Boston Geeks: BarCampBoston3 (the free geek unconference) is this Saturday & Sunday. - <AUTHOR> http://www.barcampboston.org/

<comment><USER2> I can't make the meet&greet scheduled for tonight, but is anyone interested in a post-BarCamp news.yc gathering tomorrow evening?

<comment><AUTHOR> That sounds awesome. Put it up on the wiki as an after-party.

<comment><USER3> I'd be up for that

</comment></comment></comment><comment><USER3> I plan to come -- someone asked me to offer up my iPhone dev talk, so I'll see if there's any interest.

</comment><comment><USER4> Man, I wish I could go. Anyone up for a Boston hacker meetup this summer?

<comment><USER5> I would love to. I'm going to miss this bar camp, but I'll be moving to Cambridge in a couple of weeks and would enjoy meeting some people.

</comment></comment><comment><USER6> always great to see a group of tech enthusiasts putting on their own show and learning together!

I have to say, the list of topics is a great one--something for everyone, hell bring your gf!

</comment><comment><USER7> see you guys there</comment>


Ask HN: What site you go to for us/world news? - <AUTHOR> I am new to US so have CNN bookmarked but find it somewhat populist. Anything similar to havker news but for all other news? <comment><USER2> Stick to sources that are fact driven instead of being in the business of selling angles and sensationalism.

That excludes: NBC, CBS, ABC, MSNBC, Fox, CNN. None of those consistently avoid pushing an agenda. If you utilize any of them, you have to mentally filter out their heavy propaganda, which is aggressively interlaced with actual news.

I like Reuters ([https://www.reuters.com](https://www.reuters.com)), they overwhelmingly do just straight to the point news reporting instead of cultivating stories to sell to a biased audience. And they offer comprehensive global news coverage.

APNews ([https://www.apnews.com](https://www.apnews.com)) is another decent option. They're more heavy on factual reporting, less on opinion and propaganda. There is still some overt bias you have to filter out with them.

The BBC ([http://www.bbc.com](http://www.bbc.com)) will get you some decent US + global news. They do a better job at factual reporting on US news than The Guardian and other European sources.

<comment><AUTHOR> Reuters and apnews are much better than CNN they just lack relevancy (to me).

Example of their home page news that are completely irrelevant (to me):

\- Gates admits crimes with _ and embezzlement from _ Manafort

\- Serena Williams says struggling with 'postpartum emotions'

\- Pink in Sydney hospital with stomach virus, cancels 3rd show

I guess I am looking for an aggregator like Zite used to be where you could teach it your interests. Apple news is good but you can not customize it well enough so it keeps pushing new and unwanted stuff to you (not to mention ads).

</comment></comment><comment><USER3> Legible News!

It's simple to read, and provide links to wherever necessary. No ads, just clean text.

[https://legiblenews.com/](https://legiblenews.com/)

<comment><AUTHOR> Thanks for the link, looks good.

</comment></comment><comment><USER4> [https://en.wikipedia.org/wiki/Portal:Current_events](https://en.wikipedia.org/wiki/Portal:Current_events)

Usually has the news that matters to me on it, also more international.

</comment><comment><USER5> \- [https://lite.cnn.io/en](https://lite.cnn.io/en)

\- [https://text.npr.org](https://text.npr.org)

</comment><comment><USER6> There aren't any great options at the moment. You can't easily avoid stories about, for example, Meghan Markle or the Kardashians.

My suggestion is to get an app that lets you filter out certain topics, and then pull in news from a variety of outlets.</comment>


Linux Development Tools for the MSP430 LaunchPad - <AUTHOR> http://rcfox.ca/dokuwiki/doku.php?id=linux_development_tools_for_the_msp430_launchpad

<comment><USER2> Is there any other place to get LaunchPad than TI's eshop? Because it seems to have some issue with payment authorization (at least with my non-US card).

<comment><AUTHOR> Hm. I'm in Canada, and I didn't have any trouble. (Though, now, the TI site is back-ordered into August.)

However, the first table under "Quick Links" on their wiki ([http://processors.wiki.ti.com/index.php/MSP430_LaunchPad_(MS...](http://processors.wiki.ti.com/index.php/MSP430_LaunchPad_\(MSP- EXP430G2\)#Quick_Links)) has a list of alternate suppliers.</comment></comment>


The Starfighter Low-Level Tech Tree - <AUTHOR> http://sockpuppet.org/issue-79-file-0xb-foxport-hht-hacking.txt.html <comment><AUTHOR> I'm really excited for this to come out. The release email had the following before the text you can see in the submission:

 _Helu,

This is Thomas. Here is a thing somebody wrote about Stockfighter, our project, which we're sending you because you asked us for updates from starfighters.io.

We hope you enjoy reading it. (If you want to read it in a browser, try here. Works best in a fixed-width font.)

Assuming there are no other Carpathian trickster-gods we've somehow managed to anger, you should be able to play both tech trees of Stockfighter by the end of the week. Patrick wants me to say the day, but I'm pretty sure speaking the names of actual days of the week in sentences about this project is one of the things that angers the Carpathian trickster-gods, so let's just say "a day that rhymes with Shplyday".

furtive glances over shoulder_

If it does come out this week, my holidays are not going to be very productive - or perhaps very productive, depending on your perspective!

I think this is the first real look at the low level tech tree and what kind of things it will contain. I'm excited by both of the tech trees so far, I think it will be interesting working through both of them.

I really enjoyed the style of this information release, quite a lot of information but the writing almost seemed tongue-in-cheek the whole time and was fun to read.

<comment><USER2> I do not understand what you are talking about. The article describes reverse engineering of a stock trading device, covers the basics of assembly, and shows the poor security of trading systems.

But what do you mean by "low level tech tree"? None of those words are in the article.

Edit: Apparently this is all part of a fictional game.

<comment><USER3> > But what do you mean by "low level tech tree"? None of those words are in > the article.

The title of the submission is taken directly from the email subject.

[http://starfighters.io/](http://starfighters.io/) has a great intro to what this is, made by community members 'patio11 and 'tptacek.

</comment></comment></comment><comment><USER4> I feel like I've fallen into a hole. There's jargon everywhere, I'm not sure if I'm in the middle of some sort of satirical art experiment.

Can anyone explain what is going on?

<comment><USER5> Apparently it is a fake reverse engineering report to support a programming game which, i'm guessing, is about to go live? see [http://www.kalzumeus.com/2015/08/20/designing-and- building-s...](http://www.kalzumeus.com/2015/08/20/designing-and-building- stockfighter-our-programming-game/)

<comment><USER6> This reminds me of when 0x10c was announced :)

[https://news.ycombinator.com/item?id=4649031](https://news.ycombinator.com/item?id=4649031)

<comment><USER7> That was such a let down in the end...

<comment><USER8> Good thing this is made by people who have already proved what they were worth. I love Notch but he never seemed like a "worker" type. He was just having fun until it was no longer fun.

<comment><USER9> Setting the bar a little high for us, aren't you?

<comment><USER8> Well this is just the image I have of Notch. He was just goofing around with mini-games. One became ultra famous. Lots of people got involved and it exploded from there, not really in his control.

Doesn't mean the game is not great, doesn't mean he's not skilled. Maybe I'm just sour about all his talk on 0x1c before giving up.

<comment><USER5> 0x10c was a classic 2nd system effect.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> P.S., since it isn't in that post anywhere due to in-game voice: Stockfighter launches publicly on Friday.

<comment><USER11> I signed up but I don't honestly recall what it is. Is it called "Starfighter" because it's like the excalibur game from "The Last Starfighter"?

<comment><USER12> No it is from [http://www.imdb.com/title/tt0083943/](http://www.imdb.com/title/tt0083943/) with Clint Eastwood and web browser that can be controlled with your mind.

<comment><USER11> Unfortunately the browser only accepts mind control commands in Russian, no i18n for you.

</comment></comment></comment></comment><comment><USER13> > The better exchanges do have passwords on their FIX gateways. But the > performance of a FIX login is especially important (there's often a race to > start trading at the beginning of a session)

Better exchanges enable their FIX gateways long before they accept orders. They can signal their willingness to accept orders by sending everyone a message which says "we are open." Consider also that some exchanges trade products with disparate opening times. All the same applies at the close but in reverse. Better exchanges will tell you each of your orders is closed before they disconnect. Worse ones suggest you infer the same.

<comment><USER14> Yep most of the FIX connections I've seen are connected for most of the day, long outside trading hours. Tag 103 has specific error codes for the exchange being closed.

<comment><USER15> And I here thought FIX is a fictional protocol devised specifically for this game...

<comment><USER16> I didn't believe from beginning on that FIX was fictional, since if it's a real protocol (or at least very near to a real protocol) it makes programmers that are good at Stockfighter a lot more placeable in the market - and this is what Starfighter wants to make money with.

</comment></comment></comment></comment><comment><USER17> What a beautiful intro to assembly programming and reverse engineering. Very minor issues that bother me more than they should:

\- Could it be that there is a whitespace missing after the " ◐ " or is the gap in the border intentional?

\- X/Z are used in the 'program structure' example without introducing them beforehand (or mentioning 'we will look at these later').

\- A real RE report would certainly have mentioned all visible part numbers and the type of I/O controller. Although it is certainly not relevant to the game, it somehow bothers me that the author decided to omit this information. (hmm, maybe this was described in Section 3?)

<comment><USER18> For your #2, quoting from the link:

Loads and stores are relative to the X, Y, and Z registers, which are aliases for the 16 bit register pairs starting at r26, r28, and r30 respectively (r30 is an alias for Z)

<comment><USER17> Indeed. However, this explanation is only given _after_ the example has already made use of these registers. As I stated, just a very minor issue... :)

</comment></comment></comment><comment><USER19> I'm super stoked for Stockfighter to come out, but I'm confused about something...

If you intend for performance in Stockfighter to be used as a proxy for talent by recruiters, how do you intend to prevent cheating? Seems like it should be very easy for people to work in groups, or look up walkthroughs online.

<comment><USER10> Stockfighter generates signals about players. Those signals get fed to the Starfighter founders. We might choose to get in touch with particular players and, if they want to have a geek-to-geek chat, have a brief phone call with them. We then, if appropriate, introduce them to people who can hire them at our clients. We get paid if that introduction results in an accepted job offer.

People have asked us about a variety of ways to cheat on the games. Some of them don't strike us as even a little bit problematic, e.g. using an OSS library to access our API. (Some folks are already working on these and we're thrilled about that development.)

Some of the ways people could cheat on Stockfighter are, from the perspective of someone wanting to hire engineers, pretty awesome. If you get arbitrary code execution which busts out of an emulator written by the Ptaceks _I urgently want to make your acquaintance_.

Some of the other, more boring ways that one could cheat do not particularly strike me as bothersome to our business model. We're not selling certs; we're brokering introductions of candidates to businesses that want to hire them. Scamming a row out of our database doesn't meaningfully negatively affect the world, Starfighter, or our clients. I've got _lots_ of rows.

<comment><USER20> Basically, IIRC, you're saying if someone does cheat (as in buys a good account or hires someone to kick ass for them), you human filter them anyways and it'll be pretty obvious they don't know what they're doing.

Though I was a bit confused by a statement you made. You said you'd need to beat the Turing test to automatically pass the last level of Stockfighter. But if that's true, how are you generating and validating the levels - that seems an equivalent challenge. (Unless you've made tons by hand.)

</comment></comment></comment><comment><USER21> "Legal at 35=G Inc will allow me to publish this article only if this section is not present."

I love the FIX meta humor. Order Cancel Replace Request: tag 35=G.

<comment><USER9> I can't take credit for this; an ex-HFT friend gave the name to me. :)

</comment></comment><comment><USER22> Awesome.

Having recently done a large chunk of Microcorruption, I think I get what they are going for here. Super excited.

But also a little nervous as to the timing. Like others have said, if this releases before xmas, my level of interaction with the real world may have a real impact on the most wonderful time of the year, family togetherness, etc, etc.

I'd love it if one of the founders could tell me if there's any PVP element to the low-level tech tree? What I'm really asking is if I put off playing this until some time in January, have I put myself at a disadvantage?

<comment><USER9> No. We're releasing something for people to play with before we release the actual CTF levels, to try to level the playing field a bit.

<comment><USER23> Is it too early to ask for a writeup of the connection between Real and Game economies?

If there isn't a strong tether to "real data" than this question is moot, but if that's a key part of this experiment, then I and many others will start drooling at y'alls feet pretty soon here.

<comment><USER10> I'm not going to write about our economic simulation at all, but it _may_ be reverse-engineerable. Mad props, and infinite amounts of fake Interney money, to anyone who figures it out.

<comment><USER24> "Fake Internety money" of course actually translates into real job opportunities in this case.

</comment></comment></comment></comment></comment><comment><USER25> Any predictions on how all this is going to go? Loving the throwback phrack vibe. I wonder though how much time I'm going to be able to dedicate to smashing the stack for fun and rankings. Oh, to be 13 again.

<comment><USER26> As interesting as the game is, even more interesting to me is their business model. Contingent recruiters are uniformly terrible.

To be honest, even if I didn't know them, based on their online reputations I'd expect them to be the best contingent recruiters in the country within weeks. That I completely & totally agree with their underlying philosophy on hiring makes me even more bullish.

Of course, all of that is contingent on them delivering on the game experience and delivery software products is...hard.

</comment></comment><comment><USER27> I am curious if hirers will use stockfighter to hire folks low-level embedded work, or if this will be an arbitrary shibboleth for general jobs, biased toward people interested in this sort of game. I hope starfighter expands into more diverse areas of interest.

<comment><AUTHOR> One theory bandied about is that the initial partner companies that Starfighter is working with (ie the ones looking to hire) includes a disproportionate number of financish companies such as might be found on the east coast.

I wouldn't be surprised if lots of companies in that domain would be very interested in the candidates coming out of Stockfighter, however there are so many subsystems involved in the problem environments disclosed so far that many valuable skill sets have the potential to be exercised. Part of the (general) success of both Stockfighter and Starfighter will be how well they manage to _actually_ exercise those different skill sets.

I'm cautiously optimistic so far :)

<comment><USER9> Not so much. We chose markets because we think they're fun.

<comment><AUTHOR> That was my impression as well.

There have been a number of comments from people who find the idea of the markets 'unfun', or just not relevant to the roles and tasks they want to be doing. My impression from what has been released so far is that there is actually a plethora of tasks/technologies/etc involved, and as such 'useful' skills will be used regardless of if you're in the finance industry.

<comment><USER28> I've heard Patrick make that very assertion.

</comment></comment></comment></comment></comment><comment><USER29> I guess you could consider this a noob question. I'd like to get into this and more low level stuff in general.

Background:

I'm an applied math guy that works in cv, image processing, and anywhere that stats & optimization can be used. Work has recently led to learning more distributed stuff, albeit simply wiring up zeroMQ with c++ or python and getting the concurrent dances right.

Is it safe to say that Microcorruption is sort of a pre-req to this? Should I muck around in there first for a bit or sign right up for starfighter? Thanks.

<comment><USER9> No, you don't need to get through Microcorruption. This is Microcorruption on a different architecture, with a more complex environment.

But I like Microcorruption too (I'm biased) and would definitely not try to talk anyone out of playing with it as well.

</comment></comment><comment><USER11> Interesting that their json variant uses trailing commas. Too bad that's not more common.

<comment><USER2> I was surprised to see JSON in the low level messaging of a device that is supposedly (c) 1993-2015.

<comment><USER9> Not as surprised as I was to actually work with JSON in AVR C.

</comment></comment></comment><comment> J-dawg I don't think I have the skills to get very far in Stockfighter (although I'll give it a try). I wonder if there are any plans to produce an "entry-level" version? It strikes me that this would work brilliantly as a teaching tool, and could open it up to a whole new market.

</comment><comment><USER30> I'm really hyped for this. If this is as much fun as the microcorruption CTF I'm going to be glued to my computer until I solve all of it!

I like what I'm seeing so far, AVR sounds like a fun new challenge.

</comment><comment><USER19> Another question - if you haven't bene able to dump the code running on the Network and Mystery chips, how do you know they're AVR ?

<comment><USER31> In case you haven't seen previous discussion around Starfighters: this document is fiction, describing a scenario that was invented for a game based on software reverse engineering, to be launched shortly. But one possible in- universe explanation would simply be that the three chips had the same part number.

<comment><USER19> I do understand that -- I was asking for the in-universe explanation :)

<comment><USER32> One images they observed the part number while attaching the bus sniffer.

</comment></comment></comment></comment><comment><USER33> _lurking inside the 1995 handheld UI is a more sophisticated 1997-grade trading engine_

I do like the sense of humour here.

</comment><comment><USER34> Excited. But also really intimidated :)

</comment><comment><USER35> I guess the link no longer works, the correct seems to be: [http://sockpuppet.org/blog/2015/07/13/starfighter/](http://sockpuppet.org/blog/2015/07/13/starfighter/)

</comment><comment><USER36> Is it me or this looks like an article taken from Phrack magazine or SET journal or any hacking related magazine from late 80s/early 90s?

</comment><comment><USER37> I've been wondering what I should do to keep busy in the next month between jobs. Looks like I've found it.</comment>


Amazon to spend $5B on second US headquarters - <AUTHOR> https://www.nytimes.com/2017/09/07/technology/amazon-headquarters-north-america.html <comment><AUTHOR> Austin seems like a strong candidate, since it's a major high tech hub and Whole Foods is headquartered there.</comment>


Free "Startup Wisdom" ebook from the MicroConf speakers - <AUTHOR> http://www.microconf.com/ebook.html

<comment><USER2> It frustrates me when something is labeled "free" but I have to tweet to my friends to get it.

Social capital isn't free.

<comment><USER3> Yes. I'd much rather pay $N than spam my network.

<comment><USER4> Actually, the way I see it, if the book is interesting for _me_ to read, then it'll probably be interesting for my friends to read as well. I don't love the tactic, but I don't think it's that bad (assuming I know the book is interesting, and not a completely speculative thing).

</comment></comment></comment><comment><USER5> This is a collection of blog posts that most of us have in our bookmarks someplace.

<comment><USER6> There are 7 essays; 3 are new, 4 have been published previously.

<comment><USER5> Rob, which 3 are new? I felt I had read all of them before.

</comment></comment></comment><comment><USER7> Anyone here have plans to attend? I am considering...

<comment><USER8> I'm going.</comment></comment>


Symfony 2.0 is now available - <AUTHOR> http://symfony.com/blog/symfony-2-0

<comment><USER2> I've looked through some source code in the Symfony 2 components. The code is well organized, commented, and most of all it is of high quality.

As far as I am concerned, Symfony 2 is the gold standard example for developing a PHP project of any kind.

<comment><USER3> what do you think about Yii framework which is also gaining popularity these days,

<comment><USER4> I think it's disgusting. It tries to use the component model, similar to ASP.NET. Even Microsoft realized what a disaster it was, and the community moving to ASP.NET MVC, which is similar to traditional frameworks.

</comment></comment></comment><comment><USER5> If you need a lightweight - Sinatra like framework check <http://silex- project.org/> it is built from Symfony components and works like a charm

<comment><USER6> Silex is cool. I did a quick-and-dirty benchmark with it and AiP a while back, and performance was comparable to Node.js and Express:

[http://bergie.iki.fi/blog/php_can_perform_better_than_node-j...](http://bergie.iki.fi/blog/php_can_perform_better_than_node- js/)

</comment></comment><comment><USER7> The project team did an amazing job with this release. I'm not a Symfony user myself, but their website is very professional and well organized and the documentation is excellent -- very thorough and updated for the new release.

Beyond methodology and community, one of the major decisions involved when selecting a framework is being confident that your codebase will be supported in the near future. The Symfony developers and community seem very committed to their framework. Great Job!

</comment><comment><USER8> I'm woking with Symfony 2 now for a half-year. And I can say that it is brilliant. Dependency Injection that they have implemented is a really nice feature. It is also great that it consists of de-coupled components. You can use any of the components including Dependency Injection in ur PHP projects.

<comment><USER9> Same here, I have been using it on a new project since November 2010 and it has been great, following the commits on Github and upgrading when necessary has been relatively easy. This project has really opened my eyes to the power that Git + Github (when used properly) can bring to open source software.

I would also like to add that Fabien Potencier has been amazing and is officially a coding Robot!

</comment></comment><comment><USER10> For those wants to know more about Symfony, I can assure you Symfony and Yii are at different leagues. Symfony is so much more featured than any PHP framework out there. Yml based settings and modeling plus the Admin Generator is one of a kind. I believe it is even better than Django and Rails, when it comes to flexibility and extensibility.

<comment><USER11> Just curious about that first sentence there... are you saying that Symfony and Yii are both in the same league, different from everything else, or that Symfony is in a league different from the one that Yii is in?

I haven't looked at Symfony, but I was really impressed by the event driven nature of Yii, and I couldn't wipe the smile off my face when I started looking into the active page elements.

I think 2.0 is as good an excuse as any to check out Symfony though, so goodbye to the weekend :)

<comment><USER10> I was meaning "Symfony is in a league different from the one that Yii is in"

I value Symfony so much because you can create all model classes, crud forms etc from command line (as much as you want as you update your schema) just based on specifications from a easy to manage yml file. Also with ORM behaviors, you are in control of everything about your model.

<comment><USER12> In that case I wonder what makes you compare the two frameworks and what you actually think the two are in such a separate league. You keep talking about Symfony without actually comparing it with Yii as your initial statement made me think you would. :)

<comment><USER10> Sorry about misleading, when I talk about symfony and tell about its features, I tried to pick superior parts where Yii lacks

</comment></comment></comment></comment></comment><comment><USER13> Congratulations to Fabien and the Sensio team! Fabien is an amazing evangelist for the framework, and I've had the good fortune to attend Fabien's talks on multiple occasions. I've used Symfony since 2007 and it's clear the framework has staying power and significant adoption with each new year. Congrats again!

</comment><comment><USER6> I'm currently in process of building compatibility layers from our two old PHP frameworks (MidCOM and Midgard MVC) to Symfony, and have been very pleasantly surprised with both the code quality and the responsiveness of the community.

As part of this work I will also write new Symfony2 bundles for whatever functiolity our old frameworks had a SF2 misses. The first one is the ability to run Symfony2 apps under AppServer-in-PHP, a pure-PHP application/HTTP server. No Apache required! :-)

<https://github.com/bergie/MidgardAppServerBundle>

<comment><USER14> Since PHP 5.4 there's a web server built-in: <http://php.net/manual/en/features.commandline.webserver.php>

Maybe you could rely on that, instead of aip :)

<comment><USER6> Maybe, though AiP gives us nice control of the process. And it also supports other modes than HTTP, like Mongrel2 and SCGI:

[https://github.com/indeyets/appserver-in- php/tree/master/AiP...](https://github.com/indeyets/appserver-in- php/tree/master/AiP/Protocol)

Anyway, based on your suggestion I posted a quick ticket about adding support for the built-in PHP webserver:

<https://github.com/indeyets/appserver-in-php/issues/17>

</comment></comment></comment><comment><USER15> I wish they would stop referring to their documentation as a "book." The keep calling the link to <http://symfony.com/doc/current/book/index.html> as their book, yet it offers no ebook manner of being accessed (my kingdom for a PDF.)

I can't help but wonder who this "book" is being marketed to because of this "you can only access the book while you're fully online" limitation.

</comment><comment><USER16> Can someone comment on Symfony vs. CodeIgniter? I've done a few projects in CI - any big compelling reason to switch to Symfony for the next one?

<comment><USER17> CodeIgniter is a fundamentally PHP4 system that is, today, wedged into more modern PHP5.3 programming practices. Personally, I can't see a good reason to use CI today (and I say that as someone who has used it extensively in the past--my capstone project at school was based on it!). If you want something CI-esque, you're better off looking at Kohana...but Kohana seems to give short shrift to certain important aspects, e.g. security is something of an afterthought.

Symfony2, on the other hand, can be pretty safely termed a modern system: it's almost completely modular (and not in the "override some files, it's like magic!" method of Kohana or CI), expects modern programming practices (it doesn't treat you like an idiot; you can use PHP 5.3 stuff like anonymous functions and it's cool with it), and is blazingly, blazingly fast when configured properly.

<comment><USER18> I disagree with your view of CodeIgniter. It's one of the best documented frameworks out there; it's quick to learn; and it doesn't require a lot of typing/coding. It's best suited for smaller projects, I would say, but for those projects it rocks.

<comment><USER17> CodeIgniter's documentation is indeed very good. Much better than Symfony2's, at least. I'd agree with you on that.

CodeIgniter also has no conception of how to actually work in PHP5.3. Perhaps CodeIgniter will acquire that down the road, but right now it's a poor routing kernel surrounded by a lot of inconsistent and very ugly modules that are duplicated or improved upon in the other major frameworks in common use.

"Doesn't require a lot of coding" is nonsensical; I can build a Symfony2 application to do nontrivial task in less time, with better and more reliable code, than I can the equivalent in CodeIgniter. And I used CodeIgniter since around the time of the original release. There are not many cases where something is top-to-bottom dominant in its field, but aside from documentation, which is being improved upon incrementally, Symfony2 really does fit that bill.

</comment></comment></comment></comment><comment><USER19> > _Everything is a Bundle in Symfony2: A bundle is a directory containing a > set of files (PHP files, stylesheets, JavaScripts, images, ...) that > implement a single feature (a blog, a forum, etc). That changes everything. > Share your bundles between your projects or publish them in the wild._

I have no idea whether this is novel, but it is to me, and I _really_ like it.

<comment><USER20> Sounds a little like apps in Djangoland. Maybe someone who knows both frameworks could confirm.

<comment><USER6> This has been a core idea in both Midgard MVC and MidCOM PHP frameworks, though we called them components.

<http://wiki.openpsa2.org/index.php/MidCOM_Components>

[https://github.com/midgardproject/midgardmvc_core/blob/maste...](https://github.com/midgardproject/midgardmvc_core/blob/master/documentation/index.markdown)

<comment><USER21> I really hate why Django calls them 'apps'. Kinda difficult to distinguish between a working application or a Django 'app'.

<comment><USER22> I agree, I might have one 'app' that is what I consider my actual application, but then alongside it at the same level, something like Django OAuth. It would be a stretch to call django-registration or OAuth an 'app', since they can't do anything alone.

</comment></comment></comment></comment></comment><comment><USER23> Very, very excited about this and have been for some time, congratulations to the team on the release! For those that don't know it, Symfony is a very impressive framework that puts a lot more into "Doing Things Right" than most other PHP frameworks, and some of their components (such as Assetic) are amazing contributions to the PHP ecosystem in their own right.

</comment><comment><USER24> Congrats to Symfony2 Team!

FYI, Symfony2 requires minimum PHP version 5.3.2

PHP 5.3 which is not something every shared hosting provider will support, most are still on 5.2.series. so everyone should keep that in mind while writing PHP app with Symfony2

<comment><USER25> I hear these sorts of things regarding hosting all of the time. However, in my experience, if you are working on an app that is large enough to warrant using a framework like Symfony or Zend Framework, you are probably going to also be using your own server. People don't build large expensive applications and then deploy to GoDaddy or something :)

<comment><USER26> Agree completely. CodeIgniter used to use this as an argument for supporting PHP4 (!!?!?!?), but it seems so bankrupt. I (anecdotal, I know) don't know a single person writing an application (what these frameworks are designed for) who would deploy to a classic shared hosting environment over a VPS or app cloud service.

</comment></comment></comment><comment><USER27> Well done to everyone involved, looking forward to checking out all of the new features.

</comment><comment><USER28> I'd never heard of Symfony before. Can someone point to some tech details about the framework? The site does a lot of explaining what a framework is, and some general philosophies - but not what this particular framework is.

<comment><USER29> Same here. No Idea where this came from. To be honest the effort put into this could've just contributed to an existing open source framework for improvement.

<comment><USER19> You sound like a PHP coder telling DHH to stop doing Rails 3 and get working on some existing open source framework instead.

I know that HN is somewhat ignorant of the PHP community due to the large set of idiots there and the _so not cool_ factor, but you're taking this to the extreme. Symfony is probably one of the most decent and most widely used pieces of open source PHP out there.

<comment><USER17> Sadly, Symfony/Symfony2 are not widely used _enough_. :/

(This may be a bit flippant, but seriously--there's not really a good reason to be using stuff like CakePHP, etc. in 2011.)

<comment><USER30> I may be in the process of updating a very neglected cakephp site. When I created the site, I had heard of Symfony but went with cakephp. I've not followed either framework for well over a year, so could you please give your reasons for Symfony and against cakephp?

<comment><USER19> To my experience, Cake simply does not grow beyond their own blog tutorial.

Maybe they fixed this, but last time I used Cake, for instance, if you were overriding hooks in the Model to e.g. change the data as returned to the view/controller, you had to do this different depending on how the data was collected. So in the same hook method of the BananaPeer, you either got a single Banana, or an array of Banana objects, or an array with a key "Bananas" which had an array of Banana objects. There was no way to figure this out except with a lot of testing. There was no uniform way to implement standard features and constraints inside the model.

Cake was full of this kind of shit. It was, simply, horribly badly designed and to my impression only popular because its web site was pretty. The source code was horribly undocumented and the internal SQL query building process was a disaster.

<comment><USER17> Personally, I think that Cake was popular because it was one of the first frameworks out there. It's been surpassed by all sorts of folks (Symfony2 now chief among them).

I think that, next time someone asks me why Cake sucks, I'm just going to say "BananaPeer" over and over again.

Because bananas don't have peers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> have been using Symfony since 2007. Today it powers the backend and website of my gaming startup and we still love it very much. Project is still SF 1.4 though, would love to upgrade to 2.0 but that would be too much work right now as 2.0 changes alot of basic principles.

</comment><comment><USER32> In the meantime Zend Framework folks are designing Zend Framework 2.0 for PHP 5.4. U mad symfony ? :)

</comment><comment><USER33> I highly recommend Yii ( <http://www.yiiframework.com/> ) for people looking for a PHP framework. I've never used Symfony so can't compare the two, but Yii has done everything I've asked of it.

<comment><USER34> I highly recommend Python for people looking into web development. I've never used PHP so can't compare the two, but Python has done everything I've asked of it.

 _(end joke)_</comment></comment>


One Hand Clapping -- Entrepreneurship in Ann Arbor, Michigan - <AUTHOR> http://steveblank.com/2011/04/07/one-hand-clapping-–-entrepreneurship-in-ann-arbor-michigan/

<comment><USER2> I understand the point that the writer makes but I don't understand the negativity of the point of view.

Yes, from what he writes, there are holes in the entrepreneurial environment in Ann Arbor. Members of that community must realize that or they wouldn't be bringing in people from outside.

What I don't get is how after accepting payment to be an asset in helping fill those holes he turns around and hits them with such a condescending post.

If you're being paid to be part of the solution then be part of the solution. If for no other reason then throwing your clients under the bus has a way of limiting future engagements.

<comment><USER3> "Accepting payment..." "If you're being paid to be part of the solution then be part of the solution." Funny. That's why most consultants tell the clients what they want to hear.

If I took money for this I'd have lie as well.

</comment></comment><comment><USER4> As someone that is very active in the tech community here in Ann Arbor, I can verify his claims. Ann Arbor (and south east Michigan as a whole) is not lacking in extremely talented programmers, engineers, researchers, and other potential startup candidates. Many of these people are incredibly passionate and knowledgable about their fields.

However-there is almost a complete lack of startup funding. If someone graduates from UofM and wants to launch a biomedical startup there is some money to be had, but if you want to launch the next hot computer startup you're out in the cold. There's next to no VC money and very little support for a just starting company. Ann Arbor SPARK is there to offer some support, but more certainly could be done.

</comment><comment><USER5> I would love to answer anyone's questions about what's happening around the University of Michigan and Ann Arbor, from a student's perspective!

I lead a project in MPowered, the student entrepreneurship org here at UM, I study CS in the College of Engineering, am a regular A2NewTech attendee, and am generally pretty familiar with the ecosystem here.

</comment><comment><USER6> The auto industry provides a further handicap to startups in Southeast Michigan. Former auto company staff are everywhere, so their fucked up culture seeps into every company and organization.

<comment><USER4> I can't really agree with you here. While there are many ex- Ford/GM/Chrsyler/Visteon/etc guys out and about, many of them are running their own quite successful businesses outside of the Big-3. I'm not saying they're all out of the auto business, but they're running their own small companies and generating serious revenue.

</comment></comment><comment><USER7> Regional graphs of venture capital for q4 2010, looks like there are worse places to be than Michigan, but silicon valley it is not.

<https://www.pwcmoneytree.com/MTPublic/ns/nav.jsp?page=region>

</comment><comment><USER5> More comments: <http://news.ycombinator.com/item?id=2419884></comment>


Planar Voronoi Diagrams via Fortune's Algorithm - <AUTHOR> http://www.amath.washington.edu/~dnlennon/voronoi/

<comment><USER2> Nice explanation.

What I'd like to see next, is an animation of the algorithm in progress, showing the intersections between the parabolic curves sweeping out the edges of the V.D.</comment>


Snelson's Atoms: "It Must Give Off and Receive Light Like a Tiny Space Station" - <AUTHOR> http://www.dataisnature.com/?p=2160 <comment><USER2> The models have a striking similarity to Polywell's fusion device. [http://www.bing.com/images/search?q=polywell](http://www.bing.com/images/search?q=polywell)</comment>


Create Stores with Parse - <AUTHOR> https://parse.com/store

<comment><USER2> Hmm. They seem to be launching this almost as if its part of their service, but really it's just a sort of general-purpose example that _utilizes_ their services. Might this indicate some kind of partnership with Stripe?

Edit: Yup. [http://thenextweb.com/mobile/2013/03/21/stripe-partners- with...](http://thenextweb.com/mobile/2013/03/21/stripe-partners-with-parse- and-updates-android-and-ios-libraries-to-ease-accepting-payments-in-mobile- apps/)</comment>


Nonprofit News Web Site Wins Investigative Journalism Award (audio) - <AUTHOR> http://www.npr.org/templates/story/story.php?storyId=102851849

<comment><AUTHOR> This one needs a little background. There's a meme going around these days that the demise of newspapers is bad for democracy: who will report on city hall, hold local officials to account, etc? This story is a great counterexample.</comment>


Show HN: Hello World in Different Languages - <AUTHOR> https://github.com/iamrobinhood12345/hello-world-again <comment><AUTHOR> Hello world in different languages. Open to adding more.</comment>


Ask HN: Should we as community create all-star groups for RFS? - <AUTHOR>

Should we as community create all-star groups for RFS? Thus helping improve the chances for individual members. <comment><USER2> If I had the inclination to do such a thing, I wouldn't post an Ask HN about it.

I would:

1\. Look at the top 50 HN contributors, looking at their profile (and possibly checking up on some of their posts) to figure out if they are already committed to some project or company that would interfere with working with you.

2\. Auto-select any names you recognize as people you "like". You know they're smart, and not merely prolific at posting to HN. Also look into any names you know you like who _aren't_ among the top 50.

3\. Figure out your own strengths, and, based on your lists comments, narrow down to a handful of folks with contrasting strengths and interests. A team of hardcore developer that churns out code like a machine, and a generalist that doesn't mind closing vim/emacs when other tasks need doing who also happens to have either design skills or at least an eye for great design, would be my ideal combination (but this may be reflective of my own limited experience rather than any blinding insight).

4\. Contact the short list directly, one or two at a time, with a "Hey, would you be interested in trying an experiment with me, based on RFS #X?"

5\. Profit!

<comment><USER3> You really think that those who post the most on HN would make the best hackers or founders?

An HN thread sounds just as reasonable an idea as any other.

<comment><USER4> That's the point of bullet point #2. The advantage of going for top posters is that you have a lot of data to judge whether you'd like to work with them. While if someone pops up to answer just one question, you have virtually nothing to go on. Is he a really sharp guy who doesn't have time for HN? Or just an opportunist?

That said, I don't think this is a particularly good idea. The best way to find out if you'd make a compatible team is to actually go and work with someone. When I've turned down startups, it's often not because I thought the idea or other team members were bad (often times, they're very good), it's because I don't feel any particular passion for working on that particular problem with those particular people.

</comment></comment></comment><comment><USER5> How would that work? Who would make decisions about building the groups? Would 'good' people just be placed together - that doesn't make a good team.

It seems like something that could happen, but making it a community (as in HN) effort seems like it has too many issues.

<comment><AUTHOR> People would apply for an RFS showcasing why they are qualified for that particular idea, their previous experience, working habits (to ensure team members get along) etc.

The community could then put it to all poll.

The other option is to simply have a database showcasing every interested applicant along with contact info. Then it would be up to them to find a team that works well together.</comment></comment>


Could a checklist app result in lawsuits if it leads to OCD?  - <AUTHOR>

For example, one might have a checklist for leaving the house.  This may give you some comfort at first but may eventually lead to OCD. <comment><USER2> The answers to legal questions are almost always, "It depends." More facts are always needed than given to determine how the case might come out. I say "might come out" because you need to remember that you have a jury and a judge interpreting fact and law. And how those two play out vary by jurisdiction.

There are potential tort liabilities. Each jurisdiction has its own rules of law for that. An understanding about "proximate causation" will put you on the path to assessing your own tort liability risk.

A study of contracts in your jurisdiction is needed to assess your contract liability risk.

Every jurisdiction has its on strict and products liability laws, so you need to learn those, too.

Further compounding your issue is what jurisdiction's rule of law applies? The facts and the lawyer's skills will determine how that plays out.

So the answer to your question is, "It depends."

</comment><comment><USER3> Any software app or business can lead to lawsuits for any reason at all. Basically, if your company makes any kind of significant money, other people or businesses will do whatever they can to try to take it from you.

A well written terms of service for your application should include legalese to cover liability for use of the service ("you use the software at your own risk, you don't hold us responsible for damages due to use of the software, no expressed warranty, etc"). You're probably ok just using a sample terms of service if you are solo or small, but you will want to talk to an actual lawyer with experience in this stuff when your business grows and you start making significant money.

Disclosure: I build legal case management software for large organizations, so I'm not a lawyer, but I am familiar with the kinds of things that companies get sued for (everything!).</comment>


The OPM Data Breach [pdf] - <AUTHOR> https://oversight.house.gov/wp-content/uploads/2016/09/The-OPM-Data-Breach-How-the-Government-Jeopardized-Our-National-Security-for-More-than-a-Generation.pdf <comment><USER2> One of the most frustrating things about this whole fiasco is that the OPM breach finally became public in the summer of 2015, but I and many other victims weren't officially notified (or offered our measly couple years of identity protection) until December or later. At the time, I shared some of my thoughts on the breach here (some of the info may be out of date in light of the new report; I was piecing stuff together as best as I could): [https://forrestbrazeal.com/2015/12/08/welp-i-was-an-opm- hack...](https://forrestbrazeal.com/2015/12/08/welp-i-was-an-opm-hack-victim/)

I was also annoyed that so much of the political posturing around the breach centered on OPM systems' lack of encryption. I haven't read all of this report, but it's nice to see the summary focusing on the lack of 2FA, a security practice that would actually have helped stop an internal infiltrator.

<comment><USER3> I still never received any notice about it. Was employed by DoD in late 00's, so am fairly certain my info was in the batch.

<comment><USER4> I believe Defense had their own, parallel system, so it may not be a given that you're in the leak.

<comment> nommm-nommm Cleared employees are in the OPM data leak.

<comment><USER4> Not all of them. For example, the reported risk to CIA agents in US embassies in China was that they would suspiciously _not_ be in the leaked data like actual State dept staff would be.

Apparently the Defense investigators (DSS) merged into OPM in 2004- [https://en.wikipedia.org/wiki/Defense_Security_Service](https://en.wikipedia.org/wiki/Defense_Security_Service)

</comment></comment></comment></comment></comment><comment><USER5> For folks that want an OCRed version (using ABBYY) for easier Ctrl-F'ing:

[http://data.danwin.com/pdfs/house-oversight-opm- breach-2016-...](http://data.danwin.com/pdfs/house-oversight-opm- breach-2016-09-07__OCR.pdf)

(not sure why ABBYY blew its size up to 98MB...)

And here it is in plaintext via pdftotext:

[http://data.danwin.com/pdfs/house-oversight-opm- breach-2016-...](http://data.danwin.com/pdfs/house-oversight-opm- breach-2016-09-07__OCR.txt)

</comment><comment><USER6> This isn't the "official postmortem". It's the official report of the GOP-led House Oversight and Government Reform Committee. It's a partisan political document.

A better title:

Republican House Oversight Report On OPM Data Breach.

<comment><USER7> In some places its typical for such legislative committees to also issue minority/dissenting reports - does that happen in the US?

<comment><USER8> Yes the minority members of a committee can issue their own reports, e.g. [0]. It probably won't happen in this case because the "other" party just wants this issue to go away. Arguing in public would only draw attention.

[0] [http://democrats- benghazi.house.gov/sites/democrats.benghazi...](http://democrats- benghazi.house.gov/sites/democrats.benghazi.house.gov/files/documents/Report_of_the_Benghazi_Select_Committee_Democratic_Members- Honoring_Courage_Improving_Security_and_Fighting_the_Exploitation_of_a_Tragedy.pdf)

<comment><USER9> > It probably won't happen in this case because the "other" party just wants > this issue to go away. Arguing in public would only draw attention.

From tptacek's comment, made ~5 minutes before yours:

[http://democrats.oversight.house.gov/news/press- releases/cum...](http://democrats.oversight.house.gov/news/press- releases/cummings-releases-staff-memo-on-cyber-attacks-against-opm)

Why would they want to avoid discussing this?

<comment><USER8> That looks like a different thing? I.e. a "memo" prepared by "staff"?

Nevertheless I'm sorry to have made a comment that seemed partisan. The Democrats and Republicans can both jump in a lake for all I care.

<comment><USER6> No, it's the response of the ranking minority member of the committee that produced the report we're all commenting on. It's right there in the title.

</comment></comment></comment></comment></comment></comment><comment><USER10> _" Additionally, fingerprint data of 5.6 million of these individuals was stolen."_

They'll need to change their fingerprints immediately!

<comment><USER11> The letter they sent me claimed that there is currently no way to create fake fingerprints, so there's nothing to be worried about, 2 years of identity theft monitoring is good enough.

<comment><USER12> In what world are they living, where there is "no way to create fake fingerprints"? Of course that is possible. Here is one example: [http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren.en](http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren.en)

It is easily possible to create fake fingerprints that can fool any known finger print scanner. If you know one, that supposedly can't be tricked, please let me know.

</comment></comment></comment><comment><USER13> > The Exfiltration of the Security Clearance Files Could Have Been Prevented.

TL;DR, there were two intrusion actors that were acting in concert. After being notified by US-CERT of exfiltration activity from the OPM network, OPM monitored the first one, who conducted the initial breach (use of contractor login credentials) and then performed survey of their network. They attempted to flush out her malware but failed to account for a second actor that had managed to leave an alternate access point into the network.

> "Notably, OPM Director of IT Security Operations, Jeff Wagner, recommended > deploying ... preventative technology"

So the problem was identified and brought up to committee and still ignored/tabled by the CIO, Donna Seymour. Preventive measures were only undertaken after the exfiltration of security clearance data was complete.

<comment><USER14> " and still ignored/tabled by the CIO, Donna Seymour. "

Does she still have that job? If so.. ugh.

<comment><USER15> She retired [1]

[1] [https://oversight.house.gov/release/chaffetz-responds-to- ret...](https://oversight.house.gov/release/chaffetz-responds-to-retirement- of-opm-cio-donna-seymour/)

</comment></comment></comment><comment><USER16> Interesting to see the steps they took to expel the APT (physically verifying the identity of account holders on account resets, taking services offline, resetting networking equipment).

Even more interesting is that had confidence they'd _actually_ expelled the APT. Of course, they hadn't totally eliminated a related APT already in place.

This wasn't a "provision a clean box and run a build" reset... it's a massive, heterogeneous system. I can't even imagine how many vectors a nation-state APT could use to maintain a foothold.

</comment><comment><USER17> If only we had an agency in charge of protecting and securing these kinds of systems.

It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team.

Stolen stuff includes millions of fingerprints. Those are obviously not hashed, so that's just the raw data I imagine. They'll learn lesson to not rely on fingerprints as much. Maybe that's one good thing coming out of it.

[+] CIA could still be affected, if for example some people there started at other agencies, or in the military (CIA likes to hire ex-Marines for example).

<comment><USER18> After 28 years of DoD service, civilian engineer, I just called it quits. I got tired of the retaliation for turning in security violations. The last one: sharing of passwords on a secured network. One violator's response: Where is it written we cannot share passwords? Why the retaliation? It portrays a bad image. Nice!

<comment><USER19> This kind of stupidity is why I think I can never take a gov't job. I don't think I'd last a week. Sorry you had to put up with it.

<comment><USER20> What about things the US Digital Service or 18F? The image they present is that those teams are different and outside the standard government bureaucracy. I'm skeptical.

<comment><USER21> Employee of 18F here, speaking unofficially. We care a lot about security - both from the technical side and from the policy compliance side!

<comment><USER17> How was recruitment?. Someone I know tried to get a got job there, got stuck in the queue forever. Was told to wait months. So eventually gave up and took another job.

<comment><USER22> USAJobs is badly in need of an 18F overhaul.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> OPM's e-QIP site was vulnerable to heartbleed for at least a week after public disclosure (2014).

They still claim that they were never exploited. The arrest records, addresses, and other sensitive info I was able to view say otherwise.

I expected the EINSTEIN program would have helped to quickly defend against heartbleed after disclosure, but apparently not. US Gov just sucks at cybersecurity defense.

</comment><comment><USER16> sure would be nice to have something better than a raster image of pages 2-231

<comment><USER24> Agreed, although rasterizing was likely the simplest way to ensure that redacted information can't be (somehow) reconstructed.

</comment></comment><comment><USER25> Is there a version of that document that is searchable?! OCR or something :(

</comment><comment><USER16> tl; dr.

Two distinct attacks, likely related, possibly coordinated took place. The first was observed in March 2014 and thought to be expelled in late May 2014.

Before that expulsion, a second attack began. While OPM thought it was in the clear, the 21.5M records were exfiltrated in July 2014. As late as August 2015, that same attack vector was used to steal fingerprint information as well.

</comment><comment><USER26> Is the headline of the report truth or hyperbole?

"The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation"

</comment><comment><USER27> I've only read up through the executive summary thus far but this looks like it's going to be a fascinating read.

</comment><comment><USER28> Interestingly enough, I haven't either seen either an emphasis on the main responsible directors being women; or claims that the agency was a "glass cliff".

<comment><USER29> What on earth would either of those have to do with this?

<comment><USER14> I think that was a thinly veiled attempt at saying they were "diverse-hires" (a promotion or hire based on gender politics) instead of having a qualified individual in the position.

I'm unaware of the qualifications of either director, so who knows.

<comment><USER28> No, what I'm saying is that we discuss/speculate on these things too much.</comment></comment></comment></comment>


Haste – A Haskell to JS Compiler - <AUTHOR> http://hackage.haskell.org/package/haste-compiler

<comment><USER2> Here the discussion on reddit.com/r/haskell:

[http://www.reddit.com/r/haskell/comments/1htqi2/announce_has...](http://www.reddit.com/r/haskell/comments/1htqi2/announce_haste_the_haskell_to_js_compiler_is_now)

That's the place where most intensive discussion on this kind of news usually takes place... (which holds true for this piece of news too)

edit: The reddit discussion contains an well written overview of differences between haste, ghcjs and fay (the 3 main haskell-to-js projects).

</comment><comment><USER3> Is it just me or does not a week go by without another FP-to-Javascript compiler project?

I love this trend, but I'd really love to see an asm.js target. GHC uses LLVM, which has such a backend, right?

Edit: previously I said 'Clang' instead of 'LLVM'

<comment><USER4> > I love this trend, but I'd really love to see an asm.js target.

Why? Is "asm.js" just a mnemonic for "magically fast", or is there something specific you think would be gained by not using the full target language JS as a compiler target?

<comment><USER5> asm.js is designed for static compilation, there's no magic.

</comment></comment></comment><comment><USER6> It is probably more useful to link to the github page [https://github.com/valderman/haste- compiler](https://github.com/valderman/haste-compiler)

</comment><comment><USER7> Having JS, ARM, and Intel compilers now make Haskell a multi-platform tool of choice among discriminating hackers ;-).

Let's just wait for GHCi support on both JS and ARM.

<comment><USER8> Just port over the GHC monad and you're golden ;-).

</comment></comment><comment><USER9> Having never used Haskell, I do not know if it would be possible to use it on itself so as to be able to run sample haskell test programs entered by a user on a web page.

</comment><comment><USER10> How can it support cabal? Is that only for other Haste libraries? Most haskell cabal dependencies end up needing a native library (eg: compiled c files) somewhere in their transitive dependencies (this is very unfortunate, btw).

<comment><USER11> Integrates with Cabal might mean that Haste can be installed with Cabal, but I'm not sure (ghcjs for example cannot).

</comment></comment><comment><USER12> How does this deal with calling arbitrary JS code from Haskell? For example, how would I use jQuery from Haste? Looks like a cool project, but that's the first thing I want to know for X to JS compilers.

<comment><USER13> You just make an FFI declaration in Haskell:

        foreign import ccall square :: Int -> Int

And use --with-js to link against a JS file:

        // square.js

        function square(x) {
            return x * x;
        }

Using jQuery would be an interesting challenge. I suppose you could just get the jQuery object and go nuts on it unsafely, or write typesafe(ish) wrapper functions to export. The "ccall" convention is also a bit disingenuous.

Source: [https://github.com/valderman/haste- compiler/blob/master/doc/...](https://github.com/valderman/haste- compiler/blob/master/doc/js-externals.txt)

<comment><USER14> Since jQuery is a monad i expect a Haskell wrapper to be written very soon.

<comment><USER13> You had better be joking.</comment></comment></comment></comment>


Ask HN: What do startups pay business attorneys for emails? - <AUTHOR>

I'm wondering what startup's experience has been with their business law and deal attorney charges specifically for emails, postal letters and/or faxes.<p>Do they charge for each and every email or only emails over a certain length? What are typical charges for these items? <comment><USER2> Usually, when you ask your lawyer to do something, you ask how many hours you're going to incur, unless you don't care.

<comment><AUTHOR> I got bogged down the other day with 29 somewhat long emails in one day back and forth for a negotiating project that I took on for a VC firm who I've dealt with before. Handholding and explaing to all parties on issues that weren't even related to the actual transaction in a sense. [1] Without that handholding the deal would fall through (just closed today after another 30 emails). That's in addition to whatever happened over the past 6 weeks. Plenty.

Specifically the emails didn't relate to negotiating issues they related to things unrelated but needed to make sure the seller didn't back out.

I don't quote on an hourly basis (I like to go on "value") but in this case I was curious whether I could build into my rate some way to protect myself by using something that is somewhat familiar to people using attorneys already. (Hence the request for feedback and basic framework...I know I always got billed for letters from attorneys in the past..)

This is a side thing that I do essentially for fun however getting tied up in emails all day kind of kills the fun.

[1] Example: How to use dig or nslookup to verify DNS records are setup properly. Then explaining that you don't need to query both primary and secondaries just one is fine. Sellers "tech guy" thought he had to verify 40 dns records on 4 different AWS servers and threw in the towel which literally almost killed the whole deal.

</comment></comment><comment><USER3> I had an attorney send a 6 sentence email to a stock photo company and he charged me $325 which included 1 additional correspondence of a similar length.

</comment><comment><USER4> Most charge by time not by the number or type of interaction

<comment><AUTHOR> I know they charge by time I was wondering what the typical charges are that are linked to emails.

For example if you email a question to your attorney and he emails back a 1 paragraph or 1 sentence response does that show up in billing as "email re: clarification $75" etc.</comment></comment>


Cicada 3301 - <AUTHOR> https://en.wikipedia.org/wiki/Cicada_3301 <comment><USER2> Please submit Wikipedia articles, if at all, with their original article titles. It's bad enough to have submissions of most articles from the Encyclopedia That Anyone Can Make Stuff Up In (can you tell I was just editing Wikipedia this evening, trying to fix problems), but worse when Hacker News guidelines are ignored to submit a Wikipedia article with a linkbait title. There are a few sources for this article (which is good) but there isn't much information about the article topic even from those.

Have a happy Thanksgiving, by the way. Thanks for the kind submission, and don't mind my objection to the title not being the original article title.

AFTER EDIT: After all, I read the other comments here before I posted my comment, and it's not even clear that a "secret think tank" is really what the source of the cryptic messages is. That's reason enough to change the title of the submission here.

<comment><USER3> Personally, I'd rather see a useful title on Wikipedia submissions (I'm not saying the particular title chosen in this case was useful).

For submissions of magazine or blog articles, the original title policy makes sense usually, because magazine and blog authors or editors choose titles designed to catch the reader's interest.

Wikipedia titles are more names than titles. They are meant to allow people who are already looking for information on the thing in the title. When a Wikipedia article is submitted with the Wikipedia title, there is usually nothing that tells me why I might find it interesting.

I'd like to see HN allow submitters to include a one line statement saying what is interesting about the submission.

<comment><USER4> Stories are community property; the first person to submit a story doesn't "own" it, and shouldn't have a special right to editorialize the submission.

<comment><USER3> Can't there be a sensible middle ground between slavishly copying the title from the source and editorializing?

Consider this video of Alan Kay's Turing Award lecture: [http://www.youtube.com/watch?v=ymF94cFfzUQ&list=PLn0nrSd4xjj...](http://www.youtube.com/watch?v=ymF94cFfzUQ&list=PLn0nrSd4xjjYCkOxtYqozyDuwt-4sC2L6&index=5)

The title is "Turing Award Lecture". Is it really editorializing if it were to be submitted as "Alan Kay Delivers His Turing Award Lecture"?

<comment><USER4> No, it's not. But that's not how the feature would actually end up getting used, is it? If you could design a simple feature that would resist abuses, 'pg would probably consider it.

<comment><USER3> How about allowing the submitter to optionally add a one line explanation if he thinks the title is not clear?

</comment></comment></comment></comment></comment></comment><comment><USER5> This is neat, but from the second paragraph of the article:

      According to a document posted anonymously,
      the puzzles are a recruiting for a "think tank."
      Thus far, this is unverified.[citation needed]

Calling it a "secret think tank" seems disingenuous here.

<comment><USER6> agreed, these misleading titles really bug me. hackernews turning into buzzfeed?

</comment></comment><comment> FLUX-YOU [http://uncovering- cicada.wikia.com/wiki/Uncovering_Cicada_Wi...](http://uncovering- cicada.wikia.com/wiki/Uncovering_Cicada_Wiki)

Have fun. Also, no way to verify if it's an ARG or an actual group to my knowledge.

</comment><comment><USER7> Seems more likely that this is a group of 4channers looking to have some fun rather than a "secret think tank".

<comment><USER8> That physical clues were distributed worldwide indicates there might be a little more to the story. Wikipedia lists the locations as

Annapolis, Maryland / Chino, California / Columbus, Georgia / Erskineville, Australia / Fayetteville, Arkansas / Granada, Spain / Greenville, Texas / Haleiwa, Hawaii / Little Rock, Arkansas / Miami, Florida / Moscow, Russia / New Orleans, Louisiana / Okinawa, Japan / Paris, France / Portland, Oregon / Seattle, Washington / Seoul, South Korea / Warsaw, Poland

I hadn't heard about this, does anybody have links to some of the original forum threads/puzzles?

<comment><USER9> How would that disprove anything? Can people from Poland not use 4chan?

</comment></comment></comment><comment><USER10> So I just read through the Cicada 3301 wiki and on the last page (link below), in the questions sent to the last puzzle's "solvers," there are a couple references to Douglas Hofstadter.

One of the response options is "Strange Loop," and one of the questions is:

'I am the voice* inside my head (You undoubtedly just thought "I don't have a voice inside my head." That is the voice the question is referring to).'

(If you aren't familiar, these are both references "I Am a Strange Loop", a book by Hofstadter.)

Anyway, the reference to Hofstadter and the mysterious, elaborate, international nature of this Cicada operation reminded me of a previous thing. A book called "Being or Nothingness" by "Joe K" was mysteriously mailed to academics all over the world a few years ago, and I'm not sure anyone ever figured out why. In it, there were references to Hofstadter and other thinkers. Much like Cicada 3301, the whole thing was kind of intriguing and a little creepy.

In "The Psychopath Test" by Jon Ronson, Ronson asks Hofstadter if he had anything to do with the book and Hofstadter said no. And why would he, right, but both the book and this Cicada 3301 thing seem very Hofstadter-esque to me. Just thought that might be worth pointing out.

[http://uncovering- cicada.wikia.com/wiki/What_Happened_Part_2...](http://uncovering- cicada.wikia.com/wiki/What_Happened_Part_2_\(2013\))

</comment><comment><USER11> I submitted the same wikipedia page a few months ago and it only got around half the up votes. I guess titles and timing are everything :)

[https://news.ycombinator.com/item?id=6389167](https://news.ycombinator.com/item?id=6389167)

</comment><comment><USER12> [http://www.telegraph.co.uk/technology/internet/10468112/The-...](http://www.telegraph.co.uk/technology/internet/10468112/The- internet-mystery-that-has-the-world-baffled.html?fb) A detailed analysis on Cicada 3301 by Telegraph.

</comment><comment><USER13> I have decided, arbitrarily, that Cicada/3301 is Satoshi. That was their first project (Bitcoin).

</comment><comment><USER14> Seems like a game, or art project or something of that kind. It doesn't have to be overtly commercial to still be an elaborate ruse, and it's probably more fun if it's not particularly commercial.

</comment><comment><USER15> Let's not give technical recruiters any more ideas ;)

</comment><comment><USER16> Anonymous has a great HR team

</comment><comment><USER17> NEMO 33 Zwartebeek Brussels

</comment><comment><USER18> Seems like an elaborate ruse.</comment>