Conversational UI for Wizergos Mobile APP - <AUTHOR> https://www.youtube.com/watch?v=SqUMpo7CAWg <comment><USER2> I thought typing is hard on mobiles, so the need for clickable interface. This is going backwards in time!!

<comment><USER3> Though typing is hard(not as used to be with new suggestive keyboards), it is much faster way to access information if the applications have many things and hard to figure out what to click. Since the interface is conversational it's like you are chatting with your friend and asking for things you need.

</comment></comment><comment><USER4> This looks great!! no need to click through pages if I need something. Will check this out.

<comment><AUTHOR> Thanks: Signup here: [https://www.wizergos.net/static/index.html#/createaccount](https://www.wizergos.net/static/index.html#/createaccount)</comment></comment>


AWS WAF Now Supports Regular Expressions (Regex) - <AUTHOR> https://aws.amazon.com/about-aws/whats-new/2017/10/aws-waf-now-supports-regular-expressions-regex/ <comment><AUTHOR> Seems they also launched geo location blocking today [https://aws.amazon.com/about-aws/whats-new/2017/10/aws- waf-n...](https://aws.amazon.com/about-aws/whats-new/2017/10/aws-waf-now- supports-geographic-match/)</comment>


Alan Kay's Reading List - <AUTHOR> http://www.listsofbests.com/list/111411-alan-kay-s-reading-list

<comment><USER2> A bit of context (the posted link is not the original source):

<http://c2.com/cgi/wiki?AlanKaysReadingList>

<http://www.squeakland.org/resources/books/readingList.jsp>

<comment><AUTHOR> Thanks. Your links are much better than the one I posted.</comment></comment>


Creating The Perfect GPG Keypair - <AUTHOR> https://alexcabal.com/creating-the-perfect-gpg-keypair/ <comment><USER3> The thing that jeopardizes 2048 bit RSA keys is probably going to make all of RSA untenably risky. By all means, generate a 4096 bit key; it doesn't really cost you anything in a GPG setting. But the default is fine.

</comment><comment><USER4> I think the one thing that I got from this article is that GPG is basically unusable by anyone who doesn't have cryptography as a hobby.

</comment><comment><USER5> This entire blog post is an indictment on the sad state of affairs surrounding UX around crypto. There's so much intrinsic complexity around proper crypto that the focus should be on removing as much accidental complexity as possible.

<comment><USER6> Yesterday, I installed GPGMail on my Mac and had it generate a keypair, and the procedure was actually rather pleasant and clear. I did not know yet about this master- and subkey scenario, and the setup wizard did not offer this option, but I think the UI could be extended to support this without too much extra hassle.

</comment></comment><comment><USER7> Long-lived keys should not be unprotected in memory/execution environment of general purpose hosts.

I'd take an RSA 2048 smartcard before an RSA 4096 on my Mac.

<comment><USER8> Where can you get a trustworthy smartcard?

<comment><USER9> Can't comment on trustworthiness but Kernel Concepts sells a nice OpenPGP smartcard developed by Werner Koch, the GnuPG guy.

[http://shop.kernelconcepts.de/product_info.php?products_id=4...](http://shop.kernelconcepts.de/product_info.php?products_id=42)

<comment><USER7> I like those, but I really really want something which can do bt 4.0le with an existing pairing (stronger than just bluetooth 4.0 le security, though) between my host (ideally, mac/win/linux desktop/laptops, also phones) and the device, with some level of on-device logging, access control, etc.

A type 2 pinpad + openpgp smartcard might be the best practical thing right now -- a PIN on the card, plus a passphrase from the host (I think you can require both?). Type 3 showing a hash of what you sign, or a serial number of number of signs, would be even better.

The GPF cryptostick (usb) is also nice -- I think you could also take the Werner smartcard and cut it down to a smaller size for a USB stick sized reader. Sadly GPF stick 1.2 is out of stock everywhere.

<comment><USER9> Yeah, Kernel Concepts sells the OpenPGP card in a SIM breakout style too.

I really wanted the CryptoStick, looks like they're temporarily about of stock pending the new 2.0 revision, but not holding my breath.

<comment><USER7> Yeah, I guess I just don't trust smartcards all that much from a hardware security perspective, vs. modules with battery inside a metal envelope. I'm sad Maxim/DS killed the Crypto iButton line -- it was a great compromise between smartcard cost ($20-30) and HSM physical security. The software was never great, though.

</comment></comment></comment></comment></comment></comment><comment><USER10> well, yeah, people just --gen-key and that's it. using subkeys is probably a good idea. using expiration properly is certainly a good idea. understanding gpg's trust structure sounds like a good idea.

However, even this guide is probably a little too long, and unfortunately many will not take the time to read it.

Oh yeah also the primary key is called, well, primary, not master. I do that mistake pretty often tho.

</comment><comment><USER11> What if I have a gpg smartcard and want to create subkeys to use on specific devices?

For example, I might want to have the ability to sigh messages on an ipad, and revoke the keyif the device is stolen.

</comment><comment><USER12> Ok implementing this I realized the obvious flaw: you can't use this key to sign other keys. And I can find no way to configure a subkey in GPG to do this (I suppose it might exist, GPG is dark and mysterious).

Surely, _surely_ it would be easier to just make two keypairs, store the master and then sign your "daily driver" key? This seems like a lot of effort making gpg do things it doesn't want to do for little practical gain - <USER2> full perfect key is still ideally offline.

</comment><comment><USER13> Lately there have been a few discussions about PGP keys and smartcards are always mentioned. Would smartcards be a solution for the client-side crypto objections? Could you make a secure version of cryptocat by just making it a wrapper around a smartcard reader? Could you use a smartcard to make secure use of PGP in webmail feasible?

</comment><comment><USER14> A waste of time. You should be using a strong passphrase so that it doesn't matter if your laptop is stolen.

We all use osx though so if any of us become high-value targets they'll just root our machines remotely with the help of Apple software update and steal our keys from ram or log our keystrokes directly.

<comment><USER12> The problem with a strong passphrase is remembering it and entering it quickly. I can keep a few 12-14 characters passwords in my head, but that's about it.

I like the concept of passphrases, but they're too long to be manageable when you need to type them in a bunch of times.

<comment><USER15> GPGTools ([https://gpgtools.org/](https://gpgtools.org/)) can store your passphrase in the OSX keychain. It comes with GPGMail for Mail.app, which makes it very easy to encrypt email.

<comment><USER14> Gpgmail encrypts to keys with zero trust. This is dangerous.

There is also no way to verify that the OSX keychain does not perform key escrow, as it is closed source.

</comment></comment></comment></comment><comment><USER6> The article basically assumes that passphrases are are very easy to break. Is this indeed true?

</comment><comment><USER16> Is primary/subkey idea the same thing as private CA (conceptually)?

<comment><USER17> It's the same thing of root/intermediate TLS certificates. You basically store the root in the safe and keep the intermediate online, so you can use it sign stuff (eg: generate certificates for customers' domains). If the intermediate is compromised, you revoke it, get the root and generate a new intermediate.

</comment></comment><comment><USER18> Just encrypt your laptop hdd?</comment>


Pricing on usage vs. Pricing per seat - <AUTHOR> http://gaglers.com/blog/2013/03/29/live-chat-software-unlimited-agents/

<comment><USER2> The reason that people prefer per-seat is because humans historically have a great fear large downsides. Paying per-seat is a form of insurance - I know I'm paying a premium but I won't get any shocks that the end of the month.

<comment><USER3> The point about having a fixed upfront cost/ceiling is valid. This is the reason why we have pricing plans with a fixed cost based on the customer's estimation of their usage. If you signup for a $19 plan, you will not be charged more than $19 per month.

Companies are able to roughly estimate their monthly conversations based on the number of conversations they have in a day. After this estimation if the number of conversations exceed their monthly limit, we currently do not prevent the extra conversations or charge the customers more.

We hope to have a open conversation with our customers who consistently exceed their limit and figure out the right model for the customer. The underlying philosophy about our pricing is, we want help our customers succeed by enabling their support and sales conversations, and not be a barrier ourselves.

</comment></comment><comment><USER4> A bit of a fluff piece just promoting Gaglers, but the underlying assertion is worth thinking about. A per-seat license model has definitely pushed me away from certain products, while a pure usage model is much more appealing to me.

</comment><comment><USER5> A fixed price would give peace of mind to someone like me. A pay as you go plan would just increase the uncertainty. I would always choose a fixed price plan, unless the cost saving with the pay as you go plan would be significantly lower given the average number of chats that would happen on my site.

<comment><USER3> For a small 4-6 people team, a comparable product will cost you about $100. Even if you have 10 chat conversations a day, it will cost only about $19 for all the team members to participate using Gaglers.

We think encouraging more team members to participate in the conversations gives the company lot of good karma with your customers as well.

</comment></comment><comment><USER6> By the same argument, Gaglers encourages their users to give curt, limited support to the public, since every interaction has marginal cost.

I'd rather have an extended conversation with a dedicated support rep, then a 1-line brush off from the CEO.

<comment><USER3> Hi, co-founder of Gaglers here. A chat conversation can have any number of messages of any arbitrary length.</comment></comment>


Show HN: Stallman Bot – The Interjecting Slack Hubot Integration - <AUTHOR> https://github.com/interwho/stallman-bot <comment><AUTHOR> Based on the Stallman on Steroids bot from /g/, stallman bot will interject on trigger words from the FSF Words to Avoid list.

This was made as a joke.</comment>


A website that will be built on top of user requests - <AUTHOR> https://userbricks.com/ <comment><AUTHOR> I built an experimental website that aims to build a website completely by user requests from scratch.

Brick is a request/feature that represents you want to put some feature on the website. You can bring a brick to change the text colour, typography or background image. Even you can put a brick that could be your cat picture!</comment>


A primer on Elixir Stream - <AUTHOR> http://www.activesphere.com/blog/2017/11/28/stream <comment><USER2> I just started using Phoenix and Elixir and so far I'm loving it. It's so easy to implement all these async flows.

</comment><comment><USER3> In case you're wondering how to merge streams, the functions `zip` and `concat` are 2 examples.

</comment><comment><USER4> This is a great write up. The diagrams to visualize the flow as really helpful. Well done.</comment>


Levchin Prizes: Joan Daemen (AES and SHA-3) and Moxie Marlinspike and Trevor Perrin - <AUTHOR> https://twitter.com/RealWorldCrypto/status/816693302397378560 <comment><USER2> Congrats!

Probably this crowd already knows about Daemen for AES and Moxie from Signal and NYTimes and his HN comments here. Trevor Perrin might not be as familiar of a name, but it should be. He's responsible for much of the meaty crypto underlying the Signal Protocol, and his most recent project, Noise [1], is a real marvel. A prize well deserved.

[1] [http://noiseprotocol.org/](http://noiseprotocol.org/)

</comment><comment><USER3> This prize is awarded at the Real World Crypto conference, which has become a pretty big deal. RWC is unlike normal academic crypto conferences in that it hosts practical engineering work and case studies from people deploying crypto --- but the attendance list includes many leading people in the academic field.

Last year's Levchin winners were Phil Rogaway (a cryptographer of fame comparable to that of Joan Daemen) and the miTLS team (which discovered the Triple Handshake, SMACK, FREAK, Logjam, and SLOTH TLS attacks).

<comment><USER4> For those of us unaware, the Levchin the prize is named after is famous for...?

<comment><USER3> ... is Max Levchin, of Paypal fame.

<comment><USER4> for some reason I thought there would be more story.

<comment><USER3> He likes cryptography and once had dinner with Dan Boneh and they decided to start an award for crypto contributions.

I think? that's the whole story.

<comment><USER5> Who is on the committee that decides who gets the prize?

<comment><USER3> Dan Boneh, Aggelos Kiayias, Brian LaMacchia, Kenny Paterson, Tom Ristenpart, Tom Shrimpton, and Nigel Smart.

(A pretty intense group).</comment></comment></comment></comment></comment></comment></comment>


Excuse Generator for Data Breaches - <AUTHOR> http://whythefuckwasibreached.com/ <comment><USER2> Brilliant. Mentioned in [https://www.vice.com/en_us/article/xwe3m4/this- website-has-s...](https://www.vice.com/en_us/article/xwe3m4/this-website-has- solved-cybersecurity)</comment>


CNN covers SOPA on homepage - <AUTHOR> http://www.cnn.com/2012/01/06/tech/web/sopa-web-piracy-act/index.html?hpt=hp_c1

<comment><USER2> So much effort on tackling SOPA. Three months later, there's a bill titled Stop Online Child Pornography. Then there's a lot of PR issues.

The companies should be demanding Internet Freedom bills to replace SOPA, DMCA, PROTECT-IP, COICA, CEST, OPENA, ACTA and more.

Take the fight back against the anti-Internet companies in the war against the Internet.

<comment><USER3> New laws take precedence over old laws. A hypothetical "Stop Online Child Pornography" act could trivially undo any internet freedom law.

<comment><USER2> If that's true, a hypothetical "Protect Children's Internet Future" act could trivially undo any anti-Internet law too.

</comment></comment></comment><comment><USER4> "At stake, say supporters, are American jobs. Every free piece of content scraped to be sold, or given away, online takes money out of the pockets of record companies, movie producers and other content creators and their millions of employees. Pharmaceutical companies, sports leagues and video-game makers have also voiced support. "Especially in this time of economic recovery, we cannot stand by and watch while American companies and the jobs they support are being bled by foreign criminals who are taking advantage of a massive loophole in our law enforcement capabilities," wrote Steve Tepp, who works on counterfeiting and piracy issues for the U.S. Chamber of Commerce. "These illicit enterprises are not tolerated in the brick and mortar marketplace, so why would we allow them to flourish unchecked online?""

Rhetoric of SOPA supporters > Rhetoric of SOPA detractors, when it comes to winning public support. The message needs to be streamlined...

</comment><comment><USER5> CNN, owned by Turner Broadcasting, owned by Time Warner, which supports SOPA.

</comment><comment><USER6> It's not mentioned in the article, but CNN has a dog in this fight with their iReport service. They receive and post a lot of user-generated content nowadays.

<comment><USER7> This is true to some extent or another for almost all of the major news sites. Even if they just have comments, they're aren't offering them out of the goodness of their hearts, it's because it's a cheap way to boost impressions, sometimes dramatically. (At least, this is why they existed when I worked for one of them.)

</comment></comment><comment><USER8> Screenshot: <http://i.imgur.com/9CfwQ.png>

</comment><comment><USER9> I am opposed to SOPA in the strongest sense possible coming from a nation where majority of internet users cannot afford content(music, software) at market prices let alone afford a good internet connection.

Was watching the president of the Motion Picture Association of America talk on Bloomberg West about their reasons for supporting SOPA and why SOPA is important and that guy(and those like him) is good at what he does. Those opposed to SOPA for now have confined the fight to blogs and videos on Youtube but we need to take the fight where it matters, to Washington and sway those who should be swayed to stop this thing.

Not an American citizen but american tech companies opposed to this should be talking to their lobbyists and not just posting statements on their sites

</comment><comment><USER10> Related discussion on reddit: [http://www.reddit.com/r/AskReddit/comments/o6ymp/reddit_user...](http://www.reddit.com/r/AskReddit/comments/o6ymp/reddit_users_how_would_you_feel_if_the_site_went/c3exjq4?context=3)

</comment><comment><USER11> If SOPA would increase your business income by 10 times, would you accept it then?

<comment><USER12> Except that it won't. An almost insignificantly small industry has an outrageous amount of influence compared to the industries that actually make real money and jobs in the US.

<comment><USER11> Just imagine what it would be like to make 10 times more money from iOS development say. Wouldn't you like that?

<comment><USER13> Never. I can't even imagine wanting to sell my freedom.

EDIT: I'm not sure why you would like it, either, given that the iOS games in your profile appear to be derivatives of more popular ones. If some legal department felt that you crossed the line somewhere in one of those games, you could have all your accounts suspended. That's not 10x the profit, that's 10x the risk.

<comment><USER11> I'm quite satisfied with my DropZap game in terms of originality.

<comment><USER13> I personally don't have any problem with your games, but you and I aren't the people who have to be satisfied. Your competitor's legal departments are.

There's plenty of precedent for overzealous legal departments sending out baseless legal threats already. Under SOPA, they get to shut you down right away, then leave you to clean up the resulting mess.</comment></comment></comment></comment></comment></comment>


Mystery of Glenn Seaborg's Missing Plutonium Solved - <AUTHOR> https://medium.com/the-physics-arxiv-blog/the-mystery-of-glenn-seaborgs-missing-plutonium-solved-d65f772f0111

<comment><USER2> "in cyclotron's at"...

who proofreads this?

<comment><USER3> We, the poor readers do.

There's also "That's important evidence about the samples likely origin."</comment></comment>


What forces layout/reflow in Chrome - <AUTHOR> https://gist.github.com/paulirish/5d52fb081b3570c81e3a <comment><USER2> And are none of them cached? If I go

        var w = element.clientWidth;
        var h = element.clientHeight;

Is that 2 reflows or 1?

        var w1 = element1.clientWidth;
        var h1 = element1.clientHeight;
        var w2 = element2.clientWidth;
        var h2 = element2.clientHeight;

Is this 4 reflows, 2, or 1?

\---

reading this article ([https://developers.google.com/web/fundamentals/performance/r...](https://developers.google.com/web/fundamentals/performance/rendering/avoid- large-complex-layouts-and-layout-thrashing?hl=en)) it sounds like it's 0 reflows if nothing has changed. In other words it's all cached

<comment><USER3> They cause immediate reflow only if the DOM is dirty. In both cases it'd be a maximum of 1.

This'd be 2:

        element.textContent = 'omg';
        var w = element.clientWidth;
        elem.classList.add('ok');
        var h = element.clientHeight;

<comment><USER4> And it's especially bad if you interleave them all:

      var heights = lotsOfElements.map(function(el){
        el.classList.add('ok');
        return el.clientHeight;
      });

Better is to batch the DOM updates and reads, where you can:

      lotsOfElements.forEach(function(el){
        el.classList.add('ok');
      });
      var heights = lotsOfElements.map(function(el){
       return el.clientHeight;
      });

</comment></comment></comment><comment><USER5> Speaking about reflow, I'm wondering: if I have a piece of text that contains multiple paragraphs, and I change a single character in the text, will Chrome recompute the layout for all paragraphs? Is changing a character a O(1) operation w.r.t. the number of paragraphs?

<comment><USER3> Just tried this out and the answer is yes. All subsequent elements will have layout recomputed. There is some room for optimization here (evaluate if the flow content requires new text-wrapping across lineboxes), but luckily these layouts are quite fast.

Establishing containers as layout roots (generally fixed height/width and overflow:hidden) will constrain these sorts of costs.

</comment></comment><comment><USER6> One related thing that's caused me some grief is that in Chrome, the cost of a layout is O(n) in the number of hidden elements; so if there's a large number of DOM nodes hidden inside a node with display:none, they still slow down reflows.

<comment><USER3> Somewhat. "Reflow" is typically what we call forced 1) Style Recalc and 2) Layout. Any hidden DOM elements have zero cost during Layout, as they are absent in the LayoutTree. However they can contribute to recalc, just while the browser confirms that they are still display:none.

</comment></comment><comment><USER7> Sounds like a ripe opportunity to write browser and implementation-specific JavaScript instead of trying to solve real world problems in a readable and reusable manner.

This would be more interesting if it wasn't specific to Chrome only, but looked at the web at large. Maybe specs/things like this could be extended to be part of the standard instead?

<comment><USER8> Aren't all of those properties/methods standardized to query something about the document that require it to be laid out? What do you think the standards are lacking here?

<comment><USER7> It may have been some of a gut-reaction on my part (and I'm willing to admit that), but my main gripe with documents like this is that at the moment tons of web-developers are targeting Chrome only.

When something breaks in Firefox, Safari, Vivaldi, Edge or other browsers (because obviously it was never tested outside Chrome) their answer is usually "Just use Chrome".

This is now not only happening at amateur-hour shows and quick Github POCs, but also at official products from big names like Google.

Basically "This website best viewed in Chrome". Haven't we already been there? We saw how that worked out, didn't we?

That sort of attitude is not healthy for the web at large, and documents like this will (IMO) further entrench that attitude, rather than the opposite.

<comment><USER9> >at the moment tons of web-developers are targeting Chrome only.

I'm a web developer and, in my 11 years of doing this, the only people I've ever seen do that are those experimenting with a new feature that only works in Chrome or rank amateurs.

Knowledgeable web developers write code to standards, not browsers.

<comment><USER10> > Knowledgeable web developers write code to standards, not browsers.

Really? I certainly don't try and work out how the spec says the document should render — I trust if browsers interoperably render the document the same, that's what the spec says. And I'm not someone scared of specs, having contributed to them for years and worked on browsers for years.

<comment><USER9> Yes, really.

You're saying the same thing I am, Geoffrey. Sort of. I expect browsers to render the same way as the spec says it should. I then verify in each browser. When they don't, I adjust, but I never write code, only test in ... Opera ..., and expect it to be identical everywhere. I don't only read the ... Opera ... blogs and specs and expect it all to work the same all the time.

</comment></comment></comment></comment></comment></comment><comment><USER11> I needed to know these "implementation details" between css layout and javascript also regarding css transitions: [http://stackoverflow.com/questions/12088819/css- transitions-...](http://stackoverflow.com/questions/12088819/css-transitions- on-new-elements)

tldr: you can "fade in" a new element only if you trigger a reflow at the right moment

</comment><comment><USER12> Note that in Servo a lot of reflows can be done off the main thread, not synchronously. Don't take this list as something that will be true for all time.

Even if the APIs in question require synchronous reflows now because they return some data, it may be possible to introduce new APIs that receive the data in a callback. (The usefulness of these APIs depends on the engine having support for off main thread layout, of course.)

<comment><USER3> Yes! This has me quite excited about Servo. Chrome is interested in async APIs for these as well.

Random aside: Dart's DOM originally offered these properties only as async but developers were unhappy with the ergonomics so Dart ended up delivering the sync APIs. :/

<comment><USER13> If Dart had async/await from the start I bet the async-only APIs would have been better received.

<comment><USER3> True dat.

</comment></comment></comment></comment><comment><USER14> For specifics on which CSS properties affect layout, see csstriggers.com .

</comment><comment><USER15> Funny, Chrome uses Blink for rendering and the article talks about WebKit.

<comment><USER16> Blink is a fork of WebKit and still behaves largely the same. Chrome really hasn't done a whole lot to the underlying layout/reflow logic...yet.

</comment></comment><comment><USER15> Funny, Chrome uses link for rendering and the article talks about WebKit.</comment>


Intel Announces 8 Core I9-9900KS: Every Core at 5Ghz, All the Time - <AUTHOR> https://www.anandtech.com/show/14402/intel-announces-5-ghz-all-core-turbo-cpu <comment><USER2> I used to be Pro Anandtech and consider them one of the best Sources online for Hardware News. But the fact they have yet write a single post, big or small about Intel's Zombieload and its implication on performance worries me a bit.

Then there is the "Intel" benchmarks as usual [1] on GPU. Trying to suggest the 2 CPU were both running at 25W TDP to give a "fair" comparison, without mentioning the Ice-Lake U CPU were running with 50% more memory bandwidth vs the AMD Ryzen. And we know Graphics Benchmarks do depend a lot on memory bandwidth. The memory used was somehow mentioned in Toms or Other Sites but not Anandtech. ( Although none of them had mentioned the bandwidth difference, it was up to the reader to work them out )

Anyway none of these Consumer CPU upgrade interest me anymore ( Although any improvement to iGPU would be great ) I am eagerly waiting for a 2S - 128 Core EPYC 2 on a Server or AWS to play around with it.

[1] [https://www.anandtech.com/show/14405/intel-teases-ice- lake-i...](https://www.anandtech.com/show/14405/intel-teases-ice-lake- integrated-graphics-performance)

Edit: And the lesson here, never trust a single news source. Always have a few option opened and fact check yourself. ( If you have the time )

<comment><USER3> It's not just Anandtech.

I feel like the entire "PC enthusiast" review space has dropped the ball on hardware vulnerabilities. Reevaluating performance between microcode and OS patches is an afterthought, and when a new CPU hits the market the numbers are presented without the obvious disclaimer that these performance gains may evaporate within months.

Some even perpetuate the "only relevant to datacenter" myth despite the fact that security researchers have shown to be able to exploit these vulnerabilities with JavaScript in the browser.

<comment><USER4> I'm glad the PC enthusiast space hasn't succumbed to the wild hysteria caused elsewhere by the side channel issues. It's tiresome to see every new variation people come up with reported as a new apocalypse all over again. Half the reason I still pay attention is to find if there's a new Linux boot switch I need to turn on to disable some new performance regression.

Even though I'm personally in the fortunate position not to have any reasonable exposure to these vulnerabilities, I wouldn't be particularly worried even if this wasn't the case. It's been well over a year since Meltdown and Spectre came out and there still hasn't been a single case of anyone successfully using these vulnerabilities to productive ends in the wild that I know of. Obviously, cloud computing vendors need to pay attention and there are legitimate business concerns that are affected by this, but insofar as personal computing goes? If people persist in the ridiculous notion that constantly running completely arbitrary code in naive sandboxes is a great idea, I imagine there will eventually be issues, but so far the issue seems to be vastly overblown in the popular media.

<comment><USER3> I don't see how the act of taking and publishing measurements after microcode and OS updates constitutes hysteria. It's my understanding, at least on Windows, you pretty much have to opt-out of these patches or manually install an update that disables the mitigations.

I fully support a users right to bypass these mitigations, and you're correct that your typical desktop user, at least today, isn't a target. But it seems odd that websites dedicated to performance computing have a blindspot to how automatically installed updates will impact performance.

<comment><USER5> > I don't see how the act of taking and publishing measurements after > microcode and OS updates constitutes hysteria.

It's quite easy to sensationalize benchmark results even unintentionally. The average reader of PC hardware review sites is totally willing to latch on to a microbenchmark result that shows a 20% performance drop and claim that it's disastrous for performance, even if the actual added delay to real-world operations is a fraction of a millisecond and thus will almost never cause the result of your user input to be delayed by even a single frame. There's a certain degree of irresponsibility in publishing results that you know will be taken out of context by almost everyone who reads them. I've discontinued benchmarks in the past because it was frustrating seeing readers pretend like they show a meaningful difference between products when the reader's workload never comes close to the workload represented by that benchmark.

<comment><USER6> Did you just make an argument against PC review sites publishing any benchmarks at all because readers can't be trusted to interpret them correctly?

That would kind of defeat the point.

If they published a benchmark in the past and don't bother to correct the benchmark when it becomes out of sync with reality - that is just bad journalism.

Nobody is saying you should go and cherry-pick benchmarks after the mitigations hit, but you should definitely check the benchmarks you already published once.

These sites can and should expect an informed reader.

In any case: Leaving wrong information up uncontested helps neither "experts" nor laymen.

<comment><USER5> > Did you just make an argument against PC review sites publishing any > benchmarks at all because readers can't be trusted to interpret them > correctly?

No, and you should know better.

> If they published a benchmark in the past and don't bother to correct the > benchmark when it becomes out of sync with reality - that is just bad > journalism.

Proper practice is to publish the full test conditions, including software, firmware and nowadays also microcode versions. The availability of newer versions does not make older results any less true.

At AnandTech, we make all reasonable attempts to keep a thorough database of older hardware tested on newer benchmark suites, but the time this requires means we cannot re-test everything multiple times per year. I have over 200 SSDs and counting in the collection, and that test suite is over 30 hours long. The collection of CPUs is much larger. GPU reviews typically have fewer back-catalog hardware entries because updating to new drivers a few times a year is often unavoidable. You can browse the results for current and previous test suites at [https://www.anandtech.com/bench/](https://www.anandtech.com/bench/)

> These sites can and should expect an informed reader.

You don't read the comments as often as we do.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Intel has fallen so far. It's honestly a shame to watch at this point.

I remember back when Sandy Bridge was first released, and I was extremely pleased by the performance improvements my new chip was able to provide. Did they really manage to mess everything up within such a limited timespan? Or was there just always a hidden incompetence that never showed itself until now?

<comment><USER8> It's not Intel, it's the end of Moore's law. Intel's problem is that they are not well positioned to capitalize on the specialized processors that will be required to continue ekeing out advances for the next decade or two before we're entirely up a creek. :)

<comment><USER7> From how Apple and AMD are doing with their own processors though, it seems like Intel is just fundamentally doing worse even as things become more difficult with smaller transistor sizes. Apple is going to replace Intel with their own processors because Intel has failed to meet requirements. AMD, with a shoestring budget basically on the verge of bankruptcy the entire time they were doing their R&D, managed to build out a new architecture that has provided amazing results while Intel has basically had nothing to show in the same time.

But perhaps there's something I'm missing here. Is there a misconception or lack of information here on my end that needs to be clarified? I can only make my analysis largely as an outsider looking in when talking about semiconductors.

<comment><USER8> Intel was ahead, and hit the wall first. Apple & AMD are not ahead, they're just catching up. I don't want to understate how big a problem that could be for Intel, of course. But they're also doing it on low margin parts, and Intel continues to make bank with their data center parts.

I don't think any of this represents a short-term problem for Intel, other than the general downturn in processor sales because fewer people will need to upgrade. But I think it represents a very serious long-term threat.

They have some really cool technical advances, like 3D xpoint. But I'm concerned that they do so badly on embedded and custom integration from a long-term perspective.

<comment><USER9> Apple sold millions of iPhones with 7nm chips while Intel struggles to build comparable 10nm chips and keeps releasing 14+++ nm. AMD will release 7nm chips very soon. It does not seem like they are catching up. Quite the opposite.

<comment><USER10> You can't compare nm between vendors - it's just marketing numbers.

<comment><USER11> Not directly no, but the actual feature size and density of TSMC 7nm and Intel 10nm are comparable.

<comment><USER12> What about die size?

<comment><USER5> Then you have to ensure you're comparing chips designed for the same market segment. Die size comparisons work well if you're talking about a Cortex-A53 on 16nm vs 12nm. It doesn't work as well when you're talking about a full SoC, or even a desktop CPU+GPU combo where core counts for both sides of the chip can vary greatly.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Should they be describing it as 8 cores 16 threads when there have been multiple security vulnerabilities that have to turn off hyperthreading to be mitigated?

<comment><USER14> Besides cloud providers running VMs /containers on the cloud, is Spectre/Meltdown really such an issue for day-to-day consumers ?

<comment><USER15> Yes. I think this is a common misconception.

These attacks work fine in the browser, as researchers continue to show. They allow complete bypass of any native app sandboxing layers. Surely you don't run everything on your box as root all the time.

<comment><USER16> I'll keep HT on because I use NoScript and I encourage others to do the same.

<comment><USER17> Meh. It doesn't require Javascript for your computer to run logic described by others. Browsers are such complex machines that it wouldn't surprise me if you could for example craft a malicious SVG that would bypass that, or a turing- complete CSS file that triggers a vulnerability...

By the way, does NoScript actually block in-SVG javascript?

<comment><USER18> Sure, but we all take risks every day. If you're worring about turning- complete CSS files exploiting Spectre and Meltdown then you probably don't leave the house much.

<comment><USER19> We _know_ that attackers have reason to exploit literally all compute resources they can find a way to access. This is more like worrying about leaving the house during an epidemic of exploding ebola-infected pigeons — if you can do something about it, you should.

<comment><USER18> Attackers also have to consider cost/benefit analysis when evaluating methods of attack. Claims that "CSS is Turing complete" require a user to act as a "crank" [0], so there are lower-hanging fruit out there than trying to program complicated logic which can utilize the Meltdown / Spectre exploits in CSS.

[0] [https://news.ycombinator.com/item?id=10734966](https://news.ycombinator.com/item?id=10734966)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> I don't get it. If it has an all-core frequency of 5GHz, doesn't that mean they've left some single-core boost on the table? Or have they hit some other limit and this part is basically free of thermal limits?

<comment><USER21> I believe Intel processors can't boost all cores. At least some tests I have done with my notebook processor (i7 8550u - 4c8t) with `stress -c n`, being n the number of processors, show that for n > 1 the processor doesn't reach 4ghz, only about 3.7ghz, while the package temps are still at around 70 °C. Only a single core on full load reaches 4ghz before throttling.

<comment><USER22> > I believe Intel processors can't boost all cores.

And that's exactly what shereadsthenews's point is. They can't boost all cores, and they are not boosting _any_ core beyond the all-core capacity if it's truly a CPU that runs at 5 GHz all the time.

<comment><USER23> Turbo Boost can certainly apply to all cores- the limits you hit are TDP and time based, there, not strictly thermal.

So, for example, my old laptop CPU would clock itself up to 2.7GHz on all cores... well, okay, it was a dual core, so that's not saying much, but still. But it'd only maintain that boost for a few seconds- under sustained load it dropped down to 2.5. This wasn't because of thermals, but rather because 2.7GHz was a Turbo Boost frequency, and once the PPL timer runs out...

<comment><USER23> And to explain why they don't have, say, one core boost to 5.1GHz...well, let's see what siliconlottery says.

> As of 3/16/19, the top 38% of tested 9900Ks were able to hit 5.0GHz or > greater.

> As of 3/16/19, the top 8% of tested 9900Ks were able to hit 5.1GHz or > greater.

So, Intel'd cut their yield by more than a factor of four if they only let parts that could hit 5.1 into this bin. For a 2% single-core performance boost...

<comment><USER24> I think those numbers are for chips that can 5.1 GHz all core though, which is probably a lot less than 5.1 GHz single core.

<comment><USER23> As far as I know, K-series parts don't support binning of individual cores- if you have one bad core that'll only hit 5.0, 1-core turbo to 5.1 will still result in the OS scheduler periodically picking that core to use, it clocking up to 5.1, and problems resulting.

Might be wrong, though.

<comment><USER5> Intel's Turbo Boost 3.0 [1] was their attempt to take advantage of the fact that some cores on a chip can clock higher than others. It does not work well in practice, because it requires too much collaboration with motherboard and OS vendors. This feature is not available on their desktop platform, which the i9-9900KS uses.

[1] [https://www.intel.com/content/www/us/en/architecture-and- tec...](https://www.intel.com/content/www/us/en/architecture-and- technology/turbo-boost/turbo-boost-max-technology.html)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Some of the 9900K chips are able to push 5.2Ghz, this is not a proper answer to the AMD's new lineup

<comment><USER26> I have one constantly pushing 5.1Ghz (disabled speedstep etc. been stable for months). I bought it because there was no comparable AMD cpu and as far as I know AMD is still behind. Why do you think it is not a proper answer?

<comment><USER22> I think by AMD's new lineup they're referring to Ryzen 3000 series, which isn't out yet. If the rumors are true, the top models come with 12 to 16 cores, higher IPC and higher clocks than the current Zens, pushing 5GHz boost.

A current 9900K might be some 20%-30% faster than a current Zen, but it will no longer be so when with the new lineup.

Meanwhile mitigations are eating up Intel's performance advantage..

<comment><USER26> I saw some leaked benchmarks today and it doesn't look great. I really hope AMD will kick the Intel (I even have Ryzen 1800x too and will buy the new 16 core one), but I need fastest possible single core performance and by the look of it at best it will be the same. But AMD has other problems like huge DPC latency, which makes it difficult to use for real time computations. If Ryzen happens to have the same single core speed as 5Ghz 9900k and pack 16 cores capable of delivering it each, I'll swap my Intel in no time.

</comment></comment></comment></comment><comment><USER27> Still marketing SMT. Interesting move.

<comment><USER28> Desperate, is what they are.

</comment></comment><comment><USER29> Why 5 Hz all the time? I'd love to have such an extremely powerful CPU but I'd actually appreciate if it could downclock itself automatically and stay as cold as possible whenever I don't need it's full power. Some times I run heavy computations and having 8 5Hz cores sounds great but most of the time I just read or write something so even 1000 Hz sounds an overkill.

<comment><USER30> Base frequency isn't the same as lowest frequency (ya... it's weird). Base frequency is vaguely related to the idea that if you had all cores running at the base frequency, you would run just about at the system's TDP (it's really a complete mess, this is a simplification). Your system can still drop CPU cores down to 400-800MHz in low energy states.

What this announcement is basically saying is that Intel now has a 8 core chip where all 8 cores can run at 5GHz indefinitely "out of the box".

<comment><USER9> According to siliconlottery.com 38% of 9900K are overclockable to 5 GHz. Probably they just decided to select good chips from 9900K at factory, those not exactly new chips.

<comment><USER31> That's mentioned in the article: "The new Core i9-9900KS uses the same silicon currently in the i9-9900K, but selectively binned in order to achieve 5.0 GHz on every core, all of the time."

</comment></comment></comment></comment><comment><USER32> Most 9900K can hit 5.0 all core OC for non-AVX loads.

With AVX 4.8-4.9 is still doable without hitting the top 30% of CPUs in the CPU lottery.

My 9900K does 5.1 without any AVX offset but this is a top 10-20% CPU if the figures form Silicon Lottery are to be believed.

So it's not that surprising Intel can simply bin CPUs to do 5.0 at near stock voltages since many resellers have been doing just that.

<comment><USER33> What does that spell for regular 9900K then?

<comment><USER32> Nothing if you don't care about AVX workloads you can get a 9900K and set it to 5.0ghz with an AVX offset of 2 pretty much out of the box.

Unless the KS would guarantee a 5.3-5.4 all core OC I don't see it being anything more than a PR release anyhow.

That said I'm not even sure if the 9900KS doesn't come with an AVX offset to begin with most higher end motherboards come with a 9900K 5.0 preset anyhow which sets the voltage to about 1.3-1.325 and an AVX offset of 3 it just yells at you that you need a good cooling solution and this is not guaranteed to work.

</comment></comment></comment><comment><USER34> I am likely the odd one out here, but wouldn't having the capability to turbo a single core to, let's say, 5.5 GHz or higher as factory stock be more useful in real life than the one or all eight core turbo to 5 GHz instead of 4.7? There are still enough single core/single thread apps out there that could benefit from faster single core performance, and this newest and hottest (also in temperature) i9 cannot go faster in single core than the 9900K.

</comment><comment><USER26> I have 9900k binned for 5.1Ghz all core. Absolutely brilliant CPU. I wish there was 16 core version though.

<comment><USER35> What's the power usage on that? I could imagine the heat from it keeping your home warm on a cold winter's night.

<comment><USER26> I didn't measure. It is not too hot. I am typically getting 50-65 C under my workloads.

<comment><USER26> I forgot to add - it's been delidded. Crazy I know.

<comment><USER36> Woah, what do you use it for?

<comment><USER26> Ableton :-)

</comment></comment></comment></comment></comment></comment><comment><USER37> Is it going to be that much faster? 300mhz faster than the current top one according to the article.

<comment><USER23> And the speed of my overclocked 9700K. If anything, this is just a "Hey, some people can cool an 8-core CPU at 5GHz, let's make a new bin for the 40% of CPUs that can maintain that" release.

</comment></comment><comment><USER38> I wonder how much of that power will be eaten by spectre et.al mitigations.

</comment><comment><USER39> From an interesting historical perspective, I mark the end of Moore's Law in 2001 with Intel's prediction of a 5GHz "Netburst" in 2005, which could not keep itself from melting. Somewhere I have a marketing road map of 5GHz in 2005, 10GHz in 2010. It was aspirational of course, but seeing what had to happen between then and now in order to get a chip that runs at 5GHz all the time based on their architecture is illuminating of the challenges they face.

<comment><USER40> That's an overexaggeration, IMO. Moore's law didn't really start losing steam until 2014-2015.

<comment><USER41> If you look at transistor count, yes. But single-core performance has stagnated since ~2003, that's when we hit the 3Ghz mark. Progress since then has been a lot slower.

<comment><USER40> GHz are basically meaningless. The 2GHz CPU in my laptop is an order of magnitude faster than anything 3GHz from 2003.

<comment><USER41> True for practical uses, most of the performance increase comes from more bandwidth and parallelism. But it's a mere 2-4x increase for single-thread performance, over 15+ years: [https://preshing.com/images/integer- perf.png](https://preshing.com/images/integer-perf.png)

</comment></comment></comment></comment></comment><comment><USER42> So as I understand it, this isn't new silicon, it's just binning the existing 9900K and if you wanted an overclock 9900K you would have just gone to Ciara who obviously bin and overclock and verify their systems anyway. So now you go to Ciara and Ciara go to Intel and buy a 9900KS instead of previously where you would go to Ciara they would go to Intel and buy a 5 9900K's and find the one that would've been as fast as the 9900KS anyway.

</comment><comment><USER43> 8-core processor that will run at 5.0 GHz during single core workloads and multi-core workloads."

Under full AVX workloads using Intel stock cooler?

Highly doubt it.

</comment><comment><USER44> Is that a typo on the table or do those CPUs really cost the same whether they have an integrated GPU or not?

<comment><USER5> Those numbers are Intel's "Recommended Customer Price", not actual retail prices. The -F parts really are listed with the same RCP as the parts with GPUs enabled. No, it doesn't make much sense, but Intel _has_ been experiencing a CPU manufacturing crunch, and the desktop market gets the short end of the stick when that happens.

</comment></comment><comment><USER45> There's no doubt about it: this will be a beast of a gaming chip. It will also likely cost an arm-and-a-leg (it has to, it's binned silicon meaning it's supply constrained) and likely have a really high TDP.

</comment><comment><USER46> Curious what happens when you call into the vector (AVX hardware).

</comment><comment><USER47> So now Zombieland et al can be exploited even faster!

</comment><comment><USER48> Now you can run the speculation mitigations much more quickly!

</comment><comment><USER49> It's nice to see AMD competing well enough for intel to actually push what their process can do. Finally!

</comment><comment><USER50> Well, this also means that attacks exploiting speculation with run much faster!

</comment><comment><USER51> I hope it includes a horde of running zombies.

</comment><comment><USER52> just in-time for AMD's computex keynote...nicely played

</comment><comment><USER53> no i7-9700KS? disappointing

</comment><comment><USER54> hyperthreading?</comment>


Ask HN: How do you know an idea is worth sticking with? - <AUTHOR>

I have lots of ideas some good, some bad. Heck lots are bad for various different reasons. Some of them I have worked on quite abit and still failed.  Do you take a shotgun approach or focus on one idea. if more than one how much effort do you put into each? or did you just know this idea was big. I'm working on starting 10 websites and I'm going to put about $1000 into each and see what happens, unless starts to pay off well in these areas: ecommerce, 2 markeptlaces, blog, Saas and android app. not sure about the rest yet. I figure worst off I will gain some good ip resources and skills. <comment><USER2> I believe in specialization and niche markets. Also I'd rather start with one thing and do it well. I'd give a new idea all my effort for at least 3 months before making a call if it's worth sticking with, pivoting or completely abandoning it.</comment>


Show HN: Nectarine, proof of concept parallel processing with Rails Active Job - <AUTHOR> https://www.rockstarcoders.com/parallel-map/ <comment><USER2> Not to be a naysayer but it might be a better effort to prevent having to do a bunch of work before returning a response. Have you considered polling for all the jobs to be completed instead?

<comment><AUTHOR> Hello. No apologies necessary! Wanted to put this out there for the discussion. So thanks for the comment. I'm not sure what you mean though. This is polling to see if the jobs are completed. Every two seconds it goes and polls the status of each of the Jobs that were kicked off.

      Timeout::timeout(15 * 60) do
        while(!all_job_statuses_complete?(all_jobs)) do
          sleep 2
        end
      end

Was there something else you were referring to?

<comment><USER3> Timeout::timeout has many very sharp edges you should be aware of before you use in this context.

<comment><AUTHOR> Very true. Could just as easily just count the number of times we've looped through this and multiply by our sleep to get a sense of time taken place. Thanks for the poke at that!</comment></comment></comment></comment>


Ask HN: How do you get the initial traction for your web side-project? - <AUTHOR> You had the idea and you've built it. You share your project with your friends on Twitter and Facebook for some feedback. But what's next, how do you make your side-project be accessible for a larger audience? <comment><USER2> My site [https://IndieHackers.com](https://IndieHackers.com) has in-depth interviews with lots of developers who've launched their side projects. There's definitely some good information there!

I also wrote a post about my experience launching Indie Hackers itself: [https://www.indiehackers.com/blog/launching- to-300000-pagevi...](https://www.indiehackers.com/blog/launching- to-300000-pageviews)

To answer your question more directly, I think it really depends on what you're building! If your project does a good job appealing to a niche and, ideally, solving a prickly pain point of theres, that makes it easier. The next step is to find places where those people hang out online, and then learn the rules of those communities so you can respectfully introduce what you've built.

<comment><USER3> I got my first few hundred users (aside from friends) by searching twitter for people complaining about the problem I was solving and showing them my solution. Luckily I had stumbled onto a good product market fit and It worked really well. Also posted on relevant subreddits. Everything since has been organic growth.

Edit: my hn clent is buggy and keeps replying to your comment and not the parent thread. Sorry.

<comment><USER4> Your SaaS' text to background contrast is quite low in some places, makes it very hard to read even with good eyesight

<comment><USER3> I agree, Im in the process of a complete redesign that should help. Thanks!

</comment></comment></comment></comment><comment><USER5> Here's a good list of sites to submit to:

[https://news.ycombinator.com/item?id=6488822](https://news.ycombinator.com/item?id=6488822)

</comment><comment><USER6> Here's a good article on Traction (which promotes the book with the same title and the book is Amazing!) [https://medium.com/swlh/the-19-channels-you-can- use-to-get-t...](https://medium.com/swlh/the-19-channels-you-can-use-to-get- traction-93c762d19339#.dz1lz6jed)

Also it depends on which kind of project is that, are you targeting specific people? Can you tell a bit more about it?

<comment><USER7> Great book, definitely worth buying

</comment></comment><comment><USER8> The problem is the target of the project. If friends on Twitter and Facebook fall within the target, then send your project to try.

But if the project solve a problem away from you, try to think the best channel through which sponsor your project. You study your competitor and find which channel they use because it's better choose a different channel.

</comment><comment><USER5> checkout these:

[https://growthhackers.com/growth-studies](https://growthhackers.com/growth- studies)

</comment><comment><USER9> The options depend pretty heavily on the price point, how much you can invest per user and how much traction you need to fund future growth.

</comment><comment><USER7> If its B2C then you can't go wrong with some highly-targeted FB ads to validate your idea, and gain some initial interest.

</comment><comment><USER5> find bloggers to give a free trial to. also, blogging yourself.</comment>


Document Extraction using artificial intelligence (AI) - vimox-shah We are creating AI system for generating documents for Global Shipping. We extract data from different type of trade and shipping documents and use that data to auto-generate other documents. If any one interested for more details contact on firstname.lastname@example.com or comment on this thread and provide your details. We'll contact you. <comment> vimox-shah link for our AI system is [http://pages.shipmnts.com/ida/](http://pages.shipmnts.com/ida/)</comment>


Ask HN: What's your stance on this method for poaching potential customers - <AUTHOR>

To make the long story short, my future competitor's issues are online.  That is, their bugs, feature request, etc. are viewable by all. And because of this, I can easily see what their customers/evaluators are saying about their product.  These customers/evaluators also make their e-mail address freely available.
The question that I pose to you is, how would you feel if somebody contacted you about a problem that you had raised?  Note before contacting the user, I would obviously have to believe that my product would be able to address the issues that they raised.
Would this be crossing the line or is this just how business is done? <comment><USER2> Legal, fair and _ethical_. You're offering a potentially better product to exactly the people that need it.

However, before you hawk your brand and wares, try to imagine yourself a good Samaritan and introduce yourself. You might get more information about their needs and wants than you can ever glean from a bug report. This stuff is called Solution Selling and it's a more conversational approach to sales:

<http://en.wikipedia.org/wiki/Solution_selling>

N.B: the references in that page contain wacky commercial products. A better sales advice might be "just be human and be honest". Commercial SS includes variable pricing stuff you don't need.

</comment><comment><USER3> Whatever you do, don't reference specific issues the customer had or statements they made. Most people will find this very creepy and stay away from your service. That said, you can tailor your pitch to whatever pain points that customer has.

So "I saw that you have a problem with X at wonka corp" is a no-no, but "My service is way better at X than wonka corp" should be fine. In general, keep it general.

<comment><USER4> How about "My service is way better at X than wonka corp, - also, we value our customers privacy highly and wouldn't dream of publishing your email address in a publicly available support forum."?

<comment><USER5> Well, for instance, if oracle contacted me 'cause i was on RedHat boards, I'd find it pretty creepy and irritating, especially if they started going off about redhat not respecting my privacy; I put my email on there myself. for someone else to go and assume that I didn't actually mean to put up my email would be kinda insulting.

But then, i'm not the sort of person who responds to sales solicitations. (In fact, I do my very best to avoid buying products that require negotiating with a salesperson- it's usually the mark of a higher price.) so you might not want to listen to me.

However, if you are poaching from a semi-open-source support form, you might want to keep what I say in mind.

</comment></comment></comment><comment><USER6> Well allow me to be the lone dissenting opinion. (Edit: what follows should be interpreted as a rant against this practice, not against you personally, or your business idea :)

Harvesting user's emails from a 3rd-party site that you plan to compete against is unequivocally and unambiguously a shitty, low, underhanded practice. Not to put too fine a point on it.

You didn't put in the footwork or the dollars necessary to get those customers yourself.

You didn't get the customer's permission to contact them (and NO, just because a customer posts his email address in plainview does NOT mean he's implicitly given you his permission.)

You didn't achieve a real and meaningful relationship with your customers or your competitors.

You just harvested some emails that were left in plainview, no different than any other 2nd-rate spammer on the net.

Ethics aside, any business that depends on the glomming of email addresses/discussions from 3rd-party competitors is...the best word I can find is "uninspired". If you don't have a problem with this business model, you don't have a problem with targeted spam.

</comment><comment><USER7> I think it's fair game. However, instead of building a feature and then pitching it directly to the user, I would create a landing page for it.

Something clearly laid out e.g. "(big text) Having Problems with X? -> describe the pain-point feature -> describe the app -> pricing / call to action"

This is better for a few reasons, I think:

1) It's less in-your-face. You don't want to be a sales douchebag and make the customer feel obligated to use your app because you've solved a competitor's pain-point. So instead of direct emailing them the pitch, you say "hey our app solves this problem - here's a page explaining why."

2) It's scalable, since you can just send other people to the same page without having to pitch them all the time. You could even set up some adwords campaigns for the specific phrase "XYZ app with ABC feature" and see what happens. You never know - people might be googling for a solution.

3) It's less creepy as it implies that the feature was built for the benefit of everyone (which it was) rather than the few customers that you've stalked :)

</comment><comment><USER8> If the information is freely available then I don't see that as ethically wrong. It is like being in a bar and overhearing someone who has an issue with your competitor and approaching them.

<comment><USER9> Not an ethical problem. But I wonder if the customers might feel a bit spied upon. I would keep the communication generic, wouldn't mention how you got their address and not refer to just the problem that they mentioned.

<comment><USER10> Actually I would have thought the customer (after getting over being spied on) would have felt angry at Wonka corp for making it so easy for other parties to track them. That could be something you could capitalise on without being obvious :D.

<comment><USER11> Many people don't think like that; if your house gets broken into, you don't generally complain to the locksmith who fitted cheap locks.

</comment></comment></comment></comment><comment><USER12> I say try it and see what happens. See what works, what doesn't, customize each contact and improve based on results.

</comment><comment><USER13> I contribute bug reports to open source projects. If somebody contacted me through contact information leaked in a place like that about a 'competing product', I would be angry and probably blog about it. Fortunately, nobody reads my blog. Unfortunately, it is indexed by Google.

</comment><comment><USER14> I believe you're 100% in the clear ethically.</comment>


Custom CSS properties: create responsive behaviour - <AUTHOR> https://blog.logrocket.com/custom-responsive-behaviour-using-custom-css-properties-14e2ed8a578f <comment><AUTHOR> Custom CSS properties make CSS even more powerful. For example you can configure a menu to fade in fullscreen on mobile while sliding in from left on desktop.</comment>


Climate and Unsheltered Homeless in the Continental United States - <AUTHOR> https://streetlifesolutions.blogspot.com/2019/10/climate-and-unsheltered-homeless-in.html <comment><USER2> This has always seemed pretty simple to me. Homeless people will tend to migrate to places with:

1) Favorable homeless policies (police don't kick them out or arrest them on a regular basis just for being homeless)

2) Liberal-minded residents who tolerate homelessness

3) Well-off residents who support homeless populations via direct support (begging) or indirect support (tax-funded shelters, food banks, employment programs, etc.)

Weather is a draw for the portion of the homeless population that wants to effectively be a beach bum, but I'm pretty sure that's a minority. As the author points out, Seattle has shit weather but a huge homeless population (same as Portland and, to a degree, NYC). What it has in common with LA and SF is the above 3 factors.

<comment><USER3> Is there a lot of homeless migration, or is there some other force bringing people to these cities where they then end up homeless?</comment></comment>


C++ Hating - <AUTHOR> http://cplusplus-soup.com/2010/11/21/c-hating/

<comment><USER2> As it turns out, the Microsoft Office example is not a good one.

Microsoft Office was written in C, and only relatively recently ported to C++. Please note that I didn't say it was rewritten in C++. It was ported to C++. That is, the minimum changes necessary were made to get it to compile without errors or warnings under a C++ compiler.

That means, technically speaking, Microsoft Office is now written in C++, but it's still very much written in the style of C. Quite a few applications that use C++ are written this way.

Speaking just for myself, I think C++ is scary-complex. There are a lot of corner cases and unexpected behavior to memorize. To be blunt, I think the complexity of C++ gets in the way of productivity. There is no question C++ has some nice features, I'm simply unconvinced they're worth the cost.

I'll stick with C for low level, and pick from a variety of better and more sane (in my opinion) choices for medium and high level work. That being said, if someone is happy and productive with C++, that's great. There's room for lots of programming languages in this world, including C++.

But please, don't look down on developers like myself that have rejected C++, for what we consider good reasons.

</comment><comment><USER3> I know native desktop applications are considered passé, but I still wonder: How many common/popular native desktop apps can people name that aren't obviously written in C/C++? I guess in the Mac world, Obj-C is common, but that's only a half-step away from C. I thought OpenOffice was a good example until I was educated that it is based much more on C++ than Java. The original bittorrent client was Python, but the Steam Hardware Survey indicates that µTorrent is the client of choice in practice.

I ask because the very common argument that it would be more effective to build apps in higher level languages always made sense to me in theory. But, I don't see it happening in practice. Can anyone provide good counter-examples?

Edit:

Minecraft is Java. That's one.

<comment><USER4> Most native widows desktop applications are _old_ , as in pre-2k, when C++ was really the only way to get a high performing desktop program other than C, and really it was argued (now proven false, according to Code Complete 2 as well as lectures I've seen at Georgia Tech) that large C++ programs were more maintainable than large C programs.

For mac, they're usually Objective C, especially if they're from the post NEXT era.

Mozilla is from 1994, MSWord is from the 80's, etc.

Objective C is _vastly_ different from C++, as is straight C. The people who confused C and C++ are really missing a boat to understandingville. You write _real_ C applications completely differently than you write C++ applications, a fact few C++ advocates admit or understand. The added complexity and workplace changes (about 1.5x more expensive engineers and a culture of "easy to fire") required to use C++ (correctly) is huge.

Games/Applications Written in python: Eve Online (a sure counterpoint to his World of Warcraft example), CIV IV, Miro, Blender, MacTelnet, Bazaar, Mercurial,

Applications written in java: Limewire, Maple (the mathematics software), FreeMind, Azureus, jEdit, Eclipse, Spark IM, matlab(along with a pile of other languages),

<comment><USER5> I agree, but I think there is a middle ground, which is to use the strengths of _multiple_ languages in the same app. And interestingly, one of the examples you gave is an app that I wrote (MacTelnet), which doesn't just use Python; it also calls C++ and Objective-C. :)

While C was the first language used, I added the others to gain their strengths, which include maintainability and access to powerful libraries.

<comment><USER4> Almost all languages use C libraries at some point (as that's what the OSes are written in), but yes, several of the apps are multilanguage.

I find python + weave.inline (insert C++ which is dynamically compiled the first time called) pretty awesome at getting performant apps which are fast to build and simple to debug.

<comment><USER3> I expect that the middle ground of C+HLL is more common than the purist approach simply because it makes sense to use the right tools for very different jobs.

I know that Eve is Python on top of a large, custom C++ code base. Civ and Blender as well. Adobe's Lightroom is a nice case study of 50% C++ and 50% Lua.

I've never used Python+Weave, but it makes total sense. I do think Python's built-in CTypes library is unfortunately underused. (highlights: You can create C-callable function pointers and you can call C DLL functions from default Python. No add-on libs required.)

<comment><USER4> Almost all the alternatives are quite a bit easier to use than ctypes, with the exception of SWIG

</comment></comment></comment></comment></comment></comment><comment><USER6> A long and mostly incoherent rant. I'm ever so sick of seeing these.

</comment><comment><USER7> thanks for this article! a very interesting one! didn't know Google Chrome is using Qt GUI framework...

i'm a LAMP web application developer. i know some C++, although never used it in any real-world project, and i strongly agree with the author... if a day comes and i'll need _really_ good performance from my application, think there's only one true solution and it's writing C++ code.

<comment><USER8> you didn't know chrome was using Qt because it isn't.

<comment><USER7> oh, i see now it has been stroked trough! =]</comment></comment></comment>


Indian Point Nuclear Power Plant to Close by 2021 - <AUTHOR> http://www.nytimes.com/2017/01/06/nyregion/indian-point-nuclear-power-plant-shutdown.html <comment><AUTHOR> Political decision, not safety. No nuclear engineers that I know of have claimed there are safety problems.

The plant generates about 1/4 of electric power in NYC. Rates will increase, which is a regressive tax, adversely impacting the poor, and undoubtedly there will be more air pollution as carbon-based fuels will be needed to substitute. As far as I know, NYC is using as much of the low-cost hydro power from Quebec as they can deliver.

<comment><USER2> Not unlike the closure of Rancho Seco in California:

[https://en.wikipedia.org/wiki/Rancho_Seco_Nuclear_Generating...](https://en.wikipedia.org/wiki/Rancho_Seco_Nuclear_Generating_Station)</comment></comment>


What It Takes to Hold Your Breath for 24 Minutes (2017) - <AUTHOR> https://www.wired.com/story/what-it-takes-to-hold-your-breath-for-24-minutes-yeah-its-a-thing/ <comment><USER2> On this topic, David Blaine's TED talk about holding his breath for 17 minutes is probably the most interesting TED talk there is.

[https://www.ted.com/talks/david_blaine_how_i_held_my_breath_...](https://www.ted.com/talks/david_blaine_how_i_held_my_breath_for_17_min)

<comment><USER3> Thanks for sharing - that was an incredible story. I find David Blaine fascinating because many of his magic tricks aren't tricks per se, he just does things that would be unthinkable for the average person. For instance he often takes a bite out of a wine glass and chews it up, and it seems like there must be some trick to it, except in one of his TV specials he goes to a dentist and reveals that his teeth are all worn down and messed up from eating so much glass.

<comment><USER4> This one is great: [https://www.youtube.com/watch?v=oLAs11gkqKE](https://www.youtube.com/watch?v=oLAs11gkqKE).

Ricky Gevais: "Sorry sorry David seriously, this isn't a trick. You're just sticking a needle through your fucking arm. What are you doing? That's fucking horrible. You're a maniac. That's the worst thing I've ever seen in my life."

<comment><USER5> Why was there no blood?

<comment><USER6> Likely because it's a magic trick and he didn't really poke it through his arm?

<comment><USER7> You're just guessing. He really did poke it through.

<comment><USER6> I had a look around at David Blaine poking various things into himself. I think I was probably wrong. It looks like poking a needle into a bicep is a somewhat common trick[1]. I assume he just takes the pain.

Still, I would tell everyone to be cautious believing a magician's explanation for any trick. Lying to mould people's memory of the trick is a really common technique. In one version of David Blaine's icepick through the hand[2] he says "This is the first time I let someone else choose the place" When he clearly chooses where to push the icepick through.

[1] [https://vimeo.com/33462933](https://vimeo.com/33462933)

[2] [https://www.youtube.com/watch?v=sw-l5SW5hik](https://www.youtube.com/watch?v=sw-l5SW5hik)

<comment><USER5> I'm thinking the healed piercing thing is what it is. Basically he has something akin to a fistula ([https://en.wikipedia.org/wiki/Fistula](https://en.wikipedia.org/wiki/Fistula)) from repeatedly poking the same spot, but the outside heals over so you can't see the hole.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> [https://www.cbsnews.com/news/breath-holding-games-are- killin...](https://www.cbsnews.com/news/breath-holding-games-are-killing- swimmers-cdc-warns/)

</comment><comment><USER9> Wow. That's approaching the time for dolphins, whales and similar sea mammals.

Of course, his record is without doing any work, unlike a dolphin which is swimming.

Free divers are swimming though and their underwater time is very impressive.

<comment><USER10> In another life I spent some time training in freediving. I wasn't particularly good, but got to around 4:45 for raw breath hold, a 36m dive, and swam maybe 110m in a pool, all done under strict supervision. Fun sport but very strange, it seems to attract an odd bunch.

</comment></comment><comment><USER11> Doesn't the brain start to die after 10-15 minutes without oxygen? How could he possibly go that long without breathing without suffering any brain damage? I remember when David Blaine was going for the records, the biggest concern was that he would irreversibly and severely damage his brain.

<comment><USER12> He does start with a lung full of pure oxygen.

<comment><USER13> That seems like a poor idea.

[https://en.wikipedia.org/wiki/Oxygen_toxicity](https://en.wikipedia.org/wiki/Oxygen_toxicity)

<comment><USER14> oxygen toxicity at sea level (1 atmosphere of pressure) would require a 140% oxygen mixture - it's only when you go to higher pressure environments (eg 10m underwater = 2 atm) that it becomes an issue (at 2atm, 70% oxygen is toxic; at 4atm, 35% oxygen is toxic, etc - regular air is 21% oxygen, which becomes toxic around 7atm aka 60m underwater)

<comment><USER15> You're generally on the right track, just off slightly. In the scuba diving world 1.4atm partial pressure of Oxygen is generally considered the maximum safe partial pressure when working (ie swimming). 1.5 atm for rest. This makes the depth limit for regular air to be 216 feet. Though there are a lot of divers who dove deeper than that befor trimix became so common.

</comment></comment></comment></comment></comment><comment><USER16> That's very cool but it's definitely a stunt, breathing pure O2 is definitely not normal.

I'm more impressed by spearos going down for several minutes, swimming hard, doing work, fighting a fish on a line and coming back up. I can manage 1:30 with that kind of activity but I have met folks who can go several minutes.

<comment><USER17> I'm very curious: once you've practiced for a bit, are you still having a gigantic fight with your brain/lungs to take a breath, or is that "put off" until, in your case, 1:30?

<comment><USER10> Not GP, but have trained freediving and used to spearfish almost daily.

There is usually an easy period until the desire to breath starts, from 1 to 2 minutes in. The next minute or so is tricky, you get contractions as your body tries to breathe. After that you start to slowly zone out, but you're no longer in pain. Eventually the world closes in around you.

When spearfishing you're typically fairly conservative and never get past the first easy section.

<comment><USER17> Huh, so that uncomfortableness thing actually lengthens with time. Interesting.

</completely_naive> :)

 _Adds learning how to hold breath safely to todo list_ ( _Todo list falls over_ )

</comment></comment></comment></comment><comment><USER18> What blows my mind is the guys that actually perform activities diving while holding their breathe for similarly long durations.

Learning to control your body in idle circumstances is impressive in a meditative sense, but how people manage comparable durations while physically active is a different thing entirely.

<comment><USER19> Some people seem to have _evolved_ to be able to hold their breath (over 12 minutes) and work.

Look for the "sea nomads", there have been articles about them recently, a recent (2016) research ( [https://www.cell.com/cell/fulltext/S0092-8674(18)30386-6](https://www.cell.com/cell/fulltext/S0092-8674\(18\)30386-6) ) suggests that their ability could be because they evolved a larger spleen (which helps with red blood cells).

<comment><USER20> I thought it was interesting that there are also sea nomad children who are able to see clearly underwater: [http://www.bbc.com/future/story/20160229-the- sea-nomad-child...](http://www.bbc.com/future/story/20160229-the-sea-nomad- children-who-see-like-dolphins)

Although that skill didn't evolve. It's just something kids can do with practice, and the ability is lost as we age and our lenses become less flexible.

</comment></comment></comment><comment><USER21> PSA: Trying to hold your breath for a long time is dangerous, especially if you hyperventilate first. People die this way.

The hyperventilation thing is because your brain needs oxygen to live, but your impulse to breathe is driven by carbon dioxide saturation. When you hyperventilate, you get rid of a ton of carbon dioxide, and you can get into a situation where you don't have enough CO2 buildup to trigger the signal to breathe, but you have so little oxygen that your brain is dying.

Personally, not something I'd like to mess with.

<comment><USER22> CO2 levels rise to unhealthy levels (700ppm) within a few hours of a typical bedroom if you keep the doors and windows closed. Its also why Submarines have CO2 scrubbers.

<comment><USER23> Do you have any source for this? A bedroom isn't sealed shut like a submarine would be?

<comment><USER24> I have a CO2 monitor, and I can confirm that it goes up at least that fast in my home. I can't speak for submarines or healthy levels. I've been wondering for a while why environmental rhetoric only talks about the global rise in CO2 in terms that make people think it's just an atmospheric phenomenon rather than notably changing what they're breathing. It looks like we've nearly doubled the CO2 we're breathing in the past couple centuries, not including our more sealed up lifestyle.

<comment><USER25> >only talks about the global rise in CO2 in terms that make people think

Because the levels in the global rise are negligible in comparison to what is dangerous for breathing. Here's a hint, if you think you've spotted something blindingly obvious in a field scrutinized by hundreds of thousands of scientists, you're probably making a mistake.

<comment><USER24> Thanks for the hint. The thought that the health effects of a waste product from the most profitable of industries may have gone under-reported is indeed preposterous.

Here's a study showing reduced cognitive performance at various CO2 levels in the ranges we're talking about.

[https://ehp.niehs.nih.gov/1104789/](https://ehp.niehs.nih.gov/1104789/)

</comment></comment></comment></comment></comment></comment><comment><USER26> I call BS. His entire head was not submerged. He simply found a way to breathe through his ears.</comment>