Skip Lists are Fascinating - <AUTHOR> http://igoro.com/archive/skip-lists-are-fascinating/ <comment><USER2>
        for (int R = _rand.Next(); (R & 1) == 1; R >>= 1)

For C# on .NET, this may work fine, but in general, this is a bad way of extracting a 0/1 choice from a pseudo-random number generator (PRNG). Many PRNGs use linear congruential generators, which are just a multiply and an add, and have highly predictable low bits as a result (frequently just a repeating pattern with a short period, as short as 4 or 8).

Safer:

        while (_rand.Next(2) == 0)

\- or even simply reading the bits off the other end.

Another nice thing about skip lists is that they are relatively easy to make into cheap persistent structures (aka functional structures), that is, structures where operations return a new immutable copy of the structure, but share most of the substructure with the previous version.

<comment><USER3> _anorwell is right, I'm wrong:_

Actually, his technique is _way_ faster (1 random generation per element, vs. log(n) or log(u)), but you're absolutely right, you need to take the higher order bits first or your skiplist will be very far from correct.

(P.S. I'd love to have you reviewing my code ;-)

<comment><USER4> > 1 random generation per element, vs. log(n) or log(u)

The expected height of an element is 2, and the maximum height is 32. So there is at most a constant-factor performance difference, and in practice we should find this constant to be small.

It's not clear whether any small performance gain is worth the loss of clarity in presentation of the algorithm and code.

<comment><USER5> Not only that, but if you were to write this in (say) Java, which uses a linear congruential random number generator, doing it this way would probably be even faster due to the higher quality random numbers. The least significant bits on a linear congruential generator aren't terribly random.

</comment></comment></comment></comment><comment><USER6> They are indeed fascinating, and Erik Demaine's MIT OCW lecture on it is amazing [1]. The analogy between the NYC subway system (express and local trains) and skip lists is brilliant.

[1] [http://ocw.mit.edu/courses/electrical-engineering-and- comput...](http://ocw.mit.edu/courses/electrical-engineering-and-computer- science/6-046j-introduction-to-algorithms-sma-5503-fall-2005/video- lectures/lecture-12-skip-lists)

<comment><USER7> Terrific lecture. A bit leisurely for the first hour, probably could've cover that in half the time, but then progressively realizes he's short on time and accelerates through the probabilistic analysis of the runtime. Still pretty easy to follow at warp speed near the end, because he is extremely clear. For instance, you can tell when he makes a simple 1/x mistake in a couple places (he catches himself), since his explanation which goes along with the calculation is crystal clear. Nice job.

</comment></comment><comment><USER8> I don't find skip lists to be simpler than AVL trees, but it's my understanding I'm in the minority on this issue.

What I do find very interesting about skip lists is that they support fingers - pointers to locations in the structure that allow fast modification nearby. As a very simple example, prepending an item to a skip list (this cons) is O(1) expected.

Getting this property for AVL or red-black trees is possible, but much more difficult, and requires fundamental changes to the structural invariants and representations.

For more on the uses of finger search, see:

<http://www.cs.au.dk/~gerth/pub/finger05.html>

<comment><USER9> I find AVL trees simpler as well, and probably a good deal more performant.

The nice thing about skip lists, beyond being mostly simple, is that min() is O(1), which is far more useful than the middling value at the root of AVL trees.

That you can finger-append in O(u) is misleading, since ideally u≃log n and finger operations are amortized O(1) in AVL trees (I know it's been shown empirically, not sure if analytically).

<comment><USER8> > That you can finger-append in O(u) is misleading, since ideally u≃log n

What's finger-append?

> finger operations are amortized O(1) in AVL trees (I know it's been shown > empirically, not sure if analytically)

Do you have a citation for that? I thought delete was Theta(lg n) expected, even from a finger.

<comment><USER9> By finger-append I meant that skip lists are normally singly linked, and so you can append to a sublist but not prepend nor insert into the implied subtree.

The O(1) wasn't amortized, it was expected. The citation is P. L. Karlton, S. H. Fuller, R. E. Scroggs and E. B. Kaehler, Performance of height-balanced trees. Comm. ACM 19, 1 (1976), 23-28.

<comment><USER9> I should also note that it's not very surprising that AVL restructurings show up as expected O(1) empirically, since many AVL trees are BB-trees, and it's been shown for BB-trees under the assumption that the root approximates the median - which is certainly true in most experimental settings. So It's quite possible the expectation isn't O(1) for pathological distributions, not to mention sequences.

</comment></comment></comment></comment></comment><comment><USER10> They are very interesting but in practice often preform poorly due to the cpu not being able to figure out what to cache.

<comment><USER11> Yes. I have read that big skip lists have poor data locality because the skips jump at unpredictable (probabilistic) times to memory that is probably on a different page.

</comment></comment><comment><USER12> I think the original paper is very readable: ftp://ftp.cs.umd.edu/pub/skipLists/skiplists.pdf

</comment><comment><USER13> i've always preferred treaps to skiplists as far as probabilistic data structures are concerned. that could be partially due to the fact that i felt aragon and seidel's paper on treaps to be fundamentally better that pugh's paper on skiplists, which i recall being kind of hand-wavy with respect to the analysis.

i've had to implement both and replace many of the java collections interfaces with them as the backing store for various projects or coursework. i find the structure of the skiplists intricate and fascinating as a thought experiment, but i feel they difficult for certain things, like implementing an iterator over them. treaps, if i recall correctly, just use the normal BST traversals.

would be curious to hear comparisons on the two, being probably the most popular of the probabilistic data structures.

performance wise, i've found both to have their strengths and weaknesses under various load testing scenarios. i have some stats around here somewhere.

of course the downside with any probabilistic data structure is that you're counting on the amortized bounds, but could end up with the absolute worst case performance at times. there are so many well-documented and well- implemented libraries out there for red-black trees (the gold standard in my opinion) that it's hard to find compelling reasons besides curiosity to use them in practice.

the original papers for both of them are here (treaps):

<http://faculty.washington.edu/aragon/pubs/rst89.pdf>

and here (skiplists) :

ftp://ftp.cs.umd.edu/pub/skipLists/skiplists.pdf

<comment><USER14> > of course the downside with any probabilistic data structure is that you're > counting on the amortized bounds

No. With typical probabilistic data structures you're counting on the _average_ bounds. If you have good amortized bounds and that's what you care about, you don't need to bother with the randomization. Per-operation versus amortized and worst-case versus average-case are orthogonal distinctions.

<comment><USER13> yes, sorry. that's what i meant. long day. wait, it's still not over.

</comment></comment></comment><comment><USER15> IIRC, Redis uses skip lists in its implementation of sorted sets. Good rundown of the data structure.

<comment><USER16> Exactly, Redis uses augmented skiplists so that we can support the rank operation in O(log(N)).

</comment></comment><comment><USER17> An interesting supplemental reading is the "two bowling balls" interview puzzle -- [http://20bits.com/articles/interview-questions-two- bowling-b...](http://20bits.com/articles/interview-questions-two-bowling- balls/)

It's essentially a 2 level skip list (but could be generalized where you get one extra level per bowling ball), and brings out some basic calculus to optimize lookup performance even further.

</comment><comment><USER18> The creator of Io created a kv db based on skip lists called skipdb that is worth a look.</comment>


Rain is sizzling bacon, cars are lions roaring: the art of sound in movies - <AUTHOR> http://www.theguardian.com/film/2015/jul/22/rain-is-sizzling-bacon-cars-lions-roaring-art-of-sound-in-movies

<comment> Am-hehu A while ago I discovered that all new movies (blockbusters) sounds identical. There seems to be a standard set of effects nowadays that are automatically assigned to specific scene-types. The results are boring in my opinion.</comment>


Nbvcxz 1.2.1 released – Now with 10x faster password strength estimations - <AUTHOR> https://github.com/GoSimpleLLC/nbvcxz/releases/tag/1.2.1 <comment><AUTHOR> The last release (1.2.0) introduced a new algorithm to combine the matches found within a password which provided better results, but drastically slowed down estimations. I spent some time profiling where that extra time was going, and optimized most of that slowdown away.</comment>


How to implement an algorithm from a scientific paper - <AUTHOR> http://codecapsule.com/2012/01/18/how-to-implement-a-paper/ <comment><USER2> In my field (ecology and evolutionary biology) there's a small but concerted push to get people to publish "executable papers" where all code and data is available via GitHub, on an iPython notebook, etc. so that all figures and test cases can easily be reproduced by reviewers and researchers. If you're publishing research, it shouldn't be the reader's job to parse your paper and reimplement the research you describe; it should be on you to make your results replicable, and I think this is a standard we need to insist upon. I can't count how many papers I've read lately that were missing either crucial methods or underlying data so that replication was impossible.

edit: Here's an example:

<https://github.com/weecology/white-etal-2012-ecology>

        Run portions of the analysis pipeline:
        Empirical analyses: python mete_sads.py ./data/ empir
        Simulation analyses: python mete_sads.py ./data/ sims
        Figures: python mete_sads.py ./data/ figs

<comment><USER3> I currently work in method development for proteomics, and I think about this all the time. Of _course_ methods must be reproducible, or the paper largely useless. But lately I've come to disagree that source code should be required.

If the research _relies_ on a piece of "in-house" code, which isn't described, then that's a problem. But the OP is about research where the _algorithm_ is the advance in the field. In a way, the algorithm is the result and not the method (even though the algorithm will probably be applied to a sample problem and the results thereof validated).

Now, if I develop a new method at the bench, you are expected to _do_ the method at your own bench if you want to apply it to your research. This often starts as a pilot experiment just trying out the method, which can take weeks to months, before you integrate it fully into your methods. I don't have to provide a kit which consistently implements the method along with the paper. Certainly once the method gains some traction, an outside company may begin selling kits. Until then, it absolutely _should_ be "the reader's job to ... reimplement the research" - that's an essential part of the process.

Similarly, an algorithmic method can be reproducible even if code isn't provided. Just like with bleeding edge wet-lab methods, if you want to use bleeding edge algorithms you will need to be able to code. You will need to be able to read a description of the algorithm and implement it accurately. The publicly funded result is the algorithm as an idea, and providing that the review process works, you're getting that idea. Later on, if the algorithm gains any traction, someone will implement it in a usable, robust package and more labs will be able to use it.

Finally, it takes significant time and experience to produce (and maintain) code that others can use and expect to work most of the time. That's a waste of time/money for a research lab, and an inefficient use of public funds. If you can't code yourself, leave code production to those who do it well and don't whine that you can't just plug-in whatever hot new method just came out without any effort or proper understanding.

<comment><USER4> > Finally, it takes significant time and experience to produce (and maintain) > code that others can use and expect to work most of the time. That's a waste > of time/money for a research lab, and an inefficient use of public funds.

I haven't seen people asking for maintained, (re)usable code. We just want the crappy code that was used to produce the results. There is even an appropriate license, the Community Research and Academic Programming License (CRAPL).

[1] <http://matt.might.net/articles/crapl/>

<comment><USER5> I would think most people would be unwilling to make their "crappy" code public because no matter how many disclaimers they provide with it, they will be judged by others on it.

<comment><USER6> Why on earth would anyone trust descriptions that they cannot verify?

Trusting without the ability to verify goes against everything scientific.

If you think your code is too "crappy" for publication, why do you believe it is bug free enough to produce dependable answers?

<comment><USER5> > Why on earth would anyone trust descriptions that they cannot verify? > > > Trusting without the ability to verify goes against everything scientific.

Hasn't this always been true about scientific papers? Descriptions can be verified by reproducing the experiment. Why is a paper any less trustworthy just because there's code involved?

<comment><USER7> The need for reproducibility in experiments is an accident of the fact that our universe is horrifically complicated and true reproducibility is a myth, thus we must make a deliberate, conscious effort to come as close as possible, or no progress can be made. When that is no longer true and it becomes possible to run (under certain constrained circumstances) fully deterministic experiments that can be freely replicated to the bit by anybody, it's time to rethink the assumptions made lo these many centuries ago.

People arguing against source code release often argue as if those of us in favor think that re-running the original simulation is the end-all, be-all of reproducibility. Clearly that is not the case. No one simulation can truly prove anything, and independent reverification will always have a place. But since we do have the source artifacts and original data, why _not_ release them and show exactly what was done and how it was done? Again, the idea that experiments should not do so is merely an artifact of the fact that scientific papers could only be 10 very expensive pages or so in a journal; why carry unexamined assumptions based on that now outdated fact forward into the future?

Accidents of the past are nothing more than accidents of the past, not holy writ. And I'm not aware of a good argument against release of source code that doesn't boil down to _well, that's just not how we do it_ when deeply examined.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> When my other half was going through her PhD, she was attempting to implement a signal processing approach to construct grids for FEM. Eventually adding some constraints led to an acceptable result. As she presented her findings at a conference the author of the paper eagerly questioned her about her approach. Why? He had never gotten it to work and failed to mention that next to the glowing praise heaped upon the technique.

<comment><USER3> Good thing he published then! It may have been a long time before someone thought of the approach _and_ ironed out all of the implementation details. This sounds like exactly how science progresses... incrementally building on the work of others.

<comment><USER9> Alternatively, such a paper could lead many a reader to implement a dead end. Each assumes they did it wrong, and after much wrangling, silently move on. Later, the next intellectual victim comes along.

</comment></comment></comment><comment><USER10> While peer review is flawed in so many ways and neither all papers accepted at top conferences are good, nor all good papers get accepted, it has still some meaning.

When deciding which paper to read, it can be a great hit where it was published. The link merely claims groundbreaking work was published in the best "journals". Especially in computer science, conferece papers are where recent, groundbreaking work is published and good conference are the ones that are hard to get into. However, I agree that groundbreaking work ofter gets a longer follow-up journal aritcle. But those usually appear years later and for those algorithms it is likely that there are existing implementations available by that time.

</comment><comment><USER11> With regard to section 3.5 "Know the definition of all terms", I found that in a given field these terms change over time. I wasn't really aware of it, and then I went back to a paper after reading about Domain Maps in Eric Evan's Domain Driven Design. Lightbulb! I quickly made a list of the terms used in each paper, and then drew lines between the identical or related terms.

I have for some time been attempting to learn everything I can about automated theorem proving. A key paper is Robinson's 1965 paper "A Machine-Oriented Logic Based on the Resolution Principle". It uses quite different notations compared to, say, Kowalski's "Logic for Problem Solving". Robinson made an important contribution, but his work is like the assembly language of logic. Modern papers are much higher level. Kowalski's book is 1979, so its like C. My new domain map made these works much more comprehensible, especially as I switched between them.

The other good point is patents. That's why I'm reading papers from 1965 and books from 1979.

<comment><USER12> What would happen if you just hosted your potentially patent breaking api from europe? Apart from 100ms lag?

<comment><USER11> That's not a conversation I want to have when talking to investors.

</comment></comment></comment><comment><USER13> >If you are in the U.S., beware of software patents. Some papers are patented and you could get into trouble for using them in commercial applications.

Is it only commercial applications that you have to worry about? I was under the impression that even a free implementation would be infringing the patent and make you liable for damages.

<comment><USER14> Free implementations are liable. See Madey v. Duke University. It severely restricted the research exemption (<http://en.wikipedia.org/wiki/Research_exemption>)

I have had University Council tell me I cannot open source code I have written implementing patented algorithms. It is unfortunately more common than most people think, and often not acknowledged in publications.

</comment></comment><comment><USER15> It's interesting to note how Matlab is still so fast to prototype stuff in. I've done it myself countless times.

Data generation, input, manipulation, output and result checking are all very good.

Maybe things like Go can change that, or then some optionally typed language. There is no fundamental reason not to get massive improvements.

<comment><USER16> Indeed. These plenty of room for improvement in the tools for implementing such algorithms. I'm actually spending a bit of time on the algorithm engineering and data provenance bits

</comment></comment><comment><USER17> It's kind of funny that the article lists "authors citing their own work" as an identifying feature of groundbreaking research.

I don't know about CS, but in most scientific fields, this may be a bad sign. It can mean they're just trying to pump up their own reference counts, or it can mean they don't really know what other people are doing.

The only way to be sure that neither of these is the case is to know, a priori, that they're truly doing groundbreaking work.

<comment><USER18> I think the warning sign should really be if an author _only_ cites their own work, from what I recall having a small number of references to your own previous work that you are building on is pretty standard and desirable as most research is incremental.

<comment><USER19> This is true. A lot of times the process goes:

1\. Here is a paper about some interesting things we've been looking at, here is what we know, here are some ideas we are building on. These tend to be presented at conferences, as a "what do you guys think?" sort of introduction for the larger community. It is nice, because other researchers can then tell you if this is actually new, or just a repeat of an idea (that was hard to find because it used different terms and went nowhere), or something worth looking into, or the old "hey, here's some pitfalls I see from my expertise".

2\. A couple more conference papers with results building on the ideas in the seminal paper in 1. These are just to keep awareness of your work to others in the field, get feedback, and to play the game right - you get much less credit if you don't have a history of showing you've been working on this for a while when someone comes along and "scoops" you.

3\. Actually interesting/important work. This is the type of paper that the OP calls "groundbreaking". After all that work (see documentation over the years), here is something pretty awesome!

Another facet of this process:

When doing research, you have no idea what you are doing. I mean, you have expertise and goals and hypothesis/theory, but you don't know how it will pan out. You don't know if you suddenly find a spot where a left turn is required. So publishing about these new things is a good idea. Other people in the field can benefit from just that. Further, in my experience, each small result tends to spawn more questions/investigatory tracks, etc than it closes. So a lot of papers with honest "future work" sections are great places for grad students and others new to the field to dive in and get their feet wet. They can follow some of the tracks the original researchers just had no time for, and help fill in gaps.

Finally, the self reference is a good sign, because it establishes you aren't just some person coming out of left field with $BIG_IDEA (which looks a bit crack-pot-esque...)

</comment></comment></comment><comment><USER20> I got into a situation a couple years ago, where I wanted to understand how relational databases worked. I mean how they really worked. Down to the algorithms and processes that implemented query parsing and ACID - purely so I could try and toy around with implementing some OLAP stuff on my own, without all the 'overhead' of the rest of the database (at the time I didn't really care about transactions or query optimization). I ended up getting into a pile of papers so deep I thought I would never escape, and eventually gave up. I even ordered a thick book that was a collection of papers, tying it all together.

Some of the papers on the subject - the groundbreaking ones by folks like Goetz Graefe - were brilliant and very interesting reads, but at the same time were so involved I felt like I would need to dedicate years before even scratching the surface.

Walking away, I did learn to see the difference between good papers and bad, and learned a heck of a lot on DB internals (good through the end of the 90's at least). But I think I'll stick with books from now on :)

</comment><comment><USER21> The site is down now, so I haven't seen the article— but I hope it just says "(1) give up and beg the author for their implementation, which undoubtedly contains 2 megabytes of opaque unmentioned magic constants."

</comment><comment><USER22> Harsh Truth - Sometimes the algorithm is on purpose obfuscated to make the authors gain a competitive edge.

PS - Speaking from CS perspective.

</comment><comment><USER23> I recently refereed a paper in computational geosciences and recommended substantial revision because the authors did not make their source code available for evaluation. The paper was ultimately rejected.

</comment><comment><USER24> There is one increasingly common kind of paper out there, the 'obfuscapaper'. It's a paper which pretends to outline all the steps, but really doesn't -- key information is either missing or obfuscated. You often see that with papers published by people working at companies, or by people who are about to leave academia to work at a company.

Problem is, this kind of obfuscation is really difficult to spot unless you actually understand the paper and see all the steps necessary to implement the algorithm.

</comment><comment><USER25> I bumped into #1.4 (patented research) not too long ago -- I wanted to try out Bi-Normal Separation for feature space reduction in a machine learning classifier, but BNS comes out of HP Labs and would need to be licensed. I think the wording on this point needs to be changed; why would it only apply to those in the US?

<comment><USER26> Because, officially at least, software patents in the EU are not allowed.

</comment></comment><comment><USER27> This is very interesting and something I've been thinking about lately.

My research is in molecular dynamics. I've only been a grad student for one semester, but I've written a lot of code. The code I am currently working on takes a force-field description, combines it with a listing of atom coordinates, and completely automates the production of an input file to a simulation program. (This is less trivial than it sounds. All stretching, bending, torsional, and improper atom connections must be generated. Bond- orders must be determined, solely from the structure. And then this is combined with equations from the paper describing the force-field to give an energetic potential for each connection type).

I would think this code could have a lot of value to other researchers. Though I doubt anyone in non-CS departments have even heard of Github.

</comment><comment><USER28> "create your own type to encapsulate the underlying type (float or double, 32-bit or 64-bit), and use this type in your code. This can be done with a define is C/C++ or a class in Java."

No. A Java class would certainly have worse performance than just float or double, since each instance would be individually heap allocated, have the usual per-Object overhead. Better use text preprocessing (or just "double") than that.

(otherwise, this is all fine advice)

</comment><comment><USER29> 6.3 and 6.4 read funny one after the other: put references to the paper in the comments, but change all the notation from the paper.

<comment><USER30> Probably the worse piece of advice in the article :

> 6.4 – Avoid mathematical notations in your variable names Let's say that > some quantity in the algorithm is a matrix denoted A. Later, the algorithm > requires the gradient of the matrix over the two dimensions, denoted dA = > (dA/dx, dA/dy). Then the name of the the variables should not be "dA_dx" and > "dA_dy", but "gradient_x" and "gradient_y". Similarly, if an equation system > requires a convergence test, then the variables should not be "prev_dA_dx" > and "dA_dx", but "error_previous" and "error_current". Always name things > for what physical quantity they represent, not whatever letter notation the > authors of the paper used (e.g. "gradient_x" and not "dA_dx"), and always > express the more specific to the less specific from left to right (e.g. > "gradient_x" and not "x_gradient").

Especially when you're just starting out, creating your own naming scheme just creates more opportunities to do something wrong.

<comment><USER31> Have to disagree. Those derivatives are a bad example of a good point. Most mathematical symbols aren't representable in code, at least until we're able to use unicode identifiers and sub/superscripts in every language. When you're forced to write 'theta' instead of θ then you might as well just say 'angle' so your future maintenance programmer will have an easier time of it.

An equation and an algorithm might achieve the same result but the ways they get there are so different that using different notation styles makes perfect sense. For example, a simple finite summation is a compact block in mathematical notation but it's a multi-line for loop in C. Trying to force the constraints of the 'source' notation on the implementation makes no sense.

Remember, dA/dx means 'gradient'. You're not creating your own naming scheme, you're translating the concept of 'gradient' to the appropriate notation for the medium you're working in.

<comment><USER13> >Most mathematical symbols aren't representable in code, at least until we're able to use unicode identifiers and sub/superscripts in every language.

If the Linux compose key supported more of the common mathematical symbols, I would have so much trouble not using them in all of my JS code. It's already hard not to use names like â to denote unit vectors.

As a side note, I really want to make a JS library called "Eta" for creating progress bars (puns!), where the global namespace is under Η (the Greek letter), but I think that might piss people off, even if I did allow the visually identical H as an alias.

<comment><USER32> > If the Linux compose key supported more of the common mathematical symbols,

Google '.xcompose github' (without quotes) and see what you come up with. I use this one, myself:

<https://github.com/kragen/xcompose>

but there are a _lot_ of others.

<comment><USER13> That's pretty sweet. If anybody is having trouble getting it to work in KDE, I found that these instructions were necessary: [https://wiki.edubuntu.org/ComposeKey#Persistent_Configuratio...](https://wiki.edubuntu.org/ComposeKey#Persistent_Configuration)

</comment></comment></comment></comment></comment></comment><comment><USER33> How about this one:

Figure out if the pseudocode notation in the paper is using 0- or 1-based array indexing.

If the paper doesn't match your implementation language, consider doing the initial implementation using an array adapter class. The adapters can be removed later if they reduce performance, but they will likely have save you a number of maddening errors in the meantime.

</comment><comment><USER34> I'm a little ignorant on the topic, what legal rights do I have to use a (self)implemented academic paper?

</comment><comment><USER35> Pray for an appendix with source code.</comment>


The Impact on Firm Valuation of Mandated Female Board Representation - <AUTHOR> https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1364470 <comment><USER2>
      "We find that the constraint imposed by the quota
      caused a significant drop in the stock price at the
      announcement of the law and a large decline in
      Tobin's Q over the following years, consistent with
      the idea that firms choose boards to maximize value."

The last word "value" in the abstract above is ambiguous; I guess the authors meant "share price". According to other non-monetary measures the "value" of the companies may have gone up. For example, a career path for women could keep them in the companies, making the entire Norwegian workforce more diverse.

<comment><AUTHOR> But that is value for whom? For the women who benefit. Not necessarily for the business itself, which is what this paper argues.</comment></comment>


8 hours of Windows 7 Amazon sales outstripped Vista's entire pre-order period. - <AUTHOR> http://news.bbc.co.uk/2/hi/technology/8151342.stm

<comment><USER2> I am already using Windows 7 RC as my primary OS. It's so much faster than XP and the UI improvements are fabulous. Vista was just a beta version of Windows 7, or another Windows ME. XP lasted me almost 10 years and I figure 7 will do the same.

<comment> old-gregg Faster than XP? Can you please elaborate on this? I'm a long time Windows internals geek although haven't seen a windows PC in a long while, so I'm genuinely curious.

<comment><USER2> I haven't benchmarked it, but subjectively speaking, the boot time is greatly improved, applications launch faster, and file operations are speedier, with the exception of opening an image in Windows Photo Viewer, which for some reason takes 2-3 seconds.

<comment><USER3> A lot of the perceived speed comes from barely-noticeable tweaks to the UI. Win7 does benchmark a bit faster than Vista, but it really is the UI (window response/refresh times, etc) that makes a world of difference.

<comment><USER4> (In general, people notice response time not throughput. I think thats a bit difficult to capture in benchmarks.)

</comment></comment></comment></comment></comment><comment><USER5> I'm still a little baffled by Vista's reputation. I'd rather not run Windows at all (alas, I enjoy PC gaming too much), but even just the addition of Aero makes it a much more enjoyable experience than XP for me. UAC is also clearly the right thing to do, and, begrudgingly accepting Microsoft's need to maintain backwards compatibility, they did a pretty good job of it. I've also had very few problems.

</comment><comment><USER6> I have been using XP for years now (on my tablet for over 3) and it has been reliable. After lots of research and colleague input I decided to actually wait to upgrade my machine entirely so that I could avoid the entire vista fiasco (wasn't in the mood of paying more for a downgrade).

A buddy of mine has been using 7 as his main OS for a bit now and tells me it is greatly improved over Vista. I hope its true because I am not totally comfortable using Linux as my main OS and I would love to get a new Windows machine soon...

</comment><comment><USER7> I'm currently running Windows 7 on my laptop. It's a lot more responsive and stable then Vista, so this is no surprise.

</comment><comment><USER8> And I managed to miss out on the half-off preorder. Sigh.

Hopefully they'll run another one before release day.

<comment><USER9> Can someone explain to me how the whole half-price sale made sense?

The general tone of Windows 7 seems to be "Vista done right." As a similar example, Apple's tact with 10.6 is "Leopard, but better," and has decided to price Snow Leopard at $29 as an incentive to upgrade.

Microsoft seems to have far more at stake in Windows 7, and most average users who might be interested in upgrading have likely missed out on the half-price sale. (Hell, I'm about as tech-savvy as they come, and I completely forgot to order my copy.) Doesn't it make sense to leave it at $50 for quite a while longer to get people to upgrade?

<comment><USER10> Well, I think the half price sale was a very smart move on Microsoft's part. By the end of the promotion, it was sold out on Newegg.com, and it dominated the software category on Amazon. This created a lot of buzz and demand over a short period and generated a lot of positive publicity.

Microsoft's biggest mistake with Vista was not controlling the PR. This promotional campaign lets Microsoft create a big enough lead-in demand so that it will continue to build until the actual release date.

In the end, IMHO, I think that Microsoft will continue to offer these promotions for its retail customers up to and after the official launch. Hopefully they realize that, for retail buyers, Windows 7 MSRP is still too high. They need as many people as possible upgrading, but not at the expense of the corporate buyers. Therefore, I think they will continue to offer promotions for retail buyers at pretty heavy discounts.

I'll also chime in to say that I was pretty impressed when running Windows 7 RC for a few days to test it out. Coming from XP, it was very fast and intuitive interface. I ordered 2 copies of the Professional Upgrade edition during the promotional period.

</comment></comment></comment><comment><USER11> Congrats to the guys at Microsoft.

<comment><USER12> I don't work on Windows, but I'm sure the guys over on that team really appreciate the sentiment. After all, most of them are hackers too!

</comment></comment><comment><USER13> I'm about to build a gaming PC, so I need to buy Windows. I use Linux for everything normally, so I don't keep up.

Is Windows 7 supported by all the major games (FPS/RTS)/drivers, etc? Is it recommended for a gaming PC, yet? What version should I get, for a dual core 8GB machine? Home edition enough?

<comment><USER14> I've been playing with Win7 64bit on a quad core/4GB ram setup with NVidia graphics since the RC came out. I've ran a few steam games, DoW2, warhammer online and not had any problems with them.

The graphics card manufacturers seem to have Win7 drivers out already. I've also found that running vista drivers seem to work fine too.

</comment></comment><comment><USER15> A half-price pre-order deal on the full (not upgrade) version runs in the UK until 9 August.

But, somewhat infuriatingly, the Windows 7 EULA isn't yet available (<http://www.microsoft.com/windows/windows-7/eula.aspx>), so I'm left wondering whether "Home Premium" will be licensed to run in a virtual machine, which is the only reason I'd be buying it.

</comment><comment><USER16> In the EU, how will people download Firefox if they don't have a boot-strap browser already available?

<comment><USER17> a friend's USB drive...

<comment><USER18> Yes, that's correct.

[http://www.amazon.co.uk/gp/feature.html/ref=amb_link_8436755...](http://www.amazon.co.uk/gp/feature.html/ref=amb_link_84367553_1?ie=UTF8&docId=1000321063&pf_rd_m=A3P5ROKL5A1OLE&pf_rd_s=special- product- offers-3&pf_rd_r=0A52C6F2NNGBDRA0QKND&pf_rd_t=201&pf_rd_p=470371993&pf_rd_i=B002DUCMTC)

</comment></comment></comment><comment><USER19> Requires a clean install? Is this really the state of the art in the Windows- world?

</comment><comment><USER20> Was tempted myself, but the installation seemed aimed at individuals who are not particualarly computer savvy (really awkward to format and reinstall) and their biggest concern is that they are pissed off at vista (Not using it).

So close MS, almost made me buy an OS for the first time(Aside from OEM includes).

<comment><USER21> Seriously, a visually updated install process put you off the whole OS?

<comment><USER20> I should have included the caveat, I am currently using the RC at home and love it. My problem is installing Vista/XP so I can install Win7 every 6 or so months when I want to format my computer.

<comment><USER22> Have you ever actually installed an "Upgrade" of Windows? You don't need to install Vista or XP first to use an upgrade version of Windows 7. Indeed, just having an old Windows 7 install on your machine is more than enough.

<comment><USER20> That is exactly my point. I want to install a fresh copy of the OS. Not pave over the previous instance.

<comment><USER22> Let me make it clearer for you: _you can do this with the upgrade DVD_.

</comment></comment></comment></comment></comment></comment><comment><USER23> So, one concludes that that Vista 7 has more hype than Vista had? Is that what should I be getting from this?

<comment><USER24> That a large number of people are familiar with Microsoft's pattern of: Screw one up and "fix it" with the next major release?

</comment></comment><comment><USER25> No surprise there. The devil (angel I guess in this case) is in the name and user's perception. People are familiar with the name Windows and 7 means a better version. Vista means something totally new and after years of being comfortable with Windows why switch to something new.

</comment><comment><USER26> Honest question: who in his sane mind pre-orders an OS???

<comment><USER20> 50% off is a pretty good incentive to do so. However, I heard a lot of people were burned when they preordered vista. And I don't just mean they paid good money for a shitty OS.

<comment><USER21> Oh wow I didn't realise it was 50% off.

</comment></comment></comment><comment><USER27> I note it repeats the lie that Microsoft took IE out because of an EU ruling. I can only hope this plan backfires on them and people install Firefox or Chrome instead.

<comment><USER21> Why is this voted up? This is just irrelevant and incorrect Microsoft bashing. Microsoft didn't take IE out of all copies, just EU copies.

"Because of a recent European Commission anti-trust ruling, Windows 7's European version will not be integrated with Windows' Internet Explorer, meaning that a browser will have to be installed separately."

<comment><USER27> As I said, that line you quote, from this very article, is not true. That makes my point both relevant and correct "Microsoft bashing" and you, on the other hand, are just misled by the very PR spin I'm calling attention to.

Can you show me a link to this "ruling"? No you can't. Why not? Because it's not happened yet. And when it does happen, the EU has been pushing for the installation of multiple browsers with a choice at startup.

Removing their own browser from the Euro version was an attempt by Microsoft to head off that ruling. Obviously they felt that either a) people would be more likely to install Internet Explorer this way, and/or b) that the negative reaction could be skilfully deflected onto the EU.

Sadly, part b) appears to be working judging by our posts relative scoring at least, again I can only hope they're wrong about a) and this leads to a further increase in market share for non-Microsoft browsers in Europe.

<comment><USER21> Ah I misinterpreted your comment as "non-EU copies have IE so Microsoft wasn't forced to remove it everywhere". I see what you mean was that even in the EU Microsoft isn't forced. Having understood that, they were getting pretty hefty fines there and this along with other measures went somewhat to fixing that.</comment></comment></comment></comment>


Will hosting in the US as a non-US business have any legal differences? - <AUTHOR> If you're hosting a service in the US (When you're not a US resident.) will that have any legal differences between hosting in ex. your own country (Let's say UK.)
Let's say a person in the UK has a business website call foobar.com and it's hosted in the US, will that be an American business or a business in the UK.
I'm aware that the business would be a UK business if it's registered as a business, so I guess the question is only partially relevant to non-registered businesses etc.
Note: This can really be between any country and the US. I just used UK as an example. <comment><USER2> This gets perilously close to ask a lawyer / ask an accountant, but the non- legal-advice version is "What motivates the question of whether a US-hosted website is 'an American business'?"

If a hypothetical entrepreneur is concerned that hosting with an American company might bring their data within the orbit of the American legal system, then that hypothetical entrepreneur should probably model American companies as routinely honoring lawful orders from the American legal system, and should probably model the American government as a first-world democracy which is very capable of getting a warrant for data hosted on domestic systems and, given that they have satisfied internal rationales to request a warrant or similar process, would feel substantially no additional barrier was raised by the owner of that data being a non-US person.

If a hypothetical entrepreneur is worried that hosting in the US will result in their business becoming a US-registered business, the hypothetical entrepreneur may feel happy to know that registering a business in the US is something that actually takes non-trivial work and that renting a server is neither necessary nor sufficient.

If a hypothetical entrepreneur is worried that hosting in the US might cause their non-US business or themselves personally to have income [effectively connected] with [a trade or business] within the United States that hypothetical entrepreneur should talk to an accountant and be prepared to give a _very_ thorough accounting of the facts. Note that the hypothetical entrepreneur is not uniquely at risk there due to their hosting situation; there exist a wide variety of things which constitute a trade or business or could cause the American authorities to believe that a trade or business is being conducted in the United States.

I have taken the liberty of bracketing certain words in the above paragraph which are terms of art in tax administration, for your ease of searching for further information or discussing them with your professional advisors.

Please note that it is not the case that the US and a nation of your choice will _necessarily_ agree that because a business is "an American business" for any of the above purposes that it is not simultaneously "a $NATION business" for the same or different purposes, in whole or in part.

<comment><AUTHOR> Thank you for the information, that was a really great answer</comment></comment>


FFI and Ruby 1.9.2 | - <AUTHOR> http://engineering.attinteractive.com/2010/09/ffi-and-ruby-1-9-2/ <comment><USER2> That's actually pretty neat.

Though it might be just me, being spoiled by ActiveRecord, but wouldn't it be awesome to just instantiate an object that automatically reads the exported functions in a library and makes them available to Ruby? Like what ActiveRecord does with database tables.

I guess if no one else thinks of it I could do it sometime.

<comment><USER3> This is a lot harder than it sounds. A library doesn't contain any indication of the type of the functions inside, just their names. You could instead read the header to get the types, but that requires that the development package is installed, oh and also you have to be able to parse arbitrary C code. Yikes!

Thankfully, someone's done a great part of the work. MacRuby and PyObjC need to be able to call C functions, so Apple threw together BridgeSupport: <http://bridgesupport.macosforge.org/trac/wiki> . It uses the clang front-end to parse headers, and outputs an XML file with the function info. It would be really cool if you could do this on non-Mac platforms, presumably it wouldn't be terribly much work...

<comment><USER2> True, I forgot about that, that only the names of functions are called. Though I don't think it would be that hard to create some sort of binary/assembly code parser to run over a library to extract out the number of parameters & return values for a function. In general all C like languages share a similar calling structure when viewed in assembly.

The tricky part as I see it would be to identify the parameter types, which could be done with some sort of heuristic that analyses the functions called on each parameter, or more easily by parsing a header file provided with the library.

Then you would have a tool that takes in a header and a library and spits out a class that wraps that library automatically. However it wouldn't be nearly as clean, transparent, or neat as what ActiveRecord does. Still would be a useful tool to have.</comment></comment></comment>


Born to Build, Not to Play: an Entrepreneur's 'Curse' - <AUTHOR> http://www.nytimes.com/2007/10/28/business/28invent-side.html?ref=business <comment><USER2> Build = play.

</comment><comment><USER3> I hope I am 'cursed' with Entrepreneurship.</comment>


Ask HN: video manipulation libraries? - <AUTHOR>

Anybody has any good/bad experiences with libraries that do programmatic video manipulation? Especially something that can be driven by a scripting language. Free/inexpensive if possible...<p>Thanks in advance! <comment><USER2> [http://stackoverflow.com/questions/651759/c-grab-frame- from-...](http://stackoverflow.com/questions/651759/c-grab-frame-from-wmv- file)

[http://stackoverflow.com/questions/44161/real-time-wmv- video...](http://stackoverflow.com/questions/44161/real-time-wmv-video- encoding-in-c)

</comment><comment><USER3> Like what exactly?

I've found ffmpeg and OPENrtsp both pretty easy to setup and use for basic video conversion and simple stuff. Not sure though if you're just trying to convert to a different format, add watermarks, detect scene activity, or something different.

<comment><AUTHOR> One thing I want to do is to interleave video from 2 cameras to do something like this:

<http://www.well.com/~jimg/stereo/stereo_list.html>

for a movie instead of a single picture.

So, something that I can use to slice and interleave 2 movie clips would be useful.

<comment><USER3> Holy crap, that is nausea-inducing.

If you didn't want to do it in real-time you could do this with ffmpeg and some perl (or whatever).

ffmpeg can turn a movie clip into a series of sequentially-numbered jpgs (or GIFs or PNGs). Take both the movies, convert them to a shit-ton of images, and then feed a series of images back into ffmpeg to make a movie. Basically take all the Even-numbered image files from the left camera, and the odd's from the right camera and squirt them back through a script and ffmpeg and out to a movie.

</comment></comment></comment><comment><USER4> For anything related to computer vision, OpenCV: <http://opencv.willowgarage.com/wiki>

It also includes a bunch of useful generic image processing routines like scaling, convolutions, etc.</comment>


Happy 35th birthday to Apple, Inc. - <AUTHOR> http://www.tuaw.com/2011/04/01/happy-35th-birthday-to-apple-inc/ <comment><USER2> Not bad given the conventional wisdom 15 years ago that Apple was a dead company walking.

</comment><comment><USER3> ...and a beautiful day in Cupertino for the on-campus beer bash.

</comment><comment><USER4> I am not a fanboy, but Microsoft started almost exactly 1 year before, and hasn't faced an existentialist crisis in it's lifespan. It is actually rare among companies to have gone from strength to strength almost year after year.

While some products like windows 95 inspired very long queues on launch day, the crowd I associated with never thought much of them. Infact some of them made expensive mistakes with os2.

Today I am a consumer of both apple products and steve folklore, and sometimes get confused as to where fantasy ends and reality sets in.

</comment><comment><USER5> As a former Apple ][ owner, it makes me sad to see that the Apple I used to love and admire has become the very evil entity they set out to destroy in their seminal 1984 Superbowl commercial.

<comment><USER6> You cant have one thread about apple these days without some idiot coming in and spouting the evil bullshit. Oh no, they have a different business model, how evil of a corporation for wanting to make money.

<comment><USER5> All corporations want to make money, what makes you think Apple is different?

They have turned evil in the sense that they are restricting developer freedom, overwork their employees (who are happy to oblige, at least in the US, but that doesn't make it right), play the patent game to stifle competition, and all in all, are behaving in worse ways than Microsoft ever did. Thanks to Android, they have had to back off on some of their initiatives, luckily.

The only reason why they're getting away with all this is because they are producing pretty good products overall, but again, this doesn't make it right.

</comment></comment></comment><comment><USER7> wow, Apple is young :)

</comment><comment><USER8> One Company that not only handled mid life crisis well, but actually came back with a vengeance to rule the industry it kickstarted. Hat's off to AAPL!</comment>


Ask HN: Should I launch in my local city or abroad? - <AUTHOR> I have an app with a target market.  I can launch in my local city, which isn't really known for startups, has a very small market.  Or I can launch abroad and fly there for a 1-2 months and try to launch it there.  Launching abroad has a much larger market size, but I don't know anyone there.<p>Should I simply try to launch in my local city and see if my business model works first? <comment><USER2> In my own entrepreneurial efforts, I've found it to be tremendously useful to test-market any product on a small scale before pouring a ton of time and money into it. Doing so can tell you lots of things that you might not know, such as what aspects of the product customers value the most, what desperately needs changing, whether it's priced too low or too high, or whether there's even really a useful amount of demand for it in the first place.

So, I would always recommend launching locally as a test. Gather data, do customer interviews, watch people using it in real life, and so forth. Then regroup and digest what you've learned, iterate your product based on that, and follow up with a larger scale launch.

</comment><comment><USER3> What's the service? If it's a local one, you're way better off doing it in a market that you are familiar with (your hometown). Not sure what you really mean by "not known for startups" and that shouldn't matter. If your app provides a useful service, people will use it.

There are many other unknowns launching in a city you are entirely unfamiliar with, especially if you have to move there.

It comes back to what the app actually does. Do you have to be in the city to launch it? Is there an offline component of it? If the answer is yes, stay home.

</comment><comment><USER4> Launch where you can get the most number of customers, that also have the most money, and will hand you that money the fastest. This will yield less time to get to more money, the cheapest.

</comment><comment><USER5> Why not both? I did a soft launch with one app in Malaysia, but after a few months, the majority of users are in US and UK. If it spreads, it will likely end up wherever your target market is.

<comment><AUTHOR> That's a good point. I guess the most important point is to launch first and decide later. Thanks.

</comment></comment><comment><USER6> Does it matter if your local town isn't known for startups?

<comment><AUTHOR> I am not sure. According to Paul Graham, it seems to matter.

[http://www.paulgraham.com/startuphubs.html](http://www.paulgraham.com/startuphubs.html)

<comment><USER6> I guess when I read launch I was just thinking the app itself was focused on that city. I wasn't thinking of it in terms of your business based out of there.

If it was just the app and the app has some local components then a city you know could be helpful.

If we're talking establishment of a company, employees, etc, that is something else and way beyond my knowledge ;)

</comment></comment></comment><comment><USER7> Launch remote</comment>


Facebook computers compromised by zero-day Java exploit - <AUTHOR> http://arstechnica.com/security/2013/02/facebook-computers-compromised-by-zero-day-java-exploit/

<comment><USER2> Aaaand that's why I don't have the Java plugin installed. Anywhere.

I'd like to think that we're almost to the point of viewing Java in the same light as Bonzi Buddy or Comet Cursor; IT discovers you got Java on your computer again, they just sigh and re-image it, with some stern warnings to please not download such sketchy software.

<comment><USER3> I wish that were the case.

Large companies tend to have important enterprise applications that require Java to run and, even worse, in some cases _upgrading_ the version of Java on the user's desktop will break the application. You then end up with hundreds or thousands or users with vulnerable versions of Java on the PC that you _can't_ upgrade until the software vendor fixes whatever is wrong with their application.

I've seen it countless times at my previous job (.edu with 1000s of staff and faculty) where we were basically helpless to do anything because absolutely critical applications would break if we upgraded Java on the desktop.

Solution: closely monitor traffic to/from user's PC's, hope for the best, and re-image when they inevitably got pwned.

Before someone chimes in with the obvious "switch to a different application", it's not that easy when you have millions invested and training the user base sometimes takes _months_.

Yeah, I hate Java.

<comment><USER4> > Yeah, I hate Java.

What about C and C++ induced security holes?

<comment><USER5> Indeed. Compare the number of Java vulnerabilities (plugin vulnerabilities included) with the number caused due buffer overflows and such in C/C++.

</comment></comment></comment></comment><comment><USER6> If your default browser still has the plugins enabled for Java, Acrobat and Flash you are asking for it.

In Chrome: go to chrome://plugins and disable all

Safari: Preferences, Security uncheck 'Enable Plugins'

Firefox: Tools > Addons > Plugins Tab > disable all

Don't use Flashblock or Javablock or similar extensions, they hide the applet, they don't stop execution.

You should _always_ use a browser with all plugins disabled as your default browser. Run a second browser for trusted sites where you enter the URL in yourself.

<comment><USER7> True. But once those plugins go away, something else will become the new low hanging fruit. Personally, I wonder how well WebGL will hold up, given that 3d graphics drivers are absolutely not written with security mind, and were never really intended to be hooked up to the web...

<comment><USER8> Microsoft is refusing to support WebGL for security reasons. I can't make up my mind about whether to be annoyed or impressed.

<comment><USER9> As with many (but not all) things Microsoft do, when the thick layers of gelatinous hivemind diatribe are pealed away what's left are sound, conscientious engineering decisions made by an organization with a near pristine history of supporting end users and going to extraordinary lengths to preserve backwards compatibility.

As for instances where they have not preserved support and compatibility, Silverlight comes to mind, and they dumped that largely in favour of frameworks targeting HTML+JS.

(I'm not a Microsoft employee, just a user who appreciates the APIs I cut my teeth on 20 years ago remain applicable today)

<comment><USER10>
      | when the thick layers of gelatinous hivemind diatribe
      | are pealed away what's left are sound, conscientious
      | engineering decisions

Like waiting years to take security seriously? :P

<comment><USER11> That's covered by the "backwards compatability" item.

<comment><USER10> It took them a while to even take patching security vulnerabilities in a timely manner seriously. I can understand that secure design (e.g. not running everything as admin) could fall under "backwards compatibility."

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> > Rather than using typical targeted approaches like "spear phishing" with > e-mails to individuals, the attackers used a "watering hole" > attack—compromising the server of a popular mobile developer Web forum and > using it to spring the zero-day Java exploit on site visitors.

> "The attack was injected into the site's HTML, so any engineer who visited > the site and had Java enabled in their browser would have been affected," > Sullivan told Ars, "regardless of how patched their machine was."

It seems it's high time now to start working with two separate profiles in a browser if you're forced to use Java - one internal-only with Java enabled, and the second for browsing the internet, with Java disabled (of course this works as long as your internal apps do not get hacked...).

Rather easy to achieve with Firefox (probably there are command line switches for Chrome as well):

1\. Create two profiles, `external` and `internal`, using `firefox -p`

2\. Open external profile and disable Java (will be kept in profile settings)

Then, run first `firefox -p external`, then `firefox -no-remote -p internal`, that way links opened e.g. from email clients will go to the external instance.

To differentiate the two instances, you can install some theme: <http://www.getpersonas.com/en-US/>

Total paranoiacs could try to find/write some extension that will block all the pages other than approved internal ones in the internal profile (perhaps AdBlock Plus will do?).

<comment><USER13> I think the separate profiles is the better looking tinfoil hat. For everyday browsing Adblock is nice, but I think it falls short. Throw NoScript and RequestPolicy into the mix and it gets a lot better. My friends always laugh when they watch me browse the web because I have to enable javascript for any new site and then use RP to allow that site to make requests to other domains.

<comment><USER7> I also use that approach, and while it sometimes gets annoying I am really glad for choosing it when I, once again, stumble upon some page that would like to load crap from 20 other domains.

</comment></comment></comment><comment><USER14> This happened last month, so it was 0-day THEN, not NOW.

The hole in question was patched in the February 1st Java release.

This is news because it shows how Facebook was affected by the many unaddressed security holes that were present in Java (and how it could be run -- last month -- silently), but this is NOT news of new holes in Java.

So far the latest (quite significant) fixes seem to have been effective.

</comment><comment><USER15> __"The attack was injected into the site's HTML, so any engineer who visited the site and had Java enabled in their browser would have been affected," Sullivan told Ars, "regardless of how patched their machine was." __

It's criminal how Oracle can release production code with so many security holes. It seems like every week there is a new new Java based exploit.

<comment><USER16> Some of these vulns are extremely old. I read the Oracle security bulletin which says some of them dates back to _1.4.2_. (Oracle is still willing to support such old versions if you pay for it)

</comment></comment><comment><USER17> Any ideas on which "waterhole" website was compromised?

<comment><USER18> I would suspect that it would be related to Android development given that (1) Android SDK requires Java, (2) Facebook develops a native Android app, (3) Facebook does NOT develop a native Blackberry app (other mobile SDK using Java), and (4) the identified engineer(s) were on the mobile team.

<comment><USER19> Having the Java plugin installed does not mean they were doing Java development. It could have been iOS engineers and they had the plugin enabled so they could access some internal application.

</comment></comment></comment><comment><USER4> Browser plugins are bad and should be eradicated.

But that is only half of the way, because thanks to C and C++ runtimes, they are still open to security exploits triggered by buffer overflows, strings misuse, use after free, double deallocation, array access out of bounds, stack overflow, pointer misuse...

The only safe way is to use a separate VM for browsing, or failing that, run the browser under a different user account with limited user rights.

</comment><comment><USER20> The only reason I still have Java installed on my OSX machine is to use a SQL Server management tool. If I were to run that in a virtualized environment by installing Parallels and running a separate instance of OSX in that virtual environment, would that completely isolate Java to that one "box" and protect the rest of my environment?

<comment><USER21> Does the management tool run as Java web page plugin, or as a standalone Java application? If it's the latter, just disable the Java plugin in all of your browsers and you should be safe.

<comment><USER20> It's a Java application (www.dbvis.com) so I guess if I disable the plugins I should be good. Open to any alternative suggestions.

</comment></comment></comment><comment><USER22> _"The attack was injected into the site's HTML, so any engineer who visited the site and had Java enabled in their browser would have been affected," Sullivan told Ars, "regardless of how patched their machine was."_

How can one find out if one has been infected?

</comment><comment><USER23> How long will we wait and shrug our shoulders until we start blaming Oracle and looking for assurances this doesn't happen again? 'Free' services continuously disappoint me, notwithstanding FLOSSware.

Perhaps there is a mole at Oracle leaking security holes elsewhere.

</comment><comment><USER24> It is an excellent idea to always use click to play for all plugins.

</comment><comment><USER25> I wonder what the most practical but effective defense against these kinds of exploits would be?

Company-wide install of NoScript? But that wouldn't save you if a trusted site got compromised.

Maybe they should prohibit use of all commonly targeted software? (Flash, Acrobat Reader, Java..)

This seems really serious. Surely someone must be working on a better way to protect against this kind of thing?

<comment><USER12> Regarding the corporate users, I think actually most of them should not need any of those 3 plugins enabled:

1\. Acrobat Reader plugin: use some less popular PDF reader which is not that commonly attacked

2\. Flash: you shouldn't play Flash games in the office ;) For Youtube, you can enable HTML5 version in modern browsers

3\. Java: IMO it's mostly needed in IE6-dating web apps but I might be very naive here...

Regarding Acrobat: there's a built-in PDF reader coming in Firefox soon (pdfjs). Currently I do not use any plugin, just make the browser download a PDF and render it in SumatraPDF or PDF Xchange Viewer.

<comment><USER26> Sometimes you really need Acrobat though. For fill-in PDF forms none of the other "readers" really do an adequate job.

<comment><USER27> _For fill-in PDF forms none of the other "readers" really do an adequate job._

That is not really relevant to a browser plugin. You can download and fill in PDFs with whatever application you like without browser plugins.

<comment><USER12> Exactly. BTW are the fill-in PDF forms that prevalent? I've only been using them once a year to fill my tax declaration which sadly requires installation of Adobe Reader plugin in Poland. I feel the corpo world prefers Excel for that kind of things :)

</comment></comment></comment></comment></comment><comment><USER28> Isn't the Skype plugin for Facebook video-chats made in Java, too? Sounds to me like Facebook should be one of the very first companies to want to adopt WebRTC. Not only will they become independent of Skype for video-calls, but they can offer it for everyone inside the browser, too, instead of getting them to install plugins. Hopefully they intend to make it federated though, rather than keeping it Facebook-only.

<comment><USER29> That's presuming Web browsers won't have any bugs in how they do webrtc that could allow someone to take over the browser.

Web browsers sometimes have bugs like this. I believe iPhone 1.1 had a bug in TIFF images that people used to jail break the phone

<comment><USER30> Presumably it could be sandboxed for security, being a feature of the browser itself, which Java can't be.

<comment><USER29> Sure, but what if there's a bug with your sandboxing and code can escape the sandbox? There is no magic bullet.

</comment></comment></comment></comment><comment><USER31> Are there any good malware scans for Mac? Obviously it's not going to prevent a novel attack, but I'd like to see if I'm infected with this or other known attacks.

</comment><comment><USER32> I have two banks, that require me to use Java. Please, banks, stop using java, so we can finally get rid of that POS.

<comment><USER27> Agreed. But for anything that needs a browser plugin, you can run it in a VM, if it is your own hardware.

VM software is often free and extremely useful anyway for developers or security.

</comment></comment><comment><USER33> Java is that prevalent to make it a good target, or it is full of holes making it a easy target?

Also this must be (more) very negative pr to Oracle

<comment><USER34> It's complicated.

First, yes, Java is _that_ prevalent. There's no a single corporate company out there were there's not Java devs. As simple as that. Then Java is also on so many systems even outside the corporate world: both Windows on OS X. It's typically not there by default but on Windows it depends on who ships the machine. On OS X now at least they don't ship it by default but it's trivial to install.

But really the problem ain't Java but Java applets.

Java as in "The JVM" is actually not bad at all on the server side: on the contrary, it's very robust. There are have been two very lame exploits in 2011 allowing Denial of Services on Java webservers, but no remote exploit working on Java _servers_.

The problem is Java on the client-side: i.e. on people's computers. In other word: the issue is pathetically lame Java applets.

Java applets have to be the most stupid, silly and insecure lame technology ever invented by Sun.

You should have been there in comp.lang.java.programmer back in the nineties when people were saying how stupid, silly and insecure a lame tech Java applets were... Only to be laughed at by the like of Jon Skeet (the most upvoted user today on StackOverflow). To most Java early adopters Java applets were "the nuts". Supposedly _the_ one tech going to solve all our problems.

It "only" took close to 15 years to prove wrong all the retards who thought Java applets were a good thing.

And now we're in this big mess.

For end-users it's easy: remove Java or disable Java applets.

But for the corporate world it's not so simple: many devs are, well, Java devs. Because Java is pretty much what powers the corporate world (hint: no, it's not Excel).

Then even if most apps tend to be webapps now, there are still a lot of in- house apps which are Java apps and corporate drones do _need_ to use these apps.

Then there are all the Android / dalvik devs: world is moving to mobile and Android is _huge_. Hence Java is huge.

Hence you can count on many, many, many more Java exploits being used to infiltrate companies.

Companies whose users / devs are using very poor security practices anyway.

<comment><USER35> _But really the problem ain't Java but Java applets._

Don't know about you but I find it fascinating how many comments fail to make a distinction between the vulnerable 'javaws' (i.e., applets) and the far more common 'java' vm. This 'mistake' illustrates both java competitor astroturfing and simple ignorance on the part of those commenting. Are there other potential reasons so many don't know or intentionally obfuscate the difference between java and javaws?

<comment><USER4> Plain ignorance.

Many don't even make a difference between Java the language and Java the VM with all its multiple implementations from vendors all around the World.

This security exploits most of the time are only relevant to Oracle's VM.

</comment></comment></comment></comment><comment><USER34> Defense in depth.

People should _really_ all consider doing what I do: install a throwaway VM on your system from which you surf the Web. For all the sites that I don't trust I do surf from a VM which can be erased / re-installed at will.

For sites I trust, like my GMail / Google Docs, I surf from a _separate user account_. I'm using a firewall that can do "per user" rules and I'm only using whitelists. By default no packets can be emitted. Then the user account used to access GMail / Google Docs is configured so that it can emit HTTP/HTTPS trafic.

No Java in the user accounts / VM that do surf the Web: and I'm a "Java" dev (Java + Clojure). Java can be installed only for one user account on Linux, without needing to be root.

Wanna do online banking / MoneyBookers / etc.: boot a read-only Linux CD / DVD.

Yes, it is slightly more inconvenient than using your main user account to surf the Web. But so far security and conveniency haven't exactly been good matches yet.

The state of security today is really terribly bad. It is so bad that I'm going back to a "stupid" Nokia S40 phone until things settle down.

<comment><USER36> > Yes, it is slightly more inconvenient

That's not just inconvenient, it's verging on paranoia. Most people haven't got the time or the processor cycles to spare to run a separate VM. What's wrong with just disabling plugins for all but trusted sites?

<comment><USER37> There are lots of browser bugs which aren't plugin related at all. Lots of DOM/parser/JS stuff; the most popular bug class at the moment is use-after- free.

</comment></comment></comment><comment><USER38> Wonder if those laptops were running Windows, OS X or Linux.

Hard to find details on that, anyone know?

<comment><USER27> Why would it matter? The initial attack vector is the same no matter the OS: Java in the web browser.</comment></comment>


Apple style span is gone - <AUTHOR> http://www.webkit.org/blog/1737/apple-style-span-is-gone/

<comment><USER2>
      We also use an Apple-style-span to wrap the copied
      contents to preserve the style of the copied content.

And in here lies the problem with the entire approach, you might even call it a misguided copy&paste philosophy. Not only does this produce a lot of clunky code that often still doesn't come out quite right, it butchers the document you are pasting into. It causes problems that are impossible to solve for users who don't know how to edit HTML source.

For example, if I copy a title header and some body text from a website into a CMS editor window, chances are I want them to appear as a title and text element that is in sync with my site's CSS. Instead, the browser tries to preserve the original style (a task at which is usually fails too). This forces users to paste that text into a plain text editor first in order to strip all formatting, and then they painfully transfer the plaintext back into the HTML editor and reformat it.

This workflow is broken and it's so easy to fix: just throw away all the "integration" code that gets triggered on paste. Everything would just magically work after that. So throwing out the Apple wrapper is definitely a step in the right direction.

</comment><comment><USER3> Finally! This is a really great write-up, had no idea it would be such a big issue to solve.</comment>


Cryogen: a friendly static site generator - <AUTHOR> http://cryogenweb.org/

<comment><USER2> Do you not see the contradiction in advertising something as "friendly" and "made easy", then having the first "Simple" bullet be "Shipped as a Leiningen template"?

You're pitching at (non-technical?) users who want a static site generator, and then assuming they're automatically Clojure developers.

<comment><AUTHOR> It doesn't require any Clojure knowledge to use. You simply have to install a build tool to run it. The site generation is configured entirely through config variables and templates are plain HTML.

<comment><USER3> If it doesn't require it, then don't use words you don't define in the first sentence of your webpage.

I'm currently on the lookout for a static website generator (new year, new blog). This webpage is very off putting.

The quick start guide -- install lenonwhatever, fine. The start new project? In what? When do I install your thing? Is your thing lenonwhatever?

<comment><AUTHOR> The specific commands that you have to run are listed right on the front page.

When you have lein installed, which involves grabbing the script and running it, then you simply run "lein new cryogen my-blog" and that's it. You now have your static site generator ready to go in the folder called "my-blog".

You got to the folder and run "lein ring server" to serve the site locally and watch for any changes you make. It's literally a 3 step process. Not sure what part of it you found off putting specifically.

<comment><USER3> You forget I don't know clojure. How do I install cryogen? Neither the 3 step guide, or the terminal, are complete by themselves.

I suspect you want people to do step 1 of your 3 step guide, then switch to the terminal, then switch back for step 3 of the 3 step guide? I would recommend making that clearer :) I like a guide I go through step by step, here it seems I have to follow nonlinearly.

<comment><USER4> Apparently,

> lein new cryogen my-blog

is "create a new project" and Leiningen will automatically look up what cryogen is on clojars.org and fetch the appropriate template, so you don't have to explicitly install cryogen. You really just have to install Leiningen and run the commands given in the box. But I also needed to look at the docs of the different parts to understand that, so definitively potential for improvement there.

Also, it would be nice to find out the language immediately, outside of Clojure-space most people probably don't know what Leiningen is or that it has something to do with Clojure.

</comment></comment></comment></comment></comment></comment><comment><USER5> Is the file type-based directory structure required? I find it redundant (my files already specify their type with extensions) and counter-intuitive (I'd expect to find two posts in the same "posts" directory, regardless of their type).

</comment><comment><USER6> Is there any advantage (to the end-user) of using a 'Clojure map' for the front matter of a post, rather than using YAML like site generators from other languages do, e.g. Jekyll, Wintersmith (Node), Mynt (Python).

I kinda like that my markdown files are cross-compatible with any of these various site generators and would say that YAML front matter is something of a de-facto standard?

If avoiding YAML is an opinionated stance aimed at fellow Lispers, then I think that's fair, but I think the messaging should perhaps be more along the lines of 'this is a site generator for Clojure people', not 'this is the _easy_ site generator'.

I don't think that's a bad thing, as a lot of people prefer to use a site generator written in their language of choice.

Of course this could be made a moot point by offering a YAML plugin and a single line in the docs saying '... or you can use YAML syntax if you'd prefer'.

Also w.r.t using Clojure maps, the metadata section of the writing posts [1] docs page could use a full example, otherwise I need to google Clojure map syntax.

[1] [http://cryogenweb.org/docs/writing- posts.html](http://cryogenweb.org/docs/writing-posts.html)

<comment><USER7> Avoiding YAML is opinionated :) I'm using the Clojure reader to parse Markdown files. It reads the next form from an input stream and returns the object represented by that form so by using a Clojure map to represent the metadata, there is no need to do additional parsing. The rest of the Markdown file is read line by line.

And I'll make a note to add a full example of the metadata in the docs.

</comment></comment><comment><USER8> How hard will it be to use custom layouts and custom pages using this generator?

<comment><AUTHOR> The layouts are just plain HTML with CSS or SASS.</comment></comment>


Our Google.IO HTML5 Game: Popstar Defense   - <AUTHOR>

Tom here, from Game Closure (www.gameclosure.com) -- we did a pretty ambitious game for Google IO (see youtube video here: http://www.youtube.com/watch?v=8KACnnquQRo)
Google IO was great and we probably talked to a lot of you there.  For those who we didn't, though, here's a quick overview:
Popstar Defense is a multiplayer, social game in the tower defense genre: You're a rockstar! But undead zombie popstars have returned from the grave to steal your show ~~ Only your loyal fans can save you now. (Chrome only, ALPHA):http://popstardefense.com (play code is iohtml5).
The tower defense engine we built is one of the most technically complex projects I've worked on in javascript. It uses deterministic physics to run the simulation and keep all clients in sync. It also runs on iOS, Android, and normal web browsers.
Now we need to turn this into a real game with a story, levels, balanced enemies and allies, and the whole nine yards. Are there any hackers out there who have a zany enough humor to pick this up and run with it, and know javascript well enough to tweak the engine and build out levels and content?
We're willing to pay all transportation and housing, and we can compensate you very well for 8 weeks of work. You'll be working beside some of the best javascript developers I've ever met, as well as amazing artists.
Check my profile for an email address! <comment><USER2> i'm curious about your multiplayer architecture. what does the server do? simply transport messages between clients, or run the authoritative simulation?

what was your server written in? nodejs?

</comment><comment><USER3> It's all really cool, interesting work. I'm at Game Closure now too, and I can attest that it's great fun. If you're at all interested in this sort of work (or play!), give Tom a shout.

</comment><comment><USER4> Your demo hangs at 'Connecting' in my version of Chrome (12.0). Do I need to configure my firewall or something?

</comment><comment><USER5> Hangs at connecting for me. Using 14.0.797.0 (Official Build 89638) dev on Ubuntu 11.10. And no, I didn't have the code, but cracking the MD5 in the source wasn't so hard. :D I did it only because the static....sdf.sdf.sd.f link hung on connecting everytime. :/

EDIT: HOW COULD I BE SO DUMB?! I DIDN'T READ THE ENTIRE POST, AND HENCE DIDN'T SEE THAT I DIDN'T NEED TO CRACK THE MD5 TO GET THE CODE iohtml5! WHY GOD, WHY?!!?</comment>


Social Products - <AUTHOR> http://blog.eladgil.com/2013/06/social-products.html

<comment><USER2> Off topic but Path's and Pinterest's logos sure look similar.</comment>


Ask HN: Was my submitted post nerfed / hidden / shadowbanned? - <AUTHOR> I don't submit a lot of content, but this morning I submitted this link to a WaPo article on e-cigarette addiction.
https://news.ycombinator.com/item?id=20535474
It looks like it has been hidden from the front page / subsequent pages despite what appears to be a ranking upvote.
I don't really care about the visibility, but I am curious about the moderation that might have resulted in this content getting shadowbanned. <comment><USER2> It likely triggered the flame war detector. (usually when comments > points)

<comment><AUTHOR> Hm. It does not appear to be a flame war, but I do not know the algo.

<comment><USER3> The actual HN source is not open, but some people have reverse-engineered the ranking algorithm and I think the threshold is getting 40 comments before 40 upvotes = automatically sunk.

<comment><USER4> An early version of HN is bundled with [http://arclanguage.org/install](http://arclanguage.org/install).

</comment></comment></comment></comment><comment><USER3> The best way to ask about that kind of thing is to email email@example.com (the Contact link at the bottom of the page here).

<comment><AUTHOR> Okay, I'll email and see what happens.

I also note, that this question was also nerfed.

<comment><USER4> I don't know what 'nerfed' means, but on HN, a post that doesn't get any upvotes doesn't go anywhere. That's suitable in this case, since the post was off topic and broke the site guidelines. It wasn't moderated, nor did the software do anything to it.</comment></comment></comment>


Anatomy of a Solid-state Drive - <AUTHOR> http://queue.acm.org/detail.cfm?id=2385276 <comment><USER2> _TRIM/UNMAP. A common problem with SSDs is that a host file system could erase free data but didn't have a way of telling the storage device it no longer needed that data. The TRIM/UNMAP interface lets the SSD clear the LBA (logical block addressing) entries in the FTL, giving it more free space to use in garbage collection and reducing write amplification. OS/X, Microsoft Windows, and Linux have implemented TRIM._

FreeBSD has TRIM support, too.

<comment><USER3> I feel like what they are describing is more defragmentation than garbage collection. The article uses garbage collection to mean taking sparsely filled blocks and consolidating them into a single block to free the sparsely filled ones. Garbage collection in the OO context is where you free memory the program can no longer interact with. Perhaps it means different things in different contexts?

<comment><USER4> A sparsely-filled block contains some valid data and some old invalid data, i.e. garbage.

</comment></comment></comment><comment><USER5> A picture would have been worth 1000 words here.

</comment><comment><USER6> I wonder why there aren't more products that use DDR3 memory for storage. Constant power supply and a reasonable small emergency battery seem no- brainers for server operations and you don't have these creeping failure modes as with SSD. Is it the lack of error correction? The need to refresh the state?

<comment><USER7> lack of permanence really. I have seen servers that go down for more than a few hours or even a few days. It's basically a game of chicken with your data. What happens when your power goes out for longer than you can provide backup supply to? You lose all your data that was on the DDR3.

The basic way that they deal with that is to use a two phase system. Lots of DDR3 and servers running a caching layer on them(memcached, etc...). You can buffer your writes in ram as well but that as always is a tradeoff.

<comment><USER8> "What happens when your power goes out for longer than you can provide backup supply to?" - You flush to Spinning disk.

<comment><USER9> Tough to flush to spinning disk _after_ your power goes down. So you'd have to do it continuously, which would remove most of the performance gains.

<comment><USER8> You include a battery in the package. You only need enough power to spin up the disk, flush from your RAM cache, and then power down. In fact, the DDR3 Disk Drive could include all three, RAM+Battery+Disk. Say, 64 GB RAM in DDR3 PC3-10600 1024Meg x 64 ( Crucial Part #: CT2KIT102464BA1339) for $600, 2.5" 80 Seagate ST980815A for $44, and a 10.8v, 4800mah (overkill for flushing, but they are cheap) PA3534U-1BRS battery for $19.81.

Add a charging element for battery $3.75, a controller for $5, Ram Sockets board for $4.25, Disk Interface connector for $2.00, case for $7.00, assembly for $6.50, assorted screws/packaging for $1.00.

You could sell a 64 GB DDR3 disk with backup disk for $693.5, 87% of which would be the cost of the memory itself - large such systems would be mostly the cost of the memory, as the other components (disk) don't increase in cost much, and except for the ram sockets, none of the others increase in cost at all.

Battery would need to be swapped out every four years, or so, but that would only be $20 cost each time.

<comment><USER10> Looks good, but people will forget to change the batteries and then fill the forums with complains when they lost all their data.

</comment></comment></comment></comment></comment></comment><comment><USER11> Does it make sense anymore for SSD to go through a hard drive interface?

Even SATA3 cannot keep up with a raid of SSD.

<comment><USER12> No it doesn't. It never did. However from a marketing / market acceptance perspective, it was a requirement. When you introduce a technology like flash you have to ask "Who is going to use this?" and "How?" The first mass market winner for flash was smartphones and digital cameras. Remember when Apple bought all the available Flash to launch the second generation iPhone? That flash capacity wasn't needed when people weren't building a new brand of camera or phone so some folks started putting this tech into USB sticks, and those were _really_ popular. So the USB sticks and digital cameras and USB based card readers all made the flash appear like a disk drive and that meant that it could immediately be put to use by consumers. And _that_ sort of cemented the idea that "Flash is for disks" into the minds of many people and folks have built a huge market around that.

Of course what started this revolution was memory, or EPROM to be precise. Back when dinosaurs walked the earth you stored firmware in a chip that physically had a window on the top of it. This was a "memory" chip that you would write by injecting charge into a transistor gate by forcing electrons to tunnel across to it (or out of it depending on the technology). But you needed a special programmer to do that, and to erase it, you had to get rid of those charges so you literally shined an ultraviolet light thru the window and the photons kicked the electrons right out of dodge. It was painful and the chip companies responded with something called "EEPROM" or electrically erasable programmable readonly memory. Which you could erase with a special high voltage signal on the motherboard doing the work of the ultraviolet lamp in previous generations. As density grew and the erase time shortened, manufacturers added the ability to only erase part of the memory but they could do that reasonably quickly "in a flash" as it were, and to distinguish memories that could be quickly erased from those which used older, and slower, technologies they started calling them "Flash" memories.

Of course as the article points out, Flash is nothing at all like a Hard drive, that people use it that way is an artifact. It much more closely represents the characteristics of something called "Drum Memory" [1] which, back when actual random access memory was very expensive to produce, made computers better. The reason was that a drum had a lot of heads and spun a piece of ferro magnetic material under those fixed heads. What this meant was that there was no 'seek' time, you picked the head you wanted electronically and you could read and write a few hundred to a couple of kilobytes of data. This enabled virtual memory in a big way because if you matched the amount of data on the drum with a 'page' of memory you could simply write out a page of memory or read in a page of memory faster than either tape or disk. The only problem was that you had to read all of the drum's track and write all of the track so a read-modify-write cycle meant reading in the track, modifying it, and the rewriting the entire track. Sound familiar? It should that is exactly how flash ended up working.

So here you have a random access memory that started life as a memory, but gained commercial acceptance as a pseudo disk drive, and a generation of programmers and system designers who had never heard about drum memory or considered it as something other than a curious artifact of the "before time" when people stored data as dots on a cathode ray tube for heavens sake. But they should have paid attention, because that is exactly where flash belongs. Sitting "beside" really fast dynamic ram, and even faster static ram (which is on chip and usually called level 1, level 2, or level 3 cache memory. If you remember Jeff Dean's observation about latencies every programmer should know [2], you would notice that reading 4K bytes from DRAM was on the order of .5 to 1 micro-seconds, and reading / writing 4K of memory from the network was 10 uS, and 4k read/write from disk - closer to 15000 microseconds (or 15 milleseconds). Reading 4K from flash on the PCI bus is on the order of 4 uS. Somewhere between getting it from the network and getting it from RAM. But the reason it is so much faster from the PCI bus is that you just map the PCI address space into memory space and memcpy from flash to RAM.

If you compare latency and bandwidth to going through an SSD interface you find that not only do you have a whole bunch of kernel between you and the SATA chip, which has its own protocol and drivers, you are constrained to a 6 gbit pipe which is probably shared with other SATA ports on the same SATA controller chip. From a systems architecture perspective attaching flash to your machine through an SSD plug is lame.

Now that said folks have started figuring this out. So people like Intel make PCI Flash cards, big chunks o memory like things. And all of the wear leveling is built into the flash controller just like the dynamic memory refresh logic is built into the DRAM controller. The processor sees something that looks like memory, occasionally operations take longer than expected if the controller is in the middle of something. The current challenge though is that so far folks think selling you the same flash chips that you can buy for $2/GB as an SSD should cost $200/GB as a PCI card. That math is seriously holding back flash, and the fact that the best slot to use for flash is the one your video card is sitting in (16x PCIe) and Intel has yet to add another 16x PCIe port for non-volatile memory cards, or added architectural support for putting PCI address resources into the page table. That will happen though, when I can't predict but it will because people keep asking for it and it makes some really killer server architectures possible.

[1] A pretty decent write up on drum memory from Wikipedia - <http://en.wikipedia.org/wiki/Drum_memory>

[2] A github copy of Jeff Dean's observation updated with Flash SSDs - <https://gist.github.com/2841832>

<comment><USER13> This comment is God like - do you have a blog or the like where you keep details of your thoughts?

I think I just got a blast of the future of server architecture, future latency and the end of HDDs reading this - many thanks :D

</comment></comment></comment><comment><USER14> Mojibake from acm.org?

<comment><USER15> I don't see any mojibake?

<comment><USER14> Yeah, it looks like they fixed it. All the apostrophes were misconverted most likely from Windows-1252 when I read this yesterday but they are fine now.

</comment></comment></comment><comment><USER16> When I see anatomy in a title, I expect to see pictures.</comment>


The Atlas of Remote Islands - <AUTHOR> https://atlas.conordoyle.io <comment><AUTHOR> Inspired by Judith Schalansky's award-winning book of the same name. I built it using React, Redux, and Styled Components.

</comment><comment><USER2> Doesn't work on Safari. The author missed Socotra, Galapagos and Escudo. Basically, the best ones.

<comment><AUTHOR> Thanks for the heads-up... I admittedly have only tested it in Chrome and Firefox so far, and since it's just a non-commercial side-project of mine I'm not too worried about it working in every browser.

You're right about Galapagos though, and 'Socotra' and 'Escudo' have given me two more things to google! :)

<comment><USER2> Anyway it's a cool project :) Yup they're amazing ;) Pay them a visit maybe</comment></comment></comment>


Show HN: Success Bot – Onboard users faster with in-app recommendations - <AUTHOR> Hi, HN — My name is Aaron Joyce. I'm one of the co-founders of Traitly (https://onboarding.traitly.com). Traitly helps SaaS companies to better engage their users by providing them with intelligent recommendations, using machine learning-powered tools.
Today, we're releasing our first public beta product - the User Success Bot. It enables SaaS companies to onboard new users faster and more efficiently. It can be added to your site with just one line of JavaScript.
We fetch user and event data in real-time from third-party services, like Segment, Mixpanel, and Intercom. You can specify a how-to for each event a user can perform inside your app that helps them get set up. You have the option to determine the order in which events are shown in the User Success Bot.
As a user completes an event, we update the list of items shown in real-time and increase their progress score. This helps to gamify user onboarding.
Onboarding doesn't just happen during the user's first session. The User Success Bot isn't only shown to users on first sign in - it encourages your users to complete key events inside your app over time (second, third sessions, and subsequent sessions).
We'd love to get your feedback on the product! <comment><USER2> Sounds interesting. We use Segment to track what users do inside our app. How does this data work with your widget?

<comment><AUTHOR> Co-founder here. We use Segment Webhooks to access your users' real-time data feed, for example, who your users are and what they do inside your app. Whenever a user completes an event in your app (for example, create a project or add a user), Segment sends a message to the Traitly platform and Traitly checks whether the event the user performed is a key event shown inside the User Success Bot. If it is, we remove it from the list of key events the user sees and we increase their progress score. If you need any more information on this, feel free to follow up here or contact me directly at email@example.com</comment></comment>


It's Not "Publish or Perish" but Rather "Do Great Science" - <AUTHOR> http://www.thespectroscope.com/read/its-not-publish-or-perish-but-rather-do-great-science-by-lenny-teytelman-258

<comment><USER2> See [http://www.smbc-comics.com/?id=2495](http://www.smbc-comics.com/?id=2495)</comment>


Nitrates and Ammonium - <AUTHOR> http://bigideas.network/energy-and-matter/chemistry/compounds/nitrates-and-ammonium/ <comment><USER2> This is an area where genetic modification can really help. If plants improve their nitrogen efficiency then both the total amount of fertilizer and the runoff can be significantly reduced.

[http://www.isaaa.org/resources/publications/pocketk/46/defau...](http://www.isaaa.org/resources/publications/pocketk/46/default.asp)

</comment><comment><USER3> I am surprised it is that low.

</comment><comment><USER4> So? Most of the water in our bodies probably passed through industrial water treatment plants, too.

Also, the website is down.

> Resource Limit Is Reached

<comment><USER5> Are you responding to a since changed title?

I think the main point in the article is that fixed nitrogen is incredibly important to modern society and that we are not paying enough attention to one of the consequences of that.</comment></comment>


Ask HN: Please Review my site - Free Anonymous HTML Hosting - <AUTHOR> http://pastehtml.com

<comment><USER2> What does anonymous mean? ie. Do you keep a log of IP addresses tied to the content uploaded, and where are the servers located?

<comment><AUTHOR> Well, it really means that you don't have to register or log in.

<comment><USER3> "... without registration" is the phrase then.</comment></comment></comment>