Lyft's Nice-Guy Strategy Leaves It Struggling to Catch Uber - <AUTHOR> http://www.nytimes.com/reuters/2016/04/21/technology/21reuters-lyft-ubertech.html?partner=IFTTT <comment><USER2> >"We were trying to figure out a way to reward Lyft for having better business practices and not violating our laws,"

You shouldn't need to particularly reward businesses for not breaking the law, surely. You should be able to punish those that break the law sufficiently harshly that breaking the law is not profitable.

On a different note, I wonder what the requirements are for a distributed marketplace. Extremely similar things are regularly built, is there enough common in the area of "request quotes/bids for services/items, set time limit, pick one" to become just an open protocol? I guess the harder parts would be dispute management and reputation, though they don't seem like impossible hurdles.

<comment><USER3> >>You shouldn't need to particularly reward businesses for not breaking the law, surely. You should be able to punish those that break the law sufficiently harshly that breaking the law is not profitable.

This point is very important. But why do we see people tempting to reward businesses which do not break law?

Because, we seldom see the ones breaking the law getting punished severely. What happened to Volkswagen? The CEO didn't even get the proverbial slap on the wrist, instead he got fucking multi-million dollars in reward! Was Volkswagen forced out of business? Hell no. What happened to Goldman Sachs and other such criminals? Nothing serious. Uber is getting free ride by breaking laws. What happened to it? Nothing.

So, people tend to think that way. Beyond that this is a very serious threat to free and open market economy and even the western democracies. As this is used by the covert and overt opponents and enemies of western free market economy based democracy to push forward their communist (or other equally bad ism) propaganda. It reminds me all that 99% vs 1% propaganda.

And unless, this is fixed, I guess, many general people in the western world will continue to fall prey to their vicious propaganda.

<comment><USER4> How is it propaganda if all that you said it's true? With all your fear mongering ideas of communism, you can't blame them for capitalism own weakness. Karl Marx[1] predicted this and that's why he postulated that capitalism would prey on itself. Everyone who tried to warn about this weakness and every call to fix this (just like your comment) was dismissed as communist and enemy of the western world. Communist might be a bad idea, but not everything should be treated "vicious propaganda".

[1]: Born in Prussia, part of the Western world AFAIK.

<comment><USER3> >>How is it propaganda if all that you said it's true?

That's a good question as it raises a very important point, namely, the weakness of capitalism. But what I think is this weakness of capitalism can and must be tackled from within the capitalism. Sadly, at this moment, at least in the US we are not seeing any serious efforts being done in this direction.

>>With all your fear mongering ideas of communism...

Time and again, communism and Marxism have demonstrated how vicious these ideas are: e.g. the mass killings and suffering of people in China, Russia. See these [1], [2].

The fear is not baseless, whereas the "free market economy based democracy" has been seen to be the best societal structure ever existed. I don't mean it can't be made better but that improvement can certainly not be brought by turning to Marxism [3].

>>but not everything should be treated "vicious propaganda"

I agree with you to some extent here as not everything should be treated "vicious propaganda". (That's why I upvoted it.)

But it can be seen clearly that communists and Marxists are trying to take advantage of such things by creating "propaganda" items like 99% vs 1%; and trying to sway the public opinion in their favor. This is vicious because they are trying to portrait everyone within the top 1% to be vicious while demanding "free rides" (in the Marxist style) for everyone within the 99%, whereas we can see that only some people at the extreme top are doing somethings wrong. And thus with such propaganda these people are trying to kill the very "free market economy based democracy" itself.

[1] [https://en.wikipedia.org/wiki/Gulag](https://en.wikipedia.org/wiki/Gulag) [2] [https://en.wikipedia.org/wiki/Tiananmen_Square_protests_of_1...](https://en.wikipedia.org/wiki/Tiananmen_Square_protests_of_1989) [3] [https://en.wikipedia.org/wiki/Critique_of_Marxism](https://en.wikipedia.org/wiki/Critique_of_Marxism)

</comment></comment></comment></comment><comment><USER5> Alot of people in this thread talking about how they won't use Uber for whatever reason. Those are the minority of opinion.

More people will use ride services when they are cheaper. Rides are a commodity. You will get there just as much with Uber as with Lyft. It doesn't make that big of a difference to most people. It's like the level of luxury in a car. I'm sure it's rare to find people not taking a Lyft or an Uber because the car didn't have leather seats.

I'm a daily user (to and from work, carless for over 18 months now) and I use the cheapest option. Historically it was Uber. Checked and for the past 4 months or so, it's be Lyft so I switched. Now it's back to Uber because of one reason, price.

The drivers on Lyft seem a bit happier and nicer but, it doesn't really make that much of a difference. I'm not using a car service for the quality of a 10 minute conversation with a random stranger that I'll never see again.

<comment><USER6> I use Uber because it's the only good cab company in Europe.

<comment><USER7> That seems like a bit of a generalization considering Europe contains about 50 different countries.

<comment><USER8> Quite a lot of which have pretty much the same level of service (apps included) _and_ are also legal.

</comment></comment></comment></comment><comment><USER9> 5 days ago: Lyft gaining on Uber as it spends big on growth (sfgate) [https://news.ycombinator.com/item?id=11509461](https://news.ycombinator.com/item?id=11509461)

Today: Lyft's Nice-Guy Strategy Leaves It Struggling to Catch Uber (nytimes)

Confusing world.

<comment><USER10> They are both propaganda pieces. The first was paid for by lyft, the second by Uber.

PG wrote an essay about this type of thing, but I can't seem to find it right now

<comment><USER9> Yup, I thought it was worth pointing it out. re: [http://www.paulgraham.com/submarine.html](http://www.paulgraham.com/submarine.html)

</comment></comment></comment><comment><USER11> The story does't quite match the headline. The take-away seems to be that in the face of a substantially better resourced competitor, Lyft is holding its own and even gaining, in large part due simply to happier constituents.

</comment><comment><USER12> It's interesting that these two companies are so competitive that they can't even work together in trying to win over regulators. Doing so would likely be mutually beneficial by increasing the size of the pie. Evidently it will require an even bigger threat, such as the one DraftKings and FanDuel face, to bring them together in common cause. I just feel like this rivalry has become overly personal.

</comment><comment><USER13> I use Lyft (as a rider) exclusively, and have never been picked up by a driver who did not also have an Uber phone on their dash.

<comment><USER14> I don't understand how that's possible. I thought Uber was about big expensive black cars with drivers in suits, and Lyft was about regular people giving you a lift in their hatchback. I've never take a Lyft, but I can't imagine the Ubers I've been in putting a pink moustache on their top-of-the-range Mercedes.

<comment><USER15> That is uberBLACK. Most rides are UberX

<comment><USER14> I knew about UberX but I thought that was just a side-project. I always thought Uber's tagline was 'your personal driver' and all the photos on the website used to be black cars.

<comment><USER16> Uberblack is the side project at this point. The big money is in the majority of people that need to get from point X to Y cheaply.

</comment></comment></comment></comment></comment><comment><USER17> I really hope that Uber goes under one day.

<comment><USER18> You are entitled to your opinion, but I am curious as to why you would say that. Based on business / ethical practices, or is it something else?

<comment><USER19> I'm not that bothered by them personally, but I would rather see these international taxi brands gone. They take away income and entrepreneurship from local economies.

The world is slowly becoming a boring homogeneous place run by multinational brands. It's like fast food outlets, coffee shops and so on, most of them are run from another country and look exactly the same - there's no character.

<comment><USER20> I feel you. I moved to Seoul, South Korea a few months ago, a city of many thousands of coffeeshops. Among the natives, Starbucks is really popular -- meanwhile I go out of my way to avoid going there, because it's frustrating to move 8500km and not feel the distance traveled after putting the effort into it. The rising popularity of IKEA, which arrived in Korea about two years ago, is concerning for the same reason.

It's really not about naively craving exoticism (which inevitably wears off anyway), it's just a desire for an environmental confirmation of a major life change, the absence of which is psychologically disconcerting.

Luckily there's still a boatload of little unique, charming. non-chain coffeeshops to go to, too.

<comment><USER21> If there's one thing I really missed during my time in Korea, it'd probably be Ikea. There's just no good alternative.

<comment><USER20> You can always play gmarket roulette ...

</comment></comment></comment></comment></comment></comment><comment><USER22> If Lyft ever expands to Australia, I will make a concerted effort to use them over Uber.

</comment><comment><USER23> I have only been using Uber for about a year, and haven't given Lyft a try because my credit card gives me 20% cash back on uber. That promotion ends soon, so I will probably try Lyft then.</comment>


It's time to start eating bugs instead of turkeys - <AUTHOR> https://www.linkedin.com/pulse/article/20141129043412-5439992-it-s-time-to-bring-insect-based-food-to-mainstream-consumption

<comment><USER2> It is time to understand that this kind of noise is result of EU grants given to research eating bugs.

I am not arguing that eating much of meat is necessary - I do not eat much of the meat and maybe there are some benefits in eating bugs.

But I am sure that people in responsible nations who to not bread exponentially do not need to change their habits because of people who do.

<comment><AUTHOR> It doesn't make sense to eat bugs right now. It's too expensive. That may sound ridiculous but it is true. The cheapest form is to consume them directly without heavy processing but we, American, don't do that (they look gross!!). So my point is at insects as food is still in very early phase until it can reach that cost vs. benefit curve. One day, we eat lunch protein bar made from roaches and we don't even care.</comment></comment>


Trucking 'bloodbath': 4,500 truck drivers lost jobs in August - <AUTHOR> https://www.businessinsider.com/trucking-bloodbath-4500-truck-drivers-lost-jobs-in-august-2019-9 <comment><USER2> 4,500 / 3,500,000 = 0.1% decline in truck drivers.

The industry probably has outsized exposure to the escalating trade wars and increasing tariffs.

<comment><USER3> AFAIK there is a greater percentage of trucking businesses going down than truck drivers. Consolidation. Amazon, etc.

Article even says "It was the first time since March that truckers saw job losses."

<comment><USER4> This point wasn't clear to me reading the article. I got the impression that many of those bankruptcies were independent owner/operators but that the reporter was trying to downplay that and rather let us believe these were large operators on the brink of collapse.

</comment></comment></comment><comment><USER5> Orders for new Class 8 trucks are down about 80% year over year. [https://ftrintel.com/news/latest- orders/index.php](https://ftrintel.com/news/latest-orders/index.php)

<comment><USER6> It seems however that 2018 was a "record year" so maybe it's just back to "normal"?

<comment><USER7> Apparently they are "[the] lowest since 2010": [https://www.truckinginfo.com/337568/july-class-8-orders- lowe...](https://www.truckinginfo.com/337568/july-class-8-orders-lowest- since-2010)

<comment><USER8> Probably waiting to see how the electric trucks pan out before purchasing.

<comment><USER9> Probably not. Demand for investment goods just varies very strongly with economic cycles.

</comment></comment></comment></comment></comment><comment><USER10> 4500? That's almost noise level. Certainly it's not anything close to a bloodbath. Truck drivers are the #1 job in the US, @ 3.5mm drivers.

But then again, it's BI so ...

<comment><USER11> What is 3.5mm supposed to mean? Million? What's the second m?

<comment><USER12> It's a matter of preference.

M = mega (in metric) = one million

MM = two of the roman numeral M = one thousand thousand = one million.

Both are correct.

<comment><USER11> I see, so when people use nMM they're using roman numerals to indicate million units?

TIL

That seems rather spurious and ambiguous, considering people generally use nK for thousand units, and mixing roman numerals now makes metric nM a collision with thousands.

<comment><USER10> MM is a financial abbreviation. It used to be "the standard" but nowadays they also use M.

Compare with the "M" in CPM, which is not the roman 'M' but the French 'Mille'.

So, "M" is sometimes ambiguous. In this case it wouldn't be, but I always use mm or MM to mean million, and bn or BN to mean billion.

</comment></comment></comment></comment></comment><comment><USER13> i dont understand, everybody was saying theres a million trucker jobs unfilled

<comment><USER14> It's PR to keep truck driving wages artificially suppressed.

<comment><USER15> Then a bunch of unfilled jobs would do the opposite (it would raise wages).

<comment><USER16> If there is in reality a glut of drivers, then repeating that there was a lack of drivers would bring in more drivers in spite of the glut, depressing wages.</comment></comment></comment></comment>


The Scariest Jobs Chart Ever Isn't Scary Enough - <AUTHOR> http://www.npr.org/blogs/money/2013/02/15/172116698/the-scariest-job-chart-ever-isnt-scary-enough

<comment><USER2> Its tempting to doubt this chart because, after all, the original is based on percentages and that accounts for relative population through the decades.

But, I think (and it isn't entirely clear) that the op is claiming that since population changes During The Recession, the chart percentages need to be corrected throughout the period of the recession. Since population is growing, recovery compared to the original population is actually worse when compared to the growing population. Sort of like compound interest.

Any statisticians around that can make this clearer?

</comment><comment><USER3> Where did all the "green shoots" go?</comment>


Life at Basecamp - Six Months In - <AUTHOR> http://money.cnn.com/2008/06/30/smallbusiness/online_collaboration_software.fsb/index.htm

<comment><USER2> We've been using Basecamp + Campfire for a few weeks on our project, and I have to say that I really like it so far.

I AM really concerned about the amount of content in our Basecamp site growing out of control -- already, I have to scroll several pages to add a note to an old, seldom used message... we already have fifteen or so writeboards. If there's a way to archive this stuff, it's not readily apparent to me (although I am a bit of a dolt).

For those who have used (and enjoyed) Basecamp, has this been a problem for you as your project expanded?

As an aside, did anyone else find the embedded headlines for other stories in this article dreadfully confusing?

<comment><USER3> I used to use Basecamp as part of an eight-member team for web projects. After a few weeks, it had so many rabbit holes of data in it (each one created by different users who created different organization systems) that I stopped using it because I had no idea where to look any more.

But that's not really a fault with Basecamp itself - it's just as much of a problem with any system that allows users to create their own categories or folders, like SharePoint.

It was doubly annoying that I was forced to use two systems for communication - Outlook and Basecamp. First someone would go into Basecamp and write a message - and because they had subscribed me to it, I'd get an email with their note included.

To reply to it - instead of using Outlook, which normally would be dead easy since I could just click "reply all," I'd have to figure out where to go in Basecamp to reply to it - which was so difficult to do that I never did. Instead, I'd typically just reply to the message using Outlook, which of course defeated the purpose of Basecamp.

</comment></comment><comment><USER4> Interesting article. It pointed out a lot of flaws in 37signals software that are clearly intended. Whether a lack of features and a strict conformance to bare software is a net positive or negative for small business is another conversation, but this does point out a need for features that they are missing.

This also comes along with 37signals' post on the permanent nature of features, and the importance of getting it mostly right from the beginning.

On that topic, the idea of providing business services in the mindset UNIX tools is beginning to be really attractive to me. Provide a limited set of features in a small bundle that plays well with other services, along a similar mindset. A billing component, a collaboration component, etc, such that each one can play with another very well. That should make offering new services more painless and intuitive.

Any takes on a venture? :)

<comment><USER5> _It pointed out a lot of flaws in 37signals software_

It pointed out the major flaw in the 37signals _philosophy_ : they're frozen. Sure they moved apps from the desktop to the web and simplified them greatly, two very appealing propositions for many small businesses. But OP presents a clear example of the flaw: What do you do when you have grown and your app _can't_?

Apply all the perfume you want, but if your app can't scale or be customized, in the end all you have is what you started with: a canned package.

<comment><USER6> I would have to disagree with you on this matter - Basecamp on its own provides enough features for most users, and their API is powerful enough to allow for nearly limitless expansion. Where I feel the company fails is in promoting this API to consumers. If the company had a directory of third party tools, a job board for Basecamp API developers, and built a few extension tools of their own I feel they could appease the nay-sayers while sticking true to their philosophy

</comment></comment></comment><comment><USER7> I think the premise of the article is misguided. If they need time tracking with accounting software integration, have they tried Harvest?

Linda sounds like the problem not basecamp. If Linda was doing a good job she would have researched problem and turned up Harvest-- at least as an option to try.

Instead she fell into the 'this is the way it's been done before mindset', that doesn't recognize the benefits of collaboration or web services.

In my experience, Linda's approach may make her feel like every penny is accounted for, but that will only be true in her books. Everyone else will be left with a print out of a week old, outdated gantt chart, and less certainty about what to do.

<comment><USER8> This is a great quote "every penny is accounted for, but that will only be true in her books." One of the strengths of a collaboration app, in particular if you grant customers acces to the workspace, is that you are better able to focus on the value that you are delivering, not the hours you are working. Clients pay for results not hours: I question why the strict focus on hours. We use CentralDesktop and are happy with it, but I would never confuse it with a time tracking system.

</comment></comment><comment><USER9> "Expect to either make a major investment in developing your own financial and tracking software that works with Basecamp to make it do what you need (37Signals provides an open applications development toolset, so this is certainly possible),"

Business opp, anyone?

<comment><USER10> Was just thinking the same thing. How hard would it be to use the API to pull data into a csv format? That seems to be what his main gripe was, after all.

</comment></comment><comment><USER11> Jason Fried sez: we'd prefer that you outgrow our software, because we still have your fucking money. Hah!

In 37Signals' defense, they don't have time to bend over backwards for each and every little customer whim, especially enterprisey-type crap like this customer wanted. You have to be utilitarian or else you're dead.</comment>


Cook up presentations with Git - <AUTHOR> https://github.com/jingweno/jekyll_and_hyde JekyllAndHyde is a HTML presentation generator that generates a basic Jekyll scaffold with Slippy hooking up. <comment><USER2> An alternative that's been around for a while is Pandoc, a document converter written in Haskell. It can make S5 and Slidy slide decks from Markdown.

[http://johnmacfarlane.net/pandoc/README.html#producing- html-...](http://johnmacfarlane.net/pandoc/README.html#producing-html-slide- shows-with-pandoc)

<comment><AUTHOR> That's pretty cool! Thanks thomas11! Since jekyll_and_hyde is based on jekyll, it supports Textile as well.

</comment></comment><comment><USER3> Looked at the demo: it makes a total mess all over my history stack.

If you're trying to be "trend and geek," build a system that doesn't break the back button. Unless you're building a CSS3-only engine, you don't have to store the state in the URL. You can still parse the URL fragment to allow people to deep link the slides, having a small "link to this slide" button is worth it not to have to force the user to click back 20 times to leave the presentation.

Although I guess if you're using the TOC to navigate the slides non-linearly it could be considered a feature.

<comment><AUTHOR> Thanks for the comments JonnieCache!

Hmm...I guess this is more a preference on how to use the back button on a browser. If you have open up any GitHub's repository on a HTML 5 compatible browser, you can find that it has similar design.

jekyll_and_hyde is just a simple hook over jekyll and slippy(the jQuery plugin that make your HTML file a presentation). It doesn't force you to use slippy as the presentation library. To use other library/template for your presentation, you may type in "jh new new_presentation --template=your_template_git_repo" during its creation.

</comment></comment><comment><USER4> This is quite impressive, I have to admit. Though being that there is a Jekyll python-clone called Hyde, I thought they were finally being brought togetherf...

</comment><comment><USER5> This is nice, although it's pretty similar to Showoff. <https://github.com/schacon/showoff>

<comment><AUTHOR> Showoff is pretty cool too! But the shiniest point of jekyll_and_hyde that I would like to mention is its tight integration with jekyll, which is the GitHub Pages rendering engine. That means you can publish your slides just by simply pushing it up to GitHub :).

<comment><USER5> Ture, although you can also just run showoff github and have the same thing :p

</comment></comment></comment><comment><USER6> I think I'll just stick with Beamer. Not seeing any clear advantages here.

<comment><AUTHOR> Beamer is pretty cool too. I myself like ti a lot. One shiniest point of jekyll_and_hyde is its tied integration with GitHub, which runs a jekyll rendering engine for its GitHub Pages. You can just simply push your presentation markup to GitHub and it works.

</comment></comment><comment><USER7> This is awesome! So much better then taking a USB or downloading a file. Will definitely be using this.

<comment><USER6> If you can upload an html presentation, why can't you upload any other sort of presentation?

<comment><AUTHOR> The things is you wanna minimize your toolset of making your presentation, such as just using Git and Textile. Of course other sort of presentation has their places

</comment></comment></comment><comment><USER8> You've made my day.

Finally making presentations won't suck so bad. Or at least I hope it won't.

</comment><comment><USER9> It's pretty cool but I would rather use HTML5 and maybe jQuery, that would be easier I guess

</comment><comment><USER10> Thanks jingweno, will start using it this week for my own dev slide collection.</comment>


OpenCore bootloader – open-sourced Apple UEFI drivers, enabling Hackintosh - <AUTHOR> https://github.com/acidanthera/OpenCorePkg <comment><USER2> Hackintoshes are very stable if:

\- You buy the right hardware. Intel CPU and AMD GPU. Choose Ryzen if you like those and like tinkering and hacking on your OS a lot. And no, it's very unlikely your Nvidia GPU will ever work with a recent macOS.

\- You use the vanilla method of macOS install. The dortania guides along with /r/hackintosh are all you need. Avoid tonymacx86, insanelymac, and any software with the word "beast" in the name. Run screaming from them. Do not mess with the OS install, do not put any kexts into the OS install. Put everything into EFI.

\- You set aside the occasional day for OS updates (and possibly updating OpenCore). You do not want to update willy-nilly and you definitely want to wait a day or few for the more brave to guinea pig any issues.

I've been using a 8700K/RX580 hackintosh for years now, and in many ways, it's been more stable than my actual Macs -- and certainly more modular and expandable.

<comment><USER3> Dont use Ryzen, virtualization does not work, including Docker and some other apps like Adobe ones are buggy. Other than that I agree. I made a hackintosh a month ago for half the price of what I would need to pay Apple and it is rock solid. Everything works including all wireless features like sidecar, airdrop, etc. Sleep, thunderbold, rx5700xt, everything is working well.

<comment><USER4> I use Ryzen in my "Hackintosh". However, these days I've been using GPU- passthrough and running macOS in a VM on top of Linux.

<comment><USER5> This is what I'm planning on doing. Have you had any issues? The thing I'm most concerned about is hooking my apple id up to it for icloud.

Any recommendations?

<comment><USER4> The recommendation to use an AMD GPU still stands, since it's passed into the VM. I've been using an RX 560D on Catalina (the one that didn't advertise having 2 fewer CUs, grrrr) without any graphical trouble.

iCloud mostly works, the only two apps that I can't get working are iMessage and FaceTime. This is a common issue for all Hackintoshs, it's not a VM specific problem. It comes down to needing to provide a real Apple SN that matches the kind of Mac you set your Hackintosh to identify as. I'd half recommend picking up a broken / for-parts iMac off eBay to lift the serial number off of (and to say you do actually own a Mac =P ).

I did have some trouble doing passthrough of NVMe drives in the past. I don't know if this was the VM's fault or the fact that it would get hooked by Linux on the host boot and then be unbound before booting the VM. I haven't tried again in the last 18 months, so it's entirely possible any issue there got fixed. I've been booting from an iSCSI volume from my NAS (QEMU hides this fact from macOS).

I should add that I moved away from the Apple ecosystem awhile ago in terms of my personal data. I use a mix of Google services and NextCloud (hosted on my own hardware). My Apple ID getting banned isn't too much of a concern for me. I've never heard of someone actually getting their Apple ID blocked for using a Hackintosh, I figure there are so few people actually doing it it's not worth it to Apple to enforce.

That being said, I don't know how they'd respond to a wealthy company using a bunch of Hackintoshs. I still don't understand how they expect people to properly do CI/CD for iOS without macOS in a server / virtualization environment though. My employer uses rack mount sleds for Mac Minis, but without proper IPMI, managing them is a pain. I wish you could license macOS for a virtualization environment so you could deploy a few 1U dual socket 64 core EPYC servers (128 core / 256 thread total) rather than 4x 6 core boxes per 1U.

Either that, or they should let the toolchain run on more than just Macs. I think that is one of the major features of React Native - you can develop your apps on whatever machine you want. You only need a proper Mac when you're bundling for release.

</comment></comment></comment></comment></comment><comment><USER6> I use OpenCore, on my 2010 27" iMac of all things. Needed to enable target display mode and native brightness control on the new K610m GPU. So in essence, my actual Macintosh is now a Hackintosh in Apple's eyes.

If you have a 2010 or 2011 iMac with a dead GPU btw, check out this thread on the MacRumors forum: [https://forums.macrumors.com/threads/2011-imac-graphics- card...](https://forums.macrumors.com/threads/2011-imac-graphics-card- upgrade.1596614/)

<comment><USER7> I did something similar.. I had an original Mac Pro, which didn't support 64-bit MacOS because Apple's UEFI ran in 32-bit mode and Apple's boot loader / kernel never supported switching into 64-bit mode from 32-bit mode. So to use that machine for 64-bit driver development, I had to make it into a "hackintosh", where they had a UEFI that would run in 64-bit mode..

</comment></comment><comment><AUTHOR> I bought an EGPU 1.5 years ago with the idea of replacing my gaming computer with my MacBook Pro running Windows. But due to the limitations of Thunderbolt 3 and the throughput from my enclosure, I cannot get consistent frame rates which is critical for playing fast-paced competitive games like Apex legends. It really sucks and this point, my $1000 EGPU is currently acting as a fancy adapter + charger + enabling smooth scrolling when surfing the webz.

But I have been exploring the idea of converting my gaming computer to a Hackintosh instead. This looks very promising since I require stability and security.

I just wished there was a combination of above solutions; no need to compromise between stability and performance.

Finally, some might say; just buy a Mac Pro! Well, I cannot motivate $6000 Just because I want to game every now and then.. :)

<comment><USER8> Why bother with Mac? I've just built a Xeon E5-2640 using a Chinese X79 motherboard. NMVe, proper Radeon RX580 GPU - in an open build test bench frame. All in all, something like $250 on eBay for everything. Runs the games I like well and looks great on the table, especially with two big red LED fans in front. :-)

<comment><USER9> Some people just greatly prefer using macOS over windows or linux and don't want their entire computer experience to be windows just because they play games now and then.

<comment><USER10> macOS isn't exactly perfect, but I don't know any other desktop operating system that comes even close to macOS in terms of polish and user experience.

I understand that Microsoft can't just redesign Windows over night, but I also fail to understand why Windows isn't better. Better as in more consistent and more responsive.

As much as I like to consider other operating systems, the reality is that I don't want the hassle and macOS just works.

<comment><USER11> Are you primarily a mac OS user? I am primarily a Windows user and when I occasionally have to use mac OS, I find myself regularly facing many seemingly inconsistent behaviors that really surprise me. I'm inclined to think it is a matter of familiarity more than anything.

<comment><USER9> This is likely a huge part of it.

I'm primarily macOS but have a LOT of experience with Windows.

I still feel like I'm fighting against Windows to do anything. I just think different people are suited to different workflows & macOS and Windows are very very different to each other.

<comment><USER12> Having done dev on OSX you are going to be constantly fighting the machine. Apple is worse about walled gardens than MS is. With Apple, you need to do exactly what they want or you will have pain.

<comment><USER9> My experience is the exact opposite - but we're probably looking for different things.

That walled garden approach is why, in my opinion, the OS feels as good as it does. MacOS feels like a mature operating system that Apple have created with restraint and control - where to me Windows feels like a piece of legacy enterprise software with a shiny UI.

If I wanted out of a walled garden, there's no way it'd be to a non *nix based OS - especially not to one that uses it's start menu to pump ads at me.

<comment><USER13> A definition courtesy of wikipedia

> A closed platform, walled garden, or closed ecosystem is a software system > wherein the carrier or service provider has control over applications, > content, and media, and restricts convenient access to non-approved > applicants or content. This is in contrast to an open platform, wherein > consumers generally have unrestricted access to applications and content.

By this definition Mac OS isn't a walled garden, save for kernel modules, although it could become so in the future thus its cohesive design is to be pedantic a product of itself rather than a closed ecosystem. A product of actually having a mental picture of how the whole thing works and a cohesive set of applications to go with it.

Historically windows has without third party applications been a pretty garbage experience even its image and text editors were so bad that you could randomly generate urls until you hit an alternative and most likely get a better choice. Its not shockingly that a platform that doesn't even know what good look likes doesn't have an ecosystem full of anything that represents this.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> The bootloader development in Hackintosh scene never cease to amaze me. I remember the lead developer of Clover bootloader[1] Slice, still developing it on his old Dell with 32 bit Snowleopard when it was being used for Mountain Lion and later.

But the interest in Hackintosh seems to be slowing down[2]? , it's not like Macs have become affordable, if anything Mac Pro is prohibitively expensive and hackintosh generally made more sense to those struck with underpowered Mac Pro.

Most of all, what will happen to the Hackintosh scene due to Apple Silicon? Will the community take up the challenge and make macOS work on Raspberry Pi 10(I understand that Apple Silicon is not vanilla ARM spec) or fizzle out?

[1][https://sourceforge.net/projects/cloverefiboot/](https://sourceforge.net/projects/cloverefiboot/)

[2][https://trends.google.com/trends/explore?date=all&q=Hackinto...](https://trends.google.com/trends/explore?date=all&q=Hackintosh)

<comment><USER15> I can't explain those Google Trends and I won't blame you for trusting them over the feelings of some guy on the internet, but it doesn't match my own experience at all. On the contrary, Hackintosh feels like it has become bigger and more mainstream, relatively speaking.

(Mind, I still think the scene's days are numbered due to Apple Silicon.)

<comment><USER16> Maybe running Hackintosh has become so easy you need less Google queries to achieve it!

</comment></comment></comment><comment><USER17> I'll give a big vote of thanks to the OpenCore developers.

Clover had constant stability problems during boot on my hardware (Coffee Lake, Z390), but OC has been stable since day one (v0.5.6 IIRC). I've not had a single issue since switching.

Also the documentation is second to none.

</comment><comment><USER18> As someone who used to do this myself, I don't quite understand why people still go through all the effort to run macOS. In the past I've built Hackintoshes on desktops and laptops, and it was fun to accomplish (audio through HDMI was especially tricky!), but in the end it was slower, less stable, and not nearly as useful as running Linux on the same hardware. I run Linux on everything these days.

What's the draw? Better off buying a mac if you want the "Apple Experience" anyway. If you don't, I don't imagine why you'd want anything to do with this.

<comment><USER19> I switched away from a hackintosh tower to a real Mac recently because things lined up for that to make sense, but previously I hackintoshed because nothing came as close to checking all of my boxes for a desktop environment as even just out of the box macOS.

No amount of effort spent on customizing Windows does the trick because of things about it that are unchangeable (like its terrible text rendering), and while a Linux setup can get close (especially if eschewing a monolithic DE), it requires pouring countless hours into it to get it there, and even then many details are wrong and random things are flaky.

</comment></comment><comment><USER20> What are everyone's thoughts on the future of Hackintoshes now that Apple is switching to ARM?

<comment><USER21> It's probably 2030 before Intel Mac are no longer usable, which is forever in tech time. ARM seems to be spreading its wings when it comes to high end CPUs at the moment (for example, the 96 core 4 thread ThunderX3) and it's not a big stretch to think that they will become commodity parts for desktops and servers in the near future, especially if Microsoft follow Apple's lead. Given brisk competition and open ARM licencing is quite likely to give x86 a run for its money and takes substantial market share.

Some people suggest that Apple will do some special custom hardware in the CPU that will mean Hackintoshes are impossible, but any hardware can be emulated in software, so it then becomes a performance issue. Maybe your ML workloads will suck compared to Apple hardware, for instance.

I think the biggest danger is that Apple ARM hardware doesn't support non- Apple GPUs, but even then some enterprising hacker will probably accept the challenge and enable a Linux driver bridge or the like.

<comment><USER22> macOS arm64 can run on non-Apple hardware using a relatively lightly changed KVM (and the Qemu-side changes are even less intensive than the iOS on Qemu project). However, it doesn't come without compromises on most hardware.

What I can enumerate as risk factors for running macOS arm64 in a VM:

\- ARMv8.1 atomics are mandatory. This excludes Cortex-A72 devices, like the RPi4, and earlier generations.

\- 16KB page support are mandatory, excludes the RPi4 and other devices too.

\- Rosetta uses an MSR to switch the memory model, this makes x86 threads have to all run only at one core at once on Arm CPUs where there isn't a stronger memory model. Notably, some Arm server CPUs provide TSO, making this a non- issue, and Nvidia's Tegra Xavier CPUs provide sequential consistency, making it a non-issue.

\- PAC, not a big risk factor, trap once and then patch to the non-PAC variant at worst for instructions that aren't in the NOP space.

\- FP16/dotproduct: provided in HW from quite some other manufacturers, and even when it isn't, you could feasibly emulate those fast enough.

On GPUs, Metal paravirtualization exists in macOS 11, maybe would be better to target that for reverse-engineering purposes.

<comment><USER23> > Rosetta uses an MSR to switch the memory model

Even if you give up on Rosetta, there's all the other MSRs you'll need to patch–there's not a huge number of these, but since EL0 has direct access to at least one of these you can't just patch the kernel.

> PAC, not a big risk factor, trap once and then patch to the non-PAC variant > at worst for instructions that aren't in the NOP space.

You know, I don't think Apple really uses the backwards-compatible encodings at all. Probably since they don't need to?

<comment><USER22> Hello,

> Even if you give up on Rosetta, there's all the other MSRs you'll need to > patch–there's not a huge number of these, but since EL0 has direct access to > at least one of these you can't just patch the kernel.

APRR can only remove permissions, not add them. As such, it can be stubbed out. The other MSRs are tunables for CPU errata workarounds, which can just be stubbed too.

> You know, I don't think Apple really uses the backwards-compatible encodings > at all. Probably since they don't need to?

You just need to trap once for each time you see them and then patch it there.

</comment></comment></comment></comment></comment><comment><USER24> My new Ryzentosh is faster (single core Geekbench results) than any of Apple's hardware (iMac Pro, Mac Pro...)

Yet it cost less to build than the Apple charges for Mac Pro wheels.

</comment><comment><USER25> It was incredibly worth it for me to turn my gaming PC into a hackintosh, if only for the experience of running macOS on strong hardware without needing to spend thousands of dollars. Unfortunately, I can't upgrade higher than High Sierra, since I'm using an Nvidia GPU. So I'll have to switch to AMD GPUs at some point down the road. I suppose that's what I get for using proprietary software.

<comment><USER26> You definitely can use later OS releases just need to manually install the drivers using something like [https://github.com/Benjamin-Dobell/nvidia- update](https://github.com/Benjamin-Dobell/nvidia-update)

<comment><USER27> There is no support for newer nvidia gpus on Mojave and newer; not even this script can help, correct me if i'm wrong.

</comment></comment></comment><comment><USER28> Is there a _current_ "most compatible"/"recommended" hardware list somewhere so if you wanted to buy parts for a new Mac Pro-like Hackintosh you'd have the best chance of "everything working"?

<comment><USER29> tonymacx86 has maintained a recommended hardware list that gets regularly updated here: [https://www.tonymacx86.com/buyersguide/building-a- customac-h...](https://www.tonymacx86.com/buyersguide/building-a-customac- hackintosh-the-ultimate-buyers-guide/)

Another useful guide from r/hackintosh lists hardware to avoid: [https://dortania.github.io/Anti-Hackintosh-Buyers- Guide/](https://dortania.github.io/Anti-Hackintosh-Buyers-Guide/)

</comment></comment><comment><USER30> Have been using OC without issue for around six months on my Hackintosh.

Throughout initial set up and upgrading through different releases, I have been very impressed by the quality of the documentation.

</comment><comment><USER31> is a hackingtosh the cheapest way of developing apps for iOS? should I anticipate any problems in case I go that way?

I'm working on some games and apps but only publishing it for Android, cause I don't own a mac.

<comment><USER32> I build iOS apps using Visual Studio 2019 + Xamarin on Windows, then running macOS in a VMWare VM that basically just functions as a build server (Windows communicates with it via SSH). You can find lots of YouTube videos describing how to do it.

It's technically against the macOS terms of service, but the macOS terms of service are likely illegal anyways (monopoly bundling of hardware + software, etc).

</comment></comment><comment><USER33> I never understood the appeal of Hackintosh. Linux has a hard enough time getting touchpad, display, suspend/resume, etc working on regular PC laptops. Does any of that stuff have hope for working well on reasonably modern MacBooks? Maybe this is more for reviving a 10+ year old Apple computer with Ubuntu? I understand that it's kind of fun and interesting but I feel like you're just punishing yourself if your goal is to actually try to use it day- to-day. Just get a Dell.

edit: I now realize this is for running macOS on PC hardware. I remember that I had a coworker back in like 2008 that booted his Dell Mini 10v Netbook with Mac OS X and it was fun to look at but comically non-functional. But he forced himself to use it..

<comment><USER34> > comically non-functional.

I had an eeepc 901 years ago, with an atom chip, and I turned it into a hackintosh running snow leopard. It worked great! Way better than with the original software on it.

Hackintoshes can be really good. Not all are, and you have to be careful about updates sometimes, but it can be very worthwhile. I would probably have it bootable as an option on my current Ryzen workstation, but I went with an nvidia graphics card so it's a no-go. Good thing I also love debian.

<comment><USER35> I'm amazed by this. I started using an EeePC 901 a few months ago, and it barely runs Firefox. I don't know if that says more about the computer than it does about Firefox, but I had no idea such a thing was even possible.

<comment><USER34> It's quite some time ago now! I don't think I even have mine any more...

I guess Snow-Leopard was pretty lightweight compared to what we have now. IIRC I also modded the machine a bit with a 64GB aftermarket storage card. Maybe doubled the RAM too.

Eventually I think the aftermarket storage card died, and I went back to debian/XFCE, then to debian/LXDE, in an effort to try to keep it both current and usable, with chromium for a browser as FF was too heavy.

Pleased to hear someone has one still up and running :)</comment></comment></comment></comment>


No Clojure Projects in Google Summer of Code? - <AUTHOR> http://www.google-melange.com/gsoc/projects/list/google/gsoc2011

<comment><USER2> There were a few Clojure project ideas put forward by LispNYC (<http://lispnyc.org/soc>), but LispNYC's application to be a mentoring organization was rejected.

</comment><comment><USER3> The one node.js project that I see in the list does not look terribly exciting (another chatroom). I wonder if this is at all representative of the other projects.</comment>


Lambda Calculus - <AUTHOR> http://safalra.com/science/lambda-calculus/ <comment><USER2> This page looks like it gives a very nice introduction to "programming" in the pure-untyped lambda calculus. But reading this, one would have no idea that a "meatier" side to lambda calculus existed. Just understanding the Church- Rosser theorem and its consequences, for example, would give a far deeper understanding than anything shown here. One thing that saddens me is that it shows construction of the combinators used to compute partial-recursive functions, but makes no discussion of the significance of this (the partial- recursive functions are an important computational class, and this is essentially a proof that they're lambda computable. Throw in a 6th type of combinator, and you've just proved lambda calculus capable of emulating one of the major models of computation).

It's certainly cool, but there's only so much to be gained from knowing that you can implement the factorial function with (λf .(λx .f (xx ))(λx .f (xx ))) (λfn.((λn.n(λu.λxy .y )(λxy .x ))n)(λfx .fx ) ((λmnf .m(nf ))n(f ((λnfx .n(λgh.h(gf ))(λu.x )(λu.u))n)))) .

<comment><USER3> I also think this article is lacking. Something also about domain[1] theory and categorical models could be discussed. Particular the latter as they relate to abstract machines, .eg. Curien's thesis work on combinators and functional programming. I'm not saying one can explore these in depth, but at least throw them out there for further reading to help provide a roadmap for the "meatier" side.

One could also cite a few programming constructs, .eg. (let (... and show how lisp is essentially syntactically sugared lambda calculus.

I should also add Carl Gunter's excellent "Semantics of Programming Languages: Structures and Techniques", as a good intro to this area.

[1] <http://en.wikipedia.org/wiki/Domain_theory>)

</comment></comment><comment><AUTHOR> I posted this because I'm trying to get my head wrapped around this subject and it is one of the most concise and clear explanations that I've found so far.

I want to get a more complete understanding of functional programming, and that seems to start with understanding the lambda calculus.

<comment><USER4> Understanding modern functional programming via pure lambda calculus is somewhat like understanding C++ via raw assembly. Which is to say, you'll have a great low-level understanding to build on but a long, long road ahead.

It _is_ a lot of fun, though. I once spent a delightful afternoon puzzling out how to subtract Church numerals knowing only that it was possible to do so, having previously worked out the far simpler addition and multiplication functions. Highly recommended!

<comment><AUTHOR> I figure you can't really say you understand a programming language until you can re-implement it from the ground up.

So that's my intermediate goal.

Spot on about C/C++ through the assembler route by the way, if there is one excellent way to really grok those then it is via the -S flag.

<comment><USER5> Implementing a language is complicated enough that by doing so you fully learn the implemented language AND the language used for implementation. Win-win!

</comment></comment></comment></comment><comment><USER6> This page: <http://safalra.com/science/lambda-calculus/recursion/> contains exactly the phrase "Y combinator", which I found exciting. Still trying to understand many other bits of the article.

<comment><AUTHOR> Recursion in pure functional programming has me stumped. I can't see how in practice it would ever 'end' the recursion, in other words, if I try to envision the recursion I see an endless loop in there.

In practice something needs to decide to end the recursion.

Can somebody shed some light on this ?

<comment><USER7> The Y combinator only works in languages with either a lazy or call-by-name evaluation strategy. If you run it in a language with an eager evaluation strategy then it actually would result in an infinite loop. For those languages you would have to use the Z combinator or an equivalent. The z-combinator is just the Y combinator with the argument wrapped in a thunk to prevent premature evaluation.

<comment><AUTHOR> Apologies for ignorant questions, but I don't understand how lazy or call-by- name evaluation would solve that.

After all lazy is just another way of saying 'deferred', and call-by-name is a way to identify what it is that you are calling, in either case you'd sooner or later have to do the evaluation and then you're back to that loop again.

So, what am I missing ?

<comment><USER7> Lazy doesn't just mean deferred; an unnecessary computation might never be performed at all. Take for example a function where the recursive argument is never called:

sample = (\this->(\x->x))

Then, (Y sample) can reduce as follows:

1: (Y sample)

2: (sample (Y sample))

3: ((\this->(\x->x)) (Y sample))

4: (\x->x)

Now, if your evaluation strategy required evaluating arguments to final form before applying an operator to them, then line 2 would expand forever:

2: (sample (Y sample))

3: (sample (sample (Y sample)))

4: (sample (sample (sample (Y sample))))

... And so on.

However, neither call-by-need (lazy) nor call-by-name evaluation strategies require evaluating an argument before applying some operator to it. Thus, in languages that support either of those evaluation strategies, the operator can be evaluated to the point where it throws away the argument, and the argument need never be evaluated.

This is a contrived example but real world recursion works for the same reason; at some point in the evaluation of the function, it no longer needs to be applied recursively, and once it reaches that base case, the recursive function can be discarded.

<comment><AUTHOR> Thank you!

Ok, I think I see a glimmer of understanding here, it doesn't quite 'click' yet but it is a lot clearer now.

I get the 'never needed' bit, that's like in many other languages where you say for instance

       if x and y then

And x = false, then y is never evaluated. Not quite the same, but it's a case where you can optimize out the evaluation of something because it's result will be discarded anyway.

The last part of your explanation still has me going around about what makes the decision to discard, it can't be the function itself, so it has to be some criterion outside the function causing that. For instance, maybe if work is no longer done, or if some arbitrary precision level has been reached.

Interesting stuff this!

In 'pure' functional programming you'd not have an 'if' statement to make the decision with, or is that allowed to be used to end recursion ? I just can't see that working using functions alone.

<comment><USER8> Why wouldn't a pure functional language allow you to have an if statement? Haskell certainly has one!

The key is that given the same input you need to produce the same output every time. Which is great as long as you're not doing I/O. (Haskell addresses that with monads - even though it looks like you're giving the same input, you're really giving a different input each time!)

<comment><AUTHOR> Ok, so that dilutes the 'pure' of the functional part. I know that in practice functional programs have an if to force termination, but the lambda calculus deals with abstracts. Anything evaluating lambda expressions then has to deal with that or you'd have to expand the syntax of the calculus to contain a termination function which 'magically' decides that enough is enough.

According to the definition all functions are unary functions, an if would have to be a binary function wouldn't it ?

<comment><USER8> With currying, you can easily make functions of n variables out of functions of one variable. To avoid syntactic confusion, here is a comparison in JavaScript

      // Call this with foo(x, y)
      function foo (x, y) {
          return x*y;
      }

      // Call this with foo(x)(y)
      function foo (x) { return function (y) {
          return x*y;
      }}

The key thing to notice is that you can get from one form to the other with a straight text substitution. So restricting yourself to functions of one variable involves no loss of generality.

Going back to the lambda Calculus, you can do Boolean logic there as well. See <http://safalra.com/science/lambda-calculus/boolean-logic/> for details. In fact I believe that the if construct in Haskell is just syntactic sugar around that. So it isn't that there is a decision made within the function, but rather that you call a function which turns out to be one of two different functions.

<comment><AUTHOR> Ah, right, yes, that's true, I forgot about the Currying bit (I read up on it earlier, promptly forgot it).

I'm coming at this from a 'coders' perspective, not the mathematical side of it, so the code example is much appreciated, that makes it much easier to understand.

The function 'foo' returns a function that has already 'bound' 'x' to whatever value you put in, the 'scope' then allows you to fish out the right 'x' when you're in the inner function doing the multiplication.

So, does that mean that as far as the inner function is concerned 'x' is 'free' ?

So far when reading articles about the lambda calculus it seemed like the 'free' variables where somehow magically present in the scope of the function without a hint about where they came from.

<comment><USER8> I could easily be wrong, but here is my understanding. Consider this snippet of JavaScript:

      function foo (x) { return function (y) {
          return x*y;
      }}

      bar = foo(5);

Within bar, x is bound and y is free.

Does that make sense to you?

<comment><AUTHOR> Ok, so now 'bar' contains a function where the 'x' is already bound to the '5', but the 'y' is still free because it has not yet been 'bound' to any parameter, is that what you mean ?

bar contains "function(y) { return 5*y; }"

The 'x' has been replaced by the '5' because of the function call. So 'binding' effectively pins down a function parameter and allows you to replace its instances in 'named' form with its value to reduce the expression ?

<comment><USER8> That is the way that I understand it. However you should be warned that I have never made a detailed study of the lambda calculus, and so might have basic misconceptions about it.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Twitter can edit, modify, or adapt materials without author permission/knowledge - <AUTHOR> https://twitter.com/grassy_art/status/904407242232954885 <comment><USER2> Organization focused on moving and displaying other peoples bits has a ToS allowing then to do so. It might be too vague because it's less risky to be vague than to attempt being precise and opening yourself up to opportunistic lawsuits. News at eleven.

</comment><comment><USER3> People are too quick to understand these new terms as solely necessary to provide service. The entire paragraph is:

> "By submitting, posting or displaying Content on or through the Services, > you grant us a worldwide, non-exclusive, royalty-free license (with the > right to sublicense) to use, copy, reproduce, process, adapt, modify, > publish, transmit, display and distribute such Content in any and all media > or distribution methods (now known or later developed). This license > authorizes us to make your Content available to the rest of the world and to > let others do the same. You agree that this license includes the right for > Twitter to provide, promote, and improve the Services and to make Content > submitted to or through the Services available to other companies, > organizations or individuals for the syndication, broadcast, distribution, > promotion or publication of such Content on other media and services, > subject to our terms and conditions for such Content use. Such additional > uses by Twitter, or other companies, organizations or individuals, may be > made with no compensation paid to you with respect to the Content that you > submit, post, transmit or otherwise make available through the Services."

It is easy to associate the concession of license (specially the "You agree that this license includes the right for Twitter to provide, ... to other companies, organizations or individuals for the syndication, broadcast, distribution, promotion or publication ... subject to our terms and conditions for such Content use.") with the service provided ("This license authorizes us to make your Content available to the rest of the world and to let others do the same"), but I do not see where it say that Twitter can __only __do this for providing the service. AFAIK, Twitter still can, for example, sell photos to a news agency through this same terms.

Of course, IANAL.

<comment><USER4> So basically if you post an artwork on Twitter, Twitter can proceed to sell your art (t-shirts, posters etc.), or sell licenses to do such, without paying you anything.

</comment></comment><comment><USER5> Every time one of these armchair lawyer articles is posted it stirs up a bunch of fretting about nothing. These are the legal requirements of a TOS that lets Twitter (or Google, or Facebook, or...) handle things like uploading images, creating thumbnails (including changing aspect ratio) and distributing the result to users, without a photographer suing them for copyright infringement.

Don't like that it's overly broad? Your problem is with copyright lawyers, not with Twitter.</comment>


Business lessons from The Wire - <AUTHOR> http://launchlab.co.uk/article/Business-Blog/Business-lessons-from-The-Wire/913

<comment><USER2> I think that The Wire is the most overrated show on television. Many of my friends are very enthusiastic about it, but I watched at least six episodes and could not get hooked. The show felt "cheap" to me, and boring.

<comment><USER3> You are about as wrong as anybody can get about anything. The Wire is an outright masterpiece.

I can't see how you'd find it to be "cheap". It's got probably the most brilliantly characterized people I've seen on any screen. I'd understand not liking it based on the first few episodes, but by six in it was already gliding along.</comment></comment>


Ethereum Will Be the Backbone of the New Internet - <AUTHOR> https://medium.com/loom-network/ethereum-will-be-the-backbone-of-the-new-internet-88718e08124f <comment><USER2> _That's a LOT of financial incentive for someone to try to hack / exploit the network. And yet to this day, almost 3 years after Ethereum's mainnet launch, no one has managed to find an exploit in the platform's security._

That might mean there aren't any, or that there aren't many people looking, or any exploit is really hard to find and hasn't been figured out yet, or that a malicious attacker has found one but hasn't used it yet because they're waiting to maximise their gain.

The fact there aren't any published exploits is not a sign something is secure (or not secure).

<comment><USER3> There are so many insecure badly written "smart" contracts out there that are an easy target, that trying to hack the main network is probably a waste of time.

And anyway, if someone hacks a small contract s/he will get away and keep the money, but if someone hacks the main net then Vitalik will undo^H^H^H^H fork and make it worthless.</comment></comment>


How Good C# Habits can Encourage Bad JavaScript Habits - <AUTHOR> http://enterprisejquery.com/2010/10/how-good-c-habits-can-encourage-bad-javascript-habits-part-1/ <comment><USER2> Part one's claim that using the 'new' keyword is somehow implicitly bad needs more to back it up than Douglas Crockford saying so. Douglas Crockford's opinions are just opinions. Is it slower in certain JS runtimes? Harder to read? Less maintainable?

Anyway, re: part 2

You shouldn't encourage the use of 'value || defaultValue' without clearly, explicitly pointing out that this will prevent the use of falsy values as argument values - including 0, false, and an empty string... all values people _actually_ want to use in some cases. It seems inexcusable to me that you would write:

"Based on the false-y rules we learned earlier, if we want to check if a variable is undefined, not null, and has a value then all we need to do is check the object itself."

Immediately after explaining how null and undefined are not the only falsy values in JS.

Anyway, otherwise it looks like you're sharing some good advice for newbies.

<comment><USER3> > You shouldn't encourage the use of 'value || defaultValue' without clearly, > explicitly pointing out that this will prevent the use of falsy values as > argument values - including 0, false, and an empty string... all values > people actually want to use in some cases.

Perl dealt with this a few versions back, and now they have an operator for "defined-or", // [1]. It's useful.

This makes it easier to correct the wrong (but common) way to supply default values for undefined/unpassed values:

        # Old wrong way
        my $foo = $bar || $baz; # $this will never be used if "falsy": 0, '', undef, '0E0'

        # Old right ways
        my $foo = defined $bar ? $bar : $baz;
        # Or
        my $foo = $bar;
        $foo = $baz unless defined $foo;

        # New way
        my $foo = $bar // $baz; # Uses $baz only if not defined $bar

     [1]: http://perldoc.perl.org/perlop.html#Logical-Defined-Or

<comment><USER4> C#'s ?? operator is also relevant: <http://msdn.microsoft.com/en- us/library/ms173224.aspx>

</comment></comment></comment><comment><USER5> "you should be careful to know that Object Literals are not JSON."

This rule is not only ridiculously pedantic, but the explanation page is twisted to the point of stupidity. An object literal is the source code that compiles/executes directly to an object. JSON is very much an object _literal_. The runtime element that isn't the same as JSON text is simply called an 'object'. On top of that, the term "JSON Object" has no predefined meaning and using it to mean an object that was created via JSON is perfectly reasonable.

<comment><USER6> Glad that I'm not alone in this. Though I'm no stranger to pedantry, this one is just being pedantic for pedantic's sake and really has no value, unless you really don't understand what JSON is....a string representation of a data- structure.

I think we'd be in a better place if instead of `JSON.parse()` and `JSON.stringify()`, we had something a little more familiar such as `JSON.serialize()` and `JSON.unserialize()` for example. In a perfect world we'd simply override `Object.toString()`, because that's really what it is -- and I've never really used `toString()` for anything else on an object, especially not now with to prevalence of robust debuggers. But I digress...

</comment></comment><comment><USER7> "The new keyword was added to the language partially to appease classical languages, but in reality it tends to confuse developers more than help them. Instead, there are native ways in JavaScript to declare objects and arrays and you should use those instead."

Umm... what? Ever heard of constructor functions and prototypes?

...to be fair there is a small note on this at the end of the article, but this concept in javascript is far from secondary. It deserves more than a footnote. 'new' is not something to be avoided as implied here.

</comment><comment><USER8> I have very little experience with Javascript. I come from a Python background. So please excuse my ignorance, but this doesn't sound like a designed language feature at all. These look like tricks that programmers discovered they could use to provide namespace separation.

Wouldn't it better if there were constructs built into the language to provide separate namespaces, in an obvious and coherent fashion?

<comment><USER9> In the browser, you have the global scope in the window object o it's pretty easy to define a construct for namespaces.

I thought about the namespaces thing and it sounds like a better idea than encapsulating stuff into anonymous functions so I made a little boilerplate that implement basic OOP features:

<http://jsfiddle.net/L4Tcw/21/>

Only thing that I think smells a bit is having to keep a reference to 'this' of the main object.

</comment></comment><comment><USER6> Eh, I'd chalk this up to "C# isn't JS".

Just because 2 languages share a common syntactical lineage does not mean that they behave the same way.

<comment><USER10> It's worse. It starts off with something that isn't even a good habit in C#, and admits as much, to go on detailing how a bunch of people have found out X can be a useful pattern, only to depict it as the way God intended and to completely disregard anything else.

It is a complete and utter pretentious circle jerk building on the idea of "C# has damaged you, find enlightenment".

<comment><USER11> "A best practice in C# is to limit the use of global variables."

Limiting the use of global variables is a bad habit in C#? That's news to me.

<comment><USER10> Oops, mixed up good and bad there.

</comment></comment></comment></comment><comment><USER12> Is there a problem with the jsFiddle[1] linked in part 1, or am I just being an amazing jsFiddle newb? Out of the box hitting "Run" in current FF or Chrome doesn't produce console output, as I'd expect.

[1] edit, added link: <http://jsfiddle.net/elijahmanor/teW4J/4/>

<comment><USER13> I didn't even realize there was an issue until you actually said something about the console not producing output.

Honestly I had never noticed that pane on jsfiddle. Pop open inspector or firebug for console output, seems to work there.

<comment><USER14> You haven't noticed it in the past because it wasn't there.

That isn't a pane in jsfiddle, it's the result of the 'firebug-lite-dev.js' external script being included in the jsfiddle.

</comment></comment></comment><comment><AUTHOR> part 2 [1]

\-----

[1]: [http://enterprisejquery.com/2010/10/how-good-c-habits-can- en...](http://enterprisejquery.com/2010/10/how-good-c-habits-can-encourage- bad-javascript-habits-part-2/)

</comment><comment><USER15> Is it just me or are all the YUI theater links broken? In order to watch D. Crockford's talk I have to copy the title into google, any direct links, even on YUI itself, just lead to the front page.

</comment><comment><USER16> The best JavaScript habit one can have: learn Coffeescript (or ClojureScript, or BiwaScheme, etc.) ;)

Seriously, I came to Javascript from a C# background and everything I saw pointed me towards treating JS as a compilation target, and choosing a language that enabled me to do the Right Thing(TM) easily and tersely.

I'm not saying "don't learn JS" ... just that it seems a bit odd to be manually coding in JS when there are so many better alternatives out there.

<comment><USER17> While I like CoffeeScript (and code in it, day to day), I think having a base level of what's going on in the JS is still important- and will be until browsers allow you to exactly map your CS code to in-browser results.

<comment><USER16> I strongly agree - which is why I said I'm not against learning JS. I just don't think it's terribly useful as a language as opposed to as a compilation target.

</comment></comment></comment><comment><USER18> I hate both or those language, so I guess I'm good with this.

</comment><comment><USER19> The thing I hate about javascript "best practices" is that you have to add some many parens and squiggly brackets to your code that you may as well be writing fucking lisp.

<comment><USER20> What's wrong with Lisp/Racket?

Just the parentheses?

Seems like a weird reason to have such a strong reaction to a language :/

<comment><USER19> It makes reading the code much more difficult.

"I am inside the function, the function passed into the function or the function returned from the function?"</comment></comment></comment>


Hacker Opens His Congressional Platform for Editing on GitHub - <AUTHOR> http://www.wired.com/wiredenterprise/2014/03/cole-platform

<comment><AUTHOR> github link: [https://github.com/coleforcongress](https://github.com/coleforcongress)</comment>


Ask HN: What's your favorite SDK for testing 3rd party integrations? Here's mine - <AUTHOR> https://medium.com/@meeshkan/why-we-are-mocking-the-worlds-apis-e16c4f339ee3 <comment><USER2> Rings some bells. Didn't they win Slush 2018 last year?

<comment><USER3> Apparently! [https://www.slush.org/news/the-winner-of-slush-100-is- meeshk...](https://www.slush.org/news/the-winner-of-slush-100-is-meeshkan/) They weren't kidding when they said it "took a few twists and turns before coming into fruition"...</comment></comment>


Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers - <AUTHOR> https://landave.io/2017/06/avast-antivirus-remote-stack-buffer-overflow-with-magic-numbers/ <comment><USER2> Avast Antivirus, now with free remote reset option.

I always hated anti virus packages both for the fact that AV vendors profit on something that shouldn't be required in the first place and because that software tends to hook into lots of places in the OS so _if_ a backdoor is found you are immediately in big trouble.

<comment><USER3> > I always hated anti virus packages both for the fact that AV vendors profit > on something that shouldn't be required in the first place

You must hate a lot of things then.

</comment></comment><comment><USER4> No one gets fired for installing Antivirus on every computer. From my experience enterprise IT is driven by checklist, looks good on paper, cover- my-* decisions. People are not interested in doing the right thing in large companies.

In one company every developer was forced on Antivirus without file exceptions making compilations a huge pain.

<comment><USER5> The majority of customers I work with, that is part of the standard IT image, regardless which OS your computer might have.

<comment><USER4> Yes.

And I guess non-glued usb ports on every computer.

And users that put every USB stick in their computer they are handed by strangers in front of the office. Or they find on the printer. Especially when labeled "Pictures".

Because

        CEO: Have we Antivirus installed?
        CIO: Yes.

Not

        CEO: Are we secure?
             How does your risk analysis look like?
             Do we internal or perimeter defense?
        CIO: ...

<comment><USER5> They don't need to glue USB ports, because IT is intelligent enough to disable access to them via OS configuration.

I never understood the stupidity of some people to glue them instead of using OS policies.

<comment><USER4> I have never seen a company, large or small, which disabled USB ports. Because convenience is always higher rated than security.

Glueing is much easier, can't fail with wrong configurations or roll outs, works if people have too many permissions on Linux and in a myriad of other ways.

<comment><USER5> The companies I work for, security is always higher rated than convenience.

You could buy several houses, or be settled for life, with the costs to cover an eventual security breach.

<comment><USER4> Great to hear there are companies that take security seriously.

The companies I've consulted with had USB not secured in the Laptops of the marketing departments I've seen - and yes some of them lost several hundred millions of $ b/c of breaches in revenue.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Adobe deserve a pile of the blame here for the pdf spec - it only requires the magic to appear in the first 1024 bytes[1] (and that %EOF appears in the last 1024) - thus allowing silly tricks like PDFs that are also another file type [2].

[1] [http://www.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdf...](http://www.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdfs/pdf_reference_1-7.pdf) section 3.4.1

[2] [https://www.slideshare.net/ange4771/a-binary- chimera](https://www.slideshare.net/ange4771/a-binary-chimera)

<comment><AUTHOR> I agree with the pdf spec allowing some insane stuff.

However, I think it's quite a stretch to put any blame on Adobe for this one.

In essence, Avast has implemented their own std::vec in C for the management of the magic numbers, and they implemented it quite poorly.

As mentioned in the article, the find_magicnums function supports roughly 300 (!) different magic numbers. Adobe's PDF is not required at all to exploit this bug.

</comment></comment><comment><USER7> this is the second AV fiasco in recent months. is it safe to say that running an antivirus is actually increasing your risk instead of decreasing it?

<comment><USER8> Yes. For organizations the harm is compounded because IT and users don't understand how limited AV is. They think AVs have good detection rate, and they think AVs can generally "disinfect" your computer when you get pwned, and think AV doesn't increase attack surface. This leads to the false conclusion that it's an acceptable risk to use Acrobat Reader and open attachments in Office etc.

<comment><USER9> It probably can catch your average mass-mailed word virus, or an infected usb drive brought from home, but not much more than that

</comment></comment></comment><comment><USER10> Wow. It seems as if this has been discovered by rigorous manual inspection of the code (as opposed to just fuzzing the binary to death).

Hats off!

<comment><AUTHOR> I'm sorry to disappoint you :)

I discovered this via a coverage based fuzzing engine with a dictionary (containing those magic numbers). Said fuzzing engine is similar to libFuzzer, but I have designed it with a focus on fuzzing closed source Windows binaries (PE).

</comment></comment><comment><USER11> This is probably a dumb question: but how does someone look at the source code for a commercial product like Avast? Some sort of DLL decompiler or something? If that is the case are things like function and variable names conserved? This is probably super trivial, but reverse engineering / pen testing isn't my area.

<comment><AUTHOR> Thanks for the question, I probably should have made this clearer in the article. Just presenting some pseudocode and typedefs of structs may have given a wrong impression of how this works.

So to be very clear: I reversed the functions and types without any symbols. All function names, type names, and variable names from the article are chosen by me. In the actual code, those names are most likely very different.

For such a simple function as this, all you need is the control flow graph form of X86 disassembly as linked in footnote 4 of the article.

<comment><USER12> Do you have description on the procedure of how you did all this by chance (especially, how did you get that graph[0])? I'm interested in reverse engineering, but can't find many good starting points to do it myself. And congrats on your achievement, we need more people like you, who put such shoddy programming practices in broad daylight, especially made by the companies that are supposed to make us safer.

0\. [https://landave.io/files/add_magicnum.png](https://landave.io/files/add_magicnum.png)

<comment><AUTHOR> The graph is generated by binary ninja [1] fully automatically, and this is just a screenshot of the tool. Any alternative reversing platform or disassembly tool like IDA Pro can generate you something very similar.

[1] [https://binary.ninja/](https://binary.ninja/)

</comment></comment></comment></comment><comment><AUTHOR> I am very surprised by the strong interest in this kind of work, and I appreciate it a lot!

I would love to hear some feedback, in the hope that the following posts will be more enjoyable than this first one.

</comment><comment><USER13> Take a lesson - always write parsers in C and then execute them as root, and be sure to send as much malicious content to them as possible. Bonus points for hooking it up to the internet.

<comment><USER5> Addicionally ignore all the advices given by the Algol community since the 1960's, in spite of the fact the customers were more than happy with the output of their compilers.

</comment></comment><comment><USER14> I bet Avast is far from the only software that will get really confused with so many magic numbers in a row like this.

</comment><comment><USER15> You know the edict against rolling your own crypto? It needs to be expanded to rolling your own collections in c/c++.

<comment><USER16> This is nowhere near the complexity and subtlety of crypto. Inserting into a sorted array is an elementary, computer-science-101 level task and I'd consider it to be not substantially more difficult than writing a correct FizzBuzz.

Then again, if you consider the number who fail at the latter, and how many would want to work on AV software anyway, it's no surprise things like this will happen.

</comment></comment><comment><USER17> Is the scanning engine sandboxed in any way, or is the stack protector all there is between a scanner bug and a remote exploit?

<comment><AUTHOR> The engine is not sandboxed. I will speak only for the Windows product though, because this is the only one I looked at in detail. (But the Linux engine is not sandboxed either).

This is X86 code [1] running as NT AUTHORITY\SYSTEM. Hence, successful exploitation for arbitrary remote code execution (as NT AUTHORITY\SYSTEM) only requires circumventing the stack canary.

As mentioned in footnote 6 of the article, they seem to use Control Flow Guard (CFG) on the latest Windows platforms. However, just as the stack canary, this is only a mitigation. It does not make exploitation impossible, it just makes it a bit harder.

[1] In the article, I present a pseudocode version of the relevant function. If you are interested in the actual X86 instructions, you might want to look at footnote 4 of the article.

</comment></comment><comment><USER18> That's what you get when you don't use std::vector.

</comment><comment><USER19> You sir are a genius. Hoping for more posts of a similar nature and bookmarking now.

<comment><AUTHOR> Wow, thanks! That means a lot to me. Honestly, I didn't expect this to interest anyone.

<comment><USER20> I'd think the discovery of a remote execution bug in a prominent antivirus product would interest a lot of people.</comment></comment></comment>


How the U.S. thinks Russians hacked the White House - <AUTHOR> http://www.cnn.com/2015/04/07/politics/how-russians-hacked-the-wh/index.html <comment><USER2> I used to take news stories like this more or less at face value, but not anymore.

I am not sure what we (USA) get out of this but it seems to me like we have been encroaching on Russia's space for a while. Part of the deal we made with Russia when the Germany was reunited was that the USA and Nato would not start moving military bases and military capability up to Russia's borders. I think we have been doing that. Why? Is Russia really a threat to us?

The other thing that I find troubling is that many of our allies (Germany, France) don't seem at all enthusiastic over the sanctions against Russia. Why? I would like to understand the difference in what we (USA) want and Europe does.

<comment><USER3> Likewise. I am _highly_ skeptical of these stories now. The "terrorist" threat seems to have died after falling out of favour as the public slowly came to realise there never was any major threat, and now suddenly "cyber terrorism" and hacker attacks are _everywhere_ and are apparently the greatest threat we've ever faced.

>The other thing that I find troubling is that many of our allies (Germany, France) don't seem at all enthusiastic over the sanctions against Russia. Why? I would like to understand the difference in what we (USA) want and Europe does.

I honestly don't know. The US keeps prodding Russia in recent years and for what? Is it another war they're after? What are the US hoping to gain here?

As a European I am _delighted_ to see some of our leaders pulling back from supporting the US foreign policy.</comment></comment>


People whose name is Lane tend to have addresses with "lane" - <AUTHOR> http://www.nytimes.com/2008/04/10/us/10names.html?ex=1365480000&en=00e414c74b5f7a0e&ei=5090&partner=rssuserland&emc=rss&pagewanted=all

<comment><USER2> I need to log in for that link, but not this one: <http://www.nytimes.com/2008/04/10/us/10names.html?hp>

</comment><comment><USER3> ILike (are they still around?) should/could perform another experiment.</comment>


Idea for HN: Training an article summary bot as a community - <AUTHOR> If there is no world class article summary bot, perhaps HN could crowd source one: if every article had a comment which was the 'result' of the current bot and this result was corrected by HN readers who read the article and this corrected result fed back to the ML system behind the bot, perhaps we could make something useful.<p>What do you think? <comment><USER2> It can be implemented as a different site (like [http://www.explainxkcd.com](http://www.explainxkcd.com) ) or an extension for the browser to see the summary in the site.

Bots are generally not welcome here. I think that the community would tolerate a bot that post in 1% of the articles something _really_ useful, but a bot that post in all articles will be heavily downvoted.

Also, there is a hidden assumption in the community that the users will read the article before commenting, so even hand written summaries or tl;dr are usually not appreciated too much.</comment>