$100,000 Revenues in last 12 months - wow - <AUTHOR> http://startupdesi.com/100000-startup-revenue-in-12months/

<comment><USER2> Hmm... I may be blind or crazy, but I had to actually use your search function on your excel site ( <http://chandoo.org> ) for "excel school" to find the actual product that is bringing you the most revenue!

Here is the sign up page for those of you that are curious: <http://chandoo.org/wp/excel-school/>

Call me crazy, but shouldn't you make that prominent somewhere on your homepage and each article... or am I missing something? (again, I could be completely blind or missing it, but if I am missing it... that's still an issue for your highest generating product)

I have a feeling that what seems to be almost a secret (the school) on your site which is generating the majority of your $100,000 could be GREATLY increased with higher visibility of the school. If my assumptions are correct and you implement my suggestion (which anyone here probably would), let us know when you hit $500k -- I have a feeling in 6 months.

<comment><USER3> You are right and wrong. Not many people go to that page. My home page is <http://chandoo.org/wp/> where most of my readers and search audience end up. And I open Excel School once every three months. I am doing this as it gives me opportunity to spend time with students and learn / teach better.

You would see lot more links and publicity the next time it opens.

I will also be editing the home page HTML to add link ES and other product pages. Thanks for your suggestion.

</comment></comment><comment><USER4> "I think the market where I operate (Microsoft Excel users) will change drastically in the next 10 years." . . . "What I am doing for living will be obsolete by then."

Who is going to train all your customers in these new technologies they're going to move away to? Grow your business as much as you can before Excel becomes obsolete but that point doesn't need to coincide with your business becoming obsolete.

<comment><USER3> I agree. If you read my thoughts under "sustainability", this is what I talk about.

"I love spending time with my customers and community and learning new things. I like teaching and enjoy writing. I also want my business to have meaningful social presence. There is tremendous scope for doing all this while making decent money ($100k-$200k per year). While technologies may change, I can adopt and continue to be passionate about data, analytics, visualization in future and share what I learn with my audience. This is more sustainable."

And this is what I am going to do

</comment></comment><comment><USER5> I love Excel and wish more people would actually spend the time to learn the nuts and bolts behind it. Most people think of it as a band-aid solution used by people who don't know databases but to me doing things without coding using Excel's built-in functions is like those 1k/5k competitions - how much can you do with so little?

Here's my favorite problem that I'd like someone else to take a stab at:

Sheet1:A1-A999 (source) is an unsorted list of alphanumeric strings, with lots of repeats. Without using macros/VBA/scripting code, put all the unique strings in Sheet2:A1-A### (destination) such that any changes in source list is reflected in the destination automatically (auto calculate option is enabled). Destination list should have no more than 1 blank row. You cannot use any sorting/grouping functions manually. It has to be completely automatic. I want to delete the entire source worksheet, paste 399 items, insert 400 more, paste in another 300, and delete 100 of the rows randomly, and when I switch to the destination, it should have my list ready.

Bonus points if the destination list is sorted. Double bonus if you don't use any {array} functions.

Hint: You would be using functions like VLOOKUP/MATCH/ADDRESS/INDIRECT and similar.

So why is a problem like this useful? Because if destination is generated completely dynamically using items from the source, you can pull in dynamic web data into the source and have your Excel work reliably even if macros/scripting are disabled. Also, you can have users log in manual data into the source and you can generate the summary of their data in the destination without having to rely on any code or external service.

<comment><USER6> > I love Excel and wish more people would actually spend the time to learn the > nuts and bolts behind it. Most people think of it as a band-aid solution > used by people who don't know databases

Excel is a powerful tool and it is super useful when you use it within its domain.

At the same time it is used as a band-aid solution by those who don't know how to use a database. I recently had a fellow employee come and ask me if I knew how to expand excel beyond the 70,000 row limit. After asking him a few questions I came to the conclusion that his issue was not that excel doesn't support more than 70,000 rows but he needed a database and wasn't using one.

<comment><USER7> What was the reason you thought he needed a database?

<comment><USER8> To support more rows than 70000?

<comment><USER9> That isn't the case with xslx files. Only the old binary xls files have that problem.

      Excel 2007+ </comment></comment></comment></comment></comment><comment>- 1,048,576 x 16,384 (rows x columns)
      Excel old-2003 ----    65,536 x    256

</comment><comment><USER10> Excel formation and consulting looks like an interesting niche. It is really business oriented, quite large, with a lot of people probably willing to improve. How did you reached your initial customers ?

This very good start seems to prove it. I wish you good luck.

<comment><USER3> I have been writing about Excel for last 3 years at my blog - <http://chandoo.org/wp/> Once the blog gained momentum, naturally I made it a business by offering few products and training programs.I use my blog as sole marketing platform for finding new customers and convert existing readers to customers (apart from offering kickass content...)

<comment><USER11> Great job! You found a niche and ran with it.

</comment></comment></comment><comment><USER12> And that's $100,000 for someone in India, right?

I wonder what the relative purchasing power of that $100k is for his part of India, compared to, say, someone with $100k in San Francisco.

<comment><USER13> Thats just the revenue, surely there are some costs that offset that number. Still quite nice.

<comment><USER3> $100k has roughly 5x ppp in India.

And yes, you are right. 100k is revenues. Costs are there. Mainly rent, affiliate commissions, blog hosting expenses, site maintenance, outsourcing fees (to contractors). While I do not have audited figures yet, the expenses should be less than 20% of revenues. May be even less.

<comment><USER13> If you would take a salary fit to live on (for some value of fit!) what would the numbers look like?

</comment></comment></comment></comment><comment><USER14> There doesn't seem to be a link to excel school on this page.

<comment><USER3> Its here - <http://chandoo.org/wp/excel-school/>

</comment></comment><comment><USER15> And people say startups don't lead anywhere in India. Great going!

</comment><comment><USER16> Nice! It's great to see the entrepreneurial virus run across the earth to every country like this. Chandoo is a nice business and I am sure you can adapt it to the new tools that emerge after Excel. Won't there always be a need for some sort of tabulator like Excel? Do Google docs accept most of the same formulas and charting logic from the most advanced worksheets?

<comment><USER3> Google docs, zoho and office web apps provide most of Excel's basic functionality. I am sure they will evolve to be more usable, functional during next 5 years.

</comment></comment><comment><USER17> This shows how you get an idea in your mind, think of it, apply it and stick to making it successful. Then read HN and some entrepreneurial blogs, get the idea of monetizing your audience, launch a better product, charge for it and make good enough not to take a job.

Congrats and good luck!

</comment><comment><USER18> so what exactly does this business do .. online training ?

<comment><USER3> yes, online training is one part of what I do. This itself is quite big market with lots of potential. I have a set of excel templates for project management that I sell thru my site. These are my main products.

</comment></comment><comment><USER19> You are an inspiration specially for budding 1 person entrepreneurs in India like me. :) Good luck !!

</comment><comment><USER20> Congrats Chandoo. This is a gr8t achievement. Interested in breakdown of type of customers (Students, Small Business Owners, Financial Consultants etc)?

</comment><comment><USER21> Very impressive. Congratulations on the growth.

I'd also like to add that chandoo.org loads very quickly. Nice work.

</comment><comment><USER22> Amazing stuff. Good Luck!!

<comment><USER3> Thank you...

</comment></comment><comment><USER23> Awesome!

</comment><comment><USER24> Dude, way to rock a "boring" business helping people with a real, everyday problem instead of trying to boil the ocean. Congratulations on your success -- you deserve it! (Especially because you don't seem like the type to sit on your laurels. Well done.)</comment>


Facebook will begin letting anyone post Instant Articles - <AUTHOR> http://www.theverge.com/2016/2/17/11027594/facebook-instant-articles-all-publishers <comment><USER2> I've tried to find out what Instant Articles is. So its a Drag&Drop HTML editor with image and code optimizer to make those big picture articles? Thats it?</comment>


Jeopardy's Controversial New Champion Is Using Game Theory To Win Big - <AUTHOR> http://www.businessinsider.com/jeopardys-controversial-new-champion-is-using-game-theory-to-win-big-2014-2?IR=T

<comment><USER2> Significant discussion: [https://news.ycombinator.com/item?id=7164619](https://news.ycombinator.com/item?id=7164619) (businessinsider.com)

Other submissions from other sources:

[https://news.ycombinator.com/item?id=7160032](https://news.ycombinator.com/item?id=7160032) (mentalfloss.com)

[https://news.ycombinator.com/item?id=7162644](https://news.ycombinator.com/item?id=7162644) (thewire.com)

[https://news.ycombinator.com/item?id=7164753](https://news.ycombinator.com/item?id=7164753) (dailymail.co.uk)

[https://news.ycombinator.com/item?id=7169091](https://news.ycombinator.com/item?id=7169091) (mentalfloss.com)

[https://news.ycombinator.com/item?id=7174775](https://news.ycombinator.com/item?id=7174775) (cleveland.com)

[https://news.ycombinator.com/item?id=7175378](https://news.ycombinator.com/item?id=7175378) (policymic.com)</comment>


Business students more likely to have a brain parasite spread by cats - <AUTHOR> https://www.newscientist.com/article/2175045-business-students-more-likely-to-have-a-brain-parasite-spread-by-cats/ <comment><USER3> [edited] - I was concerned that they hadn't controlled for country of origin when assessing the students - a lot of business students are from abroad - <USER2> on a second reading I couldn't tell if they'd checked it or not - it looked like they might have done, so I'm removing the comment. Don't want to be rude to the researchers.

<comment><USER4> Apparently they have controlled for this obvious possibility:

 _In each of the three resulting models, our independent variable was the prevalence of T. gondii in a given country (the proportion of people who tested positive for T. gondii exposure) – indicated by published seroprevalence data._

([https://figshare.com/articles/Supplementary_Methods_and_Anal...](https://figshare.com/articles/Supplementary_Methods_and_Analyses_from_Risky_business_linking_i_Toxoplasma_gondii_i_infection_and_entrepreneurship_behaviours_across_individuals_and_countries/6809468))

</comment></comment><comment><USER4> Remember folks, this isn't just any brain parasite spread by cats; it's specifically Toxoplasma gondii which is well known to have a life-cycle dependent on deliberately changing the behaviour of its hosts, reducing risk inhibitions. This has been repeatedly confirmed in studies on rodents, and has been strongly suggested in a number of correlative studies on humans.

Also, if we're in the business of judging the news by who's delivering it, the study was published not in New Scientist but in the Proceedings of the Royal Society.

</comment><comment><USER5> The studies that come up about toxoplasmosis are so uniformly strange, weird and remarkable that I have become deeply suspicious about the entire field of study.

Whenever you see strange and remarkable results around some topic like this, it just reeks of academic p-hacking and media attention seeking.

I suspect one day the entire field of toxoplasmosis study is going to get debunked and all of these media friendly studies will get thrown out.

The number of remarkable toxoplasmosis studies is far, far too high and really pushes the limit of credibility.

<comment><USER4> Could be. As ever, it'd be good to hear about any studies with _negative results_ to get a better perspective, but they infamously tend to get binned or ignored.

</comment></comment><comment><USER6> New scientist is pretty much a science tabloid... This is just clickbait

<comment><USER7> Here, have a link to the actual research:

[http://rspb.royalsocietypublishing.org/content/285/1883/2018...](http://rspb.royalsocietypublishing.org/content/285/1883/20180822)

</comment></comment><comment><USER8> Are cats more risk averse than dogs? Or other animals? Is that why they lie indoors all day?

Is going to business school an indication of risk averseness?

None of this seems rooted in science. "A and B have correlation, and A is anecdotally known for a characteristic B is attributed to, but no definites folks, so make your own mind"

</comment><comment><USER9> This looks like a textbook example of spurious correlation, great for introductory courses in statistics.

<comment><USER10> T. Gondii is known to reduce inhibitions. And business, entrepreneurship, sales, etc are all about reducing inhibitions.

Not saying this is a slam dunk correlation, but maybe it isn't so far from left field to have studied this link.

<comment><USER11> That would be weird if T. Gondii actually helped to fuel civilization development because of having more risk takers (and maybe more prophets as well). So not really a parasite, but a symbiote for humanity as a whole.

</comment></comment></comment><comment><USER12> Who knows, this could be valid, but remember: "5% of 95% p-value studies are false positives."

<comment><USER13> Not true, see "base rate fallacy".</comment></comment>


Show HN: I made Unmentionables, a free Taboo game for iPhone  - <AUTHOR> http://appmonkeys.org/unmentionables

<comment><USER2> "Taboo" is a registered trademark. You're probably legally in the clear to describe your game as "Taboo-like", but if your app becomes at all popular, you're likely to get a C&D if not outright sued for using the term "Taboo" so freely throughout your app.

</comment><comment><USER3> Looks nice, but I think you should put a description of what Taboo is exactly. I don't know whether it's a well-known US game but as a Brit I've never heard of it and I'm still not enlightened as to exactly what the game is! I'll google it and probably download the app shortly.

<comment><AUTHOR> I have a description, but the about page was too cluttered when I put it in, so I figured if people are finding the game, they probably know what it is. I'm still not sure whether to put it in or not, but that is a valid point for sure.

<comment><USER4> Definitely agreed with the above comment. Telling a story about what the game actually is is more powerful than inputting a list of facts.

<comment><AUTHOR> Peer pressure got to me. Added a description on the main page. Thanks for the advice.

</comment></comment></comment></comment><comment><AUTHOR> Unmentionables gives Taboo a 21st century makeover. Marathon Mode, in app purchases that are a lot cheaper than Taboo, and something you can take anywhere you go. I'm an iPhone developer, but did the designs myself, so feedback on that would be helpful too.

It's available for download at: <http://bit.ly/unmentionables>

<comment><USER5> The submission link is broken.

<comment><AUTHOR> Sorry, fixed it, silly htaccess...

</comment></comment></comment><comment><USER6> I like it. I especially appreciate that you have a free play mode. I think this could be good for road trips. Smart to have the free cards as a motivation to allow push notifications. The idea of user submitted cards is kinda neat too.

</comment><comment><USER7> Your copyright notice is in a weird spot in Chrome. Here's what I see: <http://i.imgur.com/LfQEB.png>

<comment><AUTHOR> Strange, I'm not seeing it on Chrome for Mac. <http://i.imgur.com/oGSqo.png>

</comment></comment><comment><USER8> I tried downloading the free pack from within the app, and it crashed out to Springboard. iPhone 4S iOS 5.0.1

<comment><AUTHOR> Will look into that, thanks. Out of debugging curiosity, jailbroken?

<comment><USER8> Yep.

<comment><AUTHOR> That makes it trickier, but there's a slightly tricky asynchronous connection function I wrote to download the packs. I'm hoping that's not it interfering with something you have installed via Cydia/Mobile Substrate. Do you know what you have installed perchance?

</comment></comment></comment></comment><comment><USER9> You should show an example card.

</comment><comment><USER10> Great. But what about Taboo's copyright? (Just wondering)

<comment><AUTHOR> Taboo has a trademark, not a copyright. So everywhere I use the word Taboo, I add the trademark symbol (except one screen, which has been fixed but not submitted).

<comment><USER10> Still, let say I create a game called "Run, run" which I explain in my description as:

      "The most fun way to play monopoly on your iphone"

      "But what is Monopoly?"
      "You and your friends split into two teams. [...]"

I just copied a very popular game but changed the medium of how to play it. But then, again, it's more by curiosity that I'm asking this.

<comment><USER11> Game mechanics are not copyrightable. A concrete expression of the rules is copyrightable (you can't copy-paste Monopoly's rule book), as is artwork.

"Play-alike" games are in the clear. "Look-alike" games are not.

I wouldn't say "play monopoly". I'd say "play a property-trading game like Monopoly".</comment></comment></comment></comment>


XSS (Cross Site Scripting) Prevention Cheat Sheet - <AUTHOR> http://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet <comment><USER2> If you're looking for a really good cheat sheet, check out rsnake's list: <http://ha.ckers.org/xss.html></comment>


Clinton campaign reportedly hacked - <AUTHOR> https://techcrunch.com/2016/07/29/clinton-campaign-reportedly-breached-by-hackers/ <comment><USER2> It's funny to me that government officials are now all up in arms about their personal data being made available to the people when they've implemented program after program to make our personal data available to them. Doesn't feel so good when the shoe is on the other foot, does it?

But don't worry, as you've always told us: if you haven't done anything wrong, what do you have to hide?

<comment><USER3> This is the Clinton election campaign servers. No government officials involved.

</comment></comment><comment><USER4> I find it interesting that the national media is more concerned with the hacking and who did it than with what the content of the emails was.

If Bernie Sanders was not given a fair shake and that is revealed in emails, why is that not the major topic rather than by whom or how the emails were hacked?

<comment><USER3> This is the Clinton campaign servers. You are confusing two different incidents.

<comment><USER4> It is a different issue but it reminded me of the other one, sorry to hijack/piggyback.

</comment></comment></comment><comment><USER5> At first it seemed like a brilliant Russian ploy to hack the DNC to make them look back and help Trump. Two strongmen unite! Great work!!

Now it's happened again and it seems like a brilliant ploy by the Democrats to make it look like Trump's call for hacking worked and he is totally irresponsible and a security risk!! Great work!!

Unless.....

</comment><comment><USER6> Supports Snooping on Everyone

Gets Upset When Snooped Upon

</comment><comment><USER7> They should probably just start using gmail.

</comment><comment><USER8> Great. We should worry the ugly conspiracies come to life through these leaks rather than who hacked and leaked them.</comment>


NBC just locked down Olympics coverage for the next 18 years - <AUTHOR> http://www.theverge.com/2014/5/7/5691326/nbc-locks-down-olympics-coverage-through-2032

<comment><USER2> because fuck all that.

I am seriously burned out on timeshifting bullshit.

They should have 3 or so live channels to cover realtime, and one fluffer channel for the uncommitted clueless. Everything properly DVR'd enabled.

Until then I'm just youtubing on my own time.</comment>


Riverthe.net - <AUTHOR> http://www.riverofthe.net/ Conceived by artist Ryan Trecartin and tumblr Founder David Karp, with creative programming by Nick Hasty and Sergio Pastor. Dubbed riverthe.net (currently at the temporary url http://www.riverofthe.net/), the online tool strings together 10 second videos uploaded by users through tag alone. Only three tags can be given to any video. And anyone can upload a video. Interesting, new way to watch online video. <comment><AUTHOR> Fun, new online video streaming site conceived by artist Ryan Trecartin and tumblr Founder David Karp, with programming by Nick Hasty and Sergio Pastor. It strings together 10 second videos uploaded by users through tag alone. Only three tags can be given to any video. Anyone can throw video into the river. Watch the stream of the collective unconscious!

It's also going to be projected on a wall at a show at the New Museum: <http://www.newmuseum.org/exhibitions/429/free></comment>


If You Used TorMail, the FBI Has Your Inbox - <AUTHOR> http://www.wired.com/threatlevel/2014/01/tormail/ <comment><USER2> I don't really see what there is to be upset about in this particular case. This is how investigations are supposed to be done, by the book.

The FBI has copies of the servers TorMail ran on that they legitimately seized in an unrelated investigation (the servers were also hosting child pornography websites).

In the course of another investigation, the FBI found that orders for forged credit cards were being sent to a TorMail account.

The FBI obtained a search warrant for that specific account and then accessed it from their own copy.

This is not trolling the seized database for anything and everything that might be illegal. This is finding probable cause from another source and obtaining a specific search warrant. This is how it is supposed to be done. Why would you expect anything less from competent law enforcement?

The FBI is not the NSA. FBI cases have to hold up in the light of open court.

If you are upset about the fact that TorMail was not in fact secure, well, that's on the TorMail operators and on the users for trusting the entity that controlled TorMail while knowing absolutely nothing about them. Remember, TorMail has nothing to do with the Tor protocol, and is just the name someone gave their supposedly secure and anonymous e-mail service that they hosted on the deep web. For all anyone knew, the FBI could have been running TorMail all along.

<comment><USER3> People are upset because of this new standard of "grab everything, put it in a 'secure' location and mine it in the future for past crimes."

The main concern is that something you did today may become a crime tomorrow, so now entire populations are apparently in the situation of Schrodinger's cat: we are both criminals and not criminals, and only the indistinct future will determine where we end up.

If you want a society where an individual is free to pursue their interests as long as they don't hurt anyone, it makes a lot of sense to have a transparent set of rules that are applied equitably to every citizen, regardless of their demographics or background.

If you want a society where the individual is completely at the whims of mysterious and unknown forces that can destroy their life utterly for no apparent reason at all, well then carve out special exceptions for some while reserving harsh punishments for others. Introduce secret courts, evidence and trials... Institute a "permanent record" of someone's behavior that can be used to manipulate them as desired. Break the well-thought out control systems that help avoid abuses all to make "LEO easier."

I'm assuming every experience you've ever had with law enforcement is positive?

<comment><USER4> >The main concern is that something you did today may become a crime tomorrow

Ex post facto laws are unconstitutional in the US.

<comment><USER5> > Ex post facto laws are unconstitutional in the US.

The Fourth Amendment protects US citizens from unreasonable search and seizure. Clearly that is being violated as the recent ruling on NSA data collection has pointed out.

<comment><USER6> The NSA data collecting as of right now is in fact not illegal. There are still debates if it should be or not, but as of right now, it is not.

<comment><USER7> Not according to a US District Judge who granted a preliminary injunction against the phone spying. Please don't parrot the politicians who claim legality. The fourth amendment is clear enough to prohibit this government conduct.

<comment><USER6> One says yes, one says no, so therefore it is still up in the air. Until there is a definitive ruling on the matter you can't claim it is illegal...it is still a gray area until something like the Supreme Court definitively rules one way or another.

<comment><USER8> while a gray area it is still legal. It's only illegal when the courts say it is, so de-facto it's legal. That's a pretty basic property of the US democratic system.

<comment><USER7> You're confusing "innocent until proven guilty" with a constitutional law question. There is no "presumption" that the executive branch is operating lawfully.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> {EDIT: I really hope people were risk assessing and choosing an appropriate provider. Sadly, many people weren't and were choosing what they thought was secure. This is why the newer crypto tools get a lot of hostile scrutiny. Not because people don't want them, but because they have to operate in a hostile environment and consequences of failure can be severe. If prison is a risk you need have a lot to learn about encryption and privacy.}

There should be legal controls over what information is seized. Requests should need a warrant, signed by a judge. "Accidental" seizures of too much information should be reported to the body who provides scrutiny and oversight.

Some of those accidental seizures should be criminal offences and lead to punishments for the agencies involved. (Or the individuals).

While the UK has a lousy record on this (with bizarre interpretations of law so spies can say they obey the law) the reports from the scrutineers are interesting reading.

[http://iocco-uk.info/](http://iocco-uk.info/)

Here's a PDF of the latest report: [http://iocco- uk.info/docs/2012%20Annual%20Report%20of%20the%...](http://iocco- uk.info/docs/2012%20Annual%20Report%20of%20the%20Interception%20of%20Communications%20Commissioner%20WEB.pdf)

Some parts of the UK government use statistics carefully and they have real statisticians available to produce and review the charts. This document? I'm not so sure. While the raw data can be trusted the use of pie-charts is usually a flag for me, and this document does include a few of them.

</comment><comment><USER10> It sometimes amazes me how naive people are. The reality is that since the patriot act, the entire intelligence community has had access to any information they need. One needs to be delusional to think that they do not already have access to your emails, browsing history, phone call conversations in both audio and text versions, mapping points of where you have been throughout the day. They collect a very wide net of data that they can later scan through for any reason. And no, that data isn't deleted after a certain time frame.

Why are articles like this so shocking?

Have any of you guys had IQT reach out to you, the CIA's investment ARM? They are very active in finding tech companies that can decipher this data, profile everyone automatically, categorize people, and try to predict their next behaviors.

</comment><comment><USER11> _While investigating a hosting company known for sheltering child porn last year the FBI incidentally seized the entire e-mail database of a popular anonymous webmail service called TorMail.

Now the FBI is tapping that vast trove of e-mail in unrelated investigations._

That says pretty much all about their methods.

<comment><USER12> That they'll share data across investigations? Why wouldn't they? Wouldn't it be utterly remiss not to?

<comment><USER13> Due process. Fifth amendment. Unclean hands.

Any evidence derived from or linked to this trove can _AND SHOULD_ be tossed out of court.

<comment><USER14> don't worry, parallel construction will save the day at court

<comment><USER13> PC should be recognized as fully unconstitutional.

<comment><USER15> I think the reason people are opposed to PC is the same why people are opposed to insurance companies knowing too much - we don't want them to perform their job (identifying crime, keeping a good probability distribution of bad events over population) in an optimal way, because the more wrong they are (to a limit), the more society benefits.

I'm not sure what to think of it; it's just an observation.

<comment><USER16> I don't usually quote the bible, but this has stayed with me since childhood:

[http://www.kingjamesbibleonline.org/Psalms-130-3/](http://www.kingjamesbibleonline.org/Psalms-130-3/)

> If thou, LORD, shouldest mark iniquities, O Lord, who shall stand?

Also this, from a somewhat similar source, Cardinal Richlieu:

[http://quotationsbook.com/quote/19331/](http://quotationsbook.com/quote/19331/)

> If you give me six lines written by the hand of the most honest of men, I > will find something in them which will hang him.

And finally, this:

[http://online.wsj.com/news/articles/SB1000142405274870447150...](http://online.wsj.com/news/articles/SB10001424052748704471504574438900830760842)

> The average citizen commits three felonies a day.

... I'm not sure anyone can survive perfect application of the law.

<comment><USER13> The Cardinal Richlieu line has been my G+ profile motto since registering my (2nd, pseudonymous) account.

I'd deleted my initial account after only a couple of weeks.

I'm now winding down my pseudonymous account and most Google activity.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> According to the article they did not look at the other data in the database until they had a warrant to do so. And they didn't obtain a warrant until a different investigation pointed at a tormail account.

That honestly doesn't sound too ridiculous.

<comment><USER18> Surreptitiously mine database for incriminating information.

Build case. Apply for warrant.

Oh look, surprise surprise, the warrant turned up something.

Yes, if we trust law enforcement, blah blah blah. The point of having checks on government authority is so you don't HAVE to trust government. Government is not to be trusted; it is to be kept in check. Your safety, your rights, should not be contingent upon trustworthy official.

</comment></comment><comment><USER19> I never used TorMail, but people who emailed me did. So they have private email from me even though I never used the service.

<comment><USER20> That's an accurate comment to make, yes. They know that you correspond with people who use Tor. See how this can escalate? I think we are (hopefully) all agreed that chasing down people who use the web for wrongdoing is acceptable for the govt to do - but the collateral damage is where the problems can lie - the potential for "guilt by association" here is monumental.

</comment></comment><comment><USER21> NEVER EVER trust the pipes. If you want your communication to be safe, encrypt it yourself.

<comment><USER22> Excuse my lack of knowledge in terms of mail encryption, but wouldn't the knowledge of communication be enough to warrant further investigation, even if the text itself is encrypted?

<comment><USER23> Well, yes... but then, by _openly_ encrypting your traffic, you would be stating that you are a law-abiding, technically sophisticated citizen, willing to provide decryption keys to legitimated law enforcement officials with an appropriate order.

People with real secrets to hide ought to escalate to steganography + subliminal channel communications.

</comment></comment></comment><comment><USER24> Email is one of the really worst security risk regarding exposure to false accusations. Its even worse if you consider prosecutors who is more interested in statistics and carer than justice and truth.

Almost everyone has hundred thousands of emails laying around. All in your name, all forever stored, all with a legal signature on them binding you, and each with a short text message with no context. It is very often used as evidence, attached with a conjecture provided by the prosecutor. The defended is then forced to try defend themselves both regarding the conjecture, but also having to remember and explain the original context.

It has been used in a profile case to "prove" conspiracy, and has also been used by prosecutors to move public opinion by providing snippets (official sanctioned leaking) to media.

This is why I view running a email server without full disk encryption to be negligence, and that everyone should have their own mail server. Until the legal system have caught up with technology, its not much more one can do.

<comment><USER25> E-mail was actually designed to just copy a message file from the sender's computer to the receiver's one; it is sad how it evolved into a plaintext database of private stuff hosted by third parties.

</comment></comment><comment><USER26> OT: Let me propose that link titles now replace link-baity parts (i.e. "This Secure Webmail Site") with specific data where available (i.e. "TorMail").

</comment><comment><USER27> > Now the FBI is tapping that vast trove of e-mail in unrelated > investigations.

Wait - can they do that? _Why_ can they do that?! Isn't that like a fishing expedition? Now they're just looking for crimes from that database trove? I've never used TorMail but _screw everything about that_!

This is why we need to pass some strict laws against mass collection of data, and against using data in "unrelated investigations".

</comment><comment><USER28> This post (and article) really need to have "TorMail" in the title.

<comment><USER29> Indeed. Though of course, that would cost them all the clicks of users of other services, curious to see if they are in danger.

<comment><USER28> If they keep doing it, it'll cost them everything. Such shortsightedness is the downfall of many a business these days.

</comment></comment></comment><comment><USER30> Who goes to the hassle of using Tormail and then doesn't use PGP? Tormail only kills off metadata.

<comment><USER13> Getting people to use PGP properly is ... hard.

I've been called out by no less than a Linux evangelist, working at Google, for being so rude as to PGP-encrypt my email to him "because it was such a hassle to open".

When the ICIJ was doing its extensive collaborative investigation of offshore banking, the team evaluated using PGP, but ultimately abandoned it:

 _The project team's attempts to use encrypted e-mail systems such as PGP ("Pretty Good Privacy") were abandoned because of complexity and unreliability that slowed down information sharing. Studies have shown that police and government agents – and even terrorists – also struggle to use secure e-mail systems effectively. Other complex cryptographic systems popular with computer hackers were not considered for the same reasons. While many team members had sophisticated computer knowledge and could use such tools well, many more did not._

[http://www.icij.org/offshore/how-icijs-project-team- analyzed...](http://www.icij.org/offshore/how-icijs-project-team-analyzed- offshore-files)

It's little use if _I_ have and use PGP if I can't convince my counterparties to do so.

Sad, too.

<comment><USER31> I don't get it.

What's hard about GPG or S/MIME-encrypted mail? You set up the thing to integrate with the MUA once (in GPG's case, S/MIME are supported out-of-the- box with most common desktop MUAs), then the only hassle is to enter password on startup or when reading the first message. And lock the computer properly when you're getting away.

Write a message, tick "encrypt" (or don't untick it), send, done. Receive a message, see a badge "encrypted, verified", type a password (if key's not cached before), read it as usual, done. I fail to see how anything can be easier and less obstructive than this.

At least, my only problem with encrypting email is that practically no one of my peers have keys published. This could be easily solved if mail client software vendors could make their products ask user to generate and backup a keypair on install.

Oh, right, encryption has problems with webmail. Extension/userscript kludges are insecure (unless they open separate window/tab for anything private) and break with every other update.

<comment><USER13> _I don 't get it._

I'm with you. I've had mutt set up to use PGP for ages. I've configured a half-dozen or more other MUAs to use PGP/GPG. If I've got an MUA that _doesn 't_ support PGP, I can do ASCII armor encryption and decryption easily.

That's you and me, the geek set.

The Google guy I mentioned: he's just as versed. And yet, felt he should give me grief.

If you've got a Linux desktop, odds are that the tools you need are integrated. Congratulations, that's ... about 0.5-3% of all desktops depending on whose numbers you trust and/or like.

And an increasing number of users are now on smartphones and tablets. Yes, I've got K9Mail, but I've received no, and sent very few, encrypted emails.

In corporate environments, you get the tools you've got on a standard desktop and that's it. I've had a hell of a time convincing engineering and dev teams to create and use PGP/GPG keys and/or use SSH key authentication rather than passwords. I've been at shops recently which still use rsh (and had the pleasure of giving the solution to a user creating large numbers of client sessions: oh, yeah, SSH doesn't have the 512 max outbound connections limit that RSH does due to its privileged port use). Sigh.

Key distribution is a huge part of the problem. In large part it's what PGP Corp (now part of Symantec) addressed with its appliance solutions: a box that creates, signs, manages, and automatically applies keys for users. I don't exist, and yet I've got a key published (and embedded in my G+ profile coverphoto). Oh, what the heck, let's add it to my HN profile.

As you note: webmail, mobile, smartphone, and Windows are all problematic. But more than that: people _don 't fundamentally understand the technology they use_ (part of a _much_ larger rant and topic), and this stuff confuses them utterly.

</comment></comment></comment></comment><comment><USER32> The key sentence from this article: "the FBI is adapting to the age of big- data with an NSA-style collect-everything approach."

NZ PM John Key famously said: "If you don't want to be spied on, hide under a blanket." [http://www.thecivilian.co.nz/if-you-dont-want-to-be-spied- on...](http://www.thecivilian.co.nz/if-you-dont-want-to-be-spied-on-hide- under-a-blanket-says-key/)

Actually, hiding under a blanket won't help. I don't think Americans get it yet, so let me shout it: YOUR GOV'T IS SPYING ON EVERYTHING YOU DO!

They don't wait for you to commit a crime and then get a warrant: They collect everything!

And not only the US government, but governments all around the world. In fact, the British government spied on users of Angry Birds, along with the NSA. Source: [http://www.nytimes.com/2014/01/28/world/spy-agencies- scour-p...](http://www.nytimes.com/2014/01/28/world/spy-agencies-scour-phone- apps-for-personal-data.html?_r=0)

And this is nothing new: "In 1862, Lincoln authorized sweeping control over the American telegraph infrastructure for Edwin Stanton, his secretary of war. Telegraphs were re-routed through his office, and Stanton used his power to spy on Americans, arrest journalists, and even control what was or wasn't sent." Source: [http://www.theverge.com/2013/7/6/4499636/how-lincoln-used- te...](http://www.theverge.com/2013/7/6/4499636/how-lincoln-used-telegraph- office-to-spy-on-citizens-before-nsa)

There you have it: The US government has been using NSA-style electronic surveillance to spy on its citizens since at least 1862. So do you really think anything's going to change now all of a sudden?

</comment><comment><USER33> If the French hosting service was really OVH, it would be quite strange that a Polish refugee fleeing for political reasons take part in a large-scale spying operation. But since they are now operating in the US, I guess they have no choice than look like nice little soldiers.

</comment><comment><USER34> If you used ANY webmail site, the FBI has your inbox.

FTFY.

<comment><USER35> If you used ANY webmail site, the NSA has your inbox.

FTFY.

<comment><USER36> If you use email, the Black Chamber can have your inbox if it wants.

FTFY.

<comment><USER37> If you don't use email, chuck norris has your inbox anyway.

</comment></comment></comment></comment><comment><USER38> As long as people think the issue is technical only, they'll keep choosing providers that cannot hold the promise they make. Legislation and local provisions should be very high on your list. So far, Switzerland seems like the best legislation of choice according to this article: [http://arstechnica.com/tech-policy/2013/12/switzerland- wont-...](http://arstechnica.com/tech-policy/2013/12/switzerland-wont-save- you-either-why-e-mail-might-still-be-safer-in-us/)

Of course the author seems to disagree, especially when you look at the title, but that seems only because of some odd fascination with gag orders which seem largely irrelevant in real life as several comments have pointed out.

</comment><comment><USER39> Seize it all now and justify it[or not] later. Makes sense. Maybe we should all just go to jail now and wait to see if the government finds a 'lawful' reason later for us to be there.

"Strength through unity. Unity through faith."

</comment><comment><USER40> If HN is going to be a nexus of discussion on the FBI and NSA, it needs to understand the "social engineering" programs going on, and take steps to out astroturfing.

</comment><comment><USER41> Unless I missed it, the FBI still hasn't disclosed how they tracked down the physical server. The FBI said was it was "located in a country with an arrangement with the US, who gave us access", but remained intentionally vague and said nothing more. Can they really use that data without disclosing how they got it?

</comment><comment><USER42> The site was heavily associated with small time trading of drugs and weapons and what not. While US law might be overly harsh on the criminals, I can't really bring myself to feel bad for the half a dozen people who had any substantial legitimate traffic on the server.

<comment><USER43> So having the private communications of innocent people compromised as collateral damage to an investigation of a few bad people is ok now? They have servers full of communication logs and only a handful of people have been charged with crimes based on that information.

</comment></comment><comment><USER44> Surely if you use TorMail you are also the type to encrypt your messages, right? Right ?

</comment><comment><USER45> Privacy as a Service with centralized servers isn't "swat proof."

</comment><comment><USER46> People who used tormail with their real name and/or without PGP are _naive_ and have clearly no idea in what they were into. If the NSA has a huge amount of PGP's well... who cares? :-)

</comment><comment><USER47> Parallel Construction, anyone? They just happened to be executing a search of his gmail account and certainly hadn't looked over this trove of emails from people trying to be secretive?

</comment><comment><USER48> "...we had to oppose their application to preserve our own ability to protect our own games.  Otherwise, it would be much easier for future copycats to argue that use of the word "Saga" when related to games, was fair play."

That's disgusting. "We use the word saga in more than one of our games, therefore it's our game word and it's unfair if other people steal that word from us." ...

<comment><USER49> Wrong article?

<comment><USER48> Apparently so. Fucked that one up.

</comment></comment></comment><comment><USER50> Is anything safe anymore?

<comment><USER51> Was anything ever?

<comment><USER45> Another reason to use end-to-end encryption (like gpg with in-person signed keys) where possible and not worry as much.

</comment></comment></comment><comment><USER52> use [https://www.t3mpmail.com](https://www.t3mpmail.com)

</comment><comment><USER53> So bitmessage it is then...</comment>


C Is Not Reasonable - <AUTHOR> https://www.osr.com/blog/2016/09/19/c-reasonable/ <comment><USER2> First line:

> ULONGLONG tableOffset;

It's starting well, for a C example...

Oh, and it ends even better:

> _I write drivers for a living, not scientific or statistical analysis > software. During this project, I quickly learn that casting everything to > (double) was my friend. When in doubt, stick a (double) in front of it and > test it again. In the end, the code worked pretty well. The customer was > happy. We got paid._

o_O

OKOK, so you write drivers but don't know about C types, standard types, fixed-length types, you randomly fiddle with types until it passes a test but you don't know why it passes or doesn't, and you're proud of selling that.

Wonderful.

EDIT: added the "even better" part.

<comment><USER3> As someone who only has a passing knowledge of C, why is that wrong? Is it because it should be "uint_64" instead?

<comment><USER4> Because ULONGLONG is reminiscent of Windows, Visual Studio, and its flaky and outdated support for C.

It does not remove the argument of C choosing to use the type of the operands to determine the width of the calculus, but it shown that this is not portable, standard C.

Also, if the guy writes drivers, you should expect him to be aware of these problems, possibly having built an extensive set of preprocessor macros to handle these problems, like all other drivers use. But he seems to just loop into the "modify /compile" until it compiles and behaves, without trying to understand.

<comment><USER5> To be fair, though, this entire comment thread echoes the main point of the article: in what world is it reasonable to have to keep track of such things?

<comment><USER6> Drivers, for one. Any world where performance is so critical that you want to ensure you're fitting as much information as you reasonably can into the L1 and L2 caches for the computations you must do.

There's even still a role in this world for people to fine tune the assembly code for a specific execution environment to make their HPC models execute faster.

<comment><USER5> Respectfully, this misses my point (which, granted, was poorly explained).

The necessary evil here is using low-level languages. The unnecessary evil is using a language like C with arbitrary and highly variant conventions.

Better alternatives exist for writing drivers (e.g. Rust). To be clear, historical baggage sometimes dictates that we must use C, but that doesn't change the fact that much of the C world is a footgun, leading to eye-gouging frustration and threads such as this one about the myriad pitfalls associated with the language.

The author might not be a good C programmer, but this thread nevertheless supports his point. The necessity of writing C _in practice_ is neither here nor there.

<comment><USER6> Rust and its ilk _may_ eventually eat this space, but it doesn't appear ready. For one, it's list of supported architectures is too small. For two, it's poorly optimized, when compared to C. Three, it's still too new - it has only been "stable" for a bit over a year. Four, the static verification tools are not yet there (you still need a way to verify the unsafe portions of code, which will not be trivial in a driver).

Do you know of any existing non-toy (i.e. distributed in support of a device) drivers which have been written in Rust? I'd love to see some in action, and will be happy revise my opinion of Rust's capabilities when those drivers start rolling out.

Let's be frank for a moment. Rust's biggest advantage in this space is its memory safety. But we've had memory safe languages for as long as we've had C, and they still have not eaten C's lunch. If Rust wants to pave the way into C's territory (and not just C++'s territory), it will need to identify why and address that.

<comment><USER5> Okay, point taken, but I'd like to back-pedal a bit if you don't mind. I agree that Rust is very immature, but again I think I misspoke.

The basic point I'm trying to make is that C is (a) fraught with historical baggage that makes it difficult to use safely, in practice and that (b) this comment thread proves this point.

All points made beyond this are secondary and tangential. Again, I have to agree with you about the maturity of Rust, but I must insist that using C is fraught with absolute insanity. Sometimes it's the only thing available, but it's still insane.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7>
      ULONGLONG tableOffset;

      tableOffset = (l1Index * L1_TABLE_GRANULARITY) +
                    (l2Index * L2_TABLE_GRANULARITY) +
                    startingL3->StartingOffset;

I'm tempted to point out that there's some HTML mishap, but actually the statement will be compiled if there is a variable called gt and one called StartingOffset.

</comment><comment><USER8> Arithmetic is surprisingly hard to get "right". You might try to generalise from this example that "multiplying two N bit numbers together should give a result 2N" wide, then discover that for simple examples you run out of machine bits. Then there's overflow/saturation handling, which is a mess everywhere: lots of systems have hardware support for saturation arithmetic, but you can't conveniently specify it in C.

If anyone could think of a good, concise way of _expressing_ all these bells and whistles of arithmetic, it could be implemented as a language or language frontend. For now, most languages choose to either ignore it entirely or push the user to floating or arbitary-precision arithmetic as an 'improvement'.

<comment><USER9> For modern applications programming, arbitrary-precision is probably the right way to do integer arithmetic. Python does that, and it doesn't seem to cause any trouble. The people who need to do massive amounts of numeric stuff know who they are and can take the time to learn the relevant arcana, but your typical cat pictures app never has to worry about how big any of its integers are.

<comment><USER10> > Python does that

So do Ruby or Erlang. The problem, of course, is that it has a cost: trivial arithmetic operations have to be checked and may need to allocate.

And operational coverage can be spotty outside of the trivial range e.g. when you give a bignum to an "integer" operation going through FPN, bad things can happen as said FPN are generally machine doubles (fp64)

</comment></comment></comment><comment><USER11> It is strange to pick on C for this, as I cannot think of a single language that works the way the author seems to want. The only exception I can think of is Perl, which has the "wantarray" function that lets a function vary its behavior based on what its return is being assigned to: [http://perldoc.perl.org/functions/wantarray.html](http://perldoc.perl.org/functions/wantarray.html)

With that exception, it's pretty much always assumed that an expression is evaluated independently of what it is being assigned to. I have a feeling that the author's preferred behavior would lead to some surprising results, but I can't think of any good examples off the top of my head.

<comment><USER12> It would be nice if languages allowed us to overload function names with the exact same parameters but different return types. The compiler or runtime environment should be able to select the correct implementation automatically based on type inference, or allow the programmer to specify which one should be used with an annotation. This would make some code a little cleaner instead of having to give all of those functions different names.

<comment><USER13> > or allow the programmer to specify which one should be used with an > annotation.

That's exactly:

> give all of those functions different names.

<comment><USER14> Effectively; although "name" usually implies an opaque symbol, e.g. the language would see no difference between, say, "addAsInts" vs. "addAsFloats", compared to "addAsInts" vs. "divide".

Classes, namespaces, modules, etc. allow names to have a more fine-grained structure, e.g. "int.add" and "int.divide" come from the same module, whilst "int.add" and "float.add" are alternative implementations of the same signature.

<comment><USER13> > whilst "int.add" and "float.add" are alternative implementations of the same > signature.

Maybe in a functional programming language like Haskell. But not in C++.

<comment><USER14> The syntax was just an example ;)

What I described is actually closer to ML.

<comment><USER13> Has nothing to do with syntax.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> "This is wrong, and there's a way to fix it, but shut up I don't want to learn."

ok...

<comment><USER16> Indeed. The post begins with a question and asserts that the reader doesn't know the answer. I knew the correct answer instinctively and I haven't written any C in anger in years. Expecting a C compiler to promote expression operands prior to assignment because the output location is a larger size... that's just not the mentality C programmers develop; what if the output is smaller? Should all the expression operands be demoted automatically, producing radically different results as large numbers get truncated _prior_ to evaluation? No. Obviously not. That sort of thing is self-evident to a competent C programmer.

</comment></comment><comment><USER13> I really couldn't organize my thoughts from the sheer amount of criticism I have of this blog post. So instead, I'll kindly ask anyone to give this person a "do what I mean, and not what I say" programming language.

And they will realize that even that has quirks.

</comment><comment><USER17> C is a minimal abstraction over asm and I wouldn't be surprised if this behavior can be configured in some C compiler, even though it would be odd to do so.

What I find surprising is when people say C is a simple and small language that's nice to build portable programs in. So much of C is undefined behavior or implementation specific that many professional users pin a certain compiler toolchain version for a project. Part of it is due to changing and hard to predict optimizer passes, but most of it is due to the purported portability feature of C. I mean, if I leave a lot of the semantics undefined or to be defined per compiler+target, then it's not really a portability abstraction. Not to mention the missing or, if you consider POSIX, inconsistent across platforms, C stdlib.

It's educational to look into Modula-3 and SPIN. SPIN is like MirageOS but with dynamic loading of components whereas in Mirage everything is compiled ahead of time into the final image. I mention Modula-3 because it's of similar age as ANSI-C and serves as an example of an OS written in a comparatively safe language around the same time Unix won and gave us the hegemony of C (with all the avoidable security fallout ever since).

Even though software isn't like the real world and could be improved substantially unlike world politics, we still continue dealing with bugs due to C, although we have better options. I think as long as new operating systems or libraries and applications are written in C, this won't change. Just the idea of writing kernels for IoT systems in C in 2016 makes no sense from a reliability and high assurance perspective. Getting there half way would be exposing hard-to-misuse C APIs where the implementation is in a safe language (Rust, ATS2, etc). For the moment consuming C APIs is the cross platform library interface we have to deal with, but having at least the implementation be safe would go a long way.

<comment><USER13> C portability is not portability in the Java or Python sense. It's portability across architectures, and undefined (and implementation-defined) behavior is a powerful tool for that.

<comment><USER17> Of course, but shifting the burden onto developers, where most of them aren't professional libc or kernel engineers, leads to avoidable issues.

Rust seems familiar enough to many developers, and forces them to think about resource management before running the code by not allowing incorrect code, so I hope it will lead to more libraries and applications that would have otherwise been easily plagued with issues due to choosing C. Granted, I'm not a fan of how Rust's surface has turned out, but it's a sensible compromise to attract masses of developers into writing less buggy code that operates on the same level as that written in C. So I use it as a C replacement, and for that use case I like it because there's momentum behind it.

</comment></comment></comment><comment><USER18> I am just going to leave this here:

[https://www.amazon.com/Programming-Language-Brian-W- Kernigha...](https://www.amazon.com/Programming-Language-Brian-W- Kernighan/dp/0131103628)

</comment><comment><USER19> The way to understand it is that "+" when applied to ULONGs returns a ULONG. What the heck else it would return, in a language that doesn't have arbitrary precision arithmetic?

<comment><USER20> If it were consistent with FLT_EVAL_METHOD==2, then it would evaluate in the highest precision available.

There's a lot of smug criticism of this article, but there actually is a reasonable point that FLT_EVAL_METHOD is inconsistent with the way integers are handled in C.

<comment><USER19> That's a good point.

</comment></comment></comment><comment><USER21> What harsh comments about a person that is just asking for a warning. Tell me, do you really think such a warning wouldn't be reasonable?

I do agree with the author that it would be better if C coerced the operators into the result type before the calculation instead of after. I would really like a warning when there's an implicit coercion at the end of a calculation.

</comment><comment><USER22> Programming practically requires a willingness to continue learning. But his statements are deeply troubling:

> I'm not annoyed by the way statements are formed, or even by the precedence > order (which I readily admit to not knowing or understanding or even caring > much about)

> And don't complain about how I parenthesize my arithmetic statements. I > already mentioned precedence order. All those parens are the result of yet > another lesson I learned to avoid working weekends.

... his example is saying (a×b)+(c×d)+e->f. I understand it being a learning curve to memorize that bit-shifts have higher precedence over bitwise operators, but ... you learn that multiplication happens before addition in elementary school! It's a pre-requisite to learning pre-Algebra in middle school. This isn't even some arcane programming thing you have to learn.

Sure, you _can_ pepper all your code in parentheses, but sooner or later you're going to come across code that doesn't. And a person like that working on such a codebase is a huge danger.

I don't say this to be mean, but I really don't think programming is the right profession for this guy.

<comment><USER14> Whilst the delivery could be better, I agree with the sentiment that operator precedence is a waste of time. It's exactly the kind of mundane, error-prone work that machines should be doing for us, whether it's via a sophisticated structured editor, or a simple hack like Emacs's various paredit-like modes.

> Sure, you can pepper all your code in parentheses, but sooner or later > you're going to come across code that doesn't. And a person like that > working on such a codebase is a huge danger.

I can certainly imagine someone who doesn't care about precedence using an editor which disambiguates such things automatically; either by adding parentheses, colouring the background, etc. I can also imagine such a person spotting precedence bugs introduced by a colleague who considered themselves to be above such tooling.

Lisp, Forth and friends do perfectly well without having to consult precedence tables, and whilst I appreciate that some would prefer more syntax than those provide, I think precedence rules should still stick to the meta-level, parser-directing stuff like block delimiters, statement separators ("x ; y"), and maybe syntax sugar like "," ".", "=", etc. If it can be written as a library (which certainly includes things like numeric procedures) then it shouldn't have any precedence.

Even this minimal amount of precedence should be avoidable if desired, e.g. to avoid ambiguities like "a = b xor c". In PHP this parses to "(a = b) xor c", which is a perfectly valid PHP expression and caused the most egregious waste of my time to date.

Whilst it's true that learning and applying "BODMAS" is simple enough to do in high school arithmetic, the context of high school arithmetic is vastly impoverished compared to computer programming.

For example, which has the higher precedence: integer multiplication or list append? What about floating-point division compared to image convolution? Tree construction or matrix subtraction?

I think such questions are silly, yet they're a legitimate concern in languages with heavy use of infix notation (e.g. Haskell). Languages which define a fixed set of infix operators to avoid such problems (e.g. C) cause an unnecessary asymmetry between operators and every other procedure (e.g. think about the number of times "function(x, y) { return x + y; }" has been written by Javascript programmers!), and are impoverishing their domain of discourse much like high school arithmetic (e.g. compare introductory C material to something like [https://code.world/doc.html?help/codeworld.md](https://code.world/doc.html?help/codeworld.md) or [http://www.bootstrapworld.org/materials/spring2016/tutorial](http://www.bootstrapworld.org/materials/spring2016/tutorial) )

<comment><USER10> > Lisp, Forth and friends do perfectly well without having to consult > precedence tables

It helps that they have "alien" syntaxes (prefix or postfix but not infix). Smalltalk is also a language which did away with precedence almost entirely: it has a strict right-to-left evaluation model, and only three precedence levels[0]: unary messages (aSubject aMessage), binary messages (aValue <operator> anOtherValue) and keyword messages (aSubject aMessage: aValue) but because it has "infix operators" the effect is much weirder.

[0] or possibly a fourth, the cascading `;` operator is not a message, and can become really, really weird when used with different message types e.g.

        7 + 4 squared; factorial; yourself.

binds like this:

        7 (+ (4 squared)); factorial; yourself.

so it computes 4 squared, adds it to 7, then computes the factorial _of 7_ and finally returns 7.

</comment></comment></comment><comment><USER23> It's really simple, I have a table hanging right by my screen that has type of Operand1 and type of Operand2 and then the type of the result. It has never been an issue. In general, the result is always cast towards the larger and unsigned type.

</comment><comment><USER24> implicit conversions bad stop always use casts for conversion stop do not write drivers for my hardware with this approach stop

</comment><comment><USER25> So true. A page long rant is much more reasonable than the ten-or-so keystrokes that would paste the ULONLONGs in there.</comment>


Ask HN: What is the earliest model ThinkPad that can drive a 4K monitor? - <AUTHOR> <comment><USER2> My T460p can do it, my T430 can't, so it must be between the two I think (if you're interested in the T series). I can recommend the T460p if you're looking for a slightly older and affordable model, works very well with Linux and can drive a 4K display at 60 Hz via the Displayport.

</comment><comment><USER3> T450 series - I bought this specifically to work with my 4k monitor.</comment>


Ask HN: Cheap servers/hardware? - <AUTHOR> I've been looking at online auctions for 2nd hand servers and so far I've been disappointed with the options. Has anyone got experience in finding cheap 2nd hand hardware? Doesn't have to be high quality - just for a home CPU-intensive training rig. Australia BTW. <comment><USER2> Have you tried auctions?

<comment><AUTHOR> Yeah, but they're mostly old low end desktop computers.

</comment></comment><comment><USER3> What kind of specs?

<comment><AUTHOR> >2Ghz, and a couple cores. Don't really care about RAM, anything >= 0.5GB a CPU is enough

<comment><USER3> I've had good luck with 7000 series Dell Precision Workstations. They are built like tanks, hold seven drives, have 1000W+ power supplies and are cheap (from reputable sellers on eBay in the US, don't know about Australia). The processors are Xeons and the PCI slots abundant. The 7400 I bought new is ten years old this month. It has spent about eight of those years on. It's been through Windows XP Professional x64, Windows 7, Windows 8, Windows 10, and about half a dozen Linux distros (currently Ubuntu 16.04).

Anyway, the 7000 series are beasts but don't run as hot or loud as a rack server. They are big, expandable, support ECC RAM, and include things like parallel and serial ports in addition to USB.</comment></comment></comment>


Top OpenBSD Donors - <AUTHOR> http://www.openbsdfoundation.org/contributors.html <comment><USER2> Background: Smartisan is an Android phone maker in China. Smartisan fans pay for admission tickets to attend Smartisan's new product release events, and Smartisan donates the ticket sales to an open source project. So far they've donated to OpenSSL ($160k), OpenBSD (CA$280k), and OpenResty (pending approval).

Edit: IIRC, Smartisan's first donation to OpenSSL happened right after HeartBleed.

<comment><USER3> They donated $320k in two batches to OpenSSL in 2014. Is the $160k you mention for this year? Do you have a source for the exact amount? The PR News wire bit does not mention the exact sums per org.

<comment><USER2> I went back and checked the video for the latest release event in October 2016. Smartisan collected about 2 million RMB (Chinese Yuan) in ticket sales. They also donated another 1 million RMB originally for Smartisan Open Source Foundation (its own charity arm). So that's about 3 million RMB in total donated to OpenSSL and OpenBSD.

For its December 2015 event, Smartisan tried to donate ticket sales to OpenResty, but OpenResty could not legally accept the donation due to complicated Chinese laws governing non-profit organizations. So the money is still in Smartisan's bank account and pending regulatory approval.

For its 2014 event, Smartisan donated 1 million RMB to OpenSSL.

<comment><USER3> > For its 2014 event, Smartisan donated 1 million RMB to OpenSSL.

They donated 2 million RMB, see [https://mta.openssl.org/pipermail/openssl- announce/2014-Dece...](https://mta.openssl.org/pipermail/openssl- announce/2014-December/000001.html)

<comment><USER2> My bad. I only knew one of the donations. Anyway, I'm asking a friend at Smartisan and see if their PR could release a detailed list of past donations.

</comment></comment></comment></comment></comment><comment> vcistan-refugee Surprise surprise, no donations from any of the big VC firms, including YC. Freeloaders.

<comment><USER4> If you're serious, then how is open source software "free" if there is an expectation of donations?

<comment><USER5> We should all strive for "Free as in freedom, not as in beer".

<comment><USER6> Oh here we go...

</comment></comment></comment></comment><comment><USER7> Smartisan (the phone maker) is placed in the top level, called "Iridium". It's defined as $100,000 and above.

That level of donation used to be defined as $100,000 to $250,000. [0] The removal of the top limit could in theory mean that Smartisan actually donated more than $250,000.

[0] [https://web.archive.org/web/20161114061632/http://www.openbs...](https://web.archive.org/web/20161114061632/http://www.openbsdfoundation.org/contributors.html)

<comment><USER8> $280,000 !

<comment><USER9> Well, that works :-)

Never heard of Smartisan, checking out their phones now.

<comment><USER10> If you know Chinese, I will suggest you watching the videos of the release events. That's a very popular event in China since the speech skills.

<comment><USER11> I don't understand much Chinese, but here is a video of one of those events in case you want to see what jiyinyiyong is talking about:

[https://www.youtube.com/watch?v=5hPpeKPDoDg](https://www.youtube.com/watch?v=5hPpeKPDoDg)

It seems to be quite entertaining, by judging from the number of laughs/minute :)

</comment></comment></comment></comment></comment><comment><USER12> So Google donated to OpenBSD from 2012 to 2015 but not in 2016 (or less than $5000), interesting.

They seem to be their only long term recurrent donor.

Edit: Actually they are just part of the Core Infrastructure Initiative now [https://www.coreinfrastructure.org](https://www.coreinfrastructure.org)

<comment><USER13> They still have time, as do anyone else.. 2016 isn't over. :-)

[http://www.openbsdfoundation.org/donations.html](http://www.openbsdfoundation.org/donations.html)

</comment></comment><comment><USER14> DuckDuckGo also gave more than any of Microsoft, HP Enterprise, or Yandex.

<comment><USER15> ...Does that in any way _surprise_ you?

DDG has a program dedicated to donating money to open-source projects: they do it every year. MS, HP, and Yandex might also do so, but they don't have to same kind of dedication.

</comment></comment><comment><USER16> Its strange to see negativity to genuine support for open source projects. Instead of inventing conspiracy theories to try to explain away and diminish the donations perhaps it might be better to focus on the positive.

And maybe be try to understand why all the billion dollar companies so popular here rely on open source but do not seem to accomplish much beyond token gestures and posturing. Clearly Smartisan shows if there is a will you can do a lot. Maybe there is something to learn here that can lead to a positive change.

I think its beginning to look more and more like HN should stick strictly to VC and new tech stores. There is no social or moral dimension here to process any other information.

</comment><comment><USER5> Considering few people here seems to have heard about Smartisan before this thread, I think we can agree that this sort of donation works very well for publicity among geeks.

</comment><comment><USER17> Perhaps they're simply grateful for OpenSSH and for all that it enables?

<comment><USER18> Or maybe they're just mistaken...? (I'm kidding)

 _In celebration of this milestone, Smartisan will donate approximately 3 million RMB from sales of tickets of this year 's and last year's launch events to OpenSSL Software Foundation and the OpenBSD Foundation, two Android open source service organizations._

[http://www.prnewswire.com/news-releases/smartisan- technology...](http://www.prnewswire.com/news-releases/smartisan-technology- introduces-smartisan-os-31-including-revolutionary-open-source- features-300349051.html)

<comment><USER8> Well, there is a lot of code from *BSD in Android, for example libc.

OpenBSD: [https://github.com/android/platform_bionic/search?q=openbsd](https://github.com/android/platform_bionic/search?q=openbsd)

</comment></comment></comment><comment><USER19> Thanks to Yonghao,Luo, a great guy!

</comment><comment> this-dang-guy Reminded me that I forgot to donate to them this quarter :)

</comment><comment><USER20> I wonder if their Smartisan OS is OpenBSD-based

<comment><USER21> Sadly not; but I would buy an OpenBSD phone... if anyone wants to make it, please call me!

<comment><USER22> Sign me up too!

But to be honest, the problem with Android is not the Linux kernel but the fact that most phones were never designed to be continuously updated.

<comment><USER23> Actually Linux is a very poor choice when a product depends on out of tree binary blobs to operate. The lack of stable driver ABIs and APIs are a real problem for long term maintenance. I'm really surprised that the BSDs aren't a much bigger player in the embedded space.

<comment><USER24> Wasn't the original Danger developed phones based on NetBSD?

</comment></comment></comment></comment></comment><comment><USER25> I expected Apple here, though I'm not sure what version of BSD they forked for OSX.

<comment><USER5> Apple did not "fork" anything, and certainly not OpenBSD. Their core OS (Darwin) was developed by NEXTStep. It reused chunks of the original BSD (from which FreeBSD, NetBSD and OpenBSD were all forked at one point or another) mostly for I/O interfaces, but the actual kernel architecture is very different.

AFAIK Apple are are not involved in OpenBSD at any level, nor do they donate to any OSS project; they just maintain a few selected ones.

<comment><USER26> > Apple did not "fork" anything, and certainly not OpenBSD. Their core OS > (Darwin) was developed by NEXTStep. It reused chunks of the original BSD > (from which FreeBSD, NetBSD and OpenBSD were all forked at one point or > another) mostly for I/O interfaces, but the actual kernel architecture is > very different.

That's wrong. Apple pulled in and integrated a lot of code from FreeBSD itself to modernize NeXTStep.

[https://wiki.freebsd.org/Myths](https://wiki.freebsd.org/Myths):

> most userland utilities and the C library on OS X are derived from FreeBSD > versions

> The XNU kernel used on OS X includes a few subsystems from (older versions > of) FreeBSD, but is mostly an independent implementation.

<comment><USER5> I don't see where what you state contradicts what I said.</comment></comment></comment></comment>