Keyframes: Delivering scalable, high-quality animations to mobile clients - <AUTHOR> https://code.facebook.com/posts/354469174916519/ <comment><USER2> Hey, everyone!

I'm one of the developers at Facebook who worked on this library since its conception! Really excited to be able to share this library today! I'll be checking up here periodically and can help answer any technical questions that you have!

<comment><USER3> Why does the software license [1] include the following clause:

> provided Your Software does not consist solely of the Software

Why didn't you guys choose MIT or BSD? It feels like the custom Facebook license is close to the intent of these, but it has that mysterious gotcha.

In any case, thanks for the software! It looks really slick, and I definitely have a use case for using it to replace the sprite sheet I used for Donald Trump on jungle.horse.

[1] [https://github.com/facebookincubator/Keyframes/blob/master/L...](https://github.com/facebookincubator/Keyframes/blob/master/LICENSE.md)

<comment><USER4> Note that, by publishing this repo publicly on GitHub, there is a right to fork granted by GitHub's ToS[0], which this license seems to conflict with (though IANAL of course...). Not sure what "fork" means in this context, whether it's just duplicating a repository or also modifying it.

[0] [https://help.github.com/articles/github-terms-of- service/#f-...](https://help.github.com/articles/github-terms-of- service/#f-copyright-and-content-ownership) Section F.1: "By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories."

<comment><USER5> Agreed. I've already contacted GitHub to report abuse.

This license seems to directly contradict GitHub's Terms of Service. It says:

> [...] you are hereby granted a non-exclusive, worldwide, royalty-free > copyright license to (1) use and copy the Software; and (2) reproduce and > distribute the Software as part of your own software ("Your Software"), > provided Your Software does not consist solely of the Software; and (3) > modify the Software for your own internal use. Facebook reserves all rights > not expressly granted to you in this license agreement.

Where as GitHub's Terms of Service state:

> By setting your repositories to be viewed publicly, you agree to allow > others to view and fork your repositories.

It seems impossible for me to fork this software without violating Facebook's license. To fork it on GitHub would require that I make the repo public (meaning I would be distributing the Software as "My Software" even though it consists solely of the Software). And any commits I made to the forked repo would violate their license because I am only licensed to modify the Software for my own "internal use".

<comment><USER6> (2) only seems to apply if you publish the fork yourself - "reproduce and distribute"

"reproduce and distribute the Software as part of your own software ("Your Software"), provided Your Software does not consist solely of the Software;"

<comment><USER5> If you click on the "Fork" button from GitHub's website then that is exactly what you'd be doing.

</comment></comment></comment></comment></comment></comment><comment><USER3> This is really slick, and I'm going to investigate using it for the Donald Trump animation on jungle.horse.

The license [1] doesn't look to be as encumbered as some of Facebook's other open source licenses, but does include a clause I found to be strange:

> provided Your Software does not consist solely of the Software

So if I'm reading this correctly, it means only Facebook can redistribute this software? Wat.

[1] [https://github.com/facebookincubator/Keyframes/blob/master/L...](https://github.com/facebookincubator/Keyframes/blob/master/LICENSE.md)

<comment><USER7> I wonder how that affects creating a fork of it. At what point does it become different enough that you can safely distribute it

<comment><USER8> IANAL, but it reads to me like they don't think that point exists. "You can use it, but you can't publish a fork of it." Definitely _not_ open source in my eyes.

</comment></comment></comment><comment><USER9> I was totally down with this - a tight, efficient vector graphics format with After Effects integration, super - up until the point they said these animations were JSON files.

Huh?

Didn't I just read a whole blog post saying that one of their requirements was fast loading from disk, small bandwidth usage, etc? And that's what justified creating an entirely new image format from scratch, not something the internet is really suffering a shortage of already?

I know JSON is fashionable but that ending just seems kind of ridiculous. What's wrong with a binary format? Use Cap'n'Proto and mmap it! Saying numbers _represented as text_ compresses well was the icing on the cake. No shit!

<comment><USER10> While a binary format would be better over the wire, once it's put into memory the format really doesn't matter. In fact I would argue that the decision to use JSON versus XML versus a binary format is entirely immaterial as it'll get cached once and likely never downloaded again (essentially). At least as far as Facebook's usage is concerned (they load these 6 once and never again).

Also I think you have to pick something human readable here. One of the great things about SVG is that it's in XML so you can read it, tweak it, etc. It's super handy when you want to make small changes that only affect the image. So I see using JSON as pretty handy.

Don't forget there are many types of formats out there that have 2 types: a binary and human readable type. One used typically during debugging and one used for optimal over-the-wire transport. I don't see why this couldn't be possible at a later time.

Edit: I don't understand the downvotes. Over-optimizing is a thing. For a one time download I don't see the handfuls of milliseconds you're saving mattering. In either case of receiving a binary or JSON you will store it in an optimal format on the device...

<comment><USER11> As someone who has to deal with mobile perf issues, JSON serialization/deserialization can take a lot more of a perf budget than you realize. A flatbuffer version would definitely be faster hands down.

With gzip sizing is about the same, but processing speed wise it is not.

<comment><USER12> Also if you gzip the binary version and the json version, the gzipped binary is still going to be much smaller.

Same with csv data, for download size it really pays off to preprocess and pack into arrays of binary structs before compression.

This is part of a bigger class of effects in preprocessing data before compression, it is often surprisingly effective. For example delta coding or columnar format (SoA vs AoS) can yield big improvements depending on data.

<comment><USER13> See: precomp, lrzip, srep

</comment></comment></comment></comment></comment><comment><USER14> tl;dr - A plugin/library for exporting vector animations from After Effects and using them easily in iOS/Android apps.

Previous options were exporting SVG animations, rendering to bitmap spritesheets or png sequences - or having to write a spec for the AE animation and recreate it in iOS/Android.

</comment><comment><USER15> Correct me if I'm wrong. It sounds like Keyframes is like "Flash runtime", the differences are you author your animation in After Effects, and the output is JSON (instead of SWF).

<comment><USER16> Yes, that was also my first thought. Keyframes animations were pretty much one of the earliest features of Flash. Used those nearly 15 years ago. However Flash was/is not limited to that, since it's also a completely programmable.

Since Adobe moved quite some effort away from Flash and towards HTML I'm pretty sure that they would now also support exporting keyframe animations from one of their standard tools into a native browser format.

<comment><USER17> It would be great to finally get back the true programmable animations that we had with Flash so many years ago. It took a while, but things to be coming full circle--for the better.

<comment><USER16> It's bascially the same as for UI components. Adobe had the great MXML based Flex framework back then.

The web world only slowly catched up, and I think it took until the current gen of frameworks (angular2, etc.) to be at the same level. However the good thing (as you also pointed out) is that the new variants are based on standards.

</comment></comment></comment></comment><comment><USER18> This is a powerful idea. I've looked for tools to do this exact thing. I'm the sole animator on a team of software developers and currently when I want to create an animation in an iOS app I usually start by mocking up the animation in a tool like after effects, and then recreate that animation using my graph editor as reference in core animation. Svg works well for storing shapes. Having a similar standard for storing animation curves is really powerful.

<comment><USER19> How do you directly render SVG in your mobile apps currently?

Have you tried font-iconification services like [http://fontastic.me/](http://fontastic.me/) ?

</comment></comment><comment><USER20> Why can't this just be MIT licensed?

</comment><comment><USER21> I've made the exact same thing, basically. A tool to convert AE animations to iOS. Has some other features, but it's also AE -> JSON -> code: [http://www.squall.no](http://www.squall.no) Cool to see what the folks at FB came up with!

<comment><USER22> very well polished... will check it out

</comment></comment><comment><USER23> Neat! Where's the react-native port? I know there's gotta be one since FB uses it in their apps ;)

<comment><USER19> Exactly!

This should be wrappable by a React Native Component, it really is screaming for somebody to do that...

</comment></comment><comment><USER24> Is there a way to also use it on the web? Presumably FB is also using it in their desktop site.

</comment><comment><USER25> Tell me again about how bad flash was for everything, please?

<comment><USER26> The bad part of Flash was the Adobe binary which besides needing to use the messy plugin interface (separate process using an ancient interface, ugh) seemingly always contained tens/hundreds of unresolved security issues.

</comment></comment><comment><USER27> I wonder what this means for animation studios, or edit houses. Obviously most dev shops don't have a need for full time animators, but just as obvious is that a lot of devs don't know animation fundamentals outside of how to implement an animation without jank.

<comment><USER28> > I wonder what this means for animation studios, or edit houses.

It means nothing

> A library for converting Adobe AE shape based animations to a data format > and play it back on Android and iOS devices.

You still need to be able to produce the animation at first place.

</comment></comment><comment><USER29> Any "export-paths/pipelines" available to use the lib with After-Effects alternatives?

</comment><comment><USER30> I'm reminded of this: [https://youtu.be/pAEAbqrE5Zw](https://youtu.be/pAEAbqrE5Zw)

Does it represent a lot of work by skilled technicians? Undoubtedly. Is it _interesting_ in it's own right? Frankly I think not.

The surrounding question of the socialization of the internet is interesting, to be sure, but at the end of the day these are just animated emojis...

<comment><USER31> > Does it represent a lot of work by skilled technicians? Undoubtedly. Is it > interesting in it's own right? Frankly I think not.

You don't think having an easy way to create high quality animations for any purpose that work on multiple platforms is interesting...? You might not find the current application of it interesting but that's like saying React isn't interesting because someone used it to make another Flappy Bird game.

<comment><USER32> But react isn't interesting because they could have just modified custom elements via a polyfill and javascript extension. It would work mostly natively on newer browsers. Keyframes is just after effects animation in HTML5, a feature that could be implemented more natively using svg and a solution similar to this for older browsers. Facebook seems to want to dominate with single-use, clunky libaries.

<comment><USER31> > Keyframes is just after effects animation in HTML5, a feature that could be > implemented more natively using svg and a solution similar to this for older > browsers

That's another approach which has it's own pros and cons. The approach from the article is obviously good if you have Affect Effects experts on hand. I'm not understanding why this isn't interesting to programmers who on a daily basis have to weigh up the pros and cons of different technology/library choices.

<comment><USER33> >I'm not understanding why this isn't interesting to programmers who on a daily basis have to weigh up the pros and cons of different technology/library choices.

Perhaps I'm showing my age, but this feels like this problem was solved a long time ago, forgotten or unused to a large extent and now re-invented. Flash was the clever web version back in the day but I can't see anything really new in this.

I could absolutely be missing the point though. I never count that out.

<comment><USER31> Flash isn't supported on mobile browsers (now), native Android or native iOS though.

<comment><USER33> Oh, absolutely. It was a heavy implementation of a similar solution and the mobile ecosystem is better off without it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> is facebook okay? how many developer hours went into making their emojis animate _properly_? i don't want to say it's a waste of time/shareholder value but it might be.

still interesting though. gonna check it out.

<comment><USER35> Facebook spending a developer year on it is like your average dev shop spending 5 minutes of your time on the daily stand-up.

</comment></comment><comment><USER36> Related - YouI.tv is a commercial product that exports animations and assets from AfterEffects in order to build whole apps: [http://www.youi.tv/youi- engine/](http://www.youi.tv/youi-engine/)

</comment><comment><USER37> Or, be a winner and use GSAP.

Just saying.

</comment><comment><USER38> Why not APNG?

<comment><USER31> APNG files are normally smaller than GIFs (about 30% smaller) but they're still going to be big for high quality animations. SVG/vector animations can be tiny in comparison.</comment></comment>


Scientists frantically copying climate data, fearing it might vanish under Trump - <AUTHOR> https://www.washingtonpost.com/news/energy-environment/wp/2016/12/13/scientists-are-frantically-copying-u-s-climate-data-fearing-it-might-vanish-under-trump/?hpid=hp_hp-top-table-main_climatedata-1130a%3Ahomepage%2Fstory <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=13168971](https://news.ycombinator.com/item?id=13168971).</comment>


Political scientist Nolan Dalla claims to be "push polled" by Clinton's campaign - <AUTHOR> http://www.nolandalla.com/i-just-got-push-polled-by-hillary-clintons-nevada-campaign/ <comment><USER2> The author spends most of this lengthy post congratulating himself for winning an argument against a poorly-educated call-center worker who is required to read from a script. This leaves a pretty bad taste in my mouth. Apart from anything else, it distracts from the point about alleged push-polling which is notionally the reason for the post.

<comment><USER3> Also, I didn't get the impression that he was congratulating himself, just being a bit dramatic, and clearly pretty emotionally worked up over the fact the Clinton campaign was resorting to such an underhanded and dirty tactic. But, he definitely did go more than a little overboard. He probably could have been much more effective in getting more info or changing the caller's mind if he had been calmer. Now the caller will just remember being yelled at by some angry person, and not the message he was trying to get across.

[Edited because I'm clearly still half asleep and probably shouldn't be commenting HN until after I get out of bed and have some coffee.]

<comment><USER4> I'll leave open the possibility that I'm missing something here, but all immediate evidence points to Nolan Dalla being a man.

<comment><USER3> Hah, well, I can't say I know something you don't. I'm not sure where I got that from. I thought about double checking before writing but I didn't. Lesson learned.

</comment></comment></comment></comment><comment><USER5> Well, a lot of what Bernie is saying around Clinton's speeches to big banks is sort of push innuendo as well, since he has no proof that this was anything but what it looks like. tl;dr: politics is dirty.

Also, if you are looking for an anti-pattern for how to influence people, this is a great example. The author makes it about the poorly paid worker instead of about the tactic, which makes you more sympathize with the worker being battered by this know it all.

<comment><USER6> Would it be acceptable for a banking regulator to be paid millions / year for a few hours work by the companies they are claiming to regulate?

It doesn't require innuendo to believe it disqualifies someone for the role as regulator-in-chief. Calling it innuendo is a talking point to deflect that taking this type of money is troubling behaviour for a public servant.

</comment></comment><comment><USER7> The writer, who appears to be a political scientist, doesn't know much about political campaigns, or at least how political campaign polling works. This wasn't a push poll. A push poll wouldn't waste time asking the voter for demographic information or about likelihood to vote - they would get to the negative info they want to spread within a few seconds of the call connecting. Instead, this sounds to me like the common format for a campaign poll that is used to measure the effectiveness of negative messages (so, calling a small # of voters for the purpose of fine-tuning negative ads, etc). If he had kept listening, he likely would have heard the pollster test negative messages on Clinton as well (this is also common - you're trying to figure out what messages work against you at the same time that you test your opponent's negatives). I imagine the Sanders campaign is conducting similar polls (almost any campaign with more than a couple of million dollars raised would conduct a poll like this) and, in fact, this very poll could have been coming from the Sanders campaign.

</comment><comment><USER8> Woof. The tone of this piece is fairly painful to absorb.

</comment><comment><USER9> So, this person claims to be for the working class, then effectively harasses some poor shlub on the phone who's probably getting paid minimum wage to read their script?

<comment><USER10> Do you think it is inconsistent to be in favour of policies "for the working class" and have issues with someone doing something you think is reprehensible if that person is on minimum wage and they were "just following orders"?

<comment><USER9> I think there are a lot of people who are for an abstract idea of the working class but don't have much empathy for real human beings who have to make tough decisions in order to put food on the table.

"I could destroy any one of your arguments in just a couple of seconds. Do you realize you are talking to someone with a degree in political science who has probably written more about politics than everyone in your office put together?"

Oookay.

Also, nice Godwin.

<comment><USER10> I agree with you that the tone of the article distracts from the allegation that is being made.</comment></comment></comment></comment>


Google: Keeping your personal information private and safe - <AUTHOR> http://googleblog.blogspot.com/2015/06/privacy-security-tools-improvements.html

<comment><USER2> I think people who aren't afraid of the Google panopticon won't care, and people who are afraid of it won't be reassured.</comment>


Show HN: Get related terms to a given term - <AUTHOR> https://github.com/victorqribeiro/terms <comment><USER2> Your js is breaking - searched for "Data Science"

`Uncaught (in promise) TypeError: Cannot read property 'join' of null`</comment>


Apache PDFBox – A Java PDF Library - <AUTHOR> http://pdfbox.apache.org/ <comment><USER2> I always found SVG (plus the Inkscape CLI) to be the best interface for generating PDF documents.

I'm sure there are arguments in favour of libraries like this such as performance or better control but when all you need is to generate a simple invoice with a couple of dynamic fields, just use Inkscape to draw your template and your favourite XML library to put values in it in your code. When you need the PDF, use inkscape --export-pdf to get your PDF document.

SVG also makes it quite easy to show an in-browser preview of the generated document before performing the actual conversion, avoiding a costly PDF generation most of the time.

<comment><USER3> Interesting. So do you run inkscape manually from a command line or shell out to it from a program? And I guess that would not scale well f you want to generate many PDFs, in the sense of running inkscape each time would be a perf hit?

<comment><USER4> It seems that it would scale just find with RabbitMQ, and worker queues. It may not be maximum performance per node... but that's not the same as scalability.

<comment><USER3> I guess if you have enough hardware resources, and the delta is low, it may not matter.

After all, we run Unix commands tens or hundreds of times a day, alone or in pipelines, to get things done, vs. putting all the needed functionality into one program and calling it.

Various pros and cons exist for both approaches ...

</comment></comment></comment></comment><comment><USER5> I used PDFBox a few weeks ago to dynamically annotate a set of PDFs. The library works well; but it is severely under-documented. Also, the API is asymmetric w.r.t. _get_ / _set_ in several places. After several hours of frustration, I had to look up the PDF specification for constants to set for default appearance, _etc_., and then set them directly in the underlying _COSObject_ dictionary.

Despite a few problems, the library is good. I will certainly use it again.

Edit: I used 2.0.0-RC1.

</comment><comment><USER6> I used to use a Play framework module to create simple PDFs. You just do your formatting in html and render it as a PDF. [https://www.playframework.com/modules/pdf](https://www.playframework.com/modules/pdf) (only for 1.x series). There seems to be a version for 2.x series but I have never used it([https://github.com/innoveit/play2-pdf](https://github.com/innoveit/play2-pdf)).

<comment><USER7> I do the same but using the flying-saucer library. Just pass the HTML text (with CSS) and it gives back a PDF. Up to a certain point the limitation was getting the header row of multipage tables to appear i every page. When they got to implementing support for CSS 2.1, worked like a charm. Headers and Footers (witblh page numbers) work too.

<comment><USER8> What? People still us Flying Saucer?!

</comment></comment></comment><comment><USER9> I see that they have released 2.0 lately, but can't find any dates, nor the improvements over 1.x. Is this the news? A press release would be better, probably. It's not [Show HN], it's an established Apache project, so I don't get what the news is here.

<comment><USER10> Their "Migration Guide" [1] contains a list of improvements. They should probably add a date to their pages, but reading their mailing list the release is at most a few days old.

[1]: [http://pdfbox.apache.org/2.0/migration.html](http://pdfbox.apache.org/2.0/migration.html)

<comment><USER11> The download pages do have dates, albeit you have to hunt to find them:

[http://mirror.vorboss.net/apache/pdfbox/](http://mirror.vorboss.net/apache/pdfbox/)

      [DIR] 1.8.11/                 2016-01-17 21:55    -
      [DIR] 2.0.0/                  2016-03-18 12:02    -

</comment></comment></comment><comment><USER12> Anyone has a solution to make pdf from html thats hosted. The java library flyingsaucer is stuck at css 2.1 and not much maintained. I have been meaning to check wkhtmltopdf which will need launching a process but might be the best bet for such work. Anyone has better experience in doing something similar?

<comment><USER13> wkhtmltopdf works quite well, I've used it before. A bit of a hassle to get it compiling though.

<comment><USER14> I have also had great success with wkhtmltopdf. There are pre-built binaries available too: [http://wkhtmltopdf.org/downloads.html](http://wkhtmltopdf.org/downloads.html)

</comment></comment></comment><comment><USER15> I'm surprised more people aren't simply trying to use TeX or LaTeX to generate dynamic PDFs. Most of the libraries I've looked at historically were comically incapable, limited to basics like "place a single line of text at these coordinates," with no provisions for line wrapping, paragraphs, tables, etc.

LaTeX (or any TeX variety) on the other hand give you so many different powerful features to generate any arbitrary document, and not only in PDF. There are, of course, a few associated risks that would need to be mitigated as with anywhere user input gets compiled in some turing-complete system, but I'd imagine it would be fairly straightforward to make sure input gets properly escaped so an attacker couldn't run arbitrary code.

<comment><USER16> PDFBox is quite good at extracting text from pdfs. When I use PDFBox, it is for extraction.

Maybe this has changed with newer versions of PDFBox, but 5+ years ago, the internet wisdom was to use PDFBox for extraction and something else, like a version of iText that suited your license needs, for generation.

As much as I like LaTeX, if you have made no prior time investment in typesetting with it, it is not trivial to produce custom good-looking output with it.

Have you tried using (La)TeX in a real world project? Would be cool to hear from someone on whether compilation time is an issue. Some TeX packages have a quite severe impact on performance.

</comment></comment><comment><USER17> It would be nice to see a feature diff with itext.

<comment><USER18> iText can be somewhat frustrating to work with, so it would be great if this is a viable alternative.

<comment><USER19> Really? I've used iText for years. It is extensively documented both online and in the 600-page book from Manning and the guys who wrote the library answer questions on SO, most being answered in less than 24 hours. In addition, iText has both a high-level API and a low-level interface, so anything you can do in a PDF you can do with iText. I'd be hard-pressed to think what could be frustrating about it. That doesn't match my experience at all.

</comment></comment></comment><comment><USER20> And if you're looking for commercial software that produces PDFs right in the browser, see [http://demos.telerik.com/kendo-ui/pdf-export/page- layout](http://demos.telerik.com/kendo-ui/pdf-export/page-layout)

Disclaimer: I'm part of the team. Also see [http://docs.telerik.com/kendo- ui/framework/drawing/drawing-d...](http://docs.telerik.com/kendo- ui/framework/drawing/drawing-dom#known-limitations)

</comment><comment><USER21> Hopeflly PDFBox is more stable than Apache Tika. Tika has become bloated with all the different formats that it supports.

Latest version of Tika parser has 44 compile time dependencies: [http://mvnrepository.com/artifact/org.apache.tika/tika- parse...](http://mvnrepository.com/artifact/org.apache.tika/tika-parsers/1.12)

<comment><USER5> The scope of Tika is different and wide. For the PDF subset, Tika uses PDFBox to parse and extract data from the document.

<comment><USER21> I have never noticed that. Perhaps it is because I never used Tika directly, but as a dependency from other projects such as Nutch.

I realize the scope is different, which is why I mentioned that Tika supports more formats.

</comment></comment></comment><comment><USER22> Just in case there are any posts about the complexity of using any pdf library, you need to understand that the PDF spec itself is an almost unimaginable monster of complexity and frustration.

</comment><comment><USER23> Can we use PDFBox to convert microsoft formats like .doc, .docs, .ppt, .pptx, etc to PDF?

I am struggle finding some good solution with the same.

Their website doesnt have any proper answer to this.

<comment><USER24> It doesn't seem to have that feature, no.

Windows 10 and OS X have built in PDF printers now.

<comment><USER25> Is the Windows 10 PDF printer better than the MS Office integration?

Because the MS Office PDF integration is shit, when I get such PDFs in Preview on Mac OS X and then want to print it.

</comment></comment></comment><comment><USER26> Any feedback on how this compares to Reportlab in Python or Prawn in Ruby?

<comment><USER10> PDFBox can read and render (to an image) pdfs in addition to generating them. I don't know how feature-complete it is.

</comment></comment><comment><USER27> Can it be compiled with GWT?

<comment><USER28> PDFBox does not seem to depend on anything but the JDK (1.6) and commons- logging, so it might work if you manage to find a working and matching version of commons-logging for GWT, and if PDFBox only uses the JDK parts supported by GWT. That is a pretty big if though. I doubt someone bothered to port this to GWT, but who knows, you may be in luck.

If you are trying to generate PDFs in a web-application, I would delegate this task to the back-end.</comment></comment>


Intelligence chair: NSA leaker Edward Snowden may have had Russian help - <AUTHOR> http://www.theguardian.com/world/2014/jan/19/edward-snowden-nsa-mike-rogers-russia

<comment><USER2> The NSA has no credibility and even lied to Congress as a matter of policy, so why should we believe them now? This is all part of the Snowden smear campaign, like the 60 Minutes "news" report.</comment>


Git Magic - <AUTHOR> https://crypto.stanford.edu/~blynn/gitmagic/ <comment><USER2> This is really good documentation which, I think, unintentionally makes git look complicated and terrifying.

I've been using git for almost a decade and there are plenty of things in its toolbox I've never bothered to touch - the rabbit hole goes deep. But for most, the average user could probably get the hang of it with a high level explanation of distributed version control and a handful of commands.

</comment><comment><USER3> This is one hell of a documentation! Thanks for sharing!</comment>


Sorry, Scoble, Quora is not your playground - <AUTHOR> http://quorareview.com/2011/01/30/sorry-scoble-quora-is-not-your-playground/

<comment><USER2> Just feeding off of drama. Over what, exactly? This is equivalent to posting about a Wikipedia edit war.

<comment><USER3> Why are university politics so vicious? _Because the stakes are so low_.

<comment><USER4> Don't you think that the whole "tenure track", "up or out" thing has a lot to do with it as well? The academic job search is quite brutal.

(Even further off-topic: my old university has decided that each group can have at most one professor, and that this job will be re-awarded every five years. It's too early to see the effects, but...)

<comment><USER5> I think the original version of the quote was referring to _student_ politics.

<comment><USER4> I don't think so - it's attributed to various academics, most famously Henry Kissinger; why would they talk about student politics? (That said, I didn't manage to find an authoritative source for the quote.)

</comment></comment></comment></comment></comment><comment><USER6> Pass the popcorn!

It's a challenge for any site that focuses on the Scobles of the world as their early users. What happens when it they want to change the vibe to make it more broadly appealing?

It's certainly not fatal. Twitter navigated through it a couple of years ago, when a lot of the old-timers (including Scoble) talked about how it had lost its appeal and FriendFeed was the wave of the future. It'll be interesting to see what Quora does.

EDIT: although I do think Robert's right: Quora isn't a very good platform for blogging.

<comment><USER7> I agree that Quora is not a good platform for blogging. It's a feature, not a bug -- Quora is an excellent QA site, nothing more and nothing less.

</comment></comment><comment><USER8> Ah, finally someone said it:

>> you, the ubiquitous tech evangelist, larger-than-life personality and Rackspace blogger,

</comment><comment><USER9> Might I suggest that Quora's better off without Scoble if he can't think of it as nothing more than a blogging platform?

</comment><comment><USER10> Vitriol, self aggrandization - all over an issue that doesn't seem to matter much.

</comment><comment><USER11> "Quora Review" doesn't seem to be related to Quora in any shape or form.</comment>


How to make URLs case-friendly: 301 redirects, or just show the page anyway? - <AUTHOR>

<comment><AUTHOR> URLs are case-sensitive, but on most sites they probably shouldn't be. For example, /users/Ben should work as well as /users/ben. This is true even if you have canonical links on your own site, because other sites may link them wrong, or a user will manually type in /users/Ben because he normally types his name capitalized.

Well, it's easy to just return the same page for /users/ben and /users/Ben, but is that the best thing to do? Or is a 301 redirect the better way? (So that users, including Google, never see the non-canonical URL.)

I notice reddit uses a 301 redirect for the likes of <http://reddit.com/user/BenHoyt> \-- but some other sites just show the page anyway, like <http://www.trademe.co.nz/ART/InDeX.HtM> \-- and still other sites are simply case-sensitive: <http://images.google.com/ImageS>

<comment><USER2> I would use redirects, the reason is that search engines will catalog the different URLs as separate destinations and thus lower your pagerank for that page, along with their positions in search results. Its best to have only one accessible url per destination.</comment></comment>


Ask HN: Who is building battery swapping technology for electric cars? - <AUTHOR> <comment><USER2> Something to do with the Niti Ayog's idea?

[https://yourstory.com/2017/11/battery-swapping-boon-bane- ind...](https://yourstory.com/2017/11/battery-swapping-boon-bane-indias-ev- journey/)

<comment><AUTHOR> Very good write up, I was thinking about robotic system which replaces battery by itself for any vehicle provided OEM's provide the automatic battery replacement feature in it.

It really works in many use cases in India, but not thought about the other part - Business. This article explains that well. I know Sun mobility is already working on it along tie up with OEMs, I can see the way they are hiring robotics engineers. And it looks like a very good business considering future electric cars, I am sure about users but skeptical about the profit.

<comment><USER2> If I am not wrong, Sun Mobility manufactures the Reva brand of vehicles of so not surprising.

But, is _battery swapping_ a good business? I doubt it because people balk at the idea of taking stuff on _bhade pe_ , specially if they have a long time use.

I have no doubt on EVs and related business will boom sometime but not in recent future. Even a network for repairing network which allows companies to offload their capacity to service cars will work wonders.

But, obviously as person in IT we have no idea:

a. How to get huge amount of loans like these conglomerates . Look at Reliance they got Jio running with nearly $1.5 billion in debt. Now they are building a battery unit, which again should be financed using debt.

b. How to get into the market

c. How to calculate profit :)</comment></comment></comment>


The Case for Taking a Very Little Bit of LSD Every Day – Mother Jones – Medium - <AUTHOR> https://medium.com/mother-jones/the-case-for-taking-a-very-little-bit-of-lsd-every-day-d74ebb454863#.oqqw61m04 <comment><USER2> This article covers a lot more ground than just LSD... Mental health, antidepressants, PMS, the drug war, etc.

LSD is a very useful anti-serotonin agent. I've been trying a different anti- serotonin chemical and have found it to be quite useful. It's easier to sleep all night, mainly...

<comment><USER3> What do you mean by anti-serotonin agent? One of LSD's (and many other classical psychedelics) primary mechanisms of action is as a serotonin receptor agonist. That means the psychoactive molecules enter the system and essentially behave like "extra" serotonin.

Also, taking it every day would quickly result in no effect. Tolerance builds extremely rapidly to psychedelics like LSD and psilocybin. Allowing at least a week between doses will ensure that tolerance is not a hindrance.

My perspective is that taking sub-psychedelic doses of LSD foster a feeling of having "arrived". There's nowhere else to be, so putting off projects or tasks seems silly; work, even the uncomfortable stuff, becomes more of an engaging puzzle or challenge, and there's a heightened awareness of the body that makes it trivially easy to make good choices (one just really wants to eat that fruit and use the standing desk that day).

Just one psychonaut's $0.02

<comment><USER2> > What do you mean by anti-serotonin agent?

[https://en.wikipedia.org/wiki/Ritanserin](https://en.wikipedia.org/wiki/Ritanserin)

I don't have any experience with LSD or other such substances.

</comment></comment></comment><comment><USER4> I'd like to attest to this idea but with mushsrooms. at sub hallucination doses, mushrooms are like really awesome weed.</comment>


Ask HN: How do you backup your servers? - <AUTHOR>

I do a lot of devops-work for different companies and "agencies", and i have seen a wide range of solutions so far. Unfortunately most of the existing backup solutions were really bad an i realized how less they even cared about it.
So HN: how, what, how often, where and when do YOU backup your servers?
examples:
configfiles, everything at /etc/ is under versioncontrol with git, everytime i make a change i commit and push it to a private server (offside) where every server has its own repo.
database, postgresql, every night at 02:00 a full backup with pgdump, triggered by cron, homebrew backupscript in bash, dump gets scp'ed to another host in a different datacenter, old backups are deleted manually when the disc gets full soon. <comment><USER2> I used to use a homebrew script that implemented rsync/snapshots (that is, rsync data to a directory on another server, then "cp -al" all files to create hard links into a directory called "server-datestamp-weekly" (or daily, monthly, etc).

After running into scaling issues (esp. when needing to find a specific file that I didn't have a date or server name), I wrote (and open-sourced) Snebu. This works effectively like rsync/snapshots, but it stores the file metadata in an sqlite database (so there is very little setup complexity / maintanence), and individual files are stored compressed in a vault directory, named by the SHA1 checksum of the file. This gets cross server file-level deduplication for free. This is somewhat similar to how git stores files.

Just recently posted a 1.0 release, although I need to improve the documentation a bit and post a few more front-end scripts (and finish the in- app help pages). But would love to get some feedback on it.

The site is www.snebu.com if you are interested (this points to the Github- hosted page, the project page is github.com/derekp7/snebu).

For data retention, I keep daily backups for a couple weeks, weekly backups for 6 weeks, monthlys for a year, and yearlys for as long as I have space.

<comment><AUTHOR> great project! so you call snafu still from custom sh-scripts and trigger them by cron?

how do you backup your databases?

<comment><USER2> Actually, it is "snebu", "simple network backup utility", but it does come in handy in case of a snafu...

For database backups, I'm only doing Oracle DBs right now. The procedure there is: 1) Back up all non-database files 2) Put the database in backup mode 3) Backup the .dbf files 4) Take database out of backup mode 5) Force a logfile switch 6) Backup the archive logs (archived redo logs) I'll have to make sure I include a sample Oracle backup script (along with other DBs if I get a chance to) either in the documentation, or in a samples directory.

So one of the features of Snebu is that if you re-use a backup name / serial number (datestamp), it will append those files to the existing backup. As for scheduling the backups, on my backup server I have a cron job that cycles through all the hosts to backup up, and kicks off the client-side backup script via ssh. So: backup-server -> runs master backup script, ssh's to target host target-host -> runs backup.sh, which calls snebu via an ssh command to the backup server

By having the master cron script run from the backup server (or actually any centralized host), you can keep the backups from overlapping each other. Currently, due to the way sqlite handles locking, running backups in parallel can be a bit problematic (although I think I've got most of the concurrency issues resolved, still have to QA my code changes though).

<comment><AUTHOR> oops! VERY unfortunate typo. sorry for that. i think sigmund freud would have its own thoughts on it :-)

i really like your approach, i have very similar setups (backup-master && remote execution via ssh) and put a lot of thought into this topic the last couple of weeks. i think there is way to less love and tools who properly handle backups. everyone runs his own scripts and tools, or buys some extremly expensive and proprietary "stuff".

the whole point behind this thread was to get insight on other peoples system, look at the pros and cons and write a library that fits 90%+ of the use cases.

as you can see by the amount of people, participating in this threat (by now), no one gives a shit. which brings us back to snafu.

thanks for the insights and "snebu" thou!

<comment><USER2> That's ok, you've given me a good tagline -- "Snebu comes in handy when you have a Snafu". As for comment participation, unfortunately unless you luck out and get a few upvotes immediately when you post here, you won't make the first couple pages and no one will see your submission. I had the same issue when I posted a "Show HN" about Snebu, no one saw it. I think the only way to get a submission to be visible is to have a few friends up-vote you right away (about 3 - 5 is all it takes to briefly make it to the front page), then if enough other people like the content it will stick.

</comment></comment></comment></comment></comment><comment><USER3> Chef</comment>


Strange life-forms found deep in a mine point to vast 'underground Galapagos' - <AUTHOR> https://www.nbcnews.com/mach/science/strange-life-forms-found-deep-mine-point-vast-underground-galapagos-ncna1050906 <comment><USER2> >Sherwood Lollar wants to sequence the genes of the Kidd Creek microbes and then do a 23andMe-style analysis to unravel their kinship to other residents of the deep Earth

Why woud a pop science author make free advertisement for 23andMe? genome sequencing and genome ancestry are older than some random company _which does not even do full genome sequencing_ 23andMe only does _genotyping_...

<comment><USER3> Because more people today are probably more familiar with 23andMe so it's simple way of explaining it that people would understand.

<comment><USER2> the mission statement for a pop sci author should be to educate the public, this means _not dumbing down_.

the only avoidable reason it's more familiar to the public is because of all the previous pop sci authors preferring to say 23andMe instead of "genome sequencing" and "genome analysis" etc

if enough pop sci articles stop dumbing down the public would better understand what this is all about...

<comment><USER4> I don't see how that's some kind of horrific simplification...

<comment><USER5> It's an ad, and also kind of like calling making yourself french fries a "McDonald's-style process".

Genetics is both popular-culture topic and part of high school curriculum nowadays, so it doesn't need too hard explaining, and the kind of person that wouldn't understand the explanation probably also doesn't know what 23andMe is (which reinforces this being a sneaky ad).

<comment><USER2> (upvoted but)

also like calling making yourself fries _making yourself "french" fries_ :P

<comment><USER5> Hah, sorry. I was taught that this was the correct universal way of calling this type of food across all varieties of English.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I think it's very likely that life has originated on Earth many times. If it happened once, so early in the age of Earth - it should happen more than once.

But the developed descendants of the first life outcompeted the later ones immediately so we only ever discover life that is related to us.

But if we search where life related to us couldn't go - maybe we'll find completely independent trees of life?

<comment><USER7> Then why isn't there ANY examples of life simpler than a bacterium, which itself is insanely complex? Why does all life share the same genetic and amino acid coding system, a relatively arbitrary choice?

More likely, in all seriousness, that life originated in Mars and came here via panspermia during the early bombardment period. Mars was warm and wet while Earth was still suffering cataclysmic impacts and only relatively mature examples of Martian life (e.g. bacteria) would have survived the trip.

If life originated multiple times on Earth there would be evidence for that. Heck if life originated on Earth there should be evidence for that, which there bizarrely isn't.

<comment><USER8> > _More likely, in all seriousness, that life originated in Mars and came here > via panspermia during the early bombardment period._

I am always surprised at the number of people willing to make assertions like this. Panspermia itself is a hypothesis. Panspermia _from Mars specifically_ is a huge stretch. There is absolutely no basis for claiming that this is _likely_.

> _only relatively mature examples of Martian life (e.g. bacteria) would have > survived the trip._

Why do you make this assumption? Life complexity is not generally correlated with space survivability. At least not positively correlated.

<comment><USER9> "Panspermia itself is a hypothesis. Panspermia from Mars specifically is a huge stretch."

I think "from Mars specifically" is something that requires evidence to treat as likely.

However, I don't think "Earth is the unique place where life originated" should be the default assumption according to Occam's razor. Nothing nearby is anything like Earth on the surface, but it's not speculation that there were billions of years and unimaginably large amounts of volume for life to develop underground in the rest of the universe, where it's warm and sheltered from radiation. The idea that nothing happened until Earth became "Earth-like" isn't the logical default. Naming the contrary of this far-fetched claim "panspermia" doesn't make it a "thing" that needs a "basis". By analogy, I would say that a creationist claim of humanity originating with Adam and Eve is what needs evidence, not the contrary assumption, that all humans had parents.

<comment><USER7> Where else? Venus' habitable period, if it existed, was quite short. It's gravity is also much higher and it is inward in the solar system. Even before it turned into the hell-hole it is now, dynamical models show that it probably sent few rocks our way.

The Moon appears to have formed without the resources to sustain life as we know it. There are great candidates for life in the outer solar system (Europa, Enceladus, Titan), but ejecta from these mostly get eaten up by the giant planets.

The only likely candidates for solar system origin panspermia is Mars, and maybe Ceres. Only Mars (and Earth) had the long wet period with open oceans, geothermal heat sources, plate tectonics, and sizable atmosphere. Mars isn't the only option, but the odds are way, way higher.

At least for life as we know it. But the point of panspermia is that it _would_ be life as we know it ;)

</comment></comment></comment></comment></comment><comment><USER10> Tommy Gold looks increasingly prescient. Refer to his book, "The Deep Hot Biosphere", written nearly twenty years ago. (And check him out on Wikipedia - he also first stated how the ear hears different frequencies and that pulsars are spinning neutron stars.)

These organisms are close to the root of the tree. Photosynthesis came much later.

<comment><USER11> Tom Gold wrote that paper after the discovery of life forms in underwater thermal vents, during that period he was trying to build a theory of non- biological formation of fossils fuels the discovery of life forms living in extreme conditions at extreme depths made him reconsider his stance somewhat but not to abandon it.

His paper was about microbial life feeding on petroleum and so he postulated that it would have to reach several KM in depth at least.

</comment></comment><comment><USER12> I think there is an error/misconception in the first paragraph about this mine being the deepest spot on land ever explored (unless they mean by people physically walking around). To the best of my knowledge the Kola borehole in Russia is much deeper at 12,200 meters.

[https://en.m.wikipedia.org/wiki/Kola_Superdeep_Borehole](https://en.m.wikipedia.org/wiki/Kola_Superdeep_Borehole)

</comment><comment><USER13> Speaking of strange life-forms, the first known fully anaerobic animal, discovered in 2014: [https://en.wikipedia.org/wiki/Spinoloricus_cinziae](https://en.wikipedia.org/wiki/Spinoloricus_cinziae)

<comment><USER6> That is so cool.

</comment></comment><comment><USER14> I'd like to see a plot of "most cells in an organism" vs "average elevation/depth of habitat".

</comment><comment><USER15> Very interesting. This gives us a good idea of what kind of life we might find on a planet without an oxygen rich atmosphere such as ours.

<comment><USER16> Life on Earth developed without oxygen.

The oxygen only appeared 2.4 billion years ago, as a side effect of photosynthesis and the event is sometimes called the "Oxygen Holocaust", since it caused almost all life on Earth to go extinct.

[https://en.wikipedia.org/wiki/Great_Oxidation_Event](https://en.wikipedia.org/wiki/Great_Oxidation_Event)

<comment><USER17> Yeah, that's the really cool thing. Most of the survivors likely live in the deep biosphere, well protected from oxygen. But some also survive on the surface, wherever there are anaerobic environments. Such as in some swamps and sediments, canned food, and far-gone wounds.

</comment></comment></comment><comment><USER18> > "We're finding that we don't really understand the limits to life," Sherwood > Lollar said...

As is often the case:

What we don't know > what we think we know

</comment><comment><USER16> If there is life on Mars, that's where it is!

</comment><comment><USER19> If you are daydreaming about how life started I can recommend 'A New History of Life' by Ward & Kirschvink for getting somewhat up to speed with the science.

tldr: we don't know, and may never know</comment>


Using a Thorough Research Process to Rebuild a Critical Product Feature - <AUTHOR> https://labs.contactually.com/using-a-thorough-research-process-to-rebuild-a-critical-product-feature-cdacf0a014a <comment><USER2> Great read!</comment>


Changing Date to Jan 1, 1970 disables 64-bit iOS devices - <AUTHOR> https://www.reddit.com/r/jailbreak/comments/458ao3/discussion_changing_time_date_settings_to_jan_1/ <comment><USER2> I learned about this yesterday from a Tom Scott video ([https://www.youtube.com/watch?v=MVI87HzfskQ](https://www.youtube.com/watch?v=MVI87HzfskQ)). I find it odd that his sources are suggesting that this is an integer underflow bug. First, while integer underflow itself would be a bug in this case (if it's occurring) the real bug would be not handling large time values. If they are indeed using u64 to store time, the system should be designed to, you know, handle u64. Why would parts of the system break for values like 0xFFFFFFFFFFFFFFFF?

Second, and this is more important, iOS likely is _not_ using u64. It's a BSD derivative, so it's using time_t, which is signed. No underflow involved. It just literally goes negative. And this is far more likely to be the cause of the issue. In POSIX systems, many time fetching functions return -1 as an error code, and I can easily see some programmer doing `if ((t = time(NULL)) < 0) { halt_and_catch_fire(); }` or `while (time(NULL) < 0); // wait for RTC to start up`. That's more likely, in my opinion, than some part of iOS using u64 for time and not handling large values.

The take away? My fellow engineers, please stick with time specific types (like time_t) that are i64 underneath, and please don't return negative values as error codes. Wrap broken functions like `time` into functions that return the time and an error code separately. If you'll recall from those history classes in high school and college, time before 1970 was fairly important (though clearly not as exciting without iPhones), so it's worth representing.

<comment><USER3> I wonder what happens if one sets the iOS clock forward to noon on Jan 19, 2038? (at 03:14:08 UTC on Jan 19 2038 the 32-bit signed time_t flips over).

<comment><USER4> Well, if they use 32bit time_t: Exactly the same is this bug.

If they use 64bit time_t: Nothing unusual for the next 4 billion years or so until the sun explode.

<comment><USER5> Tsch, such obvious planned obsolescence, trying to force us into a mere gigayear scale upgrade cycle.

<comment><USER6> At least after the 128bit switch I know that proton decay will be the next thing I need to worry about.

<comment><USER7> Introducing the iPhone 7. It's the first iPhone specifically engineered to withstand the Sun exploding in 7 billion years' time, and we think you're going to love it.

</comment></comment></comment></comment></comment></comment><comment><USER8> And 4chan (?) already started trolling people with "blast to the past images". At least a bit more clever than waterproofing or microwaving.

[https://twitter.com/Chubzey422/status/698210841078984706](https://twitter.com/Chubzey422/status/698210841078984706)

[https://twitter.com/gabdi_/status/698230041591836672](https://twitter.com/gabdi_/status/698230041591836672)

<comment><USER9> Yep, that was 4chan: [http://i.imgur.com/lPqI1nD.png](http://i.imgur.com/lPqI1nD.png)

</comment></comment><comment><USER10> Not permanently. Some report that it fixes itself after time, but the most widely accepted solution is to let your iPhone battery die. It seems to fix this bug every time.

[https://discussions.apple.com/thread/7458347](https://discussions.apple.com/thread/7458347)

<comment><USER11> I find that more interesting than the bug itself. Why battery dying fixes the issue? Does that reset the time? And if it does, then to what?

<comment><USER12> I fix iPhones. The battery needs to be really, really dead before it'll fix the issue. When a battery is reconnected the internal date is reset back to 0 (Jan 1 1970) until the phone connects to a cellular network/NTP server.

<comment><USER13> Wouldn't that result in the same outcome though? I find it more likely that the clock is reset to a more "sane" time - like Laforet stated as being "well into the 2000s".

<comment><USER14> When I least had an iPod touch, pretty sure it reset to 1/1/07

</comment></comment></comment></comment></comment><comment><USER15> > Theoretically, attackers can send malicious NTP requests to adjust every > iPhone's time settings to January 1, 1970

Just to be clear, this (typically) isn't possible. NTPD refuses to adjust the clock if the time difference is too large. (I don't recall what the default threshold is, but IIRC it's less than 24 hours, certainly less than 46 years.)

This is important for TLS - if an attacker could significantly roll back your system clock, they could trick your browser into accepting an expired certificate. Compromised certificates would be a problem forever, rather than just until they expired.

<comment><USER16> What if you crafted a program that mimicked the functionality of an ntp server, and but it had a built in memory of what times have been given out to network clients? Couldn't you in theory send a series of NTP answers that quickly stepped back the clock of the target system, with the stepback value being whatever the maximum value the ntp client will handle? Answer one subtracts the time by 24 hours, the next by another 24 hours, the next by 24 hours? Is there a limit to how frequently the time can be stepped back?

</comment></comment><comment><USER17> I once had an iPod touch disabled for millions of minutes after entering the wrong password too many times. Turns out the date was reset back, probably because it had died, while the "last pass enter" must have been set forward, and so it was waiting several years to allow another password.

On a similar note, you could get extra tries at the restrictions password by setting the date forward. Don't know if either has been fixed, haven't tried recently.

<comment><USER18> Yep, this was my iPad after I had a broken screen replaced: [http://blog.marksmith.org/too-much-security/](http://blog.marksmith.org/too- much-security/)

I had to reinstall from a backup to enable wifi so it could talk to an ntp server and sort itself out.

<comment><USER19> I'm surprised the default time/date is UNIX epoch + 0. Realistically, it ought to be the date that version of iOS was released.

<comment><USER20> No programmer ever wished for more special cases when integrating date handling code, especially on a networked device and one that's so tightly integrated with other platforms and devices. And imagine the nightmare of testing the device pre-release, all while faking out the dates, both local and on NTP servers and on development desktop machines the under-development devices are tethered to, and somehow knowing exactly when the release day was going to be, possibly years in advance. So... no, I'm not sure about that plan. And I guess the bug would be unaffected in any case.

<comment><USER19> > And imagine the nightmare of testing the device pre-release, all while > faking out the dates

Huh? Why would you set the date to one in the future? Make the date be the one of the build.

</comment></comment></comment></comment></comment><comment><USER21> "bricked", "permanently bricked" seem to be the hardware world's "literally". Throw the words around and contradict yourself simultaneously. Who's keeping track?

<comment><USER22> Not people looking for traffic to their site.

<comment><USER23> lol, nice.

</comment></comment></comment><comment><USER24> I repaired a MacBook Pro which had been powered off for an extended time and couldn't load OS X onto it. Turned out it was using hardware time to determine if a cert was valid when validating the OS X install image. (Validation is done by the downloaded installer so I infer that it was trying to make sure the download was okay and was not trying to prevent third-party OS installs). I fixed it by spawning a shell from the installer and setting the date the unix way -- but what is a mere civilian supposed to do?

<comment><USER25> Still not known or obvious to many, but less cryptic than a terminal to most: reset the NVRAM (aka PRAM). Hold command-option-P-R keys until you hear the startup chime for a second time.

<comment><USER24> Did that. It did not set a date close enough to now to work.

<comment><USER25> Ah, of course not, since how can the default be set to the current time?

I almost always install after booting to a full OS X system on an external hard drive (so NTP syncs the time), either via a downloaded installer or after logging in to the wifi captive portal (since Internet Recovery won't do WPA Enterprise).

<comment><USER24> On Linux and Windows, the NTP update daemon "sanity checks" the new date. It refuses to update the time if the new time is "too far" from the current time. Is the Mac any different on this front?

</comment></comment></comment></comment></comment><comment><USER26> I wish Jobs were alive to respond with something like, "then don't do that-- problem solved."

</comment><comment><USER27> Why does the device allow the user to set the date back before the device was released?

<comment><USER28> Rather than wonder why a device isn't more restrictive to the user, why not wonder why a device has problems with arbitrary dates?

<comment><USER29> I think that we can be more generous to a vendor who didn't test sufficiently for a failure mode that would be a legitimate use only to a (reverse) time traveller who wouldn't be able to connect the device to any network in existence in 1970 anyway. Seriously, people are complaining about problems when they go out of their way to set the date to a bogus value? Some behavior is its own punishment, people!

<comment><USER30> You mean a failure mode that is simply the time server saying "start of epoch, no offset"? There's a ton of ways for an offset to be zeroed by accident.

Hell, two years ago I was setting up logstash, and was wondering why none of my front-end searches were getting loglines. Turns out the front-end was expecting four-digit years and I was saving two-digit years - by widening my search to include the year 14AD (rather than 2014), there were my loglines.

I don't expect a vendor to intelligently handle this error and fix it for me, but I do expect a product not to irrevocably break itself if such an error does crop up.

</comment></comment></comment></comment><comment><USER31> I remember they thought Y2K would pose a challenge and everybody laughed it off afterwards. Could they have ever imagined bugs like these would become prevalent in the future?

<comment><USER4> We (at ring.cx) had a "Y2K" bug on Jan 1. Some old boring code was replaced with more "readable" one and "underflowed" (technically, it did not expect negative values).

Explosion: [https://gist.github.com/Elv13/73ae14074c85974ca952](https://gist.github.com/Elv13/73ae14074c85974ca952)

Fixed: [https://gist.github.com/Elv13/5fc6bb2bba51aeb14f63](https://gist.github.com/Elv13/5fc6bb2bba51aeb14f63)

(LGPLv2+, not designed to be "correct", but close enough so it isn't noticeable.)

</comment></comment><comment><USER32> "Doctor, it hurts when I move my arm like this..."

</comment><comment><USER33> I wonder if instead of it being an integer underflow issue, it has to do with a divide-by-zero issue (if something ever is divided by the entered date).

</comment><comment><USER34> "If it compiles, it ships" seems to be the order of the day at AAPL these days.</comment>


How a group of neighbors created their own Internet service - <AUTHOR> https://arstechnica.com/information-technology/2015/11/how-a-group-of-neighbors-created-their-own-internet-service/ <comment><USER2> I read about this when researching meshnets about a year ago. Along similar lines, Portland has its own meshnet, but I am not sure if the project is still active.

[https://portlandmeshnet.org/](https://portlandmeshnet.org/)

So does Toronto, and some other cities I seem to be forgetting.

I find this idea really enticing, and it is a goal of mine to start a meshnet in my own city. Unfortunately, the subculture here is small and music- oriented, and the techies I know are all about business, and wouldn't be in on a project like this unless they could make significant cash. I have been offered some money to build a startup around this idea, but could find no suitable method for monetizing it that wouldn't sacrifice my ethical values and basic idea. So, one day.

</comment><comment><USER3> What is the point of that Catalyst 2940 switch?

[https://cdn.arstechnica.net/wp- content/uploads/2015/10/dbiua...](https://cdn.arstechnica.net/wp- content/uploads/2015/10/dbiua-switches.jpg)

</comment><comment><USER4> This is nothing but socialist communal action. The owners of the upstream internet service should cut them off.

Shame on arstechnica for reporting on anti-captialist socialist nonsense! Go back to Prague, you pinkos!</comment>


Best cheap office chair for startups? - <AUTHOR>

chairs are important, but expensive. aerons are obvious but too much for a bootstrappin' startup. recommendations? <comment><USER2> Used Aerons on craigslist are the way to go. I'm of the opinion that when you're spending crazy hours in a chair, it's not something you want to skimp on. The extra productivity caused by the difference in comfort level will more than pay for the chair.

Get cheap-ass desks from Ikea or something.

</comment><comment><USER3> I have experimented with those kneeling things that have no back, and to my surprise they seem to work ok. I find it best to swap back and forth between on those and a normal chair.

In general, I find hard straight chairs better than the more common padded office style. I think the periodic shifting and squirming you do keeps your back from setting up in a bad way. Wooden kitchen chairs are cheap to come by if you don't care about matching them, but one disadvantage is that they don't slide around as well.

I am currently using a wooden rocking chair for all my office chair needs. It's easier to slide around (I glued felt strips to the rockers). If I were setting up a new office now, I would get only rocking chairs.

</comment><comment><USER4> The Russell Executive Mesh Chair @ Office Depot for $230 received a good review on cooltools as a inexpensive alternative to the Aeron:

<http://www.kk.org/cooltools/archives/000891.php>

I would take a trip to Office Depot and Staples to see if you can find anything comfortable that meets your needs.

</comment><comment><USER5> What's your budget? How many people are you buying chairs for?

If you're buying chairs for 10 people or less, give everyone a chair budget and then take a field trip to your local office furniture supply. Sometimes giving your employees those kinds of choices tells them that you are interested in their well being more than a 900 dollar chair does.

<comment><USER2> Umm, what? I'll take an Aeron over "here's $200, go to Staples" any day.

</comment></comment><comment><USER6> plenty of people going out of business right now. you may be able to pick up some used aerons.

<comment><USER7> There's always a strong aftermarket for Aeron chairs. Which means they're always available used, and always more expensive that you'd like. But, ~$700 is better than new prices, and an Aeron is a solid choice. There are only a few chairs in the same league and none that are significantly cheaper or as universally available.

</comment></comment><comment><USER8> Optima are okay...</comment>


Revolutionary School Management System in Python - <AUTHOR> https://github.com/schedutron/S-Koo-L <comment><AUTHOR> Built this as my high school project, in Python2. Has a neat SQL-like REPL interface. Supports auto-substitution-teacher assignment among other things. Another neat thing is that this is that there are absolutely zero third-party dependencies. Feel free to contribute as there is a BIG room for add-ons and improvement.</comment>


Dockcross: Cross compiling toolchains in Docker images - <AUTHOR> https://github.com/dockcross/dockcross <comment><USER2> I was recently looking into something like this. It turns out Fedora is a cross compiling (at least for Windows) powerhouse. It has the compilers but _also_ cross-built packages for most standard system libraries (libpng, curl, etc).

This is turning into a random info dump, but whatever.

Azure Pipelines has free Windows workers in their pool, for open source, with all standard Windows build tools, python, etc. I'm not aware of other CI providers with Windows instances.

I wanted to use Guix but wanted to try it out with Docker and there aren't any official packages, ran into a number of issues setting it up manually. Guix has their libraries and build environments abstracted in such a way that it should be possible to build any package with say mingw in a line (or two). Guix also seems to have a stricter versioning system than Nix, where it didn't look trivial to pin specific package/system versions.

Gnome msitools has a Wix clone for Windows MSI creation. It's a bit hobbled (doesn't support a lot of fields/parameters).

<comment><USER3> Appveyor also has free Windows CI for open source projects

</comment></comment><comment><USER4> Quiet nice to have a curated list of compilers available. However I think the pain starts when it comes to compiling libraries and programs, where the buildsystem is not designed to be cross-compiled. In nixpkgs, where have now also cross-compile support, we had to add quiet a few patches and little fixes to some libraries.

<comment> yjftsjthsd-h I hope an effort was made to upstream such patches as well?

</comment></comment><comment><USER5> When I had a need for a Dockered cross-compiler, I found that Gentoo and crossdev [0] were amazing. Because of Gentoo's philosophy of distributing source only, the toolchain was built inside the container, and using fresh versions of each tool.

A few additional steps were involved with setting up an overlay, but it was smooth sailing from there, and people on #gentoo-mips were eager to help.

[0] [https://wiki.gentoo.org/wiki/Cross_build_environment](https://wiki.gentoo.org/wiki/Cross_build_environment)

</comment><comment><USER6> For a single image approach and osx support, see: [https://github.com/multiarch/crossbuild](https://github.com/multiarch/crossbuild)

</comment><comment><USER7> To use this for anything serious, you have to know exactly how these images are built. In fact, you should just build them all from the source yourself. Consequences of using unvetted compilers/toolchain are severe, and pulling build tools from Docker Hub is something you should often try to avoid.

I like the idea in practice. Assuming you're already on a cross-compiled project, this could vastly make your job easier and you can script around this very easily.

</comment><comment><USER8> Tangential question, is there a canonical way to build cross-platform docker images without using docker hub? For example, armhf on an x86. I've seen some stuff from Balena, but nothing that looks particularly straight forward.

Unless I misunderstand, docker cross is simply for cross compiling apps.

I've been experimenting a lot with embedded boards and compiling a couple of large libraries on a Pi can take all night.

<comment><USER9> Yes, I don't know if this is the canonical way but you can use QEMU to build them [0].

[0] [https://servicelab.org/2018/09/13/platform-aware-docker- imag...](https://servicelab.org/2018/09/13/platform-aware-docker-images/)

</comment></comment><comment><USER10> If you need to do cross-compiling but not enough to do it in docker containers, ct-ng (crosstools-ng) is awesome.

It is kinda self-hosting in the sense that you unpack its release in a directory and all its files are going to stay there, including the cross- toolchain that you build.

And, of course, it can automatically build toolchains for a wide range of architectures, all while being fairly configurable.

</comment><comment><USER11> My dream is to compile windows UI applications from Docker while staying on a Linux host

<comment><USER12> You can certainly achieve this by installing MinGW cross compilers in a Docker image. Many major distros have MinGW packages, and some CI setups use exactly this setup.

(For good measure, an example would be OpenRCT2 which maintains Dockerfiles for cross compiling, like this one: [https://github.com/OpenRCT2/OpenRCT2/blob/develop/dockerfile...](https://github.com/OpenRCT2/OpenRCT2/blob/develop/dockerfiles/mingw/Dockerfile) )

</comment></comment><comment><USER13> Doing god's own work.</comment>


Modals in React - <AUTHOR> http://reactjsnews.com/modals-in-react/ <comment><USER2> A bit off topic, but after studying React js and loving it I also started studying Flux. I found that the intros were a bit confusing, and needed to write a "visual cheatsheet" for my team (if interested you can find it here: [http://danmaz74.me/2015/07/27/flux-architecture-visual- cheat...](http://danmaz74.me/2015/07/27/flux-architecture-visual-cheatsheet/) )

TL;DR for the React/Flux team if you read this: please update the Todo tutorial!

<comment><USER3> I agree. I've been using react with reflux, reflux is an excellent implementation of the flux model. It makes it simple to wire global modals into actions which can trigger those from anywhere in the app.

Also more on topic, I really like the material-ui project, and it's modals are quite nice.

<comment><USER4> For the reference [http://material- ui.com/#/components/dialog](http://material-ui.com/#/components/dialog)

</comment></comment></comment><comment><USER5> I'm surprised at how many of these use props- or even methods- to show/hide the overlay rather than simply not rendering the <Overlay> component.

This article is really shallow so I'd just like to suggest you look at the code for the Rackt modal- it takes the children you pass it and renders them in a new React container, a pattern it calls a "portal". That sidesteps all of the issues with rendering a modal in the middle of your markup (CSS cascading mainly). I thought that was really clever when I saw it.

</comment><comment><USER6> My first thought was: why are you helping people build the one of the worst UI components out there?

Not sure where it should fit in the current UI? Oh just throw it in a modal, restricting the user's ability to interact with anything else on the page, requiring an extra click to close the modal.

I'm sure there are good times to use them, but typically I find they are restrictive.

<comment><USER7> Modals have always had a place on native apps, and they similarly have a place in web apps. If you're working on something in a single page app, you shouldn't be taken away from it just to open some settings.

<comment><USER8> It is extremely rare that you actually need to block the UI. Most uses of modals would be better served with local notification that respects fitt's law. An example would be popping up a "confirmation tooltip" adjacent to a delete button that was just pressed. The subsequent required mouse movement will be a short travel away. A modal in the middle of the screen moves the locus of focus, is jarring and blocks the UI.

Simply put, blocking the UI is hostile.

</comment></comment></comment><comment><USER9> Here is our React/Bootstrap modal component:

[https://github.com/gitboard/gitboard/blob/master/src/js/comp...](https://github.com/gitboard/gitboard/blob/master/src/js/components/generic/modal.jsx)

Initially we used a 3rd party component but we finally wrote this much simpler version. It uses only React state variables to show/hide the modal and does not require any jQuery or Bootstrap JS to work (both of which can cause problems when mixing them with React). Feel free to reuse this code, the whole repository (Gitboard) is currently licensed under AGPL but we would be happy to provide e.g. an MIT license for the components or even make it public domain (as this is hardly more than a code snippet).

<comment><AUTHOR> Hey, creator of ReactJSNews here. Feel free to add it to the post and send a pull request! [https://github.com/Legitcode/ReactJSNews/blob/master/posts/2...](https://github.com/Legitcode/ReactJSNews/blob/master/posts/2015-07-29-modals- in-react.md) Anyone is welcome to write a post on the site!

<comment><USER9> Cool, will do that!

</comment></comment></comment><comment><USER10> If you want one that doesn't leave DOM lingering when closed, look for one that uses this or the same approach:

[https://github.com/tajo/react-portal](https://github.com/tajo/react-portal)

</comment><comment><USER11> Slightly off topic, but is there an AngularJS equivalent of Elemental UI? I also find myself using the same CSS and libraries over and over again, and effectively spending too much time tweaking basic forms etc.

<comment><USER12> There is angular-strap and angular-ui for bootstrap based sites

</comment></comment><comment><USER13> Nothing about routes in the article. I know how to do it with React-Route, but I was hoping it would show other people.

Getting tired of modals (especially for login/signup) that doesn't have a route to it.

<comment><USER14> I feel the opposite - I don't understand why a modal should have a route most of the time. It seems clunky and usually should not be a part of browser history.

<comment><USER13> Login and Signup for instance so you can send a link to a friend so they don't have to find the buttons on their tiny phones.

Settings, so you can send it to your parents so they can fix that shitty notification spam they got going, etc.

That's just my take on it.

</comment></comment></comment><comment><USER15> The problem I still have with the modals is the scrolling behavior. Aside from taking over the scroll event, which I do Not want to do, it seems if I want a modal to scroll without the background scrolling, the only way is to put a 'overflow: hidden' on the body tag. Anybody have a more clever way of doing this?

<comment><USER16> What's wrong with that CSS?

<comment><USER5> For one thing it hides the scrollbar which in some browsers causes the whole page to shift by a number of pixels. It's not the worst thing but it's a little bit distracting. My QA people recently sent me a bug that was basically this issue.

<comment><USER17> Exactly, and you can't simply set a left margin because the scrollbar width is different in every OS. This is what bootstrap does: [https://github.com/twbs/bootstrap/blob/83bfff7f0765503b990b9...](https://github.com/twbs/bootstrap/blob/83bfff7f0765503b990b96c303eef67009e48d77/js/modal.js#L277)

</comment></comment></comment></comment><comment><USER18> Just use polymer components and call it a day.

<comment><USER17> How a polymer component would be better than a react component?</comment></comment>


Wild gorillas compose songs that they hum during meals - <AUTHOR> https://www.newscientist.com/article/2078781-wild-gorillas-compose-happy-songs-that-they-hum-during-meals/ <comment><USER2> I've always hypothesized that humming while eatting (or saying "Mmmmm") is the perfect pitch to vibrate the hummer's tounge, which makes the flavors experienced more pronounced.

It would explain why we say "Mmmmm" not something higher pitched. Plus you can feel your tounge moving when you say "Mmmmm".

Any thoughts?

<comment><USER3> "m" is a consonant. What does it mean to assign it a pitch?

<comment><USER4> "m" is a nasal sonorant. It's assigned a pitch the same way nasal and oral vowels are- based on the positions of its major formants.

Or, less technically, when someone successfully hums a non-monotone tune- you have just heard what it means for them to assign a series of differing pitches to "m".

</comment></comment></comment><comment><USER5> Can anybody really hear anything in those samples? They seem random noise.

</comment><comment><USER6> I couldn't hear anything.

</comment><comment><USER7> More samples would be cool.

</comment><comment><USER3> The word "happy" is in the title but has no support in the article.

<comment><USER8> Ok, we replaced "happy songs" with "songs".

HN readers are like sandpaper for titles.

</comment></comment><comment><USER9> The Ku Pteleopsis Hylodendron Humming sounded like C D F D D to me. Very deep, possibly octave below left-most C on a piano, but for those saying it's just noise I'd say there's some signal there.

The Bal Gilbertiodendron Dewevrei Singing clip I can't pick anything out. Bit too quiet to tell.

</comment><comment><USER10> Programmers also do that. This is somehow linked to survival in the long run.

</comment><comment><USER11> > The other was singing – a series of short, differently pitched notes that > sounds a little like someone humming a random melody (listen to clip below).

> "They don't sing the same song over and over," says Luef. "It seems like > they are composing their little food songs."

Right. A "random melody". Also known as "random noise".

<comment><USER12> Is it so implausible that these creatures who have displayed startling emotional depth (Koko and her pet cat, anyone?) might also display musicality?

Why are we so quick to dismiss the notion that anything not human might do something creative, like hum a happy little tune to itself?

Oh, no. That's just "random _noise_ ".

<comment><USER13> The grandparent might be specifically talking about the sound clips from the article. They don't sound melodic, let alone musical (at least to my human ears).

<comment><USER14> I believe it's more of a semantic thing. A melody is inherently non-random. "Random melody" is nearly oxymoronic.

<comment><USER15> I think it's fair to call a non-repeating sequence of randomly selected, sufficiently tonal notes, on a familiar scale, in the right frequency range, a melody. So I don't think it's fair to say a melody is inherently non-random. I'd say that there only needs to be a sequence of sounds identifiable as individual notes, with a sufficiently dominant pitch as to sound tonal.

<comment><USER14> As someone who has composed aleatoric music and had many discussions with people who have devoted their lives to generative music, I have to say it's debatable whether what you described can strictly be called a "melody" unless you take the broadest dictionary definition ('a pleasing sequence of notes'), though I do think you can call it "melodic" as in 'melody-ish'. In other words, I think there's an essential difference between melody as conceived prior to the advent of generative music, which implies a decision by the composer that ' _this_ is the melody', and a 'random melody' where that decision is made in a different manner, i.e. "whatever this process produces is 'the melody'". In the case of a randomly generated score, it gets a bit confusing because it's not clear if the composer used a generative process to determine 'the melody' or if it can meaningfully be called 'random'. Ultimately we just don't have words for such things. Perhaps conveniently, generative music still plays a very minor role in music culture outside of i.e. some of Brian Eno's recent work and the enduring influence of John Cage.

<comment><USER16> Aren't you then saying that melody-ness is being conferred by the composer? That would make it extremely difficult to confirm that something is a melody or not by observation alone (and thus likely impossible when determining whether other apes can come up with melodies).

That said, I think the article is not using "random" in the literal sense but in the sense of "arbitrary", as in "novel" (rather than being simply a reiteration of a previously observed tune).

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> as if they would know the words..

</comment><comment><USER18> As usual, the SoundCloud comments crack me up :') ... Such gems as:

> nice drop > When is the next one coming out? > love the 808s [drum kit]

<comment><USER19> "needs more cowbell"</comment></comment>


The C256 Foenix Project - <AUTHOR> https://c256foenix.com/ <comment><USER2> I've been working on an emulator for this machine, here:

[https://github.com/rdaum/c256emu](https://github.com/rdaum/c256emu)

Cycle accurate 65816, with full debugger. Emulates the video hardware including sprites, tiles, and VDMA (blittery), math copro, keyboard, mouse, and some of the SD card functionality.

</comment><comment><USER3> Fantastic project, fantastic vision and its humbling to see all that work, where do people find the time ?

</comment><comment><USER4> That circuit board is a work of art. I want to buy one and frame it.

</comment><comment><USER5> Why so many fpgas? You can layout the complete amiga hardware, processor and all the custom chips on one fpga. Will we be able to write our own hardware images onto the chips?

<comment><USER2> I believe (can't speak for her, really, but) this has to do with basically treating the FPGAs as if they were custom ASICs, 80s/90s style.

Yes, you could do everything she has on one FPGA. But would that be fun?

</comment></comment><comment><USER6> Thread from last year: [https://news.ycombinator.com/item?id=17279470](https://news.ycombinator.com/item?id=17279470)

<comment><USER2> Lots has changed since then. She has made considerable progress. Rev C boards shipping for early adopters this summer. You can order a board now.

</comment></comment><comment><USER7> A good project. Problem is where is the software? What does it run C64 C128 Apple IIgs software?

<comment><USER2> This is all being worked on. Someone is writing a BASIC, others are building OS-type stuff. I've been fiddling around with OS and language type stuff.

It's its own platform. It's not like there's much from those old machines that'd be all that fun to run these days anyways. The only thing I'd want from the IIgs would be the excellent ORCA series compilers.

65816 is a challenging platform due to lack of higher level language tools, and the oddities of the ISA (switching back and forth between 8 and 16 bit register modes, etc.) but this could be surmountable with contributions. Several people including myself have attempted a LLVM backend for 65816, but nobody has finished it. Sure would be easier with the assistance of someone who was an LLVM expert.

<comment><USER8> It would be fun if Flight Simulator II could be made to run.

1 fps on original C64:

[https://www.youtube.com/watch?v=0HWzJMFeQv8](https://www.youtube.com/watch?v=0HWzJMFeQv8)

Much faster on 65816 CPU. (But video footage from an 8-bit Atari modded to use the 65816 CPU.)

[https://www.youtube.com/watch?v=yLGchhLGAE0](https://www.youtube.com/watch?v=yLGchhLGAE0)

<comment><USER2> Probably not easy to port without original sources, and even then, probably difficult.

It would probably be faster on c256, as there is a math coprocessor for mul/div.

</comment></comment></comment></comment><comment><USER9> Is there tutorial or something on how to write new software for this?

<comment><USER2> It's still early days, OS, etc. and tools, etc. still in early stages. But if you contribute, you could help write that guide :-)</comment></comment>


Problems in QA - <AUTHOR> I'm currently researching the current problems/good things about Quality Assurance. I worked myself as a QA-engineer myself and I'm now a fulltime developer. I tried to scope this to web development for now.
This is what I currently came up with.
The good:
- Software gets tested, before launch. In most cases by one or multiple people.
- There are automated test frameworks.
- We have requirement documents/ways to describe on how something has to work.
- We have test reporting tools, that can provide statistics on tests.
Based on these things we can already have a fairly well tested website, although there are still some problems, that arise with this.
The bad:
- Cycles are too slow: When doing SCRUM, some features cannot be fully tested yet. Definition of Done is endangered.
- Stuff is only partially available: the feature has been split up in to smaller things to fit into a sprint.
- Communication with developers can sometimes be annoying, some take it personally and get mad at the QA person.
- Testing a full flow can be annoying, if it involves multiple platforms. Example: A user does a signup, receives a verification code via a text message and proceeds in the flow.
- Automated testing can be a challenge. Lots of testers aren't programmers.
- Having enough unique test data. Trying to come up with ways to restart an automated test. AKA: How to delete data that's already in the website if a test fails. Without manual intervention.
The reason why I try to sum this up, is that I've got the feeling that at my current job, QA has lots of problems with these things. I wanted to ask if the people over here had any similar experiences? <comment><USER2> If you want to know why you had problems with QA in Scrum, I would suggest to read this: [https://dusted.codes/death-of-a-qa-in- scrum](https://dusted.codes/death-of-a-qa-in-scrum)

<comment><AUTHOR> I read the article, and it indeed addresses the issues that I'm currently facing. Although that the comments also mention about QA testers without development experience, which can be a good thing. How to fit these people into scrum?</comment></comment>


Ad-hoc Video App videmic – Beta testers wanted - <AUTHOR> https://www.videmic.de/en/EarlyBird <comment><AUTHOR> videmic is an ad-hoc video app enabling you to record, watch, and share videos everywhere and instantly with your friends and other people in your proximity from smartphone to smartphone. Without cellular, without wi-fi, and without any server. The beta version of the app is available for a closed group in the Google Play Store. As a beta tester you have to register yourself on our website with your e-mail address as Early Bird User. Within 24 hours later you will receive a link to the Google Play store, from where you can download the app videmic. We look forward to lots of feedback. Thank you for your support. Please note : The app only runs on Android 4.4 and later versions.</comment>


Replication of Big Bang reveals flaws in theory of atom formation - <AUTHOR> http://arstechnica.com/science/2016/08/replication-of-big-bang-reveals-flaws-in-theory-of-atom-formation/ <comment><USER2> Lithium! _shakes fist_</comment>


Semantic Scholar Adds Neuroscience Papers - <AUTHOR> https://www.engadget.com/2016/11/11/semantic-scholar-search-engine-ai-research-papers-neuroscience/ <comment><USER2> I just hope they don't dilute it. I regularly use arxiv-sanity.com and I like it because there are only ML papers, not mixed with various other fields, like on the regular arxiv.org site. They should make it easy to restrict the catalog to a desired field.</comment>


Spectre Mitigations Part 2 - <AUTHOR> https://www.wasmjit.org/blog/spectre-mitigations-part-2.html <comment><USER2> I've asked this before, but I'm going to ask it again (sorry for the repetition).

What makes this sandbox different from previous sandboxes (JVM, browsers, etc) that makes proponents sufficiently confident to put it in the kernel? All previous sandboxed designed to be secure have been broken on a regular basis.

The rationale seems to be performance, as if it is an innovation to realize that having multiple isolated processes and privilege levels has a cost, and things could be faster without context switches or virtual memory. But everyone knows this already - the real innovation is daring to trust your sandbox so much that you think you can do without process isolation.

Sorry to keep asking, but it strikes me as irresponsible to bash on context switching as having poor performance and not noting that it is really one of the foundations of computer security.

First time I asked: [https://news.ycombinator.com/item?id=18406623](https://news.ycombinator.com/item?id=18406623)

<comment><USER3> What attack scenarios you are envisioning here? If the host is only running this software (e.g. a single purpose server, firewall, etc.), the security benefits of process isolation are reduced.

Clearly if you are trying to run hostile software from multiple vendors on the same box (e.g. a browser), you want more sandboxes.

<comment><USER2> I see a future where the npm-style ecosystem develops with the JIT running inside the kernel, so you end up running a "trusted" application ends up running a whole lot of untrusted code via dependencies. Usually process isolation gives you some limit on how much damage something like that can do.

Also, if you are 100% sure that the code in it is trusted, then there really is no reason to sandbox it, right? If the intent is to only run trusted code, why is this article about spectre mitigations?

<comment><USER4> > if you are 100% sure that the code in it is trusted, then there really is no > reason to sandbox it, right? If the intent is to only run trusted code,

Trusted code can have bugs; sandboxing, in a sense, is always useful (not always beneficial)

</comment></comment></comment></comment><comment><USER5> Do _not_ run untrusted code in the kernel. Period. Double period. Triple period.

Speculative vulnerabilities and side channels are a lot more than just variant 1 and 2.

WasmJIT is a nice project. But let me repeat. Do not put it in the kernel and run untrusted code through it, period. Software mitigations are _not_ sufficient. This is not WASM's fault, this is not WasmJIT's fault; it's just a fundamental reality of modern hardware.

<comment><USER6> What if the sandbox completely denies any method of timing to the untrusted code? Including thread to thread communication.

Timing related side channels seem unavoidable, but that doesn't mean that answer in -> answer out computation is necessarily intrinsically able to perform it.

Also, if you can trust code to not be malicious, but not to be correct, loading code via WASM and executing it in the same address space isn't necessarily crazy.

<comment><USER5> > What if the sandbox completely denies any method of timing to the untrusted > code? Including thread to thread communication.

You can construct timers from shared mutable memory (think: counter thread), but even in shared-nothing systems, one can construct timers using message passing (think: a crude timer that counts messages in one process and a sender hammering it with messages).

> Also, if you can trust code to not be malicious, but not to be correct, > loading code via WASM and executing it in the same address space isn't > necessarily crazy.

Sure, agreed. This is why my comment mentioned _untrusted_ code. WebAssembly sandboxing makes sense to protect the kernel from OOB writes, but it cannot guarantee no OOB reads from speculative side-channels.</comment></comment></comment>