Ruby on Rails to Lucky on Crystal: Blazing fast, fewer bugs, and even more fun - <AUTHOR> https://hackernoon.com/ruby-on-rails-to-lucky-on-crystal-blazing-fast-fewer-bugs-and-even-more-fun-104010913fec <comment><USER2> Author of Lucky here. The title may have been a bit misleading. Lucky is not Ruby on Rails for Crystal. It has a different take on nearly everything in Rails, but it aims to solve the same problems: make web development fun and productive.

But it also adds: and make writing fast applications easy, and prevents bug from making it to production.

If you use Lucky now, you will be missing the vast ecosystem that Ruby and Rails provide, but I think that is a temporary problem. Lucky and Crystal are growing quite quickly.

</comment><comment><USER3> Eh - Rails is good. Really good. And I don't think it is just _so_ flawed that another framework has to come along and make things better. It's also fast, has a great ecosystem, is one of the least buggy development environments, enjoyable to work with...

That said, Crystal needs a rails-like framework. And who knows - maybe it will come to replace rails as the most productive and enjoyable framework for web development. But it'll take a while, a long while, to replicate the robustness that rails has - and a lot of that has to come from a vibrant community.

But it's not changing any games - it's still just a web development framework, for a language that's not even at 1.0.

<comment><USER2> I agree. I've been using Rails for 12 years and it is my second favorite framework :)

Lucky and Crystal are missing the ecosystem, which the article mentions, but it also adds a lot that Rails is missing. Lucky is much much faster and the speed is effortless. Rails _can_ be fast, but based on my experience so far, you have to do some work to get reasonable speeds.

Lucky and Crystal have also caught a lot of bugs, which makes development much more pleasurable, and happier customers.

Right now, it probably takes longer to use Lucky and Crystal. Like you said, the ecosystem is lacking so you often have to write code that Ruby would have a gem for, but in the long term, this will be solved. I'm very confident of that.

</comment></comment><comment><USER4> "Ruby on Rails for ___" is getting really old. Here's why:

Nothing will compete with Ruby on Rails for the foreseeable future. That's not to say these attempts are meaningless, but trying to compare something to Ruby's ecosystem just isn't fair.

Ruby's ecosystem caught fire in thanks to Rails, and in thanks to how we were writing web apps in the mid-late 2000s. Web frameworks were just starting to really gain adoption by hobbyists. On top of that, people were sick of writing PHP.

Remember the days of uploading a bunch of files to some server via FTP? When shared hosting powered your forums for a little while? When 100gb bandwidth was a ton? I do.

Any sort of meaningful alternative to those pains was attractive. People flocked. And Ruby's ecosystem thrived.

Ruby on Rails is much more than a handful of libraries (ActiveRecord, ActiveController, etc.) coupled in an MVC pattern to make life easier. If Rails was just that without the entirety of the Ruby ecosystem, my point would be moot. But it's not. And it's a beautiful world to live in.

I guess my point is that saying something competes with Ruby on Rails is laughable. "A new MVC framework, for those who are familiar with Rails's conventions" is better. But all this Ruby on Rails for Y... It's so near- sighted.

<comment><USER2> I do not think Lucky is Ruby on Rails for Crystal. There are new patterns for just about everything. Routing is different, querying is different, views are _very_ different.

It is Rails-like in the sense that it is aimed at productivity and developer happiness and that it aims to have most of what you need in one package.

Of course Ruby has a better ecosystem, this is mentioned in the article. Lucky (and Crystal) have a long way to go, but things are progressing rather quickly</comment></comment>


RWW - Hands on with Wolfram Alpha - <AUTHOR> http://www.readwriteweb.com/archives/hands-on_with_wolfram_alpha.php

<comment><USER2> Good god, I get tired of people calling this a "Google killer" when Wolfram has said over and over again that that is not his goal.

<comment><USER3> The public decides if it is a Google Killer, not the software maker. People will use your software in ways you never imagined. The makers of one of the slide show websites said she was really shocked when Preachers became their most popular demographic of users -- they were uploading their sermons, who would have guessed that?

That being said, most people who go to Google aren't looking for the kinds of answers Wolfram Alpha provides, so I doubt it will kill google, though if it gets out of Wolfram's control it could begin putting out the kinds of results googlers want.

You never know.</comment></comment>


KnowBe4 Got a CEO Fraud Phishing Attack. Wrong Mark - <AUTHOR> https://blog.knowbe4.com/knowbe4-got-a-ceo-fraud-phishing-attack.-wrong-mark <comment><USER2> We got hit by a similar spear phishing attempt - typically terse email from a buyer who used to be a Director.

Luckily we caught it. It was close though, the accounts clerk who received the enquiry asked for confirmation and then got bombarded with emails for a while - all single letter variations of the buyer's name.</comment>


Chapel: a parallel programming language designed for productivity at scale - <AUTHOR> http://chapel.cray.com/ <comment><USER3> Chapel (from Cray), x10 (from IBM, and fortress (from sun) were all created to solve this problem (and all got funding from DARPA to do so). Fortress (which was way out there and very cool!) Died a horrid death. I think x10 still exists.

Of all the languages out there, Julia may be the one to be used for this eventually.

<comment><USER4> I really enjoy Julia, and I see such amazing potential from it but I talk to so many people who hate it, or complain about it. I know most people haven't had the pleasure (/s) of programming in MATLAB and so some of decisions might not make sense, but that aside it's a damn good language.

I really see Julia 'winning' in the longevity sense, but it makes me nervous sometimes seeing people misunderstand that. Do you think that similar misunderstandings have prevented Chapel and company from a more widespread success?

Also, Erlang is fairly successful. According to Wikipedia, Chapel was started in 2009, and Erlang was around back then too, what does Chapel provide that obsoletes Erlang? What problem does DARPA think that Chapel/x10/etc could solve that Erlang couldn't?

<comment><USER5> Chapel and the other two languages were part of the HPCS project. An HPCS goal [was] to create a multi petaflop systems [1]. Erlang is not really the kind of language you can use to build such systems. It's not that Chapel (or the other two) 'obsolete' Erlang, it's that they were built with completely different goals in mind.

[1] [https://en.wikipedia.org/wiki/High_Productivity_Computing_Sy...](https://en.wikipedia.org/wiki/High_Productivity_Computing_Systems)

</comment></comment></comment><comment><USER6> Brings back memories as I followed the three languages for a while. Good to see a link to one plus arthurcolle's great link to a summary of Fortress's strong points. A recent foray into this theme is ParaSail language below.

[http://www.embedded.com/design/other/4375616/ParaSail-- Less-...](http://www.embedded.com/design/other/4375616/ParaSail--Less-is-more- with-multicore?page=0)

Meanwhile, functional approaches like Erlang and Haskell have been most impressive. Still a need to improve with languages already there. Cilk (below) was one for C. I've also included a list on Wikipedia for people interested in this topic.

[http://supertech.csail.mit.edu/cilk/](http://supertech.csail.mit.edu/cilk/)

[https://en.wikipedia.org/wiki/Category:Concurrent_programmin...](https://en.wikipedia.org/wiki/Category:Concurrent_programming_languages)

</comment><comment><USER7>
         config const n = 100000;    // override default using ./a.out --n=<val>

What? I smell anti-pattern. `const` should promise or specify to the compiler that this value doesn't change, so it can be baked into code.

Automatic translation of command line arguments to variables is useful (I have implemented this in shell scripts past as a nicer alternative to getopts). But the variables which receive command line overrides should be set apart in some way for that purpose.

<comment><USER8> That's not what const means, in any language I've seen with a const qualifier.

<comment><USER9> In C# it is exactly what it means. const values are substituted directly during compilation. This is why sometimes it makes sense to declare a variable as static readonly instead of const.

<comment><USER10> I'd argue that you are conflating implementation with semantics. The semantic meaning of const is 'this value will not change from here on out'. The C# compiler implements this by doing a substitution, but that is not mandated by nature of it being 'const'. Calling these variables 'config const' says 'this will be instantiated by some configuration parameter, but from here on it it will cannot change'.

If someone were to patch your C# compiler such that it didn't substitute, and instead pulled from a read-only memory location, would it in any way harm the correctness of your code?

<comment><USER9> Actually I think it's the other way around. Since there is no guarantee that it is not copied, you can't assume either way. const means just that - <USER2> at compile time. As you say how the compiler chooses to utilize that information is up to the implementation.

In C# you can't assign a const to a value not known at compile time for this very reason. However, you can assign a variable value to a static readonly field.

<comment><USER10> That's because of the implementation details of C#. If I make a const pointer in C, it's obviously not a compile-time value, because the memory location can't be guaranteed at compile time. Const values in C are definitely able to be assigned from variables. Very few languages share C#'s requirement that the assignment be known at compile-time (the only other one I can find is Nim).

<comment><USER7> Nitpick: (scoped) const variables in C can be _initialized_ from run-time values, not _assigned_.

RAAI: Really, assignment ain't initialization.

A file scope const object in C can have a value which is not known at the point of declaration.

        extern const int var;

This one is not known until either a definition is supplied later in the same translation unit, or else not until linkage with another translation unit which supplies a definition.

        static const int var;

In this case, the value is not determined until either a definition is seen which provides an initializer, or else the the end of the translation unit is reached (whereupon the tentative definition becomes actual, with a value of zero).

In this situation, though, the static value can be propagated as a true literal constant into code which precedes the point where the value is known. Just not in a "one-pass compiler".

This is also the case when a block-scoped const is initialized with a literal constant:

       { const int x = 5; /* almost "true" constant */ ... }

In C, x isn't considered a constant expression, but _de facto_ it is, which is good enough for optimizing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Hi - I am a member of the Chapel team at Cray. I will be happy to answer your questions about Chapel.</comment>


Class(American) - <AUTHOR> http://siderea.livejournal.com/1260265.html?format=light <comment><USER2> I found this honestly very enlightening as a programmer who's been inadvertantly "climbing" for a while.</comment>


Ask HN: How much should I charge for inboxing marketing? - <AUTHOR> I have a site with 300k daily impressions and almost 10k registered users, and someone reached out asking if I do inbox marketing (in the website, its a forum).
Honestly, I have no idea how much to charge.
What are some variables I should take into account?
Any suggestions? <comment><USER2> have you used the product? And can you give a personal testimonial? Also, do you email your users much with other useful content?

All those factors will go along way to value. you might want to think about a % of sales, like an affiliate but at a higher percentage since they approached you.</comment>


Ask HN: If you could work at any company where would you work and why? - <AUTHOR> <comment><USER2> Roam Research - This note taking app did things to my mind that no app has done before

</comment><comment><USER3> Calico - longevity research</comment>


I Quit My Job. Here's How I Planned the Start as an Entrepreneur - <AUTHOR> https://medium.com/@sjorsvandongen/i-quit-my-job-heres-how-i-planned-the-start-as-an-entrepreneur-7bc546631431 <comment><USER3> If I understand the timeline:

\- July 2019 - start first full time job

\- early 2020 - 6 months unpaid leave

\- June 2020 - quit job to start company

\- August 2020 - blog post about how to quit your job

So someone with less than a year of full time experience who seemingly hasn't actually built a business is giving me advice on how to successfully quit my job? I guess that's the part they've succeeded at so far.

<comment><USER4> How to become an entrepreneur (from someone who has actually done it):

      - Get income from other people via job
      - <USER2>
      - Come up with idea
      - Test market in 2 weeks for < $100
      - Rinse and repeat until market test gives positive results you can't ignore
      - Quit job
      - Release version 1 in 2 weeks
      - Have income by 4 week mark
      - If no income by 4 week mark, u fucked up, get a job

<comment><USER5> How high should the income be though? A few existing clients of mine were willing and did change to my platform, but how do you know if the business is scalable/will be competitive against other large businesses?

<comment><USER6> While helpful, I do believe these types of "rules" should not be followed as if they're set in stone. Adapt them to your own situation.

In my case I had success with a fairly complex big data platform, there would be no way a version could be released in such short a time. This didn't matter, as I followed a slightly different strategy.

A different way of looking at things is thinking about what can do wrong, and working back on trying to mitigate things. There's a big, big difference in strategy you need to take if you need, say, a thousand paying clients in order to be "ramen profitable" vs one big client. I work in the latter space, and we managed to find a way for our first customer to partially fund the development of the platform, the money they would get back once the "monthly payments" would otherwise be arriving.

Totally different approach, but it's one hell of a validation of an idea without taking on too much risk!

<comment><USER4> Well said. Yes of course those rules aren't set in stone but the idea is remove as much risk as possible, as cheaply as possible.

</comment></comment></comment></comment></comment><comment><USER7> I would actually recommend not quitting your job to be an entrepreneur. I did it, and as the money ran out I couldn't even focus anymore and made poor decisions. It seriously affected my self esteem as a man. It might be different if you're single and young and can get your expenses really low. But I am married and was supporting my wife in her education.

I strongly advise getting a part time job and bootstrapping in peace knowing you have the bills covered. The change of pace switching between tasks is not unwelcome, and I feel like I can make better decisions without a gun to my head. I don't feel like I'm losing any productivity.

I also have the resources to hire someone to do e.g. Some of the front-end development that I'm not that good at anyway, if I chose to.

<comment><USER6> I concur. It's so stressful when the clock starts ticking: suddenly you are racing against time, which may cause a certain kind of desperation, which makes you make poor choices.

Most of the things the poster is doing, like figuring out "what type of business do I want to start?", are absolutely things you must find out before you quit your job.

I would even go further and say that one should already validate the business idea before quitting. Once you figure out what you want, you can perhaps start slowly scaling down work (I know working 4 days a week is very common in .nl) and use the extra day to validate the business.

All in all, I'd say that following the advice mentioned in the article is not good for starting entrepreneurs.

</comment></comment><comment><USER8> So he's spent a month of his six-month runway, and what he's accomplished so far is writing a journal and rating a bunch of fields of business on how much he might theoretically enjoy starting a company in one of them.

Starting a business is about getting things done. Thinking about what things you might possibly want to get done in the future, or making charts about things that you aren't getting done is a pleasant way to avoid getting things done, but it doesn't really get you any closer to your goal.

</comment><comment><USER9> This is almost comedic at the complete lack of self-awareness. Once it got the to happiness rating of e-commerce and starting a podcast, I half expected the next paragraph to be an MLM pitch.

</comment><comment><USER10> This isn't advice, this is marketing. Dudes been in the workforce for a year and intended to spend half of this time travelling and has now quit.

I wish him all the best but this isn't the way to do it if you really want to make it on your own.

I ran a company for nearly a decade straight out of uni and can tell you it's horrendous to have no income and no fall back, I got through it with a lot of luck and making some some funding decisions that ultimately killed the business.

Start small, grow on the side, build something stable and then go full time - or raise a boat load of VC and hope for the best.

</comment><comment><USER11> I really like Derek Sivers "Change Careers Like Tarzan" model [https://sive.rs/tarzan](https://sive.rs/tarzan)

"I get emails from many people who want to make a big change in their career.

Each one wants to quit their current career, and boldly leap into their new venture or preferred lifestyle.

When they ask my advice, they think I'm going to say, "Yes! Quit! Go for it!"

But instead, they're surprised at my suggestion:

Remember how Tarzan swings through the jungle? He doesn't let go of the previous vine until the next vine is supporting his weight.

So my advice is: Change careers like Tarzan.

Don't let go of the old one until the new one is supporting you.

And make sure you don't lose momentum."

<comment><USER12> Its tough to take advice based on analogy to a fictional character.

<comment><USER11> Think of it as taking advice from a successful serial entrepreneur who is using a metaphor.

</comment></comment></comment><comment><USER13> He quit his job at a consultancy to become a solo consultant. Groundbreaking.

</comment><comment><USER14> Dutch government has lot of benefits and Grants for people who wish to create their own company. I would recommend applying for them in worst case scenario

<comment><USER6> WBSO and MIT come to mind. WBSO only works well if you already have some source of income, though, which can be from a part time job.

</comment></comment><comment><USER15> With economy going down the drain and nobody sees the end of the tunnel, I'm not sure, that leaving your job is the best decision, because as it was mention in the article:

"The worst thing that can happen is that I don't earn any money in the next 6 months and I'll have to find a job again."

Not sure how the job market will look in February, but pretty sure, not as nice as before Covid.

</comment><comment><USER5> Says "only action leads to results" then lists out 9 different things you should plan out... lol

And don't get me started on Tony Robbins

</comment><comment><USER16> It's almost impossible to start a business by yourself.

Your first 5 years of your career are vital because you're making connections that you can leverage when starting a new venture.

But starting by yourself AND having almost no understanding of how the industry works. No chance. This type of move kills career trajectories.

<comment><USER10> If my business had failed in the first 4 years I'd have been toast. As it was killing the business after 8 years was still hard enough to build a new career from. Starting a business in your early 20s is fun, it can work out and you will learn a lot but if it tanks you'll have been better off starting in a normal job 9 times out of 10

</comment></comment><comment><USER17> You'll probably want to validate the R in your ROI ratings with the people who will be using your product as quickly as possible instead of making educated guesses. There have been many times where my expectations of return were completely wrong.

</comment><comment><USER18> I feel like this may be relevant: [https://shefska.com/blog/i-quit-my- job](https://shefska.com/blog/i-quit-my-job)

I documented my decision making process leading up to leaving the firm I was COO at. I was 24, and making $200k per year. I still knew entrepreneurship was the right decision. So glad I made the leap!</comment>


Why does YouTube not support http? - <AUTHOR> youtube is https-only these days, for a video site why do we need https? yes login page etc needs to be ssl-protected, but what's the point of free video streaming under https? not to mention you can download those videos easily. <comment><USER2> The top answer here is good: [http://security.stackexchange.com/questions/258/what-are- the...](http://security.stackexchange.com/questions/258/what-are-the-pros-and- cons-of-site-wide-ssl-https)

"Since most of the other answers here deal with the downsides of site-wide SSL (mainly performance issues - btw these can easily be mitigated by offloading the SSL termination, either to an SSL proxy box, or an SSL card), I will point out some issues with having only the login page over SSL, then switching to non-SSL:

\- The rest of the site is not secured (though this is obvious, sometimes the focus is too much on just the user's password).

\- The user's session id must be transmitted in the clear, allowing it to be intercepted and used, and thus enabling the bad guys to impersonate your users. (This is mostly what the Firesheep hubbub was about).

\- Because of the previous point, your session cookies cannot be marked with the secure attribute, which means that they can be retrieved in additional ways.

\- I have seen sites with login-only-SSL, and of course neglect to include in that the Forgot-password page, the Change-password page, and even the Registration page...

\- The switch from SSL to non-SSL is often complicated, can require complex configuration on your webserver, and in many cases will pop up a scary message for your users.

\- If it's ONLY the login page, and f.e. there is a link to the login page from your sites home page - what is to guarantee that someone won't spoof/modify/intercept your homepage, and have it point to a different login page?

\- Then there is the case where the login page itself is not SSL, but only the SUBMIT is - since that's the only time the password is sent, so that should be safe, right? But in truth that removes from the user the ability to ensure ahead of time that the password is being sent to the correct site, until its too late. (E.g. Bank of America, and many others)."

I imagine top YouTube contributors would be pretty annoyed if their account got hijacked.

<comment><AUTHOR> isn't youtube's content mostly if not all freely accessible already? the premium portion can be hosted as ssl-only, what about the rest 99% of the content that is public already, why do we need care about hijacking in this case?

<comment><USER2> For the extra complication of making a mixed HTTP and HTTPS site, what benefit are you gaining?

<comment><AUTHOR> nginx and apache can support http/https in parallel fairly easily, not much extra complication per se. the benefits are listed in a post below.

I was chatting with a youtube engineer last night and she told me that she does not recall a wide discussion on disabling http fully, I thus submitted a request in youtube's forum and see how it goes.

<comment><USER2> > nginx and apache can support http/https in parallel fairly easily, not much > extra complication per se. the benefits are listed in a post below.

There are extra complications besides the server setup. For example, it's harder to avoid mixed content errors on HTTPS pages, you couldn't just use the "secure" flag on all cookies and you need to be careful not to send passwords or session data over HTTP. Many sites have login forms on HTTP pages that then send you over to the HTTPS site for example but this isn't secure.

Not saying it has no benefits, but mixing HTTP and HTTPS does have complications.

> I was chatting with a youtube engineer last night and she told me that she > does not recall a wide discussion on disabling http fully, I thus submitted > a request in youtube's forum and see how it goes.

Great, I'd be interested to know the reason as well.

</comment></comment></comment></comment></comment><comment><USER3> Even if they just sent the video stream itself over HTTP and did everything else via HTTP, now intermediaries could monitor what you are watching and block content selectively.

The pages themselves are so interlinked with account info & access ... that they really shouldn't be loaded without HTTPS. And weird mixes of HTTP and HTTPS are a pain to make work, because browser rightfully block mixed-content and it's way to easy to make security mistakes. Easier to just slap TLS on everything and be done with it.

Don't forget that loading a single page over HTTP gives a perfect entry-point for MITM attacks to redirect to e.g. a faked copy of youtube that steals data.

What downside does HTTPS for everything have for you?

<comment><AUTHOR> I'm not against https at all, but I do think have http-support in parallel is useful in some cases, and there is no cost to do that(i.e. support both http/https as google.com does).

the benefit of having http:

1\. corporate proxy can filter youtube

2\. we can do content-filter for kids browsing

3\. better caching support in proxy

4\. much less demanding on hardware, ssl is very cpu intensive etc

<comment><USER4> Many people _are_ against HTTP. It's out-dated technology that leaves users vulnerable.

1\. There are more effective methods.

2\. There are more effective methods.

3\. Not useful for long-tail and no one wants modified videos.

4\. The additional overhead is an insignificant cost, even to YouTube.

Your reasons for wanting HTTP are the same reasons YouTube uses HTTPS. They don't want third-party blocking, tracking, interception, or modification. YouTube is doing what their _users_ want by protecting them.

In 2016, any company that doesn't use HTTPS everywhere is probably incompetent.

<comment><AUTHOR> https is quite computation-intensive and it has its additional cost to hardware, by offering http in parallel that might mitigate the pressure a bit when https is unneeded.

when content filtering is mandated(corporate, school, church,etc), they're going to do it anyway, just need more powerful router/firewall/proxy in the middle, if http is available it will ease that to a great deal.

for people needs security, just use https by default, for people perfers to http sometimes, they will have the optional choice, just like what google.com does now.

<comment><USER4> 1\. The additional cost is insignificant thanks to increases in CPU performance. The cost of 60 fps 4K videos is also high, and YouTube does this as well. You're confused about how good companies view costs and benefits.

2\. Content filtering can be done in other ways, more effectively. HTTPS does not prevent this.

3\. Everyone needs security and privacy.

You don't seem interested in learning, so I'm done trying. Keep believing whatever you want while the entire web moves to HTTPS-only for very obvious reasons.

</comment></comment></comment></comment></comment><comment><USER5> As far as HTTPS improves privacy, all sites need it. It's not up to a company to decide what parts of browsing should or shouldn't be private. There are families/societies where watching certain YouTube videos could lead to being jailed or killed. Users shouldn't be bothered by paying attention to the status bar on every site -- we should just protect them by default.

</comment><comment><USER6> In addition to what else has been said so far, some videos are private, and making those videos interceptable would allow unauthorised access. Moreover, YouTube is not used only for entertainment. Unlike standard television, where the content is essentially chosen and pushed to you, YouTube involves pulling specifically that content on those topics which you want personally. Also unlike standard television, a greater portion of the content is controversial, biased, or sensitive. Similar to the idea of plausible deniability, making the site HTTPS-only allows people not to feel ashamed of viewing with SSL. Otherwise, we would have the classic problem of those using encryption being seen as suspicious or shady, which would prevent people from seeking the information they truly want. In a world where all your thoughts are being monitored at all times, you have no free thought.

</comment><comment><AUTHOR> not to mention video-https is very cpu-intensive, unnecessary in my opinion.</comment>


AskTog: Restoring Spring to iPhone/iPod Touch Springboard - <AUTHOR> http://www.asktog.com/columns/080Springboard.html

<comment><USER2> Lukas Mathis has written a great critique of it: <http://news.ycombinator.com/item?id=879798></comment>


Pager duty for developers? - <AUTHOR> http://discuss.fogcreek.com/joelonsoftware/default.asp?cmd=show&ixPost=11791 <comment><USER2> I've never heard of such a practice and it sounds unfathomably strange. Is it just a web development problem?

A couple of my employers have given me a cell phone, but that's no big deal - I just leave it in the office when I go home.

<comment><AUTHOR> It is one of the contention points here: <http://news.ycombinator.com/item?id=3101876></comment></comment>


Spotify hit with outage after forgetting to renew a certificate - <AUTHOR> https://www.bleepingcomputer.com/news/technology/spotify-hit-with-outage-after-forgetting-to-renew-a-certifficate/ <comment><USER2> Is that certificate they bought [1] $688 [2] for the year?

I've been wondering for a while if any security researchers use those overpriced certs as an indicator. Someone paying $600+ per year for an SSL certificate and forgetting to renew it is an indication they might be misunderstanding and neglecting other stuff, right?

1\. [https://crt.sh/?id=3263659027](https://crt.sh/?id=3263659027)

2\. [https://www.digicert.com/wildcard-ssl- certificates/](https://www.digicert.com/wildcard-ssl-certificates/)

<comment><USER3> All companies are misunderstanding some things and neglecting other things. There's a way in to every system. The best companies hire red teams to pentest their own systems and do their best to fix the flaws, but those dedicated red teams also find a way in every single time.

</comment></comment><comment><USER4> I'm really glad I saw this article - I tried spotify on my work desktop browser for the first time on the 19th and when it didn't work I assumed I just wasn't able to listen to spotify through my work computer's browser. Didn't even occur to me that spotify might be having an outage. Glad to learn I can listen to spotify at work.

</comment><comment><USER5> Why not just have two certificates rolling with overlap for some redundancy ...

<comment><USER6> Why not renew your certificate a year before the expiration date?

<comment><USER7> This begs the question: if I could remember to renew the cert 365 days before it lapsed then I could as easily remember to renew it 45 days ahead (which, operationally speaking, is as good).

In any case, certificates can only be purchased for a one year term now, so your hypothetical "one year ahead" doesn't fit the problem. Even if buying any updated cert that far ahead creates the same validity period it's not the buying the cert that's the catch — it's the _deployment_ of said cert.</comment></comment></comment>


The Making Of Dust (2003) - <AUTHOR> https://www.johnsto.co.uk/design/making-dust/ <comment><USER2> Good times. I miss the all classic maps that didn't make the transition: cs_747, as_oilrig, cs_seige, even the weird es_ maps. Each one is tied to a series of emotional childhood memories that are no longer accessible due to no one playing them.

I hate how much less experimental and quirky multiplayer gaming is these days. Dust2 may be a "good" map, but it's so freaking boring. Give me weird and unbalanced over tight and competitive any day.

(Seige returned briefly in Go for an event a few years back. That was really fun!)

<comment><USER3> Yeah in retrospect those missing maps were terribly unbalanced. They worked at the time because most people just played to have fun and get kills, and were less focused on the objective.

Now even in causal mode everyone is focused on the objective and some level of teamwork. Going solo and not playing the objective will result in much angry chat and usually a vote kick.

I do miss the more casual nature of CS (and many games) in those days though.

<comment><USER4> The shift to matchmaking from server browser changed this a lot. Having a server where you knew a bunch of regulars and could check in for a few rounds was a much different experience from being automatically grouped with random people who you'll probably never run into again.

</comment></comment></comment><comment><USER5> Also interesting, the same about de_dust2 - which is still my favorite map. Followed by Aztec.

[https://www.johnsto.co.uk/design/making- dust2/](https://www.johnsto.co.uk/design/making-dust2/)

<comment><USER6> There are people to this day that will still grind on dust2 and office for days on end it seems. It's probably impossible to know but I am sure there are people who have played those maps 20 thousand times.

<comment><USER7> 20k rounds at 2 minute rounds is under 1000 hours. I would expect anyone that played CS1.6 or CSS seriously to have that on de_dust2. Probably many have played 20k de_dust2 matches too.

Pretty sure I had well over 1k hours on de_dust2, de_nuke in practice/competition games alone (not public), and I considered myself a casual clan player.

EDIT: seems rounds were shorter than I remembered

</comment></comment></comment><comment><USER6> Wayyy back in the day there used to be a flashbang bug on dust where you could throw a bang as a CT over the central corridor and it would flash any Ts running towards it.

When I needed to make food or just run away from the PC, I would get a P90 and rush the corridor. It was suicide but you could absolutely wreak havoc with the high rate of fire.

</comment><comment><USER8> Counterstrike, and de_dust specifically, are perhaps single-handedly responsible for the rise of the "Internet Cafe culture" in many countries around the world.

My high school years were consumed by it. After getting off from school at 3:30 PM, we would head to an Internet Cafe and play Counterstrike until 6 or 7, or however long before our parents called the cafe's phone line one by one to ask the owners to tell us to come home for dinner!

We also played Quake 3 for a while, but it didn't hold our interest the way Counterstrike did.

<comment><USER9> Ah. The Internet cafe. Used to be part of my daily routine with friends as well. Except I grew up in china and my parents would beat me to shits when they found out that I went. Good times.

</comment></comment><comment><USER10> If you like this, you can find more at [https://www.reddit.com/r/TheMakingOfGames/](https://www.reddit.com/r/TheMakingOfGames/)

</comment><comment><USER11> I consider CS 1.6 a bit of a phenomenon. I could never get myself into it. I love most competitive games, shooters included, but CS feels so bland to me. Everyone plays de_dust, as if there was no other maps. Everyone picks the same gun (m4a1 for CT, ak for terro, or the sniper rifle), as if there was no other guns. Also since the maps are fairly linear, the tactics for each round are basically the same. I could never understand why the game is so popular.

<comment><USER12> I no longer enjoy first person shooters, but I was a teenager during that era and loved the game. The lack of variety that you found boring was what made the game fascinating to me at the time. Its simplicity and repetitive nature allowed one to achieve mastery through practice. Playing it, I felt the same feeling that I had after I had played ping pong regularly for several years.

<comment><USER13> Exactly this. The fact that a few maps and weapons dominated CS is what made it so unique, because you were forced to learn those few maps and weapons in extreme detail. When people couldn't distract themselves with fancy, shiny other things, they were forced to master those fewer things that were available (or were practical) and that many others had already mastered to a greater level than you. Your skill gap was was blatantly apparent to you and others, so you were very motivated to resolve your shortcomings.

</comment></comment></comment><comment><USER14> Aah! Good old de_dust! Still remember fondly the times when CS was played with all my friends, we had a clan and gamed as much as we could. Had a nostalgia moment some time back, ut then i found out they had discontinued clanbase.org. That really sucked, since hundreds, if not thousands of matched were recorded there. Would love to get a hold of the original database so i could poke around and search for old matches.

</comment><comment><USER15> If any of you played Firearms (one of the other popular HL mods at the time), this screenshot (apparently of an unreleased TF2) just has to remind you of Durandal:

[https://www.johnsto.co.uk/i/design/making- dust/tf2_01.jpg](https://www.johnsto.co.uk/i/design/making-dust/tf2_01.jpg)

<comment><USER16> Firearms, Frontline Force, and may others.

I feel like Half-Life was in some way the perfect inflection point of PC mods where the experience was compelling but the art/content requirements weren't outside of the scale of hobby/indie teams.

</comment></comment><comment><USER17> Countless lan parties which were dominated by either de_dust or bgh.

</comment><comment><USER18> From 2015: [https://news.ycombinator.com/item?id=9772521](https://news.ycombinator.com/item?id=9772521)

</comment><comment><USER19> When I think of CS:S (not surfing) I'd think of de_dust2 and cs_office. But, of the many many hours playing CS:S, my favourite map has to be surf_greatriver.

I've got well over 2k hours on that map alone (and later versions, such as surf_greatriver_xdream)

CS:S is one of my favourite games ever made - but I don't like GO that much. CS:S gave you more of what I liked (skins, maps, decent server browser, active surf community, good surf mods, ..)

<comment><USER20> CS:S was after my time. I played CS from beta4 until ... I don't know.

I liked italy and dust the most.

</comment></comment><comment><USER21> Hey if any of you are nostalgic for good old CS and have the money/space for a nice VR setup check out Pavlov. Its basically CS:VR. The first time you walk around dust/dust2 is pretty mind blowingly surreal.

<comment><USER22> I personally just spent the whole weekend with it. Not bad for $10 on steam!

</comment></comment><comment><USER23> We played the beta and first release of CS in college (UCD). Ah the memories of AWP and skywalking (jumping up on crates with aid of a buddy and walking on top of the map's bounding box "sky").

</comment><comment><USER24> Man I still have my cs 1.5.5 bootleg CD with podbot (and a key that works?) so many good memories of playing after school. I always liked the AWP maps, and the twin towers, tree tops, and who can forget de_rats?

<comment><USER9> Hahahha de_rats. That's a classic. So many good memories

</comment></comment><comment><USER25> (2003)

<comment><USER18> Added. Thanks!

</comment></comment><comment><USER26> Needs to be remade in: Rust</comment>


Schwartz - a shell for Apple's Quartz 2D graphics programming - in Python - <AUTHOR> http://schwartzapp.com/

<comment><USER2> Schwartz looks very nice and polished!

We make the exact "reverse" app - PaintCode, which is a drawing app that instantly generates Quartz 2D code ([http://www.paintcodeapp.com/](http://www.paintcodeapp.com/)).</comment>


Haskell's State monad is not a monad (2014) - <AUTHOR> http://www.cse.chalmers.se/~nicsma/no-state-monad.html <comment><USER2> This isn't about the state monad, it's about seq. "But now seq must distinguish ⊥ from λx → ⊥, so they cannot be equal. But they are eta- equivalent. We have lost eta equality!" \- once you lose eta equality you lose everything. A whole raft of monads become impossible, not just state.

Equivalence in Haskell is defined only up to ⊥; to work in Haskell we rely on the "Fast and Loose Reasoning is Morally Correct" result that _if_ two expressions are equivalent-up-to-⊥. and both non-⊥ then they are equivalent.

(Or, y'know, work in Idris with --total and avoid this problem entirely).

<comment><USER3> I always scares me how little I understand from comments talking about Haskell. Either I'm much more dumb that I though, or the whole community decided that purity beat practicality.

<comment><USER4> Eta-conversion is just the statement that having function(x) { f(x) }, in JS, is equivalent to having f. In short, wrapping a function in another function (or removing such a layer) makes no difference.

Like most of lambda calculus, this is extremely intuitive once described that way. Therefore, a situation for which it is false is disconcerting. It's also considered one of the "monad laws", which is the small set of rules that everyone assumes is true for every monad, but which the language doesn't (can't) enforce via the type system.

⊥, pronounced bottom, is a "value" that, if you ask for it, your program breaks. It may go into an infinite loop, or it may crash.

The GP post is therefore explaining that, because eta conversion in this case fails when the function returns bottom, we should be disconcerted. It's a mild form of disconcertion, however: Things would only go wonky if you try to run code that would, in any case, hang or crash.

The reason it isn't _completely_ harmless is that the difference may be observable: A crash in pure code triggers an exception, which can be caught in its impure wrapper code, and a hang can in some cases be converted to an exception by the garbage collector. In theory all bottoms are equal, but in practice they aren't.

<comment><USER3> Thank you.

</comment></comment></comment></comment><comment><USER5> This is all pretty fun reading.

At least with my own code in Haskell, I work in the mental model where I assume termination and strong normalization (all programs terminate under all evaluation strategies).

Then, Bottom corresponds to either an exception that will get forced or a computationally boring infinite loop (which the rts can sometime detect and turn into an exception). My personal style favors having those errors be very very visible.

That said, depending on what formal or informal reasoning properties you care about (especially as a library writer), these little subtleties can be really important!

<comment><USER6> This.

This thing is not a problem on Haskell because everybody always code defensively against bottoms. GHC is quick to teach this to novices.

It may still be a problem of "the lack of this feature inviabilises a lot of good code". It doesn't look like it is, but nobody can be certain, so it's a good avenue to explore.

</comment></comment><comment><USER7> The real monad was the friends we made along the way.

</comment><comment><USER8> Cute, but why should one care about ⊥, aka bottom, aka nontermination [0]? Let's write programs that terminate...

[0] [https://wiki.haskell.org/Bottom](https://wiki.haskell.org/Bottom)

<comment><USER9> It's kind of funny, looking at these halting discussions as a backend web programmer. At the heart of it, all I do all day is _try_ to write nonterminating programs in an environment where the entire universe seems hell bent on terminating the event/polling loop. It's kind of perverse when you think about it.

<comment><USER10> The nice thing is that you can actually build stuff like web servers in a total language :) Using something called co-induction a total language can model things that are potentially infinite, e.g. a web server. Co-induction replaces the requirement that every function must terminate with the requirement that the next step (e.g. the next value of a stream) can be calculated in finite time. So, the event loop could be modelled using co- induction as long as long as the event handlers do not contain infinite loops.

<comment><USER11> why is that complementary instead of straightforward induction?

<comment><USER12> The style of coinductive reasoning is very different.

In general, in induction, one has a base case and an inductive case. Hence, you can only build "finite" objects (since you start with the base case and you can apply the induction rule a finite number of times)

In coinduction, you start with an infinite object, and you show that you can "progress" \- that is, take a step in your computation. So, this shows that you can _reach_ states in finite time, even if the full structure is inaccessible, since you show progress on each state.

The phrase that I've heard is "induction is to prove what's true, coinduction is to prove what's not false"

Please do Google "practical coinduction" it has a wealth of examples.

</comment></comment></comment></comment></comment><comment><USER13> It seems to me a piece of software is either a formal proof or it's not. So if it's not and we still manage to write robust programs, the natural next question is, to what degree is it okay to knowingly violate the laws? And if you iterate that to the nth, do you end up with Clojure?

<comment><USER2> > It seems to me a piece of software is either a formal proof or it's not.

That seems like a false dichotomy. Rather I'd say: a program carries a bundle of proven properties with it, but for some programs this will be rich and for others it will be more or less trivial.

> So if it's not and we still manage to write robust programs, the natural > next question is, to what degree is it okay to knowingly violate the laws?

To what degree do we actually write robust programs though? Errors are so common we dismiss them and retry or work around without even consciously noticing the error. "Have you tried turning it off and on again" is funny because it's true.</comment></comment>


Visualizing the Coverage of Deaths in The New York Times vs. Actual Death Data - <AUTHOR> https://www.nemil.com/s/part3-horror-films.html <comment><USER2> But as my mum says when I try to point out she's worrying about the wrong things, "I don't care what the statistics say, I read about it in the paper and I believe it's worse." So is it the papers that are distorting reality or are people wilfully obstinate in their beliefs? (Hint: it's both).

<comment><AUTHOR> I don't think your mom is irrational given what is covered - but the big mistake we often make is thinking that what we read is _representative_ of what is going on. I want to use data to show this effect on a number of issues.

And the larger point I will make in a future post is that news covers what people want to read, which is problematic if the goal is good decisions.

(As an engineer, I often think about this as akin to sampling bias)

</comment></comment><comment><AUTHOR> [OP] I spent some time categorizing death coverage in the first pages of The New York TImes compared to actuality over a 20 month period. I've been intrigued about why so many make threat assessments based on news coverage, and wanted to see if the "sampling" of news was close to representative.</comment>


Diving deep into the world of emergent gravity - <AUTHOR> https://arstechnica.com/features/2017/05/emergent-gravity-and-dark-matter-explained-by-excited-universe/ <comment><USER2> Not a physicist, but the idea makes sense to me.

<comment><AUTHOR> This is the derivation of Newtonian gravity [https://en.wikipedia.org/wiki/Entropic_gravity#Derivation_of...](https://en.wikipedia.org/wiki/Entropic_gravity#Derivation_of_the_law_of_gravitation)

I'm not a physicist either, but IMO the _key_ is the Unruh effect, which is the idea that quantum fluctuations in empty space are warm when viewed from an accelerated frame of reference.</comment></comment>


I Do Not Know C: Short quiz on undefined behavior (2015) - <AUTHOR> http://kukuruku.co/hub/programming/i-do-not-know-c <comment><USER2> My 'favourite' bit of surprising (not undefined) behaviour I've seen recently in the C11 spec is around infinite loops, where

void foo() { while (1) {} }

will loop forever, but

void foo(int i) { while (i) {} }

is permitted to terminate...even if i is 1:

> An iteration statement whose controlling expression is not a constant > expression, that performs no input/output operations, does not access > volatile objects, and performs no synchronization or atomic operations in > its body, controlling expression, or (in the case of a for statement) its > expression-3, may be assumed by the implementation to terminate

To make things a bit worse, llvm can incorrectly _both_ of the above terminate - [https://bugs.llvm.org//show_bug.cgi?id=965](https://bugs.llvm.org//show_bug.cgi?id=965).

<comment><USER3> It means that empty loops (loops with empty bodies) can be completely removed if the controlling expression has no side effects.

> This is intended to allow compiler transformations such as removal of empty > loops even when termination cannot be proven.

It means while(i) {} can be eliminated as if i were 0, because there are no side effects in the loop expression or the loop body, and what would be the point of the loop if it never terminated on a non-constant expression?

As an optimization, the optimizer is allowed to eliminate it as a useless loop with no side effects. If you really want an infinite loop, you can use while (1) {}.

There are cases where automatically generated C code might have empty loops which are useless.

If you really want to go to sleep, use pause() or similar. An infinite loop eats up CPU cycles.

<comment><USER4> It's quite common in embedded systems to have the fault handler end with an infinite loop, to give the programmer a chance to attach a debugger an inspect the call stack. Sometimes this behavior is turned on or off with a debug flag, which can trigger this unexpected optimization if the flag is not a compile time constant.

<comment><USER5> You could always say

        if (flag) while (1);

<comment><USER4> Yes, that would make more sense. I have never seen this optimization actually bite anyone.

</comment></comment></comment></comment></comment><comment><USER6> I'll be honest, I didn't find any of these to be particularly surprising. If you've been using C and are familiar with strict-aliasing and common UB issues I wouldn't expect any of these questions to seriously trip you up. Number 2 is probably the one most people are unlikely to guess, but that example has also been beaten to death so much since it started happening that I think lots of people (Or at least, the people likely to read this) have already seen it before.

I'd also add that there are ways to 'get around' some of these issues if necessary - for example, gcc has a flag for disabling strict-aliasing, and a flag for 2's complement signed-integer wrapping.

<comment><USER7> I don't think #2 has been fully beaten to death yet.

Assuming a platform where you don't segfault (say that 'page 0' variables are valid) and thus runtime does proceed; I still can't think of any /valid/ reason to eliminate the if that follows (focus line 2 in the comments).

Under what set of logic does being able to de-reference a pointer confer that it's value is not 0 (which is what the test equates to)?

In my opinion that is an, often working but, incorrect optimization.

<comment><USER8> C programmers expect dead code removal. Especially when the compiler also inlines functions (and, of course, inlining makes the biggest impact on short functions; and one way to get short functions is to have aggressive dead code removal). And macros can expand into very weird, but valid, code; so the statement that "nobody would ever write code like that" isn't relevant. The compiler may well have to handle unnatural looking code.

As others have stated, compilers generally don't actually have special case code to create unintuitive behavior if it looks like the programmer goofed.

It's possible and desirable for a compiler to remove branches of "if" statements that it knows at compile time won't ever be true. And, of course, one special case of statically known "if" statements are checks for NULL or not-NULL pointers in cases where the compiler knows that a pointer will never be NULL (e.g., it points to the stack) or will always be NULL (e.g., it was initialized to NULL and passed to a function or macro).

So the standard allows the compiler to say "this pointer cannot be NULL at this point because it was already dereferenced." Either the compiler is right because the pointer couldn't be NULL, or dereferencing the pointer already triggered undefined behavior, in which case unexpected behavior is perfectly acceptable. Some programmers will complain because the compiler won't act sensibly in this case, but C doesn't have any sensible option for what the compiler should do when you dereference a NULL pointer (yes, your operating system may give you a SEGFAULT, but the rules are written by a committee that can't guarantee that there will _be_ an operating system).

<comment><USER9> C programmers should be able to expect that "optimizations" will not transform program meaning. And because C is so low level, certain types of optimizations may be more difficult or impossible. If the pointer was explicitly set to NULL, the compiler can justifiably deduce the branch will not be taken but the deduction "if the programmer dereferenced the pointer it must not be NULL" is not based on a sound rule. In fact, the whole concept that the compiler can make any transformation it wants in the presence of UB is wacky. Optimization should always be secondary to correctness.

<comment><USER8> > C programmers should be able to expect that "optimizations" will not > transform program meaning.

That's the official rule, but it's "program meaning as defined by the standard." It's not perfect, but nobody's come up with a better alternative. We get bugs because programmers expect some meaning that's not in the standard. But compilers are written according to the standard, not according to some folklore about what reasonable or experienced programmers expect.

 __*

Again, the idea isn't that the compiler found a mistake and will do its best to make you regret it. Derefencing a pointer is a clear statement that the programmer believes the pointer isn't NULL. The standard allows the compiler to believe that statement. Partly because the language doesn't define what to do if the statement is false.

<comment><USER10> > But compilers are written according to the standard.

Written to the writers _interpretation_ of the standard. I bet money that every compiler written from a text standard hasn't followed said standard. It would be nice if a standard included code fragments used to show/test the validity of what is stated.

<comment><USER11> There are examples in the standard.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Honestly, Optimizing compilers will kill C.

It killed the one thing C was good at - simplicity (you know exactly what happens where, note I'm not saying speed, as C++ can be quite a bit faster than C).

Now, due to language lawyering, you can't just know C and your CPU, you have to know your compiler (and every iteration of it!). And if you slip somewhere, your security checks blow up ([http://blog.regehr.org/archives/970](http://blog.regehr.org/archives/970) [https://bugs.chromium.org/p/nativeclient/issues/detail?id=24...](https://bugs.chromium.org/p/nativeclient/issues/detail?id=245)) .

<comment><USER13> > Now, due to language lawyering, you can't just know C and your CPU, you have > to know your compiler (and every iteration of it!).

This mythical time never existed. You _always_ had to know your compiler -- C simply isn't well specified enough that you can accurately predict the meaning of many constructs without reference to the implementation you're using.

It used to, if anything, be much much _worse_ , with different compilers on different platforms behaving drastically different.

<comment><USER9> This is not really correct. The kinds of implementation dependencies usually encountered reflected processor architecture. The C standards committee and compiler community have created a situation in which different levels of "optimization" can change the logical behavior of the code! Truly a ridiculous state of affairs. The standards committee has some mysterious idea I suppose, but the compiler writers who want to do program transformation should work on mathematica or prolog, not C.

<comment><USER14> Compiler writers have to use program transformation to do well on benchmarks. Developers who don't prioritize benchmarks probably don't use C, and if they do they really shouldn't, because sacrificing correctness for speed is the only thing C is good for these days.

<comment><USER15> Speed isn't the only reason to use C. I often use C not because it's fast, but because C is by far the simplest mainstream programming language. All these UB warts notwithstanding, no language's interface comes as close as C's to a basic, no-frills register machine.

<comment><USER16> You don't need speed, but you want to write in a language, which is closest to assembly? Hmm. Interesting view on what is simple.

<comment><USER15> Maybe we mean different things by the word "simple". What language do you think is simpler than C?

<comment><USER11> Scheme, ML, Java, Lua...

<comment><USER15> Yeah, we must have different definitions of simplicity, as I expected.

Just off the top of my head, Java has the following complexities that C lacks: exceptions, garbage collection, class inheritance, generics, and a very large standard library.

What definition of simplicity are you using when you say Java is simpler than C?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I don't think this Q&A format makes for a good case of not knowing C.

I mean I got all answers right without thinking about them too much, but would I too if I had to review hundreds of lines of someone else's code? What about if I'm tired?

It's easy to spot mistakes in isolated code pieces, especially if the question already tells you more or less what's wrong with it. But that doesn't mean you'll spot those mistakes in a real codebase (or even when you write such code yourself).

<comment><USER18> This is further compounded by how difficult it is to build useful abstractions in C, meaning that much real-world C consists of common patterns, and reviewers focus on recognizing common patterns, which increases the chances that small things slip through code review.

Agreed that these little examples aren't too difficult, especially if you have experience, but I certainly do not envy Linus Torvalds' job.

</comment></comment><comment><USER19> It's worth noting that for example #12, the assert will only fire for debug builds (i.e. the macro NDEBUG is not defined). So, depending on how the source is compiled, it may be able to invoke the div function with b == 0.

</comment><comment><USER20> C also: [https://news.ycombinator.com/item?id=12902304](https://news.ycombinator.com/item?id=12902304)

</comment><comment><USER21> IMHO the problem is with compilers (and their developers) who think UB really means they can do _anything_ , when what programmers usually expect is, and the standard even notes for one of the possible interpretations of UB, "behaving during translation or program execution in a documented manner characteristic of the environment".

Related reading:

[http://blog.metaobject.com/2014/04/cc- osmartass.html](http://blog.metaobject.com/2014/04/cc-osmartass.html)

[http://blog.regehr.org/archives/1180](http://blog.regehr.org/archives/1180) and [https://news.ycombinator.com/item?id=8233484](https://news.ycombinator.com/item?id=8233484)

<comment><USER22> >the problem is with compilers (and their developers) who think UB really means they can do anything

But that's exactly what undefined behavior means.

The _actual_ problem is that programmers are surprised-- that is, programmers' expectations are not aligned with the actual behavior of the system. More precisely, the misalignment is not between the actual behavior and the specified behavior ( _any_ actual behavior is valid when the specified behavior is undefined, by definition), but between the specified behavior and the programmers' expectations.

In other words, the compiler is not at fault for doing surprising things in cases where the behavior is undefined; that's the entire point of undefined behavior. It's the language that's at fault for _specifying_ the behavior as undefined.

In other other words, if programmers need to be able to rely on certain behaviors, then those behaviors should be part of the specification.

<comment><USER23> In some sense the language is the compiler and the compiler is the language; the language is much like a human language, used for its utility in expressing things (ideas, programs). You can tell if your human language words work by determining if people understand you. If people start being obtuse and refusing to understand you because of an arbitrary grammar rule that isn't really enforced, you'd be right to be upset with the people just as much as the grammar.

It in fact doesn't matter at all what the standard says if GCC and LLVM say something different, because you can't use the standard to generate assembly code.

The standard doesn't have anything to say about UB, so it's the compiler's responsibility to do the most reasonable, non-shocking thing with it possible: if I'm a GCC developer and you ran GCC on one of these fairly mundane examples and it compiled without error then ran rm -rf / or stole your private RSA keys and posted them on 4chan and I said "well, you can't be mad because it's undefined, it's the standard's fault" you'd probably punch me in the face after some quick damage control.

If it deletes an if loop or terminates a spinlock early that's potentially even worse than those two examples.

<comment><USER22> >In some sense the language is the compiler and the compiler is the language; the language is much like a human language, used for its utility in expressing things (ideas, programs). You can tell if your human language words work by determining if people understand you. If people start being obtuse and refusing to understand you because of an arbitrary grammar rule that isn't really enforced, you'd be right to be upset with the people just as much as the grammar.

The shortcoming of this interpretation is that programs are not (only) consumed by humans; they're consumed by computers as well. Computers are not at all like humans: there is no such thing as "understanding" or "obtuseness" or even "ideas." You cannot reasonably rely on a computer program, in general, to take arbitrary (Turing-complete!) input and do something reasonable with it, at least not without making compromises on what constitutes "reasonable."

Along this line of thinking, the purpose of the standard is not to generate assembly code; it's to pin down exactly what compromises the compiler is _allowed_ to make with regards to what "reasonable" means. It happens that C allows an implementation to eschew "reasonable" guarantees about behavior for things like "reasonable" guarantees about performance or "reasonable" ease of implementation.

Now, an implementation may _choose_ to provide stronger guarantees for the benefit of its users. It may even be reasonable to expect that in many cases. But at that point you're no longer dealing with C; you're dealing with a derivative language and non-portable programs. I think that for a lot of developers, this is just as bad as a compiler that takes every liberty allowed to it by the standard. The solution, then, is not for GCC and LLVM to make guarantees that the C language standard doesn't strictly require; the solution is for the C language standard to require that GCC and LLVM make those guarantees.

Of course, it doesn't even have to be the C language standard; it could be a "Safe C" standard. The point is that if you want to simultaneously satisfy the constraints that programs be portable and that compilers provide useful guarantees about behavior, then you need to codify those guarantees into _some_ standard. If you just implicitly assume that GCC is going to do something more or less "reasonable" and blame the GCC developers when it doesn't, neither you nor they are going to be happy.

</comment></comment></comment></comment><comment><USER24> I suppose this sort of ambiguity is what drives the passion of Rust and Go programmers.

<comment><USER25> Sorta. I write mostly Go (some JS, PHP) and I got 6/10, forgetting mostly stupid stuff like passing (-INT_MIN, -1) to #12.

But some of those are prevalent in Go. For example, 1.0 / 1e-309 is +Inf in Go, just as it is in C—it's IEEE 754 rules. int might not always be able to hold the size of an object in Go, just like C. In Go #6 wraps around and is an infinite loop, just like C.

The questions that don't, in some way, translate to Go are #2, #7, #8, and #10.

But, to your credit, I do like how Go has very limited UB (basically race conditions + some uses of the unsafe package) and works pretty much how you'd expect it to work.

</comment></comment><comment><USER26> Before: What? I know C. After 3 questions: Ok, I don't know C. Well played sir.

</comment><comment><USER27> 1\. Unless C's variable definition rules are completely different from C++'s, int i; is a full definition, not a declaration. If both definitions appear at the same scope (e.g. global), this will cause either a compiler error or a linker error. A variable declaration would be extern int i;

<comment><USER28> C's variable definition rules are different from C++'s. gcc happily compiles those two lines, g++ exits with the "redefinition" error.

<comment><USER27> That was unexpected.

<comment><USER29> Said every C programmer ever!

</comment></comment></comment></comment><comment><USER30> As a former C programmer, you know not to fool around at the max bounds of a type. That avoids all of the integer overflow/underflow conditions. When in doubt, you just throw a long or unsigned on there for insurance. :)

</comment><comment><USER31> I'm sorry, but the answer this website gives to 1. is wrong. See for yourself:

      int i;
      int i = 10;

      int main(int argc, char* argv[]){
      	return 0;
      }

Try to compile it. It doesn't work (gcc.exe (GCC) 5.3.0), the error is:

      a.cc:2:5: error: redefinition of 'int i'
       int i = 10;
           ^
      a.cc:1:5: note: 'int i' previously declared here
       int i;
           ^

Either I misunderstood the author and this example, or I do know C.

<comment><USER32> Judging by the .cc extension, you are compiling this with a C++ compiler. Quoting from Annex C (which documents the incompatibilities between C++ and ISO C) of the C++ standard:

       Change: C++ does not have "tentative definitions" as in C E.g., at
       file scope,

       int i;
       int i;

       is valid in C, invalid in C++. This makes it impossible to define
       mutually referential file-local static objects, if initializers are
       restricted to the syntactic forms of C. For example,

       struct X { int i; struct X *next; };
       static struct X a;
       static struct X b = { 0, &a };
       static struct X a = { 1, &b };

       Rationale: This avoids having different initialization rules for
       fundamental types and user-defined types.

       Effect on original feature: Deletion of semantically well-defined
       feature.

       Difficulty of converting: Semantic transformation.

       Rationale: In C++, the initializer for one of a set of
       mutually-referential file-local static objects must invoke a
       function call to achieve the initialization.

       How widely used: Seldom.

<comment><USER31> _facepalm_ of course, even if I use gcc, if I compile a.cc it switches to the c++ compiler. Thanks.

</comment></comment></comment><comment><USER33> I got every single one right. Does that mean I know C through and through? Perhaps. But all of these are the 'default' FAQ pitfalls of C, not the really tricky stuff.

</comment><comment><USER34> I made this post as a response. Disclaimer: yet another programming language trying to dethrone C. People seem to be less enthusiastic about the subject these days.

[http://andrewkelley.me/post/zig-already-more-knowable- than-c...](http://andrewkelley.me/post/zig-already-more-knowable-than-c.html)

</comment><comment><USER35> Anyone who enjoys this will also enjoy [http://cppquiz.org](http://cppquiz.org)

</comment><comment><USER36> I feel bad because I'm smart enough to answer these questions correctly in a quiz format __, but if I saw any of them in production code, I would not even think twice about it.

 __(the quiz questions themselves lead you on, plus I read the MIT paper on undefined behavior that was posted on here back in 2013)

</comment><comment><USER37> Isn't this line from #3, undefined behavior not mentioned in the article (sequence point violation)

 _zp++ =_ xp + *yp;

<comment><USER13> That's not a sequence point violation. The C standard makes it clear that zp gets xp + *yp prior to the increment. Quoting 22.214.171.124

> The result of the postfix ++ operator is the value of the operand. After the > result is obtained, the value of the operand is incremented. (That is, the > value 1 of the appropriate type is added to it.) See the discussions of > additive operators and compound assignment for information on constraints, > types, and conversions and the effects of operations on pointers. The side > effect of updating the stored value of the operand shall occur between the > previous and the next sequence point.

The last sentence is key.

</comment></comment><comment><USER38> #4 is not really language issue, rather a floating point numbers feature.

</comment><comment><USER39> (2015)</comment>


News.gmane.org is now news.gmane.io - <AUTHOR> https://lars.ingebrigtsen.no/2020/01/15/news-gmane-org-is-now-news-gmane-io/ <comment><USER2> The previous article this one links to explains why: [https://lars.ingebrigtsen.no/2020/01/06/whatever-happened- to...](https://lars.ingebrigtsen.no/2020/01/06/whatever-happened-to-news- gmane-org/).

<comment><USER3> That's funny! And here I was expecting this to be related to the sale of .org.

<comment><USER4> That would be a funny reason to switch to .io because people have been complaining about .io as well:

[https://news.ycombinator.com/item?id=8587379](https://news.ycombinator.com/item?id=8587379)

</comment></comment></comment><comment><USER5> As I see it, Gmane is a stateless website/nntp server, plus a data archive of public data (copyright law notwithstanding, since Lars never worried about it like Yahoo Groups/Oath apparently worries about now). I don't think Lars was protective of his server software IP, right? And he didn't sell Gmane for money, right?

Is there any reason there weren't 2 or 3 variations of it, run separately, as backups?

When Lars agreed to hand it over, why not put out a call to the public to clone it? Isn't the point of NNTP in the first place: a decentralized news archive?

</comment><comment><USER6> Anyone remember the discussion years ago when a lot of people on the web (including the early github community and alike) stood up against the "misuse" of TLDs like .io and .tv?

<comment><USER7> Personally, I still see it as a misuse. Those TLDs stand for countries and it doesn't feel right to me to use them for generic TLDs.

<comment><USER8> Are there any negative consequences to this "misuse"?

<comment><USER9> CCTLDs are useful for searching.

I fairly often add "site:dk" to my Google searches. I know I'm excluding Danish sites using generic TLDs, or using Danish domain hacks¹, but it's usually good enough to get past the irrelevant results I didn't want.

Search engines can also use the CCTLD as part of the signalling -- a .dk site is almost certainly related to Denmark.

That doesn't work for .to, .nu, .cc and so on. (.IO is unusual, the only genuinely linked site I can see is the government's, at [https://biot.gov.io/](https://biot.gov.io/) ) Google has a list of CCTLDs it considers "generic"², I don't know if they have workarounds for sites actually linked to these places.

¹ "A/S" is a type of company registration, so American Samoa ".as" is used, "nu" means "now" so there's some use of Niue ".nu".

² [https://support.google.com/webmasters/answer/182192#generic-...](https://support.google.com/webmasters/answer/182192#generic- domains)

<comment><USER10> Why not just lang:ja

<comment><USER11> It works for Japan I guess, but it's often more important (well, to me at least) to discriminate by country than by language.

</comment></comment></comment></comment></comment></comment><comment><USER12> .io is probably the worst choice you could go with if what you're looking for is long term stability.

This tld is problematic and really, should not be used.

[https://gigaom.com/2014/06/30/the-dark-side-of-io-how- the-u-...](https://gigaom.com/2014/06/30/the-dark-side-of-io-how-the-u-k-is- making-web-domain-profits-from-a-shady-cold-war-land-deal/)

<comment><USER13> It may be questionable on value grounds, but I suspect it will be stable:

"ICB gets to run .io "more or less indefinitely, unless we make a technical mistake," Kane told me. (ICB has so far run a stable .io namespace. It should be noted that Kane is a respected veteran of the infrastructure scene, and has been entrusted by ICANN with one of the 7 so-called "keys to the internet".)"

</comment></comment><comment><USER14> With the current state of ICANN, it seems like migrating from .org is a good idea.

If migrating to .io is a change for the better, I do not know. Why not something more traditional like .com or .net?

Edit: Disregard completely.

The guy evidently _lost_ the domain through some mild incompetence, and never managed to restore it. Boy, does that have to suck.

<comment><USER15> That's not the reason if you actually were to read.

<comment><USER16> The site guidelines ask that we avoid doing this:

 _Please don 't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."_

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER15> Don't try and get people to educate and improve themselves and instead let them babble mindlessly?

<comment><USER17> That's a fine intention, but please achieve it by respectfully providing better information (for example, like thcz's sibling comment did). Don't do it by being rude and aggressive, which breaks the site guidelines ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)) and contributes to damaging the container for everybody.

</comment></comment></comment></comment></comment><comment><USER18> Maybe name the company that's not responding and not updating the DNS record?

<comment><USER19> The 'Y' is mentioned in this blog post: [https://lars.ingebrigtsen.no/2016/09/06/gmane- alive/](https://lars.ingebrigtsen.no/2016/09/06/gmane-alive/)

</comment></comment><comment><USER20> How can we support this effort?

<comment><USER21> It seems he accepts offers to register missing mailing lists.

<comment><USER20> I meant "fund".

Something like patreon at least to keep it going.

Hate to see a great resource with a "single point of success".

<comment><USER21> Seems he's not interested in cash donations: [https://lars.ingebrigtsen.no/2020/01/15/news-gmane-org-is- no...](https://lars.ingebrigtsen.no/2020/01/15/news-gmane-org-is-now-news- gmane-io/#comment-36470)

</comment></comment></comment></comment><comment><USER22> Is this just the nntp bridge or is the web archive returning as well?</comment>


The Gloriuos Hour of Brexit - <AUTHOR> https://www.newsliveng.com/2019/10/01/the-gloriuos-hour-brexit/ <comment><USER2> This article is biased, opinionated and littered with unsubstantiated facts, which I guess makes it an opinion piece.

The facts are that the UK has almost no manufacturing base, lags behind even smaller EU countries in various modern intellectual property endeavors, and greatly benefits from the free flow of goods and services from the continent.

The author is correct in pointing out that Brexit won't be the disaster everyone makes it out to be, but it will cause a systemic and gradual decline in the GDP and living standards of the British people - and cosying up the US will come with its own set of problems.</comment>


US Department of State: Global Level 4 Health Advisory – Do Not Travel - <AUTHOR> https://travel.state.gov/content/travel/en/traveladvisories/ea/travel-advisory-alert-global-level-4-health-advisory-issue.html <comment><USER2> Borders closing? US says "immediate return" or prepare to remain abroad for "indefinite period"

<comment><USER3> > Borders closing?

Absolutely seems to be coming. We've got an inbound ban from much of Europe and a mutually-agreed closure of the US-Canada border already, and now a "don't travel now and return immediately if already abroad" advisory on top of that.

<comment><USER4> This seems very possible given the State Department's unusually stark language: "U.S. citizens who live in the United States should arrange for immediate return to the United States, unless they are prepared to remain abroad for an indefinite period."

A HN comment from a few days ago [1] drew a similar conclusion based on the way Prime Minister Trudeau announced Canada's first round of border restrictions: "Canadian travelers should return to Canada [via] commercial means while it is still possible to do so. Let me be clear: If you are abroad, it's time to come home."

[1]: [https://news.ycombinator.com/item?id=22596009](https://news.ycombinator.com/item?id=22596009)

[2]: [https://m.washingtontimes.com/news/2020/mar/16/justin- trudea...](https://m.washingtontimes.com/news/2020/mar/16/justin-trudeau- canada-closing-borders-noncitizens/)

</comment></comment></comment><comment><USER5> Where was this 2 months ago....

<comment><USER6> 3 months ago actually with the warning. we could have been screening to prevent this whole thing from getting out of hand.

</comment></comment><comment><USER7> This democrat hoax is getting really out of hand /s.

<comment><USER4> I almost missed that /s at the end.

<comment><USER8> It is terribly depressing that a '/s' was needed. The times we live in.</comment></comment></comment>


What "Slaughterhouse-Five" Tells Us Now - <AUTHOR> https://www.newyorker.com/books/page-turner/what-kurt-vonneguts-slaughterhouse-five-tells-us-now <comment><USER2> If you ever find yourself in Dresden there's a fantastic tour based on Slaughterhouse Five, run by a local man who loves the book and is quite a character. A unique lens to learn about the city through.

[http://kurtvonnegut-tour.com/](http://kurtvonnegut-tour.com/)

</comment><comment><USER3> > "It tells us that most human beings are not so bad, except for the ones who > are, and that's valuable information."

this sentiment underlies the misperception of risks like terrorism, school shootings, and child abduction.

tangentially, _billy pilgrim_ was a great little southern folk rock band. wish they'd made more music.

</comment><comment><USER4> I read it and thought it a remarkable book. I lent it to a mate who thought the same. Said mate lent it to his dad who had fought in the 2nd WW. His dad apparently said it was the best book on the war he'd ever read. If true, that's really saying something.

</comment><comment><USER5> I read this book from a Summer Reading List as a Stephen King fan in the 1990s. I assumed from the name, that it was a horror novel like Cujo.

It was not a horror novel like Cujo but it sort of was in its own way. It had a huge impact on me, though. I'm fairly sure it was the first book that ever made me cry.

</comment><comment><USER6> I generally respect Salman Rushdie (the author of the article), But I really feel he's missed the point. I am far less qualified to criticize literature than he, but I'm going to do it anyways.

SL5 is about one thing. PTSD. PTSD was not a diagnosis when the book was written, but it is at least clear to me, that the book is about a fractured man trying to repair itself by creating a world view that is comforting to it. His becoming unstuck in time is, in my mind, simply a sci-fi flashback, or perhaps, flash-forward in this case?

<comment><USER7> That's a pretty reductive viewpoint. While PTSD is certainly a component of the story, it is all but a facet of the humanity and consequences of war

<comment><USER6> All viewpoints are reductive. That's exactly the point of them.

</comment></comment></comment><comment><USER8> "Billy Pilgrim ... "comes unstuck in time" and begins to experience chronology the way Tralfamadorians do, he understands why his captors find comical the notion of free will."

The belief that time is linear is not universal. Another fictional take on 'eternal recurrence' is explored in Ouspensky's 1915 _Strange Life of Ivan Osokin_. The protagonist becomes conscious of having lived the same life repeatedly, and struggles to fix his mistakes.

It's a valuable metaphor, though I reject the concern that the timeline of every quark is scripted.

<comment><USER9> I remember this idea brought to the logical extreme (though I don't remember author's name).

A character gets born, lives, dies, repeatedly, in different circumstances. At one.moment he manages to remember something that a being from outside time tells him _between_ incarnations, in "limbo" / "bardo" type of setting.

All the people in the world is that same character, only transpoted in time. All the worst villains he faces are himself, all the best saints he meets are his (future) selves. This world is entirely by him.

<comment><USER10> The Egg is the most famous story based on that idea, I think.

[http://www.galactanet.com/oneoff/theegg_mod.html](http://www.galactanet.com/oneoff/theegg_mod.html)

</comment></comment></comment><comment><USER11> In early high school computer programming class (which officially was about programming in a particular language), our teacher didn't just teach that. The class put substantial time into things like history of programming (e.g., Ada Lovelace), and the thing I remember most was that we read and discussed Vonnegut's "Player Piano". In hindsight, that class was formative.

<comment><USER12> In his seminal book on advanced industrial society, One-Dimensional Man, Herbert Marcuse makes the case that even many ostensibly democratic nations are, at heart, totalitarian. Totalitarianism, he argues, need not manifest as dystopian wastelands with labor camps, dictatorship, secret police, and all those other Orwellian characteristics: "For 'totalitarian' is not only a terroristic political coordination of society, but also a non-terroristic economic-technical coordination which operates through the manipulation of needs by vested interests."

Player Piano, which purports to be "not a book about what is, but a book about what could be," is such a totalitarian society – not one organized by terrorism but by economic-technical coordination of vested interests. Its society is one that appears, as its main character Paul Proteus notes, as a "clean, straight rafter," that, once the surface is scraped away, is rotten to the core.

[0] [http://www.vonnegutreview.com/2013/06/player-piano-one- dimen...](http://www.vonnegutreview.com/2013/06/player-piano-one-dimensional- society.html)

<comment><USER13> So I really struggle with the concept of subtle economic coercion (ie, the basis of western society) being described as "totalitarian".

It's like 1st-world problems being described as legitimate oppression.

<comment><USER14> Note that subtle != mild.

If going against society results in you losing your job (because your employer doesn't want to deal with bad publicity), losing your home (because you can't make rent/mortgage payments), losing your friends (because anyone who hangs out with a [racist/rapist/fetus-murderer/scammer/person who refuses to sign things they can't read/etc] suffers guilt by association), and possibly starving to death in the street (if you can't convince anyone to charity you some food), then that society is totalitarian, no matter how subtle they are about it.

Current western society isn't nearly that bad[citation needed], but that's neither because it's impossible nor for lack of anyone trying.

<comment><USER15> All of these things still happen to LGBT people in western society.

<comment><USER16> It saddens me that this was downvoted, because it's entirely true. It doesn't just apply to LGBT people, though. There are all kinds of minority groups that are treated as second-class citizens in modern Western (and Eastern) cultures.

</comment></comment></comment></comment></comment></comment><comment><USER17> The movie adaptation of the book is as well done as one could ask for of such a work, at such a time. Joe Bob says check it out.

</comment><comment><USER18> I loved the book when I read it as youngster. Now .. it's faded a bit.

A little factoid I found interesting -- Vonnegut was inspired in part to write it by the holocaust denier David Irving's book "The Destruction of Dresden"

[http://lipstadt.blogspot.com/2007/04/kurt-vonnegut-and- david...](http://lipstadt.blogspot.com/2007/04/kurt-vonnegut-and-david-irving- in.html)

quote

> "Vonnegut helped perpetuate that myth and spread this form of denial. He > probably did so initially unwittingly. But since the publication of that > book enough has been written to show this is not true and he could have > corrected it has he been so inclined"

</comment><comment><USER19> Is there an eBook edition? Strangely there's an Italian eBook but I've not found an English one.

<comment><USER20> [http://libgen.io/search.php?req=slaughterhouse+five&open=0&r...](http://libgen.io/search.php?req=slaughterhouse+five&open=0&res=25&view=simple&phrase=1&column=def)

[http://booksdescr.org/ads.php?md5=B238DC565A4E2BB3FA5FBA8D9E...](http://booksdescr.org/ads.php?md5=B238DC565A4E2BB3FA5FBA8D9E522C5A)

</comment></comment><comment><USER11> A detail missed due to the HN title matching the linked page's title: the byline is Salman Rushdie.

</comment><comment><USER21> I wonder what Mr.Vonnegut would have to say about the historians that try to minimize the causalities that occurred during the firebombing of Dresden.

<comment><USER22> What historians try to do that? Are they respected in their field? And are you sure about their intentions? Are they trying to minimize casualties, or just trying to find an accurate number(which may be smaller than reported casualties).

<comment><USER23> [http://www.unz.com/article/how-many-germans-died-under- raf-b...](http://www.unz.com/article/how-many-germans-died-under-raf-bombs-at- dresden-in-1945/)

</comment></comment></comment><comment><USER24>
        [Harrison Starr] raised his eyebrows and inquired, "Is it an anti-war book?"

        "Yes," I said. "I guess."

        "You know what I say to people when I hear they're writing anti-war books?"

        "No. What do you say, Harrison Starr?"

        "I say, why don't you write an anti-glacier book instead?"

        What he meant, of course, was that there would always be wars, that they were
        as easy to stop as glaciers. I believe that, too.

Well good news for humanity. We're well on our way to stopping glaciers, so maybe we can stop war after all.

<comment><USER25> Soon after stopping glaciers will come stopping technological human civilization. Maybe that won't stop war, but it'll reduce scale considerably. So it goes.</comment></comment>


Show HN: Second. The 1-second game - <AUTHOR> https://itunes.apple.com/us/app/second-lite/id949842736

<comment><AUTHOR> URL: [http://thesecondgame.com/free/](http://thesecondgame.com/free/)

* 1 Rule! Collect the sweet orange circles in a second and move to the next set. That's the one and only rule!

* Sequential sets! Repeat each set the number of times needed to move to the next level. It grows on you, as it grows with you!

* Infinite levels! Each level is accomplished when all sets are complete and then the next comes right up. It never stops!

* Bonus! (free feature) Refill the time in your set as you walk down the levels, taking advantage of the green circles in the game! Who wouldn't love a free extra second?

Hint: Bonus appearance is random, so don't blindly count on it :)

Play it in a bus, in flight, in the subway, at a coffee break or while waiting in queue. Stress your limits. Its super clean interface and its infinite levels make it a pleasant run to a time journey. Start with a second and keep the seconds coming.

Insanely easy to understand yet so difficult to master.</comment>


Smartphone Shipments To Top 1B For the First Time In 2013 - <AUTHOR> http://techcrunch.com/2013/01/07/smartphone-shipments-to-top-1b-for-the-first-time-in-2013-but-the-definition-of-smartphone-is-slipping-deloitte/

<comment><USER2> And 70% of those will be Android.</comment>