Ask HN: Golang vs. Rust vs. Swift - <AUTHOR> I'm interested in the modern, more memory-safe languages that were built to replace the use of C++ in various places.
I wondered what people may know of each one? Below is my limited knowledge.
golang Invented for back-end web development, by Ken Thompson and two others, backed by largely open-source corporation. Has pointers, no classes/inheritance, has own compiler, as well as gcc support. Wide OS and architecture portability. Outline of original design explained: https://www.youtube.com/watch?v=sln-gJaURzk
rust Invented for cross-platform desktop app, backed by fully open source organisation. Strongly tied to x86, incompatible with other architectures.
swift Invented for native apps on client devices, backed by mostly closed source corporation (but Apple gifted clang to the BSD world). Has some level of Linux support...? <comment><USER2> This is like asking if apples or oranges or bananas are better. Rust, Golang, Swift ad infinitum all have their advantages and disadvantages.

First of all, you have not explained what the problem or issue is that you want to solve. Will you be working with bare metal? With networking? With native apps on iOS? So you should determine what it is that you actually would like to do, and then find a good fit from there.

All I can say is I like working with Go and Rust for different reasons. Rust has a slightly different paradigm, but I think people exaggerate the learning curve simply because it's just not what they're used to.

If you can't decide, then write a toy application in all three languages! This will give you a better insight into working with that language and its ecosystem. I.e. I still dislike how Go handles packages, but it's tolerable.

<comment><USER3> That's about my experience as well. I started playing with Swift when they launched it, and have dabbled here and there, but I don't have an iPhone or a Mac, so it's not very useful unless I really need to develop something for iOS (had a hackintosh for a while until my laptop died). I have since moved my prototyping to React Native targeting Android.

There are a lot of things to like and dislike about each language. I use Go at my day job and Rust for most side projects, and I feel I need to be careful with both. Go makes concurrency easy, which also makes it easy to make mistakes. Rust makes concurrency safe, which also makes it hard to optimize. I'm faster with Go in prototyping, but more confident with Rust not breaking at launch.

Learn them all. If you're an experienced dev, it'll take you less than a week to be comfortable with Go if you've done any concurrency, two weeks for Swift, and about the same for Rust (maybe more if you have little to no FP experience).

</comment></comment><comment><USER4> Swift is honestly the nicest of the 3 but a pain in the ass to use on anything other than Apple platforms. Yes, I know it runs on Ubuntu, I've done it, it's still not great.

Go is what it bills itself as, but I find it an eyesore to read and parse.

Rust feels to me like the best middle ground between the two, with an amazing ability to _force_ you to account for errors in a way the other two don't quite achieve. You'll spend eons on compile times, though.

</comment><comment><USER5> I believe that the main value proposition from Rust lang, is more about the safety guarantees, without having a GC that can add some uncertainty for execution time. (I don't know Go but it seems the GC pauses are very short, so if you don't have hard real time constraint Go GC is probably not that a big issue)

So basically use Rust, wherever you need C or C++ performances and you cannot afford to have a bug. So critical piece of the infrastructure, OS, critical embedded systems... It is probably easier to write correct concurrent Rust than C.

The fact that you can easily create static binaries that will run on Linux or Windows is nice, but I don't think this is the biggest differentiator.

</comment><comment><USER6> > Strongly tied to x86, incompatible with other architectures.

This is incorrect.

<comment><USER7> To add to this, here is a list of platforms that Rust supports: [https://forge.rust-lang.org/platform-support.html](https://forge.rust- lang.org/platform-support.html)

</comment></comment><comment><USER8> Does not matter any more. Just wrap it in a container, and put a grpc api on it (I.e. create a microservice). My preference is go, mainly due to the vast amount of open source libraries

</comment><comment><USER9> Do a simple app in each one and see which one you like best. Something like a todo API or something like ls, cat, or grep. Doesn't have to be perfect or anything just enough for you to get a feel for the language. Preferably something with dependencies outside the stdlib since managing dependancies is something you'll have to do anyway so you may as well see how it is before you get a bunch of them.

</comment><comment><USER10> In my experience. Golang's concurrency model is a lot nicer to work with. if you are doing heavy concurrency/parallelism stuff you should be looking at Golang.

Once you hit a wall with GC or want a good type system, then you can look at Rust. Note that rust is a big language with lots of concept from c++ and ml family languages. so you might need some time to get used to it.

I have no experience with swift, so I cannot say anything.

</comment><comment><USER11> Shouldn't the title be: "Golang vs. Rustlang vs. Swiftlang"

</comment><comment> 70122-_6 rust works with xbox360 classic, go-lang works with the likes of debian chromebook14-bt as far as I recall.</comment>


Facebook isn't happy about Apple's upcoming ad tracking restrictions - <AUTHOR> https://techcrunch.com/2020/08/27/facebook-vs-apple-ad-tracking/ <comment><USER2> Related [https://news.ycombinator.com/item?id=24291152](https://news.ycombinator.com/item?id=24291152)</comment>


DIY Overhead Control Panel - <AUTHOR> http://imgur.com/a/DyQZL <comment><USER2> Wow, nice work! I'd love to do something like this, but I don't know if my commitment to the task would hold up that long.</comment>


US ballistic missile systems have very poor cyber-security - <AUTHOR> https://www.zdnet.com/article/us-ballistic-missile-systems-have-very-poor-cyber-security/ <comment><USER2> The US military really needs a major upgrade in terms of its THINKING about internet security.

I've spoken to the military trained "cyber warriors" at conferences and it was unsettling. They simply had a worse grasp than some pre-college kids I've met who dabble in security between high school classes.

There's a lot of veneer there and not a whole lot of substance. It is like they're trained to be the world's best script kiddies (e.g. they run provided tools in a given order and expect a predetermined result, they don't REALLY grasp the underlying concepts at a low level).

Now I will say the NSA has some really sharp cookies, and I'm sure some other DoD departments do too. But the people at the top seem to think "cyber" war can be mapped to normal war, and train accordingly. That's a fool's errand.

Hopefully they get it together, but in terms of DoD's own internal politics it seems like a long road with the computer illiterate grey hairs at the top.

<comment><USER3> At my previous security consulting firm, the leadership team kicked off a _massive_ hiring effort of DoD veterans, driven by the idea that "cyber warfare is similar to real warfare, so veterans are a natural fit for cybersecurity jobs". Blech.

Based on my experience working with those ex-DoD folks, I echo your sentiment. Anyone who was known to be a part of the veteran hiring initiative became a black sheep among the other rank-and-file at my company, because everyone knew that the DoD folks could hardly do anything more complex than a follow a 5-step "how to install metasploit" guide without having their hand held (and even then...). They also had very little familiarity with basic security tools like MFA, IDS, IDM softwares (which makes sense after reading the article).

The worst part still was that they were very cocky about their abilities. I heard way too many times about how "I have experience with 'real war' at the pentagon, I know what I'm talking about", when in reality they certainly did not. If the actual DoD is anything like their ex-infosec employees that I worked with, I can only imagine that this article is just the tip of the iceberg.

</comment></comment><comment> jamieson-becker _IT administrators failed to install an intrusion detection and prevention system --also known as an antivirus or security product._

The conflation of two totally different categories of products decreases the credibility of the entire article.

With that said, the subject matter is tragic.. almost terrifying. Did we learn nothing from stuxnet?

</comment><comment><USER4> If WW3 ever starts, nobody will really know what works and what's been hacked. We used to have M.A.D., now we have M.A.H: Mutually assured hacked. WW2 weapons may be the only ones that still work.

<comment><USER5> More like Lackadaisically Uncertain Disarray.

</comment></comment><comment><USER6> Direct Link to DOD Report: [https://media.defense.gov/2018/Dec/14/2002072642/-1/-1/1/DOD...](https://media.defense.gov/2018/Dec/14/2002072642/-1/-1/1/DODIG-2019-034.PDF)

<comment><USER7> "...the vulnerability was initially identified in 1990..."

STIG scans are automated and the basis for identifying a finding is sometimes a lot different from the name. You have to decode the scanners script and compare the description with the code. In this case it is likely a "medium" finding that an email service is running and may be a risk. "May" and not "is". It requires a manual evaluation to confirm.

My favorite is the vulnerability identified as [redacted] which merely identifies the operating system as Windows. It is a High severity.

<comment><USER8> I have to run STIGs all the time on 450+ linux systems being a Linux Admin and all. STIGs are a good starting point, however the word guidance is in their acronym for a reason. Other security has to be considered.

At our facility we have a "check box" security department. The entity above us is so concerned about STIG findings and if they are checked of of the list, other vulnerabilities are left to the wayside.

I once got in an argument about outdated embedded versions of java in applications we use. some were up to 7 years old. I advised that we contact vendors, but being an systems admin that was up to the individual application administrators. I was told it didn't show up on scans and to shut up and color (OK they were a little nicer to me than that, same message though).

I can see how places might be lacking in security if they have the same mentality as here.

</comment></comment></comment><comment><USER9> Odds are everyone's nukes are poorly secured, not just the U.S.. So even if we manage to improve security, it only takes another side to lose their nukes to a not-so-cool-headed actor..

<comment><USER10> Nukes are a different beast entirely. Quite a few of their safety systems are physical and non-networked. The only danger are hacking delivery systems such as subs and bombers. But that would only prevent the delivery of a nuke, and not set them off.

<comment><USER8> As i recall it takes 2 people to physically launch an ICBM from either a bunker or a sub (simultaneous key turns). The other delivery method is a bomber, not sure what is takes to arm those.

<comment><USER11> ICBMs can also be launched through the Airborne Launch Control System, which sends a radio signal from an aircraft to the silo. ALCS commands have a delay and a time window of a couple of minutes I believe where they can be reversed by the crews in the LCCs, but absent their intervention, nuclear missiles can be hacked.

<comment><USER10> I am pretty sure it still requires the silo crew to launch the missile. Or at the very least have the missiles be in some kind of alert ready status.

* Update: Never mind, I stand corrected. You are correct. [https://en.wikipedia.org/wiki/Airborne_Launch_Control_System...](https://en.wikipedia.org/wiki/Airborne_Launch_Control_System#ICBMs_Remotely_Controlled)

<comment><USER11> This is a pretty interesting document, and gives quite a few hints about the workings of the ALCS: [https://static.e-publishing.af.mil/production/1/af_se/public...](https://static.e-publishing.af.mil/production/1/af_se/publication/afi91-117/afi91-117.pdf)

My understanding is that inside the capsule LCCs, if the ALCS sends a launch order, if they do nothing in two minutes, the missile launches. I believe any of the ten LCCs in the wing can abort the launch. Then there's some arbitration procedure where another LCC can reverse this and decide to launch after all, and then I think the wing commander's LCC can have a final override on that. The intention is that if all of the LCCs are destroyed, the missiles can still be launched, since there would be no one left to abort the launch, but under normal conditions, the ALCS would not be able to launch. The government is currently starting to build a new ALCS replacement system that is IP based, which I think has to be about the worst idea I've ever heard of.

</comment></comment></comment></comment></comment></comment><comment><USER12> Ballistic Missile _Defense_ Systems</comment>


Show HN: Smartwatch comparison table - <AUTHOR> http://prodct.info/smartwatches/

<comment><AUTHOR> People seemed to like the Chromebook chart, so I thought Smartwatches would be another good table to create.

Not a huge amount available right now; but hopefully the list will grow!</comment>


Thoughts on white people using dark-skinned emoji - <AUTHOR> https://techcrunch.com/2017/10/01/thoughts-on-white-people-using-dark-skinned-emoji/ <comment><USER2> I don't really understand why they don't add a blue or green or purple option that's clearly not meant to resemble anyone's actual skin tone in any way whatsoever.</comment>


Ask HN: What preventative steps are you taking during this extended pandemic? - <AUTHOR> With different guidance coming from each level of government, with each family handling it differently, and with no real end in sight -- what and why are you doing, what you're doing, during this extended pandemic?
Include work life and social life aspects.
I'm confused as to how to approach this, especially meeting (or not meeting) friends and family in person. <comment><USER2> (1) My employer has switched to (nearly) 100% remote work at least through the end of 2020.

(2) I've set up regular weekly zoom calls with my extended family.

(3) I'm spending a LOT of time just staying at home with my wife and children. Fortunately, our family gets along well.

</comment><comment><USER3> I work remotely so I'm doing basically the same I did in the past and it's working well. Only thing is that I don't visit my family since christimas.</comment>


Blocking high-risk non-secure downloads - <AUTHOR> http://lists.w3.org/Archives/Public/public-webappsec/2019Apr/0004.html <comment><USER2> From my reading, it looks they're considering this for only non HTTPS downloads _initiated from an HTTPS page_

Relevant quotes:

> ... we will likely start by treating certain high-risk downloads initiated > from secure contexts as active mixed content and block them.

> We're not planning to focus on non-secure downloads initiated from non- > secure contexts at the moment, because users at least see the "Not Secure" > omnibox badge on those pages.

<comment><USER3> Clever. This means users won't be able to easily download software from websites not plugged into CA tree. One more step towards eradicating the ability of people to independently host websites altogether.

Increasingly, I see that the web no longer fulfills any of its original goals. On the other hand, if I look at it as a software delivery/execution platform I see a horrible mess that could have been designed a zillion times better if that was the goal to begin with.

<comment><USER4> Couldn't you add additional certificate authorities to your browser at will?

The CA system is decentralized by nature. If the existing authorities start trying to manipulate your internet by controlling who they verify, which hasn't really happened that I'm aware of, you can always add a new root certificate. Or consumer browsers can offer new CA roots out of box.

<comment><USER3> The point isn't what you can do as a user. The point is that Google adds more and more hurdles to running a website without plugging into the CA chain.

CA chain is centralized. Plus, it requires you to have a domain name. DNS is also centralized (although to a somewhat lesser extent).

Effectively, we're seeing yet another step in hyper-centralization of the web.

<comment><USER5> How many websites do you actually use don't have a domain name?

also, as above, there is no one root CA. you can add and remove any ca from your system. most users don't because why would you trust a random ca from some random site.

What's the actual problem here?

<comment><USER6> That i do not want some third party's permission to make my site and desktop applications available to everyone.

Note the one you asked, but i have the same issues with the certificate mafia.

</comment></comment></comment></comment></comment></comment><comment><USER7> I dont understand why they are doing this. .exe files are known to be dangerous so usually when one downloads it you make sure its from a safe website. How is blocking non-https .exe downloads making this any safer for end-user?

I am getting fed up with Google trying to steer how the web should be. Already changed to Firefox.

Also when I think about this, this only hurts legacy windows applications which probably is hosted on a non-http site. I dont like this move at all.

<comment><USER8> Google found a threat model where attackers inject [http://](http://) .exe links into [https://](https://) web pages. This exposes a flaw in mixed- content handling, where web pages don't allow [http://](http://) resources to be loaded - but DO allow resources to be downloaded. Addressing that flaw for all file types would probably break a lot of the internet, but not for .exe (in their apparent estimation). I look forward to hearing what the Firefox and Edge teams think of this.

TLDR: In this approach, [http://](http://) sites can link [http://](http://) executables, but [https://](https://) sites cannot.

<comment><USER9> I don't see why a [https://](https://) site would serve up a [http://](http://) download link to an .exe in the first place.

Mixed-content rules would block even loading [http://](http://) _images_ on a [https://](https://) page, so wouldn't you think that blocking .exe _downloads_ from [http://](http://) sources on an [https://](https://) location would also be blocked?

I don't love Google, but this doesn't seem like a bad idea.

<comment><USER8> A properly behaving site would not. One hacked by malware distributors could.

<comment><USER10> Counter-example: Ubuntu serves their ISO via an HTTP link on an HTTPS page. They supply a gpg signature as a way to validate that the file was not tampered with.

<comment><USER9> Why? Why not serve the ISO over HTTPS?

<comment><USER11> The hostname resolves to a bunch of different mirrors run by different people who don't all share a secret key between them.

There are workarounds for this (using a redirector service and unique hostnames) but that is an additional request of donors who are providing them a lot of bandwidth for free.

It's not a great reason, but it is a reason.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> What if this was allowed: (Please excuse non-angle brackets.)

[A HREF="[http://example.com/SomeProgram.exe"](http://example.com/SomeProgram.exe") ExpectedSha256="..."]Download[/A]

If clicked, the download is checked and is quietly discarded if the hash is wrong.

<comment><USER13> Quiet discarding might not always be possible in a reasonable timeframe. You still have to get all the bytes to sha256 the payload, and so what? Do you expect the user to waste bandwidth and wait the check out? Often bandwidth and time both have costs attached.

<comment><USER8> Have we yet constructed a hashing algorithm that maps the file left to right onto the hash in a way that's provably correct at milestones other than "entire file only"?

If I could prove that the first 5% of a file is intact given the final hash, and repeat that proof continuously as the download proceeds, then it wouldn't be wasteful.

IANAC

<comment><USER14> Yeah, you could use 20 hashes.

/s

<comment><USER15> Why is that a bad idea? I mean, if you're downloading 1GB, your file is split into 1MB chunks, and each hash is 256 bits, that's only 32KB. I doubt anyone would complain about that.

</comment></comment></comment></comment></comment><comment><USER16> Malware authors are all already moving their payloads to https sites, so this will be useful for about a year until it's been worked around.

Fun fact: https is a great way to mask your malware payload from filtering proxies. So now corporate laptops have client-side HTTPS filtering, which have really stupid filter rules that break existing valid use cases of downloading files. So the users then turn the filters off, and now all the malware gets through. Yay https! We may not be secure, but we've got privacy, damn it!

</comment><comment><USER17> I wonder why the focus is just on downloads from https pages. I've not thought about this for very long but why is it ok for https pages to link to http pages? If I navigate to [https://trustedsite.com](https://trustedsite.com), and they link to [http://trustedsitesortof.com](http://trustedsitesortof.com), my browser should warn me.

<comment><USER6> That doesn't make sense, think HN/Reddit/etc, which are HTTPS and primarily link to other sites which can (and very often are) HTTP. There is no security compromised here nor any other link between the two than one referring to another.

Linking _resources_ (like images, files, etc) is another topic, but it doesn't make much sense to put a barrier for _pages_. If nothing else, you get annoying warnings that people learn to ignore.

</comment></comment><comment><USER18> Don't block anything excepting drive-by downloads. If I click on something with the intent to download it, it shouldn't matter what the source is.

This is why I use FireFox.

<comment><USER17> Yes it should - if I'm on [https://trustedsite.com](https://trustedsite.com) and they link to [http://notsotrustedsite.com/someexe.exe](http://notsotrustedsite.com/someexe.exe) you are vulnerable.

<comment><USER19> Linking from [https://trustedsite.com](https://trustedsite.com) to [https://nottustedsite.com/someexe.exe](https://nottustedsite.com/someexe.exe) doesn't seem to be much better. Nottrustedsite.com can serve you a malicious exe either way.

Https protects you against network MITMs, not evil sites sending you evil executables.

</comment></comment></comment><comment><USER20> Years pass, we have sci-fi level technology, and the main method of distributing programs to users on Windows is still downloading .exes from random sites and being on the lookout for the browser toolbar trying to sneak by when installing. I don't know what's worse, this, or Google trying to wrestle yet another group of website owners into obedience.

<comment><USER21> Well, at least under Windows (and MacOS) you are still able to distribute your application using an installer which users can download from your own site, rather than being forced to use a centralized "app store". And policies like these are making this more difficult. However they won't stop shady sites which "re-bundle" open source applications and add spyware - those will have no problem getting an HTTPS certificate.

</comment></comment><comment><USER22> > $ man 5 exe man: No entry for exe in section 5 of the manual.

Looks like I'm safe.

Though seriously, I don't see how this is going to stop people from getting infected. For a short time I did computer "repair" which was 99% removing malware/reinstalling Windows or fixing some silly configuration error the user made. One dude had downloaded 'jessia_alba_nude.exe' or something like that and infected his machine. I can totally see him following directions like "download jessica_alba_nude.jpg, rename to .exe, and double click to view" People are woefully ignorant and just want the carrot on the stick.</comment>


The Power Elite - <AUTHOR> http://www.nytimes.com/2010/02/19/opinion/19brooks.html <comment><USER3> One problem with opening the upper echelons to lower classes, is that the lower classes are more desperate for money and thus more easily corrupted. You couldn't offer GW Bush much that he didn't already have as a result of his family's status, but you might have more luck with the son of a poor steel worker like Rod Blagojevich.

<comment><USER4> _"... One problem with opening the upper echelons to lower classes, is that the lower classes are more desperate for money and thus more easily corrupted. ..."_

Really? Can you explain how are the lower classes more corruptible? Are you really suggesting that your hierarchy in society determines honesty?

 _"... His business dealings, which continued until his company's assets were seized in 1942 under the Trading with the Enemy Act, has led more than 60 years later to a civil action for damages being brought in Germany against the Bush family by two former slave labourers at Auschwitz and to a hum of pre- election controversy. ..."_

The problem with using Bush as an example is that Prescott Bush - <USER2> to both President Bush Snr & Jnr - worked with the enemy in WW2 ~ [http://www.guardian.co.uk/world/2004/sep/25/usa.secondworldw...](http://www.guardian.co.uk/world/2004/sep/25/usa.secondworldwar)

</comment></comment><comment><USER5> There are many things that had changed in the last 60 years. Trying to tell that the reason behind those changes was differences in power elite is quite shallow and not correct at all.

</comment><comment><USER6> Link to a related post analysing meritocracy : <http://news.ycombinator.com/item?id=1103408></comment>


Cloud Hosting (Amazon EC2, Rackspace etc), help please? - <AUTHOR>

I am currently going through a cost saving excercise and looking at cloud hosting as a possible solution. I currently run 3 dedicated servers, 1 load balancer, a SAN and a NAS.
It was only by accident that I came across EC2 from another post detailing how to create a proxy using EC2 to access the internet. Quite a revalation as I do love the EC2 platform and how flexible it is. I have signed up to the Windows instance to check it out to make sure it does everything I need it to.
It turns out it does do everything I need it to but I am a little afraid of the hidden costs. With my dedicated servers, I pay an amount a month and thats it. With EC2 I have worked it out and we will save money but I always feel like I am missing something in the config and if I went full scale with it they I am going to get stung.
Whats everyones experience with services like this? Can anyone offer their experience or advice? Any help would be greatly appreciated. <comment><USER2> For most projects you won't save money by using AWS or Rackspace. You are better of with dedicated/colo servers, unless you have managed servers or rackspace servers.

For CPU intensive tasks AWS is a good option, for CDN AWS & Rackspace are both good choices depending on your needs.

I am currently using AWS, for our next project I plan on using a hybrid solution VPS/Dedicated server-AWS CDN-Rackspace CDN.

Having used dedicated servers, AWS, and Rackspace. This is how I see AWS & Rackspace.

AWS

Pros:

\- Easy to add/reduce capacity

\- Very powerful configurations available for CPU intensive tasks

\- Inexpensive CDN with SSL & CNAME support

\- Disk space can be expanded without additional RAM/CPU

\- Good load balancers

Cons:

\- Poor disk read/write performance [i.e. slow DB performance]

\- Very expensive compared to hosting yourself (if you can afford to buy hardware)

\- Disk space is very expensive

\- Bandwidth is very expensive

\- Instances are expensive

\- No Customer Service (i'm not talking about technical support just basic customer service) unless you pay for expensive support contracts

\- RAM/CPU can't be expanded without upgrading into a package you might not need

\- Limited to 1 IP address per instance, which means you are limited to 1 SSL site per instance (you could use SNI, but many browsers still don't support it)

Rackspace

Pros:

\- Easy to add/reduce capacity

\- Better disk read/write performance than AWS

\- Inexpensive Akamai CDN

Cons:

\- Very expensive compared to dedicated/colo hosting yourself (if you can afford to buy hardware)

\- Disk space can't be expanded without purchasing more RAM/CPU

\- Cloudfiles (file storage) hosting is very expensive

\- Bandwidth is very expensive

\- CPU/Bundles are expensive

\- CDN doesn't yet support CNAME

\- IP Addresses are expensive

(This is off the top of my head, I might have missed something.)

<comment><AUTHOR> Fantastic feedback. I would co-locate the servers but we can't afford to buy the servers. The most expensive thing is the software for us, SQL alone costs ~£6k.

Hardware itself is cheap, setup times are long and exhaustive.

I just priced up Rackspace, its not an option, well expensive. Azure is hard to price up, could they make their form any more difficult to understand??

My current dedicated hosting provider has just put our prices up another £200 a month so thats the reason for looking round. I love our host but it annoys me that if I purchased the hardware then I would save us in 6 months what we spend in a year.

It just means me spending weeks setting up the hardware etc. I can't load balance, I won't have access to a SAN. I feel tied in.

EC2 say that the package I was looking at has good disc IO. Although I can't scale it without purchasing it really

<comment><USER2> Didn't know you were in UK. Colo/Dedicated server costs are definitely higher than here in the US. You might want to look for another dedicated server provider rather than the cloud.

The best way to get good disk IO from EC2 is setting up using a medium or larger instance and setting up a software raid.

<comment><AUTHOR> Thanks for the info. I was going to get the double extra large on my db server and double processor for the web servers.

Don't know what to do, I am finding myself pricing up SAN's etc this morning.

It's all down to time, I have the knowledge to do it all myself but I don't really want the responsibility. I don't want to go on holiday and the whole of our system to depend on me. I can make it as redundant as possible but as usual there is a cost behind that. More servers are more money.

We currently spend around 17k a year though on dedicated servers so to seriously save some money I would look at spending around that on actual hardware.

</comment></comment></comment></comment><comment><USER3> I work at Rackspace as a Cloud Solution Specialist - if you have any questions about how our cloud might compare to your dedicated configuration, I'd be happy to answer them for you.

Email me any time at mw @rackspace .com or call direct at 210-312-5464.

Matt Wilbanks

<comment><AUTHOR> Thanks Matt, I shall be in touch tomorrow

</comment></comment><comment><USER4> Just set up a cloud server on rackspace and it was my first time ever. Needed help on a few occasions and the people manning their live chat were extremely helpful. Took me a day to get everything online, setup, secured, and working without any previous experience (apache, mysql, mail server, smtp relay, etc).

What I really like is that fact that I can increase the size of my foot print in a few minutes. Since I'm starting to do PR and marketing this week if anything catches on, not to worried about experiencing server problems.

<comment><AUTHOR> Yeah I love this about EC2. I read an article this week that Rackspace hosting can take around 1.5 times more load than their EC2 counterpart.

It is all a cost saving exercise though and Rackspace to me has always = massive costs.

I'll speak to the guy who responded earlier though to see what they can do.

I do love all this cloud stuff though. I personally setup all my dedicated servers last and I know what involved, its a pain in the ass. If I could minimise that then that would be great.

</comment></comment><comment><USER5> From personal experience - AWS is slow. The latencies are far below industry average in our testing.

<comment><AUTHOR> Thanks for your feedback. I like the whole idea of AWS but I found their pricing model mis-leading as their products were laden with text heavy pages that were not clear cut.

It was only through actually setting up a reserved instance and seeing I was still being charged every day did I realise that the reserved instances still carried an extra cost.

Thanks for your feedback

</comment></comment><comment><USER6> I don't even consider EC2 a hosting provider. I think you have to do a bit of work to get around the various problems (slow, instances could disappear, etc.) However, once those issues are dealt with, EC2 works well (see Heroku.)

<comment><AUTHOR> Well I don't find EC2 very intuitive I must admit. I bought a windows reserved instance and I thought I could just "Start" it. But not, I had to create a new instance then guess which instance I had to start without being charged over the odds.

I think their whole offering is fantastic, _if it works_.

I like the whole EBS, VPC etc. I love being able to snapshot drives and recover in fails. I like that power I have to manage it.

Is Heroku purely Ruby?

I need to be able to deply Windows instances, I need MSSQL, I need to know my data is safe. I like all this cloud talk and I am certainly not one to sit still on technology when I could be saving money and getting more power with cloud based hosting.

My Current dedicated host has a cloud hosting feature but its doesn't have the same power as EC2. I want EC2 but I want the pricing to be clearer and I want to ensure that I get the power I am paying for.

I'm considering Azure as well. In fact, I will consider anything anyone can suggest.

<comment><USER6> Take a look at Rackspace.</comment></comment></comment>


Mailchimp down - <AUTHOR> https://longreply.com/r/9ca73be4

<comment><USER2> Thanks for posting this. Better than, you know, the Twitter post that is already posted.</comment>


The DooM-chip It will run E1M1 till the end of times - <AUTHOR> https://twitter.com/sylefeb/status/1258808333265514497 <comment><USER3> If this is your thing, I'd recommend reading the Doom Engine Black Book - <USER2> available on Fabiens site but the physical book is worth having!

[https://fabiensanglard.net/gebbdoom/index.html](https://fabiensanglard.net/gebbdoom/index.html)

</comment><comment><USER4> To clarify: This is the original Doom engine implemented in hardware</comment>


Rebase Considered Harmful - <AUTHOR> http://changelog.complete.org/archives/586-rebase-considered-harmful

<comment><AUTHOR> To anticipate some misunderstandings, I posted this in the light of Jeff Kreeftmeijer's latest post, "The magical (and not harmful) rebase"[1][2]. I had never read the full original "Rebase Considered Harmful" article, and after reading both posts, I'm not sure how I feel about rebase overall. Since I use Git, I'm curious to hear more from others.

Some people worry about rebase (reasonably) in terms of messing up other people's repos, but that seems like a simpler problem. Just don't do it. (Everyone would agree you shouldn't mess with history that is already public.)

I'm more curious about rebasing to produce a "clean" history. I'm not sure I like the idea of all history looking like a smooth, linear progression. (Let's set aside simple amends for typos and or leaving one file out of a commit. Those seem trivial and again not controversial.) If the point of rebase is to always smooth things out, I worry about the larger picture being lost. Anyhow, I wonder what more experienced people have to say. (Edited to make my concerns clearer.)

[1] [http://jeffkreeftmeijer.com/2010/the-magical-and-not- harmful...](http://jeffkreeftmeijer.com/2010/the-magical-and-not-harmful- rebase/)

[2] Discussion of [1] here on HN: <http://news.ycombinator.com/item?id=1779481>

<comment><USER2> I use rebase often: I develop on a feature branch, experiment there a lot, and before I push it, I rebase it to squash the thing into more managable and straightforward pieces. (I push my branches public when they're ready, and when I won't rebase them anymore)

For example, there's this project where the test environment is on another system, and I hardly ever test locally. So when I break something, there's a good chance I won't notice that until the test runs. At that point, I make a small commit to fix it.

I could push that all out, and merge the whole thing onto my master branch, but that would be a lot of useless clutter: development mixed with random fixes. I prefer my development line reasonably clean, so I rebase & squash things together before making them public.

This doesn't mean that my whole feature development will be one big patch, no. But it will be a series of clean changes, as it should be. Easier for everyone to understand later.

One line of development will look like a smooth, linear progression, but there can be many similar feature branches, which get merged to master at various points, and that line will not look all that linear. Smooth - hopefully, but not linear.</comment></comment>


Ask HN: Does this genetic testing (ie, 23andMe) service exist? - <AUTHOR> I'm thinking of a service like 23andMe that instead takes 2 samples and outputs what the children of the two people would be like, what they'd be disposed to, what their traits might be, etc.
I know this can be done at physician's offices to an extent (i.e., during family planning), but I was curious if there was anything cheap/simple out there available to the masses?
Thanks! <comment><USER2> Some other variations:

* Make your (genetic data) available to algorithms to use as criteria within a dating app for people looking to meet someone that they might want to have children with.

* Similar but use it for helping women find sperm donors (although it wouldn't surprise me if this already exists.)

</comment><comment><USER3> I carry genes for brown eyes and blue eyes. My eyes are brown. A child with a blue eyed partner may have brown or blue eyes depending on which of my genes it gets. Most things are not as simple as eye color but even if they were all binary, the combinatorics are so massive that a composite description of a child based on their parents would be a total fabrication.

</comment><comment><USER4> I find it hard to believe there isn't a huge market for this even if the results are highly questionable...

</comment><comment><USER5> Not with any reasonable accuracy for most traits - yet. There are both many to one and one to one relationships for genes to phenotype. Add in continuous/fuzzy/probabilistic measures and you get an explosion for the total set (although some subcollection might be tractable with data.)

Observationally some traits are more straightforward. Skin color, IQ and and height give us an unweighted average as the expected value for the offspring, with the height of either parent setting bounds on the variance. But that isn't news if your service can be replaced by SAT scores and simply taking a look in the mirror.

It's a good idea though.

</comment><comment><USER6> I would be curious as to the costs involved in creating a business from scratch that mirrors 23andMe's functionality with regards to design, marketing, legal, and scaled PCR.

I suspect it's a big chuck of change as they got $4 million from Google back in the beginning.

They do have long legal coat tails, so it might be indeed available business real estate for the intrepid.

</comment><comment><USER7> Quite interesting. I don't believe so, or at least I haven't heard of this.

23andMe can probably easily pivot to this area, but that hasn't stopped competitors in other fields that were dominated at the time. Plus this area is still pretty young and the market still has a lot of room for growth.

</comment><comment><USER8> Does some want to create the next Nate Grey ?</comment>


US Mayors Group Adopts Resolution Not to Pay Any More Ransoms to Hackers - <AUTHOR> https://tech.slashdot.org/story/19/07/11/1846228/us-mayors-group-adopts-resolution-not-to-pay-any-more-ransoms-to-hackers <comment><USER2> The cost of defecting is low. Why do they think anyone will actually change their future decisions because of this "resolution".</comment>


The $0.006 Object in a Sushi Container - ajay-d https://www.nytimes.com/2018/11/29/business/plastic-sushi-grass-thing.html <comment><AUTHOR> When did the venerable New York Times turn into a comic book?

Anyway, far from being an "important job" this is an example of inexcusable waste. Casually using throw-away plastic junk for something as pointless as "separating the flavors", when I'm just going to shove both of those things into my mouth anyway without bothering to rinse out my mouth and cleanse my palate with bland crackers, is beyond the pale. With our precarious global environmental situation, we should be criticizing not apologizing for frivolous waste like this.

And for this matter, stop giving me free plastic forks or chopsticks every time. I own my own reusable stainless steel utensils.

<comment><USER2> I really wish delivery services like DoorDash would present UI to opt out of cutlery and condiments (preferably as a default).

When I order a dinner for delivery to my home, I'm likely going to use my own plates/knives. If I'm ordering via phone or pickup, I can decline the default forks/chopsticks but using the UI it's nto possible without a "comment" and some restaurants don't even read that.

Yes there's already waste in the packaging but often that's compostable these days.

<comment><USER3> Why would you rather do dishes than use free plastic cutlery/containers?

<comment><AUTHOR> Why would you rather pollute the environment with more thrown away plastic crap than spend 20 seconds by a sink to clean a fork? Even if you recycle the plastic fork (few people bother to, since the fork is already associated with food waste they throw it into the trash along with the food waste) the energy cost of recycling that plastic is still inexcusable when you could have avoided the entire thing by simply owning your own fork.

<comment><USER4> Plastic is largely a byproduct from oil/gas processing... as long as we're using as much oil/gas as we do, plastic usage (even disposable) is already additional use out of the system. If it weren't composite plastic, it would be landfill sludge anyway.

Now, reducing the consumption of oil/gas could reduce plastic as a byproduct and increase costs in which case the market would self-correct.

<comment><AUTHOR> If that's the direction you want to approach the situation from, then consider that by allowing the byproducts to be commercialized you are in effect subsidizing the oil and gas, and thereby encouraging their continued use.

You should also consider the unique harm plastic waste _in particular_ does to wildlife.

<comment><USER4> I'm not saying it isn't a problem... the larger issue of littering in general, and wildlife preservation are huge to me. We have very well managed waste disposal sites, and do a lot of subsidizing recycling efforts.

My point was that if you aren't littering, then the net cost to the environment isn't such a huge thing. I'm also not a fan of government subsidies in general. Your point really isn't a subsidy, it's a means of greater use, which is generally considered a good thing. Unless you'd rather have more environmental waste that isn't used for any secondary purpose.

I'd love to see more/better efforts with regards to wildlife conservation, not littering etc. I like to do road trips while on vacation. Seeing the shear amount of litter on roadways, in the mountains and everywhere but a proper trashcan that will get disposed of reasonably is upsetting. Frankly, I think that getting society as a whole to respect their environment and other people's property (littering and vandalism) would go further to improving things than not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I always wondered about why that was put there, and considered it a waste; now I know otherwise. Good information here, thanks.

</comment><comment><USER6> Mods: please consider addressing the curiosity gap in the title by something like s/Object/Plastic Sushi Grass/ .

</comment><comment><USER7> To the people complaining about the format, does it make more sense if you look at it in the context of a social media story? It looks weird as images presented vertically on the New York times website. But this would be right at home in an instagram feed.

I personally appreciate the hand drawn look and artwork, but supplementing that with a text version would be an improvement for many reasons.

</comment><comment><USER8> It's バラン, not バラソ. Surely the New York Times is capable of finding someone who actually reads Japanese to proofread their work?

</comment><comment><USER9> I am sure this article is sardonic or maybe a word that I dont know yet, besides disturbing that is :)

</comment><comment><USER10> How does that tiny sheet of plastic in a plastic box separate the smell of fish from the rice when, in sushi, the fish is stuck either right above or inside the rice itself?

</comment><comment><USER11> I'd like that with bamboo leaves thank you.

</comment><comment><USER12> "traditional health benefits" means "bullshit health benefits", right?

<comment><USER13> Normally I would agree, but I think they were referring to "bamboo kun" which is how the bamboo plant fights off fungi and was thought to provide some antimicrobial properties, although at least in textiles seems to be ineffective [0]

[0] [https://bioresources.cnr.ncsu.edu/BioRes_08/BioRes_08_4_6501...](https://bioresources.cnr.ncsu.edu/BioRes_08/BioRes_08_4_6501_Xi_Qin_Antibacterial_Perform_Natural_Bamboo_Fiber_4310.pdf)

<comment><AUTHOR> If your sushi is sitting around long enough to start molding, you've got some logistics issues to resolve.

</comment></comment></comment><comment><USER14> I hope this crap of having drawings instead of actual text never catches on.

<comment><USER15> The author is an artist/illustrator. That is her medium. [http://wendymacnaughton.com/](http://wendymacnaughton.com/)

<comment> basil-rash I don't think we should tell artists what they can/can't do, but I do think it would be reasonable for the New York Times to enforce that all content they host is made as accessible as reasonably possible, for some definition of that.

This could be made much more accessible by just including appropriate captions, and doing so would benefit a large part of the community.

</comment></comment></comment><comment><USER16> This literally gave me a headache to read. I assume they made the article look like a 6 year old drew/wrote it because they thought it wouldn't be long enough (page-wise) without 10000pt font?

I wish there were a day to send feedback to the NYT saying "please do not do this again".

<comment><USER17> Reading handwriting gives you a headache?

<comment><USER18> Reading bubbly, squiggly cursive writing on a white background when nearly everything I use is black basically did give me a headache. Its an accessibility nightmare too.</comment></comment></comment>


Collect and analyze data from your interactions on FB - <AUTHOR> https://chrome.google.com/webstore/detail/data-selfie/kjmnobfdkgaclpkgeniccafoennghjnm <comment><USER2> Interesting (particularly the extra effort that has been put into _analysis_ not just data capture). Does it manage somehow to gather data on _all_ your interactions on FB, or just the ones through the desktop browser?

I ask because, although I don't have an FB account myself, I've observed that most of my family interact on FB using their phones, rather than a desktop computer.</comment>


India's air pollution in five charts - <AUTHOR> http://www.hindustantimes.com/static/pollution-india-five-charts/ <comment><USER2> Time to ban crackers during Diwali. Looking at the data there is always a spike around Diwali time.

<comment><USER3> That has to be an artefact, air pollution is measured near ground level so it shows up on the charts. I can't imagine that crackers contribute much to the general problem.

I heard that the air pollution is so extreme in some cities that it's comparable to running a car inside a closed garage. I was told it also smells and tastes just like it. I have no trouble believing it, just look at this [1] google image search.

[1] [https://www.google.com/search?tbm=isch&q=china%20air%20pollu...](https://www.google.com/search?tbm=isch&q=china%20air%20pollution)

<comment><USER4> Yep, once in Delhi I woke up thinking something was burning in the room. It was just the smog. Not going back there anytime soon.</comment></comment></comment>


Hacker News "Submit" functionality needs a Digg-like duplicate alert - <AUTHOR>

Do you guys agree?  I hate posting dupes ... but this site doesn't exactly discourage it. <comment><USER2> Usually when I've submitted a dupe story, if it already exists it just adds a vote to the pre-existing story.

Where the logic either breaks (or allows people to subvert it) is where different URL's can get you to the same story. Often times URL's contain some superfluous flags that don't change the content served, but just serve to log some referrer or layout type data (I'm sure everyone reading this site gets how this works). Adding, removing, or changing any of this data seems to pretty much break or confuse whatever dupe-detector logic exists.

<comment><AUTHOR> Human dupe-detection would be an excellent extension to this process.

<comment><USER3> Why not just compare the _content_ at the other end of the link with the contents of existing links.

It wouldn't be that hard. Whenever a link is submitted, YC's server would visit the link, get the response, strip all html tags and white space from it, then hash whatever is left. It would then store this hash value with the link. Whenever a new story is submitted, it is likewise hashed and then a check is made for an existing link with the same hash value. If it exists, it's a dupe, if not, allow it.

This would be an extra check to the existing dupe URL string of course. It still wouldn't catch every single thing, but it should eliminate quite a few easy dupes.

If that turns to have a low success rate, try hashing the page title or maybe the http headers.

<comment><USER4> A single comment or timestamp would change the hash.

Maybe the <title>, or the contents of the first <h1> or something would be a better proxy.

<comment><USER3> Yeah that is what I was thinking when I added that last line.

For some reason I initially wasn't thinking about comments... so the title would be a much better proxy.

</comment></comment></comment></comment></comment><comment><USER5> It catches most dupes, just not on sites like the NYT that have so many different urls.

<comment><USER6> Maybe you could check if the title of the page is the same as well, not as an automatic detection, but instead as a reason to ask "are you sure this isn't the same as foo". This might prevent most of the NYTimes dupes.

<comment><USER7> Would it be that hard to just take a fulltext index of each page that hits the hot page? From there, just show anything with some >N% similarity (probably 98 or so, as text ads can affect the site a little bit.)

<comment><USER8> With your comment, I saw for the first time how the semantic web might be useful.

</comment></comment></comment></comment><comment><USER9> Sounds like a nice-to-have feature. I don't think it's that bad to delete your own post if you notice the dup soon enough. No skin off your nose if the moderators kill it, either. That's happened to me.

</comment><comment><USER10> Hah, I beat you by 1/2 an hour <http://news.ycombinator.com/item?id=144730>

<comment><USER11> If I notice it early enough, I usually do what you just did and post the link to the original submission as a comment.

</comment></comment><comment><USER12> the only thing I noticed before (not sure if it's still valid) is that www.website.com is a dif submission than website.com

<comment><USER13> Those aren't the same URLs; the dupe detector currently only rejects exactly duplicated URLs.

</comment></comment><comment><USER14> The way they have it executed is incredibly annoying.</comment>


Show HN: Places traveled – leaving bread crumbs of your journeys - x-sam https://gradients.sergii.ml/2019/12/31/places-traveled/ <comment> x-sam Hello everyone,

I am the author and have this question every year before the New year: How was this year? What new countries did I visit this year?

So I spent a couple of last evenings and developed a set of scripts wrapped with Streamlit to fetch your data from Foursquare and visualize in different ways with Altair.

The source code to run on your own data is on GitHub: [https://github.com/lc0/traveled-dataviz](https://github.com/lc0/traveled- dataviz)

PS: the code was written while being on the road, so it might need more of polishing, but I wanted to post it before the end of the year :)

Enjoy your data and Happy New Year!

<comment><AUTHOR> Looks awesome, thanks for sharing!</comment></comment>


Ask: C++ or C#? - <AUTHOR>

Hello, Which programming language do you prefer between C++ or C#? <comment><USER2> it depends on what you're doing. c# is great for rapid development and will work for anything you're doing unless you absolutely, positively need performance.

c++ is pretty much a terrible language to use for anything unless you absolutely, positively need performance. some haters will argue that you should use c, but honestly,

for (std::vector<Hater _> ::iterator it = haters.begin; it != haters.end(); ++it) { cout << _it << "'s gonna hate."; }

<comment><AUTHOR> One constraint I have learned about C# is that it requires .NetFramework for program execution.</comment></comment>


President Obama Grants Commutations to 325 Drug Crime Inmates in August - <AUTHOR> https://www.whitehouse.gov/blog/2016/08/30/president-obama-grants-111-additional-commutations-most-commutations-granted-single <comment><AUTHOR> "They are individuals who received unduly harsh sentences under outdated laws for committing largely nonviolent drug crimes"

"The President will continue to grant commutations through the end of this administration"</comment>


Who controls the Internet? Analyzing global threats - <AUTHOR> https://blog.acolyer.org/2017/05/19/who-controls-the-internet-analyzing-global-threats-using-property-traversal-graphs/ <comment><USER2> > Distributing malicious JavaScript content The authors consider three ways to > do this: – directly compromising (or colluding with) web servers hosting JS > code; injecting malicious JavaScript when JS libraries are accessed over > unprotected connections (HTTP instead of HTTPS); and redirecting requests > for JS content via compromised name resolution.

Importantly, the first and third can be mitigated by subresource integrity (SRI) in modern browsers. If you don't control the host/CDN serving your static JS, that's how you protect against these attacks.

(The second, of course, is mitigated by regular old HTTPS.)

<comment><USER3> I agree for the third, but how sri will protect you from the first attack?

<comment><USER2> In this study, the JS is on a host separate from the site itself. Malicious JS from the compromised host will not match the SRI signature embedded in the HTML, and will be rejected.

If the main HTML web server is compromised, there's nothing you can do: a compromised web server can send whatever <SCRIPT> tag it wants.

<comment><USER3> directly compromising in my understanding tells me that the server is compromised. The server suddenly "decides" to distribute malicious JS.

</comment></comment></comment></comment><comment><USER4> CloudFlare has certainly and quite quickly become a major player in the internet game. For what it's worth, I've spent hours talking to Matthew Prince and while I'm sure he may rub some the wrong way he's undoubtedly a really good human. I'm thankful he and Michelle Zatlyn (an equally awesome and talented person) are steering that ship given the power they hold.

</comment><comment><USER5> It's interesting to compare this with the 2006 book of the same name by Tim Wu.</comment>


What this year's Oscar race can teach us about business… - <AUTHOR> http://mckainviewpoint.com/2010/02/what-this-years-oscar-race-can-teach-us-about-business/

<comment><USER2> Though I agree with the premise that too many options can hinder many business, I don't agree that this is universal to all businesses, and in particular to the average movie goer.

It's like Amazon limiting the number of books so that you had less to choose from.

The reason I think this fails with respect to movie goers, is that you likely don't select a movie based on 'oh let's make sure we go see all the movies that were nominated for an oscar'. You are more likely going to say 'let's go see a movie. what's playing, oh that one looks interesting, and it's nominated for an oscar, let's go see that'.

I think the authors theory is being swayed by his experience as a critic, and doesn't recognize that most people aren't critics.

additionally, a few years back when Chris Rock hosted the Oscars, I seem to recall him going to theatres and asking patrons what the "best picture" nominated films where about, and nobody had any idea, but they knew 'predator vs. terminator'. This could be the Oscars attempting to appeal to a larger audience.</comment>


How far the once-mighty SourceForge has fallen - <AUTHOR> http://www.gluster.org/2013/08/how-far-the-once-mighty-sourceforge-has-fallen/ <comment><USER3> For the youngins out there, 10-15 years ago SourceForge was like GitHub is now. It was extremely popular and reputable for open-source hosting. I remember thinking that one of the first considerations when naming a new project was: is MYPROJECTNAME.sourceforge.net available?

Never expected to see it decline into the spammy sketch-ville that it is now.

<comment><USER4> It's like a swanky hotel in a nice neighborhood deciding to start renting rooms by the hour.

</comment></comment><comment><USER5> What might be really dangerous is I think they also run rpmforge (aka repoforge) and many people use them on servers for yum updates as they have newer packages sometimes.

If they start messing with the releases for servers, we've got big problems.

Wait, no I might be wrong about this, I really thought they were related but rpmforge might be a completely different project.

Yeah I am probably wrong based on this old page:

[http://web.archive.org/web/20060208035034/http://rpmforge.ne...](http://web.archive.org/web/20060208035034/http://rpmforge.net/about.php)

They just re-used the "forge" name which fine but confused me and I guess I assumed it was run by sourceforge awhile back.

Sourgeforge however is owned by Slashdot's parent company, of that I am virtually positive.

<comment><USER6> That parent company would be GeekNet, Inc. [http://finance.yahoo.com/q/pr?s=GKNT+Profile](http://finance.yahoo.com/q/pr?s=GKNT+Profile)

<comment><USER7> "In September 2012, Dice Holdings acquired SourceForge from its previous owner Geeknet" says Wikipedia.

[https://en.wikipedia.org/wiki/SourceForge#Acquisition](https://en.wikipedia.org/wiki/SourceForge#Acquisition)

<comment><USER8> Correct - the various companies have been re-orged into a slightly separate entity called "Slashdot Media":

[http://slashdotmedia.com](http://slashdotmedia.com)

</comment></comment></comment></comment><comment><USER9> [http://webcache.googleusercontent.com/search?q=cache:http%3A...](http://webcache.googleusercontent.com/search?q=cache:http%3A%2F%2Fwww.gluster.org%2F2013%2F08%2Fhow- far-the-once-mighty-sourceforge-has-fallen%2F)

</comment><comment><USER10> Short version; our author objects to how SourceForge has been monetizing their traffic.

I didn't particularly like the tone, it seemed pretty mocking to me. I did not feel like that was called for.

I will suggest that at some point, if you live long enough, you will cross paths with someone you knew as a young person, someone you liked and respected, who was either charged with robbery or who was earning money in a way that you don't condone. I would ask that you judge carefully at that point. It happened to me when I drove by a friend from high school who was in the median strip asking stopped traffic for money.

Living in the world requires things, supplies, water, food, housing. Unless you can make those things on your own, you're stuck trading money for them. And to trade money, you have to get money. The longer you don't have enough money the lower and lower your standards tend to go. Some folks sadly decide to simply stop trying and check out of the system permanently. Life is real.

So when you see a site like SourceForge, you might ask what happened, or perhaps what changed, but it doesn't get you any points for judging them harshly for trying to survive. GitHub is the new hawtness and I love what those folks are doing, but I've not seen the press release that says they are operationally profitable yet, or even cash flow positive. That will change, and when it changes you may see them having to push "partner" software your way, they may have some other plan by then, or they may just sort of evaporate in some giant acqui-hire [1].

[1] Personally I think that Github being bought by, or displaced by, an infrastructure service play like Amazon's AWS is the most likely outcome.

<comment><USER11> As far as I know Github has _always_ been profitable.

<comment><USER10> That is entirely possible, I found this definitive statement from their press release when they raised $100MM from Horowitz:

 _" We've done all this without any outside investment. Our company has been profitable for years, is growing fast, and doesn't need money. So why bother?"_

And they went on to raise $100M. Presumably their business model scales with their feature set. I hope this continues for them as I like their service and their approach.

</comment></comment></comment><comment><USER12> SourceForge has been a POS and dead to me for many years.

I'm not sure it ever achieved "mightyness". Back when VA failed at what they were trying to do and started SourceForge, it was needed and they deserve praise for trail-blazing / attempting something big. But, I never really felt they carried through successfully.

</comment><comment><USER13> The sad thing is that strategy works and it works quite well. Most people that are not very technical will just click "Next" and "Agreed" blindly to complete software installation. I've seen numerous PCs plagued with toolbars and crapware for that specific reason. I always try to educate them to _always_ read what's on screen and never agree for the "toolbar thing", but it's mostly a lost fight.

<comment><USER14> After some resistance from my family (and 8 virus infections), I managed to steer my grandad onto Linux.

He wasn't a hugely skilled computer user to start with, just knowing a few patterns of clicks to open a web browser or a word document. I made him a little laminated card next to his screen explaining how to do the few things he needed to do.

It's been 2 years, and not a support call.

My only regret is checking his history to figure out where the viruses were coming from.

<comment><USER15> This my experience also. In Norway if you want to log in to your bank you need a friggin Java Applet. With all the security issues with the Java applet this year, maintaining the Java installation became really painful for my grandfather.

So I suggested Ubuntu with Unity, configured for automatic updating of software in background. I first gave him a new computer with a fresh installation, so he could try it for a few weeks first. Surprisingly it went very well (I usually have a few minor problems myself). He learned to use Unity within just a few minutes. He could use it with the Norwegian language(as he don't know english), and it worked great with increased DPI for less strain on his eyes.

Now it's been a few months, and he has not complained once! In fact, he tells me only good things about it! About how much faster it is, how much easier it is to read and how much easier it is to use the computer now.

While Unity is not a very useful desktop environment for myself, it is certainly great for people who mostly need easy access to a few applications.

<comment><USER16> > In Norway if you want to log in to your bank you need a friggin Java Applet. > With all the security issues with the Java applet this year, maintaining the > Java installation became really painful for my grandfather.

Oh this sounds painfully familiar. Every time I assist my father I notice Ask toolbar. I occasionally uninstall it, but of course it reappears with the updates. Well, at least I know that he is installing the updates so that's a good thing. But seriously Oracle, do you really need those couple of bucks from Ask?

<comment><USER17> One way to block it -- create a file in the place of the directory where Ask instlals (such as c:\Program Files\Ask). Give the file read only / system attributes. Most installers don't know how to deal with failing to create directory because a file exists by that name. I've used this trick to block a number of regular malware from reinstalling, along with Ask, and whatever else.

</comment></comment></comment></comment></comment><comment><USER18> The mighty gluster blog seems to have fallen as well.

"error establishing database connection"

</comment><comment><USER19> > _With their recent changes, users downloading from SourceForge now receive a > special closed source installer which attempts to foist unrelated third > party software onto them._

I think this deserves an obligatory "if you aren't paying for the product, you are the product." It seems to always turn out that way. After all, these projects are popular because they are good, and they are good because the developer or developers commit the time to develop, test, and support these projects. Naturally, there has to be a way to make money in order to keep these projects going, hence the Dice move. I'm not saying I agree with it, but I think it's reasonable. In other words, there is no such thing as a free lunch.

</comment><comment><USER20> LWN had a similar feature posted yesterday which has significantly more background information. [http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/](http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/)

</comment><comment><USER21> Agree entirely. SourceForge is unfortunately one of those places that puts me off projects these days. It's a baron land of advertising and poorly maintained products that just add noise.

<comment><USER22> A baron land would be a land ruled by a baron, a barren land is what you see Sourceforge as.

<comment><USER23> I thought that SourceForge was a barren land years ago, at least ever since they started putting interstitial ads in the downloads.

As someone who sits in front of Windows but does a lot of development over ssh in Unix this is slap in the face. There are both manual and automatic ways to get the real url that you could type into axel, curl or wget, but it just shows a lack of respect for customers.

I made a point to keep open source projects away from sourceforge because it was a ghetto, the same reason I didn't want to be seen on myspace. Just knowing a project is on sourceforge would bias me to think the project is not worth thinking about.

<comment><USER24> Right click and copy the url at the top of the page? I don't understand what the problem is with showing an ad underneath it.

</comment></comment></comment></comment><comment><USER25> I cannot access the article as the server is down right now, but saw a summary on a forum. [0] Was this not one of the first major no-no's of computer law in the user, starting with cases like Specht vs. Netscape? [1]

[0] [http://inagist.com/all/370801094563467264/](http://inagist.com/all/370801094563467264/)

[1] [https://en.wikipedia.org/wiki/Specht_v._Netscape_Communicati...](https://en.wikipedia.org/wiki/Specht_v._Netscape_Communications_Corp).

</comment><comment><USER26> The article gets a few things _very_ wrong. First off, there are no drive-by installers. It's an offer-based installer. Meaning that when you run it, you get a single offer of an additional product. Second, it's offering you either trialware (a trial version of a for-sale product that they hope you buy after trying) or adware (like an Ask.com toolbar to ad to your browser). The author of this blog post is either outright lying about it doing drive-by-installers and malware or is clueless about what the terminology actually means.

The last time this was posted on HN, I did a quick writeup on my understanding of it (reposted here):

"For the curious, this is an optional program at SourceForge being offered to developers as a way to monetize their work. The developer needs to specifically request it. SourceForge gets a cut, so does the developer. The installer is their first stab at this process and is using the bundling technology from Ask.com. As offer-based installers go, this one is about as good as it gets. It makes a single offer and has an Accept and Decline button with the user selecting whichever one they want (not a pre-checked box accepting the offer above a Next/Continue button). If accepted, the installer installs the offered software and it gets a standard entry in Windows' Add/Remove Programs that works as expected. If declined, the installer continues. The installer then downloads the originally-requested software.

The two issues with the current installer are that (1) it is served in place of the requested file with no indication that a substitution is made as the user downloads and (2) it requests admin rights before it starts downloading the software, which can be a security issue. Roberto (who posted the article) has stated that they are working on #1 in terms of the text shown on SourceForge as you select to download and download. As for #2, there may be some ways to rework the installer so this is not an issue. I'll mention it to him when I speak to him.

SourceForge has one other revenue-share program with developers where you place the SourceForge-branded download buttons on your own website that link to your downloads on SourceForge and you get a small cut of the ad revenue made from the download page.

If I recall correctly, SourceForge has been losing money for a few years now. Dice Holdings picked up SourceForge and Slashdot while Geek.com kept ThinkGeek.com, so they are now separate entities. These new experiments are attempts to get SourceForge to be self-sustaining/profitable. Ad revenue alone likely won't cut it.

Unfortunately, Google Code, Github and others don't offer the full breadth of services that SourceForge does for open source projects. Google Code, Github, and others have all ditched binary downloads, so SourceForge is one of the only providers to make binary downloads available to Windows and Mac user at no charge. This is why SourceForge is popular for real apps (FileZilla, Pidgin, PortableApps.com, etc) and Github is popular for components (node.js, jquery, rails, etc). The code zips available at other providers are of no use to end users.

As full disclosure, I run PortableApps.com, one of SourceForge's largest projects pushing quite a few TBs of downloads through their mirror network. We make use of the SF-branded download buttons revenue share program but do not make use of nor have any plans to use the "enhanced" installers. Everything I've discussed here is already publicly available, I just thought it would be handy to have in one place."

After that post, it was pointed out to me that Github has added in the ability to host binaries, but I would wager they wouldn't take kindly to the kind of bandwidth that the major SF projects like PortableApps.com push through. I've also been in touch with Roberto who made the mentioned post on SourceForge about some suggestions and options including doing an open source installer that the end-user/sysadmin can verify before installing instead of it being a downloader installer with the offer built in but not the app you want.

<comment><USER27> Good write-up, thanks.

But this isn't a sustainable strategy. You're basically asserting SourceForge's unique selling point/competitive advantage is its ability to host files. You've got to be kidding.

GitHub has taken off like a rocket whose thrust show no signs of abating. SourceForge is going down the drain with a passiveness that shows no sign of abating--unless it is conceptually rethought, from the ground up. You know, does something new and innovative to address project needs from a contemporary point of view. Dice certainly doesn't seem to have an appetite for that kind of risk, just an appetite for the last drops of life sucked out of a dying carcass by throwing leeches on it.

<comment><USER28> > GitHub has taken off like a rocket

I think this is in part because they charge. I like this model. Its simple. You want to use GitHub for free then you have to make your code freely available. You want to keep it proprietary then you have to pay for your account.

Where this doesn't translate well with SourceForge is that it was designed from the start to be of, by, and for Open Source projects. So the vast majority of projects would be non-paying.

However, they _may_ be able to add some features that appeal to proprietary projects who are willing to pay and use that revenue to offset any losses. It would be hard work but ultimately I think it would be be better than the appearance (if indeed it is just that) of distributing malware.

<comment><USER29> The vast majority of projects on github also do not pay. The two major features you pay for on github are larger repositories, and private repositories. The free offering is good enough for almost all open source projects.

<comment><USER26> The big issue would be downloads when it comes to real apps, though. Github discontinued binary downloads in December of 2012. But, they then added the 'Releases' functionality last month. I don't think they'd put up with the large numbers of downloads (and the associated bandwidth) of big projects like FileZilla, though.

<comment><USER30> If those projects are looking for a new home, we'd be happy to welcome them at GitHub.

<comment><USER26> From a quick look, SourceForge pushed out about 19TB of FileZilla bandwidth in the last 30 days in terms of binary downloads. I'm not sure any projects on GitHub are pushing that kind of bandwidth for binary downloads yet. Or are they?

In terms of PortableApps.com, I don't think we'd be a good fit for GitHub since we're a project that's a conglomeration of apps made portable (for USB and cloud use). I think we're around 90TB of bandwidth for downloads in the last month for our open source apps via SourceForge (some of our open source apps the publishers self-host like Inkscape and LibreOffice so we don't push those through our SourceForge project).

<comment><USER31> You can get 100TB/month for under €100 on Leaseweb. Couldn't you raise this in donations each month? I'm sure with your traffic it'd be possible.

<comment><USER26> I generally don't trust anything that sells 'unmetered' bandwidth as it nearly always ends in disaster. Their metered accounts seem to be 10TB for $95 which is about what we're paying for freeware downloads now (we can't host those on SourceForge, of course).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> How far the gluster server has fallen. Here's the text of the article:

\----

How far the once mighty SourceForge has fallen…

[Editor's note: This post is the opinion of the author and not necessarily that of the Gluster Community]

TLDR:

SourceForge, once a mighty force for the good of Open Source, has fallen far from its previous lofty heights.

Dice, the new owners, bribe strongly encourage the top projects to use a new (closed source only) installer that pushes spyware / adware / malware.

Developers using SourceForge should migrate away from it if they want to keep their integrity. End users using projects hosted on SourceForge should immediately find an alternative.

Full version:

When people download software from SourceForge, or any major repository of Open Source software, they expect the software to be trustworthy. (baring unintentional bugs)

They do not expect the software to be a source of "drive by installer" style malware, spyware, adware, or any other unrelated/unintended software.

SourceForge's new owners, Dice, have consciously and deliberately moved to a model violating this trust.

With their recent changes, users downloading from SourceForge now receive a special closed source installer which attempts to foist unrelated third party software onto them.

For example, when a user clicks on this:

        http://sourceforge.net/projects/filezilla/files/FileZilla_Client/3.7.3/FileZilla_3.7.3_win32-setup.exe/download

They instead receive this:

        http://ak.pipoffers.apnpartners.com/static/partners/dynamic/SFFZ/SFInstaller_SFFZ_filezilla_8992693_.exe

This is a "drive-by installer", designed to catch less technical users and the unwary, to fill their computers with malware / junk ware / crime ware. As abused by the notorious ask.com toolbar and others:

FileZilla_drive_by_downloader_smaller

It gets worse.

When SourceForge introduced this, it bribed encouraged the top projects to participate by giving them a cut of the take. So these co-operating projects are also knowingly selling their users down the river.

I'm not against monetisation at all, we all have lives and need to pay our bills. But not through abusing user trust. Not through preying on the unskilled or unwary.

To misquote Marge Simpson; "They not only crossed the line, they threw up on it."

If you're a developer or contributor to a SourceForge project, please ask them to move to a new project host (there are several). And cease all further involvement until it's complete. I've already done so with mine.

If you're a user of a SourceForge project, please find and use an alternative project instead.

We should all demonstrate our commitment to user safety and personal integrity around this issue.

<comment><USER33> > This is a "drive-by installer", designed to catch less technical users and > the unwary, to fill their computers with malware / junk ware / crime ware... > To misquote Marge Simpson; "They not only crossed the line, they threw up on > it."

And after a little research, it's clear that this article throws up on the truth.

1) "drive-by installer" Drive-by installers don't require user to download and intall, and are definatelly not OPT-IN like this one

2) "malware / junk ware / crime ware" \- He listed all of the wares, except the one that it is, offer-installer is adware.

I'm no fan of opt-in adware, but plenty of quality apps depend on it. I've been using daemon tools for almost 5 years now, and I've never had an issue with it. For such a trivial tool with opensource alternatives, most people won't pay, but developers needs to pay their bills and a little adware gets the job done.

For click bait garbage articles like this I wish HN had someway to unvote.

<comment><USER34> It's malware. No one wants adware and toolbars. Even if you ask politely and they say yes, no one wants that, and no one should have it. A spade is a spade.

<comment><USER35> as i said in response to another post, i hate adware and toolbars as much as the next person, but semantics is important: malware is malicious software. a toolbar that i did not intend to install, but is not malicious, is not malware.

<comment><USER36> I consider this sort of software harmful, but there is definitely an important distinction between it and software that actively tries to steal your credit card numbers, run a botnet, or send spam email. We need a word specifically for software that makes an attempt to abide by the law and avoid any outright malice, yet exists in a sort of moral gray area.

I propose "grayware."

<comment><USER37> How about "junkware" or "crapware"?

<comment><USER38> And I thought these were already the terms we use for this type of software...

</comment></comment></comment></comment></comment></comment></comment><comment><USER39> Okay. So SourceForge is pooping in the fishbowl at it's own party. Instead of picking up and leaving, maybe we could just make a concerted effort to ask Sourceforge to stop doing this? You don't have to demand everyone boycott a useful service like this every time something you don't like happens.

<comment><USER40> Are you serious ? Because you can't possibly think that asking SourceForge to "please stop making money" in order to please a handful of users will actually work.

</comment></comment><comment><USER41> It's all gone download.com

\- new cockney rhyming slang anyone?

<comment><USER42> What does download.com rhyme with?

<comment><USER43> Pete Tong

<comment><USER44> which, for non-cockneys, is slang for "quite wrong".

<comment><USER45> * just "wrong"

</comment></comment></comment></comment></comment><comment><USER46> Can you recommend alternatives that offer all their features? We use currently for example sourcecontrol, forums, bugtrackers, a wiki, the image galleries and their website hosting. I'm often unhappy with SF, but it's not quite that easy finding that kind of service elsewhere.

<comment><USER47> github has source control, a bug tracker, and website hosting. Don't know about forums and wikis.

<comment><USER48> wikis yes. forums.. not really unless you abuse the bug tracker. Github+Google Groups seems to be the complete package these days. BitBucket also provides website/wiki/issue tracker/source control features.

<comment><USER46> Yeah, it's probably a good solution for new projects. The problem with existing projects is when you already have a quarter million posts in your forum and don't want to lose them. Although maybe a mix of providers - <USER2> forums on SF and moving the rest of the project might be a solution.

</comment></comment></comment></comment><comment><USER49> At least SourceForge still offers a download option for the hosted projects, unlike Google Code...

</comment><comment><USER50> As someone who was once part of the original "Ignition Team" at VA Linux for SF.net, and who is still close friends with two of the original core SF team (the first iteration of SF.net was done by just four people in <120 days IIRC) we're all pretty much in sad agreement that it's just a husk of what it once was.

It's certainly dead to me.

</comment><comment><USER51> I'm not sure if it's possible to get the released file out of SourceForge, but my complaint would be (as a user that generally verifies cryptographic checksums) that what I downloaded didn't match what the project advertised.

Looks like some remedy in the case of FileZilla is that they host their own installer as well:

[http://download.filezilla- project.org/FileZilla_3.7.3_win32-...](http://download.filezilla- project.org/FileZilla_3.7.3_win32-setup.exe)

(Which matches the SF.net hosted FileZilla_3.7.3.sha512 list.)

Edit:

Looks like the original files can be gotten if you make your own direct link, e.g.:

[http://softlayer- dal.dl.sourceforge.net/project/filezilla/Fi...](http://softlayer- dal.dl.sourceforge.net/project/filezilla/FileZilla_Client/3.7.3/FileZilla_3.7.3_win32-setup.exe)

</comment><comment><USER52> I was just thinking the other day how much I like sourceforge. Their site has continued to improve. It's much more usable now than it used to be. I'm ok with sf monetizing their site the best they can. They've long been an advocate of open source and I appreciate an alternative to github. It's too bad the shakeup with Dice and split off of ThinkGeek, but it makes sense. Keep in mind, sf was the alternative to sites like Cnet and download.com which were/are far worse. I'm thankful for what they've done for driving FOSS adoption over the years, especially for authors on $0 budgets before the era of abundant cloud computing on the cheap, which we realize now had significant hidden costs, including human rights.

</comment><comment><USER53> So SourceForge downloads are becoming as bad as Cnet? Even the once-reputable members of the download hosting industry seem to be heading towards a rather unfortunate Nash equilibrium... Hopefully Github can sustain their model without it.

<comment><USER54> Github has plenty of customers who pay for private repos. They're profitable and have had some serious investment dollars injected.

</comment></comment><comment><USER55> The decline started years ago with the "Wait five seconds and we will redirect you to the real download page" filled with fake download buttons describing "Tired of waiting? DOWNLOAD" et cetera. They never improved their core product (repositories are still hell to navigate through) and only added interface elements and tweaked the UI to get you to.click on ads. A shame, because before that Sourceforge was the go-to place to download homebrew, free alternatives to proprietary software.

Github is great, but as it looks right now they fail to pull in those big legacy software packages. Their main audience seems to be web dev.

</comment><comment><USER56> This article is full of hyperbole and exaggerations. I downloaded the latest filezilla with the offer-installer "malware" and scanned it with Avira free antivirus, and MS Security Essentials. Both of them reported no problem.

I then was able to install filezilla without the offer-installer just by not clicking on the checkmark. After the installation, my VM ran normally, no pop- ups, no changed homepage in firefox or IE.

People that write this drivel make the open source community look like a bunch of nutjob, hippy zealots with no grasp of reality. Ads pay the bills and sadly some open source developers have mouths to feed.

<comment><USER57> The problem with these install "wrappers" is that they run with elevated privileges and you do not know what they're doing.

This wrapper presents the same problems as OpenCandy. Can you get the source to the installer? No. Can you guarantee the wrapper only does what they say it's doing. No. Do you have a fiduciary or contractual relationship with the publisher upon which you can rely if their software causes you harm? Probably not.

Avira Free and MS Essentials are certainly not the be-all, end-all to code verification, so don't feel too secure after using them, either.

</comment></comment><comment><USER58> There's a lot of good software on SourceForge still. How long before SF starts holding it ransom? Sounds like a good time to fork your favourite SF-hosted code to another service as a backup.

</comment><comment><USER59> > _I'm not against monetisation at all, we all have lives and need to pay our > bills._

OK, I'm game. How should SourceForge monetize?

Just about everyone here is running ad blocking software, not that display ads pay much anymore. Not that anyone will tolerate seeing an ad for the free software they're downloading.

Should SourceForge charge a monthly fee to projects? To users? Perhaps SourceForge should arrange licensing deals to make white label SourceForge clones? Maybe they should just start doing consulting on the side?

<comment><USER17> Don't they already have paid commercial hosting (along with a paid self-hosted version of their site)? I thought it was free only for software meeting one of their approved free licenses. Otherwise you have to pay.

<comment><USER59> Most of their projects are free licenses.

</comment></comment></comment><comment><USER60> The web installer was initially not detecting the proxy at my workplace. Hopefully popular projects like Filezilla will move their download binaries off Sourceforge.

</comment><comment><USER61> SourceForge is to github

what myspace is to facebook

what gm is to tesla

and what slashdot is to digg, now to reddit

and so on

</comment><comment><USER62> I also posted this some time ago.

</comment><comment><USER63> wait. sourceforge is still around? i doubt those that use it read hacker news.

</comment><comment><USER64> Hey guys, do you know an alternative service that provides mailing lists (no Ggle groups please)?

<comment><USER65> I don't know why you don't want to use Google Groups, but depending on your reasons you may like [http://librelist.com/](http://librelist.com/)

There's also Yahoo! Groups.</comment></comment>


Monitoring and Tuning the Linux Networking Stack: Receiving Data - <AUTHOR> http://blog.packagecloud.io/eng/2016/06/22/monitoring-tuning-linux-networking-stack-receiving-data <comment><USER2> A nice overview; thanks for sharing it!

I don't think that your claim that GRO is "a software implementation of a hardware optimization that is known as Large Receive Offloading (LRO)" is correct, though. GRO effectively replaces LRO [1]; it has fewer limitations (it works with non-TCP traffic and with bridging [2], for example). Drivers need to support it, but they are free to take advantage of hardware offloading/acceleration, and many do (including e.g. the ixgbe driver [3]).

\----

[1] In terms of function, and in the sense that LRO could be removed if the drivers that were using LRO were updated to use GRO instead.

[2] Relevant bug: [https://bugzilla.redhat.com/show_bug.cgi?id=772317](https://bugzilla.redhat.com/show_bug.cgi?id=772317)

[3] Which actually supports both LRO and GRO; if I recall, in older versions, bad things(tm) would sometimes happen if you had both enabled at the same time (whereas now the LRO setting is ignored if GRO is enabled).

</comment><comment><USER3> While most of this can be found in the MAN pages, this is a nice synopsis to have on hand. Definitely going to bookmark this.

</comment><comment><USER4> > There is, unfortunately, no easy way out.

Disagree. BSD.

<comment><USER5> That's a tough pill to swallow for many

</comment></comment><comment><USER6> It is a bit hard to follow the listings as they don't use a monospaced font. A part from that, very detailed and useful article.

<comment><USER7> Sorry about that! What browser/operating system? I suspect this is a missing font issue.

<comment><USER8> I think I see the same thing on Chrome/Linux. If I comment out the `font- family: monaco` rule in the `article.type-system-sans code` CSS rule, then a monospace font is used and makes things much more readable.

<comment><USER7> Just deployed a fix, thanks for the bug report!</comment></comment></comment></comment>


April 10/11 Brazillian Windows 7 update make computers don't boot - <AUTHOR> http://www.techtudo.com.br/noticias/noticia/2013/04/erros-na-atualizacao-do-windows-7-impedem-boot-do-sistema.html

<comment><AUTHOR> I was informed of this by cutting edge researchers in Brazil public-funded universities (they are equivalent to US Ivy League), because they relied a lot on Windows 7 and their equipment don't boot at all.</comment>


Ask HN: What skills should I focus on developing during my master's? - <AUTHOR> Hello.
I'm currently taking a master's in Development and Environment (I understand this is not the expertise of HN). I was wondering, what general set of skills I should try and learn along the way, something that could be useful for several job careers (mostly in the "Social Science" field, i.e. policy making, consulting firms etc).
Thank you! <comment><USER2> Writing. Writing can help you think through a complex problem, and then editing and rewriting can help you explain a complex idea clearly, or convince someone to take action.

Reading. Learn how to take in lots of information quickly, how to notice what _isn 't_ being said, and to find implicit or faulty assumptions.

Quantitative research. That means visualizing and manipulating data, but also knowing when you can't trust the data, and the importance of diving into the details to get things right.

Qualitative research. Statistics will only ever tell you the big picture, and only if you ask the right questions. Qualitative research can help you trace causality, and tell you what questions are worth asking.

</comment><comment><USER3> Networking with other students, your professors, professionals in industry. Being a student provides a great excuse to meet professionals and make career helpful contacts.

</comment><comment><USER4> Networking (people!) and personal impact.</comment>


Timercpp: JavaScript-like setTimeout and setInterval for C++ - <AUTHOR> https://github.com/shalithasuranga/timercpp <comment><USER2> Not trying to be mean but why submit something like this to HN? This snippet just launches a thread per every timer using standard library and sleeps. There is no way to really stop anything or knowing if timers are active etc.

Sure, it's syntactically valid C++ (probably) but that's about it.

<comment><USER3> I feel like there is a more constructive way to outline in which ways this solution might need to be improved to be suitable for various real-world use- cases, without focusing on whether this submission qualifies as HN content.

</comment></comment><comment> w-m It has the same syntax as JavaScript, but unfortunately C++ is quite a different language. As C++ has neither compiler check for lifetimes nor garbage collection, this would be very easy to misuse in practice.

The Timer requires anything captured by the lambda to still be alive by the time the function is called. This may be obvious in C++, but it's still dangerous.

Even trying to use this as a set-and-forget-timer without any captures to work around this gotcha (like the example just printing stuff) won't work as the Timer object itself also needs to stay alive until the function is called. Do it further down the stack and the Timer is long destroyed when its function is supposed to run.

<comment><USER4> agreed, it is dangeorus if newbies try to use this

<comment><USER5> If it was only newbies doing such kind of errors. :\

</comment></comment></comment><comment><USER6> It's missing `clearInterval(int)`, and these replicas return void instead of an ID that I can use to nuke the execution.

I can't quite understand what this brings that I wouldn't find from a std::thread constructor, besides less available documentation?

</comment><comment><USER7> This setTimeout implementation has very different semantics compared to Javascript.

The main issue is it creates a thread per invocation instead of using an eventloop.

<comment><USER8> Exactly. And the eventloop that is available to a C++ application will differ completely depending on framework/platform. The only thing common to all platforms is that a thread is most likely to be the _wrong_ way to do this.

</comment></comment><comment><USER9> Seems like a very useful short snippet for creating threads without having to learn a new threading API coming from a JS background.

It seems to me like it would be more useful however to implement these functions using a queue and run loop so that we don't have to worry about hard-to-trace race conditions, etc.

<comment><USER10> > so that we don't have to worry about hard-to-trace race conditions, etc

Seems to me that something like 50% of clientside Javascript coding is "worrying about hard-to-trace race conditions", so maybe that's a feature, not a bug.

<comment><USER11> Really? I thought Javascript was single threaded, aside from webworkers?

<comment><USER7> you don't need parallelism in order to create deadlocks or race conditions

<comment><USER11> I'm sorry but I'm not sure how a single threaded program can have race conditions? Surely the very definition of a race condition excludes the possibility? Or are our definitions different?

<comment><USER12> The event loop stops being deterministic if you start triggering events based on a clock. Or if you have calls blocking on external resources with unpredictable timing.

Say, you have a code like this:

      asynchronously doA();
      blockReadingFile();
      doB();

Whether doA() is finished or not when doB() executes depends on internals of doA() and on how long blockReadingFile() takes.

</comment></comment></comment></comment></comment></comment><comment><USER13> Yep that's just as awful as JavaScript.

</comment><comment><USER14> It seems author is making a point that modern C++ programming is degrading towards the same illness JS packages are: we're now going to be using libraries which are literally 60 lines of code in order to accomplish something that could be done by the standard library.

</comment><comment><USER15> You might want to do something atomic with that clear.

</comment><comment><USER16> Why is delvincasper posting projects from shalithasuranga's GitHub account? Easy upvotes?

<comment><USER17> Sharing good information isn't a crime?

<comment><USER16> The problem is that it's not that good information but for some reason seems to make it to the front page quite easily. Being critical of a project is a good thing, this isn't it.

</comment></comment></comment><comment><USER18> This seems to spin up a thread for each `setTimeout`. The overhead of this is massive.</comment>


Ask HN: What are your favorite travel sites, blogs, accounts? - <AUTHOR> There are so many of them out there and most of them are very similar. I am looking for the very best as far as content goes and design as well.<p>Thanks, hopefully this is helpful to the whole community. <comment><USER2> [https://bikepacking.com/](https://bikepacking.com/) is probably a niche. They managed a good mix of content (routes, maps, blog posts) and selling (usually bike gear). [https://bikepacking.com/routes/gira- costa/](https://bikepacking.com/routes/gira-costa/)</comment>