Http-server, a simple zero-configuration command line http server - <AUTHOR> https://github.com/nodejitsu/http-server

<comment><USER2> Have a look at gatling <http://www.fefe.de/gatling/> it's a http/ftp/smb server based on libowfat (-lowfat ;0) with ssl support. Contains basically everything you need to share a file. It is also quite scalable, see <http://bulk.fefe.de/scalability/> for an old benchmark.

One neat feature is that gatling disables the autoindex links for sorting the listing if wget is used to download/mirror a directory.

Gatling has a pretty good default configuration like automatically try to bound port 80 and if not available use port 8000 instead, automatically sharing the current directory etc. For a list of command-line configuration options have a look at <http://paste.pocoo.org/show/409206/>

</comment><comment><USER3> I built a simple zero-configuration FTP server that runs in a browser some time ago (<http://ezyftpserver.com/>). Been wondering if I should do the same with a HTTP server?

<comment><USER2> Nice idea, jftr opera already offers an http server inside your browser, it is called unite, see <http://en.wikipedia.org/wiki/Opera_(web_browser)#Opera_Unite>

I just had a look at your page and it seems you used java for providing the ftp server. How do you handle devices behind firewalls/NAT?

<comment><USER3> I don't. :-) It's Apache FTP server wrapped in an applet.

</comment></comment></comment><comment><USER4> python -m SimpleHTTPServer

<comment><AUTHOR> python -m SimpleHTTPServer cannot be configured from the command line. You'll need to write an additional py script to do anything useful. It's also missing a bunch of features you are going to want, like AutoIndex.

It also cannot serve 6,000 requests per second out of the box.

<comment><USER5> I did a `npm install http-server`.

It threw me a module not found error twice - once for `eyes` and once for `colors`

I ran it on a directory and tested it with `ab -n 100 -c 5 localhost:8080/`.

        Concurrency Level:      5
        Time taken for tests:   0.046 seconds
        Complete requests:      100
        Failed requests:        0
        Write errors:           0
        Total transferred:      175900 bytes
        HTML transferred:       149900 bytes
        Requests per second:    2159.97 [#/sec] (mean)
        Time per request:       2.315 [ms] (mean)
        Time per request:       0.463 [ms] (mean, across all concurrent requests)
        Transfer rate:          3710.33 [Kbytes/sec] received

So, in my micro benchmark, it doesn't do 6000 request/second on my box.

EDIT: `ab -n 15000 -c 5 localhost:8080/` is about 3000 req/s on my machine for http-server; 2200 for SimpleHTTPServer.

`python - SimpleHTTPServer 8080` gave me 1800 requests/second.

As far as configuration goes, for a dev server(that's what both SimpleHTTPServer and http-server are for me), the only configurations I do is to change the port.

Also, it's not like http-server is a highly configurable http server and framework combined into one - I for one can live without auto-index on/off.

<comment><USER6> Sorry about that. Bumped to v0.1.1 and published to npm.

Should fix [dist] issues. I have a feeling you need to update your npm to version 1.0 as well.

</comment></comment></comment></comment><comment><USER7> Looks nice, I was looking for something similar the other day, easily sharing a directory over HTTP from command line. I ended up writing a couple of very simple bash functions that added/removed the current directory to ~/Sites (I'm on a Mac). Apache did the rest.

</comment><comment><USER8> _sigh_

Not another "Download this shell script over insecure HTTP and pipe it to sh" gimmick. Really? While <http://news.ycombinator.com/item?id=2661209> is _directly_ above this item on the front page?

Have we learned nothing?

<comment><USER9> Like the documentation clearly states, there is nothing stopping you from:

         git clone git://github.com/nodejitsu/http-server.git
         cd http-server
         node bin/http-server

The curl installation is for npm, the node package manager, which is actually optional to use http-server

</comment></comment><comment><USER10> Nice work guys, any gzip support for js, css, and static html?

</comment><comment><USER11> Node.js. lol.

</comment><comment><USER12> hey people, check out Lightnode

<http://www.ngspinners.com/lightnode/>

<https://github.com/ngspinners/lightnode/></comment>


Joey Hess' minimal approach - <AUTHOR> http://joey.hess.usesthis.com/ <comment><USER2> It's great to be reminded that productivity doesn't really depend as much on the tools you use as some might have you believe.

I keep thinking about buying a faster laptop, or I'm complaining that getting fiber is way to expensive where I live, and then I read about someone on an ancient tiny netbook on dialup who is probably way more productive than I am.

<comment><USER3> > I read about someone on an ancient tiny netbook on dialup who is probably > way more productive than I am.

And you're not him. It doesn't matter how productive _he_ is on "an ancient tiny netbook on dialup", it matters how productive _you_ would be on it.

Getting a faster laptop or fiber is a simple matter of weighing the costs against the benefits _for you_. If it increases _your_ productivity enough to outweigh the costs, then you should get it.

<comment><USER4> I read that as more of a reflection on the necessity of things. It's possible fiber would be an improvement for jakobe, of course, but perhaps only a local maximum. "This guy does without it - maybe the lack of fiber isn't the biggest thing holding me back."

</comment></comment></comment><comment><USER5> "If it doesn't have a keyboard, I feel that my thoughts are being forced out through a straw."

Beautiful.

<comment><USER6> Yeah. Says the guy doing all his work on a 1024 x 600 display. I mean the guy no harm, but so much of what he says strikes me as incredibly back-worldly. Like using dial-up and limiting yourself to fan-less laptops. I mean I get the "thin terminal" philosophy where you have a shit laptop that connects to something much more potent. But where's the point if the connection sucks as well.

I guess in the end we have vastly different use cases, which is perfectly fine. I found it a quite interesting, if a little obscure, article to read.

<comment><USER7> I hate to pull this card on you, but what have you done? We're talking about a Debian developer who has also developed (and continues to develop) basically an open-source replacement for Dropbox ([http://www.kickstarter.com/projects/joeyh/git-annex- assistan...](http://www.kickstarter.com/projects/joeyh/git-annex-assistant- like-dropbox-but-with-your-own)), by himself on an incredible budget. He actually Gets Shit Done, and does it relatively efficiently. I would not be surprised at all if a factor towards being productive is the fact that his daily Internet connection doesn't support browsing Facebook. And when you are a creator rather than a consumer (especially of the written word, be it code, essays or books), screen size rarely matters.

<comment><USER8> > And when you are a creator rather than a consumer (especially of the written > word, be it code, essays or books), screen size rarely matters.

I don't necessarily agree with the parent post's sentiments, but I also disagree with this very broad blanket statement of yours. I am reasonably happy most of the time on my Macbook Air screen, but I definitely prefer to be coding on a larger screen when I can. I knew Joey back in college and he is a sharp guy with a LOT of working memory. My memory has gotten worse over time, and I tend to work with heterogenous codebases, so I can't fit everything in my head and need the screen real estate.

I know many excellent, productive devs who love having large screens to code on.

<comment><USER9> You sure you knew the same guy? My working memory is crap, and, presumably, getting worse. ;)

I find that functional programming really cuts down on the amount of mental state I need to maintain. So while I'll have some API docs and another module or two open for reference, I don't need to worry about what that variable gets set to two pages above.

Maybe avoiding that kind of unnecessary detail makes one's unconscious better able to work on the program too. Still learning about this: <http://joeyh.name/blog/entry/on_not_coding_late/>

<comment><USER8> Yes Joey, though I'm not sure if you still remember me - We co-founded CSLUG back in 1995. :-) I was a lowly freshman happy to get to geek out on Linux with CS folks. (Not many Physics people were really into it then.)

<comment><USER9> Ah, see, I can remeber your full name, Peter .. just had trouble getting there from the HN username. :)

As I recall, you were the secretary of CSLUG.. Indeed, querying my external memory for your posts, I find meeting minutes you posted that bring back memories. Nice :)

Nice to hear from you!

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> More on Hess' minimal lifestyle: <http://joeyh.name/blog/entry/notes_for_a_caretaker/>

I could have sworn this was a submission at some point, but I can't find it.

<comment><USER11> It might of been linked in the comments when his kickstarter was linked? That's when I remember reading it last.

</comment></comment><comment><USER12> > When power is low, I often hack in the evenings by lantern light.

The combination of forward-thinking hi-tech and rustic low-tech makes this feel like something out of science fiction. I picture him as a character in a Stephenson novel: a hermit hacker, off the grid, queuing up data and pulsing it out only when the cells are charged and the skies are clear.

Pretty awesome :)

</comment><comment><USER13> Regarding all the comments here about dial-up and slow connections whether out of preference or necessity, I can't recommend enough having a slow connection and a data limit for helping you concentrate on the things that are most important to you, but take the most effort to think about or to do. I use a three mobile 3g dongle (UK) and pay £10 a month for 1GB of downloads. I use wget to crawl and download web pages to view offline. I've been doing this for over a year now and it's great for avoiding the huge potential distractions of broadband, torrents for example, being amongst the worst offenders (have you ever downloaded a 100 computer science textbooks and never got round to any of them because you were watching a whole season of star trek: next generation? It's kind of ridiculous.)

</comment><comment><USER14> Mmmm.... "What would be your dream setup? I dream of a ARM-based netbook with exceptionally good battery life, an E-ink display, and fully open and non- proprietary hardware. I've put off upgrading for years since this seems such an obvious thing for the market to produce, but the market is fascinated with locked-down tablets instead."

<comment><USER15> While that device does sound nice to have around, I disagree with the notion that it seems such an obvious thing for the market to produce. It would have very little market appeal outside of the development community in my opinion.

</comment></comment><comment><USER16> I love this setup. After the new ARM chromebook came out I got all excited and looked about for a way to dual boot a full OS on my old series 5. It turns out it's easy now ([http://chromeos- cr48.blogspot.co.uk/2012/04/chrubuntu-1204-n...](http://chromeos- cr48.blogspot.co.uk/2012/04/chrubuntu-1204-now-with-double-bits.html)) There is a lot of pleasure in using such a small machine.

I am definitely looking forward to an e-ink laptop. As I get older my eyes grow more weary, but the e-ink display on my kindle is a joy to look at.

<comment><USER17> My main gripe with chromebooks is that they don't have a _windows key_ (KEY_LEFTMETA). As a xmonad user, I have quite a lot of functionality bound to that key and I'm not too sure about moving it over to KEY_LEFTALT (mostly because of conflicts with my Emacs key bindings).

<comment><USER16> Have you tried overloading the search key (used to be caps lock). This key is roughly useless outside chromeos (and I never used it inside chromeos anyway). I am planning to bind that key to my windows-key when I get home tonight so I can use the keyboard to get at my Unity launcher.

As an aside, I was very impressed how well Unity runs on relatively anaemic hardware. for running a terminal and a web browser it runs great.

<comment><USER17> That's a reasonable alternative and something that one could get used to. After all, Vim and Emacs people have been rebinding _Caps Lock_ to _Esc_ / _Ctrl_ for a long time. One possible downside is the extra strain that this would put on the pinky.

An alternative that I've been wondering about is key sequences (M x) for WM actions and key chords (M-x) for all other things. This seems possible to do in xmonad (last point in this blog post [1])

[1] <http://versia.com/2009/10/xmonad-metacity-gnome/>

</comment></comment></comment></comment><comment><USER18> "I don't use a desk. I work in five or six different places and postures around the house. When the weather's good, I'm outside, or on the porch. My preferred "desktop background" is some interesting view in back of my netbook's rather small screen."

This is such a liberating setup. I'm rethinking my need for a home office now.

<comment><USER3> > This is such a liberating setup.

Yeah, it's "liberating" until you develop chronic back and shoulder pain later in life.

<comment><USER19> Observing your body and changing positions whenever they become uncomfortable is _far_ better for your long-term health than is a well-engineered chair.

I now rotate between a standing desk, a normal desk, a couch (only when reading/exploring - typing here is tougher), and the floor, and all of my back problems have disappeared.

<comment><USER20> Pilates is great for developing that sense of individual muscle fatigue and for strengthening the muscles that will hold you in proper form.

</comment></comment></comment></comment><comment><USER21> _> Lately I've been focusing on programs that encourage broader use of version control systems, like git. The goal is to harness all the power that's been developed by developers for developers for managing source code, and redirect it to other purposes._

This is very interesting, especially his Kickstarter project[1]. I've always wondered how distributed revision control systems could be used in other domains.

[1] - [http://www.kickstarter.com/projects/joeyh/git-annex- assistan...](http://www.kickstarter.com/projects/joeyh/git-annex-assistant- like-dropbox-but-with-your-own/)

</comment><comment><USER22> > I use the XFCE desktop environment, with the Xmonad window manager.

I was just going to try that in my xfce, what a coincidence. In case anyone is interested, here's the instruction [http://www.haskell.org/haskellwiki/Xmonad/Using_xmonad_in_XF...](http://www.haskell.org/haskellwiki/Xmonad/Using_xmonad_in_XFCE#Configuring_XMonad_to_work_with_Xfce)

<comment><USER23> You can accomplish tiling installing x-tile in Xfce.

<comment><USER22> didn't know about that, looks like a much simpler solution. do you use it? will try out, thanks.

</comment></comment></comment><comment><USER24> Let's make a petition for someone to produce this e-ink open arm laptop. I'd buy one immediately.

<comment><USER25> My understanding is that the big issue is that e-Ink displays have a miserably slow pixel update time. The new Kindle Paperwhite is on the order of 450ms whereas the average LCD display is in the single digit ms range. Great for static text, but horrid for anything real-time.

<comment><USER24> I should have mentioned that I'd be using text-mode mostly. With my keyboard refresh rate (25key/sec) => 40ms max per redraw. That's .. quite far. If you look at this old kindle refresh rate, used as a terminal screen for a raspberry pi, it's almost usable : <http://www.ponnuki.net/2012/09/kindleberry-pi/>

I wonder how it would be on a newer eink screen.

<comment><USER24> Another video: vim on eink

<http://www.youtube.com/watch?v=FdmX52SCpG0>

not glorious.

</comment></comment></comment></comment><comment><USER26> "The only other active computer in the house is my home server and internet gateway; a Sheevaplug with a wireless dongle and a dialup modem."

Everything else maybe... but I could never go back to dialup!

<comment><USER27> A dial-in might be useful though.

</comment></comment><comment><USER28> I've never been to usesthis.com before. What a wonderful website! I would love to see more interviews like this.

<comment><USER29> I like the idea of usesthis. But I'm a bit disappointed that most setups are boring and not really individualized. This makes a lot of the interviews uninteresting if you don't know (care for) the developer. "Spoiler:" 2/3 seem to be using a Mac Book and a fairly common configuration. Please don't misunderstand me. There is absolutely nothing wrong with that configuration. But it's not very interesting to read about.

I think Joey Hess is a major exception here because he has a very individual and interesting setup. Stallman, Russ Cox and _why are a few other interesting setups iirc.

<comment><USER30> Yeah, I'm always trying to get interesting people, but I never know ahead of time what they use. Feel free to suggest more, though!

<comment><USER28> Actually, while I still very much like the idea of the site, I think I spoke too soon...it's very much focused on the hardware and software used, whereas I thought it was interviews with people in general from all walks of creative/hacker/writing/painting life about their workflow and how they get stuff done. More of these types of interviews would interest me.

</comment></comment></comment></comment><comment><USER31> Interesting, but not totally unexpected as this is very much in the tradition of Unix terminal users. Never mind that today's "dumb terminal" is probably an order of magnitude more powerful than yesterdays mainframes, and you can fall back to even bigger servers without many problems.

But I'm always a bit surprised by small-screen laptop-only users, whether it's this rather charming off-the-grid kind or your average Macbook Air coffee shop inhabitant. I like my mechanical keyboards, large displays (area, not dpi) and desk-bound isolation. Never mind that laptops introduce quite a few technical problems (heat, upgrades, computing power) that are easily avoided by your cheap mini tower.

And I guess that's at least one minor way in which I've succeeded over distraction without even trying: I don't have a big need to mix my programming/writing/browsing with outdoorsy and/or (real-life) social elements. I wonder whether the rather common preference of landscape background pictures (e.g. Napa valley) is part of that desire.

<comment><USER32> 5 months ago I transitioned from being a desktop C# app developer for medical devices to a Rails remote contractor.

This meant going from a dual quad core 3.33 extreme desktop machine with 3 displays (2 x 24 and 1 21) to an 11" Macbook Air with a 1.7 dual i5.

I'm much faster on the air. I have a tiling setup that I can quickly switch/move windows around, it keeps my vision and neck focused and reduces strain to both. It allows me to better mentally focus on what I'm currently working on, instead of having my IDE, source control, collab tool, bug tracker, etc, always visible at the same time. I'd rather do a couple quick chord commands than snap my neck 30 degrees one way for 15 seconds seconds then snap it back in the other direction.

As to heat/power? Spectacular with my MBA, this thing is as fast as last year's Macbook Pro and the iMac the year before. I've been writing software professionally since '96 and at least in the windows world, the tools have not changed a whole lot in that time period. The only advantage of a faster machine is faster compiles and db rebuilds/queries. And I'm not doing that enterprise level work of 300k+ code bases and 5 gig databases anywhere. But I did 15 years ago, and yeah, now something that would used to take over an hour might take 2 minutes. On my MBA is might take 5 minutes. For something I'd do a handful of times a day, not a big deal, but again, I don't do those types of things anymore.

Don't get me wrong. I'd appreciate more resolution. But probably more inclined to use that for extra clarity rather than increase my desktop space by a significant degree. There's a sweet spot where bad habits begin to creep back in, where just too much info is presented at one time that cognitive overload begins to set in. Just my personal experience, but I've had both setups and the latter works much better for me.

<comment><USER16> I have had a similar experience. I am a professional Java developer, which means 1G Eclipse + 1mm LOC projects. And started hacking on Go in my spare time. The difference is phenomenal. I can use a full screen terminal with vim + another screen with a browser. This is paradise.

All my tools respond instantly (with a big enough project eclipse stutters on every interaction, even with an i7 + 16G of ram). And I can code happily on my monster quad core or my hacked up chromebook. This is flexibility.

Like brandall10 I found that the difference in focus is enormous. I haven't connected with my code like this for years. In a modern IDE everything moves, every twitch of the mouse brings up some overstuffed menu or brings up some javadoc summary of somesuch. It is an environment of constant distraction.

My terminal is like a warm summer's morning. Clear skies and not a soul to disturb you.

<comment><USER33> I lived in Emacs + Ruby/Python/Perl for most of 1998-2008 and I've recently been forced into IDEs to do mobile development in Obj-C and Java.

And I'm loving it. I never had this much visibility into my code or anything close to the refactoring power (especially in Java). Maybe things go south with 1mm LOC projects but those are no picnic in Emacs either. I've gotten so addicted to the benefits of a good IDE that I think I'll take a serious look at Rubymine if I ever go back to doing Rails again.

</comment></comment></comment></comment><comment><USER34> It sounds like the new Chromebook is a pretty good solution for him. Or maybe wait a year more for the next-gen one, which hopefully will have a 4 cell battery.

<comment><USER35> I've been looking for a replacement for my Mini 9 and this seems to be about the only thing out there. Microsoft sure has strong armed everyone to make things with regular HDDs because they needed to run Windows... I actually went into Microcenter last year looking for a SSD netbook, and they practically chased me out of the store, and added $50 to everything that wasn't Windows (which they didn't have the prices on anyway). Does anyone know of a company that has Netbooks without Windows on them at a $250 price point? Dell's Linux pages are non-existent. I can't believe that something I bought in 2008 is now double the price.

<comment><USER16> I have been searching for this laptop too. The only solution I found was to dual boot my chromebook. Works beautifully and the hardware is cheap for what it brings to the table.

</comment></comment></comment><comment><USER36> For reference - <http://news.ycombinator.com/user?id=joeyh>

</comment><comment><USER37> I know for myself at least, upgrading to newer hardware is mostly a big distraction from work or whatever it is I probably should be spending time on. That said, I had a mini9 for a few weeks and typing on that tiny keyboard was pretty painful, so props to Joey for sticking with it.

If Joey is reading this... It sounds like you are living in a remote place. It'd be cool to see a more detailed blog post with pictures. Also as someone who has lived with a flaky dialup connection for a long time recently, I can highly recommend mosh. Setup irssi+bitlbee on a server running under tmux. Then connect with mosh and attach to tmux. This way you get reliable chat and irssi should set the important flag for the window, giving you notifications of new messages too. You can also configure irssi to mark you as away when you disconnect.

</comment><comment><USER38> I love his minimalism. He loves hacking but he hates devices. He lives in the most _natural_ milieu he can construct.

"I mean the guy no harm, but so much of what he says strikes me as incredibly back-worldly."

No. He approach is incredible modern.

There's some Jobs-ian about it. Steve Jobs ultimately hated devices, because a device embodies the barrier between you and the effect you need. That is why Jobs strove to make devices as _small_ , _unobtrusive_ , and _natural_ as possible.

(I just started purchasing Apple, and have thus only recently began mulling about Steve Jobs's vision.)

</comment><comment><USER39> big respect to this guy and he seems to make awesome software. But using a 5 year old netbook with very low resolution and 2gigs of ram, no external Screen and dialup modems for internet doesnt seem like a very productive working enviroment...but if it works for him, why not, but this is clearly is too minimal for my taste ;)

<comment><USER40> It is just random thoughts, but may be this very limited setup helps to think through software he develop more which probably results in better software overall.

<comment><USER41> I probably enjoy using whatever he writes, because it doesn't assume the latest hot.

</comment></comment></comment><comment><USER42> "I dream of a ARM-based netbook with exceptionally good battery life, an E-ink display"

</comment><comment><USER43> Did I miss this in the article, but whereabouts does Joey actually live?

<comment><USER44> whois branchable.com says:

      zipcode: 37620
      city: Bristol
      state: Tennessee
      country: United States of America

</comment></comment><comment><USER45> "I've used nothing else since 1996."

Wow, that's impressive but I'm not sure I'd be proud of not "using" any other Operating System than my favourite for 16 years.

<comment><USER46> It's a handy way of ensuring that your time spent dicking about is minimized. I used nothing but Windows from 1999 until mid-2010 (and I used MS-DOS as well between 1993 and 1999). Windows 3.x was horrid, Windows '9x was horrid, and Windows 2000 and following have their disadvantages, but there's a lot to be said for never having to relearn any of the basics. I used only Windows XP from 2002 (or 2003?) until 2010, which made things even more convenient.

Some people seem to like shaking things up every few years, but I'm not one of them - it just takes time away from doing what I consider more interesting stuff.

<comment><USER47> I stopped using linux and started using osx because linux always involved way too much dicking around by it's nature.

<comment><USER48> Same here. A person who knows how to program and who are easily annoyed by things like inconsistent computer behavior or lack of design aesthetics should probably avoid Linux if their interest in an OS is to help them be productive.

<comment><USER49> I find Linux to be extremely consistent; almost all programs I use read data from stdin, process it according to some arguments and output the result to stdout ;)

<comment><USER48> In all seriousness, the non-GUI parts of Linux are more consistent than the GUI parts IMHO.</comment></comment></comment></comment></comment></comment>


13brane.net – the best OSS license for interview tests ever - <AUTHOR> https://13brane.net/rants/holidazed-cavalcade-2018-day-0/ <comment><AUTHOR> About halfway down - a license to release your code under specifically aimed at the interviewing company - gotta love it. Might just try it out :-)</comment>


Porting Go to Linux on IBM Z Architecture - <AUTHOR> https://groups.google.com/forum/#!topic/golang-dev/y-mlM-XYysk <comment><USER2> IBM has been recently promoting Docker on z. IBM argues the high I/O capabilities of their platform are a good fit for the container model. (I don't disagree with them. The many-application-on-big-hardware model is not a new concept to IBM. Hell, they invented it.)

Anyways... Since Docker is written in Go, the only way Docker has been available for s390x was by building with gccgo. My guess is that native Go support is in the interest of Docker on z and would be a worthwhile investment for IBM.

<comment><USER3> > Docker on z.

Docker on Linux on VM on LPARs on z.

Nobody say it...

<comment><USER4> More likely Docker on Linux on LPAR. At that point you'd struggle to see the value of VM, other than making some of the device management/maintenance easier.

</comment></comment></comment><comment><USER5> Pascal once ran on IBM nainframes for an easy to learn, read, and compile solution. Go is latest in Wirth philosophy of languages. Good it's going on mainframe, too.

Even better is that it's often used for I/O intensive (eg networking) applications. Mainframes' Channel I/O blows traditional server architecture away in throughput. Should give a boost.

<comment><USER6> Go is a Wirth language? Do you have a source for that?

<comment><USER5> I said "Wirth philosophy." It's his style of a language in action but invented by others. Greisemer had enjoyed the simplicity and productivity of Wirth's Oberon language at a point in the past. He wanted to re-create and expand on that in their C++ replacement. Source is below:

[https://sourcegraph.com/blog/live/gophercon2015/123645585015](https://sourcegraph.com/blog/live/gophercon2015/123645585015)

<comment><USER6> Yes, I got that. Thanks for the link!

</comment></comment></comment></comment><comment><USER7> > IBM Linux on Z Open Source Ecosystem Center of Competency

Man, what a name for a group!

<comment><USER8> I enjoy SAP Center of Excellence

> Going live with SAP enterprise applications is only the end of the > beginning. In order to thrive after go-live, you need the right organization > to drive continuous business improvement.

[http://michaeldoane.com/SAP_Center_of_Excellence.html](http://michaeldoane.com/SAP_Center_of_Excellence.html)

</comment></comment><comment><USER9> They also created a native OCaml backend for IBM Z very recently: [https://github.com/ocaml/ocaml/pull/275](https://github.com/ocaml/ocaml/pull/275)

</comment><comment><USER10> What is Z exactly if I may naively ask? I've heard it's name but I'm not familiar.

<comment><USER11> CPU architecture of contemporary IBM mainframes. The 64-bit successor to the 24-bit/31-bit IBM System 360/370/390.

</comment></comment><comment> ju-st IBM is really trying to make the mainframe "cool"

<comment><USER12> since when is the mainframe not cool?

<comment> ju-st hip or trendy would have been better words (instead of cool) in my original post I think

<comment><USER13> Won't happen and thank god too. The hip and trendy crowd have no idea how to do long term support. JavaEE is the farthest from "hip and trendy" but you can fire up a 15 year old WebSphere application on brand new hardware and it'll work better than the day it was written, with full first-party support for every component that was supported from day one. I've seen production code REXX and JCL code from the 1970s which ran System/360 hardware with actual decades of uptime since the IBM mainframe was 100% redundant (literally every component from the DASD to the RAM and CPUs, which all supported hot- swappability for upgrades and failover, all within a 42U). It boggles my mind at how robustly these systems were designed. I.e., the original 360 code was based on a weird-ass 31-bit architecture. Now z/10's can run in 64 bit mode, 32 bit, 31 bit[1], or 16 bits with full support for every single application written from (theoretically 1964, but I've only seen code from the 70s still running) all the way up to Clojure and Scala if you want it.

Take a look at all those hip Ruby frameworks and look at when Yehuda Katz last made a commit to Merb and you'll figure out why CIOs still buy SAP and pay for Oracle. IBM is lucky not to deal with the 'hip and trendy' demographic- it'd just further damage their already faltering image in the corporate world.

The real market share they should be trying to pickup is not the frivolous Web 3.0ish junk. They instead should be pushing out a POWER8 + DB2 + fault- tolerant (i.e., milliseconds failover, not seconds) for under 250k with an ERP attached to it (partner with SAP Business One, 98% of the businesses doing under 250MM in gross per annum don't need more htan that). AIX 7 already has "Cluster-aware" software that does this, they just need to include it by default for up to 4U. THEN, start price gouging. Market it under the name "NEVER/down", partner with PureStorage or one of the new "EMC-killers", and aggressively market it like they did during the Watson hype (tennis ad-buys, advertising at LeMons, etc).

[1] [https://en.wikipedia.org/wiki/IBM_ESA/390](https://en.wikipedia.org/wiki/IBM_ESA/390)

<comment><USER4> > you can fire up a 15 year old WebSphere application on brand new hardware > and it'll work better than the day it was written, with full first-party > support for every component that was supported from day one.

Spoken like someone who has never tried picking up code that worked fine on WAS 6.1 and tried running it on 8.5.

<comment><USER13> Actually, I had to do that very recently. The difference between IBM and Ruby was I called in with my client's license information and within 20 minutes my IBM id had access to a WAS 6.x download. My client upgraded all their hardware (this was from old iSeries AIX to a new POWER setup) and had zero-downtime after completing the transition. The only difference was a significant increase in speed. WAS 6 still is being actively supported and hot-patched for security which is what my clients want.

You're right though - moving up major releases can break things sometimes. I spent another couple of months forward-porting to Liberty so they could run 8.x but honestly most of the breaks I dealt with was dealing with third-party functionality that the old off-shore team decided to throw in. Regardless, during that period of time, my clients business was fully operational on that new hardware with a secure, seamless transition.

I guess you sort of get the same 'future proofing' these days with VMware (the analog is basically: having old hardware, then buying new hardware and vMotioning your production instance to the new VMware ESX cluster), but you certainly didn't have that option 15 years ago, when my client was choosing what environment to run his oil/commodities firm. And that's just support on the hardware stack, rather than the 10+ year support that most businesses want as a guarantee.</comment></comment></comment></comment></comment></comment>


World Wide Mush: How the Internet has gone off course - <AUTHOR> http://online.wsj.com/article/SB10001424052748703481004574646402192953052.html

<comment><USER2> _I don't want our young people aggregated, even by a benevolent social- networking site. I want them to develop as fierce individuals, and to earn their living doing exactly that._

I totally agree. In fact, my personal website reflects this: <http://www.numair.com>

On another note, I think the destruction of the economy around things such as music is creating a massive cultural black hole. I've met far too many amazingly creative people who, if this were the 1970s, would be celebrated musicians and artists; instead, they work mid-level jobs and waste away. Do we really think amazing art and ideas should be a smaller industry than, for example, mindless drilling for natural resources? It's quite absurd, and quite depressing.</comment>


How I stopped loving Angular - <AUTHOR> https://medium.com/@igogrek/how-i-stopped-loving-angular-c2935f7378c4 <comment><USER2> A thorough review by an experienced Angular developer. After having used Angular 2/4 in a greenfield project for the last 6 months, I agree with most of what he says. TypeScript is great, but Angular is sometimes easy, seldom simple and mostly complected [1].

1\. Simplicity Matters by Rich Hickey: [https://www.youtube.com/watch?v=rI8tNMsozo0](https://www.youtube.com/watch?v=rI8tNMsozo0)

</comment><comment><USER3> This is the first non-shallow critique of angular delivered from a place of experience I've seen. After creating 2 medium size production web apps, I found my self shaking my head in agreement.

If the author reads Hacker News, thanks for the write up.

When Vue gets first class Typescript support, it will get real consideration for our next app.

</comment><comment><USER4> I think Angular 2+ just misunderstands what most applications need or what most developers want.

Typescript is an amazing tool and will be better once there's even wider support. Observables are interesting and RX.js has been useful to me. Zones are interesting but I've not had a real chance to use them.

But, I think putting these and many more concepts together make Angular even less accessible to a majority of developers. Developers can choose these components individually and mix and match for the project, but Angular has made all of these decisions already. That works for some people, but not enough.

Add to it the extreme confusion over naming and the massive paradigm shift from AngularJS 1.

I agree that Vue, React, and other libraries do a much better job and aren't complete packages, you can put together the foundation you need.</comment>


Bookmark this Adsvise is the ultimate digital ad sizing guide - <AUTHOR> http://www.adsvise.com/facebook <comment><USER2> Did you ask people to vote and comment on this story? That generally doesn't go well.

See moderator dang's comments: [https://hn.algolia.com/?query=sockpuppet%20author:dang&sort=...](https://hn.algolia.com/?query=sockpuppet%20author:dang&sort=byDate&prefix=false&page=0&dateRange=all&type=comment)

<comment><USER3> Orthogonally, the submitter however appears to be working on the project based on the changes to the site incorporating my comment on a previous submission regarding sidebar items.

</comment></comment><comment><AUTHOR> We launched Adsvise to help designers & marketers get through the mental maze of digital ad specs. It would be great to hear what channels you think we should be adding and what tools you would like to see next.

</comment><comment><USER4> Nice, really good job.

</comment><comment><USER5> That's cool. Bookmarked it already!

</comment><comment><USER6> This is super useful, I can only recommend!

</comment><comment><USER7> Bias but I love this. This is that moment when you build something that solves a problem for you (me) personally :)</comment>


Foreign demand for short-term Treasurys tumbles, led by China - <AUTHOR> http://finance.yahoo.com/news/Foreign-demand-for-Teasury-apf-1402391707.html?x=0&.v=6

<comment><USER2> Be sure and go down to the 4th paragraph where it says people have " _noted that net purchases of longer-term Treasury debt rose in December by $70 billion._ "

If this is a move from holding short term (T-bills are one year or less) to long term US debt then it's entirely positive (but I strongly suspect the overall picture is more complicated ... and in the long term I can't imagine the world's appetite for US government debt is large enough, certainly not at the current low interest rates).</comment>


Re2c: A free and open-source lexer generator for C and C++ - <AUTHOR> http://re2c.org/ <comment><USER2> For any other state machine nuts such as myself, you won't want to miss their paper on tagged DFAs: [http://re2c.org/2017_trofimovich_tagged_deterministic_finite...](http://re2c.org/2017_trofimovich_tagged_deterministic_finite_automata_with_lookahead.pdf) It is a somewhat recent follow on from Laurikari's 2000 paper and Kuklewicz 2007 paper on the same topic. Specifically, tagged DFAs let you do submatch extraction via the DFA itself. Other finite state machine regex libraries either don't do this at all, or fall back to slower engines in the general case (such as RE2). I think the downside of tagged DFAs is that they can be quite large!

<comment><USER3> It's interesting that it's using Laurikari's algorithm- I looked at the 2000 paper years ago and could not get a working algorithm out of it. Eventually I found another way to do this that I use for JOE's regular expression library. So now I'm curious which one is faster...

[https://sourceforge.net/p/joe- editor/mercurial/ci/default/tr...](https://sourceforge.net/p/joe- editor/mercurial/ci/default/tree/docs/hacking.md#regular-expressions)

It uses a variant a Thompson's matcher, see:

[https://swtch.com/~rsc/regexp/regexp1.html](https://swtch.com/~rsc/regexp/regexp1.html)

"However, Thompson-style algorithms can be adapted to track submatch boundaries without giving up efficient performance. The Eighth Edition Unix regexp(3) library implemented such an algorithm as early as 1985, though as explained below, it was not very widely used or even noticed. "

So in JOE's matcher, when simulating the NFA with the multithreaded machine, each succeeding thread will correspond to one of the sub-match possibilities. Augment this machine to keep the ones you want (the ones with the longest matching strings starting from the left usually).

<comment><USER2> > So in JOE's matcher, when simulating the NFA with the multithreaded machine, > each succeeding thread will correspond to one of the sub-match > possibilities. Augment this machine to keep the ones you want (the ones with > the longest matching strings starting from the left usually).

Yeah, this is the standard way to do it. It's what I meant by "fall back to a slower engine," since simulating the NFA is much slower than a DFA.

</comment></comment></comment><comment><USER4> FWIW I encountered re2c in the Ninja lexer

[https://github.com/ninja- build/ninja/blob/master/src/lexer.i...](https://github.com/ninja- build/ninja/blob/master/src/lexer.in.cc#L123)

and then used it for my own huge shell lexer:

 _The Oil Lexer: Introduction and Recap_ [http://www.oilshell.org/blog/2017/12/15.html](http://www.oilshell.org/blog/2017/12/15.html)

The nice thing about it is that it doesn't impose any constraints on the structure of your code.

lex/flex probably have options not generate piles of messy C code with global variables at this point, but IMO there's no reason not to use re2c instead, so it's moot.

<comment><USER4> update: Also re2c gives you "semantic actions" like Ragel or yacc, which is better IMO. Not sure if lex/flex does that. I think it has a hard-coded notion of tokens.

<comment><USER5> lex/flex definitely supports semantic actions and definitely does not have a hardcoded notion of tokens.

</comment></comment></comment><comment><USER6> I have ported the PHP re2c lexer logic to elisp in my in-progress attempt at a Semantic PHP mode for Emacs. Using the lexer tokens as foundation for syntax- coloring and indentation

[https://github.com/cjohansson/emacs-phps- mode/blob/master/ph...](https://github.com/cjohansson/emacs-phps- mode/blob/master/phps-mode-lexer.el)

</comment><comment><USER7> I usually reach for Ragel [1] for this kind of work. It has a very steep learning curve and is a bit more complex than a straight-up translation of a conventional regular expression, but the state machine combination algebra is incredibly powerful and flexible. I've used the tool in numerous projects over the years.

[1] [http://www.colm.net/open-source/ragel/](http://www.colm.net/open- source/ragel/)

</comment><comment><USER8> I use re2c a lot. It's a great tool for safely working with text in C programs, without any runtime dependencies. It's a secret sauce in many of my programs.

For example, my JSON parser that doesn't use intermediate object tree and works directly on strings: [https://megous.com/git/sjson/tree/sjson.c](https://megous.com/git/sjson/tree/sjson.c)

</comment><comment><USER9> re2c is used by PHP: [https://externals.io/message/102796](https://externals.io/message/102796)

[https://github.com/php/php- src/blob/master/Zend/zend_languag...](https://github.com/php/php- src/blob/master/Zend/zend_language_scanner.l)

</comment><comment><USER10> Hyperscan was recently posted.[1] A fast multi-pattern regex matcher. As in 1000's of patterns. Though optimized for deep packet inspection, I'm curious to try it for tokenizing.

[1] [https://news.ycombinator.com/item?id=19270199](https://news.ycombinator.com/item?id=19270199)

</comment><comment><USER11> I replaced a handwritten lexer of a proprietary PDF library with a re2c generated lexer. Besides fixing a bunch of dormant bugs, the resulting lexer was much faster. Also the state of c++ std regex implementations is pretty sad (at least it was the last time I checked) and if you just need to match with a few compile-time-known regexes, re2c is there for you to solve the problems.

</comment><comment><USER12> re2c is a hidden gem and it is used in libzdb to parse URL's [https://bitbucket.org/tildeslash/libzdb/src/9402bd5757d1db34...](https://bitbucket.org/tildeslash/libzdb/src/9402bd5757d1db346b71489439dfc005dd464971/src/net/URL.re?at=prefetch&fileviewer=file- view-default#URL.re-106) and SQL Date strings [https://bitbucket.org/tildeslash/libzdb/src/9402bd5757d1db34...](https://bitbucket.org/tildeslash/libzdb/src/9402bd5757d1db346b71489439dfc005dd464971/src/system/Time.re?at=prefetch&fileviewer=file- view-default#Time.re-168)

</comment><comment><USER13> SystemTap derived its regex functionality from re2c: [http://sourceware.org/git/gitweb.cgi?p=systemtap.git;a=blob;...](http://sourceware.org/git/gitweb.cgi?p=systemtap.git;a=blob;f=README.stapregex)

</comment><comment><USER14> Safari used to use re2c to identify Unicode Top Level Domains in order to avoid cross-site-scripting attacks. The Unicode support has no parallel that I'm aware of.

</comment><comment><USER15> Lexer generators seem like a useful algorithm wrapped up in heaps of framework bullshit. Wouldn't it be better to have a simple program that inputs regex and outputs a DFA than one that handles the entire lexing process?

<comment><USER16> Lexers run multiple regexes in tandem to determine the next token type. To do that with your method you'd have to run multiple DFAs on the same string. Lexers can do it with 1 DFA by having multiple different final states (non- final + 1 per token type vs non-final + final).

<comment><USER17> You can do that from a regex api fairly easily. Something like:

        re = regex.compilemulti([
             (".*@(.*)\\.(com|org|net)", TagEmail),
             ("http://.*, TagURL),
             ("[a-z]*", TagWord)
        ])

        match regex.tagmatch(re, pat)
        | (TagEmail, submatches):    domain=submatches[1]
        | (TagURL, submatches):      url=submatches[0]
        | (TagWord, _):              /* nothing */
        ;;

I haven't had time to do it in Myrddin's libregex ([https://myrlang.org/doc/libregex/](https://myrlang.org/doc/libregex/)) yet, but I've got plans to do something like this.

<comment><USER16> Sure, and that's exactly what re2c does too. It lets you do a match on multiple regexes:

      regex1 { code that executes if regex1 matches }
      regex2 { code that executes if regex2 matches }
      regex3 { code that executes if regex3 matches }

<comment><USER17> Yes, compiled into source code, which doesn't let you change the set of regexes at runtime.

</comment></comment></comment></comment></comment><comment><USER18> Alternative: [https://github.com/fbb-git/flexcpp](https://github.com/fbb- git/flexcpp)

(nice with [https://github.com/fbb-git/bisoncpp](https://github.com/fbb- git/bisoncpp) as parser generator)

Very well written with good documentation.</comment>


2010 and 2020 - <AUTHOR> https://xkcd.com/2280/ <comment><USER2> Does anyone else get an invalid cert authority for Cisco Umbrella CA? Both Safari and Chrome don't like that CA.

<comment><USER3> Are you viewing it from an office network? Cause I believe that is a MITM https proxy used by a Cisco a/v appliance.

<comment><USER2> Gah! Thank you.

</comment></comment></comment><comment><USER4> Amazing.

</comment><comment><USER5> Are there segments of the HN community which have been to such extremes as to feel the need to pay $5000 USD for a bottle of hand sanitizer?

Asking because I'm noticing that some others online are missing the fact that this is a comic, and not a 1:1 representation of how things are for the average person now. Which is normal maybe but not cool to watch.

This kind of emotional response seems (maybe irresponsibly, maybe not) brought to the forefront by details which have been over-magnified, and kept there, and that's how people start to make rash decisions and suffer from legitimate anxiety issues.

Last time we had an emergency where I live (last year), it wasn't cool at all because the joking of this kind had a bitter edge to it, and good people ended up in quite a panic, even going to the hospital seeking care because they are not used to even a little destabilization. In the end, most affected by the disaster were OK.

I'm not a fan of propaganda but I wish we could factor in the normal boring reality a bit more. People around me are going on hikes with their families today, and otherwise taking this a day at a time.

(With that said--props for a clever reference to the Bitcoin phenomenon. I get the joke, downvote if you feel the need to, but I do wonder if the joke is helping or hurting)

<comment><USER6> Extrapolating from the current curves, the longer this crisis goes on, the price of hand sanitizer and the price of one BTC will intersect. It probably won't but that's the joke. Which I have now explained to you.

That said, I'm looking at the bright side of all this. The economy will slow down, and a significant amount less carbon will be produced. Companies who had never considered it before may allow employees to work at home permanently, which is even less air pollution. Reducing PM2.5 saves lives.

Air travel will be drastically reduced, which helps with carbon/radiative forcing, as well as halts overtourism. People will be more inclined to cook at home with local foods and home-grown crops. In short, we'll get a little bit of a break from our most dangerous habits (with the exception of Twitter and the chans), which will buy scientists and engineers time to save the planet from climate change.

<comment><USER5> > It probably won't but that's the joke. Which I have now explained to you.

I get the joke. No need to take such a didactic tone. Your interpretation though, is one of many. There are those who are reading this and discussing as if it represents / agreeing that it represents current reality, no extrapolation needed.</comment></comment></comment>


Campus coffee shop evicts College Republicans from 'safe space' - <AUTHOR> https://www.campusreform.org/?ID=10251 <comment><USER2> Is there any more to this story? All these patrons did was wear MAGA hats? As a progressive I must say these actions only stoke the flames. We're never going to be able to work together if we can't talk to each other and we're never going to be able to talk to each other if we can't associate together. This isn't the path forward.

<comment><USER3> I would hope there's more to the story but somehow I doubt it. It says they went in there to test the perception that they wouldn't be welcome simply for their political views. So it stands to reason they probably would make it a point to not make a fuss and see if they were approached. If that's really the case, I agree it was really poorly handled.

On the other hand, as bristly as I know young progressives/liberals can be (we can be) I also wouldn't put it past the other students to be a bit obnoxious and trying to draw attention to their hats in an effort to have their point proven. Regardless you're right, not the path forward.</comment></comment>


Verk – An Elixir job processing system backed by Redis - <AUTHOR> https://github.com/edgurgel/verk <comment><USER2> I don't understand why we're rebuilding Resqueue/Sidekiq in Elixir. This seems like a problem which is solved largely by OTP.

Yes there are issues with back-pressure and over-filling mailboxes, but I can't help but wonder why you'd want to bring Redis into the picture when asynchronous processing is built-in for you.

Similarly if you want more robust queueing semantics, isn't RabbitMQ there?

Am I missing something?

<comment><USER3> OTP won't out of the box persist jobs that you want to guarantee that it will run. It won't also retry and it can't schedule jobs to happen in the future.

Unless you are willing to lose the jobs that are just in memory you can simply use Task and send messages.

RabbitMQ also does not handle retries with backoff, scheduled jobs, etc.

Disclaimer: maintainer here.

Edit: I added the "with backoff" to not mix with automatic reenqueue if you reject a message from a Rabbitmq consumer.

<comment><USER2> Fair point. Why then persist to redis, rather than using something like mnesia and keeping it all in Elixir?

Is there a compelling reason to add an additional piece of tech in my stack?

<comment><USER3> That's a great question. I chose Redis for 2 reasons:

* Simple to use

* Compatibility with other systems like Sidekiq/Resque. Out of the box it will understand their clients.

My experience with Mnesia is close to none but I know it's not trivial to deal with split brain scenarios for example. It's also complicated to connect multiple nodes for my use case (using docker) and also to deal with moving instances inside a cluster. I would need to care about the locality of the data.

One can use any Redis service (AWS Elasticache, Redis Labs) and not care about maintaining a database. The Verk user just needs to have a working Redis database.

I'm pretty sure that having the database in the same space as the job processing system would speed up things. I would love to see a project that tried this approach. Probably not using JSON but simply Erlang terms.

<comment><USER2> Seems reasonable enough. I just feel like shouting from the rooftops "redis is not a queue server" but you already know that :)

<comment> w-ll Honest question, what is redis then? I've used it for all sorts of reasons, it seams like a swiss army knife, caching, queing, pub/sub, persistence, non- persistence all-in-one utensil. You can do a lot with it, and if it's already in the stack, it's a lot easier for others to reason with.

</comment></comment></comment></comment></comment></comment><comment><USER4> Why not [https://hex.pm/packages/exq](https://hex.pm/packages/exq) ?

<comment><USER3> Here's a detailed explanation: [https://github.com/edgurgel/verk/issues/2](https://github.com/edgurgel/verk/issues/2)

</comment></comment><comment><USER5> why Redis when Elixir supports the Erlang native ETS and DETS libraries?</comment>


Medicaid kills? "Causality is the first casualty." - <AUTHOR> http://theincidentaleconomist.com/wordpress/on-gottliebs-favorite-medicaid-outcomes-studies/ <comment><USER2> The most important line in this article, for anyone who wants to compare one set of medical/insurance/etc related interventions to another:

 _Bottom line: once again, we find that XXX is shown to be [good/bad] for health, but only if proper econometric techniques are employed. Sadly, it is easier to ignore the need for such techniques and to misunderstand them than to do the work to educate oneself in their use. The real tragedy is that it leads to an unwarranted conclusion YYY..._

I.e., a fuck lot of stuff affects health outcomes and without controlling for them, you get nonsense.

<comment><USER3> I get the sense that the person who wrote those the original article that this story replies to didn't care that they were misrepresenting the studies, because they care more about the political implications than science.

<comment><USER2> Isn't that usually the case when people make comparisons like this?

See also "omfg, US life expectancy slightly lower than EU, socialized medicine now!" Or similarly "omfg, EU cancer survival rate slightly lower than US, no death panels!"

<comment><USER4> Well, he was repudiating a politically motivated point that was fairly ridiculous, "medicaid recipients get sick a lot therefore medicaid is making them sick".

<comment><USER5> Well, it's not PATENTLY ridiculous. There's a fairly extensive literature base to suggest that many of our modern treatments are not efficacious and either make outcomes worse or at the least add side effects. Though I find it unlikely that treatments could be SO bad that the effect of being treated more would be reduced life span.

The article that this article is criticizing may not be objectively seeking truth, as seems to be the case unfortunately, but we shouldn't reject its conclusion as on-face impossible

Some examples:

[http://m.theatlantic.com/magazine/archive/2010/11/lies- damne...](http://m.theatlantic.com/magazine/archive/2010/11/lies-damned-lies- and-medical-science/8269/)

Also you could look at, for psychiatry, Robert Whitaker's book Anatomy of an epidemic.

<comment><USER4> Well, sure, any given treatment could be a net negative. That's perfectly reasonable.

However, saying that the net sum of all treatment is a net negative is indeed patently ridiculous. The guy who wrote it probably has pretty good health insurance, too, just saying.</comment></comment></comment></comment></comment></comment>


The nanny state shouldn't alarm us, it's the gluttonous food industry giants - <AUTHOR> https://www.theguardian.com/commentisfree/2018/dec/30/its-not-the-nanny-state-that-should-alarm-us-but-the-gluttonous-food-industry-giants <comment><USER2> Good article. Sad but interesting how many otherwise intelligent people I know are so affected by their food addictions that they are in (mostly) a state of denial that sugar, excess fat, and processed foods in general are so bad for their health.

I have never been badly overweight but two years ago I went on Dr. Fuhrman's Eat to Live diet and it literally changed my life. After an uncomfortable two week initial 'detoxifying' period, I started feeling very good with the best effects starting about six weeks after starting the diet. Everything changed for me: arthritis and cramping in my hands from keyboard use went away, the inflammation in my knees decreased, I never had indigestion, and my thinking seemed to be more clear (I stopped getting a fuzzy feeling in the afternoons after working 6 or 7 hours).

I stopped the diet (or cut back on it) when my family moved to a new state but my wife and I plan on both getting back on Dr. Fuhrman's diet next spring.

<comment><USER3> People would rather be wrong than be seen as wrong. My opinion is as a society we need to reassess how many foundational industries affect our ability to be happy -- work, diet, housing. All of it.</comment></comment>


It's Your iPhone. Why Can't You Fix It Yourself? - <AUTHOR> https://www.nytimes.com/2019/04/06/opinion/sunday/right-to-repair-elizabeth-warren-antitrust.html <comment><USER2> People can't fix their own cars engines nowadays, which has been a huge legacy in the USA (the car enthusiast/tinkerer, the hot rod, the looking under the hood, etc), and they expect to fix intricate, miniaturized, SoC-based, waterproof electronics like smartphones?

<comment><USER3> Bullshit.

All of that is going on just fine. Same for the phones.

Bad norms tend to sideline the overall awareness, but that does not mean it is not happening.

And the key thing here is that it is possible and legal. Not everyone will, and that is OK. It is all about the people who do these things.

Frankly, you would be amazed at what people will do when encouraged and empowered.

<comment><USER2> > _All of that is going on just fine._

Fixing your own car has been "going on just fine"? In what planet? Except if you mean basics like changing oils and stuff.

This is more like it:

"Training organisations, body shops and all those in the independent sector can't keep pace with the speed of change in vehicle technology," says Jason Moseley, executive director of the National Association of Bodyshops. "For example, there's more computer code in a current Mercedes-Benz S-Class than in a Boeing Dreamliner."

This increase in complexity means body shops are taking longer to repair cars and charging more to do so as a result, forcing insurers to write off some cars that are still relatively young.

Concerned by the trend, car makers have been heavily discounting replacement parts in a practice called 'total loss avoidance', intended to save cars from being written off early in their life.

Malcolm Neil, from claims management firm Inter-est, agrees that manufacturers' rapidly evolving techniques of vehicle construction and the repair challenges new cars present are a growing concern. "Years ago, cars were all of similar construction, but not any more," he says. You can't just chop out damaged panels on a modern car, because you might cut through a sensor or its wires. For example, to replace the front wing on the current BMW 5 Series takes three times longer than on its predecessor, because first you've got to strip out the whole bootlid and disconnect all sorts of ECUs and batteries in it."

And that doesn't even take into account the dozens of cpus and electronic systems that can go wrong, or modern complex transmissions. (And let's not get in hybrid and electric cars).

Nobody would ever say those are as repairable as 60s, 70s, 80s, even 90s cars...

<comment><USER3> I never spoke to how easy any of that is, only that people are doing it anyway. And they could document the car, or teardowns can be made easier legally.

The core point being we can either discourage or empower.

Where we do the latter, all sorts of solutions to those challenges will be found.

Heck, I just did a component level repair on my Ford SUV. Mid 2000 era. The whole sub system is a few hundred dollars.

There are people doing refurbishments for less. I bought a MOSFET and used the skills I have.

Not repairing things is a huge waste. I do not care how complex they are, only that people are totally in the clear to learn how to repair, repurpose.

Doing that is basic for me. Grew up that way and never really quit. Tons of us out there doing way more than people think.</comment></comment></comment></comment>


DOJ: We don't need warrants for e-mail, Facebook chats - <AUTHOR> http://news.cnet.com/8301-13578_3-57583395-38/doj-we-dont-need-warrants-for-e-mail-facebook-chats/ <comment><USER2> I might be too late for anyone to see this, but I think it's an important point.

A lot of people assume the origin of wiretapping laws has to do with protecting citizens from the police. This isn't the case, at least not originally. Wiretapping laws were about protecting citizens from each other. Let me explain:

Once upon a time, it was too expensive to run a phone line to each house. AT&T had the brilliant idea of running one phone line and having many people on a street share the line (the rich, of course, enjoyed private communications). So if there were seven houses, and you were in house number 5, you would only answer calls that rang 5 times. The problem is that since all the houses on the block shared one phone line, any one nosy enough to but in could eavesdrop just by taking their phone off hook. The original wiretapping laws were setup to protect citizens from this, not the Government.

As a side note: before the North American Numbering plan, phone numbers were names followed by numbers. An example might be Oxford7 or OX7 on the number pad, which would ring the 7th house in the Oxford area (Oxford is a placeholder and doesn't refer to Oxford proper.)

<comment><USER3> interesting. i assume you're referring to legislation at a state level? got any links? i haven't read much about that era, but from what i have, it sounds like things were awesomely crazy back then w/ PIs tapping for clients, corporations tapping each other, etc.

at least at the federal level, everything i'd read places the catalyst for modern wiretapping laws as the conviction appeal of seattle bootlegger Roy Olmstead's arrest based on evidence gathered by a warrantless wiretap by "rogue federal law enforcement officers." his appeal reached the supreme court in 1928 and was upheld 5-4 on 18th century trespass laws. in 1934, congress passed The Communications Act of 1934, which made wiretapping a federal criminal offense and any evidence obtained from such would be inadmissible. it wasn't until the The Omnibus Crime Control Act of 1968 that the constitutionality of wiretapping was articulated for investigative purposes.

this gives a better overview/detail compared wikipedia: [http://www.americanbar.org/content/dam/aba/administrative/li...](http://www.americanbar.org/content/dam/aba/administrative/litigation/materials/sac_2012/29-1_history_and_law_of_wiretapping.authcheckdam.pdf)

<comment><USER2> Alright so digging a bit:

At common law, "eavesdroppers, or such as listen under walls or windows, or the eaves of a house, to hearken after discourse, and thereupon to frame slanderous and mischievous tales, are a common nuisance and presentable at the court-leet; or are indictable at the sessions, and punishable by fine and finding of sureties for [their] good behavior." [1] Very Early Eavesdropping law.

but it wasn't prosecuted very often and faded from the common parlance:

"Eavesdropping is indictable at the common law, not only in England but in our states. It is seldom brought to the attention of the courts, and our books contain too few decisions upon it to enable an author to define it with confidence.... It never occupied much space in the law, and it has nearly faded from the legal horizon."[2]

The first wiretapping laws were enacted by congress during world war 1:

40 Stat.1017-18 (1918)("whoever during the period of governmental operation of the telephone and telegraph systems of the United States ... shall, without authority and without the knowledge and consent of the other users thereof, except as may be necessary for operation of the service, tap any telegraph or telephone line ... or whoever being employed in any such telephone or telegraph service shall divulge the contents of any such telephone or telegraph message to any person not duly authorized or entitled the receive the same, shall be fined not exceeding $1,000 or imprisoned for not more than one year or both"); 56 Cong.Rec. 10761-765 (1918).

And you're right, that wiretaps weren't constitutional until 1968, but this doesn't discuss neighbors spying on neighbors.

I think we found the same document: <http://www.fas.org/sgp/crs/intel/98-326.pdf>

I'll ping my buddy to see if he can shed a little more light, but this is related to wiretaps, which is slightly different from eavesdropping.

[1] 4 BLACKSTONE,COMMENTARIES ON THE LAWS OF ENGLAND, 169 (1769). [2]1 BISHOP, COMMENTARIES ON THE CRIMINAL LAW, 670 (1882)."

</comment></comment></comment><comment><USER4> Guys, when will it sink through? The technology to protect yourself from wiretapping _is in your hands_. End-to-end asymmetric encryption has never been more accessible. Explain to your friends and family what PGP is _and start using it_.

Maybe the NSA has it cracked, maybe not. But the IRS sure doesn't, nor do the FDA, DEA, FCC, FBI, Google, Apple, Facebook, Microsoft for that matter.

EDIT:

Here's how it works: I run PGP/GPG (GPG is the open source/free version of PGP, they're the same protocol) locally and the first time I use it, it creates two files, a "public key" and a "private key". I post/share my "public key" online (and you assume it's really me sharing it with you - this is important).

       gnupg --gen-key
       gpg --armor --output Desktop/mqudsi.asc --export "Mahmoud Al-Qudsi"

For example, here is my public key: <http://neosmart.net/downloads/miscellania/mqudsi.asc>

Anyone can now use this key to send me a text message encrypted only for me. They just need this file and their own pgp/gpg private key; they tell it to encrypt message X for user with public key Y.

The result of that command (gpg --encrypt --recipient 'Mahmoud Al-Qudsi <email@example.com>' toencrypt.txt) will be encrypted text that no one but the holder of the private key (me) (which should never be shared) will be able to decode.

The result is plaintext. You can send it via email, text message, snail mail, whatever. There are apps that automate the encryption procedure as part of the sending process.

<comment><USER5> The problem I've had is not so much explaining what PGP is, or why to use it. It's the software.

Sending an encrypted or signed message to someone who doesn't have your keys throws all kinds of scary messages in most email clients. Maybe not a problem for _us_ ™, but a huge problem for most people who find they can't send messages to their friends without remembering to do step X for people A, B, and D, but not C or Q. And even if you explained this to them, will they remember a month down the line when their friend calls them because they think their computer got hacked? (true story. nobody reads error messages, and encryption-related ones are among the most cryptic and scary looking.)

Then try convince them to keep using encryption / signatures for you, when it breaks for other people and makes sending an email more complicated, and they have to keep track of who C and Q are. Then try to convince them that, even though they have nothing to hide, encryption is still useful.

Then do this all over again when they get a new computer and forget to install PGP and have already lost their entire keychain.

\--

The crypto is here, and yes, it has never been more accessible. The software _using_ it is still garbage.

<comment><USER6> >Sending an encrypted or signed message to someone who doesn't have your keys throws all kinds of scary messages in most email clients.

Seriously. The way PGP should work is: Whenever you send an email, it puts a header in the outgoing message with your public key. The header is not normally shown to the user and is ignored as unknown by non-compliant email clients. Then, whenever you send a message _to_ anyone you've ever received an email _from_ , you already have their public key, so your email client automatically encrypts the message before sending it, and their client decrypts any message it receives encrypted.

This is obviously ignoring a whole bunch of problems. What happens if your public key changes? What happens if the attacker sends an email from your address to the user? (Presumably in both cases the recipient will get a message complaining that the key has changed, and DKIM and the fact that your email server authenticates you will help with the second.) But here's the thing: Those problems don't happen _normally_. The average user doesn't encounter them in the first six months of using the software. They just install a client that supports the protocol and automatically get encryption for messages exchanged with anyone else using a supported client, without having to do anything special.

I think this is one of those "the perfect is the enemy of the good" scenarios. The people who want encrypted email want it to be secure against the NSA coordinating with AT&T and your email provider. Which would be great, if it didn't make the UX so terrible that no one uses it and causes everyone to default to no encryption. Do the above and you still have good security if you verify public key fingerprints manually, but it makes the process of encrypting your email as simple as installing the software, and if you don't verify keys then you're still safer against a large variety of attacks than the primary alternative of not using any encryption at all.

<comment><USER7> You forgot the most important part, validating that the public key you've received is actually for that person. That may be as simple as automatically checking public servers for a match and providing some confidence percentage based on how many people signed it or better yet how many people signed based on whether you trust them or not.

Without that, it's not just useless, it's detrimental to the system, as there could be lots of bogus keys accepted by people (imagine a virus that automatically generates and adds a PGP key to mail clients before sending to everyone in the address book, just to make it more likely to pass spam filters). Bogus keys in the web of trust would be a big problem.

In fact, if PGP/GPG were more popular, I imagine there would be the accompanying glut of horrible passwords used (or duplication from easily gleaned passwords), and pretty soon some virus would start automatically signing things it shouldn't on infected systems, and then the web of trust that the system relies on for third party verification wouldn't be so trustworthy.

<comment><USER6> >You forgot the most important part, validating that the public key you've received is actually for that person.

It's not that I forgot that part, it's that that's the hard part. That's the reason PGP is hard to use: They try to make sure you do it securely. And you _can't_ have some third party do that part for you without trusting them, and the whole idea is not to have to trust any third parties. What public servers are you going to use here? Does each email user have to run their own server? Unless you have a single central server, how do you know which server corresponds to which user?

Automating web of trust could be interesting though. Imagine you get an email from a new user that you've never received any email from before. There is some new P2P network where if you have someone's public key, you ask _that user_ whether they know the new user's public key, and they send back a signed response (either "this is the key I have" or "I don't have a key", signed either way with the known user's public key). Then if all your friends who have the new user's key agree on what it is, it's probably right. If nobody has it, you get encouraged to verify it manually (i.e. in person). And if they don't all agree you get the nasty warnings about something fishy going on.

>imagine a virus that automatically generates and adds a PGP key to mail clients before sending to everyone in the address book, just to make it more likely to pass spam filters

That seems like a low-effectiveness method of sending spam, given that the public key is uniquely identifying and tied to a sender address, so once the spam filter realizes everyone is marking all those messages as spam it can just blacklist everything sent using that key. Also, how is it different from existing PGP other than that more people would be using it? If you've infected a machine with a virus you can do whatever you want to it. You could just write the spam directly to the user's inbox, or send it out from their own address and sign it with their actual key. Compromised machine = you're screwed.

>the accompanying glut of horrible passwords used (or duplication from easily gleaned passwords)

This isn't even necessary for a virus. The problem with viruses is that they can stay resident until you type your password and then it doesn't matter how hard the password was.

<comment><USER7> > It's not that I forgot that part, it's that that's the hard part. That's the > reason PGP is hard to use: They try to make sure you do it securely. And you > can't have some third party do that part for you without trusting them, and > the whole idea is not to have to trust any third parties. What public > servers are you going to use here? Does each email user have to run their > own server? Unless you have a single central server, how do you know which > server corresponds to which user?

I'm certainly not going to argue with this, it's the basic gist of my original reply. :)

> Automating web of trust could be interesting though. Imagine you get an > email from a new user that you've never received any email from before. > There is some new P2P network where if you have someone's public key, you > ask that user whether they know the new user's public key, and they send > back a signed response (either "this is the key I have" or "I don't have a > key", signed either way with the known user's public key). Then if all your > friends who have the new user's key agree on what it is, it's probably > right. If nobody has it, you get encouraged to verify it manually (i.e. in > person). And if they don't all agree you get the nasty warnings about > something fishy going on.

Exactly. This is similar to what I was envisioning when I was talking about confidence levels. Having different levels such as "I have personally verified (signed)" and "I know of and reasonably trust this key based on people I trust" and making that public in some manner would allow a slew of interesting techniques to verifying public keys to different assurance levels.

Come to think or it, it sounds like what we need is for a social network to adopt this. Google+ with it's real name requirements might make a good fit, but maybe real name isn't what we care about, maybe we just care about email. Alternatively, some alterations to diaspora might work out well (I know little about it other than it's a roll your own social network that I think can work as a node of a larger network).

> That seems like a low-effectiveness method of sending spam, given that the > public key is uniquely identifying and tied to a sender address, so once the > spam filter realizes everyone is marking all those messages as spam it can > just blacklist everything sent using that key. Also, how is it different > from existing PGP other than that more people would be using it? If you've > infected a machine with a virus you can do whatever you want to it. You > could just write the spam directly to the user's inbox, or send it out from > their own address and sign it with their actual key. Compromised machine = > you're screwed.

I'm imagining a virus that generates one on the infected system for the address the mail client is configured for. That could be a LOT of new keys.

The problem is the thousands or millions of bogus keys that start being sent from addresses that previously didn't have ANY key associated with them (or did, but not through that machine), clog the web of trust if they make it on there. If they are automatically added to mail client/PGP systems on the recipients end, that's a lot of bogus keys in users mail clients (even if it's just the 10% that arrive before spam filters react). If clients end up syncing their known keys to some central repo at some point, that's a LOT of bad data. I can imagine a case where someone generates a legitimate key and gets it personally signed by a few people, only to find that it's verified by hundreds of people on some public servers.

As for low-effectiveness, if it evades more filters by just a few percent, at the scales spam is sent that's a BIG deal.

> This isn't even necessary for a virus. The problem with viruses is that they > can stay resident until you type your password and then it doesn't matter > how hard the password was.

True. I imagine the really fast spreading and pervasive virus's need to be quicker than that though, but I have nothing other than a hunch to base that on.

</comment></comment></comment></comment></comment></comment><comment><USER8> There is a certain logic to what they're saying, after all. You shared this information with Facebook or Twitter or Google. It's no longer in your private possession, because of that sharing, so if those companies feel like giving your messages to the DOJ, it's not really a "violation" of your 4th amendment rights, because you gave those up when you gave your "private" communications to those companies.

I'm not saying anything about how good or bad that is for American society, but I can absolutely see an interpretation of the 4th amendment where information you share with a third party doesn't get protected as if it were private. There may be other laws that protect your emails and tweets and whatnot, but the 4th amendment specifically may not be the best place to look for that protection.

<comment><USER9> The postal service, UPS, DHL, FedEx, the phone company, etc. These are all 3rd party services that people use to send private things. People have an expectation of privacy when they send a message to someone via (e.g.) Facebook Chat. Some might argue that it's an _unreasonable_ expectation of privacy if you understand the technology behind it, but _I_ would argue that the majority of the population doesn't understand the way the technology works (which would imply that the majority of the population expects that the communications will remain private).

<comment><USER10> The postal service is the _only_ one of those mail carrier which you have listed that actually have legal standing for that privacy expectation though.

Regarding phones, those also have specific laws attempting to protect wireless (cellular) communications from eavesdropping (with the exception of legal wiretaps, which cellular providers are required to be able to support).

Likewise for pagers, those have specific laws making it illegal to intercept the communications sent to pagers.

For normal phones, a specific law had to be passed to require warrants for interception of communication (the "Wiretap Statute" from 1968, later extended by the Electronic Communications Privacy Act of 1986).

So the point to all of this is that those privacy "rights" that you talk about are not 4th Amendment rights at all, they are protections granted by specific legal action on the part of Congress. Had that legal action _not_ been taken then you'd be right back in this same "interesting 4th Amendment question" that we're talking about for this.

The bottom line is that if you're willing to give info to a 3rd party unencrypted you need to assume the government can be given access to the same information unless there are specific laws forbidding it.

<comment><USER11> The anti-wiretapping laws are needed to prevent non-government entities from violating our security. The Fourth Amendment already clarifies that government must not violate the security of ourselves and our communications (papers), without a warrant naming the person being searched, and what is being sought.

<comment><USER10> Yes, but before those anti-wiretapping laws the phone company could theoretically do ad-hoc wiretapping of their own and voluntarily divulge that to the government. The only limit would have been that the phone company couldn't have wiretapped at the direct behest of the government since the Supreme Court had already ruled that the 4th Amendment applied [to the government] where the person had a reasonable expectation of privacy.

The statute fixed that privacy issue and then put requirements on when wiretaps _could_ be used by the government. Before this law and the Supreme Court decision the government was very... lax regarding warrants for wiretaps.

[http://www.it.ojp.gov/default.aspx?area=privacy&page=128...](http://www.it.ojp.gov/default.aspx?area=privacy&page=1284)

</comment></comment></comment></comment></comment><comment><USER12> Self-defence (encryption) is the only real protection from government snooping on communications.

You can't rely on policy. It moves too slowly and there are always loopholes.

It's a shame there's no mainstream or accessible solutions to encrypt email while using services like gmail. Although they exist for IM.

<comment><AUTHOR> Yep. SSL is now viewed as a good best practice for data in transit, to the point that Apple was criticized for not enabling it for the App Store (<http://news.cnet.com/8301-13579_3-57573334-37/>).

But the real issue, as you indicate, is stored data. Full Gmail encryption would presumably be done in conjunction with the client via the browser. Because the server wouldn't have access to the plaintext, search becomes tricky and contextual ads problematic. One solution would be for Google to make fully encrypted Gmail a paid service.

<comment><USER13> Google would never add encryption to gmail. As a business decision it's pretty atrocious.

<comment><USER14> Why not? They already have a popular paid version that doesn't have any advertising. It seems like encryption would be a pretty compelling add-on to lure over businesses that are nervous about their data in the cloud.

<comment><USER9> Search is another one of their features. How would search work if all of the data was encrypted? Pushing search to the client doesn't make sense. Only encrypting emails in transit doesn't make sense because that doesn't get around this issue of the government forcing them to turn over information without a warrant.

</comment></comment></comment></comment></comment><comment><USER15> let's say, hypothetically of course, that a colleague sent me a password to a server via email (gmail), so that password is then retrievable without a warrant from my email account because it was "shared" with the transmission medium? such a broad interpretation would apply to any and all communications where anyone delivers something on your behalf...so literally everything if fair game, i dont see a reason to specifically exclude USPS in such a case.

that's pretty scary.

<comment><USER16> Or, you mean things like all those websites that send you new passwords in plaintext because their security isn't what it should be?

<comment><USER15> my personal favorites are the ones that send me my _current_ password in plaintext as a form of "recovery"

</comment></comment></comment><comment><USER17> Now more than ever we need an easy to use PGP solution for the masses.

</comment><comment><USER18> The DoJ doesn't need warrants to produce email and chat evidence in a lawsuit just like they don't need a warrant to produce other kinds of physical evidence from third parties. A subpoena will suffice and always has. People seem to be unaware of how critical subpoenas are to due process, and how long they've been used.

See: <http://en.wikipedia.org/wiki/Stored_Communications_Act>

</comment><comment><USER19> Fair enough. We cant stop it. Its done. It always was. Might as well stop the "chock and horror" thing, and just accept it. In the US, both political parties love being able to spy on us, and in the UK we see the exact same thing. No main stream politicians or law enforcement will ever, ever give it up.

So, have to ask, again, why the hell is any one wanting privacy from the authorities, who we know don't have our best interests at heart, still using electronic communications? It never was, isn't and never will be secure from them. If nothing else, almost every "terrorist" trial features some electronic communications evidence. Doesn't that tell us enough?

Look, just ask your self why organisations like MI6 still use old skool drop boxes in Moscow.

Tor? Its got government finger prints all over it. I trust it as far as I can throw it.

</comment><comment><USER20> I'm confused as to why the DOJ is arguing over whether it needs a warrant or not for emails and Facebook chats and that sort of thing. This is the DOJ that we're talking about, and surely, even if a warrant is required for email, they would be able to _get_ that warrant regardless.

A warrant is simply a permission by a judge to obtain or enter certain private property, right? Wouldn't the DOJ be able to find a judge that will grant a warrant? I don't know anything about judicial law, so I'm interested in learning about how this all works.

<comment><USER21> It's about bureaucracy in a lot of cases. It may require senior agent signoff for the warrant, etc.

</comment></comment><comment><USER22> We're back to administrations saying "stop us if you can".

</comment><comment><USER23> A hacker could do some real damage with a little fake paperwork. Can't wait for it to happen and believe me it will happen eventually. The hub of information is the police and if they hand it around without any concern why not mine them? The backlash may be a bit too much to handle though if he gets caught.

</comment><comment><USER24> Is IRC safe? I have a channel as my main form of communication with friends. Some people do local logging but I know who everyone is. Ironically I plan to use IRCcloud or IRCanywhere. Self hosting of online tools should be made much easier. I plan to self-host email but it seems like a pain.

<comment><USER25> > _IRC safe?_

Definitely not. It has always been a public communications channel. I don't think anyone ever had any privacy expectations regarding IRC.

<comment><USER26> > Is IRC safe?

I am pretty sure it's not. One day there was a news story on Drudge Report: [http://www.drudgereportarchives.com/data/2005/05/10/20050510...](http://www.drudgereportarchives.com/data/2005/05/10/20050510_030800.htm) ("feds investigate huge computer attack; worldwide hunt for 'stakkato'")

As a joke, my roommate at university logged into a IRC channel with the nickname and said:

      [01:59.16] * Stakkato (email@example.com) has joined #C++
      [01:59.17] * ChanServ sets mode: +o Stakkato
      [01:59.21] <Stakkato> look i made drudgereport headlines!
      [01:59.26] <Stakkato> http://www.drudgereport.com
      [02:01.09] * Stakkato (firstname.lastname@example.com) Quit (Quit: )

It was #C++ on DALnet, a small channel of mostly regular members, in 2005. Fast forward a while -- I don't recall how long, maybe a few weeks or months -- and my friend is contacted by the FBI. A member of FBI Houston Cyber Task Force (Houston being our city of residence at the time). The investigator began asking very vague, obscure questions. Eventually my friend and I piece together the subject of the FBI's line of inquiry: that specific IRC conversation. My roommate was completely up front with them about the IRC joke, and that was the end of it. I still have copies of the email conversations from @ic.fbi.gov, where some correspondence took place.

I suppose there is a chance that an informant reported the joke to the FBI, but due to the specifics of the situation, I think it is likely that the text conversation above was caught in a a general FBI dragnet of some kind (IRC server, ISP, etc.) and logged for eventual investigation. It did not seem to be a serious line of investigation by the FBI - more of a "follow all leads" situation. Someone had run a 'grep' for 'stakkato' and my friend's IP address showed up.

That was the day when it became clear to me that everything in plaintext transiting the Internet is probably available to the FBI. At the time it was shocking; even though the conversation happened over a public network, it was surprising to me that the conversation was actually logged and later found. I hesitate to share this story, but I hope it illustrates in harsh relief the probable capabilities of incentivized investigators. Keep in mind this was 2005 - investigative capabilities have surely grown since then.

</comment></comment></comment><comment><USER27> If you encrypt your email, you'll just raise "bad guy" flags at the traffic analysis level, even before content itself is checked.

Of the top of my head, I can't think of a lever to get enough people encrypting at once so as to overcome that disadvantage.

</comment><comment><USER28> use torchat. i was surprised how easy it is to use. and actually it have best IM user interface I've seen so far - contacts list, chat window on double click and send/receive file. That's it - nothing else.

on cons side - it take a while to connect to tor network, but once started it is quite fast.

i am not saying government should be allowed violate our rights, but it is much easier to assume that anything gtalk/facebook/gmail/etc is with in reach of government and do yourself a favor - use p2p encryption

</comment><comment><USER29> Sites like <http://flammo.com/> can send private messages which the DOJ cannot see uses end-to-end asymmetric encryption

</comment><comment><USER30> We need to come up with a way to communicate using these 3rd party services securely, without actually allowing them to store the information in plaintext...

</comment><comment><USER31> Don't trust policy. If you aren't good willing to handle encryption yourself, find a medium that will responsibly handle it for you (i.e. lavabit.com)

</comment><comment><USER32> All the more reason to support projects like BitMessage: <http://reddit.com/r/bitmessage>

<comment><USER33> I'd use and support BitMessage but I can't figure out how to get it to run on OS X.

</comment></comment><comment><USER34> Reduce your attack surface by not leaving years and years of emails on your IMAP server. I know its convenient, but there is a privacy tradeoff.

</comment><comment><USER35> This is one of the reason I don't have Facebook. Weird how foreign rules can affect your privacy outside Europe.

</comment><comment><USER36> "Warrants? We don' got no warrants. We don' need no steenkeen warrants!"</comment>


Ask HN: Do you think Mitchell Baker (Mozilla CEO) needs replacing? - <AUTHOR> As we all know, Mozilla recently laid off 250 employees. What is strange is that they still have so many VPs. Add in the difficulty of Firefox adding real market share for Baker's entire time as CEO and questionable focus - WebVR and Pocket - which have not taken off for years and likely still years away.
Her answer to her $2.5 million compensation sounded a bit entitled or aloof for someone heading an open-source project (https://answers.thenextweb.com/s/mitchell-baker-aGY62z).
I'm definitely not a fan as you can tell but wanted to see if others have been thinking this or if there's something I'm missing. <comment><USER2> The problem as I see it is that Mozilla is fundamentally two companies, one relatively small that makes almost all the money (thanks to google) the other rather large that makes basically nothing

Paradoxically, the small cash flush company is a nonprofit, while the larger bankrupt one is for profit.

Worse, the larger for profit company is simultaneously attempting to he a research institute, an advocacy group and a service.

I see no problem with the ceo making a "big" paycheck given the industry and location, but I do have major reservations about the seemingly directionless steering that they and their board have done.

This is not a critique of the individual research project, some of them being great, but just because Google gives you a big wad of cash does not mean you can spend it without a plan, or that you can do "everything"

<comment><AUTHOR> Really insightful, I didn't even realize any of that.

I really thought both the Foundation and the Corporation were hurting.

I'm assuming the research you refer to is their WebVR thing and I get it but how do they abandon Servo as a core differentiator and then focus on something that is at best years away.

If she were performing, fine, take your $2.5 million but when you let 1/4 of your team go and should have seen it coming, I'm just not so sure it's a justification for management.

They're a browser - or should be - and the internet didn't just up and get quarantined because of the pandemic. To me, it's apparent that they saw the browser as secondary to the other items and it made no sense.

Really interesting analysis, thanks.

<comment><USER2> If you believe that Mozilla should fundamentally be Firefox (and I am sure many would agree) you will probably be frustrated to learn that Google gives Mozilla about $500 million a year for that and that The Core Firefox team is about 40 people.

All the rest of the formerly 1000 employees do other things on behalf of Mozilla but generate basically no revenue.

I personally place a huge value on some of these "other" projects though such as MDN the absolute best documentation out there for the web.

</comment></comment></comment><comment><USER3> Yes, bring Brendan Eich back. It was a travesty of justice that he was forced out.

<comment><AUTHOR> That would be something, wonder if that's even a real possibility.

<comment><USER4> He is running his own company now.

</comment></comment></comment><comment><USER5> Something is certainly wrong at Mozilla. However, the same board and community culture that has led to the current staff is the issue. Were Baker fired the next chief executive would continue the path set by her and her predecessor.

</comment><comment><USER6> I guess I agree with you. Perhaps she could offer to take a pay cut. At least she didn't fire 500 people on a Zoom call like TripActions. Those people have no integrity.

<comment><AUTHOR> Didn't know about TripActions and letting 500 people go on a Zoom call.

That is just ridiculous in the worst way.

</comment></comment><comment><USER7> Of course, not necessarily because of the pay but because she is unqualified for the position.

<comment><AUTHOR> My thought process was something like "How does Mozilla suddenly lose revenue for 250 employees and not see it coming in this environment?"

I understand she has served with other tech companies before and apparently done very well - in a legal capacity. If I'm getting what you're saying, she may be very well positioned for Mozilla's legal issues but technological, likely not.</comment></comment>