Sun, Oracle, Android, Google, Mozilla and JDK Copyleft FUD - <AUTHOR> http://ebb.org/bkuhn/blog/2016/01/05/jdk-in-android.html <comment><USER2> Some quotes to quickly understand what is going on.

Andreas Gal, Former CTO of Mozilla, wrote yesterday: "... a curious event got my attention: A commit appeared in the Android code base that indicates that Google is abandoning its own re-implementation of Java in favor of Oracle's original Java implementation. I'll try to explain why I think this is a huge change and will have far-reaching implications for Android and the Android ecosystem." Source: [http://andreasgal.com/2016/01/05/oracle-sinks-its-claws- into...](http://andreasgal.com/2016/01/05/oracle-sinks-its-claws-into- android/)

Bradley M. Kuhn, in charge with the task of enforcing the GPL for Linux, wrote today: "Thus, my conclusion about this situation is quite different than the pundits and link-bait news articles. I speculate that Google weighed a technical decision against its own copyleft compliance processes, and determined that Google would succeed in its compliance efforts on Android, and thus won't face compliance problems, and can therefore easily benefit technically from the better code. However, for those many downstream redistributors of Android who fail at license compliance already, the ironic outcome is that you may finally find out how friendly and reasonable Conservancy's Linux GPL enforcement truly is, once you compare it with GPL enforcement from a company like Oracle, who holds avarice, not software freedom, as its primary moral principle." Source: [http://ebb.org/bkuhn/blog/2016/01/05/jdk-in- android.html](http://ebb.org/bkuhn/blog/2016/01/05/jdk-in-android.html)

<comment><USER3> He isn't going to be able to enforce the GPL for Linux much longer as SFC needs about 1800 supporters to be able to continue their eminently reasonable copyleft compliance work.

[https://sfconservancy.org/supporter/](https://sfconservancy.org/supporter/) [https://sfconservancy.org/copyleft- compliance/principles.htm...](https://sfconservancy.org/copyleft- compliance/principles.html)

</comment></comment><comment><USER4> It's weird how uncommon the knowledge that Google lost the lawsuit is. They lost it in appeal at the Federal Circuit. There is a remaining "fair use" decision from the lower courts but Google doesn't have much hope there.

Google's current approach using Harmony's clean-room API implementation has been basically deemed illegal. Google will likely have to pay millions if not billions to Oracle for copyright infringement. And they will continue to be infringing as long as they are distributing their current Android systems.

P.S. The law of the land is now that when you create an API it is copyrighted.

<comment><USER5> > P.S. The law of the land is now that when you create an API it is > copyrighted.

I look forward to the extinction WINE and PostgreSQL, and the resurrection of the SCO corpse for another tilt at Linux vendors, he said sarcastically.

<comment><USER6> WINE is designed to be compatible with Win32. It is built to be interoperable with that existing product. They strive to be complete, and when issues are found with compatibility, they fix those issues. None of this is true of Android, which explicitly went out of its way to build an incompatible ecosystem of software and libraries using the core work of defining the Java API somewhere in the middle. When the case was first being talked about here, I did a writeup on some of this, extracting quotes from the court's decision that I think make the idea clear. I recommend reading that post.

[https://news.ycombinator.com/item?id=7723853](https://news.ycombinator.com/item?id=7723853)

<comment><USER7> But WINE _isn 't_ designed to be interoperable with Windows. I'm not even sure what that means. Outside of some special cases, it's not like you can get something useful (or even functional) by arbitrarily mixing and matching Windows and WINE components.

Instead, for the APIs it supports, WINE was designed to interoperate with Windows programs (binary and source) in same kind of way the Android Java environment interoperates with Java programs (again both binary and source) for the APIs it supports. There are some minor differences (e.g. WINE works with binary applications directly, Android requires that Java bytecode be compiled to Dex bytecode, etc.) but the overall structure is the same.

Sure, Android only supports few Java APIs and WINE supports tons of Windows APIs, but that's the distinction fair use hangs on, how does any re- implementation of a proprietary API ever get off the ground (legally anyway)?

<comment><USER8> There's a difference between "not compatible yet" and "rips out Swing and implements its own UI library."

<comment><USER9> Legally is there?

</comment></comment></comment></comment></comment></comment><comment><USER10> A bit undermined by speculation like "we should expect Oracle to..." and "despite Oracle's expected nastiness" being so central to the analysis.

If we're talking speculation, then I'm guessing the next piece of news might be an announcement that Google is buying Java and Oracle's Java team. The line of thinking goes...

\- Despite currently looking like losing a lawsuit, Google has just cosied closer to Oracle's version of Java. (Something's afoot...)

\- Despite currently looking like winning a lawsuit, and Java 8 being very well received, Oracle's rumoured to have just let its Java evangelists go, and to be less interested in Java than it used to be. (They look willing to sell...)

\- JavaOne was apparently a bit light on announcements (Could something other than just work on Java 9 be distracting them and making them put some plans on hold for a mo...)

\- Having a litigious competitor own a key piece of Android is surely a pain point for Google that gets more painful as Android keeps storming ahead. Buying it would make that pain go away.

\- Google's looking at possibly having to pay some money in the lawsuit, and will likely want to get something for it

\- Oracle's looking at an uncertain return from the lawsuit, hasn't extracted that much revenue from Java itself, and might just be happy to take some cash for someone else to be custodian of it from here on

<comment><USER11> On the other hand, a lot of companies using Java (including SIEMENS, SAP, etc) might oppose such a move from Google, and even end up buying Oracles Java team themselves.

Similar to how people expected Microsoft or Google to buy here maps, and then a bunch of car manufacturers bought it (due to wanting to have an open alternative usable in their cars, without relying on an oligopol)

</comment></comment><comment><USER12> Why is there "Mozilla" in the hn title here, but not in the article's title? (nor the article body, except for a small aside about the MPL license, in parentheses)

<comment><USER13> Its a response to earlier article [http://andreasgal.com/2016/01/05/oracle- sinks-its-claws-into...](http://andreasgal.com/2016/01/05/oracle-sinks-its- claws-into-android/) by former Mozilla CTO.

<comment><USER14> heh, Swing is part of the android api now.

<comment><USER15> Which is just one of the total lies written in that article (Swing is not and will not be part of Android API which you can easily check in commits). Sadly Andreas doesn't really understand what he was writing about :/

</comment></comment></comment></comment><comment><USER16> I find it hard to believe that the author of this post didn't know better than to refer to Andreas as a "pundit". I have my many disagreements with him personally but it's ridiculous to treat him as a tech media talking head when his opinions on the subject are clearly based on multiple years _shipping an Android-derived operating system on phones_. Not to mention Firefox for Android, which I think he had some involvement with as well. The post as a whole seems to be intended to frame disagreement with Mr. Kuhn's PoV as coming from uninformed rabble and media talking heads.

The post itself is well-written and thoughtfully argued, so it's disappointing that it's undermined by the author's choice of tone. If anyone is qualified to share their detailed thoughts on the OpenJDK/Android move, former/current officers of Mozilla are high on that list.

<comment><USER17> Andreas' post is filled with incorrect statements, such as:

> Swing will now sit on every Android phone, using up resources.

It's pretty worrying that the former Mozilla CTO seems to be so uninformed about a topic or -- worse -- decided to write an article on a topic without even spending a few minutes researching it and understanding the implications.

It doesn't reflect well on Mozilla either that they hired someone who seems to be so out of his depth on core matters to Mozilla's business.

<comment><USER18> > It doesn't reflect well on Mozilla either that they hired someone who seems > to be so out of his depth on core matters to Mozilla's business.

Andreas wasn't hired as an executive, and you could have easily confirmed this [1] before posting this comment. He started as a developer in 2008 on the JS engine. As he was basically responsible for TraceMonkey, Andreas is a large part of the reason why SpiderMonkey is one of if not the fastest JS engines around.

[1]: [https://en.wikipedia.org/wiki/Andreas_Gal](https://en.wikipedia.org/wiki/Andreas_Gal)

<comment><USER19> This topic is about a former Mozilla CTO (who allegedly worked with Android) and his inaccurate and baseless statements about the implications of Google's switch to the OpenJDK. I could accept this level of technical ignorance from a blogger or a journalist (although, a proper journalist would have researched it thoroughly), but to hear these comments coming from a CTO is baffling due to how out of touch his understanding of the situation was. I hate to use the word ignorant, but in this case he was pretty much ignorant on the entire topic which is sort of a head scratcher for someone who was once a CTO.

</comment></comment></comment></comment><comment><USER20> I'm wondering why doesn't Google ditch Java entirely and create something like XobotOS[1]. I know it wouldn't be a popular move but at least the devs will get a decent language to use (C#) and users will have a better performing OS[2]

[1]: [https://github.com/xamarin/XobotOS](https://github.com/xamarin/XobotOS) [2]: [https://blog.xamarin.com/android-in-c- sharp/](https://blog.xamarin.com/android-in-c-sharp/)

<comment><USER21> I've wondered the same. Apple did a good move with Swift. Not sure why Google doesn't invest in their own language. Would be really nice to see a full on native and new language for Android by Google.

<comment><USER22> > Not sure why Google doesn't invest in their own language.

Has no one in this branch of the thread ever heard of a little thing called Go?

You could also bring up Dart, although Google's apparent commitment (and my own interest) in that is far lower.

Work IS coming along on being able to write full Android apps entirely in other Google-originated languages. You might reasonably ask why they're not pouring dramatically more resources into accelerating that process. I don't know, but I can only speculate that the enormous scale of the existing Android ecosystem makes it risky to send the wrong signal prematurely.

If we're looking at a matter of years before full featured Android apps in pure Go is feasible, then you probably wouldn't want to talk that up TODAY. The perception would be that Java on Android is dead, and major new app development for Android would halt.

<comment><USER17> Go isn't suitable for the kind of mission critical and memory constrained apps that Android requires.

The absence of generics and exceptions makes Go a step backward compared to Java. It was also absolutely not designed for Android (its driving design goal was to compile fast).

Dart's type system is also much weaker than Java so it would be a step back as well.

Right now, Google doesn't have any in-house credible alternative language to Java.

Interestingly, Kotlin is growing on Android without Google having anything to do.

<comment><USER22> I've been working professionally with Java for 19 years. I've only worked "semi-professionally" with Go for 3 or 4 years, as a secondary language for a few niche applications at work and some personal projects at home. So I may or may not be the most qualified person in the world to represent Go here.

All that being said, the longer I work with Go, the less I really see its lack of generics as a significant shortcoming. Go simply doesn't emphasize object- orientation to the same degree as idiomatic Java. Given the choice, I'd prefer to have that tool available than not have it. However, I haven't yet personally run across a real-world scenario in which lack of generics was an actual big deal.

I am QUITE comfortable in asserting that Go's error handling exceeds that of Java's, not lags it. The "try-catch" concept is still there (as "panic- recover"), albeit discouraged in many of the cases that an experienced Java developer would want to use it. The convention of having every function return a possible error struct, and the compiler's insistence that you do something with that that returned struct, pushes Go developers into a much more disciplined mindset of approaching exception handling.

The two points above are subjective, of course. Reasonable people could argue them either way. The third response is a bit more objective. Regarding the notion that Go is " _absolutely not designed for Android_ " and its memory constraints, I must point out that neither is Java! As a matter of the Java language's syntactical suitability, the obvious observation is that Java PRE- DATES Android by more than 12 years. Considering the laws of physics and space-time, it was clearly not designed by James Gosling with Google's OS in mind. Secondly, the memory constraints of carrying a built-in garbage collection runtime also apply to Java. The only difference is a matter of maturity, and the level of resources that have gone into developing a custom Java solution for Android. There's no reason why Google couldn't do the some with Go (or almost any other language), and given Go's comparative simplicity it would probably take far less time to get there.

<comment><USER17> > the compiler's insistence that you do something with that that returned > struct,

But it doesn't. You can write `ok, _ := Foo()` and poof, the error is ignored.

Java's checked exceptions don't let you get away with this kind of sloppy programming.

<comment><USER22> Sure, you can assign returned errors to the underscore black hole and move on. However, that is still consciously and deliberately "doing something" with it.

It is glaringly obvious in a code review that you have done this. Also, although I'm not personally familiar with any Go tools similar to PMD or Sonar in the Java world... it would be fairly easy to write a static analyzer that could scan code, recognize this pattern, and report on it (along with other code smells) in an automated manner.

Nevertheless, idiomatic Go functions return an error structure, and you must do something with that error structure. There is no ambiguity as to where the error structure came from.

Contrast that with Java's model, which is much more (pardon the expression) catch-all. There is endless debate on how wide or narrow to make your try- catch blocks, when to handle an exception locally vs. throwing it back to the caller, etc.

It is very common to deal with bugs that stem from silently "swallowing" exceptions at an inappropriately low level. It is just as common to see patterns where nearly all methods throw nearly everything without a catch at all... and there's a monster try-catch block at the top level catching the base "Exception" class.

Worst of all, there are entire classes of runtime exceptions which are NOT declared as throwable in the method's signature. The compiler has no means of insisting that you do anything about those, because the compiler doesn't know which ones are possible during a given method call. Go's error handling model is safer and better thought-out in that regard.

When you think about issues stemming from Java's handling of checked vs. unchecked exception types, it makes a lot more sense why Go went in the direction it did. Also, why Go application developers are discouraged from using "panic-recover"... and why Go library developers almost always recover from panics and create error structs for passing back upstream.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> The important thing is that Java should not be allowed to be owned and trolled upon by companies. Java belongs to the community that developed it collectively, not to a single corporation that paid bucks to purchase it from Sun.

And Java IS open source. Lets not allow Oracle to monopolize and troll the API spec. If we allow that to happen, it will open a floodgates of patent trolls across the United States and the victims could be innocent startups who have just begun struggling and innovating in the market.

<comment><USER24> "Lets not allow" sounds nice, but how do you actually expect us to accomplish this? After all, Oracle does own most of the code in OpenJDK, and even the contributions must be accompanied by a signed agreement giving them joint ownership of the copyright.

<comment><USER23> > how do you actually expect us to accomplish this?

As a citizen, you can vote for legislators and senators who are of sane-mind and who understand technology enough to understand the hilarity of this situation. After all, you can read everything about them online when a candidate stands for an election, its not like some developing/third-world country where information and media are controlled.

</comment></comment></comment><comment><USER25> > Eventually, (slowly but surely) GPL enforcement will adjudicate the > widespread problem of poor Linux license compliance — one way or the other

So when is that going to happen? The Linux Foundation just stopped funding the Software Freedom Conservancy, in a concerted effort with others to kill it and any GPL enforcement.

<comment><USER3> When you, everyone else in this thread and all your friends become supporters of the Software Freedom Conservancy, then they will have enough funding to continue GPL compliance efforts. Right now they are about 50 supporters below the level needed to continue basic services (but do no compliance activities). They need a few thousand more supporters to keep up with GPL compliance activities.

[http://sfconservancy.org/supporter/](http://sfconservancy.org/supporter/)

</comment></comment><comment><USER26> Another response to the article with a somewhat different angle available here: [https://www.codenameone.com/blog/debating-brendan-eich- over-...](https://www.codenameone.com/blog/debating-brendan-eich-over-android- openjdk-move.html)

</comment><comment><USER27> So Oracle supports OpenJDK. They even hope to ditch their flavor of Java in favor of the open one. What's the fuss?

</comment><comment><USER28> This entire thing may be confusing to a lot of people, as many are already confused by what the entire Android court case was about. The confusion is not accidental. Google's very extensive PR machine has put in _a lot_ of resources to make sure people are confused (what Oracle puts into lawyers, Google puts into PR). But just to lay down a few facts:

Since 2006/7, Java has been available under two licenses: commercial and open- source. The commercial license allows free implementation of the Java APIs and has a full patent grant, but requires conformance with the Java TCK (Technology Compatibility Kit) _and_ requires payment if used in mobile devices (this was Java's main revenue stream for a long time). It is also possible to license the JDK source from Oracle under the commercial license for a fee. The same JDK is also released under the GPL. This license is completely free and unencumbered (the GPL itself prohibits any restrictions). It does not require compatibility (unless you want to call the result "Java"), and has no field of use restrictions. It also has a full (implicit) patent grant. As this article notes, OpenJDK's copyleft is not viral either (certainly not more than Linux): applications and libraries running on top of it are unaffected due to the "classpath exception". You can do _whatever you like_ with Java when you use it under the terms of its open-source license: use the implementation, use just the APIs and implement it yourself, use the whole thing or just small portion, pass the TCK, not pass the TCK, fork it or not. You are even allowed to use it to implement .NET.

Google has had both of these options for licensing Java (at least since May 2007, but that was still before Android was released). Until very recently, Google chose neither. They couldn't reach an agreement with Sun on the fee for the first license, and didn't like the second (possibly because they feared that phone manufacturers would reject a GPL runtime, classpath exception or no). Instead, they chose to argue in court that the APIs are not Oracle's to license[1].

What has changed now? Perhaps Google realized that given Android's success, phone vendors would swallow whatever license Google gives them. In any event this is a win for everyone: Google wins because they will need to spend less resources on maintaining Android, Oracle wins because Java will now be on Android, and Android and Java developers win because they'll have a better runtime and greater compatibility. This is contingent, however, on Google not forking OpenJDK too much beyond compatibility; the license does allow them to do so.

Yes, the mainline OpenJDK project is steered by the JCP (Google, Intel, Twitter, and IBM are all members) and Oracle does have veto power, but that is just the project governance. Anyone is free to fork OpenJDK, as long as they don't call the result Java (unless they fork and choose to pass the TCK). The situation is no different from other large open-source projects.

[1]: I have no opinion on whether or not Google's actions were legally justified (I do have an opinion about their ethics), but I do know that unlike Google's PR line, the ruling has little or no effect on the industry. Google's actions with Java's APIs were quite different from any other API implementation that I know of. Also, the ruling does not apply to web APIs. See discussion here: [https://news.ycombinator.com/item?id=10811011](https://news.ycombinator.com/item?id=10811011).

<comment><USER29> _Anyone is free to fork OpenJDK, as long as they don 't call the result Java (unless they fork and choose to pass the TCK). The situation is no different from other large open-source projects._

Unless I'm missing something, this is no longer the case. Oracle is arguing that they own the API and the only legal implementation is theirs (ie, Java). Just renaming is (say... "Android") is insufficient.

Forking is going to be legally on very shaky ground at least.

<comment><USER30> Oracle does own copyright on the APIs (according to the Federal Circuit), but they do provide it in OpenJDK under the GPL. That means anyone is free to fork it, _under the terms of the GPL_.

What Google did was copy the APIs, remove the copyright notice (arguing the APIs aren't copyrightable), and release the code under a different license. You can't do that under the GPL terms.

<comment><USER31> Public Knowledge, an ally of the FSF, actually recommends independent implementation (like what Google did with Java and glibc) as a method for escaping the GPL:

>If a developer does not want to be subject to the licensing terms of a library, he has a few options...Another option for a developer is to do what Google did when it created Android, and create replacement code libraries that are compatible with the existing code libraries, but which are new copyrighted works. Being "compatible" in this context means that the new libraries are called in the same way that the old libraries are--that is, using the same APIs. But the actual copyrighted code that is being called is a new work.

[https://www.publicknowledge.org/news-blog/blogs/gpl-does- not...](https://www.publicknowledge.org/news-blog/blogs/gpl-does-not-depend- copyrightability-apis)

</comment></comment></comment></comment><comment><USER32> All these complex licences (GPL2, GPL3, LGPL, Least GPL, etc) do nothing except create confusion about which license to use. I have found a simple solution that allows me to focus on my work and not on the legalese; I just use the MIT license.

<comment><USER23> > I just use the MIT license.

That's good, but there other options too that are practically similar to MIT. Most notably, the APL (Apache Public License), MPL (Mozilla Public License) and even the old BSD public license. They just differ in legal gobbledegook in their content, but essentially, you can pick and use any software under these terms and you can use/modify them in whatever manner with a peace of mind!

APL more explicitly/specifically transfers the legal rights to the user of the software through the legal wordings used. In this manner, APL is an improvement over the MIT, which in turn, is an improvement over good old BSD license. Even BSD license intended to do the same thing, but it appears that the modern law prefers every intention to be explicitly stated, rather than leaving room for assumption/derivation of that intent.

<comment><USER33> Is the Apache Public License different from the Apache License? I can't find any reference of the former and I've always seen the latter shortened to ASL or ASLv2. Apologies if this comes across as a passive aggressive correction -- I'm really curious if they're different things.

<comment><USER23> You are right, I stand corrected! APL refers more to the collection of Apache licenses by the OSI:

[http://opensource.org/licenses/apachepl.php](http://opensource.org/licenses/apachepl.php)

The particular license is just "Apache License" or ASL, in fact.

<comment><USER33> Thanks for the link. I hadn't seen that page before, nor the proper noun "Apache Public Licenses." I guess we both learned something :-)

</comment></comment></comment></comment></comment><comment><USER34> I'm not sure how common knowledge this is, but Oracle is quietly going after any company of any significant size which uses Java in their software _at all_. It's not just the embedded stuff either; simply using Java in enterprise software is enough to bring them running with their team of lawyers threatening a lawsuit. These suits are being settled at large sums without raising any external indication that this is going on. It's not the big guys or the startups that have to worry, it's the mid-sized companies that know a long, protracted lawsuit with Oracle will not end well for them.

<comment><USER35> Both Sun and Oracle have zero issues with companies that follow the Java license.

There are plenty of happy JVM vendors to choose that haven't had any problem to comply with the license:

[https://en.wikipedia.org/wiki/List_of_Java_virtual_machines](https://en.wikipedia.org/wiki/List_of_Java_virtual_machines)

Microsoft with its J++ fork and Google with Android Java have no else but themselves to blame.

But apparently Google gets a free pass while Microsoft not, because "hey it's Google and they are sooo cool".

<comment><USER24> I don't disagree with your rebuttal of GP's post, that said,

 _Google with Android Java have no else but themselves to blame._

That argument is equivalent to "well, you should just have not left your door unlocked". Just because Google could have used OpenJDK and thus avoid the lawsuit doesn't mean they should have to do so.

And Microsoft's case is completely different, as they _did_ get a license from Sun, and preceded to deliberately violate it, with the intention (as we know from the internal emails and documents) of killing Java.

<comment><USER35> Google is also killing Java with their Java 6 and a half fork, without any public roadmap how future versions are going to be supported.

This will become even worse after Java 9 and 10 get released, specially with the infrastructure API and language changes they bring in.

So if Google keeps their stubbornness, any Java library writer will be faced with support Android Java or official Java dilemma.

And hacks like RetroLamba aren't going to help anyway.

I really don't see any difference in behavior vs what Microsoft did.</comment></comment></comment></comment>


How Bad Software Leads to Bad Science - <AUTHOR> http://motherboard.vice.com/read/how-bad-software-leads-to-bad-science <comment><USER2> I'm happy that people are discussing this, but I really don't like they way the article uncritically repeats the message of the Software Sustainability Institute.

The study by the SSI, only proves that people are writing software, and that many of these people have no training in software engineering. The SSI claim this training is necessary to prevent things like the retractions of journal articles they discuss in the article. But their survey doesn't go as far as to provide evidence that there is a link between formal training in software engineering, and errors in scientific journals.

If this article was science, I would call it bad science, because the data they present is not sufficient evidence for their hypothesis.

<comment><USER3> While you are right regarding hard data an evidence, I think the core idea is

        Problems arise when that software is designed by researchers who really don't know what they're doing when it comes to coding. A single mistake in the code can lead to a result that appears innocuous enough, but is actually incorrect.

and I am actually sure that is, unfortunatley, very very much a real problem. The reasons I believe so are anecdotal, but so overwhelming I cannot ignore them. I personally prevented already a couple of false results of making it into a paper. And that is just me, in just one research group, in just one university. And that also happened by accident mostly (just staring at a guy's screen during a conversation and noticing errors all over the place, redoing an analysis for more subjects and figuring out it is completely wrong, ...). The mistakes I've seen are close to terrifying. Scripts ignoring all input but instead using a generated fixed dataset. Scripts always yielding 'good' results even if you give them white noise as input. Basically, _all_ typcial programming errors and antipatterns ever invented come together in huge god scripts which produce the results, while in the background Matlab is spitting out one warning after the other, console windows are screaming errors, and all that is just being ignored by the researcher who thinks he/she just mastered the skill of programming. Or knows he/she doesn't, but just doesn't care. As long as there are good results, you know.

Oh yes I'm getting a bit sentimental now and it's not like that _everywhere_ and not _every_ researcher writes code like that. But if even me, with over 10 years of programming experience and all my automated builds and tests and whatnot cannot reliably produce code without one mistake, how on earth are researchers for which the programming part is often just a byproduct, a necessary evil, going to do that?

<comment><USER4> If a scientist is good enough to design a proper experiment, he is good enough to design a good program. The skillset is the same.

<comment><USER3> The skilset is similar maybe, but putting it in practice is something else. In your claim you skipped the part where the scientist used his skills to _become_ good enough to design a good program. As long as that learning process didn't happen, and that takes time, he/she will not be good enough. As such I know _excellent_ scientists which are known and praised in their field and come up with inventive designs. Yet their code to do something as simple as plotting a histogram is a mess.

</comment></comment></comment></comment><comment><USER5> As a general rule, we shouldn't take seriously any computer models for which the source code is not available.

There is no valid reason why this should not already be a universal practice. If you are looking at any paper which cites the output of a custom-built computer program but omits the source code, it's probably safe to assume that the program is a mess and therefore the conclusions are not (yet) robust.

<comment><USER6> I mostly agree, though if I had to choose between the model on which the code was based or the code itself, I'd prefer the model.

While it would be great and preferable to have both, isn't the code just a language/stack/programmer(s) specific interpretation of the underlying model?

<comment><USER7> > isn't the code just a language/stack/programmer(s) specific interpretation > of the underlying model?

There's the catch -- it _should_ be, but there's no way to verify it's correct without comparing the source code against the model. (Well, I suppose if you had access to the raw data _and_ the time to rewrite the software yourself from scratch, you could do that and see if you got the same results. But who has time for that?)

<comment><USER8> I don't know who has time for that, but it's far more reliable than auditing source code. Two people using two different languages are not likely to code up the same bug, but overlooking a bug in code someone else wrote is easy. Besides, coding things up yourself is not much slower than a full audit: understanding other people's code is hard. There's a reason that many developers have an urge to throw out "legacy" code and redo it from scratch.

</comment></comment></comment></comment><comment><USER9> I am a researcher with 0 software development experience who is trying to refactor a piece of software for image analysis that a former post-doc left behind. Many individuals in our lab (including myself up until recently) write software for analysis and simulation without any understanding of basic coding best practices such as version control, unit testing, documentation, formatting for readability, or even commenting. This comes back to bite our lab in the ass frequently.

This occurs because many of our people take the code cademy course on python for example and then assume they "know how to code" when they finish; if they run into problems, they can simply consult stack overflow for anything they don't know. They therefore never learn anything about formal software development best practices unless they put in extra effort to do so, which they generally don't.

I have learned a lot trying to refactor over the last few months, and I have tried to pass on some of this knowledge to my labmates. We have actually come a long way over the last few months. We now employ version control, use style guides, and more robustly document programs. I am currently trying to sell my labmates on the merits of unit testing but we'll see how that goes :)

<comment><USER3> Things like this make me happy. Not all labs have the proper atmosphere for getting such improvements pushed through, so if you try and start succeeding that's marvellous.

</comment></comment><comment><USER10> If you're interested in improving this situation, the Software Carpentry Foundation trains scientists in modern programming practices, and also teaches scientists and programmers how to teach programming to others: [http://software-carpentry.org/](http://software-carpentry.org/)

</comment><comment><USER11> It's not only a problem of bad software, it's a problem of lack of testing, lack of proper development management (two factors of bad software, indeed), but mainly a problem of poor or lacking documentation. Not code comments, but actual documentation that allow other people to use the program. This leads to improper usage, errors that cannot be solved and are not reported and/or noticed by whoever is running the software.

Not to mention the publish-and-forget.

<comment><USER12> Absolutely. But I think that testing is still the bigger problem; a lot of scientific software is used in conjunction with other scientific software, and the interfaces themselves are also usually undefined and untested. So something as simple as IT upgrading a package to fix a bug or add a feature might break a lab's workflow in ways that are difficult to detect. It's easy to mess this kind of software up by creating code that produces incorrect results despite appearing OK by the field's dominant scoring criteria.

Also publish and forget... that's just the natural fallout of the way research is conducted and funded. I've written scientific software that I don't feel much personal obligation to maintain or update. It's challenging work which has greatly reduced payoff (to the powers that be) after it has been tallied on the scoreboard. Also, most positions in scientific labs are on a clock; not exactly an environment that fosters long-term stewardship.

I'd love to see science funding agencies spend a couple million to fund reasonably sized groups of 5-10 programmers/scientists to produce code over ~3 year funding cycles. Just to make sure that signals don't get crossed, these groups should be told not to spend a single minute of their time on publishing to journals. Dissemination is limited to short talks and training workshops. Continued funding would also focus more heavily on user surveys than third- party citations.

<comment><USER11> I agree with everything you mentioned. I have tried to establish some testing procedures in the labs I have been in the past, where even backing up data was a myth, with zero success. With the requirement to compile code in four different OSs, testing and some automated procedure was the key, but not one person came on board.

Now moving to a diagnostic setting, and working by myself, testing and documentation have been the main goals to me. And now, every single piece of third-party software has to be exhaustively validated in every aspect before being put into production mode.

"I'd love to see science funding agencies spend a couple million to fund reasonably sized groups of 5-10 programmers/scientists to produce code over ~3 year funding cycles. Just to make sure that signals don't get crossed, these groups should be told not to spend a single minute of their time on publishing to journals. Dissemination is limited to short talks and training workshops. Continued funding would also focus more heavily on user surveys than third- party citations."

On the side of software/funding, your ideas are spot on. I think it is about time to have professional and steady funding to keep software working and available. I haven't published app notes or the like in the past, most of the software I worked on were never published, but I see important applications where the code is not open source, there's no testing and no updates for years. We need to move from the on-the-clock science to some model that would allow scientific software to be properly maintained.

Maybe if we treated scientific software like we treat "regular IT", might be the key.

</comment></comment></comment><comment><USER13> That's only one part of the problem. Bad data leads to bad science just as frequently if not more frequently, a limited understanding of the effects of sample sizes on output quality for statistical procedures is another, as well as what the software is actually doing internally.

My main exposure to this has been by observing a biologist draw absolutely unsupportable conclusions from a bunch of very low quality data using some software as if it was a magic incantation. Not that that bothered supervisors or anybody else, as long as the funding kept coming everybody was absolutely happy.

The software wasn't all that bad, even though the user interface was crappy. The whole pipeline did not stand up to scrutiny, and of course _my_ sample rate of this sort of thing is too low to draw conclusions from but I really hope that was an example of how it is normally not done.

Personally I think that if you aren't using software to do something faster that you could do yourself manually then you probably shouldn't be using that software.

</comment><comment><USER14> The alternative (at least in the extreme) is bad as well --- scientists who can't program anything and are rely on pre-canned point and click analyses and programs. There isn't a button for X and so I can't do X. I pressed the Y button and so of course my Y analysis is valid. Etc.

Edit: you think this is hyperbole but I've heard the above two statements more than you might guess, coming out of the mouths of prominent scientists.

<comment><USER15> I dont think its something relegated to scientists, many people without some software experience view software as magic, and assume when it says X button does X, that it does it without error and without effort.</comment></comment>


After raising $125M at my last company, I'm bootstrapping this one - <AUTHOR> https://medium.com/swlh/after-raising-125m-at-my-last-company-i-m-bootstrapping-this-one-here-s-why-70f0d914f2fb <comment><USER2> It is tough to have these two mentalities at the same time:

> Your employees adopt your bootstrapped mentality and they, too, are careful > of where they spend your money and try to be as resourceful as they can with > limited resources

and

> Could I go and raise a few million bucks in a seed/series A round today? As > a second-time founder, yes — I've said no to several investors already and > have a strong network.

The biggest expense in almost any startup is employee salaries, so raising money almost certainly means higher salaries for employees. So you are basically saying: "I'm rich and have connections, but it is better for the business if we all are very lean". While it is true that being lean is probably better for the business, it only works if the employees buy into it. Maybe you are giving employees tons of equity and that causes them to buy in, but otherwise the whole thing seems pretty hollow.

<comment><USER3> Other than equity, there are a number of choices there. One is working conditions: you have a lot more freedom to grant people unusual working conditions if you answer to nobody. Another is compensation. Not only could you grant more equity, you can also use contractors or part-timers more freely, or otherwise mess around in ways that VCs tend to frown on.

VCs are very optimized for "go big or go home." It's nice to not have that pressure early on, for the founders _and_ the other employees.

It's interesting how different the feel is at different companies -- VC-backed vs private-equity-backed vs public. Bootstrapped is potentially a different feel, and a better match for some people.

Does it work out that way in practice? No clue. Never worked for one of these, though I've worked for VC-backed, private-backed and public.

<comment><USER4> I guess it depends on the type of company he wants to build. Does it work? Remote companies work for some, and don't for others. Not using contractors works for some, and doesn't for others. It all depends on your existing team/culture/product.

</comment></comment></comment><comment><USER5> As someone who is bootstrapping without a lot of personal capital to fuel operations, I have a hard time relating to this post.

I almost want to invent another category for bootstrapped startups that have access to large amounts of personal liquid assets.

Just think of the difference in strategic moves available to you if you have $1MM vs $10k to throw at a problem.

Having said that, I applaud his efforts to try things differently, and even agree with a lot of what is in there.

<comment><USER6> I thought bootstrapping meant only investing in your company with the company's revenue.

If you have $10MM you are self-funded, not bootstrapped (sure, an initial self funding is always necessary, but it is easy to differentiate 10k and is 10MM).

<comment><USER7> Initial money for stuff has to come from somewhere, and usually it's not the first customer.

</comment></comment></comment><comment><USER8> Can you really call a $7M personal investment "bootstrapping"? I've always associated that term with its more literal meaning, "pull yourself up by your bootstraps." Most people would happy retire on a small chunk of that.

<comment><USER9> He deigned not to mention that his bootstraps are made of solid gold.

</comment></comment><comment><USER10> After raising $125M at my last company, I'm going around talking about how I am bootstrapping this one, no doubt to raise attention and create interest and demand for the business -- it must, after all, be hot.

Whatevah.

<comment><USER11> He got to 7m in revenue before raising in his last business.

</comment></comment><comment><USER12> This article is always worth reading when bootstrapping vs taking funding comes up:

[http://www.joelonsoftware.com/articles/fog0000000056.html](http://www.joelonsoftware.com/articles/fog0000000056.html)

</comment><comment><USER13> Not exactly the most honest title, BigCommerce was bootstrapped until $7m in revenue.

In theory, everybody bootstraps until they get funding, don't they?

<comment><USER14> Bootstrapping is specifically about pursuing revenue instead of investment. So no, I think many tech companies definitely don't bootstrap until they get investor money. The common model is investor money first, revenue later.

<comment><USER15> Is it more common? Citation requested.

On the East coast, I've heard of many small businesses that self-funded (savings and/or spouse) to get started, and never took any funding. Never heard of even one incident of a small business that was invested in. Obviously it's a different world in Silicon Valley, but if we look at the nation or globe, what is more common?

<comment><USER14> Sorry if I was unclear. When I said "the common model" I was referring to the context of the previous sentence (and also this article and this site), tech startups. I agree that most normal businesses are self-funded.

</comment></comment></comment></comment><comment><USER16> He doesn't mention the amount of money he invested. If it's $5m, what does it matter if it came from investors or from him? He's just investing in his own company.

If the initial investment was $10k, then yes, it is impressive. I have an inkling that it's nowhere near that low, though.

<comment><USER17> Agreed. These "bootstraps" are looking awful sturdy...

</comment></comment><comment><USER18> I wrote something similar a while back [http://iaindooley.com/post/79031771166/using-chess-to- illust...](http://iaindooley.com/post/79031771166/using-chess-to-illustrate- when-you-should-take) but I haven't bootstrapped a company to $7 mil :) good to see the same opinion voiced by someone who has!

</comment><comment><USER19> Interesting choice of header image. I kept wondering when the author was going to talk about Soundcloud, but it never happened—turns out it's just a random photo of a startup office. (Looks like Soundcloud's old Berlin office? Not sure.)

<comment> ju-st Are offices of other startups equally "well-spaced"? Seriously, you can't cramp more people on less space or it begins to look like a Chinese sweatshop. I tried to google other startup's offices but I found only pictures of shiny conference rooms. Are they usually similar to this?

<comment><USER20> Looks like almost any other Silicon Valley office to me.

<comment><USER21> When I worked at Bigcommerce that's about the size and space we had too, so subconsciously Mitch has probably just picked a stock image that meshes with his idea of what works.

</comment></comment></comment></comment><comment><USER22> Is this just an advertisement for PeopleSpark? Or while they're busy launching, the founder decided to sit back and spend his day writing click- bait articles for HN?

Not to mention how silly it is to say he's "bootstrapping" when he's sitting on millions of dollars. In most cases you'd be an idiot to not boot strap in that case.

</comment><comment><USER23> I think the "studio" model can work, but not in the way that it's usually thought of. You can just throw ideas at the wall and see what sticks. You need at least one person who is passionate about the opportunity and is going to do whatever it takes to will that thing into life.

</comment><comment><USER24> Bigcommerce looks interesting.

I have a client that uses Woocommerce, and to be honest it has a huge support requirement, because WordPress and all the plugins updates/security problems.

Can anyone recommend any competing services to Bigcommerce which I should review?

</comment><comment><USER25> What does bootstrapping mean?

<comment><USER26> Starting a business without raising money and using your own revenue to invest in growth.

</comment></comment><comment><USER27> This is clickbait title for a submission. Mentioning any name will fix this.

</comment><comment><USER28> It seems like every time a serial entrepreneur or founder writes something about starting a business there's a surprisingly high number of people that think "How dare they fund their company with cash!"

Bootstraping is using your own personal assets to pull up your business yes?

</comment><comment><USER29> What mitchell is saying makes little sense. he is already vastly wealthy and isn't under the gun to pay rent and bills. Aside from that this is a great article for a very wealthy second time founder to read.

<comment><USER14> I think it's a great article for first-time founders as well. It is extremely fashionable right now to raise a shit-ton of money early on. Too many novices think that's basically the only way companies happen.

I agree that bootstrapping is easier for people with capital. But hopefully nobody is starting a company without at least some money in the bank. That means that everybody starting out should be asking, "Is there some way we can get to revenue with what we have?" Mentoring at events, I've seen companies get revenue literally in the first weekend of their existence, so it's not impossible even on very modest budgets.

Even if the answer is "no", I think that strongly considering it helps people build better businesses. There's a terrible tendency for people to delay contact with the market until they're "ready", but nobody is ever ready for that, not the first time.

<comment><USER30> I'd love to read either your writing or case studies of fast-to-revenue companies if you have any to share. Thank you.

<comment><USER14> Off the top of my head, I think plenty of service businesses start out this way. E.g., consulting companies, legal firms, cleaning companies, hair salons, etc. Sometimes they start accidentally: a person does a friend's tax return or a little legal work on the side from their day job. Eventually they build up enough of a reputation and a client base that they say, "Now let's make it official."

I think the same trick can be pulled off with food. A good SF example is the Creme Brulee Cart:

[http://www.thecremebruleecart.com/story/](http://www.thecremebruleecart.com/story/)

It started out with one tiny handmade cart, grew up to a food truck, and eventually added a physical store.

For startups that are service businesses, the Concierge MVP is a great example of ways to go after early revenue. For example, consider a friend's startup:

[http://amazingairfare.net/](http://amazingairfare.net/)

This is the kind of thing that at scale would require sophisticated software. But for a small number of people, you can just do it manually.

Another good concierge MVP example comes from my colleagues at Code for America:

[https://www.youtube.com/watch?v=lqTFi2U2Ebc](https://www.youtube.com/watch?v=lqTFi2U2Ebc)

They aren't getting revenue here, as it's a public service, but you can see how the manual-to-automated approach can work incredibly well.

If you're near to one, consider dropping by a Bootstrappers' Breakfast:

[http://www.bootstrappersbreakfast.com/](http://www.bootstrappersbreakfast.com/)

<comment><USER30> Thank you very much.</comment></comment></comment></comment></comment>


ECDSA Key Extraction Side Channel in Multiple Crypto Libraries - <AUTHOR> https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ <comment><USER2> This is where BearSSL discusses its deliberate design choice to implement constant-time, constant-memory-access arithmetic for its cryptography:

* [https://bearssl.org/constanttime.html](https://bearssl.org/constanttime.html)

* [https://bearssl.org/ctmul.html](https://bearssl.org/ctmul.html)

</comment><comment><USER3> Looking at libgcrypt's patch [1], it looks like the mitigation technique they're using is to blind the private key and message hash with a random number before performing point addition, and then unblinding the result of the point addition. This unfortunately requires an extra 3 point multiplication operations, so it probably isn't a good solution where performance is critical.

According to the article, the private key information is leaked through memory caches, so it looks like libgcrypt's solution just ensures that the data written to memory caches is random, rather than leaking the private key.

Also according to the article, libsecp256k1 isn't vulnerable, and they still only do 2 point multiplications [2] (compared to libgcrypt's 5 point multiplications). So it _is_ possible to mitigate this attack efficiently.

[1] [https://lists.gnupg.org/pipermail/gnupg- announce/2018q2/0004...](https://lists.gnupg.org/pipermail/gnupg- announce/2018q2/000426.html)

[2] [https://github.com/bitcoin- core/secp256k1/blob/master/src/ec...](https://github.com/bitcoin- core/secp256k1/blob/master/src/ecdsa_impl.h#L271)

</comment><comment><USER4> The constant-time operation implementation commits to libsecp256k1:

[https://github.com/bitcoin- core/secp256k1/search?utf8=%E2%9C...](https://github.com/bitcoin- core/secp256k1/search?utf8=%E2%9C%93&q=%22constant+time%22&type=Commits)

</comment><comment><USER5> Could this attack be mitigated or otherwise slowed down by using non-temporal memory loads (x86: movntdqa) when reading the private key from memory? Or using clflush to evict the cached private key data from memory after each time it's used?

The constant-time crypto in BearSSL seems like the best approach — I'm just curious if the above approaches could be used as a quick fix for the affected codebases until they can be fixed properly.

</comment><comment><USER6> Was just deciding whether to order smartcards with 4096 RSA or NIST ECC curve support. Whilst not directly related to this, I feel RSA has been examined more closely than ECC given it's long history now of use. Not sure I fully trust the NIST curves, or have faith that ECC implementations have been thoroughly tested.

<comment><USER7> I don't think this is a particularly productive way to look at things. RSA has been used for a long time, but the vulnerabilities we find in RSA implementations (for instance, the recent Yubikey RSA keygen flaw) tend to be traceable to things we knew a decade, or sometimes two decades, ago. There's very little general evidence of maturity in crypto development, so that you'd assume that a vendor would learn from industry experience in building something. You just have to sort of guess which constructions they'd have an easier time coding safely.</comment></comment>


Turn WiFi and Bluetooth signals into app actions - <AUTHOR> http://www.newaer.com/developers NewAer wants to make the Siri reminders & GPS location based triggers obsolete with a software SDK to use radios in smartphones as app triggers. They just launched their new Android and iOS SDK for the Techcrunch Disrupt hackathon, and have a pretty funny example video posted.  Nick's life is pretty sweet! LOL. <comment><USER2> Is this a joke? I remember this kind of application has been available for android since the G1, in fact when Google hosted some app contest to have some apps available on the launch of android one of the winners was that kind. That was 2008: <https://developers.google.com/android/adc/adc_gallery/>

</comment><comment><USER3> I developed a similar app for a psychology research team. They needed a way to trigger certain things (sound recording, etc) when two certain people were in physical proximity. As it turns out, bluetooth bonjour discovery did the trick when they were in the same room. Over wifi, it got triggered sooner, once one of them enterred the building where the other one was (which corresponded to being on the same LAN).

The hard problem on iOS devices (iPod touch) was keeping them awake during this, so they could detect eac other. iOS likes to sleep while locked. Got a solution, which made the battery last around a day. I guess they're not using mobile to mobile peer triggers, but fixed-to-mobile and then deliver a notification. Interesting to see this popping up in commercial tech.

I was going to spin my code out into a infrastructure for spatial awareness triggers for various home automation tasks, but also couldn't find a killer use case. I'll be following this topic for ideas :)

</comment><comment><USER4> I use Android's tasker to put my phone on vibrate when my work WiFi is detected, it's pretty convenient.

Putting features like that into other apps would be fantastic.

<comment><USER5> You can also do this using NFC. Not sure if this is possible with Tasker, but (for example) you could have a car dock with a passive NFC tag (very cheap) on it that would change the phone to automatically read your text messages out loud and prompt you to respond with voice input.

<comment><USER6> I use NFC Task Launcher to do exactly this.

Link: [https://play.google.com/store/apps/details?id=com.jwsoft.nfc...](https://play.google.com/store/apps/details?id=com.jwsoft.nfcactionlauncher&hl=en)

</comment></comment></comment><comment><USER7> iOs has a featured called region monitoring that is similar.

I use it in my app OnSite Time Tracker.

[https://itunes.apple.com/us/app/onsite-time- tracker/id470803...](https://itunes.apple.com/us/app/onsite-time- tracker/id470803110?mt=8)

<comment><USER8> How's that working out for you?

I've written a similar (open-source) app called Remindly (<https://github.com/nathanstitt/remindly>) that uses region monitoring to fire alarms.

I've found it's region monitoring accuracy to be horrid - either the alarms fire when I haven't moved, don't fire at all, or fire an hour later when I'm 20 miles outside the region.

Since I have the same issues with the built-in Reminders app, I suspect it's something specific to my geographical area, or the api is just rubbish.

<comment><USER7> In ios 4 it was accuracy was miles. As of ios 5, it's usually accurate to within a block. but it's not accurate in desolate areas (due to lack of wifi signals).

<comment><AUTHOR> Significant location change is clumsy to say the least. If you ask Siri to "remind you to get milk when you leave the house" you can see she sends messages at all different ranges of your leaving. Our engine monitors BTLE for disconnected, or WiFi zones for connected on iOS. Plus we provide background operation in iOS. Let us know what you think of the SDK in your application.

</comment></comment></comment></comment><comment><USER9> I'm curious how this works on iOS in the background? I admittedly don't know that much about it, but my understanding was that apps basically couldn't run code that constantly monitored things like this in the background on iOS.

<comment><USER3> I solved this by using the "Insomniac" approach - if you play a silent sound every 30 seconds or so, the scheduler will reset the sleep timer and the app will keep working. It drains the battery in around 1 day though.

<comment><AUTHOR> Love the idea of the silent sound. Alas, that and the IP backgrounding is a bit clumsy. We pass through Apple's store guidelines without powering up the GPS.

</comment></comment></comment><comment><USER10> <https://www.gimbal.com/>

<comment><USER11> So? Please add something to the discussion rather than just pasting a link to a competitor. What does Gimbal do that's different/better/etc.? Genuinely curious.

<comment><AUTHOR> Agreed. I've seen several demos of Gimbal and I fail to see how GPS and Google Goggles differs from this. GigaOm has a video demo: [http://gigaom.com/2013/01/11/video-qualcomms-project- gimbal-...](http://gigaom.com/2013/01/11/video-qualcomms-project-gimbal-gives- your-phone-contextual-smarts/)

</comment></comment></comment><comment><USER12> And does it work for iPhone too? non-rooted? We did such stuff as SpotEx: <http://spotex.linkstore.ru> But Wi-Fi scan on iPhone was a problem.

</comment><comment><USER13> what's the killer use case for this api?

<comment><AUTHOR> Isn't this for you to answer? NewAer builds "showcase apps" but the SDK is for all to build on. Our favorite is a menu on a tablet that knows what you ordered last time you visited the restaurant and suggests something new the 2nd visit. All with your phone in your purse or pocket. No check ins, QR codes, tapping NFC or logging in. That's the vision of the SDK.</comment></comment>


Faust: Functional programming language for real-time DSP and synthesis - <AUTHOR> http://faust.grame.fr/about/ <comment><USER2> To repeat my previous comment:

I've used Faust for a few months two years ago and I plan to use it again to write audio DSP apps. It's very powerful and expressive, and targeting many different systems/platforms is no problem. I have used generated C code on bare-metal ARM Cortex M4F platform, which is some distance away of original scope of Faust project. It was fairly easy to do. The documentation is also well written and comprehensive, it gives you very nice introduction into functional languages, time-domain DSP, as well as explanation of some common applications (pitch detector, panner...).

Two downsides I noticed (maybe they are fixed in the mean time?) are error messages and block composition. Because of the way Faust compiler works, error messages are long and not very meaningful. Some expressions are merged and simplified before error is triggered, so it's difficult correlate the expression in error output with your source code.

The other problem is that once you have the basic blocks and want to merge them into complex system, the syntax suddenly gets in your way. You have to introduce dummy wires in some blocks just to pass-through signal to its destination. The compiler can output graphical representation of code, but it would sometimes be much easier to use visual tool like the Simulink or LabView. Perhaps this is just tooling issue, but I found language syntax to be confusing and not scaling up properly.

<comment><AUTHOR> I missed the previous HN discussion of FAUST, but your comment led me to dig it up; it's good: [https://news.ycombinator.com/item?id=13012880](https://news.ycombinator.com/item?id=13012880)

Has some good links to relevant textbooks and MOOCs on the topic.

</comment></comment><comment><AUTHOR> I stumbled on FAUST while reading up on how to make VST plugins. It's incredibly concise for building signal processors and synths, as it removes nearly all of the tedious stuff; you just write functions to generate or act on a signal and plug them together in sequence or in parallel and it'll spit out a plugin to do the job. No boilerplate, no fiddling with the (very fiddly) VST SDK, etc. A C/C++ program is usually an order of magnitude longer than what a FAUST program would need to be.

<comment><USER3> > A C/C++ program is usually an order of magnitude longer than what a FAUST > program would need to be.

That's true for all functional/scripting languages vs imperative languages.

There is a study that was done years ago which came to the same conclusion as you did - "An Empirical Comparison of C, C++, Java, Perl, Python, Rexx, and Tcl".

<comment><AUTHOR> FAUST leads to shorter programs for a few reasons, one of them is certainly its pure functional nature.

The other reasons I think FAUST programs are shockingly short:

\- It's a DSL for signal processing that overloads single character identifiers with commonly used signal processing functions (+ sums multiple signals, < splits into two signals, etc.). And, of course, it has a very powerful standard library of signal processing related functions.

\- The boilerplate for getting signals in and out are handled by the language/compiler, rather than the programmer. You don't need to setup a ring buffer to receive an input/output signal or whatever...FAUST does it automagically. Even with very helpful libraries, such as JUCE, you're still doing a lot of the same tasks for every new signal processing program.

One could do these other two things in another language, even some imperative ones, I think. But, this is among the most concise tools for writing signal processing code I've seen. I only found it yesterday, so have only started reading the docs (and there's some math concepts I need to review before I can make sense out of some of the more advanced examples), but I was really struck by what a cool combination of pragmatism and purity FAUST is. It spits out the ugly stuff, so you can still readily use it in real world programs that are used by non-programmers.

It's also got a real-time experimental environment, so you can tweak your program in semi-realtime and immediately hear and see results. And, by "see" results, I mean it has a diagramming tool that spits out a block diagram of your function(s). I'm amazed it took me this long to find FAUST, as I've been reading up on this kind of programming for a couple of weeks, and it seems pretty clear it's the best thing going.

</comment></comment></comment><comment><USER4> Much of Julius O. Smith III's work is done in Faust, if you're interested in seeing how Faust is used in research: [https://scholar.google.com/citations?hl=en&user=Dx1EblMAAAAJ](https://scholar.google.com/citations?hl=en&user=Dx1EblMAAAAJ)

</comment><comment><USER5> I've been using csound as the audio engine for my Android apps but I'm looking at Faust for my new one because csound has a fairly limiting library in terms of where and how events need to be attached. With Faust I can place it in my own jni library and import and call the dsp method even if it's from deep within a nested custom view.

<comment><USER6> Have you considered libpd, the embeddable version of Puredata?</comment></comment>


Biggest problems facing science, according to 270 scientists (2016) - <AUTHOR> https://www.vox.com/2016/7/14/12016710/science-challeges-research-funding-peer-review-process?linkId=27003407 <comment><USER2> This is a very good article...but I feel the title -- although as original as it is on the original web page -- is a bit misleading...

When I first read the title, I thought it was about certain big specific research problems in certain specific disciplines (or multidisciplinary ones at best ); after I read several beginning paragraphs and the subsection titles, I realized it was more about the conflict between the survivals of researchers, especially those less established and more vulnerable ones -- as individuals in the academic world that is becoming increasingly bureaucratic each day -- and the survivals of our genuine pursuits after truth and knowledge, or less grandiosely, mere personal curiosities, which would make the life of each of us ultimately meaningful...

I think the problems presented in the article are quite real (according to my personal experience)...and just for a tl;dr, let me list those problems below,

      "Is the point of research to make other
       professional academics happy, or is it
       to learn more about the world?
         -- Noah Grand
            former lecturer in sociology, UCLA"

      1. Academia has a huge money problem
      2. Too many studies are poorly designed. Blame bad incentives
      3. Replicating results is crucial. But scientists rarely do it.
      4. Peer review is broken.
      5. Too much science is locked behind paywalls.
      6. Science is poorly communicated to the public.
      7. Life as a young academic is incredibly stressful.</comment>


The #Bitcoin pizza is worth $141,685,600 today - <AUTHOR> https://twitter.com/bitcoin_pizza/status/938607525523611648 <comment><USER2> Um. Way more now.</comment>


Amazing Stat: California Uses More Gas than China - <AUTHOR> http://blog.wired.com/wiredscience/2008/07/amazing-stat-ca.html <comment><USER2> There is already a thread on this stat here:

<http://news.ycombinator.com/item?id=249867></comment>


Save money by automatically putting your non-critical apps to sleep on Heroku - <AUTHOR> https://elements.heroku.com/addons/dynotower-start-stop <comment><USER2> Is this made by Heroku? Is it a community app? What is this?

<comment><USER3> Looks like one of the addons that can be used with Heroku accounts.</comment></comment>


On the Spline: A Brief History of the Computational Curve - <AUTHOR> http://www.alatown.com/spline-history-architecture/ <comment><USER2> Folks interested in splines should check out Raph Levien's Ph.D thesis, [http://www.levien.com/phd/phd.html](http://www.levien.com/phd/phd.html)

He made splines out of piecewise "spiro" curves (aka clothoids, Cornu spirals or Euler spirals), for which curvature changes linearly with arclength. This makes much smoother-looking curves than naive use of e.g. Bézier-curve segments, which he found made it much easier to trace or create nice looking letter glyphs for font design.

</comment><comment><USER3> There's a nice generalisation of splines to higher-dimensional spaces, in a non-ad-hoc way:

For the case of fitting a 2D surface to interpolate some control points {(x_i, y_i)}_i, x_i \in R^2, y_i in R, we can seek to find a surface f : R^2 --> R that attains the minimum

        min_f sum_i ( f(x_i) - y_i )^2 + \lambda || D f ||^2

where \lambda > 0 is some real constant parameter.

I.e., we seek to find a surface f that trades-off goodness of fit to the control points (in the least-squares sense) against smoothness (measured by the norm of the derivative).

In the 2D case these are called "thin-plate splines". They can be viewed as nice energy-mininising surfaces that interpolate between a few control points. The functions f live in Sobolev spaces - analysis of this stuff descends into a lot of PDE theory and approximation theory if you want to compute approximations to them in practice.

To get non-singular surfaces in higher dimensions than 2 you merely have to increase which derivative appears in the smoothing term, but the same idea basically works. (You also need to ensure you have enough control points to define the surface -- note that if your smoothing term is || D^k f ||^2 then a degree k-1 polynomial is invisible to it -- so the smoothing term does not control a degree k-1 polynomial component, so you have to ensure you have appropriate control points to define that part)

If you are curious to read more about this, there's Grace Wahba's book "spline models for observational data". e.g. [http://bookstore.siam.org/CB59/](http://bookstore.siam.org/CB59/)

</comment><comment><USER4> Clothoids are used for many railroad curve transitions, because they are constant-jerk curves. (Jerk is the derivative of acceleration.) They can provide a smoother look than B-splines, but are not as general.</comment>


Hashtag Propaganda. Secret UK govt tactics for post-terror planning - <AUTHOR> https://www.middleeasteye.net/news/mind-control-secret-british-government-blueprints-shaping-post-terror-planning <comment><USER2> The third sentence of the article makes the claim of the title without the scary headline.

"In operations that contingency planners term "controlled spontaneity", politicians' statements, vigils and inter-faith events are also negotiated and planned in readiness for any terrorist attack."

So that's the story, the govt. has prepared some statements, vigils and inter faith events in the case of a terrorist attack.

Read this way, and compared against the alternative of not making such plans, it's not such shock.

<comment><USER3> No, it is not that. The government hasn't prepared some statements in their own name. They prepared coordinated plans for astroturfing, simulating organic, grassroots response, with fake actors and accounts. The whole "War of the worlds" scenario, government-operated.

<comment><USER4> "Crisis actors" \- for real, this time around!

<comment> java-man _this_ time?

</comment></comment></comment></comment><comment><USER3> I feel that the UK and Commonwealth states are the worst offenders in digital privacy violations and "inauthentic behavior" programs. "Porn law", known information operations campaigns, and now this... It's one thing when Russia or China do this, and another when a supposedly free and democratic state does.

Now all dictatorships in the world, when confronted about their own propaganda and manipulation campaigns, will shrug it with "UK does that, so what?"

(Update: the article is a little low on sources and confirmations, so I would fact check the information there before leaping to any conclusions).

<comment> toby- >when a supposedly free and democratic state does

Create social media campaigns to promote social cohesion? I'm, er, actually okay with this?

The article says "politicians' statements, vigils and inter-faith events are also negotiated and planned in readiness for any terrorist attack". Nothing about that strikes me as particularly harmful; a government promoting social cohesion during times of turmoil is standard fare. What's upsetting about that?

<comment><USER3> With fake accounts, bot networks and hashtag stuffing?

Welcome to Russia.

<comment> toby- Where in this article does it allege "fake accounts" or "bot networks" are employed?

This article is from a dubious source, and is rather light on sources. Nowhere is it alleged the UK government is abusively creative accounts on social media.

<comment><USER3> "pre-planning social media campaigns that are designed to appear to be a spontaneous public response"

Can this be interpreted in any other way?

<comment> toby- Yes...? I'm amazed if you drew from that single sentence that the UK is creating fake accounts on social media and using bot networks. There's 'filling in the gaps', but that leap you've managed to make is egregious.

The third sentence further explains the false spontaneity: "In operations that contingency planners term 'controlled spontaneity', politicians' statements, vigils and inter-faith events are also negotiated and planned in readiness for any terrorist attack."

Basically: the UK government coordinates social media campaigns to promote social cohesion in the wake of terror attacks, and additionally coordinates with community leaders and politicians. That's all you can draw from the article, unless you have additional information or sources to the contrary.

<comment><USER3> These are not "spontaneous public response". Hiring people to distribute flowers to look like spontaneous bystanders is. Marching with fake posters with fake hashtags to look like spontaneous gatherings is, these are already fake personas. If you add "on social media", you can infer all the rest.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I find the UK gov unbelievably sneaky. The NSA, China and Russia get most of the publicity, meanwhile the UK spies are very hard at work out of sight behind a facade of PR.

<comment> toby- A very good point generally, but not particularly relevant here. All this article is alleging is that the UK government coordinates social media campaigns with politicians and community leaders to promote social cohesion in the wake of terrorist atrocities. They're, somehow, attempting to portray this in a negative light.

I can't help but note the complete lack of sources in the article, and we have to question[1] the source itself.

[1] [https://en.wikipedia.org/wiki/Middle_East_Eye#Links_to_Hamas...](https://en.wikipedia.org/wiki/Middle_East_Eye#Links_to_Hamas,_Muslim_Brotherhood_and_Qatar)

<comment><USER6> The whole attitude is what allowed grooming and rape gangs to go on interfered with for so long though.

</comment></comment></comment><comment><USER7> This is all very interesting, and I can quite believe it... but it's an article seemingly without much - if any? - exposition of sources or evidence?

\- ed

in fact, I've never come across this 'Middle East Eye' and when I go to find out more about them, it's surprisingly sparse on information? [https://www.middleeasteye.net/about-middle-east- eye](https://www.middleeasteye.net/about-middle-east-eye)

As I was once taught, many many years ago - of any article, always ask: "Why are these bastards lying to us?"

<comment><AUTHOR> I also looked on Wikipedia before submitting this and it didn't scream fake news site. There was also a fair few articles submitted here from that site before.

As for the sources, reading between the lines and based on some experience it feels like it is based on presentations by the marketing companies at an emergency planning conference. So not exactly secret but not for public eyes.

</comment></comment><comment><USER8> Were this to occur in an authoritarian state people would harp on about a brainwashed population.

Get the suspicion no one feels as strongly when it happens in the UK despite being the exact same ballgame.

</comment><comment><USER9> This is a dangerous article. It seems to be engineered to produce a knee-jerk anti-government reaction, as can be seen in this comment section. The article does not seem to provide any sources for any of its claims. Furthermore, I have never heard of middleeasteye.net before and it would be safe to be skeptical of any claims posted by them.

Even if the allegations are true, is it such a bad thing after all? Terrorist attacks leave people vulnerable and afraid. Those feelings can easily turn into violence against those who are perceived to be the "cause" of the attack. Taking preemptive, albeit underhanded action to ensure mass violence does not occur seems like a good thing to me.

<comment><USER10> I could see two sides to it. On the one hand, if you're in a position of trying to reduce harm in the society, it makes sense. On the other hand... it is a direct betrayal of the most foundational principles of democracy itself. It is a reversion to pre-democratic principles where the general public are seen as a teeming mass of resources to be manipulated by their betters for goals chosen by those betters, and where influence and participation of the public is to be prevented. Where do you stop once you have decided that the general public generally has bad ideas and shouldn't play a role in their own governance? We did persist, as a species, for thousands of years with governments based upon the notion that those in the government were inherently superior, chosen by a god, from special bloodlines, etc, and I don't see any reason we couldn't get back there. But for the past couple hundred years, we've been trying out this democratic bent where we don't believe there are any specially anointed people destined by mystic forces to be leaders. And actively manipulating the public opens doors to lots of dangerous practices that were previously barred solely upon the principle that it would prevent public participation. Why not suspend elections if it looks like your party will lose power if you earnestly and honestly believe that the other parties won't continue the efforts you started to 'protect the public from themselves'? You can no longer form an argument against it.

</comment></comment><comment><USER11> It's not just the UK. The US, China, Russia, EU, New Zealand, Australia, Saudi Arabia, Israel, etc.

The first thing you see after a terrorism incident is a controlled government+media propaganda campaign. They all use the same mindless talking points.

The second thing the government+media does is advocate for stealing your rights and more surveillance.

Someone does something bad, everyone else gets punished. It's true of "free" societies or authoritarian societies. Same tactics. Same terminologies. It's for our benefit and it's to keep us safe. Big brother loves us after all and knows best.

<comment><USER12> > Someone does something bad, everyone else gets punished ... It's true of > "free" societies or authoritarian societies. Same tactics. Same > terminologies.

I'm not so sure the reasons are the same in each case. A totalitarian regime obviously would love the opportunity to limit rights because it gives them more control over the populace.

But free societies often do so (in my opinion) because of the politician's fallacy[1]. There's a public outcry to "do something" so the politicians scramble to "do something". Like scramble to ban bump stocks after the Vegas domestic terrorist event even though a bump stock ban would have a near negligible effect on future domestic terrorist attacks.

Then again, it's hard to tell if the public outcry is because of the media intentionally stirring the pot, and if so, it's hard to tell if the media is intentionally stirring the pot because of some hidden political agenda or if they are just optimizing for clicks/eyeballs.

[1] [https://en.wikipedia.org/wiki/Politician%27s_syllogism](https://en.wikipedia.org/wiki/Politician%27s_syllogism)

</comment></comment><comment><USER13> This reminds me of the time I accidentally participated in a genuinely spontaneous reaction to a bomb attack against civilians by insurgents (or whatever the neutral term should be: somebody's "freedom fighters", I expect).

About an hour after the attack, a huge crowd of people had sat down blocking the streets in the European city, chanting slogans. I was near a group of teenagers, mostly, fairly photogenic, I suppose, so a television crew turned up to film them. When one of the journalists started trying to direct the young people, telling them where they should sit and what they should chant, there was an interesting reaction: they got very angry with the television crew and refused to cooperate, basically shouting at the television crew until it went way.

Unfortunately I only had a basic knowledge of the local language and could only get a rough idea of what was being said.

In view of all that, perhaps I should approve of the UK government's plans: they are directing how naive people react to the violence while at the same time giving less naive people an opportunity to learn about manipulation. Everyone benefits!

<comment><AUTHOR> Europeans generally have less trust in the media when encountering them in the street than Brits or Americans.

They are often seen directly as tools of the state or partisan at best or where footage will be used against them. During riots in European cities the TV crews often get attacked and have to stay behind police lines.

</comment></comment><comment><USER14> No one wants an ongoing debate about any difficult issues that the government has already determined the answers to. That would be messy and perhaps force them to change their plans.

The exposure of this also makes more plausible the claims that many "spontaneous" street demonstrations that turn violent are carefully planned using similar elements, though perhaps not by the government.

</comment><comment><USER15> Yeah, flagged, since we can only discuss the social media manipultion if the bad guys do it.

<comment><USER16> This isn't social media manipulation, its downright social engineering directly from the state. If it were a branch of the military or intelligence - performing something like this in a foreign country, it would have been labelled as a PSYOP.

</comment></comment><comment><USER17> Is this article seriously arguing that governments trying to prevent a terrorist attack from sparking rioting and tit-for-tat revenge attacks is a _bad_ thing?

<comment><USER16> Its a bad thing when it is this dishonest. They aren't actively fighting terrorists, or deradicalizing anyone. They are just obscuring truth and seeding public opinion under false premises.

Do you honestly think that staging "muslims handing out roses" and paying imams to say one thing in public, while they continue to say something else entirely in the mosques, will help anyone?

With all the recent years of attacks in Europe, I would say that a little bit of outrage over terrorism would be more healthier than the current response with facebook filters and staged "organic" protests.

<comment><USER17> Take a look at countries in Africa and Asia. Anger turns into rioting, revenge attacks and all out civil war. Preventing this by encouraging harmony is a good thing.

<comment><USER16> Except it doesn't encourage harmony. I would say it has the opposite effect for people intelligent enough to see through the bullshittery. In the long run it just harms the relationship between state and citizens. The special treatment that radical islamism gets in Europe is no less than bizarre. You get media appraisal in the UK for throwing milkshakes at center-right politicians and ousted by the same media for saying that Europe has an islamism problem.

<comment><USER17> I think we have very different definitions of the term "center-right".

</comment></comment></comment></comment></comment><comment><USER18> Steering the public to be upset, rather than rioting and beating people up, seems sensible.

</comment><comment><USER19> They want to continue mass publicizing the attacks, allowing them to continue their often hostile foreign policy, while minimizing the anger locals feel that could cause domestic issues. Not much of s surprise.

</comment><comment><USER20> David Cameron's Tory government is the undoing of freedom

<comment><USER21> Sadly these freedoms were under attack even during Labour's time in power. They also want more restrictions and windfall taxes on tech firms then we do already. GCHQs Mastering the internet program started under Labour.

I'm not saying that the Tories are angels in all this, far fucking from it (Their current porn law is more fucking stupid than the last). But Labour laid the ground work and the Tories fucking ran with it. Labour's stance on Article 11 and 13(renamed 17) was to pass them. In my area only one MEP from the "mainstream" parties voted against Article 11, 13/17 and he is conservative, the others who voted against in my area were independent and UKIP. Not a single Labour MEP in my area voted against them.

IMO They are both as bad as each other.

<comment><USER20> Tory cuts have massively increased poverty and is currently causing a spike in prostitution due to delayed benefits payments. knife crime is at all-time high due to theresa may's cuts to police force</comment></comment></comment>