Could Ruby be Apple's language and API future? - <AUTHOR> http://parveenkaler.com/2010/06/30/could-ruby-be-apples-language-and-api-future-3/

<comment><USER2> I've heard people suggest this before, but Apple doesn't seem to feel the same way. Ruby (even MacRuby) is banned on the iPhone along with every other language that isn't C or Javascript. Apple plays things close to the chest, but banning a language that you intend to base the whole platform around just doesn't make sense.

Syracusa isn't wrong that Objective-C is getting long in the tooth, but Apple has shown more interest in incrementally improving Objective-C than replacing it.

<comment><USER3> Yeah,

Also, it seems a bit ironic for whoever is developing MacRuby. You're donating labor to a company that gives nothing away for free or even cheap. Then they ban you. Makes you think ... perhaps you should target Ubuntu next time...

<comment><USER4> I believe MacRuby is developed primarily by Apple employees.

<comment><USER3> I guess that's an explanation...

</comment></comment></comment></comment><comment><USER5> > _The Dalvik virtual machine that ships with Android interprets byte code. A > byte code interpreter has a few advantages over a stack that runs native > code. Performance is not one of those advantages._

This is a cheap shot.

First of all, when building a JIT or a tracing compiler, it's always better to start with an efficient interpreter ... and for all intents and purposes, Android has a kickass interpreter.

Then you can add incremental improvements ... like JITing, or various tricks to optimize dynamic code paths. And this is where Android is today ... the latest version comes with a JITter that will only get better.

What an efficient VM truly allows is for regular programmers to write efficient code without thinking much about optimizations. So most applications can benefit from a good VM precisely in terms of performance.

I've also seen rewritten C++ apps in Java that ran faster, for many reasons, one of them being that you have the power to think about architectural optimizations without getting lost in little details.

And one other thing ... a mobile phone doesn't have the resources (like RAM) to shove in it too many optimizations, but on the other hand you can built specialized CPUs optimized for Android's bytecode.

If you do that, the "stack that runs native code" can eat your dust.

<comment><USER6> I am quite interested in the topic of java vs C++ and java vs C performance. Do you have specific examples that I can run down?

</comment></comment><comment><USER7> I dont see any concrete evidence that suggests Apples shift from Objective C in the linked article. Can you point to specific information that points to such a move. fyi pypy has a LLVM backend, as does haskell, I believe python is supported in Xcode too. Hence a similar article could have been written about Apple moving to python.

<comment><USER8> Apple is sponsoring the development of MacRuby. It's not sponsoring pypy or Haskell LLVM backends.

<comment><USER9> Just because they "sponsor" MacRuby doesn't mean they favor ruby as a replacement for Objective-C. Until ruby is as fast as Objective-C, I see no reason they would make such a change. Low performance languages have never gained serious adoption on embedded platforms, which includes _everything that has made Apple, Inc (not Computer) successful_.

Maybe I'm a non-believer, but I also don't see any benefit to Apple supporting ruby specifically. If they were to have a higher-than-objc level API, I expect it to be an LLVM API which would be compatible with languages with an LLVM backend.

<comment><USER10> Measuring and comparing the "fastness" of a language is a tricky thing in general, but I think it is safe to say that for most intents an purposes we can consider MacRuby just _as fast as_ Objective-C. The point you seem to be missing is that both run on top of the same runtime and both use the same foundational classes. So the same operation performed on a MacRuby String and Objective-C NSString should take exactly the same amount of time.

The only thing that prevents MacRuby from being fully compatible with Apple's "embedded platforms" is the lack of garbage collector on said platforms. By the time MacRuby is sufficiently stable and optimized Apple's portable devices will be capable of comfortably running memory managed code.

As for the "LLVM API", for one, I don't really understand how is that supposed to work - there is no "native" LLVM language and so on; for two, such an API will be lower-than-objc, not higher; and for three, reimplementing Cocoa and CocoaTouch as some new supposedly more abstract (whatever that's supposed to mean) API is going to be a monumental and almost certainly very disruptive task - and all of it for no good reason.

A lot of the comments, I'd say yours included, seem to be coming from the presumption that Apple's adoption of a higher level than Objective-C language is inevitably going to be a huge overnight change. But the beauty and genius of MacRuby is precisely that it does not require a huge overnight change. You can mix and match Ruby and Objective-C as you need or like. You can write high level, terse code using the HotCocoa wrapper or you can fall down to the nitty-gritty OS X C APIs, for a good number of which there are MacRuby bindings.

<comment><USER5> > _I think it is safe to say that for most intents an purposes we can consider > MacRuby just as fast as Objective-C_

It isn't. MacRuby is much more dynamic than the dynamic part of Obj-C, not taking into account that Obj-C really is a superset of C.

</comment></comment></comment></comment></comment><comment><USER11> I can't really see Apple doing this, if for no other reason than Objective-C is something they can control, and Ruby isn't. If the core Ruby developers decide they want to add more features, change the language's underpinnings, etc. Apple's left to play catch-up. If Apple wants to add features, then they basically have to fork the language and hope their changes get merged in.

Apple's shown (and been shown) how much of a benefit it is to control your own destiny; even with Ruby being open-source, it's still an outside influence they have to work with or against. Objective-C, for all intents and purposes, is their language, one they can take in any direction they want.

<comment><USER12> So? Apple didn't control GCC, either, when they built OS X on top of it.

<comment><USER13> Yet Apple is doing everything they can to make themselves independent of GCC.

<http://en.wikipedia.org/wiki/Clang>

</comment></comment></comment><comment><USER14> This would be all kinds of awesome, but I think it's probably a dream. To leap from ObjC to Ruby would be a absolutely massive undertaking for them.

That said, they've pulled off crazier shit before.

<comment><USER12> Not at all. Given that they're both dynamic programming languages with runtime dispatch, there's really little impedance mismatch between Ruby and Objective-C. Thus MacRuby, a Ruby implementation that encapsulates Objective-C objects and messages in Ruby objects and methods. Cocoa in Ruby without a bridge -- it's already there, it's a done deal.

Now as for whether they'd _replace_ Objective-C with MacRuby, no, that wouldn't make sense. The two would live side by side. Apple can continue to implement Cocoa frameworks and core applications in Objective-C while also offering an excellent Ruby programming environment built on top of that.

It's sort of like C# vs. F# or IronPython in the .NET world -- Microsoft didn't have to replace the base .NET assembly implementation language (a.k.a. "assembly language for CLR") in order to provide more attractive dynamic or functional languages on top of the same infrastructure.

EDIT: In fact, the semantic mismatch between Objective-C and dynamic languages like Ruby is less than the mismatch between dynamic languages and the CLR, which mirrors the statically-typed semantics of C#. Is Apple's combination of the Objective-C type and dispatch systems and LLVM going to one-up .NET from a direction that we didn't see coming?

<comment><USER15> Having used both Objective-C and .NET, I would much rather be faced with implementing a dynamic language atop .NET than have to do so atop Objective-C. While ObjC's dispatch system is quite dynamic, the relative weakness of the type system (if you can even call what ObjC has a 'type' system) and the amount of C baggage it drags along with it makes it a rather unfriendly environment for running dynamic code.

Here's one example: With the .NET type system, you can check a set of arguments against the signature of a method defined in the type information of an object instance, which means that you can be absolutely certain that your invocation will succeed without corrupting state or returning incorrect results. What's more, you can do this check at compile time (in a static language, like C#) or at run time, via reflection. The .NET JIT and runtime code generation facilities mean that you can do 'static' verification at load time for scripts instead of at the point of every invocation. In cases where you have a mismatch between the types requested and the types provided, you get clear, precise error feedback that allows the problem to be corrected. The .NET runtime is able to use this type system to perform a large number of useful safety checks against all code when it's first loaded, so that in many cases it can guarantee no memory corruption or out-of-bounds accesses will occur _without_ having to check every single operation.

As the vast majority of Objective C invocations in a Cocoa application are effectively static (you're sending a message, as described in the Apple documentation, to an object of a given interface, as described in the Apple documentation, which you constructed following instructions in the Apple documentation), the dynamic nature of ObjC invocation wins you very little. The ObjC type system cannot provide you much assistance for those invocations, because it's built atop the C type system - GCC will check your argument types for you statically at compile time, but at run time, given an arbitrary ObjC object, it's going to be quite difficult to be certain that an invocation will succeed. What's more, in most cases GCC can provide no more than warnings, and those warnings are often incorrect.

On the other hand, for the vast majority of code written in a language like Ruby or Python, your method signatures contain no type information, so no validation can be performed. Neither Objective C or .NET win here because both require strong types for arguments. You need only look at NSArray to see how little you win by using Objective C in this case.

Ultimately, in both cases, neither environment is a good fit for a language like Ruby, but I would argue that .NET (and, for similar reasons, the JVM) provides a far stronger foundation upon which to build a language like Ruby. Building a language like Ruby on top of Objective C is only superior to building it in C due to its status as Apple's preferred language for OS X development.

<comment><USER16> OK, but it's already implemented: <http://www.macruby.org>

</comment></comment></comment></comment><comment><USER17> I think there are two big reasons that Ruby isn't on the iPhone. For one, MacRuby is still in development and isn't stable yet. For another, the Objective-C GC isn't running on the iPhone, which is what MacRuby uses. As the project matures and the iPhone gets better hardware, I think Ruby will start to show up on it.

</comment><comment><USER18> You really can't avoid native execution if you want to really push the frontiers on these devices. And because these are such small devices even lone developers can really push boundaries and make money and a name for themselves. But the second you start blindly "optimizing" their products, bad things happen in spades.

In my opinion implementing a VM purpose built for a specific language spec is, was, and ever shall be a mistake. Sun was wrong to do it with the original JVMs. In this regard at the very least Dalvik is ahead of the game. The problem of course is, however, that implementing any VM at all on an embedded device results in crap performance from all apps executing through it. The reason Apple chose to remove multitasking and force C# down people's throats was simply because it's the only way to develop an application that is sturdy and fast on an embedded device today. Claiming it frees the developer from having to optimize their code betrays your ignorance of developing on embedded devices.

</comment><comment><USER19> Yes! This is so obvious to me. Why would they even bother with MacRuby if this wasn't the future of iOS development? What would bring more developers to iOS than a rapidly growing language that you can learn and apply to multiple platforms, and also to arguably the best web development environment out there? Objective C's message-passing is extremely compatible with Ruby. A high-performance, pre-installed, officially-supported Ruby implementation would be a huge edge over the drudgery of Java on the Android platform!

Yes, I am aware of Ruboto, but there is going to have to be some serious wrapping of the very extensive Android APIs to make them palatable to Ruby developers.

</comment><comment><USER12> MacRuby apparently performs quite well, at least in this stage of its development. What would be really interesting is if this translates into real- world Rails/Sinatra/whatever performance gains significant enough to create demand for OS X hosting...

</comment><comment><USER20> speaking as someone who wuvs Python and dislikes both Ruby and Objective-C I hope the answer is no :)

<comment><USER21> Unlike (I suspect) a lot of people here I don't mind Objective-C and I really dislike Ruby.

Would this effect my decision as to whether I develop for the iOS/OSX platform. No of course not.

At the end of the day I actually dislike all languages, just to varying degrees. Python is the one I dislike the least. As soon as I can get my programming job done without the need for programming I will do it.

</comment></comment><comment><USER22> Unlike many of the other commentators, this seem feasible enough, given another year or so and some progress in terms of performance and the API.

I think it'd be great to have the option to write Mac apps in Ruby instead of in Obj-C, and it seems rather Apple-like to be the first to having a language like Ruby be a primary/supported system language. Wouldn't mind seeing a Lisp there instead, but Ruby's a bit of the way there, at least!

</comment><comment><USER9> If Apple cared about having a more friendly API language, they wouldn't have deprecated the Java bridge: [<http://cocoadevcentral.com/articles/000024.php>]

The only languages Apple has ever expressed a preference for are Pascal, C, Objective-C, C++, and JavaScript. Why would they add ruby when they already have JavaScript?

<comment><USER23> Once upon a time Java was a "co-equal" with its own colored box. But Apple's been pretty mercurial when it comes to languages: Clascal, Object Pascal, AppleScript, ScriptX, SK8, NewtonScript, HyperTalk, Dylan, MCL, {AppleSoft|Integer|Mac} Basic, Smalltalk, Java, Corba IDL... most of those are way more friendly than Java, but died just like desktop Java. MacRuby's a little different, I'm guessing it's a research project to see what might be compelling about a unified, llvm-based, multiple-language runtime.

</comment></comment><comment><USER24> I believe Obj-C will always be what Apple build their API frameworks. But it is possible that MacRuby will be an option in future for programming on iOS like it is on Mac OSX.

When I heard of MacRuby, I had this immediate crazy thought that Apple choose Ruby to piss off Google :-) You know Apple vs Google and Ruby vs Python, and Google is basically a Python house.

<comment><USER25> _Google is basically a Python house_

Google is basically a C++, Java, Python and Javascript shop :) ref: <http://steve-yegge.blogspot.com/2007/06/rhino-on-rails.html>

Be interesting to see if _Go_ sneaks into that list.

</comment></comment><comment><USER26> They just took a big hit in the nerd press for banning twenty years' progress in programming language design. I think they want an iOS development process painful enough that only committed specialists (who double as evangelists) can manage to ship, because everyone else would tend to write portable code that runs on competing platforms.

</comment><comment><USER27> This article seems very very speculative. For instance, I don't think the blocks implementation in ObjC is adequate as a _full_ closure implementation. It certainly looks like Apple is trying to improve the language while continuing to remain "close to the metal" using C without the need for bridges.

</comment><comment><USER28> Nah, I think Apple has already chosen JavaScript. Don't forget, Apple actually spearheaded the HTML5 movement...

<comment><USER29> > Apple actually spearheaded the HTML5 movement...

Hahaha, that was good. =)

<comment><USER28> good and _true_ , html5/css3 innovation started with Apple's work on webkit.

</comment></comment></comment><comment><USER30> I live in Cork, Ireland, location of Apple's European Corporate HQ, and I know from friends that they've been running Ruby on Rails courses there. It might be inconsequential, but you have to ask yourself why? ... it shows at least that they consider Ruby, and Rails to be significant in some way.

<comment><USER31> indeed. especially as people inside apple have already built web apps using RoR in the past. one that comes to mind is the application they use for enterprise managing lots of iphones (i can no longer find it, but i assume it's still around)

</comment></comment><comment><USER32> It seems extremely unlikely that Ruby will _displace_ ObjC. I can imagine that it will become the blessed _scripting_ language for the Mac, in something like the way that Visual Basic has been for Windows.

Either way I'm glad to see Apple's support behind Ruby.

</comment><comment><USER33> Hardly, Apple need a compiled language for its mobile platform that does not do managed memory. But it may replace applescript.

</comment><comment><USER34> Answer: No.

MacRuby is awesome, but it'll likely eventually suffer the same fate as the Java Bridge.

<comment><USER35> No, that's probably wrong. With MacRuby, bridging is toll-free, and, as others have noted already, there is a much lower impedance mismatch between ruby and objective c than there was between java and objective c. Apple has improved the support for scripting languages over the years with the introduction of the scriptingbridge framework. These days, you can easily write an app on the mac in either ruby or python, the only constraint is that things become a mess if ever raw c structs are exposed by the cocoa api (and yes, there are still a few places where this is the case), or worse still when there is no cocoa api for a particular framework. Still, even in these cases there us some support in the scripting bridge framework, although my personal preference for this type of problem is just to wrap the c code in an objective c wrapper class before using the wrapper class from within MacRuby. Works like a charm!

</comment></comment><comment><USER36> Ruby may at some point be an optional language but it's not going to replace Objective-C.

</comment><comment><USER37> The world isn't ready for iPhone on Rails.

<comment><USER38> Yes, but isn't Rails one of the best ways to quickly deliver iPhone web apps?

</comment></comment><comment><USER39> It would be cool if they will sponsor some effort to marry ruby and llvm. ^_^

<comment><USER40> You mean like MacRuby, say?

<comment><USER39> Did they already replace Matz MRI to LLVM-based one which can pass all ruby- spec? ^_^

<comment><USER2> The original interpreter is already replaced with YARV in 1.9. But yes, MacRuby replaces YARV with an LLVM-based virtual machine. (Only passes about 85% of RubySpec right now, though.)

Incidentally, Rubinius is also based on LLVM these days.

<comment><USER39> Such a fundamental changes like unladen swallow in python or migrating to LLVM-based VM in ruby must be backed by very powerful and resourceful entity. Good news!

</comment></comment></comment></comment></comment><comment><USER41> Ruby is an impractical language so, no.</comment>


Ask HN: Does religion have a future - <AUTHOR> After watching the recent star trek movie I realized that the science fiction movies have altogether kind of agreed that there is no religion in future except in cases of some distant planets with Paganism.<p>There is no Church/Mosque/Temples anymore :)
Very rarely do we see the remain of Mexican Aztec culture but no Christianity or Islam (for that matter any other major religion) <comment><USER2> That simply isn't true tho'. The biggest and most famous franchise of all, _Star Wars_ , is heavily religious, the very first film states it openly. So is the best recent sci-fi series _Battlestar Galactica_. A main character of _Firefly_ is a preacher.

Even in _Star Trek_ the Vulcans spend an awful lot of time contemplating candles and wearing robes. They may not talk about it on-screen but the producers must have consciously chosen to use monastic/Catholic imagery.

</comment><comment><USER3> Belief in a higher power has been around since the dawn of time. There are as many religious people in the world as ever. Decrease in the west? Yes. Increase in the east? Yes. Faith has survived thousands of years of innovation, so it's a bit of generational arrogance (possibly coming from your particular western enlightenment reddit-reading background ;o) to think that we're finally outgrowing God.

Nietzsche declared God dead a hundred years ago and since then religion has been booming in china, africa, south america, et al. Of course, maybe those poor dumb people will be rich and educated like us someday. :-/

<comment><AUTHOR> your statement kind of reflecting what I am trying to say. I am from East and not West.

I am referring here to religion and not to God. Religions like Christianity and its institutions like church are so much based on Dogma that can not stand reasoning.

Will that vanish with time and scientific progress?

<comment><USER4> Some folks think so, but I don't. For two different reasons.

The first, rational. Some folks think science will overturn religion because (they so casually assume) religion is false, irrational, and inflexible. Well, that's a touch easier to just assume than to actually argue with a live Christian intellectual, isn't it? I find the viewpoint humorously arrogant, and shall return the favor: Christianity will survive because it is not only rational, but also true. Theology and science both love truth, both pursue it through reason, and anything that is true cannot remain the enemy of either one forever.

The second, human nature. Some folks think religion is nothing more than superstition, and easily overturned by education. I think folks might find that foolish if they actually visited a church and tried it; the roots of religion in human nature are an awful lot deeper than that. The need for God, for purpose, for morality, for mythology, is a very deep and universally human thing. Science, for all its practical success, is a pursuit for intellectuals, but the spiritual is universal. For every cold intellectual you show me, I'll show you ten romantics, and maybe even a couple guys who answer both calls.

Christianity has been around for two millenia; Judaism for four or five. Neither is going anywhere soon. Oh, the institutions will change, the names will change, how they actually function may grow close to unrecognizable. But folks will gather for worship and prayer as they always have, and devout mothers will pray over their children as timeless peers. The hot theological debates will be different, but doctrine and scripture that hasn't changed in three or five millienia is not going _anywhere_ in another ten.

It seems fashionable to pronouce religion dead at least once a century, but it's like the old knight said . . . the church of God is an anvil that has worn out many hammers.

</comment></comment></comment><comment><USER5> This is very interesting observation. Over last few centuries we have seen many religions evolving drastically, I guess the far future will have religions but they will evolve in such a way that I and you may not be able to find resemblance between them and todays religion

<comment><AUTHOR> The trend of that evolution is very much on the lines with Darwin's theory of evolution by natural selection.

IF we see the dogma of religion has been defeated by reason and logic over time. But some part of it still exists. Who knows eventually even that will get extinct?

</comment></comment><comment><USER6> Christianity is a very young religion (taking one example). I am certain it wont exist 100's of years in the future (mostly because certain elements wont stand the test of science). But will there be replacements? Religions born out of existing ones or created anew (a bad example: scientology). I imagine there will be.

At the end of the day religion is designed to fill a void: not the unexplained (because that, I think, is to do with faith and belief) but rather because humans constantly seek to hand off their reposnsibility. "It's not my fault I ws told to...". In a group like a religion blame can be spread out. I think society does need these organisations, for better or worse, to function (personally I wish it was different).

Will faith and belief in a higher power exist many hundreds of years in the future? Well I think there will always be those who refuse to believe the findings of science (Im thinking along the lines of young earth creationists). Many of those are due to religious brain washing - but some have actually developed that view through free will. And I dont see that changing. But I do think that faith and belief will focus on different aspects of the unexplained. I t just depends how far our science goes. In thousands of years we should have documented proof of darwin evolution for example. But will we have figured out the big bang? Who knows! :)

SO the simple answer to the question is, I think, yes religion does have a future and yes faith does have a future: but the form it takes is dependant on our scientific progression (a small irony there I feel)

</comment><comment><USER7> There is a believe in some form of a God in Star Trek, for example Picard believes <http://www.youtube.com/watch?v=lNwzawXu4v8> that the afterlife is run by someone/something, just not by Q.

<comment><AUTHOR> My question was not really about the God, but religion and institutions that promote some sort of Dogma.

</comment></comment><comment><USER8> The only hope is evolution. Religion is rooted in the wetware, and resides physically in the brain. As we evolve a percentage of the population is born with ever shrinking god regions in the wetware. Those who cannot feel or understand faith, or do not sense an external force, do not participate in religious commune.

If this mutation is successful, changes in the population will eventually bear out a larger group of mutations, than earlier populations. I definitely believe its a genetic issue and one that will be identified fully in time, as our understanding of the brain evolves.

At some point we may release the baggage of our childhood and move out into the universe that beckons. But, as long as there are more people hell bent on believing the rapture is just around the corner, the less likely I believe our species can survive.

We have technology that can eliminate us, stories in the Bible, Quran, and Torah that predict our demise, and a world full of believers set on seeing it through.

Obviously, this does not add up to a Star Trek ending. Only science can save us. Hopefully, one day they will find this root of all evil and remove it from the population.

Maybe, just maybe, we will last that long.

I doubt it.</comment>


IOS 6 Safari Caching $.ajax Results - <AUTHOR> http://stackoverflow.com/questions/12506897/ios6-safari-caching-ajax-results

<comment><USER2> Two of our iOS apps broke because of this bug. This is a huge breaking issue. Two known workaround: 1.) appending random query value to the request URL and 2.) update the web service to set "Cache-Control: no-cache" in the response headers for POST requests (perhaps this affects PUT and DELETE requests as well).

<comment><USER3> Ran into the same issue today. I'm really surprised that Apple went down this path, as I can only imagine the havoc that it will have wreaked across the web. I know that it's caused some serious issues in our app.

I'm also wondering why this change wasn't announced to developers by Apple more clearly -- I can't find any mention of it in the release notes. [1]

[1] [https://developer.apple.com/library/ios/#releasenotes/Genera...](https://developer.apple.com/library/ios/#releasenotes/General/RN- iOSSDK-6_0/_index.html#//apple_ref/doc/uid/TP40012166)

<comment><USER4> The random query value is probably the best solution. We have had this in our app for years, because it has been an issue in both java and IE for a long time.</comment></comment></comment>


Apply HN: SponsorGigs – Simple platform that connects sponsors with events/people - <AUTHOR> Sponsorgigs helps events or talented people find a sponsor – NO crowdsourcing!
Too many events and people struggle to find a sponsor that would SUIT them (and vice versa). Don't think about SponsorGigs as another crowdsource platform! If you are really passionate about something than you don't want 100 people to donate 5$ for you just for one occasion or just for one event. We want to support all the back alley skaters, the small event organisers, the marathon runners and the first time event creators.
On the other hand we help companies who want to invest their resources. We want to showcase on SponsorGigs thousands of events or talents. The companies can than choose between funding a person or an entire event. To help companies we offer them multiple information (like democratic, amount of attendees, previous success, locations and various insider information).
And we also don't want that somebody or something just gets sponsored. We want a mutual cooperation in a longer run!
We bootstrapped the site (www.sponsorgigs.com) 2 month ago and got already the first results in forms of sponsorships (it's in beta for now). It helps also that we got our own blog (blog.sponsorgigs.com).
About us: 2 guys (mix of full stack developer and business guy). Been in multiple business and created our own. We created SponsorGigs because we had problems finding the right sponsor (as our friends).
Any feedback or question is always very helpful! <comment><USER2> You spend a lot of time talking about what you're not (crowdsourcing) - but I don't fully understand what you are. Ballpark numbers would be really helpful for this.

<comment><AUTHOR> Will try to explain here a bit more. Were the platform where we help amateurs become professionals with sponsors. And where we help connecting the right event with the right sponsor (corporate level sponsorships).</comment></comment>


Ask HN: What Is the "Core" Package? - <AUTHOR> There are so many softwares, languages and frameworks that have the so called "core". This is something that I struggle for a while because to me it's not that clear what should be considered the core. When do we need to create a core package? Do we even need a core package? What should it contain? What do you guys think? <comment><USER2> > What should it contain?

For a given subset of features of a project, would you consider the project broken and unusable if you remove it? If yes, it's part of core, else it's not and can probably be extracted into a separate package.

> When do we need to create a core package? Do we even need a core package?

That depends on the project. I'd make a core package if the project is big enough that you can split it into modular parts that can be extracted without breaking basic functionality. You also have to ask yourself if it's worth it. I think it is when you otherwise have people installing a big package to only use a small part of it.

Well, that's regarding packages and its benefit to users. Having a well- defined core (via packages, modules, source files or directories) is helpful in the sense of making the code easier to understand and modify.

<comment><AUTHOR> Thank you for making a point</comment></comment>


How Vidyard (YC S11) grew from 4K to 1M views a day and achieved negative churn - <AUTHOR> http://blog.perfectaudience.com/2012/11/12/how-vidyard-grew-from-4k-to-1mil-viewsday-in-8-months-has-a-negative-churn-rate/

<comment><USER2> > Currently, the number of Vidyard customers who upgrade their plans outpaces > the number of those who cancel their accounts, Litt said, correlating with a > negative churn rate.

Maybe i have a miss-understanding of churn. But given that definition any startup with growth would have negative churn. I see no difference between upgrading to 'B' or registration with 'B'. Both is revenue. Both creates a customer.

Thanks in advance for any explanation

<comment><USER3> It's a distinction between Revenue Churn and Customer Churn. If customer A cancels their account, it is a loss of 1 account. You can't really have negative customer churn.

Revenue churn would be Customer A cancels their account which was worth $5/month. But if customer B upgrades their existing account by $10/month, you would have negative revenue churn. The negative churn here is negative Revenue churn, ie. upgrades outpace cancelations.

<comment><USER4> The idea of revenue churn is startup biz hype. This is how startups play with numbers to make their business seem better than its really doing. You can't make solid business decisions based on a framework of revenue churn since it hides real business issues. The real issue with churn rate is that you have users leaving the service. If you want to better your business you want to reduce this number and get it as close to 0 as possible. Revenue churn would hide this and make it think you're doing well, when in fact you're not. You could be facing a dwindling user base with just a small number of high paying users.

<comment><USER5> Totally, reminds of the late 90s when companies were reported to move money around in circles to increase revenue. Company A pays B, B pays C, C pays A. Lots of money exchanging hands, zero profit, infinite revenue!

</comment></comment></comment></comment><comment><AUTHOR> Hey folks,

This is part of a series of posts we're doing on our company blog about HOW early stage startups boosted key metrics. The tech press mostly just reports that company X reached some key milestone. We thought it'd be interesting to ask some of these folks how they did it.

We posted the first one to HN a few weeks ago and got a lot of great feedback. [http://blog.perfectaudience.com/2012/11/01/manpacks-grow- cus...](http://blog.perfectaudience.com/2012/11/01/manpacks-grow-customer- base-customer-service/)

The most common request was for more detail so we tried to make with the goods this time around. All feedback welcome on the piece.

And go check out Vidyard if you're doing video stuff.</comment>


Ask HN: Website that Lists All Upcoming Software Development Conferences? - <AUTHOR>

I'm looking for a website that lists most/all of the upcoming software development conferences.  Googling turned up lanyrd.com which (on its software dev section at least http://lanyrd.com/topics/software-development/) seems to be missing the obvious ones I'm interested in like PyCon and NSConf.  I also get a lot of individual conference pages, or pages specific to particular languages/development methodologies.  Is this too broad a query? <comment><USER2> I maintain a list of upcoming developer conferences in this GitHub repo:

[https://github.com/MurtzaM/Developer- Conferences](https://github.com/MurtzaM/Developer-Conferences)</comment>


Ask HN: Do developers also have a block? - <AUTHOR> Writers have Writer block or Artist have artist block ,so in the same way, do developers also have something like code block?<p>If you had one, what were the ways you used for dealing with it? <comment><USER2> Yeah, definitely. Somewhat unintuitively what often helps me is stepping away from the computer. Taking a long break to think without typing, pondering in the shower, or sleeping on it for example.

<comment><USER3> Totally agree. Best way to come over the block is to do something completely different. Give the problem to your unconscious mind and let it do the magic.

Have a long walk, run, shower, sleeping. Read a good book. Do what ever it takes to get your mind out of the code.

</comment></comment><comment><USER4> Certainly. Doesn't happen that often to me anymore to be fair but what usually helps when it happens is going for a walk, leaving work at 6pm and going to the gym, having a good dinner etc. Basically anything that is not work related.

</comment><comment><USER5> I assume you mean ideas of what to work on rather than blocked on a particular problem.

It's hard to this generalize to everyone, but for myself no, never. Actually the opposite. It flows like water and I have many more ideas that I can pursue at once.

I don't start coding them all, rather I'll conduct layers of due dilligence and market research continually trying to separate what's promising from what's a rabbit hole.

I have a whole process to try and make what I work on efficient and good risk/reward. When I was younger I'd just get interested in something and start. No more.

</comment><comment><USER6> Some of the best writers I know think that writer's block is a myth.

Their theory is that if you are experiencing "writer's block", it means you need more ammunition. You need to do more research or thinking on the specific subject you're trying to write about.

<comment><USER7> But that's exactly what writer's block is! A lack of "ammunition" or motivation to write. It can't "not exist" but still "have a fix."

For programming I often come up with inelegant solutions to complex problems. Being unable to think of a more elegant solution is something I could see being referred to as "programmer's block" (I call it "inexperienced").

Sometimes, days or weeks later, I think of an elegant solution to the problem and go back and rewrite the code. Something so blatantly obviously the only way I could have missed it before was due to "programmer's block".

Some days I just don't feel like writing code. I could also see that being referred to as "programmer's block." Especially when it lasts for weeks at a time.

</comment></comment><comment><USER8> Nope, anyone with a block is just someone who hasn't learned how to work. There's two reason for not doing the work.

1\. You don't know what you need to. 2\. You know what you need to do but are lazy and unmotivated.

Neither is a block.</comment>


Spaceglasses: Hacking Reality with Javascript - <AUTHOR> https://www.spaceglasses.com/js_developer

<comment><USER2> I really wish people would stop calling this language JavaScript. It's not. Its proper name is UnityScript, and it's more like Jscript.NET than anything else.

<comment><USER3> I usually don't mind that much when the wrong terminology and naming is used, but this specific case was a disservice for me. I was very confused to see the syntaxe he used, yet calling it JavaScript; I thought they used a modified JS syntaxe, possibly pre-compiling it to the C# equivalent.

</comment></comment><comment><USER4> Does this headset actually deliver? Anybody here try it?

<comment><AUTHOR> I submitted it - so I'm biased - but I've actually tried it, it's pretty crazy how it does the mapping over your body (even things like just tracking your gestures).

<comment><USER5> Would it work well as a complete desktop monitor replacement? How well does it render 18pt text from a HD resolution HDMI source?

<comment><AUTHOR> Not well enough that I'd throw away my monitor, but it's also a gestural control system, etc. so it' not a perfect comparison.

<comment><USER5> Okay, thanks. I'm really looking to throw away my monitor moreso than all the AR stuff.</comment></comment></comment></comment></comment>


European Union Bans Incandescent Light Bulbs  - <AUTHOR> http://redgreenandblue.org/2008/10/11/eu-bans-incandescent-light-bulbs/ <comment><USER2> This is a backhanded attempt at rationing. Unfortunately, its actually even more dangerous than the outright rationing of electricity. There are some applications where a CF simply _won't_ do and a halogen is the best for the job.

If they must ration power, tell me how much power I can use and let _me_ decide whether I'd like 5 CFL's or 1 traditional bulb on at any given time.

Governments are _super_ -lousy at picking technology.</comment>


The Gay Marriages of a Nineteenth-Century Prison Ship - <AUTHOR> https://www.newyorker.com/culture/culture-desk/the-gay-marriages-of-a-nineteenth-century-prison-ship <comment><USER2> Fascinating article.

I can assume that most of these men were not gay, but rather used gay sex as an outlet for pleasure given the hopeless circumstances they were in.

What struck to me most though, is the eventual development of romantic relations where partners would pamper each other with gifts. To me this shows a deeper need for a human connection beyond just sex.

<comment><USER3> > were not gay, but rather used gay sex as an outlet for pleasure given the > hopeless circumstances they were in

MSM behavior is on a spectrum, that moreover encompasses both deprivation- based homosexuality (the kind you get in "hopeless" circumstances with no access to heterosexual relationships) and dominance-based homosexuality (MSM sex as a raw exertion of dominance by one participant towards the other). These sorts of practices need not have much to do with "sexual orientation", as understood today.

In ancient Mediterranean cultures, being a _dominant_ participant in MSM encounters was something "anyone" could do, and was not understood as anything unusual. It was only the submissive partner that was considered highly feminized. This same model shows up in other ancient cultures, e.g. in East Asia. The modern Western understanding where MSM practices boil down to a gay "sexual orientation" that's equally shared by both partners is historically novel.

<comment><USER4> For those of you who also don't know what MSM stands for (Methylsulfonylmethane?):

Men who have Sex with Men

</comment></comment></comment><comment><USER5> I quite enjoy the description of gifts and mutual affection, but nothing in this article is new or surprising -- not sure if I'm more familiar than the average reader with queer history or everybody will feel the same.

It's in general quite astonishing to see how different the view of homosexual relationship is and has been over different cultures. It's not just a binary acceptable/not acceptable difference, but homosexuality has had a different social role in different societies in a way that is difficult to imagine today.

</comment><comment><USER6> There's a rule 34 in porn, but also a rule 34 in history: if it happened, Romans have already done it.

[https://en.m.wikipedia.org/wiki/Pythagoras_(freedman)](https://en.m.wikipedia.org/wiki/Pythagoras_\(freedman\))

<comment><USER7> I've heard that a lot of the crazy stories about Nero were just propaganda. I'm not certain that this is an example, but it definitely feels like propaganda.

<comment><USER8> > Nero, covered with skins of wild animals, was let loose from a cage and > attacked the private parts of men and women bound to stakes

Yikes. Let's hope they were just stories.

<comment><USER3> You could say the same thing about the modern stories of Epstein, Qanon, the supposed secret basement in that pizza place etc. Maybe it was just propaganda, or maybe Nero, Caligula and other Roman emperors were a bit sociopathic to say the least and were drawn to more than just abstract political power.

<comment><USER9> Are you saying Epstein wasn't in the business of pedophilic exploitation involving a number of the global'elite', and that his island wasn't a resort for said activities?

It doesn't seem right to conflate that with Qanon or Pizzagate. It's like comparing critics of a particular Covid-19 policy to flat-earthers.

<comment><USER3> > It doesn't seem right to conflate that with Qanon or Pizzagate. It's like > comparing critics of a particular Covid-19 policy to flat-earthers.

Yes, but the point is that the two cases can be indistinguishable at a distance. We'll probably never know what stories about Roman emperors were at least somewhat factual, and what were just propaganda.

</comment></comment></comment></comment></comment></comment><comment><USER10> Why is this here?

It's completely off topic for HN.

<comment><USER11> See the guidelines[1] which define on/off topic as:

> On-Topic: Anything that good hackers would find interesting. That includes > more than hacking and startups. If you had to reduce it to a sentence, the > answer might be: anything that gratifies one's intellectual curiosity.

> Off-Topic: Most stories about politics, or crime, or sports, unless they're > evidence of some interesting new phenomenon. Videos of pratfalls or > disasters, or cute animal pictures. If they'd cover it on TV news, it's > probably off-topic.

This article did gratify my intellectual curiosity, and I don't think I'd see it on TV news.

[1]: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER12> On-topic guideline essentially allows everything, rendering off-topic guideline moot. Could have been avoided by defining "a good hacker" but that's missing as well :)

<comment><USER13> >Could have been avoided by defining "a good hacker" but that's missing as well :)

Given that it's his site, his forum and his rules, I've always assumed "anything that good hackers would find interesting" loosely correlated to "anything Paul Graham would find interesting."

<comment><USER14> It's usually a measure of similarity to the mods, not pg, i.e. whatever dang thinks is interesting goes, if you are not "a good hacker" like dang - too bad for you. Although I do remember there was a pg article not so long ago that was so dumb and nonsensical it was flagged off the frontpage only to forcefully reappear a few hour later.

<comment><USER13> I don't really mind dang making those sorts of editorial decisions, since it's more or less his job. At least dang seems open to a greater breadth and depth of subject matter than many people's narrow minded view of what should be relevant here.

That said, "good hacker" as a qualifier is as frustratingly elitist as it is maddeningly vague.

<comment><USER15> My interpretation is that "good" is meant to delineate from "bad". E.g. this isn't a forum for sploits, warez and script kiddies. Reading how others interpret this is curious to me, as I joined with zero knowledge of this pg guy and personally tend to weigh his various opinions on merit.</comment></comment></comment></comment></comment></comment></comment>


Why has the search system broken the "Back" button? - <AUTHOR>

The interface to https://hn.algolia.com has changed, again, and now the back button is broken.<p>You're making it more and more annoying with every change. Please, stop it.<p>(No doubt I'm in a minority and everyone else loves it, but I do wonder whether you actually do any user testing, or if you just implement stuff because you think it's cool, and just honestly don't really care.) <comment><USER2> Don't like it either. I added the feedback to [https://news.ycombinator.com/item?id=8912684](https://news.ycombinator.com/item?id=8912684)

</comment><comment><USER3> There is no zooming on mobile. That makes search unusable for me now.

<comment><USER4> I don't understand why mobilephones respect the no zoom thing.

<comment><USER5> Word. If you give webdevs a feature that can be abused to destroy usability, they will destroy usability.

</comment></comment></comment><comment><USER6> Should be fixed now.

<comment><AUTHOR> Thank you.</comment></comment>


SourceLabs looks to tame open-source sprawl - <AUTHOR> http://news.com.com/SourceLabs+looks+to+tame+open-source+sprawl/2100-7344_3-6178793.html <comment><USER2> I can see this having both a positive and a negative effect on open source software. It might help by making it easier for corporations to adopt open source software on a system-wide scale. If SourceLabs gains momentum, however, I can envision open source projects wasting valuable time promoting their software to SourceLabs or knocking on other open source software in order to "prove" that their solution is better. This time would be better spent developing future versions, addressing current bug issues, or any number of other possibilities. Also, the conflict that could arise would not bode well either.

So while I find it to be an interesting initiative, I really hope that the positives and negatives at least offset each other, and hopefully the positive aspects will make the entire project better for the open source community.</comment>


"Stylish" browser extension steals all your internet history - <AUTHOR> https://robertheaton.com/2018/07/02/stylish-browser-extension-steals-your-internet-history/ <comment><USER2> This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this.

I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can imagine what kind of deals are being made when the extension has a million plus users.

When pushed for exactly why they wanted to buy the extensions, which are in no way monetizable, they gave vague answers about "user insights". I can guarantee there will be many other major extensions that have sold out their users.

[1] [https://chrome.google.com/webstore/detail/old-reddit- redirec...](https://chrome.google.com/webstore/detail/old-reddit- redirect/dneaehbmnbhcippjikoajpoabadpodje)

[2] [https://chrome.google.com/webstore/detail/break- timer/hklkdb...](https://chrome.google.com/webstore/detail/break- timer/hklkdbpicdmlpoiellngedpejjkmapei/reviews)

[3] [https://chrome.google.com/webstore/detail/reddit-comment- col...](https://chrome.google.com/webstore/detail/reddit-comment- collapser/njmimaecgocggclbecipdimilidimlpl)

<comment><USER3> On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see.

I've not received my own updates for weeks a few times because I haven't noticed the warning, and about a third of our users are on ancient versions presumably because of it [1].

I think the real solution to this problem is GDPR: massive fines if you abuse your users' trust (and get caught).

I'm not keen on the literal dark pattern that Firefox uses to dissuade developers from requiring new permissions.

[1] [https://addons.mozilla.org/en-US/firefox/addon/tridactyl- vim...](https://addons.mozilla.org/en-US/firefox/addon/tridactyl- vim/statistics/usage/versions/?last=365#)

<comment><USER4> Firefox is in the right here. I absolutely do not ever want extensions to automatically get new permissions automatically just because I accepted an old version's lesser permissions.

If you want more permissions, then _ask_ for more permissions.

And don't be surprised when people say NO.

Not everyone wants to grant the permissions to your update even if the update fixes bugs in older versions. Not everyone will want your new feature in the first place. Denying permissions is an easy way to eliminate the risk of having to go through and figure out whether or not the new feature is trustworthy.

And if you're not adding a new feature, then why do you need more permissions?

<comment><USER3> > then ask for more permissions.

I agree with you. As another reply to you states, however, Firefox doesn't currently let me ask. You have to kind of go hunting for it.

> And if you're not adding a new feature, then why do you need more > permissions?

Firefox does not let me explain why the permissions are needed. It would be nice if we could have a little blurb where we can state our case next to each permission.

Our current approach is to explain likely upcoming permissions requests in advance and ask our users to stay vigilant for the appearance of the tiny yellow exclamation mark, but that's not very helpful to the third of users stuck on old verions before we learnt that trick.

> And don't be surprised when people say NO.

I think very few of these users have said no on purpose. We ask for (and use) almost everything [1], so any marginal new permissions are unlikely to give us much more power. The current permission model actually makes it tempting to just literally ask for everything because we might want it for a new feature in the future.

The optional permissions are not fine-grained enough to be useful (you can accept all optional permissions, or none) and not available for enough permissions, otherwise we would use them.

Also, the first versions of our software were really slow and bad. I really doubt many people are staying there on purpose. (If there are any Tridactyl users in this thread using an old version on purpose, I'd like to hear from you :) ).

[1] [https://github.com/cmcaine/tridactyl/blob/e20a224fb8d8bbb2b7...](https://github.com/cmcaine/tridactyl/blob/e20a224fb8d8bbb2b742599cc69672d7c9fe0c42/src/manifest.json#L41)

<comment><USER4> Firefox and Chromium are both open source. If you don't like the way it works, then work with the teams to build a better experience.

<comment><USER3> I can kind of understand that charge when it is levelled about people complaining about Quantum and doing nothing about it, but I already spend countless hours a week working on a replacement for an extension that died because of Quantum.

How much more time can I reasonably be expected to donate? Just trying to find duplicates on the BMO could take ages.

Complaining into the void on the internet takes much less time and makes me feel better :)

<comment><USER4> Maybe start pointing out how things are far too complex and work to reduce complexity instead?

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I've gotten annoyed enough to just copy the source from most of my extensions (located at `~/.config/google-chrome/Default/Extensions/`), remove the update stuff from the `metadata.json` and load them as developer extensions so they never update.

It's easy enough to update them + audit the code when something breaks. The hardest part is downloading the new code (.crx) without installing it, I had to write javascript I paste into the console. StackOverflow can unzip a crx by striping the first 306 bytes.

I forked Stylish v1.5.2 a year ago before I heared of Stylus, but I've no need to to switch since the original extension was pretty good. [https://github.com/Zren/chrome-extension- stylish#fork](https://github.com/Zren/chrome-extension-stylish#fork)

<comment><USER6> You can extract the .crx without Javascript using this webservice: [http://crxextractor.com/](http://crxextractor.com/)

Used it a couple of times in the past, it is a good one.

<comment><USER5> All you need to do is remove the first 306 bytes to turn it into a normal zip file.

        tail -c +307 in.crx > out.zip

Credit to this guy in the comments. [https://superuser.com/questions/139190/how-to-unpack-a- chrom...](https://superuser.com/questions/139190/how-to-unpack-a-chrome- theme#comment624001_139198)

</comment></comment></comment><comment><USER7> Offices in the UK. I would encourage anyone in the EU who used this to file a GDPR complaint.

<comment><USER8> From their Privacy Policy:

 _" Where provided under applicable law (such as within the European Union), you may have the right to ask us to delete Personal Information which you have provided to us [... ] contact our Data Protection Officer at: email@example.com."_

[https://addons.mozilla.org/en- US/firefox/addon/stylish/priva...](https://addons.mozilla.org/en- US/firefox/addon/stylish/privacy/)

<comment><USER9> That's nice for them. I also have the right to refer them to my local data commissioner though, about the absolutely lack of meaningful consent they gathered from me here. I hope their investors get taken to the cleaners by the resulting fines.

</comment></comment></comment><comment><USER10> As others have said, immediately switch to Stylus. While we're at it stop using Ghostery as well since they were bought by an ad company. Use Privacy Badger or a decent alternative (noscript + heavy/custom uBlock lists should work just fine)

<comment><USER11> If you dont want the heavy handed solution that NoScript provides, i would suggest "uBlock Matrix".

<comment><USER12> There are two, similar, though different, extensions.

uBlock _origin_ is a dedicated, quite-good, low-fuss, ad blocker.

uMatrix is a much more general, very powerful, though somewhat fussy, general Web capabilities manager. If you don't mind fiddling with sites periodically, it's _very_ strongly recommended, but for user populations who don't do this or grasp technology poorly, it will require some fairly close managing, _especially_ if the user base doesn't report problems and just accepts "the site is broken".

I'd highlighted my preset recommended set of browser extensions for 2018 a couple of weeks back. The hero image is uMatrix's control interface.

[https://plus.google.com/104092656004159577193/posts/WVEM83FY...](https://plus.google.com/104092656004159577193/posts/WVEM83FY169)

<comment><USER4> If the site loads tons of crapware then the site is broken regardless of whether or not uMatrix blocked things.

<comment><USER12> If you've not been paying attention or specifically trying to counter that trend, you'd be amazed at how complex a typical site is. Even those which otherwise appear clean.

<comment><USER4> I appreciate the sentiment but indeed I know very well how complex a typical site is. Unfortunately I think a very large portion of most websites are far too complex for what they provide.

<comment><USER12> Agreed on that last.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> I discussed this problem (in a bit inflammatory way) last month: [https://news.ycombinator.com/item?id=17242003](https://news.ycombinator.com/item?id=17242003)

It's particularly annoying, because I do have this Stylish extension installed (using css ::after rules to tag HN users)

EDIT: You can submit an abuse report when uninstalling a Chrome extension.

<comment><USER14> Sort of ironic sending an abuse notification to a company that does precisely the same thing on a much vaster scale. And I would assume that the T&C for the new and improved Stylish that you accept when you install it informs you that you are giving them permission to do this, so there isn't even any abuse to complain about here.

<comment><USER13> I had this extension installed for years, from back when it was "still good". I don't recall ever seeing a T&C prompt, and in the last 3-4 years I've become quite vigilant about always reading full T&C texts (much to the amusement of others).

I was put in this tracking program without my consent.

</comment></comment></comment><comment><USER15> This reminds of the "WOT, Web of Trust" (haha) privacy issue in 2016: Reporters (disguising as business men) were offered data that includes the surfing habits of three million German citizens. This data was, at least partly, collected by the "Web of trust" (WOT) browser extensions. The reporters were able to use this data to identify the browsing habits of individual persons – including high-ranking German and EU politicians.

English: [https://ocr.space/blog/2016/11/wot-browser-extension- collect...](https://ocr.space/blog/2016/11/wot-browser-extension-collects- habits.html)

<comment><USER16> Indeed. I never trusted it. I never trust _any_ feature or add-on that uploads anything. That includes malicious site detectors. I only use stuff that relies on local databases.

<comment><USER12> Any recommendations on malicious site alternatives?

I'm still looking to update my router (Turris Omnia) to use DNSMasq rather than Knot Resolver, which may offer an edge on DNSSec capabilities (though I believe this has lapsed), but is far _less_ capable of being locally customised along the lines of DNSMasq.

[https://www.knot-resolver.cz/](https://www.knot-resolver.cz/)

[http://www.thekelleys.org.uk/dnsmasq/doc.html](http://www.thekelleys.org.uk/dnsmasq/doc.html)

</comment></comment></comment><comment><USER17> Google needs to take action here. From requiring re-confirming permissions every time a significant privacy policy change is made, or just by nuking SimilarWeb altogether from the web App Store.

<comment><USER18> I can already see the followup HN news: "Google attacking developers on Chrome Web Store and breaking free web!"

<comment><USER19> Yeah one thing Google doesn't do is collect info about what you do on the internet and sell it to other people.

[https://myactivity.google.com/myactivity](https://myactivity.google.com/myactivity)

More seriously: if Stylish concerns you, Chrome should too.

<comment><USER18> Google indeed doesn't sell info to other people. (It does collect it though.)

<comment><USER20> Is there a _definitive_ list anywhere of what Chrome collects and where it goes?

There have been rumours forever, but I'm interested in verifiable facts.

<comment><USER19> If you're logged in, which Chrome strongly encourages, it's your entire browsing history. See the URL above.

<comment><USER20> Thanks, but what I'm really trying to ask here is what a vanilla Chrome installation does. If someone just installs Chrome, leaves all settings as defaults, and doesn't opt in to anything, what data is being sent back to the mothership? I've never managed to find a convincing answer to that question.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> It took me less than a minute to install Stylus and import all my userstyles from Stylish.

<comment><USER12> The headache for me was that the _stylesheets_ are transferred, but the _applied domains_ are not.

I've got a system where I use a set of standard styles applied broadly against many sites.

E.g.,

Annoyances -- applied globally to all websites by default: [https://pastebin.com/raw/GrE9KX6D](https://pastebin.com/raw/GrE9KX6D)

Local Gifs: [https://pastebin.com/raw/tn7cqGtJ](https://pastebin.com/raw/tn7cqGtJ) (Exceptions to global gif filtering)

The following break on many sites too much to be applied as default, but can be used fairly generally to selected sites as needed.

Animations blocking: [https://pastebin.com/raw/7Gjxj6AT](https://pastebin.com/raw/7Gjxj6AT)

Headers / Footers: [https://pastebin.com/raw/PsXWhUGf](https://pastebin.com/raw/PsXWhUGf)

Popups / Overlays blocker: [https://pastebin.com/raw/VcgNNwDp](https://pastebin.com/raw/VcgNNwDp)

"Unstyled" CSS: what I apply to unstyled / minimally styled pages: [https://pastebin.com/raw/rtfev3vj](https://pastebin.com/raw/rtfev3vj)

For development / testing / debug:

Debug CSS: [https://pastebin.com/raw/Z3kFrRQy](https://pastebin.com/raw/Z3kFrRQy)

(Highlights class/id and entities in page.)

<comment><USER22> One of those (either annoyances, headers, or popups) broke a fork of Stylish. I'd click on the icon in the toolbar and the drop-down wouldn't appear. I noticed the user style also broke AWS navigation.

<comment><USER12> None of those sheets _except for Annoyances_ should be applied globally.

I don't guarantee Annoyances _won 't_ break other things, but I _do_ guarantee that the others will.

Assign the to a nonexistent URL or domain initially, or disable them.

If you've got specific bugs with the Annoyances sheet ... I may be able to address them.

My usual first-stop debugging tools are adding either an outline or background colour to an element:

        outline: solid 2px red;
        background: #faa;

... which tends to show what rule(s) are being triggered. If something breaks, add those rules, and disable the "display: none;" one.

I'm also finding that the shift to "display: flex;" styles is breaking some of my assumptions. It's no longer safe to presume that everything is displayed as one of block, inline-block, or inline.

Position directives are also problematic: initial, static, relative, absolute.

That said: I've evolved those styles over a few years, and they tend to work reasonably well. Some nursemaiding required.

</comment></comment></comment></comment><comment><USER23> Always the same cycle.

1/ New great product is built. People love it.

2/ Once enough people use it, start monetizing in shady ways, annoying users just not too much or they leave.

3/ Very annoyed users switch to another product back to 1/

<comment><USER24> Small correction:

1/ New great _free_ product is built. People love it.

Image and file hosting services and messengers are the best examples.

I swear it's because the well has been poisoned and it's just impossible to monetize these services in a moral way.

<comment><USER25> This is absolutely not confined to free products. I did security audits for companies and part of that job was giving a go ahead before we allowed people to install software on their devices. Free software behaved much better than paid software by a wide margin.

</comment></comment></comment><comment><USER26> Most browser extensions seem to require access to one's browsing history and keystrokes, even for legitimate functioning. Is there any way to ensure that they do only what they claim to do, and don't abuse the permissions? (Apart from verifying the source code, because clearly, lines of junk code >> interested eyeballs).

For example, would it be reasonable to enforce that an extension only acts locally, and cannot communicate with any external server? (I guess allowing arbitrary local modifications essentially allows the extension to execute arbitrary javascript code, including communicating with arbitrary remote entities?)

<comment><USER27> Yes, it's very hard to block that, since even if you block XHR from their JavaScript code, by changing the page DOM they can inject elements that communicate with a server.

</comment></comment><comment><USER28> For those actively using Stylish and needing to switch:

'"Stylus" is a fork of the popular Stylish extension which can be used to restyle the web. Not "ish", but "us", as in "us" the actual users. Stylus is a fork of Stylish that is based on the source code of version 1.5.2, which was the most up-to-date version before the original developer stopped working on the project. The objective in creating Stylus was to remove any and all analytics, and return to a more user-friendly UI. We recognize that the ability to transfer your database from Stylish is important, so this is the one and only feature we've implemented from the new version.' [1]

[1] [https://add0n.com/stylus.html](https://add0n.com/stylus.html) and [https://github.com/openstyles/stylus](https://github.com/openstyles/stylus)

</comment><comment><USER6> Tampermonkey seems to be a good alternative as well and is available for all major browsers.

Does anyone have information on if the Safari Stylish Addon does the same shady things? It's available in the official App Store and was approved by Apple it seems.

<comment><USER29> I was curious about this too. The source is on GitHub ([https://github.com/350d/stylish](https://github.com/350d/stylish)), but who knows if Apple checks that they're the same when they're approving it.

Edit: I should note that it collects analytics, but it can be turned off in the preferences. I don't remember if it's on by default, but I suspect it is.

<comment><USER6> Yes, the option is called "Collect anonymous usage statistics" and is turned on by default. But I don't trust it anymore.

Tampermonkey is here BTW: [https://tampermonkey.net/?browser=safari](https://tampermonkey.net/?browser=safari)

I really love that one, it does a great job in Safari. Unfortunately, there is no Safari App Extension yet. Since I'm running Safari Preview and Safari 12 does not accept extensions from unknown sources anymore I'm out for now.

</comment></comment></comment><comment><USER19> Just filed this Firefox bug: [https://bugzilla.mozilla.org/show_bug.cgi?id=1472948](https://bugzilla.mozilla.org/show_bug.cgi?id=1472948)

<comment><USER30> Looks like the extension has already been removed from the store.

</comment></comment><comment><USER31> Meanwhile a simple and open source bookmarking extension was taken down with no notice, no information ([https://news.ycombinator.com/item?id=17440358](https://news.ycombinator.com/item?id=17440358)).

</comment><comment><USER32> Well, shit. I installed this extension a few months ago, because _multiple_ people HN recommended it.

Tried it out, but found a different way to restyle and adjust sites to my tastes (uBlock and custom Greasemonkey) that I found easier. Then forgot about it.

And now it turns out this thing has been slurping my Internet history for months.

No downvotes, nobody calling them on it, just happy oblivious HN users that carelessly install random browser extensions and then recommend them to other people. Urgh.

</comment><comment><USER33> This has been going on for _years_ and Google has done nothing about it. These days I don't use any extensions where a major organization's reputation doesn't depend on them not becoming spyware. Truly a shame; I used to get a lot of benefit out of extensions, including a similar one named Stylebot, but now I don't trust anything other than Adblock Plus and the React Developer Tools to not covertly become malicious.

<comment><USER34> You probably shouldn't trust AB+ either (but switch to uBlock instead)

[https://en.wikipedia.org/wiki/Adblock_Plus#Controversy_over_...](https://en.wikipedia.org/wiki/Adblock_Plus#Controversy_over_ad_filtering_and_ad_whitelisting)

<comment><USER35> For reasons I do not recall now, you should use uBlock Origin instead of uBlock as well. The former is often what people are referring to anyway, but worth mentioning.

</comment></comment></comment><comment><USER36> report stylish to Google [https://chrome.google.com/webstore/report/fjnbnpbmkenffdnngj...](https://chrome.google.com/webstore/report/fjnbnpbmkenffdnngjfgmeleoegfcffe)

</comment><comment><USER37> Dark Reader (which generates dark themes dynamically) added support for static CSS so that style sheets could be migrated [http://darkreader.org/blog/stylish/](http://darkreader.org/blog/stylish/)

</comment><comment><USER38> Dangit - I just installed it yesterday to block Twitter's annoying timeline additions ("So-and-so liked such-and-such") which don't honor the account's word filter/blacklist. Any alternatives out there that are better?

<comment><USER39> Stylus, as mentioned in the article:

[https://addons.mozilla.org/firefox/addon/styl- us/](https://addons.mozilla.org/firefox/addon/styl-us/)

</comment></comment><comment><USER40> 10 months ago, I discovered and recommended _stylish_ on a post titled: "Show HN: Make Medium Readable Again"[0]. I have only ever used it for a single site: medium.

It's times like these I wish I could go back and edit/update an old post with new info. I feel like I got stabbed in the back... which happens way too often in tech these days no matter how careful you are.

[0] [https://news.ycombinator.com/item?id=15123638](https://news.ycombinator.com/item?id=15123638)

</comment><comment><USER41> In what is certainly a complete coincidence, the Stylish Firefox extension threw up an "agree to our new TOS 'effective May 22, 2018.'" modal for me today..

</comment><comment><USER42> It appears Firefox has already moved on this. Came home today and was warned that Stylish was an unsafe extension, and I can no longer find it listed as an available add-on.

</comment><comment><USER43> I actually ran into this issue previously when for some reason I got a request on a `hidden` (very cryptic URL listed nowhere) diagnostic endpoint on one of our APIs. I ended up identifying stylish as the culprit, at first I disabled the tracking option (which is opt out and probably violates GDPR), a few weeks later I installed stylus.

I also reported it around the same time and gave it a 1/5 star rating but google had no interest in the report it seems.

</comment><comment><USER44> I've been lucky enough to have never had an extension installed when it was sold, so I don't know that this isn't already the case, but if it isn't, I believe it should be: Whenever an extension changes hands (is transfered to another account), the user should be notified in the same way they would be if it requested new permissions. Along with a rule that accounts are non- transferable, of course.

</comment><comment><USER45> tl;dr: Use Stylus [1]. Use Stylus. Use Stylus.

I guess there should be an addon that notifies users for any ownership changes to browser addons they use. Or is there?

[1] [https://github.com/openstyles/stylus](https://github.com/openstyles/stylus)

<comment><USER46> This extension disables any updated extension that requires new permissions, among other niceties: [https://chrome.google.com/webstore/detail/extensions- update-...](https://chrome.google.com/webstore/detail/extensions-update- notifie/nlldbplhbaopldicmcoogopmkonpebjm)

(I'm only a user)

<comment><USER47> I thought chrome did this automatically now.

</comment></comment></comment><comment><USER48> Found same issue with Pricee the other day, not sure how to report: [https://addons.mozilla.org/en-US/firefox/addon/pricee- search...](https://addons.mozilla.org/en-US/firefox/addon/pricee-search- engine/)

</comment><comment><USER49> The culprit in question tried to do the same thing to a Voice Search Chrome extension in the past[1].

[1] [https://twitter.com/sephr/status/1014240895095300096](https://twitter.com/sephr/status/1014240895095300096)

</comment><comment><USER50> Ugh! After so many years, I now have to view a white-themed internet again. I forgot how painful and blindy websites are!

Pls redesign the whole internet to be dark themed, so we dont need add ons like this to fix the world. Thanks!

</comment><comment><USER51> So it boils down to trust anyway. No way a code signing certificate can impose that trust. At the end of the day, it all goes back to human stance towards other beings in this world and own dignity.

</comment><comment><USER52> Since "youtube-dl does not include support for services that specialize in infringing copyright", is there a fork, or addition, without this restriction?

</comment><comment><USER53> Is there an alternative to userstyles.org for hosting styles? That site is run by the Stylish folks, and I have removed my account and styles from it.

<comment><USER54> Not really. Though, [https://openusercss.org/](https://openusercss.org/) is in development right now. freestyler.ws is an unmaintained copy of userstyles.org

</comment></comment><comment><USER55> I wonder if Stylish is also able to data-mine the websites you visited while in incognito mode, since extensions don't work there.

Does anybody have an idea?

</comment><comment><USER56> Is there a system in place to update everyone on new ownership changes and implementation of anti user-good practices like this?

</comment><comment><USER57> Isn't it a common knowledge? People were massively switching to Stylus long time ago.

<comment><USER58> I didn't know until today. I'm annoyed because I never noticed the opt-out checkbox. It feels almost like I've been hacked... my browser history I thought was my own private business, is actually in the hands of a some marketing company.

</comment></comment><comment><USER59> Sadly Stylus is not in the Safari's plugins store.

Any alternatives for Mac users?

<comment><USER60> I'll have to double check and make sure but as far as I know the safari version of stylus doesn't do this — it's written and maintained by a totally different developer.

I'm planning to write my own Safari stylesheet extension some time in the coming months, though, because old style Safari extensions are being phased out in favor of Safari app extensions and I don't know if the dev of the Safari stylish extension plans to make the leap.

<comment><USER59> Do you know the name of the extension in the Safari's addons store? I disabled Stylish the moment I read this article here but I have no replacement.

If you do write such an addon as you said, please advertise it here in HN!

<comment><USER60> Correction, in my previous reply I meant to say that the Safari version of Stylish (not stylus) has a different developer and doesn't appear to share the Chrome/Firefox extension's tracking issues.

The code for the safari version is available here: [https://github.com/350d/stylish](https://github.com/350d/stylish)

With a quick glance it looks to include google analytics, but that's only used on the extension's settings page and doesn't send browser history or anything like that. JS isn't my forte, though, so if anybody else could take a look and confirm that'd be great.

</comment></comment></comment></comment><comment><USER61> It's not actually stealing if it's in the ToS, is it?

<comment><USER62> Yes, it is.

For example,

> TOS agreements require giving up first born—and users gladly consent

[https://arstechnica.com/tech-policy/2016/07/nobody-reads- tos...](https://arstechnica.com/tech-policy/2016/07/nobody-reads-tos- agreements-even-ones-that-demand-first-born-as-payment/)

<comment><USER63> As someone who used to read TOS and EULAs:

Somewhere around 10 years ago I switched strategy:

I don't read them at all. If anyone wants to sue my defense would be that nobody in their right mind (sorry younger me) would read that nonsense.

I assume the rules are basically "don't abuse our content or service",

... and I assume that they will sooner or later sell, abuse, leak, or hand over my data to law enforcement in any country including middle Eastern and African ones.

</comment></comment></comment><comment><USER64> Dont google and mozilla review source code of addons?

<comment><USER2> Mozilla yes - there's a delay when publishing whilst an actual human reviews the changes. For Google, updates are instantly published with, as far as I can tell, no kind of audit.

<comment><USER65> The Mozilla one is great, they insist on reproducible builds and do a thorough review. Although they can't catch everything, I would pick FF over Chrome all day for this reason alone.

</comment></comment></comment><comment> sahin-boydas Are There any response from Stylish developer?

</comment><comment><USER66> "OneTab" is another popular extension with the same issue. Switched to ff+"tabs aside" since then.

<comment><USER67> That is absolutely not true. OneTab has never, ever transmitted any information about your tabs outside of your browser, and will never divulge them. I'm the developer. OneTab has never made a penny, and absolutely does and always will deliver on the privacy promise.</comment></comment>


New rocket engine concept stuck – help out - <AUTHOR> Idea is to lower the dry mass to achieve higher acceleration by shooting fuel pallets from a space based platform to be then collected and ingested by the accelerating spaceship "riding the fuel trail". Problem is kinetic energy of pallet impact on ship seems to equal energy density of monopropellant at relatively low speeds. Thoughts? <comment><USER2> I had a similar idea previously for interstellar travel. My idea was to fire fuel pellets ahead of the rocket so it would collect them up as it accelerated, relative velocity being not too much.

However Anything orbiting the sun wouldn't be able to stay on target to fire the fuel for long. Calculating the trajectory to account for gravity would be problematic. The whole process would be too brittle, if something went wrong it could well be impossible to recover.

Nifty idea was to fire the pellets before and after, so when it flips mid- flight it could collect fuel pellets to decelerate.

<comment><USER3> > Calculating the trajectory to account for gravity would be problematic.

Couldn't you just make every fuel pellet a powered spacecraft just a tiny engine? It could adjust its velocity when it drifts off course. That would add some weight, but a small ion engine might fit the bill. The engine could of course be disposed of to save weight once its captured by the larger ship.

The whole process could be safer if the rocket just keeps some extra fuel in case it doesn't manage to collect say every 10th pellet.

<comment><USER2> Yes, I had thought of a buffer for that, probably a design trade off.

But if the pellet track is moved off target you have to follow it.

By the way I like to call it the PacMan Rocket.

</comment></comment></comment><comment><USER4> Exploding fuel pallets. Here's one ton of fuel, a one-ton inert reaction mass, and an explosive charge that will fire at the right time to separate the two. It drives the fuel mass to nearly the velocity of the rocket ship (this also makes catching it easier). It preserves momentum by driving the reaction mass in the opposite direction.

Hint: Make sure the reaction mass misses the rocket ship.

<comment><AUTHOR> Ok good! But how do you contain the blast without harming the ship or sending it off course?

<comment><USER4> Well, if you can manage it, the blast can be mostly linear.

I picture it like this: There's, say, a one degree angle between the trajectory of the ship and the trajectory of the fuel pallet. The explosion can happen arbitrarily far before their courses intersect. This means that the blast can be (arbitrarily far) * (sin 1 degree) away from the course of the rocket.

But that [Edit: the fuel pallet] transfers a small amount of sideways momentum to the rocket. To counter that, alternate fuel pallets from the left and the right.</comment></comment></comment>


Ask HN: Is the U.S. workforce mostly back to work now? - <AUTHOR> In Australia, much of the workforce won't be back till early Feb due to summer holidays.<p>How about in the U.S.A?  Are people mostly back to normal now after Christmas? <comment><USER2> Yes. Some blue collar workers and most white collar workers get Christmas Day off. A fraction get Christmas Eve off or a half day. Many white collar workers get New Year's Day off. In between, you work unless you want to spend vacation days. In many places and types of work (especially retail) they work even on Christmas Day. And work starts back up full force on January 2.

</comment><comment><USER3> Do you work in education or something? Most people here in Australia have been back to work for plenty long now.</comment>


Ask HN: advice/comments on looking for a job in France without knowing French? - <AUTHOR>

Hi all (but mostly the French :-) ),
We're currently in the UK, but my wife's a bit of a Francophile and would love to sample the French life for at least a while. I don't really know much about France, much less the software development job market there. As I don't speak French (I'd try to learn it once there), I suppose the most obvious question is "Can you get by in the office with just English initially?". I imagine that's a "no" for most/all small companies, but not sure if it's the same with multinationals?
Much more subjectively: I'm a fairly junior developer (2.5y out of uni). Should I expect to be able to afford to rent a 1-2 bed flat and support a wife and a toddler?
Any ballpark salary figures will be appreciated, as well as any other relevant comments. Needless to say, if you're aware of any opportunities, I'd be grateful to hear about them :-)
Cheers <comment><USER2> Hi there. American living in France and helping others to move to other countries.

If you don't speak French, it can be much harder to integrate into French companies, but more and more IT companies in France are growing and realizing that they've no choice but to adopt English, at least to a degree. Almost everyone in my office speaks English. However, I've leaving to go freelance and maybe that's your opportunity? If you can find remote work, you might be able to make it work.

As for "can you afford it", that's hard to say. Most work is in Paris, but Paris is ridiculously expensive. My wife and I have a two-bed flat with a garden for €1,350 a month and everyone's stunned by how inexpensive it is (we're actually outside Paris by a five minute walk).

As for salary, that's going to be whatever you can blag off of your employer. They tend to be a bit lower than what I was seeing the UK, but I think that's largely due to the 3 month notice period requirement. That makes employees _expensive_ if you get the wrong one, so employers (IMHO) compensate by offering a lower wage. I can't honestly say what you'd be looking at, but in Paris with only 2.5y, I'd be surprised if you'd get more than €40 or €45K, but you'll certainly be offered less!

Instead, maybe check out the larger cities such as Lyon or Bordeaux? Lower costs, still large enough to have an IT industry.

What's your IT background? There's a world of difference in opportunities between a VB hacker and a C hacker :)

</comment><comment><USER3> Toulouse is quite a nice city with reasonable rents. I stayed in a lovely two bed apt there for €500/m in 2009. Quite a contrast to London. Airbus is a very big employer there, and presumably needs a few developers on the payroll. I ran into a few foreign engineers who worked there, few of whom spoke proper french</comment>


FMRI-based neurologic signature of physical pain - <AUTHOR> http://www.freepatentsonline.com/y2016/0054409.html <comment><AUTHOR> As Micah Allen has pointed out on Twitter ([https://twitter.com/neuroconscience/status/71259271003367833...](https://twitter.com/neuroconscience/status/712592710033678337)), this appears to be an attempt to patent a brain activation pattern.</comment>


A pic of our start-up [pic] - <AUTHOR> http://blog.clutterme.com/2007/07/picture-of-our-workspace.html This is where we are founding our summer start-up. <comment><USER2> I'm actually more interested in your product than in how you look. Are you guys actually trying to take on the huge social networks head on? If your best selling point is that you're better on technical merit and/or a few small features, I don't know that you're going to find much success.

<comment><USER3> aston, we're not suicidal ;) We use the term "social network" out of convenience, but we're not working on a Facebook clone. It's a hybrid of a few different markets.

<comment><USER2> I eagerly await your launch.

<comment><AUTHOR> Aston, you kick butt.

</comment></comment></comment></comment><comment><USER4> Did you see this research: Top Social Networks: The Summer of Social? [http://blog.compete.com/2007/07/24/top-social-networks- june-...](http://blog.compete.com/2007/07/24/top-social-networks-june-myspace- facebook/)

<comment><AUTHOR> Thanks for the link, definitely an interesting read.

</comment></comment><comment><USER5> Wow, that's hell of a clean desk. Where are all the books, pizza boxes, paper with random notes?

</comment><comment><USER6> More poeple should send in pics of their startups...

<comment><USER7> _"... More poeple should send in pics of their startups... "_

isn't that what flickr is for? <http://flickr.com/photos/tags/startup> I'd settle for demo

</comment></comment><comment><USER8> The nice title you wrote today will not be soon forgotten. A pic of your start-up is actually a PIC.

<comment><AUTHOR> No, it's redundant but effective.</comment></comment>


Ask HN: What are the least covered infosec topics by online courseware? - <AUTHOR> I left the question open ended. To narrow the scope a little I am interested in hearing about under/poorly covered topics that would be of value to:

  1. software developers
  2. vulnerability researchers
  3. malware researchers
 <comment><USER2> There are lots of places to learn about 2 and 3, not sure about 1 because I'm not a dev, but something I find almost nothing about anywhere is the process of reverse engineering custom binary network protocols used by backdoors or how to identify such a protocol is present while analyzing network traffic. Some people can search through a bunch of PCAP and once in a while they find a backdoor no one has ever seen. I know a few people like this and none of them can explain it well.

Note: I'm aware that a lot of these protocols are reversed and discovered by using a malware sample found on a compromised host. Those aren't the situations I'm talking about.

Also, there are dozens if not hundreds of resources for network flow analysis, but almost all of them are too shallow to be useful. They explain what netflow is, tell you how to collect them, mention the names of the tools used to analyze them, and then provide no actual information on the analysis process.

<comment><USER3> Would this book be helpful to you?

[https://nostarch.com/networkprotocols](https://nostarch.com/networkprotocols)

<comment><USER2> I preordered it so its sitting on my desk. Just trying to find time to read it. After skimming through it, I suspect it will address a few aspects, but the overall goal of the book is so different it likely won't address most of them.

</comment></comment></comment><comment><USER3> Overall, there's a bigger lack of intermediate and advanced sources than beginner sources.

Eg you can find literally thousands of articles etc on exploiting a buffer overflow on x32. But exploiting a type confusion bug and bypassing all mitigations on the latest Windows 10....yeah, not so many.</comment>


Proposed Terror Law: Australia's Entire Internet Monitored with One Warrant - <AUTHOR> https://www.techdirt.com/articles/20140924/11254228624/proposed-terror-law-would-allow-australias-entire-internet-to-be-monitored-with-just-one-warrant.shtml

<comment><USER2> Well fuck...

I make jokes about our current PM being Australia's George W. Bush, but this comes along and it now looks like we're getting our own PATRIOT act to go with our G.W. Bush and suddenly it's less funny.</comment>


Follow the Startup School tweets with this new Twitter chat tool - <AUTHOR> http://www.tchat.io/rooms/startupschool Launched this tool a few months ago to help people participate in Twitter hashtag-based chat. Try it out an let me know what you think! Thanks! <comment><USER2> This functionality is built into YCombinator's live stream page: [http://startupschool.org/watch.html](http://startupschool.org/watch.html)

<comment><AUTHOR> Ah, didn't see that since I'm actually at the event. But, tchat.io is actually better than the Twitter widget on that page. It updates in real-time, and if you sign-in you can tweet, reply, and quote in-page without opening a new window.</comment></comment>


Will Covid-19 Kill the Whiteboard Test During Job Interviews? - <AUTHOR> https://insights.dice.com/2020/04/03/will-covid-19-kill-the-whiteboard-test-during-job-interviews/ <comment><USER2> I did a CoderPad interview one week ago. Both me and the interviewer were working from home (as everyone else, I guess). From my point of view, it was a great experience. I could google how to sort a dictionary in python, and use it right away. It was a workflow just like a regular day at work. You don't know a small syntax details, you google it, use it, and move on with your life. A whiteboard doesn't allow this. It looks like the interviewer was happy with my performance, I got scheduled for a follow-up. Wish me luck :)

</comment><comment> _-_T_-_ There are several virtual whiteboards to choose from</comment>


Cash registers in Poland fail due to new year bug (PL) - <AUTHOR> https://translate.google.pl/translate?sl=pl&tl=en&u=https%3A%2F%2Fwww.spidersweb.pl%2F2020%2F01%2Fawaria-kas-fiskalnych-delio.html <comment><USER2> I wouldn't be surprised if something alone the lines of `split("20")` or `replace("20", "")` was the culprit somewhere (to turn it into a 2-digit year). I've seen the most absurd date handling code...

<comment><USER3> Yeah, and I could imagine some developer fixing a Y2K big in the late 90s thinking, "Hmm, this may cause a problem in 2020, good thing I'll be long gone by then."

<comment><USER4> And that proves that the Y2K problem was real: even in 2020 some companies that had only these printers apparently simply can't do their business until the repair of the printers is made.

</comment></comment></comment><comment><USER5> On the topic of dates broken around New Year's, there is this perennial favorite:

[http://dangoldin.com/2019/01/06/javas-simpledateformat- yyyy-...](http://dangoldin.com/2019/01/06/javas-simpledateformat-yyyy-vs- yyyy/)

</comment><comment><USER6> So far I've heard of the following fail due to some sort of 2020 bug:

Parking meters: [https://www.nytimes.com/2020/01/03/nyregion/nyc-parking- mete...](https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-meters.html)

Video games: [https://www.dsogaming.com/news/star-wars-jedi-fallen- order-w...](https://www.dsogaming.com/news/star-wars-jedi-fallen-order- wwe-2k20-and-other-games-are-not-launching-due-to-a-denuvo-2020-bug/)

Now cash registers.

Anything else?

<comment><USER7> Trains in Hamburg: [https://www.ndr.de/nachrichten/hamburg/Software-Fehler- legt-...](https://www.ndr.de/nachrichten/hamburg/Software-Fehler-legt-U- Bahnen-lahm,hochbahn578.html)

</comment></comment><comment><USER8> Similar issue in NYC with parking meters: [https://www.nytimes.com/2020/01/03/nyregion/nyc-parking- mete...](https://www.nytimes.com/2020/01/03/nyregion/nyc-parking-meters.html)

<comment><USER9> The official explanation from the vendor is that this was an "anti-fraud security setting".

Can anyone familiar with CC processing provide insight on whether that's a reasonable explanation?

Regardless, a problem that requires a "software fix" from the vendor and manual visitations to each individual machine doesn't sound like a mere "setting"

<comment><USER10> I assume the meters are network-connected because they take credit cards, but they can't be remotely updated? Seems like an obvious omission.

<comment><USER11> Or a deliberate security measure. Embedded devices often use Harvard architecture, with separate memory for code and data, so not allowing remote updates makes remote code execution impossible.

<comment><USER12> Sure, but there are at least two other options that are essentially as secure, assuming the "remote attack" threat model:

1\. Allow customers to download updates and flash over USB.

2\. Boot device into a limited mode that allows signed updates. Certificate should be stored in secure memory.

<comment><USER13> I don't deal with PCI personally, so $0.02, but we're talking retail or unattended devices here.

I.e. low wage, minimal training, not technically proficient users with unsupervised physical access to the machine

A machine through which a large amount of cash (virtual or otherwise) flows.

The criteria of (a) being updatable by a semi-technical customer & (b) being secure against technically malicious or socially engineered ignorance attacks seem challenging to simultaneously satisfy.

</comment></comment></comment></comment></comment></comment><comment><USER4> Apparently it's a "bug in the software of popular Delio cash printers from Novitus". The product page of the printer mentioned is:

[https://www.novitus.pl/en/produkty/systemy-fiskalne/delio- pr...](https://www.novitus.pl/en/produkty/systemy-fiskalne/delio-prime-e.html)

It can be seen that the printer already existed in 2009 and then got something ("Polish Promotional Emblem" according to Google Translate) [https://www.novitus.pl/sites/default/files/certyfikaty_tp_55...](https://www.novitus.pl/sites/default/files/certyfikaty_tp_550.jpg)

Even if it's only one model, if the companies have only that _one_ model of printers they won't be able to sell anything until the printers are serviced.

Effectively, having such a bug in software, even in multiple units of the same model translates to a single point of failure for the company using it.

</comment><comment><USER13> I would love to hear what bizarre encoding they used that resulted in 2020 being an issue.

(I'm assuming these machines aren't all < year old and just break on any new year)

<comment><USER14> 2020 was a common pivot year used in the "windowing" workaround to the Y2K bug. 2-digit years < 20 are defined as 20XX, while years >= 20 are defined as 19XX.

[https://en.wikipedia.org/wiki/Date_windowing](https://en.wikipedia.org/wiki/Date_windowing)

<comment><USER15> Thanks for sharing.

Y2K used to be just an interesting story from the past. Never guessed that it would still be biting people 20 years later. Ouch...</comment></comment></comment>


Show HN: Ora.pm new features and design - <AUTHOR> https://ora.pm/features/ <comment><USER2> This was published already 6 months ago. But I like that it's still being developed. Looks like you added some cool new stuff! I will give it one more try.

Keep up the good job!

</comment><comment><USER3> Sweet design! When is github going to be ready?

<comment><AUTHOR> Thanks! Git commits references in tasks in 2 weeks or so. There is already a GitHub issues import present.</comment></comment>