Japanese toilet industry agrees to standardize complex bidet controls - <AUTHOR> http://www.theverge.com/2017/1/17/14306464/japanese-toilet-control-icons-meaning-standard <comment><USER2> > The government has recommended removing the Buddhist manji symbol from maps > aimed at foreigners, for example, for fear of unintended associations with > the Nazi swastika.

Does anyone else think this is a shame? When I've been to Asia and seen "swastikas" everywhere I've found it in a way joyful. The hate symbol has no power here, I thought; it's a positive thing. Why should one culture change their own iconography just because it was perverted in a different culture? It seems like a mild example of self-inflicted cultural imperialism.

Maybe I'm just being very philosophically naïve.

<comment><USER3> >Maybe I'm just being very philosophically naïve.

Possibly, more culturally naive than philosophically so.

World War 2 and the Holocaust had a profound impact on Western culture, and Westerners have identified that symbol with the Nazis for almost a century. The impact of Buddhist or Hindu symbology in the West, in comparison and response, has been practically nil.

For Westerners, who may never have been to an Asian country prior to Japan's Olympics, to see a manji and mistake it for a Nazi symbol is perfectly reasonable, if that is the only context in which the symbol exists for them.

The change in icons makes sense, if you (you being some hypothetical Japan) want to communicate specifically to those tourists and encourage their engagement with local businesses and culture. Why use a symbol on maps _specifically for foreigners to use_ which would probably confuse them?

You _could_ just keep it there and say "those ignorant foreigners just need to learn what it actually means" ... but that would show hostility towards to your guests, be bad for business and an impractical way to design a map.

Edit: Apparently they decided not to change the iconography for the maps. It will be interesting to find out what impact if any that appears to have on engagement during the Olympics.

<comment><USER4> > Why use a symbol on maps specifically for foreigners to use which would > probably confuse them?

If everywhere is the same, why travel? Local color like this makes destinations more interesting, not less. Hiding culture and heritage makes the value proposition weaker.

/German living in Seoul

</comment></comment></comment><comment><USER5> If you want an illustration of the problem, here's one sourced by the very scientific method of finding the closest men's restroom:

[https://www.dropbox.com/s/0iripy6m7fu5f3o/2017-01-19%2016.57...](https://www.dropbox.com/s/0iripy6m7fu5f3o/2017-01-19%2016.57.27.jpg?dl=0)

There are over 20 individual controls on that unit (which is, FWIW, common and reasonably expensive). If you do not read Japanese, good luck at finding flush... _and_ finding it will not help you finding it on the next machine you use.

<comment><USER6> I've never seen this unit nor anything even remotely this complex in a public toilet. The vast majority of toilets I've seen are the basic washlet features and a _few_ give you the added option of spray pressure. The pressure options I've only ever seen in hotels. Not only that, but the vast majority of public toilets are auto-flush.

Having said that, the "bidet" label on the "ladies" button is _highly_ misleading ;-)

<comment><USER5> This use case (use by people who are not literate) is one of those few circumstances where worse-is-better, because public toilets (like one might find in a train station or department store) are typically either mechanically operated (trivial to use) or the lowest-scale models.

That said, this is not a rare, exotic toilet in Japan; it's something which would be unremarkable in an office building or a restaurant that you could reasonably use for date night.

<comment><USER6> Living as I do in the inaka, I am rarely blessed with such things. Sometimes I think Tokyo is a different world ;-)

<comment><USER7> Don't you like the washiki toilets? ;) (seriously, I live neither in a big nor a small city, but there are way too many of them still, in this century)

<comment><USER6> I don't :-) But that's the reality of the izakayas around here. Actually the virtually brand new (7 years old???) onsen near me has exclusively washiki toilets (very nice new ones). Apparently the older patrons like them. They have handlebars on the wall too, which is a nice usability touch.

</comment></comment></comment></comment></comment></comment><comment><USER8> Oh, how badly I wished Americans had a clean way of cleaning their ... bottoms during my 8 years of stay there. Thankfully, Amazon had nice portable bidets which you could fit in your home toilets, but everywhere else it was still the same.

<comment><USER9> There's soft wipes (not the paper type). Nothing can beat that.

<comment><USER10> Bidets are the way to go, aside from being harmful to the plumbing system, soft wipes still require you to, well, wipe which is kind of barbaric once you get used to cleaning your bum with a jet of water and simply drying yourself after. It also saves a lot of money on paper costs if you use a towel to dry off.

<comment><USER9> A) saving money. It would take quite some time to recuperate the expensive toilet. Probably at least 10 years.

B) DON'T flush them.

C) I _really_ don't feel as clean from a jet spray. And I don't like it. Especially if the toilet is not mine.

D) You can bring your wipes everywhere. They will work in a desert, the forest, or ISS...

I buy baby wipes for the purpose... They are awsome.

</comment></comment></comment></comment><comment><USER11> A year ago I bought a Luxe bidet attachment for my wife as half-joke. We basically fell in love with it. Bought it for friends of ours to be funny. They thought it was hilarious, waited months to install it, then installed it and fell in love with it. Now they want to buy it for friends. We bought it for family members for this Christmas. Uproarious laughter, and then... you guessed it, they fell in love with it, and thinking of who they might buy it for. For Americans, this is truly one of those things where you come away thinking "Holy moly, why did we not do this sooner?"

It's $60 for the deluxe version, cheaper if you don't want hot water (and you actually don't need the hot water). It's a subtle-but-massive improvement in quality of life.

<comment><USER12> Hopefully this standardization should help the Japanese toilet export market. They are very quality goods that are hindered by poor UI/UX.

</comment></comment><comment><USER13> I was hoping that along with the standardization we'd get an explanation (in english) as to what these symbols mean.

I mean it's nice to know that we can standardize to:

\- a pair of line wobblers

\- two tornadoes of different intensity

\- two different fountain rides with different camera angles and zooms

\- getting mauled by a three-toed sloth, and

\- the all important black box

but maybe for people with less inductive skill some words would help too.

<comment><USER14> The one in the second paragraph is not good enough?

> _The icons in the image above mean (from left to right) raise the lid, raise > the seat, large flush, small flush, rear spray, bidet, dry, and stop._

<comment><USER15> I think they were referring to english language lettering on the toilets. Because we're not going to carry around a print out from the verge.

<comment><USER16> One read of the explanations and the icons make sense. They should be memorable after that. Of course hurricane is flush – it's the swirly result. Forever memorized.

</comment></comment></comment></comment><comment><USER17> For those who don't know, you don't actually have to use the bidet when you go to Japan. The most complicated thing about toilets in Japan is that the flush button is on the wall sometimes (and the emergency button is often on the wall, too).

<comment><USER18> ... there's an emergency button?

<comment><USER19> And in what circumstances would one use it? What does it do? Who does it call?

So many questions...

<comment><USER20> You've never been in a handicap toilet in the west?

<comment><USER19> I have - and I've never seen an emergency button in one.

<comment><USER20> Interesting. I've often seen emergency buttons in handicap toilets in the EU. Where are you?

<comment><USER19> New York. Used to live in Palo Alto and Toronto, and I've never seen emergency buttons in disabled washrooms in hose cities either. Perhaps it's an EU regulation?

<comment><USER21> Examples: [http://wheelchairsteve.com/2014/emergency-cord-in- accessible...](http://wheelchairsteve.com/2014/emergency-cord-in-accessible- toilet-hooked-around-the-wall/)

Contrary to what he writes, I've seen them in a couple of places in the UK. I rarely use the accessible toilet though, typically only in small but modern offices where the only toilet is accessible, or on trains.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> It's nice that these companies have come together to standardize their icons.

I don't see the intrigue in this story, though. Can someone explain it to me? Is it the iconography design? The "wow Japanese toilets are complicated!" reaction? People just upvoting anything that has to do with Japan?

<comment><USER23> It's not something you'd think needs standardizing. And yet here we are.

<comment><USER22> Different manufacturers have different iconography, because there is no need to standardize. This is true with microwaves, washing machines, ovens, etc. You buy a washing machine, learn how to use it, and then never think about it again.

Public utilities standardize their iconography because many people use them. That's why every sign directing you to a restroom, or an exit, or a drinking fountain looks largely the same.

Japanese bidets are alien to most foreigners, Japanese tourism is growing rapidly and will have a big spike in 2020, and since bidet toilets have basically become public utilities, the industry came together and created a standard.

It just seems like a logical conclusion without any intrigue to me. Even sticking with the Tokyo Olympic theme, the stories about the hotel shortage, the mess with Tsukiji, and the conflicts about what to do with Golden Gai are far more interesting.

<comment><USER20> > _Different manufacturers have different iconography, because there is no > need to standardize. This is true with microwaves, washing machines, ovens, > etc. You buy a washing machine, learn how to use it, and then never think > about it again._

Cars have standardized their dashboard iconography

</comment></comment></comment></comment><comment><USER24> I think the real problem is lack exposure to such miraculous devices outside of Asia-Pacific.

</comment><comment><USER25> As an American who has used Japanese toilets I can testify that they are solving a very real problem.

</comment><comment><USER26> My favorite thing is not the complexity, but that you can operate the toilets without touching them. I wish we had foot controls for cover, flush, water cleaning faucet and soap mandatory everywhere.

<comment><USER27> Alexa, clean my bottom!

<comment><USER28> I could probably build that. The remote for the washlet is just IR, bet it would be easy enough.

<comment><USER27> If you have any ambitions to HN (and reddit!) superstars of, do it (and write about it).

It would be a wonderful conversation starter.

</comment></comment></comment></comment><comment><USER19> At the risk of sounding completely uncultured, what exactly is a rear spray, and how does it differ from the bidet functionality? Is the bidet targeted and the rear spray a delightful misting?

<comment><USER29> bidet has a female icon, spray is gender less. angle (and spread) is different accordingly.

source: on vacation in japan right now, pressed the bidet button first, wrong angle.

<comment><USER19> Ah - interesting. I always thought that "bidet" was gender-neutral. Good to know!

<comment><USER30> Bidet _is_ gender neutral. This must be the japanese interpretation of the word.

</comment></comment></comment></comment><comment><USER31> Serious question: WHY can't the computer industry do this for USB-C cables and ports? It's desperately needed and shameful that they haven't done this.

<comment><USER32> The era of USB-A was a golden age - an almost mythical period of time when everyone against all odds actually agreed to converge into one universal way of attaching peripherals. Alas, nothing lasts forever. Now it's back to how it usually is with standards [1].

[1] [https://xkcd.com/927/](https://xkcd.com/927/)

<comment><USER33> I have devices with ports in USB-A, USB-B (printer, hubs, hard drive enclosures), Mini USB (ewwww), and Micro USB. I expect I'll still have all of those by 2022, except _maybe_ mini USB if I've ditched my PS3 (doubt it). But by then I'll probably also have a handful of USB-C devices (maybe 2 or 3—I have none right now) and likely a semi-compatible USB-C-2.0, plus USB-D and USB-F will be out and claiming to be the Way Forward, too.

<comment><USER34> What's wrong with miniUSB? It's a superior connector to microUSB: it's thicker and far, far sturdier, and doesn't wear out so easily like microUSB always does. Most of the microUSB cables I've used eventually get really loose and don't lock into the socket correctly; this never happens with miniUSB. I honestly wish the industry had never invented microUSB and had stuck with miniUSB instead. As a bonus, the extra thickness of miniUSB would have prevented phones from getting so thin, so we'd likely have thicker, sturdier phones too with greater battery capacity. (But oh no!! These phones might weigh 0.2 ounces more!! That's too heavy!! /s)

<comment><USER33> > The Micro plug design is rated for at least 10,000 connect-disconnect > cycles, which is more than the Mini plug design.

from:

[https://en.wikipedia.org/wiki/USB#MINI](https://en.wikipedia.org/wiki/USB#MINI)

Anecdotally (and probably relatedly), my mini-usb plugs always wiggled in the socket, while micro-usb does not. They also seemed to require less force to unplug, and so popped out accidentally more often.

<comment><USER34> That's really weird, because anecdotally, that's exactly the opposite of my experience. I've gone through a bunch of microUSB cables that got loose and wouldn't stay plugged in, and I've never had any problems with miniUSB cables and connectors at all, ever. I've never seen a miniUSB plug that wiggled in the socket, but this has been par for the course with microUSB. Besides older devices like cameras (which I no longer use), I still use miniUSB on my Microchip PIC programmer and my Fender guitar amp.

It's a bigger, bulkier connector than microUSB, with a much thicker and more robust metal shield. I really don't see how wiggling would be more of a problem on miniUSB than microUSB because of this factor.

As for force, again my experience is exactly the opposite: the miniUSB connectors require a lot of force to both engage and disengage. Not as much as full-size USB of course, but a lot more than the wimpy little microUSB connectors.

</comment></comment></comment></comment></comment></comment><comment><USER35> Are these used outside of Japan?

<comment><USER36> I'm from Denmark (Europe). Looked into it recently. They are extremely expensive. You are easily looking at 2000 USD for a cheap setup. I saw a couple of premium ones for around 14k USD. At this point, I think the problem is that here is not a big enough market to warrant investment. A Catch 22 until some big company decides to enter the market and others follow.

<comment><USER21> The cheap option is a "bidet shower". I had a rented house, owned by a Muslim, which had them installed.

They are presumably cheap to buy, but they need a proper water supply, and plumbers in Denmark are expensive...

[https://en.wikipedia.org/wiki/Bidet_shower](https://en.wikipedia.org/wiki/Bidet_shower)

<comment><USER34> Are you not allowed to buy yourself a few fittings and a wrench and do it yourself in Denmark?

<comment><USER21> I have no idea, I've not lived here long enough to find out.

Probably.

</comment></comment></comment></comment></comment><comment><USER37> this is tantamount to cultural genocide /s seriously though, one of the peculiar joys of being in japan and having a very poor grasp of the language is the inescapable urge to play with the bidet buttons. you will inevitably start spraying water all over the bathroom, get yelled at by a nice robot voice, and panic a great deal.

</comment><comment><USER38> All those different symbols were a real shitshow and people just couldn't deal with that crap, now that they are going to sort this out it won't be a pain in the ass anymore with them flushing their old way of doing things away.

</comment><comment><USER39> To me... for a an industry standardization, those icons are pretty elegant. Just thinking of standard restroom signs and then looking at these.

</comment><comment><USER40> This standardization makes it clearer that there's a button that blasts you into the air.

</comment><comment><USER41> What are the chances that they'll standardise on the Three Seashells system?

</comment><comment><USER42> So they watched Why him?</comment>


Google Chrome Hacked? - <AUTHOR> http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php

<comment><USER2> Their site seems to be going down, so here's the text:

\---

Hi everyone,

We are (un)happy to announce that we have officially Pwnd Google Chrome and its sandbox.

The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox, it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64).

The video shows the exploit in action with Google Chrome v11.0.696.65 on Microsoft Windows 7 SP1 (x64). The user is tricked into visiting a specially crafted web page hosting the exploit which will execute various payloads to ultimately download the Calculator from a remote location and launch it outside the sandbox at Medium integrity level. Note: The Calculator is used here as an example, it can be replaced by any other payload.

While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any installation of Chrome despite its sandbox, ASLR and DEP.

This code and the technical details of the underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers as part of our vulnerability research services.

The video in question is [http://www.youtube.com/watch?feature=player_embedded&v=c...](http://www.youtube.com/watch?feature=player_embedded&v=c8cQ0yU89sk)

</comment><comment><USER3> Unless Google is one of their customers it may actually be a little while before this exploit is fixed. VUPEN does security research and doesn't disclose to original vendors unless they happen to be customers.

I both love and hate them. They are extremely talented and find absolutely awesome bugs that are hard to discover without a lot of work, and I hate them because they don't disclose their work unless it is for money. While I can understand that they have to make a living too, it just feels wrong to not protect everyone in the world when possible.

<comment><USER4> The reality is that there is probably no chance that they would ever find these bugs if they weren't funded to do it and the only way to be funded is to have customers.

The net result is probably safer software for all.

<comment><USER5> The net result in this case is the government owning a zero-day root exploit for every Chrome/Win citizen's computer. It's worse than zero-day because we have no reason to expect a patch, so the window of attack will stay open.

<comment><USER6> Out of speculation, would this tie in at all to an article I saw on HN a while back about the Government hiring 3rd parties to hack Google for some reason?

<comment><USER7> Is it wrong for our government to do any security research? I mean can good things not come out of it? Be thankful it was reported.

<comment><USER6> I never said if anything was right or wrong, nor did I assume any of it, I just asked if it was related. Good to know curiosity gets flagged around here.

</comment></comment></comment></comment></comment></comment><comment><USER8> I can understand their joy but the last sentence in the post and the Twitter update: "Sorry Google...we have officially pwned Google Chrome and its sandbox with a 0-Day." [1] seem rather unprofessional for the "world leader in vulnerability research for defensive and offensive security" [2], a company with "Government customers".

[1] <https://twitter.com/VUPEN>

[2] <http://www.vupen.com/english/company.php>

<comment><USER9> Who cares if they sound unprofessional to you? Very obviously they produce.

<comment><USER8> I am still waiting for that obvious evidence. That includes more details and also tests on the latest dev version of Chrome (Chromium). I am not defending Google in any way, but some claim with no real evidence shouldn't convince anybody.

<comment><USER10> I saw a similar mentality on the Skype for Mac thread, as if there is a huge incentive to just make up vulnerabilities. More or less, when HN threads don't want something to be true ("terrible Chrome vulnerability with no public info and no pending patch!"), they make up controversies to keep them from having to accept that it's true. It's a bad habit.

<comment><USER11> I have over the years participated on a number of communities "for smart people", and this is the case in all of them. People have their particular points of view, and when there is some evidence against what the group considers to be good they use all kinds of ad-hominem attacks. I know it is just human nature, but it is sad that people don't see these patterns occurring.

<comment><USER12> Be fair. Exceptional claims require exceptional evidence. They offer no evidence at all. Scepticism is healthy.

<comment><USER13> Browser bugs are found in every single browser on every single platform. They're reported for free, traded privately, sold privately, given to the vendor for a bounty, used to spread malware, discovered in American corporations, discovered in Iranian corporations, and more. There is nothing exceptional here. This is business as usual. It's non-trivial, but far from exceptional.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> > This code and the [...] underlying vulnerabilities will not be publicly > disclosed. They are shared exclusively with our Government customers

And the vendor, I hope? Of course, we know HBGary was developing private exploits, but it wasn't exactly blogging about them.

<comment><USER15> I'm not too sure that's the business VUPEN is in. Sure, it doesn't hurt them much to share their latest Safari exploit given how slow Apple is on the fix, but with Google their window has the potential to be very short.

<comment><USER16> Citation needed for such a serious accusation. They claim to be ethical. From their about page: "VUPEN follows a private responsible disclosure policy and reports all discovered vulnerabilities to the affected vendor under contract with VUPEN, and works with them to create a timetable pursuant to which the vulnerability information may be publicly disclosed."

<comment><USER17> <http://www.vupen.com/english/services/>

> As the world leader in vulnerability research, VUPEN Security provides > weaponized and highly sophisticated exploits specifically designed for Law > Enforcement and Intelligence Agencies to help them achieve their offensive > missions using tailored and unique codes created in-house by VUPEN for > vulnerabilities discovered by our researchers.

Note also the "under contract with VUPEN" part of the disclosure bit.

<comment><USER18> _Law Enforcement and Intelligence Agencies_

Which countries? It does not specifically state US.

<comment><USER15> I'm pretty sure they limit their customer base to NATO signatories.

<comment><USER18> Link?

<comment><USER15> Well, I was close...

 _\- Gov. and Law Enforcement Agencies in Countries Members or Partners of NATO, ANZUS or ASEAN_

<http://www.vupen.com/english/services/ba-gov.php>

<comment><USER19> ASEAN includes such well-known liberal democracies as Burma, Vietnam, Laos and Brunei.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> This seems extremely unethical to me. Now that the world knows there is massive exploit in Chrome, there are bound to be more hackers attempting to abuse it - and have a few hints from the video. By blogging about this and not disclosing it to Google, they are actually increasing the risk of millions of individuals and companies being hacked.

Edit: Then again, blogging about it also makes Google aware of the exploit. I'm sure they have tons of resources working on it that wouldn't have otherwise...

</comment><comment><USER21> vupen: "Hey Google, your browser has a very nasty bug that allows for potentially horrible things to happen. We thought we'd share that with the world. If you'd like to know where it is though, you'd better give us money."

<comment><USER13> Why not? This is highly specialized research that not even well-paid Google employees were able to do.

This is actually quite common in recent years for bug hunters and exploit developers. I can think of a dozen or so companies that do the same thing. Immunity is another example.

Trying to use a moral argument to get out of compensating someone when you have the resources to do so is shameful. Sorry, but this stuff is worth far more than the (up to) $3133 they are offering.

No More Free Bugs, as they say.

They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally. Fair is fair. There is no reason this isn't worth compensating but something like pagerank optimizations is.

<comment><USER22> Publicly announcing a security vulnerability, claiming that you're sharing it with other clients with the intent of using it for "weaponized ... offensive missions", and then demanding a fee to gain the information to protect against said weaponization, sounds an awful lot like extortion. In the offline world, I don't think you can legally run a business with a strategy of: discover a problem in the security at one of Exxon's plants, publicly announce that you've discovered a vulnerability and will be selling the information to third parties, and then demand $N from Exxon for the details.

<comment><USER23> This is probably why they keep repeating that their customer is the government. You could probably sell Exxon's security vulnerabilities to the government and demand $N dollars from them to show them how to fix the problem. It's advertising the vulnerability with posts like this that seems most questionable (similar to extortion) to me.

<comment><USER22> Yeah, that's the part that seemed odd to me as well, though someone knowledgeable in this area of law (at least in the better-settled offline case) could give some better info.

I believe it'd be okay, and probably actually happens, for a private security consultant to do threat assessments for a (non-criminal) client, e.g. prepare a report for DHS on the security of U.S. oil installations. _But_ it seems like they'd be crossing a line if they posted a press release trumpeting a major vulnerability they discovered, mentioning by name which company and approximately where the vulnerability was located, but then refused to disclose it to the company in question.

I'm not sure how much it survives, but I believe there was traditionally even a common-law "duty to warn" if you were aware of significant risks to someone's person or property.

<comment><USER18> Google could easily sue them into oblivion for libel. They would be forced to reveal the exploit during proceedings to prove their innocence.

<comment><USER24> one is not obliged to prove innocence in a sensible court of law

<comment><USER25> At least in the US, civil court cases do not have the presumption of innocence, only criminal cases do.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> Looking at the video and time it took to launch the calc.exe, it could be pdf/flash exploit that they are using.

Process count in process explorer started with 5 and at the end of the demo, it looked like they have 8. That tells there are 2 extra processes that are created (discounting 1 for calc.exe).

I tried to see if pdf/flash creates new processes but I couldn't verify. Perhaps a chrome developer could get a clue about what is happening looking at the video.

<comment><USER27> They are obviously hiding something. When they flip back to Process Explorer, Chrome is perfectly sized to cover everything in the window except the calc.exe. My guess is there are other processes running that they're trying to hide that were used in the exploit.

<comment><USER28> It would have been trivial for them to patch Process Explorer to hide whatever they wanted anyway.

<comment><USER29> Nah, the vupen marketing guys are too lazy to patch it.

</comment></comment></comment></comment><comment><USER30> "This code and the technical details of the underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers"

Love the capital G.

<comment><USER31> It's a standard formation in some publications--e.g., the New York Times.

</comment></comment><comment><USER32> seems odd to me that they don't publicly disclose the vulnerabilities, but they do publicly disclose the software versions affected by their "weaponized exploits", thereby giving the heads up to whomever might be targeted to avoid using that newly compromised software.

<comment><USER33> I think the version disclosure here was less of a "This version has a bug" and more of a "The latest version has a bug." It's a lot safer to tell people which haystack the needle is in than to give away the needle anyway.

</comment></comment><comment><USER34> The two things I noticed were that 1) The user of the device is named "IAmAdmin", implying that they have admin rights, and 2) The "integrity" of chrome.exe is changed from Low to Medium at somepoint during the attack. Could this somehow be related to breaking out of the sandbox?

</comment><comment><USER35> I wonder if this is a sandboxing issue with NaCL, which is I noticed was added (default disabled) in Chrome 11.

Considering how non specific VUPEN are, I wouldn't be surprised if they're hiding this.

<comment><USER36> Sounds like it's Windows only, so I'd expect it to be related to the Windows sandboxing.

<comment><USER37> Well clearly there are two things going on here, assuming VUPEN is on the level:

1) A remote code execution exploit in Chrome

2) A privilege elevation exploit allowing the hijacked browser process to break out of its mandatory access control jail

Number 1 is of necessity a bug in Chrome itself (or a plugin). Number 2 is probably a vulnerability in the Windows sandbox, but it could instead be that they found a way to successfully attack the small part of Chrome that runs outside low integrity mode. They weren't specific as to the details.

This is, again, at the very least a remote code execution hole in Chrome, and there's no fundamental reason Linux or OS X should be invulnerable to the same hole. That Chrome on Windows is less secure than on Linux or OS X would be the wrong thing to take from this; the point of this demo is that VUPEN accomplished the feat of bypassing all the security mechanisms protecting Chrome on Windows, whereas on the other platforms you have fewer of these mechanisms in the first place (no real ASLR on OS X, no Chrome sandboxing last time I checked on Linux).

</comment></comment></comment><comment><USER38> To what extent is this extortion? I mean, they have admitted to only selling to a government. That means they find and exploit vulnerabilities in software created by a private corporation, disclose the existence of a vulnerability publicly, but don't allow the corporate body the means of fixing it. This news, if publicised, would harm Google's reputation and goodwill, perhaps non- negligibly, and cause users to switch products. Unless, of course, Google outbids a government. Pay up or suffer - would this be extortion?

<comment><USER24> I don't believe this crappy little security firm has more resources than Google, even in the Security Research Dept. They can go find it themselves and fix it. Anyway, it's probably mostly a windows bug. If you line the right bytes up together in windows' RAM, it will void itself and yield 'root' or whatever wiener name they have for it. Who knows, maybe they Govt is trying to screw google, and told them to do a fake release. Their post doesn't make them sound like real pros.

</comment></comment><comment><USER39> "it works on all Windows systems (32-bit and x64)"

They didn't say that the exploit _didn't_ work on Mac or Linux, but one can only assume they tested those and weren't successful?

<comment><USER37> I wouldn't assume that. I think the big deal here is that they managed to break out of the Windows sandbox; that's what makes the exploit particularly interesting. The same vulnerability could exist on Linux too, but they just didn't invest the time in developing and demoing an exploit there too.

Or maybe not. I'm just saying, we can't assume either way.

</comment></comment><comment><USER40> I'd like to mention something to everyone running around crying about the falling sky because THE GUBBMINT has paid a security company to audit Chrome. Oak Ridge National Labs just recently had to shut down COMPLETELY because an Internet Explorer exploit "pwned" them. Do you maybe see how THE GUBBMINT might be interested in knowing if other browsers, such as Chrome, are as vulnerable?

But by all means, put on your tinfoil hats if that's more fun.

</comment><comment><USER41> its times like these (among others) that makes me happy my browser automatically updates behind the scenes

<comment><USER42> That works as long as the exploit is known. What happens when it's not?

<comment><USER41> same thing that happens when an exploit is found for a browser that doesn't automatically update

<comment><USER42> Which I suppose begs the question: Are automatic updates the silver bullet they seem to be sold as? I don't unequivocally disagree with them, or rather I disagree with them, but based on principle. In practice, it seems easy to argue that the benefits outweigh the arguments against. Still it'd be nice if there were at least an option to turn off the updates. (Perhaps there is and I've missed it in the settings?) Nonetheless for the time being I'll stick with my old fashioned browser, just because I'm a kind of a geek that prefers to initiative his own updates.

</comment></comment></comment></comment><comment><USER43> does anyone know how much vupen charges for their exploits, on average?

</comment><comment><USER44> So, can google put a patch in Chrome that whenever it runs at VUPEN, everything VUPEN has on that computer is shipped over to Google? :-).

Google has/had the 'do no evil' in their philosophy, and disabling a scheme that misuses their software for cyber-warfare sounds like a good thing.

</comment><comment><USER45> the video is edited, right about when he's showing process explorer post- exploit. the cursor suddenly leaps across the screen, so assuming they're covering up the other child process of the main chrome process is fair. strangely, process explorer's 'process count' only goes up by 1, despite launching calc, and (seemingly) another child process. To be over-zealous, the single row of visible pixels for that other process is consistent with rundll32.exe.

That _still_ doesn't mean that it's not a chrome bug - the exploit may use flash to retrieve the payload, make use of flash-js communication, flash- chrome communication quirks etc.

</comment><comment><USER46> Impressive, but not surprising. Chrome isn't magical; ASLR and DEP have been bypassed in the past, and even if its own sandbox is perfect, the kernel it's sitting under is a huge attack surface.

<comment><USER47> ASLR and DEP, by and large, have nothing to do with the kernel. ASLR is a function of the binary loader and memory allocators, which are in userland. DEP is a function of userland memory protection flags (they're handled on the bare metal by the kernel, but the kernel just sets what it's told to by the userland). I'd put any amount of money down on the table that there is no kernel vulnerability here at all -- if there was one, I assure you that it'd be more than a Chrome vuln.

<comment><USER46> I know; my comments about ASLR/DEP and the kernel were intended to be separate. As for whether there's a kernel vulnerability, I'll defer to you (although it doesn't have to be full-fledged arbitrary code execution; it can just be a system call that's lax about security tokens), but in general the breadth of kernel code the renderers can access is pretty large.

</comment></comment></comment><comment><USER48> So assuming this is for real they're going to tell the government so it can pwn us but not tell Google so it can fix it.

</comment><comment><USER49> Not saying this isn't true, as I'm sure VUPEN is quite legit, but what stops me from creating a keyboard shortcut to calculator.exe, opening a random website which loads for a few seconds, and then pressing ctrl+alt+f6 or something to open calculator?

<comment><USER15> Nothing keeps you from doing it, their reputation keeps them from doing it.

</comment></comment><comment><USER50> This video is extremely suspicious to the point of probably being an outright lie. I would wager money that this vulnerability is a Flash exploit sold as a Chrome exploit.

It is not an accident that they hid Process Explorer after the exploit. They closed it before minimizing everything else intentionally. If you do not believe me follow the mouse pointer. The screencaster moved toward bringing Process Explorer top-level at 0:56 then realized it would show the entire thing and restored Chrome on top of it instead. With that in mind it is obvious that they do not want you to see what changed when it ran so instead we have to work with what is visible:

Process Explorer before: <http://i.imgur.com/e31Rb.png>

Process Explorer after: <http://i.imgur.com/JfPTY.png>

First item of interest is that Chrome shot up to over 400 MB of memory used which indicates that Flash is almost certainly involved.

Second, observe how long it takes for Calculator to start. Again, consistent with Flash being involved and Chrome delay-loading it.

Third, there are scroll bars on the tab. Big ones. This says there is an invisible item on the page taking up a lot of space which again points to Flash. I saved the exact same content to a file and look how small I can go without scroll bars: <http://i.imgur.com/R0eqk.png>

Fourth, flip back side by side through each photo and notice what disappears. The Windows search indexer disappears between screenshot A and B and this is what Vupen is intentionally covering up. You can still observe it indirectly based on the rows and colors at right. It is my understanding that the child processes of SearchIndexer.exe run at all times and not as some kind of cron but I do not use Windows so please correct me if I am wrong. At any rate they do disappear between A and B.

It would be very intelligent of them to blog post this as a Chrome sandbox bust (which is sort of newsworthy) and gain that link bait attention but, privately, use the exploit as the Flash and Windows vulnerability it most likely is.

<comment><USER51> I can get Chrome to chew through all of RAM and swap just by repeatedly changing the src= attribute of an img tag (which, by the way, I'd like suggestions on avoiding). Flash isn't required to eat lots of RAM.

<comment><USER52> Re: "suggestions on avoiding"

Is this for a rollover, animation, or something else? (Mind posting a code snippet up somewhere?)

<comment><USER51> I've been meaning to ask on Stack Overflow. It's simulating a video stream from a device with no FPU that's probably too slow to encode WebM or H.264. I'm dynamically generating a PNG image on the device and reloading it at regular sub-second intervals in Chrome via JavaScript. [Edit: I had to write a custom Ruby extension that directly calls libpng to get reasonable performance]

I have a hidden <img> tag and a <div>. In the timer callback I set the src= attribute of the <img> tag to the URI of the image plus the current time (e.g. "/image.png?v=123456789"), then in the <img> tag's onLoad I set the <div> tag's background-image style to the same value.

I was going to try using two <img> tags, and alternately hiding/showing them, but I doubt that will solve the caching issue. My current workaround is to keep the Chrome developer panel closed (which seems to store every resource loaded by a page regardless of any cache directives from the server) and have the page reload itself after 60 seconds of no user activity. Unfortunately, Chrome's memory usage still grows, only not quite as fast.

<comment><USER53> I, and many others, have been anxiously awaiting a fix for this:

<http://code.google.com/p/chromium/issues/detail?id=36142>

It keeps getting punted. If you care, I recommend starring the issue.

<comment><USER51> I starred it, but it doesn't look like anybody working on Chromium cares to fix it, and nobody's posted a reasonable workaround. So much for HTML5.

</comment></comment></comment></comment></comment></comment><comment><USER54> Oh my lonely Linux desktop, no 0-day for you as usual :P

</comment><comment><USER55> Whether or not this exploit is impressive, using the term "pwnd" comes across as incredibly unprofessional and predisposes me to perceiving this whole article in a negative light.

<comment><USER10> No disrespect intended, but, it doesn't negatively predispose anyone who conducts or utilizes vulnerability research professionally, so I doubt your concern matters much to them.

<comment><USER56> Oh, thank you for this comment. I wasn't aware that literally everyone who uses vulnerability research as part of their job had had a meeting and elected a spokesperson.

</comment></comment></comment><comment><USER57> A video of calculator showing up after clicking a link hardly constitutes proof of an exploit.

Considering the fact that they aren't going to publish the exploit, I just want to point out that this kind of thing could _easily_ be fabricated. There are plenty of interests that benefit from unfortunate news about their competitors.

<comment><USER58> What would those "plenty of interests" be in this case?</comment></comment>


Should I accept to have coding test after 6 years experience - <AUTHOR> I'm applying for a new job in the EU and all the recruiters asked me to do a coding test before even small companies. some of the tests were super stupid and many recruiters were unprofessional during the test ( some of them didn't accept to write a pseudocode for my solution on a whiteboard he asked to  write python code) wondering if I should train more on interview questions or should I push to keep it a high-level discussion about my previous projects. <comment><USER2> I have interviewed many people for programming positions. Some could write apparently reasonable pseudocode, but never actually convert it into working code, even in the language of their choice. A worryingly large number couldn't write the simplest routine to perform trivial tasks, even in the language of their choice.

Some of the above claimed to have 10 years experience in the field.

There's a lot of push-back against requiring FizzBuzz, and I understand that. So the approach I took was to say - "Let's start with a simple FizzBuzz routine and we'll discuss some issues that arise from it."

But you get complete jerks in recruiting, just as you actually get complete jerks everywhere. If you don't like the atmosphere the recruiters/interviewers are creating, would you want to work there? You need to assess how representative these people are of the company as a whole.

In the end, it's up to you. Sometimes to accomplish something you simply have to schlep[0], put up with the tedious and annoying for the sake of accomplishing your goals.

[0] [http://paulgraham.com/schlep.html](http://paulgraham.com/schlep.html)

</comment><comment><USER3> I code screen everyone on a laptop using their favorite tools - I want to see how they work, how they debug, how they solve problems.

Some engineers can talk a good game and can't really code at all, or they're cut-and-paste programmers who can only solve a problem by finding 80% of it on Stack Overflow...

</comment><comment><USER4> Coding tests give the appearance of an objective interviewing process, but I haven't seen evidence that such tests have predictive value. People who don't perform well don't get hired, so their possible contribution remains unknown. I have not seen companies track coding test skill and correlate it to job performance. Mostly these tests give the subjective and often irrelevant hiring process a veneer of rigor and objectivity.

In many, if not most, interviewing and hiring situations the candidate's personality and presentation will have more effect than technical skills — we form impressions of people in a few seconds. Coding tests look like the main decider but human nature tends not to work so rationally.

The proliferation of books, web sites, classes, and bootcamps for technical interview prep demonstrate Goodhart's Law: job seekers optimize for the interview rather than honing job skills and learning business domains. Interviewing well has obvious value for getting a job, but doesn't necessarily predict adding value to the business.

Companies want people who can (at least appear to) immediately write code. Employers rarely invest in training or mentoring, there's no apprenticeship path into programming for most of us anymore.

In 40 years programming I can't recall ever having to invert a binary tree, or find a cycle in a linked list. Understanding basic data structures and algorithms has value, but companies don't lose money or go under because of those kinds of things.

Sadly I find that trivial tests like FizzBuzz continue to work at weeding out a shocking number of people who simply can't write working code. That says something about programmers at all experience levels: an inability to translate requirements into code. Employers should focus on identifying that ability, rather than mastery of technical arcana.

<comment><AUTHOR> Thanks for your post I found it really helpful.

</comment></comment><comment><USER5> I had to do a coding take home test after 15+ years of experience.

The market is what the market is. You could turn down any interviews that require you to take a coding test and see what is out there.

</comment><comment><USER6> I appreciate that going through hiring process is challenging, and it is stressful and time consuming to need to prove or demonstrate yourself again and again in a process that can be rather artificial and seem unrelated to the job, often while getting negative feedback.

On another hand, think about it from a company perspective: maybe 100 people apply for an advertised role. 25 might be excluded based on CV. Remaining 75 are phone screened and given coding tests online. 35 might be excluded based on that. 40 invited to proceed to on site to interview. 5 out of 40 candidates might demonstrate reasonable ability during on site interviews in terms of actually being able to write code, and demonstrate some problem solving ability, and some familiarity with common data structures, and not have obvious red flags about how they relate to people. Two of these 5 candidates who gave a strong performance drop out due to competing offers, one runs into visa issues, remaining two offers are made and accepted.

Some candidates will apply for roles with no relevant experience, some candidates will demonstrate no ability to program in their preferred programming language during on site interviews after doing well during an earlier remote coding test (e.g. they got a friend to sit the test for them), some candidates have 10 years commercial experience but cannot assess when to use an array versus a hash map.

This might boil down to something like 150 - 200 hours of human effort, much of this engineering effort required to assess engineering ability, to identify a single candidate who is a strong fit and goes on to accept an offer.

From the company's perspective, the company has an imperfect hiring process. Sometimes candidates have a rough day, freeze under stress and don't perform well during the interview- even if they could be a good fit for the job. Sometimes the hiring process emphasises measuring things that aren't necessarily the most important things for the role. But it costs the company a lot more money to hire the wrong person versus missing hiring a person who's a great fit, so it's probably the right tradeoff to bias the hiring process to reject more often than accept, and risk rejecting a number of candidates who could have turned out great.

</comment><comment><USER7> You are taking a coding test because the recruiter cannot evaluate you based on a conversation. Even if they were talented enough to be able to, they are not trusted enough by boss / client. The money they make is so good for recruiting a person, it drives a lot of people to push for people who cannot do the job, just for the commission.

<Story Time> A few years back I was looking for work without much luck. Finally I get a call from a head hunter that wanted to place me in a contract. It was short duration, only a month, but as much OT as I wanted. Pay was also very good. They wanted a DB guy. Although I am mostly coder, I do love DB and am more talented at DB than you typical coder. Digging deeper I found out they wanted someone to work at hardening (defense) the DB from intruders. Well that was well outside of my skill set. I refused to take the job as I knew the actual customer would not be happy, and I did not want a reputation for claiming to do stuff I was not capable of.

</comment><comment><USER8> Majority of coding tests are extremely unrealistic anyways and you never use any of it in real world. Let's say some fizzbuzz or fibonacci or whatever else. I've only had 2 realistic interviews where they ask you to code some microservice or create some app and present it to them. They also make the excuse "I want to see how you think" but let's be honest in real world you would Google and try out bunch of things until something works for lets say some CRUD app you are building and you barely ever use any "logic" to build something, so don't stress about it.

</comment><comment><USER9> No, writing throwaway code is a waste of time.

</comment><comment><USER10> Seeing how someone drives an editor, IDE or cli is often a _strong_ indicator of how good they are... Watching people arrow around in vim often gives me all the information I need when interviewing...

<comment><USER11> Yeah how dare people use the keys specifically design to move around a text editor! Just use hjkl like they did on some machine decades ago because it had a limited keyboard.

<comment><USER4> The ADM-3A terminal on which Bill Joy developed vi had cursor control keys, ctrl+hjkl.

[https://en.m.wikipedia.org/wiki/ADM-3A](https://en.m.wikipedia.org/wiki/ADM-3A)

I agree that vi/vim mastery or choice of editor has nothing to do with programming skill.

<comment><USER12> "Hokey religions and ancient weapons are no match for a good blaster at your side, kid" — Han Solo, condemning Luke's use of VI

<comment><USER13> I read this as "hotkey religions" which actually fits haha</comment></comment></comment></comment></comment>


Ask HN: ETH will cross BTC price? - <AUTHOR> <comment><USER2> Assumptions/Facts:

1\. Total number of Eth is not fixed BTC is.

2\. Eth is moving to proof of stake

3\. ETH has contracts. BTC is stored value.

4\. ETh is growing faster than BTC

5\. Mining BTC requires specialized hardware

6\. Some Alt coins use ETH for running transactions.

7\. ?????</comment>


An Insurer Resists Paying for 'Avoidable' E.R. Visits - <AUTHOR> https://www.nytimes.com/2018/05/19/upshot/anthem-insurer-resists-paying-emergency-room-visits-if-avoidable.html <comment><AUTHOR> This is useful too in light of Vox's reporting project that seeks to uncover how much ER visits actually cost and how prices are actually decided: [https://www.vox.com/2018/2/27/16936638/er-bills-emergency- ro...](https://www.vox.com/2018/2/27/16936638/er-bills-emergency-room- hospital-fees-health-care-costs)

</comment><comment><USER2> You would think the hospitals would be able to help out here with a determination that even though upon examination there turned out not to be an issue, the symptoms were consistent with a condition that would require treatment in the ER.

If the diagnosis requires a medical degree or equipment not available at the corner store, how is the average patient supposed to know their condition wasn't life threatening or didn't require immediate treatment to avoid permanent disability?

</comment><comment><USER3> This kind of thing is absolutely not helping me see the merits of our health care policy.

Medicare For All. Like yesterday.</comment>


Show HN: NET Core for CPanel (NexusCore) - <AUTHOR> As .NET Core (dotnet core) is slowly gaining traction under startups and larger entities I decided to build a plugin for the well-known hosting control panel cPanel (or WHM).
My personal belief is that .NET Core is a great investment for companies, and I want to help out the ecosystem by providing an easy way for companies to host their .net core applications without having to do all the plumbing themselves.
NexusCore is targetted at (shared) webhosting companies, developers, enthusiasts and other people who love .net core.
This plugin (NexusCore) allows you to set up .NET Core hosting packages within the hosting panel, basically allowing you to host the LAMP-stack for customers as well as .NET Core accounts. As I'm a developer, it also helps me host small web apps for clients.
NexusCore is available in a freemium license model, you can host up to 5 accounts with the free license (forever), and if you need more clients we offer premium licenses.
Note: I'm not affiliated with Microsoft and/or cPanel Inc but a third party developer sharing my love for the .net core product lines.
https://nexuscore.io <comment><USER2> This feature set looks amazing! [https://applications.cpanel.net/listings/view/NexusCore- NET-...](https://applications.cpanel.net/listings/view/NexusCore-NET-Core-for- cPanelWHM)

<comment><AUTHOR> Thank you! I hope you'll be trying it out!

</comment></comment><comment><AUTHOR> If anyone has questions or wants to know more, you can ask me anything!

</comment><comment><USER3> You just changed my life

<comment><AUTHOR> Awesome, happy I found someone that can use the product. What are you planning on using it for?</comment></comment>


The Contempt That Poisoned Flint's Water - <AUTHOR> http://www.newyorker.com/news/amy-davidson/the-contempt-that-poisoned-flints-water?mbid=social_twitter <comment><USER2> Is the lead coming from lead pipes, or is it in the river? I read the article, and it mentioned lead pipes.

<comment><USER3> the pipes.</comment></comment>


Show HN: YC interview practice app - <AUTHOR> http://proto.dheera.net/yc/ <comment><USER2> This is really kind of funny. Here's a gist with all the questions I ripped out of the source, in case you'd like to read them all at your own pace (instead of robo-Sam's pace)

[https://gist.github.com/ejcx/45a66cabcaf2269d895f0c8bb1db49d...](https://gist.github.com/ejcx/45a66cabcaf2269d895f0c8bb1db49db)

</comment><comment><USER3> Move it to 'Apply HN'. And you can practice with your own app.

</comment><comment><USER4> If only we had this tech when we wrote [https://jamescun.github.io/iPG/](https://jamescun.github.io/iPG/) (of which the questions seem to be based).

[https://github.com/jamescun/iPG](https://github.com/jamescun/iPG)

<comment><AUTHOR> Oh wow was not aware of this. I took the questions from a TechCrunch article: [http://techcrunch.com/2012/04/27/be-concise-the-top- question...](http://techcrunch.com/2012/04/27/be-concise-the-top-questions- asked-at-a-y-combinator-interview/)

I like the idea of the 15 second timer. Perhaps I could use the microphone APIs to detect speaking and time appropriately. Or better yet, the speech recognition APIs to detect BS.

</comment></comment><comment><USER5> Comically difficult to understand. Possibly raise the pitch on the voice to increase clarity.

</comment><comment><USER6> Can Sam provide proper voice talent ? :-)

</comment><comment><USER7> Oh wow was not expecting this

</comment><comment><USER8> Scary

</comment><comment><USER9> It's fun, it's using a French TTS engine on my computer :)

</comment><comment><USER10> Text-to-speech bot voice aside, this is brilliant!</comment>


Introduction to LSM Trees: May the Logs Be with You - <AUTHOR> https://priyankvex.wordpress.com/2019/04/28/introduction-to-lsm-trees-may-the-logs-be-with-you/ <comment><USER2> I found this older introduction to be pretty good and part of a series: [https://medium.com/databasss/on-disk-io-part-3-lsm- trees-8b2...](https://medium.com/databasss/on-disk-io-part-3-lsm- trees-8b2da218496f)

Besides the use of LSM trees in RocksDB and leveldb-like databases, there is also the WiscKey approach ([https://www.usenix.org/node/194425](https://www.usenix.org/node/194425)) that helps read/write amplification by keeping the LSM tree small and mostly removing the values to a separate value log. There's a pure Go implementation of the WiscKey approach used by dgraph: [https://github.com/dgraph- io/badger](https://github.com/dgraph-io/badger)

<comment><USER3> He (Alex Petrov) is also writing a book for O'Reilly on the database internals: [https://www.goodreads.com/book/show/44647144-database- intern...](https://www.goodreads.com/book/show/44647144-database-internals)

<comment><USER4> weird o'reilly doesn't list that on their own website.

<comment><USER5> Seems like OReilly really goes out of their way to hide ALL books these days. When you go to the main site ([https://www.oreilly.com/](https://www.oreilly.com/)), where do you see anything related to books? All I see is "online learning", "blended courses", "conferences" and "ideas".

I'm a bit upset by this, because I've found the Safari experience terrible.

</comment></comment></comment></comment><comment><USER6> If you just need to fetch values by a key, for the main storage (might be even as simple as generated by a sequence generator) you can even avoid the asynchronous background compaction overhead and thus unpredictable read- or write-peaks and so on by hashing the keys if it's not already an integer/long based identifier: Basically storing a persistent (both on-disk persistence as well as in the functional sense immutable) hash array based trie. This can easily be extended to store a new revision through copy-on-write semantics. Instead of storing whole page snapshots however, storage advanced now permit fine granular access to your data. Thus you can basically apply lessons learned from backup systems to version the data pages itself and even improve on that.

Disclaimer: I'm the author of a recent article about a free open source storage system I'm maintaining, which versions data at it's very core: "Why Copy-on-Write Semantics and Node-Level-Versioning are key to Efficient Snapshots": [https://hackernoon.com/sirix-io-why-copy-on-write- semantics-...](https://hackernoon.com/sirix-io-why-copy-on-write-semantics- and-node-level-versioning-are-key-to-efficient-snapshots-754ba834d3bb)

<comment><USER7> You don't actually need to do asynchronous background compaction at all. You can do compaction whenever in small incremental steps not causing any spikes in read or write latencies. Just spreading it across all writes gets you slightly slower, but latency capped writes. It's unfortunate that LevelDB popularized this compaction in a thread idea. It's pretty bad one.

<comment><USER6> Good catch :-) right, but still merging/compaction work has to be done. Maybe too much, if you just need to fetch a value by its key and thus just an equality scan is needed (no range scans or other comparisons). For the latter case I've implemented an AVL-tree, which is also versioned and stored in our record pages and best read fully in-memory (but doesn't have to). For sure there are plenty of optimizations and for instance also spatio-temporal indexes or full-text indexes possible, but I guess first looking into cost- based rewrite rules for the query compiler and replication/partitioning for horizontal scaling. Too many ideas I guess ;-) but the best would be to have a great open source community :-)

</comment></comment></comment><comment><USER8> I don't understand the hash index part. I guess that for every segment on disk, you also have a hash table for it, correct? Also, this part doesn't seem to be very memory-efficient</comment>


Reversal on Carbs: Scientists now blame carbohydrates for America's ills - <AUTHOR> http://www.latimes.com/health/la-he-carbs-20101220,0,5464425.story <comment><USER3> This upsets me to no end. When I was growing up in the 70s, we had a food pyramid that was based on carbohydrates, created by no less than the USDA - not the surgeon general. Then, in the late 90s, the establishment totally came down on the Atkins/Zone type diets as being inappropriate and foolish.

How is it that we went through at least 40 years of incorrect diet advice without controlled studies giving us accurate and science based broad understanding of what actually made sense?

I also find it annoying that we continue to discuss a universal "Diet", when, in fact, different people react very differently to different types of food.

I sometimes think we're still in the dark ages in terms of certain fields of endeavors.

<comment><USER4> If you're actually interested in what happened (you may just be venting, can't really tell) there's an excellent talk called "Big Fat Fiasco" on youtube that goes into the history of the lipid hypothesis (fat makes you fat) and how it got hold: <http://www.youtube.com/watch?v=exi7O1li_wA> (it's about an hour long).

One of the most amazing parts for me was the video of the senate commission tasked with coming up with dietary guidelines (the commission that created the food pyramid) outright rejecting the majority consensus that it's foolish to publish guidelines at a time that so little is truly known and that, if anything, it's carbs, not fat that are the problem. (Yes, the scientific community back then was leaning towards carbs being the problem.) One of the senators has an amazing quote along the lines of: _I don't have the luxury of waiting to make an informed decision like a scientist._

Anyway, long story short it was politicians blessing the lipid hypothesis and then later removing all funding from anyone with a contrary opinion. The nutrition "scientists" are almost all funded by the government and therefore started to self-censor and never publish anything contradicting the anointed hypothesis. If they did they were basically booted out and never funded again.

Finally it seems the breaking point has been reached and we might get actual scientific research done in nutrition science instead of the quack research that's been the norm for the past 40 years.

<comment><USER5> Global warming (* _ducks_ *) ?

<comment><USER6> You are 100% right on. It is infinitely easier to test and isolate the variables that go into metabolism than it is to test and isolate the variables that go into global climate. Its infinitely easier because the later simply isn't possible.

"I take the hard view that science involves the creation of testable hypotheses" - <USER2>

</comment></comment></comment></comment><comment><USER7> As someone who's been on a low carb, no-grain diet (mostly) over the past year, this is gratifying to read. In that time I lost (with little effort) about 30 pounds, and while I find the diet occasionally difficult to maintain (mostly due to boredom), it's easier than a low fat diet, in which I was always starving.

<comment><USER8> I've been toying off and on with low carb diets, and my body has made it clear that if I want to continue with high carb diets it intends to make me one of the guys having heart attacks at 40 or 50, so it's now permanently "on". (I'm 31 right now.)

For a while I've been playing with spices, in all the good senses of "play", and I've been upping my culinary game. Even more recently I've started to get into sort of "gourmet" cooking; I'm scare quoting it because I'm not really in it for the attitude, but just the flavor. I have a small collection of vinegars, cooking wines, various extracts and oils (you can pry my sesame oil out of my cold dead fingers), and have been experimenting with a variety of cheeses. My wife, who isn't quite as into this yet, has also become hooked; she's discovered she really likes Balsamic Vinegar in a couple of recipes. (We buy the, ahem, "fake" stuff that doesn't take decades to create and only costs slightly more than other vinegars in the store; I'm sure it's not as good but it's good _enough_.)

And lo, it turns out that there are entire culinary traditions around the world that have centuries of history working with these ingredients, and it is good. My "boredom" level has plummeted in the past six months as I've opened these doors, and lately I'm getting to the point where I couldn't go back.

It isn't that hard, and it isn't actually that expensive. It does take some experimentation, though; you can follow recipes but I've found that my tastes and the tastes of those who are really "into" the culinary thing diverge quite strongly, even as we agree on ingredients. These are expensive ingredients relative to other foods in the store, yes, but typically you only use them in very small quantities; per use they are monetarily insignificant.

Example: I like hamburgers. For other reasons, I _have_ to eat them without a bun, but I now wouldn't eat them with a bun anyhow. I do not know what it is exactly, but I find that adding one _drop_ of sesame oil to a pound of hamburger can really change things. Don't forget to salt the meat. Toss in some dried onions for even more fun. Mix it all together, then form the patties. This is not a normal burger. I say "I don't know what it is" because something is really opening up the sesame oil, usually one drop does not have such an effect on a meal, but don't dribble much more in or you will actually ruin it. (Unless you _really_ like sesame flavor.)

And this is just one example. It really isn't surprising (in hindsight, remember I've been there) that trying to take a typical American diet and subtract the bad stuff, which also happens to be where all the flavor is, has a boring result. But there are other traditions and ways of cooking that are as good or better; after all, the recommended American diet is a local aberration, not what we've been eating for centuries.

<comment><USER9> FYI, you may want to check out some Chinese recipes. The Chinese use sesame oil quite often. As you say, a little goes a long way, but that little amount has a great affect. Vegies like broccoli and bok choy especially seem to like it.

</comment></comment></comment><comment><USER10> I think our best bet is to let our own bodies figure out what's good for us. The problem with that is that "food" these days includes many nutritive substances which simply didn't exist in modern quantities during the evolutionary development of our appetites, most notably this abundance of fructose (HFCS, anyone?). The act of consuming food usually prompts one's body to produce insulin in order to assimilate the carbs in the food, and this insulin acts as an appetite suppressant. The problem is that fructose is so simple that no insulin needs be produced in order to assimilate it, so the appetite goes unsuppressed after the consumption of calorie-dense food, and the subject continues to feed.

This leads to a positive feedback loop, because the stored calories require maintenance (heavier people must eat more to maintain their bodies, regardless of whether that weight comes from muscle or fat). This feedback loop causes all sorts of other problems, too.

That's not even getting into the ancillary effects of the other stuff that we get from grain.

<comment><USER11> >(HFCS, anyone?)

I'm not a big fan of singling out HFCS because it misses the forest for the trees. _Any_ refined carbohydrate is going to cause a strong insulin response. White bread is pretty awful for similar reasons, for example.

<comment><USER12> There are considerations other than insulin response (other parts of liver metabolism):

<http://www.youtube.com/watch?v=dBnniua6-oM>

</comment></comment></comment><comment><USER13> This isn't a reversal, at least not on the part of scientists. Reporting like this just reinforces the public's idea of "Why should I do what doctor's say? They just change their mind. First it was eggs..." and so on. Seriously, ask your mum.

Scientists have known about insulin sensitivity and why and how weight gain/loss happens for a long time. Bodybuilders and other sportsmen and women listen.

<http://www.motherearthnews.com/print-article.aspx?id=139058> is an interesting article on what actually happened. In contrast with the "oh those silly scientists, always changing their mind" headline, that article states 'scientists have known what makes us fat for almost half a century'.

<comment><USER8> That's an article by Taubes partially explaining how the consensus that fat makes you fat came about and why _that_ was a departure from the mainstream up to that point, but, uh, you are aware that Taubes has been just about crucified for those opinions? The article you cite is itself a non-mainstream article, you can't cite it as an example that the mainstream scientists have "always known" this. No, in fact mainstream scientists all over the place have been insisting that Taubes and Atkins and everybody else claiming it's actually carbs are not just wrong but evil for saying so. If this shift is actually made (which is still not a done deal), it will in fact be a consensus shift, one where the evidence has been available for centuries that the consensus was wrong, but a consensus was manufactured anyhow.

<comment><USER3> Agreed. I was on the Zone Diet for about four years, and I recall doing a ton of reading in 99-2003 on the topic. The whole idea of limiting your dietary intake to being no more than 40% carbohydrates was seen as being "fringe" dietary advice - and it only got play in the "alternative" arena of dietary advice. Atkins was seen as an outright kook. Basically, Fats and Cholesterol were the only components that seemed to get mainstream attention - there was almost no establishment focus on carbohydrates as being problematic at the time - to say otherwise is revisionist.

</comment></comment></comment><comment><USER14> So how is it that Asians eat tons of white rice but don't suffer from obesity, heart disease, diabetes and hypertension at anything close to Western rates?

<comment><USER7> Low carb skeptics often raise this point, but I'd like note that it can be misleading to consider a single diet variable in isolation. The Japanese smoke more than we do, and yet have less heart disease. Hence, smoking reduces the risk of heart disease....

Of course not. Asians eat more white rice, perhaps, but they also eat more fish, seaweed (in the case of the Japanese), more vegetables, walk more, eat more soy, etc... The effect of all of these variables, combined, may result in better overall health, and yet it could also be true that white rice in and of itself isn't that good for you.

<comment><USER15> > _"walk more"_

This part is _huge_. I moved to a new city a year and half ago and started walking everywhere. Where I used to struggle keeping the weight off, nowadays without even going out of my way to exercise, it just stays off.

And now bear in mind my city is far less walkable than your average developed Asian city...

I'm convinced that if America finally got rid of its car obsession, health levels will improve dramatically, and all this talk of the obesity epidemic will fizzle.

<comment><USER16> Exactly. We don't _need_ to exercise now, so few people do. Exercise has become something to do in our spare time. We stay in our homes and are required to use cars. When I visited China, I had to walk everywhere because I didn't have a car. Unfortunately we really can't get rid of the car obsession without a huge effort.

First, the suburbs take up so much space and distances living areas from the store areas. If we had a New Urbanist city, it would get people to walk. Now, you can't walk. Walking is impossible. You can't walk to a Walmart and grab fresh food every day. In China, my family would get food from the market every day. Now, we get food once a week and it's in big bags. That's because buying food is inconvenient.

Second, the suburbs take up space and creates the dreaded long commute. You can't walk to work. This makes public transportation unfeasible. Everyone buys a car.

It's all a big self-propelling problem. It creates its own problems, and to fix them, you have to contribute to the problem. Long distance? Get a car. A lot of cars? Build more roads. The vicious cycle continues...

EDIT: Biking is possible. But does anyone do it to commute, with so many cars and such long distances? Nope.

I personally witnessed this myself. I had to come home from school one day and today's roads aren't good for walkers. There's no sidewalk, so I had to walk on the grass or in the ditches. In many places (in the burbs, not in the city, the city is fine for walking), there were no walk signals. If there were, you had to walk along the road to the signal which often required adding more walking to the trip. For example, I had to cross the street from the library to a restaurant for lunch. I had to cross the middle of the road, and no one wants to do that.

</comment></comment></comment></comment><comment><USER17> I come from a country built on carbs: Italy. I think I hate at least a plate of pasta a per for 30 years and guess what, I'm not overweight. America, do you want to see you problem? Don't look further than your car. The one you drive to go grocery shopping 1 mile from home. Just walk, I'm actually thinking to not renew my car lease when it will expire in 2 months, and we'll keep only one car for the family. Do you both need to commute to work? Fine, get to car, but use them if you need to go further than 1-2 miles. Otherwise walk. You'd be amaze to find out how many things there are in a two miles radius.

<comment><USER18> I lived in Italy for a few years (Northern). Generally the portions of pasta that you ate were relatively small. You also ate a lot of fish, stews, and vegetables.

In regions of Italy that DO eat mostly carb loaded diets (like Sicily) there has been a relatively long running obesity issue. Walking is important, and it's a great thing. But even walking several miles a day does little to combat obesity when you're offsetting it with thousands of calories of carb-loaded food every day.

<comment><USER17> I grew up in Milan, and none in my family is obese. If for relatively small you mean "human" yeah, we don't server Cheesecake Factory portions (we actually do once in a while, I remember my dad and grand father eating pasta in a salad bowl few times).

</comment></comment></comment><comment><USER19> Bodybuilders have known this for a long, long time.

<comment><USER8> As Taubes documented, a lot of people have known this for centuries. It's not like it's that hard of an experiment to run, even in prior centuries.

If this fully pans out, as I think it will, nutritionists of the past fifty years or so are going to have the unenviable task of being used as an example of how an entire discipline with billions of dollars in funding and the best possible science apparatus can get it horribly, horribly wrong for a very, very long time.

<comment><USER20> What will be the most interesting to watch about this is the social reprogramming that will go on.

If history is a guide, within 30 years school textbooks will read as if this was just a logical conclusion and was easily reached -- instead of the brutal infighting and confusion that it actually was.

One of the weirdest things I learned as an adult was that science does not progress linearly like they teach in school. Instead people get emotionally attached to ideas, and miracle of miracles, the evidence shows they are correct.

Until the evidence shows they are not. Then it's this long struggle for changing gears, finally ending up in a spot where nobody ever talks about what went on before.

I think the human part of science is at least as interesting as the science itself. Lots of complexity and randomness, yet parts are very predictable. Neat.

<comment><USER21> agreed. science has never offered any simple narrative, it's a sprawling, incomprehensible, fascinating mess. it's a human story just like everything else.

<comment><USER22> That's definitely what I got out of reading bill bryson's brief history of nearly everything. The people involved in most of our scientific discoveries are incredibly fascinating

</comment></comment></comment></comment></comment><comment><USER23> When I cycled 25 miles a day, Monday to Friday, I could eat /anything/ in huge quantities without a problem. It makes sense, but not when you add up the calories; I was putting in way more than the most optimistic calculators said I was spending.

Then I moved closer to work, and had a total of maybe 20 minutes on my bike every day - but this being a cheaper bike I could leave it locked up outside (with a decent lock, natch) so it was my primary form of transport for _everything_ \- going to the shops, commuting to work or meeting friends out and about in town. I was still eating whatever I wanted albeit in slightly smaller portions without putting on a pound.

Whilst it's interesting and valuable science to discover quite what on earth goes on when we eat things, if your biggest concern is not putting on weight, why not do exercise that makes you sweat for 20 or 30 minutes 5 days a week? Seems much easier to me - and satisfying because you don't have to deny yourself anything!

<comment><USER24> You're giving exercise way too much credit. Even the most rigorous regiment (which most couldn't even do) can maybe burn a 1,000 calories an hour. But considering how it easy it is to ingest 1,000 calories, it's easier to make changes at the dietary level than to correct excess calories by burning them off.

<comment><USER23> Rather, I'm doubting that our understanding of calories and how they're burned off/turned into fat is wrong. I'm proof, as is anyone else who does 30 mins sweaty exercise a day. Otherwise, given the amount of Big Macs inbetween meals, the maths doesn't add up.

</comment></comment></comment><comment><USER25> There are plenty of good points in the article. However, I find the sloppy use of the word 'carbs' unforgivable and misleading. Fruits and vegetables are mostly carbs (...as dietary fiber is a form of carbohydrate too). The majority of the latter are, of course, healthy. The casual reader may get the impression from the article that all carbs are bad, and turn to a high protein diet.

</comment><comment><USER26> After having a bought of pancreatitis recently, I've been looking at my own food choices very closely to find the things that will keep my healthy, out of the hospital, and off long term drugs.

My anecdotal experience is that, lean meats, veggies, fruits are expensive, but are the best things for me personally. It is astounding how much sugar, carbs and fat is in the products I used to be eating. Obviously you need calories to survive, but I've been aiming to consume more calories that are slow burning (lean protein) and mix in "healthy" fats (omega 3 etc) with veggies fiber and vitamins.

I've been loosing weight, feeling better, and managed to cut my bad cholesterol by more then half, all without taking any medication to do so. I consider this a success of information and personal experimentation to find what works for me.

Prior to this health condition, I never put a high value the quality of the food I was eating. I cared about what food would keep me awake, revved, and burning the midnight oil, rather then what was good for my long term health.

After encountering all the sugar in our (US) food supply, I'm very much for removing the corn subsidies the federal government provides. It would remove the supply of cheap sugar that seems to permeates everything we eat.

<comment><USER27> Human body has a great capability for adaptation. So change in what you eat is just another form of adaptation. A couple of months with a new diet and you won't miss the "old stuff". (let's forget about obsessive patterns for the sake of the argument)

</comment></comment><comment><USER28> "What If It's All Been A Big Fat Lie?" by Gary Taubes

[http://www.nytimes.com/2002/07/07/magazine/what-if-it-s- all-...](http://www.nytimes.com/2002/07/07/magazine/what-if-it-s-all-been-a- big-fat- lie.html?scp=1&sq=what%20if%20its%20all%20been%20a%20big%20fat%20lie?&st=cse)

Tom Naughton's "Fat Head" is now available on Hulu:

<http://www.hulu.com/fat-head>

</comment><comment><USER29> Thanks for catching up on the last 10+ years of nutritional debate, LA Times.

Perhaps the real problem is seizing on one simplistic explanation for a complicated problems ("Meats!" "Fats!" "Sugars!" "Carbs!") and beating on it endlessly, then when that doesn't solve the problem, switching to another simplistic explanation.

</comment><comment><USER30> Carbs are _fine_ if you're active, and even necessary if you are very active (cyclists, for example, understand this pretty well). But this is the problem, I guess. We are expected to build diets on which sedentary people can get by.

</comment><comment><USER31> <http://www.youtube.com/watch?v=1yCeFmn_e2c>

How about there's more in it for them if they find something new?

</comment><comment><USER32> <http://veganbodybuilding.com/?page=bio_avi></comment>


Ask HN: How to grow after 6 years of work? - <AUTHOR>

I started my professional career more than 6 years ago. I started at a small company (less than 10 people). We were mainly a mobile development shop. I was known as 'polyglot guy' and 'Moving
MSDN' working with the various technologies (C++, C#, Python, Java) on various platforms (Symbian, Windows CE, Windows, Java ME).
Then the company met a lot of management and financial problems. The manager made a lot of mistakes and later closed the company. This was very hard for me considering that I'm responsible for my
mom & younger sisters after my father died. I worked there for 1.5 years.
Then I moved to another small company, working on ASP.net. I was able to learn it very fast & become
productive with it, performing very well at the beginning & used my good points (learning fast & using
various technologies well) but I met some problems when I was responsible for a whole project for
the first time. We ran very late & the quality was very low. Adding to this that the company was really bad when it comes to collecting their money, it was financially unstable. I had to leave after 1.5 years, though I liked this company very much.
For the next 1.5 years I worked in 3 small companies, 6 months in each one. This was really a
horrible period of my life. We were always overloaded with work, project scope was rapidly
increasing with the same cost. We were working for 16 hours a day. We were treated badly.
Everything I tried to do was not enough to save any company.
I didn't try to fight till the last possible moment. I had enough of small failing companies. I was convinced that to create a successful software project I should focus on management, not the
technical side
I went to work in a large software company, not as a senior programmer (as I used to be) but
outsourced to another big company as a technical project manager. I accepted this position for 3
reasons

    1. It is financially stable
    2. To enhance my communication & management skills
    3. This was the only way to grow
 Contrary to my previous positions, I had manage many small interdependent tasks. I wasn't good at doing this. I slipped the deadline most of the time. I have to ask everyone at each step multiple times to do anything. All the time. I'm always blamed because I'm responsible. What makes me angry is that it's late because of somebody else. The only parts that went well were the parts that I made
myself, or any tool that I made to automate a manual process. I'm much slower than any other
colleage in my team & the whole company, even people who are much younger than me
After sometime I knew that I'm not good at this. I asked my mother company to return to their HQ and work on a more technical position, but they said there isn't a vacant place for me. Later I asked for a communication skills many times, which I got finally.
I don't know how to grow in my career. I don't want to work on management, but I alsp want to feel
that my work is valuable & affecting the company positively. Here in Egypt the only way to grow is to go the management path.
I also want to work with Python. All the companies here either use C#, Java, C++ or PHP. <comment><USER2> Halfway in your writing I was thinking this guy must be from India. But no you are from Egypt. Okay its the same story there also. Let me share my story here. I am at the same level of experience as you are 6 and half years into software.

I started in a big software service shop in India. Worked for amazing clients (I cannot name them here). Some of the technology that I have worked on - Java, Lisp (yep got paid for working in common lisp), C/C++, Hadoop, JavaScript, etc. After working for 4 years I decided to move on. But I got Job in one of the news companies. Worked there for more that 1.5 years in (C# and Java). Now working in a banking product based company.

After all these years (not that much though), I have come to the conclusion that - you need to be a techie to survive software industry. I have defined growth as: learn a new language every 6 months. Do something extra like open source. I know, I may not get hefty pay packets like the managers in India but I have chosen this path. I am happy with that.

For you I believe you have identified your areas for improvement. You just need to think deep why the schedule failed? Find and read some books Mythical Man Month and Peopleware. Chances are that people have already been there and done that - so learn from them and try to adapt and apply in your case.

Moreover, _before you do anything else_ just ask yourself what do you really want to be - a manager or a techie. Once you have the answer get going with that flow.

<comment><USER3> I agree. First identify what you really want to be and go on that route. Being technically inclined, will definitely make you earn more money and respect than management. Me think :-)

You can't do both, trust me.

</comment></comment><comment><USER4> It sounds like you have a grasp of the big picture and are finding it difficult fit into corporate life. One option is to build your own pyramid, er, company.</comment>


16-Bit VM in JavaScript - <AUTHOR> https://francisstokes.wordpress.com/2017/07/20/16-bit-vm-in-javascript/ <comment><USER2> Something I've always wanted to do (16 bit as well, even) but never got around to. Thanks for the writeup!

</comment><comment><USER3> Congratulations! I've been working on a similar (though less well-documented) project in Rust: [https://github.com/jasonhansel/kineticvm](https://github.com/jasonhansel/kineticvm)

<comment><USER4> Ah very cool! Rust seems like an awesome language, especially for something like this. I'l going to take a dive into your project at some point in the week

</comment></comment><comment><USER5> Is this a VM in the sense the JVM is a VM, or is it a VM in the sense of a CPU emulator?

It seems to be the former, but I'm not well read in VM implementation.

<comment><USER6> That's a very fuzzy, if not non-existent, distinction. The only real difference is the designers' original intention. Of course the Java VM was originally only destined to exist only in software, but hardware versions do exists [1]. And of course x86 was always destined for hardware, but there's more software implementations of that than can be counted. There's also a third type in the LLVM sense, where the VM is just an intermediate step in compiling from a high level language down to machine code. And that's where the JVM (mostly) falls today.

The VM described in the OP could easily fit in any of the three.

[1] [http://www.jopdesign.com/](http://www.jopdesign.com/)

</comment></comment><comment><USER7> This is in a way that they make emulators in Javascript like that too? Might be possible to emulate Mame and Mess machines if they haven't already?

<comment><USER4> Indeed, the core concepts are essentially exactly the same. This is a lot simpler of course because it doesn't need to do anything with drawing or sound.

I really like this project [https://github.com/juchi/gameboy.js/](https://github.com/juchi/gameboy.js/) . I'd like to do something similar myself but more in the coding style I've used on the 16-bit VM.

</comment></comment><comment><USER8> Very interesting read and props for choosing _opcode D, S_.

<comment><USER4> Thanks, I've had mixed feedback about that choice!</comment></comment>


A new kind of telescope that can photograph the whole sky simultaneously - <AUTHOR> http://www.technologyreview.com/view/528911/how-to-build-an-evryscope? <comment><USER2> It is, however, not clear to me what kind of useful information we can get from the visible spectrum at this low magnification. At 85mm you can't even make out features on the moon.

<comment><AUTHOR> In the linked paper ([http://arxiv.org/pdf/1407.0026v1.pdf](http://arxiv.org/pdf/1407.0026v1.pdf)) they suggest that it will be useful for "extremely-wide-field transiting exoplanet searches, realtime searches for transient and variable phenomena, and ... the capability to effectively pre-image unexpected events detected by other surveys". Based on the relative length of the descriptions, they seem most interested in the exoplanet surveys.

<comment><USER3> This is right. The other science topics mentioned have longer timescales (hours or days), so surveys with smaller fields of view but bigger light collecting power are better at finding these events.

For exoplanet transits, though, you're interested in frequent time sampling to catch and model the passage of the planet in front of the star, so sampling all the bright stars in the sky every few minutes is a great way to do this. It also explains the high Arctic observing site (lots of stars that never set and can be observed for months at a time).

<comment><USER2> Thanks for the explanations, guys!

</comment></comment></comment></comment><comment><USER4> This thing can photograph the whole sky in a few days in much better quality:

> VISTA is a 4-m class wide field survey telescope for the southern > hemisphere, equipped with a near infrared camera (1.65 degree diameter field > of view

[http://www.vista.ac.uk/](http://www.vista.ac.uk/)

</comment><comment><USER5> My first reaction when I saw the graphic was why does it needs an equatorial mount + tracking hardware if it is whole sky?

<comment><USER6> Because it would allow only very short exposures otherwise.

<comment><USER5> I would have thought software image processing could handle this.

</comment></comment></comment><comment><USER7> Should've called it clesthora's eye

<comment><USER8> Clesthyra that is. [http://anathem.wikia.com/wiki/Clesthyra%27s_Eye](http://anathem.wikia.com/wiki/Clesthyra%27s_Eye)</comment></comment>


Omelette: Simple Autocompletion Helper for Node.js - <AUTHOR> https://github.com/f/omelette?gif

<comment><USER2> Ok - nice functionality, but why is it called Omellete exactly? Am I the only one that is getting tired of projects whose names mean nothing? Cucumber anyone?

<comment><USER3> It's just a name. I'm not good at finding cool names for projects. :( And "complete" is reserved in NPM. Nightly name. :)

<comment><USER4> I thought it might've been because omelette is a pain in the ass to spell. In fact I could've used an auto-complete when typing this comment.

<comment><USER5> Hah, I like that concept. If the author is interested in renaming, there are a lot of ones here that would make good names for this project: <http://oxforddictionaries.com/words/common-misspellings>

Though its probably a bit too late for that now ;-)

<comment><USER6> How about dyslexia? :)

</comment></comment></comment></comment></comment><comment><USER7> The use of the animated gif as part of the github readme seems quite ingenious to me. I don't think I have seen that idea in other github repos. And for a project like this its the perfect introduction. I wonder what tool did he use for this.

<comment><USER3> Quicktime Screen Recording and Mov to Gif online converter.

<comment><USER7> Which online converter did you use? What I like is that your animated gif ended up being quite small (15 sec => 600KB) enough so as you don't feel bad including it in your repo.

<comment><USER3> I used <http://image.online-convert.com/convert-to-gif>

<comment><USER7> Perfect, You now have copycats: <https://github.com/ogt/boxchareditor>

<comment><USER3> That seems beautiful! :)

</comment></comment></comment></comment></comment></comment><comment><USER8> Sorry to be so naive but what is this meant for? As in where all could I use this?

<comment><USER9> Anywhere you are accepting command line arguments. You might not know about bash-completion even if you are a basic shell user; I know in Debian, it's necessary to install the package "bash-completion" and un-comment a few lines in /etc/bash.bashrc to enable it.

Basic bash completion looks for files in the filesystem. The bash-completion package provides hints so that you can auto-complete semantically, for example

      $ apt-get up<tab><tab>
      update   upgrade

      $ apt-get install bash<tab><tab>
      bash             bash-builtins    bashburn
      bash-completion  bashdb           bash-doc
      bash-static

<comment><USER8> Ah I get it. Thanks. I barely touch these stuff... hence not aware of it. Thanks for the insight.

</comment></comment></comment><comment><USER3> You can reach NPM page from <https://npmjs.org/package/omelette>

</comment><comment><USER10> looks good! keep up your good work.

</comment><comment><USER11> fantastic work!

<comment><USER3> thank you! please contribute!

</comment></comment><comment><USER12> awesome :)

</comment><comment><USER13> good job</comment>


After years of Google Chrome, Firefox was a pleasant surprise - <AUTHOR> https://www.zdnet.com/article/after-years-of-google-chrome-firefox-was-a-pleasant-surprise/ <comment><USER2> Interestingly, I had the opposite experience. I've been using Firefox for many years after moving away from Chrome because it was too slow. Nowadays, I've been thinking about moving back to Chrome because I tried a recent version of Chrome, and it ran faster than FF. FF does have some nice features like privacy and some really cool extensions. But it's gotten slower and there are some webpages that don't work for me unless I fire up Chrome. But since I've been using FF for many years, and have all of my favorite extensions and logins saved, it's tough to go back.</comment>