Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear - <AUTHOR> https://www.wired.com/2017/04/hackers-emptying-atms-drill-15-worth-gear/ <comment><USER2> My first job was being a field technician for a bank automation supplier.

We had a "test" card that could be insert on the eprom socket. This small card was almost the same size of the original chip but had a few buttons that allowed us to make the mechanism deliver notes in order to fine tune it.

In a particular ATM design used by major banks in Brazil, this location were accessible by removing a front panel, although you would have to be kind of a contortionist in order to plug it.

Why we can find whole ATMs at junkyards is beyond me: there are many easy to spot flaws. They should grind everything when decommissioning this kind of equipment.

<comment><USER3> > Why we can find whole ATMs at junkyards is beyond me: there are many easy to > spot flaws.

If there are many easy to spot flaws, I don't think finding them in a junkyard is the root of the problem here. This is good old security by obscurity.

As Bruce Schneier says (at least about safes), you should be able to publish the blueprints and source code for the machines, then maybe they'll be secure. There should be enough physical security to ensure an attack will take longer to perform than the response time of the authorities. Any components which are vulnerable to physical attack need the same level of physical protection as the cash that's being protected.

Until this happens, 'hackers' (thieves) are going to keep finding flaws and exploiting them.

<comment><USER4> It's a false dichotomy. Your private keys are just "obscure" information that requires some effort to find too. And security protocols can be designed so the keys aren't enough.

At the end of the day it's an arms race, and you're just trying to slow attackers down.

<comment><USER5> Well, they're provably secure for some (mind-bogingly massive) search space.

Security by obscurity tends to refer to measures which can be broken once, and thereafter opened trivially. It sounds like the article is about one of these trivial openings.

Everything can be broken; the goal is to move it or arrest them before they can get in, physically or virtually. It just so happens that, virtually, the time required to brute force it can, at times, be on heat-death-of-the- universe scales. Safes tend to rely on men with guns following soon after alarms trigger.

<comment><USER6> Obtaining most keys doesn't require mind-bogglingly massive searches.

<comment><USER5> Well, it might not. Can you clue me in to the specific scenario you're thinking about?

Input rate limiting + known key size should provide a concrete search space.

<comment><USER6> Physically obtaining them through malware, viruses, bugs, backdoors, social engineering, coercion(physical threats, blackmail, application of force), tapping, physical spying, etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > They found that the machine's only encryption was a weak XOR cipher they > were able to easily break, and that there was no real authentication between > the machine's modules.

This reminds me of many many years ago some guy in a bimmer forum figured out BMW's iDriver music file formats (BR3/BR4/BR5) were simply DRM'd via XOR.[1] I was able to verify it via a simple script. Kudos to the reverse engineering masters!

[1]: [http://www.e90post.com/forums/showthread.php?t=279294#5](http://www.e90post.com/forums/showthread.php?t=279294#5)

<comment><USER8> I found it curious that the very person who mentioned it being XOR had only one single post in that forum.

<comment><USER7> That info was originated from a German bimmer forum, it seems.

</comment></comment></comment><comment><USER9> I'm not terribly shocked.

Most communication happens either at serial, SPI, or i2c busses. If it's cars, CAN.

And if you can plug in a wire somewhere, you can damage or pwn it. Most things don't have security, other than software security and physical locks. And even when there is other types of security, like cryptokeys and such, physical wires can usually bypass even those.

If they wanted something that was secure, they could do that glass mesh thing the ORWL does, and have some sort of black dyepack on the money that explodes everywhere. Go for "we ruin so you cant have". But then again, I could see criminals pissed off and taking a hammer primarily to ruin their money, and cause customer consternation.

<comment><USER10> I could see a more effective solution being embedded chassis intrusion meshes.

Disrupt the meshes in any way (EG drilling) would result in three actions.

      1) Electronic erase MOST programmable memory in the machine. (Brick it)
      2) Engage something akin to an EMO (Emergency Machine Off)
      3) If an uplink of some sort exists, broadcast repeatedly on it that such an event occurred and the current uptime.

<comment><USER11> I mean, there's chips that have that in their top metal layers, and there's still crazy people out there with electron microscopes and tiny pins that subvert them.

[https://web-beta.archive.org/web/20111124050620/http://www.f...](https://web- beta.archive.org/web/20111124050620/http://www.flylogic.net/blog/?p=86)

I wouldn't be surprised if increased physical security on ATMS isn't worth the practical difference in losses.

<comment><USER10> Sure, someone COULD do that, but how long and how fiddly is that process? How big of a risk is there to disrupting internal components.

What if you sandwich the sensitive layer as a thin mesh encased in weak resin between two metal plates?

The point of security isn't absolute, but to ruin the risk + effort vs reward balance.

</comment></comment></comment></comment><comment><USER12> >Computer security experts have long warned that no computer should be considered secure if an attacker takes physical control of it.

I think the lack of physical security is more surprising than the lack of electronic security. A three-inch hole is pretty big, all things considered. I have to imagine that ATMs are designed to resist drilling three inch holes through to the money or the dispenser mechanism. Why isn't the computer protected to similar degree?

<comment><USER13> >Why isn't the computer protected to similar degree?

It was cheaper not to.

<comment><USER2> I can confirm this. I used to work for a major ATM supplier and this was the answer I got every time I asked bank personal about the lack of physical security. They would compute the average loss from burglarized ATMs against the cost to install and maintain better alarm systems and decide against it.

</comment></comment></comment><comment><USER14> I am currently designing food machines, which have security concerns equal to financial machines in some senses (you don't want people to get poisoned through environmental contaminants, malicious reprogramming, etc.).

The article claims there is essentially no authentication between disparate modules, only simple XOR encryption. That seems a clear fail.

In my experience, ATM control boards (I was literally at a factory in China for these a few weeks ago) tend to be custom PCBs but there is a move towards genericization. Presumably because their designs tend to date from bygone eras, they do not use software-based approaches in favor of hardware and security through obscurity. Perhaps it is time for a software-oriented modular ATM redesign project with an emphasis on modern internal security? Anyone want to collaborate? Serious question. (I have an existing ATM component factory group potentially on side already.)

Second, to 'notice' the independent activity of any given module, power draw should be easy to detect. Again, the lack of such a feature probably harks back to a bygone-era hardware-oriented design psychology.

<comment><USER15> Where do you draw the line between poisoning people, and vending them unhealthy fatty sugary junk food?

<comment><USER14> Everything we sell will be made to order from fresh ingredients. Sugar is only traditionally used in a few noodle cuisines (eg. Thai) and customers can opt out of any ingredient they wish. Likewise significant lipids are really only present in meats, oils, cheeses and coconut milk. Again, Thai is a strong contender. Calorie counting is transparently supported for those who want to do the numbers. Launching in Asia, for Asia, nothing we sell will likely come close in calories to an average US serving of anything.

</comment></comment></comment><comment><USER16> Ah brings backs sweet memories to Terminator, for real now! IIRC in the movie Connor used some portable Atari with a cable attached to a creditcard to hack an ATM to spit out money.

</comment><comment><USER17> How much cash is in a fully stocked ATM? 10k, 25k, 50k, 100K?

<comment><USER18> From a 2013 reddit AMA: "Each ATM is different. We do 12,500, but have ones with metal cases that reach 26k."

From a 2010 time article: "The average size machine can hold as much as $200,000, though few do. In off hours, most machines contain less than $10,000."

In the article they cite a Philadelphia theft case where a single stolen machine held $96,000.

</comment></comment><comment><USER19> The Firefighters' Guild has been formed and dissolved repeatedly throughout the history of Ankh-Morpork. Usually formed in response to fires which cause significant damage to large parts of the city, the guild is usually dissolved in response to... er, fires which cause significant damage to large parts of the city. The Guild suffers from the undying capitalist spirit of Ankh- Morpork, as those men who are paid per-fire extinguished eventually begin to guarantee a regular supply of fires to be put out (see also Inn-Sewer-Ants). This has led to the frequent destruction of large portions of the city and ultimately to the Guild's being banned.

Seems we need lots of new ATMs, lots of them. And then prayer, for the fire- fighter-guild to not run out of money.

</comment><comment><USER20> I see these kind of stories floating around from time to time, I wonder how much money is lifted each year from banks this way. It seems to not be significant enough for banks to be proactive about the issue.

</comment><comment><USER15> Is there a tutorial on Instructables or YouTube about how to do this?

</comment><comment><USER21> Not as elegant as Barnaby Jack, but just as effective.

</comment><comment><USER22> Seems like an implementation of that XKCD comic on encryption security: [https://xkcd.com/538/](https://xkcd.com/538/)

</comment><comment><USER23> To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.

<comment><USER24> Hard to tell what's actually inside them, but these sorts of ATMs don't look very intimidating:

[http://www.edmontonatm.com/images/rl1600.jpg](http://www.edmontonatm.com/images/rl1600.jpg)

<comment><USER25> I own one of these. It's inside a building that would be closed when no staff were around, and it doesn't ever contain enough money to be worth it to most people.

I wouldn't leave that thing at an outside location with enough money in it to hurt me, unless the robberies were insured or so seldom as to be considered a cost of doing business.</comment></comment></comment>


URGENT: Congress Wants To Make Streaming A Felony | Demand Progress - <AUTHOR> http://act.demandprogress.org/sign/ten_strikes <comment><USER2> Already discussed multiple times here, except with links to reputable sites and without the ridiculous hysteria:

<http://news.ycombinator.com/item?id=2665672>

<http://news.ycombinator.com/item?id=2553927></comment>


The CEO Lifecycle - <AUTHOR> https://hbr.org/2019/11/the-ceo-100-2019-edition#the-ceo-life-cycle <comment><USER2> I can't help but wonder if the "Golden Years" is just selection bias. CEOs who are under-performing years 6-10 will get fired or step down, and only the really good ones will make it to 11+ years.

<comment><AUTHOR> They address this in the article.

> Their performance is explained in part by our sample. Most CEOs have dropped > out of the race by this stage, whether for performance, health, or personal > reasons, so it's the strongest leaders who stay longer than a decade. > Indeed, when we have shared our data, some observers have questioned whether > the outperformance of the golden years is due solely to this survival > bias—the fact that weaker leaders were weeded out earlier. But our research > shows other factors at play. When we investigated attrition rates in our > data, we saw CEOs leaving the job in consistent numbers year in and year > out. If attrition alone explained the ups and downs, we would see > corresponding movements in attrition and performance. Additionally, those > CEOs who lasted into a second decade show a similar pattern of highs and > lows over their tenure. Their survival wasn't simply a function of their > performance; the credibility and trust they built with the board and > investors helped them stay the course in challenging years.

</comment></comment><comment><USER3> What happens after 15 years?</comment>


ASP.NET MVC, Web API, Razor and Open Source - <AUTHOR> http://weblogs.asp.net/scottgu/archive/2012/03/27/asp-net-mvc-web-api-razor-and-open-source.aspx <comment><USER2> I am a developer who has leaned towards .NET over the last few projects and one of the things that used to nag me is that the platform is a closed one (and the licensing fees can be a decent part of the cost). I was fairly certain I would migrate off it if the project ever took off seriously.

And after seeing the C# love on HN on the poll for favorite programming languages last week, I realized there must be many enamored .NET programmers who would use and evangelize it more but only don't due to it being a closed platform.

Also, a lot of us have great ideas to make the platform we're using better - and with Microsoft announcing they'd make Json.NET, a third party JSON library, the default JSON serializer over their home-grown DataContractJsonSerializer in the next version of ASP.NET MVC, I wondered if Microsoft was considering the unthinkable: start accepting community developed features into their platform, and perhaps open source it to make the scope for community contributions even larger.

There's a long way to go to fully realize this vision (I'd like for .NET itelf to be open source ;-] ), but this is just incredible news.

For those who want to understand which parts of the ASP.NET stack are open source, check out this diagram on Hanselman's blog that was very useful to me.

[http://www.hanselman.com/blog/VisualStudio11BetaInContext.as...](http://www.hanselman.com/blog/VisualStudio11BetaInContext.aspx)

<comment><USER3> > Microsoft announcing they'd make JSON.NET, a third party JSON library, the > default JSON serializer over their home-grown DataContractJsonSerializer in > the next version of ASP.NET MVC

Finally! For those who haven't used it, DataContractJsonSerializer has the most absurd way of serialising dictionaries into JSON. Rather than producing {"k1": "v1", "k2": "v2"} it produces [{"Key": "k1", "Value": "v1"}, {"Key":"k2", "Value": "v2"}]

<comment><USER4> > DataContractJsonSerializer has the most absurd way of serialising > dictionaries into JSON.

DataContractJsonSerializer is a hack that is built on top of an XML parser.

For the people who are unfamiliar with .NET there is a comparison of Json.NET to Microsoft's two JSON serializers here:

<http://json.codeplex.com/> <\- Json.NET homepage

</comment></comment></comment><comment><USER5> Also worthy to note that Microsoft's BizSpark program provides free production access to Microsoft tools and products-- not Express editions but versions like Visual Studio Ultimate, SQL Server Enterprise, Windows Server Enterprise, etc. You also get a couple thousand free hours on Azure if you want to go that route. For training you also get three months of Pluralsight which brings you up to speed on the relevant tools and platforms.

I feel it's a really good time to be a Microsoft developer. The products are really solid, the skills are in demand and the barrier to entry is pretty much gone.

I realize after writing the above I come off as a big time evangelist, but this is only because I have had such a good experience for the last decade building on their platforms. Never regretted going all in other than sometime feeling like a black sheep on this site. Good to know there are a lot of other .Net folk on this site. ;)

<comment><USER6> Wait until the bill comes.

<comment><USER7> After three years, you get to keep some production licenses as well as all the software you downloaded for free. You get four Windows Servers and two SQL Servers. This really is a great program. You can read more here: <https://www.microsoft.com/bizspark/About/Graduation.aspx>

<comment><USER8> Yeah, there's a common misconception that there's a big bill coming at the end. There isn't - you get to keep the software you used during the 3 years for no charge and you get discounts if you need to buy more.

<comment><USER6> Uh, there _is_ a big bill coming at the end. You need to keep your system running, even though you now have to pay for licenses, don't you?

When building your system during BizSpark, you are unlikely to make architectural choices with respect to software licenses, because they are free. Then you graduate, and you're probably looking at a system that uses way more licenses than it would have if you had to optimize around that parameter from the get go.

BizSpark is an excellent move by Microsoft, and likely is helpful for folks starting out who already know the .NET stack. But I'm very skeptical that working in the Microsoft stack offers such a technical advantage that it is worth the risk that your business is not going to be in a position to suddenly have its operational costs bloated by software licenses by some arbitrary date determined by Microsoft.

<comment><USER8> Yes and no. The point is that you're not retroactively billed for licenses you got while in the program. Believe it or not, a lot of people seem to think that it's just a delayed payment program. Yes, if you're designing a system that's going to require more than 6 servers you might end up paying for a license. Windows Web Server runs ~$470. But for many businesses, if you're using >6 servers you're likely going to be deploying to some cloud hosting solution, or possibly using a shared hosting service (which would include licenses).

It's a tired example, but StackOverflow really is an example of a startup that got a lot done with very few devs or servers and launched a very successful business. Also key is that you can mix and match technologies as you want, something that the StackOverflow used very intelligently (e.g. Microsoft server fronted by non-Microsoft reverse proxy, etc.).

<comment><USER9> Not to mention, most startups either fail in 3 years or (hopefully) be in a position to pay for the extra servers.

<comment><USER10> It would be interesting to measure if the odds of failure somehow correlate with chosen technology stack.

<comment><USER9> Considering that most startups fail for reasons other than technical (running out of money, lack of traction, founders moving on) I don't think any correlation will be that meaningful. It will be interesting see a plot of the type of the startup (social, b2b, retail etc) versus the stack though :)

<comment><USER10> I am not so sure technology stack is entirely unrelated to failure rate. The stack you pick may influence iteration speed, hosting options, developer availability, uptime, reliability, security and costs.

Twitter would have failed had their scalability problems persisted.

In fact, I remember "Six Degrees". It was more or less Facebook, but in the late 90's. IIRC, they ran Cold Fusion on Windows.

<comment><USER11> Some say that Friendster failed mainly due to scaling issues. [http://highscalability.com/blog/2007/11/13/friendster- lost-l...](http://highscalability.com/blog/2007/11/13/friendster-lost-lead- because-of-a-failure-to-scale.html)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> > start accepting community developed features into their platform

Guthrie has done a great job of making developers on the Windows platform feel included and involved. While Microsoft's product offerings slip, Guthrie continues to grow the community of developers, maybe not in quantity but most certainly in quality. Before Guthrie, an offering like today's announcement never would have seen the light of day.

<comment><USER13> I'm not too familiar with what Guthrie has done for the .NET community, but Hanselman is a famous proponent of open source and making .NET as fun to code in as ruby and python. His coming to MS has changed the way I look at the .NET stack.

<comment><USER14> And let's not forget Phil Haack (<http://haacked.com>), who is now working at GitHub. He used to be the program manager at Microsoft for ASP.NET MVC, the first part of the ASP.NET framework to be released under an open source license.

</comment></comment></comment><comment><USER15> I'm a long time Java developer who recently move to .NET. What I love about Java when it comes to this particular issue: open source, is how easy it is to get the source code, documentation, and to navigate around given 2 assumptions:

1) You're using Maven + Eclipse (haven't tried in other IDE)

2) The source code is available (in most cases, they are) in Maven repository

Here's a simple example: I'm using Spring and Guava and occasionally I'd like to navigate to the method I use. All I have to do is hit F3 on the method call and Maven will download the source code JAR (and the documentation JAR as well) and voila: I can easily see the source code and navigate around. Ditto with the dependency of the dependency.

I have to say that Maven + Eclipse provide massive productivity increase for me and my team.

Now, I did .NET in the past briefly back when .NET was in 2.0/3.0 era. I recalled it wasn't obvious how to associate even the core .NET library (Collections, etc) via VS.NET.

How easy it is to achieve a similar workflow in .NET these days?

<comment><USER16> Resharper can do the same: <http://www.jetbrains.com/resharper/>

<comment><USER15> ReSharper can download source code over the internet or do I have to setup things manually? put them in the right place, etc?

<comment><USER17> Its automatic. If it can't get the source, it will use its built in decompiler, and produce surprisingly readable source anyway (I force it to this mode by default, due to a flaky internet connection).

<comment><USER15> How does ReSharper managed to locate the 3rd-party source code?

Does ReSharper have their own source repository or some sort?

<comment><USER18> As the parent listed, Resharper by default will download MS sources for BCL. For a third party, it will show the decompiled source.

</comment></comment></comment></comment></comment></comment><comment><USER19> I would consider paying for .net if it received first class treatment on Linux. As someone who has lived through the pain of hosting apps on Windows, I just refuse to do it in the future. I'd love to see Microsoft bring Mono into the fold and truly bring it to the level of the Windows .net implementation.

<comment><USER20> What part of hosting apps on Windows was painful to you? I actually prefer to host my apps in Windows when I'm able and the technology stack supports it. I don't need to set up new apps often, but when I do, it's many orders of magnitude faster for me to get an app running on Windows vs. Linux.

Linux works great as a server OS once I get everything set up and configured correctly. I never need to think about it again. However, I _dread_ having to set things up on a new Linux machine. There's always some hardware that doesn't install correctly or some config file that needs twiddling. Sometimes it takes an odd sequence of commands that needs to be run in just the right order to get things going. Invariably I waste hours on the internet searching forums every time I do this, getting more and more frustrated the whole time.

As far as Windows hosting goes, I find IIS 7 to be much easier to set up and customize than Apache in terms of hosting web applications. I find the uptime of Windows Server boxes to be functionally equivalent to their Linux counterparts. I also find it's much easier to administrate large groups of Windows servers because of the nice tooling. Things like Active Directory, SMS and SCOM make things pretty easy.

<comment><USER19> I currently run a company (on the IT side) with 100+ servers...a healthy mix of both Windows and Linux. To write-up the benefits I see of Linux over Windows would take a fairly long blog post...perhaps I'll do that soon. However, I will say that the last time I had a Linux hardware problem which wasn't related to a display driver issue (and in other words, not on the server) was in 2006. Our Linux servers are reliable, easily configured (admittedly....we know what we're doing) and have very high up times. Contrast that with our Windows servers which at this point we've had to resort to weekly reboot Windows to keep them performing.

Personally, I also find it much easier to find help online with Linux when things _do_ go wrong...and that Microsoft (wisely) makes the whole experience very painful unless you're willing to pony up for their more expensive "tiers" of software. As an example, even though DFS-R is included in Windows Server, try managing a real, live deployment given what you're provided with just Server. Unless you purchase SCOM, your _will_ fail.

<comment><USER19> That said, Microsoft got one thing very right: active directory. If someone were to develop a similar solution which could manage both platforms, I'd buy it tomorrow.

<comment><USER15> Identity Management and SSO are two area that once one can install them successfully, that's pretty much mark the point of no return :D.

Consultants love these kind of projects!

</comment></comment></comment></comment></comment><comment><USER21> What will be interesting to see is how well Microsoft acts as a steward of the project. I can't count how many bugs I've seen on Microsoft Connect sit untouched for years.

Assuming they're not being fixed due to lack of _development_ resources, perhaps this will help. If it's any other reason, including test resources, management resources, or overall project priorities - a move like this is unlikely to be significant.

If we're just trading a list of ignored bug reports for a list of ignored pull requests, it'd be difficult to muster much excitement.

</comment><comment><USER22> This is really great news. Open sourcing Razor means that it can be shipped with Mono, so the awkward getting-razor-working-with-mono rituals won't be necessary in the future.

<comment><USER2> Indeed - in fact they reached out to Miguel to submit a pull request. :-]

[http://www.hanselman.com/blog/ASPNETMVC4ASPNETWebAPIAndASPNE...](http://www.hanselman.com/blog/ASPNETMVC4ASPNETWebAPIAndASPNETWebPagesV2RazorNowAllOpenSourceWithContributions.aspx)

</comment></comment><comment><USER23> I wish they'd open-source WPF, so at least if they won't fix the performance issues with it I could fix them myself (or at least coerce someone with enough skill to fix them for me).

</comment><comment><USER24> I had a hell of a time trying to actually use the ASP.Net MVC sourcecode on a project a while ago. The problem was that while my own project compiled fine, many of the dependencies I was using were built against a signed version of the ASP.NET MVC DLL. Since the version of the DLL I was using wasn't signed (with Microsoft's key), those dependencies wouldn't work against the version I was compiling. If you compile everything from source, this isn't a problem, but I had a number of dependencies that had been distributed as DLLs, and for reasons now obscure to me (but likely due to time pressures), I wasn't able to replace all those dependencies with source.

I guess the moral of the story is that if you're in .Net land and want to take advantage of this, make sure you do everything with source from the get-go.

</comment><comment><USER25> I've been strictly in management for a few years now, but I like to lead from the front, i.e. know the technology. It would be painful to trade in C# for Java and VS for Eclipse. Today I took a quick look at Scala and Clojure. I think F# for either of those is also not a good trade. There are a lot of things MS does right. The more MS opens up their technology, the better.

<comment><USER15> That is strange. I'm the other way around: it is painful for me and my team to switch Java/Eclipse/Maven to C#/VS.NET/NuGET since NuGET isn't even close to Maven.

Not to mention we have to deal with licensing, buying software tools, etc while in Java land almost all the high quality tools are free, easy to download, easy to install.

Setting up a new machine is a breeze with SVN/GIT + Maven. A breeze.

<comment><USER26> NuGet vs Maven seems like a small issue when compared to VS vs Eclipse or even C# vs Java. In the latter two, MS wins hands down. I can cope with NuGet.

<comment><USER15> With Eclipse, 99% I don't need a mouse to refactor, navigate, build, run unit- tests within Eclipse or outside, and packaged a rather large codebase and its dependencies (3rd-parties or not) and Maven contributes to that significant productivity gain as well.

Eclipse recently also introduced an App-Store clone to download plugins and so far I haven't had the need to hunt down plugins from the world wide web (except for the exotic ones).

Granted I'm new with VS.NET, I'm guessing that will not be the case. Somehow I'm probably still a long way to learn how to utilize VS.NET to the same level of productivity with Eclipse... and even longer time requires to surpass it...

<comment><USER27> If your entire complaint is that you want short-cut keys then look into the Tools | Options | Keyboard configuration. I find raw VS.NET pretty lame in terms of Intellisense, no "jump to file" shortcut, etc. so installing Resharper is a necessity for productivity. But at that point everything is indeed keyboard driven.

<comment><USER28> VS2010 has "Navigate to" on ctrl-, which is better than jump to file. It's jump to anything, type a class name, a method, a filename, a partial filename, partial anything, and it will match what you write against everything in your solution. It's really powerful and I don't click around in the source tree at all anymore.

<comment><USER27> While a vast improvement on the past, "Navigate to" doesn't find stuff intelligently like Resharper's jump... e.g. if I have a file "LabListView", I can type "llv" in the "go to" window and it'll be highlighted (I could type any combination of characters but I tend to use the capitalised letters). VS2010 just shows an empty list when I do that -- I have to type a complete partial name.

I could also be imagining this, but I have the feeling Resharper remembers which files are related when I select them from this list because if there's more than 1 match it almost always seems to have the right one at the top of the list based on my current context.

<comment><USER15> FYI, Eclipse also does partial the way Resharper does out-of-the-box: semi- partial and abbreviation.

I believe Eclipse also does "best match based on previously opened files" (sort of heuristic/guessing) just like you guessed the way Resharper does it.

I wouldn't be surprised if Resharper added Eclipse's features that are missing from VS.NET being that JetBrain makes IntelliJ that competes with Eclipse.

Of course the best part of Eclipse is that it's free and you get everything :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Looking for some HN insight here. I'm still a college student interested in startups. However, microsoft products really don't excite me. Can someone explain the benefits of C# to a Ruby on Rails coder?

<comment><USER30> Good parts: C#, and the entire .NET stack, completely skewers Ruby from a performance perspective, while not putting your coding in a straight jacket like Java does. You'll also find what in my opinion are vastly more powerful debugging and profiling tools, awesome threading support (be sure to check out both C# 4.5's async/await keywords and the existing Rx library at <http://msdn.microsoft.com/en-us/data/gg577609>), better versioning, better IDEs if you're into that kind of thing, and more.

Downsides: While this is gradually changing, I don't consider _server-side Mono_ production-ready, so you'll be both developing and deploying on Windows. Deploying on Windows may prove expensive, but BizSpark (<http://www.crunchbase.com/product/bizspark>) will let you avoid that _well_ past the point where you should either be successful or have VC, making it a non-issue. The community isn't as library-happy as the Ruby community, although that's definitely changing; one side-effect of that is that, where Microsoft anticipated your needs, life is beautiful, but where they haven't, things can get painful.

I'd see my previous answer to this question at <http://news.ycombinator.com/item?id=3405362> too.

<comment><USER31> > better IDEs if you're into that kind of thing, and more.

With the caveat being you have to be into that kind of thing. Coding C# not-in VS (or MonoDevelop) is not fun.

<comment><USER30> It depends, actually. For stuff I write in my spare time, it's actually perfectly easy to write C# in Emacs and drive the compile with a short waf script instead of a solution. You'll pick up at least some csproj files if you grab packages from NuGet, but it's not horrible to manipulate them in nxml- mode, and again, it's easy to keep all of your own stuff in simple waf files.

The downside of going this route, of course, is that using VS.NET or MonoDevelop can be a bit of a pain. When working on Kiln, I instead do most of the actual _editing_ in Emacs, and use VS.NET as a solution manager/debugger/decompiler. Not ideal, but functional. You'd also have to go that route if you wanted to use Azure, I believe, since I seem to recall they want the solution file, not the assemblies.

</comment></comment></comment></comment><comment><USER32> I can't believe all the .net love lately.

</comment><comment><USER33> I've not written code on windows for years now, but today for started off with a .NET project - for an course assignment (.NET mandatory). I wasn't that bad - looks things can be completed fast enough here, however kept feeling itchy all the time that finally saying yes to closed source platform ... Came back home and now its open source. Thank you!

</comment><comment><USER34> I wonder if Phil Haack's exodus was the straw that broke the camels back? Perhaps this was just the leverage Scott Guthurie required to finally get what that team has craved for some time?

</comment><comment><USER35> It's good to see that it's been released under the Apache License: <http://aspnetwebstack.codeplex.com/license>

<comment><USER36> Also they're using Git, which is HN approved :)

</comment></comment><comment><USER37> this is awesome news for the .Net community.

</comment><comment><USER38> This is a good sign of things to come. Changes at Microsoft?

</comment><comment><USER39> Meh.

</comment><comment><USER40> Way too many Microsoft haters. BE OPEN MINDED. C# is a tool, like computer, as long as used to solve real world problems, who cares who's behind it? It's like how Apple fanboys are saying Object-C is the most awesome programming language in the world, totally biased.

<comment><USER40> Down voted as expected. Hater, identify yourself or be a coward.

</comment></comment><comment><USER40> > I am a developer who has leaned towards .NET over the last few projects and > one of the things that used to nag me is that the platform is a closed one > (and the licensing fees can be a decent part of the cost). I was fairly > certain I would migrate off it if the project ever took off seriously.

Can you explain why? Is it because the only reason it's closed? You just hate MS.

<comment><USER40> So all people who use Oracle database would also abandon Oracle since it's close source?</comment></comment>


Edgar D. Mitchell, Sixth Moonwalking Astronaut, Dies at 85 - <AUTHOR> http://www.nytimes.com/2016/02/06/science/space/edgar-d-mitchell-sixth-moonwalking-astronaut-dies-at-85.html <comment><USER2> _"...He became fascinated by flight when he watched crop duster pilots flying biplanes from an airfield near his home."_

Biplanes -> Looking at Earth from Moon in 40 years. This was my parents generation. I read Andrew Smith's _Moondust_ and remembered how important the Apollo imagery on TV was to me as a child.

[http://www.theguardian.com/books/2005/apr/24/biography.featu...](http://www.theguardian.com/books/2005/apr/24/biography.features)

<comment><USER3> Nixie tube calculators and punched cards -> Macbook Pro with Retina display. Encyclopedia Britannica taking up two meters of shelf space (and often requiring a trip to the library) -> Wikipedia over a 4G network. That's my generation :-)

<comment><USER4> I completely understand the desire to want to see physical changes in the real world, but the last 40 years have been extremely important in terms of building out learning infrastructure.

I'm very confident that the next 40 years are going to be nothing short of breathtaking in terms of the acceleration of innovation.

<comment><USER2> Hoping to see first half or perhaps a bit more of that (I'm pushing 60)

In my case: line noise on teletype -> tablets

</comment></comment></comment></comment><comment><USER5> "You develop an instant global consciousness, a people orientation, an intense dissatisfaction with the state of the world, and a compulsion to do something about it. From out there on the moon, international politics look so petty. You want to grab a politician by the scruff of the neck and drag him a quarter of a million miles out and say, "Look at that, you son of a bitch.""

[http://lazenby.tumblr.com/post/30206152130/well-right- natura...](http://lazenby.tumblr.com/post/30206152130/well-right-naturally- you-should-hate)

</comment><comment><USER6> Sadly none of these guys are getting any younger. The youngest person from the Apollo missions is now 80 years old. Humanity really needs to get a move on if we're to avoid the scenario where there is nobody left alive who has walked on the moon.

<comment><USER7> Why do you need to have humans alive who walked on the moon? It was an interesting experiment at some point, but there's not much to gain to do it over and over again, unless you plan to have a permanent human presence there.

<comment><USER8> The current astronauts generate significant interest in STEM in school children. For example, Tim Peake took a bag of seeds to space. When he gets down they're going to send the seeds to schools along with some seeds that didn't go to space. Children are going to run experiments growing and comparing both sets of seeds.

Reaction from children is along the lines of "this is so cool; I want to work in space stuff".

<comment><USER6> I agree, I think the ISS is an utterly amazing achievement. In so many ways I think it really is a prime candidate for humanities greatest achievement so far.

In many ways you make a very valid point, the ISS is what we've been up to for the last few decades rather than going back to the moon and the research coming from it will be essential in preparing for longer journeys. But for all that I stare up and marvel at it passing overhead some nights, it just doesn't hold the same mystique of say the moon or further afield.

<comment><USER9> Yes, and ISS like other 2 incredible achievements (Human Genome Project and CERN particle accelerators) are international collaborations.

Even GNU is something inherently supranational.

This should teach us something, I think.

</comment></comment></comment></comment></comment><comment><USER10> _" NASA had hoped that they could climb to the rim of the nearly 400-foot-high Cone crater and collect especially significant rock samples there. But in lugging the cart the astronauts found the climb to be difficult and experienced rapid heartbeats. Mission control, concerned about exhaustion and wary of time constraints, ordered them to turn back. Unbeknown to the men at the time, they were only about 20 yards from their goal."_

Missed opportunity. Next landing, Apollo 15 was designated a _" J"_ mission with the LRV to explore the highlands. ~ [http://www.nasa.gov/mission_pages/apollo/missions/apollo15.h...](http://www.nasa.gov/mission_pages/apollo/missions/apollo15.html) These fellas are getting on. Saw Harrison (Jack) Schmitt in '04, Charlie Duke was in the country last year. RIP Spaceman.

</comment><comment><USER11> It's a bit sad to think that the Apollo program might end up being something of a modern-day Roanoke Colony. I really hope that we manage to get back to the moon before the last of the original moon walkers leaves us.

</comment><comment><USER12> Mitchell was last man standing from Apollo 14, the first entire moon crew we have lost.

</comment><comment><USER13> > Mr. Mitchell created a stir in 2008 when he told a British radio station > that his contacts in military and intelligence circles had told him that > "we've been visited on this planet, and the U.F.O. phenomena is real," but > that governments had "covered up" the matter for at least 60 years.

Ingo Swann tells a fascinating story about the moon in his book [http://www.amazon.com/Penetration-Question- Extraterrestrial-...](http://www.amazon.com/Penetration-Question- Extraterrestrial-Human-Telepathy-ebook/dp/B00OQT960G/)

<comment><USER14> "This small book is divided into three parts. And it is with regard to the first part that I join a very long list of those who have seen and experienced things they cannot prove happened."

I went to Mr. Swann's Las Vegas talks in 2004 and 2006. He told me personally that he should have written more fiction, which paid better than working in the lab, but their first big grant came along at the same time...

</comment></comment><comment><USER15> Aww, I remember him from watching the excellent documentary "In the shadow of the moon" ([http://www.imdb.com/title/tt0925248/](http://www.imdb.com/title/tt0925248/)). Highly recommended, seems like astronauts age really well. They all looked like a spry bunch

</comment><comment><USER16> Edgar Mitchell and the Big Picture Effect: [https://www.youtube.com/watch?v=KE- PUTVULFg](https://www.youtube.com/watch?v=KE-PUTVULFg)

</comment><comment><USER17> I may be the last HN commenter to see Ed Mitchell. I had lunch with him at the Beach Club a few months ago, before he got sick(er). He was very close with a member of my family; she is very broken up right now.

He was a very interesting and intelligent guy. I'm not really sure what more to say.

</comment><comment><USER18> Was it really happen, moonwalk NAH

</comment><comment><USER19> Godspeed.

</comment><comment><USER20> Relevant XKCD: [https://xkcd.com/893/](https://xkcd.com/893/)</comment>


Cupidtino - Apple inspired Dating site - <AUTHOR> http://cupidtino.com/home <comment><AUTHOR> Apple device is must have for sign-up/login.

<comment><USER2> I'm sure that can easily be faked. But who'd want to? The entire idea of Cupidtino is, quite frankly, inane! OMFG just imagine Apple fanbois and fangals mating and producing hordes of little Apple fanbabes.... ugh! Better not imagine that, I feel sick now!</comment></comment>


Sild is a Lisp dialect - <AUTHOR> http://blog.jfo.click/sild-is-a-lisp-dialect/ <comment><USER2> I'm pretty familiar with various approaches to implementing Lisp / Scheme, and seeing projects like this is almost heartbreaking. What's been done here (which I might call the "mechanical" approach to implementing Scheme) seems to attempt to emulate an underlying LISP machine instead of emulating the language itself, and that's fundamentally problematic because, for the most part, that's the wrong abstract machine. If the author took the time to work through the first four or five chapters of SICP, they'd have the knowledge to construct a _much_ cleaner machine (based on CEK) that would, ultimately, end up far more performant and faithful to the end-goal semantics. All of this mucking about with allocation and free-cells for expressions and the like is orthogonal to building a LISP interpreter in C. (And, if the author is really interested in that sort of thing, the LISP machine is well-documented.)

If anyone else is interested in starting a project like this, getting down and dirty, I'd urge you to start with the first part of SICP and then move into Dybvig's dissertation (at [http://agl.cs.unm.edu/~williams/cs491/three- imp.pdf](http://agl.cs.unm.edu/~williams/cs491/three-imp.pdf)), which directly and plainly describes multiple approaches to producing efficient, reliable Scheme implementations.

(Also, why doesn't this link to the Github page instead of the blog?)

<comment><USER3> I hear you on prior art. But for who does your heart break? What is here that you'd like to discourage?

Those interested in getting down and dirty are highly unlikely to suspend that impulse for MIT's old intro text and a dissertation from 1987. The author apparently rewrote this three times; so says README. Nothing lofty or pristine, precious as it may be, slots in for that experience.

A state of the art impl it isn't, but we all know where to find those. But I suspect the state of the author's art has improved markedly by the exercise. Maybe if we encourage him, he'll rewrite a few more times, and come up with something wonderful and strange. Maybe it will be a Scheme. Maybe it won't.

<comment><USER4> Code is _like_ clay, although with varying degrees of grit. One should throw it around, play, discover. No harm in exploration.

</comment></comment></comment><comment><USER5> I love projects like this. I'm a chip designer, and I feel very comfortable at that level, and low level programming like assembly. I used to be comfortable in C back in the day.

These days I feel like I don't have time for the nitty gritty details of programming anymore and only work in Clojure (with occasional forays into other languages to see "how goes the world").

I have a large intellectual gap between logic gates, assembly and a high level language like a lisp. I'd really like to attempt a project like this some day, but I mostly feel like those days are behind me.

<comment><USER6> If you did not read this already, you may find it quite entertaining:

[http://repository.readscheme.org/ftp/papers/ai-lab- pubs/AIM-...](http://repository.readscheme.org/ftp/papers/ai-lab- pubs/AIM-514.pdf)

<comment><USER5> Now that's interesting. I believe I did come across this years ago, possibly before I started with clojure... I'll have to go through it again and see if I get more out of it now that I've been working with a lisp for a while.

</comment></comment></comment><comment><USER7> Recommendation: please go read Simon Peyton-Jones' "The Implementation of Functional Programming Languages". It's highly accessible, assumes little prior knowledge, and reads pretty quickly. Its focus is on non-strictly evaluated systems like Miranda and Haskell, but go read it anyway.

(EDIT: Link to free copy from the author: [http://research.microsoft.com/en- us/um/people/simonpj/papers...](http://research.microsoft.com/en- us/um/people/simonpj/papers/slpj-book-1987/))

</comment><comment><USER8> I was about to write that sild is herring in Norwegian, but then I saw you had it in the github repo (but Danish) :)

Cool project, I'll have a look at it!

<comment><USER9> I want to learn some Lisp and clojure later after I finish up with some JS (which I'm relearning) Would this be good in your opinion ?

<comment><USER10> Common Lisp is an ancestor of LISP and is more active every year. It puts its eggs in a "pragmatism" basket. Very good introductory book "Practical Common Lisp" by Peter Seibel[1].

Scheme is a lisp made from scratch. It bets on clarity, functional programming, minimalism and elegance. There is a perfect introductory book "Structure and Interpretation of Computer Programs"[2] which is a worth read even if you don't want to program in Scheme in the future.

I haven't used Clojure, but from what I've heard it's a modern functional lisp which bets on parallelism and interop between environments.

There are more lisp dialects like PicoLisp, but I know about them even less than about the Clojure, so you'll have to investigate options by yourself. I'm a Common Lisp programmer, so I can recommend that – "the profound enlightenment experience", as Eric Raymond put it.

[1] [http://www.gigamonkeys.com/book/](http://www.gigamonkeys.com/book/)

[2] [https://www.mitpress.mit.edu/sicp/full- text/book/book.html](https://www.mitpress.mit.edu/sicp/full- text/book/book.html)

<comment><USER11> I would also advocate for Racket as a great option and is very active. [https://racket-lang.org/](https://racket-lang.org/)

<comment><USER10> I know that Racket is so much more right now, but I've put it in the "Scheme box" in my mind. Is it technically incorrect to treat Racket as Scheme on batteries?

<comment><USER11> Absolutely. It really is "A Programing Language for Programing Languages" It is an excellent environment for defining well contained scheme subsets and other languages and using them seamlessly. But Racket has become its own beast and is very different from Scheme now and the reason for the name change from Scheme PTL.

</comment></comment></comment></comment></comment></comment><comment><USER6> For handling function call frames you may consider compiling your Lisp code a bit before interpretation - do an explicit lambda lifting with an explicit closure allocation. This way you'd be free to kill each frame after a call.

<comment><USER12> Thanks for this suggestion! I had come across this concept and it's one of the strategies I'm considering trying out to solve that problem.

<comment><USER6> You can even implement this part of a compilation in your Lisp itself, with a little bit of a bootstrap.</comment></comment></comment>


Harvard May Have Found the Source of Human Consciousness - <AUTHOR> https://edgylabs.com/2017/01/31/harvard-source-consciousness/ <comment><USER2> If the "rostral dorsolateral pontine tegmentum" area of our brain is associated with consciousness my immediate question is - is this area equally developed in cats, mice, birds, reptiles, fish etc?

</comment><comment><USER3> It looks like they've confused "consciousness" with "awakeness".</comment>


Hey YouTube! 750 indies have signed their declaration of war - <AUTHOR> http://www.musicthinktank.com/mtt-open/hey-youtube-750-indies-have-signed-the-fair-digital-deals-de.html

<comment><USER2> I'd like music to get distributed via BitTorrent, monetized with Bitcoin, licensed under the Creative Commons, and formatted using open formats without DRM.

That'd be hugely valuable to me. That means I can pay for music that I have control over, that I'm not banned from remixing because of an invisible contract I accept when I listen to the music.

<comment><USER3> ^ this. But what is your plan to make this a reality?

My solution: support bandcamp.com (which gives away DRM-free music).

<comment><USER2> Bandcamp.com is great. But I also support artists who are releasing work into the Creative Commons or the public domain.

I've also been doing experiments with practice recording and one-off sound files in the vein of Cory Doctorow's 50% as good for much, much cheaper concept. With any luck, I'll have a stand up comedy show to put into the public domain within a year.

I try to boycott anything from the major label studios. (Though I did pay to see Transformers 4 and A Million Ways to Die in the West) For a while I've experimented with a Richard Stallman-esque boycott of any non-free works, that is, anything not in the public domain. Maybe it's my own lack of willpower in this area (I just love Transformers) but I've come to the conclusion that a Stallman-style boycott doesn't work well with culture, because culture is too important.

I want my kids to know the history of the culture they came from. But I also want to give them a culture of freedom and an understanding of the history we've lost as a result of copyright.</comment></comment></comment>


Bank Theives Foiled by GPS-Spiked Cash - <AUTHOR> http://www.wired.com/threatlevel/2010/01/gps-spiked-cash/

<comment><USER2> Same story: <http://news.ycombinator.com/item?id=1037097>

No comments so far ...</comment>


Get Rich With: Your Own Urban Tribe - <AUTHOR> http://www.mrmoneymustache.com/2015/08/19/urban-tribe/ <comment><USER2> "I'm sick of writing for a penny a blog, I'm going to start a religion..."</comment>


Brazil's Supreme Court Censors Damaging Report on Chief Justice - <AUTHOR> https://brazilian.report/power/2019/04/15/brazil-supreme-court-censorship-crusoe/ <comment><AUTHOR> To add insult to injury, the online magazine has just been ordered to pay the 100k BRL fine _even though the news were taken down from their site_.</comment>


Pandas on Ray – Make Pandas faster - <AUTHOR> https://rise.cs.berkeley.edu/blog/pandas-on-ray/ <comment><USER2> The one line of code is

      import ray.dataframe as pd

They've replaced many pandas functions with an identical API that runs actions in parallel on top of Ray, a task-parallel library:

[https://github.com/ray-project/ray](https://github.com/ray-project/ray)

Unlike Dask, Ray can communicate between processes without serializing and copying data. It uses a shared-memory object store within Apache Arrow:

[http://arrow.apache.org/blog/2017/08/08/plasma-in-memory- obj...](http://arrow.apache.org/blog/2017/08/08/plasma-in-memory-object- store/)

Worker processes (scheduled by Ray's computation graph) simply map the required memory region into their address space.

</comment><comment><USER3> As a person who LOVES pandas, numpy, scikit, and all things SciPy, I really wish these kinds of posts would take a few seconds to include a link, or maybe just a quick paragraph, to answer one question:

What the %$#@ is Ray?

I make a habit of doing this myself whenever I do a post like this. Sure, I was able to look up Ray from the Riselab and figure this out myself, but I wish I didn't have to.

From the Ray homepage:

Ray is a high-performance distributed execution framework targeted at large- scale machine learning and reinforcement learning applications. It achieves scalability and fault tolerance by abstracting the control state of the system in a global control store and keeping all other components stateless. It uses a shared-memory distributed object store to efficiently handle large data through shared memory, and it uses a bottom-up hierarchical scheduling architecture to achieve low-latency and high-throughput scheduling. It uses a lightweight API based on dynamic task graphs and actors to express a wide range of applications in a flexible manner.

Check out the following links!

Codebase: [https://github.com/ray-project/ray](https://github.com/ray- project/ray) Documentation: [http://ray.readthedocs.io/en/latest/index.html](http://ray.readthedocs.io/en/latest/index.html) Tutorial: [https://github.com/ray-project/tutorial](https://github.com/ray- project/tutorial) Blog: [https://ray-project.github.io](https://ray- project.github.io) Mailing list: firstname.lastname@example.com

<comment><USER4> When people write obtusely, I simply read it obtusely and move on with my life.

In my imagination, this article is about some guy named Ray teaching Panda's how to run faster.

</comment></comment><comment><USER5> Comparison to Dask: [https://github.com/ray- project/ray/issues/642](https://github.com/ray-project/ray/issues/642)

</comment><comment><USER6> Ok, it would be quicker, but is it a free lunch? Is there any chance that it would introduce bugs in my code and generate wrong calculations? There's no problem if it does not optimize or even if it crashes. I can always go back to the original version.

</comment><comment><USER7> > ... 100's of terabytes of biological data. When working with this kind of > data, Pandas is often the most preferred tool

"biological data" is a bit vague, but for the data I know to be that big, sequence and array data, it does not naturally have the structure of a dataframe nor is pandas the tool of choice.

<comment><USER8> Yeah, I tend to use modified hdf5 tools for data that big.

<comment><USER9> This is exactly my go-to-move as well.

pandas.read_hdf has beaten out ray.dataframe.read_csv in terms of speed on the few files I've just initially tested now. But I imagine the programmable flexibility csvs have over hdfs (I've never used a Unix command to edit a hdf for example) is why this new approach could get some traction.

<comment><USER10> Try parquet if your data is tabular, pyarrow and related tools are getting parquet up to a pretty comparable speed to hdf5, with arguably more flexibility and a better multithreading story.

</comment></comment></comment></comment><comment><USER11> How does Ray compare to spark? Is there a reason to use spark once libraries like Dask or Ray become more mature?

<comment><USER12> RE:spark, we're curious about Ray mostly because of the potential for interactive-time (ms-level) compute for powering user-facing software. RE:dask, we care that Ray interops with the rest of our stack (Arrow). I haven't evaluated Ray-on-pandas, and the Ray was previously focused on powering traditional ML, so again, just first blush on the announce.

I don't think anything is inherent, more about priorities and momentum. For example, Spark devs have been working on cutting latency, and Conda Inc is/was contributing to the Arrow world. I had assumed the pygdf project would get to accelerating arrow dataframe compute before others, so this announce was a pleasant surprise!

</comment></comment><comment><USER13> For Mac and Linux:

        pip install ray

For windows:

        ¯\_(ツ)_/¯

<comment><USER10> [https://github.com/ray-project/ray/issues/631](https://github.com/ray- project/ray/issues/631)

</comment></comment><comment><USER12> We're super excited by the overall project at Graphistry, and hadn't realized there was a ray-on-pandas component! The first line w/ GPU count is intriguing given what we do :) Super excited to try it on our pandas code.

For node/data hackers: Our team is trying to bring the full & accelerated pydata world to JavaScript. We started with Arrow columnar data bindings ([https://github.com/apache/arrow/tree/master/js](https://github.com/apache/arrow/tree/master/js)). Next stop is Plasma bindings in node for zero-copy node<>pydata interop. That enables nearly-free calls from node web etc. apps to accelerated pandas-on- ray. If others are interested in contributing, let me/us know!

</comment><comment><AUTHOR> Github link: [https://github.com/ray-project/ray](https://github.com/ray- project/ray)

</comment><comment><USER14> I've found splitting the dataframe, and using multiprocessing module with `apply` to compute chunks of data to be quite efficient. One can use `group_by` method for that, or just slice the dataframe.

For example:

        concurrency = 4  # Num of cores
        pool = multiprocessing.Pool(processes=concurrency)
        results = pool.map(fn, df.group(...))   # fn would be a callable for computing on a chunk.
        pool.close()
        return pd.concat(results)

</comment><comment><USER15> What's not covered are the crucial operations of group-by and reduce!!!

<comment><USER16> One of the Pandas on Ray coauthors here: We're planning on releasing another post in the next few weeks discussing the technical details around group-bys. Stay tuned!

</comment></comment><comment><USER17> Could someone compare this to Dask? Would you use the two in different situations?</comment>


Two young scientists built a $250M business using yeast to clean up wastewater - <AUTHOR> https://www.forbes.com/sites/alexknapp/2020/07/06/how-two-young-scientists-built-a-250-million-business-using-yeast-to-clean-up-wastewater/#591ecf777802 <comment><USER2> I wrote some cliff notes if anyone else is interested

Company is called Solugen. $12 M/yr in 2019, on track for >30 M/yr in 2020

Wastewater treatment is 80% of their revenue

Bio-engineered a yeast to create produce enzymes that create hydrogen peroxide from feedstock sugar

The solution produced also contains organic acids that breakdown minerals. Mineral buildup can clog and corrode pipes over time

Initially created 5 gallon batches, for use in pools, hot tubs and spas. Found that market after a group of float-spa owners contacted them on facebook

Joined Y-Combinator

Partnered with wipe manufacturer to sell them hydrogen peroxide solution hoping the deal was stepping stone to bigger industrial customers

Hired a salesperson from oilfield services Schlumberger to market wastewater cleaning products to oil drillers

The product is appealing for the wastewater cleanup market because of it's anti mineral buildup effects and it does not cause algal blooms compared to HEDP. It's a $5 B/yr market. Includes oil and gas drilling which regulation requires wastewater to be cleaned. The product had a successful test with an oil and gas customer. The customer had 20% reduced efficiency in it's water injectors because of iron-scale buildup and lost $29 M/yr. The product increased production again without the need of additional acid sitmulation. Demand for wastewater treatment increases with age of oil drilling sites. "We go head to head with phosphates, We are not premium."

Production of solution also sequesters 1.35 tons of CO2 compared to it's competitor HEDP which emits 3 tons. According to independent audit from Life Cycle Analysis

Also produced more than 100K gallons of hand sanitizer that it dontated to healthcare facilities. Partenered with local ethenol facility. Plans to increase hand sanitizer production mini-mills (smaller regional production facilities) and considering commercial opportunities

Plans to expand to agriculture fertilizing, a $175 B/yr market. Hoping to re- invent fertilizer with biodegradable alternative that replenishes essential minerals and metals to soil

<comment><USER3> > I wrote some cliff notes if anyone else is interested

What does this mean? Tongue-in-cheek interpretation: 'some simple paragraphs without full stops follow'. Is it some sort of note-taking framework though?

<comment> yjftsjthsd-h Cliff notes is a series of books that are extremely abridged versions of things that students need to read.

</comment></comment></comment><comment><USER4> > Their sales pitch was that the product was petroleum-free, a boon for spas > that like to market being "natural."

It's interesting that people see genetically modified yeast producing hydrogen peroxide as "natural" \-- but not regular hydrogen peroxide.

<comment><USER5> The entire ad campaign around OxiClean: "usages the power of oxyzen" as if it natural and chemical free. It may be natural, but it isn't the [semi] friendly O2 variety that we breath.

Read some of the Q&As for Ozone Generators on Amazon, many people think it's safe for humans and pets. The internet is a dangerous place for information at times.

<comment><USER6> Arrrrrgh oxygen is a chemical, everything is made of chemicals.

<comment><USER7> Oxygen is an element. Diatomic oxygen commonly known as O2 is a chemical. Everything is made of elements, including chemicals.

<comment><USER6> Oxygen gas, colloquially referred to as 'oxygen', is a chemical.

If you want to be a smartypants I guess noble gases are elementary.

<comment><USER7> I didn't start the pedantry.

</comment></comment></comment></comment></comment></comment><comment><USER8> Very cool. Slight correction though:

>"It was a Trojan Horse for us, with an aim of selling the brand and getting a supplier contract," he says. As in the Iliad, the plan worked.

The Trojan Horse isn't actually in the Iliad, it's in the Little Iliad, a now lost epic poem.

<comment><USER9> Nice catch. The Iliad doesn't actually concern itself with the end of the Trojan War.

The horse is mentioned briefly in the Odyssey, since it's attributed to Odysseus's cunning wit. Probably the work that describes it most thoroughly is the Aenid, which came hundreds of years after Homer's works or the Little Iliad.

<comment><USER10> That's six or seven hundred years that Virgil wrote the Aneid, as a sort of founding myth for Rome during its transition from the republic to ... or really at the beginning of the empire (not long after Julius Caesar's death). It was almost a sort of political propaganda, legitimizing and linking the empire to an ancestral root to their gods.

The Romans often were inspired by, appropriated, imitated, or embraced Greek culture which was looked upon highly. Much of their success can be attributed to their ability to integrate many cultures and meld them into a diverse Roman culture.

</comment></comment></comment><comment><USER11> The Thought Emporium on YouTube has a few livestream-style videos where he does gene editing experiments like this for fun (?). Very interesting stuff. I feel like textiles will be coming soon.

[https://www.youtube.com/c/thethoughtemporium](https://www.youtube.com/c/thethoughtemporium)

<comment><USER2> Great share!

I wish these were shorter but I guess I have to breakout my notepad again

<comment><USER12> He has some shorter scripted videos.

</comment></comment></comment><comment><USER13> On one hand, really impressive stuff that is simply a net positive over what we had before.

On the other, there is no way for joe schmoes like me to invest in a great company like this. :(

</comment><comment><USER14> Mixing H2O2 with ethanol in one bottle looks strange. EtOH should just oxidize and one ends up with a bottle of vinegar or pure water with CO2 dissolved in it. They ad some stabilizer so the active oxygen is not being released or is it some kind of magic?

</comment><comment><USER15> It wasn't clear to me in reading this article whether or not this is actually cost competitive with existing hydrogen peroxide production methods. Or is it more about it being an environmentally-friendly play?

<comment><USER16> They said something about being cost competitive with the established suppliers "we are not a premium".

</comment></comment><comment><USER17> They're only several hundred years late - us Brits have been using yeast to clean up our water into nice safe beer for a long time!

</comment><comment><USER18> So is this one of the emerging multi billion dollar companies built on the new gene editing tools?

<comment><USER19> This one looks like it makes money which is strange

<comment><USER20> > [the company expects] revenue to surpass $30 million this year, though the > company is not yet profitable as it spends heavily to expand

</comment></comment></comment><comment><USER21> Wow! I like these chemical and biological processes which can alter the materials.

Guys! Can you suggest an easy way to convert PET plastic to PETG? Can we make bioengineered bacteria for this process.

I make 3d printing filament from plastic waste (currently using abs) and I can find lots of cheap PET plastic but it's not good for printing but PETG is.

</comment><comment><USER22> What are the legal/ethical/regulations you have to jump through to be allowed to dump genetically modified yeast into a pond?

<comment><USER23> They don't dump genetically modified anything anywhere. Inside a lab, they produce chemicals using genetically modified enzymes instead of traditional methods of chemistry.

<comment><USER22> Ah I see, so it's a hydrogen peroxide and mineral solution produced from the yeast. They are selling this solution with no microbes inside.

</comment></comment></comment><comment><USER24> edit: plz ignore, misread (thanks bb611)

Anyone else think it's suspicious that they paid $3M for a plant to the cofounder's father?

<comment><USER25> I think you simply misread the article.

> A half hour later, he was touring a decommissioned chemical manufacturing > plant that had been used to turn oil into plastics, with Chakrabarti's > father, Gopendu, a chemical engineer and entrepreneur. The hulking factory, > on a 5-acre site, still had intact piping and tanks, and even boasted a > 1-acre apple and pear orchard, planted by the previous owner as a carbon > offset. The elder Chakrabarti swore they'd never find a better space. After > touring 20 more sites over the next month, Hunt finally agreed. Solugen paid > nearly $3 million for the plant.

They toured the plant with him, taking advantage of free advice from a knowledgeable, skilled person. They didn't pay him.

</comment></comment><comment><USER26> Has anyone else ever heard of an MD-PhD student being called a "mud-phud"? I'm in a PhD program (and have several friends that are MD-PhD candidates) and my wife is an MD and I've never heard of this term.

<comment><USER27> I'm a mud-phud, use it myself and have heard it used all over!

<comment><USER28> What region? This thread is the first I've heard of it too.

<comment><USER27> Northeast for the most part, heard it as far south as NC

<comment><USER26> Wow, so interesting. I go to school in the northeast. I'll have to ask around.

</comment></comment></comment></comment></comment><comment><USER29> Very impressive!

<comment><USER16> Indeed! These inspiring stories give me a glimmer of hope in the future. It seems that a combination of low carbon demand by the end consumer and a desire to work on low carbon technologies by our brightest minds are disrupting the otherwise formidable capital of established high carbon tech.

</comment></comment><comment><USER21> Is it possible to create engineered bacterias at home? Or it can only be done in advanced institutes with big machines which average Joe can't afford?

<comment><USER19> Yes it is very possible. It is very expensive to verify that you did it correctly and that it works as intended.

Genetics are not like code so unless you are copying previous work expect a very long road

</comment></comment><comment> ur-whale [http://archive.is/DoCrH](http://archive.is/DoCrH)</comment>


Firefox Nightly now plays Amazon.com Flash videos using Shumway - <AUTHOR> https://mail.mozilla.org/pipermail/firefox-dev/2015-February/002683.html <comment><USER2> I'm a program manager on Mozilla's Shumway team. If you have any questions, please ask! :) The name "Shumway" is derived from "Gordon Shumway", the actual name of the TV character ALF: Flash -> Flash Gordon -> Gordon Shumway -> Shumway. :)

Shumway is written in TypeScript. It has an ActionScript interpreter and a JIT that generates JavaScript, compiled using eval(). The code is on GitHub:

[https://github.com/mozilla/shumway/](https://github.com/mozilla/shumway/)

<comment><USER3> Do you fear that by the time shumway actually works for "most ppl stuff" flash would already be gone and the effort wasted? (its gone from YT..)

<comment><USER2> Yes and no. Shumway is in a race to stay relevant as Flash fades from the web, but there will always be a long-tail of Flash content that would/will be lost when Adobe or browsers stop supporting the Flash plugin.

Even YouTube must continue to support Flash video for at least another year because many websites embedded Flash videos using YouTube's boilerplate embedding HTML with the Flash <object> tag. Google can't magically rewrite these third-party websites' HTML. :) Maybe YouTube can use some SWF that loads or redirects people to youtube.com? Or browsers could recognize YouTube's boilerplate embedding HTML and rewrite it with YouTube's HTML5 video.

<comment><USER4> This is a serious point though.

Flash, while pretty atrocious, is part of the cultural legacy of the web.

Someday shumway may be the only way reasonable way to access this via archive.org etc.

<comment><USER5> This is indeed a major consideration: Flash will undoubtedly go away as a player, and if we don't want to lose all the legacy content with it as if it were stored on floppy disks, Shumway or something like it is the only solution.

Note that for a lot of content, it's not even required to use Shumway in the form of a browser extension or built-in system: it's perfectly possible to run SWFs with Shumway as a website-deployed player. E.g., the header on [http://areweflashyet.com](http://areweflashyet.com) is deployed that way and works just fine in all modern browsers.

<comment><USER6> Well, it does not work in Chrome on iOS 7.

<comment><USER5> Thanks, bug filed: [https://bugzilla.mozilla.org/show_bug.cgi?id=1133323](https://bugzilla.mozilla.org/show_bug.cgi?id=1133323)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'm one of the developers on the video player used on that page. Great work guys!

Edit: I should add in, the player is primarily Javascript with a small rendering engine for Flash fallback. Even in the Flash case, everything is controlled via JS through a flash bridge. We prioritize HTML5 video when possible across browsers and devices.

<comment><USER2> maherbeg: thanks!

Our team was uncertain how to reach at Amazon to get your blessing. :) If you (or Amazon management :) have any problems or concerns, _please_ feel free to email me at cpeterson at mozilla dot com!

re HTML5 video: do you use it on desktop browsers? Mozilla is working hard to improve our HTML5 video implementation. Can we opt in Firefox for HTML5 video? Playing Flash videos in Shumway is just a stepping stone on the path to HTML5 video.

<comment><USER7> We do allow HTML5 video on Firefox for Windows. On Mac, we disallow it.

We feature detect everything but have been prioritizing Flash at the moment due to issues with Chrome and HTML5 video.

<comment><USER2> > * We do allow HTML5 video on Firefox for Windows. On Mac, we disallow it.*

Interesting. Is HTML5 video the default on Firefox for Windows or only used when Flash is not installed? (I only have a Mac.)

Have you found specific Firefox problems with HTML5 video on Mac? Feel free to email me if you have questions for Firefox's video team about debugging or optimization. They are friendly folks. :)

</comment></comment></comment></comment><comment><USER8> Sounds like Shumway is already further along than Gnash or Lightspark.

What versions of SWF does Shumway aim to support? 7, 8, 9, 10, all of the above?

How does Shumway interact with click-to-play and similar mechanisms to stop unwanted Flash objects from playing? Does it have that functionality built-in?

<comment><USER2> Shumway is implementing APIs as needed, not targeting a specific SWF version.

Shumway does not currently support click-to-play because it is not a real browser plugin. It hooks into Firefox's click-to-play mechanism to conditionally override the Flash plugin. This is a hack and will soon be replaced with "jsplugins", a Firefox feature that will allow browser plugins to be written in JS and run in an out-of-process sandbox:

[https://bugzil.la/jsplugins](https://bugzil.la/jsplugins)

<comment><USER9> Will this be more secure than Adobe's Flash, since that already runs in a separate process?

<comment><USER10> Since it won't be native code, they'll only be able to abuse a FF bug exposed by the JS plugin API, but should be in a very bad position to exploit a kernel bug...

Same process isolation, but the JS plugin got a vastly reduced surface to attack.

<comment><USER5> Exactly. We did a survey of Flash exploits from the last few years and almost all of them would simply have been impossible in Shumway. That doesn't mean that Shumway will automatically free of all security bugs, but the whole class of bugs that in some way is caused by memory corruption is only possible through bugs in Firefox's JS engine SpiderMonkey. Of course it's much easier to just exploit them in JS directly then, so Shumway doesn't increase the surface attackable through bugs like that.

</comment></comment></comment></comment></comment><comment><USER11> Cool tech, but I'm a bit sad that I can't watch Shumway[1] using Shumway.

[1]: [http://www.albinoblacksheep.com/flash/shumway](http://www.albinoblacksheep.com/flash/shumway)

<comment><USER12> You actually can; I'm doing so right now. However, you need to install the full Shumway extension from [http://www.areweflashyet.com/shumway/](http://www.areweflashyet.com/shumway/) (the stripped-down version shipping in Nightly is limited to Amazon only).

If you use Shumway, though, don't forget to disable Adobe's Flash (I've found that having it enabled _and_ Shumway installed results in rather brutal crashes).

<comment><USER5> Can you give steps to reproduce this crash? It should definitely _not_ happen. In fact, until [https://bugzilla.mozilla.org/show_bug.cgi?id=558184](https://bugzilla.mozilla.org/show_bug.cgi?id=558184) is implemented we rely on an installed Flash plugin to make the Flash detection used by most sites work.

<comment><USER12> Steps:

0) Have a Macbook Air running OS X Yosemite

1) Install Firefox

2) Install Adobe Flash

3) Install Nightly

4) Install Shumway

5) Attempt to open [http://www.albinoblacksheep.com/flash/shumway](http://www.albinoblacksheep.com/flash/shumway)

6) Watch Firefox complain that the tab crashed

7) Try to reload the tab

8) GOTO 6

Disabling Flash (via the Addons screen in Firefox/Nightly) seems to fix the issue.

</comment></comment></comment></comment><comment><USER13> How do you go from swf files to "action script"? Do you use flasm/flare for as2? How do you turn as3 abc files into action script? Did you write your own decompiler or use some other open source ones? There's a disassembler written in D for as3 that I used to use called rabcdasm, did your team ever take a look at that?

<comment><USER14> > There's a disassembler written in D for as3 that I used to use called > rabcdasm, did your team ever take a look at that?

RABCDAsm author here. Curious about the same, I've always thought the project might be useful to VM implementers. Also wondering if you've had trouble with obfuscators that employ control flow obfuscation, and create unreachable basic blocks with junk code.

<comment><USER2> Yes, definitely! SWF obfuscators are a problem because they rely on undocumented behavior and implementation details of the Flash plugin that the Shumway developers must debug and support to maintain compatibility. Obfuscated AS1 code can do strange things like jumping to unaligned SWF addresses in the middle of bytecodes.

<comment><USER14> > Obfuscated AS1 code can do strange things like jumping to unaligned SWF > addresses in the middle of bytecodes.

Oh, I've seen much worse. The AS1 VM actually treats the entire SWF file (after decompression) as an AS program. That means it's possible to jump outside of the bytecode tag and into e.g. the metadata of a JPEG file.

<comment><USER15> Reminds me of one highly-regarded (at the time) obfuscator whose operation consisted entirely of renaming the existing bytecode tags to a reserved value, and adding a bytecode tag after it with lots of useless code including opaque predicates which eventually jumped out of the tag, backwards, into the original code. A bit of a letdown as I was looking for a challenge at the time, but that jump out of the tag was sure easy to detect and unobfuscate...

(This is something that is still _not_ fixed in Gnash, so Shumway is certainly farther along.)

<comment><USER16> We can detect when bytecode is not well formed and fall back on interpretation, which can handle these nasty cases. This is more of a problem for AVM1 than AVM2.

</comment></comment></comment></comment></comment></comment><comment><USER17> Does anyone have experience trying this with Firefox on PowerPC or ARMHF Linux? These platforms don't have any working Flash versions from Adobe...

<comment><USER12> I'm wondering the same. I have a PowerBook G4 running OpenBSD 5.6 that I suppose I could test with, though Firefox has traditionally been pretty slow on that particular machine.

</comment></comment><comment><USER7> I just tested against Firefox Nightly on the amazon pages and it doesn't appear to be even loading the Flash renderer.

We feature detect flash via the navigator.plugins object and from that thread it doesn't look like shumway is listed there.

(I'm a dev on that player)

<comment><USER5> (Shumway tech lead here)

Somewhat absurdly, you currently need Flash to use Flash without Flash in many cases. We don't yet have support for installing Shumway in navigator.plugins, so sites that detect Flash using that (i.e., most of them) currently only work in Shumway if Flash is installed, too.

This will be fixed once [https://bugzilla.mozilla.org/show_bug.cgi?id=558184](https://bugzilla.mozilla.org/show_bug.cgi?id=558184) lands.

</comment></comment><comment><USER18> > "Note that Shumway will _not_ play Amazon's "Instant Video" films and TV > shows. Those videos use Microsoft's Silverlight plugin for DRM."

<comment><USER19> Amazon Instant Video can also use Flash. See "Player Preferences": [https://smile.amazon.com/gp/video/settings](https://smile.amazon.com/gp/video/settings)

<comment><USER2> Thanks! I didn't know that. I just tested an Amazon Instant Video in Shumway, but the video fails to load because Amazon's video player uses some Flex libraries that Shumway doesn't support yet.

</comment></comment></comment><comment><USER20> Tried it on Arch Linux + Firefox v35 works smoother than flash plugin. Used AUR package here: [https://aur.archlinux.org/packages/firefox-extension- shumway...](https://aur.archlinux.org/packages/firefox-extension-shumway/) Can't wait for this to replace everything flash. Thank You, shumway team :-)

</comment><comment><USER21> I'm waiting until they get JWPlayer working. So many sites still use it.

<comment><USER2> JWPlayer support is difficult because there are many JWPlayer variants and old versions out there. It's easier to test and whitelist individual websites to start.

<comment><USER22> Why bother emulating it, though? If you can recognize it, and recognize that it's not using any unusual settings, you could potentially just replace the whole thing with a native video player.

<comment><USER2> That's a good question. Video is just one use case for Shumway. This specific use case might be better supported by rewriting Flash <object> tags with an HTML5 video player, but Mozilla dislikes adding hacks to workaround site- specific quirks. The hacks are technical debt carried by Firefox on behalf of websites that don't bother to maintain themselves. Mozilla even removes _moz-_ prefixed DOM APIs and CSS attributes when the standardized, unprefixed name is supported.

<comment><USER23> Sounds like a perfect use case for an addon then!

</comment></comment></comment></comment></comment><comment><USER24> Only somewhat related, but is there still no way to access the clipboard in a web app without flash?

<comment><USER25> Imagine a web where you could just write to the users clipboard without a plugin + requiring a click.

It would NEVER be safe to Ctrl+V again!

<comment><USER24> The requiring a click part is the only relevant implementation detail for this functionality, in my opinion. Whether or not it requires a plugin shouldn't matter.

In fact, requiring a plugin for this functionality only serves to increase the attack surface for the browser as a platform.

</comment></comment></comment><comment><USER26> This is so cool, so more need to install hal?

</comment><comment><USER27> firstname.lastname@example.com Bass word

</comment><comment><USER28> > Shumway needs H.264 video decoders that may not be available on Windows XP > or Linux.

Today I learned that Firefox still supports Windows XP.

<comment><USER2> About 25% of Firefox Windows users run Windows XP.

<comment><USER29> Is that a real number? I've seen a huge decrease in Windows XP users over the last year, from almost 20% to bellow 10%. But that was for different product, so I'm wondering if FF got it this bad.

<comment><USER2> Yes, though I don't have a public source for it. I don't know why Firefox's OS version statistics are not public. Wikipedia says 49% of computers in China run Windows XP: [https://en.wikipedia.org/wiki/Windows_XP#Support_lifecycle](https://en.wikipedia.org/wiki/Windows_XP#Support_lifecycle)

Microsoft added its "Genuine Windows" copy protection in XP SP3, so XP SP2 is especially common. (Firefox supports both XP SP3 and SP2.)

<comment><USER30> This is a myth actually, and I hope they can kill XP SP2 support in 2015. At least getting rid of the SHA1 cert at the download site at the end of 2015</comment></comment></comment></comment></comment>


5 months after HN front page - <AUTHOR> http://www.proudn00b.com/post/2054286182/5-months-after-hn-front-page

<comment><USER2> Emile, great job! A few things:

-The font is an eyesore. You should change to a much more reader-friendly font stack (for starters, you have a sans-serif font whose base font is serif, that's a no-no). Check out some links for help: <http://delicious.com/acconrad/typography>

-You have a typo on the front page "Please use a commma between tags" 2 m's :)

-You should stagger points based on answering v. asking, as answering/mentoring is arguably worth more than asking.

<comment><AUTHOR> Ah thanks for the feedback!</comment></comment>