Tell PG: HN seems to be broken... - <AUTHOR>

At the moment, items from about number 61 onwards are nearly all Ask / Show text submissions, many low scoring, and some as old as 999 days... <comment><USER2> I assumed this was a feature. After you've read a lot of the current news, here are some interesting "Ask HN" questions that not too many people have seen yet, and now look at some of the best submissions in HN's history.

</comment><comment><USER3> I've been experiencing this problem for over a week now.

</comment><comment><USER4> After #150 seems to be normal again.

<comment><AUTHOR> And the anomolous ones seem to be getting pushed down the stack (the problem ones start at about 70 now) so it should work itself out of the system.But it would be interesting to know what went wrong.

The oldest was about 3.5 years old!:

"How does everybody backup? 28 points by mironathetin 1266 days ago | comments "</comment></comment>


Using SystemTap - <AUTHOR> http://dtrace.org/blogs/brendan/2011/10/15/using-systemtap/

<comment><USER2> On dtrace.org, huh? I didn't realize dtrace as a project has fall so low as to poo-poo the competition.

<comment><USER3> SystemTap is not competition for dtrace. If you've ever been on a system that had dtrace, you'd find that pretty much everything works.

He's going through the same exercise I went through recently where your customer is running your software on Linux and you want to try to make use of the facilities offered by that OS so he can reproduce and diagnose the same issues.

The problem is that Linux just doesn't have good diagnostic tools. Most people don't recognize it because they've never had good tools. It's like being a C programmer who's never heard of a debugger. You can keep adding stuff to your code to try to isolate a bug and keep rerunning tests hoping it hits it where you've instrumented. That seems to be fine. But then you get a debugger and you can suddenly do significantly more on a _running_ system gathering even more information on exactly the part that you care about.

This is what dtrace is. Linux needs something like it. If SystemTap will be that someday, then great. It has to work, though. My attempts to get it functional on Ubuntu and debian left me not feeling too great about the current state of thing (at least on debian, you can get kernel probes in without adding new and poorly documented package repository locations in). In neither case could I get SDTs working, though. For example, with dtrace, I can pretty trivially tell you the exact code paths in any running application on your system that are leading to IOPS. Then maybe I can exclude "known" paths and focus on only areas we don't think there should be any. This will include, for example, paging information. I can decide whether I want that when I'm drilling down. I can then look at another process that's running on the system and see when one is competing with the other for IOPS, CPU time, etc... I do this while the software is running and with minimal impact to the performance of the system.

When SystemTap does these things on my customer's Linux boxes, then I'd call it a dtrace competitor.

<comment><USER4> If I was your customer, the fact you're trying to get systemtap running on ubuntu rather than RHEL or a derivative would concern me.

Someone should really write an article on using dtrace on a BSD where it's patchable, but not officially supported, and call it 'using dtrace'. The article is very transparent FUD.

</comment></comment></comment><comment><USER5> Since HN has recently got into the habit of correcting misleading titles, perhaps PG could correct this to 'using SystemTap on Ubuntu'?

Systemtap is made, principally, by Red Hat. On RHEL and similar, running a tap consists of running the following command:

        stap tapset.stp

This is fairly well known and easily discoverable.

Ubuntu doesn't even include SystemTap in it's default kernel. Saying that his experiences running SystemTap on Ubuntu are what 'using SystemTap' is like is very misleading.

</comment><comment><USER6> You don't need SystemTap to determine which process is using I/O. Just use pidstat from the venerable sysstat package that comes with all Linuxes ([http://sebastien.godard.pagesperso- orange.fr/man_pidstat.htm...](http://sebastien.godard.pagesperso- orange.fr/man_pidstat.html)). Requires Linux 2.6.20 or later to report I/O usage. You can also just look in /proc, which has had I/O counters a few years now.</comment>


TechCrunch's New Search Engine: Powered by Yahoo BOSS  - <AUTHOR> http://www.techcrunch.com/2008/11/26/techcrunchs-new-search-engine-powered-by-yahoo-boss/ <comment><USER2> Anyone know when/if they'll release this to the public?

I can't afford to spend the time creating a search engine for my site so it would be great to have a structural search engine. In particular, I'm very interested in this structural data approach - I really just need a way to handle searching "objects" and this seems like a great way to do it.

<comment><USER3> Disclaimer: I work for the Yahoo! Developer Network

Right now you can use BOSS to get regular web search results and mix them in with you own results on your side.

I'm not sure about when vertical search will be available though. I'll follow up with some people here. I'm happy to email people who are interested when I have an update. You can email me at email@example.com once you fix the obviously silly pirate reference.

<comment><USER2> What do you mean by the pirate reference?

I've updated the grandparent to make more sense though.

<comment><USER4> I'm pretty sure he means to fix the deliberate piratized misspelling of yarrhoo-inc to yahoo-inc. This technique started with inserting "NOSPAM" into email addresses when posting them publicly on the web as a spam protection measure. Since email harvesters probably account for NOSPAM insertions by now, the pirate spelling is more effective and, on top of that, arguably funnier.

<comment><USER3> That's pretty much the size ofit. In our office we definitely value funny.

I was so tickled when I found out we own the misspelling yarhoo.com and point it at yahoo.com

<comment><USER5> you really should try and get it to redirect to it's own page on Sep 19th. That would be awesome matey.

<comment><USER3> I used to work on Frontpage and I had been trying to get a Pirate logo up. However they tend to only change the logo for major holidays or charities. The only charity I could find that did pirate day stuff are a cancer charity. Since October is Breast Cancer Awareness, that got vetoed for doing 2 cancer charity things too close together.

Ah well... I'm going to have another go for next year. I was thinking that yarhoo.com could be a pirate translation of your homepage.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> If you use Firefox you can get results from the TechCrunch Network each time you search on Google by downloading this search extension.

<http://www.webmynd.com/html/techcrunch.html>

The latest version of the WebMynd extension lets you personalize your Google searches with the information sources that you most value. So we've set up a version that shows TechCrunch results by default, but you can also get results from Hacker News, YouTube, Flickr, Wikipedia and many others (including YC startups).

</comment><comment><USER7> Cuil Killer.</comment>


Toxic – A distributed, secure, command-line based instant messenging client - <AUTHOR> https://github.com/Tox/toxic <comment><USER2> We've closed this thread to noob accounts (except the submitter) because of troll activity.

<comment><USER3> Not a moment too soon. :-/

Looking at some of these [flagkilled] comments... all I can say is... it sure makes me happy to be a part of the HN community and that we have a place which is largely free of that "nonsense" (a much too overly nice way to describe it)

</comment></comment><comment><USER4> My one experience with the Tox project was that I made a few (I thought) constructive suggestions. First, I suggested they use some form of static analysis or perhaps a 'safer' language to implement their core functionality - such as Rust or Go, instead of rather messy (at the time) C code.

Furthermore, having spent a lot of time researching parsers and how parser differentials can affect the security of systems, I suggested they use some tools, such as protocol buffers, to eliminate handwritten parsing code. The response I got was rather disheartening and downright hostile - it boiled down to the fact that protocol buffers involves C++ code which they are a priori against, without actually engaging in a factual argument (I wrote an article in the current USENIX login/ last years OSDI about parsers for binary protocols for anyone interested in background: [https://www.usenix.org/system/files/conference/osdi14/osdi14...](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper- bangert.pdf) and github.com/jbangert/nail)

<comment><USER5> First of all the choice of C is because it was the language I was the most confidant writing secure code in. I'm not going to learn a new language and then right away start try to write secure code with it.

Clang has some great tools I use like the various sanitizers. Static analysis sucks and almost never finds any real issues but we still use it.

If you think toxcore should use protocol buffers, feel free to port it. This is an open source project and contributions are welcome. If you do a better job than me then I will merge your contribution. We are at #tox-dev on freenode.

<comment><USER6> But why create your own parser instead of using proven-secure ones? Sounds like NIH Syndrome to me.

</comment></comment></comment><comment><USER7> Make it worthwhile for someone to test how 'secure' this system is before touting that title.

An audit or a bounty with no limitations on rendering the system insecure. An example of how not to do this would be the Telegram contest sham.

<comment><USER8> Contests/bounties are not indicative of security because it is very likely that potential profits from selling or using an exploit are greater than the bounty offered.

</comment></comment><comment><USER9> core C lib: [https://github.com/irungentoo/toxcore](https://github.com/irungentoo/toxcore)

Qt client: [https://github.com/tux3/qTox](https://github.com/tux3/qTox)

ncurses client: [https://github.com/Tox/toxic](https://github.com/Tox/toxic)

metro/windows client: [https://github.com/Reverp/Toxy](https://github.com/Reverp/Toxy)

plain C client (uses xlib/win32 to draw the UI): [https://github.com/notsecure/uTox](https://github.com/notsecure/uTox)

racket client: [https://github.com/lehitoskin/blight](https://github.com/lehitoskin/blight)

there's also java bindings: [https://github.com/sonOfRa/tox4j](https://github.com/sonOfRa/tox4j)

etc...

</comment><comment> ex-contributor DISCLAIMER: I am one of the many Tox ex-contributors, who used to work on it in the past. I don't want to be identified due to harassment other ex- contributors suffered in the past. The following message is my point of view on the project as a whole.

Proplex, a long-time member of the Tox-Foundation and in charge of both infrastructure and marketing, called out tox devs because the 2 people in charge (irungentoo and stqism) were dealing with money in a shady way and he got suspicious. This lead him to leaving the Tox Foundation Proof: [https://gist.github.com/irungentoo/5af26f5edefcdb7eac72](https://gist.github.com/irungentoo/5af26f5edefcdb7eac72)

After he went away and stopped to pay for the website and other servers (he hosted everything), Tox devs got angry and tracked his online activity by his browser UA, read his private email sent to his @tox.im address and considered breaking into his VPS account Proof: [https://gist.github.com/urras/ba792274f5aaf662a082/5d91d2a78...](https://gist.github.com/urras/ba792274f5aaf662a082/5d91d2a780b38e015cd4dc331eb68038f09f5c2f) and [https://archive.today/KkSWp](https://archive.today/KkSWp)

Members of the Tox Foundation such as stqism try constantly to sneak in copyright changes in unrelated fixes: Proof: [https://github.com/irungentoo/toxcore/pull/1219](https://github.com/irungentoo/toxcore/pull/1219) and [https://github.com/irungentoo/toxcore/pull/1224](https://github.com/irungentoo/toxcore/pull/1224)

irungentoo enforced censorship on his github repo to try to cover everything up Proof: [https://github.com/irungentoo/toxcore/issues/1227](https://github.com/irungentoo/toxcore/issues/1227)

After it got out of hand and too many people called out the Tox Foundation, this happened: Proof: [http://a.pomf.se/kqwgsg.png](http://a.pomf.se/kqwgsg.png)

irungentoo claims Tox is secure just because he uses a secure primitive, which is really arrogant and something only a pretentious deceiver would say. This is a crypto 101 mistake. Proof: [https://github.com/irungentoo/toxcore/issues/121#issuecommen...](https://github.com/irungentoo/toxcore/issues/121#issuecomment-35750212)

After the points exposed above, the conclusion is obvious, at least for me.

The Tox Foundation claims Tox is completely secure and nobody can break in, not even the NSA. Still, there's been no security audit and it is highly likely Tox isn't completely secure, given it's alpha software. But their website gives the idea people face no risk by using Tox right now. They are deceiving people to believe it is secure so they gain more users at the expense of putting users privacy at risk. Proof: [https://tox.im](https://tox.im) itself. See all security claims even though it hasn't been audited. Saying it's "alpha" doesn't mean to anything to non- tech-savvy, they will think it's missing a feature or two, not that their privacy and security is possibly compromised.

I believe it's my moral obligation, and of everyone's else reading this, not to use Tox. You are contributing to a shady foundation composed of menchildren that don't care about other's privacy, deals with money in a shady way and dox people who go against them. Do not trust the Tox Foundation - this is my personal message.

<comment><USER10> One of the "proof"s given here is that a pull request changed a 2013 copyright to a 2013-2015 copyright, as though that's sinister somehow. I stopped reading after that.

<comment><USER11> Read it again. [https://github.com/stqism/ToxCore/commit/bed425598f26938bd54...](https://github.com/stqism/ToxCore/commit/bed425598f26938bd54829ac64f98af8e406093c#diff-72e71364bf21b367b2a52418fbb2f862L2) He tried to get copyright away from people and assign it to the "Tox Foundation", all during a supposedly unrelated minor bug fix.

</comment></comment></comment><comment> ex-contributor One of the links I posted above "mysteriously" disappeared. I have an archived version though. It's one of the key-points of the situation I exposed, so it's worth a read.

[https://archive.today/Y6LEw](https://archive.today/Y6LEw)

<comment><USER12> Yeah, I deleted that Gist because you're using it out of context. I've talked with you one-on-one, and I've asked you to stop pasting it wherever someone mentions Tox.

</comment></comment><comment><USER13> The home page[0] seems to suggest that there are also audio and video capable clients... are they still in development, or is there something functional already?

[0] - [https://tox.im/](https://tox.im/)

<comment><AUTHOR> Toxic has 1 on 1 audio chats, and GUI clients such as uTox and qTox additionally have group audio, as well as 1 on 1 video. Both clients are usable, though I would personally recommend qTox.

</comment></comment><comment><USER14> tox does not attempt to hide your ip. Every single friend you have added has your ip. This is by design.

<comment><AUTHOR> That's partially true. However if you force TCP connections (in Toxic this is done with the -t flag) your IP is effectively hidden from your contacts because all your traffic gets relayed by TCP nodes in the network. The downside is that forced TCP connections are slower and less reliable.

Though to be properly anonymous you would need to run it through Tor: [https://wiki.tox.im/Tox_over_Tor_(ToT)](https://wiki.tox.im/Tox_over_Tor_\(ToT\))

The reason Tox doesn't have built in anonymity is because strong anonymity has a massive impact on quality (especially streaming data like audio/video). Our goal is to steal normal (non-paranoid) users from Skype and get everyone and their mother using strong encryption. In order to achieve that we need to have comparable quality rather than something that feels like you're using a 28.8k modem.

And again, anyone who actually wants anonymity still has that option.

<comment><USER15> If broad adoption is truly your goal you have a branding problem. Normal people will not use a tool called 'toxic' which prints crazy ASCII letters in the command line. You might as well ask soccer moms to hold the line at occupy wall street.

<comment><AUTHOR> Toxic is just one of many clients that are built ontop of Tox. Some clients fill a niche, others (like qTox) are meant for widespread adoption.

</comment></comment></comment></comment><comment><USER16> It's not really command-line since it relies on ncurses. I thought it was something different like where you're literally sitting at the command-line within some short of shell like:

toxuser@toxbox:~$ tox send pg "Hi, YC looks cool!"

Or maybe even crazier like that Zero project thing (I forget what it is called).

That said, good stuff. :)

<comment><AUTHOR> True, but I figure it's close enough. There is a true CLI client for Tox called Ratox. It's pretty neat. [https://wiki.tox.im/Ratox](https://wiki.tox.im/Ratox)

<comment><USER17> raTox is a actually really fun to use, but it's less of a client and more of a command line tool in a bash script.

</comment></comment></comment><comment><USER18> Also relevant, and containing video and audio chat support, is uTox[0] and qTox[1]. Looks like they are currently working on getting group video chat working.

[0] [http://utox.org/](http://utox.org/) [1] [http://utoxisfinished.info/](http://utoxisfinished.info/)

</comment><comment><USER19> Is anyone actually using this (or something like it)?

If so, I'm curious about the details like context and experience.

</comment><comment><USER20> Can Tox do persistent group text chats with offline message delivery to people when they sign in again? It's the one killer feature of Skype that keeps me on it. No open messaging programs ever support this it seems like.

<comment><AUTHOR> Currently no, but there is a groupchat rewrite underway and that is one of the planned improvements.

<comment><USER21> I look forward to this.

I have to echo the parent though, getting history from the period you were disconnected is a killer feature of skype that seems to get little or no attention.

It is one of the major things that keeps some of my group chats on skype.

<comment><USER22> You might be interested in trying Slack, then.

</comment></comment></comment></comment><comment><USER23> I hadn't looked much into Tox, but after seeing a few mentions on cyberpunk boards, and seeing how hard people are shilling against it, I think I'm going to take a closer look.

</comment><comment><USER24> Is this at all related to Nullsoft Waste? That was quite a scandal when it launched with a "whoops we didn't mean to open-source that" thing. It was a crypto-IM too.

</comment><comment><USER11> If you use a secure crypto primitive, is it correct to say your program is secure?

I mean, can you be sure something is secure just because of the crypto lib?

I thought there had something to do with the implementation too?

I ask this because of Tox. The main developer claims Tox is secure because of the crypto library.

It sounds weird to me, so I decided to ask... After all, if it was this easy all programs would be secure, right? Just import a secure crypto lib and it's done? Sounds weird.

[https://github.com/irungentoo/toxcore/issues/121#issuecommen...](https://github.com/irungentoo/toxcore/issues/121#issuecomment-35750212)

<comment><USER25> Having a sound library removes a whole host of issues; however, it doesn't remove all of them. First and second among many are key management and concatenating values before hashing or signing.

</comment></comment><comment><USER26> So how does this differ to Retroshare or Ricochet?

</comment><comment><USER27> Why'd they call it by such a negative moniker?

</comment><comment><USER28> Is Tox secure ? Compared to tinfoil chat

<comment> ex-contributor Tox still hasn't solved the serious metadata leakage issue.

They tried to cover it up by adding onion-routing for friend requests, but ACTUAL MESSAGES are still done directly.

Strong adversaries such as your ISP and agencies like the NSA, the GCHQ, etc. can still collect metadata about your conversations.

The "Tox Foundation" tries to cover this up and pretend that "tox was never meant to be anonymous", but the truth is harsh.

Now, this wouldn't be a problem if the Tox Foundation made this issue clear to its users. This is how P2P works, after all, direct connections, and that's fine.

But the problem is that Tox doesn't make that obvious for non-tech-savvy users.

When they read on the website that they are completely safe from the NSA and whatnot, they won't expect to be in any way exposed.

Still, unless these non-tech-savvy users "route all incoming and outgoing traffic through Tor" they won't be completely safe and should be worried about metadata leakage and adding people they don't actually know. But such a thing isn't made clear and Tox deceives users this way, only to get more people using it. It's unethical and outright wrong, in my personal opinion.

<comment><USER12> Again, don't listen to this guy. He just copies and pastes this stuff from 4chan.

<comment><USER29> So what? It's a completely valid point.</comment></comment></comment></comment>


Google.com susceptible to script injection? - <AUTHOR> http://www.google.com/search?hl=en&client=firefox-a&rls=com.ubuntu%3Aen-US%3Aunofficial&q=lyris.spc.int%2Fread%2Fattachment%2F36456%2F1%2Fhtmlversion.html&btnG=Search What's going on here? Why is some other domain asking for a password? Click on the link or search for
  lyris.spc.int/read/attachment/36456/1/htmlversion.html <comment><USER2> What am I missing here? I don't see anything out of the ordinary.

<comment><AUTHOR> When I go there (to a google search page), lyris.spc.int requests http authentication. Why is this happening?

<comment><USER3> maybe your browser is prefetching the result url?

</comment></comment></comment><comment><USER4> Nothing for me. They shouldnt keep html versions of government emails online.</comment>


Why America's Outdated Morals Won't Let Porn into Mainstream Business - <AUTHOR> http://www.nerve.com/features/why-americas-outdated-morals-wont-let-porn-into-mainstream-business <comment><USER2> I'm an atheist and I still think porn may be a valueless, happiness destroying exploitation of the way the human brain works in a way that makes zynga appear to be an angel of virtue. The less of it there is, the better.

<comment><USER3> I think nobody doubts that the porn industry is a very exploitative business.

However, an easily overlooked aspect of porn is that it canalizes and binds a lot of "useless" energy. A few years ago I heard this tongue-in-cheek hypothesis about male sexuality: Once they manage to reliably eliminate all porn, it will take two days before mobs with clubs and pitchforks roam the streets making political demands.

<comment><USER4> Can you provide any evidence at all to this point? I understand that you're just providing a possible potential benefit of porn, but it seems totally unfounded to me.

<comment><USER3> In truth, no. I've heard this stated by various people, among them Tim Pritlove, who said it in one of his podcasts (I think it was NSFW, but I'm not sure). Nobody I've heard it say has pointed to evidence. It is one of those things that appears plausible to a lot of people from personal experience. This of course means, that it might be wrong.

There seem to be some people trying to collect data about the correlation between availability of pornography and the level of some crimes, but I'm still waiting for something conclusive.

Not that it's easy. Quantitative sociology is, due to the interconnectedness of the system in question, a mess.

</comment></comment></comment></comment><comment><USER5> There's three underlying issues here that drive these decisions:

1) Legal and financial risk, the adult industry sees a vast amount of fraudulent transactions. That's the primary reason that most financial institutions won't deal with it, but there are specialist payment providers who will.

2) Ethical reasons. Many companies won't work with tobacco, alcohol, gambling, porn and other vice industries because it doesn't fit with their corporate objectives.

3) Marketing reasons. Even if a company doesn't intrinsically oppose vice businesses, being involved can clearly impact public perception of the business. This is a much bigger deal if you're running a multisided business like a social network or an app store because it can cause your entire business to shift because of the feedback loop.

<comment><USER6> To your second point. Aren't the corporate objectives of all US companies to make a shitload of money for their shareholders? If so, they should be jumping on all those businesses like horny teenagers, because those businesses make a _lot_ of money.

<comment><USER5> You're mistaken, there's virtually no money in the online adult entertainment business. The entire market size is only a few billion in annual revenue and it's primarily long tail, the majority of the larger players (ala Playboy) are losing hundreds of millions of dollars every year.

It's a small fragmented market which is shrinking every year.

<comment><USER7> That's true. From Wikipedia: "In 2007, Bang Bros generated a sales total of $1.9 million." That's very tiny given that BangBros is a pretty big player in that industry (2,898 Alexa rank for a paywalled site).

</comment></comment></comment></comment><comment><USER8> There's a mob of religious (and some non-religious) activists waiting around for any excuse to raise hell as soon as one of these companies makes any attempt to legitimize porn.

<comment><USER9> Porn is legal. You are thinking more of any attempt to make porn non-censored and relaxing regulatory restrictions on the distribution of porn. Yes, feminists & the religious "right" will raise hell because they're the primary reason porn is so inflammatory in this country.

<comment><USER10> > Porn is legal.

In some jurisdictions. In some it's in "gray" area (laws are uncertain or badly worded), and it some it's completely illegal.

Also laws usually make distinction between production, distribution and consumption of porn.

<comment><USER11> In the USA, I think it's only legal to be created in California IIRC.

</comment></comment></comment></comment><comment><USER11> Killing people good, fucking people bad.

</comment><comment><USER9> This is the beginning of the plot of the movie Strange Days. Essentially the ability to record the thoughts of people during extremely intimate periods of their lives. [http://www.imdb.com/title/tt0114558/](http://www.imdb.com/title/tt0114558/) It only took us 18 years to get to that point.

</comment><comment><USER12> _Alex Petralia specified he was prohibited by PayPal's privacy policy from divulging information on accounts_

I love how the companies use the "privacy policies" as excuses to not answer question even when the question is asked from the media on behalf of the person asking.

Do they think we are idiots?

<comment><USER13> If you had a company, how would you feel if PayPal shared the information with the kind of business they do with you?

<comment><USER12> Except here the company has gone to the media. That is very different. The company wants to share the data , PayPal no ...

</comment></comment></comment><comment><USER14> All the people reproducing themselves at replacement rate in your society (religious people) say that porn interferes with their social patterns.

</comment><comment><USER15> Wow, if this is the class of insert you get after paying what I presume are not insignificant amounts of fund, I'd hate to see the budget for a compelling one.

Reading between the lines, he sounds butt hurt to me due to dismissals from the sand hill road set. Well, no shit. Everybody (there) knows that adult content can be cash positive very close to day one, and due to their strong balance sheets they are hardly the likeliest M&A targets.

The rest (bulk) of the article seems to riff on mainstream acceptance nay open discussion. But it's far from jerking off that many people have an aversion to speaking frankly about. Go talk to some random guy on the streets about his bowel movements, or if his daughter is still on anti-psychotics and get back me.

If you want "respect" go do a social/mobile/whatever the new hotness is and go to the big firms hat in hand. They'll probably give you the money assuming you keep the crazy bottled up for the duration. Then you'll have no problem getting those business critical speaking gigs and becoming a go to react quote of some 3rd rate blog like tech crunch. And your friends will all be suitably impressed and jealous (to your face).

But after the money runs out all that goes away. Personally I'd just take the cash positive business for what it is ( a gift) and stop trying to validate yourself through others. Or just take up lying.

(yes, I know this doesn't have a lot to do with the specific points raised, but if you let them frame the conversation tehy've already done 90% of their job)

</comment><comment><USER16> My favorite is when I read about litigious porn companies suing for copyright violations (like Perfect10 vs Google image search), calling their copyrighted images _INTELLECTUAL_ property!

<comment><USER17> What is weird about that? IP refers to anything that is a product of intellect, it doesn't make judgements about whether something is high brow or not.

</comment></comment><comment><USER18> Obviously people have a right to create and consume smut, but it doesn't make it right or beneficial or erase the harm it does.

<comment><USER10> > harm it does

And, to be more exact, what kind of harm you're talking about?

I could think of some very real and large issues that are usually linked with pornography (human abduction, treating [usually] females as sexual objects, etc), but after some thinking (not very deep, I must admit) I've concluded none of them are caused by pornography itself (in a same way knives aren't the cause of homicides, although many people died stabbed with a knife). But I may be missing something.

</comment></comment><comment><USER19> Does anyone else think there's just an upper-limit to how much porn can be consumed by the average person? I think it's just assumed that if porn were suddenly as acceptable as mainstream programming, it would suddenly become the most popular thing, ever. But would it? People can read books for hours. People can watch Game of Thrones/Breaking Bad/Mad Men/Downton Abbey/James Bond movies in a marathon fashion. Hell, people can run _marathons_ in a marathon fashion. But watching porn, _constantly_? Besides porn/sex-addicts, how big of a market is there for porn watching in excess of 10min-1 hour a day?

</comment><comment><USER20> Why is this on HN?

<comment><USER21> Yeah, who here is interested in articles about startups, the internet giants, VC funding, etc?</comment></comment>


YikeBike - <AUTHOR> http://www.yikebike.com <comment><USER2> I have ridden recumbent bikes (e.g. <http://www.recumbents.com/home.asp>) for decades. Mine is very much like the Yike: underseat steering, approximately 20" wheels, short wheelbase, and I sit almost directly over the front wheel (like the Yike) except I have to pedal. Here is what I know:

1\. sitting on a wheel means every time you hit a pothole you say yike as your spine is pounded.

2\. you MUST keep both hands on the wheel at all times because it is dynamically unstable (very different from an 'upright' bike which will steer hands-free).

3\. forward center of gravity will dump you on your face under heavy braking (or for the Yike - the slightest braking).

4\. small wheels feel every bump in the pavement (which has a fractal dimension explored in greater detail as the wheel gets smaller).

5\. You can ride a recumbent for hundreds of miles in a day and still be very comfortable (I have) but it requires a chair-type seat; preferably with some recline to it. That seat looks painful.

6\. A short wheelbase like my bike or the Yike allows you to turn on a dime - but it takes practice as both wheels do not have the same weight and a skid is unrecoverable. Do not attempt this on ice, snow, wet leaves, etc..

</comment><comment><USER3> Yikes, that thing will not sell. The core demographic that would use it are the same people that want to look the coolest. And I can't imagine anyone cool sitting on something as dorky.

Another good idea killed by poor design.

<comment><USER4> Sadly, I'm sure they spent a lot of time on the design. I think they're just solving the wrong problem. The lack of storage space limits this to joy riding. You can't buy groceries, commute with a laptop, etc. etc.

<comment><USER5> Why wouldn't a backpack work for carrying things?

<comment><USER6> When it comes to long distance hauling of stuff on twos you want to let the machine do the work.

<comment><USER5> Sure, but given the range of the Yike I don't think long-distance hauling is really an option anyways.

</comment></comment></comment></comment></comment><comment><USER7> Every person in that video seems to be thinking "Ha ha. Look at that moron!" though I'm sure that's not what I'm supposed to be thinking.

</comment><comment><USER8> "How heavy is a YikeBike? The YikeBike weighs less than 10kg with a full battery and air in the tyres"

And how much does it weigh with a drained battery and flat tires? :)

<comment><USER9> Less, actually.

<comment><USER8> Measurably less than "less than 10kg"? Yes, I understand that air at 30psi weighs more. Let's assume that the tires hold 3 liters of air (standard for a mt. bike, the yike looks like it holds a lot less actually). The 30psi will add 3.75 grams. Less than two pennies.

</comment></comment></comment><comment><USER10> This shouldn't be compared to a regular bike but to Segway. A popular electic bicycle would also be cheap and allow pedalling.

<comment><USER11> _A popular electic bicycle would also be cheap and allow pedalling._

Absolutely. If I wanted an electric bike, I'd go with something more sensible, like this:

[http://www.treehugger.com/files/2006/10/schwinns_new_line_of...](http://www.treehugger.com/files/2006/10/schwinns_new_line_of_electric_bikes.php)

<comment><USER12> The perks of the Yike (I feel funny just saying that) are the weight (20lb vs 45lb) and size. I see lots of business people here (London) on those little fold up city bikes. The Yike seems more targetted at those customers than the traditional cyclist.

<comment><USER6> The Yike also allows you to avoid the legions of bicycle fundamentalists who will inevitably accost you over an electric bicycle choice.

<comment><USER13> How does it do that? At 20kmh I'll ride circles around this thing on my mountain bike with knobby tires wearing a 30 pound pack.

</comment></comment></comment></comment></comment><comment><USER14> I'm going to go ahead and predict this same problem: <http://paulgraham.com/segway.html>

<comment><USER15> First thing that came to my mind as well. I like the foldable functionality though. In Amsterdam there are a lot of people using folding bikes. They commute to Amsterdam by train taking their bikes and then use the bike to get into the city. Works pretty well, but it still looks kind of silly.

</comment></comment><comment><USER16> I would not want to go down a hill on that thing.

<comment><USER17> According to their FAQ: Speed limited so that it can never go faster than 20 km/h even down hill.

</comment></comment><comment><USER18> It looks like it will have pretty much exactly the same problems the segway has. It is too expensive (~3,500 - 3,900 Euros). The range is too short (9-10km) and it doesn't go fast enough(edit: When finished won't go fast enough). It reminds me exactly of how the Segway origionally wanted to be, long distance and high speed, but regulations and batteries kept it from doing so. If they are going for a small niche then they might be fine, but if they are trying to mass market it, then it seems like it'll be another pipe dream. That's not to say I don't think its cool, just not at all practical.

<comment><USER19> "Same problems as the segway has" ... let's see:

"too expensive" - check! (Got me there.)

"range is too short" - I'd like more range, but after 20 miles your feet have had enough of the Segway. Miles of sidewalk cracks beat you up and you need a rest. Really, I'd settle for a faster recharge rate.

"doesn't go fast enough" - you want to fall faster than 12 mph?

"regulations" - in 43 of the United States, Segways are allowed on sidewalks, bike paths, and roads. See <http://www.segway.com/support/regulatory.php>

"batteries" - the biggest problem with the Segway batteries is that they're considered hazmat and are hard to ship. The FAA takes a dim view of "lithium ion" anything, even though Valence's lithium iron magnesium phosphate cathodes make them safe to transport. That's really less a problem with the technology, and more of an opportunity to educate the regulators.

</comment></comment><comment><USER20> I can't imagine trying to bail out if you got into trouble with the handlebars around your legs like that.

<comment><USER17> From the FAQ (I swear I'm not from YikeBike PR): It is likely that you will jump off the front of a YikeBike in an emergency braking situation - this is very easy as there are no handle bars in the way.

<comment><USER21> At 20km/h it might not be so easy after all.

<comment><USER22> I'm guessing that sailing off the front gets progressively easier the faster you're going. It's the graceful landing that presents a problem.

</comment></comment></comment></comment><comment><USER23> Yikebike: How much: €3700~ ($5400) | How far: 9-10 km (5.5 miles) | How fast: 20 kph (12 mph)

For comparison...

Segway: How much: $2-7000? | How far: 38km (24 miles) | How fast: 20 kph (12 mph)

<comment><USER24> Another comparison:

My shitty commuting bike: 50€ | Range: unlimited | Top speed: a bit more than 30kph depending on how fast you can spin

<comment><USER25> I'm sure it compares favourably to the Yike, but the range on your commuting bike is not unlimited. How far can you ride before you have to stop and eat?

<comment><USER24> I can eat on the bike, actually. I did 210 km one day, a number of years ago, and only really stopped once (I had plenty of food that I ate as I went), but that wasn't with the city bike, for sure. Even the nice bike costs half of what this thing does, though.

Bicycles, on reasonable terrain (i.e. roads of some kind, or rideable trails) are _the_ most efficient form of human transportation, in terms of energy / km.

</comment></comment></comment></comment><comment><USER24> Sat that high up with not much in front of you... it looks like it might have some stability issues.

<comment><USER26> Yes, even the guy in the video looked wobbly.

</comment></comment><comment><USER27> This bike and segway are marketing to the WRONG demographic.

City folk are too cool and care too much about their image to ride these things.

Come out here to the small towns of the mid/northwest where we drive our cars 10 blocks to get to work. Or the grocery store is 3 blocks away, so is the movie store, and Starbucks.

They are still too expensive, but every house on my block could benefit from one of these, and if we saw each other riding it down the street, we'd all be jealous of one another and want one.

<comment><USER28> small towns don't have proper sidewalks for things like that, and having them on the road is a recipe for road rage.

</comment></comment><comment><USER29> Great, but I would not like to be seen on one.

</comment><comment><USER30> It is a sad sad state of product design that the people who spent so much time designing and making it never rode a bicycle.

If they had they would know that even getting on this contraption would scare the daylights out of a seasoned cyclist(like me).

Not to mention that it is everyone's dream to look like an idiot at speed.

</comment><comment><USER31> This is what I said the first time YikeBike was posted on HN:

"tiny wheelbase + forward centre of gravity + unexpected obstacle = faceplant."

</comment><comment><USER32> It doesn't look stable _or_ durable.

</comment><comment><USER33> Kudos to all who are trying to make bike-like commuting practical. I'm looking forward to practical ideas.

<comment><USER33> ...and let me just say I'm still looking.

</comment></comment><comment><AUTHOR> I just hope that the price will be much more reasonable when it goes into production...

</comment><comment><USER34> dammit when is apple going to release one of these so people think it's cool?</comment>


Microsoft's new multi-touch mice demoed on video - <AUTHOR> http://www.crunchgear.com/2009/10/05/microsofts-insane-new-multi-touch-mice-demoed-on-video/ <comment><USER2> The first mouse I think would look very nice on my desk right about now.</comment>


Feedbin is Open Source - <AUTHOR> http://blog.feedbin.me/2013/08/27/feedbin-is-open-source/

<comment><USER2> I've been using Feedbin as my post-google feed reader after trying out a few others, and deciding it was worth the basically-nothing a month to support one of my most-used web apps. I've been very impressed so far, and the UI is great (though I'd like an expand all for the sections...).

I think going OS is a bold move, and with a bit of luck (and community interest) it should help propel some interesting developments and keep it at the cutting edge in the post-reader landscape... and if that expand all thing annoys me enough, I could just code it up myself.

Thanks!

</comment><comment><USER3> I hope this doesn't mean that Feedbin isn't making (enough) money. I've been using Feedbin (+ Mr. Reader on the iPad) and it's been great. I'd hate for the service to close, even if I can host it myself, I'd rater pay way more.

<comment><AUTHOR> It's because Feedbin is making money that I felt comfortable doing this.

</comment></comment><comment><USER4> @benubois: Amazing. Thanks so much. An incredible milestone for a great project.

@mtthwp: No, Feedbin as a service will still require a fee; however, the code itself is now open to anyone. If you really wanted, you could go host it elsewhere yourself (for far more than the monthly fee).

</comment><comment><USER5> This is excellent. Thanks Ben.

In this post-GR era, opening up the code like this really opens up opportunity for serious innovation. As an aggregator/reader developer I look forward to digging in and seeing how you solved some issues.

Thanks again!

</comment><comment><USER6> Please pardon my poor reading comprehension skills, does "free as in freedom" equal free as in no monthly/annual fees? I hope not. I actually like to pay for feedbin as long as it means no ads and ensures my data isn't mined.

<comment><USER7> It (should) mean free as in libre: [http://en.wikipedia.org/wiki/Gratis_versus_libre#.22Free_bee...](http://en.wikipedia.org/wiki/Gratis_versus_libre#.22Free_beer.22_vs_.22free_speech.22_distinction)

"Free as in beer" and "free as in freedom" confuse me too, because beer sets you free, and freedom has no monetary definition for some people.

</comment></comment><comment><USER8> This is a great move for me, and I hope ultimately for Ben. This way I'm empowered to fix my own issues, and pay someone else to run it for me.

</comment><comment><USER9> @benubois slowclap.gif

I switched to Feedly from Feedbin earlier this week and now I feel bad. Will immediately switch back.

</comment><comment><USER10> Props. I've been considering the same move. It takes guts to make it happen.

</comment><comment><USER11> This is an amazing decision!</comment>


MtGox account database leaked - <AUTHOR> http://forum.bitcoin.org/index.php?topic=19543.0

<comment><USER2> People talk a lot of trash about frameworks like Rails, but I can spin up a shell application with bcrypt authentication via devise, roles-based authorization via cancan or declarative authorization, built-in CSRF protection, and better-than-decent default XSS protection in less than 30 minutes.

Granted, it's not perfect security-wise, but it beats the crap out of whatever mish-mash leads to this meltdown...or the one Citi had...or the one Sony had...or other one...etc.

I think security is one of the few areas where convention over configuration pays off by sidestepping lazy/sloppy approaches.

</comment><comment><USER3> Seems that "mining" the MD5 passwords is now more profitable than directly mining Bitcoins - at least there's some GPU power out there ;)

<comment><USER4> MD5? Are you kidding me?

There should be capital punishment in software development for things like that.

<comment><USER5> It is not so much about MD5, but more about not using a random salt for each password.

Stronger hash algorithms such as SHA-1 suffer exactly the same issues when used improperly (i.e. when stored without salt, or data is exchanged without HMAC).

<http://en.wikipedia.org/wiki/Salt_%28cryptography%29>

<http://en.wikipedia.org/wiki/HMAC>

<comment><USER6> I'll just leave this here: <http://codahale.com/how-to-safely-store-a- password/>

</comment></comment></comment></comment><comment><USER7> I have received the following email _6_ times, edited to remove referral code and Bitcoin address:

"Dear Sir or Madam,

A few hours ago the Bitcoin trading website Mt Gox has been hacked. Malicious individuals have been able to obtain a database containing usernames, email address and encrypted passwords. This information has been posted publicly on the internet.

As a Bitcoin supporter I'm now sending a message to every email address contained in the hacked database. This is to warn you that your username, email address and password have been leaked. I therefore strongly advice you to change your passwords. If you have used the same password on different websites it's highly recommended to change your password on all of your accounts!

For a more secure alternative to Mt Gox, the community appears to be moving to TradeHill. So this is no reason to lose faith in Bitcoin itself. It must be seen as a warning that not every website can be trusted with your data however! Their link is <http://www.tradehill.com/?r=XXXXXXX> (Note: You can remove the Referral Code when registering if you want!) This is certainly not the only website where you can exchange Bitcoins, also check out <http://www.thebitcoinlist.com/dp_bitcoin/bitcoin-exchange/>

Sincerely,

A Bitcoin supporter 1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX7"

If the sender is reading this, your script works (too well), and the warning was received 2 1/2 hours after the one from Mt. Gox, so you probably should have saved yourself the trouble.

The From headers shows the email is sent from email@example.com. However, digging into the headers it is actually coming from firstname.lastname@example.com (trying to give the guy some privacy, since he's trying to be helpful, but this way others who get the message can correlate it).

<comment><USER8> How is that helpful?

a) Every user of MtGox already received a message from MtGox directly telling them about the breach. His message did not add any new information at all.

b) He advertises for two direct competitor to MtGox, in once ase using what I assume is a referral link where he earns a comission for each trade.

c) He solicits donations for himself.

d) He does not give out his name and uses an invalid return address to hide his motifs.

e) He sent the message 6 times.

</comment></comment><comment><USER9> Just got an email from MtGox. Here are the important bits:

"If you were using the same password on Mt.Gox and other places (email, etc), you should change this password as soon as possible."

"While the password is encrypted, it is possible to bruteforce most passwords with time, and _it is likely bad people are working on this right now_."

Son of a...

<comment><USER10> A question to people that have a more active crypto knowledge than I do:

I have a 13 character password with letters, numbers and punctuation. I also seem to have one of the salted ($1$) passwords.

How much in trouble am I really?

<comment><USER11> Several months I think assumed according to this: <http://www.lockdown.co.uk/?pg=combi>

The article is 2 years old. There are botnets that I presume could do ~50 billion/sec now (Number pulled out of ass).

<comment><USER4> A single machine loaded down with four high-end cards can do 4.5GHashes/s so an army of bots could easily eclipse that.

<comment><USER11> The G means Giga, as in 4.5 Billion? I haven't seen it used that way before.

I believe bots are unlikely to have four high-end cards though, due to my assumption that the nature of bots come from weak users therefore weak computers.

Do you have a source for the capability of particular capacities to find passwords including botnets like my link?

</comment></comment></comment></comment></comment><comment><USER12> I bought some bitcoins on MtGox a month or so ago. My email address was among those in the leaked database. I received a message from MtGox about the security breach, and shortly thereafter from an anonymous user hoping to profit:

Dear Sir or Madam,

A few hours ago the Bitcoin trading website Mt Gox has been hacked. Malicious individuals have been able to obtain a database containing usernames, email address and encrypted passwords. This information has been posted publicly on the internet.

As a Bitcoin supporter I'm now sending a message to every email address contained in the hacked database. This is to warn you that your username, email address and password have been leaked. I therefore strongly advice you to change your passwords. If you have used the same password on different websites it's highly recommended to change your password on all of your accounts!

For a more secure alternative to Mt Gox, the community appears to be moving to TradeHill. So this is no reason to lose faith in Bitcoin itself. It must be seen as a warning that not every website can be trusted with your data however! Their link is _removed_ (Note: You can remove the Referral Code when registering if you want!) This is certainly not the only website where you can exchange Bitcoins, also check out _removed_

Sincerely,

A Bitcoin supporter _(bitcoin address removed)_

</comment><comment><USER13> Perhaps 100% unrelated, but for the first time since its launch I just got a 'suspicious activity' notice when I tried to log onto my Google Accounts/Gmail within the past hour. I got in ok and changed my password drastically, however one of the first emails I got of course was one from MtGox letting me know about this. Probably unconnected, but I could imagine them trying to take a hit on a lot of registered Gmail accounts after they got the information. I only signed up for an MtGox account, but I've never traded with it or really used Bitcoin.

<comment><USER14> All gmail addresses in the leaked file (including mine) got this notice. It's just a precaution from google.

I'm a bit annoyed that they didn't just sign me out and _suggest_ a password change rather than force it (since I already use their 2-step authentication scheme and use different passwords for everything). On the other hand I'm happy to know that Google cares so much about the security of my account.

<comment><USER13> Hmm, figuring this is just likely (hopefully?) my iPhone or something, but my gmail shows an account login using IMAP from United States (MI) (198.228.226.x) about an hour ago. I've never been to that state.

EDIT: Nevermind, my have been my phone or something, because MaxMind is showing that IP as Ohio (where I am).

</comment></comment></comment><comment><USER15> I have to admit that when you have real money behind a hobby[1] project of this size and amount you might want to hire some security professionals to do an audit of your system. It goes for all the exchanges. Heck, I hope brick and mortar banks do a 'real' audit while I'm on the subject (with all the hacking being done everywhere).

<http://forum.bitcoin.org/index.php?topic=19516.0>

<comment><USER16> Keep hoping: <http://news.ycombinator.com/item?id=2656837>

<comment><USER17> The title of an article I read recently comes to mind, "You don't know the problem." That is, creating an un-hackable system isn't the problem.

It's probably unrealistic to expect that anyone will ever create a completely un-hackable system. Rather, one should design their systems to fail gracefully under attack.

If someone breaks in to my Citibank account, it doesn't much matter to me, because the banks have the authority to roll back transactions with the push of a button. Their power to do so is the greatest layer of security in the whole system; just as we have seen with Mt Gox.

Unfortunately, Mt Gox is not bitcoin, it's simply an exchange, so it's once removed from bitcoin itself. The owner of that account still lost $1000, and no one can reverse it. Contrast that with bitcoin, and you can begin to see the problem.

This is a fundamental issue with all currencies, not just bitcoin. It's a trade-off. When you hold currency, you hold responsibility for securing it. If I kept $500k in USD (paper currency, bonds, whatever) under my mattress, I'd have no recourse if someone broke in to my house and stole it. That is why I'm ok with keeping my money in a bank. I give up a lot for it, but I gain a lot of security.

</comment></comment></comment><comment><USER18> There are UNSALTED md5 hashes in there.

<comment><USER19> Ehm, how we you know that? Maybe the salts were stored another place? Or simply the attacker didn't release them? Or maybe MtGox used a site-wide salt that's stored in their codebase somewhere?

EDIT: Okay, they appear to be unsalted (according to nbpoole): <http://news.ycombinator.com/item?id=2671714>

<comment><USER20> open that file and search for the most famous MD5 hash - 5f4dcc3b5aa765d61d8327deb882cf99

<comment><USER21> Meaning what?

<comment><USER22> That is the md5 digest of 'password'

</comment></comment></comment></comment></comment><comment><USER3> Thread is locked - anyone who can provide a mirror?

Edit: Just Google for the URL to find the respective Rapidshare link.

</comment><comment><USER23> For reference, I just receied this email from MtGox. I'm fortunate in that my MtGox password is not used for anything else.

Edit: the email was longer than I expected and formatting messed up a bit on HN so here's a pastebin link: <http://pastebin.com/H5bgDYhC>

</comment><comment><USER24> Passwords seem to be hashed. I think this is to be expected since this is such a techy thing (currency?), but still nice to know. Now whether they are hashed and whether the algorithm used is safe are a different story.

<comment><USER19> There are 1766 hashes that are 32 characters in base-16 (probably MD5, possibly with a site-wide salt) and 59245 hashes that are 34 characters in base-66 (appears to be an MD5-based crypt(3) hash).

 _EDIT: Ops, I missed some hashes._

<comment><USER25> There are duplicate hashes. Taking out the dups, there are 1610 md5 hashes. And 34% of these are crackable with a rainbow table. This means they are unsalted.

<comment><USER26> at least now I finally get to use that 10GB rainbow table I downloaded a while back.

</comment></comment></comment></comment><comment><USER27> The culprit may have posted to HN just hours ago:

<http://news.ycombinator.com/item?id=2671766>

</comment><comment><USER28> I can't login at MtGox at the moment. What's the best measure to take now?

I'm assuming MtGox will reset the passwords for those with an email account associated. Not sure what they will do for those without, hopefully they have IP logs for those accounts?

<comment><USER29> I wonder - if you have a payout BitCoin address configured in MtGox, you should somehow be able to prove that it is your address? Not sure - but might be a good idea to investigate that?

</comment></comment><comment><USER30> Sigh. Everybody was warned.

</comment><comment><USER31> Who wants to team up and replace MtGox?

This is absurd. Anyone with a clue about anything knows better than to use unsalted MD5 or better yet, can imagine better ways to partition security for a system to prevent this, and _at the very least_ can implement measures to prevent mass withdrawl without having to revert to transactional rollback after the fact.

Really sad. Was MtGox first? Why did they have so much volume anyway?

<comment><USER29> Is there even a way to make a server unhackable? I am really not sure :-(

I would try to put the whole thing on Google App Engine, at least then the burden would be on Google for the most part :-/

<comment><USER32> "Is there even a way to make a server unhackable? I am really not sure :-("

Its a pretty difficult thing, the simple answer it turn it off :-) however you're second comment is more relevant.

"I would try to put the whole thing on Google App Engine, at least then the burden would be on Google for the most part :-/"

Google does a good job of securing their servers, however the risk is not that the 'server' gets hacked, rather its the application running on the server. So for example someone can't log into your server but they can SQL inject a command to dump your web site's password list and they don't have to log in.

Good secure design would start with really really strong testing around the applications 'mutation' points (which is to say where it changes in response to user input). When I was at Google products had to go through a security audit before being released and those guys were pretty good at their jobs. This is one of those cases where seeing a lot of ways people try to attack services gives you a leg up on looking for common weak points.

<comment><USER4> Anything can be hacked if it has information on it. There's even those terrifying "cold hacks" where you yank the memory stick from a machine that's powered off, chill it to preserve lifespan, and plug it into another machine to read it, the thing coughing up the contents like some zombie.

Nothing can ever be fully secure, but you can make it secure for all practical considerations.

</comment></comment></comment></comment><comment><USER31> Well, I just spent two hours talking to the people interviewing developers at mt.gox and tradehill.

Tradehill: SHA-1 currently, looking at SHA-512. No one certified on security. Top creds repeatedly touted was one guy that developed "300 iPhone apps".

Mt.Gox: Was NOT hacked. There financial auditor had read-only access to the database and his computer was compromised. They were asked why the financial auditor had access to the data, with no response.

I was literally yelling about bcrypt, and apparently Mark (mt.gox) said that bcrypt wasn't actually very secure and that they're were going to use (1000 passes) of SHA-512.

<comment><USER33> People are always the weak link.

You can't just secure the servers; you've got to secure the entire set of machines which ever connect to the servers, and all of the machines which ever touch the offline data. If your data is stolen off of a laptop or USB drive -- as an absurd amount of data has been -- it's just as stolen as if it's taken from the central server.

</comment></comment><comment><USER31> As a note, a user named <TD> has join #bitcoin-dev purporting to be from Google. They are restricting access to compromised accounts and sending out texts to change passwords. They stared with plaintext-passworded users but it appears it will include everyone. I don't know the legitimacy of these claims, but based on some of the comments here and in #bitcoin, it appears to be quite legitimate.

<comment><USER34> I can confirm this. My email is in the leaked db. Both my mtgox and gmail passwords are unique, hard to guess by a dictionary attack and not shared with anything else. I received Google's message to change my password.

As an aside, seeing the public text file containing 60k mtgox accounts is strange. Without looking too hard I found a couple of people I know in there.

<comment><USER31> Fortunately, being only a few days old, my password was salted but it's still unsettling to see my email address and username (my fullname) in there.

<comment><USER35> Same here. My email is my name, so they got my name, email, and username. Fortunately, it's a relatively new username I haven't used much.

</comment></comment></comment></comment><comment><USER36> As I say: Don't trust a programmer in a suit...or that writes backends with PHP.

<comment><USER36> Reason: Most .NET/PHP-programmers just don't care about readable code nor security per definition; it's strongly bound to the reason they picked this language from the start.

...or to quote the creator of PHP: [http://axonflux.com/5-quotes-by-the- creator-of-php-rasmus-le...](http://axonflux.com/5-quotes-by-the-creator-of- php-rasmus-lerdorf)

<comment><USER37> I don't doubt that most .NET/PHP programmers don't give a crap about security.

Is this any different from RoR or Django, though?</comment></comment></comment>


Thoughts on Microsoft Joining OIN's Patent Non-Aggression Pact - <AUTHOR> https://sfconservancy.org/blog/2018/oct/10/microsoft-oin-exfat/ <comment><USER2> 'the next logical step in its increasing embrace of Linux ...'

My thoughts?

"Embrace, Extend, Extinguish" is still Microsoft's Mantra.</comment>


A surprising JavaScript memory leak found at Meteor - <AUTHOR> http://point.davidglasser.net/2013/06/27/surprising-javascript-memory-leak.html <comment><USER2> Honestly, I'm not really sure I'd call this a "memory leak" \-- I just always assumed that _all_ the variables present in a closure are maintained, if there's an existing reference to any function defined within. I'm not surprised at all, this is what I would expect.

I'm actually suprised/impressed that Chrome has an optimization to detect which closure variables are actually used in a function and garbage-collect the rest.

But it's certainly something important to be aware of. I think the main point is, why on earth would you be constantly re-defining a function "logIt" within a function that is repeatedly called? That's just bad programming -- whenever you define functions within functions in JavaScript, you really need to know exactly what you're doing.

<comment><USER3> > I just always assumed that all the variables present in a closure are > maintained, if there's an existing reference to any function defined within.

In the logical sense each function has its own closure. There is no way functions should affect _which_ [edit for clarity] variables are closed on by each other. So you shouldn't expect this.

>I'm actually suprised/impressed that Chrome has an optimization to detect which closure variables are actually used in a function and garbage-collect the rest.

In the logical sense functions close over _their_ variables, not all variables that happen to be in scope. So that optimization is needed.

<comment><USER2> If I'm understanding what you're saying, that's just not correct. Try and run this code:

        var a = function() {
          var z = "a";
          window.b = function() { z = "b"; }
          window.c = function() { return z; }
        };
        a();
        window.c(); // returns "a"
        window.b();
        window.c(); // returns "b"

As you can clearly see, the single closure containing the variable "z" is shared between functions b() and c().

So each function does _not_ have its own closure -- closures work _" upwards"_, referencing _everything_ in every scope above them.

<comment><USER3> You have two closures that share a variable. Think about nesting it deeper.

      var a = function() {
        var z = "foo";
        window.getz = function() { return z; };

        var b = function() {
          var y = "bar";
          window.n = function() { z = y; };
        };

        var c = function() {
          var y = "baz";
          window.m = function() { z = y; };
        };
        b();
        c();
      };
      a();

Now function window.n and window.m have completely different closures that happen to share the upvalue 'z', but do not share the upvalue 'y'.

<comment><USER2> I don't see how that's refuting my point -- of course they don't share "y" because they're two completely different y's in two completely different local scopes.

I had understood your comment to mean that closures don't share variables, and I was just explaining that they certainly can. Maybe I'd misinterpreted what you were trying to say...

<comment><USER3> I wasn't trying to say that at all.

I was saying that two functions side by side have _distinct closures_ , no matter how many variables they share.

The reason I said that was to point out that variables closed over by one function shouldn't affect which variables are closed over by nearby functions.

Actually I think I see how to make the wording clearer in the original. Brb.

<comment><USER4> My $0.02 regarding terminology that may help this discussion: what you call a scope is, in Lisp terms, a (lexical) environment: something that, given a name, can give you a value or a "I don't know an object with that name" error, and that you can give a (name,value) pair (a _binding_ ) to create (languages vary a bit in the way they handle the case where the name already is known)

In many languages, environments are nested. For example, in the example:

      var a = function() {
        var y = "bar";
        var z = "foo";
        window.getz = function() { return z; };

        var b = function() {
          window.bb = function() { z = y; };
        };

        var c = function() {
          window.cc = function() { z = y; };
        };

        var d = function() {
          var q = 42;
          window.dd = function() { z = q; };
        };

        b();
        c();
        d();
      };
      a()

Calling b, c, and d creates three environments. The environment created by calling d adds a binding of q to 42 to its environment; neither the one created by calling b nor the one created by calling c add bindings of its own, but conceptually, these two have their own environment. All three build on the environment of function a; that environment contains bindings for y and z

Normally, when leaving a block, the environment created when entering it can be discarded. Here, however, the environments still can be reached after execution of the block has ended; each of those environments becomes (part of) its own closure when the function returns. The closures created by calling c and by calling d are functionally identical because they both build on the same 'parent' environment and have no bindings of their own, but conceptually, each has its own closure.

More, better info at [http://c2.com/cgi/wiki?LexicalClosure](http://c2.com/cgi/wiki?LexicalClosure) and, of course, in SICP, section 3.2 "The Environment Model of Evaluation" (although I remember seeing clearer pictures for that that involve making closures. Maybe they are in the videos?)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> TL;DR -- all closures created within a function are retained even if only one closure is ever referenced. This is really interesting, and potentially devastating for certain coding styles.

I ran the code on node and the RSS does appear to be increasing without bound. Even running node with --expose-gc and forcing a global.gc() inside logIt() causes the same unbounded memory growth.

Increasing the size of the array by a factor of 10 causes RSS usage to jump up by a factor of 10 every second, so we know that the memory usage isn't caused by creating a new long-lived closure (i.e., the logIt() function) every second.

In fact, removing the call to doSomethingWithStr() doesn't change the unbounded memory growth.

Here's a shorter snippet that demonstrates the leak more dramatically (about 10 MB/sec RSS growth):

      var run = function () {
        var str = new Array(10000000).join('*');
        var fn  = function() {
          str;
        }
        var fn = function() { }
        setInterval(fn, 100);
      };
      setInterval(run, 1000);

Tried it out on node v0.8.18

<comment><USER6> What is "RSS"?

<comment><USER7> After a nontrivial degree of Googling,

[http://en.wikipedia.org/wiki/Resident_set_size](http://en.wikipedia.org/wiki/Resident_set_size)

</comment></comment></comment><comment><AUTHOR> OP here. Several people have pointed out that of course I should expect a leak, since each `logIt` object is leaked. That's absolutely true; my point was just that we don't want `str` to leak.

But the original bug that led to this discovery involved a data structure that shouldn't have leaked at all. I've updated the post to show it; duplicated here since GitHub Pages seems to cache posts pretty aggressively.

        var theThing = null;
        var replaceThing = function () {
          var originalThing = theThing;
          // Define a closure that references originalThing but doesn't ever actually
          // get called. But because this closure exists, originalThing will be in the
          // lexical environment for all closures defined in replaceThing, instead of
          // being optimized out of it. If you remove this function, there is no leak.
          var unused = function () {
            if (originalThing)
              console.log("hi");
          };
          theThing = {
            longStr: new Array(1000000).join('*'),
            // While originalThing is theoretically accessible by this function, it
            // obviously doesn't use it. But because originalThing is part of the
            // lexical environment, someMethod will hold a reference to originalThing,
            // and so even though we are replacing theThing with something that has no
            // effective way to reference the old value of theThing, the old value
            // will never get cleaned up!
            someMethod: function () {}
          };
          // If you add `originalThing = null` here, there is no leak.
        };
        setInterval(replaceThing, 1000);

</comment><comment><USER8> An excellent catch. The parse tree for the closure should be able to ascertain the reachability of the variables in scope so that fences around particular sets of variables can be established. To do that would require something a bit more sophisticated than a single taint id though. You would really want a taint 'flavor' such that for any closure and in variable in scope of that closure you could defined f(closure, var) which would return turn if that variable cannot be collected. I can't think off the top of my head how you would recycle identifiers without risking temporal tainting (where a new closure in scope with the same id came at a later time and double tainted the variable leaving it essentially uncollectable or collected early. Hmm, or maybe not since their address on the heap will be different you're probably ok with that.

FWIW that is certainly the twisty bits of garbage collected languages.

<comment><USER9> > The parse tree for the closure should be able to ascertain the reachability > of the variables in scope so that fences around particular sets of variables > can be established.

Sadly it's not quite that simple because of the behavior of `eval` (strictly speaking, direct `eval`): it can leak bindings into the surrounding scope.

<comment><USER10> Nice! You've explained why this 'memory leak' could be by design - blame eval.

In fact, Chrome GC-ing unreferenced variables could break eval if they didn't cover that case.

<comment><USER9> Only direct `eval` though. As long as you don't see any calls to symbols named `eval`, you can implement this optimization.

See [http://stackoverflow.com/questions/8694300/how-eval-in- javas...](http://stackoverflow.com/questions/8694300/how-eval-in-javascript- changes-the-calling-context)

</comment></comment></comment></comment><comment><USER11> First, it is not a bug in JavaScript at all.

Here is a technical explanation of why there is a memory leak and how to fix the problem.

The scope chain of Closures (in JavaScript) contains the outer function(s) activation object. The activation object of a function contains all the variables that the function has access to, and it is part of a function's scope chain.

This means the inner function (the closure) has access (a reference) to the outer function's scope chain, including the global object. And even after the outer function has returned, the closure still has access to the outer function's variables.

Therefore, the activation object of the outer function cannot be destroyed (for garbage collection) after it has returned, because the closure still references its variables.

When the outer function returns, its own scope chain for execution (its execution object) is destroyed, but its activation object is still referenced by the closure, so its variables will not be destroyed until the closure is destroyed.

The execution context of a function is associated with the functions' activation object, but while the execution object is used for its own execution and is destroyed when it returns, its activation object is referenced by closures—its inner functions.

Now, as to the specific example in question: The reason the str variable is never destroyed is because it is referenced buy the logIt function because the logIt function's execution object references the entire scope chain of the run function, and the logIt function is never destroyed, so the str variable remains in memory.

As the original author (OP) suggested, be sure to dereference any local variable in the outer function that the closure is using, once the closure is done with it or once the outer function is done with it.

Also, simply setting the logIt function to null (when it completes execution—returns) will allow the str variable and the entire scope of chain of both the logIt and the containing run function to be destroyed and ready for garbage collection.

For a detailed explanation of closures in JavaScript, see "Understand JavaScript Closures With Ease": [http://javascriptissexy.com/understand- javascript-closures-w...](http://javascriptissexy.com/understand-javascript- closures-with-ease/)

<comment><USER12> You seem to be describing behavior that the article did not. Specifically, the retention of 'str' because of the 'logIt' function.

If you read more closely, you'll notice that logIt was _not_ the cause of 'str's retention, but instead, the doSomethingWithStr function was.

When logIt is present by itself, str is _not_ retained. Only when doSomethingWithStr is added alongside logIt is str retained.

<comment><USER11> nknighthb, I am just wondering. Did you downvote me because you think one part of my explanation was not specific enough?

First, you are correct that I specifically mentioned the logIf function when I discuss the specific example.But that does not take away from my thorough explanation of the main reason for the problem. In fact, everything I said about the logIt function applies to the doSomethingWithStr function, since they are both closures, so my explanation stands as is.

If you read my explanation again, you will see that I clearly explained that closures still have access to the outer function's scope, so both the logIt and the doSomethingWithStr functions have access to the outer function's scope chain even after the outer function or any of the other closures returns.

It is not until both all closures are destroyed or returns that the outer function's scope activation object is destroyed.

<comment><USER12> If your explanation were all there was to it, then 'str' would not be destroyed when logIt alone were present. But it is.

logIt alone -> str is garbage collected

logIt + doSomethingWithStr -> str is not garbage collected

Your explanation could explain the latter behavior, but it does not explain the former.

Edit: To put it another way, you are addressing only one of the scenarios presented in the article, and you are assuming that scenario results in a behavior the article _specifically says_ does not occur in empirical testing. This is a key point in the article, and your "explanations" are ignoring it.

<comment><USER11> Are you saying my explanation does not explain the following? "logIt alone -> str is garbage collected"

I don't see why you don't understand why I am saying. My first post explains in detail how closures work and why the issue is not a JS bug, though it is indeed a memory leak. All I can say is that I have explained the overall inner workings of closures in JS, and my explanation covers all the scenarios outlined in the blog post.

This is the crux of the matter of the entire blog post:

"...str is only referenced in the main body of run, and in doSomethingWithStr. doSomethingWithStr itself gets cleaned up once run ends… the only thing from run that escapes is the second closure, logIt. And logIt doesn't refer to str at all! So even though there's no way for any code to ever refer to str again, it never gets garbage collected!"

And I explained why that problem is observed and why closures work the way they do.

PS. I will humbly agree to disagree: I think that I have explained all the scenarios outlined in the blog post and you disagree with me. This is not a problem; there is nothing wrong with disagreeing.

<comment><USER12> Try answering this question specifically: Why is str garbage collected when logIt still exists?

<comment><USER11> Good question: I take it you are referring to the code below. The reason str is garbage collected is because of the modern implementation of the JS compiler in Chrome. Such modern JS compilers look specifically for such unused variables in closures, even when the variable is in the execution context of the closure.

To clarify, it is Chrome's decision to garbage collect the str variable in that context that resulted in str being garbage collected. It is not a result of a JavaScript bug.

Moreover, different browsers have different implementations for how they garbage collect variables in closures' scope chain. Heck, browsers do their own thing when it comes to many aspects of JavaScript.

On second thought (from our previous back and forth), you are correct that I did not explicitly discuss this specific issue in my earlier post. So you win :) and I have up-voted your two comments accordingly.

Here is the code I think you are referring to: var run = function () { var str = new Array(1000000).join('*'); var logIt = function () { console.log('interval'); }; setInterval(logIt, 100); }; setInterval(run, 1000);

<comment><USER12> Yeah, that's exactly what I mean.

The confusing part of your posts has been that you seem to have been portraying the retention of 'str' as a _necessary_ behavior. Nobody disagrees that it's a _permitted_ implementation, only that it's the one correct or best implementation, and it's made worse by the inconsistency between the two cases, which itself invites confusion.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> The C# compiler does the same thing:

[http://blogs.msdn.com/b/ericlippert/archive/2007/06/06/fyi-c...](http://blogs.msdn.com/b/ericlippert/archive/2007/06/06/fyi- c-and-vb-closures-are-per-scope.aspx)

This is an old article, but I believe it still applies to the latest iteration of the language.

<comment><USER14> Does indeed still apply, and is actually formalized into the language spec itself [1] in section 184.108.40.206 Captured outer variables. So it's actually a feature (really) in the case of C#, not a bug.

[1] [http://www.microsoft.com/en- us/download/details.aspx?id=7029](http://www.microsoft.com/en- us/download/details.aspx?id=7029)

 _" the local variable x is captured by the anonymous function, and the lifetime of x is extended at least until the delegate returned from F becomes eligible for garbage collection (which doesn't happen until the very end of the program)."_

<comment><USER15> I don't see how that part of standard mandates that all anomymous functions share the same closure. The example only has a single lambda.

</comment></comment></comment><comment><AUTHOR> I don't know how to look at memory usage in other modern JS interpreters like those used in FireFox and Safari. Anyone able to check to see if they have this problem? (And if they manage to avoid the memory leaks in the first two code samples?)

<comment><USER16> In Firefox you could always do it manually with _about:memory_ \-- 1MB a second should be easy enough to notice. Not sure they've added a way to get a pretty graph yet, though. Probably Firebug has a way?

I wonder if using the "use strict" directive would let the browser optimize this more easily? Probably not, but Javascript _does_ have a lot of crazy corner cases, and one of them might be preventing (or just making it harder to prove safe) the optimization.

 _e:_ Here's an example of one of those corner cases:

        console.log = eval

Now whether those functions reference a particular variable depends on the string they're printing! And this swap out of _log()_ could be done at any time.

 _e2:_ Ah, as glasser and pcwalton point out, an indirect reference to eval doesn't work the same way as a direct call. TIL!

<comment><AUTHOR> No, actually, you literally have to call eval as a function called eval if you want to get the local lexicals. See sections 10.4.2 and 188.8.131.52.1 of the ECMAScript standard, or try it out:

       > (function () { var x = 5; eval("console.log(x)"); })()
       5
       > (function () { var x = 5; var e = eval; e("console.log(x)"); })()
       ReferenceError: x is not defined

</comment></comment></comment><comment><USER17> It's more of a surprising non-leak caused by clever GC that is insufficiently clever to handle pathological code. Interesting explanation, but yet another reason to be very careful of setInterval.

<comment><USER18> Not only setInterval though. This sort of leak can also show up if the closure is a DOM event handler or is otherwise exposed.

<comment><USER17> It can show up anywhere — and in fact event handlers are a major source of leaks in general — but the point is that the leak doesn't occur as frequently as you might expect not that it occurs.

</comment></comment></comment><comment><USER14> That this kind of issue exists in javascript should come as a surprise to no one - there are probably a huge number of these kind of issues just waiting to be found. It's actually the key difference between a 'designed' language and an 'evolved' language.

EDIT: I find the down-votes very amusing. Has javascript now developed a cult? Read up on the history of javascript if my message above comes as a shock to you.

<comment><USER19> I wonder if this will temper the rise of the server-side JS frameworks?

<comment><USER14> Not likely - these kind of bugs are generally fixed when found, or remain hidden simply because that part of the language is very rarely used. You'll likely see this bug in Chrome fixed within a few months.

I was commenting more on the practical effects of having an evolved language - this is a known and likely outcome in an evolved language. Designed languages generally spend a lot of time trying to avoid these kind of issues - it makes sense that not spending that time and adding in features as they are thought up means issues like this will creep in somewhere.

<comment><USER9> The only _language_ features at play here are closures and garbage collection. Pick your favorite "designed" language: if it has those two features, an implementation of that language could have this bug.

</comment></comment></comment></comment><comment><USER20> I don't know how you can safely declare what's used vs unused in a language where properties can be dynamically accessed.

It's easy to check for dict.someProperty, but dict[propertyName] where propertyName can be the string "someProperty" is a much more complicated problem. Now you have to build a tree of everything that changes propertyName and make sure you know it can never be "someProperty".

<comment><USER21> You can't dynamically access scope objects in standard javascript[0] except by using `eval`, and `eval` already triggers special handling and deoptimizations in pretty much all browsers.

[0] outside of the global scope through `window` but all variables are clearly local here so that doesn't apply.

<comment><USER20> Doh! Good point.

</comment></comment></comment><comment><USER22> Nice find. I've run into some inexplicable garbage collection issues where canvas elements in an early version of flot ended up never getting released. I could figure out no way to clear these, but I remember the flot code made heavy use of closures. I should go revisit the code and see if this might explain it. I ended up simply hanging on to the elements and reusing them, had to patch flot to achieve this.

</comment><comment><USER23> The fix in [https://github.com/meteor/meteor/commit/49e9813](https://github.com/meteor/meteor/commit/49e9813) seems to be just limiting the effect of the problem, not removing it.

The variable is still being held in memory just with the value null instead of whatever it was before.

Or does setting it to null trigger some special GC algorithm that detects that it isn't being used anymore?

<comment><USER24> There's nothing particularly special about null - it's really just that it's being set equal to any constant (or object that already exists for the life of the program). The object that was allocated and previously held in renderer will be GC'd (nothing special about that - it doesn't have any references anymore), and setting to null doesn't create a new allocation. You still have "renderer" as an entry in the dictionary of variables for the closure (which takes up a small amount of memory, presumably), but it's no longer preventing an object from being deallocated.

</comment></comment><comment><USER25> This article taught me how to find a major leak in my Dart2js code so thanks John McCutchan & Loreena Lee [http://www.html5rocks.com/en/tutorials/memory/effectivemanag...](http://www.html5rocks.com/en/tutorials/memory/effectivemanagement/)

</comment><comment><AUTHOR> Looks like Go optimizes this fully, as pointed out by [https://twitter.com/nynexrepublic/status/350717895971586049](https://twitter.com/nynexrepublic/status/350717895971586049)

If you run these on your own machine and peek at the RSIZE, it stays constant (well, the first grows slowly due to `logIt`).

[http://play.golang.org/p/A5Pz-3kthP](http://play.golang.org/p/A5Pz-3kthP) [http://play.golang.org/p/RnXr_jB5Qh](http://play.golang.org/p/RnXr_jB5Qh)

</comment><comment><USER26> > _You could imagine a more clever implementation of lexical environments that > avoids this problem. Each closure could have a dictionary containing only > the variables which it actually reads and writes; the values in that > dictionary would themselves be mutable cells that could be shared among the > lexical environments of multiple closures._

That is basically how Lua implements closures.

[https://bugzilla.mozilla.org/show_bug.cgi?id=542074](https://bugzilla.mozilla.org/show_bug.cgi?id=542074)

</comment><comment><USER27> Kudos to the excellently talented Meteor team. A great product from a genuine customer (of a free product), who feels great that there is such attention to detail.

</comment><comment><USER28> If we implement the suggested fix, and then someone evals code in that scope, they can get the surprising result that variables which look like they should be in scope actually aren't. Careful analysis of this will have many edge cases to worry about.

Implementing the simplest thing that is correct according to the spec sounds like a good idea to me.

<comment><AUTHOR> Yes, but you can statically determine whether or not eval is called.

A world-class JavaScript environment like V8 is far past "the simplest thing that is correct according to the spec".

In fact, the JavaScript spec doesn't actually define anything about garbage collection! You can create a compliant ECMAScript-262 runtime that literally never collects any garbage ever. That's certainly the simplest correct thing. But it's a bad idea!

V8 already goes to the trouble of figuring out whether or not a given variable needs to be stored in the lexical environment or not. Specifically: variables that are not used in ANY closures and where there is no eval in sight can be stored outside of the lexical environment. This is great, and better than many similar programming language environments offer.

It just would be even better if they went one step farther.

<comment><USER28> V8 attempts to be fast. There is a trade-off between sophisticated analysis during compilation, and page performance.

I'm not as convinced as you that they haven't found the right balance.

</comment></comment></comment><comment><USER29> This problem has been encountered and studied before: see Appel and Zhao's paper, Efficient and Safe-for-Space Closure Conversion.

<comment><AUTHOR> Cool! A major reason I made this post was because I assumed that this must be something people had seen before, but I had trouble finding any references to it in the JavaScript context. I'll add a link to [http://flint.cs.yale.edu/flint/publications/escc.pdf](http://flint.cs.yale.edu/flint/publications/escc.pdf) to the blog post!

</comment></comment><comment><USER30> The example code looks really silly. As others said, it's just bad programming.

</comment><comment><USER31> I'm surprised this comes as a surprise to Meteor developers. References retained won't be garbage collected... regardless of whether the lexical scope is "really small" or not, lol.

<comment><USER32> The surprise is that a non-referenced value isn't collected, not that a referred-to value isn't.

</comment></comment><comment><USER33> That is surprising? A setInterval without a matching clearInterval is always a memory leak.

<comment><USER34> No it's not.

      setInteval(function() { console.log('foo'); }, 1000)

Is not a memory leak.

But I agree that it's not surprising at all. If you can access a variable from somewhere it will obviously not be garbage collected.

<comment><USER5> The point is that you can't access str from elsewhere, which is why it _is_ surprising.

<comment><USER35> But you're still clearly retaining a reference to the lexical frame, so I'd think the "zeroth-order" assumption would be that you'd be keeping everything in that frame.

It's nice that JavaScript will do enough tree-shaking that it will eliminate the single-closure case, but that's an optimization, not something you should be counting on.

Similarly, I bet if you had a call to "eval" in there, you'd keep the entire frame, but I don't understand the exact semantics of JavaScript's eval enough to really say.

I suppose this boils down to whether your mental model is more "frame-like" or more "upvalue-like". If you think of keeping around the containing frame, it's not at all surprising that you retain the variable. If you think of the closure as a discrete set of upvalues, then it's a surprise.

<comment><USER5> > I'd think the "zeroth-order" assumption would be that you'd be keeping > everything in that frame.

Why would that be a reasonable assumption? If a variable cannot ever be referenced, it should be garbage collected. In the example, "str" cannot ever be referenced. This is why we use garbage collected languages.

> but that's an optimization, not something you should be counting on.

It's not an optimization, it's correct GC behavior, and it's absolutely something you should be counting on if you're using a GC language.

<comment><USER35> I suppose I don't find it surprising, because I've used a lot of R, and R can't even optimize the simple case. There, it's for good reason, since you can extract the environment of any function, so once a closure escapes, you have a handle onto its entire containing frame.

I think I've used scheme implementations that have the same "feature", with less of an excuse.

It's a similar "failure of GC" if you create an object with two fields, like "obj={a: giant_value, b: 5}" then had your closure return obj.b. I bet the "a" slot would not be GC'd, even though there's no way to reach it.

If your mental model is that you're holding onto the lexical frame, it's a pretty much the same behavior.

<comment><USER5> > like "obj={a: giant_value, b: 5}" then had your closure return obj.b. I bet > the "a" slot would not be GC'd, even though there's no way to reach it.

It absolutely should be GC'd. To demonstrate (on node again), this uses about 10MB of RSS, because obj.a cannot be GC'd.

      j = function() {
        var obj = {
          a:  new Array(1000000).join('*'),
          b:  5
        };
        return obj;
      }();
      setTimeout(function() {}, 30000);

If you change "return obj" to "return obj.b", RSS is about 9kb.

Edit: I think your understanding of GC might be coming from R's generational GC, which is a heuristic and quite different from V8's incremental GC: [http://blog.chromium.org/2011/11/game-changer-for- interactiv...](http://blog.chromium.org/2011/11/game-changer-for- interactive.html)

<comment><USER36> V8's GC is both generational and incremental.

Generational can be actually viewed as a variation of incremental GC.</comment></comment></comment></comment></comment></comment></comment></comment>