Trump expresses doubts about security of all computers - <AUTHOR> https://www.washingtonpost.com/politics/trump-says-he-doesnt-trust-computers-as-he-rings-in-2017/2016/12/31/705af138-cfd5-11e6-85cd-e66532e35a44_story.html <comment><USER2> Robert Morris Sr said basically the same thing: "The three golden rules to ensure computer security are: do not own a computer; do not power it on; and do not use it."

<comment><USER3> Even those rules don't work anymore.

</comment></comment><comment><USER4> I think there's an element of truth to some of what he's said, but it's like a stopped clock telling the right time rather than a deep insight. I can't imagine that having messages couriered everywhere by hand will be a practical way for the US government to function unless this is part of his plan to get people back to work?

<comment><USER5> > it's like a stopped clock telling the right time rather than a deep insight

That's a really good analogy (I mean in general, not specifically referring to this situation)! I'm going to start using it.

<comment><USER6> First time coming across it? [https://en.wiktionary.org/wiki/a_stopped_clock_is_right_twic...](https://en.wiktionary.org/wiki/a_stopped_clock_is_right_twice_a_day)

</comment></comment></comment><comment><USER7> >Trump rarely uses email or computers, despite his frequent tweeting..

If 2016 taught us anything, this is a reasonable infosec strategy - Although I assume, when he becomes President there is some high powered govt. agency that can do it securely if he uses whatever protocols they suggest.

<comment><USER8> I don't know if using Twitter on a smartphone is a reasonable infosec strategy. More than a few Twitter accounts have been hacked or taken over with social engineering. And he's using a Samsung Android smartphone, so you don't know how up-to-date he is with security patches.

But then again, according to Trump himself: "I know a lot about hacking." And he also knows "things that other people don't know. And so they cannot be sure of the situation." The man could be a brilliant hacker for all I know.

<comment><USER9> > The man could be a brilliant hacker for all I know.

Or he's been briefed by brilliant hackers.

</comment></comment></comment><comment><USER10> I don't particularly mind if Trump wants to stay off of email. What bothers me is that a lifetime of isolation against computers makes him almost entirely incapabale of understanding or prioritizing information technology, and I don't just mean things like Obama's fluff campaign for learn to code.

This isn't a fault particular to Trump, of course. Anyone who isn't using technology will likely have just a facile understanding of its full impact on life today...kind of like how it's nearly impossible to understand Twitter's appeal (or at least, differentiate it from other forms of publishing, such as blogging or mass email) without using it.

<comment><USER11> Trump lives among the 1% where they don't have to interact with computers to get around in society. He has aides and servants to conduct much of the routine paperwork and other things that ordinary people need to do to function with government and business. That includes email for communications. It doesn't surprise me that in his world, he uses phone calls and personal meetings to conduct most of his face to face business. It is definitely isolating and he lives very differently than most other people. Interestingly, I see the same situation with homeless or poor people who aren't as plugged in with everyone else.

<comment><AUTHOR> Hillary is also computer illiterate.

</comment></comment></comment><comment><USER12> Is it just me, or is it damn near impossible to not make fun of everything Trump does or says. Every time I see an article about him I feel like he's a real life Forest Gump. Hes just doing whatever, and no matter how dumb or idiotic it seems, it just works out for him.

<comment><USER13> Well, consider that that is entirely artificially created by a media establishment that ridiculed him relentlessly but he still ended up winning. It's actually nothing to do with him at all; it's that the media are presenting a view that is out of sync with reality.

<comment><USER12> I get the same feeling when I see him talk at his rallies.

</comment></comment></comment><comment><USER14> I mean, he is not wrong about every computer being potentially vulnerable... Then again, so is a commercial courier.

</comment><comment><USER15> He will publicly cast doubt on things that are contrary to his own opinions. As an example, he was the leader of the birther movement claiming Obama was not born in the USA. Tip of the iceberg.

</comment><comment><USER16> Hackers of various sorts have strong interest in hacking the Trump Organization to get dirt on him. Knowing how IT in that sort of medium-size sales-oriented low-tech business works, chances are they have very weak security procedures on their financial and other data. I wouldn't be surprised if hackers are having a field day.

<comment><USER17> Could be, but if that were true I would expect we would have seen a lot of publicity about such hacked info. Surely there's been no shortage of interest in finding "dirt" on Trump, his businesses, family, etc. The nasty political situation would be a great incentive for it. The absence of such data suggests decent security is in place.

That makes sense insofar as Trump runs large operations that has to require considerable computing resources to run them. He probably has top-notch people overseeing the data end of management and that would include maintaining security

<comment><USER13> _Surely there 's been no shortage of interest in finding "dirt" on Trump_

They did - how do you think that 2005 video mysteriously surfaced at just the right time to do the most damage?

It only didn't work because people recognized it for the obvious tactic it was.

<comment><USER18> Why do you think the media focused so strongly on Clinton's email "scandal" while avoiding covering all the Trump scandals?

</comment></comment></comment></comment><comment><USER19> "Earlier in the day, Trump ditched his press pool, traveling to play golf at one of his clubs without a pool of journalists on hand to ensure the public has knowledge of his whereabouts."

It's a little bit off-topic, but I can't help but feel like this sentence contradicts itself.

<comment><USER20> It's meant to be parsed as "traveling to play golf (without a pool... to ensure the public)", not "traveling to play golf (without pool...) to ensure the public.

</comment></comment><comment> xkcd-sucks Could this become a big make-work program for infosec or for paper-and-pen bureaucrats?

<comment><USER21> Or for the manila envelope cartel.

</comment></comment><comment><USER22> America has become ridiculous.

The headline is absurd. The article is absurd. Everything about this is absurd.

<comment><USER23> How so? The absurd thing is that it is news - it should just be common sense that computers are not secure. It shouldn't take a statement by the future US president to convey that message.

Have you ever looked at a computer owned by one of your relatives (someone who is not a computer expert)?

<comment><USER24> I've not seen any numbers, but I don't think it's far fetched to say that the US probably has ridiculously large budgets for cyber security, military research in computing, cryptography etc. We're not talking about uncle Jim- Bob's computer here.

Having the person that will lead all of that say he'd rather send couriers with hand written notes is horrifying for me. As a computer scientist I feel that this is yet another attack on science and reason. I wonder how you don't feel the same?

<comment><USER13> _Having the person that will lead all of that say he 'd rather send couriers with hand written notes is horrifying for me_

Consider [https://en.wikipedia.org/wiki/Millennium_Challenge_2002](https://en.wikipedia.org/wiki/Millennium_Challenge_2002)

        Van Riper used motorcycle messengers to transmit orders to front-line troops and World-War-II-style
        light signals to launch airplanes without radio communications

Using these tactics - in an exercise only of course - the "enemy" defeated the US military easily.

</comment></comment></comment></comment><comment><USER25> He rarely uses email. Fuck me. And this guy is a US president. In 2017. God bless America.

<comment><USER26> Without any political connotation, of just email as a communications platform: Email incurs costs of mental kind on the end user. I see nothing bad of not using it - if one can afford not to. For example, Donald Knuth seldom uses email as well. [http://www-cs- faculty.stanford.edu/~uno/email.html](http://www-cs- faculty.stanford.edu/~uno/email.html)

I'm not sure if it's such a great strategy for a future president, though (especually as he seems to spend awfull lot of time on twitter).</comment></comment>


A Simple Open Source Tool for EC2 RightSizing Analysis - <AUTHOR> https://www.fittedcloud.com/blog/simple-open-source-tool-ec2-rightsizing-analysis/ <comment><USER2> Since most people aren't doing enough waste monitoring in the first place, shrinking oversized instances should be low-hanging fruit to free up some budget

<comment><AUTHOR> EC2 is a significant part of cost for most customers. So, rightsizing is essential to keep costs under control.

</comment></comment><comment><USER3> Interesting tool. How do you get the efficiency score among the $1000 spend users?

</comment><comment><USER4> The tool is interesting. EC2 rightsizing means cost saving.

</comment><comment><USER5> The "Efficiency" metric is very useful and I really like the web interface. This is a great tool!

</comment><comment><USER6> looks interesting .. Doesn't AWS provide rightsizing recommendations?

<comment><AUTHOR> AWS does provide rightsizing tools ([https://aws.amazon.com/answers/account- management/cost-optim...](https://aws.amazon.com/answers/account- management/cost-optimization-ec2-right-sizing/)). However, we find it bit heavy duty for many customers, as it involves S3, RedShift, etc. Some customers may want simpler ways to analyze their environments.

</comment></comment><comment><USER7> The tool looks very useful. Will give it a try.</comment>


Pesticide link to long-term wild bee decline in 18 year study - chestnut-tree http://www.bbc.co.uk/news/science-environment-37089385 <comment><AUTHOR> You can download the study[0].

If you look at the model in equations (2), (3) and (4), you can see that they force fit the decrease in population of the bees on the neonicotinoid exposure. Because the decrease of the population _in this model_ is only linked to pesticides, you need a very careful analysis of the confidence intervals and the quality of the fit or you can fall into the spurious correlation trap[1].

Also _" The authors acknowledge that their study finds an association and doesn't prove a cause and effect link between the use of neonicotinoids and the decline of bee populations."_. Which is good, it means they know the limits of this study.

The other case is that around 2005, we had a shift to produce more biofuels by doing more extensive single crop farming. This also had devastating effect on the biodiversity needed for the bees, insects and the birds.

The last point is, why bees are going very well in Australia even so Australia is the most extensive user of neonics?

The issues with bees is really a hard problem, most likely a combination of many factors, so I do not want people to jump on a single factor (the neonics) then claim victory and move to other things even so neonics are most likely not the main factor.

This year was bad for our bees, 8 hives, just 1kg honey per hive...

[0]: [http://www.nature.com/ncomms/2016/160816/ncomms12459/pdf/nco...](http://www.nature.com/ncomms/2016/160816/ncomms12459/pdf/ncomms12459.pdf) [1]: [http://tylervigen.com/view_correlation?id=1597](http://tylervigen.com/view_correlation?id=1597)

<comment><USER2> A neighbour who used to keep hives here (France) until a few months ago has had them repeatedly wiped out by fungal infections, as the combination of hot and damp then suddenly cold then hot again isn't normal for this part of the world. They had four false springs here this year - crops suffered too, and foresters are having a heyday taking dead trees out of the forest.

Like you say, pesticide use alone is unlikely to be the issue - hell DDT and friends are far less friendly to insects, and we're used far longer - so it's likely a whole host of anthrogenic factors which are wiping out the bees, much like many other species.

We're pretty much the worst thing since the cambrian-ordovician extinction event for biodiversity.

<comment><USER3> Not to mention the expansion of the killer bee asiatic vesp in France.

<comment><USER2> Yup - this sort of thing has happened before (parasites spreading outside of their natural range - i.e. [https://en.wikipedia.org/wiki/Phylloxera](https://en.wikipedia.org/wiki/Phylloxera)), but as far as I'm aware this is the first time we've seen it happening due to climatic shifts, rather than direct human involvement (gee, let's import cane toads to get rid of those pesky beetles).

No amount of biosecurity can defeat threats that travel on the wind.

</comment></comment></comment></comment><comment><USER4> The strange thing is that the response will be "OK so lets create poisons that kill all insects EXCEPT bees".

<comment><USER5> We already have many, many, many pesticides that do this, but neonicotinoid pesticides are really useful for a couple of reasons:

1\. Very low toxicity to mammals. Neonics are used in flea collars, and to kill lice in farm animal bedding materials for this reason. Neonoics are also very safe to apply by human applicators.

2\. Neonics are systemic pesticides in plants. They are absorbed into the plant and provide long term protection against insects pests. Less pesticide drift, less danger to applicators, BUT it also gets into floral nectar, causing problems for bees and possibly other insect pollinators.

3\. Neonics are cheap. I can buy 5lbs of Marathon 1G, a neonic pesiticde for about $80. Something more targeted, such as Rycar is more than $500 for a similar quantity, and Rycar is not systemic, it has to be applied several times.

There is a move towards more targeted pesticides such as Rycar, Floramite, Kontos, etc. but they are expensive, and in many cases more difficult to use. That's the darn problem. Neonics are terrible for bees, but for agriculture, they are really useful and there is no clear replacement.

<comment><USER6> Ok, so lets make bees more resistant to Neonics.

:P

<comment><USER5> the non-native bees shipped around the country (US) and that are the primary pollinators in agriculture appear to already be fairly resistant to neonics.

<comment><USER7> Honeybees are themselves non-native! They're an introduced species.

</comment></comment></comment></comment></comment><comment><USER8> It took 18 years to understand pesticide link to decline in bees!

<comment><USER9> Breaking: Insecticide Kills Insects!

</comment></comment><comment><USER7> If neonicotinoids are causing a long-term decline in bee populations, why does their introduction correspond with a global increase in beehives?

<comment><USER10> Active hives have increased because beekeepers have reacted to the increase in bee die-offs by splitting hives and otherwise increasing the number of hives they have. This causes an increase in demand for queens, and companies that sell queens will have more hives in order to meet that demand. Also, simple economic growth is a possible contributor to the increase in number of hives.

<comment><USER7> Do I properly understand your argument, like the one below, to be that despite the increase in beehives, there are fewer live bees in the US?

<comment><USER10> When you talk about "increase in beehives", are you referring to hives that are managed by a beekeeper, or hives created by wild bees, and not managed by a human? When you talk about "fewer live bees", are you referring to wild bees, or bees in a managed hive? In my previous post, I was only referring to managed hives.

<comment><USER7> There _are no feral honeybees_ in the US. They were wiped out, not by neonics, but by the varroa mite, 30 years ago.

(Before we colonized this place, there were no wild honeybees: they're an introduced species).

Honeybees are livestock, not wildlife.

<comment><USER11> As an amateur beekeeper, I can tell you that honeybees _are_ wild, in a sense. A captured swarm is just a wild colony with the queen trapped in an excluder box in your hive.

They can't be domesticated, and containing them after they swarm involves tricking the bees into thinking they are the ones making a decision (you can turn their hive 90 degrees after they swarm in summer and they will return in most cases, assuming they've found a new spot for a hive).

Also, mites (and foul brood) are still a pain in the ass and I can see why bees need a beekeeper to even stand a chance.

<comment><USER7> I did a little more clicking around, and learned (wait for it) that native feral honeybees are probably gone in the UK as well. Honeybees in both the UK and North America are livestock, not wildlife.

<comment><USER12> Honeybees are indeed a non-native species to the US, but that doesn't mean there are not feral honeybees. They can survive just fine in the wild without us, as they did before they were domesticated, and they continue to do so as descendants of domesticated apis melifera and other species. This is the same as the wild boar which has existed in a feral state for centuries in the southern US, originally from domesticated pigs brought from Europeans. Calling apis melifera 'not wildlife' does not seem anywhere near accurate.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> As a fruit lover, I always choose old fruits, the damaged ones, because I can't bear waste. Most people don't have this behavior, they want shiny, clean, solid fruits, the ones obtained with pesticides. It's often the opposite of tasty, but people are stupid

<comment><USER14> What correlation is there between damaged/old fruit and not having pesticides? They weren't treated exactly the same as the other fruit in the harvest?

</comment></comment><comment><USER15> Pesticides are linked to insect deaths? What a surprise.

<comment><USER16> Saw that coming. Nothing will be done of course.

</comment></comment><comment><USER17> We have known this the last 20 years, people just don't give a fuck unless the after-effects are cutting into their profit.

I will miss the bees. I will not miss the people.

<comment><USER17> Also, it is fungicide what is the big issue here. It has the same effect on bees as if you were constantly washing your hands in sanitizers. You remove the beneficial bacteria (or in the case of bees, fungi AND bacteria) from their hives, so disruptive and aggressive fungi can invade and destroy them from the inside.

I've read this in an article when I was 11 years old. The problem, as in most cases, are the humans. Some days I am wishing for a huge ecological disruption, famine and another Spanish flu to wipe 50-70% of the globe, even though I know I too might be one to go in such an event.

In fact, that is what the Gates Foundation is expecting to be a coin-flip scenario in their lifetime, which is what, the next 20 years or so! So yeah, prepping in a WW2 bunker with broadband internet and half a year of supplies in the mountains doesn't sound so crazy after all. When shit hits the fan, shoot on sight and salt the meat.

</comment></comment><comment><USER18> .

<comment><USER19> It is not meant to be kept in the ground (few pests come from there anyway) it is meant to be in any part of the plant that an insect might feed on.

</comment></comment><comment><USER20> "We're shocked!" -No One

Seriously though, outside of a few desperate libertarians on the internet who needed not to believe it, I've never met a serious person who didn't see that likely connection.

<comment><USER21> There is evidence that neonicotinoids are harmful to bees and there is also evidence that they aren't. Why makes you so sure it's a slam dunk explanation?

Hell, even the EPA and Dept of Agriculture conducted a massive study and said it's pretty far down the list of factors in the decline of the honey bee population.

[1][http://www.usda.gov/documents/ReportHoneyBeeHealth.pdf](http://www.usda.gov/documents/ReportHoneyBeeHealth.pdf)

<comment><USER20> Just to see if I'm still batting a perfect game here, do you describe yourself as "Libertarian"?

<comment><USER21> That's your reply to a well thoughtout counter argument?

<comment><USER20> Your characterization of your two sentences and a link as a "Well thought out counter-argument" aside... it was a question you've dodged, so thanks for the answer. ;)</comment></comment></comment></comment></comment>


Show HN: Online teaching companion tool for students' emotional wellbeing - <AUTHOR> https://sulli.tech <comment><AUTHOR> We have developed a project called Sulli, which is an online learning companion tool to monitor students' emotional wellbeing. Currently, the most popular method of teaching is lecture using a video conference application. This method is limited since it only serves the purpose of delivering the class content. We believe that the role of school extends to nurturing the students' Emotional growth & Wellbeing. That being so, Sulli can connect teachers and students to a new extent.

The name "Sulli" is named after Anne Sullivan, best known for teaching Helen Keller. She taught Keller, a child that was both deaf and blind, while being partially blind herself. Although often overshadowed by the achievement of her protégé, Sullivan was a gifted educator undeterred by limitations of her circumstances. Just like Sullivan was to Keller, we hope Sulli can help all teachers and students struggling with online teaching globally under the pandemic.

Sulli represents non-verbal cues that the teacher would see naturally in a face-to-face classroom environment. It minimizes the discrepancy between face to face classroom and online learning environments in a subtle way.

Sulli is not a replacement for the conference application but a companion to the online classroom application. Students can still raise questions in the chat or through the video call.

You can give my public server a try but it can be quite slow. Please contact me directly if you would like our team to set it up for you personally.</comment>


Difference between JavaScript and Java? - <AUTHOR>

The first thing people do when they are learning is think that these two languages are very correlated because of the Java prefix.
But, i've heard they are not? I know Java, and i'm learning Javascript, and so far they are very similar at a glance...<p>So, what are the similarities and differences between them? Why the similar name? And if anyone can give me an easy definition of script that would be cool.. <comment><USER2> The language is actually called ECMAScript. It's in its 5th version right now. As its name suggests, it is standardized by ECMA.

JavaScript is a name that is licensed to Mozilla by Sun Microsystems. Technically speaking, only Mozilla can use the name "JavaScript". The Microsoft version used to be called JScript. The Adobe version is called ActionScript (ActionScript eventually turned out to be its own sorta language that vaguely conforms to ES standards).

Because ECMAScript is just a specification, it is up to the implementors to conform or not to the spec. Mozilla itself does a lot of weird stuff that doesn't actually conform to the spec. But for the main uses, all three major engines(V8, Spidermonkey and Chakra) are all pretty okay.

If you learn JS for use in node.js, then you are mainly learning the quirks of V8's implementation (of which thankfully are minimal). You may think that V8/Chrome is the dominant JS engine out there, but there are some softwares like CouchDB which uses SpiderMonkey as its engine.

In the past, I believe there used to be a mini language out of Java, also called Java Script, but that quickly fell out of use.

JavaScript as a language was designed to look similar to Java, to catch on the Java-is-the-best-thing-since-sliced-bread bandwagon in the early 1990s. Of course, when you mix paradigms, you have weird shit like ASI in JavaScript.

source: I am writing a couple of books about JavaScript.

</comment><comment><USER3> They are utterly different.

This is a topic that is well documented. You can check the wikipedia pages for both Java and javascript.

Alternatively check this [http://stackoverflow.com/a/245069](http://stackoverflow.com/a/245069)

</comment><comment><USER4> The 'Java' part was due to marketing push on the part of Netscape. At the time Java was already well established and 'LiveScript" didn't quite have the same recognition. What's more, originally Brendan Eich modeled this new language on the concepts in Self and Lisp. But again, the marketing PHB's forced him to adopt a curly bracket notation like that of C, C++ and Java.

Furthermore, Java is a compiled language, whilst JavaScript is an interpreted language (with lots of JIT tricks in some implementations, e.g. V8).

Once you start digging deeper you'll notice that other than the superficial similarity due to the curly bracket, C-derived syntax, they are extremely different languages. Even the "class based" and "prototype based" core paradigms are very different. Of course, with Java being first, a lot of folks are trying to force JavaScript to be like Java, e.g. writing code with classes - which is a kludge at the best of time.

</comment><comment><USER5> Compiled vs interpreted, strongly typed vs dynamically typed, object-oriented vs functional, to name a few.

</comment><comment><USER6> In addition to what Isiebert said, if you're a book person, read javascript, the good parts [http://www.amazon.com/JavaScript-Good-Parts-Douglas- Crockfor...](http://www.amazon.com/JavaScript-Good-Parts-Douglas- Crockford/dp/0596517742).

<comment><USER7> or if you prefer watching instead of reading, watch Douglas Crocford talk about JavaScript early years in this talk [http://www.youtube.com/watch?v=JxAXlJEmNMg](http://www.youtube.com/watch?v=JxAXlJEmNMg)</comment></comment>


Snapchat app has made over 5000 requests in the past 24h - <AUTHOR> This is new behavior I've noticed from the android app. During the 24h period it accumulated over 5000 requests (on one device!) to chat-gateway-prod.chat.snapchat.com and app-analytics.snapchat.com. During this time, I didn't use the app at all. Noticing this behavior, I decided to open the app and take a glorious screenshot of my dns requests to their analytics domain: https://ibb.co/NyTLbfX, it immediately made 28 requests over the course of 6 minutes, averaging one every 12 seconds. I didn't interact with it at all, I just opened the app and waited a few minutes.<p>If anyone who reads this bumps into someone that works on the snapchat team, can they look into this? This is the sketchy sort of behavior where I go into work and black hole all your domains across [redacted large number of] employees. <comment><USER2> The main purpose of the app is to be spyware. The messaging & photo-taking aspect of it is secondary and is just there to give you a reason to install the spyware. If they could get people to install it without those features they wouldn't even bother developing them.

The same applies for most "free" apps (especially social media) and the reason why I don't use nor recommend anyone else uses them. I've tried hard to accept the nasty behaviour as a trade-off of the functionality the app provides but the downside always outweighed the upside.

</comment><comment><USER3> If you have the app open, they're clearly gonna have background tasks running to collect data/usage stats. That's no surprise. 5000/hr is about 3.5/minute. Sounds perfectly normal for a tracking/advertising app like Snapchat. If you don't like it just quit the app

</comment><comment><USER4> No, snapchat doesn't care, dude.</comment>


IBM To Linux Desktop Developers: 'Stop Copying Windows'  - <AUTHOR> http://www.informationweek.com/shared/printableArticle.jhtml?articleID=209904037

<comment><USER2> There's free as in speech, free as in beer, and free as in working for IBM without getting paid.

<comment><USER3>
      >IBM's comments to the Linux community of developers carry a
      >lot of weight, given the huge investment and contribution
      >the tech company has made to the OS. IBM threw its weight
      >behind Linux in December 2000, when it promised to spend $1
      >billion on development of the OS the following year.

<comment><USER2> He wasn't speaking to IBM employees, was he?

Much of that billion was spent on persuading IBM Global Services customers that they needed a whole lot of new global services to switch to a different OS for running their same apps.</comment></comment></comment>


Feds: Chinese spies orchestrated hack that stole aviation secrets - <AUTHOR> https://arstechnica.com/tech-policy/2018/10/feds-say-chinese-spies-and-their-hired-hackers-stole-aviation-secrets/ <comment><USER2> I used to work at Nortel Networks along with 130,000 other people. Nortel went bankrupt and now everyone who used to work there is fighting for their pensions. Apparently a major contributor to their downfall was all of the IP being stolen and sensitive information about deals going down otherwise exfiltrated by Huawei[1]

People need to get serious about protecting the privacy of their communications and data. Nobody cares until it is too late. Seems like this kind of event might be the incentive people need to make the extra effort to use products that encrypt their data in rest and in motion.

1: [https://www.afr.com/technology/web/security/how-chinese- hack...](https://www.afr.com/technology/web/security/how-chinese-hack..).

I made this comment earlier on a story about China POPs in Canada and USA nefariously re-routing traffic through China Telecom networks but that story was marked as a dupe by the time I made my comment so no discussion ensued.

<comment><USER3> > Apparently a major contributor to their downfall was all of the IP being > stolen

If a company is heavily dependent upon existing IP then having it all stolen will be a major contributor to their downfall. But so is that dependence. Hard to make suggestions without appearing to victim blame, but companies need to be able to survive even without secrets.

<comment><USER4> Why? If you follow that standard, you are basically saying that no R&D should ever be done, because you may just get it stolen and lose any kind of benefit you would derive from doing the R&D in the first place.

<comment><USER3> That's not what I'm saying. I'm saying don't build an overly large dependence on past R&D where resting on those laurels threatens the whole company if theft occurs.

<comment><USER5> Couldn't the new R&D be stolen as well? It sounds like you don't like Coca Cola classic.

</comment></comment></comment></comment></comment><comment><USER6> I love reading about the Chinese efforts in developing a modern turbofan engine. For whatever reason, they just can't build a good medium- or high- bypass turbofan in-house. They're latest WS-20 is basically a clone of the CFM-56 and previously they spent decades developing the WS-6 and WS-10 that never met expectations.

This is a big deal because the Comac 919 is ready to go but without a powerplant, they're having to turn to Western sources for an engine. The same thing happened with the J-10 project a decade ago and again recently with the J-20. Without a reliable powerplant, you can't build good airplanes and you can't easily reverse engineer a precision turbofan.

<comment><USER7> China also couldn't make a ballpoint pen until last year [1].

I imagine making a modern jet engine is somewhat more challenging than making a ballpoint pen (both endeavours involve making high precision metal parts).

[1] [https://www.washingtonpost.com/news/worldviews/wp/2017/01/18...](https://www.washingtonpost.com/news/worldviews/wp/2017/01/18/finally- china-manufactures-a-ballpoint-pen-all-by-itself/)

<comment><USER8> "Couldn't" is a bit unfair. The article seems to imply that it wasn't from a lack of trying, but a lack of interest, and a company only took on the challenge after the issue became considered an issue of national pride and came to light.

The numbers given suggested that it cost just over $17 million to import the pen tips to manufacture 38 billion pens. Which puts the cost per tip at $0.00045/piece.

It's not hard to see why manufacturers wouldn't bother creating a process and tooling for that if it already exists.

More importantly, the article put emphasis on the idea that once the government complained about it, something was done quite quickly. Which is completely different story to a military jet engine, which is being researched, funded and developed by government-linked organizations.

<comment><USER9> Indeed, a aviation company ( Miles Aircraft ) in my home town took a license from Bic in the late _1940s_ to start manufacture of their roller-ball Biro pen.

I have a hard time believing that China couldn't replicate that technology for 70 years.

</comment></comment></comment></comment><comment><USER10> When we were discussing the Bloomberg story, I replied a couple of times to people hypothesizing maybe it was an American government conspiracy to turn people against China. My reply is that we didn't need to make up such stories, because we've got plenty of much better sourced ones already. For those who were wondering, here's an example. It still isn't proof, of course, but I think we can generally agree it's almost certainly better sourced than the Bloomberg story, which is all I'm going for here.

<comment><USER11> It wouldn't seem necessary to fabricate such elaborate stories because:

1\. Most Americans aren't paying attention / don't respond to them.

2\. We clearly have a situation where POTUS if he wanted could just make up a story and get people's attention.

On the other hand stories like this would fit in nicely with state run / controlled media as the feed could simply be placed where you know it would get attention (if only because it is exists largely by itself).

</comment></comment><comment><USER12> As an ethical Chinese myself, I'd like to reiterate that this type event is government-backed. And I am confident that HNers respect the boundary between Chinese people and the government.

I do want to point out that general Chinese people in mainland China view these type of activities negatively as well. It should not be thought as the general people endorse such activities, they were mostly made unaware of these, as always.

<comment><USER13> As a foreigner living in China, I can say that the populace is like many other countries. You have your normal people who don't really keep track of what's going on, you have your informed people who have informed opinions and realize that the world is a complicated place, and then you have your crazies who are filled with distrust of other nations and conspiracy theories in the name of nationalism and patriotism. There are some people who view these activities as negative, and there are some people who view these activities as positive, and there are some people who never even think about it. We must acknowledge there are many in China who do endorse these activities too, just as there are people in the US who feel bombing North Korea is the right thing to do. There is no need to make things look nicer than they are, just as there is no need to make things look worse than they are.

And ironically, let's face it, every country is doing something in the spy game, China is not alone in using underhanded methods to steal secrets and intelligence. And each country can easily spout their justifications too.

<comment><USER14> I'm not sure what your point is in your last two sentences. Should the US not defend its interests against foreign powers?

<comment><USER15> OP is saying that the US doesn't have the moral high ground and anyone spouting off about how badly China is acting is just being asinine since we do the exact same thing to everyone (and if we weren't then our intelligence agencies need to get off their asses and do it).

<comment><USER16> There is a fine line in spycraft. Stealing secrets from companies for commercial gain is just pathetic. Can't innovate, just hack it and steal it.

<comment><USER17> When was it that the NSA was caught stealing lists of clients from Embraer and giving them to Boeing? I can't remember if it was 2015 or 2016...

<comment><USER18> I hadn't heard of this before, but now I'm curious - do you have any more details on this?

<comment><USER17> It was in 2013. And the international press seems to be much more focused on Petrobras, where the NSA stole a lot of data than Embraer where it just stole some emails.

Here's a link:

[https://www.theguardian.com/world/2013/sep/09/nsa-spying- bra...](https://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil- petrobras)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Turnabout is fair game, to some extent. Look at the history of European porcelain, or tea. There's a fascinating documentary on CuriosityStream about Robert Fortune, who essentially committed industrial espionage for the East India Company and obtained samples and processes to kickstart tea production outside of China.

[https://curiositystream.com/video/1746/tea-war-the- adventure...](https://curiositystream.com/video/1746/tea-war-the-adventures- of-robert-fortune)

</comment><comment><USER20> It is a really interesting shift from throwing spies out of the country to criminally indicting them. I wonder if we will see similar indictments brought against US agents in the future.

<comment><USER21> Nothing has shifted. Spies without diplomatic immunity have always been criminally prosecuted. Often they're held in prison for a while, then quietly repatriated in return for one of our spies or some other political concession.

<comment><USER22> China doesn't do that: [https://www.businessinsider.com/how-china-found-cia- spies-le...](https://www.businessinsider.com/how-china-found-cia-spies- leak-2018-8)

<comment><USER23> Those spies were apparently Chinese nationals, so Beijing would have considered them traitors. In the West that draws a long prison sentence. China and Russia are less gentle.

</comment></comment></comment></comment><comment><USER24> I have a serious question: why don't governments impose sanctions on other governments that hack them when there is sufficient proof?

<comment><USER25> Because that would be hypocritical. Most likely all large governments try to hack other governments.

<comment><USER26> Exactly, and, as we all know, hypocritical crimes are treated very seriously by very toothful U.N.

</comment></comment></comment><comment><USER27> > ....a hacking group calling itself the Syrian Electronic Army hacked an > Australian domain registrar

> In early December 2013, prosecutors said, members of the conspiracy used the > same tactic to hack the Australian registrar again, this time to hijack > domain names of one of the targeted technology companies.

What's with that registrar, don't they learn from their own mistakes?

<comment><USER28> It's Melbourne IT. A terrible company that somehow still gets large contracts despite ripping clients off at every step. I'm sure their entire staff is underpaid 457s.

<comment><USER29> I used to be an underpaid 457 for nearly a decade until I got PR. Just because someone is an immigrant on a work visa doesn't mean they're incompetent. And organisational culture is a top down process, not a bottom up one. So blaming the workers seems misplaced when it is most likely a management issue (who probably _aren 't_ 457 holders). That would probably be more accurate.

</comment></comment></comment><comment><USER30> As much as I think the tariffs are not the right solution, something needs to be done to punish Chinese aggression towards the West. They've been playing very dirty without any real consequences. Trade should not be conducted through industrial espionage or intelligence agencies as a standard approach.

The blurred line between Chinese intelligence and Chinese businesses is a dangerous one as it can turn IP theft into a real escalation.

<comment><USER31> Remember that the CIA did worse (like droning children in Yemen), be careful what you wish for.

<comment><USER32> I thought the topic was world trade.

<comment><USER31> The topic is exposing spying operations in a bigger narrative of victimhood.

</comment></comment></comment></comment><comment><USER33> >Besides using spear phishing, watering holes, malware, and domain hijackings, prosecutors said, the defendants also recruited employees of some of the targeted companies to infect corporate networks and provide intelligence about investigations.

This lines up with having a Chinese spy in California Senator Diane Feinstein's office: Being both a California Senator and a 'Gang of Eight' intelligence member, the Chinese could be alerted early on about potential investigations or indictments.

[https://www.sfchronicle.com/bayarea/matier- ross/article/Sen-...](https://www.sfchronicle.com/bayarea/matier- ross/article/Sen-Feinstein-had-a-Chinese-connection-she-13121441.php)

We've seen several indictments of Chinese nationals since this story broke.

Edit: Actually the previous indictment I had in mind was the original arrest of the agent, this is just building on that case: [http://www.atimes.com/article/chinese-agent-indicted-in- jet-...](http://www.atimes.com/article/chinese-agent-indicted-in-jet-engine- espionage-case/)

<comment><USER34> > This lines up with having a Chinese spy in California Senator Diane > Feinstein's office

That's not really an accurate description of what happened. Here's Feinstein's statement:

"Five years ago the FBI informed me it had concerns that an administrative member of my California staff was potentially being sought out by the Chinese government to provide information. He was not a mole or a spy, but someone who a foreign intelligence service thought it could recruit.

The FBI reviewed the matter, shared its concerns with me and the employee immediately left my office. He never had access to classified or sensitive information or legislative matters. The FBI never informed me of any compromise of national security information."

Nothing in your article or any other reputable sources I've read conflict with that statement.

From your article:

'"He didn't even know what was happening — that he was being recruited," says our source. "He just thought it was some friend."

The FBI apparently concluded the driver hadn't revealed anything of substance.

"They interviewed him, and Dianne forced him to retire, and that was the end of it," says our source.'

<comment><USER35> Confused, why is this downvoted? Is it wrong?

Update: Funny, now the comment is upvoted and my question is downvoted :-)

<comment><USER33> Sort of, it's extremely misleading. It suggests that there is no evidence of espionage because charges were never pressed, but consider:

>According to four former intelligence officials, in the 2000s, a staffer in Senator Dianne Feinstein's San Francisco field office was reporting back to the MSS. While this person, who was a liaison to the local Chinese community, was fired, charges were never filed against him. (One former official reasoned this was because the staffer was providing political intelligence and not classified information—making prosecution far more difficult.) The suspected informant was "run" by officials based at China's San Francisco Consulate, said another former intelligence official. The spy's handler "probably got an award back in China" for his work, noted this former official, dryly.

[https://www.politico.com/magazine/story/2018/07/27/silicon-v...](https://www.politico.com/magazine/story/2018/07/27/silicon- valley-spies-china-russia-219071)

<comment><USER34> Here's the rest of what that article says about the topic. I'm not sure why it brings up the topic 2x in the same article. It looks like this paragraph is a revision of the first.

"Former intelligence officials told me that Chinese intelligence once recruited a staff member at a California office of U.S. Senator Dianne Feinstein, and the source reported back to China about local politics. (A spokesperson for Feinstein said the office doesn't comment on personnel matters or investigations, but noted that _no Feinstein staffer in California has ever had a security clearance._ )"

None of that contradicts what your first article said, that the staffer didn't know he was being recruited. He was talking about local politics to someone who worked for the Chinese government who was pumping him for information.

The rest is just speculation on the part of someone the reporter talked to about how he could have theoretically committed a crime despite not being prosecuted.

<comment><USER36> >He was talking about local politics to someone who worked for the Chinese government.

Everyone in the government contractor industry (or government itself) gets annual training on spotting these sorts of leaks. Just discussing any stuff (even if you don't work with classified things) you're doing at work with a foreign national is touchy enough that many people avoid doing it all together. Everyone who works for the federal government or a company that works for the federal government is well aware of this. This isn't an innocent mistake. It's highly unlikely that this guy didn't know what he was doing was questionable.

<comment><USER34> This guy wasn't working in the defense industry, and he wasn't in a sensitive enough position to warrant any kind of clearance.

I'm sure someone talked to him about it, but it's unlikely he got any sort of serious training.

He supposedly talked to someone who worked their way into his life _over several years_ about non-sensitive, non-classified material related to local politics. I imagine he would have been more careful/aware if the "friend" was asking about classified information, or if his "friend" hadn't done it very slowly.

</comment></comment></comment></comment></comment></comment></comment><comment><USER37> I hear in the news stories about companies being highjacked by hackers, where the hackers encrypt said companies' data and demand a ransom. If that is possible, then wouldn't it be possible for US backed hackers to do the same to the Chinese backed organizations that stole American IP?

It seems ineffective to just publicly indict Chinese hackers that are in China. The indictments are public, so the likelihood that said hackers come to the US are nill. Seems more effective to erase the trade secrets, or any other data, from these organizations.

<comment><USER38> That would raise a variety of other serious issues. Besides the ethical problem that just because someone else does something bad, doesn't make it ok for you to do that bad thing.

I could list several important reasons why "hacking back" would be a bad idea, but I'll just stick to the pragmatic "people who live in glass houses shouldn't throw stones". We have a much larger surface area and much more to lose if we get into that kind of tit-for-tat. Instead, the US is building a case that China is an aggressor, and is responding in other ways that will apply more pressure. For example, tariffs on Chinese exports.

</comment></comment><comment><USER39> If the "spies" really did "steal" (i.e. copy) an engine design then it seems like a good thing for the world in general. They have helped spread useful knowledge.

Sure, it's bad for the would-be rent-seekers whose plans have been threatened. Why should anyone else care about them?

Thanks China, and keep up the good work!

<comment><USER38> By "rent-seekers" you mean organizations that have spent billions of dollars to research and prove the tech? As the current top comment represents, if company A spends billions of dollars creating a technology, then company B steals it, company B can sell it for less because they don't have to pay the R&D overhead. Company A falters or dies. The company that actually knew how to advance the field and create new tech suffered. Is that good for the world?

The way it is supposed to work is, company A researches a tech, company b also researches a tech, the best one wins (or more likely they split the market), the competition induces more advances, and eventually the old tech becomes cheap (or free) and widely available as it is supplanted by even newer, better tech.

And yea I know our patent system is broken, etc. But I don't understand how you can have a general principle that the people who created something don't have the right to benefit off of it.</comment></comment>


First 'water-wave' laser created - <AUTHOR> http://sciencebulletin.org/archives/8016.html <comment><USER2> I got really excited about the idea of coherent water waves, but no...

<comment><USER3> This is probably the closest thing: [https://m.youtube.com/watch?v=WffR6HrEqTA&t=40s](https://m.youtube.com/watch?v=WffR6HrEqTA&t=40s)

</comment></comment><comment><USER4> > The possibility of creating a laser through the interaction of light with > water waves has not been examined, Carmon said, mainly due to the huge > difference between the low frequency of water waves on the surface of a > liquid (approximately 1,000 oscillations per second) and the high frequency > of light wave oscillations (1014 oscillations per second).

I think that's a typo - unless the light actually has a frequency of 1khz, or I misunderstood the article.

<comment><USER5> 10^14 is what they were going for. It is indeed a typo.

<comment><USER6> 10¹⁴

<comment><USER7> Searching the page for "14" misses this.

<comment><USER8> It shouldn't; search should operate in compatibility normalization space (preferably NFKD). Chrome on Windows gets this right, btw.</comment></comment></comment></comment></comment>


SF Bay Area Shelter-in-Place Orders Extended as Some Rules Ease - <AUTHOR> https://www.sccgov.org/sites/covid19/Pages/press-release-04-29-2020-shelter-in-place-extension.aspx <comment><USER2> Down toward the bottom they have a link to 5 indicators that they will be using to evaluate progress: [https://www.sccgov.org/sites/covid19/Pages/bay- area-health-o...](https://www.sccgov.org/sites/covid19/Pages/bay-area-health- officer-indicator.aspx)

I like that they have clear numerical targets for all of them.

<comment><USER3> Interesting metrics.

Indicator 1 (cases) and 2 (hospitalization) are clearly met.

Indicator 3 (test capacity) has a very aggressive target. 200 tests a day per 100k? Why must it be this high? (Germany by comparison, opening schools now, is at 80 per 100k). Santa Clara County is already at a 3% positive rate week to date (Korea level during their Feb epidemic)

Indicator 4 (case investigation) status is not disclosed but I would guess is met or close to met in Santa Clara county given how steep the drop-off has been in cases and confirmation by other counties (Contra Costa). Of course, it gets harder to contact trace as you ease restrictions.

Indicator 5 is a bit fuzzy - supply under what hospitalization assumptions?

<comment><USER4> Regarding #4, with the ubiquity of call blocking, I don't see how it is possible for them to reach 90% of the people that may have been exposed, especially once people find out that picking up that phone call means you will be in quarantine. To make matters worse, the authorities likely won't be able to tell you where/when you were exposed and to whom (medical privacy). This target is basically unreachable IMHO.

<comment><USER5> A round number repeated for 4 metrics in a row is never really meant to be taken seriously. If it turns out that they can only reach 80% of contacts, they'll adjust the plan to account for that - nobody's going to let it be the one factor that keeps restrictions from being loosened.

</comment></comment></comment></comment><comment><USER6> Reading between the lines here

"Other activities that can resume under the new order include residential moves and the use of certain shared outdoor recreational facilities that were previously ordered closed, like skate parks, but not others that involve shared equipment or physical contact." \-- I believe this means they will open up parks that were previously closed and allow people to visit again.

</comment><comment><USER7> I guess the longer term question is --

As mentioned in the daily governor's briefing, there is some kind of 2D matrix (or map) of places vs. types of activities or businesses that can be incrementally allowed to open or get to different levels of restrictions lifted. (or I hope this is the case, and not just a talking point)

How are people to know / track this? Is there some visual dashboard that everyone can refer to daily and hopefully have consistent definitions to know whether their business is covered? Press conferences (and press releases in inevitable text form) are an inefficient method having to speak the words of each change in circumstance as this continues to evolve. New Zealand seems to have a clear system of Level 1/2/3/4 that everyone has the definitions of.

This is going to have to go on for months, remember.

<comment><USER8> Even in New Zealand the definitions of each level aren't entirely clear. To the point that our Health minister has been caught out multiple times breeching our lockdown conditions.

A few days ago we reduced alert level and many people and businesses have been witnessed breaking the conditions. Some people were always going to do whatever they want, but there are many other that have been confused by rules that change day to day.

</comment></comment><comment><USER9> > Whether we have the capacity to investigate all COVID-19 cases and trace all > of their contacts, isolating those who test positive and quarantining the > people who may have been exposed.

We're all going to be inside for a long time ...

<comment><USER10> We have 20 million unemployed Americans, many of whom are currently getting paid to sit at home and play Animal Crossing.

Surely, a well-functioning society would figure out how to employ some of them to be contact tracers. Why hasn't this happened yet?

<comment><USER11> Why do you believe it's necessary for someone to perform labor in order to be allowed to live?

<comment><USER10> I have no issue with UI benefits, or equivalents thereof. I have no issue with the current extension of UI benefits.

But I do have issue with the claim that we could never hire enough contact tracers...

1\. In the middle of a massive surge of unemployment.

2\. When we are already paying millions of people to... Sit around, and do nothing.

The need for workers exists, the money to pay them exists, the workers exist, and some of them actually want to work. Why can't we put those four things together?

</comment></comment></comment></comment><comment><USER12> We also need to focus on what this pandemic had meant to us and what we can consider essential and non essential in the long run and use the lessons learnt to our benefit. Certainly the nature of work for a large number of people in Silicon Valley is such that it can be absolutely done remotely. I seriously hope and wish that unless it is absolutely necessary companies like FANG or Intel or NVIDIA or all other tech companies continue to honestly (not just on paper) encourage their employees to work from home. I am sure there are many roles that can continue to work from home in the foreseeable future :

\- Software engineers \- Software development Managers \- Product Managers \- DevOps \- SREs \- Accountants and Finance \- Marketing \- Solution ArchitectS

It is entirely possible for all these categories of people to WFH with the help of VPN, FaceTime/zoom or other Video and chat/messaging software.

Companies should also stop new constructions or building new office spaces. It is time that tech companies understand that new office spaces are not a tool to increase productivity.

Also in the long run having people work from home as much as possible will significantly improve Bay Area traffic and reduce pollution.

I understand that some folks does not have the space in their home to WFH peacefully , but with childcare facilities opening up and eventually schools ... it can be easily worked out where members of such households establish a rotating schedule and WFH on a partial basis (ie 2-4 days a week).

<comment><USER13> But office spaces do increase productivity...

<comment><USER14> Collaboration increases productivity and building new offices continuously is not the only way to increase collaboration, specially for the kind of work that SV companies does. I think from that perspective the OPs post bears merit. However it is also a matter of job security and if you don't have to go to an office physically you may feel insecure inside ....

<comment><USER15> That's true, I think a lot more can be done for the WFH perspective. If companies offered all employees a good home setup, good desk, chair, screen, keyboard, mouse, headphones, good mic, good webcam, a good whiteboarding solution as well like maybe an iPad + pencil. And there was an app allowing remote share, remote control, remote whiteboard, and subsidize cost of a good internet. I feel I'd be even more productive at home with all that in place.

<comment><USER16> We've been looking into this lately, and settled on iPad Pro + Pencil + Explain Everything as a remote meeting and whiteboarding solution. It seems promising so far. Miro is another software option that seems pretty polished, although we haven't tried it yet.

Hopefully someone with more experience can share more tips on what has worked well for them.

</comment></comment></comment></comment></comment><comment><USER17> Read the whole thing... hoping disc golf and dog parks can resume. That'd be nice.

</comment><comment><USER18> Reopening childcare facilities seems very risky.

<comment><USER19> Millions of people can't work on reopening other things without reopening those first.

<comment><USER20> THere'sno denying the importance of child care, but it seems just about guaranteed that if there is a case in one family it will spread to the other (up to) 11 families in the child's "stable group"

<comment><USER21> That's always going to be the risk until we have a working vaccine though and it's really hard to reopen without childcare in place. Without it a lot of people will have to choose between losing their jobs when their employer reopens or getting adhoc in home childcare.

</comment></comment></comment></comment><comment><USER22> The most important question : Are Barbershops going to be Open or Not? :)

<comment><USER20> I don't have an answer, but I'd encourage you to continue paying your barber on whatever schedule you used to get a haircut!

</comment></comment><comment><USER23> I have never seen this scale of sacrifice for this scale of Quality Adjusted Life Years. Just the impact on the kids missing school will be worse than the impact from the virus.

<comment><USER24> Just because you've not seen something doesn't mean its not happened. The sad reality is that people all over the world have lived like this forever. Warzones, undeveloped countries, etc.

Afghanistan hasn't been safe or stable enough for literally decades. Syria has had a civil war for many years. Much of Mali has been under the grip of religious extremists for years.

<comment><USER23> I don't think you and I are talking about the same thing. I'm talking about a societal/governmental decision to sacrifice the quality of life of the entire society for the benefit of some vulnerable group. Not civil wars or ethnic cleansing or other atrocities.

</comment></comment></comment><comment><USER25> _All construction activities...will be allowed to resume..._

This seems so arbitrary. Construction noise that you can hear and feel from home will be twice as maddening if you are stuck there. Speaking as someone whose apartment backs a sub basement deep-dig project. After a few days of quarantine one of my neighbors shouted some choice words from his balcony at the workers starting their banging and whistling at seven in the morning.

<comment><USER2> I feel you on the noise, but it makes sense to me. Construction is one kind of work where worker density is low and people are already used to wearing PPE when needed.

<comment><USER26> yah, easy call on construction reopening but no sympathy for whining about (legitimate construction) noise, which is often used by curmudgeons to adversely control all sorts of others' behaviors.

but 7am is a bit of an issue. the ordinance in LA for instance specifies construction noise can't begin before 8am but that's routinely broken here too.</comment></comment></comment>


ASK HN: How to plan and manage a large web project? - <AUTHOR>

Hello fellow HN readers. I wonder if I can spare 5 minutes of your time, if I may please.
I have a very large personal web project that I will be developing over the next 6 months. This project is much bigger then anything I've ever done before, and I am really struggling at the moment.
I want to plan and organise my project in a efficient and logical way so when I hire/fire coders others, and myself can understand everything that is to be done.
Usually I just jot things down in a notebook, or write a to-do list for the smaller projects.
I am thinking of using a brainstorming application to help me with this, have each feature of the site on its own branch and then branch off of that with its comments/solutions. Could you suggest any good applications for helping me with this? Or is there a better way to plan ideas/solutions?
I also need to start looking at svn/cvs repositories as I have never used one before to manage revision control of a project. What is the best way to start with this? I have done a little research into subversion and git, but really I am clueless as to which I should learn/use.
The last thing I need is bug tracking, I usually just write down bugs I find in my applications in my notebook and fix them as and when. But seeing how large this project is, and the use of multiple programmers. I want to keep everything in one place, so we have an up to date list of bugs and a history of old bugs, should they give us trouble at a later date. What can you suggest for me?
I don't know if I have asked the right kind of questions here but I have a million things running through my head at the moment that I just want to manage and develop this project in a correct and professional way.
If you have any suggestions on the planning, and management of a large web project could you please share them with me?
Thank you very much for your time and I hope you have a wonderful day! <comment><USER2> Couple of notes from my perspective, not really webapp specific but still relevant, at least I think so.

\- Settle in on a VCS subversion and git are two front runners to get you started on. Of course others exist but those are two big ones. Each has its own benefits and disadvantages.

\- For bug tracking, JIRA has a starter package that is $10 per app for like 10 users. Some people like JIRA/Fisheye/Greenhopper etc, others don't so use your judgment. I think for the price and the functionality you get it's a decent deal. Beware though if you grow past the number of users it's a little bit of sticker shock.

\- Look into either Agile type strategy. I've used it on several projects and it has served me well. Scope is way beyond this post or comment so I'll leave you to research. Again mileage will vary based off team experience and leadership.

Just a couple of thoughts. Hope this helps!

Derek

</comment><comment><USER3> Sounds like going with an Assembla.com account might be perfect for you. I'm in no way affiliated with the company, but most of the issues covered can be handled using their tools.

I have one git repo with all of my code. Have milestones and tickets related to specific code points. Not to mention that their Scrum/Messages tools are great.

<comment><AUTHOR> Thanks for the link, do you know of any alternatives? I would like to shop around a little. Assembla seems to have every feature, I wonder if Github does something similar? I am yet to make an account on their site.

</comment></comment><comment><USER4> Just buy these two books. You won't use everything in both, but they will give you enough ideas and perspective to make them both very worth reading:

"Making Things Happen" - OReilly "The Art of Agile Development"

</comment><comment><USER5> I recommend:

1\. using branches as short-term scratch spaces for new features. Branches should not be long-lived and if they are they should be regularly merged, unless you are deliberated separating them for some reason (eg 1.x-stable, 2.x-stable etc)

2\. You owe it to yourself to get familiar with a SCM ASAP. I use and recommend git. I also use and strongly recommend a paid account at github. Yes, paid! Then give your programmers access and watch it all come together there.

3\. I use and recommend lighthouse. I used to dislike it but it's just so frictionless and easy to use that I can't think of anything else I'd recommend.

<comment><AUTHOR> Thank you, I am reading up on git and subversion at the moment. I was thinking of hosting a copy on our own server for the time being just to test things.

What could I use instead of brainstorming? I have looked at microsoft project, but it's not really what I'm looking for.</comment></comment>


Show HN: A platform to share your side project - <AUTHOR> https://sideprojects.net <comment><USER2> The readme says that 'for profit' projects aren't allowed. Side projects can't be created for the purpose of making money? I'm not sure I understand the purpose of that restriction...

Other than that, looks awesome

<comment><AUTHOR> Thanks! There's definitely no problem with making a bit of money through a side project. Perhaps I worded it poorly, but that restriction was put in place to prevent companies/established organizations from posting their products on the platform as the site is meant for individuals to post their side projects. I'll rephrase it, thanks for pointing it out.

</comment></comment><comment><AUTHOR> Working on a side project is something a lot of us share. Whether it's an open source resource, a blog, etc., all ideas, as crazy as they are, have some sort of potential. Yet one thing I've realized is that there's really no organized service that's designed to allow you to share side projects and to garner feedback on them.

That's what sideprojects.net is. It's a platform where you can share your side projects and get feedback, ideas, and even support on them. It's 100% free to use as well :)

<comment><USER3> This is a great explanation and should be displayed somewhere on the site.

</comment></comment><comment><USER4> @sakofchit just browsing from my phone but this seems like it's using the Telescope platform (though I believe the name has since changed). Is it? I had plans to use that to launch several side-projects back in college but felt like practicing and working on rolling my own... Been busy with life and work since so I have yet to truly launch anything.. ^.^'

<comment><AUTHOR> It's VulcanJS now, but yeah I've forked it and have been working on it to make it look/function better. Definitely a great framework to work with :)

</comment></comment><comment><USER5> I don't normally suggest things.. but this immediately screamed at me going to the 'video' category..

I'd suggest if there aren't any posts for a given day, don't show it, so only days with posts are displayed. And also, then populating a page (pagination- wise) with X-amount of posts, rather than X amount of days, just to give a more consistent experience between pages :)

Other than that, seems like a great idea :)

<comment><USER5> Also, I tried clicking on one of the projects and got a 404: [https://sideprojects.net/out?url=https%3A%2F%2Fwww.producthu...](https://sideprojects.net/out?url=https%3A%2F%2Fwww.producthunt.com%2Fposts%2Fssl- checker-tool)

<comment><USER5> _Correction_ : if I click on _any_ link to go to a project, I get a 302, which doesn't redirect, with the text:

Not Found!

We're sorry; whatever you were looking for isn't here..

<comment><AUTHOR> It appears to be a problem with Firefox and I'm yet to figure out what's causing it since it works on my local environment fine. Try using a different browser

<comment><USER5> Ah okay, cool. cheers :)

</comment></comment></comment></comment></comment><comment><USER6> Great project! there's definitely some interesting things to explore here.

I had an issue though, I clicked the top link on:

[https://sideprojects.net/posts/7YZPLbcugbCyf94GY/non- vocal-m...](https://sideprojects.net/posts/7YZPLbcugbCyf94GY/non-vocal-music- pomodoro-2x-focus)

to visit the site and it takes me to

[https://sideprojects.net/out?url=https%3A%2F%2Fwww.programme...](https://sideprojects.net/out?url=https%3A%2F%2Fwww.programmersmusic.com%2F)

which is 404. hope it's a quick fix :)

Have you listed this as your own side project on there? ;)

<comment><AUTHOR> Yep, it's an issue with Firefox unfortunately. It'll work fine on any other browser. I still haven't been able to pinpoint what's causing it since it works perfectly fine on my local environment :(.

Haha, yeah I should probably post sideprojects.net on it as well :P

</comment></comment><comment><USER7> Whenever I click on a project, it leads to a page that says 'Not Found'. It looks like the redirect is not working properly.

<comment><AUTHOR> It's an issue with Firefox, try it with another browser for now.

</comment></comment><comment><USER8> Great Job Sakun! For those of you who don't know, this maker is only 18! (Source: [https://www.producthunt.com/posts/sideprojects](https://www.producthunt.com/posts/sideprojects))

Keep up the great work!

<comment><AUTHOR> Thank you so much!!

</comment></comment><comment><USER9> Where do you source these projects from? Where did you find your first users? And how do you keep spammers at bay?

<comment><AUTHOR> Great question. This is a platform where users post their side projects. They aren't being pulled from anywhere.

The first few users came from a public test on reddit as I wanted to see if this would be something that people could see themselves using. The responses I got were positive, so I went ahead and posted the website on several different (relevant) subreddits before launching on ProductHunt on September 2nd.

I haven't had much of a spammer problem (yet), but there is a spam filter and a cool-down preventing you from posting too much at once.

</comment></comment><comment><USER10> Nice idea, I hope it does well.

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER11> Just posted! Thanks for sharing.

<comment><AUTHOR> Awesome! Thanks for posting it!

</comment></comment><comment><USER12> I thought side projects were shared on GitHub/GitLab/BitBucket...

<comment><AUTHOR> It's hard to discover them, plus not everyone wants to make their side projects open sourced :)</comment></comment>


Pineapple Fund looking to convert some funds to Bitcoin Cash - <AUTHOR> https://www.reddit.com/r/btc/comments/7lnu9w/pineapple_fund_update_homes_in_haiti_education/ <comment><USER2> He just donated $1 million USD to the Internet Archive! :O

[https://blockchain.info/tx/efe552239f4cfcd167a49865c52ad3185...](https://blockchain.info/tx/efe552239f4cfcd167a49865c52ad318520166f45f4e43988237068c34b026d0)

[https://www.reddit.com/r/btc/comments/7lnu9w/pineapple_fund_...](https://www.reddit.com/r/btc/comments/7lnu9w/pineapple_fund_update_homes_in_haiti_education/drnncs5/)

</comment><comment><USER3> Money quote:

> It has been clear to us that the current bitcoin network is completely > incapable of functioning as a payment processing network, not just for "cups > of coffees" but even for multi-million dollar transactions, and we are using > SegWit.

<comment><USER4> This is laughable. I transferred btc today in about 30 mins.

<comment><USER5> And 30 minutes is acceptable...?

<comment><USER6> Don't ACH and wire transfers take at least a day? And as a disclaimer I'm not for or against either coin.

<comment><USER7> In the EU, since November 2017, wire transfers take 15 seconds (Disclaimer: some banks are still rolling it out).

Welcome to the world of the Single European Payments Area Instant Credit Transfer Scheme.

<comment><USER8> Ah. I didn't know this. Even in different currencies?

<comment><USER7> Until 2018, SEPA transactions only clear in EUR, I think from 2018 on there will also be support for other EU currencies.

<comment><USER8> Very nice.

I spent a lot of money and time before diacovering Transferwise.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is somewhat off-topic but I might as well ask this here: who are respected technical people who support Bitcoin Cash?

<comment><USER10> Ryan X. Charles at Yours comes to mind. Many technical founders of Bitcoin co's were behind SegWit2x, which flamed out spectacularly, and some are switching to Bitcoin Cash- eg Stephen Pair of BitPay.

<comment><USER9> I'm sort of surprised the centralized Bitcoin businesses like BitPay, Coinbase, and exchanges aren't collaborating to transparently push transactions between them off-chain.

Lightning Network isn't even required, just simple unidirectional payment channels would allow them to amortize the transaction fees over many transactions, and be instantly confirmed.

The only tricky bit is the sender knowing when it can go off-chain. With BitPay soon requiring Payment Protocol that becomes easier [1]

1\. [https://blog.bitpay.com/payment- protocol/](https://blog.bitpay.com/payment-protocol/)

<comment><USER10> Some exchanges use Blockstream's Liquid federated sidechain to do inter- exchange settlement.

Agreed though, payment channels have been around a long time.

</comment></comment></comment></comment><comment><USER11> > we're looking to convert some of our funds to Bitcoin Cash

He's not "switching" to bcash

</comment><comment><USER12> Title is very inaccurate.</comment>


Practical TLA+ - <AUTHOR> https://www.hillelwayne.com/post/practical-tla/ <comment><USER2> It seems like this book would have a pretty limited audience since, looking at Wikipedia at least, TLA+ is primary used at big cloud providers who are writing low-level distributed systems stuff.

Can any mortals who've used TLA+ discuss their motivation for using it and the impact it had on their project? I imagine you'd have had to work in a technology-driven environment to be able to justify it to management since formal verification isn't even in the vocabulary of most ordinary development shops.

<comment><USER3> Hey, author here. While right now TLA+ is most popular with cloud and infrastructure companies, that's more because it already has a reputation there than anything. As u/bmays mentioned, at my previous job we were using it to verify device setup, vendor integrations, and business logic. We only had ten engineers in the company, but our estimates it usually cut development time by a quarter and almost entirely eliminated post-release fires. I've also heard stories from a lot of people who've learned TLA+ from my material and, while I can't give identifying details, I can provide some high-level descriptions of what they did with it:

* A few different groups verified business ETLs with it, finding corner cases which would lose or corrupt data. Similarly, I a lot of use for deployment procedures.

* A lot of people are using it for testing optimizations: write a TLA+ spec of your system, write a spec of the optimizations, and check that they have the same behavior.

* Finding bugs in microservices. I get a _ton_ of emails about this.

* Lots of specific domain problems: trading algorithms, robotics, etc.

The main benefit of TLA+ (and formal specification in general) is that it gives you a way of both writing a precise design of your system and checking the design itself for bugs. That's something so rare in mainstream programming that many people don't even know it's possible. That's why I want to make this stuff more accessible.

Does that answer your question?

<comment><USER2> Yes, very helpful, thank you! I'd like to see methods like this go mainstream. The prevalent view these days seems to be that software construction begins and ends with unit tests... I don't know how Uncle Bob and his ilk managed to drown out all of the other approaches to construction, but it's always bothered me that even lightweight approaches to verification (like Design by Contract) haven't gotten the same traction. (I suspect it's because formal verification involves more requirements gathering and design work up front, but a lot of teams short-change that because "we're doing agile!!")

Anyway, thank you for putting this out there. I took a look at your first couple of chapters on Safari and your treatment of the subject is much more approachable to me than the wall of math I encountered in Leslie Lamport's stuff.</comment></comment></comment>


Malign incompetence of the British ruling class - <AUTHOR> https://www.nytimes.com/2019/01/17/opinion/sunday/brexit-ireland-empire.html <comment><USER3> Maybe it's just me but unless I'm really blind, it seems to me that the British ruling class is doing everything it possibly can to avoid a Brexit, including sabotaging democracy, and generally grasping at straws. They're also clearly expecting to lose a lot of money in the process.

The support for cutting out the EU is very much carried by the worker class, and this seems to be done very much in open conflict with the ruling class. Even most of the conservative

<comment><USER4> I think there's probably quite a lot you're missing, which is not a criticism because there's simply so much at play with Brexit. The ruling classes, or more accurately a particular branch of it, are very much driving Brexit as they're disaster capitalists - they know it's going to cause misery to millions of people, but they stand to personally profit hugely from it. Owners of tabloid newspapers have for years been fuelling the anger that has led to the working classes backing the idea. Our newspapers regularly run stories, that are out and out false, about immigration, EU bureaucracy, migration etc. It's straight up propaganda as a long game designed to enrich a few people.

<comment><USER3> "Owners of tabloid newspapers" ... you and I have very different ideas from who and what the British ruling class are.

Might I suggest you put yourself through another test. Get a job at the local McDonalds (or a cleaner, or driver, or ...). Look at the conditions, look who takes the jobs and why. Because it will make it VERY obvious what needs to change, and why exiting the EU is seen as a viable option.

I understand why you say that Brexit won't help with that (although I do think it might make it possible to prevent things from deteriorating further). And I even agree with that assessment, you see, but at least take a look at the other side of the argument from the perspective of the other side of the argument.

<comment><USER4> It would appear we _do_ have different ideas about who the ruling classes are, I think it's those who are actually pulling the strings.

Your "get a job at McDonalds" bit reads like the same racist arguments against immigration that are largely parroted by many leave voters, a thinly veiled "foreigners are taking our jobs" - the reality is that immigration is a net benefit to the economy and this country is going to struggle without it. The NHS is already hitting problems, our universities, who rely on foreign students paying much more in fees, are seeing a potentially catastrophic decline in enrolments (anecdata). I totally understand the other side of the argument, the problem is that it's based on lies they've been fed by those who stand to profit. The groundswell of anger that brought about the leave vote was orchestrated by exactly those who I'm calling the ruling classes - <USER2> gave the disenfranchised someone to punch down at.

<comment><USER3> > the reality is that immigration is a net benefit to the economy and this > country is going to struggle without it

As I said I understand and even agree with this argument. Now find a way to make it a benefit, not a cost, to those people (most of whom are immigrants, and yes, you read that right: immigrants are mostly pro-Brexit. This will make a lot of sense once you think about it for 10 minutes), and very little of the Brexit fervor will remain.

Fact of the matter is these people want Brexit because _their_ situation won't improve due to immigration. And let's be honest. They're right.

<comment><USER4> If you don't understand how something that is a net benefit to the economy improves the lives of everyone who is a part of that economy then I'm not sure I can help you.

<comment><USER3> Spoken as a true economic academic, well, an Austrian one.

But no worries. I can help you: you have seen your house, right ? The university building ? At the front, there's a door. Walk through and don't walk through again until you've talked to 10 young people working there about their lives. Go into the country and talk to anyone. Note how rapidly anecdotal evidence builds up that seems to contradict your basic claim here ?

<comment><USER4> Oh right, you're a "what people believe is more important than facts" brexiteer, I get why it's impossible for you to see reason now.

<comment><USER3> Nope I'm very much a facts person. For low wage workers Brexit is a far better alternative to EU: less competition for low end labor means higher wages.

No Brexit will damage people higher up mostly. That's the view, and that's correct. Or a fact, if you will.

<comment><USER5> Brexit will not damage anyone higher up. If it becomes damaging, they leave for another country.

Brexit will take that option away from anyone with lower wages, however.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> > Churchill displayed in his long career a similarly imperial insouciance > toward Ireland, sending countless young Irishmen to their deaths in a > catastrophic military fiasco at Gallipoli, Turkey, during World War I and > unleashing brutal paramilitaries against Irish nationalists in 1920.

I was unaware of the Irish serving at Gallipoli so I looked it up[0] and apparently 15,000 served with 3,000 fatalities - a similar number to New Zealanders.

Interestingly there never was conscription in Ireland - it was planned later in the war but never implemented due to the crisis it created[1].

[0] [https://www.independent.ie/life/world-war-1/sea-at- gallipoli...](https://www.independent.ie/life/world-war-1/sea-at-gallipoli- ran-red-with-irish-blood-30270528.html)

[1] [https://en.wikipedia.org/wiki/Conscription_Crisis_of_1918](https://en.wikipedia.org/wiki/Conscription_Crisis_of_1918)

</comment><comment><USER7> To quote Marcus Leroux (@marcusleroux):

"I will accept being called a settler by the New York Times only if the New York Times accepts it is a settler publication. (Plantation of Ulster: 1609. Arrival of Mayflower at the conveniently-named Plymouth Rock: 1620)."

[https://twitter.com/marcusleroux/status/1085885980173832192](https://twitter.com/marcusleroux/status/1085885980173832192)

<comment><USER8> He misses the point by a mile, as do his twitter correspondents. If we're to indulge him let's ask if the staff of the "nytimes" consider themselves "American" or if they're stuck in a time warp clinging to a 1609 "British" identity that even the British no longer recognize.

</comment></comment><comment><USER9> _imposing a patently unworkable timetable of two years_

That simply isn't true - the 2 years is written into Article 50! Any PM would have faced the same timetable.

<comment><USER10> I think the point is that there was no compulsion to begin the two-year countdown before any plan was formed or a strategy agreed.

I agree that I don't think another PM would've been obviously more clear thinking. And I also think two years should've been plenty of time, if the government hadn't run the clock down quite so spectacularly. As late as October, EU negotiators were pleading with Britain to figure out what deal it wanted.

But the comparison with Mountbatten isn't invalid: the timing itself is a self-inflicted wound.

</comment></comment><comment><USER11> Related discussion from yesterday: [https://news.ycombinator.com/item?id=18935572](https://news.ycombinator.com/item?id=18935572).</comment>


OpenSSL 3.0 - <AUTHOR> https://wiki.openssl.org/index.php/OpenSSL_3.0 <comment><USER2> One of the major improvements here: this finalizes the license change to Apache 2.0, which makes OpenSSL finally GPL-compatible. That removes one of the major reasons people had to avoid it.

(Specifically, OpenSSL is now compatible with anything licensed "GPLv3", "GPLv3 or later", or "GPLv2 or later". It's not compatible with "GPLv2 only", but that's a relatively small amount of software.)

Other major improvements: TLS1.3 support, Linux kernel TLS support (hand off crypto to the kernel and then read/write as though you had a normal file descriptor and let the kernel handle the crypto), and opaque low-level structures (no more dependencies on OpenSSL internals).

<comment><USER3> Doesn't "GPLv2 or later" specifically allow you to fork into "GPLv2 only"? How can a license be incompatible with only the latter then?

<comment><USER4> IANAL, but "GPLv2 or later" allows you (the recipient of the license) to choose either GPLv2 or GPLv3 (i.e. the one that's more convenient to you) but does not allow you to prevent others (the recipients of your modified version) from having the same choice.

This goes both ways, "GPLv2 or later" cannot be changed to either GPLv2 or GPLv3 only without permission from everybody that has ever contributed to the codebase.

The FSF requires copyright attribution from cotributors, that's why they were able to switch their projects to GPLv3-only.

<comment><USER5> > "GPLv2 or later" cannot be changed to either GPLv2 or GPLv3 only without > permission...

What? Of course it can be changed to either. It literally says so in the license name.

<comment><USER6> No, it does not say such thing. "GPLv2 or later" says you are allowed to use it under GPLv2 or GPLv3 (for now). It does not allow to change it to GPL-2.0-only (to use the correct SPDX identifier).

<comment><USER5> > "GPLv2 or later" says you are allowed to use it under GPLv2 or GPLv3

I am afraid, that you are wrong. GPL does not govern usage of software at all. You don't need to agree to GPL in order to use GPL licensed software. This is literally said in text of GPL itself.

The preamble ("this program is free software...") is not part of GPL itself — it is just short informative text. And you are misremembering, what preamble says. Citing from GNU website:

> This program is free software: you can redistribute it and/or modify it > under the terms of the GNU General Public License as published by the Free > Software Foundation, either version 3 of the License, or (at your option) > any later version.

I believe, that we should erase all SPDX-whatever nonsense from Linux source code, and replace it back with proper preamble — least other users of GPL software start to misremember as well.

<comment><USER7> > You don't need to agree to GPL in order to use GPL licensed software.

I've wondered for some time how a user is granted permission to use GPL- licensed software; permission is not explicitly granted by the GPL, but it is required so that the user can copy the software to their computer, and into memory for it to be executed, is it not?

(I am aware that the answer will vary by jurisdiction)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > OpenSSL versions with the same major number are API and ABI compatible

Finally!

> A proper HTTP(S) client in libcrypto supporting GET and POST, redirection, > plain and ASN.1-encoded contents, proxies, and timeouts

Is this really necessary? If you want a 'real' http client, you're probably using libcurl anyway (which is permissively licensed, more stable, and supports http/3).

<comment><USER2> > Is this really necessary? If you want a 'real' http client, you're probably > using libcurl anyway (which is permissively licensed, more stable, and > supports http/3).

I'd guess it's there to support cryptographic protocols that require downloading/checking keys via HTTPS. Right before that line is "Implementation of the Certificate Management Protocol (CMP, RFC 4210) also covering CRMF (RFC 4211) and HTTP transfer (RFC 6712)".

And yes, use curl.

</comment></comment><comment><USER9> I don't have much familiarity with OpenSSL and crypto scares me away from reading the sources. I wish someone could give a full run-down of everything that is in OpenSSL, an overview. You hear all the time about it being bloated and supporting too many things. I wish I better understood that. It's why people turn to wolfssl and mbedtls, right?

Smaller projects that aim for minimalism and robustness probably suffer from a lack of peer review with a more niche community backing them. Trade-offs trade-offs. I also wish I understood where they compete:

OpenSSL <-> WolfSSL <-> mbedtls

<comment><USER10> > It's why people turn to wolfssl and mbedtls, right?

I tried to use a single algorithm from OpenSSL for an embedded project and seems like it needs hacking for all the dependencies to be met. I gave up. With mbedTLS it was done within a minute (simpler to build and read IMO).

There aren't many differences between mbedTLS and WolfSSL. Both are small libraries designed for embedded use. The latter supports TLS 1.3.

Today OpenSSL probably has the best support for hardware acceleration and secure elements.

<comment><USER9> I had not considered that it may have support for hardware accelerated crypto.

</comment></comment></comment><comment><USER11> There's simply no way anybody will confuse OpenSSL 3.0, SSL 3, and TLS 1.3 :-)

<comment><USER12> I'm confused as to why they didn't skip a version release; for clarity's sake.

<comment><USER13> There was a proposal, which was declined: [https://github.com/openssl/openssl/pull/8367](https://github.com/openssl/openssl/pull/8367)

</comment></comment></comment><comment><USER14> Reading chapter 3, upgrading from 1.1.1, it seems strange for a security library to promote ignoring and even suppresing warnings. The best option, upgrading, is mentioned last.

I would prefer my security libraries to scream bloody murder if I am using them in a deprecated way.

<comment><USER15> "Deprecated" need not mean "insecure".

<comment><USER14> Are you willing to take the risk? Deprecated might mean: There are known weaknesses. Or: Less reviewed code path.

<comment><USER16> It's mostly about deprecating old APIs where a newer more general API is available, sometimes for more than 10 years.

</comment></comment></comment></comment><comment><USER17> As important as openssl is for many projects I find the engineering quality of it to be lackluster. My project is still on an older version and I wanted to upgrade. I tried to build approximately 7 versions for windows using msvs 2017 and msvs 2019. None even build but fail with compiler errors or linker errors!

On Linux if I go to system provided 1.2.x openssl version and try to build against that my code breaks with thousands of mysterious errors about undefined types (in openssl headers).

I mean Openssl solves a big problem but from engineering perspective the library is one giant problem. And I haven't even remarked on the horrible API design yet.

<comment><USER18> I've mixed opinions over the recent breakages I've witnessed in OpenSSL.

On one hand, I absolutely hate a library which breaks its API (I think lack of stability in interfaces is one of the bigger bane of the software industry and causes numerous issues down the line).

But in the specific case with OpenSSL, the breakages are legitimate imho. Most of the breakages I have seen are to clean-up interfaces and have a clear boundary between OpenSSL internals and items controlled by third party apps.

Concretely, they are switching from an API which exposed the internal structures directly to a getter/setter pattern.

Example in from one of my project:

old:

      ts_response->tst_info->serial

new:

      TS_TST_INFO_get_serial(TS_RESP_get_tst_info(ts_response))

Breaking APIs is always a balancing act, it's not something which must happen willy-nilly, but it's sometimes a necessary evil, and in the specific case of OpenSSL, if the project wants to go forward and improve in quality and stability, they are kind of forced to do it, it's just a bit regrettable that better design decisions had not be made from the start.

<comment><USER17> I'm not even talking about clear cut API breakage. I'm talking about that if I do #include <openssl.h> and build against the 1.2.x system installed OpenSSL I will get thousands of errors from headers internal to OpenSSL.

<comment><USER19> There's no such thing as OpenSSL 1.2

2018-09-11: 1.1.1-> 1.1.2

[https://github.com/openssl/openssl/commit/a4a90a8a3bdcb9336b...](https://github.com/openssl/openssl/commit/a4a90a8a3bdcb9336b5c9c15da419e99a87bc6ed)

2018-09-27: 1.1.2 -> 3.0.0

[https://github.com/openssl/openssl/commit/3a63dbef15b62b121c...](https://github.com/openssl/openssl/commit/3a63dbef15b62b121c5df8762f8cb915fb06b27a)

There weren't any releases numbered 1.1.2

<comment><USER17> Sorry you're right I mixed up the version numbers. It was 1.1.x that I wanted to upgrade to from 1.0.x

</comment></comment></comment></comment></comment><comment><USER20> Obvious question that it don't see answered on the page: why not 2.0?

<comment><USER21> [https://www.openssl.org/blog/blog/2018/11/28/version/](https://www.openssl.org/blog/blog/2018/11/28/version/)

They want to use the same version numbers for OpenSSL and a FIPS module, and the FIPS module was already versioned at 2.X.X.

</comment></comment><comment><USER22> > _1.7 Versioning Scheme_

> _The OpenSSL versioning scheme has changed with the 3.0 release. The new > versioning scheme has this format:_

> _MAJOR.MINOR.PATCH_

Yay. OpenSSL finally switches to semantic versioning. \o/

<comment><USER23> That isn't semver

<comment><USER22> What do you mean? According to [https://semver.org/](https://semver.org/):

> _Given a version number MAJOR.MINOR.PATCH, increment the:_

> _MAJOR version when you make incompatible API changes,_ > _MINOR version > when you add functionality in a backwards compatible manner, and_ > _PATCH > version when you make backwards compatible bug fixes._

> _Additional labels for pre-release and build metadata are available as > extensions to the MAJOR.MINOR.PATCH format._

Seems like semantic versioning to me! At least the major, minor, and patch will mean something now.

<comment><USER23> SemVer is a spec. In the same way that people for some reason think that Terraform is SemVer just because it LOOKS like it even though nothing actually claims that they are using SemVer [https://github.com/hashicorp/terraform/issues/15839](https://github.com/hashicorp/terraform/issues/15839)

The only thing that OpenSSL claims to enforce about their versioning policy is

> A change in the second (MINOR) number indicates that new features may have > been added. OpenSSL versions with the same major number are API and ABI > compatible. If the major number changes then API and ABI compatibility is > not guaranteed.

</comment></comment></comment></comment><comment><USER24> I worry that this is going to break so many programs and scripts in the same way that the switch from Linux 2.6 did..

<comment><USER25> That already happened once with OpenSSL 1.1 which also wasn't really backwards compatible.

It was messy then, it will be messy now, though when you took the 1.1 opportunity to modernize your code to current best-practice as requested by the library rather than just fixing the minimum, you might be pretty ok this time around

<comment><USER24> You know, I think it was a deep memory of the switch off of 0.9.8 that gave me the initial thought without realizing. Maybe the older programs will be more prepared after all. Although I hope they weren't expecting a single-digit increment..

</comment></comment></comment><comment><USER26> Pity that the bits required for QUIC didn't make the cut: [https://github.com/openssl/openssl/pull/8797](https://github.com/openssl/openssl/pull/8797)</comment>


Arrest made in the "clever" Craigslist robbery - <AUTHOR> http://www.theage.com.au/news/technology/web/dna-trail-leads-police-to-craigslist-bandit/2008/11/07/1225561116126.html

<comment><AUTHOR> The original story: <http://news.ycombinator.com/item?id=322055></comment>


Steve Blank's Secret History of Silicon Valley - <AUTHOR> http://blog.pmarca.com/2008/01/steve-blanks-se.html <comment><USER2> someone recently said wars create wealth. i think the statistic of 40,000 allied planes destroyed in WWII, while the present day commercial fleet is only 15,000 planes, is a pretty good refutation. it gives a sense of the scale of how much was destroyed.</comment>