The Evolution of C Programming Practices: A Study of Unix (2016) [pdf] - <AUTHOR> https://www2.dmst.aueb.gr/dds/pubs/conf/2016-ICSE-ProgEvol/html/SLK16.pdf <comment><USER2> I went to pick up my son at University studying CS recently.

He had replaced Win 10 on his tower with Ubuntu and was writing a pretty complex program in C++. Doing some AI/ML primitives.

Thought to myself I am old yet went to the same University and would have been coding in C++ on Unix (Ultrix or OSF or Solaris) at that point in my life.

How in the world have we not moved on?

BTW, his code was so, so pretty. Mine would have been ugly. Kids are far better coders than we were 30 years ago. I was crazy proud.

<comment><USER3> Why would we move on? C is a local maximum, like a Brayton-cycle gas turbine engine. A 787 engine is no more than 50% more efficient than a 707 engine, despite _tens of billions_ of dollars in investment and decades of R&D between the two. And we won't get even another 50% improvement any time soon. It'll take a fundamental change in technology to move past that plateau.

C is likewise on a plateau. There is nothing categorically better than C for what C does; just different points in the design space that make different trade offs. _E.g._ Rust gives you memory safety through ownership, but you can't even make a doubly-linked list while staying within the ownership system. In a different point in the design space, Go has garbage collection, but that comes with its own trade offs. All of these might become obsolete when we have _e.g._ quantum computers. But in the meantime we are just playing with different trade offs, because we've captured all the low-hanging fruit decades ago.

<comment><USER4> "E.g. Rust gives you memory safety through ownership, but you can't even make a doubly-linked list while staying within the ownership system."

Your otherwise good comment presents this like all-or-nothing when comparing it to C. To start with, C and Rust are equivalent for anything it cant borrow- check. Then, it's better than C in safety or expressiveness from there. Second, C developers use plenty external libraries to supplement the language's capabilities, including with ASM breaking abstraction gap. Likewise, whatever Rust cant handle can be proven safe with external tool, wrapped in safe interface, and used from there. This has been done in languages from C to Haskell.

So, there's different design points for sure but doubly-linked-list isnt an example of unfit for purpose vs C. If anything, that it's equal or better in safety making it a better instance in that design space. Likewise for Clay which was more C-like and used in device drivers.

<comment><USER3> But at the end of the day, I wouldn't call it a categorical improvement over C because you still have to drop down to what is basically C to handle essential tasks like declaring circular data structures. Instead, it makes a special (but common) case of tree-like data structures safer to handle. This is no fault of Rust—it is a theoretical limitation. There is no single model that let's you express arbitrary data structures, gives you memory safety, and doesn't require runtime heap walking.

<comment><USER5> The biggest difference is that in C, 100% of the code is unsafe and possibly UB, while in other system languages with _unsafe_ code blocks those low level tricks are pretty easy to track down.

<comment><USER6> Many seem to have the illusion that if you use unsafe in Rust, bad things can only happen in the unsafe blocks.

This is wrong. If your unsafe block fails to maintain the required safety guarantees (I personally don't know what they are), then the safe code could break terribly as well. And figuring out which unsafe block is the culprit can be really hard too.

<comment><USER5> I don't have that illusion.

Logic errors are always bound to happen in any language.

Problem in C is that every single line of code is either unsafe or potentially UB, specially at -O3.

And yeah everyone can always assert it doesn't happen to them, but that assertion does not hold when working in teams or using third party code.

So it is already a big security improved if the attack space is largely reduced.

Also unsafe blocks aren't nothing specific to Rust. A few system programming languages since the 60's have them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> It bothers me when "goto" is assumed to be "a maligned language construct".

People who think "goto" is evil should also give up the other jump statements: continue, break, and return (and also switch, though its not listed as a jump instruction in the C standard, at least not in '89 or '99).

You can see some contradictions in the paper regarding goto. For example, they state that deep nesting should be avoided, but goto should be avoided as well, even though one benefit of using goto is to limit nesting depth. From the Linux Kernel coding style doc: \- unconditional statements are easier to understand and follow \- nesting is reduced \- errors by not updating individual exit points when making modifications are prevented \- saves the compiler work to optimize redundant code away ;)

<comment><USER8> As a longtime C and goto user, defending the practice many times, I discovered something interesting.

My uses of goto can be replaced with nested functions! The code is nicer, cleaner, and the equivalent code is generated (the nested functions get inlined).

Of course, nested functions aren't part of Standard C, but they are part of D-as-BetterC. (D has goto's too, but I don't need them anymore.)

<comment><USER9> Just wanted to mention that GNU C has supported nested functions since forever, it's one of the main reasons I prefer GCC over Clang these days.

<comment><USER10> Yes and it annoys me no end that clang has refused to implement them as well, as they were part of my codebase as well... How better to implement stuff like qsort() callbacks than with a simple, contextual small function _just over it_ ??

YES it is dangerous due to stacks etc etc but hey, we're grown up adults, not script kiddies.

<comment><USER5> > YES it is dangerous due to stacks etc etc but hey, we're grown up adults, > not script kiddies.

That is how CVEs are born.

<comment><USER9> Using a chainsaw without paying attention is how fingers are cut off, using that as an argument against making chainsaws easier to use doesn't make any kind of sense.

<comment><USER5> Good chainsaws have protection mechanisms builtin.

C does not.

<comment><USER9> Good for you maybe, projecting that on people who have a clue what they're doing doesn't make sense either. They're mostly messing up chainsaws as well these days, for the same misguided reasons.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> There seems to be an oddity with their LOC for FreeBSD 2.0. At ~6M LOC, it is roughly 3x the size of the FreeBSD releases just before and just after it. The size steadily creeps up, but we don't see anything else that big until FreeBSD 5, so there seems to be something fishy there..

<comment><USER12> 2.0 was when they revamped the code base because of copyright problems. Check this out:

[https://www.freebsd.org/releases/2.0/notes.html](https://www.freebsd.org/releases/2.0/notes.html)

<comment><USER11> Sure, I initially though that might be it. Eg, maybe some of the non-x86 support from 4.4BSDL was not pruned out of 2.0, for example. But I checked, and 2.0 only has i386 support.

What strikes me as odd is that the very next minor release (2.0.5) is listed as 2.1M LOC, while 2.0 is listed as 6.1 MLOC. That's a reduction of 66%. Looking at a diff between the 2 releases, I do not see anything to explain that.

</comment></comment></comment><comment><USER13> This helped me out a lot as a base guidline for writing good C code: [https://en.wikipedia.org/wiki/The_Power_of_10:_Rules_for_Dev...](https://en.wikipedia.org/wiki/The_Power_of_10:_Rules_for_Developing_Safety- Critical_Code)

</comment><comment><USER5> So no discussion about any positive evolution of security best practices or static analysis, other than single line remarks?

</comment><comment><USER14> I have enrolled for CSE in [http://www.thapar.edu](http://www.thapar.edu) college this year. Can I join this C programming course with engineering?

I know basics of C and C++ !!

</comment><comment><USER15> I wonder how many of those LOC are just support for more and more hardware over the years? The nice thing about drivers is that they're almost completely modular so they don't really bloat the code even though they shoot the LOC count through the roof.

</comment><comment><USER16> DSTMT/statement density plot is nice to see. Although it wasn't my time, I've seen early code (or code from very memory-limited machines), and always been amazed out how tightly packed it seems to be. And remarkably unreadable too.

</comment><comment><USER17> A really good read! Is there a repository to share papers related to source- code analytics like this one?

<comment><USER18> Not a repository but many references about source-code analysis focused on software security/safety:

[https://www.us-cert.gov/bsi/articles/tools/source-code- analy...](https://www.us-cert.gov/bsi/articles/tools/source-code- analysis/source-code-analysis-tools---references)

</comment></comment><comment><USER19> I know this title is not technically click bate, but it got me.</comment>


Robert Pirsig on The Scientific Method (1974) [pdf] - <AUTHOR> https://kkh.ltrr.arizona.edu/kkh/natsgc/PDFs-2013/Robert-Pirsig-On-Scientific-Method.pdf <comment><USER2> It's a short excerpt from _Zen and the Art of Motorcycle Maintenance_.

I clicked the link thinking it wasn't that. Because I know and love that book. For those that haven't read the sequel _Lila_ , I highly recommend it also. It goes into _what Quality actually is_ in enormous detail, how it works, the different types and levels. While _ZAMM_ is typically concerned with relatively simple systems (like a motorbike) and how humans interact with them, _Lila_ is more the biological, social, societal systems humans are a part of, anthropology/anthropologists trying to study them, and how those systems work, how each has its own Quality.. (long story!)

A few years ago I read Thoreau's _A Week on the Concord and Merrimack Rivers_ (1849) and was immediately struck by, well, the form is _exactly_ the same as Pirsig's books - nature/observation writing interspersed with slabs of philosophical/theoretical. _Lila_ is even mostly set on a boat going down a river also. Thoreau probably does both styles better, but Pirsig has a focused theme - 'has something to say'. So if you like Pirsig, you'll love Thoreau's travel books.

</comment><comment><USER3> Pretty good description of what debugging code is like, too.</comment>


Why AI will probably kill us all: Thoughts? - <AUTHOR> https://www.youtube.com/watch?v=SPAmbUZ9UKk <comment><USER2> Aren't we just trees to them? They'll think in GHz and wonder if we're even alive as we ponderously grow and move.</comment>


The leased life - Why own anything? - <AUTHOR> http://www.boston.com/bostonglobe/ideas/articles/2010/01/24/the_leased_life?mode=PF Interesting article about Rentalic.com (and other similar services) which makes it easier to lend and borrow common, but infrequently used.
Like so many other websites, it connects mutual beneficiaries - in this case, people who own things they don't use much with people who want to use things without owning them. Members can post either belongings they have to offer or goods they are hoping to find. Items recently listed include a body fat scale ($5 a week), a bread maker ($1.75 a day), and a cupcake transporter ($3 a week). The site was launched last October with limited membership, and opened to the public earlier this month.
There have been many times where I've wanted to borrow/rent a high performance DSLR camera (for sporting events, special outings, etc.) but wouldn't feel right just bugging my friend for theirs. I can't afford the $1000+ price tag either, so that's not an option. I can understand that the DSLR example may not be the best example, because it's very expensive and fragile, but there are many other items available on their site which make perfect sense to borrow/rent for a fee (bikes, golf clubs, wheelbarrows, etc.) <comment><AUTHOR> Interesting article about Rentalic.com (and other similar services) which makes it easier to lend and borrow common, but infrequently used.

 _Like so many other websites, it connects mutual beneficiaries - in this case, people who own things they don't use much with people who want to use things without owning them. Members can post either belongings they have to offer or goods they are hoping to find. Items recently listed include a body fat scale ($5 a week), a bread maker ($1.75 a day), and a cupcake transporter ($3 a week). The site was launched last October with limited membership, and opened to the public earlier this month._

There have been many times where I've wanted to borrow/rent a high performance DSLR camera (for sporting events, special outings, etc.) but wouldn't feel right just bugging my friend for theirs. I can't afford the $1000+ price tag either, so that's not an option. I can understand that the DSLR example may not be the best example, because it's very expensive and fragile, but there are many other items available on their site which make perfect sense to borrow/rent for a fee (bikes, golf clubs, wheelbarrows, etc.)

</comment><comment><USER2> This idea works well when the product is infrequently used and you can predict the need. If you can't predict that need then it's generally more convenient to purchase. And that's the key term: _convenience_. People don't willingly inconvenience themselves without good reason.

Alternately, leasing works when the item you're leasing would cost too much to purchase outright. But that's not the case with the consumer items they're talking about here.

Businesses will often lean towards leasing instead of purchasing because one is normally paid from the Operations budget and the other from the Capital budget. For individual consumers who don't look at finance that way, leasing is about convenience and affordability. .

</comment><comment><USER3> Folks should read predictably irrational. Market norms bring out different attributes in people than social norms. I'd much rather borrow something from my neighbor (and return the favor) over trying to extract every dime I can from them (or vice versa).

<comment><AUTHOR> I agree with you about common items like a cup of sugar or a couple of eggs while making a dessert, but how about more expensive items like a lawn mower, snow blower, power washer that you will probably use a few times during the year but not enough to justify purchasing it outright (in your mind at least).

Then you have the whole eco-friendly nature of this idea -- it makes sense for many people to share these durable goods. This site makes it easier for a neighborhood to 'share' in the repair costs, upkeep, storage, etc. without actually having to pay condo association fees. I would gladly spend an extra $200 for a better, longer lasting lawn mower if I knew it was going to be used more frequently by my neighbors, and they were going to reimburse me for the upkeep and storage costs.

<comment><USER4> How do they resolve the liability issue? Someone who hurts himself with your lawnmower might try to sue you. Your homeowner's / renter's insurance policy will probably not cover what amounts to running a business out of your home.

<comment><AUTHOR> I'm not a lawyer, but I disagree with both of your points. This isn't a business (you won't be collecting taxes, for instance) and I don't think you'd be responsible for someone getting hurt. Also, power tools and other dangerous equipment is only category here. Baby/toddler equipment, camping gear, sporting goods, etc. are all too expensive if you just need to borrow something for a day or a week.

<comment><USER4> What do you mean not collecting taxes? If you rent your lawnmower to someone, that's taxable income. Of course many people cheat on little things like this, but technically they are supposed to pay.</comment></comment></comment></comment></comment>


Hands-on: Ubuntu goes social, gains Me Menu in 10.04 alpha 3 - <AUTHOR> http://arstechnica.com/open-source/reviews/2010/03/hands-on-ubuntu-goes-social-gains-me-menu-in-1004-alpha-3.ars?utm_source=microblogging&utm_medium=arstch&utm_term=Main%20Account&utm_campaign=microblogging

<comment><USER2> Holy fuck I wish they would just stop dicking with the damn thing.

No, do not want more and more stuff added to this or that. I would really like it if things would Just Work on more and more hardware, especially more recent hardware.

Fix the stuff that doesn't work quite right, and leave the rest alone. Let users add the bling they want later on.

It's like they're in some battle with Microsoft to see who can add the most superficial crap that gets in the way of just doing stuff.

<comment><USER3> We should be glad that open source (Linux/Ubuntu) works when it does. Its such a curious case that its expected of Linux to support all myriad kinds of hardware systems. Its the responsibility of the hardware vendor to provide the drivers, not the hackers who labor hard to reverse engineer the specs when the vendors even refuses to publish how the hardware works. Few vendors really care about Linux. On the other hand, Windows has it really easy. Before the release of a new version, vendors work their asses off with Microsoft to ensure that before the OS reaches market, their drivers are already up to date. Apple has to care about only one piece of hardware which is manufactured by them (leaving peripherals of course). We should be just glad that it works when it does. Those who work to make it work, work hard. Disclaimer: On my Lenovo laptop, today, every single device works now on Ubuntu 9.04 from the card reader to webcam. It didn't always.

<comment><USER2> "We should be glad that open source (Linux/Ubuntu) works when it does. Its such a curious case that its expected of Linux to support all myriad kinds of hardware systems."

It really is impressive that things work as well as they do, but OTOH, if Ubuntu is really going to be "desktop ready" then it has to support modern hardware.

I attempted an install of Ubuntu 9.10 on an HP box with a Dell LCD monitor and an nVidia graphics card, and though it started out OK, the screen eventually went black. Turns out there was no workable default video driver in place to allow even crude graphics. Even the text/low-res installation options failed.

I did finally get it running (assorted usage of virtual terminals and ftp'ing of driver), but hibernation and suspend still don't work. And gnome-terminal has acquired some bug where it never warns you if you're closing multiple tabs.

Maybe this is an apples-and-oranges deal, but when I read of new gee-whiz crap like twitter integration in the task bar, while core behavior such as hibernation is still a crapshoot, and key apps are buggy, it makes me wonder where the priorities are.

Perhaps I'm just bitter about KDE3 being dropped for the saccharine mess that is KDE4. :(

Bottom line seems to be that OSS developers, by and large, hate working on the mundane stuff, and much prefer to invent Really Cool Stuff, regardless of any real need for it.

Shouldn't bitch about stuff that's free, but I'd like to think the people calling the shots care if the end results are properly usable.

The Magic 8 ball is telling me "Xmonad looking REALLY good". :)

</comment></comment></comment><comment><USER4> For those of you that don't have Ubuntu natively installed on your computer (such as myself) there is a great answer to this problem: VirtualBox <http://www.virtualbox.org/> . I installed it recently on my XP laptop, and now enjoy Ubuntu in what seems to be native speed. In fact, my dev environment of slime/emacs sbcl is runing radically faster than lispworks slime/emacs in xp. I have a dual screen setup, so I have Ubuntu in full screen mode (you can switch out with ctrl f) in one monitor, and xp in the other. Life is good.

<comment><USER5> I too am enjoying VirtualBox as a way of setting up discrete development environments. I've got one for PHP, one for Rails, and a general Ubuntu box for anything else I want to try out (e.g. Clojure).

I documented my personal "get Ubuntu running via VirtualBox on XP" experience here: [http://www.sharingatwork.com/2009/10/get-started-building- we...](http://www.sharingatwork.com/2009/10/get-started-building-web-apps- with-your-own-ruby-on-rails-virtual-development-server/)

<comment><USER4> That's really nice having an image with the Rails environment installed. Maybe I should do the same for slime/emacs/sbcl? (I'm not sure what the demand would be)

<comment><USER6> I've been working (very slowly) on a VMWare VM tailored for Lisp hacking. I posted to

[http://www.lispforum.com/viewtopic.php?f=2&t=588](http://www.lispforum.com/viewtopic.php?f=2&t=588)

to gauge demand. It didn't seem like there's much.

I still plan on eventually "completing" it, but at the moment I'm sick of trying to get Emacs to behave in some small ways like other editors.</comment></comment></comment></comment>


Microsoft Wins Third Patent Victory Against Motorola Over Android  - <AUTHOR> http://wmpoweruser.com/microsoft-wins-third-patent-victory-against-motorola-over-android/ <comment><USER2> Please submit the original article instead of the blogspam.</comment>


Pocket: The App That Irked Me Over Privacy Today - <AUTHOR> http://teaz.me/pocket-the-app-that-irked-me-over-privacy-today/

<comment><USER2> If you are that worried about privacy on an app like Pocket, there is an open source alternative ([https://www.wallabag.org/](https://www.wallabag.org/)) and it has an iOS app. I have yet to try it myself because I didn't really expect privacy from an app like Pocket and therefore use Pocket but its features look equal (if not better) to Pocket.

</comment><comment><USER3> To be honest, I don't see the big deal here. Pocket has already been adding 'trending', 'best of' tags to my bookmarks. Where do you think they got that data from huh? While this seems like another privacy red flag, it could be possible that they just keep a database of links with a counter column, and show recommendations based on that, or another algorithm.

<comment><AUTHOR> I figured that the _Trending Now_ and _Best Of_ were just based on raw numbers of shares and saves - nothing that required much algo intrusion. I suppose that I was just looking for better clarity on what Recommendations is and would be doing. Pocket responded in a tweet that the Recommendations feature will not used to support ad targeting and our data (and metadata) will not be used for that. So, I feel a bit better. They also mentioned that _Recommendations_ will not be loaded unless we tap on the tab for it. With all of the privacy intrusive practices being carried out today, I tend to question _new features_ that aren't accompanied with a clear privacy statement.

<comment><USER3> Ah, I think I misunderstood your intentions. The nature of the article made me think it was another "Privacy is dead" rant. Thanks for taking the time to carefully research the new policies of Pocket.

<comment><AUTHOR> I actually should have clarified my intent better and hope no real harm was done along the way. I'll definitely work on this going forward.

</comment></comment></comment></comment><comment><USER4> TL;DR: AN APP I USE FOR FREE IS TRYING TO MAKE MONEY OFF MY DATA!!!!!! Oh wait, they contracted me to say they weren't. HEY GUYS THEY WEREN'T, FALSE ALARM!!!

<comment><AUTHOR> Nothing wrong with an app making money. It's all in the method.

</comment></comment><comment><USER5> Saved to Pocket.</comment>


Justin.tv doesn't treat employees as interchangeable cogs - <AUTHOR> http://rahfeedback.posterous.com/dont-treat-employees-as-interchangeable-cogs

<comment><USER2> For awhile I had a coworker with less than stellar English skills. Said employee wrote an error message that was poorly worded, and somehow we missed it and the poor English was shipped to customers. The response was that everyone on the team had to have their error messages reviewed by a member of the docs team before we could commit any code with error messages.

I never did decide if it was OK to be annoyed by that policy.

<comment><USER3> It seems like the best response to both that mistake and that situation would have been to have a policy of pulling any error messages (or other text that'll be visible to users) from a resource file. If you made the resource file use a simple enough format, you could just pass the entire thing off to the docs team before each release and let them edit it directly. It'd also make future i18n efforts far simpler.</comment></comment>


Verizon said to be valued at $285 billion - <AUTHOR> http://online.wsj.com/article/BT-CO-20130829-710771.html

<comment><USER2> The link is going to the wrong place.</comment>


Same-Sex Married Couples Have Higher Income Than Opposite-Sex Married Couples - <AUTHOR> https://www.census.gov/library/stories/2020/09/same-sex-married-couples-have-higher-income-than-opposite-sex-married-couples.html <comment><USER2> There are the attributes: same-sex, opposite-sex and married vs not-married for couples.

What if same-sex couples have more hassle getting married, and that higher income same-sex couples are more likely to progress from not-married to married than low income same sex couples?

</comment><comment><USER3> I be curious if more same sex couples are childless and there for make more money.

</comment><comment><USER4> "correlation does not imply causation"

One simple guess : same-sex couples are located more in cities than country side. Income in cities are higher.

<comment><USER5> You don't think this implies deeply rooted, systemic discrimination against opposite-sex marriage?

Edit: Corrected same-sex to opposite-sex, which is what I meant to write.

<comment><USER3> I don't see how higher income is an outcome of discrimination?

<comment><USER6> I think he is implying same sex couples live in cities because in more rural areas they would be discriminated against</comment></comment></comment></comment>


Battle over Science Roils EPA - <AUTHOR> https://thehill.com/policy/energy-environment/447520-battle-over-science-roils-epa <comment><USER2> The title of this is very misleading.

> Critics say the rule will exclude some of the most important research from > consideration simply because it does not rely on data that can be shared > publicly.

Is it really too much to ask that when a government regulator makes a rule, the science behind it be publicly available? Since when is transparency bad when formulating public policy?

<comment><AUTHOR> The data behind studies involving the effects of things on humans is not always publicly available because making it so would violate the privacy of the subjects.

That doesn't prevent the studies from being scientifically useful. They can still publicly include summaries of the data sufficient to allow others to tell if the study was well designed, to tell if their statistical analysis was reasonable, and so on.

It also doesn't prevent others from attempting to replicate the studies using other groups of test subjects.</comment></comment>


Ask HN: Young startups attending Techcrunch conference? - <AUTHOR>

It seems 2 years ago (techcrunch40) http://news.ycombinator.com/item?id=298565 it was worth it. Now, Techcrunch Disrupt May 010 winner Soluto is a not an example of young startup.
If you do not have user traction or are still working on the MVP at the moment of the application, is there any chance to get selected?
Anecdotes, stories to share on those type of conferences? Would you recommend it? if yes How to apply successfully to participate to Startup Battlefield?
Any other conferences worth the money and the time attending? <comment><USER2> TC Disrupt is not the same as TC 50. It's the Arrington spinoff: one half of a great thing, and not the great half. The other half, Calacanis, is starting the Launch Conference.

Official site is here <http://thelaunchconference.com/> but so far news has been coming through TWiST podcast.

Skip DEMO altogether. Go for the Launch conf. If you can't get in TC Disrupt is a consolation prize, but like you said, they may not accept early stage.

<comment><USER3> thanks for both info. There is also Paris LeWeb10 in Europe

</comment></comment><comment><USER4> Being on stage is worth it. There are two main conferences that target new startups: TechCrunch Disrupt and DEMO. DEMO has something happening in September, with application deadline mid-July (pretty much right now).

Applying is free. If you pass the selection process, you can make your decision then. If you are not selected (2 years ago, TC40 had about 1,000 applications for 40 slots), then you don't need to think about anything.</comment>


IPad tops Mossberg's list of best reviewed products of 2010 - <AUTHOR> http://www.appleinsider.com/articles/10/12/24/ipad_tops_mossbergs_list_of_best_reviewed_products_of_2010.html <comment><USER2> Source: [http://mossblog.allthingsd.com/20101224/best-and-worst- produ...](http://mossblog.allthingsd.com/20101224/best-and-worst-products- of-2010/)</comment>


Javascript is our field-marshall - <AUTHOR> http://writing.ludwignz.com/post/javascript-is-our-field-marshall

<comment><USER2> > There's one queue (that one thread), and it's job to is delegate jobs so it > can respond to new requests quickly.

Ironically, you can find this JavaScript code in the page

        $(document).scroll(function(){
          self.didScroll = true;
        });

        setInterval(function() {
          if (self.didScroll) {
            self.didScroll = false;
            self.scrolly();
          }
        }, 10);

It means this anonymous function is executed up to 100 times per second even when you're not scrolling.

<comment><AUTHOR> Awesome! This is what happens when you're too lazy to write your own blog theme...</comment></comment>


Submarine cable cut lops Terabits off Australia's data bridge - <AUTHOR> http://www.theregister.co.uk/2016/02/07/cable_cut_lops_terabits_off_australias_net_connectivity/ <comment><USER2> They intermix "break/broken" and "cut". It's important to know whether this is decay or sabotage.

<comment><AUTHOR> Indeed. It's a relatively new cable system so I'd be surprised if it's decay.</comment></comment>


USPTO issues 10 millionth patent [pdf] - <AUTHOR> https://10millionpatents.uspto.gov/docs/patent10million.pdf <comment><AUTHOR> US Patent and Trademark Office today issued the 10 millionth utility patent to Joseph Marron and Raytheon, for _Coherent LADAR Using Intra-Pixel Quadrature Detection._

The numbering system dates back to 1836.

See also coverage across the web:

\- USPTO announcement: _U.S. Patent 10 Million_ : [https://10millionpatents.uspto.gov/patent-10-million.html](https://10millionpatents.uspto.gov/patent-10-million.html)

\- Law.com: _Raytheon Is Owner of Landmark 10 Millionth Patent From USPTO_ : [https://www.law.com/corpcounsel/2018/06/19/raytheon-is- owner...](https://www.law.com/corpcounsel/2018/06/19/raytheon-is-owner-of- landmark-10-millionth-patent-from-uspto/?slreturn=20180519161946)

\- Government Executive: _Patent Office Celebrates 10-Millionth Award as Inventors Complain_ : [https://www.govexec.com/technology/2018/06/patent- office-cel...](https://www.govexec.com/technology/2018/06/patent-office- celebrates-10-millionth-award-inventors-complain/149131/)

\- CNN Money: _In tech, patents are trophies -- and these companies are dominating_ : [http://money.cnn.com/2018/06/19/technology/tech- patents/inde...](http://money.cnn.com/2018/06/19/technology/tech- patents/index.html)

</comment><comment><USER2> It's a shame patent 10000000 isn't something fun like US6368227B1 ("Method of swinging on a swing"). Someone should have submitted a carefully timed application for a patent that covers using one's top hat to bail out a bathtub when the plug is jammed and the taps won't turn off, for example.

<comment><USER3> Given the variable lag time between application and granting of a patent (on the order of months), even with the most careful timing, this seems unlikely to work.

</comment></comment><comment><USER4> Maybe this is a sign that there are too many patents.

<comment><USER5> The first U.S. patent was issued in 1790, signed by President George Washington. The current numbering system started 182 years ago. Which means 150 patents granted per day (400 a day in recent years). Is that a lot?

<comment><USER6> Dividing the total number of patents by 182 years masks some of the realities. Namely, there are significantly more patent grants in the past decade compared to any other. For example, 2015 had 325,979 patent grants, compared to 2005 with 157,718. There's a pretty clear trend, see [https://www.uspto.gov/web/offices/ac/ido/oeip/taf/us_stat.ht...](https://www.uspto.gov/web/offices/ac/ido/oeip/taf/us_stat.htm).

<comment><USER7> That's a great resource. I notice there's a 31% jump from 1997 to 1998. [https://en.wikipedia.org/wiki/State_Street_Bank_%26_Trust_Co...](https://en.wikipedia.org/wiki/State_Street_Bank_%26_Trust_Co._v._Signature_Financial_Group,_Inc).

</comment></comment></comment></comment><comment><USER8> I thought it was LIDAR? At least I don't know of a LIDAR not using a LASER.

<comment><USER9> I believe LIDAR and LADAR are interchangeable since it's based on a portmanteau of `light`/`laser` and `radar`</comment></comment>


Ask HN: Giving up a lifestyle afforded by a $90K to $100K paycheck? - <AUTHOR>

I am currently making about Rs. 20 Lakhs per annum (which provides a lifestyle equivalent to what $90K - $100K paycheck can buy you in the SF Bay Area.
I work in a senior technical role, lets say in a company similar to IBM Global Services (though much smaller- having about 15,000 employees). I like my job and the people I work with - even though I do end up working independently a lot on Research/Labs type of projects. I have been making reasonable progress and contributions but nothing spectacular.
Lately, I have been thinking of quitting this full-time job. The reasons are somewhat non-simple - but one of the reasons I've realized is that I don't feel full justified in making this paycheck. I feel that I would be able to deliver more value if I was not working full-time in a Global Services corporation but working independently on my own.
I have realized that given my skill level I will be able to continue in a global services corp. for many years to come- but I'm not sure if that role is ideally suited for me. I mainly work in open-source technologies like Cassandra, HBase (the entire Hadoop Stack) and in the past have worked on large projects related to the secure e-commerce payment authentication industry. Hence, I also have a good understanding of PKI, internet architectures, various web protocols, etc.
I am wondering if there is any kind of arrangement that I can offer my current employer- where I can tell that I don't want a monthly paycheck from them- but I would still like to work for them in a capacity which is relevant and useful for them?
Or do you feel that I'm completely stupid in trying to discontinue my paycheck and should just get my head straight and keep doing what I'm doing in the hope that someday this work will start becoming relevant? <comment><USER2> Markets clear. What you get isn't what's justified or fair, but what somebody else would have been willing to offer. The guys signing your paychecks probably know better than you what the competitive market price for your labor is (because it's part of their job, and they talk to a lot more people about it). There's a good chance that having you full-time, loyal, readily available, and ramped up is worth more to them than what they'd save by only hiring you in times of need, especially if they have to convince conservative customers that long projects will remain predictable and under control. They might think only having you part-time is a bad deal, if it adds risk for them.

Work is a big part of your life, and you should leave if you think you've found or created a more rewarding job. But don't leave just because you don't think you deserve what you're paid. By that standard they probably aren't any more deserving of that money.

</comment><comment><USER3> I you're gnawed by curiosity or dissatisfaction, you should definitely try this. The alternative is dismal -- perhaps it's prudence, but to you it'd always be cowardice.

</comment><comment><USER4> In your situation, it does not seem sensible to leave a well paid job without something to move on to. When you say work independently do you mean you want to consult to companies (including your current employer) or do you have something else in mind?</comment>


Ameo – Redis-compatible distributed key-value store with WebSocket API - <AUTHOR> http://marianoguerra.org/posts/ameo-redis-compatible-getsetdel-and-publishsubscribe-on-riak_core-with-websocket-api/ <comment><USER2> Cool. I implemented a similar toy project once, to directly expose a database on the server to the client via web socket. I say "toy" because that's obviously incredibly insecure.

What are the security considerations here? If you have multiple clients, should their topics be isolated? Presumably Alice should not be able to run a DEL command on a topic owned by Bob. Where would you put code for authentication / ACL?

<comment><USER3> > I say "toy" because that's obviously incredibly insecure.

I trust postgres row-level access control a lot more than a php script with dbowner access to the db - so I think this depends a lot on which db, and what "direct access" means...

<comment><USER2> True. This was a college project years ago but recently I've been thinking about revisiting it. With properly provisioned DB users, ACLs, and stored procedures, it could actually end up being more secure than it would be with an intermediary application server.

</comment></comment></comment><comment><USER4> Cool!

I built CurioDB a while back with the same idea, but using Akka as the underlying framework. Persistent Redis with distributed transactions, embedded Lua and a websocket front-end:

[https://github.com/stephenmcd/curiodb](https://github.com/stephenmcd/curiodb)

</comment><comment><USER5> Is ameo related in any way to altayanta?

<comment><USER6> linguistically yes, in any other way, I have no idea :)

</comment></comment><comment><USER7> Isn't WebSocket dead and buried, replaced by HTTP/2?

<comment><USER8> I hadnt heard this - after a bit of digging it looks like SSE + http/2 will replace a lot of the same use cases, but the consensus seems to be no: [https://stackoverflow.com/questions/28582935/does- http-2-mak...](https://stackoverflow.com/questions/28582935/does-http-2-make- websockets-obsolete)

Interesting thought though - I think more options there will be better in the long run, as long as it a "both" instead of an "either/or".

</comment></comment><comment><USER9> The title and article read like they were generated by a buzzword generator.

<comment><USER10> Submitted title was "Ameo – Redis-compatible distributed KV store on riak_core with WebSocket API"</comment></comment>


CyPhy LVL 1 Drone: all Kickstarter backers will be refunded - <AUTHOR> https://www.kickstarter.com/projects/1719668770/cyphy-lvl-1-drone-reinvented-for-performance-and-c/?utm_source=CyPhy_Works&utm_medium=Link&utm_campaign=Post_Kickstarter&utm_content=PreOrder_Page <comment><AUTHOR> Source: email from CyPhy Works / Kickstarter</comment>


New light on the pirate bay story ? - <AUTHOR> http://www.reddit.com/r/technology/comments/8y2s7/openbittorrent_an_open_free_tracker_network_with/c0asqce

<comment><USER2> So from what I understand, TPB will sell their domain name but keep all the torrents by moving it to this 'new' tracker.</comment>


Ask YC: the image on PG's front page, what does it mean? - <AUTHOR> http://paulgraham.com/

<comment><USER2> its the logo for arc

<http://arclanguage.org/>

<comment><USER3> Why is that the logo? What does it mean?

<comment><USER4> <http://www.arclanguage.org/item?id=9439>

Rtm noticed the white and black bits together make a lambda. That was unintentional, but I'm pleased.

</comment></comment></comment><comment><USER5> Was Mondrian an arc hacker?

<comment><USER4> Good catch. It's not a coincidence; he had similar goals.

<comment><USER6> Similar goals as in what? Are these goals for a Neoplastic utopia? [<http://en.wikipedia.org/wiki/Neo-Plasticism>]

>They [propenets for neoplasticism] advocated pure abstraction and universality by a reduction to the essentials of form and colour; they simplified visual compositions to the vertical and horizontal directions, and used only primary colors along with black and white.

Are you proposing something similar with Arc?

<comment><USER4> He wanted to make the best things he could out of the simplest ingredients.</comment></comment></comment></comment>


[C/C++] Use NULL, not 0, or your 64-bit code might not work - <AUTHOR> http://blog.slickedit.com/2011/05/things-i-learned-during-the-64-bit-port/

<comment><USER2> This is expecting a pointer. A NULL sentinel attribute should be set to catch this (if you are using GCC). And GCC _does_ catch this exact error.

void blah(int a, ...) __attribute__((sentinel));

blah(123, 0); will cause gcc to spew "warning: missing sentinel in function call" while blah(123, NULL); will not.

Additionally, one should remember types are important in va_arg functions. For example, passing in 0 when a parameter expects a int64_t, is the same error. It is useful to know that float is promoted to double in va_arg functions and int8_t, int16_t, and bool are promoted to int32_t.

This often causes problems with people new to C using GObject's g_object_set() and g_object_get() functions.

<comment><AUTHOR> Thanks, that was very useful.

</comment></comment><comment><USER3> According to Stroustrup ( <http://www2.research.att.com/~bs/bs_faq2.html> ):

"Should I use NULL or 0? In C++, the definition of NULL is 0, so there is only an aesthetic difference. I prefer to avoid macros, so I use 0. Another problem with NULL is that people sometimes mistakenly believe that it is different from 0 and/or not an integer. In pre-standard code, NULL was/is sometimes defined to something unsuitable and therefore had/has to be avoided. That's less common these days. If you have to name the null pointer, call it nullptr; that's what it's going to be called in C++0x. Then, "nullptr" will be a keyword."

Sounds like compiler/standard library in use bug.</comment>


Programming Principles by Alan Turing - <AUTHOR> http://www.alanturing.net/turing_archive/archive/m/m01/M01-066.html <comment><AUTHOR> I'm used to thinking of Mr. Turing as a mathematician deeply interested in automating computation, less so as a programmer slogging out code. It's heartwarming to see his hard-won tips to other programmers from ~1950, and they are remarkably relevant today. e.g....

\----

A balance must always be struck between the following incompatible desires:

      * To carry the process through as fast as possible

      * To use as little storage space as possible

      * To finish the programming as quickly as possible

      * To achieve the maximum possible accuracy

\----

1\. Make a plan 2\. Break the problem down 3\. Do the programming of the new subroutines 4\. Program the main routine

\----</comment>


IBM CTO Sees Smaller Container Platforms Ahead - <AUTHOR> https://containerjournal.com/topics/container-ecosystems/ibm-cto-sees-smaller-container-platforms-ahead/ <comment><USER3> > These advancements will be occurring in parallel to the rise of immutable > databases in the form of blockchain platforms, applications capable of > invoking quantum computing systems and artificial intelligence (AI) > platforms, which are not only going to become more accessible but also > certified to be trusted and secure, says Ferris.

Article just seems buzzword soup, bringing up: Containers, Unikernels, Blockchain, AI, 5G, IoT, Edge Computing, Quantum Computing

> containers in the years ahead will be deployed on unikernel systems

What does this even mean? Containers are built around sharing a kernel, and unikernels are all about having a kernel custom for your application. Seems the ideas are at odds.

The most charitable view to me seems to be an orchestration platform for running "containers" which are actually VMs running unikernels, instead of contained processes?

<comment><USER4> > What does this even mean? Containers are built around sharing a kernel, and > unikernels are all about having a kernel custom for your application. Seems > the ideas are at odds.

I think the most charitable translation of this is that the OS inside the container (e.g. Alpine Linux) + application will be replaced with a single unified OS + application i.e. unikernel.

I don't think that this is true, but it's a seductive idea.

From what I can tell, as system complexity goes up, you need increased instrumentation in order to property debug your application. That is a lot of what modern OS's provide.

I do sympathize with people making efficiency arguments, but I always try to bet on the "strong horse". There is just so much money and effort going into Linux, that I think it'll get efficient faster than unikernels will get instrumented.

<comment><USER5> 99% of containers don't leverage OS instrumentation or really anything unique from the underlying platform. It's typically just run this Java/Python app and maybe run this database or infrastructure component.

And there is nothing inherently inefficient about the Linux kernel. It's more that once you pack on all of the userland components you do end up with a sizeable attack vector.

<comment><USER4> > And there is nothing inherently inefficient about the Linux kernel.

The first thing that comes to my mind is the user space networking drivers for linux [1]. They aren't very ergonomic, but the massive speed increase that is possible shows how inefficient normal linux networking is.

The promise of unikernels is the speed of user space networking but with good ergonomics.

Like I said earlier, if I had to bet, I'd bet on Linux.

But there is work to be done.

___

1\. [https://en.wikipedia.org/wiki/Data_Plane_Development_Kit](https://en.wikipedia.org/wiki/Data_Plane_Development_Kit)

<comment><USER6> As much as I like dpdk, XDP and eBPF can potentially hit the same rates as dpdk. But we're currently in a state where more driver support is needed.

</comment></comment></comment></comment></comment><comment><USER7> [Disclaimer: I work for Red Hat in this area, but don't speak for IBM or their CTO]

I think reading between the lines this is really about Kata Containers-style fast booting virtual machines which run containers and give you a bit more security. Development of this is very far along, expect to see this being deployed widely soon by enterprises and others who have security sensitive container workloads.

The unikernels stuff seems rather more speculative, and I don't know specifically what IBM is referring to, but I am [at Red Hat] working with a student at BU on turning Linux into a unikernel. You link your application directly to Linux and get a vmlinuz binary which can be run in a variety of places including on cloud VMs, in qemu, in a Kata Container [in theory - <USER2> actually tried this one], or even on baremetal. Old article here: [https://next.redhat.com/2018/11/14/ukl-a-unikernel-based- on-...](https://next.redhat.com/2018/11/14/ukl-a-unikernel-based-on-linux/)

Edit: I should say for completeness there is also KubeVirt, which lets you run your pet VMs in a pod on Kubernetes. Sort of the opposite of Kata.

<comment><USER8> > You link your application directly to Linux and get a vmlinuz binary

How does this work with proprietary applications and the kernel's GPL license?

<comment><USER9> In the cloud no one can hear you violate the GPL.

<comment><USER10> This is why AGPL exists. I think it is agreed that deploying your app to the cloud is not distribution and doesn't run foul of plain GPL.

</comment></comment></comment></comment><comment><USER11> Title doesn't match the article and contradicts the article's contents. The article talks about using unikernels _with_ containers, not instead of them.

BTW, I kind of assume they mean running unikernels _inside_ containers as opposed to running containers _on_ unikernels. The article seems a bit self- contradictory about that.

<comment><AUTHOR> IBM/redhat have a few unikernel related projects going on and I'm guessing this is referring to nabla containers (or he might be aware of ukl).

The only reason to stuff an unikernel into a container is to make the transition easier for k8s/container holdouts. You'll take a perf hit and still be stuck with all the security problems containers have. Other than that at least in my incredibly biased opinion it makes no sense.

</comment></comment><comment><USER12> Same here, serveless computing and rich language runtimes don't care if they are running on top of an OS, container, or even bare metal.

"The Cloud" will drive the OS layer away into plain cloud services, and the mainframe language environments will be back.

<comment><USER13> I agree.

I wonder whether they end up being language agnostic or not.

<comment><USER14> They sort of already are: [https://github.com/newapplesho/aws-sdk- smalltalk](https://github.com/newapplesho/aws-sdk-smalltalk)

</comment></comment></comment><comment><USER15> Erm... this is corporate thinkpiece nonsense.

</comment><comment><USER16> Nope, nope and nope. This fad is as tone-deaf as Howard Schultz running for POTUS. Unikernels are TERRIBLE for operations. How do you have privilege separation? Separation of concerns? Processes? Users? Groups? Talk to a database or LDAP? Have a reliable filesystem? Drivers for hardware? Updates? Security audits?

They're the "emperor's new clothes" but they throw away ALL the generality, security, lessons and existing infrastructure by reinventing the wheel, badly. They were a fad years ago but failed for these and many reasons.

<comment><USER17> For every single ? in your comment, the answer is "it's done at the hypervisor level". A unikernel is basically a single process, so privilege separation, users, groups etc are irrelevant. Drivers are much, much simpler (and I would argue, easier to audit) because they mostly only need to access virtualized, hypervisor-provided HAL APIs. Filesystem, DB, LDAP would be external - possibly provided by another VM on the same physical hardware.

</comment></comment><comment><USER18> Quick question/idea about security: with all of the exploits today like Meltdown and Spectre, is anyone working on a truly secure container?

Something like a public website running on an Intel processor, and/or maybe subdomains running on AMD and other mainstream CPUs. They would each be running some number of containers (up to say 1000 to start) and anyone could log in anonymously and run whatever they want in a minimal OS like Ubuntu. They would probably just have access to a small filesystem and maybe some open ports for HTTP or SSL or whatever.

The challenge would be to break out and take over the host computer. If anyone does that, then the pwned container is flagged as not secure.

The idea here is that until this happens, we can't really run a container and allow public access. I'd like containers to be as ubiquitous as websites running Javascript in the browser's sandbox so that we can host our own REPLs. If companies are serious about this, they should also consider providing bounties, say $100,000 guaranteeing that their container is secure for users. If you get hacked, you get the money. Without something like that, I'm afraid that I can't believe that containers are secure on faith alone.

<comment><USER19> This doesn't work like that. Containers (like docker, LXC and other based on cgroups etc) are isolated by the kernel but they share the same kernel. This means that kernel exploit will make all those containers insecure by your definition. If you go further and try to embed containers in hardware virtualization layer (so basically mini VMs) you still don't have any guarantees because from time to time new exploit emerges that allows to break out from guest OS to hypervisor. Then you have hardware layer and exploits based on speculative execution (Spectre, Meltdown and friends). Truly secure container doesn't exist. You would need some kind of mathematical proof for whole hardware stack and all communications between different hardware subsystems + whole kernel + container runtime.

<comment><USER18> Hmmm that doesn't inspire a lot of confidence. I'd maybe be fine with a VM then, if containers fundamentally can't be made secure.

Short of a mathematical "proof" of security, the best I could come up with was to leave containers open for the hackers of the world to exploit. If a container survives, that's a fairly strong guarantee that it can't be escaped (for now).

What I am getting at is: if we know that hackers can break out of containers, then how are we ok with shared hosting running in containers? Once one gets owned, it's trivial to break into the others.

Edit: this might be a way to force maintainers to fix kernel exploits as well.

</comment></comment></comment><comment><USER20> Is this below saying the kernel context executes within the container? A Hypervisor being communicated to via each container is a security nightmare. The idea is to isolate the container so it can't make any type of hypervisor calls by not making the HV API available to the running container.

"Unikernels consist of a specialized, single-address-space machine image constructed using only a modular stack of libraries required to run an application. That approach allows a secure, fixed-purpose image to run directly on a hypervisor or bare-metal hardware without an operating system such as Linux or Windows. "

</comment><comment><USER21> Will they find a way to slip in the Watson brand?

IBM is no longer in the innovation business. They (along with Red Hat) are in the audit business.

</comment><comment><USER22> containers are implemented via cgroups (and others) and share the kernel. I presume with a unikernel, you'll not be sharing the kernel, obviously.. So concept of a "container" is there and probably the orchestration via kubernetes is all still valid up the stack, so it makes sense to call that "containers" still.

<comment><USER23> Unikernel should run directly on hypervisor. Not sure this plays along with multiple levels of virtualization in today's clouds.

<comment><AUTHOR> It does to a degree but there is immense confusion on how it does. For example with OPS [https://ops.city](https://ops.city) (I'm associated with the project) we deploy directly to AWS or GCloud as an ami or cloud image _not_ orchestrating qemu on top of an existing linux image. A lot of people until they have actually tried booting one are thoroughly confused on this process.

You could play on top of google nested virt or ami's 'bare metal' but both of those would have performance taxes.

I think in the coming years we'll see the big public clouds refactor their environments to support these in a better fashion.

</comment></comment></comment><comment><USER23> Personally I would never bet on anything alongside IBM, but this is interesting

</comment><comment><USER24> 3...2...1...and..a new hype cycle begins...or at least IBM hopes it does.</comment>


Download (fluxus) - <AUTHOR> http://www.pawfal.org/fluxus/packages/

<comment><USER2> About page (easily findable by truncating the link above).

<http://www.pawfal.org/fluxus/>

This is the software used to create the video linked to in this HN thread: <http://news.ycombinator.com/item?id=795184>

</comment><comment><USER3> I think this is some kind of coding visualization software, but I can't find any useful information online. On top of that, the submitter has no comments and seems to have made his account just to submit this. Flagged.

<comment><AUTHOR> No, I made the account to pst other things. I just havent found anything good. It is awesome software.

</comment></comment><comment><USER4> I'm twelve, and what is this?</comment>


How does Apple do payments so well? - <AUTHOR> http://www.quora.com/How-does-Apple-do-payments-so-well/answer/Brian-Roemmele <comment><AUTHOR> Interesting background stories about iTunes, how they adopted payment card aggregator model, how important iTunes Gift card was for iTunes profitability and how Apple was wise enough to buy license to Bezos's One Click patent.</comment>


Sshrc - <AUTHOR> https://github.com/Russell91/sshrc

<comment><AUTHOR> 'bring your .bashrc, .vimrc, etc. with you when you ssh'. A really nice implementation of this idea.</comment>


Hackers Wanted (Unreleased Directors Cut) - <AUTHOR> http://cyberkooltour.blogspot.com/2011/06/hackers-outlaws-or-patriots-anonymous.html Would the U.S. Government use a hacker group to launch a campaign of global terror? "The next war is not going to be fought with bullets, guns and bombs, it's going to be fought with code and computers." <comment><USER2> I'm pretty sure the best way to ensure your link goes unread is to put it in all caps.

<comment><AUTHOR> edited! thanks m8 ;)

</comment></comment><comment><USER3> Have to say that was nice documentary.

</comment><comment><AUTHOR> Would the U.S. Government use a hacker group to launch a campaign of global terror?

</comment><comment><AUTHOR> "The next war is not going to be fought with bullets, guns and bombs, it's going to be fought with code and computers."</comment>


My Personal API - <AUTHOR> http://api.azer.io

<comment><USER2> At one point in the future we should really start differentiating between an API and just raw JSON on plain sight.

<comment><AUTHOR> This is an interface that you can program. For example, you can make a JSONP request to it (e.g [http://api.azer.io/?callback=foobar](http://api.azer.io/?callback=foobar)) and fetch display/process my personal info in your app easily.

Here is an example: [http://requirebin.com/?gist=7985717](http://requirebin.com/?gist=7985717)

</comment></comment><comment><USER3> _shameless self-plug_

I've set up something similar on my personal domain, except that it outputs JSON only if it's a curl request (i.e. if the user agent begins with curl) while browsing to it using a regular browser serves the actual website:

$ curl kamal.io

nginx config: [http://pastebin.com/VBuYPHbT](http://pastebin.com/VBuYPHbT)

</comment><comment><USER4> Technically it is an elegant and neat solution. But I hesitate about the social impact.

My first reaction is that I don't want to publish this kind of information about my self. It can be really dangerous when things like religion comes into the wrong hands.

</comment><comment><USER5> Just getting JSON doesn't make it an API.

Why can't I POST you a message? Or myself as a new acquaintance? Once I'm your friend, why not POST a meetup for the two of us so I can PUT a new date in it or DELETE it later?

</comment><comment><USER6> Assuming a RESTful vocabulary, is this only GET?

What if I want to POST something to you? Or DELETE that kimchi burrito thing from your favourite foods?

Wouldn't it be cooler to support more verbs?

</comment><comment><AUTHOR> In addition to humans, you can use personal-api for cats, as well: [https://blackbear.api.azer.io](https://blackbear.api.azer.io)

It should also work for other animals.

</comment><comment><USER7> Only names like "favorite drinks" are not so nice to use within an App, better name it "favorite-drinks" / "favorite_drinks" / "favoriteDrinks"

</comment><comment><AUTHOR> ...and if you'd like to create yours, this makes it really easy: [http://github.com/azer/personal-api](http://github.com/azer/personal-api)

<comment><USER8> why not just use a plain .json file?

<comment><USER9> it won't be an API server that you can have features like jsonp

</comment></comment></comment><comment><USER10> male: true should be sex: "male"

<comment><USER11> Here you go: [https://github.com/azer/personal- api/fork](https://github.com/azer/personal-api/fork)

</comment></comment><comment><USER12> Pretty nice actually, but can't understand why one would like to use this. I mean if someone wanted this info to implement the API on their app, wouldn't it be tiring to go through millions of websites to get user data?

This sounds interesting, and maybe something like Gravatar can built upon it.

<comment><USER13> I got thinking about almost exactly the same thing. But what value would such a service have over using a social login like Facebook, Twitter or Google, given that these are already well established?</comment></comment>


Show HN: ContextCue – Create and host private, ethical ads - <AUTHOR> https://contextcue.com <comment><USER2> I will 100% try this within the next weeks. I am ddg-ing every possible variation of "ethical adsense alternative" without any useful leads for months now.

<comment><USER3> You will have the same experience from this one :(

At least judging from their page where all they claim is ethically correct, not effectiveness.

<comment><USER2> I haven't had an experience. That's the point. Most of my projects remain unmonetized for ethical reasons. The only thing I could find until now was tize[0], which is a completely different approach to advertising that didn't strike me as particularly circumspect.

0: [https://tize.io/](https://tize.io/)

</comment></comment></comment><comment><USER4> Interesting idea and I am excited to try out.

That said, trying to actually get started (as a publisher) is a little challenging. Theres no reference to the script that has to be loaded on the dashboard -- I had to find it in your FAQ.

I cant remove a site that had a typo in the address -- when I tried to overwrite it I now have two with the same name.

I'm also hitting a CORB issue on my dev site -- though to be honest I havent spent too much time yet on it, but it is preventing me from deploying ContextCue ads

<comment><AUTHOR> Thanks for trying this out! We should probably warn potential users that this is still in the early stages (we've been working on this for nearly a year and figured we should get some feedback).

1\. Definitely a good idea (I'm glad you could find it in the FAQ though!)

2\. We definitely need to be able to edit sites, just didn't make it in time.

3\. We probably need to revisit how the development flow is here. I believe the site needs to match the hostname + port. Ex. "localhost:3000"

<comment><USER4> Thanks -- I can email your support account, but #3 at first was CORS, then it became CORB when I got the ports working ([https://chromium.googlesource.com/chromium/src/+/master/serv...](https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md))

<comment><USER5> Editing of sites is now live–thanks for your patience :)

</comment></comment></comment></comment><comment><USER6> Good to see.

I always thought a way to have individually targeted ads but not give up privacy is for the user to indicate what topics they are or are not interested in. An agent could manage an anonymous profile somewhere that provided a identifying token that the user's browser provides in place of a tracking cookie.

<comment><USER7> EDIT: The website says these ads are not individually targeted. Hooray!!

I'm leaving the rest of this comment for context.

...

Wait, these are still individually targeted?

In that case, I need to learn a lot more about them before I can be OK with them -- specifically, how it's possible to individually target ads without collecting data about users.

> that provided a identifying token

If that's what it's doing, then I'm out.

<comment><AUTHOR> Nope, we don't do any individual targeting. We base the ads on the website that that the ads are on. We believe that targeting based on the website will still provide relevant ads because the user is already interested in the content of the website. In fact, we don't store any cookies on the user's device.

</comment></comment></comment><comment><USER8> :clap: This looks great! I'm very excited that ethical ads are becoming more and more common. It looks like this recently launched.

I am the founder of [https://CodeFund.app](https://CodeFund.app). We are an ethical ad platform that is focused on funding open bloggers, builders and maintainers. We also do not do any tracking of users nor allow 3rd party scripts.

I'd love to connect sometime and see if there's anything we can do to help. We also have a small group that meets each month to discuss ethical ads.

<comment><USER9> Javascript again... That means putting the balls of my visitors in your hands. I would not do that. It does not feel ethical to me.

I wish there was an ad network that works with static html elements.

<comment><USER8> We provide a server-to-server API service that allows HTML rendering sans JavaScript. However, the unethical part of using scripts is not in the fact that scripts are used, but what those scripts include. Yes, there must be trust between parties. This is why we are 100% open source. This is why we ensure that no 3rd party scripts are included alongside ours.

I'm sorry, but I do not believe you can get more ethical than that. I stand behind our mission and our reputation.

</comment></comment></comment><comment><USER10> How are the ads served? Are you using Javascript or simple images? If it's the former I'm afraid there's no way to trust you (as the JS can change at any time and become malicious).

<comment><AUTHOR> We use JavaScript to fetch the ads, but the ads themselves are static images. We went with static images for a few reasons. 1) Speed. There's no need to download a bunch of JavaScript, CSS, and HTML. 2) Security. No JS in the ads means no bitcoin mining on the ad network [1] 3) Privacy. Since we host all of the images/ads, advertisers can't inject their own tracking code.

If the JavaScript to load the ads is a non-blocker, send me an email and we can discuss other options.

[1]: [https://arstechnica.com/information- technology/2018/01/now-e...](https://arstechnica.com/information- technology/2018/01/now-even-youtube-serves-ads-with-cpu-draining- cryptocurrency-miners/)

<comment><USER7> I love what you're doing here, by the way. This sounds like how advertising should be done.

> We use JavaScript to fetch the ads

Sadly, since I keep JS disabled in order to help protect myself from all the bad advertisers out there, depending on JS means that your system would be filtered out too. Collateral damage and all that.

Perhaps you do this, but if not, then you might consider using a noscript element to alert people like me that they might want to allow your script to run.

<comment><AUTHOR> That's a good point. We'll add this to our long list of things to do :)

</comment></comment></comment></comment><comment><USER11> This looks awesome! Do you have any info about publisher payout rates, or how the revenue earned (like RPM) compares to, say, Adsense? I'm psyched to try it :)

<comment><USER12> Yes, publishers get payed 70% of our revenue compared to Adsense's 68%.

</comment></comment><comment><USER13> Who is this company which wants to help me deal with my customer's "trust issues"?

I really am interested in this advertising model because really hate what these trackers have turned the internet into, but when I can't even find a street address and phone number on their web page then that's a no-go for me.

</comment><comment><USER7> If their claims about not collecting data from users is correct, then this is something I could get behind.

<comment><USER5> You can read more about our privacy policy here: [https://support.contextcue.com/support/privacy- policy](https://support.contextcue.com/support/privacy-policy) Feel free to reach out if you need any help getting started!

</comment></comment><comment><USER9> It looks strangely anonymous.

Who runs ContextCue?

Where is it located?

<comment><USER12> Hey there, I'm Corey one of the developers at ContextCue. Thanks for the feedback! ContextCue is run by me and 3 other developers out of Indianapolis, IN.

<comment><USER9> Hmm...

If me and 3 designers would start a new project, we would use our original HN accounts to communicate. Put our names on the project and link to our other projects and social media presences.

And we would for sure announce it on our Twitter accounts.

None of this happened here. Why?

<comment><USER14> ... maybe they didn't have HN accounts before?

</comment></comment></comment></comment><comment><USER15> How do I know I can trust the numbers you give me as an Advertiser?

<comment><AUTHOR> This is a great question, and a very important one.

The number of users referred to your site or product (based on traffic logs) should be similar to the number of ad clicks that you're charged for. This won't be 100% accurate due to some browsers removing the referral header, but there should be a strong correlation between the two.

I think ultimately though, it's about trust. I don't believe it's in our long term interest to attempt to defraud our partners as a company. We do well when our partners do well, and providing fake numbers will cause our partners to have a lower ROI, making them less likely to stay on our network.

It will take time for us to establish trust, but I believe that we won't be successfully unless both advertisers and publishers trust us.

</comment></comment><comment><USER16> [https://contextcue.com/pricing](https://contextcue.com/pricing) is broken. :|

<comment><USER12> Sorry about this guys, we were so eager to get this out there! We used a template to generate the website and forgot to remove extraneous links. Will be fixed soon. In the meantime, there's no fees for signing up or hosting ads!

</comment></comment><comment><USER17> Looks very interesting, I have a few websites where I could maybe slap some of this just to try.

<comment><USER5> Sweet! Let us know if you need any help getting started on the publisher end of things: [https://support.contextcue.com/support/publishers/start- host...](https://support.contextcue.com/support/publishers/start-host-ads)

</comment></comment><comment><USER18> Could this work with a (big evil) prebid stack? Or as a static tag in DFP?

<comment><USER18> I know that defeats the whole point, but big publishers can't just make a leap blindly.

</comment></comment><comment><USER19> Do you provide a list of publishers or share estimated volume numbers?

<comment><USER12> We just launched today, and are currently recruiting publishers!

</comment></comment><comment><USER20> Just a heads up, you might want to look over your site. You've got a unfinished tag in the bottom "user data/p>", and several links don't work such as [https://contextcue.com/pricing](https://contextcue.com/pricing) (After clicking the "start now" button it's linked to)

<comment><AUTHOR> This should be resolved now. Thank you!

<comment><USER13> I'm still getting an AccessDenied. Also for [https://www.contextcue.com/contact](https://www.contextcue.com/contact)

<comment><AUTHOR> Sorry, I should have been more clear. Those links were to old pages that don't exist anymore, so I removed them from the original page.

We have moved most of our support/information resources over to [https://support.contextcue.com](https://support.contextcue.com) for now, since we do have limited resources and we would rather be spending time building the network than building contact forms :)</comment></comment></comment></comment>


Microsoft Cognitive Toolkit is now generally available - now with Keras support - <AUTHOR> https://www.microsoft.com/en-us/cognitive-toolkit/blog/2017/06/microsofts-high-performance-open-source-deep-learning-toolkit-now-generally-available/ <comment><USER2> Finally, Keras support!</comment>