? For example there's a couple of places in my area that run an open office either weekly or monthly and it might be good to have a listing of those sorts of spaces.

It'd also be good to link in with the coworking visa that a number of coworking spaces are members of. And in fact it'd be good to work more closely with coworking spaces in general via the coworking wiki.

</comment><comment><USER17> Great initiative! AirBnB for desks is really needed. Would be great to choose one day where I'd like to work :)

I think a lot of works needs to be done on UI. You don't need location from browser, you can just show desks within my city (get that from ip). And no facebook connect?

Watch how AirBnB did it. Start slow and from few cities then generalize it to other.

Good Luck!

</comment><comment><USER18> Please please please, let me create an account without having to jump through silly hoops like OpenID or Twitter. Your little website just isn't compelling enough for me to do that.

I want to try it though, just to give you some feedback. Please let me create a simple login so that I can do so.

<comment><USER19> OpenID is easier than having to register for each site.

And you have Gmail right? Then you have an openid account.

<comment><USER18> In what respect? Because you have to type your password twice the first time you use a particular site with your standard throwaway user/pass combo?

In exchange for that single extra input box, OpenID forces a longer login process every time you use a site. The breakeven point where user/pass starts beating OpenID in terms of convenience happens at visit number two.

<comment><USER20> I type "stackoverflow.com", and click "login" then "Google", done. This is the same number of clicks as having my browser save my username and password.

What am I missing?

</comment></comment></comment></comment><comment><USER21> OK, this web site has a terrible terrible interface. It uses these nonstandard recessed ovaloids and SOME of them are text fields and others are buttons that take you to other pages. It also tries to establish a HTML5 database without letting me know why.

<comment><USER3> what buttons/links are you talking about exactly?

Nothing sets up an HTML5 database, but it does ask use geolocation if your browser supports it

<comment><USER21> "The website "<http://desksnear.me"> is requesting 1 MB of disk space to store "html5 test db" as a database on your disk."

WORKPLACES, SIGN IN and Search By city or address all use novel UI elements of thinly recessed semi-transparent ovaloids, or let's call them extreme rounded rectangles. One is a text field and others are buttons.

<comment><USER3> Interesting. I wonder if that is Modernizer.js doing that without us realising it. What browser/OS are you using? I'll see if I can replicate it. On Chrome/OS X I never get asked.

<comment><USER21> Safari/OS X. You have to set "None allowed before asking" in Security if you want to be informed before a db is established. The issue is not that there is a message, it's that it's alarming to have a db set up without an obvious reason for it.

I guess I don't really care though. I am right about the user interface problems, but since your folks are slamming the downvote button as fast as they can in response to useful feedback when you've obviously not done user testing, I don't really care any more about giving good usability feedback. "Someone says our interface has problems! Punish him! He must die!" That's a stupid attitude and your company will fail if it retains it.

<comment><USER3> We didn't down vote you. I've only had an account for a day and don't even have the ability to down vote. There are only 4 of us so the down votes are coming from OTHER people.

I don't appreciate your attitude and assumptions about how we are responding to your criticism. I'm legitimately trying to understand why the HTML5 database is being created (it is the Modernizer.js script) and I'll be trying to stop it from doing so.

As to the interface issues, I didn't respond to that because I didn't understand your criticism. The other replies to your message have explained it better and I agree, that's a bit confusing. We WILL be looking into that so back off.

</comment></comment></comment></comment></comment></comment><comment><USER22> It's almost unusable on my G1, I think because of this:

        <meta name="viewport"
           content="width=device-width;
           initial-scale=1.0; maximum-scale=1.0;">

I can't zoom out to properly see the page.

<comment><USER6> Dude Im sorry about that, my bad. Used the HTML5 Boilerplate and didn't remove it before going live. I feel your pain. Iw anted to do a full mobile skin but time ran out.

<comment><USER22> NP. It seems something like this would be especially handy on phone if you're out and about and looking for a place to work.

Now I just need coworking places in north Scottsdale :).

</comment></comment></comment><comment><USER23> There's already a pretty good directory here: <http://wiki.coworking.info/Directory>

It has none of the comfort features that desknear.me is attempting, though.

</comment><comment><USER24> Free Co Working Space for Bangalore Hackers

[http://www.getr.co/free-co-working-space-for-bangalore- hacke...](http://www.getr.co/free-co-working-space-for-bangalore-hackers)

</comment><comment><USER25> Nice work guys - this is excellent. Site feels awesome, and I will definitely be using it rather than having to put a shoutout on Twitter to find coworking spaces.

Great idea. Excellent execution.

</comment><comment><USER26> I've added Gridspy (be fun to have a companion) <http://desksnear.me/workplaces/87-gridspy-office>

</comment><comment><USER5> Like the application? Head on over to <http://railsrumble.com/entries> and vote for us!

</comment><comment><USER27> Nice site, and I'd like to add the coworking space I work at, but...I don't own it. It looks like adding it presupposes ownership of the space.

<comment><USER15> Currently, it does, but we are discussing/planning the ability to add locations you don't own in a later release.

</comment></comment><comment><USER28> I was confused by the button "workplaces". Maybe something more explicit like "completely workplace listing" or "all workplaces"?

<comment><USER3> good idea. I've added it to the list

</comment></comment><comment><USER29> I don't think the Rails Rumble is actually in Earth, Texas (as the map shows) ;-)

<comment><USER15> I blame Google!

<comment><USER6> I blame it on the boogie.

</comment></comment></comment><comment><USER30> Great idea and nice execution! I can't wait til there is some desks in my area.

</comment><comment><USER31> one thing, it did take me a second to figure out where i could upload a picture.

i kept naturally thinking it would be someone in the workplace edit page. Maybe a link from that page would be nice.

<comment><USER5> Good idea! It's on the list.

</comment></comment><comment><USER32> Also see loosecubes.com.

<comment><USER25> Looks good too, but I think the guys have captured some of the social elements better with @desksnearme - additionally the availability rollover in desks is awesome.

</comment></comment><comment><USER31> great idea for a site. good luck in the rumble!</comment>


The Unofficial Guide to Rich Hickey's Brain - <AUTHOR> http://www.flyingmachinestudios.com/programming/the-unofficial-guide-to-rich-hickeys-brain/

<comment><USER2> In philosophy, "identity and individuation" is an interesting topic. Saul Kripke, a logician, wrote a book titled that. Philosphy of logic has solved some puzzles there.

Identity: what makes us humans? Individuation: What makes human X different from human Y

We can further go down the abstraction: Identity: what makes me 'me'? Individuation: what makes me at X (time, space) different from me at Y (another time, another space).

Whenever we speak of spatio temporal career of an object (object in general, not from programming), there we see the issue of identity.</comment>


Acoustic Denial of Service Attacks on HDDs - <AUTHOR> https://arxiv.org/abs/1712.07816 <comment><USER2> The paper links to this entertaining YouTube video from 2009, in which someone demonstrates the effect by literally shouting at a rack of servers: [https://www.youtube.com/watch?v=tDacjrSCeq4](https://www.youtube.com/watch?v=tDacjrSCeq4)

(EDIT: replaced the link I found via YouTube's search with the original, thanks robotmlg!)

<comment><USER3> That's a reposted video, the original is from Bryan Cantrill (formerly of Sun, now CTO of Joyent): [https://www.youtube.com/watch?v=tDacjrSCeq4](https://www.youtube.com/watch?v=tDacjrSCeq4)

<comment><USER4> Wow.. so, how much interference is caused by the ambient noise of the server room itself? Is there some "critical threshold" for noise beyond which you'd have to install sound dampeners or smth?

<comment><USER5> I've had a case that caused disk performance to drop because the memory correctable errors rose above a server BMC threshold.

Turned out that the BMC beeped the internal speaker which vibrated the chassis at the right harmonic frequency that matches the HDD sensitivity spot and reduced performance. After that we disconnected the speaker on all servers.

The overall nose may impact the HDD performance but mostly if the vibration is at the right frequencies. Some are a lot more important than others.

</comment></comment></comment></comment><comment><USER6> The dimensions involved in modern hard drives are staggeringly small; the bit cells have dimensions in the tens of nanometers -- about as big as couple- year-old semiconductor feature sizes.

It's not shocking that strong external vibration that induces resonances in the mechanical components causes dysfunction: the miracle is that hard drives function _at all_ , even in the face of mild mechanical maltreatment.

</comment><comment><USER7> That's pretty incredible how something seemingly innocuous can have tremendous power if wielded properly. Some of the Side-channel attacks that people come up with are really outside the box and clever.

</comment><comment><USER8> Also see:

[https://github.com/ortegaalfredo/kscope](https://github.com/ortegaalfredo/kscope)

They present 'Resonance attack against HDD':

[https://www.youtube.com/watch?v=8DdqTz3CW5Y](https://www.youtube.com/watch?v=8DdqTz3CW5Y)

They include code etc.

</comment><comment><USER9> This also somewhat implicitly confirms one thing I've noticed over many years of servicing PCs, mostly for others --- HDDs mounted in cheap flimsy cases seem to have shorter lives than those in cases made of heavier material.

Too bad they only tested 4 WD Blue (consumer/desktop) drives; I would've liked to see other models, particularly WD Black (high end workstations), Gold (datacenter), and Purple (DVR applications). The WD Blacks I use are noticeably heavier, and they do advertise them as having more vibration dampening.

<comment><USER10> I have several greens fail SMART well before their time, not crash, only later came to the understanding in every case it was when I played loud music. My nearby small 4" subwoofer was causing it even though isolated from floor, apparently acoustic coupling. I understand this is/may be from lower flying height (from lower speed, but aren't they tail-draggers?).

</comment></comment><comment><USER11> With all due respect for the research or the researchers, and if I read the paper correctly, they _discovered_ that inducing vibrations to something sensible to vibrations (at a given "right" frequency of course) causes malfunctioning of the something.

And, though technically it _can_ be said (as stated in the conclusions) that the technnique may represent a "non-contact DoS attack", the experiments with speakers placed at 15 and 25 cm from the device cases don't really qualify for "feasability of real-world attack".

I mean if you can get access to be able to place a speaker within 15, 25 (or even 500 cm for that matters) from a device, there are much easier ways to attack it.

If you could somehow transmit the sound waves/vibrations with enough intensity to be able to affect a hard disk from another room or from the outside of a building, then that would be a feasible realworld atttack.

</comment><comment><USER12> resonance is a hellofa thing

Can carry information, cf. Huygens synchronization, oscillators sync up through resonance... [https://www.youtube.com/watch?v=Aaxw4zbULMs](https://www.youtube.com/watch?v=Aaxw4zbULMs)

<comment><USER13> I've seen resonance snap a 1" grade #9 bolt. Vibration and resonant vibration are real killers when it comes to mechanics and construction.

</comment></comment><comment><USER14> I wonder if you could change what a HDD writes or reads with a specific pattern of vibrations, making it "fail" selectively.

</comment><comment><USER15> Related - Using HDD errors to detect movement and sound - [https://www.youtube.com/watch?v=ntw32kYDryM](https://www.youtube.com/watch?v=ntw32kYDryM)

</comment><comment><USER16> Is it really _denial_ of service, or just deterioration of service?

<comment><USER2> The paper has the full details; they were able to halt all disk access for minutes at a time, resulting in operating system crashes.

</comment></comment><comment><USER17> I run an 8 disk hardware RAID6 at home for entertainment. It's not far from some fairly serious home theater equipment. Right now I'm thinking back on the timing of various faults and I'm pretty sure I've DOSed myself, lol.</comment>


Vit-D and COVID19 update: big review (Benskin) peer reviewed; tide turning? - <AUTHOR> For months I updated my review of evidence that low D worsens C19. Is the tide starting to turn? (As it did for masks.) Hopeful signs lately. And time to go back to other things. So here's a sign-off update:
Benskin's great review: www.researchgate.net/publication/342976453_A_Basic_Review_of_the_Preliminary_Evidence_that_Covid-19_Risk_and_Severity_is_Increased_in_Vitamin_D_Deficiency is I'm told peer reviewed & accepted. Been in review a while so some stuff out-of-date: Shouldn't include withdrawn Indonesian study & Jun-16 cut-off misses important Israel study & others, but author gets criticism of bad studies right, notes the mistake in setting RDA & has great comprehensive review of early mechanism papers & group-level association studies.
There's been suspicion the D+C19 relationship is explicitly suppressed by various forces. I'm not going to dig into that. I hope someone does someday. Will those on the correct side be rewarded & naysayers/suppressors judged by history?
Despite antipathy, recent weeks have seen many more mechanism papers & other reviews  plus a change in media tone. Eg "There has been a clear shift in recent weeks towards putting a greater emphasis on the role of vitamin D in public health messaging." www.chroniclelive.co.uk/news/north-east-news/vitamin-d-keep-you-safe-18690173
Vit D now the top trending clinical topic on Medscape: reference.medscape.com/viewarticle/933781
I've been updating my review & 1pager as studies come out but will now stop paying close attention to get back to work on aging bio. No idea if I've helped with D/C19, but mostly out of my hands now. Happy to make updates to my 1pager agingbiotech.info/vitamindcovid19facts for important items if contacted.
Aging is an even bigger risk factor for C19 than low D, just less easily modified but not immutable. More in my Tweet'ed version of this message: twitter.com/KarlPfleger/status/1293679019716558848 <comment><USER2> > There's been suspicion the D+C19 relationship is explicitly suppressed by > various forces.

Why would anyone want to suppress that kind of information?

<comment><AUTHOR> Some point the figure at big pharma. I've no evidence of any foul play, but the pharma industry would lose money if a large fraction of their revenue comes from drugs to treat conditions that are at least in part the consequence of inadequate vitamin D.

There seems to be more to it than that. Probably partially lack of belief that anything so simple, cheap, and easy could be such a help. I believe a similar skepticism surrounded mask use (and still does for a minority of folks).

And lack of the medical system (notably doctors) receiving much training in micronutrients.

And some amount of conservatism on the part of the bodies that do things like set RDAs. The IoM (now NAM) in the US was clearly being very conservative in its setting of the UL and its refusal to up the RDA when its statistical mistake in setting it was pointed out. And in the UK the recent NICE study was super-conservative (some would say narrow-minded) to only consider peer reviewed & published studies when it did a rapid review of D for C19 evidence.

But all this is just wild speculation to give you some idea since you asked. I would love to read the behind the scenes expose someday. Meantime I'm limiting myself to the evidence not looking into the conspiracy theories.</comment></comment>


Asmttpd – Web server for Linux written in amd64 assembly - <AUTHOR> https://github.com/nemasu/asmttpd <comment><USER2> I'll try and get this building for OSX.

For the uninitiated, might I recommend my: [http://nickdesaulniers.github.io/blog/2014/04/18/lets- write-...](http://nickdesaulniers.github.io/blog/2014/04/18/lets-write- some-x86-64/)

Though, this is written in yasm syntax, which is slightly different.

Also, keep an eye out for a blog post on Interpreters, Compilers, and JITs I'm working on (cleaning it up and getting it peer reviewed this or next week)!

 __update 1 __Actually, would the syscall 's be different between Linux and OSX? Let's find out, once this builds! _hammers away_

 __update 2 __Got it building and linking. bus error when run, debugging with gdb.

 __update3 __Can 't generate dwarf2 debug symbols for OSX? $ yasm -g dwarf2

 __update 4 __Careful, this tries to listen on port 80 [0] (0x5000 (LE) == 5*16^1 == 80), I would never run any assembly program off the web with elevated privileges. I recommend 0xB8B0 (LE, port 3000).

update 5

> Actually, would the syscall's be different between Linux and OSX?

Looks like yes: [http://unix.stackexchange.com/a/3350](http://unix.stackexchange.com/a/3350) These might be close to shim out (OSX and Linux at least share a calling convention, unlink Windows). I'll upstream what I have.

[0] [https://github.com/nemasu/asmttpd/blob/master/main.asm#L24](https://github.com/nemasu/asmttpd/blob/master/main.asm#L24)

<comment><USER3> Freudian slip?

unlink(Windows) indeed...

</comment></comment><comment><USER4> It's been closer to 20 years since I last read a complete program in x86 assembly, so this is quite fun to look at.

I'm somehow disappointed (quite unreasonably, of course) that the code uses plain old zero-terminated C strings instead of something more exotic. One of the fun things about assembly is that you get to reinvent basic language features on the fly -- calling conventions, data layout, strings, everything.

<comment><USER5> Out of curiosity What would you have done for strings?

<comment><USER4> Well, for a HTTP server, I don't have a specific idea... But in general, the fun part would be trying to come up with string representations that are optimized for the particular application.

The original 1984 _Elite_ computer game is famous for its huge galaxy full of planets. Each of them had individual names and descriptions such as "Lave is most famous for its vast rain forests and the Laveian tree grub."

Yet those strings were never stored as plain strings. The game had to run in 32kB of memory, so almost all strings were stored in a tokenized form and expanded using a pseudo-random number generator:

[http://wiki.alioth.net/index.php/Random_number_generator](http://wiki.alioth.net/index.php/Random_number_generator)

That article shows how the planet description strings were stored and reconstructed on the fly. The base representation for the aforementioned description of planet Lave was only a handful of bytes: "\x8F is \x97"

So I think _Elite_ is a pretty good example of an application written in assembly that didn't have anything like a generic string type.

<comment><USER6> Indeed! Full details of the string routine at [http://xania.org/201406/elites- crazy-string-format](http://xania.org/201406/elites-crazy-string-format) if you're interested in quite how mad it was!

</comment></comment></comment></comment><comment><USER7> I wrote httpdito, a web server for Linux in 386 assembly, a couple of years ago (mostly outdated discussion is at [https://news.ycombinator.com/item?id=6908064;](https://news.ycombinator.com/item?id=6908064;) a README is at [http://canonical.org/~kragen/sw/dev3/httpdito- readme](http://canonical.org/~kragen/sw/dev3/httpdito-readme)) and I was happy to get the executable under 2000 bytes. I actually used it the other day to test a SPA, although for some things its built-in set of MIME-types leaves something to be desired.

But it doesn't have default documents, different kinds of error responses, TCP_CORK, sendfile() usage, content-range handling, or even request logging. So asmttpd is _way_ more full-featured than httpdito, and it's still under 6K.

(...httpdito possibly doesn't have any bugs, either, though ☺)

</comment><comment><USER8> Relevant: [http://i.imgur.com/INBvStO.png](http://i.imgur.com/INBvStO.png)

</comment><comment><USER9> Days ago I saw a lightweight httpd written in C here, yesterday a C++ header- only httpd library caught my mind, and now an httpd in assembly. I'm curious what would come next...

<comment><USER10> Oh, I bet someone writes httpd in vhdl or verilog... Unbeatable header parsing time I'm sure.

Or maybe in CSS. [https://news.ycombinator.com/item?id=9567183](https://news.ycombinator.com/item?id=9567183)

<comment><USER11> > Oh, I bet someone writes httpd in vhdl or verilog

I would love to see that.

</comment></comment></comment><comment><USER12> Shameless plug for a companion IRC bot in ARM assembly: [https://github.com/wyc/armbot](https://github.com/wyc/armbot)

</comment><comment><USER13> The name is confusing, the first thing i thought of was an SMTP-server.

</comment><comment><USER14> A little strange to see: "Sendfile can hang if GET is cancelled." in the readme and no corresponding issue. Not even one closed as "wontfix". Sounds like DOS?

</comment><comment><USER15> Why would someone write a web server in assembly? just for fun?

<comment><USER16> Probably to lower overhead associated with C language features, similar to the reason why many people write things in C instead of a higher level language.

<comment><USER17> To avoid overhead people implement specialized compilers suited for the task at hand. If anything, going down to C, and especially assembly will hurt performance as low-level code is much harder to optimize for obvious reasons. Above all of that real-world performance comes from proper system-level design, not micro-optimizations, and using a low-level language (be it C, C++ or assembly) will prevent one from quickly iterating over different ideas.

<comment><USER18> > low-level code is much harder to optimize for obvious reasons

What are the obvious reasons I'm missing?

<comment><USER17> As cgabios noted below low-level code obduscates intended behaviour. Ever tried to write a C optimizer? A trivial example is a for loop vs map -- the former has inherent ordering semantics and compiler does not have any way of knowing if this behavior needs to be preserved, while the latter just tells that a particular operation needs to be applied to each element so compiler is free to reorder/parallelize/etc. There are much worse situations that arise from low-level language having to preserve the underlying machine memory semantics (that is one of the reasons why it is hard to compile low level languages like C or C++ to e.g. Javascript. Compiling x86 assembly would reuire a full machine emulation).

This is discussed in detail in most introductory CS books if you would like to learn more.

<comment><USER16> In asm you write loops because they are easy, map is hard (and generally slow because it's a lot more code.)

ASM derives performance from specialization, ASM asks, how often is this code ACTUALLY going to run on another architecture, OS, etc? And then gains performance by not supporting those things via abstractions, etc.

Throw away your CS textbook and run benchmarks, reality dictates theory, not vice versa.

<comment><USER17> Specialization is what compilers do really well. :) Humans -- not so much.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Maybe it's just me, but I honestly don't know what this is doing near the HN top. It's more or less literal translation from C.

<comment><USER20> No, a literal translation is what you get when you write a http server in C and inspect what assembly code it produces for x86.64. Since this assembly code is nowhere close to that output it is not a literal translation.

<comment><USER21> Only if you use a completley naive compiler, any level of optimisation moves from being a literal translation

<comment><USER20> No, any correct translation a c compiler produces is, by definition, a literal translation.

<comment><USER21> No, that simply means that they are semantically equivilant, which is very different to a literal translation. To quote an online dictionary [0], "2\. Word for word; verbatim: a literal translation.". Optimisation in compilers is certainly not word for word.

Take a simple problem like the FizzBuzz problem, write it as the simple obvious branching style. Now compile it with GCC or Clang (with -O3) and you end up with lookup table (or at least I did a few months back. Semantically equivalent but not literal "word for word" translation.

[0] [http://www.thefreedictionary.com/literal](http://www.thefreedictionary.com/literal)

<comment><USER20> You are missing that there exists many more than one literal translation for a particular C program to asm. Using your logic a compiler could not produce a literal translation of any program unless its output to 100% matched that of all other compiles for the same program.

</comment></comment></comment></comment></comment></comment><comment><USER22> No dependencies at all, runs on Docker 'FROM scratch', Nice! - [https://registry.hub.docker.com/u/0xff/asmttpd/](https://registry.hub.docker.com/u/0xff/asmttpd/)

</comment><comment><USER23> I propose that a web framework be called Assembly on Ambulator.

<comment><USER24> Given that it's so small, 6k, I'd called the framework based on this Assembly on Alleys.

It could totally implement a DSL... call it "C" for convenience, that generates the required assembly code :-).

<comment><USER25> > call it "C" for convenience

As distinct from C, I take it.

<comment><USER24> No, that is part of the joke I was (apparently) failing at making.

</comment></comment></comment></comment><comment><USER26> benchmarks?

:-)

<comment><USER27> Just because it is in ASM, doesn't mean an exact equivalent in C won't smoke it performance wise. Just sayin... Aside of intellectual curiosity, one would be very hard pressed to write ASM code that is even barely more efficient than C code generated by a decent compiler, i.e. clang, or Intel C....

<comment><USER28> Just because it's asm doesn't mean it's fast, sure. Just because it's C doesn't mean it's faster than an implementation in your favourite scripting language.

Having said that, compilers do pretty badly on C-to-simd optimisation. The best you get is loop vectorization if it's really simple logic. You can usually get some pretty good wins there. The fact you lay out your memory for simd usually is a win all of its own due to cache prefetching even if you don't actually use any simd instructions. Compilers need heuristics to manage cache when you know what you're trying to do, (eg when should it use non- temporal writes, for example?) Fast C code is written while having a really clear mental model of the underlying architecture and the assembly that the C will produce with -O3 (or whatever flag is relevant to your compiler) and then checked with -S or objdump -D, profiled with callgrind/cachegrind, perf, rdtsc etc...

The compiler really can't "Do it for you" You /can/ use a compiler as one of your tools when /you/ do it. As Randy Hyde points out you can always beat the compiler because you can use its generated assembly language in every case you can't beat, so the absolute worst you get is a tie.

So yeah, you can totally smoke clang, Intel, microsoft and gnu C compiler and get paid something for doing it in certain industries too. :-)

Mike Acton being aggressively opinionated on the subject, but the lecture is _really_ good (despite/because of) the bits you'll disagree with and the manner he'll rub you the wrong way. [https://www.youtube.com/watch?v=rX0ItVEVjHc](https://www.youtube.com/watch?v=rX0ItVEVjHc)

</comment></comment></comment><comment><USER29> What's the performance like?

</comment><comment><USER30> Amazing!</comment>


Uber adds tipping - <AUTHOR> https://techcrunch.com/2017/06/20/uber-adds-tipping/ <comment><USER2> Extensive discussion: [https://news.ycombinator.com/item?id=14596529](https://news.ycombinator.com/item?id=14596529)

<comment><USER3> We've merged the comments there.</comment></comment>