Write yourself a Git (2018) - <AUTHOR> https://wyag.thb.lt/ <comment><USER2> Thanks for sharing. I too agree on this: "... Git is complex is, in my opinion, a misconception... But maybe what makes Git the most confusing is the extreme simplicity and power of its core model. The combination of core simplicity and powerful applications often makes thing really hard to grasp..."

If I may do a self plug, I had recently written a note on "Build yourself a DVCS (just like Git)"[0]. The note is an effort on discussing reasoning for design decisions of the Git internals, while conceptually building a Git step by step.

[0] [https://s.ransara.xyz/notes/2019/build-yourself-a- distribute...](https://s.ransara.xyz/notes/2019/build-yourself-a-distributed- version-control-system-just-like-git/)

<comment><USER3> While this is nice, I think it should be emphasised that the blob-tree-commit- ref data structure of git is not essential to a DVCS. One of the disadvantages of everything being git is that everyone can only think in terms of git. This makes things like Pijul's patch system, Mercurial's revlogs, or Fossil's sqlite-based data structures more obscure than they should be. People not knowing about them and considering their relative merits has resulted in a bit of a stagnation in the VCS domain.

<comment><USER4> Worse is better.

</comment></comment></comment><comment><USER5> This is great, thanks for sharing.

People in this thread might also appreciate this essay: [https://maryrosecook.com/blog/post/git-in-six-hundred- words](https://maryrosecook.com/blog/post/git-in-six-hundred-words)

And the more expanded version: [https://maryrosecook.com/blog/post/git-from- the-inside-out](https://maryrosecook.com/blog/post/git-from-the-inside-out)

It really helped me comprehend Git enough to start understanding the more complex work flows.

<comment><USER6> I really enjoy the way MRC explains topics. I, too, would recommend her essay.

</comment></comment><comment><USER7> I recommend "Git from the bottom up"[1] for a nice and relatively simple tutorial that shows you the inner design of a git repository.

[1] [https://jwiegley.github.io/git-from-the-bottom- up/](https://jwiegley.github.io/git-from-the-bottom-up/)

</comment><comment><USER8> On the note of Git being difficult, I'm really curious to see if Pijul[1] ends up being easier to understand than Git.

[1]: [https://pijul.org](https://pijul.org)

<comment><USER9> From my limited knowledge (mostly based on jneems article series[1]), I think Pijul is more powerful, but for the same reason also considerably more difficult to understand than Git.

In particular, Pijul supports (and depends on) working with repository states that are, in Git terms, not fully resolved. In addition, those states are potentially very difficult to even represent as flat files (see e.g. [2]). Git is simpler in that it mandates that each commit represents a fully valid filesystem state.

That said, I still think Pijul might have a place, if it turns out that it supports superior workflows that aren't possible in Git. But the "VCS elitism" would probably become worse than it is today.

[1]: [https://jneem.github.io/merging/](https://jneem.github.io/merging/) [2]: [https://jneem.github.io/cycles/](https://jneem.github.io/cycles/)

</comment></comment><comment><USER10> Folks interested in this may also be interested in a new book from James Coglan "Building Git": [https://shop.jcoglan.com/building- git/](https://shop.jcoglan.com/building-git/)

It also takes a ground-up "build it yourself" approach and has tons of interesting detail.

</comment><comment><USER11> Having written my own git client, I can tell you that "the most complicated part will be the command-line arguments parsing logic" doesn't go away. I wouldn't be surprised to wake up one day and find someone published a proof that NP != P, and the proof involved trying to parse the git command line.

<comment><USER12> Case in point:

[https://git-man-page-generator.lokaltog.net/](https://git-man-page- generator.lokaltog.net/)

:)

<comment><USER11> Doesn't seem that realistic. I reloaded a bunch of times, and didn't get a single one where the same command can mean 3 different context-sensitive things that each take different arguments but are all named the same command.

</comment></comment></comment><comment><USER13> A bit of a plug, I know, but here's a tool I wrote to make selective committing a bit easier and more interactive:

[https://github.com/andrewshadura/git- crecord/](https://github.com/andrewshadura/git-crecord/)

Those familiar with Mercurial will surely notice it is, in fact, a port of a Mercurial's interactive commit functionality, previously a separate extension called crecord.

</comment><comment><USER14> It is indeed a great (and time consuming approach). Other VCSs have gone a little further than Git though, simplifying their workflows or the GUIs and CLI commands to make their use more intuitive like [https://www.plasticscm.com/](https://www.plasticscm.com/) and others.

</comment><comment><USER15> I always thought the best way to learn something is by doing it.

The only problem now is the time.

</comment><comment><USER16> This free ebook is also a good resource if you're just starting with Git: [https://www.git-tower.com/learn/git/ebook/en/command- line/in...](https://www.git-tower.com/learn/git/ebook/en/command- line/introduction)

There is a video course as well: [https://www.git- tower.com/learn/git/videos#episodes](https://www.git- tower.com/learn/git/videos#episodes)

</comment><comment><USER17> Just be aware that it is a good start but isn't as complete as the command list would indicate - runs up to about the point of index files, so not quite at 'git add'.

</comment><comment><USER18> Good job, thanks for sharing.

I'm just written a simple git dumper tool ([https://github.com/owenchia/githack](https://github.com/owenchia/githack)) a few days ago. Learn by doing is a very good way and I really enjoy it.

</comment><comment><USER19> This is such a great tutorial to learn Git from the bottom up. I always thought the "back end" part of the Git is pretty complex but this tutorial makes it look so easy.

</comment><comment><USER20> This is simply excellent. I already know some basics of the internals of git at a conceptual level but this tutorial makes the knowledge so much more concrete. Wonderful.

</comment><comment><USER21> Seems to be a great opportunity to learn some Git and Python at the same time. I like those kind of approaches very much. Thanks!

</comment><comment><USER22> Does any body know any more write your own type tutorials for any other projects ?

Please point them out here

<comment><USER23> Doing a search on HN for "write your own" returns a lot of answers, including 'Ask HN: "Write your own" or "Build your own" software projects' [https://news.ycombinator.com/item?id=16591918](https://news.ycombinator.com/item?id=16591918) from a year ago.

</comment></comment><comment><USER24> Great! Thank you for writing an iterative one.

</comment><comment><USER25> It might be fun do try this in Rust as well.

<comment><USER26> Or in Haskell. Or in C++.

</comment></comment><comment><USER27> I have an admission to make: I don't understand git. By this I mean I have a few simple commands I use (status/add/commit/push/pull) and if I try to do anything more complicated it always ends up with lots of complex error messages that I don't understand and me nuking the repository and starting again.

So I think: there must be a better way.

I have often thought about implementing a VCS. The idea behind one doesn't seem particularly complex to me (certainly it's simpler than programming languages). If I did I would quite probably use WYAG as a starting point. My first step would be to define the _user 's mental model_ \-- i.e. what concepts they need to understand such that they can predict what the system will do. Then I would build a web-based UI that presents the status of the system to the user in terms of that model.

<comment><USER28> Yeah, I too don't really understand git. It seems that it was developed without any concern for affording a good mental model of its operation to its users, and thus it is just a complex black box you chant arcane rituals at and hope it doesn't decide to burn your world down. I know I _could_ build a mental model of it if I put enough time into it, but who wants to do that when there's actually useful things to do? So instead when I have to use it to contribute to open source projects I have a sheet of notes with incantations to cover the specific things I've had to do with it in the past.

<comment><USER29> I have the exact opposite problem. I have a mental model of git, but not a very good one for most of its competitors; I don't really get mercurial for example, but git is just:

1) uncommitted stuff in workdir. Potentially can be lost, so commit often.

2) blobs in repo representing snapshots at commit time. Can never be lost.

3) symbolic references to the blobs. Can always recover from reflog.

4) tools to sync the above two things between repositories. (fetch and push)

5) tools to merge, diff and otherwise manipulate the changes between snapshots and files.

I'm confident that git will never lose my data, so long as I commit it. This makes experimentation stress-free.

Technically, you can lose data by explicitly deleting your refs, expiring the reflog, and running gc, but if you go that far you might as well rm -r .git

<comment><USER30> Mercurial is the same except:

0) you forgot to explain git's index. Mercurial doesn't have the index, it works how you described git.

2) data (blobs, revsets, whatever) in the repo actually can never be lost, there is no automatic gc

3) no need for some different tool/viewer to view commits that don't have refs

Technically there are several ways to remove data from the repo, but it never ever happens automatically behind your back.

<comment><USER29> The mental model helps me with git because it maps pretty closely to what data actually exists. The index is just a useful thing to help me put stuff into a repository in a controlled manner. I've never attained a similar transparent understanding of mercurial.

I think I've asked this before, but what exactly are mercurial's branches?

In git, they are a "physical" feature of the repository as it represents a set of lineages, not an actual repository object.

As such, any reference to a commit uniquely identifies a branch, so the concept of a "named line of development" is simply implemented as a reference that gets updated as you make more commits. When you "delete" a branch in git, it goes nowhere. Only its name is removed.

What sort of structure does mercurial use to represent its branches? I know they are not just an emergent thing like in git.

<comment><USER30> Mercurial uses a DAG just like git. It has facilities for embedding a branch name in each commit, or for not doing that and having anonymous branches. It also has a feature similar to git's "branches"

Two articles that might help if you really want to dig into it:

[http://stevelosh.com/blog/2009/08/a-guide-to-branching-in- me...](http://stevelosh.com/blog/2009/08/a-guide-to-branching-in-mercurial/)

[https://bryan-murdock.blogspot.com/2013/06/git-branches- are-...](https://bryan-murdock.blogspot.com/2013/06/git-branches-are-not- branches.html)

<comment><USER29> Hmm, so the branch names are part of the commit's metadata. I'm not sure I agree with that, but I guess it's a valid choice.

The first article also states that unnamed branches are useful for small, temporary diversions, and notes that git has to name branches, but I think that's somewhat misrepresenting git since you can throw away names as soon as they are no longer useful. To me it seems kind of silly to have unnamed branches, given that names are free and much easier to remember than commit hashes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> I have nothing to directly comment on the tutorial. Just a tangential mention regarding the tedious argument parsing boilerplate in Python, I have found Python Fire to be much more convenient: [https://github.com/google/python- fire](https://github.com/google/python-fire)

It would have shaved off another 15-20 lines from the 503 line example ;-)

<comment><USER19> Python Fire looks much more concise. But do you know of any other languages that handles argument parsing better then Python ?

<comment><USER32> Clojure.

<comment><USER19> Can you please post a hello world example ?

</comment></comment></comment></comment><comment><USER33> If you find these kinds of "build your own X" articles interesting, there's a repo on Github that aggregates them, sorted in various categories:

[https://github.com/danistefanovic/build-your- own-x](https://github.com/danistefanovic/build-your-own-x)

<comment><USER34> I think I found my learning projects for the next 10 years.

</comment></comment><comment><USER35> If it helps anyone, I wrote a two-parter on Git internals a while back

[https://looselytyped.com/blog/2014/08/31/gits-guts- part-i/](https://looselytyped.com/blog/2014/08/31/gits-guts-part-i/)

[https://looselytyped.com/blog/2014/10/31/gits-guts-part- ii/](https://looselytyped.com/blog/2014/10/31/gits-guts-part-ii/)

Disclaimer — This is my blog

Update - Fixed formatting / Clarified post</comment>


Ask HN: How to handle my Bitcoin ATM stock - <AUTHOR> I developed a bitcoin atm software and have the possibility to (slowly) roll it out on hundreds of cash-in/out devices. Everything works fine, but I am just wondering how to handle my bitcoin stock with the insane volatile bitcoin market price... I have to buy in advance and not on demand to reduce fees, and I know it should average over time.. but it seems very risky..
are there other ideas to be able to transfer bitcoins immediately or get bitcoins on demand with very low fees? <comment><USER2> Sounds like you need otc!</comment>


How To: Hosting with Amazon S3, CloudFront and Route 53 - <AUTHOR> http://paulstamatiou.com/hosting-on-amazon-s3-with-cloudfront/ <comment><USER2> Nice write up. We have a very similar setup ( _Jekyll generated static site + S3_ ) for our website[1] and reading through this is kind of nostalgic of getting it set up ( _and a friendly reminder to go back and gzip some of CSS files_ ).

The biggest plus of this setup is that once it's deployed you don't think about it. It just works and you never think about scaling. Oh and it's cheap ( _seriously it 's like peanuts a month as all you pay for is bandwidth at $.10/GB_).

The biggest negative is getting SSL. CloudFront supports it but it's expensive ( _$600 /mo see [2]_). Compare that to the pennies it costs to host the non- HTTP site on S3. In our case our cloud app is on completely separate domain (SSL-only) and our public site is informational only so the trade off works. The only SSL enabled link on our public site is for our contact GPG key and it's linked directly to the HTTPS S3 URL.

[1]: [http://www.jackdb.com/](http://www.jackdb.com/)

[2]: [http://aws.amazon.com/cloudfront/pricing/](http://aws.amazon.com/cloudfront/pricing/)

<comment><USER3> Why put the GPG key on HTTPS page linked from a HTTP page? If the HTTP site is compromised through MITM the attacker can easily change the link to a bucket he controls, that is also HTTPS (i.e. [https://s3.amazonaws.com/secure.jackdb.com/pgp/security_at_j...](https://s3.amazonaws.com/secure.jackdb.com/pgp/security_at_jackdb_dot_com.asc)).

I don't think it adds anything to security, but actually provides for a fake feeling of safety.

<comment><USER2> You're absolutely right about being able to MITM the HTTP piece and replace the content. That's true for any mixed content site. In this case though I disagree that having the HTTPS link to S3 is entirely useless. It's used specifically for an SSL link to download our GPG key, that additionally is available on a number of key servers and indexed by search engines like that too[1]. In that usage it's one of many ways of getting that key and, like all GPG keys, should really be verified before use anyway. For just about anything else though I agree that mixed content is a very bad idea.

[1]: [https://www.google.com/search?q=jackdb+gpg](https://www.google.com/search?q=jackdb+gpg)

<comment><USER3> Alright, I thought I was missing something :)

</comment></comment></comment></comment><comment><USER4> I wrote an npm module to automate this workflow. You can read about it at [http://caisson.co/](http://caisson.co/).

Simplifies the process to a couple commands:

      $ caisson init yoursite.com
      $ caisson push

<comment><USER5> This is so awesome! You've taken a 15 minute process and condensed it to 15 seconds.

</comment></comment><comment><USER6> Hi! I hope somebody can answer me this.

Why do you need this DNS routing? I tried to Google and see a large offer of "hosted DNS" services, but I don't understand something:

I have a small site. It runs over at Digital Ocean. I point the DNS records of the domainname to the Digitial Ocean server by putting then into the text- boxes where I log into the domain-name-reseller.

Where in all this would I require a more advanced solution?

<comment><USER7> CloudFront has different IPs for different regions and manages this via DNS. So, if you're on an ISP peered directly with CloudFront and make a request using your ISPs DNS servers, CloudFront's DNS might give you back the IP to a server directly on that peering circuit. These kinds of relationships and new servers are added/removed all the time, so the IPs change regularly. A hard- coded IP in an A record won't work because of this. It works for your DO VPS because the IP is static and there is only one server.

<comment><USER8> there's also the IP Anycast [1] option. That's what you get with OVH CDN [2], for example, but not with CloudFront. Anycast routing is totally independent from DNS, thus it works fine with an A record and also makes it easy to install SSL certificates.

[1] [http://en.wikipedia.org/wiki/Anycast](http://en.wikipedia.org/wiki/Anycast)

[2] [https://www.ovh.co.uk/cdn/](https://www.ovh.co.uk/cdn/)

<comment><USER9> Anycast just refers to BGP announcing an IP address/range out of multiple locations. Most commonly, it's done with DNS because UDP is connectionless. It's becoming increasingly acceptable to do full anycast, i.e. have actual TCP/HTTP(S) on an anycast IP, but there are risks to that approach. If routing changes and you end up changing to a different location during a TCP session, the new location won't have all the state information needed, thus dropping the connection. It's theoretically possible to keep such state information synchronized, but it's sufficiently complex that nobody is doing so. This is why most of the larger, more established CDN's anycast DNS only and don't do full anycast.

</comment></comment></comment></comment><comment><USER10> One big warning here.

If you are wanting to serve static content for multiple domains (e.g. somefont.ttf for foo.example.com, bar.example.com and baz.example.com from a single CloudFront distribution) CloudFront is not your solution, because CloudFront does not vary its cache on the Origin header. So if your first visitor is loading foo.example.com/static/fonts/somefont.ttf, then the Access- Control-Allow-Origin header for somefont.ttf will be set to "foo.example.com". Subsequent requests for that file from (bar|baz).example.com will fail with a CORS error.

It was a pretty shocking thing to find out. We've concluded AWS/CloudFront isn't a viable CDN until this is fixed. Based on the following thread, it isn't clear when or if it will be fixed: [https://forums.aws.amazon.com/thread.jspa?threadID=114646#](https://forums.aws.amazon.com/thread.jspa?threadID=114646#)

<comment><USER11> Any reason to serve this from a single distribution? Their UI basically tells you in no uncertain terms that subdomain == distribution.

<comment><USER10> Where does it say that? I'm not talking about assigning foo.example.com as the domain name for the distribution.

<comment><USER11> Right, this is still the scenario where you're using the distribution hostname they give you, e.g. abcdef1234.cloudfront.net

[http://docs.aws.amazon.com/AmazonCloudFront/latest/Developer...](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/WorkingWithDownloadDistributions.html#DownloadDistValuesDomainName)

"Changing the origin does not require CloudFront to repopulate edge caches with objects from the new origin. As long as the viewer requests in your application have not changed, CloudFront will continue to serve objects that are already in an edge cache until the TTL on each object expires or until seldom-requested objects are evicted."

</comment></comment></comment></comment><comment><USER12> If you're needing an s3 deployment library for stuff like this, I'm planning a major merge on mine (s3tup) later tonight or tomorrow. It uses yaml files to declaratively control configuration of buckets and keys, and makes it nicer to do more complex things like setting appropriate headers based on pattern rules. Check it out here.

[http://github.com/heyimalex/s3tup](http://github.com/heyimalex/s3tup)

</comment><comment><USER13> I built BitBalloon ([https://www.bitballoon.com](https://www.bitballoon.com)) to simplify all of this, while bringing benefits such as atomic deploys, built-in form processing, automatic gzipping, bundling and minification of your assets and perfect cache headers.

We have a comparison with S3 here: [https://www.bitballoon.com/blog/2013/12/03/bitballoon- amazon...](https://www.bitballoon.com/blog/2013/12/03/bitballoon- amazon-s3-comparison)

</comment><comment><USER14> I use Namecheap DNS (free, as they are my registrar). I can control everything, including APEX. It has never fail me.

And for hosting, Github pages (Jekyll rocks!) do a great job. I think you are still paying too much, Paul.

<comment><USER15> > And for hosting, Github pages (Jekyll rocks!) do a great job.

Using GitHub pages to auto-build your Jekyll site is great if and only if you have no need to customize your Jekyll build or website environment:

\- You must use the versions deployed by GitHub; most of the time they're up to date, but if there's a bug fix you're relying on in any of the libraries, you're out of luck. I ran into this on my own site: RedCarpet had a Markdown parsing bug that was fixed in version 3, but the Jekyll that GitHub Pages uses depends on version 2. Jekyll loosened this dependency weeks ago, but it's not in a full release yet.

\- You can't use any Jekyll plugins, even the ones marked safe.

You can avoid the above by building your site locally and uploading the output, there are still a few other caveats:

\- Like timrivera mentioned, there is no support for server-side redirects outside the baked-in ones (i.e. www to or from naked domain; name.github.io to domain). S3 has these out of the box.

\- You can only use one domain per GitHub Pages repository.

\- GitHub will allow Googlebot to index your repository's master branch. If you're used to that convention, you're out of luck: it's hardcoded into github.com's robots.txt. You need to use a different name for your mainline branch.

\- You cannot use a private repo for GitHub Pages, and GitHub's terms of service require you to allow other people to fork your public repositories, regardless of license.

\- There is no support for SSL.

If you're okay with all of that, GitHub Pages is totally fine. But if you aren't, non-VPS alternatives like S3 are pretty attractive.

<comment><USER16> Re: Google--if you use a CNAME for your site on GitHub pages, will your site also show up as name.github.io in google search results?

<comment><USER15> It shouldn't: name.github.io → example.com is a 301 redirect. However, [https://github.com/name/name.github.io/blog/master/*](https://github.com/name/name.github.io/blog/master/*) and [https://github.com/name/name.github.io/tree/master/*](https://github.com/name/name.github.io/tree/master/*) _will_ show up in Google searches.

Here's an example, using the atmos.org example the GitHub Pages documentation uses: [https://www.google.com/search?q=Saying+how+it+was+%E2%80%9Cs...](https://www.google.com/search?q=Saying+how+it+was+%E2%80%9Csuper+light+and+fast+webserver+with+really+good\(better+than+pound\)+proxy+module.%E2%80%9D)

One result for atmos.org, and then a duplicate result for [https://github.com/atmos/atmos.github.io/blob/master](https://github.com/atmos/atmos.github.io/blob/master). Here's a screenshot in case you see something different: [http://i.imgur.com/TavoyuW.png](http://i.imgur.com/TavoyuW.png)

The only way to prevent that from happening is to avoid using a branch named "master" in your repository.

</comment></comment></comment></comment><comment><USER17> I'm already hosting a website with this setup. Works perfectly and is blazing fast. I recommend it for everyone.

The website is a static marketing front for a web app that is being served from a SSL subdomain on another cluster. The only thing i'm doubting about is that i want to offer a one input field e-mail signup on the frontpage, which of course, will be without SSL in this setup. What would you do? Skip this fast signup and put the whole signup on the subdomain or use the signup with a post to the SSL page (less secure)?

<comment><USER18> I'd probably resort to an iframe on the SSL site.

<comment><USER17> Isn't this as safe as just posting to an SSL page? If there is a MITM-attack they will just replace the contents of the iframe to another page?

</comment></comment></comment><comment><USER19> I built my first mobile-first layout using his writeup(s), and will likely move from Heroku to S3 using this one. High five.

<comment><AUTHOR> thanks for reading!

</comment></comment><comment><USER20> Stammy! Nice writeup! There's a really simple way of redirecting your naked domain to the www-bucket at S3: just point the naked domain to ip 126.96.36.199 and it will redirect automatically. Just be warned it's a free service.

<comment><USER21> Is there documentation of this anywhere?

<comment><USER12> [http://wwwizer.com/naked-domain-redirect](http://wwwizer.com/naked-domain- redirect)

</comment></comment></comment><comment><USER22> Great writeup. At the end he links to the AWS docs for this whole process which I found equally if not more helpful. [http://docs.aws.amazon.com/gettingstarted/latest/swh/website...](http://docs.aws.amazon.com/gettingstarted/latest/swh/website- hosting-intro.html) but OP's tutorial definitely has some extra informative tips

<comment><AUTHOR> Yeah the key point is that if you know you are going to do Cloudfront, the AWS docs make you do extra steps. They have you setup DNS for S3, then change it for CF.

</comment></comment><comment><USER23> Paul's general workflow also works with just Grunt and one of its many S3 plugins. For example, you can clone the Bootstrap github repo (which comes with a nice Grunt build config), npm install an S3 plugin, add S3 deployment tasks to Gruntfile.js, and boom - static site generator and deployer.

</comment><comment><USER24> I feel like SSL/TLS is a requirement for websites in 2014.

Does Amazon S3 and CloudFront support HTTPS?

<comment><USER12> Even worse than the $600 a month, there's no way to _disable_ ssl on your site if you're serving off cloudfront, so if one of your users makes an https request and you're _not_ shelling out the cash for custom certs they'll be greeted by a big red warning page in chrome (returned cert for *.cloudfront.com).

<comment><USER8> This is actually a great point _against_ using custom domains (CNAMEs) with Cloudfront. At least if you can't afford the custom SSL certficate option.

Cloudflare somehow got this right. They serve non HTTPS enabled web sites with different IP addresses so that you can never reach them over HTTPS (could be better "This webpage is not available" vs. scary red "This is probably not the site you are looking for!" message in Chrome). Plus, they have a great free anycast DNS network that can be compared to Route 53. And best off all, you never pay for the bandwidth.

</comment></comment></comment><comment><USER25> Nice! We actually built a service to do this: [https://getforge.com/](https://getforge.com/) including a few other nice static hosting tweaks. Takes the hassle out of dealing with Amazon.

</comment><comment><USER26> A cost effective alternative to this (I'm open to being corrected) is to use a cheap server (say a $5 monthly box from Digital Ocean) and Cloudflare (which is free).

</comment><comment><USER27> FWIW, after evaluating many solutions, I'm switching my DNS from zerigo to DNS.he.net - free, featureful, and backed by a company I believe will be around.</comment>


Ruby: The Year of Concurrency (Matz at RubyKaigi 2019) - <AUTHOR> https://www.youtube.com/watch?v=WZu-WVzbEOA <comment><AUTHOR> there are english subtitles (if they are not on by default)</comment>


6 classic hacker movies for your Thanksgiving weekend - <AUTHOR> https://blogs.csc.com/2016/11/24/6-classic-hacker-movies-for-your-thanksgiving-weekend/ <comment><USER2> I'd add The Conversation:

[http://www.imdb.com/title/tt0071360/](http://www.imdb.com/title/tt0071360/)

<comment><USER3> This is a great movie! Tempted to watch it right now.

<comment><USER4> Follow it up by watching Enemy of the State and treat it as the sequel.</comment></comment></comment>


Teenagers make $170k on Apple iPhone OS platform - <AUTHOR> http://labs.teppefall.com/2010/04/teenagers_make_170k_on_apple_iphone.html

<comment><USER2> > Very impressive right ? Except the journalistic angle is basically "kids > make money from nothing" when the reality is that they have access to two > MacBook Pro's, at least one iPhone , two iPad's, a broadband connection, a > credit card to pay for the Apple Developer license plus web hosting.

I typically despise this point of view. Sure, I can readily admit that there is an element of luck in success - but I've never done it to the extent of belittling other people's accomplishments.

On a sidenote: this is why I didn't enjoy Malcolm Gladwell's outliers- you can't diminish people's success to merely luck - even if you pre-append your babble with, sure they were smart, but they were really just lucky.

I mean where do you draw the line? To use his own example - Lebron James isn't talented: he was just lucky to be born with athleticism and ability? Were Larry and Sergey just lucky to be born with an ability to reason and work hard? Give me a break.

<comment><USER3> "Were Larry and Sergey just lucky to be born with an ability to reason and work hard?"

Almost anyone is born with the ability to reason and work hard. Larry and Sergey were obviously born with this ability. In addition they were both born into families where both parents were professionals in the mathematical sciences. Larry's parents were CS professors. Sergey's dad is a math professor and his mom works for NASA. In addition, Larry's older brother Carl sold his company to Yahoo for $400M+. Thus not only did math and programming run in the family, so did software entrepreneurship.

Not belittling their achievements, but parts of the backstory make it seem like Google was predestined. Where do you draw the line between luck and work, indeed...

<comment><USER4> Do you have a source for Carl's role in eGroups? It is hard to tell whether he was just an employee at the company or something more: <http://en.wikipedia.org/wiki/EGroups>

<comment><USER3> I'm not really sure but his old ZVUE page said he was a founder. Most of the articles I've seen imply that he was the 2nd person to join the company.

</comment></comment></comment></comment><comment><USER5> In other news, kids make millions from playing football.

<http://wcbstv.com/national/nfl.draft.Bradford.2.1649569.html>

<comment><USER6> Basketball's where it's at. Good work if you can find it :).

<comment><USER7> actually, baseball is where its at

<comment><USER8> my kid's at least giving golf a shot. Even if you just play in college you travel to sick locations. 20th place at the 2009 Masters was $97,500.

<comment><USER9> Yeah but becoming a top 20 golfer is incredibly hard. And that's only about what a seasoned minor league baseball player makes.

</comment></comment></comment></comment></comment><comment><USER10> Why did these kids succeed? The answer is, quite possibly, that they deserved to! Go to their website and take a look at the _supported use case_ for their app. Their app appeals to both the _browser and collector mindset_. Already, they are harnessing powerful psychology. On top of that, if their "perfect formatting" claim for article, then they also are presenting a polished UX.

I tried out two different Wikipedia apps for my old Windows XP Tablet machine. If you're technically inclined, you can load a compressed snapshot of Wikipedia and carry it with you. That puts you in the position of "administrator and custodian" of your Wikipedia snapshot, which isn't fun and seems like work, whereas being a browser and collector is an addictive sort of hobby.

You can think of this as Instapaper for Wikipedia.

</comment><comment><USER11> Bookmarklet

      javascript:location='http://translate.google.com/translate?u='+encodeURIComponent(location);</comment>


iPhone or iPad on Ethernet - <AUTHOR> https://ultracrepidarian.phfactor.net/2020/08/04/iphone-or-ipad-on-ethernet/ <comment><USER2> There are better ways to do this, see a few items below.

Hooking an iOS device directly to the network is useful at times. Large downloads, network testing, and when you have to deal with a lot of devices.

[https://redpark.com/iphone-to-ethernet-adapter/](https://redpark.com/iphone- to-ethernet-adapter/)

[https://www.apple.com/shop/product/HMJU2ZM/A/belkin- ethernet...](https://www.apple.com/shop/product/HMJU2ZM/A/belkin-ethernet- power-adapter-with-lightning-connector)</comment>


Breathtaking Design - <AUTHOR>

http://bit.ly/JhZjI5 <comment><USER2> Unless @aplusk (Ashton Kutcher) is an investor, I'm pretty sure him, and the other people in the screenshots, did not consent to the use of their image to promote this product. I wonder how fast they will get sued.

<comment><USER3> They may be in the public domain or purchased from a photography site. I actually think I've seen that picture of Ashton used elsewhere on the web.

</comment></comment><comment><USER4> Why the short url ? It points to <http://discovercircle.com> if anyone is curious.</comment>


Tips for finding security issues in GitHub projects - <AUTHOR> https://gist.github.com/EdOverflow/922549f610b258f459b219a32f92d10b <comment><USER2> Thanks for sharing! Seems like a company that does this as an automated service (for private orgs/repos) would be $.

<comment><USER3> Just have to make sure you don't get sued into oblivion by Veracode or some other IP-obsessed dinosaur...

</comment></comment><comment><USER4> What does the author mean about timing attacks on HMACs with Array.equals? Does HMAC leak info and is it subject to timing attacks if you HMAC on both sides before doing equality checks? Does he mean for e.g. session cookies?

<comment><USER5> [https://codahale.com/a-lesson-in-timing- attacks/](https://codahale.com/a-lesson-in-timing-attacks/)

<comment><USER4> So okay, if you're using HMAC where the user can provide the HMAC, this would be an issue (like session cookies), but it the user can only provide preimage (as in e.g. encrypting database column and wanting lookup) then this wouldn't be an issue, I don't think.

<comment><USER6> Yes. In situations where a hash is modifiable by the user and you do string comparison the issue exists. It isn't solely a problem for MACs.

</comment></comment></comment></comment><comment><USER7> Some of the links are bad but this is a great list of things to keep in mind when seeing where your work is with regards to security.</comment>


Ask HN: As a programmer, what would you be looking for in a HTML & CSS book? - <AUTHOR>

Hi
I'm starting to write an e-book about HTML & CSS. My intent is to target complete beginners and graphic designers, but also developers who are mostly familiar with back-end technologies (object-oriented programming, server configuration, database manipulation...).
If you are such a developer looking to better understand how the front-end works, what exactly would you be willing to learn? Or what is something about CSS that your mind just can't grasp? <comment><USER2> Great news. As a member of your target audience I'm excited to be able to provide so thoughts on what I would find helpful. My main complaint with a lot of the beginner HTML/CSS books is that they approach the subject from a static perspective. They seem to assume that I'm only interested in creating a simple static website when in fact I suspect anyone who's learning HTML/CSS is doing so implicitly because they want to learn how to ultimately create dynamic database-backed web apps. A book that approached the topic with that in mind from the get go would be much appreciated. Also, one of the major topics I think is overlooked is the PROCESS odd designing and creating a real web app UI. As a beginner, I'd very much like some insight into how one goes about creating a web app using HTML/CSS...I.e., what process do you follow when attempting to realize an idea you have in your head or which you have sketched out. I would also like extensive coverage of how to use all the standard tools which are now very common and which attempt to make it easier to develop well- laid out attractive web apps: twitter bootstrap, foundation 4, CDS preprocessors, grid layouts, etc. These things are becoming as important as simply knowing about HTML/CSS. I guess what I'm saying is that we don't necessarily need another book which teaches basic HTML/CSS (tags, and so forth), we need a book that closes the gap between such books and the more advanced topics like HTML5 (I.e., adding JS/jQuery functionality to a web site). I hope this ramble has been helpful. Thanks for asking for input!

<comment><AUTHOR> Thanks for the insight.

Your comment will probably lead me to write a book _solely_ targeting programmers, instead of trying to target beginners and graphic designers as well.

What is it about creating a HTML/CSS web app that is hard to grasp?

<comment><USER3> One of the issues I face is that simple CSS illustrations demonstrate interplay of positional effects between one or two items. The same positional effects give a different effect when in a multilayer container. What is the general guideline for wire-framing an app?

</comment></comment></comment><comment><USER4> I like examples, how things work, but not a lot of fluff...

Two books permanently on my shelf for CSS and HTML are Stylin' with CSS by Charles Wyke-Smith, and Visual Quickstart Guide to HTML by Elizabeth Castro. Both books covered the basics enough to get a grasp of the big picture.

Mainly if I had a question about where X goes where and what Y does, I could find an direct answer from these books usually with an example if applicable.

There are probably a bunch of common front-end situations you could cover in a book would be great (AJACX search queries, the basics of responsive design (it all starts in the CSS) etc.

And another suggestion - avoid using frameworks. You want your book to last, don't use some framework-du-jour, keep it vanilla and then let the reader decide what framework would better fit their work later on. If you do use frameworks - make sure the framework is listed in the title or content info so folks can decide if that would be useful for them.

</comment><comment><USER5> To me it is not so much about the syntax of HTML/CSS itself which I can of course google etc, the biggest challenge is how to put a sketch/wireframe/concept to HTML/CSS version. How do i create the layout ? Where do I position a section ? How do I decide if I should create nested rows vs columns vs what not. These are the things that are so difficult to me as a programmer who just barely hacks some bootstrap/zurb themes.

</comment><comment><USER6> layouts. I still can't make head & tail out of it. I found tables easier.</comment>


Why is a Rust executable large? - <AUTHOR> https://lifthrasiir.github.io/rustlog/why-is-a-rust-executable-large.html# <comment><USER2> Previous discussion [https://news.ycombinator.com/item?id=11823949](https://news.ycombinator.com/item?id=11823949)

</comment><comment><USER3> There's been an increased interest in removing jemalloc by default, which will cut down on that initial size. [https://github.com/rust- lang/rust/issues/36963](https://github.com/rust-lang/rust/issues/36963)

<comment><AUTHOR> I'm excited to see that as well; that'll make it even easier to integrate with C code via FFI.</comment></comment>


Show HN: Mashup of Amazon.com's wish list and Balanced Payments - <AUTHOR> https://wishlistgranted.com

<comment><USER2> Knee jerk reaction: Great work. I had a similar idea floating around in my mind and it's cool to see something like it come to fruition.

Incoherent Rambling: How about expanding to more than one item wishlists that span multiple site APIs and market it as a simple, efficient, online wedding registry replacement?

You can rank your items in terms of preference, people can contribute money, then the app just buys and ships the items from the top down until the list is complete.

As a wedding gift purchaser I wouldn't have to make a trip to some random store and go through the hassle of getting the registry, nor would I have to navigate to a site I may never use again (I'm looking at you Williams Sonoma) and setup an account to purchase one item.

As a bride or groom it would be nice to just supply someone with one short URL when they asked "where are you registered?" without having to go through all the hassle of setting up a ridiculous "we're getting married" wedding profile on Yet Another We're Getting Married Social Network.

Like I said, incoherent rambling. Could result in an interesting tool, though.

<comment><USER3> MVP. If they had went for bells and whistles, it would never be released.

<comment><USER2> yeah, sorry if I gave the impression that "OMG this site NEEDS THESE FEATURES RIGHT NOW!!!"

That wasn't my intent. It's legitimately a great idea and a seemingly well executed MVP (I haven't dug deeply into it yet). Hence my suggestions being prefaced with "Incoherent Rambling"

It's hard not to see a good initial execution on an interesting idea and think aloud "I wonder where this could go next..."

In either case, OP, keep up the good work.

</comment></comment></comment><comment><USER4> Wishlists are so impersonal. Donating funds to someone's wishlist takes just a few minutes, and you don't even have to speak with the recipient. If the point of gift giving is to strengthen social bonds and show regard for one another, how do wishlists achieve this?

That said, if wishlists are your choice, this is an efficient way to handle it.

<comment><USER5> _If the point of gift giving is to [...]_

And if it isn't? I'm sure many people don't ascribe to this particular theory of gifts as a universal truth. Also, gift giving often happens in an important, larger context, which is always different; gift giving at Christmas, for example, is hugely loaded depending on your background, your attitude toward the holiday, what significance you do or don't attach to it, this same set of attributes for every person you may want to give a gift to, and many other things.

Wish lists can be considered impersonal, I can see that. Many people grew up with them, though, and in that case they may not alter a person's perspective of the gift at all. For Christmas in particular, when a whole lot of busy people are expected to give gifts to a whole lot of other busy people, finding the time and insight to get meaningful gifts for everyone involved can add to an already often stressful time.

</comment></comment><comment><AUTHOR> Here's a little blog post about how it started [http://www.peterbe.com/plog/wishlistgranted](http://www.peterbe.com/plog/wishlistgranted)

</comment><comment><USER6> The $1 transaction fee seems crazy wasteful to me on purchases under $50 or so. I would consider just buying the whole item for a friend (through Amazon, letting Amazon eat the transaction fee) before I'd give anywhere from 5-10% extra to a third party.

If the average item was $20 and the average contribution was $5, banks would also be making 10% or more per wishlist item when they would normally make 3% or less.

That just rubs my cost-effectiveness sensitivities the wrong way.

<comment><AUTHOR> If you want to buy the whole item, bypass Wish List Granted and go straight to Amazon Wish List and buy it there. It gets cheaper.

But if spending $20 on every friend you have, my site is a better alternative.

Also, the reason I add the $1 transaction fee is to cover the cost of the shipping.

</comment></comment><comment> jack-r-abbit I like this. Just yesterday I added an item to my wish list that is quite expensive. I know that a single person is not going to want to buy it for me. But if several of them contributed, it would be more realistic.

Edit: It also makes a new way to get tips/donations. People might be more likely to donate if their money is going to something they can see. You might even get people to donate a little more if they see you are very close to getting the item.

<comment><AUTHOR> It sounds like you like the idea and you are using amazon wish list. So let me ask you, did you use the site?

I suspect the site is one of those "Great idea! ...but I wouldn't actually use it" which is sad but maybe the honest truth.

<comment> jack-r-abbit Well... I mostly use my Amazon wish list to keep track of things that I will likely buy myself in the future. I don't really expect people to buy them for me. So I did not sign up for the site. However, it is a great idea and is something I am likely to make use of at some point. I just don't have a need at this moment.

<comment><AUTHOR> Sorry if my question sounded personally attacking. I'm just a web geek trying to improve what I build.

So, it sounds like it was the concept that held you back. Not something that I was doing wrong on the site per se.

<comment> jack-r-abbit Don't worry. I didn't feel attacked at all. I understand the need to get feedback from users (or non-user in my case) to improve things. And it was not even the concept that held me back... just lack of need at this time. Generally speaking, I'm not one to sign up for something until I actually plan to use it.

</comment></comment></comment></comment></comment><comment><USER7> Aha, nice hack, simple and interesting. Actually I launch a wishlist-similar project for this shopping season few days agao: [https://www.shoplify.us](https://www.shoplify.us) , that help people collect their products not only from amazon but from any website. it's still in early stage, and there are many features will be release later. Maybe we can do some cooperation if you think it's cool :)

<comment><AUTHOR> The advantage of using only Amazon.com is that I don't need to store the person's address. Also, I don't really need to store anything about the item.

I might morph it into any Amazon.com product that isn't necessarily on your wish list. That way, you can pick an item for a friend and tell his/her friends the URL to collect the money.

</comment></comment><comment><USER8> Cute! And timely.

Looks like you still have some work to do: [https://www.monosnap.com/image/JkLBAEYvPAOE96ab7YqrFoXgc](https://www.monosnap.com/image/JkLBAEYvPAOE96ab7YqrFoXgc)

& Here's the console output: [https://www.monosnap.com/image/JWwoDPyQrFyrokGxIt0b4i8Qe](https://www.monosnap.com/image/JWwoDPyQrFyrokGxIt0b4i8Qe)

<comment><AUTHOR> How the heck did you managed to get to that? What amount did you enter?

<comment><USER9> The card was declined because it was an invalid card number.

"No such issuer" means that the first six digits, Bank Identification Number, are incorrect and card was declined as a result.

We (Balanced) should be doing a better job to make this error more understandable or mask it by returning some invalid card number error.

<comment><AUTHOR> Thanks for the reply. I still need to make a better job of displaying any general errors from Balanced that aren't for a specific input field.

</comment></comment></comment></comment><comment><USER10> Is there any chance this could be made to work with international amazon sites? I tried to enter my amazon.fr wishlist URL, but it said that no such wishlist was found on amazon.com

Great concept though!

</comment><comment><USER11> Neat idea! If a little impersonal. Perhaps adding a personal message field that gets printed on a card and sent along with the package? Theres gotta be a service for that.

<comment><AUTHOR> It does that! If you make a contribution, you type in your name and a personal message. That gets included later when the order is shipped from amazon.com.

<comment><USER12> Nice!

</comment></comment></comment><comment><USER13> This should be marketed to charities, then the public. Unless peace on earth and good will toward all mankind is available on Amazon.

</comment><comment> jack-r-abbit You mentioned $$$ in another comment. May I ask how you will monetize this? (obviously you don't have to answer... just curious)

<comment><USER14> Well, if the service becomes popular, the OP will find himself sitting on a nice rolling account of cash (the funds that haven't yet been spent or returned to donors), which might be capable of generating interest. I can't imagine that income being appreciable (or entirely legally kosher), but who knows?

<comment><AUTHOR> It's easy to make money on anything that is popular. The "profit" made on top of adding a small fee. on top of Balanced's fee, is so minuscule and quickly eaten by shipping costs.

Right now, I'm more interested in building something that makes a profit just for the hell of it. All my other side-projects are making me absolutely nothing. ...nothing but resume padding :)

</comment></comment></comment><comment><USER15> Hmm. I'm tempted to create a Canadian clone of this (since you only work with Amazon.com at the moment).

<comment><AUTHOR> Let's race! :) I'm going to add UK, CA later. Maybe FR and DE too. BUT only IF this is a success which I don't know it will be. Getting onto HN just means traffic but not necessarily $$$ which would the motivator for adding more features.

</comment></comment><comment><USER16> Fraud will probably be quite a problem, but nice concept.

<comment> jack-r-abbit I guess if you had a number of stolen credit cards you could set up a wishlist item, then use them to contribute. I imagine the final Amazon purchase would be on record as coming from WishListGranted and the item is gifted to you so that might be one layer of separation between you getting an item and the use of stolen cards.

Perhaps you could elaborate on what types of fraud you think would happen?

<comment><USER17> A common use case for stolen cards is to do small transactions and see if they are successful or not to let you know if the card you found/bought actually works or does not. This site would be a great way to do that.</comment></comment></comment>