A Meta Lesson - <AUTHOR> http://andy.kitchen/a-meta-lesson.html <comment><USER2> What confuses me about the state of the art of machine learning is that at both training and execution time, there is no notion of system resources.

These systems _cannot_ runtime-optimize themselves like the human brain, because attention, boredom, frustration and other mechanisms cannot arise 'naturally' without such a notion.

Also, if the system can not infer its own boundaries (by feeding its output into itself, at least indirectly), it can not develop a notion of self and engage in meta-learning.

Given that the brain is a 20W system evolved towards learning things over a long time span in a changing environment, I'd really like to see an energy consumption comparison with current neural nets. With AutoML it may be necessary to separate network construction, feature learning and inference.

Is there a Moores law equivalent here? Maybe launch a competition: "You are given ten 10 Watt-years, create the best system for this task (e.g. image segmentation)". With current electricity prices, training a system equivalent to a 10-year old brain will cost around $100 (not including I/O and training environment).

</comment><comment><USER3> > Rodney Brooks (approx.): No, human ingenuity is actually responsible for > progress in AI. We can't just solve problems by throwing more compute at > them.

I find this amusing considering nature just kept throwing more time at the universe until humans emerged. That said, I don't think Brooks is wrong. I can't recall where in the lectures this is, but I remember Feynman going on a rant about how poorly designed the human eye was. Human ingenuity really is an essential piece of the puzzle, seeing as Nature, in and of itself, isn't very smart.

<comment><USER4> You kind of have to add an implicit "unless we want to use a computer the size of a planet and wait two billion years for the answer".

<comment><USER5> 42?

<comment><USER4> I'm not saying that's why the Earth is here, but have you noticed that almost every new medical advance does something beneficial _for mice_?

</comment></comment></comment></comment><comment><USER6> The nice thing about philosophical views is that they don't really matter. Whatever gets the ball rolling in beating the SotA we'll accept it.

In science we shouldn't have to abide by philosophical views. They only hurt. Theorems, proofs and the empirical evidence should fix it. Can you believe there was a time when the world was against Yann LeCun because everyone speculated neural networks don't work for complex scenarios?

Both points of views Sutton's, Brookes' are utter speculations as we cannot generalize or learn anything meaningful from them. Both of them are saying: "Since I don't know for sure how we're going to improve the AI in the long run therefor he's what I suspect the right approach is". They are even looking at the same history of AI is seeing different things. Go figure now.

In mathematics old tricks only get you so far. The hard problems in a particular moment in time can only be overcome by deploying new tricks. Why wouldn't that be the case in the AI space?

Hard coded rules, got us started. Then more computation made the next step. Then we mixed the two. Then we created more purposefully handcrafted architectures such as CNN. Then we manually annotated millions of data points. Then GANs came along to fix some stability issues.

What's the next trick now? Don't worry, since no one knows both authors are just speculating.

</comment><comment><USER7> Reading both of the posts make me believe that Sutton has stated a more global outlook in the progression of complexity than Brooks did, or that Brooks is simply trying to continue to encourage the current generation of AI research.

My naive take of each of their arguments, which are seemingly obvious but nonetheless profound:

Sutton: advancement in computation capacity > specifically devised methods

Brooks: building specific tools help in solving the problem

You see, neither of them are wrong. However, what Brooks is arguing for is essentially - hey, we invented paper, but we have no computer yet, let's make some line paper and graph paper to increase our productivity, hooray! Then what Sutton is saying is, dude, show me how your method will continue to be productive when computers are invented.

I do also want to propose my takeaway from these pieces though. From Brooks I take that building tools/methods is essential to local optimization and tools/methods can be extended to fit new global advancements. And to Sutton's point, we are in a state of ever progression by the extension of the essence of Moore's Law.

</comment><comment><USER8> Sutton's position might be described as Darwinian (our brains evolved with nothing but natural selection guiding the process), while Brook's position might be called Chomskyan (we are born with a rich set of rules in place.) These are not, of course, mutually exclusive.

</comment><comment><USER9> Perhaps a more meta lesson is that a single viewpoint is rarely sufficient.

I'd also be curious to see how hard researchers like these push their differences if publication was anonymous or like code, contributors are acknowledged but we refer to the project name, Linux not Torvalds et al</comment>


CNN's anti immigrant propaganda - <AUTHOR> http://www.huffingtonpost.com/entry/58bbc5fee4b02eac8876cfad <comment><USER2> "For the last few days, CNN has been promoting an episode of Believer with the title "City of the Dead," and showing footage of corpses being burnt on the banks of the River _Ganga_."

"Ganga" means something very different to English-language readers.</comment>


Ask HN: How do you write job offers in general? - <AUTHOR> <comment><USER2> Find a template or example. Customize it.

<comment><AUTHOR> Which template is your favorite?</comment></comment>


Are You in the Top One Percent of the World? - <AUTHOR> https://www.investopedia.com/articles/personal-finance/050615/are-you-top-one-percent-world.asp <comment><USER2> This is such a fallacy. It's meaningless being in the top 1% of the world unless you can transact for property and services at some world sourced purchasing cost - otherwise, the so labeled 1% level of assets means precious little in actual life stability or security.</comment>


Which States Are in the Midwest? - <AUTHOR> https://fivethirtyeight.com/features/what-states-are-in-the-midwest/ <comment><USER2> Interesting to ask residents' opinions.

But here's this: [https://en.wikipedia.org/wiki/Midwestern_United_States](https://en.wikipedia.org/wiki/Midwestern_United_States)</comment>


JPMorgan to ban fintech apps from using customer passwords - <AUTHOR> <comment><USER2> I assume you meant to link to this [https://www.ft.com/content/93dcfc52-210b-11ea-b8a1-584213ee7...](https://www.ft.com/content/93dcfc52-210b-11ea-b8a1-584213ee7b2b)</comment>


Distributed Systems are hard to program - <AUTHOR> https://web.archive.org/web/20130103211716/http://rajith.2rlabs.com/2008/07/23/5-reasons-why-distributed-systems-are-hard-to-develop/ <comment><AUTHOR> I found this via a dead link on a slide from one of Joe Armstrong's talks.</comment>


New SMB Worm Uses Seven NSA Hacking Tools, whilst WannaCry Used Just Two - <AUTHOR> https://www.bleepingcomputer.com/news/security/new-smb-worm-uses-seven-nsa-hacking-tools-wannacry-used-just-two/ <comment><USER2> As a sysadmin I have always hated SMB. I loved samba for their attempts to opensource it so I could at least use samba4 in prod and feel confident in it's stability, but I always felt like it was a bad protocol without many good alternatives. NFS is about the same, even worse when trying to serve to windows clients.

For those on linux or not aware, if you see 'cifs' it is the same thing (mostly).

One thing I always did was require connections to use latest smb (mitigates many old version attacks), ensure auth is using highest available methods, but more than anything is running the SMB server behind a well monitored and maintained firewall. That's the thing that gets lots of companies.

Also, this: [https://wiki.archlinux.org/index.php/Samba#Block_certain_fil...](https://wiki.archlinux.org/index.php/Samba#Block_certain_file_extensions_on_Samba_share)

Finally, segment your damn networks with vlans/subnets!

<comment><USER3> so what would be the choice of tech to share files between computers on a private network?

<comment><USER4> SFTP/SSH (many IFS and fuse implementations) is an option. But it's not always a good alternative.

<comment><USER5> Not being knowledgeable enough about these protocols and their relative advantage/disadvantages, can the people who downvoted this comment also write down _why_ to help others? That always makes more sense when it's not obvious.

<comment><USER6> I think this is downvoted because it's considered slow and/or hacky and having a fair amount of overhead (especially for SSH -- e.g. User and Key management).

That being said, I think the explanation is not available because ... people aren't really sure about a better option!

If we take the common (IMO complex) Network filesystem protocol implementations as having irredeemable flaws (so SMB and NFS, all versions), the only viable contenders I can think of are block level network device protocols. E.g.: iSCSI, NBD, DRBD, and probably quite a few others. These of course have the disadvantage of exposing _block level_ protocols to clients, leaving the actual filesystem management up to the client.

Summary: it's always a tradeoff and most of the options suck in one way or another. I personally wouldn't downvote this comment. But maybe someone could enlighten me.

<comment><USER7> What about webdav?

<comment><USER8> WebDav didn't take off because no-one really felt like giving away a high quality implementation in kernel-space for Windows. And Microsoft viewed it as competition against SMB and their licensing model.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Question - wouldn't it be feasible to write a worm that uses the vulnerability to deliver a patch for the vulnerability... and then maybe deactivate itself after several days (the worm / spreading portion)?

Or is there something I'm missing?

<comment><USER10> Reminds me of a tricky situation I got myself into :

When I was in college, I wrote a simple worm to display a new year greeting on all computers it infects. Once it infects a computer, it did the following: 1\. it replicated itself to as many computers as possible 2\. Displayed the greeting (till user acknowledges it through a key press) 3\. self delete (in the hope that it will quickly die by itself)

I seeded it in one of the computers in our college network. I didn't expect it to be so effective; It spread itself very quickly in the entire network. With self-delete, I thought it would die on its own. I was wrong. Machines kept infecting each other in a perpetual loop. The only way I could stop it was to write a new version that replicated, and cleaned the first version. This new version kept replicating in the network even after a year. This new version was not doing anything visible to the user, and I was saved :)

<comment><USER11> You should have included another functionality to check the current date, like, it should stop spreading and just delete itself if it's already in April. ;)

<comment><USER10> Good thought :) When I put out the first version, I haven't really understood the consequences or its effectiveness; In fact it had my code name in the greeting :( When it first appeared, people found it amusing; but it quickly went out of control and kept appearing again and again. This annoyed people. I was in trouble. I had to quickly find a solution in that panic.

</comment></comment></comment></comment><comment><USER12> Waiting for the first Intel Management Engine based ransomware.

</comment><comment><USER13> I've been wondering since this began, is there any reason as to why someone would open up their file server/shares to the internet? I remember reading somewhere that SMB wasn't designed for WANs and seems like a terrible choice to put on the internet (even without the security risk).

<comment><USER14> You have a corporate network which has SMB everywhere (as it's windows based). You have 1 of your 10,000 users run "funnyscreensaver.exe", and before you know it you're entire network is infected -- doesn't matter that your firewall blocks incoming or outgoing 137/139/445 - or even if it's an isolated network without even nat capability.

</comment></comment><comment><USER15> Primary source: [https://github.com/stamparm/EternalRocks/blob/master/README....](https://github.com/stamparm/EternalRocks/blob/master/README.md)

</comment><comment><USER16> It's obvious that 7 is bigger than 2. So we should be more scared this time.

</comment><comment><USER17> Time to switch to something different than Windows.

<comment><USER18> or keep Windows up to date

<comment><USER19> And don't random-click things.

<comment><USER20> May I point out that probably nothing was clicked with wcry2.0 that the worm access via smb from internet facing 445 and then internally on lan. Although yes random clicking not advisable ever...

</comment></comment></comment></comment><comment><USER21> Just two, like that's nothing at all now.

<comment><USER22> This may be only the beginning.

</comment></comment><comment><USER23> "Once infected, he can weaponize any time he wants, no matter the late patch."

<comment><USER24> Right, like any compromise. You can't be sure it's fixed unless you reinstall from scratch.

<comment><USER25> Even then you can only hope that it has not infected your BIOS/Other HW firmware

<comment><USER14> Nuke it from orbit, only way to be sure

<comment><USER26> Uh oh, time for the humorless hackernews downvote.</comment></comment></comment></comment></comment>


Laura Poitras Does Not Want to Talk About WikiLeaks and Russia - <AUTHOR> http://www.thedailybeast.com/articles/2017/05/08/laura-poitras-does-not-want-to-talk-about-wikileaks-and-russia <comment><USER2> Laura Poitras Does Not Want to Talk About Marlow Stern's theory "that there is a relationship between WikiLeaks and Russia".</comment>


Bayesian Inference Lectures [video] - <AUTHOR> https://www.youtube.com/playlist?list=PL9v9IXDsJkktefQzX39wC2YG07vw7DsQ_ <comment><AUTHOR> I came across this series of YouTube videos by Aubrey Clayton on Bayesian Inference (based on Ed Jaynes' book, 'Probability Theory: The Logic of Science') that I thought explained the fundamental ideas extraordinarly well but judging by the viewing figures, are not widely known.</comment>


Ask HN: Spectre/Meltdown do I need to replace my phone? - <AUTHOR> In light of recent events, everyone is talking now about how critical it is to immediately update their OS, update their browsers, update their kernel... But almost every smart phone in the world will never get any system updates. Are we all supposed to go out and buy brand new ones from the select few that are still getting security updates? Is there any future for using this as some kind of legal leverage against Google and mobile manufacturers? <comment><USER2> Your phone may not even be affected, so I would say you are 'jumping the gun'.</comment>


Facebook Axed Pro-Vaccine Ads from Health Orgs, Let Anti-Vaxxer Ads Slip Through - <AUTHOR> https://www.thedailybeast.com/facebook-axed-pro-vaccine-ads-from-hospitals-and-health-orgs-let-anti-vaxxer-ads-slip-through <comment><USER2> If you watch this part of the congressional hearing, you can see that at least Zuckerberg is clearly not an anti-vaxxer: [https://youtu.be/9EgrrR1M2Ck?t=3938](https://youtu.be/9EgrrR1M2Ck?t=3938)

I assume that their ad filtering task is just a really hard problem.

</comment><comment><USER3> Key word missing from the title: some. It looks like Facebook has a filter to ban anti-vaccine ads, but like any filter, has false positives and negatives. That the article gives examples of _only_ the false positives and negatives, and none for the cases where the filter worked correctly, is outright deceitful.

But then, this kind of selective reporting is hardly unique.</comment>


Where are we in the Python 3 transition? - <AUTHOR> http://www.snarky.ca/the-stages-of-the-python-3-transition <comment><USER3> The python 2.x to 3.x change will be studied for many years. How to completely rob an ecosystem of its momentum in one fell swoop. I still don't understand why 3 couldn't have had a mode switch defaulting to 2.x behavior. The whole debacle would have been avoided and all the ugly details would have been hidden behind the language implementation. It would have definitely been more work and you might even call it an ugly hack (and Ed DeCastro would likely have thrown a fit if one had asked his opinion) but it would have at least made the transition instant and seamless.

The present mess will - if not resolved in a much more drastic fashion - <USER2> more and more teams to switch away from python. It's a real waste of the potential that python had (and still has).

I never even bothered porting my code, I'm 'stuck' on 2.7 and anything new gets written in another language. Even bloody PHP, the language everybody loves to hate on, gets deprecation and backwards compatibility better than python.

<comment><USER4> That's the same approach that IE took for many years - IE7 embedded the IE6 rendering engine, IE8 embedded both the IE7 & IE6 rendering engines, etc. You could switch between them with a meta tag, or with developer tools.

It didn't stop IE from being robbed of momentum.

I think this is more a case study of what happens when fundamental assumptions that a technology ecosystem is based upon change. Things like string & collection types, async mechanisms, interface/protocol definitions, package managers, programming paradigms, developer preferences, and hardware performance characteristics are foundational to a language's definition. After all, the network effect that binds a language ecosystem together is all based upon being able to share code between multiple unrelated developers.

In Python's case, unicode happened. A lot of old Python code was written on the assumption that everything was a sequence of ASCII bytes; it was just plain broken in the presence of unicode characters. There's little you can do here other than accept that much of your ecosystem's strength is gone anyway and build for the future.

I suspect we'll see similar problems crop up in other languages in the near future; in particular, promisification in ES7 is a big threat to the existing Node ecosystem, which is all based upon callbacks. A language that jumps on the promise bandwagon early (Rust? Go? Elixir?) could rob Node of much of its momentum. Similarly, if Android & iOS win out over the web, that could lead to a big resurgence in Java or rise of Swift over server-side technologies like Node or Go.

<comment><USER5> so python is the IE of programming languages? yikes ;)

<comment><USER4> Python 2 is, yep. And Java, and C++, and PHP, and all those other languages that were super popular at the turn of the millenium but now feel really dated.

Actually, C++ has an even bigger claim to the title, because it now has "modern" versions that are much better, more standards-compliant, and have language features borrowed from newer languages...but a number of enterprises are stuck with no-exceptions, no-STL, no-move-semantics subsets because that's how all the existing code is written.

<comment><USER6> The IE metaphor is terrible for programming languages :)

I don't know about PHP, but C++ (and I suspect Java too) is backwards compatible and doesn't belong in the same class with Python. One can still compile older code and start using new features as they see fit, there is no hard break.

</comment></comment></comment></comment></comment><comment><USER7> I moved last month and I have been using Python since 1.5.2

What prevents me from recommending it to everyone I pass on the street is that the PyPy 3.x line is back on 3.2.5 which makes it not compatible with many libs which have a 3.3 minimum, which is most. Yes, I give to pypy.org [http://pypy.org/py3donate.html](http://pypy.org/py3donate.html)

Recommendations to folks

      * switch your daily interpreter to Python3
      * use tox, https://pypi.python.org/pypi/tox
      * use six, https://pypi.python.org/pypi/six
      * when you go native, go cffi, https://pypi.python.org/pypi/cffi

<comment><USER8> This kills it for me too. I rely on pypy, and I just can't see myself sacrificing my productivity by using Six.

Also, Python 3 neglected to fix one of the most annoying things about the language - default arg value

      def foo(x=[]):
          x.append(1)
          print x

      foo() # 1
      foo() # 1 1

Why is this still busted??

<comment><USER9> Can you (or someone) clarify what problem you're talking about? This seems to work as expected for me:

        def foo(x=[]):
            sum = 0
            for a in x: sum += a
            return sum
        print foo([3,5])  # 8
        print foo(x=[3]) # 3
        print foo([]) # 0
        print foo() # 0

Is it the fact that kwargs are required to have defaults? Or what?

<comment><USER10> The problem is that the default argument is mutable.

      def f(a=[]):
        a.append('v')
        print a

      f(['ok']) # ['ok', 'v']
      f()       # ['v']
      f()       # ['v', 'v']

<comment><USER9> Ah, thanks.

</comment></comment></comment></comment></comment><comment><USER11> > While some people feel stuck in Python 2 at work and are "depressed" over > it, others have reached the point of having transitioned their projects and > accepted Python 3, both at work and in personal projects.

It is not as simple.

I would be simpler if it was 2006 again. Python would have less competition on being an easy to use language, batteries included, with good enough performance (SMP wasn't as popular then). Java had a bad perception -- too bloated, enterprise-y, Javascript on the server wasn't happening much. Go wasn't there. Scala not as popular. In that context, people would eventually have switched to Python 3 even if it took some pain (security maintenance, some newer features etc), because GIL wasn't a big deal and it sure wasn't going to be Perl again (maybe Ruby for webdev?).

The situation is more difficult today -- Python has more serious competition. Once a team has found the time/money/excitement to switch to Python 3, it is a high chance they'll start looking and evaluating other languages/platforms/libraries (and I speak as a person who loves Python and used it professionally for 12+ years). It is now competing with Go, Elixir, Javascript, Scala, Julia, Clojure, even Rust, Java, and C++14. No matter how cool Python 3 is and what new features it brings, it will have a harder battle to fight just because of the current environment.

<comment><USER12> > It is now competing with Go, Elixir, Javascript, Scala, Julia, Clojure, even > Rust, Java, and C++14.

That would have happened no matter what. It's not really a bad thing, is it? I can't see how something better coming along is anything but great news.

</comment></comment><comment><USER13> If someone would make a Python 2.8 (or call it Python 5=2+3 if you like), I would pay for it. It must run basically every python 2.7 (or 2.6) program without changes. It should backport as many features as possible. The meaning of "str" and string literals (bytes or unicode) should be configurable on a per-file basis. It should have a print statement. Finally, it should be able to use all the binary modules from 2.7 (maybe after recompilation).

Currently at our work (in physics research), I have the feeling that people are giving up on Python. It's not worth the trouble to port to python 3 - especially because we can't switch all code at once; we'd have to support both versions for years. C++ which is also heavily used here is getting much nicer, with proper tooling it is even more pleasant to work in (code completion etc). We are mostly using Python for a) configuration files and b) quick and dirty scripts. For these cases, Python 2.7 will be good enough forever. If someone does something more complex, they'd probably use Python 3 - but they treat it like it's a completely different language rather than a new version of Python 2.

<comment><USER14> You'd have to pay a lot.

Jokes of mine like [https://github.com/dutc/rwatch](https://github.com/dutc/rwatch) and [https://github.com/dutc/didyoumean](https://github.com/dutc/didyoumean) and [https://bitbucket.org/dutc/astexpr](https://bitbucket.org/dutc/astexpr) are examples of adding major features to the CPython interpreter at run-time. It works fairly well in practice. It ends up looking like a `__future__`-import pragma that has interpreter lifetime scope rather than file scope.

`__future__` imports cannot be undone within the same file -- after all, they're pragmas scoped at the file level, not actual imports -- and it would make sense for these backported features to behave similarly, though at the scope of the interpreter's lifetime. That might not do what you want.

As you'd expect, the most superficial of Python 3's new features (syntax changes, `raise from`, &c.) would be easiest to backport. The bulk of the difficulty would be in merging those changes into Python 2.7. Making the result hot-loadable would be just as easy as in `dutc-rwatch`, though being able to toggle features on-and-off independently would require combinatoric effort with the naïve approach. You'd need to do something smarter.

All in all, it's wholly possible to do what you want, and you probably have the skill to even do it yourself.

I'd happily do the work myself, but only for lots of money. Unfortunately, the burden of both certifying the resulting interpreter as correct and of maintaining this fork would be large.

And then when you're on-boarding some fresh new post-grad you've just hired into your research group:

"Oh, we use Python 2.8 here. That's what we call Python 2.7 with an unsupported collection of modules that mutate the currently running interpreter to backport features from Python 3. Don't worry; it only breaks in ways that no one outside of this office will ever have a chance of ever understanding or helping you debug."

<comment><USER14> Oh, I should also mention that I found a way to embed Python interpreters within themselves. I have a couple of different ways to do it.

Here's one: [https://gist.github.com/dutc/eba9b2f7980f400f6287](https://gist.github.com/dutc/eba9b2f7980f400f6287)

Here's another: [https://gist.github.com/dutc/2866d969d5e9209d501a](https://gist.github.com/dutc/2866d969d5e9209d501a)

I've given, like, a million conference talks about this.

Better than creating some horrible Python 2.8 hybrid would be funding (or convincing me to volunteer to do) the work of completing this bridge. This involves writing 2/3 and 3/2 PyObject shims and figuring out some GIL and GC issues.

Then, within a given host interpreter, you'd be able to execute modules within a guest interpreter of whatever Python version you want.

With the shims and the bridge work, you'd be able to interact with these objects seamlessly from host-to-guest and guest-to-host.

</comment></comment></comment><comment> wh-uws As much flak as ruby has gotten for its performance issues and "magic" (read: heavy preference for use of meta programming) ...

One thing I think the ruby core team has done a great job of in my opinion is always having some awesome new features in the next major release that make you say "hey thats awesome" and make you want to upgrade despite any headache it might cause and the headaches are generally minimal.

Its been interesting to see python so publicly and painfully fail at that.

A whole new language version release that as far as I can tell only changed internal plumbing and went so far as to make you have rewrite print statements?

I just don't understand how they could think people would want to move to that.

<comment><USER15> Maybe Python 2 to Python 3.0 didn't introduce many "awesome" features, but 3.4 and 3.5 have been great.

<comment><USER16> asyncio and pathlib are absolutely killer features for me. I never much cared about Python 3 until asyncio came on the field. As soon as I saw some example code Guido had written, I started using tulip, and have been a willing participant on the wild ride it has taken.

<comment><USER17> Pathlib lets me down a bit -- I find myself having to str() the Path objects and lose their benefits, because the rest of the standard library doesn't use pathlib.

But asyncio is great. It shows how much better asynchronous programming can be when you have support from the language itself. I can't imagine going back to a byzantine system like Twisted even if they did manage to finish their Python 3 port.

</comment></comment></comment></comment><comment><USER18> I'm a long time Python user and I still tend to go for 2.7 over 3. When writing packages, I'll add support for 3 as an afterthought, but that's it.

The main reason for this and the main reason I prefer Python to other languages is the excellent and complete ecosystem of libraries. I've never seen a single Python library I wanted to use in the last 8 years that didn't have support for Python 2.7. I still run into those that don't support Python 3 well. So, using Python 3 means being terrified that I run into a case later on where I need to use some package that only supports 2.7 and I get stuck. With all of the other potential problems to run into while coding, why would I want to add that extra one, especially for something work-related?

I imagine this will continue being an issue until some major packages stop supporting Python 2.7 entirely and force people to make a choice.

</comment><comment><USER19> I was in denial stage until we picked Python 3 for a project at work. Then I went into anger and bargaining with the other dev on the project. Heh. _blush_

Being forced to come to terms with Python 3 has made me see the light, though. I still have a host of personal projects in Python 2, but anything new I write is in 3.

For me, it was concurrent.futures that pushed me into acceptance stage.

<comment><USER20> My experience was similar. An even bigger push in my case was the async stuff in 3.5.

It's going to be a little while before pypy supports 3.5, but once that happens, Python will be very well placed. Something like Tornado + pypy + py3.5 looks a lot like the app server stack of the future IMHO.

It has been a massive PITA, and probably could have been better handled, but hindsight is easy. The future looks bright.

</comment></comment><comment><USER21> The Python team is blind to the huge number of users that will never switch to Python 3. My industry (a large one) is currently standardized on RHEL 6 (and the CentOS equivalent), which uses Python 2.6! I'm not generally able to install arbitrary software or demand upgrades without a lot of beurocracy. I was looking forward to the day when we move to RHEL 7 with Python 2.7.

I've started to view the lack of changes in 2.7 as a feature. I would value the stability and lack of breaking changes. Knowing that Python 2.7 is on a limited timeline, and that the Python 3 folks (users and developers) are trying to kill off 2.7, I can't think of any reason not to switch to another language.

In short, my field is nowhere near "acceptance" of Python 3, and the "anger" stage will just make us (me at least) leave Python behind. I will never want Python 3.x, and I don't even want Python 2.8. I wish people would recognize that stability is a virtue for some of us...

<comment><USER22> The investment in porting your code from Python2 to Python3 should be many times smaller than porting to an entirely new language ecosystem.

<comment><USER23> Yea, but what's to stop Python 4 from doing the same thing as Python 3?

It's clear from the tone of this article that the python core devs haven't learned the value of backwards compatibility even after their huge python 3 failure. The author makes it seem like the problem preventing python 3 adoption was python users' unwillingness to accept the inevitable, rather than the poor migration path provided (especially initially).

In a massive, old production codebase, upgrading your platform is incredibly risky, even if no code changes are necessary. But when you have to make code changes in a dynamic language...

The thing is, not all systems have tests. Not all systems even have known, defined behavior. Upgrading these things can be a multi-month, very risky project.

Given that python 3's backwards incompatible changes were made for purely cosmetic reasons and there are few compelling reasons to upgrade, I totally get the anger people feel. I work in startups with relatively new codebases and good test coverage, but I can empathize with other types of organizations. I'm shocked that python devs don't, even after 7 years.

<comment><USER24> That is an incorrect characterization of the core development team.

[https://opensource.com/life/14/9/why-python-4-wont-be- python...](https://opensource.com/life/14/9/why-python-4-wont-be-python-3)

</comment></comment></comment></comment><comment><USER25> From LearnPythonTheHardWay.org:

> A programmer may try to get you to install Python 3 and learn that. Say, > "When all of the Python code on your computer is Python 3, then I'll try to > learn it." That should keep them busy for about 10 years. I repeat, do not > use Python 3. Python 3 is not used very much, and if you learn Python 2 you > can easily learn Python 3 when you need it. If you learn Python 3 then > you'll still have to learn Python 2 to get anything done. Just learn Python > 2 and ignore people saying Python 3 is the future.

Besides, judging from the number of DARPA-sponsored projects that require Python 2.7, the future is not going anywhere soon.

<comment><USER26> I'm so tired of seeing people act like LPTHW is some gospel. I tried using it to learn Python and absolutely hated it. It scared me away from Python. Especially the "don't ever use 3, use 2" thing.

And if you're going to assume that government entities use of a language is what is going to drive our market than you better stop using Python and hop back on to the ColdFusion and Fortran train.

<comment><USER25> It's not an act. LPTHW is my Bible. I retake the courses every Sunday. Saying that I should hop on the Fortran train for stating that even advanced fearless Python users opt for 2.7 is heretics!

</comment></comment></comment><comment><USER27> Personally, I can't wait to switch to python 3. I'm glad most of the community is finally getting behind it.

The cogs move slowly. We've only just upgraded our huge codebase to 2.7, but I expect we'll be on some release of 3.x in about two years. Almost all of our big list of dependencies now support 3.3+, so there is little reason to not upgrade.

</comment><comment><USER28> One frustrating part of attempting to transition is that not all libraries make it clear which Python versions are supported. Usually it's Python 2-only code that isn't clearly labeled as such, but it happens with Python 3 code as well. Sometimes a library doesn't work under specific versions of Python 3. The result is that library research takes longer than it would.

Please include this in the README for any project, even if it seems obvious.

</comment><comment><USER29> > I have yet to hear from someone who has used Python 3 that they think it is > a worse language than Python 2

the maker of the most succesful Python projects: Armin Ronacher

<comment><USER30> Just ask him about unicode for LOLs.

</comment></comment><comment><USER31> Those of us running Arch Linux have to check the rearview mirror to see the transition... back in 2010 when "python" started defaulting to Python3.

It wasn't the smoothest thing, but the world didn't end, either. Lots can be learned from it if you're thinking of making the move.

</comment><comment><USER32> Use 3. Unless you have a good reason to use 2, then use 2.

The world doesn't have to be perfect. Go make something.

</comment><comment><USER33> Can someone explain aiohttp server vs wsgi? It seems wsgi is the old standard but now you can run a server right in python, kind of like node. Are people running aiohttp instead of wsgi?

It seems like aiohttp can do everything that Flask can do. Are more people using this?

<comment><USER34> I want to know too. I did a little toy project with websockets in aiohttp and it was extremely enjoyable.

It'd be reassuring to know that other people see it as "the future" too, so I could invest into it more heavily.

</comment></comment><comment><USER35> I think one fundamental miscalculation went like this: early adopters will start writing new code in python3, and it will gradually become more normal for new code to be python3, and eventually it will snowball and python2 will become legacy.

The problem is that early adopters have a choice: python3, or a completely different language. And there are a lot of good languages to choose from, and early adopters are a more radical by nature.

That's why breaking backwards compatibility is almost always worse than it looks like on paper: the early adopters you are counting on to get you through the transition are also the most likely to leave your platform completely.

</comment><comment><USER36> What I think people figured out is you can port Python2 code to PyPy4. Then for all the testing involved, you remove any potential CPU performance worries and the GIL in one fell swoop.

Those two perks are worth more than any piddly features of Python3, which were already resolved in the ecosystem. I ported to PyPy instead of Python3 and gained those advantages, but can always port to Python3 when/if it ever gains traction. But I'm just as likely to migrate new projects to something else than Python3.

I view this blog as a long-form denial letter to himself.

</comment><comment><USER37> I like the fact that the 'python core' devs have moved on to doing something other than pointlessly fiddling with something that's reasonably good, ie python 2.7

As for 'lack of support', what are folks expecting support for? If there's a known security issue, somebody will write a patch.

</comment><comment><USER38> I am on CentOS and honestly for most of our applications there is just no compelling reason to change. We can do everything with 2 that we need.

I have seen some async stuff that looks interesting in 3 but not enough to make me change.

</comment><comment><USER39> I've always wondered why they couldn't package 2 and 3 in the same binary and let the user have a switch for which to use?

<comment><USER40> They don't need to. You can install all versions (at least tested 2.4 - 3.5) side by side without any conflicts, which makes the whole dispute which language version to use so silly.

</comment></comment><comment><USER41> >With five years left until people will need to pay for Python 2 support, ...

Is this some sort of thing?

<comment><USER42> It's just the author pointing out that the EOL for official support for Python 2 is 2020. After then, the Python dev team won't be providing any (free) support, so people who want to keep using it will have to pay for it in some way -- whether by investing time in maintaining a fork, or by paying someone else to do so.

The absence of a "Python 2.8" fork suggests that the idea of forking hasn't been popular enough to happen organically without someone putting money in, after all.

<comment><USER37> >The absence of a "Python 2.8" fork suggests that the idea of forking hasn't been popular enough to happen organically without someone putting money in, after all.

Or it's evidence that python 2.7 works just fine for many people.

</comment></comment></comment><comment><USER43> Wait, Python 3 has existed since 2008 and the transition is at 20%? How is that any form of success?

<comment><USER27> He said that 20% have reached "Acceptance", the last of the 5 stages, and said that most people are in stage 4 (Depression). That'd put overall progress at more like 80%.

This article also wasn't actually talking about _adoption_ of python 3, just applying the stages of grief to how people _feel_ about it. IOW, adoption of python 3 might still be worse than 20%, but 20% have accepted that they will need to adopt it soon.

Anecdotally as a full time python guy, I'd agree with the OP. The number of people interested in Python 3 has been growing a bit every year, and it seems opposition to adopting it at all has finally mostly dwindled :)

<comment><USER44> According to the python community survey of 2014, 80% of users are still using Python 2. Of course, that was two years ago, but 2014 was still six years after Python 3 was released. ([https://wiki.python.org/moin/2.x-vs-3.x-survey](https://wiki.python.org/moin/2.x-vs-3.x-survey))

If the python developers were any normal business, they would have abandoned Python 3 and returned back to developing what their customers obviously prefer; the problem here is that the python developers essentially concluded that because users get python for free, they aren't customers at all and the python developers can do whatever they want and their users will eventually be forced to fall into line.

Except they won't...

Python users are refusing to migrate to Python 3 as a community. It's a shame that the python developers have decided to try to show their customers who is boss because it won't work--the developers will lose. Many people will continue with 2.7 forever and fork the language in 2020 like Perl 5 day. The rest, like me, have dumped python and moved on to greener pastures.

<comment><USER43> Yep, it's true. My company started a major python2.7 project in 2015.

<comment><USER36> Pretty smart bet. You have production-ready PyPy to migrate to, and can always port to 3.x if it ever takes over (looks like never).

</comment></comment></comment></comment></comment><comment><USER29> Extended the maintenance timeline from 5 to 10 years is not helping the transition at all.

<comment><USER37> The extended maintenance timeline is an implicit admission that nobody wants to hop on their wagon.

</comment></comment><comment><USER45> There was a Simpsons episode[1] back in 1991 in which Homer, after eating a poisonous fugu fish, must deal with the five stages. It's an all time classic:

       Dr. Julius Hibbert: Now, a little death anxiety is
       normal. You can expect to go through five stages.
       The first is denial.

       Homer Simpson: No way, because I'm not dying!

       Dr. Julius Hibbert: Second is anger.

       Homer Simpson: [furiously] Why you little... !

       Dr. Julius Hibbert: After that comes fear.

       Homer Simpson: [worried] What's after fear?
       What's after fear?

       Dr. Julius Hibbert: Bargaining.

       Homer Simpson: Doc, you gotta get me outta this.
       I'll make it worth your while.

       Dr. Julius Hibbert: Finally acceptance.

       Homer Simpson: Well, we all gotta go sometime.

       Dr. Julius Hibbert: Mr. Simpson, your progress
       astounds me.

If only this Python transition were so simple.

[1] [https://en.wikipedia.org/wiki/One_Fish,_Two_Fish,_Blowfish,_...](https://en.wikipedia.org/wiki/One_Fish,_Two_Fish,_Blowfish,_Blue_Fish)</comment>


Practical Artificial Intelligence Programming in Java (free) - <AUTHOR> http://www.markwatson.com/opencontent/ So what do you all think of this book? <comment><USER2> Interesting quote from the author:

 _While I consider Java to be twice as "programmer efficient" as C++, I consider Common Lisp to be twice as good as Java for some applications._

</comment><comment><USER3> _Practical ... in Java_

That's an oxymoron.

</comment><comment><USER4> How is commercial use defined in terms of the book? It's not that free. Then again, if you use an algorithm for something at work, it does makes sense to reimburse the author. I just thought I should point it out.

<comment><USER5> The Noncommercial clause of the CC license refers to republishing the _book_. The algorithms can be used for anything you like, without obligation to the author.

</comment></comment><comment><USER6> Looks interesting. Thanks for sharing.

</comment><comment><USER7> Just checked the content. It is a "modern" book despite some old stuff in neural network, generic algorithm and expert system. It is a book mainly about natural language process with a bigger title "artificial intelligence" which should be carefully avoid in today's word.</comment>


Apple - google - you - <AUTHOR> http://swissmiss.typepad.com/weblog/2008/03/apple-google-an.html

<comment><USER2> I think that being constantly bombarded with images of the Apple and Google UIs, with their unattainable zenlike simplicity, has given me the hacker equivalent of an eating disorder.

Complex GUI -> GUI Complex

Not that it's necessarily a bad thing. I suppose a little cognitive purging now and then never hurt anyone.

<comment><USER3> GUIrexia?

<comment><USER4> Actually, I think GUIlimia works better on both counts...

</comment></comment></comment><comment><USER5> A way around accessing websites crammed with ads and unnecessary features is to access its mobile pages even when you are using your computer. Just compare the followings:

<http://bofa.com>

<https://www.bankofamerica.com/mobile> Which one would you prefer accessing?

You can use Google to search for mobile pages or use <http://tiltview.com> to be redirected to a mobile version of a page.

</comment><comment><USER6> Yeah, but when you're not a product company, your UI is driven entirely by business requirements. I'd love to see if Google's internal apps (e.g. HR) are as clean as their homepage? I know that Gmail and Greader are not "simple" or "minimal".

Complex requirements -> complex UI.

That said, if your UI is intuitive, and matches the users' mental model of the requirements, those complex UIs can still be very usable (e.g. gmail).

</comment><comment><USER7> Original Source: <http://stuffthathappens.com/blog/2008/03/05/simplicity/>

<comment><USER8> Some interesting comments on that one if you want to waste a minute or ten.

</comment></comment><comment><USER9> Vim : a blank screen or maybe just lines of "~"

<comment><USER10> Unfortunately there's a huge difference between Apple / Google style minimalism and vi style minimalism:

[http://rob.tc/index.php/2007/08/20/everyones-first-vi- sessio...](http://rob.tc/index.php/2007/08/20/everyones-first-vi-session/)

<comment><USER11> Just so you know, I modded you down due to blog spam. That was short enough you could have put it in your comment (not to mention, the "everyone's first VI session" skit is probably older than me, and definitely not due to the website you linked).

<comment><USER10> I'm sorry I wanted to give the blog where I heard it from credit...

</comment></comment></comment></comment><comment><USER12> Adwords is quite a bit more complicated than the cartoon of "your company's app".

<comment><USER13> True, but AdWords isn't meant for the average web-user.

The point is not to automatically simplify the design to its bare minimum its to consider your users needs and their ability to handle complex UIs.

Its a scale with power users on one end that want all those flags and options, and the average lay-person who wants things as simple as possible, always remember who your target audience is.

I strongly believe in following the Google approach of data-mining usage stats for your apps, to test different UIs on 1% of your audience and select the one with the best results.</comment></comment>


It costs 5x more to attract a new customer than to retain an existing customer. - <AUTHOR> http://tomfishburne.com/2013/11/acquisition.html

<comment><USER2> In my experience this is false for SaaS products. This is because you can get new customers by improving the amount and quality of passive traffic you get, or by optimizing ads. This has a very good return on investment. But if a customer is somewhat unhappy and wants to leave but you persuade them to stay by building that "one small feature" they really wanted your return on investment is terrible. The feature will take several days to build and test and in exchange the customer will be happy for a only month or two after which they will again come with unreasonable demands.

Retaining a customer makes a lot of sense when you are a consulting shop where customers pay you for the work you do. In a SaaS world where a small percentage of the customers is already responsible for 80% of the support load trying to retain them is often just not worth it.

How much effort you should put in retaining a customer is a function of the cost to require new customers (CAC) and the LTV of the customer. And for SaaS focusing on customer acquisition works much better. Or to put it really simply: if your goal is to grow your SaaS business at 20% month over month the few customers that want to leave but could be persuaded to stay are simply a distraction.

<comment><USER3> The most important thing in any business is that you really need to know who is your customer and who is NOT your customer. If you master that, then everything else is "easy".

Here is my take on this:

\- if customer is leaving because he or she is demanding some feature to be implemented, then he or she is not your customer anyway.

\- if customer is leaving because your service seems too expensive, then he or she is not your customer anyway.

\- if customer is leaving because he or she is generally unhappy about the service, it is important to work hard to understand customer use case and whether your solution is really for that customer

\- if customer is leaving because your service does not work or it is flaky, then... oh well fix it and try to convince customer via nice support. Or maybe that feature you are selling should not be part of your service...

</comment></comment><comment><USER4> I wonder if the same sort of idea applies to retaining employees, girlfriends, etc.

<comment><USER5> ...with the caveat that there's negative cost associated with retaining bad ones instead of cutting them loose and finding better fits.

<comment><USER6> the same is true of bad customers and clients

<comment><USER7> only if keeping a customer is exclusionary to having another in its place (e.g. consulting or services with limited 'slots' for customers).

</comment></comment></comment></comment><comment><USER8> Out of interest, how many people here have been in a startup company where it has been _really_ hard to gain new customers, but once they realise what you are doing for them they love you forever?

This was my position ten years ago. The company folded because it was just so expensive to get new customers and the bubble burst so we couldn't get any further investment.

<comment><AUTHOR> We've had this issue with our startup since our competitors are either a Goliath in the space or well-funded startups. Yet we probably get at least a few emails each week from users who just love what we do. We've also had a fair share of users email us asking us how they can give us money, because they don't want us to disappear. So, I guess, we're doing something right.

<comment><USER9> Do you have some sort of referral system in place? If people like you enough to email you, I bet they'd email their friends too if you give them a hint and way to do so.

<comment><AUTHOR> Yup. People even earn silly badges for referring their friends and, actually, we do get a high conversion rate from user invites. There's just not enough eyeballs hitting the site outside of users that search for us directly.

</comment></comment></comment></comment><comment><USER10> Lovely blanket statement.

There are plenty of cases where it costs 25x more to attract a new customer (Think aviation), and 25x less to retain an existing customer (Think Twitter). It really depends what you're building and who you're selling it to.

</comment><comment><USER11> Of course it does. Most sales organizations know this.

There are still reasons to hunt new customers though:

\- You don't want your business to fail at the loss of one customer.

\- New customers can help you push the product.

\- It's possible to simultaneously invest in new and existing customers if both are profitable activities.

\- In a SaaS model, your existing customers keep revenue flat. New customers grow the top line.

</comment><comment><USER12> Great post. Wrote about how much effort it was to fill my beta list here: [https://medium.com/what-i-learned- building/3408064eda35](https://medium.com/what-i-learned- building/3408064eda35)

</comment><comment><USER13> I learned this fact from the temp in an episode of the Office.

</comment><comment><USER14> Does that rule really apply to regional monopolists, though?

This is why I don't like some of the states' proposals for bringing fiber there by giving even more such regional monopolies to companies. Fiber is great, if they do make it happen, and don't trick us like they did the last time when they received hundreds of billions of dollars, but giving them regional monopolies just means we'll go through this again in 10-15 years, when we'll need to upgrade to quantum Internet or whatever.

The solution is to let companies fight it out, not give them special privileges/monopoly in order to "bring something" to a community.

<comment><USER15> > Does that rule really apply to regional monopolists, though?

Exactly.

Comcast is a bad example in this article, because they have near 100% complete monopoly control over the vast majority of the markets that they serve. (And what little competition they have from DSL is almost never remotely competitive)

If you have 100% monopoly, then you _can_ have terrible customer service, spam everyone with marketing offers, and have it work. Your a monopoly, your customers have no other choice than to do business with you, regardless of how terrible you are.</comment></comment>


Samsung installs keylogger on its laptop computers - <AUTHOR> http://www.networkworld.com/newsletters/sec/2011/032811sec2.html <comment><USER2> Am I the only one that wipes the OEM operating system as soon as I buy a computer? Even if I'm putting Windows right back on it?

I started doing it because of the crap they bundle in there, but this seems like an unintended good reason to do so as well.

<comment><USER3> The only problem is that now you have to find a way to download the iso's from microsofts' servers to do it now because most laptop manufacturers only give recovery media that gives you all the crapware when you reinstall.

It wasn't that long ago that you got actual windows install media when you bought a computer.

<comment><USER4> > It wasn't that long ago that you got actual windows install media when you > bought a computer.

Oh, I'm afraid that was actually quite a long time ago.

However, the last time I checked, Microsoft did impose a condition that mostly affected laptop manufacturers, such that they were required to provide any genuine Windows customer with real Windows media on request, rather than just some not-quite-real-Windows recovery media. Is this no longer the case?

If that is still a requirement for installing OEM Windows on laptops for sale, maybe a campaign where a significant fraction of Samsung laptop customers suddenly started demanding real media would attract the attention of whatever fool thought this was a good idea. This is not mutually exclusive with an expensive class action lawsuit, of course. }:-)

<comment><USER5> Back in... 2006?, when purchasing a Dell I put down $10 to receive a plain Jane XP Pro installation disk, in addition to the crapware-infested restore disk that came with it by default.

More recently, helping a friend with a Dell purchase, I could no longer find that option in the online order flow. Maybe if you call them and ask...

(I'm not a regular Dell purchaser.)

<comment><USER6> I've reinstalled Windows on Dell computers for friends that didn't have the discs. I just called Dell, and they mailed me a plain Windows install disc for free. Awesome! I'm not sure if they still do that.

With HP, I wasn't even able to pay for an install disc of any sort, and since the recovery portion of the HD was gone I had to buy a copy of Windows. I'll never buy an HP computer for this reason.

<comment><USER5> I'll add that that disk was actually stolen in a burglary. When I subsequently needed to reinstall, a friend burned a copy of his XP Pro disk and mailed it. In combination with the code on the license sticker on the machine, this worked fine.

(I'm hesitant to download an image from an unknown source.)

I don't know about Windows 7 -- I seem to recall reading that installation disks for it work somewhat differently, but I don't recall the details.

<comment><USER3> If you look you can get the windows 7 isos from microsofts' servers (or in this case their distribution network through digital river).

These have worked for my OEM licenses, XP though I remember you needed to use the disk with the correct service pack to install with your software key. (A sp1 key wouldn't work with a sp2 disk and vica versa.)

<comment><USER7> Links? I'd definitely be interested in this seeing as how I just bought a Lenovo and want to wipe it.

<comment><USER3> google: windows 7 iso (first result) (mydigitallife)

The links that say msft-dnl.digitalrivercontent are the same as when you buy online (at least when I bought my win 7 professional license for my desktop the iso linked is the same as the one I downloaded).

Those are probably the only ones I would trust, make sure you are indeed going to digitalrivercontent website, download appropriate language and version/arch (prof, home prem 64 or 32)

<comment><USER5> Does this still apply?

[http://www.windowsvalley.com/unlock-all-editions-from- window...](http://www.windowsvalley.com/unlock-all-editions-from- windows-7-iso-image-x86-and-x64/)

 _To get all editions-

4\. Just delete the file and finally create the bootable ISO and burn your unlocked disc._

<comment><USER8> Yes, that should work.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Off-topic: I wrote a _very primitive_ passive keystroke logger a few years ago (just to demonstrate how they work). I still have the source code and folks email me about it often:

<https://github.com/16s/16k>

My example is _really trivial_ and it only works on Windows, but it works well and demonstrates the concept of passive keystroke logging. Unlike system wide hooks, passive logging just monitors the key states. Sort of like when you are playing a video game and press the 'P' key. The game pauses because it's monitoring the P key's state (up or down) and can tell when it changes. Extend that concept to the entire keyboard and you have a passive keystroke logger.

Passive loggers are more challenging to detect as well and they run just fine as a normal user (no need to be root).

<comment><USER10> Just use SetWindowsHookEx() with WH_KEYBOARD_LL. Here's some ancient proof of concept code I wrote for detecting user activity (keyboard and mouse):

<https://gist.github.com/a95f198292c9e453e054>

This was originally to be used with malware that needs to run when the user is away from their workstation. You can access p->vkCode in KeyboardProc() to see which keys are pressed.

One interesting thing to note is that if you remove the invisible window/message pumping loop, the program behaves erratically when processing the low-level inputs. I never looked into this.

<comment><USER11> This is really really easy to detect for malware analysts. One of the first things you look for in memory on a compromised system is hooking. Most rootkits use hooks at different levels to hide or monitor things.

Strangely, on a clean system most hooks tend to be from the Antivirus (usually hooking filesystem calls for on demand scans).

<comment><USER10> Definitely. Any amateur effort will generally involve SetWindowsHookEx() + DLL injection to capture keystrokes. The intention was to move this up to ring 0 eventually, but I decided to work on more lucrative things instead.

<comment><USER11> Actually, I'm speaking at DC4420[1] on the 20th of April on evading defence mechanisms, I think I might bring this up there.

[1] - <http://www.dc4420.org/>

<comment><USER10> Cool, I will check it out.

</comment></comment></comment></comment></comment></comment><comment><USER12> "The statements that Samsung installs keylogger on R525 and R540 laptop computers are false.

"After investigating into this matter, it was found that the software installed was in fact Vipre, not the commerical keylogger called StarLogger. The confusion arose because Microsoft's Live Application multi-language support folder, 'SL' folder, was mistaken for StarLogger

"(Live Application is Microsoft's application which provides messenger, email, video, photo gallery functions. Depending on the language, under C:\windows folders 'SL' for Slovak, 'KO' for Korean, 'EN' for English are created.)"

<http://www.samsungtomorrow.com/1071>

</comment><comment><USER13> This strikes me as dubious at best. I think a more likely explanation is that his detection software is flagging anything with the path "c:\windows\SL" as malware.

He says "This key logger is completely undetectable," which is clearly untrue (he has allegedly detected it).

If it's logging his keystrokes, it's either storing them locally or sending them off somewhere else, or both. If he's as qualified as he says, he should be able to find out which (find a file that increases in size after a lot of keystrokes, use Wireshark...).

<comment><USER14> Yeah, except Samsung admitted that they installed it in the followup article.

<comment><USER13> I stand corrected, and should have read the followup article.

I don't think the Samsung "confirmation" brings me to 50% confidence that Samsung actually was logging and capturing people's keystrokes, though.

I would still like to see what the keylogger is actually doing - storing, transmitting, what?

</comment></comment></comment><comment><USER15> Talk about burying the lede...

And what does he mean by "After the initial set up of the laptop"? What exactly did he do? Couldn't it just mean that the security software he is using to do the scan or the media he is using is infected? I just think this sounds fishy until he's verified it with a completely different set of tools.

<comment><USER16> Not only that, but there are legit reasons to include a keylogger as part of a laptop build out. Every computer has, or should have, this kind of auditing capacity. The question is a) whether it's turned on by default and b) whether any information is being transmitted on the sly. In all likelihood, this was either some sort of mistake, or the keylogger is intended for use by the computer's owner -- not by Samsung.

EDIT: Sorry for scaring people. Listen, I HATE keyloggers and other invasive software. Here:

<http://bit.ly/2U3iAH>

My point was that I can see a legit need for low-level auditing by whoever owns the PC. Including such a package that's turned off by default, might be better than forcing a worried parent to sift through 12 keyloggers on Google, half of which are malware, a quarter of which don't work, in order to find out if her 12-year-old is composing YouTube dances and uploading them to 4chan.

<comment><USER17> Hey guys, I disagree with codingthewheel's idea, too, but we need to get a little meta here:

His comment is not spam.

His comment caused discussion.

His comment is an opinion, not a false fact.

There are no personal attacks of any kind in his comment, and his language is fine.

His argument is simply unpopular.

None of your responses indicate any of the usual legitimate reasons for downvoting.

So why the downvotes? Do you really want HN to be an echo chamber instead of an arena of civil discussion?

<comment><USER18> I think the downvoting in this case is equivalent to saying 'your point of view is dangerous'.

<comment><USER19> No, the equivalent would be to click _reply_ , and then type "I think that your point of view is dangerous."

<comment><USER18> Meaning can be inferred from the down-voting. I think that was probably the meaning behind most of the negative votes.

I actually believe that it's okay to use voting to express whether you agree or disagree with a point. Where's the harm?

I think that the experience of reading HN is enhanced when there's contrast between popular and unpopular ideas. If a post is unpopular, it doesn't mean that I don't read it. If anything, I might pay more attention to it.

In some cases its lack of popularity might spark more debate; like it has in this case.

<comment><USER20> _I actually believe that it's okay to use voting to express whether you agree or disagree with a point. Where's the harm?_

This is a bad point of view and is what is leading to the degradation of HN as a place for people who see the world through a different lens. We have already lost a lot of beautiful minds due to heard voting. Downvoating is for items that do not belong on HN, nothing more nothing less. If you downvote because you do not agree with an idea you are actively suppressing discussion, no matter how strongly you disagree. Many time from people more brilliant that ourselves.

<comment><USER18> The voting mechanism is a tool. People choose to use tools in whichever way they see fit. A culture will develop and form according to the norms which are set around group usage.

On HN people I've found that many people use voting to signal whether they agree (or disagree) with something. If that wasn't the case, I'd see my karma rise - rather than rise, fall and fluctuate.

As far as I can tell, if something shouldn't be on HN, we have the ability to flag a post.

I can agree that a post shouldn't needless be hammered into negative space, just as a person's point of view shouldn't be needlessly trampled on in meat- space. But I think that down-voting in general has found a place.

We can say that it might be better to never down-vote - but many users have the ability, and it's a regular practice. Neglecting the fact is a little like ignoring the fact the emperor is wearing no clothes.

<comment><USER20> _As far as I can tell, if something shouldn't be on HN, we have the ability to flag a post._

You cannot flag comments downvoting is there to discourage, trolls and abuse.

 _We can say that it might be better to never down-vote - but many users have the ability, and it's a regular practice. Neglecting the fact is a little like ignoring the fact the emperor is wearing no clothes._

I am well aware of that and it has lead to a decline in the standard that HN used to be (while my account may not reflect it I have been around here for a long time, and witnessed the decline first hand). It has been complained about on HN ad nasium. No one is neglecting the fact that it happens, I am just stating that doing so makes HN a worse place the results are obvious and have already lead to some valuable people leaving.

<comment><USER18> To flag a comment, click on 'link' and then 'flag'.

I think the decline is largely due to a rise in meta-discussion about HN and a rise in articles which are mainly designed to self-promote their authors.

I apologise for playing my part in the first ... ;P

<comment><USER20> _To flag a comment, click on 'link' and then 'flag'._

Thank you, you learn something new every day.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> [http://www.networkworld.com/newsletters/sec/2011/040411sec1....](http://www.networkworld.com/newsletters/sec/2011/040411sec1.html)

 _Samsung responds to installation of keylogger on its laptop computers_

 _The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."_

 _In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners._

[…]

 _We contacted three public relations officers for Samsung for comment about this issue and gave them a week to send us their comments. No one from the company replied._

</comment><comment><USER22> _Mohamed Hassan, MSIA, CISSP, CISA graduated from the Master of Science in Information Assurance (MSIA) program from Norwich University in 2009_

Really bad way to start an article. Who cares about all these qualifications? Did he find a key logger and how did Samsung respond?

Unfortunately, they have decided to make us wait for the response. That seems really lame IMHO.

<comment><USER23> I think it means that the author does/did not expect you to be the target audience. To you, an appeal to authority does not mean much, but for someone who does not have much technological knowledge, it may have some weight.

Maybe they were trying to pull views from yahoo finance or something?

<comment><USER24> Perhaps he wasn't getting any response from Samsung, and posted this to prod them into action. Still this seems like a really terrible way to end an article:

 _In the next article, Mr Hassan discusses how Samsung responded to his discovery._

</comment></comment></comment><comment><USER25> _The findings are false-positive proof since I have used the tool that discovered it for six years now and I am yet to see it misidentify an item throughout the years._

Thus, it is false-positive proof? Why wouldn't he test it against other tools? Why wouldn't he try to find out as much about this as you can before writing an accusatory article?

Further, why is he running a full-system security scan on a fresh installation of Windows? Is that normal? If this is a genuine accusation of wrongdoing, then I think that the actual sequence of events and his entire methodology should be disclosed.

<comment><USER26> > Further, why is he running a full-system security scan on a fresh > installation of Windows? Is that normal?

If you're a bit paranoid or don't trust the manufacturer (with good reason, apparently) it makes perfect sense to run a scan on a fresh system after initial setup. It's probably not a normal thing to do - pausing all usage of the system to check it for malware - but it makes sense.

> the actual sequence of events and his entire methodology should be > disclosed.

Eh, not really. We just need to run the same scans (using lots of different software) on other Samsung laptops, both the same and different models, and see if it detects the logger. If the logger is found, then he's right, if it's not than he's wrong (and probably it's his own software which is infected). His methodology only matters if no supporting evidence for infection is found.

<comment><USER25> > If you're a bit paranoid or don't trust the manufacturer (with good reason, > apparently) it makes perfect sense to run a scan on a fresh system after > initial setup.

That's what I mean. If he had reason to not trust them, then he should share his reasoning. It would help us to understand why he was conducting a post- installation scan in the first place. It is not normal behavior otherwise.

> Eh, not really. We just need to run the same scans (using lots of different > software) on other Samsung laptops, both the same and different models, and > see if it detects the logger.

Very true. I meant that it would help us to maximize our success with duplicating his method, which would translate into a higher detection rate if the logger actually exists. If one isn't found, it would help us figure out why he might be seeing what he sees.

<comment><USER27> > _That's what I mean. If he had reason to not trust them, then he should > share his reasoning._

From the end of the article:

> _Mohamed Hassan, MSIA, CISSP, CISA is the founder of NetSec Consulting Corp, > a firm that specializes in information security consulting services._

Most likely a client discovered what appeared to be a keylogger and brought it to NetSec for investigation. Part of that process would have likely been to purchase a new Samsung laptop as part of a simulation to figure out how the keylogger may have been installed. Finding it on a fresh purchase must have been quite surprising!

</comment></comment></comment></comment><comment><USER28> It would be interesting to hear from the HN community, people with Samsung laptops, if they've had this happen, or if they check now, if this keylogger is discovered.

<comment><USER29> Currently on an R720 and I've no SL folder, either.

I've poked around various locations on the machine and run some scans with a number of different tools, but I've discovered nothing untoward, as yet.

My attestation is somewhat of an irrelevance, however, as I've no way of accurately replicating the environment in which Mr Hassan carried out his research. It looks as though I shall simply have to wait and see how this all plays out over the coming days.

</comment></comment><comment><USER22> Samsung's response is here: [http://www.networkworld.com/newsletters/sec/2011/040411sec1....](http://www.networkworld.com/newsletters/sec/2011/040411sec1.html)

<comment><USER30> That's kinda mind blowing.

Use of such a laptop in the UK would appear to contravene the Computer Misuse Act (on at least a count of unauthorised computer access), if you have a Samsung with this software I suggest you hire a good lawyer and shop around for investment opportunities for your payout.

What are the chances that Samsung have also breached government secrets acts with this in several countries!?

<comment><USER2> What's mind blowing is that anybody believes what a support department says.

<comment><USER30> I'm trusting the report here but it was at least second level and they referred somewhere for help with the query so it appears it was 3rd level support. Certainly attributable to the company in such a case.

</comment></comment></comment></comment><comment><USER31> Thank heavens this was software based - now imagine if they shipped keyboard firmware with a built in keylogger! Who knows, may be some do - that would be nearly impossible to detect as they can encrypt it.

On a related note - My bank requires me to use a on-screen virtual keyboard to log into the online account. The keys of this virtual keyboard are randomly rearranged every time it is invoked. That could certainly beat keyloggers.

<comment><USER32> You'd think so, but actually there exist keyloggers that take screenshots on mouseclicks, precisely to bypass this.

<comment><USER31> Of course :) On the other hand, security is about putting as many deterrents as practically possible - nothing can be 100% secure. So to that extent it is still better to have measures like on screen keyboard than not. And then even if you somehow perfected the on-screen keyboard to not give out screenshots - there is always browser based malware that can send your session or creds to the attacker without bothering about keylogging!

</comment></comment></comment><comment><USER33> I would have expected this to show up from many different sources. The fact that only one person is reporting this makes the story somewhat suspect. Surely he's not the only Samsung owner to run a malware scan.

<comment><USER34> > Surely he's not the only Samsung owner to run a malware scan.

On a machine he just bought, without installing anything else?

Besides, someone has to be first.

<comment><USER33> He noticed this back in February so I'd think that's a fairly long time to be the only report. A few other things bothered me about the article: the heavy handed reference to Sony's rootkit, as others noted, is inappropriate since the Sony rootkit was clearly a deliberate decision. In this case, the most we can say at this point in time is that he found a keylogger on a Samsung computer. Whether it was put there deliberately or not is unknown. Which leads to my further gripes with the headline (which flatly implies that it was deliberate), with the fact that he didn't retain the evidence but chose to write about it (which means noone can verify his findings), and with his apparent lack of curiousity about whether the keylogger was operational and where it might be sending its data.

<comment><USER35> _On March 1, 2011, I called and logged incident 2101163379 with Samsung Support.

...

The supervisor confirmed that Samsung did knowingly put this software on the laptop to "monitor the performance of the machine and to find out how it is being used."_

<comment><USER33> Ah. Missed that bit. Thanks.

</comment></comment></comment></comment></comment><comment><USER36> This isn't the first time Samsung did this kind of thing. On their android phones, they have a system called CarrierIQ that is deeply embedded into the system and can monitor practically all aspects of phone usage.

<http://forum.xda-developers.com/showpost.php?p=11763089>

</comment><comment><USER37> So, has ANYONE verified this independently yet?

</comment><comment><USER38> Here's a plausible scenario under which Samsung is innocent:

1) Starlogger is part of the security software Hassan installed, and 2) The Samsung person he reached didn't know what he was talking about

I have no idea if this is really what happened, but consider:

Hassan says _After the initial set up of the laptop, I installed licensed commercial security software and then ran a full system scan before installing any other software._

This could simply be an embarrassing mistake, compounded by the ignorance of some call center person... I'm waiting for confirmation from others with Samsung systems.

</comment><comment><USER39> I am skeptical this is true. Some phone tech support guy overseas is not official confirmation of official policy. I would like to see more widespread confirmation ('happened to me too!') before people start dumping on Samsung.

Also missing, evidence it was turned installed and running at bootup, evidence it was sending information anywhere. It should be fairly easy to use the laptop, connect to the internet, and see what data is sent to what server, owned by whom. THAT is evidence. These are just random unimportant files in some random directory until then.

</comment><comment><USER40> I wonder where it stores all this logged information. Despite a lot of references to the Sony rootkit, the author doesn't specifically call this a rootkit other than to say it's "completely undetectable" (not really). There's also mention of traces of the program being found in c:\windows\SL, which means its not very well hidden. More information is required.

</comment><comment><USER41> However, a scan result does not mean much, a full proof would be if he found the keystrokes actually logged in some file and/or being sent to somewhere.

Btw, I am typing this from a Samsung R510 laptop. Fortunetaly I don't use crappy windows. I run Gentoo Linux.

<comment><USER42> "Fortunetaly (sic) I don't use crappy windows. I run Gentoo Linux."

A reasonable observation followed by a stupid effectively ad hominem attack. The reason your Linux PC is free from the Samsung keylogger (if it does exist) is only because there's little to no incentive to bother with attacking Linux users. Do you really believe Microsoft has spent billions in research and hiring the brightest minds in technology to create an inherently insecure OS, or is it more likely that the incredibly large userbase creates much greater incentives for security attacks?

<comment><USER43> No, the reason his computer does not have the keylogger is because he installed an operating system other than the one it came with (assuming the story is accurate). Even if he had reinstalled Windows, he would not have it.

<comment><USER44> Unless the BIOS knows how to install Windows keyloggers in Windows root partitions and Linux keyloggers in Linux root partitions.

</comment></comment></comment></comment><comment><USER45> It's a disappointing cliff-hanger ending. Without more information it's impossible to say whether this is just some malware accident or a deliberate policy by Samsung. I'm inclined to think that the former situation is more likely.

<comment><USER46> The link to the part where someone from Samsung confirms they installed the keylogger so they could lern how people use the machines.

<comment><USER45> Second part [http://www.networkworld.com/newsletters/sec/2011/040411sec1....](http://www.networkworld.com/newsletters/sec/2011/040411sec1.html)

</comment></comment></comment><comment><USER47> I own a HP laptop which recently had its mother board replaced. The machine came with an OEM installation of MS Windows Vista - I didn't reinstall / remove but I did lock out and changed the password for the 'Administrator' account. To my surprise when the laptop came back from repair (official HP on warranty repair) the Administrator account was unlocked and the recent activity on that account indicated that video files were being run recently from it.

I assume that they must have a way to unlock the account I just hope it's not a full time remote control like mentioned in this article. You can be sure of one thing - I will never buy from HP again.

<comment><USER48> You realise you can unlock/reset passwords just by booting a CD? Locked is just a small setting in a file on disk.

As far as playing video files, that seems like it might have been part of testing - making sure it can handle a tiny bit of stress.

<comment><USER47> By booting an OS from a CD - yes I knew about this. I just hope it isn't a built in 'unlock' utility.

If that was the case then OK. I also understand running things to check if they work - that's why I didn't make a problem out of it.

I am not OK in changing/running things on the machine without contacting the owner. This makes a user uncomfortable.

</comment></comment></comment><comment><USER45> The second part is more interesting, but it doesn't give any indication as to whether the keylogger was installed on a small number of internal test machines which then accidentally escaped into consumerland, or whether this is a more widespread practice. If it is widespread then Samsung are really entering a world of pain in terms of lawsuits.

</comment><comment><USER49> Is there not a hole in this argument? Why wouldn't he first question the store at which he bought both of these Samsung laptops? This isn't solid evidence that the source of the keylogger is from the hardware manufacturer and is borderline defamation.

<comment><USER50> The following line from the article in question leads me to believe that he did not purchase the second laptop from the same store.

"I returned that laptop to the store where I bought it and bought a higher Samsung model (R540) from another store."

I will wait for confirmation/proof in either direction before drawing any conclusion regarding possible "defamation" on the authors part.

<comment><USER49> Indeed, we shouldn't jump to any conclusions. My point was that the author appears to already have, especially given the article's title. There are lots of situations that could explain to origin of the malware (reseller, pre- installed bloatware, etc), but the author chose one.

</comment></comment></comment><comment><USER51> One user reporting an incident does not a story make. Lazy journalism.

Also: a possible publicity attack from someone who has just started up a security consultancy... But this could rebound on him due to his EXTREMELY sloppy work and total lack of forensic skill.

</comment><comment><USER52> Could be any number of reasons for this. The store may have messed up and had its computers infected by a virus. Or Samsung itself. Or user error, like other people pointed out already.

What I would be interested to know is if the logger actually phones home, and if so, to where. That would give fairly conclusive proof if Samsung did it or someone else. If it's just logging stuff locally then what's the point? Maybe Samsung (if Samsung is indeed the culrpit) could claim it's for tech support reasons?

</comment><comment><USER53> If it's true I wonder if Samsung actually does that deliberately or were their production systems hit by some malware.

<comment><USER54> It's possible --- and the customer service manager he was talking to just said anything to get off the phone, even if it meant lying about something he didn't understand. Maybe he didn't even realize it would paint his company in a bad light.

</comment></comment><comment><USER55> If you think logically, why they would even do that? What can they get out of logged data. Can you give me the answer?

I think you are exaggerating this thing too much.

<comment><USER56> Let me pull on a conspiracy theorists hat here, and give one possible reason:

When you purchase a laptop, at least in my experience, it records the serial number of the laptop purchased. Now, generally you don't purchase a laptop in cash (At least in the states, but that really has to do with overzealous cops who think anything over a hundred dollars is drug money), you use a credit/check card. What this means is at checkout they have an address, and name (From the card) and a serial number.

You go home, and type away, log in to Facebook, do whatever you normally do, all the while keylogger is running away in the background. NSA walks over to Samsung and says "Hey, can we get those keylogger results? Great, here's your million dollars", takes those, then sees that John Doe is searching for poison on Google. They run off, and arrest him.

Basically, that information would be NSA's wetdream.

Is this true? Probably not, but it's one possible motive.

</comment></comment><comment><USER57> This in no way compares to the Sony Rootkit fiasco. Even if the keylogger is still there I'll hardly doubt that Samsung installed it on purpose.

<comment><USER58> It's an interesting one.

If it was Samsung's responsibility (big if at this stage obviously) then I'd actually be more scared if they didn't install it on purpose.

I get that large corporations intentionally do bad things for money but I kind of assume that they're competent enough that they don't _accidentally_ let their master install for a new laptop get infected with a key logger. I'm not saying that I believe them to be completely competent, just that the level of cock ups I expect from them doesn't run to this.

For me if they did install it accidentally then that's worse than them installing it deliberately for some ill considered audit or support purpose.

<comment><USER59> > I kind of assume that they're competent

"Never attribute to malice that which is adequately explained by stupidity."

<comment><USER58> Possibly I should be clearer.

I assume them to be broadly technically competent in so much as they won't let their master install get infected with a key logger.

I'm happy to accept that they may be incompetent when it comes to making decisions about whether it would be a good idea to install a key logger for support or audit purposes.

</comment></comment></comment></comment><comment><USER55> I am trying to find "Mohamed Hassan" on Internet. Now there is a doubt in my mind that he is even a real person?

</comment><comment><USER60> Does this mean a Samsung exec will get some jail time just like the Utah University student who did the same thing and changed his grades?

[http://findarticles.com/p/articles/mi_qn4188/is_20070107/ai_...](http://findarticles.com/p/articles/mi_qn4188/is_20070107/ai_n17107665/)

</comment><comment><USER61> Well, if this turns out to be true, no more Samsung in my family.

</comment><comment><USER62> It sucks when companies start to impose crapware on consumers and defend it as useful.</comment>


Ask HN: Learning Ruby beyond Codeacademy - <AUTHOR>

I've been learning Ruby of late - my background includes some coding, mostly enough-to-get-by Javascript and PHP, but I'm in marketing and not currently any sort of engineer. However, I've got a side project I want to get going and I'd really like to do it myself... at least get it up and running, as much for ego as anything else. So, I'm teaching myself Ruby (at 33 and married, going back to school isn't a particularly feasible idea).
I've gone through quite a bit of the Codeacademy classes, but I'm not sure where else I should be looking. I'm also curious what complementary technologies I should be looking into - Rails, I assume, but should I be digging more into things like cloud server administration? I've set up web servers on AWS, but never anything particularly complicated.
Thanks,
- A marketer who wants to be a coder because coding is more fun <comment><USER2> Learning by Doing.

I suggest you to start building something. If you have no idea what you want to build, ask your family, friends or co-workers for a neat idea that solves a problem & try to build it. if you are unsure about your skills, then pick a dead simple idea. complexity of idea is not important. More importantly, the satisfaction taking an idea & turning into reality is amazing.

This is how you will go from a novice learner to experienced developer that ships code that people actually use.

</comment><comment><USER3> Check out Learn Ruby the Hard Way [0]. You don't have to do every exercise, but check out the titles and do the ones with names of stuff you might have only skimmed over in code academy. CA is good for teaching syntax, but L*HW is good for teaching you to actually make stuff using good practice.

[0]: [http://ruby.learncodethehardway.org/](http://ruby.learncodethehardway.org/)

<comment><AUTHOR> Danke, will check it out.

</comment></comment><comment><USER4> Codeschool is awesome, and gets pretty deep into everything you'd want to know.</comment>


Learn Datalog Today Ported to DataScript and Clojure (JVM) - <AUTHOR> https://gist.github.com/fasiha/2ab2c1cb203c26a2b63532831f1b6021 <comment><USER2> Thanks! This came at the perfect time. I just started working through learndatalogtoday.org plus doing my own DataScript practice in Clojure. I just ran all your examples without a hitch.

After working through learndatalogtoday I'm going to try translating "A Beginner's Guide to SQL" ([http://www.sohamkamani.com/blog/2016/07/07/a-beginners- guide...](http://www.sohamkamani.com/blog/2016/07/07/a-beginners-guide-to- sql/)) into DataScript. I don't think I'll totally "get" Datalog/DataScript until I get through that. If anyone has done something similar I'd love to see it. I'm not finding many good introductory tutorials for DataScript.</comment>