Chess Steganography - <AUTHOR> https://incoherency.co.uk/chess-steg/ <comment><USER3> If anything the "one-sided" mode is even more fun: [https://incoherency.co.uk/chess- steg/oneside.html](https://incoherency.co.uk/chess-steg/oneside.html)

It lets you interactively encode a message in your moves when playing against a player who is not in cahoots with you :)

(Disclosure: I made this).

And yeah, sorry about the lack of error-checking. If pretty much anything goes wrong it (maybe) writes an error to the console, and just does nothing.

I'd be interested to see if anybody can produce a short message which can't be encoded because it results in a state where the only legal moves are checkmate.

<comment><USER4> I'd be interested in the shortest word that can't be encoded in the "one- sided" mode when playing against a strong AI. I played Stockfish as white while having black try to encode "hello" but Stockfish was able to checkmate black before it had finished.

[https://lichess.org/yeg4eqyG](https://lichess.org/yeg4eqyG)

</comment></comment><comment><USER5> 1\. e4 g5 2. h3 c6 3. f3 Bh6 4. d4 Bf8 5. Rh2 b6 6. Ne2 Qc7 7. b3 f6 8. Ba3 Qg3+ 9. Kd2 a6 10. Kc3 a5 11. Nxg3 Nh6 12. Ne2 Kd8 13. Qe1 Rg8 14. Nf4 e6 15. Bb2 Kc7 16. Be2 Ng4 17. Ng6 Ne3 18. Qg1 f5 19. Ba3 Bg7 20. Nh8 Ng4 21. exf5 h5 22. Bd6+ Kxd6 23. Qc1 Bf8 24. Qb2 Ke7 25. Bb5 Ke8 { White resigns. } 0-1

<comment><USER6> Best. Phrase. Ever.

<comment><USER7> Was this meant to be in alignment with this person's view point? [http://amp.civilbeat.org/2017/05/hawaii-prof-to-white- guys-g...](http://amp.civilbeat.org/2017/05/hawaii-prof-to-white-guys-get-out- of-the-way/)

<comment><USER6> It was a reference to [https://en.wikipedia.org/wiki/Dirty_Hungarian_Phrasebook](https://en.wikipedia.org/wiki/Dirty_Hungarian_Phrasebook) \- no idea why I got downvoted ... perhaps Monty Python isn't appreciated outside the UK ?

<comment><USER6> Clearly not.

</comment></comment></comment></comment></comment><comment><USER8> A dual to this is: how can you encode chess games in the smallest number of bits?

A move has one of 64 source squares and one of 64 destination squares, so that suggests a naive way to encode games using 12 bits per move. However, there are never more than 256 legal moves in any position, so we can improve on this by listing the legal moves in some reproducible order, then using 8 bits to pick one of them.

Of course most positions have far fewer than 256 legal moves. And some moves are more likely than others. So we can improve on this for real chess games (though not for random chess noise or the output of the chess steganography program in non-blunderfree mode) by sorting the moves in order of decreasing likelihood and doing some Huffman encoding so more likely numbers get shorter encodings. "Order of decreasing likelihood" is not trivial to define - <USER2> using a deterministic chess engine with a large depth would not necessarily be optimal, even putting aside performance concerns.

The state of the art in this is almost certainly the version used by Lichess [https://lichess.org/blog/Wqa7GiAAAOIpBLoY/developer- update-2...](https://lichess.org/blog/Wqa7GiAAAOIpBLoY/developer- update-275-improved-game-compression).

<comment><USER9> I'm not entirely understanding the motivation for this. The most naive method would be to just UCI move notation, that's simply square1-square2. Eg: e2e4 e7e5 g1f3, etc. That's 4 bytes per half move or ply (5 bytes for the once in a blue moon promotion). At an average of 80 ply per game, that's 320 bytes per game notation.

So if we have a billion games that'd just be 320GB. And as you mention converting this to binary yields 6 bits per ply, for a fraction of that. In other words you could naively encode every single game that's ever been played online, offline, or anywhere for a small fraction of the space on a regular large consumer HDD and still have plenty of space left for centuries of games to come. 20TB RAID kits go for less than $1k now a days. And you could load critical (likely to be accessed multiple times and/or concurrently) games (every game ever played by a very strong player, all games within the past year, etc) on a single SSD for rapid access.

Of course saving space is much better than not saving space, but the proposed method does not come for free. It involves some fairly complex heuristics. That means you're trading space for computational complexity. The former is practically free for things on this scale, but the latter very much is not. The article mentions that their decoder was only able to process around 1,111 games per second on average.

Lichess has been pushing around 40k players at some times and will presumably continue to grow. Performance this low on a critical and invokable task also seems to expose a clear denial-of-service vector. And adding new servers is vastly more expensive than adding some new hard disks. By contrast encoding and decoding games in UCI is practically free.

So what is the motivation here?

<comment><USER10> Writing chess software as a hobby is relatively popular. And many people try to optimize as much as possible even when it's not strictly necessary. That's probably motivation enough - although lichess as a business probably doesn't have the same incentives as a hobbyist would.

<comment><USER9> Sure I completely get that, but what the core issue I was hitting on is that you end up trading an expensive resource (computing power) for a very cheap resource (disk space). In cases where disk space requirements become enormous this can be a necessary trade, but here that's not really an issue. I enjoy not strictly necessary optimization as much as anybody, but unless I'm missing something this optimization seems that it would ultimately result in a less performant system with very little to show for it so it wouldn't be particularly fair to call it an optimization.

<comment><USER10> Ah yes, but this way you get to write compression algorithms _and_ do performance optimization. The journey is more important than the destination.

Edit: Also (in Lichess' case) you're not trading CPU usage for disk space, you're trading CPU usage for disk space _and_ network traffic, which you're probably paying much more for.

</comment></comment></comment></comment></comment><comment><USER11> Amazing!

Small nitpick: I wanted to see the "hidden message" in The Game of the Century[0], but it says the last move is illegal:

        Illegal move played?? Rc2#

[0]: [http://www.dwheeler.com/misc/game_of_the_century.pgn](http://www.dwheeler.com/misc/game_of_the_century.pgn)

<comment><USER12> That is intended behavior. Game ending moves are not allowed. See the explanatory blog post: [https://incoherency.co.uk/blog/stories/chess- steg.html](https://incoherency.co.uk/blog/stories/chess-steg.html)

</comment></comment><comment><USER13> [https://en.wikipedia.org/wiki/The_Flanders_Panel](https://en.wikipedia.org/wiki/The_Flanders_Panel)

</comment><comment><USER14> You could then encode the chess notation in a video of two people playing a game of chess. How's that for a hidden message?

<comment><USER15> The chess players in the video might be blinking "torture" though if it's a "no blunders" message.

</comment></comment><comment><USER16> The lichess link doesn't work for me; is anyone else getting "Cross origin request forbidden"?

<comment><USER17> Getting it also

<comment><USER18> Same thing, just copy-paste the moves into [https://lichess.org/paste](https://lichess.org/paste)

</comment></comment></comment><comment><USER19> Errrr this type of stuff is the absolute bane of my Lichess rating

</comment><comment><USER20> Just imagine AlphaZero romancing LeelaZero to plan an escape. That's probably why they didn't release a lot of games :)

</comment><comment><USER21> Was hoping chessboard QR codes when I saw the title

<comment><USER22> Now there's an idea! Make it happen kylek!

</comment></comment><comment><USER23> this is really cool on so many levels - this could lead to a general turn based game playing steganography - like go, poker etc? just need a little more time :)

</comment><comment><USER24> This is pretty fun. You might run into a useless result, such as "Hi, I'd like to buy some weed." without blunders translating to a 369 move game, but if you have the freedom to experiment with minor variations, you can find one that works. "Hi, I'd like to buy some weed" is only 41 moves.

</comment><comment><USER25> So, I'd don't have a board readily available and don't know the notation to well. But does "resign" mean give up in this context? Would it be possible to make this actually run into chess mates at the end of the message?

<comment><USER26> > does "resign" mean give up in this context

Yes.

</comment></comment><comment><USER27> Lol. You can put stenography in any noisy information channel.

</comment><comment><USER28> I wonder if theres an anti steganography move pattern to obfuscate your opponents move. Or do you just win quickly to avoid them sending a useful message?

</comment><comment><USER29> I tried it but it slowed down my browser and capped my CPU so i had to stop.

</comment><comment><USER30> very cool!

ps- got a cors issue on the "view on lichess"

</comment><comment><USER31> I've just tried to unsteg one of my real games to find out if I had anything smart to say, but got "chess-steg.js:139 Uncaught URIError: URI malformed"

<comment><USER32> So if chess-steg were written in C, one could play a chess game with a malware bootstrap payload!

</comment></comment><comment><USER33> This seems fairly pointless

<comment><USER34> Yeah... I had thought that this would be a good way to share messages secretly, but the thing is the moves are nonsensical, so anyone who bothered to check out what the game progresses would know something is up and would google "Chess message encoding" (the fifth result is the blog post for it, lol).

If the moves actually made sense, this would be a lot more useful. There's probably something that can measure how good a move is, so I guess what you can do is make sure that the moves you use to form a message are above a certain threshold. That way, someone looking into the moves wouldn't immediately know that they're being used to encrypt messages. But honestly other than that, I dunno what you can use it for.

<comment><USER3> What you describe is exactly what the "without blunders" mode attempts to do, but evaluating every possible move for each player to a useful search depth takes a long time, so it doesn't search very far.

Also, the more you restrict the space of allowable moves, the more moves are required to encode a given message.

<comment><USER34> Oh I didn't notice that option, cool.

By the way, what was your motivation for creating this?

<comment><USER3> It's just a fun & interesting idea.</comment></comment></comment></comment></comment>


Hydrogen - Without The Nasty Carbon Footprint - <AUTHOR> http://www.scientificblogging.com/news_releases/hydrogen_without_the_nasty_carbon_footprint

<comment><USER2> Gentlemen. Please hear this.

Hydrogen has a carbon footprint. It's just "indirect".

Virtually all hydrogen used the the world today is produced by "reforming" natural gas. "Reforming" is a process where natural gas is burned with limited oxygen and some water thrown in. The chemistry is a bit tricky but hydrogen is produced and CO2 is exhausted.

You can produce hydrogen electrolytic decomposition of water but it results in about a 90% loss of energy. Very expensive proposition and if the electricity was generated with any kind of fossil fuel then that production process generated some carbon.

Only way to use hydrogen without a carbon footprint is to use electrolysis where electricity is generated with something like wind or nuclear.

But I think these new lithium ion batteries that are supposed to come out next year are going to get the job done a lot more efficiently.</comment>


Ask HN: Separating searching for problems from work and life - <AUTHOR>

I recently got out of the hospital with myocarditis and pericarditis. I originally thought I was having a heart-attack but being a healthy 25y/o man that was ruled out pretty fast. After a few days in the hospital they had absolutely no conclusive cause for my condition. I've been suffering a major amount of stress lately which lead to this condition. They gave me a paper on stress cardiomyopathy and it makes complete sense to me as two weeks earlier I was having panic episodes due to stress and I knew that I would give myself heart problems if I continued. Freaky stuff how powerful the mind is.
Regardless, I'm sure I don't need to say but I've been doing a lot of thinking. It all boils down to some core problems. Negative thinking: focusing on bad things that could happen, lack of confidence, trust issues with people.
However I've now realized something: part of this way of thinking is fundamental to how I work. The most crucial part of my job as a SysAdmin/Engineer is finding problems and solving them and finding ways to improve existing systems. It's completely in my nature to find problems and then solve them (I'm self taught). However I think lately I've been focusing on so many problems that it's gone out of control. I realize this now as I analyze photos on Flickr (photography is a hobby of mine). I look for the problems in the photo, look for room for improvement, then leave without gratification on to the next one. Seeing this pattern outside of work has triggered a red-flag.
What I'm asking is how do more experienced and like-minded people handle this? How is it possible to separate looking for problems in work and life? How is it possible to find positivity in problems? How is it possible to take it easy when you're constantly looking for efficiencies because it simply isn't good enough?
Please share your stories and perspectives on this. I'm sure I'm not the only one who's encountered this problem. <comment><USER2> Therapy can help a lot with this. The point of therapy is that instead of letting problems get trapped in your mind and ruminating over them, you talk them over with a trained listener and work out how to deal with them. Or you accept them.

A long-term solution for people that are in creative or stressful jobs often involves some degree of compartmentalization. You may recognize that a problem may require your full attention and take over your life for a week or two - but then when the problem is solved, force yourself to take a step back, breathe, attend to the other areas of your life that need attention, and celebrate your victory. Your work may be stressful, but your life need not be. And then once you've had a time to savor and reflect on the last problem, you can pick out a new one.

Oftentimes, you end up _more_ effective at work when you do this. The tendency when you get stuck in the "See a problem, fix a problem, repeat" loop is that you end up taking on very similar problems, ones that you can already see a solution to when they're presented to you. As a result, you get that rush of accomplishment each time, but you don't grow as a person or step outside your comfort zone by facing new challenges.

</comment><comment><USER3> I used to be very worry-prone too in the past. Stoicism (the philosophy) changed my life. This book provided a very clear introduction, and I make it a habit to reread it every year: [https://www.goodreads.com/book/show/5617966-a-guide-to- the-g...](https://www.goodreads.com/book/show/5617966-a-guide-to-the-good- life)

I also recommend giving Buddhist mindfulness a try (this book is great: [https://www.goodreads.com/book/show/64369.Mindfulness_in_Pla...](https://www.goodreads.com/book/show/64369.Mindfulness_in_Plain_English)), but in the end Stoicism seems to be more suited to the pragmatic, analytical mind of a programmer, because it provides a very logical approach, as opposed to the more spiritual nature of Buddhism.

I seriously cannot overemphasize the improvement Stoicism has brought to my life. I went from having a lot of the experiences you are having (without the physical problems though) to living an almost completely worry-free life.

</comment><comment><USER4> I recently dialed 9-1-1 due to shortness of breath. Eventually it subsided. My pulse, blood pressure and EKG were all completely normal. The emergency room doctor diagnosed it as anxiety, which I do get sometimes however at the time I wasn't actually anxious about anything. I was otherwise having a pretty good day.

"Looking for problems" is something I myself do quite a lot. It's hard ever to be satisfied with anything.

Though I work as a coder, my degree is in physics. I was puzzled at first at some of the research that physicists actually do, such as Caltech's numerical simulation of sand dunes based on the computational physics of sand particles.

Eventually I realized that most physicists go around looking for any kind of problem at all that they think they can solve. Most such problems, while perhaps interesting intellectually, aren't of much use however sometimes useful stuff falls out of them. Consider that the laser was at first regarded as "a solution looking for a problem".

As to how to answer your question: I don't know but I could use that answer myself.

</comment><comment><USER5> "Worry about things you can control and don't worry about things you can't do anything about."

"Everything has imperfections and always will have some. You can't remove all imperfections, focus on the ones that come in the way of enjoyment/utility and can be fixed."

"80% is good enough."

These are the mottos I live by now. My life couldn't be more simpler and stress free and worry free.

I am an ex-Systems Engineer and went through "life-changing" medical episode a few years ago. I used to be like you in both work and life, always looking for the problems to solve, improving systems, and in general being hyper and perfectionist and always stressed because of these. Everything changed during the medical recovery. It made me realize my own mortality and how fragile life can be. And, instead of fixing things, I need to focus more on enjoying things as they are.

<comment><AUTHOR> Thanks for this. I'm on this path right now but with only a week out of the hospital it's still pretty fresh. I fully understand that feeling of mortality though. I think letting go of the things I can't control is one thing I need to work on. I need to let go.

And thanks to the other two posters as well. Any perspective is welcome right now.</comment></comment>


Software firm wants naked web coders - <AUTHOR> http://web.orange.co.uk/article/quirkies/Software_firm_wants_naked_web_coders

<comment><USER2> Not sure where the girls in that picture came from. Not any software shop I've ever worked at.</comment>


How Scribd runs 150,000,000 polygon intersections a day - <AUTHOR> http://coding.scribd.com/ <comment><USER2> I think a lot of people (me included) just though of Scribd as a YouTube of documents -- taking advantage of unlicensed material to juice up Pagerank, and then somehow converting that into a revenue stream. It also seemed kind of annoying to launch a Flash player just to view a PDF in a now, double- scrolling window, however I'm reminded, while reading this technical post, about the Ycombinator interviewer who said: "where's the rocket science?" Clearly, we're seeing some smart developers tackle a tough problem, and for a broad audience. I think they have a bright future!

<comment><USER3> I don't really see how Scribd will be able to maintain any appeal if Chrome polishes up their in-browser PDF rendering, which basically loads instantaneously and seems to render things fine. (The HTML transmogrification is cool, but if PDFs are fast, why do I need it?)

<comment><USER2> My point was that, I don't know that they have any legitimate appeal now, but they seem to be smart, and they're building a IP portfolio in an important space, so they might be able to switch gears or sell their IP. Heck, they might see the writing on the wall and maybe that's why they're writing these technical blogs, to gain exposure for their IP and technology.

</comment></comment></comment><comment><USER4> JavaScript/HTML seems to have caught up to Display PostScript at last. Nice.

</comment><comment><USER5> ok that's crazy. Is scribd becoming the new pdf (I mean that in a good way)?

<comment><USER6> The only thing I could applaud more would be a new (and simpler) cross platform document format (for asset encapsulation and offline viewing) that could be transformed to and from HTML on a whim. Scribd <-> My Screen <-> My Printer. To death with PDF.

Come to think of it HTML5/CSS3 + an open archive/compression format would suit this purpose nicely.

<comment><USER7> What is your problem with PDF?

Almost any browser other than lynx has a buitin pdf reader, and pdf can be created by just about anything.

Finally pdf is a format that allow you to ensure that no matter where it is printed, it is exactly as you wanted it to be.

<comment><USER8> The problem with pdf is that everything about it is clunky and slow. I didn't _decide_ to groan whenever I see that something I want is trapped inside a pdf; years of annoyance just built that up as a reflex.

Edit: actually, there is an exception, and you mentioned it: printing a pdf, once you have it open, is almost always a good experience. Too bad it's the thing I want to do least often.

</comment></comment></comment></comment><comment><USER9> Well, that's about as many as a modern 3D game engine executes in one second, so, meh.

<comment><USER10> I wasn't going to say anything, but you're being upmodded like crazy, so...

It's a complete apples to oranges comparison. Scribd is performing quite complex logic with an emphasis on correctness not speed. I feel like you're dismissing an interesting article for the sake of an amusing one liner, and that's pretty much the antithesis of HN.

<comment><USER9> _I feel like you're dismissing an interesting article for the sake of an amusing one liner, and that's pretty much the antithesis of HN._

It is a nicely-written and illustrated article, but it describes a problem that hasn't been considered 'interesting' for decades and can, in any case, be tackled with a caching scheme. Why would they need to run the same intersection logic over and over, when there's only a finite number of glyphs to render in any given document?

<comment><AUTHOR> > but it describes a problem that hasn't been considered 'interesting' for > decades

Actually, polygon operations on grids is still an active research area, with the latest papers on the topic less than two weeks old: <http://www.sci.utah.edu/socg2010agenda.html>

> Why would they need to run the same intersection logic over and over [...]?

We usually don't. It basically depends on the context in which the glyphs appear on the page. For a standard, say, LaTeX document consisting of mostly text and without weird graphic operations taking place around or on top of the text, a given glyph is just processed once.</comment></comment></comment></comment>


On Writing a C++ Book - <AUTHOR> https://lospi.net/c/c++/programming/developing/software/2019/07/28/cpp-crash-course.html <comment><USER2> C++ isn't my favourite language but it does have a special place in my heart. It wasn't the first programming language I learnt (that was Visual Basic) but it was the first language I did something _serious_ with that was used by other people.

It has been a few years since I did any C++. I looked into it when C++11 came out and it was very much like a new language with foundations of the old language I both loved and hated. Since then I haven't had a need to use it. However I have a few little side projects I want to work on and C++ would be a fine choice for most of them so perhaps I will sit down sometime and get myself acquainted with the newer standards.

Side note: I was gifted a copy of Professional C++ by Gregoire a few months ago so if anyone reading this has read the 4th edition it would be nice to know if this is a good book to get myself up to speed again or if I should look elsewhere :)

</comment><comment><USER3> Once you've become familiar with the basics of the language, I highly recommend taking a look at C++ Core Guidelines

[https://github.com/isocpp/CppCoreGuidelines](https://github.com/isocpp/CppCoreGuidelines)

</comment><comment><USER4> Wow, well done! Will pick this up once Rust in Action is finished.

"It took twice as long to write half of what I proposed. I began writing a projects-based C++ book with a short introduction to the language." Well done for pushing through. It's really easy to become totally discouraged.

</comment><comment><USER5> is this out? No Starch still shows "early access" and "be ready in September", amazon showed it will be released on September 10, 2019. The TOC looks good to me. I hope it has a sample chapter.

<comment><USER6> >I'm also beyond elated that it's getting published

I took that to mean that it is now in the process of being published.

<comment><AUTHOR> Yes! Going through production/printing rites now. No firm date yet, I'm guessing low numbers of weeks.

</comment></comment></comment><comment><USER7> Sounds promising.

I used C++ somewhat, almost 20 years ago, before discovering Python, but I never got very good at it. Over the years I wanted to strengthen my C++ skills, but I never found quite the right material or avenue. Most books/tutorials are too basic for me, others already assume a certain familiarity with C or C++. Maybe this book is better...

</comment><comment><USER8> > C++ has a daunting reputation because its fundamental elements nest so > tightly together

Do they? I tend to find that C++'s features are often quite disjoint, which means that you can pick-and-choose which bits you want to use but the language isn't quite designed like a coherent whole as some other languages are.

<comment><USER9> Any language that grows big has that problem.

My favourite example is Python, I started using it with version 1.6 and even though I only use it for small scripting tasks, always followed each release since then.

It might appeal to beginners, but underneath lies a language as powerful as C++, where even the most savy will fail to remember what changed between minor releases.

<comment><USER10> As much as a like python, it is not as powerful as c++. Hence the reason you have to use cython/cpython to improve performance.

<comment><USER11> Powerful doesn't mean fast. Python is quite slow but C++ is not powerful enough to make so many things usable without -comparatively- a lot of work.

C++ is very fast and entrenched in a few markets ( gamedev, trading, etc) but that's it. As a _language_ it is quite average, encumbered by too many features, too many corner cases.

</comment></comment></comment></comment><comment><USER12> Interesting that the author didn't include C++ Primer in his list of favorites. It's not perfect, but I think its latest edition (C++11) is a pretty good way to learn C++ currently.

<comment><USER13> Do you mean A Tour of C++? That's an excellent introduction by Bjarne himself, but does not talk about some things such as the Boost library.

<comment><USER14> A tour of C++, by B. Stroustrup. Short (~250pages) and accessible introduction to the language and libraries. The second edition has been updated for C++17 and some parts of C++20.

Amazon link: [https://www.amazon.com/Tour-2nd-Depth-Bjarne- Stroustrup/dp/0...](https://www.amazon.com/Tour-2nd-Depth-Bjarne- Stroustrup/dp/0134997832)

C++ Primer, by Stanley B. Lippman, Josée Lajoie, and arbara E. Moo. Really huge book, 970+ pages. Covers almost everything from the language, updated for C++11. I wouldn't use it as a beginner though.

Amazon link: [https://www.amazon.com/C-Primer-Stanley-B-Lippman-ebook- dp-B...](https://www.amazon.com/C-Primer-Stanley-B-Lippman-ebook- dp-B0091I7FEQ/dp/B0091I7FEQ)

The first one is really nice introduction, I picked it up a few months ago to learn the language. Quick read, simple to follow, I really enjoy this book. The second one works as a reference as it goes way more in details and covers a massive amount of stuff!

<comment><USER15> Primer is a really dry reference. It was too boring for me to read it in order. Too many details on not very fun topics from the beginning.

</comment></comment></comment></comment><comment><USER16> Did I miss or there isn't a section that covers modern build systems? I would have loved to get an intro to that.

<comment><USER17> I was also thinking the same thing after glancing at the table of contents. I remember working with C++ while studying at grad school with instructions by two professors who quite loved the language. Even though I enjoyed the language and its STL very much, the mess of its build system and linking to other libraries is what comes to my mind whenever I think about C++. This is exactly why I never touched it again.

Cargo does a fantastic job for Rust in this regard. Rust won me over.

<comment><USER16> >Cargo does a fantastic job for Rust in this regard. Rust won me over.

Cargo - that's exactly what I would love to have in C++. Probably there is something that I am just not aware of as I do not do a professional cpp development.

</comment></comment></comment><comment><USER18> As a dabbler in hardware and edge deployed machine learning models, this is exactly what I've been looking for.

</comment><comment><USER19> Which version of the C++ standard is this book targeting? Also, any links to reviews?

</comment><comment><USER20> What would be the modern (14/17/20) C++ as the first language book nowadays?

<comment><USER21> Everyone has a different path, but frankly, I wouldn't recommend C++ as a first programming language. It's much easier to comprehend if you have some background in another language.

My three favorite C++ books are _C++ Common Knowledge_ , _Modern Effective C++_ , and _Effective C++_. Two of those predate C++11, but most of the advice is still applicable.

As for introductory texts, I guess there's: _Accelerated C++_ , _C++ Primer_ , _Discovering Modern C++_ , _A Tour of C++_ , and of course _C++ Crash Course_ (the book under discussion).

I wouldn't get too hung up on "modern" C++. The vast majority of C++ programmers learned the old stuff (the vast majority of which is still valid), then caught up on the new stuff with _Effective Modern C++_ , blog posts, etc. Just as it's useful to know C before you learn C++, it's useful to know old C++ before you learn modern C++.

<comment><USER22> > Just as it's useful to know C before you learn C++, it's useful to know old > C++ before you learn modern C++.

There are definitely varying opinions on this. If you look for C++ courses for beginners they mostly do not start with C these days. I'd be surprised if any courses currently being taught don't start with lots of std library stuff (especially vector, string, map, etc...).</comment></comment></comment>


Standard ML - <AUTHOR> https://dl.acm.org/doi/abs/10.1145/3386336 <comment><USER2> See also Ocaml, which has had some news relatively recently about improved multicore support.</comment>


Ask HN:  Does anyone know how to get back into facebook? - <AUTHOR>

Long story:  http://textblog.anands.net/archives/196
Short story:
I have 3 RSS feeds and I was trying out various options to add the feeds to my profile.  I finally settled on a Yahoo Pipe to aggregate all my feeds into a single feed.
Facebook termed it as a violation of their TOS.  A GUI mis-understanding later, my account got disabled.
Question: What is involved in getting back into facebook? Does anyone know? <comment><USER2> I've had a couple friends with similar experiences, their accounts were reactivated after:

1\. Emailed request/explanation.

2\. Short time period (~2 weeks).

<comment><AUTHOR> Thanks, I have emailed them already. Appreciate your reply.</comment></comment>


Chinese Spies Got the NSA's Hacking Tools, and Used Them for Attacks - <AUTHOR> https://www.nytimes.com/2019/05/06/us/politics/china-hacking-cyber.html <comment><USER2> So China ran a network sniffer and captured and reversed some 0day that the NSA lobbed at them? I'd be pretty surprised if this sort of thing didn't happen all the time in cyberwar, considering the NSA has a massive, worldwide sniffing operation and China has the GFW. I feel like this story is omitting some important fact that makes this a bigger deal.

<comment><USER3> Agree, this reminds me of a 'limited hangout' [0] where a small bit of the big story was released for people to talk about so that the real story never gets revealed.

[0] [https://en.wikipedia.org/wiki/Limited_hangout](https://en.wikipedia.org/wiki/Limited_hangout)

<comment><USER4> Lately this seems to be virtually every story related to "spygate" from the times. One persons "scoop" is another powerful person's attempt to shape narrative.

<comment><USER5> The ufo conspiracies are an example of this. The government promoted ufo stories to distract from the real stories.

<comment><USER6> As an insider please let us know, what are the real stories?

<comment><USER5> "According to later estimates from CIA officials who worked on the U-2 project and the OXCART (SR-71, or Blackbird) project, over half of all UFO reports from the late 1950s through the 1960s were accounted for by manned reconnaissance flights (namely the U-2) over the United States. (45) This led the Air Force to make misleading and deceptive statements to the public in order to allay public fears and to protect an extraordinarily sensitive national security project. While perhaps justified, this deception added fuel to the later conspiracy theories and the coverup controversy of the 1970s. The percentage of what the Air Force considered unexplained UFO sightings fell to 5.9 percent in 1955 and to 4 percent in 1956. (46)"

Source: [https://www.cia.gov/library/center-for-the-study-of- intellig...](https://www.cia.gov/library/center-for-the-study-of- intelligence/csi-publications/csi-studies/studies/97unclass/ufo.html)

</comment></comment></comment></comment></comment></comment><comment><USER7> > Based on the timing of the attacks and clues in the computer code, > researchers with the firm Symantec believe the Chinese did not steal the > code but captured it from an N.S.A. attack on their own computers

Out of curiosity, I wonder who directed the NSA to attack Chinese computers?

<comment><USER8> Even though the NSA-style attack was conducted by Chinese hackers in March 2016 (comfortably before the Shadow Brokers' leak of NSA tools in August 2016), it's possible that the tools were circulating outside the NSA earlier and thus used outside of NSA direction.

Edit: That was confusing. Basically, we don't know when exactly before Aug2016 the tools were leaked, so it could have been someone else probing the Chinese server.

<comment><USER9> After the Wikileaks Vault 7 releases, specifically the details about how Marble and Umbrage make it easy to implement a digital false-flag attack, I don't see how anyone can be certain of the identity of a sufficiently skilled attacker in the modern era. Any state security agency in any reasonably- advanced country likely has their own equivalents of the Marble and Umbrage tools at this point.

Was this attack from China? Was it from the US making it look like China to justify US economic and diplomatic retaliation? Was it from Germany looking to embarrass the US with a false-false-flag attack making it look like the US made a false-flag attack on China after the US spied on Merkel's phone conversations?

We could go down rabbit holes forever. Who can be completely trusted to speak openly, knowledgeably, and honestly on specific instances of attacks? Every last individual and organization in that world is neck-deep in their own agendas.

</comment></comment></comment><comment><USER10> Yet more evidence that you can't trust anyone with magic software that defeats device security without making the devices insecure.

<comment><USER11> OS makers have that magic software and seem to keep it secure enough. They can update your device and potentially hack if it they want to. If you think that's a bad idea, what alternative would you propose for automatic security updates?

<comment><USER12> The "magic software" is, at its core, just strong encryption and an unbroken chain of trust.

You trust your OS updates because your machine trusts the certificate it is presented with. Your machine trusts that certificate because it is signed by an authority which is in your machine's local list of trusted authorities.

If people mess up that list of trusted certificate authorities, it can easily compromise the system. Remember this?

[https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...](https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident)

Now imagine if, instead of having an identifiable certificate authority which accidentally allowed third parties to intercept and modify your encrypted traffic, that were an undetectable feature of the encryption algorithm.

If that were the case, no matter how much you trusted the entity that understands the nature of the backdoor, you would not trust your OS.

<comment><USER11> So the problem is more about transparency and reliability of the software than about government access? I don't think so though because otherwise anyone proposing government backdoors would neutralize opposition by saying let's make it a front door, we'll have our certificate trusted by those same CAs and be open about it.

</comment></comment></comment></comment><comment><USER13> This NYT article is paywalled but Symantec's blog post [0] (on which much of the NYT article is based) is not.

\---

According to the blog post, "Buckeye", a group allegedly working on behalf of the Chinese state, also used an "exploit of a previously unknown Windows zero- day vulnerability. This zero day was reported by Symantec to Microsoft in September 2018 and patched in March 2019."

So Symantec reported a zero-day -- _which was being actively exploited in the wild by a state-based actor_ \-- to Microsoft and Microsoft _STILL_ didn't release a patch for it until six months later?

[0]: [https://www.symantec.com/blogs/threat- intelligence/buckeye-w...](https://www.symantec.com/blogs/threat- intelligence/buckeye-windows-zero-day-exploit)

</comment><comment><USER14> >the Chinese did not steal the code but captured it from an N.S.A. attack on their own computers

I don't understand the US's relationship with China. The above seems to possibly suggest some mild cold war scenario?

<comment><USER15> I don't know how much foreign relationships or China-US policy you follow but when it comes to China-US, the term "Thucylides' Trap" gets thrown around a bit ( [https://foreignpolicy.com/2017/06/09/the-thucydides- trap/](https://foreignpolicy.com/2017/06/09/the-thucydides-trap/) \- a term coined by this guy: [https://en.wikipedia.org/wiki/Graham_T._Allison](https://en.wikipedia.org/wiki/Graham_T._Allison) )

Rivalry between a rising power and an existing superpower is inevitable. How it gets resolved though is not certain.

China is on track to overtake the US economically in a decade or two (if you consider PPP adjusted GDP they've already surpassed us). That have implications in other areas too -- strategic, diplomatic, cultural, etc. How will the US respond to this? Will we simply let it happen or will we stop it and perhaps violently? What will it mean for our agendas in different areas since China and the US don't share the same goals in many areas. What's especially frightening to me is that Xi seems to advocate a view that China's rise is a return to a historical greatness and that China is destined to dominate -- similar in some sense to the old "manifest destiny" idea of the US. Xi's idea is now enshrined into the Chinese constitution along side Mao's ideas. My view is on this rather bleak but I think the US needs allies more than ever. Ironically I think two equally matched powers are more likely to come to a peaceful coexistence than if one side perceives the other to be weaker. Maybe a new cold (or cool-ish) war isn't so bad compared to a hot war.

<comment><USER16> Its not clear what the ideological lines are though. With USSR, it was a very clear Capitalism v/s Communism ideological battle. Its not clear to me that the rivalry would escalate to the same levels as it did during the Cold War.

There is one thing that does give a lot of hope to me personally: the close economic relationship between the US and China has created a tight bond between the countries even if they are unwilling to admit it openly.

Its not inconceivable for world powers to co-exist in peace. There will be a lot more frontiers in the future that can be competed on without wanting to destroy one another.

<comment><USER17> There need not be an ideological conflict. Ideology was a mobilizing idea in the 20th century but has lost mindshare. France and Britain vied for centuries having similar societies and economies. There can be a tribal aspect to conflict, as well as simply a competition for the spoils of world dominance, which are many.

<comment><USER18> > Ideology was a mobilizing idea in the 20th century but has lost mindshare.

Ironic then that it is called the Thucydides trap then, since the ideological lines between Athens and Sparta were very stark indeed.

</comment></comment></comment></comment></comment><comment><USER19> So China pretty much pulled the reverse card in UNO?

<comment><USER20> Sounds like it. They arranged to be rubber to our glue.

</comment></comment><comment><USER21> Do you think cybersecurity or ai is a better field to dive deeper into as a career/business field? I feel like in some ways ai has already been hyped up but cybersecurity tends to be quite niche in its demands?

<comment><USER22> Why only pick one?

<comment><USER23> Because one has limited time

<comment><USER24> But shouldn't you at least try both? They seem to me to be two very different things.

<comment><USER21> I've already been dabbling in both but if Im to either start a business or pursue a career in a single field I feel it's probably going to require more more dedication to one thing, but thanks for the response

</comment></comment></comment></comment></comment><comment><USER25> > Chinese intelligence agents acquired National Security Agency hacking tools > and repurposed them in 2016 to attack American allies and private companies > in Europe and Asia, a leading cybersecurity firm has discovered.

Does that open up the NSA to a lawsuit from those U.S. companies that were attacked by the same tools the NSA created and used against targets in China?

It seems like there ought to be some liability for any organization that gives this kind of technology to another organization who is likely to misuse it, even if "give" in this instance means "use it against them".

<comment><USER26> Of course not. The NSA didn't put those vulnerabilities there. If we want to start pointing fingers, the first point of liability would be with whoever released the vulnerable software.

<comment><USER27> I do and you probably do too. Of course we can fantasize that these vulns have been planted, maybe even a couple have been. But most of them are probably just uncaught mistakes and subtle semantic errors. I believe in proving software (and other stuff) correct, but that doesn't mean we'll arrive at some point to the one true software. The problem is about defining formally what it is to be correct, having a model that encompasses all things you care about. You can't blame people for writing faulty software and shipping exploitable hardware, that's just what one does. I think it makes sense to blame people for discovering exploits and not disclosing them properly tho. That's what one is expected to do... Some wishful thinking: let's hope the US will see that the only move with positive outcome is to start a global disarmament initiative. We seem to have forgotten the days of fighting for de-weaponizing encryption, this should apply to cyber-security in general.

</comment></comment></comment><comment><USER28> Something about this whole article is bullshit. In fact, it could be a planted story BY NSA.

The Shadow Brokers released _source code_ and the USA still doesn't know how it was leaked. There's no source code in an "interception".

</comment><comment><USER29> If someone steals a gun and kills someone, I'm mostly mad at the murderer, but I'm at least a little mad at the irresponsible gun owner.

<comment><USER30> It's more like one murderer stealing a gun from another murderer, since they both use the tools against everyone else.

</comment></comment><comment><USER31> China is becoming an increasingly big threat to the west and it's values, only because it's a communist dictatorship. With the rise of the middle class and the ultra rich in China, I dont know for how long with the communist party stay in power. It seems the government censorship and all the spying does work for controlling the people into believing the government is doing good to them...

<comment><USER32> China hasn't actually been communist in a long time. I think the current situation is that the growing middle class will give at least tacit support, so long as they keep growing. With memories of the late 60's still hanging over that nation, they prize stability more than nations that haven't lost it in living memory.

Now, if the economy turns really sour, then like Indonesia in the 90's they may discover that the populace gets restless very quickly. But, for now, I think the Chinese middle class is not in the mood to make big trouble.

<comment><USER33> The Chinese have found (or been given) the _modern Middle Kingdom_ under the rule of the Communist Party. What is happening in China is what has always happened in China. Certain invariables that even the Cultural Revolution could not erase from the Chinese nation. What China dislodged during the reign of Mao was out dated _forms_ of these invariables. Confucius is out, Party Chairman's 'thoughts' are in.

The West is used to seeing the decrepit aspect of the Chinese and associates that with its characteristic societal structure. But this nation also has an aspect of splendor. This renewed splendor appears to bother some in the West. In fact, any sort of renewal of Asia not under the control of the West is "alarming" to the West.

Don't worry. Asians don't hold grudges .. ;)

<comment><USER34> every country has its history. That does not justify China's human rights violations. I am all for China overtaking the throne as the global hegemony, if they cared about human rights outside of the Han people. Stopping the genocide on the western part of China would be a start. Either way, US being number two may give us a much needed gut punch. We can trim some of our collective fat.

<comment><USER31> I mean, China only got where it's now by stealing tech from the US and EU. Either with spies, or by letting foreign companies "compete" in China, only if they partner up with a local company, and then for the government to clench the foreign company so that they finally quit the market. Also, if the IP was actually protected, Chinese companies would have to pay billions back to the US and EU... I only like Trump because he sees the bigger picture in terms of China being a threat, how much China is making a fool of the west, and also due to the tax cuts.

<comment><USER35> are you sure that you've gone through some critical thinking before saying that?

<comment><USER31> Are you perhaps Chinese? All your comments are about defending China regarding the same issues. Its funny. Have you heard of those government actors in China that are paid to flag comments and write good comments about the government

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> 188 upvotes in 3 hours and already off the front page. Clearly people are flagging this post. The question is why...

</comment><comment><USER37> Golly, who could have ever expected this? Hopefully everyone remembers this when authoritarians cry about needing backdoors in all of our encryption.

</comment><comment><USER38> Ok, so Edward Snowden runs off with few terabytes of NSA data. He briefly stops in China, before finally going to Russia. Now NSA hacking tools are used against US and we are supposed to believe that "Chinese did not steal the code but captured it from an N.S.A. attack on their own computers".

Somehow I'm not convinced.

<comment><USER39> > He briefly stops in China, before finally going to Russia.

Hong Kong is NOT China.

<comment><USER32> Well, it is and it isn't. But I think any tools he had that long ago would not be newsworthy by now.

<comment><USER40> Yeah that's what I was thinking. 4 years between Snowden's releases and Vault 7, and another 2 years from then until now. Most 0-days don't live that long. Not to mention the fact that Snowden has always refused to work with Wikileaks... The conspiracies that people treasure are quite revealing.</comment></comment></comment></comment>


Show HN: DailyTechVideo – curated conference talks for full-stack developers - <AUTHOR> http://dailytechvideo.com

<comment><AUTHOR> I launched [http://DailyTechVideo.com/](http://DailyTechVideo.com/) about eight months ago, and continue to upload a new video (nearly) every day. I've learned a ton, and hope that others have, too!

If you know of a good video that I can add to the collection, please feel free to tweet me at @DailyTechVideo. I'm always looking for new interesting, high- quality talks!</comment>


HTLV-1: An emotional call to eradicate ancient virus (2018) - <AUTHOR> https://edition.cnn.com/2018/05/10/health/htlv-1-virus-who-letter-study/index.html <comment><USER2> First thing I wanted to do within on paragraph was find the wiki on this- for anyone else interested [https://en.wikipedia.org/wiki/Human_T- lymphotropic_virus](https://en.wikipedia.org/wiki/Human_T-lymphotropic_virus)</comment>


Most Popular Programming Languages 2010 – 2023 (Extrapolated) – By GitHub PRs - <AUTHOR> https://www.youtube.com/watch?v=LjWn2aJ3o2g <comment><AUTHOR> Original GitHub data is for 2012 - 2020. Rest of the data is extrapolated using linear regression. Programming languages move slowly, so my future prediction has a decent chance of holding.

I will try predicting further into the future via introducing seasonality and using a more complex extrapolation formula. We'll see how it goes then.

</comment><comment><AUTHOR> Update: 2019 Q4 Python data is an extrapolation error. It doesn't swing up enough to surpass JavaScript. Though it might by 2023, that is yet to be seen.</comment>


How a Router's Missed Range Check Nearly Crashed the Internet - <AUTHOR> http://www.renesys.com/blog/2009/02/longer-is-not-better.shtml <comment><USER2> This might be a good post to ask this particular question: I am very unfamiliar with the nuts and bolts of how the Internet _actually_ works. I understand DNS resolution, ports, HTTP protocol - all of the higher-level abstracted stuff that you need to know to program within the environment. However - route-maps? BGP? ASN? Whatever else is under the hood that makes it tick - no idea. What's a good book to learn all this stuff?

<comment> patrickg-zill I will try to give you a quick recap, the books other have suggested are good.

Your connection to the Internet is probably single-homed, that is, one connection going to one upstream provider. Simple enough to understand - "send all packets not meant for the LAN to this address".

Consider that a large company, or a datacenter with hundreds to thousands of servers, will have multiple connections to multiple providers, such as ATT, Level3, Sprint, Cogent, etc.

BGP is the border gateway protocol - it lets you load sets of prefixes (eg. 188.8.131.52 if that range were all owned by one provider) and then given the connections you have and what prefixes are connected to that connection, it will try to use the least number of hops to get your traffic to the destination.

ASN is autonomous system number - basically a "site location" that represents an organization that has some number of IP addresses (represented by prefixes as above).

You use the ASN in conjunction with the other information you give BGP, so that you don't have to store ALL the routes for ALL the locations and compute the path for each packet.

Big routers like the larger Ciscos have custom RAM chips and do most of the routing in hardware, in order to be fast enough. They are called TCAMs : [http://www.enterprisenetworkingplanet.com/nethub/article.php...](http://www.enterprisenetworkingplanet.com/nethub/article.php/3527301)

<comment><USER2> Thank you for that. Now, let me ask you this: so, let's say we are talking about that large datacenter with hundreds to thousands of servers. What are the possible reasons for why you would have multiple providers as opposed to just pumping everything through one?

Is it:

1) A provider might not have enough bandwidth available for your needs, so you need to diversify?

2) You would get multiple providers so that you try to reach as many destinations as possible directly? IOW, if I only have ATT, then in order to get to destination X that's on Level3 there's an extra hop wherever the hell ATT connects to Level3, and you also have Level3 yourself then the fastest route to that is through the Level3 network?

3) All/None of the above/something else?

<comment><USER3> If you are large enough (say, you are a large national access or hosting provider), there is no single, even larger "The Internet, Inc." upstream provider you can use as your single link. You have to negotiate peering agreements with the other large actors so that you have reliable and affordable routes to all parts of the net. At this level you need things like BGP to know where to send traffic for a destination outside of your own net, because you could have several possible routes with different performance and/or price.

Unlike most LANs wich are either physically or logically (via the spanning tree protocol) structured like a tree, the core internet is a weighted graph.

</comment></comment></comment></comment><comment><USER4> Interesting little fact, the BGP protocol and other bits related to propagating routing information will not converge to an answer in general, but will under certain conditions such as "no dispute wheel" (which can happen if the routing distances don't satisfy a triangle inequality[by which I mean some geometric notion of distance], though thats too strong an assumption about routing choices to be reasonable).</comment>


Truffle.io - Life is complicated so we made dating simple. - <AUTHOR> http://jointruffle.com

<comment><USER2> Looks nice, but the text reads as if it was written by a non-native speaker of English, or at least someone who is not really sensitive to the nuances of the language. I suggest you run the site past a few people who _are_ sensitive.

A few quick thoughts:

(1) A comma is not a clause separator.

Life is complicated.

We made dating simple.

(2) Actually, I think "We _make_ dating simple" sounds better.

(3) Truffle _accesses_ , not _access_.

(4) "Folks" sounds a little odd to me.

<comment><AUTHOR> Ah thanks for the insights, true I am not a native speaker. Will run it tomorrow with couple of people here.

</comment></comment><comment><USER3> Nice looking website, but don't you think it's a bit weird to use a LinkedIn profile for dating? LinkedIn is like the one place on the internet where you have to act professional. I don't even like it when my personal life overlaps with LinkedIn so I Can't even begin to imagine myself feeling comfortable using it for dating.

<comment><AUTHOR> Thanks :) LinkedIn is just an authentication mechanism for us make sure that the user is a working professional. We don't post anything on your LinkedIn profile.

<comment><USER4> Doesn't matter. I would never use my main linkedin account to login, and I won't bother to create a(nother) linkedin account just to access your service. Nor would I ever want to date a 'working professional'. Sorry, not for me but best of luck with it. Hope it works for you.

<comment><AUTHOR> So I get the emotions about not mixing your professional and personal life. But tell me how do you meet people then? Do you meet at the coffee shop or at the bars. Most of the guys are shy and need some kind of platform for the first conversation.

There is also an element of trust for girls to go on a blind date with a guy whom she knows works in some reputed company.

</comment></comment></comment></comment><comment><AUTHOR> \- Make your profile in 1 min exact \- Browse pictures of other users \- Meet them over for a coffee, no ping pong messaging</comment>


Xmake vs. Cmake - <AUTHOR> https://tboox.org/2019/05/29/xmake-vs-cmake/ <comment><USER2> The biggest problem is that, despite the many different solutions, no build system has come out as a clear winner for C/C++. So every library out there uses a different build system, and to use them all in your app, you must degenerate to makefiles in order to be able to call all the different build tools you need for each library.

Every now and then, a new god build system comes out (one builder to rule them all), which only exacerbates the problem.

Until the C++ language leaders bless a particular builder, this will continue.

<comment><USER3> I've tried a lot of build systems but IMHO CMake is the only one where you can get away with just using CMake and the platforms target compiler. The rest includes additional pain points, more stuff to set up and configure.

What's missing from my point is the community getting together and defining a canonical way to actually build CMake projects for all use cases. If you look at github, there is hardly any project using CMake to the extent of its abilities, or things stuck in CMake 2 days. In commercial scenarios I've seen even worse.

Package manager make this even worse since all of them neglect the fact that there actually may be packages available on a platform via existing package managers. What puts me of about vcpkg or conan is that on a Linux box this should just allow one to use yum/apt/etc instead of manually downloading from yet another 3rd party. Having yet another repository is pretty much only usable for non-commercial projects where things such as long-term support barely have a meaning.

<comment><USER4> > there is hardly any project using CMake to the extent of its abilities

I disagree. Every CMake project I've worked on does some weird thing that you couldn't do with Meson or XMake or whatever.

I'd be happy with CMake being the defacto C++ build system if its language wasn't so god awful. The most unforgivable things are that `if()` is broken and there's no real list type (they're just semicolon-delimited strings, with extra complications). In fact everything is a string.

</comment></comment></comment><comment><USER5> One very nice feature of CMake is that it can create project files for different IDEs. Add that to XMake if you want to be competitive with CMake as at least on Windows, it's a time saver to be able to use Visual Studio to build a C++ project as you can directly debug easily.

<comment><USER3> It's also one of the most problematic thing at the same time since getting the generators set up properly to output IDE usable stuff for a project that e.g. needs to be usable in IDEs on Windows, macOS and Linux is very time-consuming. Writing macros to make this work has been nerve wracking IMHO.</comment></comment>


Facebook and Microsoft Partner on Remote Development - <AUTHOR> https://developers.facebook.com/blog/post/2019/11/19/facebook-microsoft-partnering-remote-development/ <comment><USER2> Just an FYI for people - The Remote Development extensions are not open source. I'd hope if Facebook were joining efforts, they'd do so on a more open project.

1: [https://code.visualstudio.com/docs/remote/faq#_why-arent- the...](https://code.visualstudio.com/docs/remote/faq#_why-arent-the-remote- development-extensions-or-their-components-open-source)

2: [https://github.com/microsoft/vscode/wiki/Differences- between...](https://github.com/microsoft/vscode/wiki/Differences-between-the- repository-and-Visual-Studio-Code)

3: [https://github.com/VSCodium/vscodium/issues/240](https://github.com/VSCodium/vscodium/issues/240) (aka, on-the-wire DRM to make sure the remote components only talk to a licensed VS Code build from Microsoft)

MS edited the licensing terms many moons ago, to prepare for VSO (Visual Studio Online = VS Code in browser using these remote extensions/apis that no one else can use)- [https://github.com/microsoft/vscode/issues/48279](https://github.com/microsoft/vscode/issues/48279)

Finally, this is the thread where you will see regular users being negatively impacted by the DRM (a closed source, non-statically linked proprietary binary downloaded at runtime) that implements this proprietary-ness: [https://github.com/microsoft/vscode-remote- release/issues/10...](https://github.com/microsoft/vscode-remote- release/issues/103) (of course, also with enough details to potentially patch around this issue if you were so inclined). Further, MS acknowledged that statically linking would help in May, and yet it appears to still be an issue.

I just hope they don't come after Eclipse Theia...

<comment><USER3> Fuck. I really bought into MS's open VSCode spiel.

<comment><USER4> It's the Open Core business model that is becoming the standard Open Source business model these days. Wikipedia even has a nice little list of companies that use the same business model: [https://en.wikipedia.org/wiki/Open- core_model](https://en.wikipedia.org/wiki/Open-core_model)

It's not EEE. The open core makes it so that the last step in EEE doesn't work. With an open core, anyone can fork.

</comment></comment></comment><comment><USER5> Very happy about this move. Nuclide's remote development capabilities were way above anything else I've tried (Sublime, IntelliJ Ultimate, VSCode, remote SSH mounts, etc).

It's the only solution I've found that really allows you to browse the remote filesystem as smoothly as you would with your local drive (including when you're also changing the remote files outside the IDE), degrade functionality as needed when the connection isn't great (using caching appropriately), and immediately recover when it comes back. The only cost to pay was a bit of setup server-side (installing watchman and opening a port, if I remember correctly). I really hope they can bring the VSCode experience to the same level!

<comment><USER6> What is missing from vscode for remote development? MS released their remote development extensions earlier this year, and everything from browsing to searching feels native.

<comment><USER7> Do you happen to know if it works for vagrant VM's? Because having a file system mismatch (symlinked dependencies in vm, IDE doesn't recognise them) is a bit of a pain point for me right now, it would be really fantastic to find a solution within VSC.

<comment><USER6> Not sure, but it works by storing files on the remote server under ~/.vscode, and this is where all the normal code files are stored. When you connect to a remote system it loads these files over ssh.

</comment></comment></comment></comment><comment><USER8> I was an Atom holdout for a while - it felt disingenuous the way Microsoft kind of swept in and usurped their idea.

But man, eventually I caved. VSCode is a marvel. It performs better than most native IDEs I've used, despite being Electron-based. It's the good parts of Visual Studio without any of the legacy baggage. Its package ecosystem is just as vibrant as Atom's, with solid support for nearly every language under the sun, but at the same time its built-in features and attention to detail in the user experience are Apple-level (really, Apple-of-ten-years-ago-level). I still can't believe I get to use it for free.

<comment><USER9> I would say Microsoft's dev tools have always been best in the business, but only in their ecosystem and only for their ecosystem. A big part of the reason I still go out of my way to use MS SQL is how good SQL Studio is.

The revolution with VSCode is the openness, not the quality.

<comment><USER10> Out of interest, have you ever used Jetbrains products like IntelliJ IDEA and friends? Even back when I was writing C#, years ago, Visual Studio was way less productive without their ReSharper plugin.

<comment><USER11> I'm sure it's a "too each their own" feeling.

Personally, I've never seen Visual Studio so unproductive as with ReSharper installed. The number of colleagues over the years I've had to work to convince them to remove or disable ReSharper to get any work done on projects has been too many. ("I hate Visual Studio because it is too slow." "Do you have ReSharper installed? What happens when you disable it?" "Wow, Visual Studio is really fast now." Surprise.) I've had employers install it by default, I didn't like using it, and I made sure that my employer wasn't paying for a license directly for me when I uninstalled it.

If Android Studio is any indication, I don't see what the fuss is about IntelliJ either. But some of that is certainly just lack of familiarity because I only open up Android Studio when I have to.

<comment><USER10> It may just be that my experience was a good while back and VS has improved since then. At the time the built-in static analysis really wasn't up to scratch.

</comment></comment></comment></comment></comment><comment><USER12> I teach underprivileged adults how to code. Most of them use old computers so I had them ssh into my server when they code so they don't have to install anything. When they learn about web development, whatever they built would be immediately available online under their subdomains that they could show off immediately to their friends and try on their phones.

The only drawback is that they had to learn and use vim to do their code editing. I tried to make their lives easier by setting every user with a default vim config, but the insert vs normal mode is a big hurdle for most students.

I'm glad visual studio code supports remote development, I'm hoping that means now my students can use it to ssh access my server and code there. Excited to try this out with new students.

<comment><USER13> Perhaps you can let them edit their files locally and instead of vim, teach them how to scp/rsync the files onto your server. Hopefully their computers are at least fast enough to run VS-Code.

<comment><USER14> My mid end computer isn't fast enough to run VS code.

<comment><USER15> A raspberry pi can run VS Code so I'm a bit curious what you call a mid end computer.

</comment></comment></comment></comment><comment><USER16> I'm disappointed this wasn't really about remote workers but about remote development as in code doesn't live on the machine. That said, remote development tends to be awful, and more tools could be helpful if it's not specific to a FBs particular implementation of remote dev shards. Learning that at Facebook you don't develop things locally and likely are on a box with all sorts of things tracking your usage and access to everything lends even further credence to the big brother thing. I understand that for a codebase and app that's too big to run on one client machine it makes sense, but what also makes sense is having piecemeal development environments where you just pull the components that you need.

<comment><USER17> Disclaimer: Work at Facebook

Not really sure what you are implying with the 'Big Brother' comment. The remote development servers are only used for writing/debugging code and not for other daily tasks. Even if they are tracking what tools/functions I am using on the server, what does that matter?

Personally, I have found remote development awesome because it enables engineers to start contributing to a huge product in the very first hour. No need to wait for the repository to clone, the dependencies to install, and the code to build before you can become productive.

<comment><USER18> > Personally, I have found remote development awesome because it enables > engineers to start contributing to a huge product in the very first hour. No > need to wait for the repository to clone, the dependencies to install, and > the code to build before you can become productive.

I am nobody but I've had this nagging feeling ever since I started working on websites for big corporations about why can't I work on my code on my local machine with no network connectivity? Why do I need to talk to three different databases and two different services on five different servers? Why can't I just fake all those things during my development?

If anything, my not so humble opinion is that remote development further enables bad habits. Of course, remote development is a tool and is not to blame but I recently learned the term "hermetic" build [Google SRE]

>The build process is self-contained and must not rely on services that are external to the build environment.

Personally, I think we should work towards making it possible to run (or at least stub) the whole stack on a single physical machine - be it local or remote. What do you think? I think this is a trivial problem engineering-wise but I am not very good at selling ideas.

[Google SRE] [https://landing.google.com/sre/sre-book/chapters/release- eng...](https://landing.google.com/sre/sre-book/chapters/release-engineering/)

<comment><USER6> Outside of web development, sometimes you need special hardware or workspaces configured to do development. Usually this can be done in a container, but that comes with its own annoyances. Having a central development server for large compiled code bases is really useful.

<comment><USER19> Not true. Worked on a real distributed payment system. Every service came with a mock clone or a single server mode to standup all services in the same box. Every developer had a powerful personal desktop (or two). I loved it. Everyone I knew there loved it.

<comment><USER6> See comment below. Just because it wasn't true for you, doesn't mean it's not true. I'm not talking about mocking services to run it; I'm talking about the development environment and sharing with a team of 20 or so on a code base that takes 45 minutes to compile without parallelizing the build. You also cannot mock GPU functions. There's simply no cuda emulator.

</comment></comment></comment></comment></comment></comment><comment><USER20> The trend seems to be the IDE and development environment will move to the cloud for larger companies. This is what Facebook and Google are already doing. It makes ramp up easier, environments more consistent and tooling more predictable. Also you can spin up multiple development branches of the same codebase without having to switch branches or stash changes (a big deal when you have one giant monorepo). And probably harder to leak any IP.

<comment><USER21> I might be becoming an old fart, but I really don't see the benefits. I use vim, so technically I've been able to do remote development for years, but I've never felt the need to. Git makes sure that I have easy access to the right code version, Docker and docker-compose make sure I have the right environment. I only run one version of the codebase at a certain point in time. After all, I'm mentally focused on one problem at the time, right?

Yes, running docker-compose for the first time takes a bit longer. But seeing it unfold and having all the parts present on my local system helps me understand this new system better. And really, how often does this happen?

</comment></comment><comment><USER22> I've just set up remote development VM on my personal server and it's super seamless. Love this stuff, crazy fast. It's scary that I, a person who expressed my dislike with Microsoft in the past, got hooked on VSCode + Typescript.

But.

There is a possibility that in a corporate environment this tool could be more of a hurdle. Imagine that you don't have control over your VM. No root, no sudo, everything is monitored and scrutinized.

Sounds scary.

I'd rather have a bare metal machine with something like Proxmox just for my team's needs.

</comment><comment><USER23> Why is everyone in this thread so into the concept of remote development, especially when it comes to the likes of Microsoft and Facebook leading the charge? Both companies harvest massive amounts of data about their users and have a proven track record of privacy violations.

What happens if this becomes the norm and IDEs are only in the cloud? Do these corporations decide who gets to code on their platforms and gain the ability to peep into the technical secrets of every competitor?

I will never support this.

</comment><comment><USER24> I did remote development through Putty sessions using vim/tmux for several years. Would have been nice to have something like this.

</comment><comment><USER25> Everything is better than "cloud desktops" and everything that includes remote desktop connection for UI, with bad font rendering etc. I don't use vim, I use IDEs and like when they have native and fast rendering

<comment><USER26> vscode is based on Electron. So even if you run it locally, it runs on "browser". So Remote Desktop is not needed.

Also there's some other features for remote development. You can for example develop inside Docker while running the UI on your desktop [1]. Or you can connect via ssh [2]. A bit like IDE split between client and server components. All the intelligence runs remotely, just UI runs locally.

[1] [https://code.visualstudio.com/docs/remote/containers](https://code.visualstudio.com/docs/remote/containers) [2] [https://code.visualstudio.com/docs/remote/ssh](https://code.visualstudio.com/docs/remote/ssh)

<comment><USER27> Electron is not the browser - it's node.js + HTML DOM - I get what you are trying to say but being electron based doesn't really buy you anything in the scenarios you listed, native UI IDEs can and do use SSH filesystem and language servers in a same way VS code does (for example both those features exist in visual studio proper, and work even more reliably imo)

<comment><USER28> Node.js runs on V8, so if you add the DOM and HTML... you have, essentially a browser.

<comment><USER27> That doesn't really buy you anything distributed over a native UI + IO framework.

You could use the DOM based text editor (I think the VS code one is called Monaco ?) to build a cloud IDE (I've seen a few instances of this) but VS code has nothing specifically suitable for this over standard IDEs.

</comment></comment></comment></comment></comment><comment><USER29> I hadn't realized Nuclide was dead. It had a great experience browsing remote files systems (albeit quite a heavyweight setup, but the big problem with it is that it tried to do too much. It override almost every preference and plugin. It was crazy.

You just had to drink the kool aid and give up any thought of of using any of your own preferences, but it worked.

Guess I'm uninstalling it now.

</comment><comment><USER30> Remote development via TRAMP is the number 1 reason I'm stuck with Emacs. More support via other editors is always appreciated.

<comment> dan-robertson The sad thing about tramp is that it requires code to be written agains it. When it was added to emacs, developers had not previously had to think that some buffers might be on remote machines and so their code would not magically work agains it. New code ought to be written with tramp in mind using functions that work remotely but this isn't always done.

With a complex development environment (say compiler, separate autocompletion/jump to definition program, version control, maybe a test runner or other external programs) made out of emacs modes, it only needs one thing to not be made with tramp in mind or with bugs for the whole thing to fall apart in practice.

What I have is ssh access to a powerful development box and a relatively non- powerful desktop (possibly using multiple of these in one day). Everything runs on the dev box and I use emacs over ssh with x forwarding. This works fine (the network latency is low and I'm not super sensitive to it anyway) with some hacks to ssh back to the desktop to play sounds or open links, and a lot better than tramp or sshfs). But I am a bit worried about the future: emacs is becoming more graphically complex in various ways leading to more data needing to be transferred as the X protocol is less suited to it; and X (and in particular X forwarding) is dying for various reasons. Screen sizes are also getting bigger. A trivial update at 1080p takes a few hundred kB, a trivial update at 4K takes close to 1Mb, viewing an image takes a lot more.

The emacs future I'm hoping for isn't so much a better tramp than a fatter emacsclient. That is, instead of using ssh to run emacsclient on a remote box, which causes the server to connect back through ssh to my X server to open a frame, I would run emacsclient locally which would talk (over ssh I guess) to the remote emacs and speak a more efficient protocol to it, and use modern apis to push the pixels onto the screen.

<comment><USER31> Emacs works great in a terminal, all the issues you mentioned disappear ;) (you didn't mention why you really need GUI Emacs) - I use emacs 95% of the time inside remote tmux sessions, you also have true color support is that your thing, what issues do you have?

Also, ITerm lets you open http links.

<comment> dan-robertson Emacs in a terminal misses out on various text properties, on things like client frames (or just multiple frames in general), on images, and on font/size variety. I suppose you may feel like you don't want to ever touch the mouse for some reason but I think it's often useful for scrolling, selecting, copying, and pasting. There are also a bunch of keys which can't be differentiated by a terminal. Finally the gui wastes less space on buffer dividers and the fringe

</comment></comment></comment></comment><comment><USER32> I can't wait for this tooling to advance. It would be amazing to have one IDE that came pre-configured to work with "every" language and work on code bases of any size. With the addition of language servers there has never been a better time to build such tooling.

</comment><comment><USER33> Has anyone found good documentation on now to get Visual Studio Online (Self Hosted) setup?

<comment><USER34> I used this one recently (using code-server). iPad focused but it's all the same: [https://medium.com/@ow/its-finally-possible-to-code-web- apps...](https://medium.com/@ow/its-finally-possible-to-code-web-apps-on-an- ipad-pro-90ad9c1fb59a)

</comment></comment><comment><USER35> BTW folks who haven't tried VS Code SSH remote yet, it's _very_ impressive. For all intents and purposes you get "local" dev experience on a remote box, connected over SSH. Python code complete and cross-referencing is much smarter than what you'd usually get in Vim, and if you want Vim keybindings, you can have that too. I still use Vim for a lot of things, but when I need to work on a large codebase and need better code navigation I find myself reaching for VS Code more and more. Kudos to the team, very impressive product, especially the remote stuff. I've never before seen anything as seamless as this.

<comment><USER36> What are the benefits of having local dev experience on a remote box vs coding locally and sending the code to the remote machine to run it there (e.g. Pycharm remote deployment)?

<comment><USER35> Some companies, like e.g. Google or Facebook do not allow company code to be stored on a laptop, even if it's company laptop. And even if they did have code there it would not be practical, because everything above the kernel is compiled from source and it would take forever without build artifact cache. That, BTW, affects you even if you work with Python, because Python has to pull in a bunch of custom C++ libs to call the various services, and guess what, those are also built from source. Add to that the fact that your laptop is usually a Mac, and you're developing for Linux, and not just any Linux, but a Google/FB flavor thereof, with custom hacks, custom toolchains, etc. The code you work with is mapped to your workstation using a custom filesystem, so you don't store it there either. It's all transparent to you, of course.

So it's not really practical to do "local" development even if that were allowed.

But even if you aren't at a FANG, your company workstation often has the "right" set up and it's much more powerful than a laptop, so if you're dealing with compiled languages it might just be easier to deal with it remotely, as long as the experience is seamless.

<comment><USER36> Ok, but what if you want to run the same code on multiple remote machines (e.g. launch several deep learning simulations)?

<comment><USER35> At Google you run it on Borg. At companies which have non-trivial on-prem compute you'll probably find k8s being used for cluster management nowadays, same idea. Without cluster management you'll have to copy it to the remote machine (and set up deps there)

<comment><USER36> Ok, so it seems like Pycharm is still the only tool which can do that

<comment><USER37> ... you're using pycharm as a cluster management tool? I'm not sure if I'm impressed or horrified :P

<comment><USER36> Not a cluster, just three independent GPU servers. Each one has a remote interpreter configured in Pycharm.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER38> I have such high hopes for remote development, I want this in all my editors/environment.

Semi-OT but: How are spinup times for different VM/host options? Would it be feasible to have a beefy dedicated machine with something on it that spins up a VM/container when I SSH to it, with all my stuff on it?

Would it be feasible to build something like that with any of the major cloud hosting providers? One always-on server accepting the SSH connection and forwarding it to a fresh VM or something?

It seems wasteful to resources allocated 24/7 when they will probably only be used 8/5.

<comment><USER39> Remember that the VM is running on a hypervisor that is on 24x7 regardless of whether there is a virtual machine there.

The beauty of a VM is that it can get migrated around, so those hypervisor hosts can get turned off when load is not there. This is something that is likely happening already.

</comment></comment><comment><USER40> There is already VSCode server:

[https://github.com/cdr/code-server](https://github.com/cdr/code-server)

What was better in Nuclide that is not in this one?

<comment><USER41> I love code server and have been using it for a while. Hope they don't get crushed by Microsoft's offer. Though I guess that was always a risk.

</comment></comment><comment><USER35> So after reading the article, by "partner" they just mean they replaced their internal thing with VS Code? Wow, what a monumental achievement!

<comment><USER37> > by "partner" they just mean they replaced their internal thing with VS Code? > Wow

Incorrect - they built their own remote-editing solution (similar to vscode's built-in edit-over-ssh, but with a load more features), and have been working with Microsoft to get those features upstream.

</comment></comment><comment><USER42> VSCode is the only Electron based app that I freely install.

Just hope that with the jabs from React Native for Windows team does to Electron based apps, that eventually VSCode gets rewritten in React Native instead.

</comment><comment><USER43> Article mentions "remote development" is trend now a days. Is it really so ?. ABAP has been on remote development from day one and its quite an old language.

</comment><comment><USER44> This is good I guess but it's interesting to realize that news about vscode scare me.

It's in such a good place right now. With the exception of multi-monitor support (the only real issue with Electron, in my opinion, but a big one), everything about it is wonderful to the point where I feel that it can almost only get worse from here.

So far the team has been incredible, continuously improving without making it feel bloated and slow so hopefully my fears will continue to be put to shame for years. But yeah.

</comment><comment><USER45> my ML team is currently developing remote environments along these lines. I think I'll cry the day we have build pipelines that can auto-upgrade our conda environments overnight.

</comment><comment><USER46> ok, so Atom is dead

</comment><comment><USER47> Read whole thread so far, haven't seen anyone mention their network conditions. Can people indicate to me if this is just as nice over Pacific ocean sized hops or is this just working nice when you're talking down the road / in the building?

</comment><comment><USER48> > We're making Visual Studio Code the default development environment at > Facebook

IDE choice is a highly personal thing. This sounds awful.

<comment><USER49> It's the _default_, as they say in the article:

> There is no mandated development environment. Some developers use vim. Some > use Emacs. And even more engineers use our internal, unified development > environment called Nuclide.

<comment><USER50> "Default" readily morphs into "only supported". Into "if you use something else and complain to IT when it breaks, IT addresses the issue by replying 'try using an editor from this century'."

<comment><USER37> To my knowledge the "default" editor has changed ~3 times in the past 5 years (fbide, atom, vscode) - and yet I've been using vim this whole time with no problems, and never had anybody suggest that I stop ¯\\_(ツ)_/¯</comment></comment></comment></comment>


Ask HN: What is the best open source software that you use? - <AUTHOR> Ask HN: What is the best open source software that you use? <comment><USER2> Firefox. Runs on all the platforms I use (Linux, Android and Windows). Shares state between all the devices I run it in. Been somewhat the same since Phoenix days for me, the end user.

GNU Core Utils. They've been the pretty much the same since I first learned about those.

</comment><comment><USER3> \- VLC: If it can't play it, it's not a video or audio file.

\- nginx: It's fast and has a lot of features.

\- MAME: Arcade emulator, this project is amazing.

\- ImageMagick convert: Wonderful command line tool for manipulating images

\- ffmpeg: Wonderful command line tool for manipulating videos

</comment><comment><USER4> Linux OS. Near perfect OS for developers.</comment>


Custora online class: An intro to Customer Lifetime Value - <AUTHOR> http://blog.custora.com/2013/01/custora-yc-w11-online-class-an-intro-to-customer-lifetime-value/

<comment><USER2> I'm unfamiliar with Custora but this looks like it might be a worthwhile free learning opportunity from a company that works in the CLV space.

However I find it odd that it's necessary to attend the class from 2-3pm EST with no offline options after the fact. Perhaps they will make it available and just want more people to join the live version, but not everyone works US timezones.

</comment><comment><USER3>
      > Thursday, Jan. 29th, at 2PM EST.

Wait, what? Jan. 29th (yesterday) was Tuesday...

<comment><USER4> Thanks for pointing that out!

We've just updated the post. The correct date is: Thursday, January 31st.</comment></comment>