Leaked document: EU Presidency calls for massive internet filtering - <AUTHOR> https://edri.org/leaked-document-eu-presidency-calls-for-massive-internet-filtering/ <comment><USER2> Non-EU readers should bear in mind that the presidency of the EU is much _much_ weaker than that of, say, the US. It's rotated around the countries on a schedule, and has mainly agenda-setting authority.

That is, countries who hold the presidency will use it to try to get movement on some issues that they care about, but it doesn't have anywhere close to enough power to get something passed which the other member states do not agree with. Real power sits with the Commission, the Council of Ministers and the Parliament in various proportions.

<comment><USER3> True. One wonders what Estonia, or its government, has to gain from this, though.

<comment><USER4> It's the same thing all autocrats want which is to consolidate their power while protecting the little people from themselves.

I can see where they are coming from though; I'm pretty sure the investigations of Internet usage that turn up on politicians desks contain pretty disconcerting information about the human condition.

<comment><USER3> This seems to be focused on copyright, not "protecting the little people from themselves." I find a financial reason more likely to be behind this push.

<comment><USER4> Yes after finding and reading the document (TFA was hosed) I have totally misunderstood it's content; maybe a better headline including the word copyright would help.

<comment><USER5> Thank you for admitting the misunderstanding.

It's really dangerous to go around calling democratically elected governments "autocratic". These people really do try, and there's really no indication that any government except maybe Hungary is bent on perpetuating their power. Calling them names just removes any incentives for anybody to do well: Why bother, if you're just going to be called an incompetent autocrat anyway?

</comment></comment></comment></comment></comment></comment><comment><USER6> China's example is massive.

China's success has proven that countries _can_ succeed without adopting western liberal freedoms. In fact, success adopting only a small subset of economic and personal freedoms, and none of the political freedoms. The economy is good, the state is stable..

Proof of concept for non-liberal systems.

This means freedoms need to be argued for on their own merits. Free speech for its own sake. No censorship for its own sake. etc.

Much harder. Much more prone to compromise and erosion.

<comment><USER7> A huge chunk of millennials are non longer believe in free speech [0], and everyone seems to agree that Facebook et. al's censorship of objectionable content is great. Between the insanity of the current government/far right, and the rise of the far/tankie left, I'm not sure that liberalism is long for this world, even in the West.

[0] [http://www.pewresearch.org/fact-tank/2015/11/20/40-of- millen...](http://www.pewresearch.org/fact-tank/2015/11/20/40-of-millennials- ok-with-limiting-speech-offensive-to-minorities/)

<comment><USER8> I don't recall a time in history when publishers (what Facebook et al. are) were required or expected to publish whatever any random person or organizations opinions.

Furthermore, the country most in favor of limiting free speech to protect minorities, Germany(70% pro, 29% against, total population) , ironically has the most experience with the dangers of both extremes of allowances on speech. On one hand the Nazi's were able to rise to power partly because they were able to publicly scapegoat groups of people who were eventually slaughtered en mass. On the other hand you have the Stasi who would torture and murder people based on a whiff of being critical of the ruling party.

Look, I'm for free speech, but lets not pretend that its an issue that doesn't require a modicum of nuance to approach.

<comment><USER9> > publishers (what Facebook et al. are)

They're not publishers, so your argument falls apart in the very first sentence.

I don't recall a time in history when services (what Facebook et al. are) were allowed to police the content of communications made with their service. I don't recall AT&T, when they allow customers to communicate using their telephone lines, being allowed to police the content of those communications. I don't allow printer manufacturers being allowed to police the things people print.

Before you reach for the keyboard to type the words, "that's different" \- no, no it's not. It's not different at all. Facebook offers a service. They aren't publishers. My analogy is closer to reality than yours. It just so happens that Facebook is technically able to police my speech, and so you've chosen to shrug and say it's okay. If AT&T had been technically capable of listening to my speech and policing it, what argument would you make that they shouldn't be allowed to do that? Whatever argument you come up with, I make the same argument for facebook.

> I'm for free speech, but

"...but I'm not really for free speech."

It's all or nothing. You either accept it as a principle because you understand that it's literally the most important principle, or you don't. In your case, you don't.

<comment><USER10> The problem with your analogy is that it is tied to a very small window in history.

Has liberalism and free speech only existed in the time span where there's been regulated common-carrier type "services"?

Lets roll back the clock to before AT&T. Was there free speech and liberalism? Was any printer required to print anyone's manuscript? Was any newspaper required to be open to all opinions? Was any private person or organization required to spread those opinions across the world?

Historically, Facebook is much more like an open-to-the-masses publisher/distributor than you claim, with the difference resting more in economics (cost of publishing) than anything else. But that difference is hugely significant in practical terms - an unrestricted Facebook doesn't have much historical analog at all, hence the debate.

<comment><USER8> I agree that it doesn't have much a historical precedent and its important to have this debate, I'm not sure where I fall on it myself if I'm being honest, but facebook does have historical precedent in its size, in the past we've busted up corporations that have grown to this size into smaller individual entities but idk how you'd do that with fb, you could spin off instagram or maybe spin off its video hosting services but this all gets really tricky really fast.

</comment></comment></comment></comment></comment></comment><comment><USER11> > the Presidency has worked hard in order to make the proposal for the new > copyright Directive even more harmful than the Commission's original > proposal,

I read that as "corporations can enforce copyright... I can't"

See Youtube drama of a news organization using someone's video without attribution or payment... and then filing automated copyright claims against the original, because parts of the "copyrighted news broadcast" appear verbatim in the video.

<comment><USER12> I think there's also a serious risk of infringing on fair use/fair dealing and even remixes and so on here. An algorithm can't tell whether you're using content for piracy or for criticism. As you point out, YouTube's Content ID system has given us a fantastic preview of the potential problems here.

<comment><USER3> Their solution seems to be mandating providers to offer a mechanism for redressing grievances and having the rightsholders explain themselves in a reasonable time period. It seems to be just for PR (it doesn't seem to provide any mechanism in case the explanation is ridiculous), but it could provide an interesting venue for DDoSing copyright holders.

</comment></comment></comment><comment> Joe-Z I sincerely hope that we will succeed in keeping the internet as democratic as possible and not let it be destroyed by corporate interests in the name 'terrorism prevention'.

I'd like to give a shout-out to epicenter.works, an Austrian NGO, which I've been following the last 1.5 years or so. I think it's hard to get the public engaged in these topics, but they seem to be really determined.

Here's a google translate link to one of their latest articles / achievements (preventing a 'surveillance package' in Austrian law):

[https://translate.google.com/translate?hl=en&sl=de&tl=en&u=h...](https://translate.google.com/translate?hl=en&sl=de&tl=en&u=https%3A%2F%2Fepicenter.works%2Fcontent%2Fueberwachungspaket- gescheitert-wir-rufen-zum-schulterschluss-fuer-sicherheit-statt)

<comment><USER13> The Internet was never democratic. When did you get to vote on anything?

<comment><USER14> > When did you get to vote on anything?

October 2000, there were a worldwide online vote to select some members of the ICANN Board of Directors.

[https://www.icann.org/news/icann- pr-2000-09-21-en](https://www.icann.org/news/icann-pr-2000-09-21-en)

<comment><USER15> I love HN.

</comment></comment></comment></comment><comment><USER16> > upload filter

Your upload is my download. A user _uploads_ an HTTP request to a server, and the server _uploads_ an HTTP response to the user. Of course that sounds unnatural compared to the user downloading the HTTP response. But the difference between upload/download is purely semantic and only distinguishes the _intent_ of the user. Regardless of terms used, data flows in one direction, then back in another. The only distinguishing factor is its direction and whether or not both sides can establish the initial connection. So in that sense, a server uploads data to the user, who implicitly permitted the sever to do so when establishing the connection.

This misappropriation of technical language to advance a policy goal is revealing in that it shows the concept is fundamentally unlegislatable and therefore unenforceable, or worse, arbitrarily enforceable.

This is just part of an ongoing legislative pattern of the past 5-10 years. My reading of its trajectory is that regulatory regimes will eventually require licenses to run any service behind public IP addresses, to register domain names, and to advertise BGP routes or run public DNS resolvers. When coupled with centralization of inbound routing infrastructure (transatlantic fiber) and/or increased regulation of IP transit companies, this licensing legislature will work effectively.

<comment><USER17> > A user uploads an HTTP request to a server, and the server uploads an HTTP > response to the user.

Direction-wise, this is true, connection-wise, it's not. There is no active connection initiated from the server to the client; it's one long connection that is client->server, only the direction of the data changes.

</comment></comment><comment><USER18> Is anyone surprised at this? The internet is a single point which governs the majority of information and communication for the people now. Someone who is in power can potentially eliminate threats and increase their own power/wealth. I would be more surprised to find the opposite -- that the powerful had privately written a memo telling others that privacy matters more than their own power/wealth/safety.

Its like all the "shocking" revelations on the corruption of elections using voting machines -- hardly surprising given that the manipulation guarantees "legitimate" power from the people, the cost is fairly low relative to payoff, and the effect is largely untraceable.

<comment><USER17> > The internet is a single point which governs the majority of information and > communication for the people now.

That is because instead of building mesh networks out of our routers, mobile phones, home servers, raspberry pis, we, in Europe, are waiting on the {government,council,leadership,isp,bigco} to do it for us. It would be more than possible to build city-wide networks in the UK and cross-city connections with, for example, long range ubiquity, without and ISP or corporation or BT involved, but nobody seems interested, because nobody care any more. Virgin blocked a few more sites, "meh".

I know this sounds like a rant, but I'd really love to see a worm which turns every wifi capable device into gigantic mesh network and see how ISPs panic.

</comment></comment><comment> apk-d Personally, I think the cookie law could be expanded a bit further. Currently, I'm not always appropriately notified that the website I'm visiting uses cookies. How about we institute a law that requires browsers to implement a feature that detects when a cookie is stored, locks the browser and proceeds to play an unbridged rendition of the _Ode to Freedom_ (yes, that's really what it's called) while displaying a full page warning that you have to manually accept. Later, we could expand the mechanism to cover websites that use CSS stylesheets.

</comment><comment><USER19> So at a quick glance at the leaked document, it seems to contain provisions for requiring certain services to let copyright holders have unlicensed content pulled and to provide ways to stop such content being posted in the first place. Excluded from this group would be e.g. ISPs, storage providers and service providers whose primary function is not to distribute content to the public.

The article seems very alarmist and light on detail. This draft may well be pretty bad, but I'd recommend reading it to form your opinion.

</comment><comment><USER20> So I admit that I've only skimmed the PDF on statewatch.org that the site points to, but I didn't see the "massive filtering" bit. This reads like the DMCA seems to be practiced; can someone point out to me the specific page number of the PDF, or better the text within the document, which refers to the content filtering?

I'm not saying the DMCA is a good thing or a bad thing; I'm just trying to get calibrated to what is being proposed in the directive. Thanks for the help!

</comment><comment><USER21> and they still call me paranoid ...

</comment><comment><USER22> > follow in the footsteps of China regarding online censorship

This phrase makes the article seem overly dramatic. The proposed directive is all about copyright and not about censorship in the common sense. So, if I own the copyright (e.g. I wrote a blog post critizing the European Commission), this directive doesn't apply to me.

<comment><USER23> Copyright enforcement is censorship.

</comment></comment><comment><USER24> The web page is receiving the "hug of death" right now, and is having difficulty loading.

Pasting the content here in case it goes down (I did not include the in- paragraph hyperlinks though).

However, here is the leaked document they reference in the first sentence: [http://www.statewatch.org/news/2017/aug/eu-council- copyright...](http://www.statewatch.org/news/2017/aug/eu-council-copyright- directive-estonian-compromises-11783-17.pdf)

</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>==

A Council of the European Union document leaked by Statewatch on 30 August reveals that during the summer months, that Estonia (current EU Presidency) has been pushing the other Member States to strengthen indiscriminate internet surveillance, and to follow in the footsteps of China regarding online censorship. Standing firmly behind its belief that filtering the uploads is the way to go, the Presidency has worked hard in order to make the proposal for the new copyright Directive even more harmful than the Commission's original proposal, and pushing it further into the realms of illegality.

According to the leaked document, the text suggests two options for each of the two most controversial proposals: the so-called "link tax" or ancillary copyright and the upload filter. Regarding the upload filter, the text offers two alternatives:

* Option A maintains the Commission's original proposal of having in place an upload filter which will be under the control of platforms and other companies that are hosting online content. Although it removes mentions to "content recognition technologies", in reality, there is no way to "prevent the availability" (another expression which remains in the text) of certain content without scanning all the content first.

* Option B is, at best, a more extreme version of Option A. In fact, it seems so extreme that it almost makes the first option look like a reasonable compromise. This may, of course, be the "diplomatic" strategy. In this extreme option, the text attacks again the liability regime of the e-commerce Directive – which, bizarrely, would not be repealed, leaving us with two contradictory pieces of EU law but adds a "clarification" of what constitutes a "communication to the public". This clarification establishes that platforms (and its users) would be liable for the copyright infringing content uploaded by its users.

The proposals in this leak highlight a very dangerous roadmap for the EU Member States, if they were to follow the Presidency's lead. The consequences of these flawed proposals can only be prevented if civil society and EU citizens firmly raise their voices against having a censorship machine in the EU. We will be turning on our call tool at savethememe.net before each of the key votes in the European Parliament. Make use of the tool, and call your representatives to stop the #censorshipmachine!

No, you can't enjoy the music you paid for, says EU Parliament Committee (05.07.2017) [https://edri.org/no-you-cant-enjoy-the-music-you-paid-for- sa...](https://edri.org/no-you-cant-enjoy-the-music-you-paid-for-says-eu- parliament/)

Proposed Copyright Directive – Commissioner confirms it is illegal (28.06.2017) [https://edri.org/proposed-copyright-directive- commissioner-c...](https://edri.org/proposed-copyright-directive-commissioner- confirms-it-is-illegal/)

EU Copyright Directive – privatised censorship and filtering of free speech (10.11.2016) [https://edri.org/eu-copyright-directive-privatised- censorshi...](https://edri.org/eu-copyright-directive-privatised-censorship- and-filtering-of-free-speech/)

Copyright reform: Document pool [https://edri.org/copyright-reform-document- pool/](https://edri.org/copyright-reform-document-pool/)

(Contribution by Diego Naranjo, EDRi)

</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>==

<comment><USER25> That's horrendous... as it stands what are the odds this sees the light of day? I really hope this leak is a test, and it's just blown out of the water for now.

<comment><USER26> I guess today maybe no, but 10-15 years later and after one or few terrorists attacks with standard narrative, we will get in situation where without government id you could not write a comment, like today in china. This is not happening because of need security, but because of people ignorance and government greed to control everything.

</comment></comment></comment><comment><USER27> Site can't be reached at the moment. Anybody care to provide a TL;DR?</comment>


60-degree angles on a lattice - <AUTHOR> https://blog.plover.com/math/60-degree-angles.html <comment><USER2> The (7,2), (1,4) solution is surprisingly good. I did a really dumb brute force search and you have to get a decent ways out before you get anything better. Here are pairs of points for which there are no other better pairs with a lower max coordinate:

      (4,1), (1,4): 61.92751306414705
      (5,1), (1,3): 60.25511870305778
      (6,2), (1,5): 60.255118703057775
      (7,2), (1,4): 60.018360631150664
      (17,3), (4,11): 60.00891367665869
      (18,7), (2,13): 60.00333223031155
      (19,5), (3,11): 60.001318460471495
      (26,7), (4,15): 60.00009466237024
      (59,21), (9,49): 60.000006796458415
      (97,26), (15,56): 60.00000048796379

<comment><USER3> Why are they all >60? (The idea is just to find the closest to 60, right?)

<comment><USER2> No idea. I guess technically I omitted:

      (2,1), (1,2): 36.86989764584401
      (3,1), (1,3): 53.13010235415599

So I don't _think_ it's a bug in my code, but that is pretty odd.

<comment><USER4> Took me a while, but I think I figured it out!

At first this was pretty surprising to me, and I was pretty sure it must be a bug in the code. Well, I tried it myself and got the same results. :-)

After a few false starts, here's what I think is the probable explanation. Note that we're trying to approximate √3 by a fraction of the form (ad- bc)/(ac+bd). The closest _fractions_ we get (among a, b, c, d below a given magnitude) could be either below or above √3.

Consider an angle of (π/3+ε). If you look tan(π/3+ε)-tan(π/3), it works out to be (tan(ε) + 3ε) / (1 - ε√3). When ε is replaced by -ε, if you look at tan(π/3)-tan(π/3-ε), it works out to be (tan(ε) + 3ε) / (1 + ε√3).

For small ε, the former, namely (tan(ε) + 3ε) / (1 - ε√3), is larger than the latter, namely (tan(ε) + 3ε) / (1 + ε√3). (More generally, this boils down to the fact that the second derivative of tan(x) is positive.)

This means that it's easier (you're allowed a larger difference in the angle) to achieve a given closeness of the fraction (ad-bc)/(ac+bd) to √3 by picking the angle to be greater than π/3 (=60°) than if the angle is less than π/3.

For larger denominators, √3 becomes about as easy to approximate to a given closeness from below as from above (by fractions of the form (ad-bc)/(ac+bd)), but among roughly equally distant approximations, the ones from above are closer _in angle_ than the ones from below.

<comment><USER4> Can't edit the above post, but when trying to write this up more carefully I realized it's not correct:

(1) For one thing, the difference in epsilon is very small: the _ratio_ (1 + ε√3)/(1 - ε√3) is 1+2√3ε+O(ε²), that is, we're comparing something like 4ε+4√3ε² versus 4ε-4√3ε², which is probably too small to matter.

(2) The argument looks like it applies to all angles, but in fact experimentation shows the same phenomenon does not appear, and finally,

(3) Here are the next two terms after:

(211,14), (94,191): 60.000000269 (253,140), (1,55): 59.999999869 (265,71), (41,153: 60.000000035

where we see that one term is less than 60 degrees.

</comment></comment></comment></comment></comment><comment><USER5> After constructing the two rays at an angle of approximately 60 degrees, the author goes about constructing an actual (approximate) equilateral triangle by drawing two perpendiculars. That might be useful if one needs a triangle of precisely that size, but given a pair of compasses (or a straightedge with two markings), one gets any ≈equilateral triangle by just marking the two intersection points of any circle around the origin with the two rays. I believe this method doesn't give anything less precise than the method outlined in the post.

Given that the idea was to make the construction simple and small, I'm surprised the compasses method wasn't chosen.

<comment><USER6> I was confused as well, but I think the idea is that he's using only graph paper and a straightedge without measurement. (or markings)

So he has to place points with integer coordinates on the graph paper, and draw lines between them.

<comment><USER7> That's an interesting number set. The set of all points that can be produced from a straight-edge and the grid of integers.

I'm pretty sure this is just the grid of rational numbers. Interestingly, this is a subset of the 'constructible' numbers. That is, the numbers that can be produced from a compass and straight-edge (without even needing a grid).

<comment><USER8> It's not so surprising, since once you have a compass, straightedge, and a line segment you call "unit length", you can construct all of the integer valued points in the plane.

</comment></comment></comment></comment><comment><USER9> Oh, wow, beautiful. I wonder if there's a way to rephrase this as a diophantine approximation problem? If one ray must be axis-aligned then of course it's just the convergents for √3, but with two rays it's a little trickier.

<comment><USER4> We can indeed relate this problem to the "usual" Diophantine approximation problem of approximating a number α by a rational number p/q, but there's a twist.

The "usual" problem, where we want p/q to be close to a real number α, can be thought of as finding Gaussian integers (q + ip) that lie close to the line y=αx in the complex plane, i.e. points z on the lattice such that Im(z)/Re(z) ≈ α.

Here, with α=√3, we want to solve the same problem, i.e. find rational numbers p/q close to α, except that p/q must further be of the form (ad-bc)/(ac+bd) for some (a, b, c, d). Here's the thing: this is precisely the same as saying that (q + ip) is not a Gaussian prime! This is because (a-ib)(c+id) = (ac+bd) + i(ad-bc). ([https://en.wikipedia.org/w/index.php?title=Brahmagupta%E2%80...](https://en.wikipedia.org/w/index.php?title=Brahmagupta%E2%80%93Fibonacci_identity&oldid=863796842)) So any (q + ip) of the form (ac+bd) + i(ad-bc) can be written as the product of two Gaussian integers, and vice-versa.

So the relation between the Diophantine approximation problem and this one is that while there we want to find Gaussian integers close to the line Im(z)=αRe(z), here we want to find _composite_ Gaussian integers close to the line Im(z)=αRe(z).

(Note we can get different "best" approximations depending on how we measure closeness; see my other comment here: [https://news.ycombinator.com/item?id=18555240](https://news.ycombinator.com/item?id=18555240) Also, I expect that as denominators get larger, the primes get sparser, so this becomes closer to the usual problem. Of course in the original post linked here, the goal is to find small solutions, so the difference matters.)</comment></comment>


Life's Quantum Crystal Ball - <AUTHOR> http://fqxi.org/community/articles/display/194

<comment><USER2> It's not the ability to predict the future that defines life. It is the ability to create it.

<comment><USER3> It's not even the ability to create it, just the process of experiencing it.</comment></comment>


German Engineering Yields New Warship That Isn't Fit for Sea - <AUTHOR> https://www.wsj.com/articles/german-engineering-yields-new-warship-that-isnt-fit-for-sea-1515753000?mod=trending_now_4 <comment><USER2> How's the F35 going, WSJ?</comment>


Innovative Reusable Photo-Stickers (Limited 200 Beta-Testers) - <AUTHOR> http://www.piklip.com <comment><AUTHOR> Hi HN, I'd like to get your feedback on my new product PIKLIP. It's a special sticker-type photo-print that sticks to pretty much any flat surface, and can be used over and over. It's an efficient new way to display your photos - quickly and mess free.

We're still in beta, and currently accepting 200 beta-testers. Unfortunately we have to charge a small fee of $5.99 which includes printing and shipping cost to anywhere in the world.

Would be great if any of you can give it a try! Thanks :)

[http://www.piklip.com](http://www.piklip.com)

</comment><comment><USER2> (Beta participants pay $6)

<comment><AUTHOR> Sorry we have to charge money for beta. Because it's a physical product that requires material, printing & shipping cost, we needed to ask our testers to pay a small fee.</comment></comment>


Takipi: Groovy for Java Developers? Meet Gradle, Grails and Spock - <AUTHOR> http://blog.takipi.com/groovy-for-java-developers-meet-gradle-grails-and-spock/ <comment><USER2> Apache Groovy joined the Apache Software Foundation in November last year (2016) and, like all products at ASF, should be tagged with "Apache" on first use in a new context like a web page such as yours. On your web page, that would be "Apache Groovy" one time near the top, and "Groovy" the other 32 times.

This is a small burden for those benefiting from Groovy integration, considering all the good things the ASF provides in return. Unfortunately, the Groovy project management (PMC) chairperson at Apache is ignoring this requirement. That doesn't mean you should also poke the finger at the ASF.

> it includes a list of features that differentiate it from Java, such as: > Static and dynamic typing

Groovy's original use case was as a dynamically-typed language for the JVM. Virtually no-one uses its more recent static typing because of QA issues.

> Groovy is one of the 20th most popular programming languages for July 2016

Groovy jumped from 0.33% to 1.18% in a single month 6 months ago. See [http://www.tiobe.com/tiobe_index?page=Groovy](http://www.tiobe.com/tiobe_index?page=Groovy) This indicates either cheating by Groovy's backers or erroneous measurement by Tiobe. Groovy's long-term rating (Oct 2007 to Jan 2015) at Tiobe sits at 0.1%.

> Gradle is a tool built in Groovy that helps us with our Java

Gradle is built in Java, not Groovy. It has provided Groovy as a DSL, but will be providing Kotlin as its preferred DSL for writing build scripts and addons with Gradle 3.0, due soon.

> On the official website you'll be able to find the major sites who chose > Grails

They "chose" Grails, but sites aren't choosing Grails anymore. Virtually no- one upgraded from Grails 2 to 3 when it was released early last year.

> you can find a long list of Groovy related projects, such as: GPars

GPars has been bundled with the Groovy distribution since its production release.

> Java developers have a pretty good chance to come across Groovy during one > project or another, due to the impressive tools written in it

Groovy's main use is for small scripts testing Java code, and build scripts. It's not very good for larger projects, for which a statically-typed language (e.g. Java, Kotlin, Scala) is better.</comment>


My experience using Spring boot for website development - <AUTHOR> At work, I was asked to learn spring boot and the first task was to build a simple crud app, just end to end functionality for a model with automated tests, builds, static code analysis etc. I hate to admit it, but for the first few days (and even now) I couldn't tell which was up and which way was down, nothing made sense.<p>- Installation was a nightmare. Workplace uses windows, so the usual dance of installing the jdk, setting the env variables, creating a project in eclipse and for some reason it uses the jre instead of the jdk. Some plugins/packages such as lombok work in eclipse but not in vs code! And even in eclipse there's some annotation (@Data I think) that's supposed to generate getters and setters but it doesn't work.<p>- Flexible architecture : some use service, serviceimpl and controllers. Some skip the service interface. And it turns out you can extend crudrepository and have a fully functioning rest endpoint without writing any code using spring data rest!<p>- Magic : this is incredibly frustrating. Some repository types are automatically exported, some are not and the docs do an atrocious job of explaing what's going on. Place some file abc.xyz in the root and magic happens!<p>- Docs : the single worst part of learning spring boot, especially for newcomers. How can the docs possibly be so insensitive to newcomers? Or do they expect only experienced devs at big cos to use spring boot?<p>- I hate to admit this, but I still don't know what a god damn bean is, what AOP is, what inversion of control is.<p>This was mainly a rant and a bad one at that, but I had to vent. <comment><USER2> I would say that you were likely more successful than the typical first time exposure using Sprint Boot.

Your comments also sound spot-on to much of my first time exposure to Spring (pre Boot). I've used Spring and Spring Boot on many projects since and it wouldn't be my first choice. It tends to be selected for its popularity which means there are StackOverflow answers, pretty good support for common use cases, and a large pool to hire from.

At the same time, Spring Boot (or even just Spring) aren't the worst once you get used to them. I myself have come to dislike other aspects of it (e.g. slow startup, JPQL and Hibernate quirks, excessive gc, poor scaling). Most of these things probably won't have much of an impact until the application gets to a certain level of complexity or scale. But if it wasn't about solving for the future, Ruby or Python would be better to start.

</comment><comment><USER3> I've been programming in Java since I started working as a programmer. Learning to setup a Windows machine for Java development is difficult if you aren't familiar with environment variables and the like.

Java, like C++, has gotten more and more features/keywords over the years. Frameworks like Spring Boot tend to make use of those features. Also, Spring Boot is a sit down and read the guides compared to something like Rails or ExpressJS and the like. Depending on your Java knowledge the documentation is going to be hit or miss I think. Also, convention over configuration makes it harder for new developers to get the hang of developing with a framework like Spring Boot because they don't know the conventions usually.

</comment><comment><USER4> It really doesn't take that long to read the Spring docs. I know a few days for some devs is an eternity though. The magic can be frustrating though and burn you. When you have millions of lines of code in a project though, AOP and Spring can make your life bearable. I'd much rather spend the time to learn some magic than have to deal with that much boilerplate. Spring is most likely overkill for a small/medium sized project.

</comment><comment><USER5> One suggestion I have is to try using Intellij as your IDE. It has some built in integrations that make spinning up a new spring boot project a lot simpler.

Or, if you really like using an IDE that doesn't offer these integrations, then another option is to make use of this page: [https://start.spring.io/](https://start.spring.io/)

It makes the initial setup easier.

</comment><comment><AUTHOR> Continuation:

I will likely be changing teams soon, so hopefully this will be the last time I use spring boot.

Now I am not a complete noob to webdev. I have worked with django extensively and I have had a pleasant expereince with it. Everything is so beuatifully thought out, the docs are wonderful and I am never left scratching my head wanting to curse at the top of my lungs.

I'd love to hear your thoughts on this topic.

<comment><USER4> What docs were you reading? I've found Spring docs to be incredibly detailed and comprehensive. You do have to read it like a book though, and it will take days. It really is like it's own programming language.

This is what I've read [0]

0: [https://docs.spring.io/spring/docs/5.2.0.BUILD- SNAPSHOT/spri...](https://docs.spring.io/spring/docs/5.2.0.BUILD- SNAPSHOT/spring-framework-reference/)

[https://docs.spring.io/spring/docs/current/spring- framework-...](https://docs.spring.io/spring/docs/current/spring-framework- reference/web.html)

[https://docs.spring.io/spring- data/jpa/docs/current/referenc...](https://docs.spring.io/spring- data/jpa/docs/current/reference/html/#repositories.definition)

I thought installing JDK was pretty okay on windows with [https://adoptopenjdk.net/installation.html#windows- msi](https://adoptopenjdk.net/installation.html#windows-msi) It does all the PATH and ENV settings for you.

</comment></comment><comment><USER6> either you go in with a mentor to understand spring or read their docs like a book for a day or two. otherwise everything will feel like your point 3, magic

spring definitely feels like magic for first 6 months.

aop and ioc exist outside of spring and java as well.

</comment><comment><USER7> I use Intellij with Spring and all that jazz at work. Massive enterprise software. I don't _hate_ it, but boy, I can see why these behemoth applications move at a snail's pace.

</comment><comment><USER8> You mention Django. What amount of experience with Java did you have going into this? IMO Java development has a steeper learning curve than Python development.

<comment><AUTHOR> I used java for competitive coding competions, so I know the basics, but I've never used any frameworks in java before. Having experience in web development and knowing the basics of java, I thought I would be productive in spring boot in a few weeks but I never would have guessed I would be so completely lost with spring boot. (please don't ask me how many weeks I spent learning spring boot, it's simply embarrassing).

(I'll be offline for a few hours, I'll check back here in a few)

<comment><USER9> Using Java in coding competitions is an entirely different world from production enterprise java development. It may as well be a different language. Trying to learn all the Java patterns, annotations, web servers, etc for one CRUD app is a lot to tackle.

</comment></comment></comment><comment><USER10> #1 is a mostly Windows-related problem. You would've had similar issues with a Ruby- or JavaScript-based stack, probably much more so because Java generally is quite decent in terms of platform-independence. With other environments you often have to deal with native binaries or compiling for your specific architecture, which can get messy if things don't work as expected during installation.

I agree that the magic behind autowiring different types of Spring Data repositories can be quite confusing.

The Spring Boot documentation in general is quite good, though. There are many how-tos and specific examples with working source code. Apart from Pivotal's (the company that's the main maintainer of Spring and Spring Boot) own resources, [https://www.baeldung.com/](https://www.baeldung.com/) and [https://www.mkyong.com/](https://www.mkyong.com/) are fantastic for learning about Spring and Spring Boot, too.

Concepts such as AOP or inversion of control aren't exclusive to Spring Boot (or Java, for that matter). It's useful to learn about them anyway and yes, if you don't know about those subjects before starting with Spring Boot you're in for quite a steep learning curve because you'll not only have to grasp the ins and outs and implementation details of a new framework but understand entirely new abstract concepts at the same time as well.

As for beans specifically, the definition of that term within the larger context of Java has varied a bit over time so there might be at least some ambiguity here, which can lead to understandable confusion. Traditionally, a bean in Java is a class which a.) is serialisable, b.) has a zero-argument constructor and c.) has getters and setters for modifying the internal state of its instances. Due to these properties beans lend themselves to storing and passing application state (for example in the larger context of a dependency injection environment).

With Spring and Spring Boot, 'bean' usually refers to the @Bean annotation that allows to have a method return an instance of a particular class, which will then be made available to other components of the application through Spring's dependency injection.

The @Bean annotation leaves the object instantiation and wiring to the user (see [https://www.baeldung.com/spring-bean](https://www.baeldung.com/spring- bean) ) whereas other Spring annotations such as @Component or @Service (both are so-called stereotypes, with @Component being the more generic one that simply marks a class as 'managed by Spring' while @Service denotes that the component in question is to be used within the application's service layer. See [https://www.baeldung.com/spring-component-repository- service](https://www.baeldung.com/spring-component-repository-service)) delegate wiring to Spring dependency injection.</comment>


Hackerreddit.com - <AUTHOR> http://hackerreddit.com/

<comment><USER2> This would be cool if it was a news aggregator pulling from HN and various programmer/tech/hacker sub-reddit's. This is something I have wanted for a while. Sort of a Reddit front page for hackers that is a combination of handpicked sub-reddit's and HN stories.

<comment><USER3> Would you pay for a news aggregator that automatically clusters similar stories according to their content?

</comment></comment><comment><USER4> I was expecting comments on the same stories from hn and reddit. Is this just a split view of hn and reddit front pages?</comment>


IQ scores are falling and have been for decades, new study finds - <AUTHOR> https://www.cnn.com/2018/06/13/health/falling-iq-scores-study-intl/index.html <comment><USER2> It takes a lot more than one paper and a CNN article to overturn the evidence that is against this. I'm not talking about IQ scores falling, but rather the cause of it suggested here. Although the environment does have notable roles (for example the impact of lead), it's naive to come out and say that the environment is all that matters in driving these effects. Dysgenic Fertility ([https://en.wikipedia.org/wiki/Dysgenics#Fertility_and_intell...](https://en.wikipedia.org/wiki/Dysgenics#Fertility_and_intelligence)) is different in different countries, and the pattern of change mentioned in the article is also different, with Norway often being a bit of an outlier.

>It's not that dumb people are having more kids than smart people, to put it crudely. It's something to do with the environment

This is false. The correlation between cognitive ability and number of offspring is negative. Here's a link to a systematic review on this topic: [http://sci-hub.tw/https://www.sciencedirect.com/science/arti...](http://sci- hub.tw/https://www.sciencedirect.com/science/article/pii/S0191886918302903) that covers many datasets, where you can see the negative correlations on page 114 (8 in this pdf), which vary from -0.01 to -0.27 depending on the group in question. Although this does not rule out an environmental influence by itself, it's dishonest to simply dismiss it as the article has done.

> In a separate study that has not been released, he and his colleagues looked > at existing research in an effort to demonstrate that staying in school > longer directly equates to higher IQ scores. Keyword here is "an effort to > demonstrate". That sounds like they really want the results to come out in > their favor, and we know that is not a good sign. They can mess around with > correlation and causation and p-values and subgroups and framing all they > want, but whatever they come up with will contradict a lot of the existing > literature in this area in order to push their agenda.

</comment><comment><USER3> The simplest explanation would be that either the IQ tests are missing some aspect of human cognition that is getting more developed in spite of others, or that the weighting used to calculate the final IQ number based on the particular results might be wrong or not representative of the actual cognitive effort required for each of them.

Let's not forget that IQ tests are just statistical analyses, while we still lack a bottom-up explanation of intelligence.

</comment><comment><USER4> This is not a new discovery. It's known as the Flynn effect. [1] It initially was the observation that IQ scores were constantly increasing over time. This was one of big correlations in support of intelligence being driven by environment. Our environmental conditions were improving, and so was our IQ.

But then sometime starting around the mid 90s it began to reverse in developed nations. And by reverse, I mean IQ's began declining - not approaching some sort of asymptotic 0 level of growth. So, if we normalize for age, an average person born in the 70s will have a higher IQ than an average person born in the 90s.

[1] - [https://en.wikipedia.org/wiki/Flynn_effect](https://en.wikipedia.org/wiki/Flynn_effect)

</comment><comment><USER5> I have no PNAS*, but just for starters...

Firstly, this is such a massive and important finding, even cessation of the Flynn effect would be, that one has to wonder why we haven't seen it published until now.

Secondly, one of the frustrating parts of being a statistician is that a 90% explanation of nearly every effect comes from some common-sense factor. So much so that it raises suspicions when a strong effect is shown along with a series of specific and fairly complicated 'anti-explanations'. The article seems more interested in disproving the 'idiocracy' effect than finding some alternative explanation.

<comment><USER6> PNAS? I've never seen this short form before. What does it mean?

<comment><USER7> (he means a subscription with [http://www.pnas.org/](http://www.pnas.org/))

<comment><USER6> ahh, thank you!

</comment></comment></comment></comment><comment><USER8> Literally for decades people have been predicting average IQ scores would drop due to social/genetic factors. It's evidence of a successful theory. Society should stop pandering to the lowest common denominator and allow gifted students to excel in separate environments

</comment><comment><USER9> A few days ago naturalness.com had an article about this topic and refers to 3 scientific studies that show that the more toxins the mother was exposed to, the less IQ the child has. It is a linear function.

</comment><comment><USER10> Dupe of [https://news.ycombinator.com/item?id=17302830](https://news.ycombinator.com/item?id=17302830)</comment>


What if states earned their Electoral College votes based on turnout? - <AUTHOR> https://medium.com/@hodgesmr/earned-electoral-allocation-a9e806fadf0e <comment><USER2> Wouldn't this lead to a TON of games? Now if you're a Democrat in Nebraska, or a Republican in California, it's in your best interest NOT to vote. That way the winner-takes-all majority in your state would get less of an impact. On the other hand, all of the Democrats in California and Republicans in Nebraska would definitely want to show up to the polls.

Basically if you think your party will win, you want to show up. If your party will lose, you want to skip. There are basically 3 equilibria: 100% of either party votes and 0% of the other one, or exactly 50/50 with the outcome unknown to anyone.

<comment><USER3> Which is why the votes ought to be pooled across states, so all the Republican votes in California don't get lost, just because the state majority ended up voting Democratic.

<comment><USER2> If you're pooling votes across the states then you don't exactly have an eloctoral college any more, and you get the turnout-proportional results anyway.

<comment><USER4> The National Popular Vote bill would guarantee the majority of Electoral College votes and the Presidency to the candidate who receives the most popular votes in all 50 states and DC.

The national popular vote winner would receive all of the 270+ electoral votes of the enacting states.

Under National Popular Vote, every voter, everywhere, would be politically relevant and equal in every presidential election. Every vote would matter in the state counts and national count.

The bill has passed a total of 33 legislative chambers in 22 rural, small, medium, large, red, blue, and purple states states with 250 electoral votes. The bill has been enacted by 11 jurisdictions possessing 165 electoral votes—61% of the 270 electoral votes necessary to activate it

[http://www.NationalPopularVote.com](http://www.NationalPopularVote.com)

</comment></comment></comment></comment><comment><USER5> Meh, why is turnout something one should encourage? Put another way, why should the voices of those who could barely be bothered to show up be amplified over those of those who really care?

I don't _want_ 100% turnout; I _do_ want the people who don't care to stay home. I'd also like to only allow people who can pass the citizenship test given to prospective naturalised citizens to be able to vote, but that's an entirely different discussion…

<comment><USER6> Sounds like you disagree with the core concept underlying one man, one vote. Why should a person who squeaks by with correctly answering 6/10 of the test questions be given the exact same voice as someone who gets 10/10, and someone with 5/10 gets no voice at all?

<comment><USER7> I convince people to not vote. If I can convince you not to vote with a single argument, then your input is something our country doesn't need. I do not at any time stop them from voting; I only tell them it doesn't matter and they shouldn't waste their time.

Everyone gets a vote, but I'm not losing any sleep when those who don't care enough to vote don't get their say recorded.

(Of course there is a problem where people who want to vote are prevented from voting. This is an issue that needs to be fixed so that everyone who wants to vote can vote.)

<comment><USER6> So you draw the line at "desires to vote" rather than "is capable of answering a few trivia questions". But say passing the test was a requirement to vote, wouldn't the people who want to vote naturally proceed with studying for and taking the test, while those who don't want to won't be bothered since overcoming the obstacle is even greater than overcoming the resistance of mailing in a form or going to an actual booth? (Or perhaps using an app?) Thus the test would serve as a proxy for desire, with even more potential upsides according to GP. What would the distribution look like given no filter, filtering by test passers, and filtering by people who want to vote?

<comment><USER7> >But say passing the test was a requirement to vote, wouldn't the people who want to vote naturally proceed with studying for and taking the test, while those who don't want to won't be bothered since overcoming the obstacle is even greater than overcoming the resistance of mailing in a form or going to an actual booth?

The problem is that any such test with answers could be inherently biased against some groups. 'Do I feel like going to vote today' is not biased in such a way as the person taking the test is the creator of the test itself.

Imagine if there was a test to vote, but every person created their own test, answered their own test, and then scored their own test (and the test didn't have to make sense to anyone, including the person who created/took/graded it).

</comment></comment></comment></comment></comment><comment><USER8> _Green states received a larger proportion of Electoral votes compared to their actual turnout. Red states received less._

Wish I could read these maps, but I'm red-green color blind (like 8% of men). Please consider using different colors or some additional indicator to show this information.

<comment><AUTHOR> Wow, sorry for this! I just used default colors that were in the Google Sheets chart tool. For my own education, is there a different spectrum that would do better?

</comment></comment><comment><USER9> Some reasons we have the Electoral College: [https://en.wikipedia.org/wiki/Electoral_College_%28United_St...](https://en.wikipedia.org/wiki/Electoral_College_%28United_States%29#Support)

<comment><USER10> "Many proponents of the Electoral College see its negative effect on third parties as beneficial."

<comment><USER11> Yeah: It forces parties to be broad-based and adaptable if they're going to compete nationally.

It also avoids bizarre situations like France's 2002 election, wherein the Left had to choose between Chirac and Le Pen (something similar is not improbable in 2017, as well!)

<comment><USER12> Does it? I'm an American leftist, probably going to have to choose between Hillary and Trump.

</comment></comment></comment></comment><comment><USER13> I'm surprised voter turnout isn't lower. Unless you live in a swing state, or Maine or Nebraska, voting for president is a waste of time. If you are in a swing state, it still might not matter unless you are in a swing district. It's a terribly broken voting system.

<comment><USER14> I find the psychology of voting fascinating. Most people are unwilling to vote for a third-party/longshot candidate, as their vote would be "wasted", despite the fact that their single vote is guaranteed not to matter. I think the driving motivation for most is the desire to be on the winning team, or if you're in the wrong county/state, to be able to say you fought the good fight for your side. In other words, despite the secret ballot, people vote more for reasons of in-group signaling than attempting to influence policy.

As you say, the 50ish percent we do get is impressive. If we really care about turnout (and disincentivizing some of the shadier techniques campaigns use to manipulate turnout), we should turn Voting Day into a national holiday and a mandatory duty (perhaps with an opt-out "I choose to abstain" for true protest votes, but the point is that you still have to show up or mail your ballot, period.)

</comment></comment><comment><USER15> Will never happen. The Republican Party has almost made it its official platform to make it very hard for voters to vote. They are opposed to a holiday for elections; they come up with all sorts of excuses to take people off electoral rolls; they raise the bogey of "voter fraud" each and every election, when there's not much evidence of any.

<comment><USER16> Okay, I'm in.

The Democrat Party has almost made it its official platform to make it very easy for non-citizens to vote; since they're most likely to vote Democrat. They support a holiday for elections; only because it would make it easier for a part of their base to vote, not because of any benefit to voters in general. They come up with all sorts of excuses to keep people on electoral rolls; whether they should be or not. They raise the bogey (boogeyman?) of Republicans raising the bogey of "voter fraud" each and every election; even though there has been voter fraud throughout the country's history and used to be part of the platform of Progressives of the past. Edit: meaning Progressives of the past were fighting voter fraud, which many Progressives of today claim doesn't exist.

Give us some more. It's easy to provide the cynical but plausible reverse when demonizing people according to group identity/accusations thrown out there for polarizing political drama.

And before anyone jumps the gun, as often happens in these cases because people can be silly, these comments may or may not reflect my personal political views.

EDIT: you forgot the Social Security scare the Democrats accuse the Republicans from time-to-time to get old people to vote Democrat. Or is that one played out?

<comment><USER17> There's the teensiest difference between cynically encouraging people to vote, because nonvoters tend to be more Democratic than voters, and cynically trying to prevent black people from voting, because black voters tend to be more Democratic than nonblacks.

<comment><USER16> Sure there is. But are we really going to say that it is the official stance of the entire Republican party to actively prevent black people from voting? Despite the fact that one of the leading Republican candidates right now is a black man? That is absolutely ridiculous and can only be the product of a childish and overactive imagination of a conspiracy theorist partisan nutjob that produces nothing of value whatsoever in a modern society. Maybe, just maybe, the problem you describe exists mostly on the local level and it's completely unfair to paint half the country as racists or bigots because of political differences?

Are there people who actively scheme to prevent people from voting and/or get their candidate to win in nefarious ways? Sure. Are some of them Republicans? Yep. But some of them are Democrats too, they just target different people in different ways. All in all, this is the voter fraud of the modern age; using laws to give your candidate the advantage.

<comment><USER17> There's not a single policy or position that could be described as "the official stance of the entire Republican party," so you're demanding an unrealistic bar be met.

The voter suppression schemes are transparent, and they are officially endorsed in the most recent Republican platform. If you want to deny their intent--decreasing Democratic votes--and effect--disproportionately removing black people's ability to vote--you might as well go back and claim that Southern literacy tests were a wholly benign attempt at improving good government.

I'm not even sure how much we disagree, aside from equivocation about Republicans taking that position to increase odds of winning and Democrats taking the opposite to increase their odds. But the USA has a long and storied history of screwing over black people and their civil rights, so we should be especially sensitive about policies that target them to undermine their civil and political rights.

<comment><USER16> >> There's not a single policy or position...

That's exactly my point. I'm not the one suggesting it, I'm responding to it.

>> The voter suppression schemes are transparent...

Yes, I even stated that. My point is that I'm not willing to label half the country as to be a part of it. In fact, I'm willing to blame people among the Democrat party of doing much the same. I just don't say it's official Democrat policy so that I'm not blaming the entire group.

>> literacy tests

Which tests? Those run by Republican or Democrat members?

>> I'm not even sure how much we disagree...

On the face of it, I don't think we do.

>> But the USA has a long and storied history of screwing over black people and their civil rights...

Which I said, US history is rife with voter fraud or disenfranchisement, whichever term you prefer. I'm not sure where you're going with all this, since it seems you are agreeing with me. Am I misunderstanding?

</comment></comment></comment></comment></comment></comment><comment><USER18> This a fun little data project. No one is passing a constitutional amendment to change the EC to seats based on turnout. Even the National Popular Vote Interstate Compact, which does not require a constitutional amendment unfortunately seems to be stalled indefinitely.

</comment><comment><USER19> And if we also split those electoral votes as close as possible to the way the people of the state voted we can get even closer to a direct election. And that's what the author seems to want - he's still got butt-hurt that Al Gore lost even with the popular vote. Why not just say what you want instead of proposing something that sounds kinda interesting but will never happen?

<comment><AUTHOR> This was something that I was just kicking around in my head and wondering "what would these results actually look like?" And then I realized that all the necessary data was publicly available, so I grabbed a coffee and went to town. I'm not actually proposing this change and had no idea what the results would be until I started writing.

</comment></comment><comment><USER20> Wouldn't this just be a general election with sort of weird rounding rules?

edit: no, because of winner-takes-all nonsense. seems like a bad idea.

</comment><comment><USER21> This can also lead to some less desirable outcomes, such as calls to make voting mandatory.

<comment><USER22> Why is making voting mandatory* a less desirable outcome?

*Or as I prefer to say, "equal cost voting choice", ie. that it takes just as much time and effort to not vote (go to polling place, accept ballot and void it) as it does to vote.

</comment></comment><comment><USER23> It seems crazy that election day isn't on a Saturday.

</comment><comment><USER24> Wouldn't it be simpler to just go all the way towards direct election than take a halfway step towards direct elections such as this?

<comment><AUTHOR> This was a thought-experiment, and nothing more. Not actually advocating this change.

<comment><USER24> Ah ok!

</comment></comment></comment><comment><USER25> Wouldn't that favor small states, who can mount a turnout campaign with far fewer workers?

<comment><USER26> I think it would be proportional. Larger states have more workers to draw on. The question is, how are the 'get out the vote' drives funded? By the parties? The state?

It has an appeal though. You have to exercise your right to vote in order to be represented. Is that impacting your liberty to not vote if you don't want to?

<comment><USER27> With all due respect to all involved I read his comment as geographic population density.

I've lived in voting districts where the election was in the basement of my dorm, in the suburban subdivision's elementary school, and in a rural area where voting was a good 10 minute highway drive. Obviously theres a big difference in "get out the vote" when one voter is pound on the dorm door and tell them to press the "B" button in the elevator, than some rural district where each voter represents like a quart of gasoline burned.

</comment></comment></comment><comment><USER28> >Wyoming voters made up 0.193% of the total popular vote in 2012. That would earn them a total of one electoral vote. In reality Wyoming gets 3.

and they get the same amount of senators as California or NY. This is why US politics will always lean conservative. There are just too many "fly over states" with tiny conservative populations that have an undue influence on national elections.

All too often "money in politics" are blamed for the lack of liberal or progressive changes in the nation. That's a red herring for the most part, or at least, problem #2. With a system like this its very difficult to put in liberal reforms. Hell, Obamacare, which is pretty much a Reagan-era proposal, barely got passed with a Democratic majority in almost all branches of government. Even after passing, its been endlessly disputed with at least two major losses to the law via SCOTUS. Those courts? Packed with conservative leaning judges by POTUS, who has a major advantage to winning if he's a conservative. This stuff comes full circle and starts with the over- representation of lowly populated conservative areas.

<comment><USER11> Vermont and Rhode Island get two senators apiece as well, and they're not exactly the most conservative states.

<comment><USER28> I count 13-16 low population states. Pretty much all of them are red states. Vermont and Rhode Island don't remotely make up for it. The reality is that if you live in a highly populated state, your voting influence is greatly diluted compared to the people in these states.

Hell, the city I live in has TWICE the population of North and South Dakota combined.

[https://en.wikipedia.org/wiki/List_of_U.S._states_and_territ...](https://en.wikipedia.org/wiki/List_of_U.S._states_and_territories_by_population#/media/File:Map_of_each_state%27s_population_as_of_2013.svg)

<comment><USER4> With National Popular Vote, big cities would not get all of candidates' attention, much less control the outcome.

16% of the U.S. population lives outside the nation's Metropolitan Statistical Areas. Rural America has voted 60% Republican. None of the 10 most rural states matter now.

The population of the top five cities (New York, Los Angeles, Chicago, Houston and Philadelphia) is only 6% of the population of the United States and the population of the top 50 cities (going as far down as Arlington, TX) is only 15% of the population of the United States. 16% of the U.S. population lives in the top 100 cities. They voted 63% Democratic in 2004.

Suburbs divide almost exactly equally between Republicans and Democrats.

Big cities do not always control the outcome of elections. The governors and U.S. Senators are not all Democratic in every state with a significant city.

The main media at the moment, TV, costs much more per impression in big cities than in smaller towns and rural area. Candidates get more bang for the buck in smaller towns and rural areas.</comment></comment></comment></comment>


Diaspora sending out alpha invitations - <AUTHOR>

This is from the email I have just received:
--- --- ---
Dear Friend of Diaspora* -
Thanks for your interest in being part of the Diaspora* community. You may not have heard from us in a while, but we've been working hard, head-down. We've built the first stage of a new social web, one better than what's out there today: a place where each of us owns our own information, where each person controls his or her own privacy, where no-one is a product, and where we all control our own destinies.
We're sending out alpha invitations now, as quickly as we can. If you haven't gotten yours yet, you will receive it by the end of October.
There's been big news in the social networking world recently, and we can't help but be pleased with the impact our work has had on two of the biggest developments. We're proud that Google+ imitated one of our core features, aspects, with their circles. And now Facebook is at last moving in the right direction with user control over privacy, a move spurred not just by Google+, but more fundamentally by you and thousands of other donors, as well as hundreds of thousands of people who've lined up to try Diaspora* -- that is, by all of us who've stood up to say "there has to be a better way." We're making a difference already.
And aspects is just one of the many ways we're pioneering the future of the social web.
Here's a quick preview of some of the other ways:
- We'll make the social web more fun than it is today. - Our distributed design gives you the security of owning your own identity and data. - This also gives you the freedom to do what you want online. - Our ecosystem provides the commons, the connective tissue for an evolving social web. - We're not gatekeepers, so our ecosystem will always support the latest apps.
We'll tell you a little more about each of these points in the weeks ahead.
And we'll keep working to get your alpha invitation to you just as quickly as we can.
Until then, thanks again for your interest in Diaspora.
Sincerely, - Maxwell, Daniel, Ilya, Sarah, Yosem and Peter
The Diaspora team Thursday, September 8th, 2011 <comment><USER2> Anyone else feel that these guys have missed their moment?

Their whole raison d'etre is privacy and openness, and it seems to me the once-regular privacy scares around Facebook don't seem to be happening any more, or at least they're not registering with mainstream users, many of which are probably now becoming more savvy.

</comment><comment><USER3> No offense, but what makes you think that Google and Facebook 'imitated' Diaspora? It's a naturally occuring idea that is visible in real-life interactions. Circles seems to be a lot more intuitive and user-friendly than what you guys 'invented'.

<comment><USER4> AFAIK someone who worked at google researched heavily in the topic of circles. He ended up in facebook. I don't think Google imitated Diaspora as they had given this circles phenomenon adequate research and breakthrough.

<comment><USER5> What was his Pi approximation?

</comment></comment></comment><comment><USER6> What is an "invitation" to an open source project?</comment>


Is the iPod Classic going away? - <AUTHOR>

In his keynote, Jobs said that they are releasing "all new iPods". Absent, however, was any mention of the iPod classic. The largest iPod is the Touch 64Gb. I hoped that at minimum Apple would release a 128Gb version of the Touch. At that point I could see retiring the Classic. However, right now nothing touches it's 160Gb capacity. However, it has poorly responsive controls and a hopelessly outdated UI. I was hoping some sort of rev would address this. An iPod touch w/hard drive would be amazing, but surely is not to be. Anyone care to speculate whether this niche will be filled? <comment><USER2> No: [http://store.apple.com/us/browse/home/shop_ipod/family/ipod_...](http://store.apple.com/us/browse/home/shop_ipod/family/ipod_classic?mco=MTM3NTMxMzA)

<comment><AUTHOR> Yes, I know it is available at present on their store. I am asking about its future prospects. Jobs made no mention of it, while claiming that they were updating "all" the iPods. What is the future for a device like this?

<comment><USER2> There probably isn't. They will most likely continue to sell them unchanged but as soon as the iPod touch more or less catches up in terms of capacity (I'm guessing 128 GB) the iPod classic will be dead. (That could happen in one year.) As you said, Jobs said nothing about the classic (even more extreme: he said that shuffle, nano and touch are the entire iPod lineup), that certainly should tell you something.

I say good riddance, the iPod touch is terrific, all the classic has going for it is capacity.

</comment></comment></comment><comment><USER3> I wondered this too. Frankly, I don't understand why there isn't a 1TB iPod classic. I understand that eventually flash will replace hard drives, but it just isn't economical yet for the largest sizes.

64GB Touch: $400

160 GB Classic: $250

<comment><AUTHOR> Well, remember we are dealing with a 1.3" HD, and those are nowhere near 1TB in capacity.

<comment><USER3> Really? The 160 GB iPod Classic was introduced Sept 2007. It seems like the technology should exist to at least have 500 GB at that form factor (though maybe the demand doesn't exist).</comment></comment></comment>


CSS Gridish - <AUTHOR> https://github.com/IBM/css-gridish <comment><USER2> The "fallback to flexbox" part makes me feel like a dinosaur. It wasn't that long ago when we were falling back to tables and floats...

<comment><USER3> Indeed. But it's worth pointing out "falling back" to flexbox isn't a solid backup plan-- most versions supporting flexbox also support grid, or are evergreen.

[https://caniuse.com/#search=flexbox](https://caniuse.com/#search=flexbox) [https://caniuse.com/#search=grid](https://caniuse.com/#search=grid)

<comment><USER4> Assuming you can target browsers that support both, when does one pick flexbox over grids and vice versa? or does grids entirely replaces flexbox use case?

<comment><USER5> The community has been saying to use flexbox when you are only working with one axis, but I am not too sure that is true. Grid has adapted so many of flexbox's rules, browser support seems to be the only differentiator.

<comment><USER6> I have a site in flexbox and planning to move it to grid to learn.

There are typical 1D places (stacks of divs, basically), so typical for flex. But since I can do the same with grid I wonder if I should use flex anywhere now (even for 1D).

Note: browser compatibility does not matter for this site

</comment></comment></comment></comment></comment><comment><USER7> Interesting. This project is by IBM.

<comment><USER8> IBM still have a lot of talented and dedicated engineers despite the questionable management decisions.

I would guess this probably started off as an unofficial endeavour by a single or small group of employees and the beancounters agreed to publish it as OSS.

<comment><USER5> I had been working on all of this build process for our own grid design. Then in the last month I realized I could move all design decisions to a config file to make it compatible for other people's design systems.

</comment></comment></comment><comment><USER9> Is this an efficient doorway into understanding CSS grid, one that has the bonus of giving you useful code? Or, is this more of a crutch, the output of which will not educate you about the grid goodness?

I'd like it to be the former, so that I can be productive out of the gate and figure out what I'm doing as I go. That may be unprofessional, but I make quick-and-dirty prototypes for academics; nothing that has to scale. Plus, I'm lazy.

<comment><USER10> This is the best resource I've found about making your own grid goodness, if that's what you're after: [http://j4n.co/blog/Creating-your-own-css-grid- system](http://j4n.co/blog/Creating-your-own-css-grid-system)

This tool seems oriented at abstracting away a lot of detail, and to be aimed at solutions that have to scale. If I wanted to learn as I go, I'd start without the abstractions.

<comment><USER11> That has nothing to do with CSS Grid, though, which is what the IBM tool is about. CSS Grid being the new way to layout in CSS: [https://www.w3.org/TR/css-grid-1/](https://www.w3.org/TR/css-grid-1/)

</comment></comment></comment><comment><AUTHOR> Automatically build your grid design's CSS Grid code, CSS Flexbox fallback code, Sketch artboards, and Chrome extension. [https://ibm.github.io/css- gridish/](https://ibm.github.io/css-gridish/)

<comment><USER12> i can't find how to get the Sketch artboards to magically appear :) Sounds cool ....

</comment></comment><comment><USER13> i am also a little surprised, when finding it from IBM</comment>


YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support - <AUTHOR> https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-mobile-sdk-for-ios-and-lastpass-support/ <comment><USER2> If I'm authenticating with "something I have" then why not use the iPhone itself which also happens to add a layer of "something I am" (FaceID) as well as easily supporting entry of something I know (PIN or password).

Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all.

I trust the secure element on the iPhone a lot more than I trust the hardware on the Yubikey.

The days are numbered for this whole idea of a separate piece of hardware USB/NFC to do authentication. If I'm adding a "something I have" factor to my authentication flow (or even making it the only factor) it's going to be the phone hardware itself, not an extra dongle thing I have to carry around.

FIDO's upcoming CTAP unfortunately is going about it the wrong way, IMO. I don't want to have to establish NFC or Bluetooth from my iPhone to my desktop to enable me to use my iPhone to authenticate on my desktop. It's entirely unnecessary since both devices are already online. They are designing for a corner case which makes the primary case too complicated.

<comment><USER3> Do iPhones allow access to the underlying TPM devices?

I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.

<comment><USER4> Yes, iPhones allow storing data that can't leave the device. Otherwise OTP apps would be pointless.

I don't know the details, but some apps use it to store OTP secrets. Eg. if you use the DUO app, your secrets will be backed up, but they can only be restored on your phone. (was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair)

Not sure what Google authenticator does.

<comment><USER5> Are iOS Authenticator apps actually calculating OTPs on the Secure Element? Is there a way to execute arbitrary code on it? If not, they have to pull the keys off to the main CPU where they're open to attack like anything else. Still secured as private app data, still mostly protected, but an attacker with a jailbreak could still dump them.

I know for a fact I can dump Google Authenticator keys from my Android device with root as I'm able to back it up and move it to another device. Theoretically on most Android devices even there's a secure enclave available that could do it, yet I haven't seen any apps use it.

Most of the benefit of OTPs really comes from approving on a secondary device rather than protecting the keys to an absolute degree though, so this is probably of little concern to most users. In fact it may provide a convenience benefit, I like being able to backup and move my keys, without that I probably wouldn't use 2FA at all.

<comment><USER6> Using the secure enclave, you (as a developer) can have it generate a private key you'll never be able to get and then ask it to sign / encrypt (symmetrically) arbitrary things for you.

[https://developer.apple.com/documentation/security/certifica...](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave)

AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.

<comment><USER7> Sadly, the Secure Enclave doesn't support HMAC-SHA-1 or importing keys [1] so it's not compatible with the industry standard TOTP 2fa mechanism.

[1] [https://developer.apple.com/documentation/security/certifica...](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave)

<comment><USER8> I think we can do a lot better than the industry standard TOTP 2fa system anyway. TOTP involves sending plaintext private keys around during setup.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Yubikey OTP is much weaker than a good challenge-response protocol like U2F. I assume that Yubico is supporting OTP because iOS only exposes NDEF data, and NDEF is effectively a one-way protocol.

<comment><USER10> Allowing two way communication would permit innovation in connecting devices that are not subject to Apple's direct control.

<comment><USER11> Yeah, it's so annoying having to buy Apple brand Wi-Fi routers and Apple brand Bluetooth headphones.

<comment> m-p-3 Wait, your non-Apple bluetooth speakerphone allow you to speak, not only listen?!

</comment></comment></comment></comment><comment> m-p-3 I kinda hope they'll make a newer version of the Yubikey that supports NFC and PGP keys bigger than 2048 bits.

<comment><USER12> Agreed on NFC but they support 4096 bit RSA in the current generation hardware:

[https://www.yubico.com/product/yubikey-4-series/#tab- specs](https://www.yubico.com/product/yubikey-4-series/#tab-specs)

It suffers the usual PGP-world usability problems so I ended up not using it very much but it was definitely working and takes noticeably longer to generate the key than a 2048-bit key does.

</comment></comment><comment><USER13> I wonder if there is a method to detect NFC at a greater distance than you can read it - could be used to 'find any yubikeys hidden in office desks'

</comment><comment><USER14> I'd like to see Safari support... does anyone know if it'll have it (perhaps thru a sharing extension?)

</comment><comment><USER15> Ok, this is dumb. Real dumb. I would trust (the leaked) secure enclave OS than Yubico's offerings. And the Secure Enclave is already built in, versus this 3rd party hardware.

Also, using something like andOTP is perfectly fine to run, which is also a U2F TOTP solution. It integrates perfectly with LinOTP, Google Authenticatior, or other 2fa solutions.

In essence, if you're using Linux anywhere, 2fa is free to implement, free to manage serverside, and just works. There's no reason for Yubi-anything.

Also, within the next few weeks/months, NIST will be stating that phone calls, Texts, and emails are no longer an acceptable 2fa for secure stuff.

<comment><USER12> > Also, using something like andOTP is perfectly fine to run, which is also a > U2F TOTP solution. It integrates perfectly with LinOTP, Google > Authenticatior, or other 2fa solutions.

It also has a massive attack surface since you need to secure an Android device. The big win for a dedicated hardware token is that there's so little to attack, along with lesser things like not running out of battery at inconvenient moments.</comment></comment>


Why create gRPC if you can run REST over HTTP/2, and there is websockets? - <AUTHOR> If you say communication, then isn't websocket already there for that? gRPC honestly looks like it could have been just websocket with library enforcing data contracts.<p>I'm confused, over actual benefit here. It seems it is being forced with promise of benefits that already exists.. <comment><USER2> Apart from the fact that you can do bidirectional data transfers with both, they are quite different:

\- grpc and HTTP/2 have a fixed paradigm (RPC plus streaming), whereas websockets are lower level and just describe how packets are transferred in each direction. For PRC you have to build something on top (e.g. following the WAMP conventions).

\- grpc on top of HTTP/2 features per stream flow. Doing something like transferring a 4GB file on top of websockets without loading everything in memory is not as easy, since flow control is somewhere between basic and missing there.

\- They have different ordering guarantees. grpc doesn't gurantee ordering between different requests, websockets guarantees it between messages.

\- grpc comes with an interface definition language (protobuf) and code generators, which makes it much easier to build interoperable and backwards compatible services.

\- gprc is proxyable per request, since each stream contains all relevant information (endpoint, parameters, auth, etc.). In total grpc and HTTP/2 are more stateless than a websocket connection, which could contain any kind of data.

\- websockets work out of the box in browsers. The original grpc specification not, due to relying on features that are not exposed in browser APIs.

<comment><USER3> Since you brought it up, what are your _(or anyone in-the-know 's)_ opinions on transferring large _(~GB)_ files via gRPC?

I recently implemented my first gRPC service and while it went nicely, I ended up writing a somewhat gross HTTP service along side the gRPC service to push and pull bytes to. After some short research _(not testing myself!)_ , it sounds like gRPC has significant overhead for large files due to having to chunk each file up, and the byte chunks end up not being efficient on CPU time/etc.

Since my download service required no security/etc that gRPC might excel at, I just used gRPC for setting up the download/upoad, querying data, etc.

It would have been much simpler to fully use gRPC for the upload and download, but it sounded costly. With no specific question, what are your thoughts on gRPC streaming "large" data?

example perf tests: [https://ops.tips/blog/sending-files-via- grpc/](https://ops.tips/blog/sending-files-via-grpc/)

<comment><USER2> In an ideal implementation it should be pretty much as fast as plain HTTP/2, since the overhead is only a bit of protobuf framing between chunks. Which depending on the chunk size is negligible.

However what I think comes into play in the benchmark is the behavior of the real library, and most likely the garbage collector. There might be paths in the code where the each chunk is freshly allocated and later on dropped. This gets more costly if chunks get bigger, which might explain the degradation in the measurements.

In this example the client's chunk size is allocated once and everything else is a cheap slice, which should be good. However for the server I'm not sure, I guess it might allocate the buffer for each chunk just in order to drop it later on. Then you could investigate if you can give protobuf a prepopulated data structure with a reserved maximum size (e.g. from a pool) that it should use for deserialization, which might speed things up.

Another thing which obviously comes into play is the performance of HTTP/2 implementations, which may vary a lot. I think even for Go, the HTTP/2 implementation in the net package and the one in grpc where different (not sure if they unified them now, there was an attempt on the way). So the question would need to be investigated separately for each of those.

<comment><USER3> Appreciate your insight!

</comment></comment></comment></comment><comment><USER4> Are you really asking why not replace a well-defined RPC protocol that has properly specified data serialization and error signaling with a randomly slapped together half of an RPC protocol?

<comment><USER5> REST is not intended to be a RPC protocol. Comparing it to one isn't appropriate.

The point of REST is to totally and generally describe the semantics of a networked application's state transitions and is protocol-agnostic. GRPC exists to invoke remote functions.

Why use REST? That's well-documented in Fielding's thesis [1]. Use the appropriate architecture for the appropriate task.

[1][https://www.ics.uci.edu/~fielding/pubs/dissertation/fielding...](https://www.ics.uci.edu/~fielding/pubs/dissertation/fielding_dissertation.pdf)

<comment><USER4> > REST is not intended to be a RPC protocol. Comparing it to one isn't > appropriate.

Ah yes, an obligatory reminder about this cute little original idea that never got implemented for computers to consume. Though whenever somebody talks about REST _API_ , they mean "almost RPC with underspecified semantics", not a hypertext driven way of fetching the data.

<comment><USER5> The web, as it is consumed by humans, generally adheres to the RESTful constraints quite well. RESTful architecture (e.g. the architecture that lets you use one client to consume literally billions of applications and provides the mechanisms for you to move between them totally transparently) works very well for building a specific kind of application. Now, most of us are not building the web, and so we have other constraints that are often times more important. You are mistaken in your assertion that this was never implemented, considering the fact you posted this comment from a REST client.

A general comparison of REST and RPC is as unproductive and harmful as blindly making "REST APIs" everywhere. The way to escape this game of buzzword bingo is to introduce nuance to our conversations about architectures, not by changing the buzzword.

<comment><USER4> >>> REST is not intended to be a RPC protocol. Comparing it to one isn't appropriate.

>> Ah yes, an obligatory reminder about this cute little original idea that never got implemented for computers to consume.

> The web, as it is consumed by humans, generally adheres to the RESTful > constraints quite well.

Quite an apt observation: _as consumed by humans_. But we're comparing something that's commonly called "REST" to _an RPC protocol_ , and RPC protocols are quite clearly intended for computers, not humans. This something that is commonly called "REST", even if you argue it's called incorrectly, is very far from the famous PhD thesis.

> You are mistaken in your assertion that this was never implemented, > considering the fact you posted this comment from a REST client.

OK. If you say that I'm wrong about implementations, show me where's a production system _where the computer is the primary consumer_ (i.e. not merely a terminal for displaying something to a human operator, and not a second-class citizen like web crawling bots) and the system is RESTful in the original meaning. I can't think of even a single one. Note, however, that WWW cannot be considered such an implementation, because its primary consumer is human, not computer, and I remind you once again: we're talking under this post about unsupervised computer-to-computer communication, where human operator is a rare guest.

> A general comparison of REST and RPC is as unproductive and harmful as > blindly making "REST APIs" everywhere.

Much less productive is trying to pull an unrelated idea (the original meaning of "REST") into discussion about machine-to-machine communication, especially that the original term was created post factum to describe WWW's architecture (already existing back then!) and wasn't used for pretty much anything else, so introducing the term hasn't advanced nor produced anything.

<comment><USER5> We agree that ad-hoc RPC mechanisms are inappropriate.

REST is not a RPC mechanism - people wrongly "using it" as one does not change what REST is, simply because there is a wealth of academic and industrial knowledge that uses REST in a specific way. This way is formally defined, and retroactively changing the meaning offers no immediate advantage.

Again: when a statement "REST is worse than RPC" is evaluated, it implies to people (who are already obviously confused) that REST is worse than RPC. When people look at what REST is (i.e. Fielding's thesis) they are further confused, because what Fielding describes obviously isn't designed to compete with RPC. RPC existed when Fielding was writing his thesis and developing HTTP. He wasn't solving the same problem.

The best thing to do is to instruct what REST actually is so that the confusion is dispelled. Perpetuating ignorance only leads to more problems. Pointing out that REST is not an ideal mechanism for machine-to-machine communication is therefore extremely relevant.

Fielding was heavily involved in the design of HTTP 1.1. The justification of the design decisions is REST and became his thesis. Implying that Fielding was disconnected from the design of the web is factually incorrect.

Folks on Hacker News (where the web is obviously one of the most common application delivery mechanisms) might want to know how well-behaved web applications are constructed. That's definitely relevant to this thread and community.

</comment></comment></comment></comment></comment></comment><comment><USER6> gRPC isn't really designed with web programming in mind at all; it's primarily used for server-side languages. (For example, it supports 64 bit ints.)

</comment><comment><USER7> It's almost exactly like the difference between static and dynamic languages (with gRPC being the static option). It's an order of magnitude faster and (like you said) to a certain extent enforces compliance with an API. Brittle, though.

<comment><AUTHOR> i get it's faster over http, but i haven't seen much when it comes to websockets.

</comment></comment><comment><USER8> You can build gRPC and get REST for free.

[https://github.com/grpc-ecosystem/grpc-gateway](https://github.com/grpc- ecosystem/grpc-gateway)

<comment><USER3> Hell, I don't know how production-friendly it is, but it sounds like clay[1] will even give you http-json endpoints without setting up a 2nd server.

[1]: [https://github.com/utrack/clay](https://github.com/utrack/clay)

 _edit_ : If you're using Go, of course.</comment></comment>


What Can You Build in 600 Lines of Code? - <AUTHOR> https://blog.codinghorror.com/what-can-you-build-in-600-lines-of-code/ <comment><AUTHOR> Also related: [http://aosabook.org/en/500L/introduction.html](http://aosabook.org/en/500L/introduction.html)

I would love to read if you guys have more examples of this.</comment>


Ask HN: Rust concurrency vs. Go after drop of green threads and segmented stacks? - <AUTHOR>

I have been a big fan of the Go programming language, and how it allowed me to write concurrent multi-core programs with minimal effort.
The lack of generics and an enforced GC still makes me very intrigued of the Rust programming language as an option for many future use cases, especially as Rust used to have something comparable to the go-routines and channels in Go.
After I heard they are moving out green threads to the standard library [1], and also abandoning segmented stacks [2] (something I'm not as much knowledgeable about, but have understood it has implications for concurrency), I'm starting to wonder whether it ever will offer the same strength in terms of building concurrent multi-core programs, as in Go.
Would be cool to have some experts give their views on this, and elaborate a little on what the consequences of those decisions will be, especially compared to what we have in Golang.
[1] https://mail.mozilla.org/pipermail/rust-dev/2013-December/007565.html
[2] https://mail.mozilla.org/pipermail/rust-dev/2013-November/006314.html <comment><USER2> Just a small note: Go has also abandoned segmented stacks. They were a placeholder until Go got precise GC which enabled it to use contiguous stacks with pointer rewriting. Here's a good explanation of this – [http://agis.io/2014/03/25/contiguous-stacks-in- go.html](http://agis.io/2014/03/25/contiguous-stacks-in-go.html).

<comment><AUTHOR> That's a very relevant point, thanks for the link, will check!

</comment></comment><comment><USER3> What exactly are the "concurrent multi-core programs" you wrote in Go doing? Do you have any examples of concrete problems you had that became easier to solve when you used Go's concurrent multi-core features?</comment>


Protecting users from insecure downloads in Google Chrome - <AUTHOR> https://security.googleblog.com/2020/02/protecting-users-from-insecure_6.html <comment><USER2> This is long overdue. It was kinda crazy how you couldn't even visit a plain HTML page over plain HTTP without Chrome showing a "Not Secure" badge in the URL bar, yet downloading an executable file over an insecure connection produced absolutely no warning at all. You couldn't even manually check whether the file was downloaded over a secure connection without explicitly going to the downloads page. (I think Firefox is even worse in this respect right now, in that the only way to check where a file was downloaded from is to open the downloads library, right click an item, click "Copy Download Link", then paste it into a place where you can read the text.)

One thing I do find particularly interesting about this post though is the part where they imply they might start blocking _all_ insecure file downloads at some unspecified point in the future. That would be a pretty major move.

</comment><comment><USER3> Both Microsoft and Apple ignored my emails regarding them serving HTTP downloads from HTTPS pages. I guess they'll pay attention when this sort of security feature gains enough traction.

<comment><USER4> Those downloads from MSFT and AAPL are signed binaries, which the OS verifies, so download over HTTP is much safer.

Still, I agree unencrypted or unauthenticated transport has no place on the Internet in 2020.

</comment></comment><comment><USER5> hopefully disabling javascript on http sites will follow</comment>


This Isn't an Operating System, It's an RPG - <AUTHOR> http://kotaku.com/this-rpg-is-based-on-an-operating-system-1793059177 <comment><USER2> desktop environment _

</comment><comment><USER3> This looks pretty neat</comment>