Multiple Vulnerabilities in ASUS Routers - <AUTHOR> http://seclists.org/bugtraq/2017/May/24 <comment><USER2> ASUS uses their own Linux distro called ASUSWRT, whenever I've looked at it it's been, well ... _interesting_ from a security perspective, even compared to other WRT OSes.

I did a ton of stuff on the AC series and some of their smaller hardware (like the WL330-NUL which is an awesome little thing but riddled with bugs). The bottom line is that if you have an ASUS, you should expect bugs.

If you're worried about being exploited via your router, making sure you use a dedicated browser to configure a router and have no other web pages open at the time will help against certain classes of bug, as will logging out immediately after you've finished. Making sure that you know what's being forwarded is also useful, as is turning off UPNP.

OpenWRT is a little bit better (but people tend not to update their routers) but has it's flaws for various reasons (mostly in the web interface), as do most of the WRTs. If you're really worried, Mikrotiks tend to be better, and very little beats an OpenBSD firewall.

</comment><comment><USER3> This always boggles my mind. The hardware on those seems decent enough but the software is almost universally utter dog shit. Why do these companies treat the software (security as well as UX) side so poorly, considering that this is what the enduser sees, is beyond me.

I bought one of those affected routers recently. Since the DD-WRT has slower Wifi performance for that model I considered staying with the stock firmware... for about 30 minutes. When configuring something device names I think I used '-' in a name. The Web UI allowed it and saved it. On refresh the JS was all broken because of that character. No device list for me. Flashed it with DD-WRT, never looked back.

<comment><USER4> usually the firmware for these devices was written up to 10 years ago, when the threat landscape was very different from what it is today.

you'll notice that newer devices on fresh codebases (ie: mesh routers) are much more up to par security-wise.

<comment><USER3> Certainly seems that way. I didn't/don't have any mesh routers so I couldn't tell but I image that the Google router thingy is way better software/security wise (privacy being probably a seperate discussion in this particular case ;). I've also read some good things about Ubiquiti here.

Anyhow I keep wondering how many beatings on the security front do those companies need to take in order to figure out that, at the current landscape, developing a decent, secure and clean firmware/frontend would give them a big big edge over the competition.

</comment></comment></comment><comment><USER5> If you're using Asuswrt-Merlin, looks like these fixes are only available in the current 380.66 Beta builds: [https://github.com/RMerl/asuswrt- merlin/blob/0e15da3404ccabb...](https://github.com/RMerl/asuswrt- merlin/blob/0e15da3404ccabbf13509a911c7ddc4a5efa5461/Changelog.txt#L5)

<comment><USER6> can you flash asuswrt-merlin over the default asus firmware?

<comment><USER7> Yes

<comment><USER6> Thanks for confirming!

</comment></comment></comment></comment><comment><USER8> The usual wifi router security rules apply:

\- change the default password \- keep the firmware updated \- disable WPS. \- If possible change the port the web interface is running on (don't use port 80 or 443) \- disable the web interface if you are command line savvy. \- disable wifi access to the web interface (require ethernet)

<comment><USER9> And document these changes in written form taped to the router. Nothing like a factory reset due to a lost password or obfuscated management port change.

</comment></comment><comment><USER10> Is it time to get a "grown-up" firewall for my home?

I'm currently using a standard Apple Time Machine as a firewall/router, but with all this crap (crap router software/hack attempts/NSA shenanigans) going on, thinking about putting something more serious in front of it (connected to my broadband modem). Yeah.. I realize I'm sounding paranoid.. ;)

I'm thinking of Protectli's "Firewall Micro Appliance" [https://www.amazon.com/dp/B01H2QJTM4](https://www.amazon.com/dp/B01H2QJTM4)

I believe it's FreeBSD and comes with pfSense. Thoughts?

<comment><USER11> That looks like a very nice box, if a bit expensive. I have been quite happy with my Mikrotik hAP AC[1], I run the dev previews so I get firmware updates pretty much weekly (and at least for my home network, none of them have broken anything, yet...) 1: [http://a.co/37wiiiM](http://a.co/37wiiiM)

<comment><USER12> I'd hope something like that would last years, and even today 100mbit is lower than many network connections. I try to switch to the comcast plan that's the best bang per $, and that's currently 200 mbit at my locale. The ubiquiti seems similar, but has GigE.

</comment></comment></comment><comment><USER13> Routers should run open source software so vulnerabilities can be patched by the community.

Routers manufacturers wants to push the latest hardware for profit. The only reason router manufacturers want to patch security vulnerabilities is negative press articles. Negative press would hurt future sales so its better to patch the current product line. When current product line is no longer sold security patches stops but the use of the device by its users Continues.

This is the reason we need to open source everything.

If it can be hacked it will be hacked.

</comment><comment><USER14> Looks like anyone using third party firmware (such as [https://wiki.openwrt.org/toh/start](https://wiki.openwrt.org/toh/start) ) shouldn't be affected by the issues this advisory highlights.

<comment><USER15> Actually nowadays OpenWRT is LEDE, but there are talks about merging the projects back as we speak.

[https://lede-project.org/about](https://lede-project.org/about)

And yes, I'm surprised there still are routers in the wild not running OpenWRT :p

<comment><USER16> I'd consider it, but I'm generally happy with the Asuswrt-Merlin firmware, and I can't find a resource that describes things like benefit, risks, and functionality I might lose. Is there such a thing?

<comment><USER5> AFAIK, only the stock and Asuswrt-Merlin firmware builds support Broadcom's proprietary acceleration (ctf.ko). On my RT-N66U, WAN throughput can hit 870 Mbps. Without it, I max out around 170 Mbps.

If there's a way to run OpenWRT / LEDE _and_ get gigabit speeds out of a router, someone please let me know. :)

<comment><USER16> > _On my RT-N66U, WAN throughput can hit 870 Mbps. Without it, I max out > around 170 Mbps._

Eeek! Thank you. :O)

</comment></comment></comment></comment></comment><comment><USER17> This is one thing that pisses me off, more about the FCC who requested the routers be fully locked down... I used to buy all ASUS as before the change it was very easy to get third party (Tomato) firmware on them that was updated more regularly.

</comment><comment><USER18> The 4G-AC55U router is also vulnerable but did not receive a security firmware update (last firmware release was a year ago on 2016-05-20) and is not listed on the page.

If you happen to be running this device you may want to apply precautionary measures.

</comment><comment><USER19> Am I the only user who does _not_ want a web interface on a router?

<comment><USER20> I doubt it, but for consumer-grade devices that need to have sufficient mass- market appeal, it's the logical choice.

</comment></comment><comment><USER21> Why don't routers simply host their admin panels on a separate and secured wireless network that is blocked from the internet? Although it sounds impractical, it would render so many of these CSRF/XSS exploits useless.

<comment><USER4> because then the vast majority of users wouldn't know how to use it.

even if you include instructions you'll have a huge proportion of users who will either return the device because they couldn't figure it out, or call your support line and make your support overhead skyrocket

<comment><USER22> This is probably quite accurate. I doubt more than 20% of the population even KNOWS that their router has a "configuration screen", much less how to access it.

The biggest practical security upgrade for most users was when they started randomizing SSIDs/passwords and printing them on stickers on the back of the router.

</comment></comment></comment><comment><USER23> I wonder why some routers are not listed as vulnerable (I have N65U)

</comment><comment><USER24> Title should have the word 'again' at the end.

</comment><comment><USER25> does this affect the asus black diamond router?

The web interface to update the firmware has never worked for me.

<comment><USER26> Open the link and check for yourself...

<comment><USER25> I did, there was no mention of specific models

<comment><USER27> There are, check the bottom of the page.

"Affected models include the following ASUS routers:

RT-AC55U RT-AC56R RT-AC56S RT-AC56U RT-AC66U RT-AC88U RT-AC66R RT-AC66U RT- AC66W RT-AC68W RT-AC68P RT-AC68R RT-AC68U RT-AC87R RT-AC87U RT-AC51U RT-AC53U RT-AC1900P RT-AC3100 RT-AC3200 RT-AC5300 RT-N11P RT-N12 (D1 version only) RT-N12+ RT-N12E RT-N18U RT-N56U RT-N66R RT-N66U (B1 version only) RT-N66W"</comment></comment></comment></comment>


Hello (Distributed) World: Designing Software that Spreads P2P - <AUTHOR> http://blog.cyll.org/post/943403226/hello-distributed-world-designing-software-that

<comment><USER2> They're using SHA1 to sign / identify programs. Finding and exploiting a hash collision would be fairly straightforward and could have really bad consequences, since I presume I could publish my "rogue" modified program to peers fairly easily.

<comment><USER3> Just out of curiosity, is there any new progress in the collision discovery of SHA1? Can you provide some references so that I can dig into?

<comment><USER4> Here is the questions posed to the Stack Overflow audience, however its from 2009[1]. The linked article says that they can now get collisions in about 2^52 operations- as opposed to the previous 2^69.

The National Institute of Standards and Technology has urged Federal agencies to stop using SHA1 digital signatures by the end of 2010, and instead start transitioning to the SHA2 family[3].

[1] [http://stackoverflow.com/questions/1147830/understanding- sha...](http://stackoverflow.com/questions/1147830/understanding- sha-1-collision-weakness)

[2] [http://www.schneier.com/blog/archives/2005/02/sha1_broken.ht...](http://www.schneier.com/blog/archives/2005/02/sha1_broken.html)

[3] <http://csrc.nist.gov/groups/ST/hash/statement.html>

</comment></comment></comment><comment><USER5> it's a little annoying hearing about but not seeing this "spin" language.

<comment><AUTHOR> What sort of examples would you be most interested in seeing?

<comment><USER6> How about a chatroom?

<comment><AUTHOR> Ignoring user interface and the mechanics of peer discovery...

      user-interface, discovery-system |
      # This process is spawned with two pids as arguments

      # If either pid halts, I halt too.
      user-interface.link
      discovery-system.link

      user-interface.subscribe(when(
        text-entered: { message |
          # I entered a message in the UI, announce it to everyone subscribed to me
          my-actor.announce('exclaimed, message)
        }
      ))

      discovery-system.subscribe(when(
        peer-discovered: { name, peer |
          # Discovery system located another user in the chat room

          # Send message to user-interface showing a Growl style notification.
          user-interface << ('notify, "{name} arrived.")

          peer.subscribe(when(
            # This guy went away - "halted" is announced when a process stops
            halted: { result | user-interface << ('notify, "{name} left.") }

            # This guy said something
            exclaimed: { message | user-interface << ('text-append, "{name}: {message}") }
          ))
        }
      )

      main.loop

<comment><USER7> Are the names discovery-system, user-interface, my-actor important?

<comment><AUTHOR> Every process has "my-actor" defined in its global environment. It provides methods related to basic actor functionality. In this case I'm calling the "announce" method to say something to all of the process' subscribers.

user-interface and discovery-system are two hypothetical processes whose pids (process identifiers) are passed in to this process as arguments. user- interface would be responsible for creating a window with a text display area and a text entry box. discovery-system would use our remote service discovery model to find others chatting in the same "room."

</comment></comment></comment></comment></comment></comment><comment><USER8> So now we can't patch a security hole in a library without "recompiling" every application it's linked to? That seems like a huge step backwards to me.

<comment><USER9> Security holes present an interesting challenge. Since we allow authors to blacklist their code at the uuid level, it's possible to issue a network-wide advisory that revokes execution rights for that specific uuid.

This can instantly close the hole until a patch is released. This keeps users safe and gives application authors time to test against their application with the new library before re-publishing.

In many cases, application authors are the only people that are qualified to test interactions between their applications and the updated library.

<comment><USER9> The distributed programmer in me wants to point out that having applications automatically use the latest version of a library is a scary proposition.

During a distributed operation, participants can arrive at many different points in time. This means that applications using the newly-patched library will likely be interacting with applications using the unpatched library. Whenever multiple versions of anything are interacting with themselves things can get complicated.

In light of this, we opted to keep things simple and predictable for ourselves (and others). Since applications always run against exactly what you say they should, you're free to keep running forward, without having to worry about tripping over past decisions.

</comment></comment></comment><comment><USER10> Great stuff! Show more!

</comment><comment><USER11> Interesting. But what is their approach to security? Capability-based? Or simply not connecting to computers you don't trust?

<comment><USER9> Generally speaking, we don't connect directly to unknown computers, but there are other reasons for that.

Security is addressed at a few levels (here are 6 of them).

1\. Access to native resources requires specific permission.

2\. All processes (including those with access to native resources) can only be addressed by their 288-bit process identifier (128-bits of which are random). The only identifiers known to a process are its own, those of its children, and ones explicitly given to it.

3\. The Actor model means each process can independently decide which messages to reply to, which to ignore, and how long to wait for a response (if at all).

4\. Each node has a unique RSA key-pair. The 160-bit fingerprint of the public key is the non-random part of every process identifier. This allows nodes to verify the remote processes they communicate with. (And if necessary, encrypt messages sent to them.)

5\. Hash-based distribution makes it easy to blacklist poorly-written or maliciously-crafted code, once it's been identified as such.

6\. System services in Skynet are always kept current with live, on-the-fly updates.

</comment></comment><comment><USER6> Is this going to be open-source?

<comment><USER9> Without making any promises, it's hard to imagine any programming system becoming successful without being largely open source.

</comment></comment><comment><USER12> I've been waiting for this release for a looooong time. Bravo!

<comment><USER13> What release? It's another blog post.

</comment></comment><comment><USER13> Is there any protection against software piracy?

<comment><AUTHOR> We don't build any in, but the same strategies (ie, requiring a license key, etc) that work for regular applications like Microsoft Word also work for fluid applications. The bits can be copied easily, but the same is true for traditional software.

Crazy strategies, like CDs that physically can't be copied and must be in the drive or kernel extensions obviously won't work, but that's probably a good thing. =)</comment></comment>


Ask HN: Building a property portal in Cake PHP? - <AUTHOR>

Does anyone really use Cake PHP anymore for large websites such as property portals?<p>Would you suggest another language? <comment><USER2> If you know php use it. Cake has generally fallen out of favor as a framework though things can be cyclical.

Laravel, symfony and zend remain the full featured frameworks that seem to have the most traffic.

<comment><USER3> Second on Laravel. Formerly used CodeIgniter which has also fallen out of the spotlight.</comment></comment>


Photoshop Elements: a Stripped-Down Version of Photoshop Aimed at Amateurs - <AUTHOR> http://www.wired.com/software/softwarereviews/news/2007/09/photoshop_elements6

<comment><USER2> Looking at the new user interface, at first I thought this was a Web app. There's also some visible influence from Lightroom.</comment>


#1ReasonWhy: Women on Discrimination in Gaming - <AUTHOR> http://kotaku.com/5963528/heres-a-devastating-account-of-the-crap-women-in-the-games-business-have-to-deal-with-in-2012

<comment><USER2> >because there's not enough investment in AAA games about something other than war, cowboys, football, cars. sorry, but it's true

Is that discrimination against women in gaming? It seems out of place.

<comment><USER3> I don't think it is out of place. Which comes first? The games designed for boys and men or the boys and men wanting the games? Or does the issue go even further, boys and men building games for boys and men and forgetting about games for women?

We know there are a lot of women playing video games out there, but much of the industry focuses its hype on games in the above categories.

Now, whether or not that's discrimination, I can't really say. However, it's a structural focus that's probably born out of a male-dominated workforce. Who knows how many great, marketable AAA games die on the idea floor because they don't fit into male ideas of what makes a great AAA game...</comment></comment>


Services you'd keep using if they weren't free - <AUTHOR> http://franticindustries.com/blog/2007/02/22/services-youd-keep-using-if-they-werent-free/ <comment><AUTHOR> There are a lot of services I use because, in addition to being useful and convenient, they are free.

Despite how much I may gain in productivity or enjoyment from a service, it may stop being so as convenient or approachable when I have to grab my credit card to check it out. But that said, if Google Calendar, Flickr, or Wordpress became pay only, I probably would take the time to sign up for a subscription account.

For those of you entrepreneurs with non-pay business models: Would a user want to continue using your service or product if you began a mandatory charge? How about those of you who already plan to charge: Would your user-base increase x-fold if you decided to make it free?

I think these might be some interesting questions to ponder when you're still in the early stages.</comment>


Trading on Russian stock markets suspended indefinitely - <AUTHOR> http://www.moscowtimes.ru/article/600/42/371018.htm <comment><USER2> Now _that's_ how you do a market intervention.</comment>


Show HN: Gmail message ID finder, Chrome extension to grab RFC 822 ID of message - <AUTHOR> https://chrome.google.com/webstore/detail/gmail-message-id-finder/comcoiiifldaaejpbgbincdkoohihbae <comment><AUTHOR> Hi HN! Gmail message ID finder is a small Chrome extension that adds a 'Copy message ID' button to the Gmail message menu. When you click it, the RFC 822 message ID of that message is copied to your clipboard. With this ID, you can find the exact message again later very easily.

I personally use it for keeping track of important emails in our CRM.

Because this ID is a property of the email itself, and not something that this extension provides, it works everywhere. If your colleague got CC'd on an old email you'd like to point them to, you can pass them the message id and it will work for them as well.

It also works great in Inbox and the Inbox & Gmail Android apps.

See also the site at [https://gmail-message-id-finder.co](https://gmail- message-id-finder.co)</comment>


Ask HN: Do you get work offers via your StackOverflow profile/activity? - <AUTHOR>

We all know the power of SO and its relevance to hackers. For those of you who are very active and possibly leaders in certain areas, do you get contacted often for work based on your SO profile/activity ? I mean it should make sense that SO should generate a lot of leads even if you are not really looking. <comment><USER2> No, though I have had contract/job offers via github, and even once via Hacker News.

(Both of which ironically I couldn't accept because they wanted onsite workers in London and New-York respectively; me? I've worked remotely for 8 years now, and have no intention of leaving Edinburgh._

</comment><comment><USER3> Yes, but nothing that has ever been worth pursuing because they don't pay enough or have stupidly small vacation policies or require me to show up in person.

</comment><comment><USER4> Yes.

I get a lot of freelance/contract offers too. Depends on the question I answer, if it's a good and quality answer, I will get more inquiries.

</comment><comment><USER5> I got approached twice. One of them was for YPlan. Would have loved it but wasn't ready to leave the current company by then...

</comment><comment><USER6> once i got cold called because of my SO profile.

definitely helped me in other interviews.</comment>


A way to manage data transfer to GCP - <AUTHOR> https://www.zenko.io/blog/move-data-to-google-cloud-storage/ <comment><USER2> the article implies you can't do "gsutil sync", but you can, so I don't really understand why you wouldn't use that for syncing data.

<comment><USER3> The article mentions gsutil being slow and not resuming transfers, maybe thats their main issue?

<comment><USER4> That is correct. gsutil will be a one-time thing. If you want to ensure, constant replication with metadata tracking with parallel workers for transfer(fast), this will be good. And I think they support have AWS, Azure and Ceph along with GCP

<comment><USER5> Zenko supports replication from Scality's RING, AWS S3, and other S3-compatible hosts (Wasabi, CEPH, and Scality S3 Connector) to AWS-compatible (Wasabi, DigitalOcean, RADOS Gateway), Azure, and GCP target clouds.

Azure sourcing is in development.</comment></comment></comment></comment>


Renault - The Car as a Platform - <AUTHOR> http://blogs.wsj.com/tech-europe/2011/12/08/renault-opens-up-car-as-platform/ Volvo has a anti driver distraction system, so your phone won't ring when you are executing turns, or near a school.
The usual navigation aids come to mind such as traffic reports.
Other useful things might be Siri-like reminder to buy milk on the way home, or ask you why you haven't picked up your kids from school. <comment><USER2> Sorry, the platform is ugly and expensive. It will also never be the same as the original platforms. My Dad was a hacker before I was even born. He hacked on 50's - 70's Chevy's mostly. That was the kids freedom back in the day. Like an aircraft carrier to the U.S. it was their own moving piece of sovereign territory. Their cars had muscle, style and they were easily hackable. They had radios which would blare rock'n roll which their parents may not have approved of. They had back seats which were where many of the modern hackers (me for sure) were conceived. Today, we have the internet and cell phones. We can spin up a server for next to nothing. An Iphone is expensive enough. A !!!!ing Renault? No thanks.

<comment><USER3> Look at the bright side ... Maybe one day we can download a driverless app to the car . That will be something</comment></comment>


Steve Jobs - Billion Dollar Hippy (BBC Documentary) - <AUTHOR> http://getdenso.com/videos/2995181

<comment><USER2> Watch it last night. Nothing new of any value. If you read any of the articles when the guy died you'll know the story already. Only interesting bit was steve woz saying how he wasnt bittered but was upset to the point of crying when he read years later than jobs had fucked him over on the money from the split for developing a game in the early days.

</comment><comment><AUTHOR> Reposting, the other link seemed to only work in the UK. Hopefully this works.</comment>


Ask HN: Online Therapy? - <AUTHOR>

Anyone from the HN community attend online therapy sessions and if so, who do you recommend?  Looking for someone who performs CBT or mindfulness training. <comment><USER2> I've met and worked with the founders of [http://www.psychologyonline.co.uk/](http://www.psychologyonline.co.uk/) and can recommend their service. It's the leading provider of online CBT in the UK and for the NHS, however, they also offer an international private service called Thinkwell [http://www.thinkwell.co.uk/](http://www.thinkwell.co.uk/)

</comment><comment><USER3> How does online therapy work?</comment>


Experimenting with Light Fields - <AUTHOR> https://www.blog.google/products/google-vr/experimenting-light-fields/ <comment><USER2> I just played their demo. Even on a VR rig, this is one of the more resource intensive experiences.

Definitely very cool; cooler than it sounds. You get to experience a summation of all the subtle touches missing from VR today - like how a reflection on something changes as you rotate your head.

</comment><comment><USER3> My understanding is that there is an insane amount of data stored in the light field captures that must be streamed seamlessly to the headset. Can someone shed some light (heh) on the technical issues surrounding light fields?

<comment><USER4> Light fields are large, but not insane, because they are highly compressible. Think of them as a matrix of images, each representing a micro lens at a point in the field. Most patches of the image seen through each lens are roughly similar to a patch in the non-light field JPEG.... just skewed to a slight different place.

This isn't 100%... new image can be exposed by looking around a corner, shifting reflections, etc. But each lens requires adding less and less to your compression table.

So really, the light field is an index into a slightly expanded compression space more than it's a whole new set of data.

As for the complexity of rendering... it's just a JPEG with a gnarly projection equation. There's nothing fundamentally more complicated about that... although it's complex math.

As with anything it takes time for code to mature, but in the limit there's nothing fundamentally more complicated about it than playing compressed video.

There's probably some efficiency to be gained with custom compression algorithms and custom hardware, although I don't know enough about existing video compression hardware to say for sure how far the existing chips will get us.

</comment></comment><comment><USER5> Which comes just in time for the Lytro acquisition rumors:

[https://www.androidcentral.com/google-reportedly-buying- lytr...](https://www.androidcentral.com/google-reportedly-buying-lytro-no- more-40-million)

</comment><comment><USER6> I have to say this was a really cool demo, although the subject's eyes following me as I moved was a bit freaky

</comment><comment><USER7> Is there a video that can show the result anywhere?

<comment><USER8> You can check this one out: [https://www.youtube.com/watch?v=a-JX3ZPi720](https://www.youtube.com/watch?v=a-JX3ZPi720)

But like with all stuff VR, to "get it" you really have to experience it in VR. Especially how different this feels from 360 pics (stereoscopic or not) or photogrammetrie isn't obvious I think if you haven't seen it yourself.

</comment></comment><comment><USER9> It is a sort of geometric optics approximation as I understand, otherwise it was an electromagnetic or quantum field. It looks more for entertainment than for research purposes.

<comment><USER10> The author is Paul Debevec. Give him a little credit. [https://en.m.wikipedia.org/wiki/Paul_Debevec](https://en.m.wikipedia.org/wiki/Paul_Debevec)

It's a better approximation than you can make with a normal camera, so its applications are even broader. Instead of a normal camera image which captures the position of focused light rays on a plane, this captures the position and direction of light rays as they move through a volume. Personally I would not call such a versatile instrument useless.</comment></comment>


Node.js Web Server Guide - <AUTHOR> https://github.com/aspnetde/nodejs-webserver-guide

<comment><AUTHOR> After working in the Microsoft universe for a decade I decided to broaden my horizon, so I digged into Node.js. I am quite impressed with what I found and what I could accomplish in a few weeks with that tooling, but one thing was left - I had no idea how and where to host my stuff. As I did not find a typical all-in-one-solution, I just made the decision to also dig into Linux. That's the (preliminary) result of my journey, which may be helpful to others too.

(And if I got something horrible wrong, just tell me and I will fix it ...).</comment>


FBI Returns Seized Devices to EFF Client - <AUTHOR> https://www.eff.org/deeplinks/2015/11/eff-pleased-announce-return-our-clients-equipment <comment><USER2> The tweet [https://twitter.com/Sidragon1/status/588433855184375808?ref_...](https://twitter.com/Sidragon1/status/588433855184375808?ref_src=twsrc%5Etfw)

<comment><USER3> I am always amazed at the authorities reaction to this. In the entire history of modern communications has a terrorist ever announced publicly and in advance that he/she/they are now going to go out to place "xyz" at time "nn:nn" and going to do "some despicable act", so please come arrest me?

There are examples of course about warning about planted explosives etc (The IRA did this all the time), but these never include an invitation to apprehend the actual culprit - but rather as terror tactics in their own right.

<comment><USER4> It doesn't matter. Authorities (at least their managers/directors) think in terms of PR/Damage Control and Risk. The fallout if they did nothing and something happened (maybe even just reporter reporting that tweet was ignored by FBI) would be enormous. Much, much worse than fallout that occurs for "overreacting".

And once they've reacted it's very hard to admit they are wrong or ever let go (as in they are unwilling to accept PR/blame). Just to avoid the .001% chance of headline "FBI had perpetrator in custody but let him go!"

Sadly, the public is a ignorant, fickle, short-sided, lynch mob. Public facing organizations are(have to be) driven by risk mitigation rather than being effective.

</comment></comment></comment><comment> dan-silver Is there any easy way to determine if the equipment can be trusted?

Does anyone offer services in this area and how much would it cost him?

<comment><USER5> A security researcher obviously can't trust those devices anymore.

If I were him I would sell them and buy new ones.

<comment><USER6> Maybe I have an overactive conscience, but I'd feel kind of wrong about selling without disclosing that I had good reason to believe it was compromised (a serious, unfixable, almost-invisible defect), and probably nobody would buy if I told them that.

<comment><USER7> Agreed. This would be similar to knowingly selling a defective device, only much worse.

But another thought that crosses my mind is that future disclosures and research may give him new insight to inspect the equipment and try to understand the extent of potential compromise. I would replace it but then hold onto it forever. Twenty years from now, the parts could be a goldmine for documenting what will surely be a historically significant time in the world of surveillance and privacy.

</comment></comment></comment></comment><comment><USER8> Is this the guy who claimed he hacked into an engine control computer via the in-flight entertainment system network?

So is this evidence that he didn't actually do that, or just that the FBI was unable to decrypt or otherwise get anything useful from his devices?

<comment><USER9> Part 1) Yes

Part 2) I don't know

<comment><USER10> Part 1) This is according merely to an FBI affidavit [1] applying for a search warrant, much less a charge or conviction. Roberts has claimed he was misrepresented, albeit understandably coyly [2]. "Yes" is an uncritical answer.

[1] [http://www.wired.com/wp-content/uploads/2015/05/Chris- Robert...](http://www.wired.com/wp-content/uploads/2015/05/Chris-Roberts- Application-for-Search-Warrant.pdf)

[2] [http://www.slideshare.net/EC-Council/a-funny-thing- happened-...](http://www.slideshare.net/EC-Council/a-funny-thing-happened-on- the-way-to-the-airport-chris-roberts) (slide 10; apropos nothing, this was a very boring and actually mildly annoying talk)

</comment></comment></comment><comment><USER11> Given the current security climate, if that were my stolen gear, I'd treat it all as suspect and burn the lot in a barrel.

There's no telling who's done what to it or what kind of nasties are now in the firmware.

<comment><USER12> I think you are overestimating both the ability and the budget of the FBI.

<comment><USER13> The FBI are a government agency, with some funds, and they had physical access to the devices, for some time.

The devices absolutely cannot be trusted.

Whether a person cares about trusting the FBI or not (or thinks they're happy with just flashing the firmware and replacing the harddrives) is another thing.

</comment></comment></comment><comment><USER14> The question is if any of that equipment can still be trusted.

<comment><USER15> Inspect it for hardware modifications, and, assuming there are none, perform a factory reset and you're good.

The amount of engineering the Feds would have to do to ensure a hack evades those two safeguards is prohibitive.

<comment><USER16> Agreed; people overestimate the technological expertise of the U.S. Govt. -- in my anecdotal experience they're laughably behind.

<comment><USER17> Isn't that what we thought before Snowden showed us the NSA reprogramming firmware? I know that I said it was being blown out of proportion when the Snowden leaks started, and boy was I wrong.

<comment><USER18> Snowden showed us that the 5-eyes countries are actively producing and marketing - in their own secret organizations with secret, anti-democratic agreements - massive-scale spy and intrusion technologies. Anti-democratic, freedom-defeating agreements for the purpose of total information control over human civilization.

Massive-scale, actually: full-spectrum.

There are no aspects of modern technology infrastructure that are off the table in these realms: all systems are targets. Planet-wide.

So, its not just that the NSA will be reprogramming firmware or putting key sniffers in your macbook or writing 0-day exploits. Its that they'll listen to everything, anywhere along the wire, as they see fit.

</comment></comment></comment></comment></comment><comment><USER19> Not only have tweets become news, they've become evidence of crimes. Law enforcement and newsgathering both have been reduced to searching for 140-character wisecracks and following the wisecrackers.

Why would a serious person, especially a security researcher, write a tweet except to manipulate the press or law enforcement?

How about a little white-hat opsec and infosec?

<comment><USER20> 1\. The tweet wasn't news, his arrest was news 2\. The tweet wasn't evidence for a crime, it was evidence that a warrant was justified, and other evidence included a supposed admission to the FBI. See [http://www.wired.com/wp- content/uploads/2015/05/Chris-Robert...](http://www.wired.com/wp- content/uploads/2015/05/Chris-Roberts-Application-for-Search-Warrant.pdf)

</comment></comment><comment><USER21> I wonder if you could play two gov agencies against each other: Dear IRS, I can't fill out the tax form because the FBI seized all my electronic equipment which contained relevant information. FBI's response to IRS's inquiry to return the devices: We lost them (alternative: we managed to destroy all data contained on them, pick one depending on how much you believe in hanlon's razor). The hypothetical me to IRS: I'm not paying any taxes until you guys figure that shit out lol.

<comment><USER22> While funny, I think that this falls into the trap of believing that the various bits of the government must operate robotically according to strict, logical principles. There are humans in the system who, for better or worse, can act according to what they perceive as the spirit, rather than the letter, of the law.

</comment></comment><comment><USER23> Is the EFF Client Chris Roberts, the game developer of Star Citizen?</comment>


Does "www." Mean Better Transport Layer Security? - <AUTHOR> https://eprint.iacr.org/2019/941 <comment><USER3> This may be surprising to some people, but it's not a new pheonoema and I feel it's kinda known in TLS circles. Everyone who's done scans on TLS vulnerabilities should know this (speaking as one of the authors of the ROBOT attack).

What's often going on is that the www domain is delegated via DNS to a thirdparty service provider, while the apex domain is hosted on some appliance and just does a simple redirect. The reason for that is that you can't do DNS delegation for an apex domain.

During our ROBOT investigations we found a particularly weird example: We found a particularly severe variant of our vulnerability in old versions of Cisco ACE load balancers. Cisco told us that these were out of support, so they're not gonna get fixed. Turns out: they used one of them to redirect cisco.com to www.cisco.com.

<comment><USER4> I'm not sure I grasp the situation. Does this mean that third parties can modify DNS entries?

<comment><USER3> Well, yes, if you let them.

DNS is hierarchical. If your DNS server manages example.com then you can set a delegation for a subdomain - e.g. www.example.com - to someone else. I.e. you could say "for this subdomain the nameservers from google's cloud service are responsible". You can go further and e.g. configure the google cloud service so that abc.www.example.com goes yet to another DNS service.

So a company could say "we manage the DNS for our domain inhouse, but for www. we let some other company do it and pay them for it". This is pretty standard.

</comment></comment></comment><comment><USER5> > Additionally, 24.71% of these redirections contains [...] HTTP intermediate > URLs.

One problem I've found is that if you have a redirect from HTTP to HTTPS, then you don't notice an extra redirect from HTTPS to HTTP (e.g. redirect from HTTPS plain domain to HTTP www, which then in the next request get upgraded from HTTP www to HTTPS www).

Combine that with the fact that it is surprisingly difficult to prevent the AWS load balancer from redirecting from HTTPS to HTTP. Literally Apache, Nginx, Tomcat, Jetty all get it wrong out of the box. I had to write this blog post to prevent myself from getting it wrong in the future: [https://www.databasesandlife.com/jetty-redirect-keep- https/](https://www.databasesandlife.com/jetty-redirect-keep-https/)

The particular application I discovered that on did not accept HTTP traffic, so I discovered the extra redirect. Most people don't.

<comment><USER6> > Literally Apache, Nginx, Tomcat, Jetty all get it wrong out of the box.

Absolutely correct, it's surprisingly difficult to get a really good working configuration with no weird fallbacks or side effects and have working http2. I have five server blocks per domain name when using nginx, some are reusable though, here:

* Port 80 with wrong domain - close connection, nothing legit does this

* Port 80 with right (www. and .) domain - redirect to [https://](https://)

* Port 443 with no SNI - close connection, nothing legit does this

* Port 443 with www. SNI (http2 enabled) - <USER2>

* Port 443 with . SNI (http2 enabled) - display proper page

Not surprisingly it tremendously cut down the amount of exploit scanners and bad bots from logs (they seem to rely on everyone not enforcing SNI) and managed to hide the server from Shodan :D. This is of course not to diss nginx, other servers e.g. caddy and apache were worse or even impossible to configure to the same point.

<comment><USER7> If you're just going to redirect www to . why not make it a CNAME instead of a hop?

<comment><USER8> CNAME in this case makes no difference vs an A/AAAA record. The HTTP side of things doesn't care what kind of DNS record it was, but will be affected by what the fqdn is, since it will affect cookie propagation and other security things in the browser.

</comment></comment></comment></comment><comment><USER9> Interesting. From my observation less and less sites actually use the www subdomain. Some give plain 404, domain not found, certificate errors and similar when browsing them with (or without) www, depending on how they are set up. It's a mess, really. Usually they actually behave the same, including TLS configuration etc.

Also something I observe daily: When I tell someone to go to "example.com" some will punch in "www.example.com", others will simply do "example.com". There is also the ultra rare occurrence of someone typing in "[http://www.example.com"](http://www.example.com").

Personally I just configure www to point at the same as the regular domain and have the www as a "subject alternative name" in the certificates. And in Nginx it's as easy as just adding it to the "server_name". I suspect it's the same for all other major HTTPDs.

<comment><USER10> Annoyingly Chrome doesn't even show the 'www' any more unless you actually click on the URL bar

<comment><USER11> These URL mangling behaviours of Chrome are getting really insane. It kind of works for very well known, ultra large sites like Facebook, Youtube, Google and other large corporations, but how are you supposed to know whether you're at the right place for the myriad of smaller and/or personal websites if most of the URL is hidden?

<comment><USER6> Honestly, you should be redirecting from either www. to . or vice versa, having one of them broken or doing something else is bad in 99.99% of cases.

<comment><USER12> The way you are using "www." and "." is incorrect. The dot isn't part of the local hostname "www". It is a separator or delimiter for the textual elements in the domain name. "Redirecting from (or to) ." is a weird and as far as I know completely wrong way to talk about redirecting from or to the domain name one level up in the hierarchy. The only time a dot plays any role in a domain name (other than that of a simple separator) is when it's used at the end of the fully qualified domain name.

<comment><USER6> What if I'm talking about redirecting an entire TLD "www" to ""?

Obviously it's a separator, I just found writing "" and "www" too weird. Not to mention that in this context where you're not really a recursive DNS resolver it really doesn't matter how one specifies the existence or lack of it of a subdomain. In addition to that some things use "@" (instead of the dot I used).

<comment><USER12> Whether it feels weird or not, the hostname label is "www".

The hostname-as-tld example is sort of against the rules:

[https://serverfault.com/questions/907226/is-it-possible- to-c...](https://serverfault.com/questions/907226/is-it-possible-to-create-an- a-record-for-a-global-tld)

Either way, "." by itself can only meaningfully refer to the root, not some arbitrary enclosing domain name. There is no way you will convince me that using "." as a shorthand for "parent domain" is a good idea, for that and all the other reasons.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> I use www. for everything because of cookies, when having cookies on the plain domain they are on every subdomain automatically, while having them on www. is exclusively for www.

<comment><USER9> I like your idea but it's based on false assumptions. See RFC6265. Depending on the implementation on the backend side (specifically the "Set-Cookie" header) it's possible to handle a cookie generated on "www.example.com" on "example.com" or "sub.example.com" ... and all other possible combinations.

[1] [https://tools.ietf.org/html/rfc6265](https://tools.ietf.org/html/rfc6265)

<comment><USER14> With the correct configuration, www.example.com cookies do not leak over all subdomains, but it's impossible to configure example.com cookies to _not_ leak over all subdomains.

<comment><USER15> If you omit the domain it shouldn't leak, though as with many things web it's browser-specific: [https://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_path](https://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_path)

</comment></comment></comment></comment><comment><USER16> A quick summary from a layman: Most websites that have both a www-domain (www.example.com) and a plain domain (example.com) tend to have better security configurations on the www-domain. It's worth noting that they seem to have scanned only for some known weaknesses, and that there is no law stating that www-domains must be stronger. Also, some websites that implement both www and plain may implement a redirect to a weaker configuration (oops). They analyzed about 1.3 million websites, so it's a decent chunk of the internet.

Of note to me is that they didn't comment on _why_ they might be configured differently. As in, does following a popular tutorial to configure Apache or Nginx neglect the plain domain? You couldn't determine the reason through a web scan so I don't blame the researchers for offering the reason. They also don't offer any way to fix the disparity. Obviously, the best practice is to just configure your server's www and plain domains correctly, but clearly most of the internet isn't following their best practices checklist.

<comment><USER17> The crap apex domain difference is probably explainable due to the fact you can't CNAME an apex (Yes, some CDN's/systems have work arounds).

So www gets put behind a nicely configured CDN with decent TLS settings, whereas the apex gets a crappy HTTP redirection service or maybe worse, the actual origin itself, serving up a half baked config.

<comment><USER18> Highly probable. Cloudflare, for example, has CNAME flattening to address this problem.

[https://blog.cloudflare.com/introducing-cname-flattening- rfc...](https://blog.cloudflare.com/introducing-cname-flattening-rfc- compliant-cnames-at-a-domains-root/)

</comment></comment></comment><comment><USER19> www is more secure to use than the root domain because of how cookies are set. Setting a cookie for the www subdomain ensures that it's only available for that subdomain and not globally across all subdomains. It makes sense that sites that use www are generally more secure.

<comment><USER9> > www is more secure to use than the root domain because of how cookies are > set.

> Setting a cookie for the www subdomain ensures that it's only available for > that subdomain and not globally across all subdomains.

No, www is not more secure because of cookies. As you said, it depends on how cookies are set, which is up to the host, as this is defined in the HTTP headers coming from the server. It's possible to access a cookie from "www.example.com" on "example.com" or "sub.example.com" if it's configured like that on the backend. Also the browser needs to comply. (Protip: most browsers do)

<comment><USER20> > It's possible to access a cookie from "www.example.com" on "example.com" or > "sub.example.com" if it's configured like that on the backend.

Ok but to my knowledge it is impossible to set a cookie on example.com and make it inaccessible to subdomain.example.com.

<comment><USER21> That's not true at all.

Try document.cookie = 'a=b' in a browser console on non-www domain and then do document.cookie on the www variant.

You'll see it not set. (The cookie will only be accessible on subdomains if you include the domain explicitly, like document.cookie = 'a=b;domain=toplevel.domain')

<comment><USER22> My understanding that doesn't work on old versions of IE.

<comment><USER23> Yeah, because the WHATWG folks changed the spec after 20 years. Not because IE implemented the wrong thing. Not surprising folks in this thread remember the old spec, which was valid for longer.

</comment></comment></comment></comment></comment></comment><comment><USER24> > Further analysis of the top domains dataset shows that 53.35% of the plain- > domains that show one or more weakness indicators (e.g. expired certificate) > that are not shown in their equivalent www-domains

And Chrome still wants to fool the user into thinking these two domains are the same.[0]

Great job, Google.

[0] [https://news.ycombinator.com/item?id=20626807](https://news.ycombinator.com/item?id=20626807)

</comment><comment><USER25> Related tangent: use of a "www" CNAME provides a convenient safety net of sorts when it comes to mitigating DDoS attacks.

</comment><comment><USER26> I asked a question about this exact topic on Information Security over 4 years ago, which received very little attention but the one answer it received came to the same general conclusion (possibility of protocol differences):

[https://security.stackexchange.com/q/91717/78662](https://security.stackexchange.com/q/91717/78662)

However, if these are hosted on the same server, there is a long-standing bug in Apache that forces the same protocol and cipher suite for all virtual hosts:

[https://serverfault.com/a/698478/293818](https://serverfault.com/a/698478/293818)</comment>


Ask HN: How many project have you started but haven't shipped? - <AUTHOR>

Starting a project is easy, but finishing is hard. I have a folder with 20+ unfinished/unshipped projects. Am I the only one that has the problem of being unable to ship things? <comment><USER2> Let's see, I have 33, count em, subfolders in my /prj directory.

4 are folders for random hacks or experiments I do (eg, one for Ruby, one for Clojure, two for misc stuff). So I won't count them.

5 are random admin stuff, so I won't count them either.

2 are folders containing work from previous jobs. 2 are university projects.

That leaves 20 personal projects I started.

 _Unshipped/unfinished_ :

-Botnet (Facebook game in Rails, never finished)

-KAF (Business plan + notes for a startup in the smart TV space. Never actually wrote any code for this so I don't know if it counts as a project).

-NAND cpu (simulated CPU built from simulated NAND gates. I got as far as making an adder and got bored)

-Pixelworld: (a multi-user canvas thing.)

-Robots Rising (clojure browser game, got bored and gave up)

-Unimemes (can scrape Facebook groups and find the most liked pictures, got bored)

 _"Shipped" but gave up quickly_ :

-ChineseVille (Facebook app similar to Lingt, "launched" with a very incomplete alpha and gave up after no-one showed interest)

-Discrete (Pixel-art webcomic, did about 5 strips, some people on Reddit liked it but I decided it was too pretentious so deleted it)

-Nohao (user-rated learning resources. Released a very early version and no-one was interested, so gave up).

-Real Reading List (similar to Nohao, but focused on textbooks. (lesson: everyone has had the idea of reselling textbooks to students, it has never worked)).

 _Learning projects_ :

-Facebook-friends scraper

-Pond (Clojure game)

-Rails survey app

 _Hackathon projects_ :

-Twitballot (twitter polls)

-Vettr (online careers fair)

 _Shipped_ :

-My personal homepage

-Shintolin (MMO browser game)

-Writing (stuff on my personal blog)

-Warwick Fashion Group (blog done for a friend)

-Warwick Uni Startups (website for a university society)

I count the last 3 groups as successes, which makes 10/20 hit rate. That's better than I thought, though I'm being a bit generous with the definition of "shipped". Shintolin is the only significant personal project I've worked on (it was also the first, go figure). There's also a whole bunch of work/university/freelance projects I've completed which aren't on this list, but that's obviously thanks to massive extrinsic motivations.

Unlike most people, my problem is shipping too early -- I tend to release stuff in a really crappy, unfinished state, when of course no-one will be interested. (It did work for Shintolin, though -- I posted it on a forum when all players could do was walk around and punch each other, and people seemed to really like it). That said, I don't regret giving up on any of the other projects (except maybe ChineseVille, which could have worked if I stuck with it).

(And of course, software projects are by default never finished. That's why I've come to enjoy writing -- you realise you've already written too many words, even though you have more to say, and can then stop and hit "publish". There's no limit to the features you can add to any piece of software).

I've realised I'm gonna have to partner with a finisher if I want to achieve anything significant in future.

</comment><comment><USER3> Tons. This work is like art, imagine, create, not finish, and toss to the side.

Here's a few that come to mind:

'07 - A Search Engine that used MS/GOOGLE/YAHOO as my seed and resorted the order based on some composite ranking from comparing the three results.

'08 - An Email Myself Blogging service that took some words, links, and posted it on the date in the email.

'09 - A Local Coupon site to work against Valpak. You could throttle the amount discounted so you didn't have the Group On effect. I came back to this idea 20x, but in order for it to work you have to hit the pavement and talk to store/rest/bar owners.

'10 - Social networking site for fitness with a workout tracking tool.

'11 - Quit a company that got bought by Google (just had to get it off my chest)

'12 - Notes sharing tool that's transformed into something else. I stopped for a month on it, bugged me so much that finally late March I got back on that damn horse. In 4 weekends I have POC (like a lawn motor on wheels) that finally worked...but I'm excited about it now.

In the end that # of projects doesn't count for a damn thing. Everyone of those ideas listed above could work, have worked for someone else. Someone that saw one thing to the end. You aren't alone though, so don't beat yourself up one bit.

1, that's the number I am going to focus on this year. Finishing one idea out.

</comment><comment><USER4> Quite a few unshipped. I think there ought to be a difference between unfinished and unshipped. My projects are unshipped by which i mean I finished them but couldn't commit the time to market/sell them.

Eventually you learn: If you build it they will come; If you are lucky.

</comment><comment><USER5> I have a ton of projects that I haven't finished... Some of them are still ideas I think could have some merit, if only I had the time or motivation to finish...

Burnout is a real killer

</comment><comment><USER6> Definitely 20+, could be closer to 30+. Some of them I lost interest in, some I lost interest in the technology. Some I want to work on so bad but have no time.

</comment><comment><USER7> Yep I'd say around 20 started. Somewhere close to 100 new ideas not even touched yet. I'm just staying locked onto one thing at a time now.

</comment><comment><USER8> I have around 10 here... yeah, procrastination is the root of all unshipped products. :/

</comment><comment><USER9> I lost count a long time ago.

</comment><comment><USER10> You are not. To be fair, I also have a few products that I've shipped but that didn't go anywhere -- of course, I didn't really expect them to as I didn't really do anything in the way of marketing or anything, but they're out there (or shuttered).

In my case, for the most part, I'll either come up with an idea or a challenge. In some cases, I'll work towards an idea and usually, I'll get further along with those because I start with the boring stuff like logins, user profile pages, etc.

With the challenges ("How would you build a web site that did <insert something novel here>?"), those are pretty much guaranteed to be DOA. I do the hard part, sometimes realizing my initial approach was stupid, starting over, and then doing it more elegantly, and then uhhhh, well, that's it. The chance of me writing all the boring crud for something like that to make it multi- user is infinitesimal.

</comment><comment><USER11> Dozens.</comment>


Various Schemes of making $5,000/month at home (Quora) - <AUTHOR> https://www.quora.com/How-can-I-make-5-000-per-month-working-from-home?share=1 <comment><USER2> If these people where making half as much as they claim, they wouldn't all be selling snake-oil drop-shipping courses online.

<comment><USER3> But you can make over $5000 a month fleecing rubes. Buy my course to see a first-hand example.

</comment></comment><comment><USER4> A lot of the answers read like a lot of the spam I see on Facebook! :) Most of the schemes seem to be around reselling stuff on ebay/amazon or blogging to make adsense/affiliate money.

<comment><USER5> Was going to say the exact same. "Would you like to finally find success working from home? Would you like to do more than just get by? Today we are talking about how to hustle your way to making $5,000 per month or more. Learn from these examples and use them as inspiration when devising your own work at home success plan." .. and my scammy-senses are tingeling.</comment></comment>


Model View Whatever - <AUTHOR> http://khanlou.com/2014/03/model-view-whatever/

<comment><USER2> The article is pretty well thought-out and documented, but I feel it's missing the target once again.

Am I the only one to feel that this plethora of nebulous patterns hinder creativity and intelligence more than anything else ? What is the deal really ? I may be missing the whole point but for me it seems to be, summed up : keep as much of the core business logic separated from the interface because one will die sooner than the other. Then the correct model depends a lot on the platform you're building on, and the freedom to try and design new paradigms seems to me a much more valuable asset than trying to force-fit your app into MV-WTH. I feel we don't even remember what constraints these models are here to help optimize. Please tell me if I'm missing something. I eagerly await the day when this will all (MVC and friends) settle down and we will be able to start building on top of all that towards more ambitious architectures.

<comment><USER3> I'm curious what you feel the target is. What we call patterns here are no different than any other industry.

Seriously, name an item and we can quickly describe some common patterns in them. More interestingly, we can describe different sets of patterns that cover the same item. Depending merely on the vantage of who is looking at it.

I think this is where things get truly difficult in programming patterns. We try to get the one abstraction to rule them all. Not necessarily that easy to do.

<comment><USER2> To me the target is being able to adapt. Patterns are not bad in themselves. What make me cringe is the obsession with MVC and derivatives. That's like trying to fit everything that is merely spherical in the "ball" label. That is "ballish", "ballable", "balloid". Maybe it's just not, and being able to take a fresh look on it might open new perspectives.

Looking for one abstraction to rule them all is is like looking for one word to rule them all. Does it make sense ?

<comment><USER3> Oh, it certainly does. My point on the "one abstraction" was just how fraught that idea is.

On the train home I thought of a retort to the idea of all of this. When it comes to describing a system, there are really only two things I care about. The inputs and the outputs. Anything that obscures either of these in relation to the other is just going to get in the way at some point.

I used to call programming web pages the act of building a giant Rube Goldberg machine where you mix several inputs into building out a web page. I still feel this way, to an extent, but I am hopeful of simple solutions that do not obscure where data comes in and how it goes out. (If that makes sense.)

</comment></comment></comment></comment><comment><USER4> I'm beginning to appreciate the concept of Interactors and Entities more these days (application-specific business logic versus application-independent business logic), now that I'm some sort of a mature adult (jury is still out on that one). This post highlights that as part of the "VIPER"-style architecture. The great part about these patterns is that they can typically be applied to a lot of modern Ruby and iOS projects _both_ to cleanup code.

Great post; I always enjoy reading these sorts of things.

</comment><comment><USER5> Funny, I have ended up with VIPER (sort of). Only, nearly all of the classes involved are Plain Old Objects, instead of having particular defined/inherited behaviour. It's quite nice. My view layer is gone, too, as I'm just kicking out JSON from my server (although I can wrap dumb views in front of the API if needed). This is web development, mind you.

Lately I've been trying to learn game engine development, from scratch in C++(!). It's... an experience, and aside from the amazing book Game Engine Architecture and a few others I have, I've come to really miss how well defined architecture is for web dev compared to game dev.

</comment><comment><USER6> If anyone wants to see the MVVM (MVCP) pattern in Rails 3 action, the diaspora codebase on github is a good place to look.

We also add our own standards to Rails:

        app/clocks/      # clockwork
        app/hacks/early/ # before boot
        app/hacks/late/  # after initialize!
        app/threads/     # launched in Thread.new to save RAM costs (150 MiB / process)
        app/workers/     # sidekiq

And foreman_god to support passenger-like tmp/stop.txt and tmp/restart.txt

<comment><USER6> s/app/lib/</comment></comment>


If the Moon was the Size of a Pixel, a much more accurate Solar System scale - <AUTHOR> http://joshworth.com/dev/pixelspace/pixelspace_solarsystem.html

<comment><USER2> "most of space is just... space"</comment>


Court permits joinder in BitTorrent filesharing case - <AUTHOR> http://legaltimes.typepad.com/files/huvelle-opinion-voltage.pdf

<comment><AUTHOR> This is a rather technical decision in a content piracy lawsuit. Distributors of _The Hurt Locker_ and other films have accused BitTorrent filesharers of copyright infringement, and added a long list of potential defendants ('Does 1-1000,' as in 'John/Jane Doe') based on IP addresses.

A large number of people have filed motions to have themselves dismissed from the case or for protective orders that would prevent their future involvement, on a variety of legal grounds. These have been denied by the court, on the basis that the filers have yet to be named as defendants; although it's possible that that will happen in the future should the IP addresses in the plaintiff's complaint match up with the ISP customer accounts of the filers, the court decided that pre-emptive dismissal hearings would likely result in a colossal waste of time.

Most of the material in the linked opinion is civil procedure legalese that will only be of interest to lawyers. On pages 14-16, however, the court considers BitTorrent's method of operation, and specifically the plaintiff's claim that the nature of seeding is such that any downloader of a specific file via BitTorrent is by definition engaged in sharing that file for as long as the BitTorrent client remains connected to the network and the file has not been deleted. If I understand the court correctly, previous attempts to join large numbers of defendants this way failed because the plaintiffs were claiming that multiple copyrights were being infringed by all defendants - <USER2> reasonably argued that such a shotgun approach risked penalizing individuals for all possible crimes committed by everyone in a group. It was unreasonable for plaintiffs in those cases to join defendants _en masse_ by pointing to the availability of multiple torrents of copyrighted works, because there was no basis to think that every defendant would necessarily have downloaded the same movies, and thus they could not be said to be acting in concert.

Here, by contrast, there's a good chance that people who downloaded a torrent for a specific movie went ahead and downloaded the movie, and if they were ever a seed peer, then they must by definition have been acting in concert with other seed peers to infringe upon the plaintiff's copyright. On that basis, the judge rejected the procedural argument for dropping defendants from the case at this stage and refused to guarantee immunity from future joinder. So the case will go ahead for the time being, and seems as if it will be based on a realistic description of how BitTorrent actually functions which is well understood by the presiding judge - a small victory for the plaintiffs.

IANAL, plus I have only read it through once - so some or all of the above may turn out to be incorrect. Don't construe anything I say as legal advice! Also, I'm highlighting the particular issue that interests me, so don't mistake this for a comprehensive summary either. In fact, don't read any of the above, and if you did read it just forget about it :-)</comment>


Absolution: The long odyssey of a child soldier - <AUTHOR> https://granta.com/absolution/ <comment><USER2> A Long Way Gone [0] is an amazing (and harrowing) first-person account of a child soldier in Sierra Leone. It's not too long of a book, and I highly recommend it.

[0] [https://smile.amazon.com/Long-Way-Gone-Memoirs- Soldier/dp/03...](https://smile.amazon.com/Long-Way-Gone-Memoirs- Soldier/dp/0374531269?sa-no-redirect=1)</comment>


Be careful not to automate the fun out of life - <AUTHOR> https://www.iafrikan.com/2018/01/27/dont-automate-the-fun-out-of-life/ <comment><USER2> Not sure why the author chose to go with "elevator operator", instead of "horse-and-buggy driver".

> _But if people aren't careful, its fully autonomous cousin may one day drive > the joy of driving, or even an entire joy of living, out of human > experience._

There's no joy in spending 50 minutes in stop-and-go traffic on the freeway. This is a bunch of feel-good nonsense. Are you going to feel wistful about no longer spending three hours a day doing laundry by hand, too?</comment>


Pull up artists (podcast) - <AUTHOR> https://www.outsideonline.com/2365341/pull-artists <comment><AUTHOR> Neat discussion about maximal physical process, specifically endurance ie chronic exercise.</comment>


The future of C# and Visual Basic [video] - <AUTHOR> http://channel9.msdn.com/Events/TechEd/Europe/2014/DEV-B345 <comment><USER2> Much to the derision many of the developers I know, I still say that C# is the best language I've ever worked in. But the .NET platform is one of the worst I've ever worked in. So opening up C# to more platforms sounds very, very good to my ears.

I only wish Xamarin's products didn't cost so much. With Swift on the scene I really can't justify spending money to write my side projects in C# instead of in the environment Apple provides. Or Java for Android, which let's face it, is already similar to C# anyway.

<comment> V-2 I hope that Microsoft buys Xamarin (I know, I'm evil) and makes it free, or very reasonably priced.

<comment><USER3> If by some miracle Visual Studio ever ran on non-Windows platforms, Microsoft would then be free to kill off Xamarin Studio.

And as long as we're being evil, I wouldn't mind seeing Microsoft buy up Light Table (if that's even possible) and build some of its features into Visual Studio. Namely inline eval and live code modification.

<comment><USER4> Both of which it has have via Roslyn/Edit and Continue.

<comment><USER5> Interesting. I knew VS had been working toward features like that; I wasn't aware they'd come as far as they have. Though from my poking around there appear to be some limitations: no redefining lambdas in a live session, for example. And I'm pretty sure that Instaparse is still out of reach, though that's not really what was being referred to. But thank you for reminding me, it's been a while since I've had an occasion to touch VS.

</comment></comment></comment></comment></comment><comment><USER6> C# seems to look more like Scala with every release (a good thing), with talk of primary constructors for C# and string interpolation etc.

EDIT: Interesting to see Neal Gafter is involved (See Roslyn mention here: [http://www.gafter.com/~neal/](http://www.gafter.com/~neal/)), who is rather fond of Scala from what I've read: [http://www.infoq.com/articles/neal-gafter- on-java](http://www.infoq.com/articles/neal-gafter-on-java)

<comment><USER7> >C# seems to look more like Scala with every release

It does, but then that begs the question of "why use c# at all?". C# is still missing (along with F#) scala's most powerful features, and I prefer the JVM and openness of the ecosystem to .NET

The contact I'm on, we're having a lot of success porting away a _large_ C# application to Scala.

<comment><USER8> You also get a step-wise path to rewrite the applications. Going to Scala would probably be a complete re-write which is risky and time consuming. I don't think Scala usage will grow much more now that Java 8 is released. The benefits of rewriting a Java application to Scala is probably not that great in comparison to the cost. And the C# to Scala re-write is probably even worse from a cost/risk perspective.

<comment><USER9> Well, obviously other people did the math and went ahead with it.

> I don't think Scala usage will grow much more now that Java 8 is released.

I don't get that reasoning. As the GP mentioned, even C# projects migrate, so why would Java's more concise anonymous inner classes be a show-stopper?

</comment></comment></comment></comment><comment><USER10> I wish there was a tl;dr version as its quite hard to find the time and motivation to sit there and watch something like this for over an hour.

<comment><USER11> There are slides, which give you a quick synopsis (look under the video)

<comment><USER10> Thank you - completely missed them :)

</comment></comment></comment><comment><USER12> TL;DR (slides) [https://view.officeapps.live.com/op/view.aspx?src=http%3a%2f...](https://view.officeapps.live.com/op/view.aspx?src=http%3a%2f%2fvideo.ch9.ms%2fsessions%2fteched%2feu%2f2014%2fDEV-B345.pptx)

</comment><comment><USER13> Although most of the language features have been discussed before. I am excited for null propogation as well as string interpolation. These are will improve the signal to noise ratio and allow for easier to read and write code.

From my experience with C# null checking before method calling or indexing is such a pain and the coffeescript like null propagation is a much needed feature.

</comment><comment><USER14> They're releasing it under the Apache licence 2? Impressive. That definitely seems like something the Mono project could just utilise directly without any licence concerns.

<comment><USER15> Xamarin is selling licenses to proprietary gamedevs for quite a while now. That may put a dent in their business.

<comment><USER16> The mono compiler (that Xamarin uses, and would presumably be replaced by the Roslyn compiler), is released under GPL and MIT X11 licenses ([https://github.com/mono/mono/blob/master/LICENSE](https://github.com/mono/mono/blob/master/LICENSE))

I don't think this will have any effect on Xamarin licenses at all.

</comment></comment></comment><comment><USER17> I don't see why Microsoft still put resources into Visual Basic.

C++/C#/F#/MSSQL/PowerShell is all they really need to concentrate on.

<comment><USER18> There are legions of VB programmers out there, you just don't hear from them. The ones I worked with a decade ago were not the types to wind up on HN, to read programming blogs, or to engage with the wider programming community. They were only really interested in programming to the extent that they used it to do a job (they were "Morts" [1]).

Mind you I don't think there's anything wrong with that as an attitude. Anyway, Microsoft puts resources into it because they probably have zillions of paying customers using it.

[1] [https://web.archive.org/web/20080218051638/http://www.nikhil...](https://web.archive.org/web/20080218051638/http://www.nikhilk.net/Personas.aspx)

<comment><USER19> I am still a Classic Visual BASIC (VB 6.0) programmer.

Microsoft made it so VB 6.0 needed the Microsoft Java Runtime to install and it works with Windows 95 to XP, but in Vista and above it has problems installing. There are ways you can trick it to install but in the long run it is not worth it as it causes OS instability.

I got an XP Pro Virtual Machine in Virtualbox that I develop VB 6.0 apps inside of. GIT only works with XP and up, so Windows 2000 and under are out of the question. (Something about IPV6 support in the Git app and the first Windows to support that was XP so it fails in earlier Windows) So if you want to do legacy Windows programming and use Git, XP is your best choice. Visual Sourcesafe never seemed to work properly and I always had coworkers and management get in and scramble the files by accessing them directly on the NT Server or whatever and load them in MS-Word or MS-Frontpage that changed the formatting and then they saved bypassing source control. At least in Visual Sourcesafe 6 this was true, and I believe that Git is much better.

Since 1983 I have learned over 37 different programming languages on many different platforms. I only did Visual BASIC programming from 1995-2002 because in my area the IT shops were Microsoft shops and management decided to use Visual BASIC. While I knew Non-Microsoft languages, management never wanted me to use them.

I ended up on disability in 2003, and by that time Visual BASIC evolved into VB.Net influenced by Java and took a turn for the worse. Then Visual C# got used because it is more like Java than VB.Net is, and the high schools and colleges teach C# and Java so these new programmers learn it.

In high school I learned Pascal, in college I learned Pre-ANSI C, COBOL, FORTRAN, Ada, X86 Assembly, and others.\

Around 1995 I was learning Java and JavaScript. Then later Python and a few others. But on my spare time at home, because my managers didn't want me to use them.

I just recently took a Ruby on Rails MOOC and passed it with 100% on each programming assignment. I used to do VBScript ASP 3.0 programming. ASP.Net changed all of that apparently.

So yes I am one of the legions of VB programmers out there, got forced into disability, too old to work in my 40s (They only want young people), and read Hacker News because my interests are scattered all over the place in learning stuff.

The die hard Visual BASIC only programmers were the ones I had a coworkers who I had to hand-hold and teach Visual BASIC to them. Most earned university degrees but had no idea how to program. They secret handshaked their way to a job, while I had to pass tests and show code. I super debugged their code, and their code was sloppy and crashed systems and servers. They moved on without me into the Dotnet era and Visual C# and stick to Microsoft websites for their news using Bing as a search engine. They find me on social networks and ask me to apply for my old job so I could help them, but I cannot go back, I can only go forward. Work on my side-projects and do it as a hobby until I can get off disability one day.

</comment></comment></comment><comment><USER20> I second that that C# and the .NET platform are a joy to work with. If you've never given them a shot, you may be pleasantly surprised.

</comment><comment><USER21> This is all very nice, but what would make me truly excited is if they released their runtime for linux ... yeah, it's just a dream. would be a lot of work I expect and they wouldn't want to even if it was easy.

<comment><USER2> Well, Mono exists. At this point porting to Linux would just be duplicating a large amount of Mono.

<comment><USER21> Yes, I use it extensively and it's good. But the Microsoft runtime is awesome. Much faster and very stable. I do a lot of number crunching (distributed on a small cluster) and don't want to use Windows in this scenario for various reasons. Mono is good enough that I choose to compromise, but MS runtime on linux would be a dream come true.

</comment></comment></comment><comment><USER22> I had use VC and VB a long time (15+ years) ago and have since moved to Linux + gcc, python, golang, mobile etc.

After watching this video for 20 minutes of all the fancy GUI details, I have couple of higher level questions:

       1) Do C#/VB still only build for Windows, Win Mobile?
          Can they build targets for IOS, Android, Linux?
          I heard the new CEO of MSFT suppose to be more supportive of cross platforms.

       2) I began to like the concurrency model in golang a lot.
         Does the C#, VB support that kind of concurrency in their language design?

<comment><USER23> 1 - Mono still works well and Rosyln compiles and runs in Mono.

2 - Not at a syntax level, but there is good concurrency support in the .NET stack.

<comment><USER24> "Concurrency" at syntax level is kind of dumb anyway.

<comment><USER22> The way golang works seems to be follow the model of Unix pipe (stdio pipe) between process. They are simple channel between go-routines (kind of) light weight threads.

The concept is built into the language itself.

Anything wrong with that?

<comment><USER24> Yeah. Goroutines not backed by real threads (afaik there's also gorountine -> os thread), those "green" threads from Ruby and fibers are just ugly hacks.

Sorry but from my point of view, "real" concurrency is done at the OS level. The OS schedules threads to the CPU depending on their priority and "other" things. Having a single OS thread and runtime code that "yields" so another piece of code can run in the same thread, that's not concurrency...that's a toy.

Sorry for being so blunt.....but that's my opinion.

<comment><USER25> Switching goroutines is much lighter than switching OS threads. When this "toy" and "hack" becomes as heavy or slow and thus no more useful than OS threads, then you can make a point. As I see it, you aren't making a point right now, just explaining what OS threads do and calling goroutines names. So let me point in the direction of an explanation of what goroutines do: [http://www.cs.columbia.edu/~aho/cs6998/reports/12-12-11_Desh...](http://www.cs.columbia.edu/~aho/cs6998/reports/12-12-11_DeshpandeSponslerWeiss_GO.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER26> Here is a recent C#/.NET experience that I had: Some of my time is spent profiling/sampling/optimizing the pipeline at work. I decided to take a stab at a C#/.NET tool that is executed quite a lot throughout the day, only to find out some unexpected things - all variables in a functions would be initialized to defaults (used or not, covered or not)... So splitting large functions into smaller would (actually) help in this case for sure:

[https://gist.github.com/malkia/ebf7f54063c5aec6d1b0](https://gist.github.com/malkia/ebf7f54063c5aec6d1b0)

Some answers from Eric Lippert about it (declaration spaces) [http://blogs.msdn.com/b/ericlippert/archive/tags/declaration...](http://blogs.msdn.com/b/ericlippert/archive/tags/declaration+spaces/)

And this stackoverflow: [http://stackoverflow.com/questions/2976628/question- on-c-sha...](http://stackoverflow.com/questions/2976628/question-on-c-sharp- variable-scope-vs-other-languages)

It's not something I've seen in other languages/vm's. And seems like "ngen install" with some attributes would help it:

      [MethodImpl(MethodImplOptions.AggressiveInlining)]
      static int func1(int flag)

But I'm no longer able to think of C# as closer (not close) to the metal, because of this exactly. It'll affect me how I look at it and code in it.

</comment><comment><USER19> The main problem is the GUI Windows Forms that Visual Studio uses that they won't allow for use on other operating systems other than Windows.

If they included libraries that could compile the Windows GUI Forms to other operating systems like GNU/Linux, *BSD Unix, iOS, Android, Mac OSX ect it would be used more for those platforms.

Instead you have an incompatibility and it prevents developers on Non-Windows platforms to take it seriously. How can you claim it is cross platform when the GUI parts won't even compile?

Visual BASIC 6.0 was the last version of Visual BASIC that didn't stink and add in a bunch of Java features. I consider it Classic Visual BASIC for version 6.0 and under.

This Visual BASIC is really VB.Net and not Classic Visual BASIC. I'd much rather use the BASIC based Jabaco [http://www.jabaco.org/](http://www.jabaco.org/) to make Java Bytecode JAR files than use VB.Net to make binaries. At least the Java JAR files are cross platform better than VB.Net and C#.

<comment><USER27> There is another BASIC that compiles to Java and is more actively developed than Jabaco :B4J [http://www.basic4ppc.com/android/b4j.html](http://www.basic4ppc.com/android/b4j.html)

Also for cross-platform development there are even dialects that compile to HTML+JS: [http://pewtersoftware.com/browserbasic/](http://pewtersoftware.com/browserbasic/)

And other platforms: [http://www.monkey-x.com](http://www.monkey-x.com)

<comment><USER19> Thank you I'll look into them.

Monkey-X looks like Blitz BASIC rather than Visual BASIC. But I like the fact that it can go cross platform.

</comment></comment></comment><comment><USER28> What's the use case for a getter-only auto property? I can't imagine how that would work, does someone have any insight?

edit: is it "same as a public readonly field, but it's a property"?

<comment><USER29> Yeah, it must be initialized in the constructor.

Similar to the JVM, the CLR can offer binary compatibility of libraries, which is something Microsoft cares a great deal about. Changing a public readonly field in to a public readonly property is source-compatible, but not binary- compatible. That's why properties are generally preferred, even when you don't strictly need one. The language was actively discouraging either immutability or binary-compatibility by making it more verbose to get a trivial readonly property.

<comment><USER28> Ah, that's the catch, it makes sense now.

</comment></comment></comment><comment><USER30> C# is neat and I used it as my primary language for a good 6 years from 1999 to 2005, and then a little bit since they -- maintaining legacy projects. But a platform specific language it isn't the future in my opinion, it is just too limiting. Python, JavaScript and other types of cross platform languages, even if slower and sometimes more annoying to debug, is where the money and the future is.

<comment><USER14> JavaScript, yes. Python? Python isn't particularly popular and there aren't many Python jobs around. It also isn't a particularly popular language on any platform but Linux (so while technically cross platform, if few use it on other platforms is that relevant?).

If you've been ignoring other languages to concentrate on Python of all things in the last few years then you have missed the gravy train. Object C, Java, and C are the most popular, and both Java and C are cross-platform (and better still actually used cross-platform unlike Python).

As an aside I see significantly more Java, PHP, and C# jobs than any other language (mostly for web-apps). Then after those I see pure mobile development (Java-Android, and Object C).

<comment><USER31> _Python isn 't particularly popular and there aren't many Python jobs around._

Where have you been looking? Maybe if you only focus on pure web-dev, but I see Python and Python jobs everywhere. But I will concede that many of those jobs are science, engineering or analysis jobs that primarily involved programming python, rather than pure programming jobs.

 _It also isn 't a particularly popular language on any platform but Linux_

That is not my experience at all. Of all the cross platform scripting languages (Perl/Ruby/PHP/Lua/Javascript etc) it is by far the most popular on Windows, and certainly the best supported. I can probably also name a half dozen big commercial Windows apps that use Python as its main scripting language.

<comment><USER14> > Where have you been looking?

The normal places you'd find developer jobs. I didn't check the Python forums or other Python specific job boards.

> Maybe if you only focus on pure web-dev, but I see Python and Python jobs > everywhere.

That's strange. In what industries? Doing what?

I see C engineering jobs, tons of webapp jobs (PHP, C#, Ruby on Rails, etc), Java for all the things, VB.net for business desktop applications, and so on. I cannot think of the last time I ran across a Python job except they're occasionally listed as a "useful skill" in a SysAdmin job advert.

> Of all the cross platform scripting languages (Perl/Ruby/PHP/Lua/Javascript > etc) it is by far the most popular on Windows, and certainly the best > supported.

I see a decent amount of PHP on Windows and it seems to be very well supported. JavaScript I guess more so but that seems like an odd thing to list in that context.

<comment><USER32> > That's strange. In what industries? Doing what?

For one, Python is very big in the GIS space. Python is one of the main scripting language for ArcGIS, which is the main software platform that GIS folks use.

</comment></comment></comment></comment></comment><comment><USER33> These additions are all nice but most of them really aren't more than syntax sugar. What c# really really needs is stricter reference handling of objects, such as const * const in C. Now when you send an object into a library function you don't have the slightest idea what the function will do to your object. Take the simplest case of void Foo(List<string> bar). What will Foo do with bar? 1. Iterate it once and calculate something based on the contents. 2. Iterate it once and store references to all strings in the list. 3. Mutate the list by adding or removing items. 4. Store a reference to the list itself and modify it two days later from another thread causing a race condition because you thought you held the only reference to that list.

Case 3 could be excluded by using ienumerable here but in many other cases its not that simple.

I'm not asking for c++ and manual memory management here, just some kind of constraints on what a function may do with its arguments. I've seen case 4 cause so many bugs its ridiculous, it doesn't even have to involve multi threading before it gets nasty.

<comment><USER34> _Now when you send an object into a library function you don 't have the slightest idea what the function will do to your object_

There are more languages then C# which tend to have these problems, and for all of them these problems can be avoided in a number of ways merely by applying the typical good practices and well known design patterns. For instance just giving your functions proper names (examples 1. GetLongestString 2. StoreReferencesToAllStrings (still hacky, not sure if there are proper usecases for that?) 3. RemoveDuplicates 4. InstallList or so) and making sure functions do One Thing only will get you a long way in preventing problems. Not saying it is easy, but I've been using C# for at least 5 years and don't really recall problems with it. Did have problems with weak event handlers disappearing due to gc but after learning it it didn't happen again.

</comment></comment><comment><USER35> Letting NuGet packages inject domain specific tooltips and warnings sounds awesome.</comment>


Life of a seed round: practical advice for fundraising - <AUTHOR> https://www.gyroscope.cc/blog/2017/4/10/life-of-a-seed-round <comment><USER2> The "Rule of Two" seems like one of the most important takeaways here... If there was a "correct answer" to questions like market and product, many more startups would be successful... There's a certain amount of prestidigitation in bringing any new company/product to market, and to think any one person's opinion (including your own) is the 'truth' is misguided.

</comment><comment><USER3> 1\. What would you do differently if you were to go back and do it all over again?

2\. As you think about your future funding, what are you doing now? What notes have you written to yourself for the future?

<comment><USER4> (author of the post, glad to see it is on HN!)

1\. I'd do more research into each firm and partner. I think we could have been more tactical about who we talked to; in some cases it was obvious we didn't align with the investing thesis of the firm but this was our first time and we were so excited that anyone would talk to us that we took meetings that probably weren't as valuable to the VCs as they were to us. Also there's a million things in hindsight. Also this whole process is emotionally exhausting, so I'd prepare myself more for that aspect.

2\. We're building our business - launching the product, selling it, getting to clearly defined revenue goals. The big thing we're doing now is making our key indicators obvious and tracking the heck out of them. We're really, really trying to stay focussed.

</comment></comment><comment><USER5> Does YC explain why they don't use SAFEs somewhere?</comment>


Clojure transducers from the ground up: using them in practice - <AUTHOR> https://labs.uswitch.com/transducers-from-the-ground-up-the-practice/ <comment><USER2> Transducers are also familiar from automata theory. There's a recent line of research into automata and transducers with symbolic representations for transitions. I've studied using them to apply fusion to pipelines of stream transformations [1]. Here's talk I have for a related paper [2] and this talk by Loris d'Antoni gives a general overview of symbolic automata and transducers [3]. In a few weeks I'll have a talk up that summarizes the last three papers I have on the subject.

[1] [http://dx.doi.org/10.1145/3062341.3062362](http://dx.doi.org/10.1145/3062341.3062362)

[2] [https://youtu.be/0IL60qJEKLU](https://youtu.be/0IL60qJEKLU)

[3] [https://youtu.be/ca9IF-7nSOA](https://youtu.be/ca9IF-7nSOA)

</comment><comment><USER3> From reading this it seems like clojure transducers are the same thing as linq expressions over IEnumerable. Is there any additional functionality they provide?

<comment><USER4> One thing I _believe_ is not possible with linq is you can pass a transducer to a function (since a transducer is just another function), which can then insert it into a pre-existing chain of transductions.

<comment><USER5> The analogue of a transducer is an iterator transformation, aka. something like `IEnumerator → IEnumerator`, which is also just a function.

</comment></comment></comment><comment><USER6> So are transducers basically this Java, but in Clojure:

[https://gist.github.com/tomwhoiscontrary/e41d52e9c98a706552b...](https://gist.github.com/tomwhoiscontrary/e41d52e9c98a706552be66f8a5f2fc17)

?

I've done that in terms of Consumer, but it might also be possible, and perhaps more elegant, in terms of flat-mapping functions (Function<T, Stream<T>>).

If i've understood right, then from a Java point of view, transducers are an attempt to reify the various operations on streams - mapping, filtering, etc. To do that, you have to figure out a type which is general enough to model all those operations.

The need for a general type is where you get the perilously-close-to-general- abstract-nonsense "a transducer is a transformation from one reducing function to another". Here, "a reducing function" is what stands in, in a very oblique way, for the stream - it's ultimately a conduit for values, and transducers take some existing conduit, wrap another layer of processing round it, and give you the resulting conduit. So they're a bit like backward streams, i suppose. If anything, it's like how you go around wrapping up layers of OutputStreams when doing IO:

      new PrintStream(new BufferedOutputStream(new GZIPOutputStream(new CipherOutputStream(new FileOutputStream("file.dat"), cipher))));

Except instead of explicitly constructing wrappers, transducers know how to do the wrapping.

<comment><USER7> I thought that transducers also abstracted away the _difference_ between an input stream and an output stream? (Or the difference between pulling values on demand versus pushing values.)

</comment></comment><comment><USER8> This is a small point, but to the author: in your first part of the article[0], binding the function argument to f in map, and then binding the head of the collection in filter was a bit confusing when scanning through...

<comment><USER9> Happy to review the code, but I'm having trouble understand which snippet you're referring to.

</comment></comment><comment><USER10> This is not related to electrical transducers, which (without any additional scoping context) was what I thought this article was about.

Relabeling it "Clojure transducers" would help the title in every way. But it's been up for 7 hours now, so we'll see if it changes.

<comment><USER2> Transducer is the standard term inside CS for this model of computation [1]. Often there are some disambiguating terms, such as finite-state transducer, but this article does not limit itself to any particular kind. Of course Hacker News has content from both fields so the overloading of the term is unfortunate.

[1] [https://en.m.wikipedia.org/wiki/Finite- state_transducer](https://en.m.wikipedia.org/wiki/Finite-state_transducer)

<comment><USER11> Transducers don't really directly map to any existing CS construct. In fact, Clojure transducers occupy a strange twilight world between "fold endomorphism" and "stream transformer". Most transducers are both. Some are just one or the other.

</comment></comment></comment><comment><USER12> The domain (uswitch.com) along with the word "Transducers" really threw me off. It's about clojure not electricity!

<comment><USER9> Ops, didn't think about that! Added Clojure to the title. Thanks for raising. (author here).

</comment></comment><comment><USER13> Reducing the font size (CMD -, CMD -) helps immensely :)</comment>


Geek To Pro: The Inspiration - <AUTHOR> https://medium.com/unforgettable-moments/23af7d9419a6 Not quite as tech-y, but the inspiration part of why I'm a web developer with plans to try out for the NFL. <comment><USER2> Wow, that's quite the story. I'm glad to see you got through it with your sanity intact.

I also like to hear about the tough times that people have in web development. Too many stories here are along the lines of...

ASK HN: I'm making (insert figure for annual per capita GDP of emerging market household) monthly (if not weekly) - how can I get more free time for my start-up?

First world problems.

Web development isn't terribly hard. It's not easy, but that argument is pointless because the stuff we do in our editor certainly isn't the hardest part. The hard part is dealing with clients and managing the business.

We see so many articles here and in the media pumping people up talking about the lack of developers and how they can basically write their own paychecks. Meanwhile, good developers in the Philippines might make $800 / month. A good developer (but bad business manager) freelancing in the U.S. might not make much more than that (as you

I think web development probably looks much like the rest of the economy. The top 1% are fantastically successful. The top 10% is probably doing pretty well. The last 90% are probably struggling.

About the article. Perhaps you picked the title just to be catchy, but aren't you already a pro? As web developers, are we just geeks? Are our clients picking us up because we are geeks that they have to deal with? Or are we actually pro's who are creating value for them?

<comment><AUTHOR> I definitely picked the term geek on purpose. The term sometimes comes with a stigma outside our own little tech bubble. The stigma seems to put limitations on the perception of what we can do and what we're capable of. To some degree, that's part of what I'm trying to address. You seem to hit that part on the head.

And it's definitely true. Web Development (even if you're considered good) isn't as flashy (I'll use the term loosely) as it sometimes seems from the outside. There are so many ups and downs. What defines us as developers is how we navigate through the downs so we can make it to the next up.

</comment></comment><comment><USER3> No matter whether you end up pro, it sounds like you'll appreciate everything that life has to offer and have a good story for your kids.

That said .7 seconds is a hell of a lot of time to shave off your 40 yard dash, especially if you're starting out in relatively decent shape. But I suppose the only way to know is to go for it, good luck!

<comment><AUTHOR> Absolutely. It has already been a great story to tell them, just trying to keep making it better.

And I agree, .7 seconds would be a feat by itself. Right now my best hope is to work on my flexibility and work hard at those drills. My flexibility is poor right now and definitely contributing to my slower time. When running I couldn't help but feel like I just wasn't able to move my legs as fast as they should. It was compounded by the fact that after 5 or so in a row I wasn't winded at all, which meant that my conditioning wasn't the problem.

But I'll go for it and hopefully this next 40 time is in the 4's.

</comment></comment><comment><AUTHOR> For reference on how this is tech related, read the first post.</comment>


US proposes tighter export rules for computer security tools - <AUTHOR> http://www.pcworld.com/article/2925372/us-proposes-tighter-export-rules-for-computer-security-tools.html

<comment><AUTHOR> Here's the actual document [https://www.federalregister.gov/articles/2015/05/20/2015-116...](https://www.federalregister.gov/articles/2015/05/20/2015-11642/wassenaar- arrangement-2013-plenary-agreements-implementation-intrusion-and-surveillance- items)</comment>


Linux VFAT patent patch Q&A - <AUTHOR> http://article.gmane.org/gmane.linux.file-systems/33530

<comment><AUTHOR> The patch in question is available at <http://article.gmane.org/gmane.linux.file-systems/33529></comment>