How to tell which font is used in a PDF? - <AUTHOR> <comment><USER2> Take a screenshot and run it through [https://www.myfonts.com/WhatTheFont](https://www.myfonts.com/WhatTheFont).

</comment><comment><USER3> One way is to copy a word from that part of the PDF document, and paste it into Word or another rich text editor. Then click in the middle of the pasted word. The editor's font display will show you the name of the font.

There is a Lin/Win/Mac font tool here [http://www.foolabs.com/xpdf/download.html](http://www.foolabs.com/xpdf/download.html)

</comment><comment><USER4> Many PDF viewers will list the fonts used. Acrobat at least used to do this.

</comment><comment><USER5> pdffonts, part of poppler-utils, will dump a list of font names.

<comment><USER6> Another, hackier, approach at the commandline is to use:

        strings file.pdf  | grep -i fontname

This will give a line like:

        <</StemV 120/FontName/ZXOBUP+MinionPro-BoldIt/FontStretch/Normal/FontFile3 426 0 R/FontWeight 700/Flags 98/Descent -360/FontBBox[-230 -360 1684 1032]/Ascent 1032/FontFamily(Minion Pro)/CapHeight 651/XHeight 454/Type/FontDescriptor/ItalicAngle -12/CharSet(/space/T/i/n/o/t/v)>>

Comapred to pdffont's

        ZXOBUP+MinionPro-BoldIt              Type 1C           WinAnsi          yes yes yes    364  0

Or you can use perl:

        strings file.pdf  | perl -ne 'print "$1\n" if (/FontName\/(.+?)\//)'

and get a list of font names alone, like:

        ZXOBUP+MinionPro-BoldIt</comment></comment>


Understanding LSTM Networks (2015) - <AUTHOR> http://colah.github.io/posts/2015-08-Understanding-LSTMs/ <comment><USER2> If you like this and Chris' other posts, don't forget to check out [https://distill.pub/](https://distill.pub/) which he co-founded. Such high quality explanations.

</comment><comment><USER3> This is also a good one: [https://deeplearning4j.org/lstm](https://deeplearning4j.org/lstm)

</comment><comment><USER4> It's a great text, but I recommend supplementing it with: [http://blog.echen.me/2017/05/30/exploring- lstms/](http://blog.echen.me/2017/05/30/exploring-lstms/).

Additionally, GRU may be simpler to understand memory unit.

</comment><comment><USER5> Too hand-wavy for my taste. I have the feeling I still don't know why they work.

<comment><USER6> Agreed. Don't know why this article gets high praise, I'm sure the pretty pictures help.

<comment><USER7> Hi! I'm the author. I was also pretty surprised by the amount of attention this article has gotten. That said, I can give you my take on how it advanced the dialogue.

As you note, the main contribution of this article is the diagrams -- but I think it's a bit deeper than being pretty. Previously, diagrams of LSTMs had lots of loops in them. This made them hard to understand. (In fact, they were ambiguous because of unclear execution order.) The diagrams in this article unrolled the loops, which seems to be a much easier way to reason about LSTMs. They also work at the abstraction of layers instead of weights and matrix multiplies, which make the diagram less noisy and focuses the reader on the important ideas.

Since diagrams were previously challenging to consume and understand, explanations prior to my article tended to focus on the six equations than define an LSTM. While that's a relatively clear way to think about LSTMs once you've really internalized them, it can be very hard when you are trying to understand them for the first time. In particular, the equations introduce ~15 variables. If you aren't already familiar with those variables, it's extremely challenging to keep them all in your working memory and understand what's going on.

In contrast, the diagrams don't require a new reader to hold lots of things in working memory, and visually hint a great deal of the narrative (like the horizontal line at the top).

</comment></comment></comment><comment><USER8> Had been my first reading on LSTM and was so smooth and lucid. I did need to read more literature and code, but a great resource to begin with.

</comment><comment><USER9> prev discussion: [https://news.ycombinator.com/item?id=10130341](https://news.ycombinator.com/item?id=10130341)</comment>


Show HN: Pastemagic - paste with desired formatting, fix linebreaks, instant OCR - <AUTHOR> https://pastemagic.com <comment><USER2> Thanks for this - pasting to and from Word/docx or PDF has always been painful and this makes things much smoother :))

</comment><comment><USER3> I've been wanting this for a long time! Thanks for sharing. I wish it was integrated into MacOS though, so I could access via keyboard shortcut. There are so many times I realize I need to "remove formatting" but only after I've already pasted and quick access to OCR would be great.

<comment><AUTHOR> Thanks -- yeah, I'd love to build something like that, like Cmd+Opt+Shift+V or something... unfortunately my skills are all web programming, I wouldn't have a clue how to build an OS-wide keyboard shortcut. If there's enough interest, maybe I could learn though...</comment></comment>


Show HN: PDrive – Free Encrypted Storage - <AUTHOR> https://pdrive.co/ <comment><USER2> As a user this is my experience: The mobile landing page doesn't really tell me what it does other than one sentence. And then I'm supposed to log in to something called Blockstack that I don't understand.

The project might be cool but it's not easy to understand.</comment>


IOS 7: A Fatal Flaw - <AUTHOR> http://jada.ms/ios-7/

<comment><USER2> Jonathan, the title on the actual article is just "iOS7". Where is the "fatal flaw"?</comment>


Xiaomi's phones have conquered China – now it's aiming for the rest of the world - <AUTHOR> http://www.businessweek.com/articles/2014-06-04/chinas-xiaomi-the-worlds-fastest-growing-phone-maker <comment><USER2> From CNET: "Xiaomi's Redmi offers exceptional value for its low price, and blows all other budget handsets out of the water. If you're looking for a cheap Android smartphone without having to compromise performance, look no further." [http://www.cnet.com/products/xiaomi- redmi/](http://www.cnet.com/products/xiaomi-redmi/)

<comment><USER3> I don't know, I'd much rather have a Moto E for $129 than that phone for $135. Looks seriously chunky and vanilla Android is far nicer.

Will give them a nod on the 720p display though.

<comment><USER4> The Moto E SOC has two relatively slow A7 cores and a slow graphics chip though. Something to keep in mind.

</comment></comment></comment><comment><USER5> When did Businessweek's website start requesting your browser location when you visit it?

<comment><USER6> about:config

geo.enabled = false

Problem solved.

<comment><USER7> Thank you.

</comment></comment></comment><comment><USER8> Looks like a solid option, I love it when companies ditch non-integral aspects of their budget to improve functionality or form of their product. That's also why I shop at Aldi, because you get lower prices with the same quality products, at the cost of having to put a quarter into the cart, bag your own items, and even bring your own bags (or use empty boxes).

That said, I've been ditching smart phones lately in favor of dumb phones. Not only is life too short to be attached to a gadget all day long, but you can't beat the price (roughly $7 a month for an emergency mobile phone).

<comment><USER9> Yes, and whoever creates the most value will (and should) win.

tangent: I've noticed ALDI products are often the same quality - and the same _price_ \- as the "generic/home/no name" brands of regular supermarkets. But in nicer packaging. Basically, generic brands are high enough quality these days, but people will pay more for shiny. (I can feel this in myself).

To out-ALDI ALDI, you'd sell generic brands in generic packaging.

</comment></comment><comment><USER10> My girlfriend got one of these the other day in Singapore. The cash vs tech spec ratio on the thing is much better than the premium handsets and she seems quite smitten for picking up a good deal.

The reason they sell out so quickly is the local phone stores buy them in bulk the minute they're released and add a $20 premium on each set.

</comment><comment><USER11> I've bought a Huawaei and am very pleased with it (only the camera is crap). In the past I tried different Chinese brands but they were all crap. It seems they worked hard to change that. Huawei and Xiaomi both get great reviews for there low cost phones.

Btw: Xiaomi means something as 'grain of rice'. Meaning that small things still can be big.

</comment><comment><USER12> You say that like its a promise that keeps going unfulfilled.

I think these is an update that Xiami is is pretty much on track to do what they keep saying it's going to do and putting some more clarity on the how. EG _take Xiaomi beyond China and into Brazil, Mexico, Russia, Turkey, India, and five countries in Southeast Asia._

It's a status update.

</comment><comment><USER13> Online only selling mode is proving to be a good one. In India Motorola tried that with an exclusive deal with online retailer Flipkart for Moto G and it was an instant hit. More on quality less on Stores and Ad.

In international market it would be tough to compete with phone with Android OS.

</comment><comment><USER14> Great! I'm all for more cheap high-spec Android phones! I would buy one.

</comment><comment><USER15> Feels like i have read the exact same thing half a year ago and half a year before that. We have seen countless times that what works in asia doesn't always work in the rest of the world and vice versa. Last i heard was that iPhones sell very well in China though :)

<comment><USER16> The sell very well if you forget there are a billion people. They sell really badly if you take that into account.

</comment></comment><comment><USER6> I hope they come up with a name that's easy to pronounce if they do.

I also doubt they will do well in the rest of the world for the same reason Huawei aren't - lack of trustability.

<comment><USER17> Based on my circle, Huawei is not insignificant and getting traction. Cheap and reliable is a good way to start.

<comment><USER18> I have a Huawei Ascend P1 LTE. It's certainly cheap. I wouldn't describe it as reliable; it was very prone to locking up if you disabled and later re-enabled the wifi. They released an OTA firmware update which mostly fixed this, but now the screen is starting to blister in a few places.

</comment></comment></comment><comment><USER19> I like their domain, very short, haha.

</comment><comment><USER20> Any article that begins with a narrative is manipulative tripe and not worth reading.

<comment><USER6> Also grammatical mistakes like "an historic".

<comment><USER21> That's not a clear-cut mistake, and in my opinion totally forgivable. [http://www.betterwritingskills.com/tip-w005.html](http://www.betterwritingskills.com/tip-w005.html)

<comment><USER6> Most people, including Americans, pronounce historic as historic, not 'istoric.

<comment><USER22> Northern UK here. "An' istoric" is _very_ common in informal speech, even in the south but more so in these parts, but I wouldn't expect to see it written that way.

</comment></comment></comment></comment></comment><comment><USER23> > Now It's Aiming for the Rest of the World

More like getting sued in the rest of the world.

<comment><USER24> Samsung seems to be doing just fine ;)

<comment><AUTHOR> There is a reason why Samsung manages to pull that off. [1]

Price-fixing and counter-suing strategy. They always have been using the same disruptive method in every industry they are in. By the time the verdict is out they have mass produced and sold it with huge profits lined up to pay a settlement fee.

1\. [http://www.vanityfair.com/business/2014/06/apple-samsung- sma...](http://www.vanityfair.com/business/2014/06/apple-samsung-smartphone- patent-war.print)

</comment></comment></comment><comment><USER25> Xiaomi is cheap.

But I hate Android, if they change the OS, maybe I will buy one.</comment>


Out-of-Place Artifact - <AUTHOR> https://en.wikipedia.org/wiki/Out-of-place_artifact <comment><USER2> I was hoping for a list of real, scientifically accepted out of place artifacts, like the Anau seal. Or Göbekli Tepe.

<comment><USER3> Some of the stuff in the books of Charles Fort (1874-1932; kept and published notes about the unusual) has been accepted. Looks like the magazine is still published.

[https://en.wikipedia.org/wiki/Charles_Fort#Fortean_phenomena](https://en.wikipedia.org/wiki/Charles_Fort#Fortean_phenomena) [https://en.wikipedia.org/wiki/Fortean_Times](https://en.wikipedia.org/wiki/Fortean_Times)

Original edition of 'Book of the Damned':

[https://archive.org/details/bookofdamnedbych00fortrich/page/...](https://archive.org/details/bookofdamnedbych00fortrich/page/n9)

</comment></comment><comment><USER4> >> Over 20,000 objects were found over a 15-year period at the Goddard Site in Brooklin, Maine. The sole non-Native artifact was the coin.[8]

By frequentist assumptions and given this evidence, the probability that Vikings visited the Americas before Columbus is 0.00005. We can therefore safely conclude that the Vikings never visited the Americas before Columbus.

(er, joke)

<comment><USER5> Post this on twitter and @nntaleb will correct you!

</comment></comment><comment><USER6> What about the fact that the reed boats on Lake Titicaca look like the reed boats Ancient Egyptians used to make? Huh? Huh?!

My favourite contentious potential sign of cultural contact is the extensive usage of sweet potato (native to South America) in the Polynesian Triangle. One of the signs that convinced Thor Heyerdahl to launch the Kontiki expedition, but he assumed (for various reasons) that contact must've gone South America -> Polynesia - things like the prevailing currents and winds being east to west.

However, given what we know of eastward Polynesian expansion, that it tended to occur during El Ninos when the currents and winds change in the Pacific, I find it more probable that the seafaring Polynesians who settled some of the most remote islands in the world, travelled to South America and then back again.

<comment><USER7> Yes there's a theory that states that one of the Incas "Tupac Yupanqui" is believed to have gone to the Polynesia around 1465 with boats and 20 000 crew members

</comment></comment><comment><USER8> This is so weird: on the one hand some of these crackpot theories think some things are too advanced (Antikythera dev), other times they want think people were more advanced than known evidence suggest (Baghdad battery). So they are all over the place, but consistent in thinking modern understanding is wrong.

<comment><USER9> A sophisticated mechanical astronomical computer is no less implausible in that time period than a battery for electroplating. Neither require aliens.

The Incas did electroplating. We even have the remnant electroplated artifacts. Did the Incas invent batteries for electroplating first or was it the Greeks? We don't know yet. If Greek electroplated items are found someday then we'll be able to say they did it first.

<comment><USER3> And yet Antikythera sat gathering dust for 50 years (until Price) because noone knew what to make of it ... "most scholars considered the device to be prochronistic..." (WP)

After Price spelled it out, it still took decades for enough scholars to die - and the tech to understand it became available - only then it became more plausible ...

</comment></comment></comment><comment><USER10> In the same vein of this if you like crackpot theories, research Tartaria and mud floods.

<comment><USER11> If floods and mud are your thing, check out zermatism:

[http://unurthed.com/2007/12/23/szukalskis-science-of- zermati...](http://unurthed.com/2007/12/23/szukalskis-science-of-zermatism/)

</comment></comment><comment><USER12> Couldn't the Maine Penny just have been transported in an animals stomach?

<comment><USER13> That seems a lot less likely than either of the current hypotheses (it was carried there directly by Norse explorers vs. it was traded from one group to another across the distance).

</comment></comment><comment><USER14> I recommend scrolling down to Babylonokia.

</comment><comment><USER15> > The term is used largely by cryptozoologists, proponents of ancient > astronaut theories, young Earth creationists, and paranormal enthusiasts.

<comment><USER16> What's the significance of this line?

<comment><USER17> It's not a scientific concept, it's a term used by the aliens-built-the- pyramids crowd.

<comment><USER18> The aliens didn't build the pyramids, they merely advised the human architects by, e.g., imparting knowledge of geometry and metallurgy.

<comment><USER19> We see evidence of increasing ability to build larger and larger pyramids over time in Egypt.

The construction method is pretty well known by now, big ramps of gravel to roll/push stones up. Gravel spread around, contruction times vs. number of people on site, well known.

Another example a group of university students hauled a Stonehenge sized rock from a likely quarry to Stonehenge site in a couple of weeks.

We forget what human labor can do.

<comment><USER20> >We see evidence of increasing ability to build larger and larger pyramids over time in Egypt.

That's not totally true, is it? The first pyramid was Djoser's pyramid in saqqara in about 2650BC. The first true pyramid was build around 2590BC (around 60 years later). The largest and greatest of the pyramids was built around 2570BC (only about 80 years after the first pyramid). Things really went downhill from there, but the Egyptian civilization lasted for another 3000 years.

<comment><USER21> The point is they clearly perfected their techniques over time. We have evidence of failures and mistakes too.

There is nothing about the ancient pyramids that lies beyond human capability. There are plenty of videos on youtube of 1-4 people moving 15-ton stone blocks around.

Occam's razor: the simplest explanation is humans built the pyramids and no aliens were involved.

<comment><USER22> OT, but more and more I wonder how prevalent fossil fuels are. We wonder at just how frequent life occurs. But fossil fuels have basically catapulted us in energy production over a very short time.</comment></comment></comment></comment></comment></comment></comment></comment>


An alternative look at the Zendesk IPO - <AUTHOR> http://www.thenordicweb.com/2014/04/23/what-you-really-need-to-know-about-the-zendesk-ipo/

<comment><USER2> Not one number in this "alternative look". IPOs are about valuation, use of proceeds, execution to date, and business plan. It seems to me that many capital markets observers keep having a creationism point of view when justifying valuations.

<comment><AUTHOR> The "alternative" refers to the fact that it is not just an overview thats been copied and pasted from the S1 form, but more a speculative look at what the information detailed implies for their future.

</comment></comment><comment><USER3> "The battle for talent is as important as the battle for customers." I totally agree .. With an amazing product, customers won't be able to not use a CRM system such as Zendesk.

</comment><comment><USER4> I don't even.</comment>


Tacit Knowledge - <AUTHOR> http://www.doxsey.net/blog/tacit-knowledge <comment><USER2> I had an interview one time where I couldn't remember the name of a plugin that I used every day. I'm terrible with names. It was quite embarrassing to try to answer a theoretical question about how I would solve a problem when the most obvious answer was just the name of the plugin, but I couldn't remember it. I was reduced to trying to stall and pull up my usual tools so I could see the name. (It was a video interview.) It occurred to me that the interviewer might think I was just googling it, but whatever.

All that to say that it is quite true that without the tools in my hand I was hard pressed to describe what I would do.

</comment><comment><USER3> The top performers in many fields are like this, having started young enough with enough neural plasticity that their knowledge is literally part of their makeup.

However, I'm barely like this at all. I might have an instinct for where bugs will be or that something just shouldn't work like that. But I rely almost entirely on nonintuitive, crystallized knowledge:

* I can definitely tell you all the vi commands I know. If I can't name a keyboard shortcut, I can't remember it at all.

* I concentrate while driving, executing conscious algorithms like 'stay in the middle of this gap', 'start coasting exactly now to save brakes', or 'move one lane left if you would have to brake'.

* When I learned a foreign language, I did it by patching together conscious learning like 'n before b is pronounced like m'. I was consequently much worse at speaking than intuitive types, which is the best way to learn, but also much better than most people from my country ever get.

* If I can't answer an interview question, it's because I can't remember the crystallized fact I wrote down in my notes, not because I know but can't describe it. I rely almost totally on notes and snippets for this reason.

In some part it's not because I couldn't get through a task intuitively but because I think there's always a best way to do something and it's usually better than just muscle memory. For example, my ice skating improves when I'm consciously thinking "pressure on the outside toe" or "tuck your pelvis under" instead of skating naturally. That's the opposite of pro skaters, but it works best for me. In programming this means I keep little reminders for myself about when to use log level WARN, which stream collector to use, ways to test recursive queries... all explicit.

</comment><comment><USER4> Polanyi is a key figure in philosophy of science, next to Kuhn and Popper.</comment>


Memory Safety in Rust: A Case Study with C - <AUTHOR> http://willcrichton.net/notes/rust-memory-safety/ <comment><USER2> A lot of point-missing here about the example C program. Maybe everyone else in the world is a perfect C coder who never makes a mistake, but I've found every single one of those mistakes in my own code at one point or another (though of course, not at quite the same density). The point is that they're easy to make, and though there is tooling, it's extremely cumbersome and imperfect.

Worse, over time as a codebase gets more complicated and older - and only if you're one of the few lucky enough to start with C code that isn't an unholy, inconsistent no-warnings disaster-mess slop bucket of horror - some of those warnings have a nasty habit of getting disabled so some middle manager can expedite some unreasonable commitment out a door to tick a box.

Call me a masochist but I enjoy writing C, particularly with valgrind, *san, afl, et al at my back. But I felt the point was well made by the author and I find it hard not to feel like a world where these problems simply didn't exist at all might be a bit nicer

<comment><USER3> > The point is that they're easy to make, and though there is tooling, it's > extremely cumbersome and imperfect.

What's hard about adding -fsanitize=address or -Weverything to your Makefile? Or running a program under Valgrind, or using the clang static analyzer or coverity? Using AFL can be a little cumbersome but still not that hard.

<comment><USER4> Depending on what you're doing, AddressSanitizer might not be available for you to use, as there are plenty of ASAN-incompatible constructs that may be used by libraries your application depends on.

(it's worth looking at other sanitizers anyway, it seems not everyone is aware of their existence after all; if you can't put C away they're really great tools for retaining your sanity :))

</comment></comment></comment><comment><USER5> Not exactly the best example. If I take this code (test.c) and try to compile it:

      > gcc test.c

I get an error:

      test.c:21:3: warning: function returns address of local
      variable [-Wreturn-local-addr]
         return &vec;

After I fix that error, the program segfaults when running. Compile with asan:

      > gcc test.c -Fsanitize=address -lasan -g

Then we can start debugging these problems:

      ==3261== ERROR: AddressSanitizer: attempting double-free on 0x60040000dfd0:
          ...
          #2 0x4008b5 in vec_free ./test.c:46

Not trying to say that this is the best workflow for debugging C, but the tooling does exist for these kinds of programming errors.

<comment><USER6> None of which will help detect the integer overflow unless you're quite serious about your testing.

<comment><USER5> Very valid point. The code for that:

      int new_capacity = vec->capacity * 2;
      assert(new_capacity > vec->capacity);

<comment><USER7> asserts are for diagnostic-enabled code, don't use them for security checks.

<comment><USER8> This is one area where Rust also differs from C; assert!s are left on in release mode; you use debug_assert! if you want something only in development.

<comment><USER7> I agree, it's a hella questionable language choice, and not limited to C.

I found out about it through [https://github.com/rohe/pysaml2/issues/451](https://github.com/rohe/pysaml2/issues/451)

</comment></comment></comment></comment></comment></comment><comment><USER9> This is more like "a comparison of terrible C to middling Rust." Rust is generally a superior language, but this sort of comparing the worst kind of C to middling (or, worse, well-written) Rust doesn't seem useful to me.

I suppose it could be worse: these sorts of examples could always use obfuscated C as their source for comparison.

<comment><USER10> Yeah, sure. Personally, as much as I dislike the way the Rust community evangelizes the way Rust works (like the Haskell community writing another monad tutorial), there are some pretty common categories of errors demonstrated in the C code:

\- Return pointer to stack object (more common than you might think!)

\- Incorrect size passed to malloc()

\- Pointer to array outliving invalidation of array

Some of the remaining C code appears to be garbage intended to distract you from the errors people actually make, but there is some good stuff in there and I pull out similar examples when I'm trying to convince people not to learn C or C++ just to improve the quality of their greenfield projects.

<comment><USER11> > Return pointer to stack object (more common than you might think!)

Maybe when you're still learning how to program.

A combination of valgrind/sanitizers will catch all of these mistakes. The same class of mistakes can also be made in "memory-safe" languages, just replace pointer with index and memory with array.

<comment><USER12> Valgrind will only catch such indexing errors when you read/write out of bounds when running Valgrind.

There is a huge difference between out-of-bounds indexing leading to undefined behavior or an exception/panic.

<comment><USER10> Valgrind won't catch certain indexing errors even if you exercise them. Valgrind only checks that the address is valid, not that the address was derived from a pointer to the object you are accessing.

        int main() {
            int x[16];
            int y[16];
            int z[16];
            x[0] = 0;
            y[0] = 0;
            z[0] = 0;
            y[18] = 3; // Valgrind thinks this is OK.
            return 0;
        }

<comment><USER13> [https://i.imgur.com/fgufyE1.png](https://i.imgur.com/fgufyE1.png)

<comment><USER10> I think you may have missed the part of the conversation where we were talking about Valgrind, specifically, and not talking about the address sanitizer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> That C code is bad and doesn't compile on macOS using clang without adding #include <assert.h> . Just looking at it you can see the bugs. But the main problem I'm having with this article is comparing a contrived C program with no tooling to Rust. As the author notes returning a stack address is caught by clang. Also simply compiling with address sanitizer or running under Valgrind would have caught the rest of the bugs.

I'm not saying Rust isn't safer than C or not a sweet and useful language it is those things. What I am saying is comparing Rust to C without all the tooling that Modern C developers use is kind of disingenuous.

<comment><USER14> I don't even use any tooling except occasionally a debugger (gdb on Linux / Visual studio on Windows). I have spent more than 500 hours of the last 8 months in C (no complicated data structures), and I'm pretty sure I've spent less than 2 hours total tracing memory bugs. (not saying there aren't more hidden).

<comment><USER3> Use as many tools as your platform supports. I've had "stable" C code run just fine for two years but come crashing to a halt immediately under address sanitizer. So if code is working just fine now it could still be buggy and not work on other platforms or when built by other compilers.

<comment><USER14> Yep - might do. Unfortunately, to be honest, the OpenGL implementation I use printed quite a bit of a mess when run under valgrind, so I haven't tried again. (Could improve the architecture to bench separately). Update: tried and valgrind doesn't report problems in my own code under normal operation, except for me being sloppy at shutdown :-)

<comment><USER3> Check out the docs for suppressing errors in valgrind[1]. Also try the various compiler sanitizers, as well as the clang static analyzer and if your project is open source, coverity.

[1]: [http://valgrind.org/docs/manual/manual-core.html#manual- core...](http://valgrind.org/docs/manual/manual-core.html#manual- core.suppress)

</comment></comment></comment></comment></comment><comment><USER15> Having learned Rust and used it for nearly 2 years, I am now happy using C. I think most issues in C are easily catchable. Here me out:

1\. If using Int for indexing or any sort of len or count, make sure it's positive when needed, and within bounds of what's allocated. As in if you plan on allocating huge data, plan it out and use the right data type.

2\. If you alloc, then free when done. If you free, set to Null; and before you free, check for Null.

3\. If you realloc, in particular, check that it actually worked and prepare for basic error handling.

Rust requires all of these steps by default.

Finally, just test some of your code. Rust makes this easy, and encourages it.

I still really like C.

<comment><USER16> > _before you free, check for Null._

You can free(NULL), no problem. It will not do anything.

<comment><USER17> It's usually a problem with pointers to structs that have pointer members. In a typical destruction sequence, you usually free the members before the struct itself.

</comment></comment></comment><comment><USER18> Would anyone realistically write this C code though? The second point (the initial total amount being 0) is something that anyone paying even a cursory glance at the source code could pick up on, as were many of the others (who the hell gets the address of stack memory and returns it? This is C 101).

If this was found-in-the-wild C then I wouldn't be bothered with it, but this is completely contrived.

<comment><USER12> No experienced C programmer will write this code, but years of buffer overflow/double free CVEs show that even experienced programmers make such errors occasionally. And one error can be enough for a system compromise.

Of course, this is not only an argument in favor of in Rust, but any memory- safe language. Rust just happens to address some of the same problem domains that C and C++ have traditionally been dominant in.

<comment><USER15> Why is double free so commonly an issue? Isn't setting to Null after free and checking for Null before hand a common practice?

<comment><USER19> It's usually not calling free() on the same variable within a single function, although that can sometimes happen. The most common case, I expect, is when two separate data structures both have pointers to the same object and believe they own it, then later end up calling free on the same address at different times.

</comment></comment></comment></comment><comment><USER6> There's an extra bug in both the C and the rust code. The code assumes that, if length == capacity and capacity >= 1, then length < capacity *2. This is false for finite-precision integers. In C, this will manifest as an out of bound write when the array gets too big. In Rust, it'll panic when array bounds checking or integer overflow checking catches it.

<comment><USER20> A related issue is that overflow on signed integers in C is undefined. Vec.length, Vec.capacity, and new_capacity should all be changed to size_t to avoid a compiler optimizing out an overflow check.

Edited to be explicit about programming language.

<comment><USER8> (Note that they are both well-defined in Rust)

</comment></comment></comment><comment><USER21> Another problem with the C code, which is perhaps even more subtle, is the usage of `int` for the length, capacity, and loop index. On 64-bit platforms these variables will overflow for very large arrays, which will likely break the entire implementation. The call to `malloc()` should give a signed-to- unsigned conversion warning which will hint about this, but unfortunately many people ignore integer warnings. Incidentally, this could also be caught by compiling with `-ftrapv` or `-fsanitize=undefined`, but this problem is only triggered in a rather extreme corner case that is unlikely to be exposed during testing. The correct integer type to use is `size_t`, which is guaranteed to be large enough to hold the size of any object in memory.

<comment><USER14> Personally I'm going the other direction. I use int for anything unless there's a serious need to make an exception. The amount of complexity introduced by using a zoo of integer sizes and signedness is unmanageable to me.

There is no point in measuring array sizes in size_t. I don't make bigger allocations >2G. (At some point this assumption will probably break and I will have to re-think my approach. Shouldn't we all move to 64-bit integers by default already?)

<comment><USER22> > There is no point to measure array sizes in size_t. I don't make bigger > allocations >2G.

I think almost every Rust program I've ever published regularly encounters files greater than 2GB (even 4GB), and if I had used C and its `int` type everywhere, I'd be in for a very very bad time.

This of course doesn't mean I am allocating >2G on the heap, but I might memory map the file. Or there might be some other counter (line counter? byte counter?) where using `int` would just fail.

There are even some alternatives to my tools written in C, and either they or their dependencies use `int` instead of `size_t`, and that leads to actual bugs their end users hit in exactly the cases where files are greater than 2GB.

Getting integer sizes right is important, and it's not just in cases where you're putting >2G on the heap.

<comment><USER14> > Getting integer sizes right is important, and it's not just in cases where > you're putting >2G on the heap.

I prioritize on getting their _values_ right :-). So far I have not encountered bugs due to my pretty uniform usage of int. But if they had to deal with allocations >2G, my programs would just die.

Yup, I make some exceptions as well, for example to measure time in microseconds, or to measure the size of very large streams. And of course I try to assert that all downcasts to int are valid, and that my integer operations don't overflow, etc. (why do CPUs still not support overflow exceptions?)

I'm pretty sure we could get rid of quite some historical baggage in terms of integer types. For example, I'm currently working on a network module, and there is a type socklen_t which is to indicate the size of a socket structure. I might be missing something, but to me there is no good reason not to use simply int.

</comment></comment></comment></comment><comment><USER23> Lots of comments seem to say "these aren't mistakes any experienced C programmer would make".

Does that really make the protection against those mistakes less important?

<comment><USER3> > Does that really make the protection against those mistakes less important?

No it doesn't. But from a C programmers point of view it's kinda like can you show examples of bugs in C that wouldn't immediately be found in code review or by tools like ASAN, Valgrind, Coverity or even just the C compiler, that Rust can solve. Those are the examples that would interest the C community.

<comment><USER24> Bugs that sneak through code review are, almost by definition, the hardest to demonstrate. If a qualified person familiar with the code couldn't see it, it will take a lot to explain it to an average reader. Hidden bugs are generally in large and complex codebases, but such codebases are also the worst for example code in a blog post. So that's why the next best thing is to show it in obvious case, and leave it for you to extrapolate it to your complex cases.

Also the more complex the problem, the more likely it is incomparable between C and Rust. The prime example is a controversy whether Heartbleed would have happened in Rust. On one hand a direct C-to-Rust translation of the whole system with a custom memory-reusing allocator wouldn't have prevented the bug. OTOH such approach from Rust perspective is very contrived and unusable in practice, so one can argue nobody would have structured the code like that in the first place.

</comment></comment></comment><comment><USER25> So rust isn't memory safe? You can still access invalid pointers?

I'm just trying to clarify...it's lifetime safe, but not access safe, or leak safe?

<comment><USER8> Unsafe code allows programmers to write code the compiler can't check. Unsafe code is expected to uphold the safety invariants, but humans can make mistakes.

Most people mean "safe Rust" when they say "Rust."

Leaks are memory safe though. They're hard, but not impossible, to get.

<comment><USER9> > Most people mean "safe Rust" when they say "Rust."

I disagree. I think they mean Rust code they see in use that has no explicit "unsafe" blocks. For example, most people are going to say "let mut v = Vec::<i32>::new(); v.push(0)" is "safe Rust." It is, in the sense that all the rules of Rust safety apply to the specific code quoted as-is. It also isn't, because 'Vec' is littered with unsafe.

<comment><USER8> That's what I mean by "safe Rust", so we agree.

<comment><USER9> We don't, though. The quoted code isn't safe. It has implicit unsafe blocks in it. You can't claim there are two dialects of Rust if you inlcude the "unsafe" dialect in your definition of "safe" as long as there isn't an explicit "unsafe" block present. It's misleading

<comment><USER8> That's not a useful definition, though, as that means that all code everywhere is unsafe, since the hardware is.

</comment></comment></comment></comment></comment></comment><comment><USER16> The 382th episode in which a rustacean blames C while he has only practised C++.

1\. The (int PTR) cast of malloc() gives you away immediately. No cast in C.

2\. > _missing free on resize. When the resize occurs, we reassign vec- >data without freeing the old data pointer, resulting in a memory leak._

Er... C has realloc() for that. Once again, you do delete() + new() only in C++, not in C.

BTW, you forgot other errors in your "C" program.

<comment><USER26> Please don't post snarky dismissals here. Not cool, and you can make your substantive points without casting them that way.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment>


Asynchronous Tracking for Google Analytics - <AUTHOR> http://code.google.com/apis/analytics/docs/tracking/asyncTracking.html <comment><USER2> nbga.js is what I used before. JavaScript heavy pages could be affected quite a lot by the traditional way of including GA.</comment>


What making the Front Page did for our mobile app - <AUTHOR> http://blog.getspiralapp.com/post/91163926357/our-experience-on-the-hacker-news-frontpage

<comment><USER2> The original post had 16 points ([https://news.ycombinator.com/item?id=7972089](https://news.ycombinator.com/item?id=7972089)) and peaked only in the first hour, which means it likely descended quickly on the front page.

There's a huge difference between hitting the front page and hitting the _top_ of the front page in terms of throughput. (speaking from experience)

<comment><AUTHOR> Definitely makes sense. Have there been previous submissions analyzing the relative impact of the top 10 positions? I imagine it's pretty steep, but not quite as steep as for say, Google search results, since people are clicking through multiple submissions.

As a habitual reader of both front page and second page submissions, I was surprised by how much traffic dropped off immediately after losing front page status.

<comment><USER3> I think the "unknown or expired link" effect is partly to blame here.

I hardly ever bother to try clicking through to page 2 except when there's nothing interesting on the first page.

</comment></comment></comment><comment><USER4> We have to go deeper... "What writing an article that made the front page about making the front page did for our website." Karmaception!</comment>


Zinc sponge anode makes Li-ion alternative rechargeable - <AUTHOR> https://www.electronicsweekly.com/news/research-news/zinc-sponge-anode-makes-li-ion-alternative-rechargeable-2017-04/ <comment><USER2> Nice to see an article with a link to the underlying academic paper, even if it is paywalled ([http://science.sciencemag.org/content/356/6336/415](http://science.sciencemag.org/content/356/6336/415)).

</comment><comment><USER3> ">100 high-rate cycles at 40% depth of zinc discharge at "an energy content competitive with lithium-ion batteries"." is the problematic part.

<comment><USER4> But context helps...

"Nickel-zinc alkaline is seen as a less fire-prone alternative to lithium-ion cells, which have been banned for some US military applications, according to NRL."

So they now have a battery that works with a few hundred cycles with density close to that of Li-Ion that won't explode. It may not replace Li-ion in your vape stick but still sounds like a win for the emergency lights in the armory of a battleship (for example).

<comment><USER5> I'd expect a battleship to stay in operations for a very long time without spare part and replacements available.

The battery will long be dead by the time they'll need it.

<comment><USER6> An aircraft carrier needs resupply with avgas every three days when operating up-tempo. Warships use up resources like crazy, they're not going off on five year missions like Star Trek.

<comment><USER7> ...avgas? I'd hope it get refilled with JP-5, unless the naval aviation field has suddenly moved back to piston aircraft when I wasn't looking.

<comment><USER6> Indeed, although the article I found in Quora (from a carrier guy) actually used the term avgas and I didn't parse it :-)</comment></comment></comment></comment></comment></comment>


A fractal in Bach's cello suite (2008) - <AUTHOR> http://mathtourist.blogspot.com/2008/09/fractal-in-bachs-cello-suite.html

<comment><USER2> Anyone interested in this should read "Gödel, Escher, Bach: An Eternal Golden Braid" by Douglas Hofstadter.

<http://en.wikipedia.org/wiki/Gödel,_Escher,_Bach>

It's an enlightening, bewildering and very funny book about such things.</comment>


Ask HN: Traveling to Hawaii in a couple of days, any suggestions? - <AUTHOR> I'm going to Oahu/Kauai/(maybe big island) with a friend and I was wondering if you guys had any suggestions. I was hoping to do the Kalalau trail but the permits seem booked up for months on end.<p>Looking to get a good mix of nightlife, backpacking and general exploring in. I haven't traveled in a long time so any tips would be appreciated! <comment><USER2> Just got back from Kauai a few weeks ago, it was great. Anini Beach was great for snorkeling. The north shore beaches were great in general and relatively uncrowded. Tunnels Beach was rough and not really snorkelable, but you can if you really want to. Poipu was fun, but packed, and the water rough as the sandbar was out. Hit the canyon, lots of old tourists, but still worth it and at the end of the canyon (at the last lookout point) you can hike the Napali coast however far you want.

There isn't much night life in Kauai. Things tend to close down after 6.

AFAIK, you can still hike the trail, just not legally camp overnight. We paid a bunch extra for a Jeep rental and had fun exploring the inland dirt roads -- it was worth every dollar extra.

If you have any questions about recent Kauai/Maui, I can answer.

<comment><USER3> Kauai is majestic. The island feels like 90%+ nature - I fell in love with there being that much greenery. My girlfriends parents live at Anini. If you paddle board the reef instead of snorkeling the sea turtles come out.

To visit, end of the road is worth driving as you see various parts of Kauai.

<comment><USER2> There were sea turtles everywhere when we were at Anini a few weeks ago. At least a dozen just in the small-ish area we snorkeled. You couldn't miss them.

<comment><USER3> Great. Amazing isn't it?

</comment></comment></comment></comment><comment><USER4> Not a helpful answer, but this thread makes me happy.

I've gotten so accustomed to the poor lifestyle choices we see here every day that I was fully expecting this to be a question about where to find coworking space on the island so as not to have to break one's working routine or accidentally enjoy the place.

Glad to hear there are still plenty of sensible people here. Have a great trip!

</comment><comment><USER5> Only partially related, but take a Benadryl at the start of the flight and sleep through it. Long flight times combined with time zone changes and the crazy reductions in airline seat pitch make the trip awful.

</comment><comment><USER6> Road to Hana is a great outdoors option. Lots to see along the stops, waterfalls, natural landmarks.</comment>


Ask HN: Is permanent residency required to launch an MVP and earn money from it? - <AUTHOR> I've recently moved to Canada for work (temporary work permit).
I've been working on an app recently as a side project, and I'm very passionate about.
I know it's extremely hard to find product market fit, but the only way to figure out if it's worth pursuing is to launch an MVP fast (I can't launch in my home country), but I'm not sure if doing so will violate my status in Canada, especially if I start earning money. I am not willing to incorporate at the moment, I just think this app could help a lot of people.<p>Also, I have a friend in Silicon Valley who is permanent resident (I'm not), can we launch in the US? If so, can I work on the app while living in Canada? <comment><USER2> Worry about it after you get results from MVP.</comment>


Ask HN: How to pitch startup to corporates without losing ownership? - <AUTHOR> I was just reading this [https://playbook.samaltman.com/] and thought I would post here.
I have a startup and a well specified product in my mind and I'm already drafting a business plan. It's a b2b product which requires an upfront investment to develop an MVP for. Some will ask why don't I built it myself - I am not a coder, nor a full-stack developer.
The plan is to reach out to a bunch of businesses but I am afraid they would either laugh me out of the door or simply take my idea and with their infinite balance sheets build it themselves.
Besides asking the representatives of those Corporates to sign an NDA at the door during the demo what else can I do to protect myself?
Finally, let's say I wanted to create animations such as this [https://www.youtube.com/watch?v=2y6aVz0Acx0] to demonstrate my use cases - which software would you recommend for me to work on?
Many thanks <comment><USER2> | simply take my idea and with their infinite balance sheets build it themselves

If large businesses were actually able to do this then the vast majority of startups would never exist. These days many startups are really just speculative r&d for big co's that like to spend capex for a (mostly) known commodity vs opex that may never amount to anything.

You probably wont make them a customer, but the chances of big co managing to take your idea, implement it, and put it out into the market to compete with you is vanishingly small.

</comment><comment><USER3> The best protection is going to be execution.

NDAs aren't really going to help you in this regard.

Just take some meetings, tell them what you're working on and if some form of collaboration is of interest.

</comment><comment><USER4> Is your idea very unique? There's much more to commercial success than just the idea itself. If your idea is very unique, then you might want to consider patents as a way forward in addition to NDAs. Companies, especially large ones, have minimal interest in stealing startup ideas.

</comment><comment><USER5> Do you know any of the potential customers? Are you solving a problem they complain about? Is there a solution already?

check out bubble.is you might be able to build a prototype.

If you have a few customers using a patched together prototype you have a 100% better chance of finding a developer.

<comment><AUTHOR> Thank you for posting, I am not currently looking for a developer and as I mentioned I do know of potential customers which are not consumers. My questions were specifically about protecting my idea during the demo session and the program I should use to create an animation.

<comment><USER5> You can find some explainer video creators on Fiverr.

[https://www.fiverr.com/search/gigs?query=explainer%20video&s...](https://www.fiverr.com/search/gigs?query=explainer%20video&source=main_banner&search_in=everywhere&search- autocomplete-original-term=explainer%20video)

10 Awesome Software To Make Explainer Videos? [https://www.wowmakers.com/blog/explainer-video- software/](https://www.wowmakers.com/blog/explainer-video-software/)</comment></comment></comment>


BBC open source their "Glow" Javascript library - <AUTHOR> http://www.bbc.co.uk/glow/

<comment><USER2> The BBC's Glow effort has always confused me. They were using jQuery on the main BBC web site a few years back and I ended up chatting with them about it. They mentioned that they were working on their own library since they needed support for Safari 1.3 (if you've ever had to support that browser version, it's miserable - I'm not even sure it could be described as 'functional'). This was a little bit odd since they hadn't actually submitted any tickets or patches requesting that Safari 1.3-related bugs be fixed.

Now, I should take a step back and mention that some people are just set to be framework authors. They see a problem and want to write their own framework that matches their mental model. This isn't a bad thing - I certainly did that when I wrote jQuery (decided not to use Prototype back in 2005 and wrote my own instead) and the BBC guys are of the same ilk. It's important to realize that the BBC's Glow effort is less about filling a specific void in the market and more about them wanting to write and run their own framework. In an organization as large as the BBC this scale does tend to make its own brand of sense.

If you look through the timeline for when changes were made to the level of browser support, v3.3 shows when support for Safari 1.3 was dropped to "Level 2" (a.k.a. "The web page must be functional in a gracefully degraded state.") - this was in September of 2008 (long before the public release of the library, today).

Timeline: [http://www.bbc.co.uk/guidelines/futuremedia/technical/browse...](http://www.bbc.co.uk/guidelines/futuremedia/technical/browser_support.shtml#history)

If you look at the support table for which browsers they support (the important ones are Level 1) it's interesting to note that they actually support _less_ browsers on less platforms than most other libraries. For example, jQuery supports Firefox 3.5 (on Windows, OSX, Linux), Chrome 2 (on Windows), Opera 10 (on Windows and OSX), and Safari 4 (on Windows and OSX) in addition to the browsers listed in Glow's Level 1.

Support Table: [http://www.bbc.co.uk/guidelines/futuremedia/technical/browse...](http://www.bbc.co.uk/guidelines/futuremedia/technical/browser_support.shtml#support_table)

In the end I think some seriously short-sighted planning went into the creation of Glow. When I was talking with some of the guys at the BBC who were working on it (before they were using it internally) I asked them: "Don't you think that you will have dropped support for Safari 1.3 before you end up finishing and releasing the library? Writing a framework isn't trivial, it's going to take a while and Safari 1.3 is already effectively dead." (At the time Safari 1.3 had a 0% marketshare.)

And now, sure enough, here we have yet another JavaScript library that does similar, but not quite the same, things as every other library - with worse browser support, less uptake, less documentation, and more fracturing of the community.

<comment><USER3> Glow does support Firefox 3.5, Chrome 2, Opera 10 and Safari 4. We're certainly not going to ignore new versions of browsers until they appear on that list.

At some points, we've been ahead of jQuery when it comes to new browsers. Basically because we were able to quickly patch and release in order to fix high-profile BBC pages. This isn't a criticism of jQuery, but it shows the benefit of us being devoted to the BBC.

The BBC will always have to support older browsers because of our users. I think it would be unfair to ask other libraries to hang back with us (I'd much rather they advanced actually), and I wouldn't want to be using a library that left us behind.

At the moment, our support table is actually closer to other libraries' than it has ever been, that support gap will naturally increase and decrease over time.

We're not trying to steal your thunder at all, although I can see why it may have came across like that. My advice to developers is: use the library which has the most features you require. Whichever you pick, request the features that are missing.

With all the libraries innovating and others taking note, the quality of all libraries increases. Having one library to rule them all doesn't drive things forward, a good example of this is when IE6 was the only major browser, browser development stagnated.

We're not about filling a void in the market, but filling a void at the BBC. We're open sourcing our efforts because we should.

You mention you communicated with us? I'm not aware of this at all.

Having said all this, we're looking at the possibility of using Sizzle in Glow 2.0, although it's a bit vague about which browsers it intends to support. Would be great to know the details!

[http://groups.google.com/group/sizzlejs/browse_thread/thread...](http://groups.google.com/group/sizzlejs/browse_thread/thread/196a7b28aa1acb3a/e9f510f74c995cbc?lnk=gst&q=browser+support#e9f510f74c995cbc)

Cheers, Jake.

<comment><USER4> I'm less concerned about jQuery's thunder and more concerned about the BBC's use of public money to fund developers' vanity projects.

How is the time and cost which of building and maintaining Glow outweighed by the level of page degradation that Safari 1.3 and other tiny niche users would have experienced (where it could not be mitigated by other page design considerations) using, for example, jQuery?

<comment><USER3> It's common for people to see something they don't think directly benefits them and decide it's a waste of the licence fee.

Perhaps you're not tied down to older browsers, so Glow has no benefit compared to other libraries, for you personally.

I'm a fan of the Radio 4 programme "More or Less", a review of stats in news stories. It's audience would seem insignificant compared to reality TV shows and soap operas, should the BBC scrap "More or Less" and reassign its budget to reality TV?

Would you say it's wrong that we support screen reader users, even though their numbers are small? Is time spent helping these users a waste of their licence fee?

No, we're happy to cater for minority users even if it means being behind other libraries. I wouldn't want other libraries to do the same, as they can be the choice for people who don't need the support of old browsers, and they can perhaps be faster and leaner for it.

<comment><USER5> But you're missing the point that you could have spent the time you spent developing Glow on extending jQuery to do all of these things that you want Glow to do. Then you would have the benefit of everything that jQuery does plus everything that Glow does... but going down separate development paths is not helping anyone at this point.

Unless Glow is doing something nifty that jQuery is not other then supporting screen readers and older browsers.

</comment></comment></comment></comment></comment><comment><USER6> Its so nice to see traditional media releasing open source tools like this. See also the New York Times release of their map reduce toolkit [http://open.blogs.nytimes.com/2009/05/11/announcing-the- mapr...](http://open.blogs.nytimes.com/2009/05/11/announcing-the-mapreduce- toolkit/)

<comment><USER7> Agreed.

The Washington Times have also released some pretty impressive open-source django apps over at <http://opensource.washingtontimes.com/projects/>

it includes django-supertagging which is pretty much the best automated django tagging solution out there!

</comment></comment><comment><USER8> Since I paid for this (as a license fee payer in the UK) I'm glad it's been opened. You don't need to thank me :)

I look forward to the day they send me Blu-rays's of my tv programs as well :)

</comment><comment><USER9> Well. I just looked through Glow, and ...

Yeah.

Anyway, to salvage something from this: all I want out of these "frameworks" are ways to do DOM work based on CSS selectors.

jQuery, prototype, dojo ... all I want is $(..)

Anyhow, I was in the middle of ripping down dojo's query.js, which is the standalone CSS3 select/query part of dojo, so I could just deal with that without the rest, and I stumbled across DOMAssistant.

I've only been using it a couple of days now, but it's less painful than the other frameworks, because it pollutes my head less.

It's basically just A) the fastest and most complete CSS2.1 and CSS3 selectors (currently fastest slickspeed), and B) a minimal framework where everything is accessible off of $() and $$().

The 'whole' thing is 9k gzipped, too.

Anyway, there are probably a ton of very useful things that jQuery/prototype/effects.js/mootools do that all-day js wonks know like the back of their hands; I like DOM assistant for the querying, though.

</comment><comment><USER10> I think the more exciting part of this is to see another media company releasing open source code. As it's been said, the JS library is becoming a crowded space and perhaps it would have been better for them to contact another library and see about integrating into it.

I think we're going to see the beginning of meta libraries. Code which links up multiple libraries. Maybe you grab a few libs from moo, prototype and jquery, and then layer Glow on top?

Useless side note: When I was planning my own blogging engine I was going to call it 'Glow' so I definitely like the name at least :)

</comment><comment><USER11> All these arguments about BBC should have just used jQuery are non-starters.

There are plenty of off the shelf website production systems on the market, for instance. If you think a JS team should only ever use a library, I presume all your websites are created in Drupal using built in templates.

Software you produce yourself does exactly what you want with no bloat. jQuery is excellent, but there will always be gaps in it for any given organisation. Additionally there will be bloat. Sizzle is fantastic software, but my guess (based on actual observations) is that 90-95% of the selectors it is given in the wild are of the '#someid' or 'tag.classname' type. These can be handled with 20 lines of code, but Sizzle is closer to 1000. Many libraries contain code to support use on both standards compliant and quirks mode web pages, but if you only ever code in one of these, that extra code is useless.

Then there is the issue of dependency. External dependencies are one of the weakest points of any software product. You can't directly fix bugs or fill functionality gaps, so you must either branch the product or work around the issues. Both approaches cause pain when wishing to upgrade to the next version (a decision which may be forced on you by the supplier's support levels) by either having to re-engineer the patch or check compatibility of the workaround. Yes, you can submit bugs or patches, but you cannot control when, or even if, these will end up in a released version. Even if your bug is fixed, you may still have to re-engineer your codebase, because the fix may break your workaround.

If your organisation has the resources to produce a piece of software itself, it should. That organisation will end up with a product that does exactly what is required with no bloat, will avoid the pain of external dependencies, and will have team of people on board which provides a centre of excellence for that technology. For organisations much smaller than the BBC, these benefits will probably outweigh the small cost saving of using a JS library like jQuery. For the BBC, it's a "no-brainer".

</comment><comment><USER12> Another JavaScript library, this space is already crowded and from what I can tell, there nothing available in Glow that isn't available in other popular libraries.

Maybe being backwards compatible to IE 5.5 is important enough to switch to this I don't know.

<comment><USER13> I can understand why backwards compatability is important for an organisation such as the BBC. But at the same time it would be really nice if these larger organisations were encouraging people to upgrade their browsers where possible.

<comment><USER14> But not so nice if you're a paying user (via the license fee) and upgrading means a new OS or computer. I think their mandate is to work for their paying users, ahead of helping web developers.

<comment><USER13> But the web is worldwide, how many readers of BBC news are from outside the UK? And not every UK citizen has to purchase a license.

They've recently been trying to encourage everyone to make the switch to digitial TVs. I'm sure it's a lot easier to get people to upgrade their browser than buy a new television.

<comment><USER15> The BBC has a specific mandate to the British people. If they are not serving them then they are not doing their job.

<comment><USER16> We're talking mainly bells and whistles (progressive enhancement) via Glow not basic access to data.

That said BBC produce a lot of content for the web that not everyone can get (people don't all have computers), several digital radio channels (not everyone has digi-radio), several digi-TV channels (a lot can't even get the signal, many don't have the hardware).

So the BBC aren't worried about large scale access issues, why worry so much about obsolete browsers?</comment></comment></comment></comment></comment></comment>


PHP Cheat Sheet - <AUTHOR> http://encycode.com/wiki/index.php/PHP_Cheat_Sheet

<comment><USER2> _"PHP doesn't support global varibles..."_

Since when?

<comment><USER3> Nice catch. As explained at www.php.net/global, PHP most certainly does "support global variables". They are accessible by declaring them with the "global" keyword within the scope they are to be used, or by accessing them via the $GLOBALS superglobal (one that, it appears, the author neglected to include in his list of superglobals)

</comment></comment><comment><USER4> Is `=&` actually an operator, or is it simply:

$foo = &$bar;

"set $foo to the address of $bar", like you'd expect from C?

<comment><USER5> The proper way is $foo = &$bar, but for some reason $foo =& $bar seems to be frequently used to achieve the same thing.

</comment></comment><comment><USER6> when i look at that cheat sheet, i understand why php has such a bad fame: if you need to look up those function, you can't create good code!

still, a real php cheat sheet may be helpful to navigate through php's idiotic functions naming scheme...

</comment><comment><USER7> No mention of lambda style anonymous functions, too!

</comment><comment><USER8> Omits foreach; regretful.

<comment><USER9> It's a wiki, you can edit it: [http://encycode.com/wiki/index.php/PHP_Cheat_Sheet#Foreach_L...](http://encycode.com/wiki/index.php/PHP_Cheat_Sheet#Foreach_Loop)</comment></comment>


EFF Patent Project Gets Half-Million-Dollar Boost from Mark Cuban and 'Notch' - <AUTHOR> https://www.eff.org/press/releases/eff-patent-project-gets-half-million-dollar-boost-mark-cuban-and-notch <comment> against-patents If you're a designated inventor of a patent or a patent application who opposes patents, you could publicly state your support for patent abolition at the Inventors Against Patents site: <http://inventors-against-patents.org>

(A site operator here; the site was launched a few days ago. The idea is that anyone campaigning for a patent reform can use support by designated inventors as a presumably convincing argument in the eyes of the general public.)

Edit: As Richard Stallman points out in a comment at EFF's site, abolishing software patents can be easier than shortening the period during which a monopoly is granted to 5 years as EFF proposes; he cites a requirement by WTO that all patents are granted for a period of 20 years.

The nice thing about publicly supporting abolition is that you automatically support "less radical" proposal's like EFF's 5-year reform, and you support all of them at the same time just once and all campaigners can use your support. DRY :)

<comment> jack-r-abbit I can see how that would be quite the annoying situation to be in. On one hand, an inventor that opposes patents could simply not file a patent. But then that leaves them open for someone else to come along and file the patent and then sue them for patent infringement. So the inventor is then compelled to file a patent simply as a way to keep some one else from getting it... even if they never plan to go after others for infringement.

<comment><USER3> You can always stop someone else from patenting your idea by publishing it yourself, though. You don't have to play the game to affect the outcome.

<comment><USER4> Clear this up for me please. How does that help? Isn't that essentially the prior art thing that still has to get resolved in the courts?

<comment><USER3> Yes, but it changes the dynamics. If the defendant can point to solid prior art, the patent troll will likely beat a hasty retreat. The last thing they want is to have their weapon taken away from them by the adults in the room.

<comment><USER4> Thanks! Though that still seems more expensive than filing the patent.

</comment></comment></comment></comment></comment></comment><comment><USER5> Hmmm, that's a bold move from Notch. I wonder how political activism in the US by a Swedish citizen is going to sit. Personally, I would just have thanked my luck for working in a country with sane patent laws.

<comment><USER6> I think Notch is in a good position. Minecraft has huge draw among children. Think of how many politicians' kids might play it.

<comment><USER7> Maybe my perception is skewed, but I imagine most American politicians' children being in their 20's to 30's.

Edit: Apparently wikipedia really does have a page for everything: [http://en.wikipedia.org/wiki/List_of_current_United_States_S...](http://en.wikipedia.org/wiki/List_of_current_United_States_Senators_by_age)

<comment> jack-r-abbit Our President's kids are 11 & 14\. Sure that is just one case but I also imagine current generation of politicians is on the edge of a more recent trend to have kids later in life (not counting the other trend of having kids at age 14).

<comment><USER7> Obama is only older than 15 or so of the 100 senators. As far as American politics go, he is quite young.

</comment></comment></comment></comment></comment><comment><USER8> EFF's ideas for patent reform:

<https://defendinnovation.org>

They sound pretty good to me.

<comment><USER9> #1 I feel this is just a scapegoat with allowing people to hope and wait 5 years for bullshit patents to expire; I don't know what a fair length of advantage time, temporarily monopoly should exist.

#2 If someone isn't infringing, then sure - troll should pay. But a lot of unknowns could invalidate a patent, perhaps just decidedly not detailed enough by a judge who ends up reviewing it, which I don't think makes sense to be a point of having the troll pay for it. If a patent is seen as invalid, then it can no longer be used to sue people.

#3 Agreed.

#4 It would be impossible for either party to prove, so then this just leaves costs open ended for the person who owns the patent.

#5 This is confusing. They seem to be trying to deal with a problem not directly associated with patents themselves? More they just want more information to make it easier if it'd be a good idea or not to infringe? You could always send an email and ask if what you're doing infringes - <USER2> you're not trying to patent something on top of existing patents further. Though I imagine that's not a tactic most people would be comfortable with.

#6 Define what a small fraction is, vs. how important something is in an application; It could be the most valuable piece in some overall 'bloated' scheme

#7 If you look at benefit to the economy, currently measured by GDP, any money being spent (on lawyers) is positive for GDP, and therefore for the economy..

In conclusion, I think these suggestions put forward by EFF are meant to deal with stopping the damage and strain trolls put on the system, though not fairly take into consideration real innovation, that actually is created, and used. Things like "swipe to the right to unlock" - I don't think that's complex enough to consider it patentable - but it is patented (I believe) - but never should have been. I am sure there are much more complex systems that people can come up with, that might take many years to develop or discover - but once known and concepts turned into something tangible, it would not take long to re-engineer, so there may not then be any incentive to attempting to develop said system; It could even take years of looking for someone to fund what you want to create that you have a patent on, especially if it's "so far out there" that people might have trouble understanding its value. Anyway - it'll be interesting to see where it all goes. I think all patents, software and not, should be thrown out. Other mechanisms would surface to allow innovation to move forward.

<comment><USER10> I agree that #1 and #4 are problematic, and to a lesser extent #6.

#3 sounds good, but how do you stop people from submitting code written in Brainfuck or TECO or something?

<comment><USER11> Regarding #3 I think they want the patent holder to prove he is actually using the invention for a (commercial) benefit. If you invent a copy protection scheme they want to see you actively sell it to third parties or actively use it in your own product. I think that makes sense to be honest, people shouldn't be able to sleep on an invention until they find a suitable company to sue for high profit margins.

Edit: This is in reply to points about _software patents_ only.

<comment><USER12> The classic drug pipeline includes pure research companies that would be NPE's.

<comment> against-patents Isn't it rather possible that the right answer for software is not like the right answer for drugs, and that it takes an expert in a particular field to propose a sensible reform (assuming one is needed in that field)?

A lot of the questions about what patents tend to do seem to have different answers in different fields: [http://inventors-against- patents.org/faq.html#is_abolition_o...](http://inventors-against- patents.org/faq.html#is_abolition_obvious)

</comment></comment></comment></comment></comment></comment><comment><USER13> How does this work exactly....Mark Cuban sponsors a chair and the EFF hires 2 attorneys to execute the mission of the chair. But given that this a $250K grant, that sounds like it covers their salary for 1 year. What happens in the next year? Is this a commitment in perpetuity where he keeps paying these salaries? Or does the EFF have to find money next year to pay these salaries?

I am not condemning this move, I am really curious about how this stuff works.

Anyone know?

<comment><USER14> No idea, but I guess having someone working on this issue full-time for a year will give them some idea of how effective this type of move is, and it's certainly better than no action at all.

If it is effective, I'm sure there are a variety of ways to continue to fund the initiative.

<comment><USER13> Perhaps...but I am still curious as to how it works :)

</comment></comment></comment><comment><USER15> Yep, enough money for two attorneys oughta do it. Although i have to admit, i would love to have that title 'The Mark Cuban Chair to Eliminate Stupid Patents'.

</comment><comment> shawn-butler The EFF should stick to its core mission. This is an overreach and is a mistake.

Worse it's a waste of time, money and valuable attention. If you want political action and have the money and resources then why not form a single- issue political action group, get involved and do something?

This is just writing a check and getting your picture and name in the media, something by the way at which Mark Cuban, whose hypocrisy knows little bounds, excels.

<comment><USER16> That seems like be a lot of harsh claims and little to back them up.

It's easy to see how you could argue that this is exactly the EFF's core mission, the link from software patents to digital rights is hardly ephemeral, and the EFF has a history with the (since expired, the system works!) GIF patent. I think that an opponent argument is conceivable, but you haven't made it.

And why _would_ you form a single-issue political group, when you could join ranks with a sympathetic existing political organization, which brings enormous resources, relationships and standing to the table?

<comment> shawn-butler The EFF is supposed to be about protecting digital rights. Do you believe that either Apple or Samsung is violating the civil rights of the other?

I could see taking on a case on behalf of someone who is a victim of another abusing the system say by an NPE troll. Wading into legal reform and becoming a lobbyist organization is another matter entirely in my mind.

Generally speaking from the evidence we see around us on a daily basis, the EFF is failing to hold the line in its mission as it is. They have no easy task. I don't really see how biting off yet even more than you can chew and becoming further diluted helps. Should the ACLU be active in environmental causes? We can agree to disagree about how best to achieve political reform and maintain credibility. There are indeed many ways to skin a cat.

<comment><USER17> First of all, "civil rights" means (in the US context) a particular set of issues, which aren't actually the core ones defended by EFF _or_ the ACLU, although they sometimes overlap. I think you mean civil liberties.

Second, EFF has been working on intellectual property reform since its founding. It's long argued that antiquated or misapplied ideas of how IP should be enforced are actually a free expression issue, since (among other ideas) code is speech. It's actually one of the core principles at the basis of mapping traditional civil liberties onto the digital realm, which is at least some of the (looser) ideas behind "digital rights". Patent reform is part of that. It's not just about Samsung and Apple, it's about people being able to express themselves -- in free software, or the application of algorithms, in a digital world.

</comment></comment></comment></comment><comment><USER18> If HN was serious about patent trolls, we would have our answers by now. <https://news.ycombinator.com/item?id=4927832>

</comment><comment> M8R-fhlcjm what exactly have Cuban or Minecraft innovated?

<comment><USER19> Well, Minecraft is the one of the largest (if not _the_ largest) indie developed game in the world. So there's that.

<comment> M8R-fhlcjm biggest != technical innovation

Quake 1 had better graphics and editors eons ago

</comment></comment></comment><comment> M8R-fhlcjm You won't be able to create an exception for software not to be patentable. It's over, get used to it and move on.

<comment> against-patents It's a tad pessimistic, given that, say, slavery was abolished by most nations after being widespread and acceptable, in all cultures and on all continents, for thousands of years. Things end, especially if people actively try to end them.</comment></comment>


Archaeologists Are Spotting Ancient Ruins in Cold War Spy Photos - <AUTHOR> http://www.theatlantic.com/technology/archive/2016/06/among-the-remnants/488279/?single_page=true <comment><USER2> Are these available in Google Earth? If not, why not?</comment>


Airbus hit by series of cyber attacks on suppliers - <AUTHOR> https://www.france24.com/en/20190926-airbus-hit-by-series-of-cyber-attacks-on-suppliers <comment><USER2> Other comments here incorrectly pointing out that Boeing and Airbus don't manufacture in China - they do. And why wouldn't they, it's obviously much cheaper to manufacture there given material and labor costs. Obviously they don't manufacture highly sensitive military aircraft in China, but commercial aircraft, sure why not.

What they don't do is the design, testing, and certification in China. This is the real IP - not the materials or the assembly techniques, but how to navigate the regulatory landscape of the FAA and the EASA in extremely complex hardware/software integrated systems. The article mentions certification documents/evidence as a primary target.

The funny thing in all this is that passengers inherently trust the FAA and EASA operated system and inherently do not trust a Chinese-owned, manufactured, and regulated system for commercial aircraft. When really this breach was all about the money - Chinese companies want to get in on Boeing and Airbus' market.

I don't have a dog in this fight, but I will say that Boeing isn't doing itself any favors with it's cost cutting efforts on the 737 MAX, and that if it wants to keep consumers trust in its planes over the perception of "inferior" foreign competition, it needs to work much more closely with the FAA to ensure safety is the primary motivating factor on new designs and does not get overriden by fuel efficiency.

<comment><USER3> Russia has expertise building airliners. Wonder why manufacturers never took to producing there for cheap labor? My guess is China leveraged their market potential to entice cos to take some of their mfg to China.

<comment><USER4> Russian industry was taken over by the mafia. That is much less tenable than the situation with China.

<comment><USER5> [http://www.softpanorama.org/Skeptics/Pseudoscience/harvard_m...](http://www.softpanorama.org/Skeptics/Pseudoscience/harvard_mafia.shtml)

Somehow I sense you did not intend irony.

[main stream version: [https://www.thenation.com/article/harvard-boys-do- russia/](https://www.thenation.com/article/harvard-boys-do-russia/)]

</comment></comment></comment></comment><comment><USER6> > "Globally recognized standards, such as ISO 27001, 27701 and 9001, can > definitely ensure a baseline of security, privacy and quality assurance amid > suppliers. One should, however, bear in mind that they are no silver bullet > and some additional monitoring of suppliers handling critical business data > is a requisite."

This is misleading.

ISO standards dictate that a company should have certain processes in place. Like quality assurance, customer satisfaction, continuous improvement, ect. They do _not_ specify individual processes or procedures to the company. They just lay out which structures should exist in an ISO compliant company. It is up to the company to develop processes and procedures that fulfill those structures.

The specific standards that _are_ a "silver bullet" (as the author puts it) are NIST 800-171 "DFARS", ITAR, AS9100, NADCAP, and other smaller (yet equally significant) manufacturer-specific specifications that get flowed down the supply-chain on an as-needed basis.

So there is no ambiguity. If a supplier does business with a diverse enough client base in aerospace they will almost certainly have overlapping systems in place to protect against these things. Without pretty much all of the specifications I listed above, a supplier would not legally limited in what they are allowed to possess and produce.

<comment><USER7> Do companies with ISO certifications ever get reviewed after-the-fact? Or do you just have to check the right checkboxes during an initial review process?

<comment><USER6> I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense.

Basically an auditor comes and quizzes you on your own processes. You must show that you have processes which meet ISO criteria, and that you religiously follow those processes.

Basically you have a lot of freedom to develop your business, just be sure you adhere to whatever you put into writing.

<comment><USER8> Back in the day of Total Quality Management and ISO9002 the software company I worked for decided to get itself certified. Problem was, nobody had a clue how to quickly describe the business of creating software as a set of processes, let alone apply them in measurable ways under the beady gaze of an auditor. So with evil inspiration it was decreed that the software division had no processes at all. The customers could rest assured that the Accounts and Marketing departments were fully ISO9002 compliant - as for the actual product they were buying? spun out of desperate sweat and divine revelations so far as they could tell.

But this didn't entirely get the software division off the hook. We still had to be able to show an auditor that we knew our processes were excluded. So there was a special folder containing just one functional page besides the meta-bumf to support it, and it read (in effect) "THE ACTIVITIES OF THE SOFTWARE DEPT ARE EXCLUDED FROM ISO9002 PROCESSES". And we were all trained to be able to produce it upon demand.

We passed the audit. Our letterhead paper gained the magical ISO9002 seal of approval. The administrator who had championed the long and expensive business sprung from its success to a much larger company. In her absence the process documentation for the rest of the company quietly withered and when the follow-up audit came due we quietly neglected to apply for it. The letterhead paper was reprinted with a snazzier logo and no seal of approval. We got back to work, quietly apprehending the next big thing.

<comment><USER6> That is a great story!

I've seen companies pack trunks of cars with unclaimed scrap. Buy a 55' trailer with cash, fill it with stuff, then claim it belongs to the neighbors. Load material onto 30' racks and send the forklift operators home.

It's almost better that your company committed to ISO to kinda get organized and then let it slide afterwards. I'd almost say it's worth it in a medium sized company every 10 years just to stay accountable and organized.

</comment></comment></comment></comment></comment><comment><USER9> How does one know that a particular attack is "state-sponsored" or originates from a particular country? Exactly what does it mean to be "state-sponsored"? And who provides this analysis?

<comment><USER10> You look at the the target and analyze the methods used in the attack to make that determination. For example, a zero-day exploit involving expensive equipment screams state-sponsored. Criminal enterprises wouldn't waste their money and resources analyzing and attacking Juicero machines in an embassy.

Also, the same tools and techniques get recycled, so you can use clues from previous attacks to tie together a motive.

> Exactly what does it mean to be "state-sponsored"?

It means an attack was either performed by a foreign agency or by a group getting paid to act on their behalf.

> And who provides this analysis?

Government agencies and private companies provide these types of analysis services.

</comment></comment><comment><USER11> A question I've always wondered, and relevant here. If this is inter-company (and probably intra-company) communication, why don't these companies manually exchange one-time pads and use them? It's surely not hard for a courier to carry literally terabytes of OTP, and report if it was taken off them at any point.

I was thinking of tape or HD, but now you an have the courier carry a terabyte of OTP in a few USB sticks.

<comment><USER12> Let's say you do that:

1\. Send giant HD of OTP bits to other office.

2\. Everyone at that office who needs to communicate, so you make those bits accessible on the internal network so various machines can get to it.

3\. Now a hacker that accesses the network can get to your OTP bits.

At that point, you're no better than using some other security mechanism.

<comment><USER11> Oh FFS. I was expecting some silly answer involving couriers being intercepted but this is just as bad.

> 3\. Now a hacker that accesses the network can get to your OTP bits.

Which is on an internal network so is not exposed (unlike the contents of a VPN which necessarily goes external) so can be more secure. While nothing's unhackable it adds an extra layer to break through.

That the article says "It was very sophisticated and targeted the VPN which connected the company to Airbus" shows the VPN was the weak link, and not the internal networks. So harden the weakest link.

</comment></comment></comment><comment><USER13> The way I figure, if a sophisticated attack is so sophisticated that it can only be state-sponsored, then it is sophisticated enough to appear to be sponsored by another country.

<comment><USER14> Your problem here is ability and motive. What other countries are capable of executing this attack and would want to steal this information? As far as I know Comac is the only company that is attempting to build planes that rival Boeing and Airbus for commercial flight so you have your motive. The Chinese have a history of corporate espionage (lookup Huawei and Nortel) and given that Comac is a state owned company you can clearly understand why they would try to steal information.

If you're trying to frame someone, there has to be a plausible explanation for why you would do it.

<comment><USER15> >Comac is the only company that is attempting to build planes that rival Boeing and Airbus

Boeing also competes with Airbus, as in actively competes in real dollar terms compared to Comac which is more or less aspirational. Given their current situation they have as much incentive to hack Airbus, plus they've been accused recently:

Airbus to sue NSA, German spies accused of swiping tech secrets

>European aerospace giant Airbus is promising legal action over claims its top blueprints were stolen by German spies and given to America's intelligence agencies.

[https://www.theregister.co.uk/2015/04/30/airbus_us_german_in...](https://www.theregister.co.uk/2015/04/30/airbus_us_german_intelligence/)

My view is that both Boeing and Comac is actively stealing from airbus because why wouldn't they?

<comment><USER16> Yes, US/NSA/Boeing must at least be under suspicion in these circumstances.

As the Comac C919 approaches certification and full production, airlines, especially Chinese ones, will delay orders, to wait and see, or actively prefer the C919 over the 737 series. Even if the C919 is delayed with the usual teething troubles, many customers will decide to wait, or buy Airbus if they have to.

At this point, Boeing is the weakest of the three competitors in the mid-size market, and must be desperate to do anything to survive.

</comment></comment></comment></comment><comment><USER17> Out of curiosity: why is China not mentioned in the article's title, when the first sentence states a "Chinese state-sponsored hacking operation"?

<comment><USER18> It took my vouch to un-dead your comment, useful because I couldn't reply to it otherwise. I'm morbidly fascinated as to how the _top two comments on this submission were marked_ dead _in the first place,_ but considering it took a vouch to automatically bring it back to life, there's a hint of a Flag brigade on this thread.

To answer your comment: because the title of the submission "Airbus Suppliers Hit in State-Sponsored Attack" and the title of the article "Airbus Suppliers Hit in State-Sponsored Attack" are identical, and that's totally fine. Changing the title of the submission to include a detail from the article actually editorializes the submission, which is not ideal for HN or the audience here.

<comment><USER19> Please don't post insinuations of astroturfing or similar manipulation ("Flag brigade") without evidence. If you're concerned about abuse, please follow the site guidelines and email firstname.lastname@example.com so we can look into it.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER18> Hm, I didn't bucket flag-brigading into the astroturfing bucket (specifically because they're quite different - one suppresses speech whereas the other purports to be grassroots speech). Your point is well taken, but going forward dang, there's value in adding the "or similar manipulation" qualifier to the current iteration of guidelines:

> Please don't make insinuations about astroturfing. It degrades discussion > and is usually mistaken. If you're worried, email us and we'll look at the > data.

Hopefully this comment is viewed as both the acknowledgement as well as the constructive feedback it's intended to be.

<comment><USER19> For sure it's constructive. I'll see about expanding the wording.

Edit: ok, done. [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment></comment><comment><USER20> Interesting how Boeing and Airbus don't manufacture in China, and coincidentally China hasn't been able to produce any viable competitor to those products.

Goes to show that without easy access to product blueprints/IP at the factories, China is very slow to actually innovate on their own. Hence why I feel the "China will outpace everyone in tech and take over the world" is super overblown.

Even their university culture practically encourages cheating in classes to pass, so you have generations of students graduating with weak understanding of the fundamentals. The US is obviously not a perfect meritocracy, but China is super far from that.

An economic model where American/European/Japanese/Korean tech is stolen and then friends of politicians are gifted CEO positions of companies that clone that stolen tech...not sustainable at all. If you want a painful example of what I'm talking about, watch the AI debate between Jack Ma and Elon Musk. It's so clear that Ma has an absolutely minuscule understanding of the AI landscape.

When robotic manufacturing eventually becomes cheaper and faster than manufacturing in China, meaning they'll no longer have IP to steal, they are in huge trouble.

<comment><USER21> Wow, these are some seriously racist comments.

<comment><USER20> What does race have to do with any of this? I'm discussing their government's economic and academic model. That's like saying criticism of America's healthcare system is racist against whites, because that's their majority ethnic group.

If anything, it says a lot about you that you associated everything I said with their ethnicity rather than the government itself.

<comment><USER22> The term "racism" includes both race-based as well as ethnicity-based stereotyping. See, for example, Wikipedia:

[https://en.wikipedia.org/wiki/Racism](https://en.wikipedia.org/wiki/Racism)

The idea of Chinese companies/universities/etc. being uncreative and over- reliant on imitation and industrial espionage is quite obviously a somewhat tired cliché. I'm certain it makes an appearance in almost every single front page comment threat on the Chinese economy of the last five years or so.

There might even be a kernel of truth. But, as others have pointed out, the same was said of Japan and Taiwan before. In such a situation, you should be wary of repeating such stereotypes if you don't have first-hand experience, which I doubt many of those regurgitating that trope have.

</comment></comment></comment></comment><comment> ga-vu Original report: [https://www.france24.com/en/20190926-airbus-hit-by-series- of...](https://www.france24.com/en/20190926-airbus-hit-by-series-of-cyber- attacks-on-suppliers)

Link to the actual source, please. This is a rehash (abhorrent blog spam) of a proper news report.

<comment><USER19> Thanks! Url changed from [https://www.infosecurity-magazine.com/news/airbus- suppliers-...](https://www.infosecurity-magazine.com/news/airbus-suppliers- hit-in/).

</comment></comment><comment> cde-v Seems like Boeing is getting pretty desperate to fix their MCAS issues.

</comment><comment><USER23> Without wanting to dive into the politics cesspool, In general I'd favour sharing IPR on RAND terms, rather than locking it up as special secret sauce. I think if Comac is struggling to learn how to make safe aircraft, then helping them is "build a better world" more than fighting them at the firewall.

</comment><comment><USER24> I used to complain so bitterly that the computers I had for AI research work, despite being a flavor of Linux, had no access to any sort of networking, making the installation of basic packages a pain.

It turns out the safest way, barring spies who willingly steal, is provide no entry/exit points for data. For smaller organizations or small divisions that's feasible, but super hard to maintain at larger divisions.

<comment><USER25> Having seen what a competent Red team can do that is not much of a barrier if information its valuable enough

</comment></comment><comment><USER26> So, it used to be that saying anything remotely skeptical about Bitcoin was the way to get downvoted on HN. Nowadays, it seems that saying anything negative about China is how.

Although, in the field of aeronautics, it is not like China is the only "state sponsor" to engage in espionage, or that this is anything new for any of the major powers.

<comment><USER19> It's not remotely close to true that negative comments about China are "the way to get downvoted on HN". On the contrary, HN's demographic, while quite international, is almost all Western, and for better or worse it follows geopolitical trends and the leads set by government and media.

When we have to ask commenters not to take HN threads into nationalistic flamewar, it's usually because of generic nationalistic rhetoric against China. This happens often enough that we routinely get accused of being pro- Chinese. We're not, of course. We're against nationalistic flamewar, regardless of who is flaming or being flamed, because it's against HN's rules and destructive of the spirit of this site.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER26> I appreciate HN doing their best to keep discussion in a productive zone and out of flamewar territory. I enjoy HN a lot, which is very different from most sites that allow comments.

However, comparing my parent comment here to the average for most comments I make, or comparing it to comments related to Russia, France, Germany, or any other major nation-state, I have to say that the empirical evidence does not support your statement. :)

But, again, I appreciate HN discussions and the efforts to keep it a productive discussion.

</comment></comment></comment><comment><USER27> I hear good things about this MCAS thing Boeing is doing. Maybe it's worth copying.

<comment><USER28> Maybe you're being sarcastic, but this seems unrelated. The attacks are on internal networks with an attempt to gain unauthorised access to technical data; it seems to have nothing directly to do with attacks on the software that directly flies the plane.

<comment><USER29> No, but perhaps it is coming from the same organization that thought MCAS was a great idea. After all, such an organization obviously has severe deficiencies with basic systems engineering; what other deficiencies might it have?

<comment><USER30> That's a cheap shot and a risible one at that. The hierarchy of decision- makers who designed and implemented MCAS and the hierarchy of decision-makers who handle the information security at Boeing is (as I'm sure you're well aware) so far removed and unrelated to each-other as to be essentially distinct. Conway's Law doesn't really apply here.

<comment><USER31> Exactly. A rogue bunch of MCAS engineers hacking Airbus is not based on any kind of reality.

</comment></comment></comment></comment></comment><comment><USER32> My first question would be if the Chinese hacker is American looking or if he is named Boejing Wang or something like that.

Jokes aside there are a huge number of mobile devices with saved credentials for exclusive business VPN access and a lot of businesses restrict access to resources based on the source of requests, which can be the corporate network of a supplier. This is often done to enable some forms of electronic data interchange. Putting these services in another network would probably have helped.

It would be my guess that the hacker gained access through a privileged network with stolen VPN credentials. There would be countless ways to achieve that.

Perhaps pickpockets should just sell the stolen phones to relevant companies.

<comment><USER33> I am not following your borderline racist comment about a name. Why do you assume stolen credentials? Low hanging fruit could be the entry point, but advanced attacks are common with state actors so this is highly assumptive and brings nothing to the discussion.</comment></comment>


Spam is not a Marketing Strategy: Fast Company and the Cost of Online Pollution - <AUTHOR> http://contentini.com/spam-is-not-a-marketing-strategy-fast-company-and-the-cost-of-online-pollution/

<comment><USER2> For every person who complains about these strategies, there are 100000x who are happily clicking the fast company link, forwarding stupid puppy pictures around and clicking on malware.

</comment><comment><USER3> it also gets their website a crapload of links, which = SEO, which = higher rankings, which = more traffic</comment>