Packets of Death - <AUTHOR> http://blog.krisk.org/2013/02/packets-of-death.html <comment><USER2> _That_ is great HN content!

Debugging deep down the rabbit hole, until you find a bug in the NIC EEPROM - and the disbelief many show when hearing a software message can bring down a NIC.

I for one would enjoy reading more content like this on HN that what qualifies as best as a friday-night hack

<comment><USER3> > the disbelief many show when hearing a software message can bring down a > NIC.

Shouldn't be a surprise to anyone. Firmware is just software, and it necessarily deals with raw bytes. Not really surprising that it can contain bugs that are triggered by certain byte patterns.

<comment><USER4> It would be interesting to see what the actual error in the NIC firmware source was.

This invalidates my assumption that a shop like Intel probably uses formal verification in firmware development.

Its also scary to consider how many very important (nuclear/damn control, etc) systems while themselves might be formally verified are dependent on services of lower level software (OS, drivers) and hardware (firmware) that are not...

<comment><USER5> Dam control, or damn control? I teach a control systems course, so I know about both kinds.

PS You should be very frightened. The industrial control systems industry are slow to adopt new tech/new best practices/anything else new; and even more reticent to touch anything that "works." Tons of vulnerable equipment controlling dangerous things with default passwords (if any at all). I could go on for days.

<comment><USER6> Too true... (I work at a SCADA/HMI software company :)

</comment></comment></comment></comment></comment><comment><USER7> Makes me wonder if this is related to in-band management? One of the interesting thing about working at NetApp, which had its own "OS" was that every driver was written by engineering. That allowed the full challenge of some of these devices to be experienced first hand.

One of the more painful summers resulted from a QLogic HBA which sometimes, for no apparent reason, injected a string of hex digits into the data it transmitted. There is a commemorative t-shirt of that bug with just the string of characters. It lead NetApp to putting in-block checksums into the file system so that corruption between the disk and memory, which was 'self inflicted' (and so passed various channel integrity checks) could be detected.

Here at Blekko we had a packet fragment that would simply vanish into the center switch. It would go in and never come out. We never got a satisfactory answer for that one. Keith, our chief architect, worked around it by randomizing the packet on a retransmit request.

The amount of code between your data and you that you can't control is, sadly, way larger than you probably would like.

</comment><comment><USER8> I ran into a similar problem with an Intel motherboard about 10 years ago.

We had problems when some NFS traffic would end up getting stalled. Our NFS server would use UDP packets larger than the MTU and they would end up getting fragmented.

Turns out the NIC would not look at the fragmentation headers of the IP packet and always assume a UDP header was present. From time to time, the payload of the NFS packet would have user data that matched the UDP port number the NIC would scan for to determine if the packet should be forwarded to the BMC. This motherboard had no BMC but it was configured as if it did have one.

It would time out after a second or so but in the meantime drop a bunch of packets. The NFS server would retransmit the packet but since the payload didn't change, the NIC would reliably drop the rest of the fragments of the packet.

Of course Intel claimed it wasn't their bug ("it's a bug in the Linux NFS implementation") but they quickly changed their tune when I coded up a sample program that would send one packet a second and reliably cause the NIC to drop 99% of packets received.

While it turned out to be a fairly lame implementation problem on Intel's part (both by ignoring the fragmentation headers and the poor implementation of the motherboard) I have to say it was very satisfying to solve the mystery.

<comment><USER9> Reading about the OP's issue got me to a doc from Intel ([http://www.intel.com/content/dam/doc/application- note/sideba...](http://www.intel.com/content/dam/doc/application- note/sideband-technology-appl-note.pdf)) re: the "NC Sideband Interface", which sounds like the place where the bug that bit you "lives". Reading over that doc made me shudder a few times, thinking about the complexity and, thus, potential bugs that could be lurking there. I wonder if the OP's bug was related, too.

Having the NIC inspecting incoming frames and potentially diverting them to the management controller sounds like a scary proposition. I'd almost rather just have dedicated Ethernet hardware for the management controller. The decrease in switch ports needed is certainly seductive, but I wonder if it's worth the risk.

(Do you happen to recall which Intel motherboard this bit you on? I was just getting out of whitebox Intel motherboard-based server builds about the time you're describing, but I'm just curious if only for the nostalgia.)

<comment><USER10> "IPMI operates independently of the OS and allows administrators to manage a system remotely even without an OS, system management software, and even if the monitored system is powered off (along as it is connected to a power source). IPMI can also function after an OS has started, offering enhanced features when used with system management software."

Yikes! Sounds like system management mode in a BIOS!

<comment><USER9> It's worse than that. It's not BIOS-- it's a freestanding computer.

You'll enjoy this (or be horrified by it): <http://fish2.com/ipmi/itrain.html>

<comment><USER11> But it's a freestanding computer that means that I don't need to go to the data center at two in the morning to bring up a box that's kernel panicked.

Yeah, be careful with it. Firewall it silly. But recognize that it's a tool that can be very useful.

<comment><USER9> They're definitely useful tools-- don't get me wrong about that. The fear is that they're controlled, essentially, by an in-band signaling mechanism.

Being grafted onto the same NICs on the server computer that you might potentially expose to the Internet makes firewalling them a more difficult proposition. I get a lot of piece of mind from having management interfaces on an an out-of-band control network whenever possible.

<comment><USER11> If you use your BMC's "pass-through" capability to push its traffic through your regular NICs, you're Doing It Wrong. In fact, if you're not running a separate physical network (not merely separate VLANs) that is, to the extent possible, air-gapped from the rest of the world for your IPMI traffic, you're probably still Doing It Wrong.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I've always had mixed emotions about NICs that have hardware assisted offload features. I welcome the decrease in CPU utilization and increased throughput, but the NIC ends up being a complex system that very subtle bugs can lurk inside versus being a simple I/O device that a kernel driver controls.

If there's denial of service hiding in there I wonder about what other security bugs might be lurking. It's scary stuff, and pretty much impossible to audit yourself.

Edit:

Also, I'm a little freaked-out that the EEPROM on the NIC can be modified easily with ethtool. I would have hoped for some signature verification. I guess I'm hoping for too much.

Edit 2:

I wonder if this isn't the same issue described here: <https://bugzilla.redhat.com/show_bug.cgi?id=632650>

<comment><USER10> Be very afraid of PCI firmwares. You can insert rootkits there that have full access to RAM. An IOMMU can mitigate this threat.

<comment><USER9> It sounds like, in this case, the OP is talking about the EEPROM holding code executed by the embedded coprocessor on the NIC (or, at least, lookup tables that the coprocessor uses) rather than a PCI option ROM that will be executed by the host computer's CPU. Depending on how the access to the EEPROM is performed (i.e. if such access is facilitated by the co-processor versus being read out directly from the EEPROM) I'd think an attacker could even implement "stealth" functionality to allow the compromised EEPROM to appear to be benign when audited.

Depending on what functionality is being offloaded to the NIC (are there still NICs that do IPSEC and crypto offload?) there's the possibility for information disclosure vulnerabilities in the NIC itself. Yikes.

<comment><USER12> > OP is talking about the EEPROM holding code executed by the embedded > coprocessor on the NIC

Yes, but this coprocessor has access to the host's PCI bus. That is enough to totally pwn the machine, since it gives read/write access to all memory (well, all memory below 4GB, IIRC, but that's enough.)

</comment></comment></comment></comment><comment><USER13> Very good detective work. However, a small suggestion, given:

 _I've been working with networks for over 15 years and I've never seen anything like this. I doubt I'll ever see anything like it again._

This is a very excellent case for fuzz testing. My thinking is that you want to whip up your Ruby and your EventMachine and Redis going and run a constant fuzz with all sorts of packets in your pre-shipping lab.

The idea is that you _want_ to create a condition where you do see it, and the other handful of lockups that are there that you haven't yet seen.

<comment><USER14> Surely that's the manufacturer's job.

Since it's caused by a specific byte at a specific place, surely you'd only need to fuzz an average of 256 packets (of the required length) to find it... which suggests it wasn't done at all... zero...

<comment><USER15> That's assuming you know the magical position. If you need to test all positions, it's 256 to the power of the number of bytes in the message.

<comment><USER16> But couldn't you test all the positions at once, by having the entire packet be random data? Unless the packet has to be a particular length for this to happen, which I didn't notice in the article.

</comment></comment></comment></comment><comment><USER17> Fantastic Article, Fantastic fine. Well done.

As a telecoms engineer predominantly selling Asterisk for the last 4 years and Asterisk experiance extending back to 2006 it's shocking to see this finally put right. For so many years, I have avoided the e1000 Intel controllers after a very public/embarassing situation when a conferencing server behaved in a wierd manner disrupting core services. Not having the expertise the author has, I narrowed it down to the Eth. Controller, Immediately replaced the server with IBM Hardware with Broadcom chipset and resumed our services in providing conferencing to some of the top FTSE100 companies.

Following this episode, I spend numerous days diagnosing the chipset with many conference calls with Digium engineers debugging the server remotely. In the end, no solution, recommendation to avoid the e1000 chipset and moved on.

<comment><USER17> brings back memories....

<http://lists.debian.org/debian-isp/2009/06/msg00018.html>

</comment></comment><comment><USER18> As someone who works with FPGAs/ASICs, this isn't that weird.

Everything gets serialized/deserialized these days, so there's all kinds of boundary conditions where you can flip just the right bit and get the data to be deserialized the wrong way.

What's more interesting is that it bypasses all of the checks to prevent this from happening.

Here is the wiki page on the INVITE OF DEATH which sounds like the problem you hit:

<http://en.wikipedia.org/wiki/INVITE_of_Death>

<comment><USER19> > _Everything gets serialized/deserialized these days, ... and get the data to > be deserialized the wrong way._

Can you elaborate? I recognize the words, but not the meaning.

<comment><USER20> Anybody else waiting for him to reply with something like:

"Oh yeah, I used to work at Intel - that nic's got a YAML parser in it"…

</comment></comment></comment><comment><USER21> Persistent bugger.

"With a modified HTTP server configured to generate the data at byte value (based on headers, host, etc) you could easily configure an HTTP 200 response to contain the packet of death - and kill client machines behind firewalls!"

That's worrisome, I'll bet there are lots of not-so-nice guys trying to figure out a way to do just that. There must be tons of server hardware out there with these cards in them.

<comment><USER22> I read the whole thing and that is the line that stuck out most to me. This could very scary. It could be used to bring down a webserver

<comment><USER9> It sounds like the vulnerability could be used to bring down any machine you can send an arbitrary Ethernet frame to. (I immediately wonder if it works for broadcast frames? Sounds like a way to take down a LAN full of machines quickly if it does.)

Edit: Per <http://www.kriskinc.com/intel-pod> it does work on broadcast frames. Yikes!

<comment><USER23> Heh, yeah and he pretty much gives all the info on how to create the attack.

The test would be to find out how common that particular NIC is out there - and grab a few and test out his method.

Looks like it would be fairly trivial to setup duplication given the author did all the heavy lifting in finding this. Putting a small AWS bot-net up that just sweeps massive IP blocks would be easy - heck you could do it really easily from a single machine, it would seem.

If you can take out a machine with a single packet....

<comment><USER21> Just to be on the safe side I just checked all my machines, the majority have broadcom cards, the three that have intel cards are all another type. I think I'll sleep soundly tonight but I felt compelled to check.

<comment><USER23> That was a very responsible thing to do. :)

<comment><USER21> Professional paranoia. Stuff like this is really no fun at all.

off-topic:

A long time ago we found that a certain ping packet would be dropped with about 30%, which in turn triggered a monitoring system to register 'server down' when enough packets in a row were missed.

This would happen about once every day or so, leading to an operator being paged (usually at 3am). Very annoying problem and incredibly hard to debug. We'd replaced just about every piece of hardware except for a stupid little T-connector. My buddy Jasper and me looked at it and we both more or less at the same time said 'it can't be'. We swapped out the T-connector, problems solved.

It took the better part of a day to nail that one, I still remember the hostname (chopper) of the SGI box that the thing was connected to (SGI Challenge, an Indy sold as a server with one of those silly thinnet adapters dangling off the back, even though it had a UTP connector too).

Some bugs... I can't say I'm mourning the demise of coaxial ethernet and the bus topology.

<comment><USER23> Heh, I have had experiences like that with T-connectors.

Heck, even just a few months ago I spent 2 hours troubleshooting a 10G fiber connection on all brand new gear before swapping out the brand-new cisco 10G SR SFP module which was DOA.

Thinking the same exact thing after swapping out everything else, including all patch cords on both ends "It can't possible be this SFP module"

Yup.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> I've been unable to reproduce this on systems equipped with the controller in question. I'd love to see "ethtool -e ethX" output for a NIC confirmed to be vulnerable.

/edit Ah, I spoke to soon; the author has updated his page here with diffs between affected and unaffected EEPROMs:

<http://www.kriskinc.com/intel-pod>

</comment><comment><USER25> Can anyone remember the source of the quote :

      Sometimes bug fixing simply takes two people to lock themselves in a room and nearly kill themselves for two days.

Reminded me of this

</comment><comment><USER26> So is it only the byte at 0x47f that matters? Could you just send a packet filled with 0x32 0x32 0x32 0x32 0x32 to trigger this? (Like, download a file full of 0x32s?) Or does it have to look like a SIP packet?

You'd think the odds of getting a packet with 0x32 in position 0x47f is almost 1/256 per packet? So why aren't these network cards falling over everywhere every few seconds?

<comment><USER27> Probably because there is a 2/256 chance of getting sent the inoculation value. But it's a good question.

<comment><USER28> Later in the article it states that any value other than 0x31, 0x32 or 0x33 acts as an "inoculation value", so that would be a 253/256 chance for each packet of at least 1151 bytes.

<comment><USER29> is 1151 an unusually large packet? Because otherwise how are these NICs not getting inoculated as soon as they're online?

<comment><USER28> It depends on what the server is doing - packets that size wouldn't be unusual in a bulk data transfer (like a HTTP response) but are larger than you'd see in the typical DNS query/response.

</comment></comment></comment></comment></comment><comment><USER30> Before actually testing this with the real payload, is there a better way of determining if you have a potentially vulnerable driver than something like this?

      # awk '/eth/ { print $1 }' <(ifconfig -a) | cut -d':' -f1 | uniq | while read interface; do echo -n "$interface "; ethtool -i $interface | grep driver; done
      eth0 driver: e1000e
      eth1 driver: e1000e

<comment><USER31> This is not about the particular linux driver, but about a particular chipset, and even then, only sometimes...

The linux e1000e may support many chipsets, so the fact that it's in service on your box doesn't necessarily mean you're running the suspect chipset, or that it's vulnerable.

Check with lspci -v, and check with the concrete test using the cold boot+magic packet others and the OP have posted.

</comment></comment><comment><AUTHOR> Updated with more specific info: <http://www.kriskinc.com/intel-pod>

</comment><comment><USER32> Intruiging.

Intel 82574L ethernet controller looks to be popular too. Intel, Supermicro, Tyan and Asus use it on multiple current motherboards and Asus notably on their WS (Workstation) variants of consumer motherboards, e.g. the Asus P8Z77 WS (socket LGA 1155) and Asus Z9PE-D8 WS (dual CPU, socket LGA 2011).

<comment><USER33> It's quite popular because while it has large amount of weird quirks (usually specific to silicon revision / configuration) it still works and in many cases better than other comparable chipsets.

</comment></comment><comment><USER34> <http://computer.yourdictionary.com/truck-roll>

</comment><comment><USER35> I'm not surprised - firmware for ethernet controllers have grown quite complex, with the addition of new features that allow the hardware to do more work on behalf of the kernel.

Could this be a bug in the code of the EEPROM that handles TCP offloading, or one of the other hardware features that are now becoming more common? (<https://en.wikipedia.org/wiki/TCP_offload_engine>)

</comment><comment><USER36> Wow, I've run into what seems to be the same problem with this controller before. We "fixed" it by upgrading the e1000 driver.

</comment><comment><USER37> My servers all have the affected cards (two per machine - yikes!) but so far I can't reproduce the bug (yay).

There are subtle differences between the offsets I get when I run "ethtool -e interface" versus those in the article that indicate an affected card (but they're quite close).

Mine are:

0x0010: ff ff ff ff 6b 02 69 83 43 10 d3 10 ff ff 58 a5

0x0030: c9 6c 50 31 3e 07 0b 46 84 2d 40 01 00 f0 06 07

0x0060: 00 01 00 40 48 13 13 40 ff ff ff ff ff ff ff ff

Output of "ethtool -i interface" (in case anyone wants to compare notes):

driver: e1000e version: 1.5.1-k firmware-version: 1.8-0

I tested both packet replays by broadcasting to all attached devices on a simple Gbit switch and no links dropped.

<comment><USER38> You need to shut down, boot up the server, and do a test right away. The very _first_ packet of 1152 bytes or more that it receives after a cold boot determines if the NIC is going to be affected or "inoculated" (until next cold boot).

<comment><USER37> Thanks mrb, I missed that a cold power up was needed. I'm going to try again now but it's a bit tricky as the affected machines are in a different country and I don't have access to full remote power cycling (I can only reset the machines). Hopefully, the data centre staff will be accommodating (after all, if my machines are affected, likely hundreds of their other clients are too as I'm using dedicated servers provided by them).

EDIT: it's difficult to tell definitively doing it remotely but I still can't re-produce the bug after a cold boot.

</comment></comment></comment><comment><USER39> I had something similar in my home network, but my network foo is not good enough and I did not have to time to debug for days and weeks.

Basically one linux box with NVidia embedded gigabit controller could take down the whole segment. It would only happen after a random period, like after days when the box was busy. No two machines connected to the same switch would be able to ping each other any more after that. I suspected the switch, bad cables, etc. In the end I successfully circumvented the problem by buying a discrete gigabit ethernet card for the server in question.

</comment><comment><USER40> Kielhofner is a pretty awesome guy. I met him a couple of times "back in the day" at Astricon conferences when he was hacking together Astlinux.

He was instrumental in taming the Soekris and Alix SBC boards of old and creating Asterisk appliances with them. If you've got a little asterisk box running on some embedded looking hardware somewhere, it doesn't matter whose name is on the sticker, its got some Kielhofner in it.

I live about a mile from Star2Star. I ought to pop in one of these days and see what they're up to.

</comment><comment><USER41> This seems much more serious than the much-ballyhooed Pentium FDIV bug. Hopefully Intel will be on the ball with notifying people and distributing the fix.

</comment><comment><USER42> Cool!

I'm currently working on an open source project where we are chasing "hang really hard and need a reboot to come back" issues with _exactly_ this same ethernet controller, the Intel 82574L. I wonder if it's related!

Our Github issue: <https://github.com/SnabbCo/snabbswitch/issues/39>

</comment><comment><USER43> Well this hurts. I have a critical machine with a dual NIC Intel motherboard. I had to abandon the 82579LM port because of unresolved bugs in the Linux drivers, and the other one is a 82574L, the one documented in this post.

I suppose I can send just the right ICMP echo packet to router to make it send me back an innoculating frame.

<comment><USER44> Good luck

</comment></comment><comment><USER45> <http://en.wikipedia.org/wiki/Ping_of_death>

<comment><USER19> That was an OS-level bug, it's far less exciting.

<comment><USER45> I'll agree it's more interesting in that the end-result was a box that required a hard boot, but still these two issues aren't that distantly related: it effected routers and many, many OS platforms, so it's not as if it was related to some implementation detail that MS left out of Windows.

Correct me if I'm wrong (no, seriously) -- aren't both "packets of death" just poor handling of said malformed packets? Violations of their respective protocols? (TCP/SIP)

<comment><USER46> You probably want to re-read the linked article a bit more closely.

</comment></comment></comment></comment><comment><USER47> Reminds me of my own adventures with systems hanging on PXE boot when a Symantec Ghost PreOS Image didn't boot up completely, and went on to flood the network with packets. See <http://dynamicproxy.livejournal.com/46862.html>

</comment><comment><USER48> This somehow reminds me of the slammer SQL worm. A simply formed single packet caused a tsunami over the internet.

Personally, I am not at all surprised that this sort of thing exists. I'm sure there's lots more defects out there to be found. turning completeness is a cruel master.

</comment><comment><USER49> I have mixed feelings about the write up. I think it gets clear pretty early on that the issue is in the NIC hardware at which point it is time to stop wasting your time investigating problem you can't fix and start contacting the vendor.

<comment><USER8> In my experience dealing with a similar bug (see my other post in the thread), the vendors will immediately assume it's not their problem.

They spent a long time "showing" us that a different version of the Linux kernel didn't exhibit the problem so it must be a Linux kernel bug. Turned out the different version just sent data differently so it didn't trigger the same bug with the same data. Other data would have triggered it.

I wouldn't be surprised if the majority of "bugs" they receive reports on turn out to not be bugs in their hardware. There's probably parallels with the reports of compiler bugs, most end up not being bugs in the compiler.

The unfortunate truth is that responsibility of proving it's the vendors bug falls on the customer.

I had to write a proof-of-concept "exploit" to show the problem was with their hardware, effectively troubleshooting most of the problem for them.

<comment><USER50> THIS.

It's always someone else's testing procedures, someone's else's hardware... The thing is though, most of the time it is. Tech support at the lower levels especially are used to dealing with people who have bad configurations are are using the products incorrectly. The annoyance comes in when you as a customer narrow a problem down but can't get anyone on the phone who can help you at that level.

</comment></comment></comment><comment><USER51> It's like a reverse example of a broken packet... You can see a number of interesting samples and stories in the museum of broken packets: <http://lcamtuf.coredump.cx/mobp/>

</comment><comment><USER52> Congrats Sir, you've just discovered the Internet Kill-Switch!

The "red telephone," used to shut down the entire Internet comes to mind.

You discovered howto immunize friends and kill enemies in CyberWars.

Do governments have an Internet kill switch?

Yes, see Egypt & Syria they're good examples. We know China is doing Cyberwars, they are beyond Kill-Switches.

Techcrunch: [http://techcrunch.com/2011/03/06/in-search-of-the- internet-k...](http://techcrunch.com/2011/03/06/in-search-of-the-internet- kill-switch/)

Wiki: <http://en.wikipedia.org/wiki/Internet_kill_switch>

We know Goverments deploy hardware that they can control when needed. Smartphones are the best examples for Goverment issued backdoors, next to some Intel Hardware (including NICs).

</comment><comment><USER53> Author mentioned a custom package generator tool "Ostinato". I met the author of this tool 2-3 months back. A lone guy working on this tool as a side project. Amazing work. :)

</comment><comment><AUTHOR> It appears to work if you send the packet to the network broadcast address. Quick way to detect if any of the machines are vulnerable(they won't respond to the second ping).

<comment><USER54> you conveniently omitted the part in which you walk to the racks and reboot them all.

<comment><USER13> Right! Except it sounds worse--sounded like you needed to cycle power to bring them back.

<comment><USER28> Luckily there's usually a convenient switch for power-cycling a whole suite of racks at once ;)

</comment></comment></comment></comment><comment><USER55> Great diligence! I had 1G hubs lockup with Intel 82578DM. I was too lazy track it down, so I just dropped the speed to 100M, which made it work.</comment>


Iaito – A Qt and C++ GUI for radare2 reverse engineering framework - <AUTHOR> https://github.com/hteso/iaito <comment><USER2> > I had never coded Qt nor C++ until I started Iaitō,

Well, a project like that is surely a good way to just jump right in and learn it! Kudos for that!

</comment><comment><USER3> I just want to say this is awesome, have always been looking for examples of how to do QT ui that just looks right.

When you are adding windows support drop by the msys2 irc channel on OFTC. We have support for qt5 using mingw with premade packages available in pacman.

A lot of effort went into qt5 support by alexey.

<comment><USER4> Out of interest: how do your packages differ from the official (MinGW-backed) build at [https://www.qt.io/download-open- source/#section-2](https://www.qt.io/download-open-source/#section-2) ?

<comment><USER3> MSVC is the main target for windows for qt5.

They do provide a mingw version to support the community of devs and are great for accepting code upstream.

With most projects however mingw targets are often somewhat neglected and broken even with release versions in some subtle ways.

Our Mingw packages are actually used more broadly by devs on a daily basis and tested regularly by a package manager with other projects that depend on qt5.

Fixes end up in msys2 before they reach qt5 upstream because of that, some times we have too many as you can see here.

[https://github.com/Alexpux/MINGW- packages/tree/master/mingw-...](https://github.com/Alexpux/MINGW- packages/tree/master/mingw-w64-qt5)

We also have static builds and 64bit support for the mingw-w64 target as previously mentioned by jsheard

</comment></comment></comment><comment><USER5> Really appreciate the choice of Qt and not Electron.

<comment><USER6> True, I feel electron stack is like a cancer for native apps.

<comment><USER7> It's a false dichotomy. The people who use electron are generally not people who know Qt. So the choice isn't app in electron vs app in qt but app in electron vs no app at all.

<comment><USER8> It depends. Obviously if you're an experienced front end web developer then Electron is an easy choice, and the benefits of using your existing knowledge probably outweighs the speed/resource benefits of a native app, especially for something simple.

A lot of people think Electron is easy to use for everyone though. I fell into this trap last year, I've been doing HTML/CSS since I was in school, and I'm comfortable enough in JS. But once things started getting complex with my project, I realised I was going to need to use some of the bigger frameworks that I'm not familiar with. I started trying to build something with React, Redux, and all the various things that go with it, got overwhelmed, and gave up.

I've recently gone back to the original idea I had, and started from scratch in Qt, with no knowledge of it. It was a bit of a learning curve at the start, but overall the learning experience has been a lot easier than trying to learn the entire current JavaScript ecosystem.

I would say Electron is a good choice for JS experts or simple programs, but otherwise I'd recommend at least giving Qt a try.

<comment><USER9> if it's a simple program, why would you want to include a few hundred megabytes of dependencies? Seems like a good opportunity to learn something better.

</comment></comment></comment></comment></comment><comment><USER10> It's really great. Even if I know Qt and C++, I spent some time in ElectronJS. ElectronJS <<<<<<<<<<<< Qt + WebKit. This javascript is a weird language and killed a lot of time by simply providing many choices, some of which are horrible, but widely used.

</comment><comment><USER11> That looks absolutely great. Radare2 is amazing software, and this seems like a good GUI for a first release and a massive improvement to current reverse engineering and open source solutions.

If the author is lurking around, is it possible to rename the functions listed on the side? I am not at home and cannot test it out.

<comment><USER12> For those who might want a somewhat indirect introduction to radare...

Here's something from Linuxconf.au and hacking Thinkpads:

[https://youtu.be/Fzmm87oVQ6c](https://youtu.be/Fzmm87oVQ6c)

<comment><USER13> For those looking for a more direct introduction to radare, you can view a simple walkthrough for analyzing a binary here: [https://youtu.be/3NTXFUxcKPc?t=513](https://youtu.be/3NTXFUxcKPc?t=513)

</comment></comment></comment><comment><USER14> This is great...

I did wonder why Qt 5.3 was used along with QWebView (QWebEngine[View] and friends are the way forward apparently)

Hope to see it on windows soon.

</comment><comment><USER15> What's the relationship of this project to Bokken (GTK+ r2 GUI, <[https://bitbucket.org/inguma/bokken>](https://bitbucket.org/inguma/bokken>))? Is Bokken just dead?

<comment><USER16> Well, there's code of Bokken in this project, so I guess they're basing this project on it.

</comment></comment><comment><USER17> that looks really good, I am really looking forward to using this

i think radare has scared a lot of re beginners because the UI was not very intuitive, i'd love to see that change

</comment><comment><USER18> i notice your .ui files have a lot of stylesheets in them, did you edit them by hand or did you use some tool?

looks great btw!

<comment><USER19> I believe he used Qt Creator.</comment></comment>


Quora Co-Founder Charlie Cheever Steps Back From Day-To-Day Role At The Company - <AUTHOR> http://techcrunch.com/2012/09/11/quora-cheever/ <comment><USER5> Quora is great for geeks, but I've always found it off-putting that you have to sign in with facebook to see all the content. I understand why they do it, but I just don't much like it. One more point of friction maybe? I'm not sure.

Also, a lot of the best discussion on Quora is too "inside baseball" in the tech world. It has amazing discussions on frameworks, scaling, interesting company history on Facebook, Google, etc. but I just can't see people outside of tech using Quora. Why would my non-techie wife use Quora? Why would people who already latched on to Stack Exchange sites, Yahoo Answers, and so on use Quora?

<comment><USER6> Firstly, you don't need Facebook to login. I signed up with an email account and I've always been using that to login.

I was also attracted to Quora due to the more "techy" questions and answers that they have[1] but I've noticed for the past year or so, there are quite a lot of interesting non-techy questions and answers that people like your non- techy wife will enjoy.

In example:

1\. What are some news stories that the American mainstream media completely misconstrued and/or presented out of context that ended up helping change American laws or culture? [http://www.quora.com/digest/track_click?source=1&tid&...](http://www.quora.com/digest/track_click?source=1&tid&hash=bd2d5529bd018bc932e7ae2e5390885f&ty=1&url=%2FNews%2FWhat- are-some-news-stories-that-the-American-mainstream-media-completely- misconstrued-and-or-presented-out-of-context-that-ended-up-helping-change- American-laws-or-culture&digest_id=58876238&click_pos=1&ty_data=1512561)

2\. Why is there this belief that the USA is a conservative country? [http://www.quora.com/digest/track_click?source=1&tid&...](http://www.quora.com/digest/track_click?source=1&tid&hash=bd2d5529bd018bc932e7ae2e5390885f&ty=1&url=%2FPolitics%2FWhy- is-there-this-belief-that-the-USA-is-a-conservative- country&digest_id=58876238&click_pos=2&ty_data=1514043)

3\. What are some things that airline pilots won't tell you? [http://www.quora.com/digest/track_click?source=3&tid&...](http://www.quora.com/digest/track_click?source=3&tid&hash=bd2d5529bd018bc932e7ae2e5390885f&ty=1&url=%2FAirlines%2FWhat- are-some-things-that-airline-pilots-wont-tell- you&digest_id=58876238&click_pos=3&ty_data=1509294)

4\. What is the most beautiful number, and why? [http://www.quora.com/digest/track_click?source=3&tid&...](http://www.quora.com/digest/track_click?source=3&tid&hash=bd2d5529bd018bc932e7ae2e5390885f&ty=1&url=%2FNumbers%2FWhat- is-the-most-beautiful-number-and- why&digest_id=58876238&click_pos=6&ty_data=1509647)

I can give you more but they do have a lot of interesting questions (and answers) about politics, life, science, etc.

[1]disclaimer: I've been a Quora user for nearly 3 years.

<comment><USER7> >Firstly, you don't need Facebook to login.

As I recall, Quora did require a Facebook account for a while [1]. I imagine that someone initially put off by that requirement isn't going to be particularly inclined to continually check back to see if/when it changes.

Also, since removing the Facebook requirement the means to sign-up with an email address has gone through several iterations of varying unobviousness.

1: [http://www.quora.com/Why-did-Quora-decide-to-stop- requiring-...](http://www.quora.com/Why-did-Quora-decide-to-stop-requiring- users-to-register-via-Facebook-Connect-or-Twitter-OAuth)

</comment></comment></comment><comment><USER8> Usually a founder steps back when there's either disagreements about the roadmap/path or if they realize that the product/company will not become as successful as they though it would be.

<comment><USER9> _or if they realize that the product/company will not become as successful as they though it would be._

I'd put my money on this one ^^, if I had to choose. If growth is 50% month to month founders can learn to "agree to disagree" over a lot of things. Quora was way too overhyped to begin with and maybe they bought their own hype

</comment></comment><comment><USER10> Charlie is a really smart and humble guy; I respect him a lot. He's definitely someone I look up to as a person and as a leader. He is the one that inspired me to move to San Francisco and join a startup, and I'm grateful for that.

Best of luck, Charlie, with whatever direction you decide to go.

<comment><USER11> When I met him, it took me a few minutes to realize that he was the founder. He spoke about Quora and the associated technology therein in an amazingly casual way.

He sold it to me without even really selling it.

</comment></comment><comment><USER12> Ughh, these moments suck. Every startup goes through them but it is just painful to watch founders getting forced out of the companies they started.

</comment><comment><USER13> Adam D'Angelo answered a question on Quora regarding this: [http://www.quora.com/Charlie-Cheever-1/What-is-Charlie- Cheev...](http://www.quora.com/Charlie-Cheever-1/What-is-Charlie-Cheevers- status-at-Quora-as-of-September-11th-2012)

<comment><USER14> It's kind of a vague, press-release style answer that is short on details though.

</comment></comment><comment><USER15> As negative as people are on Quora (oh lookz bubblez!) - I honestly think that they are onto something (as is Google+).

They are both interest based social networks - rather than geographically constrained ones (i.e. Facebook and people you know IRL). Think of all those disparate niche forums we all frequent around the web lumped into one easily usable, easily searchable, real-time and real-name network - that's what Quora/Google+ are becoming.

Quora/Google+ are essentially specialist forums reimagined - <USER2> discussions based along interest lines with real-time feedback by people you can actually see (instead of geographical/friendship ones and pseudonyms on forums).

I go to Facebook (rarely) to catch up with people I know IRL - but with whom I don't really share that much in common (apart form going to school/living nearby). Indeed, outside of Facebook's instant messaging utility - I really have very little use for it (yes I understand that "normal" people differ).

I go to Quora/Google+/specialist forums/HN to discuss things I'm interested in with people who are like me. They do have something here - and the fact that they have such a strong hold on so many smart people (see how prolific some are) illustrates this fact. I think reports of Quora's death are greatly exaggerated (especially with their war chest).

For more, see here on (you guessed it!) Quora:

[http://www.quora.com/Hypothetical-Questions/Imagine-its- Janu...](http://www.quora.com/Hypothetical-Questions/Imagine-its- January-1-2016-and-look-back-and-answer-this-Why-and-how-did-Quora-take-over- the-web)

</comment><comment><USER16> As a Quora user this seems to be a big setback for the company. Charlie has always been more engaged in actually using the product and interfacing with the community. Adam has picked it up a bit lately, but their stats below show who was more engaged with the product.

Charlie: Users They Follow - 3474, Topics - 578, Questions - 1240, Answers - 1524, Edits - <USER3>

Adam: Users They Follow - 587, Topics - 338, Questions - 890, Answers - 848, Edits - <USER4>

This could certainly just be a result of their focus at the company, but it is interesting.

</comment><comment><USER17> I am actually really interested in knowing if his departure is in any way fueled by the recent changes in privacy policies that had some backlash from users.

I, for example, deleted my account when I decided I was not trusting of their handling of my data. I refused to continue to participate and quit.

I would be really interested if these canges fed this leaving in any way.

<comment><USER18> Since it said he was leading the Android app development (which was released a few weeks ago), I doubt he was involved in the privacy policy changes.

<comment><USER19> He's one of two founders in a company with under 50 employees; he wouldn't be nose-down on a single project unless there'd already been some devolution of roles.

<comment><USER18> It's certainly signals that. The Android app is more or less a port of the iOS app and isn't a project you'd expect a founder to be heavily involved with.

<comment><USER19> If that was his _only_ project, yes. But I've not seen evidence of that; I was suggesting that even if he'd stewarded that Android app project he'd also still, as a founder, be weighing in on things like the "who viewed this" feature and policy.

</comment></comment></comment></comment></comment><comment><USER20> Good for him. Looks like he's going to enjoy the fruits of his labor. There's no reason to assume he's being forced out.

<comment><USER21> isn't there? From what I understand Quora has been pretty stagnant. It failed to go mainstream. Sure the valley people know of it's existence...but most people? not so much

<comment><USER22> You have to wonder then why Paul Ryan submitted a question to Quora. Was it coordinated, or was Ryan already a Quora user?

<comment><USER14> The Republicans had to show they were also hip to social technology after Obama did an AMA on Reddit.

</comment></comment></comment></comment><comment><USER23> techcrunch has been down all day for me (on mobile). anyone else experiencing this?

<comment><USER24> Same here.

<comment><USER25> Yup, all day.

</comment></comment></comment><comment><USER26> Time for the business people to take over.</comment>


NYTimes Obituary for Ada Lovelace - <AUTHOR> https://www.nytimes.com/interactive/2018/obituaries/overlooked-ada-lovelace.html <comment><USER2> Some background on this: [https://www.nytimes.com/2018/03/08/insider/overlooked- obitua...](https://www.nytimes.com/2018/03/08/insider/overlooked- obituary.html)

On the topic of NYT obits, there's a really great episode of the Longform podcast with NTY's senior obituary writer Margalit Fox: [https://longform.org/posts/longform-podcast-43-margalit- fox](https://longform.org/posts/longform-podcast-43-margalit-fox)

</comment><comment><USER3> Unclear from the title, but this is a 100 plus years later obituary rather than something written at the time.

</comment><comment><USER4> Politics on Hacker News usually gets flagged.

<comment><USER5> This is political? Please explain.

<comment><USER6> Adding new historical obituaries specifically to address the issue that those other than White men were historically ignored in that section of the paper certainly seems at least related to a currently active area of identity politics.

Not that I think the comment on politics usually getting flagged was useful or necessarily accurate.

<comment><USER4> Most people, me included, come to Hacker News for their tech-related news specifically because they don't want to see these kinds of useless, clickbaity, virtue signalling pieces.

<comment><USER7> It's certainly not clickbait by any convention that I know that term. It's only useless to those of us who already knew about Lovelace's contributions. But, like many reposted articles, I'm content to let them lie for the sake of other HNers who haven't seen it yet.</comment></comment></comment></comment></comment>


How Scylla Leverages Control Theory to Keep Compactions Under Control - <AUTHOR> https://www.scylladb.com/2018/06/12/scylla-leverages-control-theory/ <comment><USER2> This is reaching state of art status. I always wondered what was the best way of dealing with such conflicts - this is awesome.

</comment><comment><USER3> Very cool!</comment>


Google unveils Android-based Pixel C tablet - <AUTHOR> http://www.theverge.com/2015/9/29/9415607/google-pixel-c-tablet-android-marshmallow <comment><USER2> Well, it's cool that they seem to want to join this market, and I don't want to be a naysayer, but I really hope they have a decent stylus for this or the device would be kind of moot for me.</comment>


U.S. senators to introduce bill to secure 'internet of things' - <AUTHOR> http://www.reuters.com/article/us-usa-cyber-congress-idUSKBN1AH474 <comment><USER2> A better option is to create a government testing and patching standard, fips-1024 let's say, and only buy devices that comply. The private industry usually follows and innovates around said standards, whereas the forceful regulatory approach seems to fail quite often.

</comment><comment><AUTHOR> Well, if only we realized sooner, the best way to make the IoT secure is to get Congress involved.

</comment><comment><USER3> Great, this has been a long time coming.

<comment><USER4> Who the hell knows!

The principle that IoT vending should not be lawless, and that you should not be allowed to sell made-for-pwn'ing shite is good. The idea that it is a bad thing for stuff to join a botnet even if the botnet doesn't harm the stuff's owner is also right.

Whether this or any other particular piece of legislation actual helps with that is not known yet. Whether the legislation gets used as barrier to entry to keep secure products out of the market while giving conforming but dodgy products the green light is also not seen.

The best I can say is that, from the article, the senators seem to be taking a sensible attitude, and the description of the bill is has no obvious stupidities.

I expect that legislation will matter less than the attitude courts around the world take to things as the practical consequences of IoT are brought before them one case at a time.</comment></comment>


Twitter web app now runs ES6+, reducing polyfill bundle size by 83% - <AUTHOR> https://twitter.com/wongmjane/status/1291388433747685376 <comment><USER2> > (gzipped size went from 16.6 KB down to 2.7 KB!!)

A couple orders of magnitude are missing from these sizes if my browser dev console is any indication. What are they even talking about.

<comment><USER3> The polyfills, not their own code. Effectively all they did was update their browser support baseline, dropping support for very old browsers, with the result that about 14KB of code that made it work on those old browsers can now disappear, because more recent browsers don't need it.

<comment><USER2> Ah, so they saved 14KB off their ~1MB javascripts by dropping old browsers. Must be a slow news day on HN I guess.

<comment><USER4> Maybe the news should be "dropping support for a bunch of browsers is only going to save you a few insignificant kB".

</comment></comment></comment></comment><comment><USER5> Twitter is garbage as far as I'm concerned.

I use Firefox with uBlock (standard lists) and uMatrix (all Twitter-related requests permitted) and it's still buggy as hell.

If I try to paste anything into the "compose tweet" dialog it just completely crashes with a very helpful "something went wrong" message.

If I try to cut and re-arrange parts of my tweet, it duplicates all the text and puts it out of order.

The tweet box is not even a <textarea>, it's a <div> stuffed full of <span> elements.

Additionally, the tweet box <div> is nested __over 40 layers deep __in a massive pile of divs.

As always, they're trying to be way too clever for their own good.

I'm not at all surprised they need polyfills for that trash.

<comment><USER6> >The tweet box is not even a <textarea>, it's a <div> stuffed full of <span> elements.

ah yes, because webdevs _love_ reimplementing widgets from scratch. that's no a problem in and of itself, but they also implement it half-assed, so you end up with gems like what OP described, or links being implemented as <a href="#"> with an onclick.

<comment><USER7> I think you'd find most front-end developers don't love reimplementing widgets from scratch but instead are required to because designers, product owners and customers expect this sort of experience. I just don't think Twitter would remain competitive if it had the interface of Hacker News.

<comment><USER8> Tell that to Craigslist.

<comment><USER9> Craigslist has lost a ton of market share to literally every other company. I haven't used it in years cuz there are just better products.

</comment></comment></comment></comment></comment><comment><USER10> "A polyfill is code that implements a feature on web browsers that do not support the feature. Most often, it refers to a JavaScript library that implements an HTML5 web standard, either an established standard on older browsers, or a proposed standard on existing browsers."

</comment><comment><USER11> I'd love to see some stats on page load times etc.

There's a lot of repetitive debate on HN about JS web apps slowing things down and I'd like to know if the effects would be as bad if you could use the latest browser tools unpolyfilled.

<comment><USER12> I added support for ES2017 bundles for compatible browsers for Instagram.com a couple of years ago - we saw a 5.7% reduction in the size of our core consumer JavaScript bundles when we removed all ES2017 transpiling plugins from our build. In testing we found that the end-to-end load times for the feed page improved by 3% for users who were served the ES2017 bundle compared with those who were not (more info here [https://instagram-engineering.com/making- instagram-com-faste...](https://instagram-engineering.com/making-instagram- com-faster-code-size-and-execution-optimizations-part-4-57668be796a8))

<comment><USER13> 3% is in the margin of error, surely, so basically no gain? Just a waste of dev time?

Feels like you should make that the start of the blog post and cut it down massively, so people know it's not worth bothering with?

<comment><USER12> Why do you think its in the margin of error? I never mentioned the error bars on the statistic - We did an extensive AB test and it was a 3% stat-sig improvement

<comment><USER13> A 3% improvement on a 3 second page load means it loads in 2.91 seconds. So even if it were statistically significant, it's not practically significant?

Unless your initial page load is taking like 10 seconds, a human wouldn't even notice. And if it is taking 10 seconds, well, then you've got better things to fix.

That's not an actual improvement. That's just noise.

<comment><USER14> I worked at a big web site and we could demonstrate lots of incremental revenue (many millions of dollars) from a change like this. Even though it doesn't seem noticeable to an individual, it adds up. If you draw a graph with page load time on one axis, and usage on the other, it's a smooth curve, not a step function. Out of all your customers, some fraction of them are going to get distracted and disengage after 3 seconds but not after 2.9 seconds.

Imagine you lower the grip on everyone's tires by 3%. Most people wouldn't notice, but for a few people it will prevent them from being T-boned when they wait too long to brake for a red light. That improvement would be measurable if your data was good enough. I'm not saying optimizing your website is important like preventing car crashes, but it's an illustration of how a small change can lead to a measurable improvement.

</comment></comment></comment></comment></comment></comment><comment><USER15> We tried doing this at Facebook few years ago but decided not to bother due to an insignificant effect on user metrics like TTI (time to interaction), FCP (first content paint), etc.

14KB is nothing when you're shipping 1MB+ of JS and all the other assets.

<comment><USER16> 1MB+ gzipped JS? That's a lot

</comment></comment><comment><USER17> That's awesome! Man, things on the front-end side are shaping up pretty nicely these days.

Also Twitter is such an incredible product. I love it. It's one of the few curate-by-default (along with Instagram, another masterpiece) feeds one can have. If your feed sucks, only you are to blame. Beautiful.

</comment><comment><USER18> "twitter.com no longer supports Internet Explorer 11"

[https://twitter.com/i/release_notes](https://twitter.com/i/release_notes)

<comment><USER19> Quick check-in: who here is still supporting IE? Please provide as much detail about your website (industry, audience, usage) as possible.

<comment><USER20> I still occasionally maintain a website for a school, with stats that'll horrify you.

Around 78% of browsers hitting the site are running IE8, and these will be parents making use of the portal to do stuff like check calendar dates, book appointments to see teachers, and check student grades.

We tried extremely hard to move the community onwards, including outreach to upgrade computers for families and so on. But in the end, they just don't want to move on from Windows XP because everything else is too confusing. Even if you make it look the same.

As for how often they're using the site... It's somewhere around 1/3rd of the parents hit it at least once a day using an outdated browser.

... Whilst their kids are using school-provided Thinkpads all running on Windows 10, or recent-ish school-provided iPads. (The school does all the maintenance on them as well).

<comment><USER21> I used to work in school IT.

If Google and Mozilla aren't going to step up their "managed browser" game then we're going to continue seeing MS and Apple dominate education. It's not like school IT depts like running IE, but it's basically the only browser you can lock down.

"But you shouldn't lock down kids' browsers, and let them have blah blah..."

Okay look, I don't actually give two shits if little Marcus wants to browse Pornhub on his school laptop, we're honestly not paid enough to care. But we do have administration breathing down our necks, school policies to enforce, and angry detached parents to appease.

<comment><USER22> You absolutely can manage Firefox, you can even keep doing it using GPOs.

[https://support.mozilla.org/en-US/products/firefox- enterpris...](https://support.mozilla.org/en-US/products/firefox- enterprise/policies-customization-enterprise/policies-overview-enterprise)

</comment></comment></comment></comment></comment><comment><USER23> Anyone elses scrolling still messed up with ad blocker?

And hope this change makes it easier to block trends from explore tab. I love topics, but I don't wanna see all the celebrity and politics crap every day...

<comment><USER24> Twitter is unusable if you want to avoid Politics. I unfriended almost everyone but all it takes is a single Like from anyone and it's Politics galore.

<comment><USER25> I really wish they'd add "harmony mode" or something that would get you away from the shrill toxicity of standard Twitter. People can't help themselves but click "like" on the most extreme statements possible, so users are incentivized to make the most extreme statements to maximize likes.

The only success I've had is by starting a private list of knowingly healthy users that's aggressively curated to make it stay that way, and never looking at the home timeline.

<comment><USER23> They need synonyms for mute words

</comment></comment></comment></comment><comment><USER26> After looking at my networks tab[1], I had misunderstood this. It's only the size of the polyfill that has been reduced. The page is still downloading 800KB of javascript.

[1]:[https://imgur.com/a/01LfeiW](https://imgur.com/a/01LfeiW)

</comment><comment><USER27> 83% sounds really impressive but it's only 13kb, which would make practically no difference to the end user at all unless you're on dial-up.

<comment><USER28> There is a significant benefit if you consider the billions of views their pages get every month. A lot of bandwidth saved. Lot of energy saved.

Every reduction is good in my view.

</comment></comment><comment><USER29> Joys of being able to drop IE11

</comment><comment><USER30> Hope it happens for all sites going forward. Alongside everyone supporting prefers-color-scheme for dark modes.

[https://developer.mozilla.org/en- US/docs/Web/CSS/@media/pref...](https://developer.mozilla.org/en- US/docs/Web/CSS/@media/prefers-color-scheme)

</comment><comment><USER31> Has anyone else noticed that as of a few days ago, middle-clicking a tweet that's embedded in another tweet (like a retweet with comment) causes the new tab to steal focus? It's worse than scroll jacking IMO.

</comment><comment><USER32> Wouldnt you load appropriate polyfill bundle based on Browser UA string anyway?

</comment><comment><USER33> By gzipped size I'm referring to the polyfill bundle itself

update: thanks for disambiguating the title, OP!

<comment><USER34> Do you have any information on how they achieved this?

<comment><USER33> They now have two production build variations (I'm guessing two Webpack config):

modern: ES6+, less polyfill

legacy: ES5, more polyfill

The appropriate variation is served by detecting browser's version from the User-Agent string

<comment><USER35> Note: since v8.0, Angular comes with built-in differential loading and will do all the heavy lifting to achieve exactly that.

[https://angular.io/guide/deployment#differential- loading](https://angular.io/guide/deployment#differential-loading)

</comment></comment></comment></comment><comment><USER36> These size decreases would practically matter in the 14.4k baud modem days.

<comment><USER37> I'm sure you love the modern web and its 2MB average page load, but most people don't.

This is code, so after it's downloaded it needs to be parsed and executed… needlessly.

What are you complaining about exactly?

</comment></comment><comment><USER38> Now when are they going to stop it auto-refreshing on desktop Chrome, making it functionally useless?

</comment><comment><USER39> Is there actually a completely static version of Twitter as well? A 0.0 KB JS version?

<comment><USER40> Twitter works with JS disabled, but there's a nag screen on every page load.

Alternatively, for reading only, there is [https://nitter.net/](https://nitter.net/)

</comment></comment><comment><USER41> Glad to see at least something happening on the web side of Twitter. Because frankly their website is a hot mess of invalid, incorrect or messed up UX states and interactions.

Hopefully that will be the next step after reducing the bundle size.</comment>


I'm Sick Of GOF Design Patterns - <AUTHOR> http://thecodist.com/article/i_39_m_sick_of_gof_design_patterns <comment><USER2> I learned a lot from reading the GOF book two or three years into my programming career. I think like most people, I'd already invented a few of its patterns, like pluggable Strategies, but it was great to have shared names for things.

On the other hand, I interviewed a while back and was talking about a web sockets project where my Javascript received a callback when a message arrived. "Did you think of that in terms of Design Patterns?" they asked. "Not really, callbacks are pretty common in Javascript." They really didn't like that answer. If I could think faster on my feet, I'd have whipped out that quote from Peter Norvig: "Design patterns are bug reports against your programming language."

</comment><comment><USER3> This person sounds super jaded. Like they didn't get a job because they didn't know about some pattern they were asked about.

The thing about the GOF book is that it gives you a great foundation for designing great software. No, they aren't the only patterns out there, but you are going to find at least some of them in any well designed system. You will also see a lot of code that is clearly based on a GOF pattern, but evolved from that to solve a specific problem.

For instance, you can't get a web job these days without being familiar with MVC. And really, you should know what component modern day web frameworks are missing (an observer). You will probably use some rendition of the chain of command at some point in your career. Then you have the proxy pattern, bridge pattern, adapter pattern which are all popular as well.

So sure, hate on GOF. But you're completely missing something if you do, and expressing such distaste for it makes you look bad (imo). GOF doesn't take away the creative aspect of programming, it actually facilitates it by giving you a solid foundation of which to work. So while some will perform a piece of sheet music, others will use the sheet music as inspiration to create something new and beautiful.

<comment><USER4> What I got from the article is that these patterns are guidelines, not paths carved out of stone that you have to follow. How he presents it is irrelevant to what he's trying to convey.

</comment></comment><comment><USER5> > Yet people insist on you naming a design pattern in interviews, like it's a > secret handshake, or asking a carpenter if they know any kinds of wood. What > does it prove? Nothing.

Looking at someone's code is more useful than asking if they know patterns. But some knowledge of patterns is a good thing IMHO.

For example, if I can point at some of my code and say "Yeah, that's kind of like a factory" and know I'm understood by my teammate, then that's a good thing.

One goal of the design patterns movement was to introduce a terminology that could be shared and understood. I think they succeeded to some degree, because employers are looking for familiarity with this terminology. Why is it such a PITA?

> Programming isn't paint by number, every day you make decisions on what to > write and how to design or structure the code in a continuous basis.

But wouldn't it be quite cool if you could check your thinking against other peoples successes and failures? Patterns simply catalogue problem/solution, I don't think you're supposed to implement them in a paint by numbers fashion.

</comment><comment><USER6> The right answer to the Patterns interview question is, "Whenever I see a pattern, I abstract it away."

<comment><USER7> You are right in such a deep sense that I wish I had more than one upvote to give.

This is what people mean when they say a design pattern represents a deficiency in a language: the very fact that it's a design pattern and not, say, a library function is _precisely because_ that language provides no way to abstract it away. Hence, rather than being something that we can turn into a reusable code artifact, the pattern instead becomes a piece of programmer lore, existing only in comments, in design documents or in people's heads.

<comment><USER8> You're thinking wrong. You're thinking like you're going to only use one language ever in your career. You're not (unless you have a very stunted career).

Learn what you're doing, independent of language. Then also learn what you're doing within the language.

<comment><USER7> I strongly disagree that I am "thinking wrong". I think you're saying that design patterns are a useful abstract way of thinking about your problem that you then translate into code using whatever tools are available in the language you're using. I think there _are_ some patterns for which this is true, but the majority don't fall into that category.

</comment></comment></comment></comment><comment><USER9> Obligatory link:

16 out of 23 patterns were found by Peter Norvig to be simpler or invisible in Lisp or Dylan:

[http://www.norvig.com/design-patterns/](http://www.norvig.com/design- patterns/)

<comment><USER10> Thank you.

This explains thoroughly what is wrong with design patterns ala GOF. It's not that particular frequent patterns in particular languages or enumerating them in academic fashion is wrong. It becomes wrong when sophistry of these band- aids to language flaws are raised as somehow being really important, when actually they are just reactions to accidental complexity. It often creates unnecessary complexity to description of systems and cargocult overengineering.

I would claim that it's much more beneficial for budging engineers to program something they have not programmed before (like a space invaders clone or a scheme interpreter) than to remember each GOF pattern.

And, since these band-aids are unnecessary in several languages, it would be much more fruitful to learn one of these languages rather than memorize some band-aid.

The reason the patterns are common is that they are pretty much obvious after you understand the low-level language and you are familiar with some higher level language.

It's nice to be able to give things names, but, being able to name a bird does not mean you know anything about it's important characteristics. Or, to misquote Feynman, "GOF design patterns are pretty much as important to software engineering as ornithology is to birds".

Also, if you read Christopher Alexander's work, I would claim that GOF patterns are not patterns in the sense Alexander uses.

I've seen quite a bit of damage done by GOF patterns. Simple code bases become more complex due to an implementation of some GOF pattern because that's "the modern way to do it by the book".

I would claim that it's important to first figure out a most simple way to do something, and if it fits into some GOF category then fine, you can identify it and move on.

<comment><USER9> I wouldn't say "what is wrong". I mean, the patterns stand on their own merit: they provide a recipes for solving commonly recurring program design problems in Java, C++ and their ilk. "What is wrong" is making a religion out of them: elevating these patterns to an overly important status, as if they are some important generalities in software engineering, if not in fact computer science or even mathematics.

</comment></comment></comment><comment><USER11> I had just finished undergrad computer engineering when the GoF book was published and it was a total revelation at the time. But as the author says, good ideas can be made terrible by too much slavish devotion and not enough thinking.

</comment><comment><USER12> I think the key usefulness of books like "Design Patterns" is to create a common language. Now, when I say "this is an observer" people instantly know it subscribes to an "observable" which notifies its observers by calling their callbacks.

Now... What I am sick of is people misapplying those patterns in situations and languages they really shouldn't.

</comment><comment><USER13> I always viewed design patterns as a communication tool between programmers. Saying

      $('.button .link .pulldown')
         .addClass('active')
         .on('hover', highlight)
         .on('click', doSomething);

is quite a mouthful. But if everyone's familiar with design patterns, then you can just say "Oh, it's a Builder pattern" and everybody knows what you're talking about. Same goes for many, many other situations; familiarity with MVC will go a long way towards understanding angular.js, and familiarity with Chain of Responsibility will teach you about WSGI or Django Middleware, or the State pattern will help you understand trampolines in interpreter implementation.

</comment><comment><USER14> The adage "those who don't know history are doomed to repeat it" comes to mind when I read this article.

If you simply write off the GoF patterns then you're likely to spend a lot of time creating inferior solutions to common problems. You are less likely to recognize a common problem when you see one. At the same time, people who just see the GoF patterns as some sort of bible will implement things in a ridiculously complicated way because they're trying to use as many patterns as possible.

Basically they're just tools to have in your tool chest. You have to learn how and when to use them.

</comment><comment><USER15> 2005 called, it wants its strawman argument about 90s object oriented design books back.

While we're revisiting the classics: I'm Sick Of XML Configuration Files! I'm Sick of Static Typing! I'm Sick of Exceptions!

</comment><comment><USER16> > Yet people insist on you naming a design pattern in interviews, like it's a > secret handshake, or asking a carpenter if they know any kinds of wood. What > does it prove?

It proves you can communicate succinctly with other developers. I can't count the number of times I've had a coworker laboriously explain some design they "invented" only to reach the end and realize they just described an observer, or command, etc.

Sure, I get sad when people overuse design patterns too, but I find them incredibly helpful as a communication tool.

</comment><comment><USER17> that's as good as saying "i'm sick of arcs, square windows, rafter roofs and linked lists". of course patterns aren't the end-all-be-all of software development. but it's the trait of a good craftsman and engineer to know what patterns exist and how to use them.

Sadly, and in that I agree with the author, people in interviews only ask for knowledge of patterns, not when and when not to use them.

in that sense, the title better were: "I'm sick of people thinking of patterns in an idiotic fashion", avoiding creativity at all cost". But then, that's just complaining about the single-mindedness of less experienced colleagues.

The patterns themselves and knowing how to use them I still consider a valuable asset and in parts, the author says that.

But beyond that, the value of patterns is that you can easily communicate with other developers about architectural decisions. And communication is 80% of software development in a team.

<comment><USER18> > that's as good as saying "i'm sick of arcs, square windows, rafter roofs and > linked lists".

Well, no -- except for the last, which we'll come back to -- because _software isn 't the same thing as physical architecture_. The nature of software is that components can be and should be reusable, so if you have to rebuild the same thing from a complex "pattern" (more than a simple parameterized constructor or the equivalent) each time you use it, it means that the tool (programming language) you are using has a failure of reusability. With physical architecture, you obviously need to build a new copy every time you need one -- windows are fundamentally not reusable.

Now, for linked lists, yeah, it would be silly to be sick of linked lists _as a concept_ when building software.

OTOH, you can legitimately be sick of having to build a struct with a data member and a next pointer and all the associated manipulation functions every time you need a linked list of _< new data type>_ \-- that is, sick of linked lists as a GOF-style Design Pattern -- rather than being able to (if you want to be exceptionally explicit about naming a type for the list) doing something like:

      type newDataTypeList = [NewDataType]

The better your language is, the less you have books of "Design Patterns" with implementation recipes, and the more you have code libraries where the documentation of the "pattern" covers effective use, rather than implementation.

<comment><USER17> > software isn't the same thing as physical architecture.

and software isn't the same thing as a design pattern (neither are components). The pattern describes the /concept/ and allows the builders to call an arc "an arc" instead of describing the tedious 100 steps required to actually build one and the explanation of why it works.

Reusability isn't a relevant aspect of design patterns - this is a hallmark of implementation. I can implement 200 singletons and have no need to re-use them. Same goes for windows - just because I have built a bathroom window doesn't mean I need (or even want) to reuse it for my living room.

And language 'quality' is not even a metric, I don't see the relevance of your last paragraph.

<comment><USER18> > and software isn't the same thing as a design pattern

And GOF-style design patterns -- which are heavily implementation-recipe- centered -- aren't the same thing as design patterns more generally.

> The pattern describes the /concept/ and allows the builders to call an arc > "an arc" instead of describing the tedious 100 steps required to actually > build one and the explanation of why it works.

GOF-style design patterns actually describe the tedious 100 steps required to actually build them, and are in particular selected not by their general applicability but by the fact that they are specifically things that _cannot_ be abstracted in the languages of the time that the book drew from, e.g., they are largely implementation recipes for things for which implementation recipes rather than reusable libraries are required in the common OO languages of the time the book was assembled.

> I can implement 200 singletons and have no need to re-use them.

Yes, but the reusability I'm talking about isn't the individual implementation but the common infrastructure -- with a language that is more flexible than, you can build the infrastructure for a singleton once, and the next time you don't have to build a whole singleton implementation, just the bits that are unique. With physical architecture, you have to build the whole thing each time, so implementation recipes are, to an extent, an unavoidable accompaniment to design patterns, rather than a sign of a problem with the implementation medium (in the case of programming, the particular language.)

</comment></comment></comment></comment><comment><USER19> "What do you think about Design Patterns ?" is actually a really interesting question to ask during an interview.

</comment><comment><USER20> I don't know that you understand the true value in patterns. Take for instance this series of numbers. 1,1,2,3,5,8... I bet you can look at it and say hey I recognize that pattern, 13 will come next because its the fibonacci sequence. Immediately, you can look at 5 and 8 add them together and know what comes next. You don't have to confirm the math that lead up to 5 or 8. You know because you understand the patter.

Patterns in software mean the same thing. If I can recognize the pattern through reading code, UML, or by being told with jargon, I am going to save time and energy.

I am going to assume you are not a musician or music theorist or something along those lines. Mainly because music is patterns.

MENSA describes intelligence as the ability to recognize patterns. (Couldn't find my source on this.)

But lastly, GOF didn't tell people that their patterns are a means to an end, they are a starting place.

</comment><comment><USER21> I'm tired of design patterns, too. One of my favorite quotations these days is Brendan Eich's paraphrasing of a sentiment attributed to Peter Norvig: "Design patterns are bug reports against your programming language".

That said, if you can write a rant of this length on the topic without once mentioning how they facilitate higher-bandwidth communication between team members, you're missing something.

Asking about design patterns in an interview is not a secret handshake. Instead, you are being tested to see whether you're just bringing your own programming talents in isolation, or whether you're also bringing along the force-multiplier of communication.

</comment><comment><USER22> In my interview revenge fantasy I imagine turning the tables on the interviewer:

"Before I tell you what I know about design patterns, let me ask you a question. From speaking with you, I can tell that you are articulate and have a good command of the English language, in other words, you're a good communicator.

Now, if I asked you to give me a sentence containing a _gerund_ in a _preposition phrase_ could you? Probably not, even though you probably don't go a day without writing such a sentence. Could I assume that because you aren't familiar with the _terms_ in the above question that you probably aren't a good communicator?"

<comment><USER23> Now that's one hell of a straw man.

</comment></comment><comment><USER24> I somewhat agrees with the author. But I think GOF Design Patterns is only ONE step in the right direction and it is time to move beyond that.

It is because of the GOF Design Patterns that we started to talk about anti- patterns. In my opinion, learning about the anti-patterns maybe more important than learning about patterns.

</comment><comment><USER25> The author's analogy with Mozart's music is curious. Mozart's compositions are closer to the classical forms of a symphony, concerto, etc. than other well known composers who came later. He didn't slavishly follow some rules, but other composers broke way more rules than he did.

Edit: Grammar

</comment><comment><USER26> I think what you're trying to say is that you're sick of people _misusing_ or otherwise applying GOF patterns without thinking about them. Being 'sick of GOF patterns' is something entirely different.

<comment><USER27> Not entirely different. If a thing is so consistently misused as to controvert its original purpose, it's fair to say you're "sick of X" as a proxy for its community or educational standards or other meta-application.

I don't agree with the author's approach either, but I don't think he's trying to say what you think.

</comment></comment><comment><USER28> I've always taken these "design patterns" to be a Shibboleth of the bottom 80-ish percent of programmers.

The mediocrities can't handle math. If they dig deep enough into any technical area, they get confused and insecure and pissed-off. Design patterns is the Revenge of the Not-Nerds. It's to use the language of the business to turn the tables and make the actually competent feel queasy and unsure of themselves in the (artificially stupid yet complex) environment. It ends up reinstating a mediocrity-protecting connections- or seniority-powered system because no individual can get anything done.

I call the programmers who like that nonsense "math haters". (Rhymes with "death eaters".) Instead of y = sin a*x, which is "too mathematical", it's a Vibrator object with an .apply(double x) method that returns a double. That class of functions (parameterized by a) is a VibratorFactory. But since there can only be one, why not seem extra business savvy and call it a VibratorFactorySingleton. I'm going to throw in Proxy and Abstract and Visitor in there too, not because I know what they mean in this context (I don't) but because no one else does either so I can get away with it. It's an AbstractVibratorFactoryProxyVisitorSingletonFactory.

All because I needed to use a simple trig function. But (to the math haters) trig functions are scary!

So much of this "enterprise-y" nonsense is there not just to dumb down, but to smart-out (as in, drive the smart people out of) programming. It serves the interests of characters like Twitter's PHP CEO (obviously fictional, but people like him exist) who seek to commoditize programming at all costs.

For more on this: [http://michaelochurch.wordpress.com/2012/04/13/java-shop- pol...](http://michaelochurch.wordpress.com/2012/04/13/java-shop-politics/)

<comment><USER29> What an obscure load of tosh. I might as well say that all the maths-nerds don't really know how to program because they don't understand design patterns properly, as evidenced by them hating on it all the time.

But of course, I wouldn't say that because I have absolutely no evidence and it would be based purely on my close-mindedness and preconceptions. (I also wouldn't say it because I have no hatred towards "maths-nerds" !)

And also - when has a pattern ever been used to abstract away a maths problem? I certainly haven't seen it!

Understanding patterns, but more importantly, design _principles_ , help when writing code because of the limitations of the language (any language) in properly describing the problem domain. If those principles lead to the creation of patterns which are then given names and taught to the masses, I cannot understand how learning about them would make someone a worse programmer.

<comment><USER8> I agree with you in general. But learning the design patterns superficially, and applying them where they don't really fit, can in fact make someone a worse programmer. Hopefully they'll grow out of it, so the "damage" is part of the student phase, but some probably do get stuck there and never progress.

<comment><USER30> For me, design patterns are a good thing. If it's a phase, I'd prefer people to be stuck there rather than never learn them.

My reasoning is that using a pattern is like documentation. If I see a pattern in some code, i barely have to read the code. Code is hard enough to read as it is, patterns make it easier.

I've heard various figures over the years but one that i think is a decent estimate is that maintenance is 80% of the SDLC. That means reading a crapload of code. Any time you can reduce the burden is a good thing.

It's true that a lot of GoF's design patterns are particular to languages like java and c#, and not relevant to dynamic languages especially.

I think your idea about applying design patterns where they don't fit isn't really the source of the problem. Some developers aren't good at understanding the problem they are faced with, so they do the wrong thing. That isn't anything to do with applying or not applying design patterns - it's a different discussion altogether.</comment></comment></comment></comment>


Ask HN: Am I learning Python the right way? - <AUTHOR>

So I have some previous SQL experience but I don't think it counts for much. My objective is to eventually build a databound website using Python/Django by June this year.
What I have done so far:
1) Finished Learning Python the Hard Way
2) Went through the Django tutorial online. Realised I was still a long way off from trying to understand a Python framework and I wasn't grounded in the basics yet.
3) Did HeadFirst Python but stopped half way. Didn't like their approach. Thought their HTML/CSS series was better.
4) Spent the last week attempting to do exercises here: http://www.cse.msu.edu/~cse231/PracticeOfComputingUsingPython/index.php. I found the site randomly. Found myself asking more questions on Stackoverflow after I couldn't find the solutions through googling.
5) Got stuck on one of the questions where I needed to access a specific value from the tuples inside my list. I realised that must be a really basic thing you have to know
6) Once again googled for it but found nothing. Posted the question on SO and getting flamed for asking a newbie question.
I think I'm doing this the wrong way. I like material/books that encourages hands-on participation rather than books that just 'talk at you'. Should I just read a whole bunch of them beginner books over and over again?
I'm pretty sure that I still wouldn't have found the answer to my question (use list comprehension) by doing so.
tl;dr: What's the best approach to learn python for a beginner? <comment><USER2> So, I am by no means a Python expert, or even moderately good at it, but I've been making strides in learning by building my own webapp. See, things really didn't "click" until I had to apply them to something I'm personally interested in. I could do all the tutorials in the world but then as soon as I tried doing something on my own, I'd fail. The key is to just accept that you'll fail immediately when you start out (and feel like an idiot), but keep going and keep solving small problems until the whole website comes together.

Took me from early December to mid Jan to get a full website up from not knowing Python/Django in the slightest. (I did do 1.5 years in CSC learning Java in college, but transferred to an art major... but the prev. experience with a different language certainly helped with learning Python).

The app: <http://weddinginvitelove.com>

I started out by finding a tutorial doing something kind of related (took a blog tutorial, turned a blog post model into a designer profile). Found some friends who were experts in Django (both of whom I only knew through Twitter at that point) to bounce questions off of ("I'm trying to do this but it isn't working, what am I doing wrong?"). Their help was invaluable.

So, basically, just start doing it and you'll start picking it up a lot faster.

</comment><comment><USER3> This is kind of interesting: <http://www.pythonchallenge.com/>

I started out with python doing project euler (<http://projecteuler.net/>) though that really won't give you that good of a background in python for the web and I mostly learned by going through the tutorial on the python website and going through the docs.

If you want a book I think apress begginning python is among the more recommended books after you have started out, and for the sake of time and your wallet avoid oreily's python books as they are about 700 pages over length.

You might want to give the Python Essential Reference a try instead as it is quite a good reference and something like the first 6 chapters are a nice quick tutorial, though it probably is more high level than you want (probably read it in a store first).

The django book (<http://www.djangobook.com/>) is available for free and is good for learning the internals though it can be a bit dry and there a some screencasts for django around if you look.

Hopefully that helps.

<comment><AUTHOR> Project Euler got hard for me really quickly. Thanks for tips.

</comment></comment><comment><USER4> Dive into Python is pretty good if you're a programmer already.

[http://code.google.com/edu/languages/google-python- class/ind...](http://code.google.com/edu/languages/google-python- class/index.html)

Some sites are a bit harsh to people new to a language. <http://www.reddit.com/r/learnpython> is often much more tolerant.

</comment><comment><USER5> You might see how far you get with Dive into Python (<http://diveintopython.org/>), though it is aimed at people with some level of prior programming experience...

</comment><comment><USER6> If you have beginner questions use the irc channel. There are many python releated channels. You can also use the mailing lists.

I recommend you to join your nearest Python User Group. You will be in contact with python developer, and sooner than later you will doing python for living.</comment>


How is JavaScript different from Java? - <AUTHOR> http://www.java.com/en/download/faq/java_javascript.xml <comment><USER2> There's a typo on the first point. Instead of, "Java is an OOP programming language," it should read, "Java is an object-oriented OOP programming language."

That aside, it's a wonderfully enlightening document clearly written by someone well-versed in the issues. :-D

<comment><USER3> "Java is an object-oriented object-oriented programming programming language."? Not sure that I agree.

<comment><USER4> It was a sarcasm. In original there was already "programming programming".

</comment></comment></comment><comment><USER5> >They require different plug-ins.

I wonder what JavaScript plugin is the best

<comment><USER6> At least the Javascript plugins don't want me to install the Ask Toolbar when updating.

</comment></comment><comment><USER7> Java is to JavaScript as ham is to hamster

<comment><USER8> As car is to carpet

* [http://stackoverflow.com/questions/245062/whats-the-differen...](http://stackoverflow.com/questions/245062/whats-the-difference-between-javascript-and-java)

<comment><USER9> As rap to rapist?

</comment></comment></comment><comment><USER10> I used Java for 7 years and got burnt out with programming because of the amount of upfront design effort required. I would never start coding because I knew my architecture wasn't abstract enough and refactoring it later would be hard.

JavaScript was a breath of fresh air. I could start hacking without thinking about the design, but instead focusing on simplicity and the problem at hand. Refactoring later was trivial.

A big part of this is that whereas Java is OO, JS can start out procedural, evolve to be OO and then go functional, all within the same project.

I'm now churning out more quality code than ever at [https://starthq.com](https://starthq.com)

<comment><USER11> >> I used Java for 7 years and got burnt out with programming because of the amount of upfront design effort required.

That is essential for any software engineering project (and is almost the definition of `engineering`)

>> I could start hacking without thinking about the design

o.O

>> Refactoring later was trivial.

I've never heard someone say that about JavaScript -- in fact, I've heard just the reverse. Java tooling makes refactoring much, much easier. Not so for JavaScript.

<comment><USER12> You're right. As much as people rail on java here, it still has some of if not the best tooling in the industry.

You can make javascript pretty easy, but the process is a bit more involved (not a bad thing to know your own code though.)

It makes me happy to be able to use sublime for all my programming but java.

That being said, I have to agree about the design though. You're only shooting yourself in the foot if you just start coding right away. Even just 10-15 minutes of design up front to understand what the heck you're doing will save hours down the road. I think it's more of a problem of balancing the 2.

Some people overdesign and don't get anything done while others just do everything and end up with code rot and technical debt later.

<comment><USER10> Of course one needs to think about the problem up front, especially in JavaScript. The problem with Java was that due to the fact that it's not dynamic, it was easy to get carried away creating abstract base classes and interfaces, or worse yet using generics to build up the foundation for what you actually wanted to do, before you wrote any code that was useful.

In JS, the focus for me is to get something that gets the job done in as simple way as possible, and then work to make it more generic.

</comment></comment></comment></comment><comment><USER13> What the page should have been:

        How is JavaScript the same as Java?

        They both start with the letters J, A, V, A.

</comment><comment><USER14> TIL that scripting languages are distinct from programming languages.

<comment><USER15> Also that JS can only run in a browser, and that it requires a plug-in.

<comment><USER16> Also that Java is compiled and JS is "all in text".

<comment><USER15> That one is at least roughly accurate. It's poorly worded, but the idea it is trying to convey is at least true.

</comment></comment></comment></comment><comment><USER17> 1998 called and wants it's "scripting languages" back.

</comment><comment><USER18> Java - Write once, debug everywhere.

JavaScript - Write once, run everywhere

<comment><USER19> This should be the other way around actually.

<comment><USER20> JavaScript - Write everywhere, run once?

<comment><USER21> Until the first error in the console ;-)

</comment></comment></comment></comment><comment><USER22> sort of thing a high school football coach, assigned to teach computer science over the summer, would write on the chalkboard for his students to memorize for the exam.

</comment><comment><USER23> Personally I enjoyed all the whitespace in the XML source.

Props to mozilla.org for ensuring that dinosaur of a link keeps working!

<comment><USER24> LOL you noticed it! :D

</comment></comment><comment><USER25> >JavaScript code are all in text.

Is Java bytecode not text based? If not, how would you classify it?

<comment><USER26> No, it's an array of bytes. Disassembled Java bytecode could be considered text-based, but I'm pretty sure the actual class files are considered binaries.

<comment><USER27> Of course, Java code is all binary, not at all human-readable or writeable. And there are not compilers for Javascript (except for a few JIT compilers in Safari, Chrome, Internet Explorer, and maybe Opera).

<comment><USER28> Actually all modern browsers and standalone interpreters like node.js have a JIT compiler for JavaScript; and while Java's bytecode is still not a machine code and is also JIT compiled by the Java "virtual machine", both languages are equally "scripting" or equally "non-scripting" (wherever you want to put the "scripting" line).

<comment><USER27> I guess I shouldn't have left off the <sarcasm> tag.

</comment></comment></comment></comment></comment><comment><USER29> Can we just start calling the language "JS" consistently? Other languages get to escape from their stupidly-named origins, such as "Personal Home Page".

</comment><comment><USER30> Anyone can find out how Java is different from Javascript in about 30 seconds.

What I would like to know is WHY THE FUCK JAVASCRIPT has the word JAVA in its name?

<comment><USER31> I remember reading somewhere that it was to piggy-back on Java's popularity.

<comment><USER32> In the same way CPP was only a way to cash on C's popularity.

</comment></comment></comment><comment><USER15> >Java code needs to be compiled while JavaScript code are all in text.

Well, one correct bullet point out of four is, uh, I guess it's better than zero.

</comment><comment><USER33> Is there a historical reason the page is 'java_javascript.xml' but returns an HTML document with text/html mime type?

<comment><USER34> They might have static xml files on server and XSLT template engine to produce html

</comment></comment><comment><USER35> That is one painful page

<comment><USER36> TRUE, that is _all_ plain wrong, amazing ;-)

</comment></comment><comment><USER37> Didn't it have something to do with cars and carpets?

</comment><comment><USER38> Why is there Java in Javascript?</comment>


40 maps that explain the internet - <AUTHOR> http://www.vox.com/a/internet-maps

<comment><USER2> Ref. map #3 and why Norway was the first country to join ARPANET:

"Tracing the origins of the Internet in this country, it turns out that Norway was the first non-english speaking country on the net. It also turns out that the reason for getting Norway on to the net was a highly laudable cause. In 1971, NORSAR (NORwegian Seismic ARray) at Kjeller just outside Oslo was connected to the Seismic Data Analysis Center (SDAC) in Virginia with a fixed, 2.4Kbits line. NORSAR and SDAC were financed by DARPA (US Defence Advanced Research Projects Agency) for the purpose of monitoring the early nuclear test-ban treaties, the Norwegian array being ideally situated close to the Soviet test sites on Novaja Zemlja in the Arctic."

[http://www.isoc-no.no/isoc-no/social/isoc-no-art.html](http://www.isoc- no.no/isoc-no/social/isoc-no-art.html)</comment>


The man with two penises - <AUTHOR> http://www.thomas-morris.uk/man-two-penises/ <comment><USER2> Three years ago, someone with this condition did an AMA on Reddit: [https://www.reddit.com/r/IAmA/comments/1u75hh/i_am_the_guy_w...](https://www.reddit.com/r/IAmA/comments/1u75hh/i_am_the_guy_with_two_penises_ama/)

<comment><USER3> The Reddit comments led me to a another iama about a women with a double vagina. Then someone proposed they should meet. Anyway what a fascinating story.

</comment></comment><comment><USER4> Things you learn playing trivial pursuit as a kid: diphallic terata</comment>