FBI overstated forensic hair matches in nearly all trials before 2000 - <AUTHOR> http://www.washingtonpost.com/local/crime/fbi-overstated-forensic-hair-matches-in-nearly-all-criminal-trials-for-decades/2015/04/18/39c8d8c6-e515-11e4-b510-962fcfabc310_story.html <comment><USER2> A few years ago I remember reading reports of the FBI forensic labs doing much worse-- taking evidence from the crime scene and contaminating evidence taken from the accused with it so that it would produce a "match" and the like. It was a big scandal.

In fact over the past 20 years I've heard this story at least a dozen times-- where crime "labs" at different levels of government and in different states (eg: state labs, federal lagbs, etc) were caught doing this.

And when it happens, that isn't enough to get people to be able to appeal unless they have evidence the lab did it in their specific case.

One of the problems of our system is that the criminal system is lacks checks and balances. The judges, prosecutors, police all work for the government. They all have the same interests-- they all report to people who want to look "tough on crime".

Since the police immediately take over crime scenes and collect the evidence and then get the evidence analyzed, they have a lot of power to be corrupt in the interest of more convictions-- and the consequences are negligible for being caught.

Whose going to try a dirty cop? You can shoot a guy in the back on video and never get put on trial for it in this country. (I left Texas when a cop gunned down an unarmed black kid who was on his knees crawling away from him... shooting him multiple times in the back... on my college campus. The cop lost his job and then joined the police force in a suburb. No charges were filed. Apparently a black kid crawling away was "threatening" to the white cop. Alas, I moved to a liberal state and was then myself the victim state corruption- though fortunately, the damage was only $3k to a lawyer.)

This is why I think any evidence submitted in court needs to come from an independant lab, done in a double blind way, and with several audit cases sent to that lab regularly (eg: taking dna from people not involved in crimes and send it in as if it was part of an investigation and see if they are fabricating evidence.)

The idea that the government is independant and objective is to me, now that I'm older and have seen these scandals over the years, laughable.

Every time it happens everyone acts like its' a rare thing.

It's not.

<comment><USER3> I think, the problem is similar to the trouble we have with judges in our country. One judge recently said something that really put a very shady light on many of his colleagues. I regret, that I don't remember it exactly, what he said.

The trouble in my opinion with some judges in my country and with the police in some countries is, that everybody just assumes, that because they work for law enforcement, they have a high level of integrity. But when you look how they are educated, the subject "integrity" is not even touched (I even don't think, that it is taught in law schools).

In my country, when somebody is already a judge, there is nearly no chance at all, that this person will be held accountable for misjudging. I think, not even the highest courts can replace a judge that repeatedly and knowingly is bending the law. At least I don't know of any case at all where a judge was punished or even replaced. And don't think, that all judgments are correct in my country.

In my opinion, when there is one thing to be learned from history, it is that any person can err and even the best meaning persons can change into dictators over time depending on situations.

<comment><USER2> Yes, and having travelled extensively and lived in Mexico and Chile, my experience tells me that while the USA has failed to have adequate checks and balances, other countries often have even less. I loved both of those countries, but I wouldn't really feel safe in Mexico, and I didn't feel fully safe in Chile. I think the Carabineros of chile are taught integrity and are mostly above reproach, however, and so I hold Chile out as a good example of doing it right. But even still, none of these countries have enough checks and balances.

I think the problem is there's a magical thing that happens to people when they think about government.

They somehow think it's ok for government to do things that individuals cannot. And once you give a group of people that magical power, it's easy to forget that they are people.

<comment><USER3> When I was younger, I thought that the western countries (US and Western Europe) are better (off) than other countries like South America or Asia, because they have much less corruption than those countries.

Today I am differentiating much more and I must admit that I am not knowing, why we are better of as for example South American countries. Of course, they have a high level of corruption, but when you look deeper, you will see, that we in Europe have also much corruption. The main difference: While in many South America countries everybody knows about the corruption, for example in Germany corruption is much much more covered -- but it exists, maybe even in the same degree as in South American countries. It is just covered much more. What makes me worry is, that while the normal police-men in Germany may have integrity, the normal top-politician seems to have none left. I can give no name of a top politician today, where I would assume, that he is not influenced or even bribed by some groups.

I think, that this gives a really bad signal to all the people in this nation. Many say: "Why should I pay taxes, for those crooked people?" And I must admit, that this is a strong argument in these times.

<comment><USER4> I think there is a big slice of perspective you're missing here.

Yes, at the higher levels of power everything is dirty.

However, you have to look at what the consequences of that are, how it manifests in a society, and how far it spreads.

And in Germany, it works pretty well. Yes, enormous government projects don't always go to the most capable or efficient. Yes, big business owners contribute to politicians, avoid taxes, and erect legal obstacles to competition that would benefit society. However, the society basically works. The corruption is not interfering with basic services to the people. A journalist can write what she wants without fear of physical reprisal. Individual property rights are by-and-large respected. School teachers actually benefit the children. Police officers don't operate as a tax force on their own behalf. Thats not the case in every country.

So while I agree with you that even the 'best' countries still have a very real battle to maintain integrity, there is absolutely a spectrum and largely, North America and Western Europe are near the top of it.

<comment><USER5> I think North America is corrupt beyond any help. Look at the deep state they do horrible things and no one cares. And there is no freedom of expression, even as i write this im afraid. The cia infects people with sifilis has torture concentration camps all over the world where they imprision people without a trial and inflict upon them all kinds of sick and perverted tortures. They traffic drugs and control criminal organizations in sveral countries, they are the top dogs in the underworld. They persecute journalists they hire some to decieve the public. They are really toxic and deceithfull. Not to mention the wars they go in foreign countries and kill thousands if not millions and destroy any trace of civilization. They a destructive force. =(

</comment></comment></comment></comment></comment></comment><comment><USER6> How does this not get all FBI testimony thrown out by judges? If there is an organisation who pays its employees to lie in court, and they are known to suffer no ill consequences for lying, all of those employees' testimony should be considered worthless.

<comment><USER7> I fear that even with this gross miscarriage of justice over decades, people may not be granted a retrial. It's the entire reason the Innocence Project exists.

[http://www.innocenceproject.org/free-innocent/improve-the- la...](http://www.innocenceproject.org/free-innocent/improve-the-law/fact- sheets/access-to-post-conviction-dna-testing)

I've never understood how the possibility of new evidence doesn't immediately reopen a case (in general). I thought we wanted real, actual, blind justice based only on facts and absolutely nothing else. It turns out it is rarely that simple.

<comment><USER2> All people have an agenda. Their agenda generally favors themselves in some way or another.

We, as the potential victims of injustice want a real, actual, scientific, blind justice system that presumes innocence and requires proof beyond a reasonable doubt, checked by a jury that can nullify laws, and the like.

Politicians want to be "tough on crime" so they appoint judges and prosecutors who get convictions. Judges want to be re-elected because they are "tough on crime" (in places where judges are elected) Prosecutors want to have a successful career so they will do anything they can get away with to get a conviction. The police want to have the case be off their hands and to be "closed" so that their stats look good because it's good for their career because the Mayor wants to be "tough on crime" and so the police find the first plausible suspect and try to build a case.

All these organizations are in cahoots, literally, and so no prosecutor is going to indict a judge or cop unless they absolutely have to.

So long as the public can be lead to believe they live in a society with the "rule of law" not the "rule of man" then nothing more needs to be done. And the public is very gullible! (Especially when you control the schools and you raise them to be gullible.)

IT's not that these people are evil. ITs that they are self interested.

The founding fathers attempted to put in checks and balances and they did a damn good job.

But over the past 200 years, they have been systematically eroded.

<comment><USER8> But there are far more potential victims of injustice than politicians, judges etc. Since we're talking about a democracy here, it should be possible for this majority to create an environment where the selfish interests of politicians and judges align with the need to protect innocents. Yet this same democracy creates an environment where protecting innocents puts officials at a disadvantage.

Things are clearly very backwards.

</comment></comment></comment></comment><comment><USER9> I'm constantly amazed at how terrible criminal forensic science seems to be. Everything except DNA matching appears to be no better than voodoo, and even the DNA stuff is tricky. Is there something about this particular field that attracts charlatans and incompetents? Is it purely a motivational problem, wherein the people who pay for these results are more interested in a conviction and don't care if it's right?

<comment><USER10> I've worked a bit on fingerprint recognition devices (using various vendor SDKs) and people clearly overestimate the accuracy of these kind of devices. The majority can be fooled with a fingerprint made by melting gummy bear with some tape to gather the fingerprint. Creating fake fingerprints is really easy and cheap. I'm also not mentioning the crappy firmware these devices are generally equipped with, everything close to metal seems to have really low quality firmwares, most of the time, you need to compensate on your side for some unfixable problems in the firmware.

The main problem is TV I guess, for the average guy, these kind of technologies are completely infallible and people tend to forget that just like anything else, it's just an indicator that can be fooled / misinterpreted / badly gathered.

<comment><USER11> Yes it's a bit tinfoil-hat but when you look at shows like CSI and 24, you couldn't imagine a better propaganda campaign that "evidence is infallible and torture is OK".

<comment><USER12> I've been of the opinion that shows of that nature are a pretty transparent attempt at gas lighting the populous into feeling as though such behaviors and practices are acceptable, desirable & necessary.

I'll go polish my tinfoil hat now.

</comment></comment></comment></comment><comment><USER13> The fact that the matching process is not double-blind indicates that it is _designed_ to be corrupt.

<comment><USER14> Not being double-blind makes it cheaper. Hence takes less budget, lower taxes, everybody cheers.

Anybody proposing to make it double-blind is going to need to find the money, either from other departments or by raising taxes. Without a chorus of public support behind them, this is a very hard sell. And easily reversed after the next election.

</comment></comment><comment><USER15> They really oughta have a "blind" approach to testing forensic evidence where samples are prepared by other forensic professionals to be sufficiently similar but not matches and real matches, neither of which are from a real trial. The forensic examiners should never know when they have evidence from a real trial.

<comment><USER16> Just call it a variation of the well-known "line up" that everybody already understands.

</comment></comment><comment><USER17> Legal arguments, like most things in life, reward narrative over truth. "Truth" is an unbelievably high bar to pass – even basic ideas like confidence level are beyond the understanding of the legal system.

"Beyond a reasonable doubt" is actually a decent epistemic standard. The problem is that juries and judges are not exposed to the information that would lead to reasonable doubt in these cases.

So basic epistemology already makes bad outcomes likely. Add the incentives (political, organizational) in cases like these, and terrible things happen.

<comment><USER18> The problem is the incentives go to one side (winning the case) without a counterbalance incentive (being not punished for misconduct). If police misconduct such as perjury and fraud routinely led to grave consequences for the person doing it, the balance of the incentives would be closer to what it needs to be. But the Blue Wall[1] and general reluctance of the justice system to punish their own, prevents it from happening. Even when the fraud is discovered, the perpetrators frequently are not sanctioned in any way, the worst that happens is that convictions get thrown out, but that does not create counter-incentive. Thus, no balance.

[1] [https://en.wikipedia.org/wiki/Blue_wall_of_silence](https://en.wikipedia.org/wiki/Blue_wall_of_silence)

</comment></comment><comment><USER19> Again we see that our law enforcement branch is overreaching, acting in error, and effectively breaking the law. What penalty is appropriate for this? How do we rebuild our country to stop this? I believe the answer is to hold the perpetrators responsible. Easy to say, but we need financial and jail times far beyond the pain these people cause. We need to root out this corruption, whether it's intentional or negligent.

<comment> o0-0o I posit white collar crime should carry more severe penalties than blue collar crime.

<comment><USER20> This is an interesting perspective with which I am currently inclined to disagree. Could you provide more rationale to justify the idea that nonviolent crimes should be punished more severely than violent crimes?

<comment><USER21> I'm not that poster, but people with more power should be held to account more strictly for abusing it. While there are noteworthy exceptions, violent crimes are (generally speaking) low-leverage crimes that rarely impact more than a handful of people, whereas the ramifications of even something as "non- violent" as this sort of fraud can be significantly more harmful to much bigger groups of people.

(I am also of the opinion that corporate protections are largely bullshit and that executives and boards should be civilly and criminally liable for wrongdoings perpetuated by their companies. Probably the only way to make them act decently.)

<comment><USER18> These things are very hard to compare. If one steals $10 from every person in the US, he stole 3 bln. dollars. That's huge. However, mostly nobody's life has been seriously, permanently and unrecoverably affected - at least excepting some really untypical random occurrences. If one robs one family of all their possessions, or causes one person be permanently disabled, or dead, that is very grave permanent and unreparable consequences, even though it is for one or few persons only. Humanist morals dictates the latter is worse than the former, so should be punished harder. Of course, in real cases it all gets mixed and unclear, especially when also question of intent comes into discussion.

<comment><USER22> You're really sweeping under the rug a lot of people who would be impacted by having $10 taken away.

I am certain >0 people would have checks bounce, payments declined, fees imposed on them. For many people $10 can be the difference between being able to afford rent, payment of utilities or other items that could cascade into affecting their life significantly. The poor are really susceptible to these type of accidents

Also, about 60 million of the US population are below the age of 14 (which given you got 3 bln dollars from $10, I'm assuming you're taking the whole ~318 million population), that means many minors just lost $10 that to them would likely be more money than they ever had or be a significant amount of money.

And that doesn't even go into other aspects of the theft, like the effects nationwide on everyone having money taken away from them. The erosion of confidence in the safety of their money.

I posit to you a likely scenario of what you described. Imagine if everyone citizen in the US were issued a government mandated ID with an associated federally insured bank account. Now, the whole scenario becomes viable, where a hacker could steal $10 from every citizen in the U.S.

Now, that would first create a huge debacle. It would most likely cause an immediate loss of trust in the online marketplace, cost probably billions of dollars in getting it fixed. It would end many people's careers, most likely lead to companies getting fined, economic stagnation depending on a cascade effect from a loss of confidence in markets. It's hardly a victimless crime.

Sure, we could keep diminishing the amount to something ridiculous till we're maybe talking about stealing 1 cent. Which would still be a fairly juicy pay off of 3 million, and that would erase away many of my points or at least reduce their incidence significantly. I'm sure some people would miss payments or have other inconveniences affect them. Likewise, the theft would have repercussions on many people's lives.

Even if I were to take the magical scenario of someone who magically made 1 cent disappear from everyone's wallet/bank account. That would still cause great impact and damage. "Are there more people like him with such magical powers?"

I guess what I'm trying to say is that you have to look at the final magnitude not just the token value of the damage done per capita. And also look at the damage done by having affected so many people simultaneously.

<comment><USER18> I think you overestimating it - there are not a lot of people that have bank accounts with payments coming out of them that keep balances below $10. Most of people that are poor enough so that $10 is a real issue for them would not even have a bank account.

> $10 that to them would likely be more money than they ever had

I have hard time to believe for most 14-year-olds $10 would be "more money that they ever had", in this day and age. For 5 year old, sure. But typical 14 year old not ever having a price of two sandwiches in Subway (or one in a fancier place, or a meal in a relatively cheap restaurant)? I don't believe it.

> I'm sure some people would miss payments or have other inconveniences affect > them.

Like lots of people that had the balance of exactly 1 cent and had their rent payment of exactly 1 cent coming in. That doesn't sound ridiculous at all :)

I think you're reaching here. That's not the point anyway - the point is that these things are not just numbers, and are not directly comparable and workable using simple arithmetics.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> Reminded me of George Carlin's last standup special, where he said "it's part of their [cops'] job to commit perjury whenever it helps the state's case":

[https://youtu.be/jgxyCudDiM4](https://youtu.be/jgxyCudDiM4)

</comment><comment><USER24> This only reinforces my perspective that even highest levels of law enforcement need to be operating in a fully transparent way.

</comment><comment><USER25> The headline is inaccurate. The article says more than 20 years preceding the year 2000. They are not precise about what more than 20 years means, but I read that as late 1970s to 2000. From the headline and HN title it would seem like it starts from the beginning of time.

Edit: I see now that the hn title matches the wapo headline, changing to reflect that. Still a bad headline.

</comment><comment><USER26> I'm thinking about how much their incentivization might have influenced them. One fundamental difference between German and Anglo-American law is the prosecuter's task, as mandated by law. In the US it is to get as many convictions as possible (guilty or not). In Germany, the law wants a prosecutor to "find out the truth and use all evidence against AND also for a defendant".

Methinks the former case is one of the driving forces behind the "Bazaar" mentality.

</comment><comment><USER27> I wonder if partial DNA "matching" will one day be the hair strand analysis of our time.

</comment><comment><USER28> I did not understand from the article what "overstated" means.

Was it a partial match that they described as 100% accurate? did they hide the statistical probabilities? was the evidence faked?

</comment><comment><USER29> This is a great short documentary on the history of hair analysis at the FBI:

[http://www.retroreport.org/video/how-dna-changed-the- world-o...](http://www.retroreport.org/video/how-dna-changed-the-world-of- forensics/)

</comment><comment><USER30> Justice needs a meta-moderation function.

<comment><USER31> It does have one. But the situation has to be very bad for enough people to be willing invoke it.

<comment><USER32> Am I missing something, or are you talking about a violent revolution?

<comment><USER33> I don't know about a _" violent revolution"_, but I'm very skeptical of fixing a broken system while working within the rules of said system.

<comment><USER34> It's been done successfully many times in many countries. Look at Britain for example. Say what you will of the problems they have now, but they're undoubtedly better off than when they were under the thumb of the monarchy and the aristocracy. Gradual changes in the law punctuated by occasional serious strides forward led to a near complete abandonment of the previous system.

</comment></comment></comment></comment></comment><comment><USER35> Am I the only one who wonders what this costs each time something like this happens?

<comment><USER24> If you mean the cost in terms of trust citizens have in these institutions, then certainly I think the answer is no.</comment></comment>


Business dilemma: Windows RT or iPad? 84% say Windows RT - <AUTHOR> http://www.zdnet.com/debate/business-dilemma-windows-rt-tablet-or-ipad/10107426/ <comment><USER2> From what I understand you can't join an RT tablet to AD and manage it as a device. This would be a problem in most big businesses.</comment>


Starting a Startup with Nick Franklin, Co-Founder and CEO of ChartMogul - <AUTHOR> https://www.youtube.com/watch?v=vJxNXNWlbOU <comment><USER2> Very helpful interview.</comment>


LeCun's take on Ali Rahimi's "Test of Time" award talk at NIPS - <AUTHOR> https://www.facebook.com/story.php?story_fbid=10154938130592143&id=722677142 <comment><AUTHOR> So sorry, I messed up the link somehow. Please flag if you run across this submission.

[https://www.facebook.com/yann.lecun/posts/10154938130592143](https://www.facebook.com/yann.lecun/posts/10154938130592143)

</comment><comment><AUTHOR> Some good stuff in the comments too. Here's the talk:

[https://news.ycombinator.com/item?id=15857633](https://news.ycombinator.com/item?id=15857633)</comment>


Earned $10,120 in 30 Days by Sending Horse Poop to People: Marketing Experiment - <AUTHOR> http://www.shitexpress.com/blog/how-we-earned-10120-usd-in-30-days-by-sending-horse-poop-to-people-amazing-kickstart-of-a-marketing-experiment/?y

<comment><USER2> [https://news.ycombinator.com/item?id=8709837](https://news.ycombinator.com/item?id=8709837)

[https://news.ycombinator.com/item?id=8711746](https://news.ycombinator.com/item?id=8711746)</comment>


Ask HN: Programmers Without Relevant Degree - barry-cotter

How did you get your first job programming?<p>A friend of mine finds it difficult to believe that one can get a job programming without the credential. I'm telling him that it's helpful not necessary, if you can show you can code. <comment><USER3> Without going into too much detail, my life kinda screwed up in my late teens (mostly by me), and I had few qualifications and wasn't really going anywhere.

I didn't have any degree and after a miserable period on the dole started work at a data entry place. I'd been interested in programming since my first ZX81, and started finding things I could do to optimise the data entry process. Naturally, the company loved this and I got promoted. I used that as a portfolio for my next, slightly more developer-like job, and then wrote their website and e-survey stuff for them and used that as a portfolio for the _next_ job and so on. I had a very clear plan - work for a proper software dev company one day.

11 years later and I'm the best paid dev in the building, working for a large multi-national, with a fancy title and everything. And have been for a few years now.

You don't need to have a degree to prove you can do something, you just need to do it. Even _with_ a degree it's all about drive and determination. So - <AUTHOR> you want to get into programming then write plenty of your own stuff, or get into lots of Open Source, then get a list of firms in your area and ring them to try to get them to look at what you've done.

When I interview people these days, that's what I'm looking for - <USER2> about their craft, not necessarily their credentials. We've hired some people with top class degrees who unfortunately think the learning stops there.

Think of a degree just as a short cut to an interview, if you happen to already have the degree. Oh - but stay away from big firms, you'll never get past a Human Resources department with enthusiasm alone.

The irony is that I'm now getting sick of being employed to write endless enterprise drivel, and now my ambitions are to do with starting out for myself. Hence reading lots of HN.

</comment><comment><USER4> I have found through experience that different cultures/markets require different qualifications. In the US you can create some practical experience (home projects) for yourself and usually find a lower-paying entry level position with a smaller company. After a few years experience you don't get asked about your lack of formal education anymore (this is what I did by the way, I have a Sociology undergrad).

In London, I found that people are much more interested in degrees and pedigree. Job interviews often started with education questions first, and I feel like I was considered less valuable because of the lack of CS background (that was my opinion at least).

In Switzerland, where I am now, the people I encounter place a very high value on training programs. Scrummaster training is more valuable than Scrum experience and programming certificates are important in a way I never expected. However, the Swiss have a very strong culture of apprenticeship and "Lehrling" programs, and both shops I have worked in have many more interns than I have seen elsewhere. And the interns are often in the last phase of their Masters degree!

This is all just experiential and not very quantitative. But my answer is it depends on where you live. If you agree to work for less than the next person then I think you have a very good chance of landing a programming job.

</comment><comment><USER5> It really depends on what type of programming you and your friend are talking about, it may be worth clarifying this with him.

Though from personal experience I would say with most jobs (and especially those relating to web development), lack of experience and social skills will play a larger roll in whether or not you're able to secure the position you want rather than lack of a degree.

<comment> barry-cotter How would one recommend getting that experience?

I imagine in web development, writing stuff and putting it on a portfolio site or github would be pretty good, or patching an existig community website, or writing stuff for charities or small businesses.

But for other types of programming? What would be the best way to get internships, or to develop something that can showcase your abilities?

</comment></comment><comment><USER6> What degrees does your friend see as being relevant?

Most job specs I've seen look for a technical/scientific/quantitative degree. This doesn't have to be something related to computing: it normally translates to degrees such as maths, engineering and physics.

Getting a first programming job without any degree is harder, although if you show you can code (via prior experience) then it's not a big deal.

Looking for a first programming job with an unrelated degree (say, something creative) and no experience might raise some eyebrows.

<comment> barry-cotter He has a B.A. and M.A. in Classics, and is doing a B.A.I. in Engineering at the moment. He has a decent grasp of the theory of C++, having read through Stroustrup though I'm not sure how good the practice is.

In Ireland, we've recently moved from a four year B.Eng. (Honours) system for professional qualification to three year Bachelor (Ordinary) with a subsequent two year Masters being necessary for professional accreditation. Given that it's a new programme no one has any idea how the new degree will be viewed in the marketplace.

I'm of the opinion that it'll be a good standalone qualification, he isn't.

<comment><USER7> It can be done with nearly that exact degree. My B.A. is in Latin, but I was able to leverage that plus a good interview into an internship at a good company. I took that experience and got a job at a small software company as well as a spot in an M.S. program, which then led to better opportunities. It hasn't been a straight road, but it's gotten me where I wanted to go. I think your friend can do the same.

</comment></comment></comment><comment><USER8> I started off doing software tech support. While doing support I built tools to streamline and automate things. Managers took notice and offered me a job where it was a blend of coding, system analysis, and handling escalated support issues. I automated pretty much everything in that job as well. At that point I had some useful experience on my resume so I started interviewing for "pure" software engineering jobs.

I've been a software engineer for the last 10 years. No CS degree (though I did study engineering), but I love building stuff and I think that passion came through in my interviews.

</comment><comment><USER9> If you don't have a degree but do have the required coding skills you will get that job.

I have till date met 1000 programmers who have degrees from reputed institutes but don't know shit about coding.

@philbarr's method is actually very cool.

In the beginning you can work for start-ups and then switch.

Also: Take a look at this post Why can't programmers program?? by Jeff Atwood [http://www.codinghorror.com/blog/2007/02/why-cant- programmer...](http://www.codinghorror.com/blog/2007/02/why-cant-programmers- program.html)

</comment><comment><USER10> I think programmers have one common skill set that gets them off to software development - mathematical acumen.

Of course, it should still go with passion and and tenacity to become a good developer. There's a lot of programmers / coders out there who did not have any formal degree or training in the field of software development but have made some great strides. The key thing here is in doing it, execution and making value out of the codes you write.

</comment><comment><USER11> I don't have a degree, yet, I never found it an issue to get a job. How? I had my name all over the internet, patches, bug reports and quality code.

In most cases, that weighted a lot more than any degree I could've achieved.

</comment><comment><USER12> If he loves to code credentials are irrelevant, otherwise he needs to credential up.</comment>


This link says it's from YouTube but it's not - <AUTHOR> http://www.youtube.com/redirect?username=digitalhook&q=http%3A%2F%2Fsecuritytube.net%2FSocial-Engineering-Attacks-using-Simple-Redirections-video.aspx&video_id=Vgc3NVVpb8c&event=url_redirect&url_redirect=True&usg=UE0DOmwjBRK-mgheFtW1hMTEvh4=

<comment><USER2> My first computer job as a teen was working at a small SEO shop (3 people) writing little cgi/perl scripts for this and that.

Yahoo's http server at that time used to take redirect URLs in this format: "<http://yahoo/url/*http://exiturl/>. They were using these URLs on all search results, I'm guessing to track click-throughs to improve rankings. So I set up a script on our site to load an image using this format with the img src in the exit-url, and for the yahoo-url and we would round robin 'client' links though. Essentially spoofing legitimate search&clicks on yahoo from unique IPs from our site visitors. Over the next two weeks all our sites started bubbling up in the results. This worked for about a month before Yahoo changed something (I'd guess they started validating the http-referrer or the exit- url), and it all stopped working.

But, for that brief window of time when it was working, I was the king of the high fives.

(FWIW, I don't do SEO work of any kind anymore, and I certainly don't advocate 'blackhat seo'.)

</comment><comment><USER3> This is a common exploit. So common that it's #8 on the 2010 OWASP top 10 most critical web application security risks: "Unvalidated Redirects and Forwards".

[http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projec...](http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project)

Every web app developer should review these vulnerabilities before releasing their code to the world.

<comment><USER4> Interesting. Facebook had a similar exploit earlier but they seem to have solved it easily by attaching a hash to the redirect:

site.com/redirect?l=<url>&h=hash(secret,url)

<comment><USER5> that doesn't seem to solve it. the youtube redirect also has a signature, but generating a signed link is trivial.

<comment><USER6> Good point. Clearly there's a pretty serious problem with however they're creating those hashes.

</comment></comment></comment></comment><comment><USER7> [https://www.google.com/accounts/CheckCookie?continue=http%3A...](https://www.google.com/accounts/CheckCookie?continue=http%3A%2F%2Fwww.youtube.com%2Fredirect%3Fusername%3Ddigitalhook%26q%3Dhttp%253A%252F%252Fsecuritytube.net%252FSocial- Engineering-Attacks-using-Simple-Redirections- video.aspx%26video_id%3DVgc3NVVpb8c%26event%3Durl_redirect%26url_redirect%3DTrue%26usg%3DUE0DOmwjBRK- mgheFtW1hMTEvh4%3D%2F&chtml=LoginDoneHtml)

This link looks like it's from google.com but it's not.

Incidentally I think this only works if you're currently signed in to a Google account, oh yeah it's bouncing from an HTTPS address as well.

</comment><comment><USER8> It is technically a YouTube link, but it is redirecting to securitytube.net. I know this because the Internet I am on blocks YouTube, but not SecurityTube, so going directly to the redirect link works, but the YouTube link does not.

At least that is what my browser says:

[http://www.youtube.com/redirect?username=digitalhook&q=h...](http://www.youtube.com/redirect?username=digitalhook&q=http%3A%2F%2Fsecuritytube.net%2FSocial- Engineering-Attacks-using-Simple-Redirections- video.aspx&video_id=Vgc3NVVpb8c&event=url_redirect&url_redirect=True&usg=UE0DOmwjBRK- mgheFtW1hMTEvh4=)

Looks like someone found a YouTube exploit.

<comment><AUTHOR> correct! Basic idea is to show how easy it is to use this simple redirect against users of social media sites. Most people on HN would have seen this link and trusted it to be from YouTube.

<comment><USER8> Furthermore, I can see browsers detecting this type of behavior and prompting the user about it.

If a browser sees an encoded URL in the query string, and then gets a location header to go to that URL, and that URL is not on the same domain, it would prompt the user that you are leaving that domain.

I can't see many sites that are legitimate, and use redirection techniques that meet all of my criteria.

<comment><USER9> <http://voice.google.com/> redirects to <http://google.com/voice>. Technically different domains, but I would be really annoyed if I had to confirm this every time. I suppose you could add a white list, but now we are just annoying people when they first start using a particular install of a browser.

<comment><USER8> No, I'm talking about seeing something like:

<http://voice.google.com/?r=google.com/voice>, where the resulting URL is inside the query_string

<comment><USER9> So then we start obfuscating the URL parameters? Or what if google.com/voice is just one step in a series of redirects? What if some "clever" dude decides to protect against this and say base64 encode the r argument to "protect" his app?

</comment></comment></comment></comment></comment></comment><comment><USER10> I don't know a single non-technical but non-internet-ignorant user who wouldn't be suckered in by this. I've taught people how to scan for valid links, and now they can't even trust that.

<comment><USER11> On proggit, we just found that even techical, internet savvy users can be suckered in by this.

[http://www.reddit.com/r/programming/comments/bpy7h/think_you...](http://www.reddit.com/r/programming/comments/bpy7h/think_youre_immune_to_phishing_attacks_see_if_you/)

1 in 5 attempted to sign in. The results are hardly scientific, but the comments are full of users who were fooled.

<comment><USER12> Sorry but I'm not sure users from reddit are all web savvy. It's still interesting that people don't look at urls when asked for passwords.

<comment><USER13> Maybe not reddit as whole, but surely the people reading the programming subreddit are a bit more web savvy than the average person?

</comment></comment></comment></comment><comment><USER14> URLs are not a security mechanism. They are a non-canonical resource locator, where each part is resolved by a different server. It's a way to write a "program" that does a DNS lookup and HTTP query in a simple way.

Nothing more, nothing less.

If you want security, start a CA, give each site you like its own SSL cert (signed by you), and enjoy.

<comment><USER15> I've looked at the costs of starting a CA and they are absolutely astronomical for the average person. Not that every person should be able to start a full- fledged CA, but the whole thing is scammy on the tail-end.

</comment></comment><comment><USER16> Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.

<comment><USER17> So it is important to also check the URL in your address bar _after_ you click, as well. This trick won't be able to fake that.

<comment><USER18> But would you always catch it if you were redirected to www.youtube.com.you1ube.com/something?

Or possibly worse - <http://www.youtube.com⁄bad-site.com/something_else>

<comment><USER19> When hovered, then clicked in Opera:

opera:illegal-url-24

Error!

Invalid URL

The URL <http://www.youtube.com⁄bad-site.com/something_else> contains characters that are not valid in the location they are found.

The reason for their presence may be a mistyped URL, but the URL may also be an attempt to trick you into visiting a Web site which you might mistake for a site you trust.

</comment></comment></comment></comment><comment><USER20> This is hardly new, but I agree it is an issue.

The answer to this security issue is either:

1) The bit.ly route - store off-site urls your organization wants to link to as a value and give the user an url with just the key in it.

2) Create a secret salted hash of the url and include that with the url in the args. Upon request, the receiver would re-hash the url and compare it to the hash given. Unless someone reverse engineered your hash this system prevents someone casually manipulating a url.

<comment><USER21> If you're going to that much trouble, perhaps you could set up permissions to add target URLs?

</comment></comment><comment><USER22> This is not new. Various 'recognized' websites have redirect urls that are not protected. Once the redirect is complete the site it properly identified.

If you have to be afraid of what links you click on you are running the wrong software.

<comment><USER23> It's not about technical exploits, it's about making it eassier to social engineer and phish. For instance, redirecting to a fake youtube login page. Even slightly more savvy users will look at the original link, click it, then click through and follow instructions. Single signon systems that have redirects aren't uncommon, so the user can be used to seeing that sort of behaviour.

I'm surprised youtube has such a basic problem on their site.

<comment><USER24> Isn't this what SSL is for, proving identity? In this case, even a cursory look at the URL would indicate that something was up.

Sure, this makes fishing a little easier, but users need to watch out for themselves. It's a big bad world out there :)

<comment><USER23> Yes, but it's not hard to get an SSL cert for some random domain. So user clicks a youtube link, ends up on "centralised-video-authentication.com", sees SSL icon, all good?

I agree with you in general, but youtube shouldn't be making things harder for security.

</comment></comment></comment></comment><comment><USER25> I wonder how many sites have a similar redirect feature for post-login pages instead of outbound click tracking. This feature makes it easy to login from any page, and immediately return to the page upon success. How many sites don't validate the full url before redirecting? Scary thought...

</comment><comment><USER26> This title makes me definitely _not_ want to click it.

<comment><AUTHOR> Can you suggest something better?

<comment><USER27> It may suffice to point out in the comments that it redirects to [http://securitytube.net/Social-Engineering-Attacks-using- Sim...](http://securitytube.net/Social-Engineering-Attacks-using-Simple- Redirections-video.aspx) . (As of this posting nobody else has posted this yet.)

Also, despite having "video" in the URL, the text says all you need to know. I don't think very many people around here will have a hard time figuring out how this happened. I don't need a video.

</comment></comment></comment><comment><USER28> This is a case where the web is only as secure as its most insecure link. Even if your site uses a hash to prevent abusing redirects people can still abuse them. They need only find a site that uses hashless redirects, generate some redirect link using that site, and then create a legit redirect link using your site. Blacklisting certain domain strings in the url would not solve this- new domains are too easy to obtain. Whitelisting would help but may be prohibitive depending on what you are building...

</comment><comment><USER29> This is why I'm using the RequestPolicy addon on Firefox : <http://www.requestpolicy.com/>

It asks for confirmation when a page tries to redirect unexpectedly like this.</comment>


You Don't Like Crossfit? Get Over It - <AUTHOR> http://www.liftbigeatbig.com/2014/05/you-dont-like-crossfit-get-over-it.html

<comment><USER2> What's with the bizarre hyper-defensive title... is "Crossfit" something everybody hates...?

<comment><USER3> I think there have been some critics concerning its safety and effectiveness. I think there was a good article criticizing crossfit in hacker news some days or weeks ago. It seemed to make sense to me.</comment></comment>


Why Gitlab pays local rates - <AUTHOR> https://about.gitlab.com/2019/02/28/why-we-pay-local-rates/ <comment><USER2> When I choose to live in, say, Shanghai- it doesn't automatically reduce my cost of living.

I'm losing the security of clean drinking water so bottled water costs me- ~30$ per month. I'm giving up on social security but need to invest in a way that I have it. I'm giving up on safety regulations so have to buy and do things accordingly. In the end the cost of living equals out.

I do not living in London so I need to manage my own health.

Any argument about local rates is bogus

<comment><USER3> Shanghai and London may have similar costs of living after certain factors are accounted for, but that's a coincidence not a rule. Compare Manchester and London. London has much higher rents and higher prices in shops, bars and restaurants. Everything else is about the same. Ergo, London has a higher cost of living.

</comment></comment><comment><USER4> There are two weak points that I can see:

I live in Bay Area as a single person.

Even though the living cost is high, I still save more than $100,000 USD per year. Think about it. A $3,000 monthly apartment is only $36,000 a year

If Gitlab pays a local rate, and, say, I live in Vietnam (where I'm from), it's almost impossible to reach $100,000 USD in savings.

Bay Area's cost of living is high. But the salary is way way higher.

If I joined Gitlab, I'd just move to Bay Area for an instant increase in my saving performance.

Another one point is that Gitlab will be at a great disadvantage in hiring outliers (e.g. someone extraordinary). They're gonna demand the Bay Area's rate no matter where they live. But I suppose Gitlab will definitely make exceptions for these kinds of people.

</comment><comment><AUTHOR> hard problem to crack, but the reasoning in the "Standard pay eats away at production and personnel" paragraph is a bit simplistic. It's not explaining or supporting the "why". It is just stating the obvious.

</comment><comment><USER5> payng Different wages where there is freedom of movement does not make sense to me, especially since only 1/3 of wage difference gets eaten up by rent in my location. It almost traps people to stay in London when they could be much healthier and more productive working in Portugal. I don't see why they even need people in London for geographic diversity.

Also, their salary calculator for my area is 30% below market, so something is off.

<comment><AUTHOR> Weirdly, the salary for a role suitable to me is kinda above market rate.</comment></comment>


Show HN: Busybeaver, an Implementation of the Busy Beaver Turing Machine Game - <AUTHOR> http://rajk.me/static/busybeaver.html <comment><AUTHOR> In particular, a good challenge is the 2-state solution. Decrease the number of states to 2 and try figuring out the rules (toggle "Instructions") that make the 2-state Busy Beaver. 1-state is somewhat trivial, 3-state isn't really possible by hand unless you have a lot of time.

<comment><USER2> Interesting. Probably would be helpful to describe the Busy Beaver problem. [https://en.wikipedia.org/wiki/Busy_beaver](https://en.wikipedia.org/wiki/Busy_beaver)</comment></comment>


UN Women ad series reveals widespread sexism {using real Google search data} - <AUTHOR> http://www.unwomen.org/en/news/stories/2013/10/women-should-ads <comment><AUTHOR> This ad for UN Women "uses genuine Google searches to reveal the widespread prevalence of sexism and discrimination against women. Based on searches dated 9 March, 2013 the ads expose negative sentiments ranging from stereotyping as well as outright denial of women's rights."

They don't show what the equivalent searches for men are.

<comment><USER2> I tried "women should", and got 0: "er bags", 1: "er tattoos" and 2: " be seen and not heard". Then I tried "men should", which returned " weep", " weep cracker", oh and " er bag".

<comment><AUTHOR> Yes. It gets a bit more targeted when you add the space [men should ] or [women should ]

I guess there are a lot of online bibles affecting the search?</comment></comment></comment>


Facebook MaliciousChat: Changing messages after the fact - <AUTHOR> http://blog.checkpoint.com/2016/06/07/facebook-maliciouschat/ <comment><AUTHOR> tl;dr: Send a message on Facebook messenger, grab its id, and you can alter it by sending more messages with the same id.

Seems simple enough to probably have been abused by many.</comment>


Booz Allen Statement on Reports of Leaked Information - <AUTHOR> http://www.boozallen.com/media-center/press-releases/48399320/statement-reports-leaked-information-060913

<comment><USER2> Booz Allen -- one of my personal most hated companies. They are known for being incompetent, wasteful and for getting contracts by being in bed with everyone else in the government. Not unlike other military industrial contractors but they do take it up a couple of notches. They put "butts in seats" and then charge up the nose for it. Those butts in seats don't know how to finish the project, so they put more butts in seats and charge even more.

If it wasn't for all the red tape and the good ol boys network, just going around and re-doing all the mega-expensive and broken Booz Allen contracts behind them at the fraction of a cost would be a good start-up idea.

<comment><USER3> I've not dealt with BAH personally but they were also on my "Least Favored Government Contractors" list. A friend of mine left the service and ended up with a job there, which is where I first heard of them.

SAIC was the one that leaked a bunch of PII, and in stupendously stupid fashion, so they're also on my crap list.

At least Electric Boat (part of General Dynamics) and Newport News Shipbuilding actually builds stuff right the first time. Bath Iron Works I've heard good things about as well.

I wish I could think of very good tech contractors that help the government, but that would imply the government has very good tech systems...

</comment></comment><comment><USER4> Booz Allen Hamilton "In The News" page highly ironic. Check the first three items. [http://www.boozallen.com/media-center/press- highlights](http://www.boozallen.com/media-center/press-highlights)

1 Where to Find - And How to Woo - Your Next Hires

2 Application Vulnerabilities Remain Security's Biggest Concern

3 Stopping Hacks from Stealing Corporate Secrets or Disrupting Electric Service

</comment><comment><AUTHOR> Looks like Snowden's former position is available as well: [http://careers.boozallen.com/job/Honolulu-Information- Securi...](http://careers.boozallen.com/job/Honolulu-Information-Security- Engineer%2C-Mid-Job-HI-96801/2280056/)

<comment><USER5> Obviously the slides didn't come from Booz Allen, they have many jobs requiring PowerPoint experience:

[http://careers.boozallen.com/mobile/job/Herndon-System- Integ...](http://careers.boozallen.com/mobile/job/Herndon-System-Integrator- Job-VA-20170/2649992/)

</comment></comment><comment><USER6> Yeah, he _technically_ did something wrong, but Booz Allen should come into the spotlight, as they are _profiting_ from this nastiness. Fuck them.

<comment><USER7> Well, Booz Hamilton Allen is now a dirty word in Europe, Asia, and probably even in the US now. WHo the hell is going to want to contract out to them now?

<comment><USER8> BAH is a massive corporation full of ex-government officials, and vice-versa; the current Director of National Intelligence is a former BAH executive.

They're gonna be ok.

<comment><USER9> A current BAH executive is also the former DNI.

</comment></comment></comment></comment><comment><USER10> There's nothing interesting or unexpected about this statement at all.

</comment><comment><USER11> Clearly their "core values" differ from mine. And America's.</comment>


Show HN: Tagsdock 3-Search and add Instagram hashtags from your iOS keyboard - <AUTHOR> https://itunes.apple.com/app/tagsdock-hashtags-keyboard/id971209113?mt=8 <comment><AUTHOR> Tagsdock is the fastest, easiest and most effective way to hashtag your posts on Instagram from your iOS keyboard.

Like most Instagram users, I use hashtags for my photos. Bulk copying hashtags from other apps and then opening Instagram app every time to paste it sucks. Wanted to tag my Instagram photos faster, so we built Tagsdock. We launched last year with over 100+ curated popular hashtags categories. You could choose from over 3000+ popular hashtags for any photo from these 100+ hashtags categories.

One of the most requested features was to search for any hashtag. You can now search for any hashtag from your iOS keyboard by clicking on the search icon. You will be shown a list of the top 30+ related popular hashtags for that hashtag.</comment>


True-color GIF with 32697 colors - <AUTHOR> http://phil.ipal.org/tc.html# <comment><USER2> The file size isn't too bad, but in Safari the rendering time is terrible. You can see it render each block, and it takes about 10 seconds to render the whole thing.

I assume this is because it's not a commonly used feature, so the code paths are only implemented for compliance rather than performance.

<comment><USER3> It's actually more of a hack to deal with malformed GIFs and goes directly against spec. To address GIFs where each frame has a 0 frame delay, most GIF decoders implement a minimum frame delay value.

See: [http://nullsleep.tumblr.com/post/16524517190/animated-gif- mi...](http://nullsleep.tumblr.com/post/16524517190/animated-gif-minimum- frame-delay-browser-compatibility)

 __Edit __: This is what it looks like with all frame delays set to 2 centiseconds:<http://i.imgur.com/24xpZEd.gif>

On Chrome and Firefox, you should see it animate more quickly.

<comment><USER4> GIF performance seems improved in safari, at least in 6.x, though this is just anecdotal evidence. The GIFs with 0.02 second frames (the actual ones, not just the "here's what it looks like under x browser" ones) seem to render with the same frame rate for me in Safari and Chrome now.

</comment></comment></comment><comment><USER5> I took a screenshot so interested people can see how badly images can be mangled by the proxies used by some mobile companies.

(<http://i.imgur.com/DYbVSbj.png>)

<comment><USER6> Wow what mobile companies do that?

<comment><USER7> AT&T, Verizon, Sprint, T-Mobile... depending on network, image size, device and browser user-agent.

<comment><USER8> I just tried it on Verizon from Chrome on my ThinkPad (via mobile hotspot) and my Galaxy Note II. Both displayed a perfect image, albeit very slowly.

Not saying there aren't cases where it does happen; obviously from that screenshot there are; I just didn't run into it.

</comment></comment></comment></comment><comment><USER9> <https://news.ycombinator.com/item?id=5691086>

Same URL but without the dupe-eluding # tacked on the end.

<comment><USER10> Why hasn't HN fixed this?

<comment><USER9> I once posted an "Ask HN" about this and it was soon killed.

At this point I have to assume it is a feature, not a bug, so it's hard to fault people who take advantage of it.

</comment></comment></comment><comment><USER11> > So a GIF file with more than 256 colors gets very large very quickly.

Sure, due to a library that doesn't do compression! Has anyone an example of one with compression?

Also, looking at this:

<https://bugzilla.mozilla.org/show_bug.cgi?id=149205>

It seems that the block by block thing is not an animation on purpose, it's really how browsers render it (and other programs load only the first frame etc...), because each sub-image is a frame. So not that ideal.

<comment><USER12> Yes. It's called libpng.

</comment></comment><comment><USER13> I lost an argument about this years ago. In Uni I learnt that you could create GIFs with more than 256 colours, but when challenged I could find none. And all references in the net mentioned just 256. I was sure but I ended up believing I just had a brainfart or was lied to in class.

This is ~10 years late to my argument :(

</comment><comment><USER14> The images could be compressed; the relevant patents expired a few years ago. (Is this an old page?)

<comment><USER15> The last modified date on <http://phil.ipal.org/tc217.gif> is 12 Dec 1999, which was 3 years before the last patent expired.

</comment></comment><comment><USER16> Internet explorer (10) doesn't even render it properly in the first place.

(<http://i.imgur.com/R87CGQ4.png>)

<comment><USER17> Your zoom appears to be set to 125% (not sure if that absolves IE or not -- I see similar lines in Opera when zooming). Looks okay to me at 100%.

</comment></comment><comment><USER18> Cool, I wrote about a similar technique (but with a somewhat different approach which I think balances file size/quality concerns better in practice):

[http://notes.tweakblogs.net/blog/8712/high-color-gif- images....](http://notes.tweakblogs.net/blog/8712/high-color-gif-images.html)

</comment><comment><USER19> "32697 colors" is not True Color, it's High Color.

<comment><USER20> The point is that if you render the image in blocks of 16x16, there can only be 256 colors per block, so there can be as many colors in the image as there are pixels. This 217*217 image has some duplicate pixels in the lower and higher values but gets fairly close to that maximum.

</comment></comment><comment><USER21> I can't be the only one bothered by the choice of dithering algorithm in that example, right?

<http://en.wikipedia.org/wiki/Dithering#Algorithms>

</comment><comment><USER22> _"No one tried or needed to generate images with more than 256 colors since they could not be viewed on anything less than high priced graphics workstations."_

Except that given this refers to the late 80's, Amigas had been displaying 4096 colors since the mid 80s. Not millions of colours until the early 90s but still a far cry from the 256 colours of the average PC.

(No, gif was not a native datatype, but the Amiga was remarkably ahead of its time with plug-able file formats.)

</comment><comment><USER23> This is no different than 200 256-color GIFS loaded side by side. Sure, the entire image is 32K colors, but each 16x16 block is limited to 256 colors still.

Plus the forced animation makes it effectively useless.

What's the point of that?

<comment><USER24> Well, in a 16x16 block you only have 16x16=256 pixels, so the blocks themselves are basically "true color". Stack blocks and you'll have lossless true color. Of course, this was more interesting before .png support became widespread in browsers.

(Also, I believe you're not restricted to 16x16/256col blocks. If you can fit a pattern of 255 distinct colors + transparency over a larger image, you could stack several frames to create the same effect, without having to drop down to 16x16 local blocks)

</comment></comment><comment><USER25> This makes me angry with Adobe: I feel cheated that for the past twenty years I could have been making GIF images with more than 256 colors in Photoshop.

</comment><comment><USER26> A couple days ago that there was another page submitted to HN describing how gif animation worked. It then suggested this technique was possible.

</comment><comment><USER27> Picasa Photo Viewer, when the image is downloaded then opened using this program, doesn't show anything over just the first block (top left).

<comment><USER28> Same in Chrome Version 26.0.1410.63 (Ubuntu 12.04)

<comment><USER29> It shows on the iPad in Mobile Safari but loads and fills out slowly in a grid of squares in rows and columns of 3 or 4 (I forget). It took about 15 seconds in all to render. Fascinating nonetheless and I learnt something.

<comment><USER30> Mobile Chrome on Android 4.0.3 has The same behavior. At first I thought it was an animated gif.

Edit: looks like it is an animation of the rendering process.

</comment></comment></comment></comment><comment><USER31> Photoshop correctly opens and interprets this image. Frame propagation is used to achieve the effect.

</comment><comment><USER32> There is something charming about 256 colors though.

</comment><comment><USER33> What's the point of this? Hi Res animated gifs? Color me sort of interested...

</comment><comment><USER34> Fails miserably on Chrome / Android 4.2 / Nexus 7 ...

<comment><USER34> Actually it's my proxy server that failed, didn't realise it was an animated GIF and I have it set to deanimate images by default. Ooops!</comment></comment>


Tyndall F-22s, Left Behind Before Michael Hit, Possibly Damaged Beyond Repair - <AUTHOR> http://www.airforcemag.com/Features/Pages/2018/October%202018/Tyndall-F-22s-Left-Behind-Before-Michael-Hit-Possibly-Damaged-Beyond-Repair.aspx <comment><USER2> I really love the statement from the colonel in charge of the base; it's clear, concise, and conveys his message perfectly.

> Wing Command Col. Brian Laidlaw said in a statement Friday the base was > "better than yesterday, and that is how it is going to continue to be. We > will continue to persevere."

I like it so much that I really just want to make it a motto to live by: "things are better than yesterday and that is how I will continue to make them."

<comment><USER3> There was an state re-election campaign here in New South Wales, Australia 10 or 20 years ago run under the slogan

 _More to do but heading in the right direction_

which was widely mocked for being particularly uninspiring. I still quote it all the time - hardly a week goes by when it can't be amusingly slipped into conversation hehe. (Usually to helpfully complete someone's attempt to describe the state of a situation they're working on.)

<comment><USER4> The most outrageous part of the 2007 election was that they won. State politics is so unbelievably uninspiring

<comment><USER5> There's something to say for boring politics.

<comment><USER6> As a US-er I would cherish that boredom. Our politics are insane.

</comment></comment></comment></comment></comment><comment><USER7> Tyndall didn't _lose_ $1bil in F-22 assets; the HN title of this article is pure clickbait.

No other state takes hurricane evacuation more seriously than Florida. This article[1] posits that Tyndall has 55 F-22s divided between two training squadrons. If only 4 were left behind, that's 93% brought to NMCM Airworthy status or better, which is mindblowingly effective.

[1] [http://www.thedrive.com/the-war-zone/24204/setting-the- recor...](http://www.thedrive.com/the-war-zone/24204/setting-the-record- straight-on-why-fighter-jets-cant-all-simply-fly-away-to-escape-storms)

<comment><USER8> The products are 'out of warranty' and effectively antiques.

The article states how much it would cost to get the tooling back to make more of the planes and you would be looking at spending billions to make replacements.

There is no 'series production' going on and therefore that means that 'maintenance' is more like 'restoration' with these dubious machines.

I wonder if it would make more sense and provide as much utility if the Air Force just settled for a fleet of classic concept cars. It wasn't as if the Air Force was of any use whatsoever on that day seventeen years ago when action stations was actually needed.

<comment><USER9> The whole project was a boondoggle from the very beginning. It's up there in the procurement hall of shame with the B1, B2, and LCS.

<comment><USER10> The topic is the F-22. Are you thinking of the F-35?

<comment><USER9> No the F22. $350 MM per plane for something that will never see its, admittedly impressive, capabilities needed or used. Very much like the B2 in that respect.

<comment><USER11> The B-2 has been used to great effect in its intended role for years. Similarly the F-22 is operational today. They're both combat proven.

Geopolitical rivals have similar tech to the F-22 entering service.

You may disagree with the wars being fought but this tech does what it says on the tin.

<comment><USER9> That's revisionist history. Its intended role was nuclear strikes deep in the heart of the Soviet Union. It has certainly not been used to great effect or otherwise for that.

Likewise, we will never go to conventional war with those "geopolitical rivals". Instead we go to war with countries like Syria and sub-national actors like ISIS neither of which have similar tech entering service, to put it mildly.

<comment><USER11> The B-2 was always a long range bomber capable of deploying both nuclear and conventional weapons. It needed to have the capability to reach and bomb Russia but that was never the only intended role.

It was also the first plane to drop JDAMs which are useful regardless of the tech level of the enemy.

It's a long range bomber that was designed to fly long distances and drop bombs that entered service and flew long distances and dropped bombs.

No part of that history is "revised".

Furthermore, maintaining military parity with geopolitical rivals is _why_ we do not engage in conventional warfare with them. The MAD doctrine has proven to be effective for decades.

I'm happy to hear reasoned criticism of American foreign policy but the B-2 and F-22 are both performing exactly the jobs they were designed for. Both as combat vehicles and as deterrents.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> There goes 12 hours worth of the defense budget.

<comment><USER13> Wow, that's actually correct according to wikipedia

In FY 2017, the Congressional Budget Office reported spending of $590 billion for defense, about 15% of the federal budget.[1] For the FY 2019 president Donald Trump proposed an increase to the military to $681.1 billion. [2]

<comment><USER7> ...except the statement is pure bullshit given the assets weren't actually lost.

<comment><AUTHOR> ... except that they were, the aviation industry term for an aircraft that has been damaged beyond economical repair is "hull loss"

[https://www.google.com/search?client=ubuntu&channel=fs&q=avi...](https://www.google.com/search?client=ubuntu&channel=fs&q=aviation+hull+loss&ie=utf-8&oe=utf-8)

<comment><USER7> Please cite the media outlet which has asserted that these aircraft have been damaged beyond economical repair.

From the article: _"We anticipate the aircraft parked inside may be damaged as well, but we won 't know the extent until our crews can safely enter those hangars and make an assessment," the spokeswoman said._

Anecdotally, a former life once allowed me the privilege of directing flightline ops during several hurricane evacuations. This isn't anything new to me, and I've seen far worse than what this article (and others) have depicted--to include an entire squadron of F-15s engulfed in storm surge saltwater flooding up to their cockpits during Wilma, none of which resulted in airframe loss.

<comment><USER14> they don't make 'em like they used to

</comment></comment></comment></comment></comment></comment><comment><USER15> I would have thought the base would have some nuclear hardened hangars for storing planes?

IANAP (I am not a pilot/military) but the airbases near me in Scotland have bunkers like [these]([https://i.pinimg.com/736x/9e/24/8f/9e248f941d40fca8e947c4a57...](https://i.pinimg.com/736x/9e/24/8f/9e248f941d40fca8e947c4a57d6c45bc.jpg)) for storing RAF Tornados and Typhoons.

Hopefully this loss will be a lesson to the USAF

<comment><USER11> You're assuming you know more about evacuation planning and base design than the US Air Force. I think that's an unreasonable assumption.

Some possibilities: 1) Nuclear hardened bunkers exist on base but were already full. 2) Nuclear response planning does not require planes to be stored in hardened bunkers. 3) The threat model for a nuke is different than a hurricane.

<comment><USER16> Regardless... these guys had a LOT of warning.

Excuses don't seem credible.

<comment><USER11> 72h is a lot of warning? It's not like they left _everything_ behind. There was a large scale evacuation and a significant amount of hardware was moved without being lost. Do you have any indication that the evacuation was poorly planned or executed? Or that the base design was lacking?

I'm not offering excuses. Hell, I'm not even suggesting the base design was satisfactory or that this damage is acceptable. I am offering possible explanations for why this amount of hurricane damage was sustained and why these specific air frames were not in "nuclear hardened bunkers".

"I saw some bunkers somewhere" is a pretty poor excuse for criticism of a military installation's design, or anything really.

<comment><USER17> >> _72h is a lot of warning?_

It's not 72hours, but probably since ~ 1492 they knew that FL is hurricane country. They also know that x% of planes are always on maintenance and a certain amount of planes cannot evacuate to a safer base. And while not cheap, it's possible to make hurricane proof hangars. Someone dropped the ball and a lot of money was lost.

<comment><USER18> Not all hurricanes are equal. This was the most destructive hurricane to hit that region in recorded history (yet still weaker than the storm that took out Puerto Rico a year ago). The Florida panhandle has mostly been an infrequent target for slow and rainy cat 1 hurricanes every 20 years or so. Those storms take down some trees and power lines, and sometimes cause minor flooding.

This was a strong cat 4 with heavy forward momentum and a significant storm surge, a 200+ year storm for the area. Nobody builds for highly unlikely events like this, they buy insurance.

<comment><USER17> >> _Nobody builds for highly unlikely events like this, they buy insurance._

Building better ones I bet would be cheaper than year after year insurance on billion $ items

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Belgium, too, is having trouble with their fighter jets (#1 post on HN at the moment):

[https://news.ycombinator.com/item?id=18211632](https://news.ycombinator.com/item?id=18211632)

<comment><AUTHOR> Not coincidental at all, found it linked from a forum that was also discussing the F16.

</comment></comment><comment><USER20> So one got, like, a flat tire?

</comment><comment><USER21> I am curious what reasons there could be for the planes to be immovable by road. F22 has a 13.56m wingspan. Would it make sense to build trucking platforms for such contingencies?

PS: I have no knowledge in the subject, just curious.

<comment><USER7> From this article[1]:

 _Throwing jets on flatbed trucks? People don 't realize how large of a flying machine a Raptor is. They are roughly 44 feet wide, 62 feet long, and weigh over 43,000lbs. They are not something you just throw on pop's flatbed and skidaddle out of dodge. Nor are they made to be transported that way in the first place. And to where? You are talking about a highly sensitive asset packed with classified material. Its skin treatment alone presents a national secret risk. These aircraft are supposed to sit in last minute hurricane traffic heading somewhere as they hog up multiple lanes? The whole notion is ridiculous. And if they can't seek refuge in time, you have a flying machine strapped to a flatbed. Good luck with that._

[1] [http://www.thedrive.com/the-war-zone/24204/setting-the- recor...](http://www.thedrive.com/the-war-zone/24204/setting-the-record- straight-on-why-fighter-jets-cant-all-simply-fly-away-to-escape-storms)

<comment><USER22> "You are talking about a highly sensitive asset packed with classified material."

Ok, let's leave it to be destroyed by weather then

<comment><USER23> Even once destroyed it's still within the base that is presumably still guarded. Once out of the base on a flatbed the risks of losing any part of it are much greater.

<comment><USER22> Getting an intact plane to safety would be far less of a risk of losing parts than letting it be destroyed in a flood.

</comment></comment></comment></comment></comment><comment><USER24> Look at it this way - climate change is making the job of keeping a functional military harder and harder - something that may help focus minds as much as IPCC reports.

<comment><USER25> Please cite a good source for this assertion. With hard numbers, not conjecture.

<comment><USER24> Which assertion?

Losing a billion dollars of planes because of weather? I know it is only a billion (a drop in the ocean for the military) but if a adversary had knocked out three F-22s they would be considered a national threat.

Treat the weather like a potential national security threat is what I am saying.

<comment><USER25> There has been stormy weather across the planet, for as long as we know of. Climate change or no...

</comment></comment></comment></comment><comment><USER26> It's easy to find better solutions given that we now know the hangers would fail. It's cheating to know that.

For example, a probable solution would be to place the aircraft far from things likely to become flying debris, then add sandbags... lots of sandbags. Park the planes on the runway, then add enough sandbags to divert the wind over the top.

I'd take that chance if I knew that the hangar would fail, but again, that is cheating.

<comment><USER27> I wonder if a fighter jet would be damaged by the wind alone (ignoring debris) as long as it is tied down. Naively a fighter jet is already designed to cope with high speed air flow.

<comment><USER28> The procedure is to turn aircraft tail into wind and lock the flying surfaces. But as noted that's useless against debris.

</comment></comment></comment><comment><USER29> Looks like it's time to upgrade building codes. I wonder what it would take to make 150mph winds survivable by homes and hangars.

<comment><USER30> Lots and lots of concrete. Which isn't that expensive if you've going to rebuild a state. The bigger problem for Florida is that it has no high terrain to absorb the hit. Britton Hill is a mere 345 feet above sea level. Which makes Florida a big sand bar that storms just roll over.

<comment><USER29> I would start with using screws/bolts instead of nails holding the wood to the foundation. It takes a lot to pull that loose. The other problem is the roof being lifted off from suction. I would bet that bolting it to the frame would stop a lot of that.

With relatively minor changes like that, an ordinary wood frame house should be considerably stronger.

<comment><USER26> This has been the building code in Florida for a quarter century.

Most people do better. Typical construction in Florida is concrete block. There is no "ordinary wood frame house" in Florida. That would be out of place. We have termites, but not concrete-eating termites.

To me it feels like the houses are about 5% wood frame, 90% concrete block, and 5% solid poured concrete that could stop a truck tossed by a tornado.

<comment><USER29> If I was an architect, I'd be headed to Florida first to survey the damaged and undamaged and see what design elements worked and what failed. Then hang out my shingle to offer this expertise for the rebuild.

</comment></comment></comment></comment></comment><comment><USER31> It takes a lot to make me furious, but I'm furious.

These morons built an Air Force base with billions of hardware in hurricane territory, and were caught flat-footed by a hurricane because apparently there were no adequate plans for what to do when a hurricane approached?

Jesus christ. Those planes are irreplaceable. F-22 production has ceased, so it's not like they can order up some more. And considering the problems with the F-35s, those F-22s are some of the only capable 5th-gen fighters we're likely to have for a longggggggg time.

(I understand that most of the places were apparently evacuated, but it's tough to swallow any significant loss of those very expensive pieces of hardware due to inadequate planning)

<comment><USER7> > due to inadequate planning

Seeing as you've had the opportunity to thoroughly evaluate Tyndall's emergency hurricane evacuation procedures, the airworthiness of 55 aircraft divided between two squadrons, O&M/MILCON budget of a training base, and logistical impediments arising from 72-hours notice coupled with a swarm of evacuating civilians from surrounding areas, please do take the time to enlighten us all.

<comment><USER31> What are you saying here?

Are you saying that their plans were adequate? Clearly they weren't; they lost at least a handful of irreplaceable planes.

Or are you saying that there was just no way to predict or prepare for a hurricane hitting an airbase right in the middle of hurricane country? I mean, a lot of hurricanes roll through that part of the country.

        the airworthiness of 55 aircraft divided between two squadrons,

My "evaluation" is what the article says. Namely, that the planes left behind weren't airworthy. If you know otherwise, let's hear it.

I'm no military brain genius, but it seems obvious to me that at any given time less than 100% of the planes at any given airbase would be airworthy and that perhaps some provision should be made for sheltering or evacuating these planes if a hurricane rolls through this base which, again, is located in a very hurricane-prone region.

        O&M/MILCON budget of a training base

I'd think that the cost of making sure you don't lose a billion dollars worth of fighters every time a hurricane rolls through a hurricane-prone area probably costs less than, I don't know, a billion dollars.

<comment><USER7> That you've summarily dismissed the efficacy of planning for which you know precisely _zero_ of is baffling.

That you presume to parade your decision making as superior to the dozens of career field officers and senior enlisted members with real skin in the game-- let alone the hundreds preceeding them who have _earned_ their keep--is even more baffling.

That you continually insist $1bil in F-22 assets was lost to this hurricane is quite telling of both blatant ignorance and inexperience in matters relating to military aircraft maintenance operations.

Admittedly, I'm rather insulted by the magnitude of sheer narcissism and narrow-minded hubris in your remarks.

<comment><USER31> Let me back up a step.

I angrily said "these idiots" as if everybody involved was an idiot.

What I should have acknowledged is that the folks on that base are insanely talented (I know enough about the military to know that the folks trusted with these aircraft are very elite) and in all likelihood pulled off a freaking miracle to save as much hardware as they did with (more importantly) zero loss of life. I have no doubt that they spent 72 hours stretched to their limits and performed admirably.

Whatever else we disagree on, at least we agree on that.

What I am angry at is the design of a base that had inadequate structures and/or procedures in place to enable those assets to be fully protected and/or evacuated in the event of a hurricane. Clearly those (or the budget allocated) were not adequate to fully handle the situation. The results attest to that.

<comment><USER11> This was the most powerful hurricane to hit the Florida panhandle in recorded history. The base has withstood previous hurricanes and storms. So yeah, the structures were inadequate to protect some of the planes from the storm of the century (or two?) but should we expect or desire the base to withstand that? Of the dozen planes left behind so far only four are suspected to have been destroyed and even that isn't actually known yet. It is still possible the base did protect the planes at least in part from this extreme outlier event.

The lifespan of the planes is only ~30 years. Losing a few of them to a total freak storm doesn't seem as outrageous as you are making it out to be, especially when much more of the fleet was evacuated than should be expected based on typical readiness.

You're acting like the USAF had no hurricane plan at all when in reality they obviously did. Not all the F-22s were lost and a bunch of the other assets made it out too.

</comment></comment></comment></comment></comment></comment><comment><USER32> Does that $1b replacement cost include the cost of restarting the f22 assembly line?

</comment><comment><USER33> One cannot put an F-22 on a truck and drive it to safety?

<comment><USER11> Not if all the trucks are busy moving other assets.

<comment><USER34> And particularly on 72h notice.

</comment></comment></comment><comment><USER35> Karma.

</comment><comment><USER36> There's many billions more dollars where that came from.

</comment><comment><USER37> Since this amount of money lost isn't outrageous to the Air Force, what was keeping them from moving the planes we paid for, and spending the ~billion dollars on us and our pursuit of happiness, liberty, and life?

<comment><USER38> From the article: "The F-22s left behind could not fly for either mechanical or safety reasons, said a spokeswoman, who also said all the hangars on base were damaged."

<comment><USER39> Can't those airplanes be moved / evacuated by ground?

<comment><USER11> In a word, no. F-22s are huge. Time and trucks are limited.

<comment><USER22> Could they possibly have thought ahead a little more? Is this the first time a storm hit the area or something?</comment></comment></comment></comment></comment>


BlockSci: A high-performance tool for blockchain science and exploration - <AUTHOR> https://github.com/citp/BlockSci <comment><AUTHOR> BlockSci is an academic research project at Princeton, but we're committed to maintaining it as open-source software, and we hope it's more broadly useful. If you're interested in using it or contributing to it, here's a list of ideas that we'd love to see implemented.

1\. Create a Block Explorer. BlockSci would make a good backend for a block explorer website, because it would benefit from the built-in analysis library, with features like address clustering and parsing multisignature scripts.

2\. Support more blockchains. BlockSci supports several blockchains, but there are limitations detailed in the paper [1]. For example, currently we don't support any script operations not found in Bitcoin. Supporting more altcoins/blockchains would make BlockSci more useful.

3\. Identify cold wallets and associated usage patterns. Cold wallet addresses could be identified by various patterns on the blockchain such as infrequent large withdrawals. After identifying these addresses, there are many interesting questions to ask such as studying the rate of deposits vs withdrawals.

4\. Improve clustering heuristics. BlockSci's address linking is based on the two heuristics from the Fistful of Bitcoins paper [2]. These heuristics have known limitations, leading to false positives and negatives; there's a lot of room for improvement here.

5\. Extract hidden messages. There are many messages encoded into the Bitcoin blockchain ranging from Wikileaks cables to Rickrolls [3]. We can find them if we can guess how they are encoded. But can we automatically extract and decode these hidden messages, say, by looking for address strings that look non- random?

[1] [https://arxiv.org/pdf/1709.02489.pdf](https://arxiv.org/pdf/1709.02489.pdf)

[2] [https://cseweb.ucsd.edu/~smeiklejohn/files/imc13.pdf](https://cseweb.ucsd.edu/~smeiklejohn/files/imc13.pdf)

[3] [http://www.righto.com/2014/02/ascii-bernanke-wikileaks- photo...](http://www.righto.com/2014/02/ascii-bernanke-wikileaks- photographs.html)

<comment><USER2> Is the underlying data updated in realtime?

<comment><USER3> One of the authors here. It can be used for realtime analysis. The data is updated using a parser program which performs incremental updates. Adding a single block is extremely rapid. Running this repeatedly (for instance using a cron job) will keep the data up to date. I'm planning on adding a daemon mode in the next version to simplify the process of live updates.

</comment></comment></comment><comment><USER4> Does Blocksci allow one to test out new consensus algorithms as well ? Especially nuances like proof of work vs proof of stake ?

How much of overlap is there with tools like Jepsen (e.g [https://github.com/jepsen- io/tendermint/blob/master/README.m...](https://github.com/jepsen- io/tendermint/blob/master/README.md))

<comment><USER3> BlockSci is purely targeted at providing an easy and efficient method of asking questions about existing blockchains. BlockSci can certainly be used to study Bitcoin's testnet as well as blockchains created in Bitcoin's regtest mode. However BlockSci provides no ability to simulate protocol modifications since it depends on importing data from existing full node software.

</comment></comment><comment><USER5> At first I thought this was some sort of combo Sci-Hub meets Blockchain, where journal articles were inserted into the chain as a timestamp of release as well as circumvention of censorship.

</comment><comment><USER6> That sounds like an oxymoron. Signing folders is hardly interesting.</comment>


New Android malware uses Google Play icon, conducts DDoS attacks and more - <AUTHOR> http://thenextweb.com/google/2012/12/27/new-android-malware-uses-google-play-icon-to-trick-users-conduct-ddos-attacks-and-send-spam-texts/

<comment><USER2> I've worked for a few months investigating malware on mobile platforms(Android specifically) so this is interesting to me. Interesting because most DDOS threats from botnets on mobiles weren't a big deal since the platforms were so limited. Now the technology is catching up(quad core phones!) but you'd need a LOT of zombies to damage a network using just phones.

Though I suspect like previous botnets before it, this would be used to steal information such as bank OTPs or the like.

This is a very hot topic for research right now.

</comment><comment><USER3> Blogspam FUD mongering.</comment>


New Mac Defender malware variant drops admin password requirement - <AUTHOR> http://arstechnica.com/apple/news/2011/05/new-mac-defender-malware-variant-drops-admin-password-requirement.ars <comment><USER2> _Since any user can install software in the Applications folder, a password is not needed," Intego wrote on its blog._

Any _admin_ user. Yet another reason to setup a separate admin user and make your daily account non-admin.

edit - the original blog post has it correct:

 _Since any user with an administrator's account – the default if there is just one user on a Mac – can install software in the Applications folder, a password is not needed_

Either way though, you still have to click your way through the installer. It doesn't get installed invisibly.

<comment><USER3> >Either way though, you still have to click your way through the installer.

So just replace the installer with any other executable that can install to Applications and provoke the user into launching it?

<comment><USER4> I don't think a non-installer bundle executable will be interpreted as LSRiskCategorySafe, so the user would have to manually launch it and click through the untrusted executable warning.

Really Safari just needs to ditch the concept of "safe" file-types in the first place.

</comment></comment></comment><comment><USER5> If you look at the removal process in the support document from Apple it doesn't really look all that bad: <http://support.apple.com/kb/HT4650>

Just kill the process and delete the .app file. Compared to Windows malware this is a breeze to remove.

<comment><USER6> I am sure the next ones will not be as hard to get rid of.

<comment><USER7> since this one is easy to remove, I am assuming you meant to say 'as easy to get rid of.'

<comment><USER6> (Slaps forehead) Damn, yeah that is what I meant. This is a problem that will probably get worse.

</comment></comment></comment></comment><comment><USER8> With the erosion in Windows' market share and the increased use of Macs, it was a matter of time before Macs became a target for malware. Based on what happened with Windows and its base of "gullible" users, can't say that one couldn't see this coming. Apple will have to take a close look at securing the desktop against threats that play on their users's lack of sophistication when it comes to computers. It will be interesting to see whether they choose to go the Windows way with more warning boxes and lower ease of use, or find a different way.

<comment><USER9> My guess? Maybe more warning boxes for software downloaded from the web but their priority will be making the Mac App Store the place to go for software for all their users (no warning boxes there and overall a seamless experience).

I do not believe that Apple will stop users from installing software they didn't get from the App Store. There is just too much legacy software out there and it is doubtful whether Adobe and Microsoft (both crucial for the continued success of the Mac) will ever move to the App Store, even if pressured.

The Mac App Store is inherently more secure (or is the right word 'safer'?)†, that's where Apple wants people to get their software.

†I do not argue that there will never be malware in the Mac App Store.

<comment><USER10> _I do not believe that Apple will stop users from installing software they didn't get from the App Store. There is just too much legacy software out there_

Apple is very good about ignoring legacy software. 6 years ago 100% of Mac software was built for PowerPC, and as of Lion none of that software will run. I can easily see them prohibiting non-store apps once developers have had a few years to make the transition.

 _it is doubtful whether Adobe and Microsoft (both crucial for the continued success of the Mac) will ever move to the App Store, even if pressured._

Why wouldn't they? Apple would certainly be willing to give them a break on the 30% fee if needed.

</comment></comment></comment><comment><USER11> Well, looks like it just officially became a "real" trojan. On that note, turn off "automatically open safe files" in Safari, and use Chrome or Firefox instead anyway.

</comment><comment><USER12> Tangentially, I wonder if Mac users, as malware victims, are bigger buyers. Will a Mac user (typically higher educated and higher paid than an average Windows user) spend more money on average than victims of attacks on other OSs.</comment>


Deep JavaScript: Theory and Techniques - <AUTHOR> https://exploringjs.com/deep-js/ <comment><USER2> Have you seen that Flanagan's JavaScript the Definitive Guide, the famously big book with the rhinoceros on its cover, has recently seen a new edition? I wonder how deep its JavaScript goes :-)

([https://www.amazon.co.uk/JavaScript-Definitive-Guide- David-F...](https://www.amazon.co.uk/JavaScript-Definitive-Guide-David- Flanagan/dp/1491952024))

<comment><USER3> David has written about what's new, if anyone's interested: [https://davidflanagan.com/2020/05/03/changes-in-the- seventh-...](https://davidflanagan.com/2020/05/03/changes-in-the-seventh- edition.html)

I also (briefly) interviewed him about it here: [https://superhighway.dev/david-flanagan- interview](https://superhighway.dev/david-flanagan-interview)

<comment><USER4> No PDF version?

</comment></comment></comment><comment><USER5> I've never heard of object sealing or freezing, glancing at the Table of Contents. JavaScript keeps surprising me.

      // Levels of protection: preventing extensions, sealing, freezing
      Object.preventExtensions(obj)
      Object.seal(obj)
      Object.freeze(obj)

<comment><USER6> From using immer[1], I learned about Object.freeze(), which immer uses under the hood.

[1] [https://github.com/immerjs/immer](https://github.com/immerjs/immer)

<comment><USER7> Though I recommend to my team to avoid mutation if at all possible, there are times which I have found immer absolutely invaluable. Try spreading out an object 15 levels deep to replace a single property value and you'll catch my drift.

<comment><USER8> My biggest challenge with immer has been that my code aesthetic taste leans functional, but immer makes code look imperative even if it is ultimately functional. Always looks a little wrong to my eye!

<comment><USER9> Writing old-style pure code to do changes in a deeply nested structure is cumbersome, both to write and read. Eventually every language will find nicer ways to allow programmers to express these mutations.

JavaScript doesn't provide a nice way to extend the language syntax, unlike some other programming languages. So most DSLs end up looking like imperative code but do pure mutations underneath. I understand, for the reader it's confusing, because unless you know that it's a DSL you never know whether the mutations are pure or not.

Compare that with Haskell, with its support for custom operators, allows for some quite succinct code to express deep mutations (cf. lens library)

</comment></comment></comment></comment></comment><comment><USER10> This looks like it's worth a place in an electronic bookshelf. Among other things, following a link in the contents led me to this little pearl: [https://mathiasbynens.be/notes/globalthis](https://mathiasbynens.be/notes/globalthis)

<comment> ezequiel-garzon He's great! Consider [https://mothereff.in/ampersands](https://mothereff.in/ampersands)

</comment></comment><comment><USER11> Love this!

Some languages are typically taught in introductory programming courses - it's a very deliberate process aimed at explaining concepts from the ground up. JS is the opposite, people mostly learn it top-down, doing web development and being forced to use it.

And like eager college graduates need to learn it's sometimes a waste of time to optimize an algorithm, DIY JS devs can greatly benefit from a bit of theory and technical depth. Resources like this are perfect for that.

I can also wholeheartedly recommend Kyle Simpson's You Don't Know JS.

</comment><comment><USER12> One of the things I love about JavaScript is that you can write an almost 10x faster hash table than the standard library if you take care of cache misses and GC: [https://github.com/ronomon/hash- table#motivation](https://github.com/ronomon/hash-table#motivation)

In fact, all the usual low-level optimization techniques like reducing branch mispredictions and expensive memory accesses apply, and make a huge difference, even though you're writing in a high-level language.

<comment><USER13> I do appreciate the effort the author put into that library and obviously performance is important.

However, JS doesn't primarily live in the server side world, it mostly lives in the browser world. And in the browsers, you _rarely_ do heavy processing. If you are, you're doing it wrong - that logic needs to live on the server.

You're also doing it wrong in you are relying on server side NodeJS for tasks that involve heavy duty computations.

Still, interesting to know. I wonder if the author can make this repo a proposal to the TC39 committee.

<comment><USER14> I consider this wrong on all counts and I don't see where you're coming from to make these claims. You obviously benefit from performance gains on the server and client in standard use-cases.

A Node.js server's main thread is nickel and dimed by a thousand little cuts. A faster hash implementation can reduce loop delay by a nontrivial amount. This isn't heavy processing.

Same with the client. Any sort of game could have a good reason to be doing hashtable lookups in a hot loop on the client. This isn't heavy processing in some exotic use-case, it's rather elementary. And perf trade-offs especially help slow clients. And freeing up the main thread lets you fit in more nonreducible cycles.

Also, moving work to the server because your client implementation is too slow and then generalizing that to "always do work on the server", is tautological. Where you do work is fundamentally a business logic / product design concern that is only a performance concern in the suboptimal case where you can't fit the work on the server or client. So faster implementations move what are performance concerns back into the realm of higher level product design decisions.

These aren't symptoms of "doing it wrong". This is just plain jane software engineering.

<comment><USER12> > This is just plain jane software engineering.

Thanks, love this quote!

</comment></comment></comment></comment><comment><USER15> Disappointed not to see a dead-tree version.

</comment><comment><USER16> A few bits of deep JavaScript that I've learned from _Deep JavaScript_ :

– The % operator calculates the remainder, not the modulus, which makes difference for negative numbers.

– Constructors can return a Promise.

– Function names are stored as the .name property.

</comment><comment> seph-reed I just think this is interesting. The following statement is true:

`(~~4.2 === 4) && (~~-3.5 === -3)`

<comment><USER17> Isn't `true` the expected result? Apart from that, who would write code like this?

<comment><USER5> Antagonistic JavaScript code golfers typically are not JavaScript users, I've found.

edit: It's like writing an intentional buffer overflow in C. You don't see it as often because it requires actually knowing how to program.

<comment><USER17> The thing is, the result above is not even specific to JavaScript (in PHP for example it also returns `true`), and it makes a lot of sense if you know what the bitwise operators do.</comment></comment></comment></comment>


An easy way to protect and transfer their confidential data – Crymer - <AUTHOR> http://crymer.com/ <comment><AUTHOR> We made a big update. Now you can decrypt files in one click, open and edit them without decryption. Giving access to them remotely. We will be glad if you test our work. Thank you.</comment>