Blockchains and Cryptocurrencies: Burn It with Fire [video] - <AUTHOR> https://www.youtube.com/watch?time_continue=240&v=xCHab0dNnj4 <comment><USER2> There is a contradiction when saying that cryptocurrencies are great for criminal endeavors but useless in the real world - because, clearly, the black market is part of the real world. Illegal things are not necessarily immoral things - sometimes the reverse is true.

We should at no point compare unstable, 1st generation bubbly tokens with fiat cash at it exists today. We are fast entering an era of the cashless society: every transaction, every purchase ever done stored for the duration of your lifetime and up for grabs for the tax-man, law enforcement, any interested agency and any future repressive regime. Financial privacy is quickly becoming illegal and synonymous with money laundry.

Crypto is certainly a nice thing I would hope to exist in this brave new world.

</comment><comment><USER3> There are a lot of arguments in here, but I think the main one goes something like this:

* Government control over and monitoring of financial transactions, currencies, and financial services is a good thing. It exists for many reasons and serves many important purposes. Many regulations respond to historical experiences of problems which critics might not be familiar with.

* Cryptocurrencies have been created and adopted by people who actively dislike such regulation, disagree with particular policy aspects of it, want to experiment with alternatives to it, or benefit from avoiding it. I (Weaver) don't sympathize with these people, don't appreciate their creation of parallel monetary and financial mechanisms partly or wholly outside of regulatory frameworks, and would be happy if they got in trouble or had these capabilities taken away.

* Cryptocurrencies are an unreasonably expensive, impractical, and risky alternative to existing financial institutions, instruments, and technologies for the overwhelming majority of purposes _except for_ the antiregulatory ones. If people are willing to bear these costs and risks, they probably don't understand them, or else they willingly accept them for antiregulatory purposes. I (Weaver) wish they would understand these costs and risks better and decide that they aren't worth it, or be prevented from pursuing antiregulatory goals.

My attitude is quite different from Weaver's, but I think it's good to be aware of this argument.

<comment><AUTHOR> Yes, even I'm sympathetic to the anti-regulatory uses of cryptocurrency(donating to Wikileaks or safely buying drugs), but I haven't really seen a use case for blockchains or cryptocurrencies outside of these.

From what I can see, blockchains can only be used to keep track of digital or network resources, that can be transferred and validated on the network itself. So you can track stuff like Zorgbucks or DNS addresses on the ledger, but you run into serious problems when you need to keep track of meatspace resources. The local governing authorities don't give a shit about who your blockchain says owns this toothbrush or this plot of land. The only way to track and enforce transfer of this kind of stuff is if you create a fleet of Robocops to go along with your blockchain.

<comment><USER4> Neither of you have experienced warrantless freezing of assets of theft of money by your financial institution. If you had, you would understand why it might be important to preserve this control, even as a law abiding citizen.

<comment><USER3> I didn't mean to endorse Weaver's views, only to summarize them.</comment></comment></comment></comment>


Cochlear unveils hearing implants that work directly with Apple's iPhone - <AUTHOR> http://www.reuters.com/article/us-apple-cochlear-idUSKBN1AB1SI <comment><AUTHOR> This seems like such a small thing right now. Looking forward to the interconnectedness of people and machines, this is going to be a watershed event for a lot of people. Cochlear implants are in 10s of thousands of people today, and being able to directly connect them and other hearing aids to mobile supercomputers is a huge huge step. I cannot even imagine what new interaction modalities emerge as a result of this.</comment>


Python decorators they won't tell you about - <AUTHOR> https://github.com/hchasestevens/posts/blob/master/notebooks/the-decorators-they-wont-tell-you-about.ipynb#blob_contributors_box <comment><USER2> This is linking to a file, is there a rendered version to read?

<comment><USER3> [http://nbviewer.jupyter.org/github/hchasestevens/posts/blob/...](http://nbviewer.jupyter.org/github/hchasestevens/posts/blob/master/notebooks/the- decorators-they-wont-tell-you-about.ipynb)</comment></comment>


Raspberry Pi web simulator - happy-go-lucky https://github.com/Azure-Samples/raspberry-pi-web-simulator <comment><AUTHOR> if it meets the guidelines, this might make a good Show HN. [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)</comment>


Why do so many ex-offenders go back to prison?  A new study suggests they don't - <AUTHOR> http://www.slate.com/articles/news_and_politics/crime/2015/10/why_do_so_many_prisoners_end_up_back_in_prison_a_new_study_says_maybe_they.html <comment><USER2> I personally know several people that did go back. The common thread was parole and/or probation programs that just weren't achievable.

Requirements vary, but typically there's: \- tons of recurring fees (classes, mandatory drug testing, etc) \- reimbursement of the court's costs \- classes, parole officer, drug testing, etc, located in areas away from public transportation \- judges that chronically no-show, after you've paid to get there, parking, etc.

I spoke to one in-depth...it's about $500/month in direct costs, not including indirect costs like transportation. In many areas you would really have to own a vehicle to get to the required places. Which, for a felon, also means "special" high cost SR-22 insurance.

Couple that with the sort of jobs available to a convicted felon, and...

<comment><USER3> If you choose to serve out your sentence in full do you still have to go through all these different fees and classes?

Do all felons have to have SR-22 insurance or only those convicted of vehicle offences?

<comment><USER2> You can choose to serve the full sentence, and you would not have all of the fees, but you would still have some...like reimbursement of court costs. You're also subject to some classes. Drug offenders, in some states, have to take classes if they want their driver's license back. (even if the offense was not vehicle related in any way).

It's also not a trivial trade-off. Varies by state, but in Texas, for example, you could be choosing between 2.5 years + probation or 5 full years.

Not all felons need SR-22 insurance, but many whose offenses were NOT vehicle related have to have it. Drug convictions, for example, even if it had nothing at all to do with a vehicle.

</comment></comment></comment><comment><USER4> A way of explaining it that (hopefully) makes it clearer:

Let's say you have just invented the concept of prison, and let's say 50% of people come back every year after going to prison for the first time, and 50% never come back again.

In year 2, you'd observe that of the year 1 population, 50% returned, and 50% didn't.

In year 2, you'd also add a new influx of prisoners.

Therefore, in year 3, you'd observe that of the year 2 population, 75% returned and 25% didn't.

But, the real underlying recidivism rate is still 50%, not 75%.

<comment><USER4> To expand on their mall analogy: There is a big difference between asking "what percentage of this week's mall visitors will return next week", and asking "when people visit this mall for the first time, what percentage of them will return the following week".

<comment><USER5> So the difference in their studies is what percentage of first time offenders will return to prison vs. what percentage of overall prisoners will return to prison?

<comment><USER6> Seems more like one counts (Number of prison stays)/(people who have gone to prison), while the other counts (people who have gone to prison more than once)/(The number of people who have gone to prison in total)

</comment></comment></comment></comment><comment><USER7> A better source, with a previous HN discussion, that says much the same thing, is far better sourced, and makes a lot of other important points:

[https://news.ycombinator.com/item?id=10091586](https://news.ycombinator.com/item?id=10091586)

HN readers will be unhappy to read that the war on drugs is not principally, directly responsible for US incarceration rates.

HN readers will probably thrilled to read that responsibility for over- incarceration is placed squarely on overzealous prosecutors; the rate at which arrestees are charged with felonies has climbed sharply, despite an overall drop in crime.

<comment><USER8> While it may not be the principal account for incarceration rates, the paper does note that 17% of the current prison population is in prison on drug- related charges. Additionally, it notes that 20% of the growth in prison populations can be attributed to drug-related charges, and that about 20% of the flow of prisoners can be attributed to drug-related charges.

That 20% number is still a _massive_ number of people incarcerated on drug- related charges. It's still a massive problem and solving it will put a huge dent in the insane incarceration rate that we see.

Of course a problem as large as the over-incarceration of the US population is going to be complicated and is going to require many solutions rather than a single silver bullet. I'm all for prosecutorial reform as well as drug reform; I'm willing to bet I'll need to discover several other things that we need to reform in order to bring our incarceration rates down.

Put another way, if I'm optimizing some code and I see 20% of CPU-time is being spent on a trivial operation that is definitely a section of the code that I'm going to evaluate and attempt to readdress even if it doesn't fully resolve the performance issues.

<comment><USER5> If the CPU usage of my code jumped by a massive percentage, and only 20% of it can be attributed to one problem, I'm certainly going to pay attention to it. But I'm going to pay a lot more attention to the problems causing the other 80%.

<comment><USER9> Not if the 20% was the single largest individual process sucking up power.

<comment><USER10> And whose solution was simple (even if not immediately easy to achieve).

[Edit for focus: And whose solution was obvious.]

</comment></comment></comment></comment></comment><comment><USER11> There is a slight mistake in the article toward the end where the interviewer asks what good the BJS statistics are and the response is polite waffling and its wrong. What its actually extremely useful for is numerical prediction of how many beds you'll need in 10 years so build X prison beds per year etc, based on greater population growth and "repeat customer" rates. I'm not talking about conspiracy level stuff or isn't the prison industrial complex evil signalling, but just predictive numbers. The meta problem that the article does overall get correct is trying to apply "how many beds to build" statistics to "what fraction of prisoners turn their lives around" is totally useless as the interviewee properly states. In that way the BJS stats are awesome for construction budget projections while being simultaneously totally useless for pontificating on cultural problems. The dude interviewed basically gets this correct in long format, only screwing up this one question.

No one else has caught the obvious startup analogy of freemium model whales, AFAIK. Most people playing freemium games do not pay in. On the other hand a huge fraction of freemium revenue comes from whales. Therefore you can make all kinds of weird inaccurate statements about the revenue vs population distribution. Like if all your revenue comes from whales, all your customers must be whales, right? Or all your revenue comes from repeat customers therefore most customers are repeat customers. Strange logic like that.

</comment><comment><USER12> The article would have been better with actual data. Its unclear to me if the effect is large or small. Seems like it could be either depending on several factors.

</comment><comment><USER13> The academic discussion of prison sentences and recidivism must be completely dysfunctional if this sort of elementary mistake is derailing things. This is truly a Statistics 101 idea.

<comment><USER14> Welcome to sociology.

</comment></comment><comment><USER15> While the overrepresentation of the repeat offenders is a valid concern, I feel like this makes a big point out of a relatively small change in conclusion.

      Old Analysis: slightly over half were incarcerated again
      New Analysis: about one third are incarcerated again

So regardless of how you measure it, there's an enormous _relative_ risk of recidivism -- the general population is incarcerated at a mere 0.66% level [1] so that's still a 50x relative risk (compared to a 75x under the old calculation).

There is no avoiding the conclusion that ex-convicts are vastly more likely to perform crimes than the general population. From the perspective of risk management and policy design, 50x vs 75x doesn't seem to change much to me.

And I could forgive a lay person for taking the 50x relative risk to mean "ex convicts tend to return to jail" even if it's "only" 1 in 3. The general rate of incarceration is nowhere near 1 in 3.

[1] [http://www.sentencingproject.org/template/page.cfm?id=107](http://www.sentencingproject.org/template/page.cfm?id=107)

<comment><USER14> Well, of course. Criminals tend to commit multiple crimes. Would you prefer a world where crimes are just randomly committed by anyone, including you and your family, with uniform distribution? If you would, you know where to start.

<comment><USER16> Kind of a cop out answer. Obviously some recidivism is caused by some people being predisposed to crime, but when some countries have recidivism rates that are half of other countries' rates, can you really claim that it explains all of it?

</comment></comment></comment><comment><USER17> Interesting article... I think many go back because we set them up for failure during reentry. Housing and jobs can discriminate against those with criminal records, making it difficult to reintegrate with society.

</comment><comment><USER18> The first thing I think when reading the headline is that friends paradox on social networks. Feels like that. But I don't know if these paradoxes are interrelated.

<comment><USER19> It is related, and is called the inspection paradox. Identified for me by Allen Downey, with some explanation below:

[http://allendowney.blogspot.com/2015/11/recidivism-and- singl...](http://allendowney.blogspot.com/2015/11/recidivism-and-single-case- probabilities.html?showComment=1448932959307#c8157557553082969443)

</comment></comment><comment><USER20> Like anything with a political undertone, how recidivism rates are calculated is defined by the messenger. A politician wanting to take a hard nose approach to crime is going to want a higher recidivism rate so he/she can say that keeping people in prison reduces crime. On the flip side, the reality is that by providing jobs, education, and general opportunities, upon release there is a less chance that someone will recommit.

The real problem, as someone else pointed out, is that in most cases the individual is set up to fail in the justice system.

I will use myself as an example. I served a one-year supervised felony probation. On the last day of my probation I was cleared by my probation officer. Although technically my probation did not end until midnight, when I met with my probation officer in the morning she gave me a letter stating I had met my obligations and at midnight would be clear from further supervision. I had been planning a move out of the state the following day and in preparation had rented a moving van and was beginning to pack my things. With the van parked in front of my house, an overzealous sheriff deputy who knew I was on probation, stopped to see what was going on. Simply because I had already begun packing the van, he decided he would violate my probation for moving without permission. I was arrested again for a violation and subsequently spent the night in jail until a judge released me the following morning. Luckily my attorney was able to convince the state not to press for additional time and my probation was terminated. It cost me a little over $1000 in additional legal fees (or as my attorney so eloquently put it, do you want me just to play golf with state's attorney or take him to dinner afterwards) for my attorney to handle that for me. I was fortunate enough to be able to afford the costs, however, I have seen first hand how others without the means would have been violated and most likely would have served time or an additional length of probation resulting in additional costs.

While someone else pointed out that high incarceration rates are not entirely to blame on the war on drugs, they are directly related. We live in a society where zero-tolerance laws take precedence over common-sense laws. We incarcerate people at the highest rate in the world. The system is like a giant ponzi scheme. We incarcerate so many people that we have to charge outrageous court and other fees to afford to support the cycle of incarceration. Yet the failure to pay these same fees are often one of the leading reasons that people are violated on probation or parole. We have people serving mandatory sentences for charges that in today's society are no longer crimes. However, if a politician attempts to make a change and get those individuals released they are viewed as being soft on crime. An interesting study would really be a comparison of fees paid to sentence served. I know I was able to essentially pay more in fees to reduce my probation time. Similar to getting a mortgage and paying points up front to reduce your interest rate.</comment>


Password Diary: A password manager for your grandma - <AUTHOR> <comment><USER2> No link?</comment>


The Feel Good Initiative. Discover new music daily. - <AUTHOR> http://thefeelgood.com/explore

<comment><USER2> I love the "instant on" feel of this app. Just press play. Very cool.

The fact that you don't instantly force a registration page on a potential user will help attract the BugMeNot types who would otherwise move on.

<comment><AUTHOR> Yes, that was one of our key goals. You can even tag music and organize playlists without registering. You only need to register if you want to post music or save your favorites/tags (they are stored in cookies for guests).

</comment></comment><comment><AUTHOR> The result of about 20 days of exploratory programming. We didn't really know where we were going in the beginning. Things to check out: tagging (I like this song), posting your own music, the podcast (my favorite), other tidbits.

Note: I submitted The Feel Good back in February but it was a totally different site, so this is not a dupe.

</comment><comment><USER3> How about an embeddable mini-player? The src could be per-song, per-channel, or just "Featured Music."

I bet a lot of people (myself included) would love this for their blogs. Then it becomes a functional ad for your site.

<comment><AUTHOR> We are actually working on this feature right now :)

<comment><USER3> Another idea: A narrow, vertical interface for loading in Firefox's sidebar. Makes it easier to keep the player open while you browse elsewhere.

</comment></comment></comment><comment><USER4> Finally, a You Tube for audio. I've been waiting for something like this for some time -- sites like <http://virb.com/> are nice, but revolve around the album, which isn't usually how an indie artist really writes.

Now I can put things up as I work on them, which'll be cool.

\-- <http://thefeelgood.com/blinks>

<comment><USER5> Yes, a YouTube for audio. I was waiting for it for ages... why didn't anybody did it before? I think this idea & implementation has magic; in other words, it's a winner.

</comment></comment><comment><USER6> Reminds me of Pandora.

I don't like the fact that the music stops when I click to go into comments

Sorry... however, I do like it, and everything seems nicely executed

<comment><AUTHOR> That's high on the todo list. Look for it today or tomorrow.

<comment><USER6> Awesome. Well, it's bookmarked. I'll visit again in a month or so

</comment></comment></comment><comment><USER7> It's hard to figure out how to follow a channel vs. how to favorite a song. I notice that if I favorite a song I start to follow the channel automatically.

Also, I've mentioned it before, but I would like affiliate links. I'd like to buy music from some of the new artists I've found through the site, but I am too lazy to look them up on Amazon/ iTunes

<comment><AUTHOR> Affiliate links are now live on the comments page. 6 minutes turnaround :)

The philosophy of following vs favorites is that we automatically pick the channels you follow based on which ones you like the most songs from. It will work for the majority of the users. More "likes" = stronger relationship. However, the podcast is only limited to 20 songs per day for the channels with the strongest relationship, so only the minority of power users that have more than 20 songs a day will need to explicitly follow a channel or another to keep it in the podcast. But you are right, we need to communicate this better.

<comment><USER4> Could you add iTunes links? I've got music in iTunes, but not on Amazon. (CDBaby only does the former.)

<comment><USER8> Oh I see what you mean, electric sheep is in iTunes. (i really like it) We'll try to do that soon.

</comment></comment></comment></comment><comment><USER7> I love these guys. They think of everything and they make a great product. I loved the original feel good, and I love the new one too. Congrats on the [re]launch!

</comment><comment><USER9> How does this site not violate copyright law? I love the idea, but as it is, I feel like a nasty letter from the RIAA is being carried by a postman still wet from the tongue of some RIAA lawyer.

Anyway, don't let that set you back. It seems great.

</comment><comment><USER10> Liked it straight away. Long time last.fm user and yet have never used their site to listen to music in the way I used this. Do you host the music shared via the share good music feature? What on earth is going on copyright wise?

</comment><comment><USER11> Suggestion: On your sign up page, I think you should make it simple by just asking username and password. Since you are just launching, your sign up page should be very simple. See <http://anywhere.fm>

</comment><comment><USER12> What are the copyright issues you're dealing with?

</comment><comment><USER13> Nice, easy-to-use website, but what awful music. I'll stick to the classics, thanks:

<http://www.youtube.com/watch?v=p_Tf2lQvDz0>

<comment><AUTHOR> lol, well that's the idea. post the music you like

</comment></comment><comment><USER14> Blocked by my IT department already...

Ya'll may be on to something. ;)

</comment><comment><USER15> Making your logo a bit prominent will make your brand more easily identifiable. As it is right now, I searched the page but couldn't really determine what was the logo.

<comment><USER16> I actually like the way you've done the logo - meshing it with the slogan and all. You've given it a very upstream look - the logo, like the site itself, is laid out quite unconventionally. Now, I hope this was on purpose, yes? ;D

</comment></comment><comment><USER7> Can I play a continuous stream of music from just the channels I follow, preferably with forward/back/pause options?

<comment><AUTHOR> Yes, in your Podcast page. Currently it goes 3 days back, but we are thinking about expanding that or turning it into a river.

</comment></comment><comment><USER17> What language did you make it in?

<comment><AUTHOR> my homegrown PHP framework

<comment><USER18> Well now I have a counterexample for when people say PHP sucks :). I think your site looks and works great and it just goes to show that great hackers can always do great things.

<comment><AUTHOR> The advantage of writing your own framework:

      $ ab -c 5 -n 5000 http://thefeelgood.com/explore
      [...]
      Requests per second:    784.50 [#/sec] (mean)
      [...]

      Percentage of the requests served within a certain time (ms)
        50%      4
        66%      4
        75%      4
        80%      5
        90%     12
        95%     13
        98%     22
        99%     40
       100%     40 (longest request)

That's running on a 1/2GB Joyent accelerator.

</comment></comment></comment></comment><comment><USER19> Where is all of the music from?

<comment><AUTHOR> other users

</comment></comment><comment><USER20> nice, I love last.fm for this exact reason. I use that site the way you guys are promoting this one. Skip a song or say you like it and eventually it learns what to recommend. I will keep my eye on this one

</comment><comment><USER21> A volume control and/or some type of compression/limiting would be useful.</comment>


A new storage engine for PostgreSQL to provide better control over bloat - <AUTHOR> http://amitkapila16.blogspot.com/2018/03/zheap-storage-engine-to-provide-better.html <comment><USER2> This is potentially BIG news. At my last company Postgres bloat was a gigantic problem. We did a lot of data updates and sometimes customer databases (we sharded by schema) would be bloated by as much as 300%. This really hurts when some customers are 50+ GB. Not only does bloat take up more space but it slows down queries.

We would occasionally resort to taking the customer offline for scheduled maintenance to do a pg_dump/pg_restore to get their DB back in shape.

I'm very curious to hear when this might become available for production use cases.

EDIT: Article states this has been proposed for Postgres 12

<comment><USER3> Are you aware of pg_repack [1]? I haven't had a chance to use it myself yet, but it's designed for reclaiming bloated space without downtime.

[1] [https://github.com/reorg/pg_repack/](https://github.com/reorg/pg_repack/)

<comment><USER2> We tested pg_repack early on. Our experience (at least 5 years ago) was it didn't reliably clean up after itself in all cases so we were left with random triggers in the database. With thousands of customer databases this was a huge potential hassle.

I have heard plenty of people use pg_repack so maybe it got better or we didn't test it enough.

<comment><USER4> We use pg_repack and hit that exact problem (left over triggers etc). In the end we resorted to creating and dropping the pg_repack extension after each run.

(edit: Missed an "and")

<comment><USER5> Do you have any idea why their docs are not mentioning this, or even why their software aren't doing that itself?

<comment><USER6> I haven't used pg_repack in production, but on my development box with PgSQL 10.x, if you end the process early, pg_repack will complain on the next run and ask you to clean up by dropping and re-adding the extension. Maybe this occurs in the wild if the cleanup code is not reached, for whatever reason.

</comment></comment></comment></comment></comment></comment><comment><USER7> I really wish the EDB guys (both Robert Haas and Amit Kapila) would mention in their blog posts about this feature that it's meant to use the pluggable storage API which is also slated for PG12. That would make it more clear that we are not abandoning the current storage format, just giving users choice (per table) to use what works best for their use case. It would also alleviate the worries that some comments expressed for both of the blog posts.

<comment><USER8> Where can we find a summary of the pluggable storage API?

<comment><USER7> I don't think there is a good summary, it hasn't been settled yet. The (rather lengthy) discussion is like with everything on -hackers mailing list - [https://www.postgresql.org/message- id/flat/20160812231527.GA...](https://www.postgresql.org/message- firstname.lastname@example.com)

</comment></comment></comment><comment><USER9> There was an intelligent comment about the extra writes when writing to UNDO and the extra reads when anyone needs to read UNDO and suggesting that it might not always beat the traditional system which just has to write a new tuple. It was deleted while I was composing my reply, so here, without context, is my reply!

Certainly there are complicated trade-offs here. Some things to consider: (1) unless the pages get flushed to disk due to memory pressure or a checkpoint, the UNDO data won't hit the disk so that '2x write' isn't a disk write, (2) in-place updates don't require every index to be updated (only indexes whose key changed), skipping the famous "write amplification" problem (more generally than HOT can), (3) the 2x reads for transactions that need modified rows applies only to transactions running with old snapshots; in the traditional system _every_ transaction pays for reading past the bloat that can't be cleaned up (in other words, an old snapshot is a tax on every transaction in the traditional design, but UNDO is only a tax on the transaction that's using an old snapshot in this proposed system).

</comment><comment><USER10> I'm a PostgreSQL newbie [1]. From the discussion below, it seems that most of what's being addressed [2] is only really relevant in cases where there are really long-lived transactions. So a better-behaved system in which the transactions are of fleeting duration wouldn't see as much benefit because they don't suffer much from the problem.

Am I understanding that correctly?

[1] Our DBs are currently all SQL Server, but due to licensing costs, we're going to do all new stuff in pg, and over time, migrate the legacy stuff.

[2] I see there are other across-the-board benefits from e.g., smaller tuple headers; I'm talking about the main thrust.

</comment><comment><USER11> Considering that: storage costs are falling rapidly - update in place is a poor design, immutable far superior - pg is rock solid because of this architecture including DDL rollback - vacuum can recover dead space anyway! - this does seem to me to be a bit of a wasted (large) effort. Reducing size of headers and padding sounds good though. I would much rather see effort spent on incremental auto refresh of materialized views. NOT IN Foreign Keys,would also be useful to enforce XOR constraints. And Table Input parameters for Functions.

<comment><AUTHOR> Vacuum can't recover dead space in all cases. Consider if the dead rows are distributed throughout the table, it won't be able to reclaim it, only it can facilitate the future insertions into it. Also, the work it does to do that is many-a-times quite heavy for many workloads as it can slow down the system. I think you haven't fully looked at all the other benefits of this system which includes reducing write amplification by (a) by avoiding rewrites due to freezing, hint bits (b) making it possible to do an update that touches indexed columns without updating every index.

I think there are other benefits too in terms of just raw performance because it avoids a lot of work like HOT pruning. Yes, it instead needs to discard undo, but that is much cheaper.

In general, I think it is an overstatement to say that this is a wasted effort.

<comment><USER11> Yes I didn't mean completely wasted, just feels to me that this requires a huge effort and is a risk to Postgres's legendary reliability - for a relatively small gain, especially considering that ssd storage capacity will continue to increase dramatically and plummet in price. Would be better I think to prepare for new paradigm of unified immutable memory coming v soon, (Optane already shipping) which will enable Postgres to compete with 'in memory, databases like SAP Hanna

</comment></comment></comment><comment><USER12> > zheap will prevent bloat (a) by allowing in-place updates in common cases > and (b) by reusing space as soon as a transaction that has performed a > delete or non-in-place update has committed

I'm not going to pretend to understand all of this, but is there not a trade off here? Is MVCC not fast and concurrent because it does create new rows instead of trying to mutate the old/current ones, would it be slower writes?

In other words, are we sacrificing speed for less storage consumption?

<comment><AUTHOR> It appears like we are sacrificing speed in some cases, but it is not actually true. In the current heap, we have to modify a current row, add a new row, and then WAL log diff of both rows (or in some cases need to write both rows) and routinely perform Hot-pruning. Now, when the new row can't fit on the same page, we have to write both the pages, the page which contains old row and the page that contains new row.

In zheap, we need to write an old row in undo, but in many cases, it won't be written to disk as undo worker will discard the undo very quickly unless there are open snapshots. In this, we don't need to perform Hot-pruning. So, there is an additional cost of memory copy, but that is more than compensated by savings.

You can read 'macdice' reply in this regards.</comment></comment>


How To Be Productive without Becoming a Productivity Freak - <AUTHOR> http://www.dragosroua.com/how-to-be-productive-without-becoming-a-productivity-freak/ <comment><USER2> This post needs to be proofread; the errors in syntax make it hard to read. Also, what the hell's a running train roof?</comment>


Peter Thiel, PayPal Co-Founder, to Be Delegate for Donald Trump - <AUTHOR> https://amp.theguardian.com/us-news/2016/may/10/peter-thiel-paypal-co-founder-to-be-delegate-for-donald-trump <comment><USER2> I wonder if Thiel is still as enthusiastic about Trump after The Donald's recent comment about printing money to pay off the national debt.

</comment><comment><USER3> peter thiel is a contrarian. That implies that he follows the unpopular opinion. Since elections are based on popularity, if thiel is right, Hilary becomes president

</comment><comment><USER4> I had no idea about Thiel's politics. Is it acceptable to judge someone's character based on their political beliefs?

<comment><USER5> Only if you can make the right judgement. The Trump support is very heterogenous. Unless you know the reason that specifiic individual support him, you may judge wrong.

<comment><USER4> I can think of a few politicians in history with whom there is no reason that excuses supporting them - for me, Trump is on that list.

</comment></comment></comment><comment><USER5> So there is at least one Trump supporter in Silicon Valley.

<comment><USER6> I think you'd be surprised by how many there are.

<comment><USER5> Trust me, I won't. I know why they keep low profile though. I was mostly mocking the recent media wave of "no one in SV likes Trump" articles.</comment></comment></comment>


New Freebox update censors ads by default for 5.5M users - <AUTHOR> http://www.rudebaguette.com/2013/01/03/new-update-to-freebox-censors-internet-ads-by-default-for-5-5m-users/

<comment><USER2> Good riddance though. I wish other ISPs would follow suit.

People do NOT like advertisements, the popularity of AdBlock shows that pretty clearly.

<comment><USER3> Well we (web developers) are trying to make the ad experience as best as we can. A lot of websites wouldn't even exist without ads (Google, Facebook etc...). If ads are annoying you, use Adblock, but do not remove ads from every user by default! I work for big startup in the US, and we wouldn't exist without ads.

<comment><USER4> I think they're just doing that to get good publicity (oh Free doesn't show ads on internet? I think I'll sign-up at that ISP!) and also to piss off youtube.

They will turn it off by default in a couple weeks/month for sure. Mark my words.

</comment></comment></comment><comment><USER5> Without an option to disable this, or an option to white-list certain things, this is basically just highly targeted censorship.

<comment><AUTHOR> Its possible to disable it but it's enabled by default. Lets see how long they last before Google strike back ! Free has always been in trouble with Google because they don't want to pay for the peering.

<comment><USER6> Knowing the reputation of Xavier Niel, he is gleefully waiting for Google's counter attack.

</comment></comment></comment><comment><USER7> 'Censorship' of spam emails is ubiquitous. How is this different from that for an end-user?

<comment><USER8> Spam email do not contain any content you want to read.

Webdevelopers/contentcreators create content but use ads to fund development of those works.

</comment></comment><comment><USER9> The flip side of net neutrality issues.

Don't tamper with my Internet please.

</comment><comment><USER10> They seems to only want to block Google ads. Free and Google have had issues for a long time about 'who pays for bandwidth'. Google doesn't want to pay, so Free blocks their revenues.

</comment><comment><USER11> Freebox Revolution = 2 M users only !!! 5.5 M users, but 3 M are using the Freebox V5 (the previous version is unable to block ads).

</comment><comment><USER12> I'm sure that this would also reduce traffic on some of nosiest advertisements which would benefit an ISP greatly.

<comment><USER8> ads don't add up to a lot of traffic for an ISP, video and so on does.

</comment></comment><comment><USER13> This is huge news.

ISPs modifying the HTML served is a big issue. I'm not that much of a fan of ads, but disabling ads is crazy.

It's not working that well apparently.

First thing is: a _lot_ of Google ads are served directly inside GMail (these are the ones I notice the most) and at the top of the result from Google search.

If that trafis is over HTTPS I've gat to wonder how Free plans to filter them out.

But in any way: Free already wanted to throttle YouTube, which is not OK.

If I'm paying Free that much of an amount each month I want my bandwith. I Free cannot provide me the bandwith I want, then I'll go to an ISP who can and who doesn't throttle me.

<comment><USER14> Free isn't modifying HTML, but filtering ads servers IPs.</comment></comment>


Kevin Rose: "Digg traffic has grown by over 40% since July" - <AUTHOR> http://thenextweb.org/2008/10/09/kevin-rose-diggs-recommendation-engine-stirred-traffic/

<comment><USER2> Does anyone here use Digg successfully? I've found the homepage has turned essentially into an RSS aggregator for a couple of sites.

Does the recommendation engine work at all?</comment>


Jack Dorsey Needs to Step Down - <AUTHOR> https://www.profgalloway.com/twtr-enough-already <comment><USER3> >> As of 12/6 I am the direct and beneficial owner of approximately 334,000 shares in Twitter.

Well, that's your problem.

<comment><AUTHOR> > _Well, that 's your problem_

It looks like an activist position. The shares were acquired with the view of making them more valuable through direct action. This is a validated hedge fund strategy.

<comment><USER4> That seems pretty likely to fail. How often does that actually result in positive gains?

<comment><USER5> All the time if its a good activist investor, just look up that term.

<comment><USER6> Not all of the time. Way too much chance involved. But enough to make a profit on average.

</comment></comment></comment></comment></comment><comment><USER7> What's curious to me is how Twitter made so few improvements so slowly during the past few years, when its Chinese counterpart, Weibo, could release waves of new features in fast pace. Not that all the new features are good in users' eyes, of course, but isn't fast iteration a motto in the Bay Area?

<comment><USER8> Don't you think that scaling to handle global growth is a feature?

<comment><USER9> Except twitters DAU has been pretty steady at around 300-315 million since 2015.

[https://www.statista.com/statistics/282087/number-of- monthly...](https://www.statista.com/statistics/282087/number-of-monthly- active-twitter-users/)

<comment><USER7> Yeah, and Twitter's user base has not increased much. Scalability is not really that much of problem.

</comment></comment></comment></comment><comment><USER10> Woah. Galloway bought $10m worth of Twitter shares and is demanding Dorsey's ouster by board!

<comment><USER11> Roughly 0.04% of the company, for those curious what the math works out to.

<comment><USER12> It's actually 0.04%.

<comment><USER13> he could build a new twitter for less

<comment><USER6> He could set up a twitter clone for almost nothing because there are already fully working free software alternatives.

</comment></comment></comment></comment></comment><comment><USER14> Drivel. Nothing directly actionable. If a CEO has to be physically in his office to successfully run the company, he has done a poor job in building leadership under him/her. Jack is doing what he should be, finding new growth opportunities. Milking the users with more Ads will just piss off users for short term gains.

<comment><USER15> Are you kidding? Twitter is a tech company with a great brand and a monopoly platform that has a stock that performs like a mall chain. The rate of product change is so slow. There are so many opportunities for growth that are not advertising.

Seriously, if you can't push out a CEO for under-performance in this case, when can you.

<comment><USER16> The rate of product change at twitter is something every company should learn from!

Devs like new features a lot more than users do. Users feel disrupted by new features. Users don't open up their favorite app and say "gee whiz,I wonder what new feature there is today". Users don't even think about twitter, they think about tweets,replies,likes and other users. You focus on what matters to users, not what matters to devs and everyone else who does not get the user base.

Imagine feature-creep at their scale! Twitter is the most tolerable mainstream social media network I know of for many reasons -- all centered around their resistance to change and refusal to follow the trends at fb,instagram,snapchat,linkedin,etc...

Repeat with me: you don't need more growth if everyone is happy and you already have a steady and growing profit. You want more growth of course but you don't need it. You focus on what you have and need first then you consider your wants and features...very slowly.

<comment><USER17> One example of a feature that I (a user) would love to see get a little love is Lists.

I use them frequently, but Lists are not well-designed at the moment. I can't see if I've already added a user to a list, the "update" is weirdly different from that of the main timeline, there are no aggregations/stats/summaries and AFAIK, there is no interaction with push notifications. They do nothing on the platform to draw anyone's attention to the feature.

But Lists are great! I can pare down my feed to a curated set of users who are all talking about the same thing -- I have an NLP list, and ML list, a "politics" list, etc. I can follow other people's curated lists too. Twitter is huge, it's awesome to have some path to a smaller cohesive community.

It's really weird to me that they would have a feature "above the fold" on the main menu of the platform that seems so dusty and under-utilized. What's the deal? Do they not have enough engineers over there or something?

</comment></comment></comment></comment><comment><USER18> In case anyone else didn't know who he is: [https://en.wikipedia.org/wiki/Scott_Galloway_(professor)](https://en.wikipedia.org/wiki/Scott_Galloway_\(professor\))

</comment><comment><USER19> Why does Twitter need to have a huge market capitalization and return for investors? Can't it just be the "global heartbeat of the information age", as the author so humbly (/s) puts it?

<comment><USER20> I have a serious question about your question, understood under the current regime rules: How does one build and maintain a "global heartbeat of the information age" without return to the funders?

Even if I was an inventor that wanted to build one of these things for no personal benefit, until it was profitable (under some business model), it could not sustain without the goodwill of grant-givers or the greed of investors that knew their money would be returned to them under some sort of risk-adjusted time-based return calculation.

In other words - who can afford to do something like this for free? (Now - <USER2> am not a fan of Twitter, so if the answer was "no one", it wouldn't hurt my feelings, but I guess some people think that it is important somehow?)

<comment><USER21> They're public. The funders' "payout" ship has sailed. They've also been profitable this year, according to Yahoo finance.

<comment><USER20> Yes, now. But I don't know how one would finance the build-out of a public utility like this.

</comment></comment></comment></comment><comment><USER22> I like listening to Scott Galloway but I think his perspectives on this issue are biased. He regularly advocates for progressive positions and is, for example, an outspoken fan of Elizabeth Warren. The bits about Twitter's financial performance are fair grounds for critique but the unfocused parts of this rant (for example asking Twitter to "protect journalists, especially women") seem nonsensical/alarmist in order to drum up support.

What Galloway is ultimately looking for here is for some views to be allowed and others disallowed. I do not think that is okay on a platform that is as big and pervasive as Twitter (or Facebook). They are, for all intents and purposes, a public digital square. And figuring out what is a "conspiracy" or "junk science" should ultimately be left to the reader, with algorithms otherwise ranking content as neutrally/objectively as possible. After all, we trust Twitter users with the ability to vote.

<comment><USER23> > _And figuring out what is a "conspiracy" or "junk science" should ultimately > be left to the reader, with algorithms otherwise ranking content as > neutrally/objectively as possible._

I think the vast majority of the users would prefer this as well. Just give me a chronological timeline and gtfo.

There's a small _extremely_ vocal minority of users that want to censor any and all thoughts they don't approve of. This group has tons of journalists in it and for one reason or another, Twitter has paid outsized attention to it and let it shape the product and company policy, to nearly everyone's loss, including Twitter.

In fact one of the very best things about Twitter is it gives regular people a way to refute journalists, bad journalism and media agenda. It gave the audience a voice and they use it. "Protect journalists" seems like code for "protect the narrative".

<comment><USER24> _This group has tons of journalists in it and for one reason or another, Twitter has paid outsized attention to it and let it shape the product and company policy, to nearly everyone 's loss, including Twitter._

It's a simple competitive issue. Every click that goes to Twitter is one that doesn't go to newyorktimes.com, washingtonpost.com, or (yes) foxnews.com... and it's one that isn't likely to lead to any of those sites, for that matter.

Regardless of their political alignment, journalists have no reason to support disintermediation between news makers and news consumers. It threatens their livelihoods. Say what you will about Trump (just not here, please), but he does understand that much. Twitter is worth a lot to people like him, which I'd think would make it worth a lot to investors as well. Arguably it would have been a better investment for Jeff Bezos than WaPo was.

Heck, just the ability to front-run Tweets by five seconds might be worth a lot on Wall Street.

</comment></comment></comment><comment><USER25> Why does Twitter need to perform as well as Facebook or Google?

Facebook is dying down and being replaced with Instagram. Instagram is littered with ads and doesn't feel irreplaceable.

Google's core product (search engine) is nearly unusable these days thanks to all the ads and the push for e-commerce related results.

Sure, they're profitable. But the products are garbage.

Twitter feels like something that's harder to replace. It feels more like an utility. The core product has changed little over the years and that's why it's good and people keep coming back to it. If someone doesn't ruin it, I wouldn't be surprised if it outlives both Facebook and Google.

I already find the ads annoying. If they add even more, plus a bunch of useless features, and try to censor the discourse on the platform to top it off, it will be the death of twitter.

</comment><comment><USER26> Twitter hiring Anthony Noto was one of the worst. They need to replace the board which essentially means someone needs to acquire them in order to unlock the potentials.

<comment><USER27> Problem is that nobody wants them. Two or three years ago there was regular talk about Twitter selling the company, but every potential buyer (e.g. Google) said no in the end. Twitter is just not a very good business, but it does attract a lot of scrutiny due to its size and impact. It has pretty much all the risks of Facebook with none of the cash flow.

<comment><USER28> Twitter wasn't profitable two years ago. Eight straight quarters of positive net income can do wonders for attracting a buyer.

</comment></comment></comment><comment><USER29> How did this professor get his hands on $10m of Twitter stock?

<comment><USER30> Galloway founded the digital intelligence firm L2 Inc, which was acquired in March 2017 by Gartner for $155 million, and the now defunct Firebrand Partners (founded in 2005), an activist hedge fund that has invested over $1 billion in U.S. consumer and media companies.

[https://en.wikipedia.org/wiki/Scott_Galloway_(professor)](https://en.wikipedia.org/wiki/Scott_Galloway_\(professor\))

</comment></comment><comment><USER31> I question one of Twitter's strategy's: not having a paid plan

There are several web properties that I use and cheerfully pay about $5/month to support.

I get value from Twitter because I follow some awesome people whose tweets helps me efficiently keep up with interesting new papers, tech, github repos, etc.

It baffles me that there is not an option to pay $5/month for an ad-free premium account.

</comment><comment><USER32> Could moving to Africa be a signal from Dorsey that he'd like to move on from _both_ of his positions? One could imagine that e.g. Morocco could be a tenable location for CEOs of some Western firms, but much further south could make travel and communication much more difficult.

</comment><comment><USER33> Whatever happened to Red Envelope? I used to read that name a lot and then it just kind of vanished.

<comment><USER20> Hongbao is still huge and getting bigger. AND on Chinese Single's day, Alibabi did about $30B, which is about 4x the total ecommerce volume in the US.

</comment></comment><comment><USER13> Why dont u make your own twitter then? it's really easy to start (hard to scale, but if you get to that point u re up for sucecss)

incidentally these:

> Fake accounts, GRU-sponsored trolls, algorithms that promote conspiracies > and junk science

i know they exist and i see them in responses to tweets but i dont follow any of those, and havent seen any of them being followed a lot. they seem like typical harmless spam like the stuff i remove from signups all the time. Twitter is pretty great for me at this time, and i m glad they re not trying to become facebook. there's a reason why facebook can't be the fun , witty platform that twitter is.

</comment><comment><USER34> Galloway with his $10M activist position and pedagogic theology forgets the most important stakeholders in Twitter are the DAU.

</comment><comment><USER35> Well said but little sympathy for the author.

</comment><comment><USER36> Galloway is trying to cash in on his cred from having a pulse and noticing the huge gaping goatse financial wreckage that is WeWork

What a thought bleeder

</comment><comment><USER23> I think it makes total sense to question if a CEO can be part-time and be effective (I agree with the author of this post, they can't). That being said, this post is all over the place.

> _Greatness is in the agency of others, and many talented executives have > left the firm._

Uh huh. Twitter has always succeeded in spite of itself. There's never been any innovation and execution has been middling at best. I don't think there were ever "great" executives on board, and if there was, they didn't accomplish anything.

The rest of the post is just a stereotypical political rant about Russian bots and Trump. If there's a problem with the culture of Twitter's user base, much of the blame must lie on those with blue checkmarks. It's a toxic community.

<comment><USER37> I'm pretty convinced that any community with a global broadcast layer trends towards tragedy.

<comment><USER38> It belies an ugly truth - the global community is pretty tragic even if things are on the rise - let alone the real world with its mixed metrics and setbacks.

</comment></comment></comment><comment><USER39> > Political scandals happen daily under this administration. The president has > tweeted about nuclear war. He becomes more erratic under pressure. How will > the next bout of nuclear war tweets be handled? Whom, if not the CEO, are > those delegated to?

Beyond nearly everything else, this sums up my deep concern with Twitter/Trump.

</comment><comment><USER40> Jack Dorsey didnt want the job in the first place, they had to beg him to come back. Twitter was even more of a dumpster fire back then. No one wanted to buy the company and no one wanted to take the helm. The only thing that saved the company (which the article mentions as well) is Trump used it during his 2016 campaign and helped revive a company that should have died then.

</comment><comment><USER41> $10M position in what is essentially the leaking sewer of the Internet? I thought he was smarter than that.

<comment><USER42> One of the many sewers, where hundreds of millions of people enjoy swimming. Imagine if you could clean it up. What would that be worth?

That's Galloway's position.

<comment><USER41> >> "enjoy"

Citation needed. Best I can tell the only thing people "enjoy" there is shitting on each other, and this seems to be the platform's raison d'être. It's kind of hard to enjoy being on the receiving end of that though.

</comment></comment></comment><comment><USER43> Man, why does a simple blog need so much JavaScript? (Sorry, I know this is not the most productive of comments, but I am genuinely curious to know. Also, if not me, someone else is inevitably going to say it, I suspect).

<comment><USER44> Maybe all the author cares about is writing and content?

I don't think this is an issue at all for the majority of people.

Remember that you (and people visit/comment on articles on this orange site) are the 0.01% of people in the world that care about JavaScript being an issue.

<comment><USER45> Why doesn't he just serve some nice plain text then?</comment></comment></comment>


Three French Entrepreneurs just funded 101 startups (25000€ each) - <AUTHOR> http://101projets.fr 2000 ideas were submitted, 290 pitchers. 101 teams got funded today with 25000€ each...<p>The Trio is composed of french most known serial-entrepreneurs : - Xaviel Niel, founder and CEO of Free.fr, second ISP in France. - Marc Simoncini is the founder of Meetic, main french online dating service. - Jacques-Antoine Granjon, founder of vente-privee.com, French ecommerce company that pioneered the model of online flash sales <comment><AUTHOR> 2000 ideas were submitted, 290 pitches. 101 teams got funded today with 25000€ each.

The Trio is composed of french most known serial-entrepreneurs :

\- Xaviel Niel, founder and CEO of Free.fr, second ISP in France.

\- Marc Simoncini is the founder of Meetic, main french online dating service.

\- Jacques-Antoine Granjon, founder of vente-privee.com, French ecommerce company that pioneered the model of online flash sales</comment>


Show HN: Nsynjs – JS engine with stoppable threads and without callback hell - <AUTHOR> https://github.com/amaksr/nsynjs <comment><USER3> So it stringifies the function you give it, splits it into its component bits of execution, then interprets the contents alongside a state machine (with judicious use of bits concatenated together and eval'd). Interesting, for sure. AFAIK there's no preemption mechanism (or resource management), so all it does is make your code execute asynchronously - very asynchronously - <USER2> every-line-interwoven-randomly kind of asynchronously.

I do love me some metaprogramming, but is there a real scenario where you'd want something as dangerous as this compared to a generator (or a system of generators)? They have very clear atomicity guarantees (things between yields will happen synchronously), unlike what this ends up decomposing your code into. I suppose that's just the cooperative vs supervised threading debate, though?

</comment><comment><USER4> So interesting project! I'm skeptical on the practicality of it but it's still interesting.

>> global.nsynjs = global.nsynjs || require('nsynjs');

Don't do this. The module pattern is pretty well known and you can use it to return a singleton. Global has some built in node.js stuff but I wouldn't mess with it.

>> Example of wrapper to setTimeout, that will be gracefully stopped in case if pseudo-thread is stopped:

This seems overly complex and unintuitive. Also, there are lots of references to `synjs` but the project's name is `nsynjs` which seemed confusing to me.

Honestly, like I mentioned at first, cool project but callback hell is very easy to avoid even without Promises or async / await as long as you follow solid development patterns.

I would be interested if you have benchmarks / comparisons against callbacks, promises and async / await.

<comment><USER5> > The module pattern is pretty well known and you can use it to return a > singleton.

How would you even make it _not_ return a singleton? I thought that was default.

<comment><USER6> One way is to delete entries from `require.cache`.

Either way you _might_ get a separate instance if npm decided that your module and another module require different version of a given module. These would both be singletons though. Just singletons of instances of different versions of the same module.

</comment></comment></comment><comment><USER7> Reminds me of `node-fibers`[1]

        var Fiber = require('fibers');

        function sleep(ms) {
            var fiber = Fiber.current;
            setTimeout(function() {
                fiber.run();
            }, ms);
            Fiber.yield();
        }

        Fiber(function() {
            console.log('wait... ' + new Date);
            sleep(1000);
            console.log('ok... ' + new Date);
        }).run();
        console.log('back in main');

It is used heavily in meteor[2]

1: [https://github.com/laverdet/node-fibers](https://github.com/laverdet/node- fibers) 2: [https://github.com/meteor/meteor](https://github.com/meteor/meteor)

</comment><comment><USER8> Could you please not advocate SQLinjection in your example code?

> friends: dbQuery("select * from firends where user_id = "+userId).data,

> comments: dbQuery("select * from comments where user_id = "+userId).data,

> likes: dbQuery("select * from likes where user_id = "+userId).data

I'm no js developer, but there has to be a way of using prepared statements, even if just for sample code.

It's not 2001 anymore, security is important!

<comment><AUTHOR> I agree with you. It's just for illustration purposes I intentionally oversimplified it to pseudo-code.

<comment><USER9> That's the wrong thing to be oversimplifying, tbh.

</comment></comment></comment><comment><USER10> What's wrong with async/await?

<comment><USER11> It's a kludge. Syntactic sugar to remove one level of nesting.

Other languages come either with great concurrency support out of the box (Go, Erlang) or enough constructs to implement cooperative schedulers without having to specify async/await (Lua).

<comment><USER12> Not disagreeing, but as a long time JavaScripter it is remarkable to me that no matter how delightful or expressive or ergonomic the language tries to become, the same old criticisms manage to evolve with it (this may not be unique to JS).

[Edit] JS has long been criticized (fairly or not) for offering clunky "concurrency" strategies. If you must down vote, please have the decency to offer a counter perspective.

<comment><USER13> As someone who has been around for a long time and manages teams using many different languages (C,C++,C#,Java,Python,JavaScript) my JavaScript/Web teams are the most problematic in terms of cost/performance/gating bugs/upgrades/multi-platform support. The JavaScript critiques that you see are just an expression of the time and resources being wasted.

<comment><USER12> Where in the stack did you spend your time before you became a manager?

</comment></comment></comment></comment></comment><comment><USER14> I'm using ES6 async/await and I can't be happier, async programming is almost sane now. The only drawback is that you have to remember that it's all syntax sugar about Promises and they are just a bit more than syntax sugar about callbacks, so you have to understand how each async thing works or you'll be mad. But when you know those things, you can be asynchronously productive.

</comment><comment><USER15> Sightly related question, is there a library that

\- takes in a function and returns a promise returning function

\- the new function will use a web worker in the browser and something like a thread worker in NodeJs.

\- isomorphic, as in same API in browser as in the server (so maybe usable in nextjs and nuxtjs based applications

Just curious if anything like that exists.

</comment><comment><USER16> The JavaScript callback hell thing is pretty much solved now isn't it?

<comment><USER17> yes. I also never had it in the first place.

<comment><USER18> Having to manually handle callbacks (and error callbacks) is the hell in itself.

<comment><USER17> Fair enough :D

</comment></comment></comment></comment><comment><USER19> I can't quite see the need of this now we have async/await.

<comment><USER20> Me too. For the sake of sanity we should stick with async / await and forget the time we had to choose from dozens of different ways of doing async code (most of time requiring tedious wrappers).

Lets the winner takes it all.

<comment><USER21> async/await doesn't change the fact that we have two types of functions, async and sync.

</comment></comment></comment><comment><USER22> How is this an improvement over `await` and `async`?</comment>


shrtn.co, the URL shortener that could earn you money - <AUTHOR> http://thenextweb.com/apps/2010/11/16/try-this-shrtn-co-the-url-shortener-that-could-earn-you-money/

<comment><USER2> Hooray, another URL shortener! The web is becoming a better place every second.</comment>


How apps track your location without asking for permission - <AUTHOR> http://blog.trustlook.com/2015/06/02/how-apps-tracking-your-location-without-asking-for-permission/ <comment><USER2> Very real issue to consider as we all try to guide Android's imminent permission system update (Make noise and open issues!)

Is accessing nearby BSSIDs available in a similar fashion on iOS? A quick look reveals: [https://developer.apple.com/library/ios/documentation/System...](https://developer.apple.com/library/ios/documentation/SystemConfiguration/Reference/CaptiveNetworkRef/index.html#//apple_ref/c/func/CNCopyCurrentNetworkInfo)

<comment><USER3> On iOS you can only access the information of the SSID you are connected to, not a list of nearby networks.

<comment><USER4> Android has a lot of information leaks. I hate to keep beating this dead horse, but as of last year Google gives every app you install access to your cellphone number without them needing to ask for an extra permission (READ_PHONE_STATE is now a freebie as far as the app store is concerned, it isn't listed, in fact it will say "no special permissions" if READ_PHONE_STATE alone is in the manifest).

I honestly think Android's permission system is a joke, and a sceptical Google will fix the majority of the information leaks with this up-coming update.

PS - It is "interesting" that getting your google account address requires a special permission on Android, but getting your phone number does not. Wonder why that is? IMEI too.

<comment><USER2> Actually as of the Android M preview you can get the user email address without any permission guarding.

This is because GET_ACCOUNTS is under PROTECTION_NORMAL, and so it is automatically granted at install time.

<comment><USER4> Ouch, that's certainly a step on the wrong direction. I guess they get points for consistency, but they're being consistently bad.

<comment><USER5> If they've found that users almost always say yes to it, that might be the correct choice for being consistently usable even if you (and I) dislike that choice.

<comment><USER6> Enabled-by-default is a defensible choice (even if we don't like it), but it sounds like this is un-disableable, which I think is not defensible.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I tried their proof of concept app on CyanogenMod. Its PrivacyGuard was not fooled at all; it described the app as asking for Location permission, and it blocked access to the list of wifi access points unless that permission was granted.

</comment><comment><USER8> I wonder if this is a corner case of Google Play policy. Stealing privacy is forbidden on GP, but nearby wifi AP should be considered as a public accessible info.

<comment><USER9> Since nearby APs indicate where you are, I'd argue that IS private information.

</comment></comment><comment><USER10> It just gets worse. Can someone with more knowledge than I please give an opinion:

Does the iphone or cyanogenmod do this?

Are there any alternative phones/OS's which don't share your data?

Thanks,

</comment><comment><USER11> I am surprised that this is even news to people. Fire OS uses Wi-fi to set timezones (which means, by just knowing the BSSIDs, Amazon can pin point your location). Similarly, IP Addresses, if you have tolerance for error, can pretty much help you gauge (coarse) location as well.

It goes without saying that the OHA-Android [0] is a data mine for Google already. With M, they're really upping that game [1]. Far worser things to worry about.

[0] [http://arstechnica.com/gadgets/2013/10/googles-iron-grip- on-...](http://arstechnica.com/gadgets/2013/10/googles-iron-grip-on-android- controlling-open-source-by-any-means-necessary/)

[1] [http://www.computerworld.com/article/2931084/android/google-...](http://www.computerworld.com/article/2931084/android/google- now-on-tap.html)

</comment><comment><USER12> > _Note that these metrics are accessible even with system wifi and location > disabled_

Can someone explain this? It doesn't seem to make sense that with wifi disabled this would be possible (and the code they link to specifically has a fall through if wifi is disabled). Maybe something just got jumbled up in their explanation.

<comment><USER13> According to the paper:

"the Android OS by default performs WiFi scans in the intervals of tens of seconds, even when the WiFi is turned off; the setting to disable background scanning when WiFi is off is buried in the advanced settings."

It looks like you can stop this from happening when the WiFi is off it just requires an extra step. I don't have an Android device so I can't really verify this.

<comment><USER14> The option you are looking for is called "Keep Wi-Fi on during sleep" and it can be found under Settings -> Wifi -> Advanced on Android 4.3. This is the only device I can test with.

I advise turning it off unless you _need_ it to be on, not only for privacy reasons but for battery life. I noticed an increase in battery life by turning that feature off.

<comment><USER15> On a Samsung Galaxy S5 running Lollipop (5.01?) it's under Wifi -> Advanced -> Always Allow Scanning.

With this turned off and GPS turned on (ie, not using Wifi to determine locations) I get a terrible reduction in battery life because all locations are done finely with the GPS chip. With all location services disabled I get much better battery life.

</comment></comment></comment></comment><comment><USER16> Basically doing what the coarse location provider does anyways, which is corollate visible APs on the device with a db of mapped APs.

Yes, it's possible, but constantly scanning for APs will have the side effect of an app draining battery even faster than if it used the phone's location service.

<comment><USER17> During the Android setup process it asks you if you want to enable this feature and has a side note that these scans are specifically to save battery life because they take much less energy than typical location services.

<comment><USER16> Yes, wifi scan location takes less power than GPS location. Rolling your own wifi location service in an app will take more power than the framework's service, however, and it will almost certainly be less optimized.

</comment></comment></comment><comment><USER18> So what is that tool name mapping the BSSIDs on a Google Map? [http://blog.trustlook.com/wp- content/uploads/2015/06/Screen-...](http://blog.trustlook.com/wp- content/uploads/2015/06/Screen-Shot-2015-06-02-at-6.13.30-PM-1024x474.png)

</comment><comment><USER19> may be they fix it as a new feature after Google M.

</comment><comment><USER20> The original title of the article is "How apps track your location without asking for permission".

Reading the article to the end:

>> The same method also applies to iOS, which has greater user location data privacy protection. Nonetheless, iOS still allows acquiring the current connected wifi BSSID. A user can deny the location requests on an iOS device at will. However, an app using wifi BSSID can still get a user's static location without asking.

So singling out Android in HN submission title is grossly misleading. Especially since reading this comments shows that people don't read the articles posted -_-

<comment> the-dude > So singling out Android in HN submission title is grossly > misleading. > Especially since reading this comments shows > that people don't read the > articles posted -_-

I have always considered HN the 'new Slashdot'</comment></comment>


Rich Hickey on the Power of Lisp REPLs (2015) - <AUTHOR> https://groups.google.com/d/msg/clojure-dev/Dl3Stw5iRVA/IHoVWiJz5UIJ <comment><AUTHOR> > […] it is important to think broadly about the power of multiple sessions, > even from the same user. At first we are talking about 2 sessions, for human > and IDE. But it is quite common in rich Common Lisp IDEs like Lispworks for > people to have multiple listener (REPL) sessions open at the same time > (against the same runtime). You can launch long running processes that > produce streaming output, switch to another listener and continue > interaction and development, have separate listeners for separate > contexts/state/command-history etc. There's a lot to Lisp development that's > not RPC. And of course a socket REPL server could support multiple > simultaneous users, where 'users' might be programs.

> Have you ever worked with an environment like Lispworks or Allegro? If not, > I would definitely recommend trying it.

[…]

> [http://franz.com/images/ide.png](http://franz.com/images/ide.png)

> [http://www.lispworks.com/images/lw-ide- > gtk.png](http://www.lispworks.com/images/lw-ide-gtk.png)

> Note multiple listeners, data inspectors and more. Maybe not the latest > GUIs, but the capabilities should be a source of inspiration for any Clojure > IDE.

[…]

> Here's a wonderful demonstration of the power of nestability:

> "Programming Should Eat Itself" by Nada Amin > [https://www.youtube.com/watch?v=SrKj4hYic5A](https://www.youtube.com/watch?v=SrKj4hYic5A)</comment>


How Much Snow Has Fallen: Up-to-Date Data Tracking Winter Storm Jonas Snow Fall - <AUTHOR> http://www.nytimes.com/interactive/2016/01/22/us/east-coast-snow-storm.html <comment><AUTHOR> Here are NASA satellite images of the storm: [http://www.nasa.gov/image- feature/blizzard-bears-down-on-us-...](http://www.nasa.gov/image- feature/blizzard-bears-down-on-us-east-coast)</comment>


Introducing the Brand New Pingdom Control Panel - <AUTHOR> http://future.pingdom.com/ <comment><USER2> Lovely! Far far nicer looking than the current panel, though it doesn't really make good use of my resolution; and some of the elements feel a little 'big'. But a massive improvement nonetheless.</comment>


Zero and forget -- caveats of zeroing memory in C - <AUTHOR> http://www.eliteraspberries.com/blog/2012/10/zero-and-forget--caveats-of-zeroing-memory-in-c.html

<comment><USER2> Making it hard for the compiler to optimize your memset-zero away is not a long-term solution. At some point in the future the compiler might be able to analyze this and optimize it away. As a cryptographer you should not rely on bad compilers.

Actually, using his memzero solution would work, but not because of his reasons. Putting memzero into another compilation unit (.c file) requires to compile it separately. memzero itself cannot be compiled to a NOP, since the compiler does not know how it is used and a call to memzero cannot be optimized since the compiler does not know what it does.

Nevertheless, link-time optimization in theory could still optimize across compilation units. The only solution which comes to my mind is to use 'volatile' for the memory access, but that will never be fast.

<comment><USER3> > The only solution which comes to my mind is to use 'volatile' for the memory > access, but that will never be fast.

As you are insisting that the memory is accessed when you demand that the memory is wiped for cryptographic purposes, you will not be burned by the usage of volatile. (To be clear, you would of course not _use_ the memory with volatile: you would add that qualifier only when you went to wipe it.)

<comment><USER2> If you have a type like "volatile int*" for your array elements to zero, the compiler cannot use SSE intructions to write the zeros, e.g. MOVNTDQ.

[http://www.jaist.ac.jp/iscenter- new/mpc/altix/altixdata/opt/...](http://www.jaist.ac.jp/iscenter- new/mpc/altix/altixdata/opt/intel/vtune/doc/users_guide/mergedProjects/analyzer_ec/mergedProjects/reference_olh/mergedProjects/instructions/instruct32_hh/vc194.htm)

<comment><USER3> Interesting. Is there a reason for this? I was under the impression that volatile only required that the accesses actually happen, not that the accesses had to happen in a manner considered "boring". Is the issue that volatile is also demanding that the ordering remain consistent, and the SSE instruction is not capable of guaranteeing that?

(edit:) In fact, that instruction, and a small handful of others (MOVNTI, MOVNTQ, MOVNTDQ, MOVNTPS, and MOVNTPD) do seem to cause re-orderings. On x86, at least, any other form of optimization should continue to be allowed (involving cache-lines, etc.), but you are definitely right: this instruction's usage would not be. :(

<comment><USER4> The easy way of reasoning about what optimizations the compiler can do with a volatile location is to think "If this were actually a memory-mapped IO port, would this compiler optimization change the observed behaviour".

</comment></comment></comment></comment></comment><comment><USER5> Personally, I'd just write a wrapper function for memset().

The following one works in at least gcc 4.5.3 and clang 3.1, but is actually not guaranteed to work by C language semantics:

        static inline void memzero(void *volatile block, size_t size)
        {
            memset(block, 0, size);
        }

A safe alternative is

        static inline void memzero(void *block, size_t size)
        {
            static void *(*volatile const memset_)(void *, int, size_t) = memset;
            memset_(block, 0, size);
        }

but has the downside that the virtual call cannot be optimized away, whereas gcc and clang actually inline the call to memset() if the first version is used.

If this is a concern, there's probably no alternative to an explicit loop:

        static inline void memzero(void *block, size_t size)
        {
            volatile unsigned char *bp = block;
            while(bp < (unsigned char *)block + size)
                *bp++ = 0;
        }

</comment><comment><USER6> That implementation will die with a bus error for seven out of every eight possible values of mem on most non-x86 architectures, zero out the wrong memory regions for these values on some more exotic architectures, and be horribly slow everywhere else. [http://stackoverflow.com/questions/1496848/does-unaligned- me...](http://stackoverflow.com/questions/1496848/does-unaligned-memory- access-always-cause-bus-errors)

</comment><comment><USER7> Whether memset(), or any other function, gets optimized away by GCC should depend on function attributes (1) -- more exactly on the `pure'; possibly some others. However, GCC (tested with 4.7.1) somehow considers memset() pure regardles of declaration. The default declaration is:

      $ echo '#include <string.h>' | gcc -E - | grep memset
      extern void *memset (void *__s, int __c, size_t __n) __attribute__ ((__nothrow__ , __leaf__)) __attribute__ ((__nonnull__ (1)));

When replaced by hand with declaration lacking any attributes, it still gets optimized away.

        	/* will be optimized away for unclear reasons */
        extern void *memset (void *__s, int __c, size_t __n);

Contrast that to behavior of any user-defined function:

        	/* may be optimized away */
        extern void * memxxx(void *__s, int __c, size_t __n) __attribute__ ((pure));
        	/* should not be optimized away */
        extern void * memyyy(void *__s, int __c, size_t __n);

IMHO GCC's special handling of memset() is broken...

(1) [http://www.cs.auckland.ac.nz/references/c/gcc4.7/Function- At...](http://www.cs.auckland.ac.nz/references/c/gcc4.7/Function- Attributes.html)

<comment><USER3> (edit: I just noticed that qznc's earlier top-level comment makes this same overall point, even down to the specifics about future optimization and volatile. That comment is also shorter, so it is probably provides more "bang for the buck" to read it instead of mine.)

I am pretty certain that memset is not conceptually being handled especially different: it is simply being inlined. If you have a memset of a variable to 0, gcc's compiled output might involve just a single mov instruction and if it is a small array, it might be a few mov instructions: if it is a lot of memory being cleared, it might involve a call.

However, as it is inlined, the semantics are pretty clear for how it should work (and attributes like pure will be deduced, as they would for any function you include in your actual code; you don't need to mark it as such <\- edit: to be clear, though, that I really don't think that memset is "pure"... it is pretty much the exact opposite of "pure"): it is equivalent to assigning a variable a value, and if that variable's value will not ever be used, then the assignment will not happen.

Instead, if the developer really really _really_ insists that that assignment happen even if, from the perspective of the C language standard there is no legitimate side effect of that operation, the correct thing to do is to temporarily qualify the pointer with volatile and _then_ do whatever it is you wanted (such as wiping it).

Sadly, this article does not even in a single place mention "volatile", so I'm not certain that the author understood how this works. Instead, he states that a "solution" is to instead put a zero in the first element and then copy it to subsequent elements... something that could easily be detected by abstract interpretation, and which a sufficiently smart compiler would be correct in also optimizing away.

<comment><USER7> It's not about volatile; marking the array as `volatile' caused warning, and the call is still optimized away:

        a.c:14:2: warning: passing argument 1 of 'memset' discards 'volatile' qualifier from pointer target type [enabled by default]

To take `volatile' into account, the `memset()' would have to to have `volatile void * s' as first argument in its prototype.

Curiously enough, making a custom function with volatile pointer argument and `pure' attribute still causes GCC to optimize it away. I guess such combination makes no sense anyway.

        extern void * memaaa(volatile void *__s, int __c, size_t __n) __attribute__ ((__pure__));

<comment><USER3> Right. I did not claim that once you added the volatile qualifier that you could still use the existing implementation of memset: if you simply cast the pointer to volatile and then pass it to the existing version of memset, you will certainly get a diagnostic indicating that you lost the qualifier, as memset itself does not have volatile as part of its type definition.

However, the author's attempts to redefine memset without using volatile rely on gcc limitations: in the first "trivial" case that it does not use abstract interpretation while looking for constant variables (in this case, it should be easy to fold that loop down to "oh, that rvalue is always a constant 0), and in the second that it does not do extensive optimization across compilation units.

As for the other thing you noticed: while I would imagine that the gcc- specific "I am the developer and want you to do something very special and important" __attribute__ would override any notion that it might have regarding "volatile", they are really orthogonal concepts: with just that prototype the compiler wouldn't even know if that function does anything at all with the memory you passed... the function might just do something with the pointer value and not indirect it at all; therefore, one would pretty much demand that "pure" have the semantics that gcc is giving it here.

</comment></comment></comment></comment><comment><USER8> CERT's Secure Coding wiki has more to say on the subject, including portable code for a memset_s() function that can still potentially be optimized way:

[https://www.securecoding.cert.org/confluence/display/seccode...](https://www.securecoding.cert.org/confluence/display/seccode/MSC06-C.+Be+aware+of+compiler+optimization+when+dealing+with+sensitive+data)

[https://www.securecoding.cert.org/confluence/pages/worddav/p...](https://www.securecoding.cert.org/confluence/pages/worddav/preview.action?pageId=3524&fileName=protecting- sensitive-data.pdf)

</comment><comment><USER9> The assumption that the trivial solution won't be optimized out is, I think, wrong. From your experiment GCC is indeed not smart enough to do so but I would bet that a compiler like ICC would. In this case the best is probably to use some pragmas to avoid optimizing out a statement.

</comment><comment><USER10> OpenBSD has a function called secure_bzero. All it currently does is call regular bzero, but if external compilation isn't enough to do the job, we come up with something else.

Regarding the article, I don't at all understand why the three arguments are necessary. Why would the following patch not work?

        - memset(x, 0, n);
        + memzero(x, n);

<comment><USER11> i think it's to keep the patch(es) easier to read. it certainly feels awkward.

</comment></comment><comment><USER12> _Note that the type punning is only actually useful on systems where memory addresses are 64 bits wide, hence we include that code conditionally for environments with the LP64 data model, which incudes most Unix-like systems._

The first statement seems false. I was not previously aware of an association between the number of address lines and the size of the data bus on computing systems? I know I've had 32-bit processors with at least 64-bit memory buses, and the SheevaPlug has a 32-bit processor with a 16-bit memory bus.

Also, the code above this paragraph will only use wide accesses on 64-bit architectures ("#ifdef __LP64__"), even though there are benefits available on 32-bit systems.

</comment><comment><USER13> Why isn't there a keyword stating "don't optimize this!" in the C Standard? If there is is, please correct me. There are a bunch of similar problems introduced by optimizing compilers that could be solved with such a keyword.

<comment><USER14> One way to inhibit optimisations we used was to declare one of the variables involved as "volatile". I'm not sure about MS, Intel, GCC etc but ours took this as a sign to not run any optimisation passes over code involving volatile variables.

<comment><USER15> In GCC 4.4 and up you can use the following:

        #pragma GCC push_options
        #pragma GCC optimize ("O0")

        memset(a, 0, 3);

        #pragma GCC pop_options

'volatile' should also work, I don't see why there is any need to rewrite memset. Here is a related question on SO:

[http://stackoverflow.com/questions/2219829/how-to-prevent- gc...](http://stackoverflow.com/questions/2219829/how-to-prevent-gcc- optimizing-some-statements-in-c)

Edit: buried at the bottom of that post is another method:

        __attribute__((optimize("O0")))

</comment></comment></comment><comment><USER16> I've only ever done an short compiler class in college, but wouldn't a sufficiently sophisticated optimizer unroll the loop and propagate the constant, thus eliminating the read, allowing the entire block to go away?

</comment><comment><USER17> Relevant for those thinking that "volatile" will save the day: <http://www.cs.utah.edu/~regehr/papers/emsoft08-preprint.pdf>

It shows that a) volatile does not have to do _anything_ (if that is documented by the compiler) and b) you cannot trust your compiler to be bug- free. The latter is one reason to follow cert.org's advice to read the disassembly output of your compiler.

</comment><comment><USER18> Could please someone explain why this is an issue in the first place?

If the memory of the process is available to other processes after it finishes (or while it's running), isn't this already a lost game? I.e., how can you be sure that this particular chunk of memory wasn't cached on disk at some point? how can you be sure that someone didn't access it before your memset() call?

<comment><USER19> Remote exploits for one.

Imagine a web server that didn't wipe plaintext passwords or encryption keys from its memory after finishing with them. If the web server was remotely exploitable then it could be possible to obtain the contents of the memory of that process remotely, thus possibly leaking passwords or other sensitive information of other people that have connected to that web server at some point in the past.

> how can you be sure that someone didn't access it before your memset() call?

True, but there's a difference between having a very small window of opportunity where the data could be obtained via a remote exploit, and leaving the window wide open for possibly endless period of time.

Obviously you shouldn't have any remote exploits in the code in the first place, but it's good practice for secure programming to keep the sensitive information in memory for as short a period as possible just in case there is something that you aren't aware of.

</comment></comment><comment><USER20> A good solution in c is to use calloc, which is malloc + zero'ing out the memory.

<http://www.cplusplus.com/reference/clibrary/cstdlib/calloc/>

Also, in a standards-compliant compiler, statically declared variables are automatically initialized to zero unless stated otherwise.

<comment><USER17> That won't work here. Here, the goal is to have 'cfree': zero'ing out memory and then freeing it.

<comment><USER20> OK, shows me for skimming too much.

There apparently used to be a cfree though it appears to be equivalent to free.

I upvoted rwg's comment regarding CERT's Secure Coding wiki. memset_s is the correct solution given it is part of the C11 standard.

</comment></comment></comment><comment><USER21> Relevant artcile: Overwriting memory - why? - <http://www.viva64.com/en/k/0041/></comment>


Reproducing Young's experiment at home - <AUTHOR> http://www.teralab.co.uk/Experiments/Youngs_Slits/Youngs_Slits_Menu.htm <comment><USER2> I think you should change the title in the page, or at least highlight what is unexpected.

Short version: Mark as bold the sentence "This experiment goes a step further by performing it one photon at a time to show the interference of single photons."

Long version:

First I was not sure what was the Young's experiment. I know the double slit experiment but I didn't know that Young was the creator. Perhaps this varies from one country to other, or from university to other, or from one major to other, ...

Second, I thought it was the usual double slit experiment. Build some slits in aluminum foil, a laser, a ccd camera and call it a day. The one photon at a time was unexpected.

I propose a new title, something like "Reproducing Young's double slit experiment at home with one photon at a time". It's a little too long, ...

<comment><AUTHOR> I would, but it seems I am not able to change the title anymore. I have an "edit" option in my comments, but maybe this functionality does not work for submissions? In particular I am not the author of the linked page.

</comment></comment><comment><AUTHOR> I found this page via [http://physics.stackexchange.com/questions/54052/is-it- possi...](http://physics.stackexchange.com/questions/54052/is-it-possible-to- reproduce-double-slit-experiment-by-myself-at-home) and I think it is really interesting.

Furthermore it is interesting to know that one might consider the technology on the page quite oldschool, however its most important value is the text and the images in the description and they are provided by good old HTML.</comment>


Ubuntu Discards System Tray - <AUTHOR> http://www.readwriteweb.com/archives/ubuntu_discards_system_tray.php?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+readwriteweb+%28ReadWriteWeb%29 <comment><USER2> Such an inaccurate article from the get-go. Original source and discussion:

<http://design.canonical.com/2010/04/notification-area/>

<http://news.ycombinator.com/item?id=1286346></comment>


Infiltrating a Botnet - A Conversation With a Botmaster - <AUTHOR> http://www.cisco.com/web/about/security/intelligence/bots.html <comment><USER2> this is a good article. it's pretty clear that, if you had the know-how to write your own botnet software, you could really clean up. you could design your own communication protocol, rather than using irc the way everybody else does, which would help evade detection. windows users are lucky that anybody capable of such a thing probably already has a much more satisfying "real" job.

too bad the article devolved into an ad for cisco products at the very end. i was really digging it up to that point.

<comment><USER3> Seconded. I liked it save for the Cisco advertising as well.

</comment></comment><comment><USER4> nice read there. would make sense to post this link here too: [http://philosecurity.org/2009/01/12/interview-with-an- adware...](http://philosecurity.org/2009/01/12/interview-with-an-adware- author)

<comment><USER5> This is the kicker:

 _I got to write half of it in Scheme, which probably means that I deployed more Scheme runtime than anybody else on the planet._

</comment></comment><comment><USER6> Solid set of info there. Anyone know or have a guess as to the forum the botmaster linked to? Email's in profile if you don't feel like posting it for the public.

<comment><USER7> The name of the bot is fatalzircd according to the guy and they didnt censor that so its not all lost. After googling that name I found several forums and easily found one with a source code download.

</comment></comment><comment><USER8> He mentioned old school and then quoted 2005, i dont know if its just me but the idea of a botnet is certainly nothing new, and definately spawned from IRC.. FWIW you could date the article 1999 and throw in mentions of wingates a couple of times and sprinkle on some SOCKS proxy information for flavor and i'd know no different.

</comment><comment><USER9> I'd be interested in seeing the code. I've always wanted to see what that side of the wall does.

</comment><comment><USER10> Is it possible to monitor bot nets to figure out what they are doing?

<comment><USER11> Yep, but it's a lot of work. There at least a few researchers that keep track of bot activity, reverse samples, monitor via wire-compatible clients, etc. From what I gather it's getting harder, some newer worms use decentralized control channels, signed updates, etc.

One way to observe worm behavior: <http://www.honeynet.org/>

SRI writeup on their dissection of Storm: <http://www.cyber- ta.org/pubs/StormWorm/report/>

</comment></comment><comment><USER12>
      the researcher suggested a TOR audio conference

Audio over TOR? I thought it was too slow for that.

<comment><USER13> Skype wouldn't work, but all you need is a 12kps stream. The problem with tor is sometimes the nodes are very slow, you could probably pick a path that showed to be faster but as far as I know it's non trivial.

<comment><USER14> May work. Tor is not really that slow. It just has a lot of latency.

</comment></comment></comment><comment><USER15> A masterful bit of deception. Who would have guessed that a botmaster would be so trusting?

<comment><USER16> What did he have to lose? The researcher had already penetrated his botnet, and if he was hidden behind an "anonymous proxy chain" then his identity wasn't at risk, non?

<comment><USER2> he had a _lot_ to lose. the "reporter" could have been collecting subtle details, and trying to match them up with known real-world suspects.

in his position, i certainly wouldn't have talked. but it's probably a lonely occupation, and who else are you going to talk to.

</comment></comment></comment><comment><USER17> Interesting article, but the lack of subtlety in some parts made me cringe, e.g: "wanta be partners?".</comment>


How I Hacked the Affordable Care Act to Save $10,000 - <AUTHOR> http://www.upbed.co/blog/how-i-hacked-the-affordable-care-act-to-save-10000 <comment><USER2> There are several misinterpretations here, not the least of which is confusing Medicare with Medicaid.

</comment><comment><USER3> I'm confused. What was the hack?</comment>


Apple wants its 3G MacBook prototype back - <AUTHOR> http://news.cnet.com/8301-27076_3-20099494-248/apple-wants-its-3g-macbook-prototype-back/

<comment><USER2> Oh, it's from 2007? I got my hopes up prematurely, it seems... if they haven't acted on this idea in four years, it's probably for a good reason. A 3G macbook would be a great addition to their product lineup, though.</comment>