Multi-threaded SQLite without the OperationalErrors (2017) - <AUTHOR> https://charlesleifer.com/blog/multi-threaded-sqlite-without-the-operationalerrors/ <comment><USER2> Everything old is new to somebody.

Python recipe for multithreaded sqlite access from 2007: [http://code.activestate.com/recipes/526618-multithread- suppo...](http://code.activestate.com/recipes/526618-multithread-support-for- sqlite-access/)

Which is itself based on this one from 2006: [http://code.activestate.com/recipes/496799/](http://code.activestate.com/recipes/496799/)

A quick google search for 'python multithread sqlite' also brings up [https://pypi.org/project/sqlite3worker/](https://pypi.org/project/sqlite3worker/)

</comment><comment><USER3> I feel like the scenarios in which it makes sense to use SQLite for multi users apps is growing, for a few reasons:

\- SSD hard disks are ubiquitious

\- WAL Mode: readers don't block, and multiple processes can access a single database

\- DB-per-customer is getting more common due to privacy laws

\- The browser itself is increasingly being used as a client side cache DB in its own right

IIRC Nomadlist uses (or used) sqlite. Wonder how many more web sites are using it in anger.

<comment><USER4> I am 100% on board with this sentiment. We are already exclusively using SQLite to back our B2B application and it has absolutely zero issues even under heavy workloads. I would say its easily faster (especially in terms of request latency) than the SQL Server instance we previously-utilized for the same purpose. WAL is an absolute must if you are dealing with any sort of concurrency. As long as you can satisfy the following constraints, I see zero reason to use anything other than SQLite:

\- Only one process will ever own the authoritative copy of the database at a time.

\- You don't have any near-term plans to cluster or otherwise go wide on your persistence layer across multiple processes. Keeping in mind that even if you do need to do this, it shouldn't be a huge deal to import your SQLite files into something that natively supports clustering like Postgres, or use some partitioning strategy that can distribute SQLite databases across multiple nodes.

I feel like a lot of misinformation has been put forth that would make SQLite seem unacceptable for larger-scale concurrent business applications, but every benchmark I've personally ran against SQLite makes every other database engine look like a joke (within the constraints laid out above; obviously a 30 node Postgres cluster is going to destroy a single instance of SQLite). You just need to understand a few magic PRAGMAs to get things up and running (journal mode = WAL), because it certainly isn't capable of any of this directly out of the box.

I don't know about the 'anger' aspect of it, but I certainly feel dejected by the current approach that most take regarding business object persistence. SQLite feels like a way to sidestep an entire universe of non-value-add concerns (creating a separate sql instance, networking, security, configuration, policy, etc).

In terms of management, SQLite absolutely cannot be beaten. It is literally as easy as copying any other file when performing backups or restores. You need to be a little careful with the .WAL and .SHM files, but nothing that can't be managed with a few lines of script in a cron job.

<comment><USER3> I'd be interested to hear as much about your set up as you can divulge. How many concurrent writing users you have, you use a cache, etc.

> In terms of management, SQLite absolutely cannot be beaten. It is literally > as easy as copying any other file when performing backups or restores.

This - I have a lot of respect to DBAs, enough to know that I am not one.

<comment><USER5> Can't speak for GP, but it really will vary on workload. How much data is in each DB, how much workload is write vs read. In a mostly read scenario (say a blog), I'd be surprised if you couldn't handle 100k simultaneous users on a fast drive, more with a good caching strategy.

For modest read/write, should be able to get 1000-10k users without much issue.

A little advice would be to ensure logging is to a separate db/drive from the main data if you are logging changes, etc.

The only down side is distribution with High Availability, but so many scenarios don't actually demand the extra overhead for true HA.

</comment></comment></comment></comment><comment><USER6> > _By default, pysqlite opens a transaction when you issue your first write > query (it does this by parsing every query you execute), and then committing > that transaction when you issue any other query that is not a SELECT, > INSERT, UPDATE or DELETE, e.g. CREATE TABLE or PRAGMA._

What's the rationale for this default? Performance? Consistency? Even without the problems mentioned in the article, I'm not sure if I would want my database to commit multi-query transactions without an explicit command to do so.

<comment><USER2> Definitely performance. Writes without a transaction are slow. SQLite's 99.999% use-case is for single thread single access, so you lose little and gain a lot by deferring writes until you actually need them done.

> _I 'm not sure if I would want my database to commit multi-query > transactions without an explicit command to do so._

You can easily disable it by setting the isolation level per [https://docs.python.org/3/library/sqlite3.html#controlling-t...](https://docs.python.org/3/library/sqlite3.html#controlling- transactions)

</comment></comment><comment><USER7> In my testing putting a mutex around a single write connection gives incredible performance, beats Postgres by a wide margin. SQLite for single db, single file per user is incredibly compelling for the one db per user privacy story alone.

</comment><comment><USER8> What's the benefit of pushing everything to a thread and faking sync operations instead of putting a mutex around writes?

<comment><USER9> In cases where you don't care about the query results your logic thread doesn't end up blocking.

<comment><USER10> In cases where you don't care about query results _and you don 't care if the operation completes_, you mean.

</comment></comment></comment><comment><USER11> I use a similar approach in RediSQL ([http://RediSQL.com](http://RediSQL.com), fats in-memory SQL on redis protocol).

There is a single thread that reads from a queue of statement.

The downside is that is hard to hold a lock on the db while doing application level operations, but that is a really advanced use case that I see rarely on the wild.

<comment> le-mark Redisql sounds interesting, are you getting any customers/tranction?

<comment><USER11> Thanks!

Some, not as much as I would hope. Definitely still need a job!

I believe is a quite though sale, there are many open source databases that you can use for free, but very few (if any?) offer in-memory as first class feature.

And databases are worse than marriages, quite difficult to migrate out so a new player need to sell itself very well before to even be considered.

If you are interested, or you would like to consider some form of partnership feel free to drop me few lines at firstname.lastname@example.com

</comment></comment></comment><comment><USER12> I'm looking to build a saas app on AWS and was seriously considering using SQLITE db for each company. I was also looking at RDS (Postgres) but im really thinking with SSD this isnt going to be necessary. The only downside I can see is that i'd have to handle backups and provide read instances if that became necessary.

<comment><USER13> Have you looked at ActorDB [1]? It's a distributed version of SQLite that may be particularly suited to multitenant SaaS applications.

[1] [http://www.actordb.com](http://www.actordb.com)

<comment><USER12> Did not know about this. thanks

</comment></comment></comment><comment><USER14> I think the real answer starts with using APSW, which peewee already supports. APSW, while not 100% compatible with pysqlite, is much more predictable and overall more transparent wrapper to my taste.

</comment><comment><USER15> Judging by the title only, I expected the post to handle 'BEGIN IMMEDIATE TRANSACTION' and sqlite3_set_busy_timeout...</comment>


Software Development 101: Validate your assumptions - <AUTHOR> https://shekhargulati.com/2017/07/22/software-development-101-validate-your-assumptions/ <comment><USER2> In software development never assume anything. Software development is hard and assumptions can catch you out very quickly. Remember the old phrase - assume makes an ass out of u and me.</comment>


Show HN: I made a tool that made me faster at Git - <AUTHOR> https://github.com/jesseduffield/lazygit <comment><USER2> > are YOU tired of typing every git command directly into the terminal

I'm not. Are there many people that are? Is this not just a matter of learning to use shell keybindings effectively? That and aliases does wonders to avoid repetitive typing. Many times I type `git s` (alias for `git status -s`) out of reflex when I really meant to do `ls`.

When I forget to add `-a` to `git ci -m ...` (`ci` being `commit`) and get an error because the index is empty, I just `<caps>kF-aa<enter>` (<caps> being <esc>) to add it and re-execute. It's muscle memory; I do it before I even realize I did it.

<comment><USER3> If you editor has a correct git support, you never need to do git status because it will show you which files had been edited since the last commit.

Every time I hear people saying how much they prefer the git command line is because they never seriously tried to leverage the git features of their IDE.

Vs code with git lens or intellij idea have excellent git integration. Everything is one shortcut away. The git commands that are used are log into a console if you want to check.

At the end of the day both methods work, it's just a matter of preference but it is worth trying a good git UI.

Also if you ever try to teach someone git, it's not as intuitive as you think [1]. Having a consistent UX can help.

That's why there is definitely a space for this kind of git UI as presented in the article. [1][http://stevelosh.com/blog/2013/04/git- koans/](http://stevelosh.com/blog/2013/04/git-koans/)

<comment><USER2> > If you editor has a correct git support, you never need to do git status > because it will show you which files had been edited since the last commit.

I prefer sticking to the Unix way. An editor is an editor. Why should it support git specifically? Git is only tangentially related to file editing, so it doesn't really make sense for an editor to know anything specifically about it.

> Every time I hear people saying how much they prefer the git command line is > because they never seriously tried to leverage the git features of their > IDE.

But I am! The whole OS is my IDE.

Seriously though, I've done fugitive in vim and magit in emacs. After some time of using them almost exclusively, I've decided it's better to use the shell. It's not because I haven't tried more "integrated" ways of programming, but because I find that the flexibility/power that comes with treating every feature of an IDE as a separate program in an OS environment is better.

EDIT: Added more comments.

<comment><USER4> > I prefer sticking to the Unix way. An editor is an editor. Why should it > support git specifically?

Because it's convenient. IDEs work with files. Git manages files. Ergo, IDEs should support Git.

</comment></comment></comment></comment><comment><USER5> Awesome work OP! I'm a big fan of using tools like this to supplement git, especially when it comes to some of the more complex operations.

Personally I use tig, which is basically this but different. I used to use Sourcetree and I loved it but it slowed to a crawl with bigger projects with long histories.

[https://github.com/jonas/tig](https://github.com/jonas/tig)

Best screenshots I can find on google are ironically from the Atlassian blog:

[https://www.atlassian.com/blog/git/git- tig](https://www.atlassian.com/blog/git/git-tig)

<comment><USER6> I use tig as well but I am currently experimenting with FZF and some gitconfig aliases.

</comment></comment><comment><USER7> If you're an emacs user, I can't recommend magit [1] enough. I was a diehard CLI user and had flags and aliases out the wazoo, and it was still a step change in usabilty and power for me. Staging hunks, rebasing, and stashing are all vastly easier. Amending or editing a commit is a breeze, and it's tied in to all of the other emacs tools you already use, e.g. org-mode to boot!

It's easier to see it in action than explain it. If you've two minutes to spare, check out this emacsrocks screencast [2], or Howard Abram's longer presentation from the PDX Emacs Hackers meetup [3].

[1]: [https://magit.vc/](https://magit.vc/)

[2]: [https://www.youtube.com/watch?v=rzQEIRRJ2T0](https://www.youtube.com/watch?v=rzQEIRRJ2T0)

[3]: [https://www.youtube.com/watch?v=vQO7F2Q9DwA](https://www.youtube.com/watch?v=vQO7F2Q9DwA)

<comment><USER8> Seeing a former coworker use Magit in Emacs is what got me to look into the Vim version: [https://github.com/jreybert/vimagit](https://github.com/jreybert/vimagit)

From what I gather it's nowhere near as feature-complete, but it lets me create commits with immense ease and precision.

<comment><USER9> Fugitive is great:

[https://github.com/tpope/vim-fugitive](https://github.com/tpope/vim-fugitive)

</comment></comment></comment><comment><USER10> > are YOU tired of typing every git command directly into the terminal, but > you're too stubborn to use Sourcetree because you'll never forgive Atlassian > for making Jira? This is the app for you!

lol

<comment><USER11> this readme really speaks to me

<comment><USER12> I'm out of the loop. What's the story here? Why are devs sad about Atlassian and Jira?

<comment><USER13> Jira has some asinine design issues, e.g. the only way you can link a git commit to a ticket is by putting the ticket ID into the commit message, generally has confusing choices for UI, code blocks {code}are annoying to add{code} and don't follow any existing conventions, integration with Confluence sucks, basic functionality is locked away in paid extensions, the list goes on

<comment><USER14> MVP Jira just needs to present a list of stuff to do. But now it's used like a panopticon of social control where I work. And I'm thinking I'm not the only one with stuff like Scaled Agile being out there.

<comment><USER15> Jira doesn't _have_ to be evil. It is intrinsically awful due to that tendency enterprise database products have of growing the flexibility to reimplement various wheels inside of them, poorly. But using it for evil depends on managerial intent.

At my gig, everyone grumbles about Jira, because it sucks; see above. But, we have workflows built primarily around it with various integrations, and it works for coordinating ~200 folks in a starting-to-get-there "Agile" model.

It is actually the worst for the managers - they spend a surprising amount of time noodling around in Jira to feed the workflows. For individual contributors, it works and isn't too much overhead.

From an administration standpoint, it is OK (we run the on-prem version). More stable than some enterprise monstrosities, but the with occasional problem. The plugin-store-thing is annoying - somehow it manages to entice nearly every new business-side user into asking for some random thing, they usually get what they want, and then they sit unused aside from occasionally breaking things.

<comment><USER16> > More stable than some enterprise monstrosities

It must have gotten a lot of stability improvements since I stopped managing jira clusters a few years ago because, from the ops side of things, JIRA was one of our main "make a cron job that restarts tomcat every night" running jokes at multiple companies over the last decade.

I've also had wonderful (/s) experience with the unicorns in Gitlab but that's another tale.

<comment><USER17> That's what you get for putting unicorns in a product.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> You know what would make me faster at git?

"git undo" : undo the last git command line, whatever it did. Especially if you don't understand what it did or it overwrote local files.

<comment><USER19> [https://github.com/tj/git-extras](https://github.com/tj/git-extras) provides "git undo" (among others).

<comment><USER20> It's a pretty useless wrapper over "git reset":

[https://github.com/tj/git-extras/blob/master/bin/git- undo](https://github.com/tj/git-extras/blob/master/bin/git-undo)

It won't help you if you don't understand what the last command did or when it overwrote local files; it'll just make everything worse.

</comment></comment></comment><comment><AUTHOR> Hey guys thanks for all the feedback so far! I whipped up a quick tutorial for anybody who wants to know the basics [https://www.youtube.com/watch?v=VDXvbHZYeKY](https://www.youtube.com/watch?v=VDXvbHZYeKY)

</comment><comment><USER21> This looks great. For some reason I don't mind using the GUI tools to view history and branches but for commits always use the command line. This should save some time and much typing.

<comment><USER22> I use TortoiseGit's GUI for everything except features that it doesn't have, like git add -p. It makes life so much easier when you can just right-click and go to "Show Log", search for something you care about, then right-click that one commit in 2017 that messed things up and click "Browse repository" to look at the entire repo & diff arbitrary files without checking out a single file messing up your work tree. Trying to do every single thing with a command line interface just sounds insane to me.

</comment></comment><comment><USER23> I'm mostly using plain Git, but there's one thing for which I needed a TUI: line-by-line selective committing.

After trying to find something I liked, I ended up porting crecord extension for Mercurial to Git: [https://github.com/andrewshadura/git- crecord](https://github.com/andrewshadura/git-crecord)

<comment><USER24> git add --interactive?

<comment><USER23> That doesn't have line-by-line functionality, and it's not interactive.

If you had a look you'd see git add -i is not even close to it ;)

</comment></comment></comment><comment><USER25> I use VS Code and GitLens lately. VSCode's diff view and GitLens explorer cover my needs very well.

<comment><USER16> Gitlens is incredible. I can't believe none of my coworkers I ever mention it to have used it.

<comment><USER26> The CodeLens feature in VS2017 is really similar, it's the only reason we pay for the pro license instead of just using community edition.

<comment><USER27> It's hard to believe MS still charges people who are making their platform more worthy and with competition from Jetbrains.

</comment></comment></comment></comment><comment><USER28> Personally I have been typing all git commands manually into the terminal and never felt a need for GUIs or tools such as this.

There are a number of git shortcuts defined in my zsh aliases [0]. It goes like:

      # Git aliases
      alias g='git'
      alias ga='git add'
      alias ghb='git browse' # hub
      alias ghpr='git pull-request' # hub
      alias gp='git push'
      alias gpoh='git push origin HEAD'
      ...

Using these aliases, we rarely have to type more than 3-4 characters for a git command. Savings and efficiency not only add up over years of using git, but also accelerate as you become more proficient in using your own aliases that fit your special needs.

[0] - [https://github.com/sungwoncho/dotfiles/blob/master/zsh/alias...](https://github.com/sungwoncho/dotfiles/blob/master/zsh/aliases.zsh)

<comment><USER29> With Mercurial, I like that all commands can be abbreviated to their shortest unique prefix, plus some built-in aliases. So I type a lot of `hg up`, `hg pus`, `hg ci`, `hg pul`, `hg bo`, and so forth. Most of these are almost the same length as your aliases.

Whenever I have to touch git and `git co` doesn't work, I think, okay, fine, we'll go through the full dress rehearsal; `git checkout` it is.

<comment><USER30> Plus, actually sane command names, and super powerful functionalities (for example, answering to another comment, you always could "hg blame (annotate)" an arbitrary version of a file without having to check it out first)!

</comment></comment></comment><comment> a-b But why? There are so many awesome tools like tig and magit!

\- [https://github.com/jonas/tig](https://github.com/jonas/tig)

\- [https://magit.vc/](https://magit.vc/)

<comment><USER31> Magit is great but it's just so incredibly slow at big repos. For certain things like Instant Fixup magit is still faster than the command line but most of the time I can do it much faster via the command line. Sometimes I'm not even sure whether magit is just slow or my emacs hangs.

<comment><USER32> Please post your OS and Emacs version.

Magit hasnt been slow for me since I upgraded to Emacs 26. Older versions of Emacs were not optimized for spawning processes on OSX and it was causing a 10x slowdown for some operations.

<comment><USER31> Perhaps I should revise my statement. It isn't magit itself that's slow, but rather magit is calling out to slow git commands. And while those git commands are taking up 100% of my CPU, Emacs itself is using 0% CPU and totally unresponsive.

Just a few moments ago I had to kill Emacs because magit was executing this command:

        git branch --remote --contains 10a1663bf96f

<comment><USER33> That particular issue has been fixed a few weeks ago. You should update Magit. Also you should be able to avoid killing Emacs by just pressing C-g a few times if some subprocess takes a long time.

</comment></comment></comment></comment></comment><comment><USER34> Thanks for making this, it looks great! I'll be giving it a shot tomorrow.

I've been moving more and more to terminal for all of my development. My dev. stack is now: vim; tmux; lynx; ddgr; zsh; and docker. It is game changing for distraction-free programming, consistency between languages, and the ability to use the exact same setup everywhere -- even on remote machines.

<comment><USER27> We need CLI to work on repo on remote servers. I was using tig but didn't like it for lack of ability to easily navigating file tree on each commit and this seems better.

</comment></comment><comment><USER35> I've been using Fork: [https://git-fork.com/](https://git-fork.com/) because of its 2 primary advantages over SourceTree: • Dark mode • Tabs

<comment><USER36> Looks neat but no Linux version again :( There are 2 things I miss the most when developing under Linux and they are Sharex and Sourcetree. Smartgit is alright but not as good as the latter.

<comment><USER27> OT but considering Jetbrains stuff works on Linux there isn't much to miss except a decent git GUI but do you miss anything else? I just don't find the benefit of using Linux for development.

<comment><USER36> Ability to use proper shell (and env) for dev tasks and build scripts is the main benefit for me.

Sharex is the other thing I mentioned, its screenshots/screenrecords on steroids, check it out.

</comment></comment></comment></comment><comment><USER37> I have been using [https://github.com/scmbreeze/scm_breeze](https://github.com/scmbreeze/scm_breeze), and though not as feature-packed, it does make the workflow fast.

<comment><USER38> I've been using this for probably 6-7 years now and it's become a standard part of my workflow. I've never had problems using git, but scm_breeze makes things faster (shorthand commands for common operations), and adds some nice bells and whistles. It's never caused a problem for me in the entire time I've used it either.

</comment></comment><comment><USER39> I've yet to find a git setup that is more productive (for me at least) than SublimeGit for Sublime Text. The combination of a text based interface with single character shortcuts, and the quick support for staging individual parts of files, means I'm probably twice as fast as the next best thing. It's the reason I haven't moved from Sublime to VS Code.

This looks like it could be close, and I'll definitely give it a try. If I could decouple myself a bit more from Sublime that would be great. The plugin community just isn't the same as VS Code.

<comment><USER40> I switched to gitsavvy a few weeks back because it is more complete than sublimegit. I paid for sublimegit years ago and really love it.

But I wanted single line commits so gave gitsavvy a go. I had to redefine a couple of shortcuts (Ctrl-D from Discard to diff) but it's been excellent. The only thing I can't get working is gitlab integration.

It's a worth a shot.

<comment><USER39> Oh nice, thanks! Sublime Git has everything I need for my git workflow so I'm not feeling like I need anything else, but I will give this a shot to see if it's faster for the bits I do use.

</comment></comment></comment><comment><USER41> One Git UI that I absolutely love but I rarely see mentioned is GitKraken. It's so nice having a fully cross-platform Git GUI, that's attractive and intuitive.

<comment><USER42> To be honest, they try to compete with souretree and git tower but they are there is a huge difference in the performance since GitKraken is made on electron and really slow when looking at large diffs.

I am a long time git tower user, and i have given GitKraken more than a few shots. I always go back to a hybrid command line and git tower workflow

</comment></comment><comment><USER22> 'Go' question that came up when I tried to build this: How do you build a Go .EXE on Windows that doesn't have any file paths embedded in it?

<comment><USER43>
        go build -gcflags=-trimpath=$GOPATH -asmflags=-trimpath=$GOPATH

[https://stackoverflow.com/a/45302415](https://stackoverflow.com/a/45302415)

<comment><USER22> Did you try this yourself? Because I already tried it and it didn't work. Remember I said I'm on Windows.

<comment><USER43> Yes, we do this for our release builds, including Windows. It does only remove the leading prefix (GOPATH) from panics, not the full file path.

I don't think there's a way to remove the whole file paths other than replacing strings in the compiled binary. In our case GOPATH was the only sensitive part (since function names can't be removed either, for reflection to work).

We also couple it with a defer handler to obfuscate panic traces.

<comment><USER22> It didn't even remove the leading prefix for me. I tried both forward and backward slashes. (The version in the binary is with forward slashes.) Note that I'm using go1.10.3.windows-amd64.zip.

EDIT: Looking more carefully, it seems like it actually removes the prefix for files in the current module, but nothing from files in its dependencies. This is despite the fact that both of them share a prefix for me, and that's what I'm trying to remove. Any idea why?

<comment><USER43> This changed from 1.9 -> 1.10, now the asm/gc/ldflags only apply to the module being compiled directly, not other modules.

[https://golang.org/doc/go1.10#build](https://golang.org/doc/go1.10#build)

You can resolve this by using "all" as the pattern (-gcflags=all=-trimpath=$GOPATH)

<comment><USER22> Ahh!! Okay thanks, that works... almost. Now there's still one spot left where the path of the Go installation is embedded... :\

</comment></comment></comment></comment></comment></comment></comment><comment><USER44> How much time do people spend messing with their source control that extreme tools like this become necessary?

I commit like, once a day. What am I doing wrong?

<comment><USER2> To each his own, but I'd say committing once a day. That's unless I'm wrong in thinking that doing so means your commits are quite big and could be broken up into smaller, more manageable changes.

Personally, I like it when `git diff` displays only one or at most three screenfuls of changes that haven't been committed.

<comment><USER44> Maybe I'm one of those low productivity types that interview processes are trying to permanently weed out, but I rarely write more than 40-50 good lines of code per day. Commits any smaller than that would just look like code Hemingway.

</comment></comment></comment><comment><USER45> IntelliJ now and forever. We still have some crap on SVN and the version control menus are nearly identical switching between that and git.

</comment><comment><USER46> This looks super neat. Will try it out. Although I'm a sourcetree user... lately `git add -i` has changed how I use got massively.

<comment><USER47> got add -p is pretty nice too

then got commit -v to verify the hunks

<comment><USER46> Dang. So git add -p basically just skips straight to the patch portion and then -v adds a diff to the bottom of the commit message file so you can review it. Nice!

<comment><USER48> It doesn't seem to pick up new files.

<comment><USER49> It can, if you first do: git add --intent-to-add <filename>

<comment><USER23> Try git-crecord, you won't miss git add -p.

</comment></comment></comment></comment></comment></comment><comment><USER50> Nice idea - I don't like going too far above the git cli, but I usually find myself building a set of terminals watching different git commands such as status, log, diff etc for a more parallel overview...

This tool looks like it does that a bit better with interactivity maintained, and for some reason i'm more comfortable accepting a CLI git UI into my workflow than a GUI.

</comment><comment><USER51> I don't touch aliases. History search with fzf is much better. Same number of keystrokes, but your actions remain clear and explicit.

<comment><USER27> Do you type Ctrl-r every time issuing git command?

<comment><USER51> Normally I'm using vim-fugitive, actually.

</comment></comment></comment><comment><USER52> raw console magit I see

<comment><USER52> ps: the [https://github.com/jroimartin/gocui](https://github.com/jroimartin/gocui) ui toolkit used here seems very very nice

if people know an equivalent outside go, please comment

<comment><USER53> I had the same thought. I'm amazed not to have seen any commentary here on it yet. Looks really, really nice. I looked for something comparable for Elixir but haven't found anything comparable yet.

</comment></comment></comment><comment><USER54> I use GitHub desktop, it's pretty solid.

</comment><comment><USER55> I've always been a fan of Git Town: [https://github.com/Originate/git- town](https://github.com/Originate/git-town)

Not a UI but helps with some commands you run in a row quite often

</comment><comment><USER56> Might be a good opportunity to advertise my git-send bash function / zsh plug- in:

[http://github.com/robertzk/send.zsh](http://github.com/robertzk/send.zsh)

<comment><USER57> While we're at it:

       git_show_blame () {
       	if [ -z "$3" ]
       	then
       		printf "USAGE: git_show_blame filepath start_line_num end_line_num" && return 1
       	else
       		[ ! -z "$4" ] && printf "\\n${LPURP}[git_show_blame]${NC} Warning: extra arguments provided. Ignoring everything after the first 3\\n\\n"
       		git show $(git blame "$1" -L "$2","$3" | awk '{print $1}')
       		return $?
       	fi
       }

Use with recursive search `grep -Rn your_regex .` to track down the original commit that your pesky coworker added two years ago without any corresponding documentation for an alert that's going critical at 2am...(only slightly exaggerating there :P)

</comment></comment><comment><USER58> Whether or not anyone is tired of typing git commands this is a cool project. I intend to try it out. Great work jesseduffield!

</comment><comment><USER59> I used to race and coach skiing for many years. Intermediate skiers always used to ask me what skis to buy to make them better at [ice|powder|moguls|steeps|etc] while I and most proficient skiers used the same boards every day in all conditions. This tool reminds me of that.

* I acknowledge that some really great skiers are geeked on their equipment and use a variety of skis. Point still stands.

<comment><USER60> What exactly is the point, other than you just calling the author insufficiently advanced by way of some creaky analogy? One of the many things that distinguishes programming from skiing is that it's fairly easy for people at all levels of expertise to make their own tools. And that's what this person did.

<comment><USER59> You are right. Sorry everyone!

</comment></comment></comment><comment><USER61> Looks nice but I think you need some better documentation before anyone can use it.

</comment><comment><USER62> I'm a Windows user, and I love Tortoise Git for this kind of stuff.

</comment><comment> jags-v Nice first project with go. the project made wanna learn go :).

</comment><comment><USER63> This utility is nice. Let me try out and save some time.

</comment><comment><USER64> Damn, that's a really nice UI!

</comment><comment><USER65> congrats, you have discovered darcs.

</comment><comment><USER66> Why not just use an actual GUI then rather than a shitty TUI?

GitX (Mac only sadly) is the best of the free ones, and Tower is then best of the commercial ones. Try those.

</comment><comment><USER67> >>but you're too stubborn to use Sourcetree because you'll never forgive Atlassian for making Jira? This is the app for you!

This is the most ridiculous ad ever.</comment>


Red-Black Trees in a Functional Setting (Okasaki, 1993) - <AUTHOR> http://www.eecs.usma.edu/webs/people/okasaki/jfp99.ps

<comment><USER2> If you haven't read Okasaki's dissertation:

<http://www.cs.cmu.edu/~rwh/theses/okasaki.pdf>

I'd highly recommend it. It's hard to find a dissertation that reads like a novel, but he somehow managed to accomplish such a feat.

<comment><USER3>
      It's hard to find a dissertation that reads like a novel

That's why he turned it into a book: [http://www.amazon.com/Purely-Functional- Structures-Chris-Oka...](http://www.amazon.com/Purely-Functional-Structures- Chris-Okasaki/dp/0521631246/)

<comment><USER2> Good point. Judging from the table of contents, he added a chapter up front on various types of trees, tacked on Haskell source in the appendix, and mushed all the conclusions together.

But I'm a poor grad student, so I'll read the free dissertation over the $75 book. ;)

</comment></comment></comment><comment><USER4> This is probably the best explanation of Red-Black trees, even outside of a functional setting.

There is an implementation that is pretty faithful to Okasaki's paper here: [http://www.cs.kent.ac.uk/people/staff/smk/redblack/Untyped.h...](http://www.cs.kent.ac.uk/people/staff/smk/redblack/Untyped.hs) . I used as a reference once because it also implements delete.

In the same directory, Kahrs develops other versions with stronger constraints coming from the type system, but I never got far enough in to Haskell back then to understand them.

<comment><USER5> I find it particularly interesting that he breaks down the number of neccessary cases to only 4 compared to the standard explanation found everywhere else.

<comment><USER6> Yes, that's the power of purity. On the syntax side, or-patterns express those remaining four cases very succinctly.

</comment></comment></comment><comment><USER7> In case anyone needs them, I wrote up Okasaki red-black trees for Scala:

[http://matt.might.net/articles/implementation-of- immutable-p...](http://matt.might.net/articles/implementation-of-immutable- purely-functional-okasaki-red-black-tree-maps-in-scala/)

<comment><USER5> Well, thanks, I was just about to take Okasaki's paper and see what an implementation in Scala would look like.

</comment></comment><comment><USER8> I took his Programming Languages and Translators class when he was at Columbia. It was, hands-down, the best class I've ever taken. His enthusiasm for the subject was evident. The aspect about the class I liked best, and which I try to emulate, it that he rarely ever directly answered a question. He would, with incredible patience, ask you questions in-turn to help lead you to the solution or definition. I always found that impressive from a graduate- level professor.

I think I still have his ML implementation of Red-Black trees he gave the class.

</comment><comment><USER9> bst were the first time i went "holy crap. i love complex problem solving"</comment>


Ask HN: Event-Driven Programming vs. Object-Oriented Programming - <AUTHOR>

I am a javascript developer. I am new to Event-Driven development "paradigm", and I have some questions about.
I think that EDP and OOP are not at the same level, so I use Object Oriented paradigm behind Event-Driven. But I am not clear what EDP gives to a OOP project: Order? maintenance? scalability? easier to test? Or is EDP just a good architecture solution for those languages that are not OOP natively?
I've read that can help with dependency injection too. But this can be sorted out using libraries such as RequireJS, can't be? <comment><USER2> It depends on how you want to handle message passing. Would your architecture be simpler if you could decouple your sender and receiver? It can make it harder to track errors (as in, where the message came from, determining who is listening to it, or tracking down circular logic), but it does give you some very nice options for decoupling. I would strongly suggest looking through the design patterns used in Twitter Flight, which is a framework based largely on an evented system.</comment>


Ask HN: What are the biggest (simple) ideas in recent history of computing? - <AUTHOR>

I'm curious which ideas you would consider the most original, creative, important, influential, etc. in recent history of IT, computer science, but to keep it still a bit focused, let's restrict examples to the web.
I'm thinking especially of those ideas which don't need technical jargon to explain and are easily understood by everyone. Ideas that were under everyone's nose for a long time and in retrospect they are totally obvious if you ask the right question, but still they seemed like magic when they first appeared.
To get it started, here are three that I can randomly think of: CAPTCHAs, tags, torrents. <comment><USER2> This was asked recently by Alan Kay:

[http://stackoverflow.com/questions/432922/significant-new- in...](http://stackoverflow.com/questions/432922/significant-new-inventions- in-computing-since-1980)

It turns out the answer is "nothing significant". Or more correctly "nothing that's been published."

</comment><comment><USER3> The "blog" or perhaps "blog-inspired" things. tags are one you mentioned - trackbacks and pingbacks are two more.

"friending" as a verb/process might be another.</comment>


Quora User Data Compromised - <AUTHOR> https://blog.quora.com/Quora-Security-Update?share=1 <comment><USER2> [https://help.quora.com/hc/en- us/articles/360020212652](https://help.quora.com/hc/en- us/articles/360020212652) contains more detail.

</comment><comment><USER3> This is why I hate companies that force you to sign up to gain access to content. I do not _want_ that relationship. Sooner or later those systems will be legacy and then maintaining them will be a pain. Bitrot will set in and sooner or later there will be a breach.

One new development is that you used to be able to get your invoices mailed via snail mail. Then that disappeared and you got your invoices mailed via email. Then _that_ disappeared and now you have to create an account on some portal so that you can download your invoice. So that's one userid/password combo per business relationship or service that you use privately. Healthcare, HOA, insurance, payroll etc., every bloody two bit player requires you to log- in to their oh-so-secure service rather than that they send you your stuff. Which requires a ton of overhead and - sure enough - sooner or later they get hacked because by then the amount of data they hold on to is more valuable than their security could reasonably be expected to defend.

<comment><USER4> I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too.

For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. As it turns out, they _did_ get breached. I got an alert about someone who isn't the water company trying to hit the card for 80 cents. Most card runners use amounts under $1 because most credit card spending alerts have a $1 minimum. But privacy.com warned me, so I warned the water company, who was very thankful. Turns out their 3rd party provider had been breached and they were grateful for the alert too. Ended up saving a few thousand of my neighbors a lot of headache.

<comment><USER5> Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu item disappeared, bringing clicks-to-login from 1 to ~10.

A few weeks ago I saw bitwarden finish their third party security audit and took the opportunity to jump. Couldn't be happier. Autofill fails less, the "copy password" menu works, the mobile experience isn't intentionally broken to sell an app, and export->import went without a hitch. Better, actually: it is the first time I have done an export/import and had the resulting data immediately work better in the second app. There's also the hope-springs- eternal factor of bitwarden giving me the option to host the sensitive stuff myself once I get off my butt and set up that server I've been meaning to for a while now.

If you're thinking about lastpass, save yourself the trouble and try bitwarden first. Or something else, but bitwarden has been good to me and lastpass, well, hasn't, to put it politely :)

<comment><USER6> LastPass is one of my least liked most used tools. Everything about the implentation feels second rate; slow, unreliable login capture, unreliable form fill, occasional inability to edit records, buried password copy, clunky UI, inappropriate modal nagging in browser and app... Most times I use it I am cursing it.

I tried to switch to pass, and I'm not sure if it was something to do with how I imported but it didn't list my passwords and the browser plugin was clunky and didn't work. Anyone had success with pass/gopass.

Bitwarden seems like a happy Medium, I'd rather not do my password ops. The pricing seems fair (and rather optional). I'll try it, thanks.

<comment><USER7> I have the same disappointing experience with LastPass and have grown tired of it. One of these days I will do something about it!

<comment><USER8> Check out Keepass! Rather than syncing directly into a Cloud, it allows you to store a database file into any location. It supports MFA (e.g. by combining a password with a secret file, or a Yubikey). And everything is open-source.

I like the model a lot, because it solves the "database ownership" issue, where your Password provider (be it LastPass, 1Password, etc) becomes in itself a weak link.

<comment><USER9> I used to use KeePass but the lack of a proper crossplatform UI eventually broke it for me; KeePassX on linux looked and performed terribly, the Android app was just bad, etc etc etc.

I switched to 1password which - at least at the time - offered a web-based fallback hosted from your own dropbox. Plus at the time you owned the data and were responsible for storing and syncing it. Dropbox support came out of the box but if you want you can use a local file.

<comment><USER10> Have another look at KeePass. They recently got a native Mac implementation, and I seem to recall seeing a new one for Linux at the time.

On the Mac, KeePass now feels like a better experience than having to pay a subscription for 1password.

<comment><USER11> Or MacPass for macOS, which was a very slick alternative to the KeePass application at the time.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> In 2013 a quora moderator contacted me and demanded that I provide my real name, and information that my name is real or they would ban my account. I tried reasoning with them, that I just wanted to view content and did not attend to write answers or interact etc, plus, they had a valid email address and facebook profile (also fake name on facebook). They fought back "we actually want proof of your real name like a scan of ID". I danced around and did not end up giving them a scan of my id, but I changed it to my real name.

Today my information is probably leaked. Information I didn't want to give and that they threatened me for it.

Where is the apology Quora? From all the recent leaks this is the one that pisses me off the most, because it's the one that was forced unto me.

<comment><USER13> Can I ask why you wanted to view Quora's content so much? They flood Google search results but I've never seen a single substantial answer on there - it's like an off-brand Stack Overflow with an even worse "I know programming so I'm smart about every subject" problem.

<comment><USER14> My experience with Quora answers has been that they are blatant ads from people working on different companies.

Just search for anything like "what is an open source alternative to X" and the results will be a lot of people trying to justify why their Y paid option is a good solution for your problem.

<comment><USER15> I quickly stopped using Quora after finding the answers consisted solely of scam software (just didn't work), adware or stolen & rebranded software.

It seems to be popular with scammers and they have taken over.

<comment><USER16> In other areas it seems like it's people working on their craft of writing fiction, notably erotic fiction. Questions like "What's the naughtiest thing you've done at work?" generate those kind of responses. Which is fine, just don't expect me to believe it really went down like that.

</comment></comment></comment></comment></comment><comment><USER17> I really started hating Quora a while back, probably 3 years ago and stopped collaborating. Most because "people" were spamming answers with marketing bs... So many answers start with "I'm Bob, CEO of MyCompany.com, I am an expert in this and that"

Most Quora users are hungry for answers and flood-request you to answer their question just because the system recommends them to do so. No matter how many times you pass, the system still keeps notifying you that "you are needed". Quora doesn't understand a no is a no.

IMHO -> There truly isn't any benefit on providing good answers on Quora, other than stroking your ego, might as well become a micro-influencer on Instagram.

Even worse most questions seem truly 1-Google search away and the answers are low-effort. Sure you do have some rare gems, and those are truly amazing to read. Alas, that's not often and spamming answers just for the sake of answering has become a reality.

<comment><USER18> I feel like questions like "Why is <insert my opinion here> true?" have become increasingly common too. Thats like asking: "Please confirm my opinion, I don't want to learn anything new!"

</comment></comment><comment><USER19> Wow. If this had happened a couple years ago, before they made all the anonymous entries truly anonymous, this would have been _really_ ugly.

It's a valuable lesson in "don't keep data you don't need".

EDIT: A little backstory for non-Quorans. Until early 2017, anonymous Quora answers and comments were anonymous to the public but not actually anonymous in the database (they were still "your" entries). In early 2017 they (presciently) made all this content fully anonymous, even in the database.

<comment><USER20> Their doc says:

> Is content posted anonymously still secure?

> Yes. Anonymous content cannot be connected to user accounts, so content > posted anonymously is still secure.

[https://help.quora.com/hc/en- us/articles/360020212652](https://help.quora.com/hc/en- us/articles/360020212652)

</comment></comment><comment><USER21> I feel that this is becoming a standard narrative. SV company comes up with an idea, decides harvesting lots of user data is how they will monetize. VCs pump in a lot of money and expect their returns, so company is now forced to collect even more data aggressively (the sign-in wall that many others have pointed out is an example of this). VC pressure causes company to "innovate" fast, most likely trading off security for new features in the meantime. As this progresses and they become more valuable, they are then targeted by hackers, which causes some type of compromise of users' data.

Quora is an intimate medium — tied to real names, real and often deep interests. It's especially bad that this happened.

There needs to be a better way to realign incentives in this ecosystem, otherwise this story will repeat.

<comment><USER22> I'm still amazed to this day that people give real names to their online accounts. I'd never put my real name anywhere online. It works quite well for me and if my data is leaked, I'm still ok. Probably I should use more email accounts to don't be linked, but it's fine anyway.

</comment></comment><comment><USER23> At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping to provide individual companies with as little information about me as possible.

The toughest ones here are my online banking and my online health portal, but other than that, I have gotten pretty picky about what information I give any company.

<comment><USER24> This is a healthy mindset to have.

I feel that for every company that self-reports a leak, there are multiple other companies that have leaked your data and either haven't discovered the breach, refuse to disclose it, or flat out sold your data to the highest bidder.

<comment><USER25> You would be correct. In the US, which I might remind you, does not have a national law on the books regarding data breach notification. Even at the state levels, it's varies pretty wildly on top of, most notifications are only required if there is evidence. So here is the challenge: what if I keep no logs, and have terrible security monitoring capability? If I am notified or discover a critical vulnerability on my own, but have inadequate logs to show or detect if it was exploited... am I required to notify? I have been told no (I fervently disagreed; I think suspected breaches, or critical vulnerabilities which may lead to breaches but were inconclusive should still require notification).

<comment><USER26> Still, I would have thought it is good practice to notify your users if you leak their data to thieves. Quora did the right thing and should be applauded.

As a counterexample, it seems that Newegg had a massive breach (thieves installed JavaScript that skimmed credit card numbers for weeks) in August, and even though my credit card was likely stolen, I hever heard about it from Newegg.

<comment><USER27> Not sure why you didn't hear from Newegg, but they did send out a mass email notification with details of the breach.

<comment><USER28> I somehow got their email a week or so after the event, and after my card's fraud prevention called for suspicious activity, reverted the transactions and cancelled my card. The bank official was not aware of the leak.

</comment></comment></comment></comment></comment></comment><comment><USER29> [https://blog.quora.com/Quora-Security-Update](https://blog.quora.com/Quora- Security-Update) seems to be misleading, especially the introduction. They start with 'some user data was compromised', however, it seems that for 'approximately 100 million Quora users' – that's basically all users! – all user data was compromised …

In addition, many questions remain open, for example: Which ' leading digital forensics and security firm' is working for Quora?

I hope for Quora that they met their 72-hour deadline according to the GDPR. Looking at [https://www.quora.com/about/privacy](https://www.quora.com/about/privacy), it does not look if Quora was / is GDPR-ready. They do not mention any legal basis for the processing (art. 13 GDPR) and they do not inform about their GDPR data representative in the EU (art. 27 GDPR).

<comment><USER30> There can only be one digital forensics and security firm in the lead, right? All of the other firms are trailing...

<comment><USER31> This is more like "leading experts"––there's no "best expert". Just marketing…

</comment></comment></comment><comment><USER32> I think at this point it should be standard practice to say _what_ hashing algorithm is used in passwords when disclosing a breach.

The email I got from quota just says "encrypted" passwords, and while the blog post says "hashed", it doesn't say what algorithm. For all we know it could be something useless like MD5

<comment><USER33> It'd be useful in the sense that you'd be able to warn others, but for your own password you should be using a password manager with auto generated random passwords. That way the only thing you need to do is change one password on the leaked site.

<comment><USER32> That's exactly my point. I use 1password to handle my logins, but most people I speak to use the same password for everything, so knowing how likely it is that other services could be compromised due to this is vital.

</comment></comment></comment><comment><USER34> So I'm not a security expert, so I ask this in real earnest to learn: what is it that these companies keep doing wrong, and/or why aren't they adjusting to the climate that these types of attacks are increasing over time?

Or are they trying to adjust, and the attacks are getting so sophisticated that the pace of investment in counter-measures is below that of the pace of advancement in the complexity of attacks?

Or something in the middle?

<comment><USER35> It's a whole lot of things, but first and foremost and probably the simplest explanation, security is hard. Incredibly hard.

Once you understand how difficult attack mitigation is, then you can pick and choose from a variety of factors:

\- executives may not have a realistic understanding of how difficult attack mitigation is so they don't allocate the resources for hiring

\- incompetent admins overestimating their abilities

\- competent admins who are underfunded

\- incompetent admins who underestimate the value of the data they're protecting

\- competetent admins who may not have an accurate picture of what data they're trying to protect so their threat model is flawed due to inaccurate information

\- executives who are aware of how difficult mitigation is but don't place customer data privacy as a priority.

\- the current iteration of our growth obsessed corporate models unintentionally results in a race to the bottom in many ways.

\- little incentive for companies to factor in social impacts as we don't yet seem inclined to figure out a way to include impacts on society as _one of the many_ metrics to measure a company's success or failures.

It's worth remembering though, even the most responsible, most well funded, most security conscious, and best staffed organizations have been compromised at one point or another—security is hard.

<comment><USER36> An organization running original software on the internet first needs to be preventing vulnerabilities in its own codebase. Nothing "admins" do is going to help much if the application itself is full of SQL injection and direct object reference. You can have impeccable configuration, firewalls, etc. and not even be playing the game.

<comment><USER35> Absolutely. Apologies if I indicated my list were the _only_ possible issues at play.

</comment></comment></comment></comment><comment><USER37> It's genuinely hard to imagine a second-rate question and answer site could have any credentials, or indeed any non-public content, that anyone else could be interested in. From the list of what's been taken, it sounds like it's mostly email and hashed passwords, though I suspect Quora's user base is not entirely populated by people committed to a strict one-off password policy.

Happily I get to once again bemoan the disappearance of JCSV, who was astounded that Quora was still a thing five years ago: [http://jesuschristsiliconvalley- blog.tumblr.com/post/4896203...](http://jesuschristsiliconvalley- blog.tumblr.com/post/48962035819/quoraquoraquora)

</comment><comment><USER38> Seems like a complete database exfiltration. Quora advertisers also had info compromised from a separate email notice:

      - Account information available on the Ads Manager account settings page.
      - The email address provided for notifications about your ad campaigns.
      - Campaign structure and setup, including information like budgets, schedule, bids, targeting, and ad information.
      - Notifications that were in your Ads Manager, such as ad paused, logo approved, and ad ready.
      - Audience setup information available on the Ads Manager audience page such as types and creation date.
      - Partial credit card information, including name, expiration date, and the last four digits of the credit card.

</comment><comment><USER39> The Quora link to more details is a masterpiece of corporate obfuscation. Posing as a FAQ, it presents questions, then proceeds to not answer them (at least, as of a few minutes ago).

[https://help.quora.com/hc/en- us/articles/360020212652](https://help.quora.com/hc/en- us/articles/360020212652)

What happened? - not answered in any detail

What kind of user data was affected? - answered!

How do I know if I was affected? - not answered

How was it brought to your attention? - not answered

How many Quora users are affected? - not answered

<comment><USER40> All of these appear filled out now.

Quora is good about responding quickly, which should be appreciated. That the FAQ wasn't fully filled out was just because it was being filled out. I know this can be an awkward experience for someone who immediately sees and responds to the tech news, but a bulk of their users won't be that profile. They got the framework for response laid out immediately, and are working on the responses. This seems pretty solid.

<comment><USER39> They were already filled out, but with non-answers. For example:

> When did you first learn of the issue? How was it brought to your attention?

> We first learned of the issue on November 30. Upon learning about the issue, > we immediately launched a comprehensive investigation and remediation > effort.

There is absolutely nothing in there about how this was brought to Quora's attention. Did they see identities for sale on the dark net? Were they approached for a ransom? Did a user inform them? Nothing.

The other questions ditto.

<comment><USER40> Ah OK – I read this wrong then. My bad. I am confident, or at least optimistic, they will make improvements, if not, then I'll let you know how my foot tastes.

</comment></comment></comment></comment><comment><USER41> No system is breach-proof; security breaches happen. We as engineers should strive to reduce the break-ins and diligently push for high standards nevertheless.

Having said that, this is pretty much a perfect response to the situation.

1\. Quick turnaround from the breach to the announcement 2\. Concise description of what happened 3\. Owning the mistake 4\. Update of their mitigation 5\. Promise to follow up & actionable items. 6\. Additional technical detail for more interested: [https://help.quora.com/hc/en- us/articles/360020212652](https://help.quora.com/hc/en- us/articles/360020212652)

It sucks that this happened, but for that alone I'd like to applaud Quora team. Yes, it would've been _great_ if they didn't have to force me to sign up from the first place. It would've been great if this breach has never happened. But for the context, they're handling the issue as well as possible.

</comment><comment><USER42> This is all bullshit. My data is all over the place. At this point I expect none of my personal data to be private. This last few weeks alone my data was stolen from British Airways, Cathay Pacific, SPG/Mariott, Quora. As users we are completely powerless.

Time for change. Time for intelligent heads to come together and think of how a better internet security architecture needs to look like.

<comment><USER43> I wonder how easy it would be to piece together all these breaches with any degree of accuracy to build a "complete picture" of an individual.

Say your name, email address and social get leaked in one 500m user dump and your email passport number and actual address in another. I've never worked with datasets on this scale hence the ignorance.

Maybe its possible for one person of interest but how complicated would it be to match up everything?

<comment><USER44> I've oftened wondered if I am helped by my practice of using [servicename]@[mydomain.com] for each service I sign up for. I used to do it to help control and track spam, then I stopped when spam stopped becoming an issue. But now I feel like no longer having a single unique key to correlate my data across different leaked data sets might also be a benefit.

</comment></comment></comment><comment><USER45> Exposed Data:

\---

Based on what we have learned, some of our users' information has been exposed, including:

\- Account information (e.g. name, email address, encrypted password, data imported from linked networks when authorized by users)

\- Public content and actions (e.g. questions, answers, comments, upvotes)

\- Non-public content and actions (e.g. answer requests, downvotes, direct messages)

Questions and answers that were written anonymously are not affected by this breach as we do not store the identities of people who post anonymous content.

<comment><USER46> From an email I got

\---

What information was involved

The following information of yours may have been compromised:

Account and user information, e.g. name, email, IP, user ID, encrypted password, user account settings, personalization data

Public actions and content including drafts, e.g. questions, answers, comments, blog posts, upvotes

Data imported from linked networks when authorized by you, e.g. contacts, demographic information, interests, access tokens (now invalidated)

Non-public actions, e.g. answer requests, downvotes, thanks

Non-public content, e.g. direct messages, suggested edits

Questions and answers that were written anonymously are not affected by this breach as we do not store the identities of people who post anonymous content.

</comment></comment><comment><USER47> I always found Quora's demand that I make an account merely to read, like Pinterest, extremely rude. I don't think I ever gave in and made an account but I suppose I can find out now.

</comment><comment><USER48> Interesting (to me, at least) that the regular Quora update emails land in my inbox (or in the Social tab in Gmail, anyway), but the security breach notification was spam filtered...

<comment><USER49> Well they probably sent a shit-ton of emails in a short timespan to notify most if not all users which could have triggered spam algorithms.

</comment></comment><comment><USER50> I recently got an email from Quora, "you read XXX, did you find what you're looking for?"

I don't want every site that I visit sending me an email every time I click on a Google result.

I hit that SPAM button as fast as I could.

</comment><comment><USER51> That's lame, but there is to always remember that information leaks are happening in almost every company out there. The way we build and run systems is no adequate, unless very large efforts (like in the case of Google) are made in order to try to limit the attack exposure, but this is not for everybody cost-wise IMHO. Makes more sense for companies to limit the amount of data they ingest. In this regard it's very bad that Quora or Linked-In force you to login just to see content. As a user, if you want to live under correct expectations, assume that your real name and profile picture, and possibly an hashed password, are always automatically leaked.

</comment><comment><USER52> > ...there's little hope of sharing and growing the world's knowledge if those > doing so ... cannot trust that their information will remain private.

Here's a crazy idea, circa 1990's: don't store their personal information! Allow people to browse Quora without using their real names. I'm very happy I deleted my Quora account when I did.

<comment><USER53> So you're under the impression Quota actually deletes all information related to your account when you click on delete? I'd be surprised.

</comment></comment><comment><USER54> My take on Quora and business like them:

They are hiring people based on leet code questions and school prestige and not based on real technical knowledge about systems. Their business people are top school MBA grads with no security domain expertise. They then proceed to build massive data collection programs using open source tooling that non of them fully understand. Their business model depends on that data and monetizing it in various ways. An so the complexity of their application goes through the roof with regards to user data. Their user facing web apps are the tip of the iceberg for a massive surveillance scheme.

<comment><USER55> > They are hiring people based on leet code questions and school prestige and > not based on real technical knowledge about systems

Isn't that true for almost all companies based in the Sillicon Valley?

<comment><USER54> The big companies, Google/Fb/etc hire that way but they also bring on niche experts. Leet code at those companies is for the code monkeys. They hire the people writing the ML/distributed systems/security code out of PhD programs and targeted hiring. Theres more to it, dont feel like typing it all up

</comment></comment></comment><comment><USER56> One thing I would like to do is have various US Senators send letters to the major corporations, and perhaps even large open source groups (like npm), and ask them, proactively, what they are doing to secure citizens around the world's data.

There is something called the Cybersecurity Bipartisan Caucus in the US Senate.

I have found calling these senators (which I have never done before for any politician about anything) extraordinarily helpful and gratifying. I have even explained that I don't live in their state, and yet they still listen and clearly need the advice from good security/sysadmin people (like asking them why Facebook still doesn't have a CSP Security Header).

It was only 6 days ago that the "International Committee on Privacy", made up of Senators from countries around the globe, met in London to question Richard Allan, VP of Privacy at Facebook. Mark Zuckerberg rejected the request for his attendance.

[1] [https://www.warner.senate.gov/public/index.cfm/cybersecurity](https://www.warner.senate.gov/public/index.cfm/cybersecurity)

[2] [https://www.parliament.uk/business/committees/committees- a-z...](https://www.parliament.uk/business/committees/committees-a-z/commons- select/digital-culture-media-and-sport-committee/news/grand-committee- evidence-17-19/)

[3] [https://www.youtube.com/watch?v=1P97ubLDbJI](https://www.youtube.com/watch?v=1P97ubLDbJI)

</comment><comment><USER57> It's strange that:

\- the linked article says the breach included hashed passwords, but makes no mention of salt

\- the help page says they're forcing affected users to change their passwords

If the passwords were salted before being hashed and stored, then:

\- Why not mention it, so users (especially those who don't use unique passwords on every site) know that it's not trivial for their password to be found?

\- Why force people to change their passwords?

<comment><USER58> From the email that I received from Quora:

> the passwords were encrypted (hashed with a salt that varies for each user)

Looks like the article says the same thing.

<comment><USER57> At the time I posted my comment, the web page said:

encrypted password (hashed)

Now it says:

encrypted password (hashed using bcrypt with a salt that varies for each user)

</comment></comment></comment><comment><USER59> The folks asking for snail mail are joking right? Snail mail is an obsolete relic of a time gone by, and belongs in the dust-bin of history alongside buggy whips, wood fired steam engines, betamax, etc.

Personally I'd pay to be able to _stop_ getting snail mail. If it weren't for the one or two rare pieces of semi-important crap that show up, sent by dinosaurs that don't realize we aren't living in the 20th century anymore, I'd quit checking my physical mailbox once and for all. I mean, it's not like 99/100'ths of what comes in there isn't junk catalogs, fundraising letters from politicians I hate, sales flyers from stores I hate, bills that I pay online already, mail meant for the previous residents, etc. But unlike email spam, it actually costs me effort to scrape that garbage out of the box and haul it to the dumpster.

Blech. Personally, I want no part of it.

</comment><comment><USER60> > encrypted password

I hope they mean hashed, not encrypted.

<comment><USER61> Did a double take at this too, but they clarified that it means "hashed with a unique salt" later on. Not a good word choice for a summary though!

<comment><USER62> They do indeed, but then for some reason, they also say "this breach may have exposed ... the password you used" [0] which is a statement I think is wholly incompatible with the notion of "hashed with a salt that varies for each user" (but please let me know if I'm incorrect).

They can rightfully say "encrypted" to a lay audience because the definition of encrypted is not so strict as to require decryptability, but why would they say that the password might be exposed?

[0] [https://help.quora.com/hc/en- us/articles/360020212652](https://help.quora.com/hc/en- us/articles/360020212652)

<comment><USER63> It's reasonable your password might be exposed since the attacker can now perform an offline brute force attack on the password hashes.

How likely it is your password gets brute forced really depends on the hash function used. If it's md5... all but the strongest password could be broken. (though at least the passwords were salted). If they're using something like bcrypt with a work factor of 10+, it's a different story and only the weakest passwords are at serious risk.

The fact that details on the hashing scheme aren't shared makes me assume it's not great...

</comment></comment></comment></comment><comment><USER64> >I didn't know I had a Quora account. How is it that my email or information was exposed? You may have signed up for Quora some time ago. While you might not have regularly visited or used Quora, your account remained, and this breach may have exposed some of your information, such as the email address you signed up with, the password you used, or actions you took on Quora.

Would be nice if websites measured user activity and could 'lock out' or otherwise release their data if they never use the site; at least, confirm with said user via email if the account is needed.

But in this era, I'm sure companies would prefer to keep whatever data they can get.

<comment><USER65> Byond (2d tile/sprite based online gaming platform) does this. After a year of no activity they inactivate your account, and delete the hashed password. You have to reset your password to regain access.

</comment></comment><comment><USER66> In other cases customers have had trouble filing individual lawsuits for damage because the companies successfully argue that the information--usually credit information--doesn't belong to them, it belongs to the credit card companies.

However, in this case, there is no credit card information to muddle up or confuse a case. It's only a users personal information--private messages, moderator requests, reports against other users--that has been compromised because they didn't collect credit card info. And there's an enforced "real names" policy that makes it identifiable.

</comment><comment><USER67> From reading the details it looks like almost all user data (and every user's data) is compromised. Using the word ,,some'' should be illegal in this instance.

</comment><comment><USER68> Is Quora legally liable for compromised data? Making companies legally liable for compromised data might be one way for them to be scrupulous about minimal data retention.

</comment><comment><USER69> Actually, I was looking at an answer last night and couldn't see it because my account was logged out. This happens on Chrome from time to time, so I didn't think much of it. But, when trying to log back in it said my password was incorrect. This was before the announcement.

I wonder if some had their details reset altogether? Either way, this looks like a major breach considering the value of people who have signed up with Quora.

</comment><comment><USER70> Quora would not allow you to read multiple answers by clicking on "similar questions" (on the side) without creating an account.

And then this happens!

<comment><USER71> Valid point. If you're aggressively farming data, so much so that you log them in automatically if they are logged into the google account then you better be careful with data too

</comment></comment><comment><USER72> The post states:

>"We recently discovered that some user data was compromised as a result of unauthorized access to one of our systems by a malicious third party."

"Some user data"

Then goes on to say:

>"For approximately 100 million Quora users, the following information may have been compromised:

Account information, e.g. name, email address, encrypted (hashed) password, data imported from linked networks when authorized by users Public content and actions, e.g. questions, answers, comments, upvotes Non-public content and actions, e.g. answer requests, downvotes, direct messages (note that a low percentage of Quora users have sent or received such messages)"

Wouldn't this be closer to "all user data was compromised"?

It seems absurd for them to state "some user data was compromised." That's seems like a pretty comprehensive list of user data. What else would there be?

This is a company that for years forced account sign up and obscured user generated content even for users who just wanted to browse unless you created an account. Seriously fuck Quora.

</comment><comment><USER73> I've started keeping a log of all information I provide to a company: addresses, phone numbers, names, social security number, etc... I started doing it just to keep track of everywhere I need to update next time I change address, phone, cards, and emails at the same time[1], but it's been eye opening to watch the list grow.

I think of it as something like a reverse password manager; instead of "here's a website, what's my data", it's "here's a bit of information about myself, who has it?"

It's a pain keeping that list updated but at this point I'm so hooked on being able to see my personal info leak out into the world bit by bit that the friction is worth it.

I'm still trying to figure out what I should do with the data I have on myself, if anyone has any suggestions.

[1] That situation seems sketchy seeing it written down like that, so just want to explain that it's because I moved to a different country (address, phone, credit cards) and away from gmail at the same time.

</comment><comment><USER74> How were the passwords hashed? Wait. You know what? At this point it doesn't matter. Using the same password everywhere is a broken concept and password managers are still unadopted. At this point the only solution is either SSO from a few point of trust (facebook, google, twitter, etc.) or/and password managing+generation by default (safari, iOS)

<comment><USER75> > At this point the only solution is either SSO from a few point of trust > (facebook, google, twitter, etc.)

No, that's what made OpenID awful. Your accounts all go down if one those "points of trust" get taken down for whatever (or no) reason.

<comment><USER74> It does suck. What I'm saying is that security for the people is not getting much better than that atm.

</comment></comment></comment><comment><USER76> I hate Quora for the dark pattern practices of forcing you to login before you can see anything.

In a way this is a great example of why you shouldn't collect data Willy nilly.

I really really really hope we get some sort of a law where companies are seriously liable for data breaches.

US has a ton of tech companies but very little regulation that protects the customer.

</comment><comment><USER77> Are there any details about how the passwords were stored? "Encrypted" is a bit questionable. I'd expect hashed.

<comment><USER63> They clarify that the passwords were indeed hashed and salted. "Encrypted" is just there to help the non-technical audience understand their passwords aren't exactly leaked in plaintext.

No details on the hashing scheme used though, so we don't really know how easy it'll be for the attacker to brute force the password hashes.

<comment><USER78> Because they didn't mention it, and the age of the site makes me think it isn't something we'd consider secure.

</comment></comment></comment><comment><USER79> I've always been impressed with Quora's engineering team. Kinda curious what slipped passed them.

</comment><comment><USER80> This is seriously distressing. This underscores the reasons why you should never use a third party messaging system for any sort of private conversations.

Why is this so easy? Is it impossible for a well-funded company to keep it's user information private? If so, can we act like it?

</comment><comment><USER81> Several friends and I had our Steam passwords stollen. Lesson I learned was not to have same password to more than one service because gmail account was hijacked too. The perpetrator stopped at changing gmail language to Polish, thank God. But, damage he/she could have done was much greater. It was before "login attempt from unknown location" messages. It was a drag to bring all back but we did it. The lesson also is: joining any online service/site we must accept the risk anything you provide could be stollen at some point and modify our usage phylosophy of these services.

<comment><USER82> 2FA when possible as well. Both Steam and Google offer this.

</comment></comment><comment><USER83> This is another reason why I don't like the "social logins". You give them so much data. They strongly encourage you to use the social login instead of using the regular email sign up.

<comment><USER84> At least your password won't be exposed in that case.

<comment><USER85> It will be, once fb/google is breached (which will happen eventually). The consequences for you will be far more unpleasant.

</comment></comment></comment><comment><USER86> I received an email from Quora informing me of the breach, but I do not have an account. I even used the "Forgot Password" function to confirm - why did I receive this email?

</comment><comment><USER87> Bruce Schneier says data is a toxic asset. He's right. There should be (will be?) laws preventing collection of most data, and punitive liability when collected data is breached.

</comment><comment> rv-de > While the passwords were encrypted (hashed with a salt that varies for each > user), it is generally a best practice not to reuse the same password across > multiple services, and we recommend that people change their passwords if > they are doing so.

According to my trusted Password Safe ([https://pwsafe.org/](https://pwsafe.org/)) I call about 400 accounts my own - each one with a unique random password.

</comment><comment><USER88> 1\. Force everyone to register to get access to content. 2\. Leak that data. 3\. ... 4\. Profit. Not sure how this part works though.

I hope lesson should be learned: don't force users to register just because you can

<comment><USER89> I see no lesson to be learned from the business perspective. If equifax can recover from their data loss, any company can.

<comment><USER90> Well equifax didn't harm any of their customers so their bounce back should be no surprise.

<comment><USER91> I'll bite. How did they not harm their users?

<comment><USER90> Equifax's customers are whoever pays them for access to data. Their customers are not the people who had their personal data exposed.

The first rule of Web 2.0 is still true: if you are not paying for the product you _are_ the product.

<comment><USER91> It costs me money (past a certain number of freebies) to access Equifax's data on me--to get a credit report.

I get that this is not their main business model, and that their customers that they bundle and sell consumer data to are more valuable. But end users, in this case, are still customers. They still pay money and get a service in return. Contrasted with e.g. Google services, it's a different scenario.

</comment></comment></comment></comment></comment></comment><comment> King-Aaron I somehow got added into the Quora ecosystem some time back, without even actually signing up from memory. Just one day I'm getting notifications that someone is talking to me on Quora.

Even though I didn't explicitly set up an account, it seemed to have done it for me already. I just assumed it was one of those shitty content aggregation platforms like the sorts that steal all the posts from Stackoverflow and rebrand them.

</comment><comment><USER92> From now on, I will assume all my user-data will be compromised, we need a new way to store the user-data, it will be a balance of convenience and security, but more importantly, it needs to be temporal, i.e. the use-data shall not be static anymore, something like a virtual and temporarily generated password for each session?

</comment><comment><USER93> It's quite obvious that Quora doesn't care a lot about user data. Just for looking at the website, you need to login with Facebook and in fact other users could at some point even see which parts of the site you browse to without informing you. Kind of sucks, luckily deleted my account half a year ago.

</comment><comment><USER94> Is it really that hard to keep a database secure?

Genuine question - not sarcasm. I would love to know how the attackers got in in the first place.

Usually when I hear about a breach, my first reaction is "yeah, I would have covered that from the start," but if there's something to be learned here, I'm all for it...

<comment><USER40> Yes it is, when you have the surface area of a company like Quora, or even a much smaller company.

I worked at Quora, and totally unrelated, at my current company, had the opportunity to source and be point on multiple penetration tests. At my current company, I work with some people I consider extremely competent at SQL, and in particular PostgreSQL, but that didn't stop the pentesters from finding SQLi in our code. It sneaks in, and all it takes is one fuck up for a hacker to go to town.

I think that most startups don't understand the value of dropping 20-30k on an engagement with a competent pentest company, and this can propagate even longer into an org to the point that they never bother to get outside testing. Don't fall into that trap. Having a third-party with eyes on your org is worth every cent. If you run a startup or aspire to, I highly recommend you consider getting a pentest when you have ~5M ARR, and continue to do a yearly engagement to make sure your shit is covered until you can afford a full time security staff.

</comment></comment><comment><USER95> What's bad about Quora website is that, whenever you see Answer notification, when you click on it, instead of a popup for quick review, the website will go to new url for the answers. That's why i don't use Quora much these days due to the stupid UX.

</comment><comment><USER96> Feels good to have left Quora and gotten confirmation that they'd wiped my account shortly after they hit mainstream. (Cannot remember exactly what happened but I think they defaulted to showing every question I visited in my public timeline or something.)

</comment><comment><USER97> The game of large numbers: so hackers obtain a million passwords. How with they decide to waste their time on any of them? In Quora's case that requires real identities and institutional affiliations will they go after the cream of the crop then?

</comment><comment><USER98> Clearly this is well orchestrated and professional. I'm wondering what could be the motivation for such an attack. There is no monetary benefit whatsoever. Perhaps some AI company wanting to acquire solid data to train their models?

<comment><USER99> Rumors are that it was a disgruntled ex-employee.

<comment><USER54> Really? Do tell

</comment></comment></comment><comment><USER100> I didn't even know I had a quora account. Never continuously registered one. Got the e-mail though. Tried to log in, had to "complete my account" before I could go on.....wtf.... I deleted my account now, tho.

<comment><USER101> I knew I had an account but it was via oauth and I had to create a "real" quora account in order to delete it. The notice that they were storing contacts from other social networks was the part that pushed me over the top towards deletion.

<comment><USER100> This must have been it. Still not sure at which point I've ever logged in to quora, but I can't think of any other explanation

</comment></comment></comment><comment><USER102> I haven't used Quora in over a year. It's been overrun with gurus.

</comment><comment><USER65> No mention of hashing algorithm for passwords, so until they provide that info, I would just assume they hashed with unsalted md5 or sha1 or even crc, and treat it as if they had stored them in plain text.

</comment><comment><USER103> The solution to data security is incorporating security at the base layer, i.e. [https://universallogin.io/](https://universallogin.io/)

</comment><comment><USER104> Is there an email notifying all users of the incident and a separate email notifying those affected, or just one?

Many companies seem to use intentionally vague wording to suggest you might not have to worry.

<comment><USER105> I too got one email and I'm not sure now if I'm affected (I got the same content as on the website in this email)

</comment></comment><comment><USER106> > Account information (e.g. name, email address, encrypted password, data > imported from linked networks when authorized by users)

Quora encrypted passwords instead of hashing them? FAIL.

</comment><comment><USER107> This is the email that they sent to users: [https://nfil.es/w/kHYd7t/](https://nfil.es/w/kHYd7t/)

</comment><comment><USER108> I think we're at a point where it's safe to assume most of our data can be collated into a frighteningly thorough profile of our lives for anyone on the internet to see.

</comment><comment><USER109> Not gonna shed a tear for the self-important people who wanted to slap their wisdom on everyone signed with their real name. It's as much a failure of quora as it is their own.

Anyone remember the glory days of facebook , when real names were "revolutionary" and all the rage? Quora followed that cargo cult (founded by facebook people, after all) and the consequences of that choice are due today. We really need to introduce the concept of "expiring data" on the internet, personal or not. After a reasonable amount of inactivity, identities shuold be anonymized.

</comment><comment><USER110> They need to release their hashing algorithm. If it is some sha1+salt nonsense, then they have exposed plaintext passwords for most of these people.

</comment><comment><USER111> [https://xkcd.com/1269/](https://xkcd.com/1269/)

Just be a nihilist, guys.

<comment><USER112> or a sage

</comment></comment><comment><USER113> I'm angry at them for this, but more angry at myself for not deleting my data years ago when I stopped logging in.

<comment><USER114> I am angry at myself for signing up for this stupid quora. Nothing but advertising of offshore "web developers" explaining how their "product" can solve the "question" they asked with their fake accounts.

I would love to punch the CTO of this company in the nose with passion.

</comment></comment><comment><USER115> "encrypted (hashed) passwords"

Was it hashed AND encrypted or another case of people not understanding the difference?

<comment><USER116> Seems like "encrypted" is in there for laymen and "hashed" being a clarification for more technical people. In the post they say: "... the passwords were encrypted (hashed with a salt that varies for each user) ..."

<comment><USER115> In that case how laymen are ever going to learn if we use incorrect words to make them feel safer?

"Ah, they were ENCRYPTED so I don't have to worry"

The thruth is they are most likely already reversed.

</comment></comment></comment><comment><USER117> Does Quora still have a real name policy?

<comment><USER38> Yes, but they also allow organization accounts now, and they're rather slow at dealing with spam so around half the people you see are using fake names.

</comment></comment><comment><USER118> This is Why I've gone over to using a proper password manager, with unique passwords for all accounts

</comment><comment><USER119> Can anyone explain how is Quora still relevant? How did they raise the $85M for their series D only last year?

To me it seems its going the way of Yahoo Answers, if it already hasn't. It might be gaining some traction in developing countries but the ratio of signal:noise seems really low at this time, coupled with terrible UI.

</comment><comment><USER120> No announcement for me, but I cannot login no matter what I try.

</comment><comment><USER121> This is one reason I dont write anonymous answers on Quora....

</comment><comment><USER122> Advertisers had their campaign data compromised, too. Yeesh.

</comment><comment><USER123> Maybe they asked how to do website security on Quora...

</comment><comment><USER124> Is anonymous question or answers also compromised?

</comment><comment> onion-soup This is why services like metamask will take over

</comment><comment><USER125> This was a nice reminder to delete my account.

</comment><comment><USER126> quora already sells your data to as many third parties as possible... i don't suspect this changes much.

</comment><comment><USER127> can they ask if their data was compromised on the question&answer site?

</comment><comment><USER128> And now they're 504ing...

</comment><comment><USER129> I'm experiencing a sense of schadenfruede because I'm embittered by Quora's arrogant "real names" policy. They won't "let me" contribute.

Nothing insightful. I'm just here to kick them while they're down.

<comment><USER130> It's not _that_ hard to be as anonymous as you like on Quora. It's been a while since I contributed, because I got tired of their schizophrenic moderation, but I don't recall that mobile text authentication was necessary. Unlike say, Twitter. And even that isn't all that hard to get around, using hosted SIMs.

<comment><USER129> It's impossible for me to be as anonymous as I like on Quora, because they require a government ID with the name I want to use. Which isn't even that weird! It's my legal last name, plus my childhood nickname for a first name.

Your name just didn't provoke their Real Name Gestapo.

<comment><USER130> Huh. Good to know, thanks.

</comment></comment></comment></comment><comment><USER131> Who is getting fired? Oh that's right, no one...

<comment><USER131> Just got my email from Quroa...Who writes this drivel:

Conclusion

It is our responsibility to make sure things like this don't happen, and we failed to meet that responsibility. We recognize that in order to maintain user trust, we need to work very hard to make sure this does not happen again. There's little hope of sharing and growing the world's knowledge if those doing so cannot feel safe and secure, and cannot trust that their information will remain private. We are continuing to work very hard to remedy the situation, and we hope over time to prove that we are worthy of your trust.

<comment><USER132> Some poor peon at the bottom of the ladder instead of the engineers/managers actually responsible for the mistake. The great thing about being at the top is being able to delegate away blame. After all, it's your job.

<comment><USER133> Much more likely some highly paid PR flack, likely with corporate counsel sitting adjacent.

</comment></comment></comment></comment><comment><USER134> Quora is an absolute shit show. It won't allow you to read content on mobile web EVEN WHEN YOU ARE SIGNED IN! To top it they disallow any screenshots of the same! Check here [https://pbs.twimg.com/media/Dc-9ldcU8AUr23v.jpg](https://pbs.twimg.com/media/Dc-9ldcU8AUr23v.jpg) [https://pbs.twimg.com/media/Dc-9ldbVAAALJfX.jpg](https://pbs.twimg.com/media/Dc-9ldbVAAALJfX.jpg)

Even though I have been a heavy quora user (reader and contributor), I would be really happy if it died a really painful and stupid death

<comment><USER135> Zhihu (Chinese offshoot of Quora) does the exact same shit on mobile as a way to force users to download their app (which pushes a ton of ads plus other frills). Looks like they got their full playbook from Quora.

</comment></comment><comment><USER136> Barely a month back in the facebook data breach thread in HN, I was downvoted and my comment removed when I said that it has become a fashion for the top 500 web/e-com companies to come one day and announce data breach and walk away. I said there that it all looks to me as part of a conspiracy theory where they hide behind a breach to sell data/ buy data en masse for marketing purposes.

<comment><USER137> I don't think large companies have much interest in _selling_ data. It's a long-term asset. The real money is in renting. E.g., Google and Facebook make a lot of money renting access to you based on the data they have. That's far more lucrative than selling the raw data once.

Also, it's implausible to me that selling the data wouldn't come out eventually. As we saw with Cambridge Analytica, even pretty obscure uses of data can eventually turn into giant media exposure for privacy breaches. The brand damage is is very expensive. Facebook's market cap is down something like $100 billion; there's no way they could have made that kind of money from trying to quietly sell copies of their data.</comment></comment>


Ask HN: Searching for an article on the evolution of the scroll feed - <AUTHOR> Hello,<p>I've done a search on google and hn.algolia.com but I'm unable to find an article I saw on here form a year back. It was talking about the team of developers at facebook that popularized the scroll feed. Does anyone have any links for write up's on the evolution of the scroll feed? <comment><USER2> How come there's no title for this question?

<comment><AUTHOR> Fixed!</comment></comment>


Ask HN: Is there other language that allows inline machine code? - <AUTHOR>

The language here(www.vttoth.com/w.htm) can do something like this:

  write := 0x8B55, 0x8BEC, 0x085E, 0x4E8B, 0x8B04, 0x0656, 0x00B8,
           0xCD40, 0x7321, 0x3102, 0x8BC0, 0x5DE5, 0x90C3

  _() :=
  {
      write(1, "Hello, World!\r\n", 15)
  }
 Is there other? <comment><USER2> I think GCC can do this, but it's certainly not part of C.

<comment><USER3> MSVC can do this as well, as can many other C compilers I think.</comment></comment>


Let's stop trivializing design work - <AUTHOR> https://medium.com/@jonasdowney/lets-stop-trivializing-design-work-c4beb48a339c#.u1qg41iqr <comment><USER2> I can pull open inkscape and make an okay logo for an application in a few hours and have it meet all the criteria listed in that article. Its an icon. You aren't moving heaven and earth, you're just pulling verts around until you make something that people can click on to launch your app. I'm going to repeat an earlier comment I made on this because I've really come to hate the design/UI/UX 'image' in the last few years.

>Design is getting so pretentious and haughty. The icon design evolution video, the article littered with artistic buzzwords, all this song and dance for a circle in a squircle over a gradient. And the Layout, Hyperloop and Boomerang symbols are arguably even more useless and confusing than before.</comment>