How a double-free bug in WhatsApp turns to remote code execution - <AUTHOR> https://awakened1712.github.io/hacking/hacking-whatsapp-gif-rce/ <comment><USER2> > WhatsApp parses it with a native library called libpl_droidsonroids_gif.so > to generate the preview of the GIF file.

Another victim of Android not exposing the image codecs to the NDK.

I guess, like many, they decided to use libpl_droidsonroids_gif instead of having to deal with JNI to call BitmapFactory or ImageDecoder.

Because of these kind of exploits codecs have their own hardness processes, [https://source.android.com/devices/media/framework- hardening](https://source.android.com/devices/media/framework-hardening), but naturally it doesn't help when applications bring their own native alternatives along instead.

<comment><USER3> ImageDecoder didn't support animated gif for all APIs they support so you're again looking for reasoning in the wrong bush - exposing codecs wouldn't help.

<comment><USER2> So I should look into careless programming, lack of fuzzing and proper testing practices bush instead?

Because that is what that tone reminds me of.

<comment><USER4> Your proposed solution wouldn't work. You appear to have been unaware and instead of saying "thanks, I didn't realize the limitation existed, that's unfortunate" you instead attack the messenger. All file parsers should be throughly fuzzed, yes. Not sure what tone has to do with it.

<comment><USER2> That would have been indeed my answer if the comment didn't look like a snarky attack.

 _" so you're again looking for reasoning in the wrong bush"_

<comment><USER5> [https://rationalwiki.org/wiki/Tone_argument](https://rationalwiki.org/wiki/Tone_argument)

</comment></comment></comment></comment></comment></comment><comment><USER6> > In Android, a double-free of a memory with size N leads to two subsequent > memory-allocation of size N returning the same address.

I get that freelists are fast and great for small chunk reuse, (I'm guessing that's the implementation that allows double return) but is there no way to protect against double-free here? I wish it crashed instead.

Edit: it does indeed look like a form of a freelist - [https://blog.nsogroup.com/a-tale-of-two-mallocs-on- android-l...](https://blog.nsogroup.com/a-tale-of-two-mallocs-on-android-libc- allocators-part-1-dlmalloc/)

<comment><USER7> At what level are you looking to cause the crash? Some options:

Compiler - insert code and memory usage to show area as free/not-free and check on malloc/free. Data has to be recorded at runtime because the type system does not provide enough information to be sure. Static analysis can only guess with C.

OS - Every malloc would need to be in a separate page

Libc - could do something similar to compiler

They all come with overhead in performance and/or memory usage, unless you change the technology stack in some way. Garbage collection is one approach. Adding extra type information to make it clear from static analysis (so you get something like Rust) is another. Or, some hardware support that gives more granular permissions.

<comment><USER8> Perhaps malloc() could allocate 1 byte extra at the start of the allocated block with some magic number written to it and free() could assert that the number is correct and change the number to mark the block as freed.

<comment><USER9> Problems: double free might still happen, except now some innocent memory block can be corrupted as well, which just happened to have the magic value in that address.

All memory allocations are now misaligned, decreasing performance. On some platforms misaligned access causes a bus error exception.

The marker would generally need to be at least 8 bytes. This would alleviate the problems, but also cause pretty significant overhead.

<comment><USER10> On the other hand, the chances of an innocent memory block having a random 8-byte magic value is vanishingly small, so that would work even better. If free() took only 1ns to run and you called it 2^64 times, that would take >500 years.

</comment></comment></comment></comment></comment><comment><USER11> At first i was wondering how one can get RCE out of double-free and then author proceed to drop a bomb - android would reliably return same adress to the next two allocations of same size as freed memory. Android behaviour here is simply unacceptable. One would expect (yeah) memory managment bugs from user space applications, but return same memory from a default allocator twice because of double-free is a terrible peculiarity, undefined behavour or not.

<comment><USER12> How do other malloc implementations avoid this? It seems natural if what "free" does involves adding the pointer to some free list. Obviously you wouldn't want to scan the whole free list every time looking for duplicates - is there another way to avoid this behavior?

<comment><USER13> Bitmaps don't require scanning.

<comment><USER14> They do, you'd just scanning a smaller thing.

<comment><USER13> What are you scanning the bitmap looking for? Why not just index into it and look at the relevant bit?

</comment></comment></comment></comment></comment><comment><USER15> _Affected versions The exploit works well until WhatsApp version 2.19.230. The vulnerability is official patched in WhatsApp version 2.19.244

The exploit works well for Android 8.1 and 9.0, but does not work for Android 8.0 and below. In the older Android versions, double-free could still be triggered. However, because of the malloc calls by the system after the double-free, the app just crashes before reaching to the point that we could control the PC register._

</comment><comment><USER16> Even as someone who hasn't had to deal with memory allocation since college CS classes many years ago, I found this explainer to be easy to follow and enlightening. Well done!

tangent: Your "About" link goes to a 404: [https://awakened1712.github.io/about/](https://awakened1712.github.io/about/)

<comment> jor-el The author of the blog post is my friend, I will ask him to fix it. The funny thing is, he don't even knows about HN at all and he has no idea that his post is trending. :P

</comment></comment><comment><USER17> Somewhat related question: Does anyone know when the fixes for CVE-2019-11927 will be released for iOS? The advisory[0] says:

>This issue affects WhatsApp for iOS before version v2.19.100 and WhatsApp for Android before version 2.19.243.

But the latest version I see on the App Store is 2.19.92 (iPhone S3, iOS 13). The AppStore website says the same[1].

The Android version[2] seems updated (2.19.271)

[0]: [https://www.facebook.com/security/advisories/cve-2019-11927](https://www.facebook.com/security/advisories/cve-2019-11927)

[1]: [https://apps.apple.com/in/app/whatsapp- messenger/id310633997](https://apps.apple.com/in/app/whatsapp- messenger/id310633997)

[2]: [https://www.whatsapp.com/android/](https://www.whatsapp.com/android/)

<comment><USER18> Whenever Apple finishes the app review, I suppose. It's a bit of a shame that people are running vulnerable versions of WhatsApp because Apple is taking its time.

<comment><USER19> There is an expedited review process for this kind of thing. It's impossible to tell who is to blame here. It could be that they abused the expedited review process before and are excluded, or they never requested it, or perhaps they were late in sending in the new version. Or Apple found a problem in the new version, or they were slow.

</comment></comment></comment><comment><USER20> Can someone explain the RCE part? I understand the double free bug but not the exploit part.

<comment><USER21> The double-free bug means that a double-free of a chunk of size X might lead to subsequent allocs of that size X to return the same pointer.

The lib in question parses the GIF twice.

In the first run, it allocs an internal info struct of size X, then you trigger the double-free so this info struct is freed twice.

In the second run, it allocs the same internal info struct of size X and gets a ptr Y. Then, by crafting the GIF so one of the frames to be decoded is also of the size X, it will alloc intermediary space for this frame, but due to it being the same size, you'll get the _same_ ptr Y returned, and the frame gets unpacked over the info structure...

So, you get your user-provided frame data placed in the internal info struct. Luckily for the exploiter, there are function pointers inside the info struct which are called a bit later.

So you can provide a memory address to jump to by putting it in the right place in the magic frame. You can't also put executable code in the magic frame due to restrictions, but you can place shell commands in the frame and shuffle registers by using already available executable chunks by selecting the right jump address (this is explained well in the post I think).

<comment><USER22> Awesome explanation! Thank you! Does this mean also that function pointers inherently weaken security (by providing a means of code execution given other faults)?

<comment><USER21> They are a very common design-pattern in traditional C, as you kind of emulate object-oriented virtual function overloading by using them in structs. I don't think it's realistic to avoid them just by principle..

As in network server hardening, you can usually start by following where user- provided data goes, and harden its path.

In this case however the first problem was a clandestine bug (the double free in some cases), probably induced by the programmer trying to be a bit too clever with the management of these structs (if you're not threaded you could simply have a single static declaration for this info struct and forget the malloc/freeing, or at least malloc it just once upon each thread init, haven't looked at this code..).

Generally keeping track of all malloc/free pairs is tricky and you can go a long way by trying to simplify your logic, I mean even if you don't get exploited like this, you might simply crash sometime or leak memory or in general behave badly.

There are good reasons why there exist all kinds of memory-managed languages :)

</comment></comment></comment></comment><comment><USER23> If I understand this correctly, the underlying problem is in GIFLib, which calls _reallocatearray_ , a wrapper around _realloc_ that guards against overflows when computing the size of the memory buffer to reallocate from the number of items and item size.

However, reading [https://github.com/aseprite/giflib/blob/master/lib/openbsd-r...](https://github.com/aseprite/giflib/blob/master/lib/openbsd- reallocarray.c), I don't see how that could lead to a double-free, unless _realloc_ double-frees, or unless a different _reallocatearray_ gets linked in.

Also, that comment on how _realloc_ isn't portable feels scary. I can see that introduce subtle bugs in libraries used on a different platform from where it is developed.

Hence, I think one should forbid the use of raw 'realloc' in portable code.

<comment><USER24> Most likely this is getting linked [https://code.woboq.org/userspace/glibc/malloc/reallocarray.c...](https://code.woboq.org/userspace/glibc/malloc/reallocarray.c.html)

realloc on linux frees the ptr [https://linux.die.net/man/3/realloc](https://linux.die.net/man/3/realloc)

<comment><USER25> I thought Adroid had its own BSDish libc, not glibc? (But the implementation is likely mostly-identical anyway.)

<comment><USER14> Android uses its own implementation, called Bionic: [https://en.wikipedia.org/wiki/Bionic_(software)](https://en.wikipedia.org/wiki/Bionic_\(software\))

</comment></comment></comment></comment><comment><USER26> The post is impressive with the demo and explanations

</comment><comment><USER27> That was surprisingly easy to follow. I always thought these exploits were quite a bit more magical, but it seems pretty straightforward. Scary.

</comment><comment><USER28>
      int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
      int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
      const uint_fast32_t newRasterSize =
              gifFilePtr->Image.Width * gifFilePtr->Image.Height;
      if (newRasterSize > info->rasterSize || widthOverflow > 0 ||
          heightOverflow > 0) {
      ...
          info->rasterSize = newRasterSize;

OT, but isn't that test redundant? For rasterSize = height x width to increase, at least one of height or width must increase, and so anytime the first term of the || is true, at least one of the other terms will also be true, so the first term is redundant. It seems it could be simply this:

      int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
      int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
      if (widthOverflow > 0 || heightOverflow > 0) {

<comment><USER14> > rasterSize = height x width to increase, at least one of height or width > must increase

Not if they're negative.

<comment><USER28> height and width are of type GifWord, which is typedefed to uint_fast16_t.

</comment></comment></comment><comment><USER29> Does anyone know if such behavior is possible on iOS as well?

And maybe if Signal has a similar issue? I'm not sure if they use the same GIF decoding library on Android? And iOS?

If someone doesn't know off the top of their head maybe they can point me to some docs.

</comment><comment><USER30> Is there a legitimate reason for the Android sandbox to allow calls to `system()`?

<comment><USER31> I suppose in case you ship some prebuilt executable to do stuff? E.g. ffmpeg. Just a guess, though.

<comment><USER32> IMO execve with its already-parsed-argv is a much safer way to invoke another program. You don't need the shell to interpret the boundaries of command line arguments, it invites trouble.

<comment><USER31> Doesn't execve() end in the same syscall as system()? Not as comfortable for exploitation, but maybe still feasible? (Embedded systems I take a look at usually don't have an OS with either of the two, so I honestly don't know how the implementations look like).

<comment><USER32> system() basically does a fork and an execve of sh -c 'arg passed to system()', then waitpid to block on the result. execve is a syscall, system is a libc function.

</comment></comment></comment></comment></comment><comment><USER33> The GIF format is over 30 years old. One would think that decoding them was a problem solved long ago, and that decoding libraries would have all the bugs found and fixed by now.

As someone who has also written a GIF decoder, more for learning purposes than anything, I checked what mine would do with that GIF: it does reallocate twice, but since the first time already nulls the buffer pointer, it doesn't actually double-free (since free()'ing a NULL pointer is defined by the standard to have no effect.)

</comment><comment><USER34> The demo clip has been disabled by google drive due to too many plays. Does anyone have a copy/backup he'd be willing to share?

</comment><comment><USER35> I recall someone once designed an image format which stored (image width - 1), and added 1 to the image dimensions while decoding. That eliminates an edge case, but no clue what would happen with MAX_INT image size...

</comment><comment><USER36> _To prevent falling victim to this attack, it is highly recommended that all WhatsApp users update the app to the latest version._

Do I have to do this myself? Doesn't update itself?

<comment><USER37> It usually does, but you can disable updates in Play Store.

> The exploit works well until WhatsApp version 2.19.230. The vulnerability is > official patched in WhatsApp version 2.19.244

</comment></comment><comment><USER38> This is a very easy to follow explanation, even for those not familiar with these types of attacks. (me)

</comment><comment><USER39> Assuming version numbers of acceptable, he should have sold this to Zerodium.

</comment><comment><USER40> Exactly how terrified should I be right now?

</comment><comment><USER41> How does one go about finding stuff like this? Also how much time did it take to research and develop the full exploit? Sounds like a lot of work, especially if you're not getting paid.

<comment><USER31> I think the author can answer this better, but I'd guess it's mixture of hobby, curiosity and luck (or rather good intuition where $stuff breaks). [edit] Can be anything from a Saturday if it is the first thing you poke into (and easily grasp the call/stack structure) to a few weekends trying different vectors (or figuring out how to layout your fake memory).[/edit]

At least from my experience breaking stuff for security lectures/CTFs.

This is probably also a good way to make a name in the security industry (RCE against WA on CV should look pretty neat). [edit]So not getting paid is relative (and again, if happens out of curiosity - not a huge difference spending a weekend binging some anime or breaking stuff).[/edit]

</comment></comment><comment><USER42> > 24 minute read

A simple (number_of_words)/(200WPM) isn't a great metric when words from code snippets are also counted.

<comment><USER43> What would you suggest instead? We still read words from code snippets.

<comment><USER42> According to that metric you spend 1 minute to read this --

        notroot@osboxes:~/Desktop/gif$ ./exploit
        buffer = 0x7ffc586cd8b0 size = 266
        47 49 46 38 39 61 18 00 0A 00 F2 00 00 66 CC CC
        FF FF FF 00 00 00 33 99 66 99 FF CC 00 00 00 00
        00 00 00 00 00 2C 00 00 00 00 08 00 15 00 00 08
        9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 84 9C 09 B0
        C5 07 00 00 00 74 DE E4 11 F3 06 0F 08 37 63 40
        C4 C8 21 C3 45 0C 1B 38 5C C8 70 71 43 06 08 1A
        34 68 D0 00 C1 07 C4 1C 34 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 54 12 7C C0 C5 07 00 00 00 EE FF FF 2C 00 00
        00 00 1C 0F 00 00 00 00 2C 00 00 00 00 1C 0F 00
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00
        18 00 0A 00 0F 00 01 00 00 3B</comment></comment></comment>


Where can I meet a cool and smart co-founder in the SF Bay area? - <AUTHOR>

I have had a couple ideas for a few months that I want to start hacking on. I have some coding skills but I would need someone with hax0r skills to help me make this happen. Where is a good place to meet parties interested in forging powerful alliances for good? <comment><USER2> When you ask questions like this, you _really_ need to state where exactly you live. If you don't, all answers are going to be vague generalities since we can't say "Stop by your local Founder's Exchange". However, if you said, "I'm in Pittsburgh and looking to meet a cool and smart co-founder," then I know a dozen different places to meet people, and there's probably a bunch of people on HN from your town too who might grab a beer and introduce you to people.

<comment><USER3> I'm in Pittsburgh and looking to meet a cool and smart co-founder. Well, sort of. :)

Where are you best places in the Burgh to find tech entrepreneurs?

</comment></comment><comment><USER4> Find places that coders actually hang out and participate. There are too many events where idea guys scavenge for the rockstar developer who will buy into the vision. "All I need is someone to do X,Y, and Z and this thing will be huge! I can't pay you and you'll only get 20% of the company."

Don't be that guy.

Go to actual hacking events. Show people what _you_ have actually done and are trying to accomplish. They'll respect you much more for it and they'll let their guard down. You have to earn their trust. There are simply too many people out there looking to take advantage of coders to put together their "revolutionary" idea.

Edit: Specifically, look for HN meetups and browse Meetup.com for language specific events.

</comment><comment><USER5> Check out your local startup scene. Go to every event and talk to other like minded individuals. Going to conferences can also be a good way to meeting people.

</comment><comment><USER6> <http://www.hackersandfounders.com/>

<http://www.meetup.com/Co-Founders-Wanted-Meetup/>

<http://wiki.hackerdojo.com/> \-- Great volunteer run CoWorking space in Mountain View. Hope this helps.

</comment><comment><AUTHOR> I straight edited that post!

G-YEAH!</comment>


Cannonball Record Broken: 25 Hours, 39 Minutes from NYC to LA - <AUTHOR> https://www.roadandtrack.com/car-culture/a33656042/cannonball-record-broken-25-hours-39-minutes-from-nyc-to-la/ <comment><USER2> Yeah, sorry, 175mph on the freeway is not something I'm okay with. For other cars on the road going 65mph that's a relative speed of 110mph. I'd like to see them in jail.

<comment><USER3> > 175mph on the freeway

That's also 175mph driven by a person who as a professional wouldn't legally be allowed to drive that long in many places (even if they're swapping, that's 12.7h of driving each). It's not a good state to be driving even at normal speeds.

> I'd like to see them in jail.

Given the drivers publish their names and various proofs... why aren't more of them arrested?

<comment><USER4> The new record holders wait until after statutes of limitations have elapsed in the various jurisdictions they traveled through.

<comment><USER3> Is there really no cooperation in enforcement at interstate level? I thought the police cars stopping at the state line was an 80s movie trope.

Also, the way I understand the statute of limitations in the US is that the time limit only applies to getting the charged filed. If the person is known (like in this case) they could be charged right now.

<comment><USER5> Each state is its own sovereign, state officials in one state is not recognized as such in another state (it doesn't mean they can't work together, they can be deputized or whatever the state laws say about another state officials, it just means by default, they can't be involved in another state's affairs and if they do, they'd be breaking the laws themselves even with good intentions).

Only the federal government can be involved in the interstate affairs but the constitution itself does not allow the federal government to be involved in police matters, only the states.

In addition, if someone breaks the law and cross the state line, the federal agencies can only be involved if the crime was being committed at the federal level. If no federal law exists, then there's nothing they can do.

Status of limitations is different in each state, it's not federal level. So, in some state, it can be from when the crime was committed. You can get the details here: [https://www.lawinfo.com/resources/criminal- defense/criminal-...](https://www.lawinfo.com/resources/criminal- defense/criminal-statute-limitations-time-limits.html)

</comment></comment></comment></comment></comment><comment><USER6> As far as I can tell, this is an illegal race that puts innocent peoples lives at unnecessary risk. Nothing to glorify IMO.

<comment><USER7> Pull the stick out your ass, this is America.

<comment><USER8> I don't understand this selfish attitude. 'Being America' justifies putting innocent lives at risk? If they want to risk their own lives on a closed course, they are free to make that decision for themselves, but (America being America) freedom works both ways.

</comment></comment></comment><comment><USER9> It's interesting that they took the Audi and made a few small mods to make it look like it's a ford police interceptor from the front.

Is there a possibility this would fool other police? Or just people to get out of their way.

<comment><USER10> Both. I think it lends just enough plausible deniability if they did get stopped by police, but provides a certain amount of cover by creating some hesitation to identify it as either a private vehicle or a cop car (i.e., creating uncertainty) and prevent stoppage and other slowdowns. A friend of mine used to drive a Ford Crown Vic with a whip antenna on the rear that was actually an unmarked ex-cop car. When he would get in the passing lane, he'd never get blocked—US drivers recognize white or dark blue Ford Crown Vics and Taurus models as common police vehicles and usually change to the right (non- passing) lane immediately.

</comment></comment><comment><USER11> I wonder if the records set now during the reduced traffic COVID era will be able to be beaten once regular (or accelerated traffic begins due to reduced public transit use) resumes.

If we defund the police completely then maybe new records will be set (I'm being facetious of course).

Alex Roy has a very interesting talk he gave at Google 12 years ago (Wow!) on the subject of Cannonball runs. I highly recommend it: [https://youtu.be/IQpg0tvap4A](https://youtu.be/IQpg0tvap4A)

</comment><comment><USER12> I've heard of this happening again and again lately because of the lack of traffic due to Covid.

<comment><USER13> That's what it says in the article as well

</comment></comment><comment><USER14> Has anyone seen anything about attempts to charge/prosecute people who attempt this? I haven't seen any reporting on it, but it seems like it would make for a good long-form article.

</comment><comment><USER15> Three significant threads in the last year:

[https://news.ycombinator.com/item?id=23206216](https://news.ycombinator.com/item?id=23206216)

[https://news.ycombinator.com/item?id=22842110](https://news.ycombinator.com/item?id=22842110)

[https://news.ycombinator.com/item?id=21701917](https://news.ycombinator.com/item?id=21701917)

</comment><comment><USER16> I'd be curious to hear more about the scouting system they have. The fact they can make it so far with such a big target on themselves (their speed) and not get stopped once does not bode well for officers trying to stop trafficking of any kind.

<comment><USER17> Previous record holders have used people in planes to scout for police. I'd imagine they did something similar. GPS systems that let people report speed traps probably help a lot too.

</comment></comment><comment><USER18> Here's a great video from 2 days ago explaining the recent record attempts during COVID

[https://youtu.be/GOWn1WSYhVQ](https://youtu.be/GOWn1WSYhVQ)

</comment><comment><USER19> While I do not approve of the cannonball run in anyway due to the horrendous disregard for others safety, I am a little impressed at the speed they achieve and the optimization they do to achieve this.

Wish it was more an opennly organized even with safety regulation, safety provisions and road closures rather than acting like road thieves, ignoring the rules for glory.

</comment><comment><USER20> Arrest these people.

</comment><comment><USER21> Did they put a GoPro on the front and release a time lapse video of the trip?</comment>


MacOS native sudo with Touch ID - <AUTHOR> https://www.imore.com/how-use-sudo-your-mac-touch-id <comment><USER2> I don't understand the purpose of step 12:

12\. Click on the Lock icon in the bottom right corner [of the Finder Info window for /etc/pam.d/sudo].</comment>


Map of all Google data center locations - <AUTHOR> http://royal.pingdom.com/2008/04/11/map-of-all-google-data-center-locations/ <comment><USER2> North America and Europe are lucky to have so many Google data centers. India, Africa, and Australia have none. Russia and South America each have 1. And China has only 2.

<comment><USER3> I don't think luck has anything to do with it :/ Probably more a business decision based on many factors.

<comment><USER2> Come on. It would be pretty unlucky if you had to rely on a server 8000 miles away.

<comment><USER4> Unfortunate? Perhaps. Unlucky? No.

</comment></comment></comment></comment><comment><USER5> I find it fascinating that a company who is generally pretty open and transparent about most things(outside of adsense and search algorithms) is so secretive about something as trivial as data centers. Probably want to avoid terrorism or corporate espionage I'd wager.

<comment><USER6> Secrecy, shell corporations in particular, save them a lot of money before a data center is operational.

Once a data center is operational, it harbors significant trade secrets in terms of efficiency. Google is so frequently open because they stand to benefit from it. They don't benefit by lowering the cost of data centers for competitors, so it makes perfect sense for them to be secretive. They are secretive by default, and open when they reasonably believe they stand to benefit from it.

<comment><USER7> Google recently published a bunch of specs on their server fleet, touting energy efficiency. The designs were somewhat old, but certainly its not withholding information solely to keep data centers expensive.

</comment></comment></comment><comment><USER8> If you was wondering about where Google keep the Gmail data, the answer is in this: <http://www.geekculture.com/joyoftech/joyarchives/669.html> :)

</comment><comment><USER9> So that's where my data is.</comment>


Joe the office mate - <AUTHOR> https://github.com/lukego/blog/issues/32 <comment><USER2> > Joe wrote amazingly simple programs and he did so in a peculiar way. First > he wrote down the program any old way just to get it out of his head. Then > once it worked he would then immediately create a new directory program2 and > write it again. He would repeat this process five or six times (program5, > program6, ...) and each time he would understand the problem a little better > and sense which parts of the program were essential enough to re-type. He > thought this was the most natural thing in the world: of course you throw > away the first few implementations, you didn't understand the problem when > you wrote those!

I thought I was the only one who did that.

<comment><USER3> Good code isn't written, it's re-written.

It is scary when something "works the first time", because it probably doesn't.

<comment><USER4> There's different ways to re-write though. I tend to assume I couldn't come up with the right design if I tried. So I will leave my naive implementation in place until USE shows me a bug or a new feature and then that IMPLEMENTATION shows me where my architecture is clunky, and how to fix the original thing.

Over time, everything important gets a full rewrite or four, but only piece by piece.

Generally I assume in an implementation vacuum the long term spec isn't even well defined so I would never just rewrite something immediately.

Sometimes if a module proves difficult to amend I will start over from scratch. But usually by then I have tests and use cases I am confident in.

I love the idea of people doing these rewrite series though... not trying to be evangelical. Just describing a different kind of rewrite.

<comment><USER3> Back when rocks were young, one of my hobbies was writing assemblers because the ones available were generally terrible. My first few attempts were pretty bad. The fifth or sixth assembler that I wrote was commercial quality; it was fast, had macros, supported most of the different microprocessors that our platform had, and became widely used. It's been forked and is still in active development today, 35 years later. I'm still proud of it.

But those first efforts were indeed awful, and those were preceded by even more false starts; it took 2-3 years of iteration [not full time!] to get to something that was good.

(Simple assemblers are, well, simple. But if you're in an industry where it's common to write a _ton_ of assembly -- like the early gaming industry was -- you start gauging assemblers by the creature comforts they provide, such as a decent macro capability, cross-reference and listing support, performance, and support for chip manufacturer assembly syntax).

<comment><USER4> I've been trying to build a web-based IDE for more than 10 years. The first one was a PHP script that had write access to change the files in its own directory.

I've started over completely, at least 6 times, trying entire new languages, entire new feature sets, entire new hosting paradigms.

Each time I try again, I get closer to something professional. Each time the hacks get a little too messy and realize I'm out of my depth.

But lately less and less changes with each rewrite. I am able to pull entire chunks of code in from a previous iteration and have them work well, with little modification.

The process of writing software that's beyond one's ability is fascinating.

</comment></comment></comment></comment></comment><comment><USER5> A little selfish of me, but I'm very sad I never got to meet him. Programming is in a rather unique state where most of the foundational people are kept alive in living memory. There's people who can recount working with Dijkstra, or Dennis Richie or Joe Armstrong. Heck, there's probably some people who can remember Von Neumann (Peter Lax?). I really hope we can keep these memories alive. There's nothing really comparable for other fields. Nobody alive today can remember working with Gauss or Riemann.

This may be a gross exaggeration, but I believe we'll look back on programming during the mid to late 20th century like we do for physics in the early to mid 20th century. We'll marvel at the amount of talent alive at the same time.

<comment><USER6> TIL Dijkstra died in 2002. I don't know why, but I always thought he was much older than that!

<comment><USER7> Probably because he's cited with the frequency, authority, and timelessness of any major philosopher.

<comment><USER8> It's amusing to note that Dijkstra's most famous quote is something he never wrote.

Dijkstra submitted a letter to the editor of the Communications of the Association for Computing Machinery (CACM) that he titled "A Case Against the Goto Statement".

Niklaus Wirth was editor of CACM at the time, and he changed the title to the infamous "Go To Statement Considered Harmful".

[https://en.wikipedia.org/wiki/Considered_harmful](https://en.wikipedia.org/wiki/Considered_harmful)

Here's the story in Dijkstra's own hand (scroll to the last page of the PDF):

[http://www.cs.utexas.edu/users/EWD/ewd13xx/EWD1308.PDF](http://www.cs.utexas.edu/users/EWD/ewd13xx/EWD1308.PDF)

This is a good reminder that when you read an article with a clickbaity title, don't blame the author, blame the editor.

</comment></comment></comment></comment><comment><USER9> One thing I've thought about a lot when people like Joe pass away is that it's somewhat sad that they never are able to receive all the appreciation people give after they are gone.

In a parallel culture timeline it is easy to imagine the announcement of someone soon to die (when possible of course), and all these kind words of appreciation from strangers being passed on to the one dying. On the other hand, I guess that the time is better spent with close family, but regardless, I hope that he somewhat understood his importance to so many people all over the world.

<comment><USER10> This seemed to happen with Gord Downie of the Canadian band The Tragically Hip. He was given a diagnosis of terminal brain cancer, but had the energy for a cross-Canada tour a few months later. He was much loved across the country, and though the band's arena-sellout days were mostly behind them, they blew the doors off with sold out shows at the country's top venues, culminating in a nationally-televised concert. I've always marveled that he got the chance to have this touching denouement to his career, and I'm glad he did. And I'm very thankful that I managed to see them in Vancouver.

<comment><USER11> Similar thing happened to Wilko Johnson, guitar player in Dr. Feelgood and actor in Game of Thrones. But in the end he surprisingly ended up surviving his terminal cancer, thanks to his doctors.

[https://en.wikipedia.org/wiki/Wilko_Johnson#Cancer](https://en.wikipedia.org/wiki/Wilko_Johnson#Cancer)

</comment></comment></comment><comment><USER12> I can't say I've ever seen someone use an issue tracker as a blog before, but it does make sorting the posts dead easy.

<comment><USER13> I wish he would of called it an e-zine. Then "Issues" would match the use case... Bring e-zines back dang it! _raises wrinkly millennial fist_

<comment><USER13> A fun side effect of his approach is you can see people who forked off the idea, there's at least two people blogging using this format as well:

[https://github.com/lukego/blog/network/members](https://github.com/lukego/blog/network/members)

</comment></comment></comment><comment><USER14> I hope when I die I'll be worthy enough to ascend to whatever is the programmer Valhalla and I'll see Joe there, amongst the other greats.

I have never written a line of Enlang, but as I've seen the advantages of loading binaries at run-time as swappable components I get an inkling of the beauty of the idea. It's not near so easy in C# as it appears to be in Erlang.

Also, I nominate the name of programmer Valhalla to be called "Greenfield."

</comment><comment><USER15> If anyone related to Joe has access to his home directory and knows someone managing his estate who could grant a copyright release, I'd be interested in adding it to the Internet Archive (out of respect). Email in profile.

<comment><USER16> I'd be very cautious as to what from my home directory I'd be ok with going online, even after I died. Much of the material might still have relevance to others, and they might not want it published…

<comment><USER17> > _Joe 's home directory was a treasure trove of new and old ideas…This was > all openly shared over NFS and exciting to explore._

Agreed but I suspect that this home directory as exposed on the NFS might be appropriate.

</comment></comment></comment><comment><USER18> Sounds a lot like the stories I've heard about other software legends, or any kind of legends really. Sadly there aren't many places left with enough margin for creativity, it needs space and comes without guarantees.

</comment><comment><USER19> I've only seen glimpses of this great man from his conference talks on YouTube, but he came across as a very intelligent, relatable and humble person.

It's a great loss.

</comment><comment><USER20> I can't believe he died. What a loss.</comment>


NYC Police union slashes number of 'get out of jail free' cards issued - <AUTHOR> https://nypost.com/2018/01/21/police-union-slashes-number-of-get-out-of-jail-free-cards-issued/ <comment><USER2> _" The city's police-officers union is cracking down on the number of "get out of jail free" courtesy cards distributed to cops to give to family and friends.

Patrolmen's Benevolent Association boss Pat Lynch slashed the maximum number of cards that could be issued to current cops from 30 to 20, and to retirees from 20 to 10, sources told The Post."_

I think the limit on the number of these cards a cop should have should be zero. Any cop who gives preferential treatment to a family member of a cop (or another cop, or a politician, etc.) should be prosecuted for corruption. This practice really undermines citizens' trust in the police (and in the city government, which apparently tolerates it).

</comment><comment><USER3> Couldn't tell whether the entire premise of the article is satire. :(</comment>


Ask HN: How to earn $0.5 per hour 24/12 hours? - <AUTHOR> Jokes apart. How can I earn 0.5 dollar per hour any SaaS PaaS idea? I can invest $2000 for this. Please <comment> jerome-jh Jokes apart? You're talking of a >200% annualized ROI. My advice is to learn how to count: that's always profitable in some way.</comment>


Max Howell (Swift package manager engineer, creator of homebrew) leaves Apple - <AUTHOR> https://mobile.twitter.com/mxcl/status/763957931616325632 <comment><AUTHOR> Remember all the shit Google was given for _not_ hiring him? Well, it turns out he doesn't like working for big companies anyway.

[https://news.ycombinator.com/item?id=9695102](https://news.ycombinator.com/item?id=9695102)</comment>


Show HN: Download anything from WWW as JSON - <AUTHOR> https://crawlcrawler.com/ <comment><AUTHOR> Hi HN! A Common Crawl crawl isn't the web, we all know that but it's a start, isn't it? What if you could expand a full-text index from one of those crawls to also include all of your favorite sites? What if you could download that as JSON? What if you could decide on the update frequency? What if... there were no cookies?

I'm running out of what-ifs here. Do you wanna try a search, just one will do, and then tell me: what else do you need? I really wish I knew.

Edit: I'm Marcus, BTW.</comment>


Gumroad Stories: Sacha Greif - <AUTHOR> http://blog.gumroad.com/post/24981408485/gumroad-stories-sacha-greif

<comment><USER2> If you're interested in the topic of digital delivery services, I also wrote an article comparing a couple of them:

[http://www.smashingmagazine.com/2012/03/29/selling- digital-g...](http://www.smashingmagazine.com/2012/03/29/selling-digital- goods-online-e-commerce-services-compared/)</comment>


JPMorgan Chase raises its minimum wage by 20% - <AUTHOR> https://www.theguardian.com/business/2016/jul/12/jpmorgan-chase-raises-its-minimum-wage-by-20 <comment><USER2> It should be noted that JPMC has been reducing headcount every quarter since 2012, with an active initiative to further reduce the headcount of the tellers and divisions with technology. Make no mistake JPMC's total compensation paid taking into consideration the reduction in the number of employees will be lower after the "raise" for those who remain. [http://www.wsj.com/articles/j-p-morgan-expected-to-lay- off-m...](http://www.wsj.com/articles/j-p-morgan-expected-to-lay-off-more- than-5-000-by-next-year-1432834029)</comment>


Visionary Mathematician Vladimir Voevodsky Dies at 51 - <AUTHOR> https://www.quantamagazine.org/visionary-mathematician-vladimir-voevodsky-dies-at-51-20171011 <comment><AUTHOR> In previous threads, there was speculation about the cause of death. The article states that according to his former wife the cause of death was an aneurism.</comment>


Ask HN: Can a successful company founder still hack? - <AUTHOR>

Just out of curiosity, if one's company becomes as successful as, say, facebook, does he become too involved running the company to do actual coding? If so then are his hacking days over? If so, again, then was he really a hacker in the first place, someone who derives his joy from, or lives for, solving technical challenges. <comment><USER2> Not that I have been remotely in the league of Facebook or a billion dollar company as a founder (I have been an executive at some). I do have 3 exits under my belt. 2 where to large travel companies.

That being said, I never felt comfortable getting too far away from development. I always felt that loosing my deep understanding of development would put me at a competitive disadvantage as a technical visionary. Even as my role changed within these organizations, I always found some time to design and write solutions. While it was not all day every day I did get one or two days during the week to do so. I don't know if I am A-Typical or not but I do represent the fact that it can be done if one want's to.</comment>


IPad Developers Code Their Apps in the Dark - <AUTHOR> http://www.wired.com/gadgetlab/2010/03/ipad-developers-in-the-dark/ <comment><USER2> Did anybody here get the iPad email? I didn't, and I'm wondering if that means only "select" devs will be allowed to get on the iPad on day one.

Still though, I'm going to code like crazy to get my game ready to go, just in case. I've already mostly got it ported, so a week should be plenty of time.

<comment><USER3> I got the email a few hours ago, but there's no way I'm going to get anything in there in the next few days.

<comment><USER4> I got the email as well. Right now I'm racking my brain trying to think of a minimum viable product that still takes advantage of the unique advantages of the iPad. Then I'm gonna try like hell to crank it out in the next 7 days to see if I can't have it available at launch.

<comment><USER5> Make a whoopee cushion app.</comment></comment></comment></comment>


Dynamic_cast(C)++ - <AUTHOR> https://www.teamten.com/lawrence/writings/dynamic_cast_std_integer_c.html <comment><USER2> I actually think the old keyword is quite clever. I'm sure it could make sense in some places.</comment>


The rechargeable nanowire battery that makes nanobots possible - <AUTHOR> http://www.extremetech.com/extreme/91544-the-rechargable-lithium-ion-nanowire-battery-that-makes-nanobots-possible

<comment><USER2> This submission is quoting this page: [http://www.physorg.com/news/2011-07-scientists-battery- nanow...](http://www.physorg.com/news/2011-07-scientists-battery- nanowire.html)

That is, in turn, referencing this page: <http://pubs.acs.org/doi/abs/10.1021/nl2017042>

That, in its turn, refers you here: <http://pubs.acs.org/doi/full/10.1021/nl2017042>

Which is paywalled. 8-(

Make do with whichever summary you choose.

And yes, they've built a battery, and interestingly, they've got it technically correct.

Technically, an AA "battery" isn't a battery - it's a cell. It's not a "battery" until you have a whole - well - _battery_ of them.

This has gained me points in trivia quizzes, but is so far outside "normal" usage that if you try to correct people about it you get even worse ostracization than correcting people about "less" and "fewer."</comment>


Bitcoin drops 50% overnight as China's Biggest BTC exchange stops Yuan deposits - <AUTHOR> http://techcrunch.com/2013/12/18/bitcoin-drops-50-overnight-as-chinas-biggest-btc-exchange-stops-deposits-in-chinese-yuan/ <comment><USER2> The /r/bitcoin subreddit has a suicide hotline disclaimer stickied to the top. Yikes.

[http://www.reddit.com/r/Bitcoin/comments/1t5ofu/please_stick...](http://www.reddit.com/r/Bitcoin/comments/1t5ofu/please_sticky_usa_suicide_hotline_1800273talk/)

<comment><USER3> Yowza. I guess it's true that the majority of people investing in Bitcoin saw it as more of an quick-flip play than a long-term value investment.

<comment><USER4> That sub is about as volatile as the currency itself. Though some people mentioned buying bitcoin on credit and that could put you in a pretty bad situation.

<comment><USER5> No worse than buying material goods on credit, which a huge number of people do. If anything it's less bad, as at least with a gamble you might get the money back to pay off the credit. Of course, whether you value a TV or a chance of getting rich more is subjective.

edit: I stand corrected, good points below. But it is still very possible to use credit to speculate without it being a huge problem, e.g. if you could afford $x over 3 months but think you need to spend it all now to see the benefits then the slight interest on the credit just becomes part of your risk, but doesn't mean you'd be in trouble if it doesn't work out, other than losing money which is a risk regardless.

<comment><USER4> Most material goods are bought with the knowledge that their value will depreciate significantly and quickly. Investments are not seen that way so people will, foolishly, bet money they don't have and a good indicator of that is putting it on plastic.

</comment></comment></comment></comment></comment><comment><USER6> In other news the United States Dollar has almost doubled in value in a single day: [http://www.coinion.com/2013/12/07/united-states-dollar- almos...](http://www.coinion.com/2013/12/07/united-states-dollar-almost- doubles-in-value-in-a-single-day/)

<comment><USER7> Ha! The story is of course a jest, but there's no reason why you can't look at it that way. A cup is either half empty or half full.

<comment><USER8> There are as many reasons as there are other things in the world besides bitcoin why you can't look at it that way.

$/yuan, $/euro, $/big mac, $/potted plants, $/dinner at applebees...

<comment><USER6> No, it's just that those things also doubled in value.

<comment><USER8> Touche, sir

</comment></comment></comment></comment></comment><comment><USER9> The cognitive dissonance is magic. You couldn't fake the tragic similarities to the dotcom crash. People yelling "hold for long!" with people raining down and everybody having a little voice inside their head saying, "I'm smart. I'm sure I knew the risks better than the next guy. I read the forums. I got this computer. This is it. 50% down is nothing."

Then when nearly everything was 95% down and liquidity was drying up because the bulls had all been beat into puddles in the street... everything went back to normal. And we did it all over again.

It doesn't matter if you write the history and they read it. Human nature is to be dragged into these things. Recognize the pattern. Look for the short.

</comment><comment><USER10> Buy btc when it's low, buy things with btc when it's high :) If you're trying to invest in it like a forex trader without adding liquidity to the market (e.g., buy-n-hold), you're part of what drives these bubbles in the first place..

I treat these bubbles as periodic shopping sprees. I bought a bunch of e-cigarette stuff and a few christmas presents during this bubble. (and I still have more $us worth of btc than what I spent on the original btc).

<comment><USER11> Buy low and sell high? What a brilliant strategy.

EDIT: If you think you've found a sure-fire way to beat the market, you are probably wrong. That or you are doing insider trading or high-frequency trading (arbitrage).

<comment><USER10> Ah, except I'm not trading for cash. I'm trading for something that means more to me than cash (which I would have used cash to purchase anyway) :) What the merchant does with it afterwards, on the other hand.

And I'm not in it to make a fast buck. I'm just using it for occasional vanity purchases. I don't like treating a volatile commodity as a forex investment.. just doesn't seem wise. If it crashes to <$1/btc, I'll be out like, a hundred bucks. So what?

<comment><USER12> What's the difference between what you are doing and selling btc for cash and using that cash to buy stuff?

The only difference is that you are forced to buy things at a certain time rather than keeping it in cash.

The underlying transaction is the same.

<comment><USER10> > forced

No, not really. It just changes my strategy on which currency to use when I want to buy something.

</comment></comment></comment></comment></comment><comment><USER13> It rebounded back to almost same level

[http://bitcoinity.org/markets/bitstamp/USD](http://bitcoinity.org/markets/bitstamp/USD)

% change 24hrs, -10% at time of this post

<comment><USER14> From my brief observation of bitcoin this seems to be the defining characteristic for bitcoin, crashes followed by rebounds, pretty much since it was created, making me believe that most of bitcoin usage is speculation (is that already confirmed?).

Anyway, the question that keeps me from investing a dime into bitcoin is "What if it doesn't rebound?". If it really is being used as an investment vehicle and not a currency, than the answer to that, in my opinion, is eventually it will drop and continue to drop to the point where it's worth pennies on that dollar. With the boom and bust nature, I suspect many people will eventually just give up on it as a currency which would be close to a death sentence for bitcoin.

I am heavily biased towards index funds with the lowest fees so I'm rather pessimistic about bitcoin in general, just like I am about playing the stock market. It would be interesting to see what would happen if banks started to care about bitcoin. The market needs to grow many times over but I would expect them to be the only people making consistent money (and not even sometimes) just like they do on the stock market.

<comment><USER15> There faster, more efficient ways to cause your hair to turn gray and fall out than watching BTC's waxing and waning on an hourly basis.

Personally I suggest looking at the 52-week moving average -- it's a lot more comforting and a lot less stressful.

</comment></comment></comment><comment><USER16> I wonder how many Finance professors just opened up their Investment 101 lecture deck and added a new case study under the Risk/Return slide. I think a lot of investors and speculators just got reminded of regulatory risk.

That said, the MBA professors are updating their case studies for Regulatory Arbitrage...outcome tbd:

[http://en.wikipedia.org/wiki/Regulatory_arbitrage#Regulatory...](http://en.wikipedia.org/wiki/Regulatory_arbitrage#Regulatory_arbitrage)

</comment><comment><USER17> At least it shows where the bitcoins are used

</comment><comment><USER18> I'm still in it for the long haul. I'm sure it will go back up at some point.

</comment><comment><USER19> The reaction to all of this is completely ridiculous, because it lacks good context.

Bitcoin is still up around 444% if you look at the chart from six months ago: [http://bitcoinity.org/markets/bitstamp/USD](http://bitcoinity.org/markets/bitstamp/USD). It's still one of the best investments of the year, if you compare it to pretty much everything else (the stock market, gold price, options, housing, oil, you-name-it). When the fed tapering program begins, I think we are going to see a similar (though probably not as drastic) drop in the stock market as well, which I also believe to be overinflated. That hits a lot of people too, most of whom have their retirement funds built on it. It's just the nature of investing, which I have a lot of trouble at times isolating from the idea of gambling.

The real lesson here is that if you're just trying to get into Bitcoin to make easy money, you're going to be disappointed. People should be hesitant of get rich quick schemes in general, and in altcoins in particular. When friends and family ask if they should buy Bitcoin, I immediately warn them that getting into Bitcoin solely on price increase speculation is akin to gambling or stock investing and should be treated as such. As Roger Ver said, Bitcoin's price is the least interesting thing about it. What excites me about Bitcoin is the ability to control your own purchasing power, and not require a central system (bank, payment processor) to manage and send it. Bitcoin is still at an incredibly early stage in its development, and like anything, there is a lot of uncertainty now, and to come.

It's not my intention to gloat, but I want to give you a positive story against all this. I sold enough of my ownership of Bitcoin at about $950/BTC to pay my usual salary in USD for an entire year, which will allow me to work on Coinpunk and Neocities full-time, and have some extra funds to pay people that help me work on it. I have never had this opportunity in my life, and I'm really excited about it. It's like getting angel investment without the investor, and it gave me complete autonomy to do for the project what I feel is right. For me (and for people that were sensible about it), it's been a very good year.

My prediction is that the China situation is going to get sorted out eventually. But sure, until that happens, the value of Bitcoin has fallen because of concerns about liquidity. If the US banned the ability to exchange dollars, I imagine you would see a similar drop in its value as well. And it's looking like most countries are invariably going to not ban Bitcoin. The US hearings in particular were quite positive. If China's government decides it's done with Bitcoin, it just means that other countries will have the opportunity to become the leader in Bitcoin startups. And that's also a positive thing for me ultimately, but sadly, not as much for future entrepreneurs in China. As someone that works on startups for a living, I would always rather have a level playing field than be given an opportunity due to a punitive effect.

<comment><USER20> I love the idea of Coinpunk.

And I wish I could contribute, but I'm so jaded and scarred by Javascript at this point it's not even funny. (For context, I spent a lot of time debugging JS on Internet Exploiter in the early 2000's long before anything cool and JS- related existed, and I do Ruby now.)

Can you do me a huge favor, though (and I'd be happy to toss you an entire bitcoin if you simply promise to do this): You NEED a better test suite. You're writing software that deals with money (or "a money," whatever), it _absolutely_ needs a robust test suite. Primarily unit tests, but also a few functional tests. For both the server-side AND client-side code. Bitcoin itself has a reasonably good test suite, yours should too. I REALLY doubt Blockchain.info has a good one. You could distinguish yourself this way while also covering your own ass in the event you need to refactor things without breaking things :)

I didn't think tests were fun to write until I realized how much time they were saving me in debugging and headaches after the fact. Do it now, before your code size gets much bigger.

I highly recommend this book [http://www.amazon.com/Growing-Object-Oriented- Software-Guide...](http://www.amazon.com/Growing-Object-Oriented-Software- Guided-Tests/dp/0321503627)

Again, happy to order it for you (it's not cheap) or just toss in some more BTC if you promise to order it and read it.

I don't know what cred I can give you other than to tell you I'm "GSpotAssassin", a well-known big tipper on /r/bitcoin. (I got into bitcoin very early, and I'm an open-source developer.)

Anyway, congrats on your self-funded expedition, that is pretty fucking rad and I expect big things. :)

<comment><USER19> Thank you for the feedback! I agree, improving the testing suite is definitely a high priority and high on my list.

</comment></comment></comment><comment><USER21> Can we finally stop listening to the Winklevoss twins now?

</comment><comment><USER22> Dogecoin 50% gain only alt coin to post gains in 24 hours.

>reddit and 4chan

Well looks like the internet has decided what coin they want to use.

Buttcoins are deprecated.

<comment> vezzy-fnord I'm still shocked how a dumb meme-based altcoin gained so much popularity, where all other just as boring and generic Bitcoin forks died down or are completely insignificant.

To their credit though, they based it off of Litecoin... making it a fork of a fork.

Either I have no sense of humor, or we aren't going to be seeing October 1993 any time soon. Can't wait for "Latvian Potato Coin" to appear in the future.

<comment><USER22> Your shocked because your old and have no sense of humor and think money is serious business.

Dogecoin has the fastest rate of adoption, of any crypto-currency. Ever, period. It makes every coin, even bitcoin look like an absolute failure.

Because it's fun, and kids think it's cool. You guys missed the boat, because you were too busy being serious.

<comment><USER23> Cut it out. You are trolling. Your reference to "buttcoins" is a good indicator you're from /g/ and this isn't /g/.

Edit: FYI, [http://rbt.asia/g/?task=search2&ghost=yes&search_text=dogeco...](http://rbt.asia/g/?task=search2&ghost=yes&search_text=dogecoin&search_op=op&search_del=dontcare&search_int=dontcare&search_ord=new&search_capcode=all&search_res=post).

</comment></comment></comment></comment><comment><USER24> who cares? Nobody owns it anyway.. This is what I don't get. They say only 1000 ppl own Bitcoin. So why the popularity? I mean who cares if those 1000 ppl get rich or lose all their money?

<comment><USER25> 1000?! Where did you get that number from? Coinbase has 650.000 users alone...

<comment><USER26> There was some headline about a week ago that said roughly 1000 people own half of all bitcoins.

<comment><USER25> True, but the total amount of bitcoin owners are in the millions. AznHisoka stated that only 1000 people own bitcoins, which is simply not true.

</comment></comment></comment></comment><comment><USER27> I am not an expert in markets or finance, but this is my observation: a lot of inexperienced people owning BTC will sell when they see these sudden drops; experienced investors will be there, reaping the benefits and buying BTC at a "discount". It wouldn't surprise me if BTC will go back to 1,000 US$ and beyond just in a matter of weeks.

This is NOT an investment advice, but I would buy some BTC now that the price is at approx. 600 US$, and keep it for a few months at least.

<comment><USER28> You are not an expert, that is not advice, but you advise people to buy it at some arbitrary value? Thats one of the many things wrong with bitcoin, all the stupid people talking shit. Classic bubble signs.</comment></comment>


Google to ramp up AI efforts to ID extremism on YouTube - <AUTHOR> https://techcrunch.com/2017/06/19/google-to-ramp-up-ai-efforts-to-id-extremism-on-youtube <comment><USER2> Earlier related discussion: [https://news.ycombinator.com/item?id=14583017](https://news.ycombinator.com/item?id=14583017)

</comment><comment><USER3> "expanding counter-radicalisation efforts by working with (other Alphabet division) Jigsaw to implement the "Redirect Method" more broadly across Europe. "This promising approach harnesses the power of targeted online advertising to reach potential Isis recruits, and redirects them towards anti- terrorist videos that can change their minds about joining. In previous deployments of this system, potential recruits have clicked through on the ads at an unusually high rate, and watched over half a million minutes of video content that debunks terrorist recruiting messages," says Walker."

Does them performing this kind of intentional manipulation, and having such success, scare the shit out of anyone else?

</comment><comment><USER4> How about employing real people this time, google?

Your previous efforts to police crafty humanss using AI has utterly failed. Just look at adsense and play store.

<comment><USER5> There is something like a decade of video uploaded to YouTube every day.

Even if you employed entire countries you still wouldn't stand a chance at reviewing it all.

Automated systems are the only way it can function at all.

<comment><USER4> > Automated systems are the only way it can function at all.

Not in its current form. Google with all its might hasn't even managed to remove those "work from home for $$$" youtube comments.

Google doesn't have a good way to incorporate human intelligence (users) into its AI. Pure AI has no chance against an army of highly adaptable humans.</comment></comment></comment>


Don't Call Me, I Won't Call You - <AUTHOR> http://www.nytimes.com/2011/03/20/fashion/20Cultural.html?_r=1&src=twr

<comment><USER2> This article certainly has interesting implications for those of us hyperventilating about next-generation voice technologies. Being in the VoIP engineering consulting business (and a fixed-line centric one, at that), it does highlight an interesting point I usually ignore due to self-selecting bias; I like talking on the phone, and tend to talk to a lot of other people who do also. It's important for people like me to be reminded that overall, voice minutes are declining as a proportion of electr(ic/onic) communication.

Also, text is a big deal. In the fixed-line VoIP world, we tend to dismissively poo-poo SMS as a pre-IP anachronism that maintains its captive user base at the whim of carriers who design handset interfaces that afford vast UX preference to SMS over other means of delivering text messages, e.g. the various iPhone "free text messaging replacement" apps that have popped up that run over IP rather than the SMS portion of the mobile transport core. I usually think its days are numbered, and think 160 characters is laughably impractical in a world of mushrooming smartphone adoption. But the kinds of sociological observations raised in this article make me wonder if that's really true.</comment>


Social.com launches - <AUTHOR>

I just completed the launch of a new site at Social.com.  This is a collection of the same tools (bookmarklet, WP plugin, widget, Google Reader integration) that was formerly called BigTweet.  The bookmarklet in particular is useful for posting to Twitter, Delicious and Ping.fm without leaving the current web page.
I listened to the comments previously about BigTweet in HN (logo & site design was poor, etc) and tried to make some improvements with the change to Social.com.
I would appreciate any feedback on the site and the tools.  Thanks!
- Scott <comment><AUTHOR> Adding clickable link

<http://www.social.com/></comment>


Donald Trump plans to make getting a green card very, very difficult - <AUTHOR> http://qz.com/833906/president-trump-plans-to-make-getting-a-green-card-very-very-difficult/ <comment><USER2> Have you ever tried to get citizenship in Germany or Australia? Both countries are many times more difficult than the US.</comment>


Is Heroku a way to hack? - <AUTHOR> If I found this on iPhone should I be concerned?https://devcenter.heroku.com/ <comment><USER2> I'm not really sure why you'd be concerned, 5 seconds of Googling and you'd figure out that Heroku is just a cloud hosting service.</comment>


Conservatives changed twitter name to 'FactCheckUK' during the TV debate - <AUTHOR> https://www.bbc.co.uk/news/technology-50482637 <comment><USER2> I wonder if Twitter will react: Changing your display name to misrepresent who you are, while keeping your "blue checkmark" smells pretty abusive.

<comment><AUTHOR> I think anyone else doing this would lose their checkmark. Shouldn't be any different for politicians. But will they be brave enough?

<comment><USER3> Twitter has explicitly stated that they will allow politicians to violate the rules applicable to others, so this shouldn't be a surprise.

<comment><AUTHOR> Does this apply to any political institution too? This was the Conservative's main account rather than an individual politician.

</comment></comment></comment></comment><comment><USER4> Twitter could fix this in no time by adding an alert next to a recently changed name (within a few days) and/or a list of previous names. Steam figured this stuff out years ago.

<comment><AUTHOR> Would be better to change the design to make the real username more prominent. That can't be changed.

</comment></comment><comment><USER5> I feel like if you need to do these kinds of tricks to win maybe you shouldn't win.

<comment><USER6> It's more of a way of showing off that they are above the rules. It won't be used to hammer them in the press, and Twitter is unlikely to ban them for it.

<comment><AUTHOR> It's more of the same from them. Last week they doctored a video of the shadow Brexit Minister to make it look like he didn't have an answer for a question on Brexit. In reality he answered the question immediately, and very articulately i might add.

This is part of a long-running campaign of underhanded tactics. There are probably many other things going on that no-one has noticed yet.

</comment></comment></comment><comment><USER7> I think we can all agree that blue check marks shouldn't be misrepresenting who they are.

That said, the 'outrage' to this is pure political games. Don't be a sucker.

<comment><USER8> So you think it's wrong.. but a reaction to something wrong is purely political gaming? Illogical.

<comment><USER7> Intent matters. I don't think they were intending to mislead people.

I've worked enough in politics and the marketing side of things to know that the conversation about this gimmick went something like:

"We can 'fact check' during the debates as a way to increase engagement on Twitter, etc."

not like

"We can change our Twitter handle to trick people into thinking our falsehoods are facts."

And if you believe their goal was nefarious, then congrats: you're playing the gross political game.

<comment><USER8> An official party social media account changing it's branding to masquarade as a fact checking service during a televised debate? The intent to mislead is clear.</comment></comment></comment></comment>


Ask HN: A replacement for last.fm? - <AUTHOR>

Since today you can't really listen to radio on last.fm outside US, UK & Germany, can you recommend something similar but for free?<p>Thanks. <comment><USER2> <http://listen.grooveshark.com/>

</comment><comment><USER3> <http://thesixtyone.com>

<comment><AUTHOR> hmmm.. not exactly but thanks!

<comment><AUTHOR> until then www.arigato.ro :D

</comment></comment></comment><comment><USER4> Shoutcast radio on winamp is what I have used for years, many stations there.

<comment><USER5> Hurrah for nostalgia!

</comment></comment><comment><USER6> <http://www.hypem.com>

tons of good music - some hard to find songs as well

</comment><comment><USER7> I use last.fm recommendations + <http://seeqpod.com>

</comment><comment><USER8> Most radio stations have individual feeds on their sites. That's the best tip I can offer.

</comment><comment><USER9> <http://www.imeem.com>

</comment><comment><USER10> <http://www.lala.com>

</comment><comment><USER11> pandora.com?

<comment><USER12> Doesn't work out of the US.</comment></comment>


The Highest Resolution Color Photo of Pluto Released So Far - <AUTHOR> http://i.imgur.com/8EfBsJC.jpg <comment><USER2> [https://news.ycombinator.com/item?id=10277682](https://news.ycombinator.com/item?id=10277682)

[https://news.ycombinator.com/item?id=10274313](https://news.ycombinator.com/item?id=10274313)

</comment><comment><USER3> Here is the original: [http://photojournal.jpl.nasa.gov/catalog/PIA19952](http://photojournal.jpl.nasa.gov/catalog/PIA19952)

</comment><comment><USER4> It's still amazing to me that in May we had a fuzzy blob of pixels and today we have this detailed image.

[https://twitter.com/tothur/status/620601134651166720/photo/1](https://twitter.com/tothur/status/620601134651166720/photo/1)

It's a bit surprising that we don't have the billionaires sponsoring similar style missions. New Horizons was so cheap. We still have Eris and Makemake.</comment>


A cave in Romania that was sealed for 5.5M years - <AUTHOR> http://www.bbc.com/earth/story/20150904-the-bizarre-beasts-living-in-romanias-poison-cave <comment><USER2> Some interesting takeaways::

\- The cave is called "Movile".

\- 3 species of spider, a centipede, 4 species of isopod (the group that includes woodlice), a leech never seen anywhere else in the world, and an unusual-looking insect called a waterscorpion

\- Movile's only snail [probably the only snail _species_ ] suggested that it has been down there for just over 2 million years.

\- Many animals are born without eyes, which would be useless in the dark. Almost all are translucent as they have lost pigment in their skin.

\- The cave seems to have no contact with the surface; Chernobyl accident had released lots of radioactive metals, which had found their way into the soils and lakes surrounding Movile Cave. However, a 1996 study found no traces of them inside the cave.

\- The ecosystem seems to be supported by _chemosynthesis_ ; bacteria oxidise methane, sulphide and ammonia, generating energy and organic matter.

<comment><USER3> The sad irony is that by opening it and discovered it, we've ruined the entire ecosystem. But by not discovering it we never would have known about it, and it is an educational opportunity lost.

Really cannot win either way. Just have to hope there are other, undiscovered, caves like this around the globe.

<comment><USER4> There are almost certainly thousands, if not tens of thousands, or hundreds of thousands of undiscovered caves exactly like this around the globe. And even that is probably a wild underestimate. The world is a very, very big place, and humans, despite all our activity, have barely scratched the surface of most of it.

<comment><USER5> endoplanets

<comment><USER6> I really like this word! Did you coin it just now?

<comment><USER5> Thanks! To my knowledge, yes; I haven't googled.

</comment></comment></comment></comment></comment></comment><comment><USER7> "in pitch darkness and temperatures of 25 °C"

Is this supposed to be terrifying? Anyone who woke up at night and walked to the bathroom faced pitch darkness and temperatures of 25 °C!

<comment><USER8> 25 °C for British people is pretty terrifying :p

<comment><USER9> You'd be complaining about the heat at that point.

<comment><USER10> We need to start having conversations about whether the law compels people to go home from work and school at that sort of temperature.

</comment></comment></comment></comment><comment><USER11> The title is a bit misleading. The cave was discovered in 1986. It's just that this article is a bit more recent.

<comment><USER12> What's 30 years compared to 5.5M :)

</comment></comment><comment><USER13> _Fewer than 100 people have been allowed inside Movile, a number comparable to those who have been to the Moon._

BBC reporting is really kind of crappy. 12 people walked on the Moon; 22 people orbited the Moon.

<comment><USER14> Technically 100 and 32 are comparable numbers.

<comment><USER15> Technically all numbers are comparable.

<comment><USER16> Technically incorrect: [http://mrob.com/pub/math/largenum-2.html](http://mrob.com/pub/math/largenum-2.html)

<comment><USER17> Would a tl;dr here be:

Is BB(26) - BB(25) greater than or less than BB(25)?

<comment><USER18> I am certain it is greater. BB(n) grows super-exponentially.

In fact I would be willing to bet serious money that BB(n+1)/BB(n) is greater than BB(n) if 3 < n.

(This is, of course, assuming that one assumes that BB(n) is well-defined. That is an interesting point of philosophy given the existence of Turing machines which can't be proven to not halt.)

<comment><USER19> > In fact I would be willing to bet serious money that BB(n+1)/BB(n) is > greater than BB(n) if 3 < n.

BB(n) grows faster than any computable function. In order for BB(n+1)/BB(n) > BB(n) to hold, BB(n) merely has to grow faster than a sequence whose new terms are obtained by repeated squaring (like k^2ⁿ). That's computable, indeed primitive recursive, so BB(n) definitely grows dramatically faster than it.

[https://en.wikipedia.org/wiki/Primitive_recursive_function](https://en.wikipedia.org/wiki/Primitive_recursive_function)

Edit: another way of looking at this is that the Ackermann function grows unbelievably faster than functions that easily satisfy the property you describe, and the Busy Beaver function grows unbelievably faster than the Ackermann function. Somehow putting it this way feels like an understatement, though!

<comment><USER18> It is unfortunately not that easy. Consider the following function, if n is even then f(n) = BB(n/2), else f(n) = BB(2n). Then f(n) grows faster than any computable function, but still if n is odd, then f(n+1) < f(n).

However you have encapsulated the reason why I would be confident of this result. :-)

</comment></comment></comment></comment></comment></comment></comment></comment><comment> mh-cx Maybe I've missed it, but how exactly do they know it was cut off for 5.5M years?

<comment><USER20> Good question. I've read a bunch of articles about it (haven't delved into the research papers), and none of what I've read ever mentions that.

That said, I suspect it's based on the location and composition of the cave and it's surroundings.

</comment></comment><comment><USER21> I find this fascinating! Googling a bit, it seems there is a documentary on the Movile cave: [http://www.dailymotion.com/video/x1qpffb_the-secret- underwor...](http://www.dailymotion.com/video/x1qpffb_the-secret-underworld- movile-sulphur-cave-life-romania-national-geographic-adventures_tech)

</comment><comment><USER22> > Strangely, the worse the air gets the more animals there

> are. It's not at all obvious why that should be, or how

> the animals survive at all.

Mmmm I think it's the opposite: On more animals using the same static air balloons, less Oxygen will be there.

<comment><USER23> Almost like concentrations of humans

</comment></comment><comment><USER24> A walk-through of the cave:

[https://www.youtube.com/watch?v=9tOghHmhQKI](https://www.youtube.com/watch?v=9tOghHmhQKI)

It gets more interesting starting on the third video.

</comment><comment><USER25> Goes to show how resilient life is. Which makes it all the more unlikely that life is all that rare.

<comment><USER26> Resilience is probably not that closely linked to the probability of arising. Maybe once it exists, it is resilient, but when it is absent, chances of it arising are still very low.

<comment><USER27> Based on what? The only planet that we've explored extensively (Earth) is teeming with life everywhere we look.

<comment><USER26> Just a thought. As you yourself say, we know only of one planet with life. However, looks like life only arise once on this planet. If life is so abundant in the Universe, why wouldn't it at least arise several times independently on the planet where the conditions are so great?

<comment><USER27> It would have to die off before it could arise again. Fortunately with a Hillary Clinton administration looming, we may get to see that scenario play out.

</comment></comment></comment></comment></comment><comment><USER28> Both HN _and_ BBC titles are rather clickbaity. Pity for what turns out to be an interesting article on non-photosynthesis-based food webs, communities, and metabolism.

<comment><USER29> I believe the protocol here is to not complain about the title without suggesting a better alternative for the mods.

<comment><USER28> I know. Point is there's not a particularly good option as suggests itself to me.

You too?

</comment></comment></comment><comment><USER30> Are animals in a cave like this considered endangered species?

<comment><USER31> Well, they are now that we found them.

<comment><USER32> But were they endangered before we knew about them?

<comment><USER33> Their state of endangerment was a superposition of being endangered and not until the cave was opened.

</comment></comment></comment></comment><comment><USER34> This is fascinating. Life is everywhere. This is real "pitch black", just with smaller monsters.

</comment><comment><USER35> Perhaps the Andromeda Strain will be found in a cave, not in space...

<comment><USER36> You might like Peter Watts' Starfish.

<comment><USER35> Thanks for that, I'll take a look.

</comment></comment></comment><comment><USER37> What I'm reading is that the cave is like a 5-million year old micro brewing process, and as with many microbrews there are some nightmarish scorpions and spiders and scary creatures associated with the cave's brand. If that allegory is correct, then by exploring that cave we have essentially opened the cork and stuck our finger in, haven't we?

</comment><comment><USER38> Holy shit my city is #1 on HackerNews.

</comment><comment><USER39> Those creatures have evolved on their own tangent. Quite interesting to see how different they are compared to the creatures outside of the cave.

On another note an well hidden cave like that would be great for preserving man made historical artefacts.

</comment><comment><USER40> ... and then humans came along and filled it with coke bottles, plastic bags, old car tyres and other rubbish.

</comment><comment><USER41> So in summary, life, ahh, finds a way.

<comment><USER42> Cenozoic Park just doesn't have the same ring to it. Especially since all parks are technically Cenozoic Park.

</comment></comment><comment><USER10>
        > became roughly the 29th person to enter

Roughly?

<comment><USER42> "We don't know for sure how many of his girlfriends Steve has snuck into the cave over the years, and frankly we're afraid to ask."

</comment></comment><comment><USER43> This article reminded me of Terreria and the caves in it.

</comment><comment><USER44> Minecraft dungeon discovered!

</comment><comment><USER45> > Movile's only snail suggested that it has been down there for just over 2 > million years

This is a bit misleading. It should say only _species of_ snail, not a single snail that's been alive for 2 million years

<comment><USER46> Of course he's been single for 2 million years... it's not like he could go out and paint the town with the door closed.

<comment><USER47> Rotifers keep it in their pants for two million years

</comment></comment></comment><comment><USER48> Like comments like this, but just a heads up that dang has ban user who repeatedly post summaries in the comments.

EDIT: Here's a recent comment from dang (the main HN mod) on the topic of summary comments: [https://news.ycombinator.com/item?id=11608134](https://news.ycombinator.com/item?id=11608134)

<comment><USER49> We detached this subthread from [https://news.ycombinator.com/item?id=11683260](https://news.ycombinator.com/item?id=11683260) and marked it off-topic.

<comment><USER48> Any reason that HN doesn't have a meta and way to visualize show that a submission/comment has meta related content tied to it?

<comment><USER49> I'm not sure I follow, but the answer is probably that it would complicate things.

</comment></comment></comment></comment><comment><USER50> Right, just saw this a minute ago on reddit. It seems like HN is just /r/Futurology, /r/TodayILearned, /r/Programming, and /r/Startups rolled into one.

<comment><USER51> I'm here for the comments

<comment><USER50> Meh. I used to think more highly of HN comments, but as they started covering stuff I already knew a fair bit about, I realized the highest voted comments usually only have the appearance of knowledge / wisdom / experience / etc, but without the substance of it.

</comment></comment></comment><comment><USER52> That must be were my motivation was hiding since last week...</comment>


File Uploads 2015 – Another day, another monolith Ruby gem - <AUTHOR> http://blog.choonkeat.com/weblog/2015/10/file-uploads-2015.html <comment><AUTHOR> While the Ruby community wasn't looking, the rest of the world has moved on to having standalone servers to manage & process their file uploads.

Latest example: [https://medium.com/medium-eng/the-stack-that-helped- medium-d...](https://medium.com/medium-eng/the-stack-that-helped-medium- drive-2-6-millennia-of-reading- time-e56801f7c492?source=tw-f29a01c49588-1446087364731#e425--share-0-487)</comment>


We Want a Wii! (Still) - <AUTHOR> http://www.freakonomics.com/blog/2007/04/19/we-want-a-wii-still/ <comment><AUTHOR> We talked about this yesterday <http://news.ycombinator.com/comments?id=14719> which was not enough. The wii is too much and they aren't handling it in the correct manner either.</comment>


EGO is the number one reason most startups fail. - <AUTHOR> http://blog.helpjuice.com/2011/10/ego-is-the-number-one-reason-most-startups-fail/

<comment><USER2> Absolutely agree that being too attached to your current personal vision of the product and not having sufficient flexibility is a dangerous thing, particularly during the early days when it's important to learn from the market and be capable of pivoting quickly. Though I'm not sure you can emphatically state it's the "number one" reason without a bit more than a single anecdote.

One of the commenters mentioned Steve Job's ego. I'm not sure many people really know as much as they think they do about Steve's actual management style and how his personality affected decision making (<http://lucisferre.net/2011/11/18/the-cargo-cult-of-jobs/>). But I think it's important to note you can certainly succeed in spite of your ego, just as you can succeed with it, by knowing when to put it aside. Nothing is quite black and white.

I do, however, think that some amount of ego is necessary if one expects to lead a business.</comment>


Codr, an app to help teach kids to code - <AUTHOR> http://codrlab.com <comment><USER2> Ugh, that site is painful to use. Broke my back button. Checkboxes don't actually check. Advancing the slideshow/presentation/whatever can only be done by clicking the right angle at the bottom right, which is miles away from what I'm doing at the top left on my big desktop. Yikes.

<comment><USER3> I thought it was just a title page; I didn't notice the horizontal scroll until I read your comment.

</comment></comment><comment><USER4> I normally avoid negativity in my comments, but I'm afraid I really can't see the purpose of this site.

I only seem to be able to access the JavaScript section (no matter which options I pick), and am immediately presented with, what to a child, would be indecipherable code.

What is jQuery? What is CSS and how is it able to render certain Scratch Blocks? What is a var? What is setTimeout?

Children need to have things explained, and it appears that the creator has had zero contact with anyone with pedagogical experience.

</comment><comment><USER5> What a waste of my time - I went to that website and there's nothing there! only <codr> on the screen and there's nothing you can do.

</comment><comment><USER6> Can you get any language besides JS? I can't seem to get anything else no matter what combo I put in the questions.

</comment><comment><USER7> I'm appalled that some of the first languages you intend to teach are Javascript (But really JQuery) and Python. That's just my personal opinion, but when I think "Teaching kids to code" I don't think "pick languages unlike any other language, and that will teach bad expectations of future languages." I would even be happy if you were to teach them something like VB over Javascript and Python.

<comment><USER8> What's the problem with Python? It's no more complicated than VB and was designed as a teaching language. The significant whitespace may be annoying, but it's semantically identical to other ways of specifying blocks.

Javascript for teaching programming to children is an awful idea, though.

<comment><USER4> JavaScript is an excellent language to get children to learn to code, because it runs in a web-browser, an environment children are very familiar with.

<comment><USER8> Javascript is an awful language to get children to learn to code because it doesn't understand numbers and pretends to be object-oriented when it's prototypical - which puts it by itself in the world of popular languages.

That it naturally runs in a browser is an awful reason to use it. Use something that compiles to javascript if you feel web programming is so important.

</comment></comment></comment></comment><comment><USER9> The ideal language for this use case already exists: BBC BASIC.

</comment><comment><USER10> Just a tiny piece of feedback: I was annoyed that clicking the checkboxes didn't work in order to answer the questions at the beginning, I had to click the text.

ie:

      I consider myself to be an:
      [ ] Artist
      [ ] Gamer
      [ ] Storyteller

It would be nice if one could tick the checkbox by, huh, clicking on it :)

<comment><USER11>
        >It would be nice if one could tick the checkbox by, huh, clicking on it :)

Ease up there Jony Ive, this is codrlab, not uxlab (j/k)</comment></comment>